gateway reference. The claimant can export the full receipt, including their own

destination, without a hosted wallet.

Evidence: `OpenAgents.Settlement`, `OpenAgents.Settlement.PaymentGateway`, its

seven append-only schemas with their uniqueness and partial-uniqueness

Evidence: `OpenAgents.Settlement`, `OpenAgents.Settlement.PaymentGateway`, the

settlement schemas and tables, with their uniqueness and partial-uniqueness

constraints, and the pricing, claim, verification, duplicate, stale-commit,

approval, budget, retry, reconciliation, expiry, dispute, refund, privacy, and

receipt-export cases in `test/openagents/settlement_test.exs`.

defmodule OpenAgents.CompensationFenceTest do

  @moduledoc """

  COMPENSATION-001 and append-only invariants, at the database. Every claim

  bypasses the Ecto changeset and writes raw SQL, because the property is that

  PostgreSQL refuses the row or mutation — not that the application declines

  to build it.

  """

  use OpenAgents.DataCase, async: false

  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  alias OpenAgents.Conversations

  alias OpenAgents.Repo

  describe "compensation policies can never grant payout authority" do

    test "a policy receipt with payout_authority true is refused" do

      assert {:error, %Postgrex.Error{} = error} =

               Repo.query(

                 """

                 INSERT INTO compensation_policy_receipts

                   (id, policy_id, version, policy_digest, rules, actor_id, auth_method, approval_receipt_ref, inserted_at)

                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)

                 """,

                 [

                   uuid(Ecto.UUID.generate()),

                   "sarah.compensation.accounting.v1",

                   1,

                   hex(),

                   %{"payout_authority" => true},

                   "operator:test",

                   "test_session",

                   "approval:policy:payout:#{System.unique_integer([:positive])}",

                   now()

                 ]

               )

      assert error.postgres.constraint == "compensation_policy_no_payout"

    end

  end

  describe "compensation accounting tables are append-only" do

    setup do

      user = github_user("compensation-fence-#{System.unique_integer([:positive])}")

      {:ok, conversation} = Conversations.ensure_conversation(user)

      {:ok, %{turn: turn}} = Conversations.create_turn(conversation, "Use a module.")

      tool_step = setup_tool_step!(turn)

      policy = insert_policy!()

      allocation = insert_module_allocation!(policy)

      outcome_decision = insert_outcome_decision!(tool_step)

      event = insert_event!(tool_step, policy, outcome_decision)

      share = insert_share!(event)

      adjustment = insert_adjustment!(policy, event)

      statement = insert_statement!(policy)

      %{

        rows: %{

          "compensation_policy_receipts" => policy,

          "compensation_module_allocations" => allocation,

          "compensation_outcome_decisions" => outcome_decision,

          "compensation_events" => event,

          "compensation_shares" => share,

          "compensation_adjustments" => adjustment,

          "compensation_statements" => statement

        }

      }

    end

    test "compensation_policy_receipts rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_policy_receipts", rows)

    end

    test "compensation_module_allocations rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_module_allocations", rows)

    end

    test "compensation_outcome_decisions rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_outcome_decisions", rows)

    end

    test "compensation_events rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_events", rows)

    end

    test "compensation_shares rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_shares", rows)

    end

    test "compensation_adjustments rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_adjustments", rows)

    end

    test "compensation_statements rejects update and delete", %{rows: rows} do

      assert_rejects_mutation("compensation_statements", rows)

    end

  end

  defp assert_rejects_mutation(table, rows) do

    id = Map.fetch!(rows, table)

    assert {:error, %Postgrex.Error{} = update_error} =

             Repo.query("UPDATE #{table} SET id = id WHERE id = $1", [id])

    assert update_error.postgres.message =~ "#{table} is append-only"

    assert {:error, %Postgrex.Error{} = delete_error} =

             Repo.query("DELETE FROM #{table} WHERE id = $1", [id])

    assert delete_error.postgres.message =~ "#{table} is append-only"

  end

  defp setup_tool_step!(turn) do

    now = now()

    turn_id = uuid(turn.id)

    receipt_id = insert_turn_receipt!(turn_id, now)

    insert_tool_step!(turn_id, receipt_id, now)

  end

  defp insert_turn_receipt!(turn_id, now) do

    insert!(

      """

