disclosure that named a gap without naming the surface that closes it would be

asking the reader to go looking.

It carries one more decision (issue #246). `independence.deployment` publishes

how far the code assembling this projection is from the head of the ref its

proofs ran against: `proven_ref` (`refs/heads/main`, a fixed ref name and not

instance data), `known`, and `behind`. A count of commits is a count, so the

content rule is unchanged and the shas that count lies between stay off this

page — `EXIT-006`'s proof turns red for one, and this decision does not relax

that. It belongs in the same bounded projection for the reason the disclosure

does: a status page assembled by code 57 commits behind the ledger reports

health for surfaces the reader cannot reach (#187), and nothing else on this

page can tell them so.

What the projection carries beside counts is the bounded public SCV activity

band (`scvs`: a derived public id, a label, a status, a weight, and one

bounded activity line), the forge deploy lane (short shas, statuses, timings,

`export_recipient_encryption`, and `operator_reads_source` was added. That is

the decision being asked for, not an accident.

Amended 2026-08-25 (issue #246). The disclosure publishes its own distance from

the revision its proofs ran against. Every claim above is derived from the

running node, and the running node's code can be older than the ledger those

claims answer to: #187 found the forge serving a revision 57 commits behind

`main`, where the export route, the `EXIT-005` chain, and this module itself did

not exist, while every proof of them stayed green. An invariant that is proven

and not deployed reports nothing, which is the outcome this contract exists to

prevent, reached by a second route. So `independence.deployment` publishes the

number of commits on the head this node serves that the running revision does

not carry, and `/status` renders it in words.

It is a distance and nothing else. Both revisions it lies between are commit

shas, and adding one to this projection was among the mutations below; the

proof stays red for them, and this amendment does not touch that rule. The

distance is derived the way everything else here is: the running revision is

the one `/api/status` already publishes for this node, the proven revision is

the head of `refs/heads/main` in the bare projection this node serves, and the

count is `git rev-list` over objects already on disk. `RELEASE-004` binds the

proof matrix to the exact candidate sha and `.githooks/pre-push` refuses a push

without it, which is what makes that head the newest proven revision.

The claim is narrow on purpose. It is not "how far behind `main` this forge

is" — nothing on this node can see a `main` it declines to serve. A forge that

will not serve its own repository, a node whose bare projection is empty, and a

release built from a revision this forge never accepted all report `known:

false` and no distance, which is the same withholding `EXIT-005` and `EXIT-006`

already decline to detect. The distance is also not an axis of `degraded?`: a

node one commit behind is not less independent, and folding ordinary deploy lag

into the independence verdict would make that verdict mean nothing on the day

it mattered. It is published beside the verdict, as the verdict's margin of

error. The published key set moved with the claim, as `STATUS-001` requires:

`independence.deployment.proven_ref`, `.known`, and `.behind` were added, and

`deployment/1` is public with the revision as a parameter for the same reason

`degraded?/3` is — the node running the proof reports a build revision that is

not a commit at all, so the projection alone could only ever exercise the

branch that withholds.

`STATUS-001`'s rule holds here: the section carries counts, booleans, family

names, issue numbers, and one document path, and the proof asserts that every

string it publishes is a ledger family name or fixed vocabulary — a repository

path, an account id, a node name, or a commit sha reaching it turns the proof

red. The whole section degrades to `nil` like every other gather, so a node

that cannot assemble it renders the page without it rather than failing.

names, issue numbers, one ref name, and one document path, and the proof asserts

that every string it publishes is a ledger family name or fixed vocabulary — a

repository path, an account id, a node name, or a commit sha reaching it turns

the proof red. The whole section degrades to `nil` like every other gather, so a

node that cannot assemble it renders the page without it rather than failing.

Six mutations were confirmed to fail the proof and reverted: publishing an

empty gap list while the ledger records gaps; making `degraded` constant;

`false` is the correct answer today — so the proof reads the compiled import

table the way `export_recipient_encryption` already does.

Three more were confirmed for the deployment section and reverted: publishing

the running revision beside its distance, which the vocabulary assertion and

both `STATUS-001` key-set assertions catch; hardcoding the distance to zero,

which the seeded-repository counts catch and the compiled-import-table read

catches independently of them; and dropping the section from the projection,

which `STATUS-001`'s stale-key assertion catches.

