From 83bb2ea723641b9783e02c6c6a350f67bc5e399a Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 18:46:43 +0000 Subject: [PATCH 1/2] docs: correct the dangling truth-gate reference in MERGE_POLICY The demotion-rule section cited `.github/workflows/agent-completion-enforcement.yml` in the present tense as a file that "documents" its own failure mode. The preceding commit deletes that file, so the reference dangled. Recast in past tense and record that both workflows were removed as unsatisfiable. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WAtfaTNtsPS6wzzo865nd3 --- MERGE_POLICY.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/MERGE_POLICY.md b/MERGE_POLICY.md index 561ea289a..b5bb2ab39 100644 --- a/MERGE_POLICY.md +++ b/MERGE_POLICY.md @@ -161,8 +161,10 @@ was written to remove. A check red on everything has zero signal and actively hides real failures. `agent-completion/truth-gate` was red on ~100% of pull requests for weeks, including merged ones, and nobody noticed because everyone had learned to -ignore it. `.github/workflows/agent-completion-enforcement.yml` even documents -this failure mode in its own comments while its sibling did exactly that. +ignore it. `.github/workflows/agent-completion-enforcement.yml` even documented +this failure mode in its own comments while its sibling did exactly that. Both +have since been removed as unsatisfiable; the rule above is what should have +caught them first. Demotion is not forgiveness. It is refusing to let a broken gate keep laundering itself as enforcement. From 614edeeff115e69db976531441f60f01ae4f311a Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 18:51:15 +0000 Subject: [PATCH 2/2] docs: reconcile stale truth-gate guidance in dated reports and the agent SOP CodeRabbit's full review on #1434 found two dated remediation reports still giving present-tense operational instructions about machinery this branch deletes. A sweep for the same defect found a third the review missed. docs/runbook/pr-remediation-report-2026-08-04.md Historical banner; recommendation 3 ("restore the publishing App or drop the gate") recast as resolved-by-removal. There was no trust path to restore: all three allowlists were empty by construction. docs/pr-remediation/2026-07-31-run.md Historical banner; the "provide a provenance disposition" next-command and the infrastructure note recast to past tense. invalid_payload was a symptom, not the disease -- the arming condition was mandatory under another gate. .jules/agent_orchestration_sop.md Not flagged by the review. Line 65 listed "the truth gate reports the real remaining blockers" as a live verification gate an agent must satisfy before advancing a PR. Repointed at PR Governance / Canonical issue and evidence. Observations in the dated reports are left intact -- they are an accurate record of the queue on their run dates. Only the imperatives changed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WAtfaTNtsPS6wzzo865nd3 --- .jules/agent_orchestration_sop.md | 4 ++- docs/pr-remediation/2026-07-31-run.md | 25 +++++++++++++------ .../pr-remediation-report-2026-08-04.md | 20 ++++++++++++--- 3 files changed, 37 insertions(+), 12 deletions(-) diff --git a/.jules/agent_orchestration_sop.md b/.jules/agent_orchestration_sop.md index d2bb64574..e87e66f0e 100644 --- a/.jules/agent_orchestration_sop.md +++ b/.jules/agent_orchestration_sop.md @@ -62,7 +62,9 @@ Before a PR advances: - all current review findings are fixed and resolved with evidence; - a current-head independent review exists; - deployment evidence is bound to the same head, or deployment is explicitly non-applicable; -- the truth gate reports the real remaining blockers; +- `PR Governance` / `Canonical issue and evidence` report the real remaining blockers + (this bullet named `agent-completion/truth-gate` until #1434 retired it — the gate + was red on ~100% of pull requests, so it never reported real blockers); - the focused issue and #898 are updated with exact evidence. Vercel proves the Next.js application build and runtime only. It does not prove Python, Cloud Run, Cloud SQL, worker, webhook, or credential behavior unless those paths are explicitly exercised. diff --git a/docs/pr-remediation/2026-07-31-run.md b/docs/pr-remediation/2026-07-31-run.md index d9b5d5a72..240fdab78 100644 --- a/docs/pr-remediation/2026-07-31-run.md +++ b/docs/pr-remediation/2026-07-31-run.md @@ -5,6 +5,12 @@ Automated execution of the PR Remediation & Publish Runbook against merge available). Oldest-first scan of all open PRs, each driven to a terminal state per the runbook's Definition of Done (`MERGED` / `DEFERRED` / `HALTED`). +> **Historical as of 2026-07-31. Superseded in part — do not action the truth-gate +> items below.