      INSERT INTO turn_receipts

        (id, turn_id, model_id, persona_id, persona_digest, role_id, role_digest,

         instruction_digest, input_digest, input_message_count, input_bytes,

         provider_started_at, inserted_at, updated_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        turn_id,

        "test-model",

        "test-persona",

        hex(),

        "test-role",

        hex(),

        hex(),

        hex(),

        0,

        0,

        now,

        now,

        now

      ]

    )

  end

  defp insert_tool_step!(turn_id, turn_receipt_id, now) do

    insert!(

      """

      INSERT INTO turn_tool_steps

        (id, turn_id, turn_receipt_id, sequence, provider_call_id, provider_item_id,

         provider_response_id, tool_name, tool_version, module_id, side_effect_class,

         invocation_key, catalog_digest, raw_arguments, argument_digest, requested_at,

         inserted_at, updated_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        turn_id,

        turn_receipt_id,

        1,

        "call-#{System.unique_integer([:positive])}",

        "item-#{System.unique_integer([:positive])}",

        "response-#{System.unique_integer([:positive])}",

        "host",

        1,

        "sarah.host",

        "read_only",

        hex(),

        hex(),

        "{}",

        hex(),

        now,

        now,

        now

      ]

    )

  end

  defp insert_policy! do

    insert!(

      """

      INSERT INTO compensation_policy_receipts

        (id, policy_id, version, policy_digest, rules, actor_id, auth_method, approval_receipt_ref, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        "sarah.compensation.accounting.v1",

        1,

        hex(),

        %{"payout_authority" => false},

        "operator:test",

        "test_session",

        "approval:policy:valid:#{System.unique_integer([:positive])}",

        now()

      ]

    )

  end

  defp insert_module_allocation!(policy_id) do

    insert!(

      """

      INSERT INTO compensation_module_allocations

        (id, policy_receipt_id, module_id, module_version, artifact_digest, contribution_ref,

         allocation_ppm, lineage_digest, actor_id, approval_receipt_ref, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        policy_id,

        "sarah.host",

        1,

        hex(),

        "OpenAgentsInc/openagents.com",

        1_000_000,

        hex(),

        "operator:test",

        "approval:allocation:#{System.unique_integer([:positive])}",

        now()

      ]

    )

  end

  defp insert_outcome_decision!(tool_step_id) do

    insert!(

      """

      INSERT INTO compensation_outcome_decisions

        (id, tool_step_id, invocation_key, outcome_receipt_ref, outcome_digest, decision,

         reason_code, actor_id, auth_method, decision_receipt_ref, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        tool_step_id,

        hex(),

        "outcome:decision:#{System.unique_integer([:positive])}",

        hex(),

        "accepted",

        "verified_outcome",

        "outcome-reviewer:test",

        "test_session",

        "approval:decision:#{System.unique_integer([:positive])}",

        now()

      ]

    )

  end

  defp insert_event!(tool_step_id, policy_id, outcome_decision_id) do

    insert!(

      """

      INSERT INTO compensation_events

        (id, tool_step_id, policy_receipt_id, outcome_decision_id, module_id, module_version,

         artifact_digest, invocation_key, outcome_receipt_ref, technical_units, eligible_units,

         classification, reason_code, event_digest, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        tool_step_id,

        policy_id,

        outcome_decision_id,

        "sarah.host",

        1,

        hex(),

        hex(),

        "outcome:event:#{System.unique_integer([:positive])}",

        0,

        0,

        "ineligible",

        "outcome_rejected",

        hex(),

        now()

      ]

    )

  end

  defp insert_share!(event_id) do

    insert!(

      """