Evidence: `OpenAgents.Forge.Independence`, `OpenAgents.Forge.AtRest`,

`OpenAgents.NetworkStatus`,

`OpenAgentsWeb.NetworkStatusLive`, `OpenAgents.DataRights.Age`,

obvious home for it is not free: `EXIT-006`'s proof turns red when a commit

sha reaches the disclosure.

**What #246 added.** The disclosure now publishes its own distance from the

revision its proofs ran against. `independence.deployment.behind` on `/status`

and `GET /api/status` is the number of commits on the head this node serves

that the running revision does not carry, so the next 57-commit gap is a

number on a public page rather than a rehearsal waiting to be performed. The

proof stayed as it was: a distance is a count, and neither revision it lies

between reaches the projection. What it still does not report is a forge that

withholds its own repository — that node reports `known: false` and no

distance, the same withholding `EXIT-005` and `EXIT-006` already decline to

detect — and it does not act on the gap it reports. Nothing raises an incident

when the distance grows; a reader or a check has to look.

## 1. Restore a repository and its bounded work history

**Proves:** an account's source and its work records survive on a machine that

A forge that records its limits in a document and reports itself healthy on its

status page has hidden them.

The disclosure also publishes its own distance from the revision its proofs ran

against. Every claim in it is derived from the running node, and the running

node's code can be older than this ledger: in August 2026 the forge served a

revision 57 commits behind `main`, where the account export, the WAL chain, and

the disclosure itself did not exist, while every proof of them stayed green

(#187). `independence.deployment.behind` is the number of commits on the head

this node serves that the running revision does not carry, so a reader who

checks `/status` sees the gap without performing a rehearsal to find it (#246).

Its bound is the same withholding the rest of this document names. The distance

is measured against the head this node serves, so a forge that will not serve

its own repository, a node whose bare projection is empty, and a release built

from a revision this forge never accepted all report `known: false` and no

distance at all. Being behind is reported beside the independence verdict, not

inside it: a node one commit behind is not less independent.

## Rehearsals

`docs/forge-exit-rehearsals.md` defines six rehearsals — restore, receipt

  `degraded?` is true while any of the three falls short, so the page does not

  need a human to decide when to say so. It is expected to be true today.

  A fourth section says how much any of that is worth. Every claim above is

  derived from the running node, and the running node's code can be older than

  the ledger those claims answer to: #187 found the forge serving a revision 57

  commits behind `main`, where the export route, the chain, and this module

  itself did not exist, while every proof of them stayed green on `main`. A

  disclosure that cannot say how far its own code is from the code its proofs

  ran against is asking to be trusted on exactly the point it exists to remove,

  so `deployment` publishes that distance: the number of commits on the head

  this node serves that the running revision does not carry (#246).

  It is a distance and nothing else. Publishing the two revisions it lies

  between would put a commit sha on an anonymous surface, which `STATUS-001`

  keeps content-free and this section's own proof turns red for. It is also not

  an axis of `degraded?`: a node one commit behind is not less independent, and

  folding ordinary deploy lag into the independence verdict would make that

  verdict mean nothing on the day it mattered.

  Nothing here carries content: family names, counts, booleans, issue numbers,

  and a document path. It answers with the same shape when the ledger is

  unreadable, so `STATUS-001`'s rule that the page renders during an incident

  still holds.

  a ref name, and a document path. It answers with the same shape when the

  ledger is unreadable, so `STATUS-001`'s rule that the page renders during an

  incident still holds.

  """

  alias OpenAgents.DataRights.ExportInventory

  alias OpenAgents.Forge.Anchor

  alias OpenAgents.Forge.AtRest

  alias OpenAgents.Forge.Pushes

  alias OpenAgents.Forge.Repos

  @schema "openagents.forge_independence.v1"

  @export_controller OpenAgentsWeb.DataController

  @account_export OpenAgents.DataRights.AccountExport

  # The ref a candidate is proven against before it is pushed: `RELEASE-004`

  # binds the full local matrix to the exact candidate sha and

  # `.githooks/pre-push` refuses a push without it, so the head of this ref is

  # the newest revision the ledger's proofs have run against.

  @proven_ref "refs/heads/main"

  @sha ~r/\A[0-9a-f]{40}\z/

  @doc "The disclosure, in the shape `/api/status` publishes it."

