And `mirror_now/1` is a force push of every ref, so the mirror overwrites what a

direct push left there rather than merging with it.

Amended 2026-08-25 (issue #188). "Strictly lossy" is a claim about evidence,

and it was being read as a claim about objects. Where a repository's log was

seeded from a shallow fetch, the mirror holds ancestors the WAL never held and

no rebuild can produce — 307 commits for this repository, measured on both

sides — so before the seed the mirror is strictly *richer* and is the only

copy. The invariant is unchanged and the direction still holds: the recovery

path consults no mirror, and a receipt still derives from the WAL alone.

`OpenAgents.Forge.Backfill.import_history/3` closes such a gap the only way an

append-only log can, by appending the missing objects as a `git_bundle` entry

that leaves the ref map unchanged and asserts no push. It takes a file an

operator supplies rather than reaching for a mirror, so it adds no call this

invariant's proof would fail on, and it writes no principal, sequence, or time

that would turn borrowed bytes into evidence of a push.

`docs/forge-operator-independence.md` records which half of the relation

applies to what.

Evidence: `OpenAgents.Forge.Sync`, `OpenAgents.Forge.Pushes`,

`OpenAgents.Forge.PushReceipt`, `OpenAgents.Forge.Verification`, and

`OpenAgents.Forge.PushReceipt`, `OpenAgents.Forge.Verification`,

`OpenAgents.Forge.Backfill`, `test/openagents/forge/backfill_test.exs`, and

`test/openagents/forge/independence_test.exs`.

### EXIT-004 — A clone is complete and self-hosting

   returns `:ok` on success and a typed error when the WAL cannot produce a

   servable projection. `EXIT-003` turns red if a mirror input is added.

4. Measure history rather than ref maps. Identical ref maps are not identical

   history, and this is the step that finds a seeded repository whose log holds

   less than its mirror does:

   ```sh

   git clone https://openagents.com/{owner}/{repo}.git forge && \

     git -C forge rev-list --count refs/heads/main && \

     cat forge/.git/shallow

   git clone https://github.com/{owner}/{repo}.git mirror && \

     git -C mirror rev-list --count refs/heads/main

   ```

   A `shallow` file on the forge side names the boundaries. Each boundary's

   parents are what the log does not hold, and the mirror is where they are.

5. Where the forge is behind, close it with the objects and not with invented

   evidence. `OpenAgents.Forge.Backfill.import_history/3` appends a bundle to

   the log as a `git_bundle` entry that leaves the ref map alone and claims no

   push. Build the bundle from the mirror, one branch per boundary parent:

   ```sh

   git -C mirror branch --force preseed-1 <parent-of-boundary-1>

   # ... one per boundary ...

   git -C mirror bundle create pre-seed.bundle preseed-1 preseed-2 ...

   git -C mirror bundle verify ../pre-seed.bundle

   ```

   Put the bundle on the node, inside the container, and import it:

   ```sh

   bin/openagents rpc 'OpenAgents.Forge.Backfill.open_boundaries("{storage_key}")'

   bin/openagents rpc 'OpenAgents.Forge.Backfill.import_history("{storage_key}", "/tmp/pre-seed.bundle", "operator:{who}")'

   ```

   `import_history/3` proves the bundle against a throwaway repository that

   borrows the projection's objects and refuses to write unless every

   boundary's recorded parents resolve and the union walks, because an

   append-only log cannot retract a bad entry. `{storage_key}` is the

   repository's storage key, not its name — `OpenAgents.Forge.RepoRef` is the

   only translator, and #190 is the defect that made the difference matter.

   This is a permanent write on a forge people are pushing to. Watch every node

   converge afterwards: a node that cannot materialize the entry falls back to

   a full rebuild from sequence zero, which step 3 records as unexercised

   against the live projection.

### Result, 2026-08-25

**Steps 1 and 2 pass against the live forge.** Both remotes advertise the same

live 423-commit projection is untested.

`docs/2026-08-25-forge-exit-rehearsals-2-to-6.md` records both halves.

**Step 4 re-measured later the same day, and step 5 is prepared but not run.**

A fresh clone of each side: the forge serves 461 commits on `main`, `git fsck`

clean, grafted at five `shallow` boundaries rooted at `eda094c6`; the mirror

serves 767, `git fsck` clean, rooted at `a352f78e`, and `git rev-list --count

eda094c6` there is 308 — the seed and its 307 ancestors. The counts are at

different tips because the forge was ahead; the gap is unchanged.

