From b9810532cee2d92de939a45978c6561936908d22 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 06:16:38 +0000 Subject: [PATCH] docs(triage): record PR remediation run 2026-08-04 Oldest-first scan of all 65 open PRs against the PR Remediation & Publish Runbook. Same terminal conclusion as the 2026-07-31 run: no autonomous merge path exists; remaining work is human-only (PUBLISH GATE is human by default, auto_merge_policy unset). Material change since last run: 4 non-draft PRs (#1311, #1358, #1359, #1366) are now green and mergeable, awaiting only a human ready/merge decision. Also corrects the 2026-07-31 run's "gate faulting" framing of the agent-completion/truth-gate invalid_payload result: the collected verdicts (#1370, #1356) show it is a legitimate fail-closed verdict for a missing agent-completion contract (no linked canonical issue + no trusted-publisher provenance manifest), not a workflow bug. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_019hqExzDLDCCbRLdofRxcn1 --- docs/pr-remediation/2026-08-04-run.md | 114 ++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 docs/pr-remediation/2026-08-04-run.md diff --git a/docs/pr-remediation/2026-08-04-run.md b/docs/pr-remediation/2026-08-04-run.md new file mode 100644 index 000000000..7e8c2529e --- /dev/null +++ b/docs/pr-remediation/2026-08-04-run.md @@ -0,0 +1,114 @@ +# PR Remediation & Publish Run — 2026-08-04 + +Automated execution of the PR Remediation & Publish Runbook against +`groupthinking/EventRelay`. GitHub surface: GitHub MCP (PR read + comment + +merge available). Oldest-first scan of all open PRs, each driven to a terminal +state per the runbook's Definition of Done (`MERGED` / `DEFERRED` / `HALTED`). + +## Headline finding + +**No open PR has an autonomous merge path — same terminal conclusion as the +2026-07-31 run.** 65 PRs are open; 57 are drafts (→ `DEFERRED` by SCOPE GATE). +The material change since 2026-07-31 is that **4 PRs are now non-draft, green, +and genuinely mergeable** (`mergeable_state: unstable` = mergeable, not blocked) +— they are waiting only on a human ready/merge decision at the PUBLISH GATE, not +on any fixable automation blocker. + +Per the runbook and the standing guardrails for an unattended scheduled run: + +- **PUBLISH GATE** (runbook §3.8): human by default; `auto_merge_policy` unset → + conservative → **no auto-merge to protected `main`**. None of the four green + PRs carry an `automerge` label, so none qualifies for the labeled fast-path. +- **CI GATE** (runbook §3.6): the recurring red check on #1280 / #1281 / #1356 is + `agent-completion/truth-gate/pr-` returning `invalid_payload`. **This is a + legitimate fail-closed verdict, not a workflow fault** (correcting the + 2026-07-31 run's "gate faulting" framing). Its own machine-readable verdict + attributes it to a missing agent-completion contract: + `invalid_fields: [issue.number, policy.agent_login, policy.run_id]` and + `collection_errors: [missing_linked_issue, missing_closing_issue_reference, + missing_agent_run_id, missing_agent_login]` — i.e. the PR links no canonical + issue and carries no agent-lock provenance manifest. It is security-sensitive + governance infrastructure (runs via `pull_request_target`, trusted + append-only publication) and was **not** patched autonomously. +- **CodeRabbit loop** (runbook §4) is a no-op: CodeRabbit reports + `Review skipped: excluded by label configuration` on these PRs. + +Therefore no merge, commit, or review-loop action was taken against any PR. The +only remaining work is human — this run cannot advance it. + +## Terminal states — non-draft PRs (the actionable set) + +| PR | Author | Title | CI (combined) | Blocker | Terminal state | +|----|--------|-------|---------------|---------|----------------| +| 1280 | jules[bot] | fix(a11y): ARIA label on search clear button | ❌ failure | truth-gate `invalid_payload` (no linked issue/provenance) + Vercel "Canceled from Dashboard" | HALTED(ci_failing: missing agent-completion contract) | +| 1281 | jules[bot] | fix(security): route API errors through formatApiError | ❌ failure | truth-gate `invalid_payload` (no linked issue/provenance) + Vercel canceled | HALTED(ci_failing: missing agent-completion contract) | +| 