"ceilings — and carries no record an account authors. What an " <>

          "account did with a model is its threads, which export whole."

    },

    %{

      family: :gym,

      api?: true,

      status: :not_user_data,

      mechanism: nil,

      proof: nil,

      issue: nil,

      note:

        "Operator benchmark rows: graded runs of our own agents against " <>

          "task suites, posted by the bench harness. Aggregate measurement " <>

          "of the product, carrying no record an account authors."

    },

    %{

      family: :capacity,

      api?: true,

defmodule OpenAgents.Gym do

  @moduledoc """

  The Gym: graded benchmark runs of our agents, recorded so capability work

  has a scoreboard.

  The framing (`docs/2026-08-24-harbor-terminal-bench-plan.md`): Harbor and

  Terminal-Bench are not only measurement, they are the training ground —

  new coder capabilities, model-swapping policies, and plugins prove

  themselves against graded task suites, and this context holds the results

  those proofs produce. The harness runs elsewhere (the monorepo's bench

  lane); this is the record and the surface.

  Operator-only on every path for now: the Gym is a workbench for the

  people building the agent, not a public leaderboard. Widening it later is

  a deliberate act, not a default.

  """

  import Ecto.Query

  alias OpenAgents.Gym.Run

  alias OpenAgents.Repo

  @maximum_listed 200

  @doc """

  Record one run, idempotently by recipe digest.

  A resubmitted digest returns the existing row as `{:ok, run, replayed?:

  true}` rather than duplicating or refusing: the harness retries uploads,

  and a retry is not a second run.

  """

  @spec record_run(map()) :: {:ok, Run.t(), boolean()} | {:error, Ecto.Changeset.t()}

  def record_run(attributes) when is_map(attributes) do

    changeset = Run.changeset(%Run{}, attributes)

    case Repo.insert(changeset) do

      {:ok, run} ->

        {:ok, run, false}

      {:error, %Ecto.Changeset{errors: errors} = failed} ->

        case Keyword.get(errors, :recipe_digest) do

          {_message, options} ->

            if options[:constraint] == :unique,

              do: replay(Ecto.Changeset.get_field(changeset, :recipe_digest), failed),

              else: {:error, failed}

          nil ->

            {:error, failed}

        end

    end

  end

  @doc "Runs, newest first, optionally filtered by suite. Bounded."

  @spec list_runs(keyword()) :: [Run.t()]

  def list_runs(options \\ []) do

    limit = options |> Keyword.get(:limit, 50) |> min(@maximum_listed) |> max(1)

    Run

    |> filter_suite(options[:suite])

    |> order_by(desc: :inserted_at)

    |> limit(^limit)

    |> Repo.all()

  end

  @doc "Distinct suites present, for the surface's filter row."

  @spec suites() :: [String.t()]

  def suites do

    Run

    |> distinct(true)

    |> select([r], r.suite)

    |> order_by(asc: :suite)

    |> Repo.all()

  end

  defp filter_suite(query, suite) when is_binary(suite) and suite != "",

    do: where(query, [r], r.suite == ^suite)

  defp filter_suite(query, _absent), do: query

  defp replay(digest, failed) when is_binary(digest) do

    case Repo.get_by(Run, recipe_digest: digest) do

      %Run{} = run -> {:ok, run, true}

      nil -> {:error, failed}

    end

  end

  defp replay(_digest, failed), do: {:error, failed}

end

defmodule OpenAgents.Gym.Run do

  @moduledoc """

  One graded benchmark run of an agent against a suite.

  A run is a record of measurement, never of execution: the Harbor harness

  (`docs/2026-08-24-harbor-terminal-bench-plan.md`) runs the trials and this

  row holds what came back — how many tasks the suite graded, how many

  passed, what it cost, and the digest of the exact recipe (CLI version,

  model catalog revision, plugin set, dataset version) that produced it.

  `recipe_digest` is unique: submitting the same run twice replays the first

  row rather than duplicating it, so a trend line never counts a run twice.

  The bounded `report` map carries per-task rows and anything else the

  harness wants to keep beside the headline numbers; it is data about the

  run, not a second transcript store.

  """

  use Ecto.Schema

  import Ecto.Changeset

  @primary_key {:id, :binary_id, autogenerate: true}

  @bounded_fields [:suite, :agent, :model, :recipe_digest]

  @maximum_report_bytes 262_144

  schema "gym_runs" do

    field :suite, :string

    field :agent, :string

    field :agent_version, :string

    field :model, :string

    field :lane, :string

    field :tasks_total, :integer

    field :tasks_passed, :integer

    field :input_tokens, :integer

    field :output_tokens, :integer

    field :cost_microusd, :integer

    field :duration_seconds, :integer

    field :recipe_digest, :string

    field :report, :map, default: %{}

    timestamps(type: :utc_datetime_usec, updated_at: false)

  end

  def changeset(run, attributes) do

    run

    |> cast(attributes, [

      :suite,

      :agent,

      :agent_version,

      :model,

      :lane,

      :tasks_total,

      :tasks_passed,

      :input_tokens,

      :output_tokens,

      :cost_microusd,

      :duration_seconds,

      :recipe_digest,

      :report

    ])

    |> validate_required([:suite, :agent, :model, :tasks_total, :tasks_passed, :recipe_digest])

    |> validate_bounded_fields()

    |> validate_number(:tasks_total, greater_than_or_equal_to: 0)

    |> validate_number(:tasks_passed, greater_than_or_equal_to: 0)

    |> validate_passed_within_total()

    |> validate_report_bound()

    |> check_constraint(:tasks_passed, name: :gym_runs_task_counts_check)

    |> unique_constraint(:recipe_digest)

  end

  @doc "Pass rate in [0.0, 1.0]; nil for an empty suite rather than a fake 1.0."