** `agent-completion/truth-gate` was retired in #1434 (closing #1432). +> It is no longer possible to "provide a provenance disposition" or "relax the gate +> for legacy PRs", because the gate no longer reports at all. The queue observations +> below remain accurate for the run date; the remedies referencing the gate do not. + ## Headline finding **No open PR has an autonomous merge path.** All 30 open PRs are drafts. Every @@ -73,8 +79,9 @@ confirmed across the directly-inspected sample (734, 810, 831, 869, 903, 906, The blocking gate is human by design. To advance any substantive PR a maintainer must: -1. Provide the truth-gate's *historical provenance disposition* (or relax the gate - for legacy PRs predating their focused issues). +1. ~~Provide the truth-gate's *historical provenance disposition* (or relax the gate + for legacy PRs predating their focused issues).~~ **No longer applicable** — the + gate was retired in #1434; there is nothing left to disposition. 2. Mark the PR ready for review and complete final human review. 3. Merge to protected `main` per branch policy. @@ -87,12 +94,16 @@ mark-ready + merge**, e.g.: # Same shape: 999, 1000, 1002, 1003, 1004, 1005, 1006, 1007, 1008 ``` -## Infrastructure note for maintainers +## Infrastructure note for maintainers — resolved + +The `agent-completion/truth-gate` workflow was erroring with `invalid_payload` on +several PRs (#995, #1038, #1040, #1047, #1049) — the gate was faulting rather than +evaluating its rules, and it blocked the merge status of otherwise-green PRs. -The `agent-completion/truth-gate` workflow is erroring with `invalid_payload` on -several PRs (#995, #1038, #1040, #1047, #1049) — the gate is faulting rather than -evaluating its rules. Worth a look independent of any single PR, since it blocks -the merge status of otherwise-green PRs. +*Resolved in #1434 by retiring the gate.* The `invalid_payload` fault was a symptom +rather than the disease: the underlying arming condition was mandatory under another +required check, so no repair to the payload builder could make the gate satisfiable. +It was red on ~100% of pull requests — including merged ones — across 1,182 runs. ## Runbook parameters (as run) diff --git a/docs/runbook/pr-remediation-report-2026-08-04.md b/docs/runbook/pr-remediation-report-2026-08-04.md index 91f2a8db1..bbc66e15d 100644 --- a/docs/runbook/pr-remediation-report-2026-08-04.md +++ b/docs/runbook/pr-remediation-report-2026-08-04.md @@ -5,6 +5,16 @@ **Scope:** `groupthinking/eventrelay`, all open PRs, oldest-first **Parameters as invoked:** `auto_merge_policy: label:automerge`, `merge_method: `, `non_github_hosts: []` +> **Historical as of 2026-08-04. Superseded in part — do not action the gate +> recommendations below.** `agent-completion/truth-gate` and `Agent completion +> enforcement` were retired outright in #1434 (closing #1432), together with +> `agent-completion-enforcement.yml`, `agent_completion_gate.py`, and +> `.github/agent-lock/trusted-publishers.json`. The deadlock this report measures +> was structural, not a payload bug: `PR Governance` requires a linked issue, that +> issue arms the truth gate, and the armed gate then demands an intent snapshot only +> dispatch-originated work can have. The observations below remain an accurate +> record of the queue on the run date; the remedies do not. + --- ## Definition of Done — outcome @@ -121,10 +131,12 @@ prime candidates for a human to promote and merge. All are drafts, so step 1 for 2. **`main` is itself red** (`dependency-review` via the unfixable ecdsa/GHSA-wj6h-64fc-37mp advisory, and a `gitleaks` false-positive on a package hash). #1156 fixes both at the root — merging it first would clear inherited red checks across the whole queue. -3. **The trusted-publication check (`Agent Lock trusted publication`) is not being published**, - so `Agent completion enforcement` fails repo-wide. This has been overridden manually on - prior merges (#1108/#1103/#1098). Either restore the publishing App or drop the gate from - required checks. +3. **The trusted-publication check (`Agent Lock trusted publication`) was not being published**, + so `Agent completion enforcement` failed repo-wide. This had been overridden manually on + prior merges (#1108/#1103/#1098). *Resolved by removal:* #1434 retired the gate rather than + restoring the publishing App. All three allowlists in `trusted-publishers.json` were empty, + and the file's own note recorded that an empty allowlist blocks rather than downgrading to + `not_applicable` — so there was no provisioned trust path to restore. 4. **3 PRs are red only on Vercel** with "Canceled from the Vercel Dashboard" (#1122, #1129) or a deploy failure (#1003, #1043-class) — manual/infra cancellations, not code. Re-run the Vercel deployment to clear.