[SUPERSEDED by #899] Establish autonomous repository governance and delivery state

[Codex]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>[AGENT:Codex] Establish autonomous repository governance and canonical delivery state</issue_title>
<issue_description>## Outcome

Make GitHub Project #9 and main the canonical delivery state for EventRelay, while reducing duplicate agent work, stale branches, preview noise, backtracking, and unnecessary human intervention.

This is the single remaining-work issue for the 2026-07-20 repository, tracker, Notion, and Vercel audit.

Canonical state

State	Canonical source
Code	main in groupthinking/EventRelay
Delivery backlog	GitHub Project #9
Work definition	GitHub issues
Implementation	One canonical issue-linked PR
Production	Vercel production deployment from main
Runtime evidence	Vercel Runtime Errors plus Sentry once connected
Strategy and executive reporting	Notion as a generated read-only mirror
Design exploration	Stitch; never an implementation source of truth
Local copies	Disposable working copies; never authoritative

Completed during the audit

• Created this canonical governance issue.
• Opened draft PR ci: establish autonomous repository governance #899 with:
  • ready-PR evidence contract;
  • exactly-one-canonical-issue validation;
  • competing implementation PR detection;
  • scheduled, non-destructive repository drift reporting;
  • strengthened PR template preserving agent-lock provenance.
• Verified PR ci: establish autonomous repository governance #899 at exact head b0793b58b2fd6bbcb4393e5afbd2d8f1bd81129f.
• CI, Security Scan, Dependency Review, Secret Scan, Auto Label, CodeQL, and Coverage passed on that head.
• E2E was skipped by repository configuration.
• Updated the Notion EventRelay Live Launch Board to mark its June 14 snapshot as historical and identify GitHub as canonical.
• Created focused OAuth production issue Execution: verify Google OAuth in Vercel production (PR #903) #900 from actual Vercel runtime evidence.
• Restored PR fix: harden API-cost webhook outbox retries (MYX-79) #869 to draft so its GitHub state matches its documented “do not merge” status.

Required implementation order

Phase 1 — Land and activate repository governance

• Review PR ci: establish autonomous repository governance #899’s workflow logic and permissions.
• Resolve its canceled Vercel preview context as non-applicable or configure docs/workflow-only PRs not to request previews.
• Mark PR ci: establish autonomous repository governance #899 ready after review.
• Merge PR ci: establish autonomous repository governance #899 only while all required checks still pass on its exact head.
• Run Repository Reconciliation manually once after merge.
• Confirm it creates or updates one [automation] Repository drift report issue without deleting branches.
• Add the governance check to the repository ruleset only after a successful live run.
• Do not make an advisory custom status required by itself.

Phase 2 — Configure GitHub Project #9 as the delivery control plane

Create these fields:

• Outcome
• Status: Inbox, Ready, In Progress, In Review, Blocked, Awaiting Production, Released, Archived
• Priority: P0–P3
• Workstream: Product, Platform, Reliability, Security, Operations
• Owner Type: Agent or Human
• Canonical Issue
• Active PR
• Target Date
• Blocked By
• Production Evidence
• Decision Needed
• Last Verified
• Supersedes

Configure these rules:

• Automatically add every repository issue and PR.
• New issue → Inbox.
• Ready issue with acceptance criteria → Ready.
• Draft PR → In Progress.
• Ready PR → In Review.
• Required check failure → Blocked.
• Merge → Awaiting Production.
• Production verification against exact main SHA → Released.
• Set a work-in-progress limit of three.
• Permit no more than one active implementation PR per canonical issue.
• Require a target date when an item becomes Ready.
• Keep Decision Needed empty unless human judgment is actually required.

Phase 3 — Reconcile PR and branch sprawl

Audit evidence showed 12 open PRs and more than 100 remote branches.

