ARG OPENCODE_VERSION

ARG DEBIAN_SNAPSHOT

ARG SOURCE_DATE_EPOCH=0

# Geist TTFs for server-side image rendering (Open Graph cards). The web

# ships the same faces as woff2; librsvg reads system fonts through

# fontconfig, so the release image carries the pinned release's static weights.

ARG GEIST_FONT_VERSION=1.7.2

ARG GEIST_FONT_SHA256=7fc800d2ac6b92844895196e5041aca55d814c15db70c44f79b3b83ab82b04e2

ARG GEIST_REGULAR_SHA256=5c8968eafb98a4c4f47033daf29e38e284a6f2a82eb017d171ab040fe7c4b615

ARG GEIST_MEDIUM_SHA256=0090e004725f6f64b841715b4167920580f883fcf9b67fc6d744089103fec101

ARG GEIST_SEMIBOLD_SHA256=612ec98df33935354f39e81e54101656961ab6e5549f64b63eb57868ba7bab8d

ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}

RUN sed -i \

      /etc/apt/sources.list.d/debian.sources \

  && printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99snapshot \

  && apt-get update \

  && apt-get install -y --no-install-recommends libstdc++6 openssl libncurses6 locales ca-certificates curl git \

  && apt-get install -y --no-install-recommends libstdc++6 openssl libncurses6 locales ca-certificates curl git unzip fontconfig librsvg2-bin \

  && rm -rf /var/lib/apt/lists/*

# Server-side image rendering (Open Graph cards) reads system fonts through

# fontconfig. The CSS declares the family as "Geist Sans" while the TTFs'

# internal name is "Geist", so the alias below keeps librsvg on-brand without

# touching the web font stack. Zip and extracted-file digests are both checked.

RUN set -eu; \

  archive="geist-font-v${GEIST_FONT_VERSION}.zip"; \

  curl -fsSL --retry 3 -o "/tmp/${archive}" \

    "https://github.com/vercel/geist-font/releases/download/v${GEIST_FONT_VERSION}/${archive}"; \

  echo "${GEIST_FONT_SHA256}  /tmp/${archive}" | sha256sum --check --strict; \

  install -d -m 0755 /usr/local/share/fonts/geist; \

  unzip -q -j "/tmp/${archive}" \

    "geist-font/Geist/ttf/Geist-Regular.ttf" \

    "geist-font/Geist/ttf/Geist-Medium.ttf" \

    "geist-font/Geist/ttf/Geist-SemiBold.ttf" \

    -d /usr/local/share/fonts/geist; \

  rm "/tmp/${archive}"; \

  cd /usr/local/share/fonts/geist; \

  printf '%s  %s\n' \

    "${GEIST_REGULAR_SHA256}" "Geist-Regular.ttf" \

    "${GEIST_MEDIUM_SHA256}" "Geist-Medium.ttf" \

    "${GEIST_SEMIBOLD_SHA256}" "Geist-SemiBold.ttf" \

    | sha256sum --check --strict; \

  printf '%s\n' \

    '<?xml version="1.0"?>' \

    '<!DOCTYPE fontconfig SYSTEM "fonts.dtd">' \

    '<fontconfig>' \

    '  <match target="pattern">' \

    '    <test qual="any" name="family"><string>Geist Sans</string></test>' \

    '    <edit name="family" mode="assign" binding="same"><string>Geist</string></edit>' \

    '  </match>' \

    '</fontconfig>' \

    > /etc/fonts/local.conf; \

  fc-cache -f >/dev/null; \

  fc-match --format '%{family}\n' 'Geist Sans' | grep -qx 'Geist'; \

  rsvg-convert --version

# Codex, for the SCV deployment lane (SCV-001), pinned by version and

# checksum like every other external artifact in this image.

RUN set -eu; \

  case "${TARGETARCH:-$(dpkg --print-architecture)}" in \

    amd64) codex_arch=x86_64; checksum=bd758d53d56e41dc65e045f4589df79a038ed197a011adcb52a258e6ad64cfda ;; \