The mirror holds all five boundaries and each one's parent, so a single bundle

closes every boundary at once. Built from the mirror by the recipe in step 5

over `fdd00d4c`, `e0e61fb1`, `0fcbbbb8`, `f8a7822a`, and `c91327d6`, it is

7.2 MB and `git bundle verify` reports a complete history.

The import itself was not performed. It is a permanent append to a shared

production log, its failure mode is the fleet-wide rebuild step 3 has never

exercised live, and both belong to an attended operation rather than to a

read-only rehearsal. #188 records the decision — import the objects, keep the

push record starting at the seed — and

`docs/forge-operator-independence.md` carries the reasoning.

## 4. Key rotation

**Proves:** that no rotation invalidates an already-issued receipt, and that a

and `EXIT-003` proves both halves.

Two operational facts belong here rather than in a footnote. First,

`:forge_mirror_urls` is empty in `config/config.exs` and set by no environment,

so no mirror runs today and GitHub holds whatever was last pushed to it

directly — `REPOSITORY-002` states that trade. Second, `mirror_now/1` is a

force push of every ref, so configuring a mirror overwrites whatever direct

pushes left there rather than merging with them.

`:forge_mirror_urls` is empty in `config/config.exs` but `config/runtime.exs`

reads `OPENAGENTS_FORGE_MIRROR_URLS_JSON`, and production sets it for

`openagents.com`, so a mirror does run and GitHub holds what the forge last

pushed there — `REPOSITORY-002` states that trade, and a direct push to GitHub

is overwritten rather than merged. Second, `mirror_now/1` is a force push of

every ref, which is the destructive half of that: it overwrites whatever the

mirror held rather than reconciling with it. Both statements were false here

until #188 measured the deployment against them.

### The mirror is lossy about evidence and richer about pre-seed objects

"The mirror is strictly lossy" is true of one thing and false of another, and

collapsing the two is what #188 found. The relation has two halves and a

boundary between them, and the boundary is the seed commit `eda094c6`.

**Everything the WAL records — the whole log, from the seed forward.** The

mirror is strictly lossy and is never an input to recovery. It carries objects

and refs and no evidence, so a forge restored from it serves the same source

with no record of who produced it. That is `EXIT-003`, and it is the half that

is load-bearing: the recovery path must not be able to consult GitHub, or

GitHub becomes authority by accident.

**Everything before the seed — 307 commits.** The relation is inverted. This

repository's log was seeded from a `--depth=1` fetch (#179), so the WAL holds

one commit per ref and no ancestry, and no rebuild can produce what the log

never held. Those commits are objects with no evidence attached anywhere: no

WAL entry, no sequence, no principal, no receipt. The mirror is the only copy

of them, which is exactly the input this document said was never an input.

Measured on 2026-08-25, both sides cloned fresh:

| Source | `main` commits | `git fsck` | Root of `main` | Holds `c91327d6` |

| --- | --- | --- | --- | --- |

| The forge | 461 | clean | `eda094c6`, the seed | no |

| GitHub mirror | 767 | clean | `a352f78e` | yes |

The counts are taken at different tips, because the forge was ahead of the

mirror when they were read; the gap itself is stable. `git rev-list --count

eda094c6` on the mirror is 308 — the seed and its 307 ancestors — and the forge

holds the seed alone.

The forge's clone is not broken by this and `EXIT-004` is not violated by it.

The clone succeeds, passes `git fsck`, and writes a `shallow` file naming five

reconciled boundaries, which is `EXIT-004`'s stated outcome after #179: history

that says where it stops is servable, and history that dangles is not. What is

true is narrower and worth saying without softening it — **the forge is

canonical for its own history only from the seed forward**, and a reader who

wants this repository's first 307 commits has to get them from the mirror.

### The decision about the 307 commits

Decided 2026-08-25 (#188): **import the objects, and do not manufacture the

evidence.** Three shapes were weighed.