      INSERT INTO compensation_shares

        (id, event_id, contribution_ref, allocation_ppm, allocated_units, share_digest, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        event_id,

        "OpenAgentsInc/openagents.com",

        1_000_000,

        0,

        hex(),

        now()

      ]

    )

  end

  defp insert_adjustment!(policy_id, event_id) do

    insert!(

      """

      INSERT INTO compensation_adjustments

        (id, event_id, policy_receipt_id, contribution_ref, kind, delta_units, reason_code,

         actor_id, auth_method, adjustment_receipt_ref, adjustment_digest, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        event_id,

        policy_id,

        "OpenAgentsInc/openagents.com",

        "refund",

        -10,

        "customer_refund",

        "operator:test",

        "test_session",

        "approval:adjustment:#{System.unique_integer([:positive])}",

        hex(),

        now()

      ]

    )

  end

  defp insert_statement!(policy_id) do

    now = now()

    insert!(

      """

      INSERT INTO compensation_statements

        (id, policy_receipt_id, contribution_ref, cutoff_at, gross_units, adjustment_units,

         net_units, event_count, state, statement_digest, actor_id, statement_receipt_ref, inserted_at)

      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)

      RETURNING id

      """,

      [

        uuid(Ecto.UUID.generate()),

        policy_id,

        "OpenAgentsInc/openagents.com",

        now,

        100,

        -50,

        50,

        1,

        "reconciled",

        hex(),

        "operator:test",

        "approval:statement:#{System.unique_integer([:positive])}",

        now

      ]

    )

  end

  defp insert!(sql, params) do

    %{rows: [[id]]} = Repo.query!(sql, params)

    id

  end

  defp uuid(value), do: Ecto.UUID.dump!(value)

  defp now, do: DateTime.utc_now()

  defp hex, do: String.duplicate("0", 64)

end

defmodule OpenAgents.Effects.DatabaseConstraintsTest do

  @moduledoc """

  EFFECT-001, at the database: the CHECK constraints on `effects` reject

  malformed rows even when the insert bypasses the application changeset.

  """

  use OpenAgents.DataCase, async: false

  alias OpenAgents.Repo

  @insert_effects """

  INSERT INTO effects

    (id, kind, payload, payload_digest, source_kind, source_id, idempotency_key,

     status, attempts, maximum_attempts, available_at,

     lease_owner, lease_expires_at, claimed_at, completed_at, last_error,

     inserted_at, updated_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,

          $12, $13, $14, $15, $16, $17, $18)

  """

  setup do

    base = %{

      id: uuid(),

      kind: "test.kind",

      payload: %{},

      payload_digest: "sha256:" <> String.duplicate("0", 64),

      source_kind: "test_source",

      source_id: uuid_string(),

      idempotency_key: uuid_string(),

      status: "pending",

      attempts: 0,

      maximum_attempts: 5,

      available_at: now(),

      lease_owner: nil,

      lease_expires_at: nil,

      claimed_at: nil,

      completed_at: nil,

      last_error: nil,

      inserted_at: now(),

      updated_at: now()

    }

    {:ok, base: base}

  end

  describe "effects_lease_pair_check" do

    test "a lease owner without an expiry is refused", %{base: base} do

      assert {:error, %Postgrex.Error{} = error} =

               Repo.query(@insert_effects, values(%{base | lease_owner: "worker-1"}))

      assert error.postgres.constraint == "effects_lease_pair_check"

    end

    test "an expiry without an owner is refused", %{base: base} do

      assert {:error, %Postgrex.Error{} = error} =

               Repo.query(@insert_effects, values(%{base | lease_expires_at: now()}))

      assert error.postgres.constraint == "effects_lease_pair_check"

    end

  end

  describe "effects_status_shape_check" do

    test "a claimed effect without a lease and claimed_at is refused", %{base: base} do

      assert {:error, %Postgrex.Error{} = error} =

               Repo.query(@insert_effects, values(%{base | status: "claimed"}))

      assert error.postgres.constraint == "effects_status_shape_check"

    end

    test "a done effect with an owner is refused", %{base: base} do

      completed_at = now()

      assert {:error, %Postgrex.Error{} = error} =

               Repo.query(

                 @insert_effects,

                 values(%{

                   base

                   | status: "done",

                     lease_owner: "worker-1",

                     lease_expires_at: completed_at,

                     completed_at: completed_at

                 })