      _invalid -> raise "environment variable OPENAGENTS_FORGE_ROLLING_PROVIDER is not admitted"

    end

  # Optional one-way GitHub mirrors, keyed by bare repository name. URLs must

  # stay credential-free (RuntimeConfig enforces it): authentication belongs

  # to the nodes' git credential helper or SSH key, never to this value.

  forge_mirror_urls =

    case optional_text.("OPENAGENTS_FORGE_MIRROR_URLS_JSON") do

      nil ->

        %{}

      encoded ->

        case Jason.decode(encoded) do

          {:ok, urls} when is_map(urls) and map_size(urls) >= 0 ->

            valid? = Enum.all?(urls, fn {repo, url} -> is_binary(repo) and is_binary(url) end)

            if valid? do

              Map.new(urls, fn {repo, url} -> {repo, url} end)

            else

              raise "environment variable OPENAGENTS_FORGE_MIRROR_URLS_JSON must map repository names to credential-free git URL strings"

            end

          _invalid ->

            raise "environment variable OPENAGENTS_FORGE_MIRROR_URLS_JSON must be a JSON object from repository name to credential-free git URL"

        end

    end

  rolling_instances =

    case optional_text.("OPENAGENTS_GCP_ROLLING_INSTANCES_JSON") do

      nil ->

    forge_public_paths: Map.new(forge_repos, &{&1, []}),

    forge_internal_git_url: required_text.("OPENAGENTS_FORGE_INTERNAL_GIT_URL"),

    forge_operator_token: optional_text.("OPENAGENTS_FORGE_OPERATOR_TOKEN"),

    forge_mirror_urls: forge_mirror_urls,

    forge_data_dir: required_text.("OPENAGENTS_FORGE_DATA_DIR"),

    forge_build_dir: required_text.("OPENAGENTS_FORGE_BUILD_DIR"),

    forge_build_queue_dir: required_text.("OPENAGENTS_FORGE_BUILD_QUEUE_DIR"),

Status: Implemented. Meta tags ship on every public page; the signed,

content-versioned card endpoint serves repository, issue, blob, and commit

cards; rasterization runs through librsvg with a committed fallback card when

the binary is absent. One operations requirement remains: fleet images need

`librsvg2-bin` (and, for exact brand type, the Geist TTFs) installed — until

then nodes serve the fallback card by design.

the binary is absent. The release image carries librsvg, fontconfig, and the

pinned Geist TTFs; dynamic cards render wherever a rebuilt image runs.

## What links to our pages look like today

Remaining operations work, tracked here so it cannot be forgotten:

* Add `librsvg2-bin` (and optionally the Geist TTF faces) to the release

  image. Until that lands, production nodes serve the fallback card for all

  dynamic URLs — correct, branded, but generic.

* The release image now carries `librsvg2-bin`, `fontconfig`, and the pinned

  Geist TTFs (v1.7.2, zip and per-file digests checked in the Dockerfile) with

  a fontconfig alias from the CSS family name "Geist Sans" to the files'

  internal name "Geist". Dynamic cards render on any node running a rebuilt

  image; deploy the rebuilt image and the staging check below goes green.

* The staging check should assert a dynamic card URL returns bytes other

  than the committed fallback, proving rasterization end to end.

| `OPENAGENTS_FORGE_OWNER` | Exactly `OpenAgentsInc` |

| `OPENAGENTS_FORGE_INTERNAL_GIT_URL` | HTTP(S) service URL with no embedded credentials |

| `OPENAGENTS_FORGE_OPERATOR_TOKEN` | Secret required when the forge is enabled; empty while disabled |

| `OPENAGENTS_FORGE_MIRROR_URLS_JSON` | Optional JSON object from repository name to credential-free git mirror URL; empty disables one-way GitHub mirroring |

| `OPENAGENTS_FORGE_BUILD_EXECUTOR` | `sidecar` |

| `OPENAGENTS_FORGE_ARTIFACT_STORE` | `local` until the durable store gate replaces it |

| `OPENAGENTS_FORGE_WAL_ADAPTER` | `local` or `gcs` |

records returned by `DNS_CLUSTER_QUERY`. The readiness report records only

whether those settings passed; it never prints their values.

### Forge GitHub mirroring

Setting `OPENAGENTS_FORGE_MIRROR_URLS_JSON` turns on one-way mirroring: every

accepted forge push is followed by a best-effort `git push --mirror` to the

configured URL, and `OpenAgents.Forge.MirrorWatch` compares refs every five

minutes, retries drift, and raises one `forge_mirror_lagging` incident per lag

episode past fifteen minutes. Mirror freshness appears on the public status

page as `current` or `lagging`; with no URLs configured it reads `off`.

Two rules are load-bearing:

1. **The URL carries no credential.** RuntimeConfig refuses mirror URLs that

   embed userinfo. Authentication belongs to the nodes: give each fleet node

   a read-write GitHub credential through a git credential helper or an SSH

   deploy key for the target repository. The mirror push runs as the same

   user as the release.