• Classify every open PR: keep, supersede, split, or close.
• Preserve a PR only when it owns unique, still-required scope.
• Link every retained PR to exactly one canonical issue.
• Convert blocked or unsafe work to draft.
• Close explicitly superseded PRs with a link to the canonical replacement.
• Inventory all remote branches.
• Map retained branches to active issues/PRs.
• Delete merged branches automatically after the repository policy is verified.
• Produce proposals, not automatic deletion, for unmerged branches older than 14 days.
• Preserve protected, release, incident, and explicitly retained branches.
• Prevent agents from opening a third competing PR for the same issue.

Phase 4 — Tighten CI without creating a permanent red repository

Current CI weaknesses:

• TypeScript checking is informational.
• Python linting is informational.
• CI uses npm install rather than deterministic npm ci.
• A transcript workflow test is explicitly omitted.
• E2E is skipped by repository configuration.

Required work:

• Fix the existing TypeScript violations, then make type-check required.
• Establish a clean production Python lint baseline, then make it required.
• Synchronize lockfiles and replace CI installation with npm ci.
• Restore or formally quarantine the omitted transcript workflow test with a tracked issue and expiry.
• Enable a minimal production-path E2E smoke test.
• Add workflow concurrency cancellation for superseded runs.
• Bind required evidence to the exact current head SHA.
• Keep security, dependency, secret, CI, and coverage checks required.
• Require production evidence only when the changed paths affect a deployed surface.

Phase 5 — Reduce automated dependency and preview noise

• Group frontend minor/patch dependency updates into one weekly PR.
• Group backend minor/patch dependency updates into one weekly PR.
• Keep majors isolated and require explicit compatibility evidence.
• Lower simultaneous Dependabot PR limits after grouping is verified.
• Deploy Vercel previews only for PRs carrying preview-required or affecting deployed frontend paths.
• Cancel older preview deployments when a newer head arrives.
• Do not treat a manually canceled, non-applicable preview as an application failure.
• Post preview URL, exact head SHA, and result to the PR and Project item.
• Allow production deployments only from main.

Phase 6 — Remove Hayden as the universal mechanical bottleneck

Current CODEOWNERS assigns essentially every path to @groupthinking.

• Define path-based ownership for frontend, backend, infrastructure, security, and documentation.
• Use automated review/check owners for mechanical validation.
• Require Hayden only for:
  • product direction;
  • security exceptions;
  • irreversible infrastructure changes;
  • billing/credential ownership;
  • final production approval when risk requires it.
• Do not require human approval for formatting, dependency patching, generated documentation, evidence refresh, or clearly reversible maintenance that passes policy.

Phase 7 — Production and runtime truth

Google OAuth

Tracked in #900.

• Standardize the supported OAuth variable names.
• Confirm production credentials exist without printing them.
• Verify the authorized production callback URI.
• Redeploy from main.
• Complete a real user sign-in and callback.
• Verify the audited error groups remain absent for 24 hours.
• Attach deployment ID and exact main SHA.

Sentry

The requested Sentry connector was unavailable during this audit.

• Install/connect Sentry with access to the EventRelay project.
• Define production and preview environments consistently.
• Attach release/commit SHA and Vercel deployment identifiers to events.
• Create or update GitHub issues only for actionable, non-duplicate production regressions.
• Auto-resolve linked runtime issues only after the production release is healthy for the defined observation period.
• Prevent Sentry and Vercel from opening duplicate issues for the same fingerprint.

Vercel runtime synchronization

• Convert new production runtime error clusters into one deduplicated issue per fingerprint.
• Include route, first/last seen, occurrence count, deployment, and exact commit.
• Route configuration/credential findings to infrastructure; route code regressions to the owning workstream.
• Keep secrets out of all issues, comments, logs, and artifacts.

Phase 8 — Notion executive mirror

• Replace manually maintained task state with a generated summary from GitHub Project Fix LiteRT-LM MCP Server based on code review #9.
• Show current production SHA and deployment state.
• Show current P0/P1 blockers and human decisions required.
• Show completed, blocked, and next-three executable items.
• Add a Last Verified timestamp.
• Display a visible stale warning if synchronization fails.
• Do not allow Notion edits to silently overwrite GitHub delivery state.