               )

      assert error.postgres.constraint == "effects_status_shape_check"

    end

  end

  defp values(attrs) do

    [

      attrs.id,

      attrs.kind,

      attrs.payload,

      attrs.payload_digest,

      attrs.source_kind,

      attrs.source_id,

      attrs.idempotency_key,

      attrs.status,

      attrs.attempts,

      attrs.maximum_attempts,

      attrs.available_at,

      attrs.lease_owner,

      attrs.lease_expires_at,

      attrs.claimed_at,

      attrs.completed_at,

      attrs.last_error,

      attrs.inserted_at,

      attrs.updated_at

    ]

  end

  defp uuid, do: Ecto.UUID.dump!(Ecto.UUID.generate())

  defp uuid_string, do: Ecto.UUID.generate()

  defp now, do: DateTime.utc_now()

end

    end

  end

  describe "crash boundary" do

    test "the launch effect survives a failed inline placement" do

      remove_horde_supervisor()

      on_exit(fn -> restore_horde_supervisor() end)

      _fake =

        start_supervised!({OpenAgents.Effects.WorkLaunchTest.CrashingHorde, []})

      recording_launch_handler()

      {:ok, conversation} =

        Conversations.ensure_conversation("effect-launch-failed-placement")

      owner = Conversations.get_conversation_owner!(conversation)

      assert {:error, :worker_start_failed} =

               Work.start_job(%{

                 conversation_id: conversation.id,

                 owner_visitor_id: owner.id,

                 surface: "text",

                 goal: "a job whose worker could not be placed"

               })

      assert [job] = Work.recent_jobs(conversation, 1)

      assert job.status == "queued"

      job_id = job.id

      assert [effect] = Effects.for_source("work_job", job_id)

      assert effect.kind == "work.launch_worker"

      assert effect.payload == %{"job_id" => job_id, "worker" => "job"}

      assert effect.source_kind == "work_job"

      assert effect.source_id == job_id

      assert effect.status == "pending"

      assert %{claimed: 1, completed: 1} =

               Worker.run_once(identity: "worker-outbox")

      assert_received {:launch_requested, OpenAgents.Work.JobServer, ^job_id}

      assert Effects.get(effect.id).status == "done"

    end

  end

  # The ordinary path, run to a terminal job so no worker outlives the test.

  defp start_job(browser_key) do

    {:ok, conversation} = Conversations.ensure_conversation(browser_key)

      Application.delete_env(:openagents, :effects_launch_observer)

    end)

  end

  defp remove_horde_supervisor do

    remove_horde_supervisor(5)

  end

  defp remove_horde_supervisor(0) do

    :ok

  end

  defp remove_horde_supervisor(retries) do

    case Supervisor.terminate_child(OpenAgents.RuntimeSupervisor, OpenAgents.HordeSupervisor) do

      :ok ->

        case Supervisor.delete_child(OpenAgents.RuntimeSupervisor, OpenAgents.HordeSupervisor) do

          :ok ->

            :ok

          {:error, :running} ->

            remove_horde_supervisor(retries - 1)

          _ ->

            :ok

        end

      {:error, :not_found} ->

        :ok

    end

  end

  defp restore_horde_supervisor do

    _ = Supervisor.terminate_child(OpenAgents.RuntimeSupervisor, OpenAgents.HordeSupervisor)

