- Replaced Ra's captured session-query functions with stable

  module-function-argument descriptors. The cluster suite now runs under

  coverage without a peer crashing on an instrumented function identity.

- Merged the default and cluster coverage exports locally. The combined result

  is 83.37%; the exact-SHA receipt and enforced floor remain pending.

Gate 0 still requires an enforced coverage floor, release startup proof against

a disposable database, and an exact-SHA gate receipt.

- Merged the default and cluster coverage exports locally. The current combined

  result is 83.58% from 1,222 default tests and all 9 cluster tests.

- Added `ops/ci/coverage.sh` to discard stale exports, run both suites with

  warnings as errors, collect execution from distributed peers, merge both

  exports, and enforce an initial 83% floor. Raise the floor as direct recovery

  and release-path tests land. Do not lower it to admit a candidate.

- Added coverage-aware peer shutdown so peer execution flushes back to the main

  coverage node before a test stops the peer.

- Added direct `RaBootstrap` decision tests for healthy, phantom, join, form,

  and wait outcomes instead of treating cluster execution as indirect proof.

Gate 0 still requires release startup proof against a disposable database and

an exact-SHA gate receipt.

Do not use the current green suite as evidence for untested code. The updated

coverage audit records strong Issues and Projects coverage and the defects it

The first merged coverage attempt also exposed an instrumented anonymous Ra

query that crashed on a peer with `badfun`. Session-registry queries now use

stable module-function-argument descriptors, and all 9 cluster tests complete

under coverage. The merged default and cluster result is 83.37%.

under coverage. Coverage-aware peer shutdown now collects remote execution, and

direct `RaBootstrap` decision tests cover the previously untested worker. The

merged default and cluster result is 83.58% and passes the enforced 83% floor.

## A2. Blocker: staging is not isolated from production today

    # The cluster's member set as seen by a peer (survives our local server

    # being down — the phantom-member case after an ungraceful restart).

    peer_members = discover_members(connected -- [node()])

    members = if local_members != [], do: local_members, else: peer_members

    cond do

      # Healthy: our local server is up and we are a member.

      node() in local_members ->

    case convergence_action(node(), connected, local_members, peer_members, expected) do

      # Healthy: the local server is up and is a member.

      :healthy ->

        :ok

      # Phantom: peers still list us as a member but our local Raft server is

      # not running (ungraceful restart lost the tmpfs data dir). Restart it so

      # it rejoins and catches up, instead of sitting as a dead config entry.

      node() in peer_members ->

        _ = Ra.ensure_local_server(peer_members)

      {:restart_local, known_members} ->

        _ = Ra.ensure_local_server(known_members)

        Logger.info("ra_bootstrap: restarted phantom local server (#{node()})")

      # Cluster is formed elsewhere but we are not in it yet: join through an

      # existing member (add_member + start our local server).

      members != [] ->

        via = Enum.find(members, &(&1 in connected)) || hd(members)

      {:join, via} ->

        case Ra.join(via) do

          {:ok, _, _} -> Logger.info("ra_bootstrap: joined cluster via #{via} (#{node()})")

          :ok -> Logger.info("ra_bootstrap: joined cluster via #{via} (#{node()})")

        end

      # No cluster yet. The coordinator forms it once a majority is present.

      coordinator?(connected) and majority?(length(connected), expected) ->

        case Ra.start_cluster(connected) do

      {:form, formation_nodes} ->

        case Ra.start_cluster(formation_nodes) do

          {:ok, started} ->

            Logger.info("ra_bootstrap: formed cluster across #{inspect(started)}")

            :ok

        end

      true ->

      :wait ->

        :ok

    end

  rescue

      :ok

  end

  @doc false

  def convergence_action(local_node, connected, local_members, peer_members, expected) do

    members = if local_members != [], do: local_members, else: peer_members

    cond do

      local_node in local_members ->

        :healthy

      local_node in peer_members ->

        {:restart_local, peer_members}

      members != [] ->

        via = Enum.find(members, &(&1 in connected)) || hd(members)

        {:join, via}

      coordinator?(local_node, connected) and majority?(length(connected), expected) ->

