question with an answer, and `OpenAgents.Forge.Verification` computes it from

the WAL and the repository alone.

Independence here is structural, not a promise: a verifier that queried

PostgreSQL would be asking the operator to confirm the operator. The proof reads

the module's compiled import table and fails on a call into `OpenAgents.Repo`,

Ecto, or Postgrex, so the property cannot decay through an added convenience.

The verifier accepts either a `Repository.storage_key` or an `owner/name` path.

An `owner/name` path is resolved to a storage key through the same repository

mapping the serving path uses, and only the resolved key is checked against the

WAL. The report names both the requested path and the resolved key so an operator

sees the mapping.

Independence here is structural, not a promise: the WAL-and-repository check

itself reaches no database, because a verifier that queried PostgreSQL for the

log or the bare repository would be asking the operator to confirm the operator.

The `owner/name` resolution does query the repository table, but it is a

separate, exercised step. The proof reads the module's compiled import table and

fails on a call into `OpenAgents.Repo`, Ecto, or Postgrex, so the property

cannot decay through an added convenience.

Five disagreements are distinct findings, and each is exercised by breaking it.

An entry the store cannot produce is `entry_object_missing`. An entry whose

  only an operator who serves something other than what was pushed.

  """

  alias OpenAgents.Forge.{Repos, WAL}

  alias OpenAgents.Forge.{ReceiptRepository, Repos, WAL}

  @internal_ref_prefix "refs/internal/"

  @typedoc "The verification outcome for one repository."

  @type report :: %{

          repo: String.t(),

          storage_key: String.t() | nil,

          entries: non_neg_integer(),

          findings: [finding()],

          head: anchor() | nil,

  sequence predate the chain and are not covered by it.

  """

  @spec verify(String.t(), keyword()) :: {:ok, report()} | {:error, report()}

  def verify(storage_key, opts \\ []) when is_binary(storage_key) and is_list(opts) do

    case WAL.read_index(storage_key) do

      {:ok, _generation, index} ->

        entries = WAL.entries(index)

        findings =

          sequence_findings(entries) ++

            entry_findings(storage_key, entries) ++

            ref_findings(storage_key, index) ++

            object_findings(storage_key, entries) ++

            reachability_findings(storage_key, index) ++

            chain_findings(entries) ++

            anchor_findings(entries, normalize_anchor(opts[:anchor]))

        report(storage_key, entries, findings)

      {:error, reason} ->

        report(storage_key, [], [finding("wal_unreadable", %{"reason" => inspect(reason)})])

  def verify(repo_or_path, opts \\ []) when is_binary(repo_or_path) and is_list(opts) do

    {repo, storage_key} = resolve_repo_or_path(repo_or_path)

    if is_nil(storage_key) do

      report(repo, nil, [], [finding("repository_not_found", %{"repo" => repo})])

    else

      case WAL.read_index(storage_key) do

        {:ok, _generation, index} ->

          entries = WAL.entries(index)

          findings =

            sequence_findings(entries) ++

              entry_findings(storage_key, entries) ++

              ref_findings(storage_key, index) ++

              object_findings(storage_key, entries) ++

              reachability_findings(storage_key, index) ++

              chain_findings(entries) ++

              anchor_findings(entries, normalize_anchor(opts[:anchor]))

          report(repo, storage_key, entries, findings)

        {:error, reason} ->

          report(repo, storage_key, [], [

            finding("wal_unreadable", %{"reason" => inspect(reason)})

          ])

      end

    end

  end

  defp resolve_repo_or_path(repo) when is_binary(repo) do

    if String.contains?(repo, "/") do

      case ReceiptRepository.resolve(repo) do

        %{storage_key: storage_key} -> {repo, storage_key}

        nil -> {repo, nil}

      end

    else

      {repo, repo}

    end

  end

  defp report(storage_key, entries, findings) do

  defp report(repo, storage_key, entries, findings) do

    report = %{

      repo: storage_key,

      repo: repo,

      storage_key: storage_key,

      entries: length(entries),

      findings: findings,

      head: head(entries),

        refute match?("Postgrex" <> _rest, inspect(module))

      end

    end

    test "an owner/name path resolves to the same report as its storage key", context do

      seed_history!(context)

      assert {:ok, by_key} = Verification.verify(context.repo)

      assert {:ok, by_name} = Verification.verify("exit-owner/demo")

      assert by_name.repo == "exit-owner/demo"

      assert by_name.storage_key == context.repo

      assert by_key.entries == by_name.entries

      assert by_key.head == by_name.head

      assert by_key.findings == []

      assert by_name.findings == []

    end

    test "an unknown owner/name returns a repository_not_found finding", _context do

      {:error, result} = Verification.verify("exit-owner/no-such-repo")

      assert result.repo == "exit-owner/no-such-repo"

      assert result.storage_key == nil

      assert result.entries == 0

      assert [%{code: "repository_not_found", detail: %{"repo" => "exit-owner/no-such-repo"}}] =

               result.findings

    end

  end

  ## ── EXIT-005: each entry commits to the entry before it ────────────────