coverage node before a test stops the peer.

- Added direct `RaBootstrap` decision tests for healthy, phantom, join, form,

  and wait outcomes instead of treating cluster execution as indirect proof.

Gate 0 still requires release startup proof against a disposable database and

an exact-SHA gate receipt.

- Added `ops/ci/release-smoke.sh`. It requires an explicitly acknowledged

  disposable PostgreSQL URL, generates throwaway runtime secrets, builds the

  production assets and release, starts the real release, waits for the bounded

  `/healthz` response, and terminates the release cleanly.

- Fixed `mix assets.deploy` to compile Phoenix's colocated assets before

  Tailwind resolves them. The release smoke exposed this production-only build

  failure and now passes against a fresh PostgreSQL 18 container.

Gate 0 still requires an exact-SHA gate receipt that runs and records these

completed stages from one clean commit.

Do not use the current green suite as evidence for untested code. The updated

coverage audit records strong Issues and Projects coverage and the defects it

      "assets.build": ["compile", "tailwind openagents", "esbuild openagents"],

      "assets.test": ["cmd --cd assets npm test"],

      "assets.deploy": [

        "compile",

        "tailwind openagents --minify",

        "esbuild openagents --minify",

        "phx.digest"

#!/bin/sh

set -eu

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)

repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)

release_bin="$repo_root/_build/prod/rel/openagents/bin/openagents"

database_url=${OPENAGENTS_RELEASE_SMOKE_DATABASE_URL:-}

disposable=${OPENAGENTS_RELEASE_SMOKE_DISPOSABLE:-}

port=${OPENAGENTS_RELEASE_SMOKE_PORT:-$((40000 + ($$ % 20000)))}

release_pid=

assets_digested=0

smoke_root=$(mktemp -d /tmp/openagents-release-smoke.XXXXXX)

release_log="$smoke_root/release.log"

cleanup() {

  if [ -n "$release_pid" ] && kill -0 "$release_pid" 2>/dev/null; then

    kill -TERM "$release_pid" 2>/dev/null || true

    wait "$release_pid" 2>/dev/null || true

  fi

  if [ "$assets_digested" = "1" ]; then

    (cd "$repo_root" && MIX_ENV=prod mix phx.digest.clean --all >/dev/null 2>&1) || true

  fi

  rm -rf -- "$smoke_root"

}

trap cleanup EXIT INT TERM

if [ ! -d "$repo_root/.git" ]; then

  echo "release smoke must run from a Git worktree" >&2

  exit 1

fi

if [ "$disposable" != "1" ]; then

  echo "set OPENAGENTS_RELEASE_SMOKE_DISPOSABLE=1 after you provision a disposable database" >&2

  exit 1

fi

if [ -z "$database_url" ]; then

  echo "OPENAGENTS_RELEASE_SMOKE_DATABASE_URL is required" >&2

  exit 1

fi

for command_name in curl openssl; do

  if ! command -v "$command_name" >/dev/null 2>&1; then

    echo "$command_name is required for the release smoke" >&2

    exit 1

  fi

done

cd "$repo_root"

echo "Building production assets and release"

assets_digested=1

MIX_ENV=prod mix assets.deploy

MIX_ENV=prod mix release --overwrite

secret_key_base=$(openssl rand -base64 64 | tr -d '\n')

github_token_key=$(openssl rand -base64 32 | tr -d '\n')

echo "Starting release against the disposable database"

env \

  DATABASE_URL="$database_url" \

  GITHUB_CLIENT_ID="release-smoke-client" \

  GITHUB_CLIENT_SECRET="release-smoke-secret" \

  GITHUB_REDIRECT_URI="https://127.0.0.1/auth/github/callback" \

  GITHUB_TOKEN_ENCRYPTION_KEY="$github_token_key" \

  PHX_HOST="127.0.0.1" \

  PHX_SERVER="true" \

  POOL_SIZE="2" \

  PORT="$port" \

  SECRET_KEY_BASE="$secret_key_base" \

  "$release_bin" start >"$release_log" 2>&1 &

release_pid=$!

health_url="http://127.0.0.1:$port/healthz"

health_body=

for attempt in $(seq 1 120); do

  if ! kill -0 "$release_pid" 2>/dev/null; then

    echo "release exited before it became healthy" >&2

    tail -40 "$release_log" >&2

    exit 1

  fi

  if health_body=$(curl --fail --silent --show-error --max-time 2 "$health_url" 2>/dev/null); then

    break

  fi

  sleep 0.5

done

case "$health_body" in

  *'"status":"ok"'*) ;;

  *)

    echo "release did not return the expected bounded health response" >&2

    tail -40 "$release_log" >&2

    exit 1

    ;;

esac

kill -TERM "$release_pid"

wait "$release_pid"

release_pid=

echo "Release startup smoke passed"