**Import the objects and a push record for them.** Rejected, because it invents

evidence. A WAL entry carries a sequence, a principal, and a time, and

`OpenAgents.Forge.Pushes.reconcile_receipts/1` derives a receipt from every

entry. Writing entries that claim 307 pushes nobody made would publish receipts

for pushes that did not happen, in a log whose entire value is that a receipt

derives from the WAL and never from a second authority. Synthesizing the record

to make the count come out right destroys the thing the count was measuring,

and it is the defect class this tracker keeps finding.

**Record that the forge is canonical only from the seed forward, and stop.**

That is true, it is what this document now says about the present, and it is

not enough as an end state. It leaves the forge's own authority holding less

than its mirror does, so "GitHub is a mirror and never authority" reads as a

statement about the whole repository while being true only about evidence and

false about half the objects. It also leaves the only copy of this

repository's first year on an account the operator does not control, which is

the dependency this document exists to remove.

**Import the objects and keep the push record starting at the seed.** Chosen.

The objects and the evidence are different claims, and only one of them is

missing. The log gains the bytes; it gains no assertion about who pushed them.

`OpenAgents.Forge.Backfill.import_history/3` is that operation and it is

already written and proven — `test/openagents/forge/backfill_test.exs`, six

tests, including one that rebuilds from sequence zero afterwards and gets the

whole history back. It appends the bundle as an ordinary `git_bundle` entry

carrying the ref map unchanged, an empty shallow set, and a principal that

records who authorized the import rather than who authored the commits. It

proves the bundle against a throwaway repository sharing the projection's

objects and refuses to touch the log unless every boundary's recorded parents

resolve and the union walks the way `git upload-pack` walks it, because an

append-only log cannot retract a bad entry.

This does not weaken `EXIT-003`. The bytes arrive by an operator's hand on one

occasion, not by a code path reaching for GitHub: no module on the recovery

path gains a mirror call, and the proof that fails on one is untouched. What

changes afterwards is that the mirror stops being the only copy of anything.

**Not yet executed.** The bundle is built and verified — 7.2 MB, `git bundle

verify` reports a complete history, and it closes all five recorded boundaries

— and the recipe is in rehearsal 3 of `docs/forge-exit-rehearsals.md`. What is

left is a production write that cannot be undone: a WAL append is permanent by

design, `EXIT-005` makes removing an entry a rewrite of the whole suffix, and

if a node fails to materialize the new entry `OpenAgents.Forge.Sync` falls back

to a full rebuild from sequence zero, which rehearsal 3 records as never having

been run against the live projection. That is an attended operation on a forge

people are pushing to, not an unattended one, and it is tracked separately

rather than being described here as done.

## Exit

`EXIT-004` is the narrow claim that actually holds: a clone taken through the

published Git transport carries every advertised ref, every object behind those

refs, and re-serves the same history from somewhere else with the forge deleted.

The one omission is the `refs/internal/` namespace, where stack boundary

commits are retained without being advertised; the proof asserts that this is

the *only* omission, so withholding a branch would turn it red.

refs that the WAL holds, and re-serves the same history from somewhere else

with the forge deleted. The one withheld namespace is `refs/internal/`, where

stack boundary commits are retained without being advertised; the proof asserts

that this is the *only* withholding, so hiding a branch would turn it red.

Where a ref's history reaches back past what the WAL holds, the clone is

grafted rather than truncated: a `shallow` file names the boundary, and the

copy is complete with respect to what the forge has and honest about where that

stops. `EXIT-004`'s #179 amendment states that outcome. The pre-seed section

above says what is on the other side of the boundary and where it lives.

That is exit for source. It is not yet exit for everything, and the remaining

gaps are named rather than softened.

    # every ref, that made both documents promise the destructive thing was

    # switched off while it was switched on. Neither claim can return while

    # runtime still reads that variable.

    #

    # `docs/forge-operator-independence.md` joined the guarded set with #188:

    # it is where the mirror contract is written in prose, it carried the same

    # sentence, and the first pass corrected the two files a test named while

    # leaving the third to be found by hand a second time.

    test "does not claim a mirror is unconfigured while runtime configures one" do

      assert File.read!("config/runtime.exs") =~ "OPENAGENTS_FORGE_MIRROR_URLS_JSON",

             "the guard below is only meaningful while runtime reads this variable"

      for path <- ["INVARIANTS.md", "CLAUDE.md"] do

      for path <- ["INVARIANTS.md", "CLAUDE.md", "docs/forge-operator-independence.md"] do

        text = File.read!(path)

        for claim <- [