    _ = Supervisor.delete_child(OpenAgents.RuntimeSupervisor, OpenAgents.HordeSupervisor)

    horde_spec = {

      Horde.DynamicSupervisor,

      name: OpenAgents.HordeSupervisor,

      strategy: :one_for_one,

      members: :auto,

      process_redistribution: :passive,

      delta_crdt_options: [sync_interval: 150]

    }

    case Supervisor.restart_child(OpenAgents.RuntimeSupervisor, OpenAgents.HordeSupervisor) do

      {:ok, _pid} ->

        :ok

      {:ok, _pid, _info} ->

        :ok

      {:error, :not_found} ->

        case Supervisor.start_child(OpenAgents.RuntimeSupervisor, horde_spec) do

          {:ok, _pid} -> :ok

          {:ok, _pid, _info} -> :ok

          {:error, :already_started} -> :ok

          _ -> :ok

        end

      _ ->

        :ok

    end

  end

end

defmodule OpenAgents.Settlement.ConstraintsTest do

  @moduledoc """

  SETTLEMENT-001, at the database. Every claim here bypasses the Ecto changeset

  and writes raw SQL, because the property is that PostgreSQL refuses the row —

  not that the application declines to build it.

  """

  use OpenAgents.DataCase, async: false

  import OpenAgents.IssuesFixtures

  alias OpenAgents.Repo

  @insert_policy """

  INSERT INTO settlement_treasury_policies

    (id, policy_id, version, policy_digest, rules, actor_id, auth_method,

     approval_receipt_ref, inserted_at)

  VALUES ($1, $2, 1, $3, $4, $5, $6, $7, $8)

  """

  @insert_spec """

  INSERT INTO settlement_bounty_specs

    (id, treasury_policy_id, issue_id, revision, buyer_ref, amount_sats,

     acceptance_criteria, verification_policy, destination_kind, expires_at,

     spec_fingerprint, actor_id, auth_method, approval_receipt_ref, inserted_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)

  """

  @insert_claim """

  INSERT INTO settlement_claims

    (id, bounty_spec_id, spec_fingerprint, claimant_ref, work_job_ref,

     destination_kind, destination, destination_digest, state, claim_digest,

     expires_at, inserted_at, updated_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $12)

  """

  @insert_verification """

  INSERT INTO settlement_verifications

    (id, claim_id, spec_fingerprint, commit_sha, work_job_ref, verifier_ref,

     verifier_policy_digest, evidence_digest, outcome, reason_code, auth_method,

     decision_receipt_ref, inserted_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)

  """

  @insert_intent """

  INSERT INTO settlement_payment_intents

    (id, claim_id, verification_id, idempotency_key, amount_sats, commit_sha,

     destination_digest, spec_fingerprint, state, attempts, intent_digest,

     actor_id, auth_method, approval_receipt_ref, inserted_at, updated_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $15)

  """

  @insert_receipt """

  INSERT INTO settlement_payment_receipts

    (id, payment_intent_id, claim_id, amount_sats, fee_sats, payment_hash,

     preimage_digest, gateway_ref, paid_at, receipt_digest, inserted_at)

  VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)

  """

  setup do

    repository = repository_fixture()

    issue = issue_fixture(repository, %{title: "Settlement constraint test"})

    now = DateTime.utc_now()

    expires_at = DateTime.add(now, 900, :second)

    policy = insert_policy!(now)

    spec = insert_spec!(issue.id, policy.id, 1, now, expires_at)

    claim = insert_claim!(spec, now, expires_at)

    verification = insert_verification!(claim, now)