Phase 9 — PR #869 production-safety boundary

PR #869 must remain draft until all current blockers are proven resolved.

• Resolve the current agent-completion truth-gate invalid_payload fields.
• Resolve or revalidate the in-memory SQLite/threading review finding.
• Verify shared PostgreSQL and migration-owned schema are actually active in the target deployment.
• Verify deploy-time migrations and runtime driver configuration.
• Prove reliable worker CPU/liveness across instance replacement.
• Make usage persistence and outbox enqueue atomic, or add durable reconciliation.
• Prove the canonical v1/HybridProcessor path emits track_api_call.
• Eliminate application-start create_all() as the production migration path.
• Supply a durable database and API_COST_WEBHOOK_URL in the deployment.
• Complete PostgreSQL multi-instance and revision-replacement validation.
• Confirm the PR does not carry or inherit an incompatible TypeScript 7 preview change.
• Re-run all required checks and production-shaped tests against the exact final head.
• Only then mark fix: harden API-cost webhook outbox retries (MYX-79) #869 ready.

Automation acceptance tests

• A ready PR without exactly one closing issue reference fails governance.
• A draft PR is not blocked while its evidence is incomplete.
• Two open PRs closing the same issue are detected.
• A compliant ready PR passes.
• Scheduled reconciliation paginates beyond 100 branches.
• Active PR branches and main are excluded from stale proposals.
• The drift report is updated rather than duplicated.
• Repository reconciliation performs no deletion.
• Project state follows PR/check/deployment events.
• A production error creates one deduplicated issue with commit/deployment evidence.
• A docs-only or workflow-only PR does not require a Vercel preview.
• Released status requires evidence from the exact deployed main commit.

Human decisions still required

• Approve and merge PR ci: establish autonomous repository governance #899 after final review.
• Authorize or enter Google OAuth credentials in Vercel; never post them to GitHub.
• Connect/install Sentry and select the EventRelay project.
• Confirm path owners or teams that can replace @groupthinking in CODEOWNERS.
• Approve the first proposed deletion batch for unmerged stale branches.
• Decide whether the FastAPI/Cloud Run backend remains canonical or is intentionally retired; encode that decision in architecture and deployment policy.

Completion criteria

This issue may close only when:

1. Project Fix LiteRT-LM MCP Server based on code review #9 reflects all active work automatically.
2. Every retained PR maps to one canonical issue.
3. Branch and PR sprawl is reconciled and kept within policy.
4. Required CI is deterministic and production-path E2E runs.
5. Production deploys only from main and records exact commit evidence.
6. OAuth is verified working in production.
7. Vercel and Sentry runtime findings deduplicate into actionable issues.
8. Notion is a current generated mirror rather than an independent tracker.
9. Human involvement is restricted to decisions that genuinely require authority or judgment.
10. PR fix: harden API-cost webhook outbox retries (MYX-79) #869 is either production-proven and ready or remains safely draft/closed.

External-access blockers recorded

These are tasks, not excuses:

• GitHub Project Fix LiteRT-LM MCP Server based on code review #9 field mutation was unavailable through the connected GitHub interface used during the audit.
• Vercel environment-secret mutation was unavailable; credential values require an authorized owner.
• Sentry was not installed/callable.
• GitHub CLI was unavailable in the workspace, so repository writes used the connected GitHub app.
  </issue_description>
• Closes [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898

Comments on the Issue (you are @codex[agent] in this section)

@groupthinking @codex take ownership of this issue as the lead execution agent.