2. **The mirror is force-pushed.** `--mirror` makes the configured remote

   exactly match the forge. Configure it only on a repository you accept

   being overwritten by forge state — for this project, GitHub's

   `OpenAgentsInc/openagents.com`.

Staging receives the value through the optional

`forge_mirror_urls_json` Terraform variable; production sets the environment

variable directly in its fleet configuration.

## Local defaults

Development and test remain sanctioned degraded modes: the database may use a

    openagents-runtime-secret = google_secret_manager_secret.runtime["openagents-staging-fleet-config"].secret_id

    openagents-builder-secret = google_secret_manager_secret.runtime["openagents-staging-builder-config"].secret_id

    startup-script = templatefile("${path.module}/templates/fleet-startup.sh.tftpl", {

      network_cidr = var.network_cidr

      project_id   = var.staging_project_id

      region       = var.region

      network_cidr           = var.network_cidr

      project_id             = var.staging_project_id

      region                 = var.region

      forge_mirror_urls_json = var.forge_mirror_urls_json

    })

  }

RELEASE_NODE=openagents@$instance_ip

EOF

# Optional one-way GitHub mirrors, keyed by repository name. The value is

# deployment policy (credential-free URLs by construction -- RuntimeConfig

# refuses anything else), so it rides the plain environment when the

# operator sets it.

if [ -n "${forge_mirror_urls_json}" ]; then

  echo "OPENAGENTS_FORGE_MIRROR_URLS_JSON=${forge_mirror_urls_json}" >>/run/openagents/runtime.env

fi

export DOCKER_CONFIG=/run/openagents/docker-config

mkdir -p "$DOCKER_CONFIG"

chmod 0700 "$DOCKER_CONFIG"

  type        = map(string)

  default     = {}

}

variable "forge_mirror_urls_json" {

  description = "Optional JSON object from repository name to credential-free git mirror URL (e.g. {\"openagents.com\":\"https://github.com/OpenAgentsInc/openagents.com.git\"}). Empty disables mirroring."

  type        = string

  default     = ""

}

# and the divergence stays invisible until a clone disagrees with the site.

#

# The forge can mirror `main` to GitHub (`OpenAgents.Forge.Pushes.mirror_now/1`,

# watched by `OpenAgents.Forge.MirrorWatch`), but `:forge_mirror_urls` is empty

# in `config/config.exs` and no environment sets it, so no mirror runs today.

# Until one is configured, GitHub receives only what someone pushes to it, and

# `mirror_now/1` is a `git push --mirror` -- a force push -- so a configured

# mirror would overwrite whatever a direct push left there.

# watched by `OpenAgents.Forge.MirrorWatch`): an operator sets

# `OPENAGENTS_FORGE_MIRROR_URLS_JSON` for the environment and every forge push

# is mirrored one-way, with lag detection on the status page. Until that

# variable is set, GitHub receives only what someone pushes to it, and

# `mirror_now/1` is a `git push --mirror` -- a force push -- so configuring it

# makes the mirror authoritative over whatever a direct push left there.

#

# Git hands a pre-push hook the remote's name and URL on argv. Called directly,

# take the same two arguments; a name alone is resolved through `git remote`.

    startup = File.read!("infra/staging/templates/fleet-startup.sh.tftpl")

    outputs = File.read!("infra/staging/outputs.tf")

    assert terraform =~ "network_cidr = var.network_cidr"

    assert terraform =~ ~s(network_cidr           = var.network_cidr)

    assert startup =~ "instance_ip=$(metadata instance/network-interfaces/0/ip)"

    assert startup =~ ~s(iptables -C INPUT -s "${network_cidr}")

    assert startup =~ "--dports 4000,4369,9100:9115 -j ACCEPT"

    assert outputs =~ ~s("openagents@${instance_ip}" => instance_name)

  end

  test "the optional forge mirror rides the fleet environment untouched" do

    variables = File.read!("infra/staging/variables.tf")

    terraform = File.read!("infra/staging/main.tf")

    startup = File.read!("infra/staging/templates/fleet-startup.sh.tftpl")

    # Deployment policy, not a secret: the JSON carries credential-free URLs

    # only (RuntimeConfig refuses userinfo), so it flows as plain env.

    assert variables =~ "forge_mirror_urls_json"

    assert terraform =~ "forge_mirror_urls_json = var.forge_mirror_urls_json"

    assert startup =~ "OPENAGENTS_FORGE_MIRROR_URLS_JSON=${forge_mirror_urls_json}"

  end

  test "IAP SSH reaches the fleet and deploy controller" do

    terraform = File.read!("infra/staging/main.tf")