    %{

      issue: issue,

      policy: policy,

      spec: spec,

      claim: claim,

      verification: verification,

      now: now,

      expires_at: expires_at

    }

  end

  describe "payment receipt uniqueness" do

    test "a payment hash cannot be reused for another receipt", context do

      intent_1_id = Ecto.UUID.generate()

      payment_hash = hex64()

      assert {:ok, %{num_rows: 1}} =

               insert_intent(intent_1_id, context, "intent-#{unique()}", "paid")

      assert {:ok, %{num_rows: 1}} =

               insert_receipt(

                 Ecto.UUID.generate(),

                 intent_1_id,

                 context.claim.id,

                 payment_hash,

                 context.now

               )

      second =

        insert_issue_chain!(

          context.issue.id,

          context.policy.id,

          2,

          context.now,

          context.expires_at

        )

        |> Map.put(:now, context.now)

      intent_2_id = Ecto.UUID.generate()

      assert {:ok, %{num_rows: 1}} =

               insert_intent(intent_2_id, second, "intent-#{unique()}", "paid")

      assert {:error, %Postgrex.Error{} = error} =

               insert_receipt(

                 Ecto.UUID.generate(),

                 intent_2_id,

                 second.claim.id,

                 payment_hash,

                 context.now

               )

      assert error.postgres.constraint ==

               "settlement_payment_receipts_payment_hash_index"

    end

    test "a second receipt for one payment intent is refused", context do

      intent_id = Ecto.UUID.generate()

      first_hash = hex64()

      second_hash = hex64()

      assert {:ok, %{num_rows: 1}} =

               insert_intent(intent_id, context, "intent-#{unique()}", "paid")

      assert {:ok, %{num_rows: 1}} =

               insert_receipt(

                 Ecto.UUID.generate(),

                 intent_id,

                 context.claim.id,

                 first_hash,

                 context.now

               )

      assert {:error, %Postgrex.Error{} = error} =

               insert_receipt(

                 Ecto.UUID.generate(),

                 intent_id,

                 context.claim.id,

                 second_hash,

                 context.now

               )

      assert error.postgres.constraint ==

               "settlement_payment_receipts_payment_intent_id_index"

    end

  end

  describe "payment intent partial uniqueness" do

    test "two paid intents for one claim are refused", context do

      first_id = Ecto.UUID.generate()

      assert {:ok, %{num_rows: 1}} =

               insert_intent(first_id, context, "intent-#{unique()}", "paid")

      second_id = Ecto.UUID.generate()

      assert {:error, %Postgrex.Error{} = error} =

               insert_intent(second_id, context, "intent-#{unique()}", "paid")

      assert error.postgres.constraint == "settlement_payment_intent_single_paid"

    end

  end

  defp insert_policy!(now) do

    id = Ecto.UUID.generate()

    Repo.query!(@insert_policy, [

      uuid(id),

      "policy:#{unique()}",

      hex64(),

      %{"max_payment_sats" => 100_000, "daily_budget_sats" => 1_000_000},

      "actor:operator",

      "session",

      "approval:#{unique()}",

      now

    ])

    %{id: id}

  end

  defp insert_spec!(issue_id, policy_id, revision, now, expires_at) do

    id = Ecto.UUID.generate()

    fingerprint = hex64()

    Repo.query!(@insert_spec, [

      uuid(id),

      uuid(policy_id),

      issue_id,

      revision,

      "buyer:openagents",

      2_500,

      ["The constraint holds."],

      %{"name" => "forge.precommit.v1", "requires" => ["mix precommit"]},

      "bolt12_offer",

      expires_at,

      fingerprint,

      "actor:operator",

      "session",

      "approval:#{unique()}",

      now

    ])

    %{id: id, spec_fingerprint: fingerprint}

  end

  defp insert_claim!(spec, now, expires_at) do

    id = Ecto.UUID.generate()

    destination_digest = hex64()

    fingerprint = spec.spec_fingerprint

    Repo.query!(@insert_claim, [

      uuid(id),

      uuid(spec.id),

      fingerprint,

      "agent:claimant-#{unique()}",

      "work-job:#{unique()}",

      "bolt12_offer",

      "lno1#{String.duplicate("q", 40)}",

      destination_digest,

      "verified",

      hex64(),

      expires_at,

      now

    ])

    %{id: id, spec_fingerprint: fingerprint, destination_digest: destination_digest}

  end

  defp insert_verification!(claim, now) do

    id = Ecto.UUID.generate()

    commit_sha = hex40()