Execution contract:

1. Work through the phases in the issue's stated order.
2. Treat GitHub Project Fix LiteRT-LM MCP Server based on code review #9, repository issues/PRs, main, and the Vercel production SHA as canonical.
3. Reuse or supersede existing work; do not create competing PRs for the same scope.
4. Keep one canonical issue-linked PR per executable unit.
5. Require exact-head test and deployment evidence before advancing status.
6. Keep changes reversible and use draft PRs while blockers remain.
7. Do not delete unmerged branches, expose credentials, alter billing, weaken security controls, or deploy irreversible infrastructure without explicit human approval.
8. Escalate to Hayden only for product direction, credential ownership, security exceptions, irreversible infrastructure, or final production approval.
9. Update [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898 with completed checkboxes, links, blockers, and the next executable action after every merged unit.
10. Continue until the completion criteria are satisfied; do not report completion based only on code generation or a green advisory status.

Start with final review and activation of PR #899.</comment_new>

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Error		Jul 20, 2026 11:56pm

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 4c080d7.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[Copilot]

Copilot wasn't able to review any files in this pull request.

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "invalid_fields": [
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[vercel]

The .vercelignore excludes the entire scripts/ directory, so the ignoreCommand script referenced in apps/web/vercel.json is removed during clone and the build fails with "No such file or directory".

[groupthinking]

Automated review (head 99deb8c)

Review requested — here are verified findings. Flagging rather than gating; leaving the merge decision to @groupthinking.

🔴 Correctness: the new governance regex misses the owner/repo#NNN closing form

pr-governance.yml and repository-reconciliation.yml both detect the canonical issue with:

/(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi

This only matches the bare #NNN form. It does not match the fully-qualified owner/repo#NNN form or the full-URL form — which is exactly what agents use throughout this repo. Verified:

Body text	Regex captures
Closes #898	898 ✅
Closes groupthinking/EventRelay#898	(none) ❌
Fixes https://github.com/groupthinking/EventRelay/issues/898	(none) ❌

Consequences:

1. This PR would fail its own check. #901's body closes the issue via Closes groupthinking/EventRelay#898 (qualified form), so canonicalIssues.length === 0 → the gate fails with "exactly one closing reference". Since draft:false, it would not be exempted.
2. Competing-PR detection silently under-reports. Any competing PR that references the issue in qualified/URL form is invisible to the scan — defeating the headline feature.

Suggest broadening the pattern, e.g. (?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+(?:[\w.-]+\/[\w.-]+)?#(\d+) plus a full-URL \/issues\/(\d+) branch, with a unit test asserting all three forms resolve to the same issue number.

🟠 Does not resolve the systemic truth-gate blocker

Every open PR (I sampled the full backlog #617→#903) is red on agent-completion/truth-gate/pr-<N> with invalid_payload / gate publication failed. This PR does not touch that logic in pr-checks.yml; its own Phase 9 lists "Resolve the current agent-completion truth-gate invalid_payload fields" as still-open. The strategy here (keep truth-gate advisory, add a separate enforced check) is sound, but the actual unblock isn't in this diff.

🟡 [WIP] title vs draft:false

Title says [WIP] but the PR is marked ready, so downstream draft-exemption logic (including the new pr.draft early-return in pr-governance.yml) treats it as enforced. Recommend keeping it a draft while WIP, or dropping the [WIP] prefix.

✅ Good: pull_request_target used safely

pr-governance.yml runs on pull_request_target with read-only permissions and does not check out PR head code — it only reads pr.body. That avoids the usual pull_request_target privilege-escalation footgun. 👍

Net: the workflow scaffolding is reasonable, but the canonical-issue regex is a blocking correctness bug given how this repo's agents write closing references, and this PR doesn't itself clear the truth-gate that's blocking the backlog.

---

Generated by Claude Code

[groupthinking]

Superseded by the more advanced canonical governance implementation in #899.

#899 already contains the workflow-catalog/audit additions and focused policy tests, has a READY Vercel preview at exact head f16368e4ec7250b4a29188600521b718d0841c6a, and is the branch currently receiving review fixes.

Before this PR is closed, its only unique potentially reusable scope is the path-aware Vercel preview suppression. That implementation is currently blocked because .vercelignore excludes the referenced scripts/ command. Transfer a corrected, tested version to #899 if still needed; do not continue a competing governance implementation here.