1311 | dependabot | build(deps): bump ip-address 10.2.0→10.4.0 | ✅ success | — | HALTED(awaiting_merge_approval) | +| 1356 | groupthinking | Claude/determined maxwell rswptp | ❌ failure | truth-gate `invalid_payload` (unfilled PR template: placeholder title, no linked issue, no manifest) + merge conflict (`dirty`) | HALTED(human: fill contract + resolve conflict) | +| 1358 | dependabot | build(deps-dev): bump postcss 8.5.23→8.5.25 | ✅ success | — | HALTED(awaiting_merge_approval) | +| 1359 | dependabot | build(deps): bump the uv group (2 dirs) | ✅ success | major bump: `cryptography` 48→50 (crosses CVE-2026-69247), `google-cloud-aiplatform` 1.91→1.133 | HALTED(awaiting_merge_approval — human review advised, major deps) | +| 1362 | dependabot | build(deps): bump npm-minor-patch group (17 updates) | ⏳ pending | truth-gate still "collecting evidence" | HALTED(ci_pending) | +| 1366 | groupthinking | docs: record F8 web ownership (apps/web → uvai.io) | ✅ success | docs-only, low risk | HALTED(awaiting_merge_approval) | + +The 57 draft PRs are `DEFERRED(draft)` per SCOPE GATE and are not enumerated +individually here (unchanged in disposition from the 2026-07-31 run). + +## Staged next commands (human) + +Safe fast-path candidates — green CI, mergeable, low risk. **Human mark-ready + +merge:** + +``` +# Docs-only, fully green: +gh pr merge 1366 --squash + +# Green dependency bumps (verify each is intended): +gh pr merge 1311 --squash # ip-address 10.2.0 -> 10.4.0 +gh pr merge 1358 --squash # postcss 8.5.23 -> 8.5.25 (dev) + +# Review before merge — major version jumps: +# gh pr merge 1359 --squash # cryptography 48->50, google-cloud-aiplatform 1.91->1.133 +# gh pr merge 1362 --squash # npm-minor-patch group, 17 updates — wait for CI green +``` + +## Infrastructure note for maintainers (corrects the 2026-07-31 framing) + +The 2026-07-31 run called the `agent-completion/truth-gate` `invalid_payload` +result "the gate faulting rather than evaluating its rules." **The verdicts +collected this run show that is not accurate** — the gate *is* evaluating and is +returning a legitimate fail-closed `invalid_payload` because the PRs lack the +agent-completion contract. Verified on #1370 and #1356, whose machine-readable +verdicts both report `invalid_fields: [issue.number, policy.agent_login, +policy.run_id]` (no linked/closing canonical issue, no agent-lock provenance +manifest). A prior owner comment on #1356 says the same: *"the PR body is still +the unfilled template … no linked issue, no agent-lock manifest. The gate needs +the real manifest/evidence, which I can't synthesize."* + +The real, systemic gap for maintainers is therefore **not a workflow bug** but +that the contract cannot be satisfied by an agent from a PR today: the +`policy.agent_login` / `policy.run_id` fields require a *trusted-publisher* Check +manifest, and the companion `agent-completion-enforcement.yml` documents that the +trusted-publisher App "has not been stood up yet" and +`.github/agent-lock/trusted-publishers.json` is unprovisioned. Until that +infrastructure exists (and each PR links a canonical issue), agent PRs without a +linked issue will stay red on this gate by design. Two independent levers: +(1) provision the trusted publisher + populate the allowlists, and/or (2) ensure +each substantive PR carries a `Closes #` reference (the reason #1366 and +the green dependabot PRs pass the gate as `not_applicable`). This is +security-sensitive `pull_request_target` governance code and was not modified by +this unattended run. + +## Runbook parameters (as run) + +```yaml +github_surface: github-mcp # write-capable, confirmed (auth: groupthinking) +coderabbit_handle: "@coderabbitai" # no-op here: excluded by label config +auto_merge_policy: unset # -> conservative: never auto-merge protected main +merge_method: unset +non_github_hosts: [] # no sub-agent spawn +``` + +_Terminal-state summary: 0 MERGED, 57 DEFERRED (draft), 8 HALTED (4 awaiting +human merge approval; 3 on the truth-gate for a missing agent-completion +contract — a linked canonical issue + trusted-publisher provenance the gate +legitimately requires; 1 CI pending). No autonomous merge path exists; remaining +work is human-only._