    Repo.query!(@insert_verification, [

      uuid(id),

      uuid(claim.id),

      claim.spec_fingerprint,

      commit_sha,

      "work-job:#{unique()}",

      "verifier:forge-precommit",

      hex64(),

      hex64(),

      "accepted",

      "criteria_met",

      "session",

      "decision:#{unique()}",

      now

    ])

    %{id: id, commit_sha: commit_sha}

  end

  defp insert_issue_chain!(issue_id, policy_id, revision, now, expires_at) do

    spec = insert_spec!(issue_id, policy_id, revision, now, expires_at)

    claim = insert_claim!(spec, now, expires_at)

    verification = insert_verification!(claim, now)

    %{spec: spec, claim: claim, verification: verification}

  end

  defp insert_intent(intent_id, context, idempotency_key, state) do

    Repo.query(@insert_intent, [

      uuid(intent_id),

      uuid(context.claim.id),

      uuid(context.verification.id),

      idempotency_key,

      2_500,

      context.verification.commit_sha,

      context.claim.destination_digest,

      context.spec.spec_fingerprint,

      state,

      0,

      hex64(),

      "actor:operator",

      "session",

      "approval:#{unique()}",

      context.now

    ])

  end

  defp insert_receipt(receipt_id, payment_intent_id, claim_id, payment_hash, now) do

    Repo.query(@insert_receipt, [

      uuid(receipt_id),

      uuid(payment_intent_id),

      uuid(claim_id),

      2_500,

      3,

      payment_hash,

      hex64(),

      "gateway:#{unique()}",

      now,

      hex64(),

      now

    ])

  end

  defp hex40, do: Base.encode16(:crypto.strong_rand_bytes(20), case: :lower)

  defp hex64, do: Base.encode16(:crypto.strong_rand_bytes(32), case: :lower)

  defp unique, do: System.unique_integer([:positive, :monotonic])

  defp uuid(value), do: Ecto.UUID.dump!(value)

end

defmodule OpenAgents.Voice.Voice003PartialUniqueIndexTest do

  @moduledoc """

  VOICE-003, at the database. The partial unique index allows only one active

  voice session per conversation. These claims bypass the Ecto changeset and

  write raw SQL, because the property is that PostgreSQL refuses the row.

  """

  use OpenAgents.DataCase, async: false

  alias OpenAgents.Conversations

  alias OpenAgents.Repo

  @initial_control_id "00000000-0000-0000-0000-000000000001"

  @insert """

  INSERT INTO voice_sessions

    (id, conversation_id, generation, status, architecture, provider_id,

     model_id, voice_artifact_id, provider_session_id, persona_id,

     persona_digest, role_id, role_digest, instruction_digest,

     tool_catalog_digest, event_sequence, usage, started_at, connected_at,

     ended_at, termination_reason, failure_code, release_control_id,

     inserted_at, updated_at)

  VALUES

    ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10,

     $11, $12, $13, $14, $15, $16, $17, $18, $19, $20,

     $21, $22, $23, $24, $25)

  """

  setup do

    {:ok, conversation} =

      Conversations.ensure_conversation("voice-003-browser")

    %{conversation: conversation}

  end

  describe "one active session per conversation" do

    test "a second active session is refused by the partial unique index",

         %{conversation: conversation} do

      conversation_id = uuid(conversation.id)

      now = DateTime.utc_now()

      first_id = uuid(Ecto.UUID.generate())

      assert {:ok, %{num_rows: 1}} =

               insert_voice_session(

                 first_id,

                 conversation_id,

                 1,

                 "connecting",

                 now

               )

      second_id = uuid(Ecto.UUID.generate())

      assert {:error, %Postgrex.Error{} = error} =

               insert_voice_session(

                 second_id,

                 conversation_id,

                 2,

                 "listening",

                 now

               )

      assert error.postgres.constraint ==

               "voice_sessions_one_active_per_conversation_index"

    end