  @spec projection() :: map()

  def projection do

      "export" => export,

      "verification" => verification,

      "private_data" => private_data,

      "deployment" => deployment_section(),

      "document" => @document

    }

  end

    end

  end

  # How far the code answering all of the above is from the code the ledger's

  # proofs ran against. The forge hosts its own repository, so no outside

  # service is consulted: the running revision is the one this node reports as

  # deployed, the proven revision is the head of `refs/heads/main` in the bare

  # projection this node serves, and the distance between them is a `git`

  # count over objects already on disk.

  #

  # The claim is deliberately narrow. It is not "how far behind `main` this

  # forge is" — nothing here can see a `main` this node declines to serve. It

  # is "how many commits on the head this node serves the running revision does

  # not carry", which is exactly what the count establishes. A forge that will

  # not serve its own repository, a node whose bare projection is empty, and a

  # release built from a revision this forge never accepted all report `known:

  # false` and no distance, which is the same withholding `EXIT-005` and

  # `EXIT-006` already decline to detect.

  defp deployment_section, do: deployment(safely(&running_revision/0))

  @doc """

  The deployment section for a given running revision.

  Public with the revision as a parameter for the same reason `degraded?/3` is

  public: the node that runs this proof reports a build revision that is not a

  commit at all, so the projection alone can only ever exercise the branch that

  withholds. A proof that never sees a real distance cannot fail on the day one

  stops being computed.

  """

  @spec deployment(String.t() | nil) :: map()

  def deployment(revision) do

    behind = safely(fn -> commits_behind(revision) end)

    %{

      "proven_ref" => @proven_ref,

      "known" => is_integer(behind),

      "behind" => behind

    }

  end

  defp commits_behind(running) do

    with repo when is_binary(repo) <- List.first(Repos.allowed_repos()),

         storage_key = Pushes.mirror_storage_key(repo),

         true <- sha?(running),

         head when is_binary(head) <- Map.get(Repos.refs(storage_key), @proven_ref),

         true <- sha?(head) do

      count_between(storage_key, running, head)

    else

      _unknown -> nil

    end

  end

  # The same revision `/api/status` publishes for this node, so the distance

  # and the revision it is measured from can never describe different code.

  defp running_revision do

    OpenAgents.Forge.DeploymentNode.health()["revision"]

  end

  defp sha?(value), do: is_binary(value) and Regex.match?(@sha, value)

  # `running..head` counts commits reachable from the served head and not from

  # the running revision, which stays the right number when the running

  # revision is not an ancestor of it. A revision the bare projection has never

  # heard of fails the read, and a failed read claims nothing.

  defp count_between(storage_key, running, head) do

    case Repos.git(Repos.bare_path(storage_key), [

           "rev-list",

           "--count",

           "--end-of-options",

           running <> ".." <> head

         ]) do

      {output, 0} ->

        case Integer.parse(String.trim(output)) do

          {behind, ""} -> behind

          _unparsed -> nil

        end

      _unreadable ->

        nil

    end

  end

  defp operator_section do

    %{

      "model" => "single_operator",

  projection because a single operator who can read and rewrite everything is a

  fact about the service's condition, not a footnote in a document. It carries

  counts, booleans, family names, and issue numbers only, and degrades to `nil`

  like every other gather.

  like every other gather. Its `deployment` section publishes how far the code

  assembling this projection is from the head of the ref its proofs ran

  against, because a disclosure compiled 57 commits ago answers for code nobody

  is running (#187, #246).

  """

  @schema "openagents.network_status.v1"

  defp independence_text(%{"degraded" => true}), do: "degraded"

  defp independence_text(_disclosure), do: "no disclosed gap"

  # A proven invariant that is not deployed reports nothing, so the distance

  # between the two is worth a line of its own (#246). It says what it cannot

  # tell you as plainly as what it can.

  defp deployment_text(%{"known" => true, "behind" => 0, "proven_ref" => ref}),

    do: "running the head of #{ref}"

  defp deployment_text(%{"known" => true, "behind" => behind, "proven_ref" => ref})

       when is_integer(behind),

       do:

         "#{behind} #{if behind == 1, do: "commit", else: "commits"} behind #{ref}; " <>

           "an invariant proven there is not proven here"

  defp deployment_text(%{"proven_ref" => ref}),

    do: "distance from #{ref} unknown; this node serves no head it can measure against"

  defp gap_text(%{"family" => family, "status" => status, "issue" => issue})

       when is_integer(issue),

       do: "#{family} · #{status} · ##{issue}"

                  @projection["independence"]["private_data"]["issue"]