        {:form, connected}

      true ->

        :wait

    end

  end

  # We are the coordinator iff we are the lowest-named connected node — a stable,

  # coordinator-free way to pick exactly one former.

  defp coordinator?(connected), do: node() == Enum.min(connected)

  defp coordinator?(local_node, connected), do: local_node == Enum.min(connected)

  defp majority?(present, expected), do: present * 2 > expected

      elixirc_paths: elixirc_paths(Mix.env()),

      start_permanent: Mix.env() == :prod,

      aliases: aliases(),

      test_coverage: [summary: [threshold: 83.0], local_only: false],

      deps: deps(),

      compilers: [:appup, :phoenix_live_view] ++ Mix.compilers(),

      appup: "rel/openagents.appup.exs",

#!/bin/sh

set -eu

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)

coverage_dir="$repo_root/cover"

if [ ! -d "$repo_root/.git" ]; then

  echo "coverage gate must run from a Git worktree" >&2

  exit 1

fi

case "$coverage_dir" in

  "$repo_root/cover") ;;

  *)

    echo "refusing to clean an unexpected coverage path" >&2

    exit 1

    ;;

esac

# Coverage exports are cumulative. Remove the generated directory before both

# runs so an old partition cannot make the current report look better.

rm -rf -- "$coverage_dir"

cd "$repo_root"

MIX_ENV=test mix test --warnings-as-errors --cover --export-coverage default

MIX_ENV=test mix test --warnings-as-errors --only cluster --cover --export-coverage cluster

MIX_ENV=test mix test.coverage

      :peer.start_link(%{

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        shutdown: OpenAgents.Test.RemoteCover.shutdown(),

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

      :peer.start_link(%{

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        shutdown: OpenAgents.Test.RemoteCover.shutdown(),

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

defmodule OpenAgents.Cluster.RaBootstrapTest do

  use ExUnit.Case, async: true

  alias OpenAgents.Cluster.RaBootstrap

  test "keeps a healthy local member unchanged" do

    assert :healthy =

             RaBootstrap.convergence_action(

               :node1@host,

               [:node1@host, :node2@host],

               [:node1@host, :node2@host],

               [:node1@host, :node2@host],

               3

             )

  end

  test "restarts a phantom local member from the peer membership" do

    peer_members = [:node1@host, :node2@host, :node3@host]

    assert {:restart_local, ^peer_members} =

             RaBootstrap.convergence_action(

               :node1@host,

               peer_members,

               [],

               peer_members,

               3

             )

  end

  test "joins through a reachable member of an existing cluster" do

    assert {:join, :node2@host} =

             RaBootstrap.convergence_action(

               :node1@host,

               [:node1@host, :node2@host],

               [],

               [:node3@host, :node2@host],

               3

             )

  end

  test "forms only when the local node is coordinator and a majority is present" do

    connected = [:node1@host, :node2@host]

    assert {:form, ^connected} =

             RaBootstrap.convergence_action(:node1@host, connected, [], [], 3)

    assert :wait =

             RaBootstrap.convergence_action(:node2@host, connected, [], [], 3)

    assert :wait =

             RaBootstrap.convergence_action(:node1@host, [:node1@host], [], [], 3)

  end

end

    base = %{

      name: unique_peer_name(name),

      host: ~c"127.0.0.1",

      shutdown: OpenAgents.Test.RemoteCover.shutdown(),

      args: [~c"-setcookie", Atom.to_charlist(cookie)]

    }

          name: short_name,

          host: ~c"127.0.0.1",

          user: %{},

          shutdown: OpenAgents.Test.RemoteCover.shutdown(),

          args:

            [

              ~c"-setcookie",

      :peer.start_link(%{

        name: unique_peer_name(name),

        host: ~c"127.0.0.1",

        shutdown: OpenAgents.Test.RemoteCover.shutdown(),

        args: [~c"-setcookie", Atom.to_charlist(cookie)]

      })

defmodule OpenAgents.Test.RemoteCover do

  @moduledoc false

  def shutdown do

    case Process.whereis(:cover_server) do

      nil -> 5_000

      _pid -> {10_000, node()}

    end

  end

end