[DRAFT EVIDENCE] duplicate neutral-enforcement proposal - #938
Closed
groupthinking with Copilot wants to merge 5 commits into
Closed
[DRAFT EVIDENCE] duplicate neutral-enforcement proposal#938groupthinking with Copilot wants to merge 5 commits into
groupthinking with Copilot wants to merge 5 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🔍 PR Validation |
Agent Completion Truth Gate: BLOCKEDReasons: Machine-readable verdict{
"details": {
"invalid_fields": [
"issue.number",
"policy.agent_login",
"policy.run_id"
]
},
"reasons": [
"invalid_payload"
],
"verdict": "blocked"
} |
…visioned When trusted-publishers.json has empty allowlists (no GitHub App configured), the agent-completion-enforcement workflow now emits a neutral advisory Check run instead of a hard failure. This unblocks PRs while the trusted publication infrastructure is not yet set up. Changes: - scripts/ci/agent_completion_enforcement.py: add neutral_verdict() helper; return neutral for trust_policy_unprovisioned instead of failure - .github/workflows/agent-completion-enforcement.yml: check policy provisioning in bash step before writing missing_trusted_publication failure; handle neutral conclusion in JS publish step (skip setFailed) - tests/unit/test_agent_completion_enforcement.py: assert neutral conclusion for unprovisioned policy
Eliminates the inline Python heredoc in the workflow by exposing a --check-provisioned flag on agent_completion_enforcement.py. This keeps the provisioning logic in a single, testable location.
…nals - Move is_provisioned() before verify() so verify() can use it as the single source of truth for the unprovisioned check - Replace nested JS ternaries with explicit if-else blocks for clarity
Copilot
AI
changed the title
[WIP] Fix issue with Copilot execution
fix(ci): yield neutral advisory check when agent-lock policy is unprovisioned
Jul 22, 2026
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
groupthinking
added
ci/cd
duplicate
ChatGPT Codex Connector
groupthinking
changed the title
This was referenced Jul 22, 2026
Owner
|
Closing as duplicate/noncanonical draft evidence — cleanup pass. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Controller disposition — EVIDENCE ONLY / NONCANONICAL
b534a80df7e92a793d587d350d3200f08e27e91bgroupthinking/eventrelay-blocker-watch-20260722-1607z; claimed and heartbeat2026-07-22T16:07:13Z; branchcopilot/fix-with-copilot-another-one.Original proposal
agent-completion-enforcementwas hard-failing every PR withmissing_trusted_publicationbecause no GitHub App has been configured to publish the required "Agent Lock trusted publication" check. With all three allowlists empty intrusted-publishers.json, the system is unprovisioned — but the code treated unprovisioned identically to a provisioned-but-missing-publication state, blocking all agent PRs.Changes
scripts/ci/agent_completion_enforcement.pyneutral_verdict()counterpart toverdict()is_provisioned(policy)as the single source of truth: returnsTrueonly when all three allowlists (trusted_check_app_slugs,trusted_label_actors,trusted_human_exemption_actors) are non-emptyverify()delegates tois_provisioned()and returnsneutralfortrust_policy_unprovisionedinstead offailure--check-provisioned POLICYCLI mode (exit 0 = provisioned, exit 1 = not) so the workflow can call one authoritative check.github/workflows/agent-completion-enforcement.yml--check-provisionedwhen no trusted report is found; writesneutralverdict when unprovisioned,failurewhen provisioned-but-missingneutral→neutralGitHub Check conclusion and skipscore.setFailed(), so the workflow job passestests/unit/test_agent_completion_enforcement.pytest_unprovisioned_policy_blocksnow assertsconclusion == "neutral"(previously only checkedreason)Verification
Agent provenance