                )}

              </li>

              <li :if={@projection["independence"]["deployment"]} id="status-independence-deployment">

                deployment: {deployment_text(@projection["independence"]["deployment"])}

              </li>

            </ul>

            <ul

  alias OpenAgents.DataRights.ExportInventory

  alias OpenAgents.Forge.Anchor

  alias OpenAgents.Forge.Independence

  alias OpenAgents.Forge.Repos

  # Every string the disclosure may contain. A repository path, an account id,

  # a node name, or a commit sha reaching this projection fails here, which is

    tamper_evident

    tamper_evident_published

    /.well-known/openagents-forge-anchor.json

    refs/heads/main

    portable partial blocked not_user_data

  )

    end

  end

  describe "the disclosure publishes its own distance from the proven revision" do

    # #187 ran the forge 57 commits behind `main` for long enough for six exit

    # surfaces to be proven and absent at the same time, and every tip-shaped

    # check stayed green. The distance is the disclosure's own margin of error,

    # so it is derived from the repository this forge serves rather than

    # restated.

    setup :bare_repository

    test "the distance is the commit count between the running revision and the served head",

         %{shas: shas} do

      # Three commits on `refs/heads/main`. A node running the first is two

      # behind, a node running the head is current, and each answer is a count

      # `git` produced, not a number this test also computes by hand.

      assert %{"known" => true, "behind" => 2} = Independence.deployment(Enum.at(shas, 0))

      assert %{"known" => true, "behind" => 1} = Independence.deployment(Enum.at(shas, 1))

      assert %{"known" => true, "behind" => 0} = Independence.deployment(Enum.at(shas, 2))

    end

    test "the ref the distance is measured to is named" do

      # A distance with no ref names nothing. `RELEASE-004` binds the proof

      # matrix to the candidate sha before `.githooks/pre-push` lets it reach

      # this ref, which is what makes its head the proven revision.

      assert Independence.projection()["deployment"]["proven_ref"] == "refs/heads/main"

    end

    test "a revision this forge never accepted reports no distance" do

      assert %{"known" => false, "behind" => nil} =

               Independence.deployment(String.duplicate("a", 40))

    end

    test "a running revision that is not a commit at all reports no distance" do

      # The packaged image reports `"image"` until a deployment commits a sha.

      # That is a real state, and it must withhold rather than guess.

      assert %{"known" => false, "behind" => nil} = Independence.deployment("image")

      assert %{"known" => false, "behind" => nil} = Independence.deployment(nil)

    end

    test "a forge that does not serve its own repository reports no distance", %{shas: shas} do

      # The bound this section names. A forge withholding its own repository

      # reports nothing here, exactly as `EXIT-005` and `EXIT-006` decline to

      # detect a forge that withholds a log.

      previous = Application.get_env(:openagents, :forge_repos)

      Application.put_env(:openagents, :forge_repos, ["served-by-nobody"])

      on_exit(fn -> Application.put_env(:openagents, :forge_repos, previous) end)

      assert %{"known" => false, "behind" => nil} = Independence.deployment(Enum.at(shas, 0))

    end

    test "neither revision the distance lies between reaches the projection", %{shas: shas} do

      # `STATUS-001` keeps commit shas off this page, and adding one was among

      # the six mutations `EXIT-006`'s proof was confirmed against. A distance

      # is a number and fits; the revisions it is a distance between do not.

      published = strings(Independence.projection()) ++ strings(Independence.deployment(hd(shas)))

      for sha <- shas, published_value <- published do

        refute String.contains?(published_value, sha)

        refute String.contains?(published_value, String.slice(sha, 0, 12))

      end

    end

    test "the distance is read from the served repository rather than asserted" do

      # The same compiled-import-table read `export_recipient_encryption` uses.

      # `OpenAgents.Forge.Repos` is reached from this module for one reason —

      # counting the commits between the running revision and the served head —

      # so a hardcoded distance loses this call in the same commit.

      {:ok, {module, [imports: imports]}} =

        :beam_lib.chunks(:code.which(Independence), [:imports])

      assert module == Independence

      assert OpenAgents.Forge.Repos in Enum.map(imports, &elem(&1, 0)),

             "EXIT-006 derives the deployment distance from a git read of the repository " <>

               "this forge serves. A disclosure that stopped reading it must stop " <>

               "publishing a distance."

    end

    test "being behind is not an independence shortfall" do

      # Deliberate, and recorded in EXIT-006: a node one commit behind is not

      # less independent, and folding ordinary deploy lag into `degraded` would

      # make the verdict mean nothing on the day it mattered. The distance is

      # published beside the verdict, never inside it.

      clean_export = %{"gaps" => []}

      clean_verification = %{"anchor_published" => true, "anchor_witnessed" => true}

      clean_private_data = %{

        "export_recipient_encryption" => true,

        "encrypted_at_rest" => true

      }

      refute Independence.degraded?(clean_export, clean_verification, clean_private_data)

    end

  end

  describe "the disclosure carries no content" do

    test "every string in the projection is a family name, a status, or fixed vocabulary" do

      families = Enum.map(ExportInventory.entries(), &Atom.to_string(&1.family))

      assert body["independence"]["degraded"]

      assert body["independence"]["operator"]["model"] == "single_operator"

      refute body["independence"]["operator"]["mirror_is_authority"]

      # A check reads the distance here without rehearsing a single exit

      # surface, which is what #246 asks of this section.

      assert body["independence"]["deployment"]["proven_ref"] == "refs/heads/main"

      assert is_boolean(body["independence"]["deployment"]["known"])

    end

    test "the status page names the degraded state and every gap", %{conn: conn} do

      assert has_element?(view, "#status-independence-private-data")

      refute has_element?(view, "#status-independence-anchor-witness")

      # A person reads the distance on the page for the same reason: #187 was

      # found by hand, one surface at a time, and nothing said a word.

      assert view |> element("#status-independence-deployment") |> render() =~ "refs/heads/main"

      rendered = render(view)

      for entry <- ExportInventory.with_status(:partial) do

    end

  end

  # A bare repository this node serves, with three commits on `refs/heads/main`

  # and no working tree — the shape `OpenAgents.Forge.Repos` maintains. The

  # commits are built with plumbing so the fixture never depends on a checkout.

  defp bare_repository(_context) do

    base = Path.join(System.tmp_dir!(), "independence-#{System.unique_integer([:positive])}")

    File.mkdir_p!(base)

    previous_data = Application.get_env(:openagents, :forge_data_dir)

    previous_repos = Application.get_env(:openagents, :forge_repos)

    Application.put_env(:openagents, :forge_data_dir, base)

    Application.put_env(:openagents, :forge_repos, ["disclosure-fixture"])

    on_exit(fn ->

      restore(:forge_data_dir, previous_data)

      restore(:forge_repos, previous_repos)

      File.rm_rf(base)

    end)

    path = Repos.ensure_repo!("disclosure-fixture")

    {tree, 0} = Repos.git(path, ["hash-object", "-w", "-t", "tree", "/dev/null"])

    tree = String.trim(tree)

    shas =

      Enum.reduce(1..3, [], fn index, acc ->

        parent = if acc == [], do: [], else: ["-p", List.last(acc)]

        {sha, 0} =

          Repos.git(path, ["commit-tree", "-m", "commit #{index}", tree] ++ parent,

            env: commit_identity()

          )

        acc ++ [String.trim(sha)]

      end)

    {_output, 0} = Repos.git(path, ["update-ref", "refs/heads/main", List.last(shas)])

    %{shas: shas}

  end

  defp commit_identity do

    [

      {"GIT_AUTHOR_NAME", "proof"},

      {"GIT_AUTHOR_EMAIL", "proof@example.test"},

      {"GIT_AUTHOR_DATE", "2026-01-01T00:00:00Z"},

      {"GIT_COMMITTER_NAME", "proof"},

      {"GIT_COMMITTER_EMAIL", "proof@example.test"},

      {"GIT_COMMITTER_DATE", "2026-01-01T00:00:00Z"}

    ]

  end

  defp restore(key, nil), do: Application.delete_env(:openagents, key)

  defp restore(key, value), do: Application.put_env(:openagents, key, value)

  defp strings(value) when is_map(value), do: value |> Map.values() |> Enum.flat_map(&strings/1)

  defp strings(value) when is_list(value), do: Enum.flat_map(value, &strings/1)

  defp strings(value) when is_binary(value), do: [value]

    "generated_at",

    "independence",

    "independence.degraded",

    # The disclosure's distance from the revision its proofs ran against

    # (#246). A count and a ref name: the two revisions it lies between are

    # commit shas, which this page does not publish.

    "independence.deployment",

    "independence.deployment.behind",

    "independence.deployment.known",

    "independence.deployment.proven_ref",

    "independence.document",

    "independence.export",

    "independence.export.blocked",