  def score(%__MODULE__{tasks_total: 0}), do: nil

  def score(%__MODULE__{tasks_total: total, tasks_passed: passed}), do: passed / total

  defp validate_bounded_fields(changeset) do

    Enum.reduce(@bounded_fields, changeset, fn field, acc ->

      validate_length(acc, field, min: 1, max: 200, count: :bytes)

    end)

  end

  defp validate_passed_within_total(changeset) do

    total = get_field(changeset, :tasks_total)

    passed = get_field(changeset, :tasks_passed)

    if is_integer(total) and is_integer(passed) and passed > total do

      add_error(changeset, :tasks_passed, "cannot exceed tasks_total")

    else

      changeset

    end

  end

  defp validate_report_bound(changeset) do

    report = get_field(changeset, :report)

    case report do

      map when is_map(map) ->

        if byte_size(Jason.encode!(map)) > @maximum_report_bytes do

          add_error(changeset, :report, "is larger than #{@maximum_report_bytes} bytes")

        else

          changeset

        end

      _other ->

        add_error(changeset, :report, "must be an object")

    end

  end

end

        {:required_bearer, :issue, :envelope},

      "get /api/v3/agent" => {:required_bearer, :agent, :legacy},

      "post /api/v3/agents/:handle/box-control" => {:required_bearer, :agent, :legacy},

      "post /api/v3/gym/runs" => {:required_bearer, :gym, :envelope},

      "get /api/v3/gym/runs" => {:required_bearer, :gym, :envelope},

      "delete /api/v3/agents/:handle/box-control" => {:required_bearer, :agent, :legacy},

      "post /api/v3/agents/:handle/computer-control" => {:required_bearer, :agent, :legacy},

      "delete /api/v3/agents/:handle/computer-control" => {:required_bearer, :agent, :legacy},

          icon="folder"

          patchable={false}

        />

        <%!-- Operator-only: the Gym is a workbench for the people building

        the agent, not a public leaderboard yet. The operator allowlist IS

        the whitelist, deliberately, rather than a second gating

        mechanism. --%>

        <Layouts.sidebar_link

          :if={@operator?}

          path={~p"/gym"}

          label="Gym"

          icon="dumbbell"

          patchable={false}

        />

        <Layouts.sidebar_link

          path={~p"/artifact-catalog"}

          label="Artifact catalog"

defmodule OpenAgentsWeb.GymRunController do

  @moduledoc """

  The door the bench harness posts graded runs through.

  Authority is the fleet-promotion shape without the privileged scope: an

  ordinary `forge:write` bearer plus live operator standing, rechecked on

  every request through `OpenAgents.Accounts.admin?/1`. Recording a

  benchmark row is operator work, but it moves no money and deploys

  nothing, so it does not need a scope of its own the way promotion does —

  the recheck, not the scope, is what keeps it operator-only.

  Idempotent by recipe digest: a retried upload answers `200` with the

  existing row where the first answered `201`, so harness retry policy

  needs no special casing.

  """

  use OpenAgentsWeb, :controller

  alias OpenAgents.Accounts

  alias OpenAgents.Gym

  alias OpenAgents.Gym.Run

  alias OpenAgentsWeb.ApiError

  def create(conn, params) do

    with :ok <- operator(conn) do

      case Gym.record_run(params) do

        {:ok, run, replayed?} ->

          conn

          |> put_status(if(replayed?, do: :ok, else: :created))

          |> json(%{"run" => run_view(run), "replayed" => replayed?})

        {:error, changeset} ->

          ApiError.changeset(conn, changeset)

      end

    end

  end

  def index(conn, params) do

    with :ok <- operator(conn) do

      runs = Gym.list_runs(suite: params["suite"])

      json(conn, %{"runs" => Enum.map(runs, &run_view/1)})

    end

  end

  defp operator(conn) do

    if Accounts.admin?(conn.assigns.current_user) do

      :ok

    else

      ApiError.refuse(conn, "not_operator")

    end

  end

  defp run_view(%Run{} = run) do

    %{

      "id" => run.id,

      "suite" => run.suite,

      "agent" => run.agent,

      "agent_version" => run.agent_version,

      "model" => run.model,

      "lane" => run.lane,

      "tasks_total" => run.tasks_total,

      "tasks_passed" => run.tasks_passed,

      "score" => Run.score(run),

      "input_tokens" => run.input_tokens,

      "output_tokens" => run.output_tokens,

      "cost_microusd" => run.cost_microusd,

      "duration_seconds" => run.duration_seconds,

      "recipe_digest" => run.recipe_digest,

      "recorded_at" => run.inserted_at

    }

  end

end

defmodule OpenAgentsWeb.GymLive do

  @moduledoc """

  The Gym: graded benchmark runs of our agents, operator-only.

  Read-only over `OpenAgents.Gym` — the harness runs elsewhere and posts

  results through `POST /api/v3/gym/runs`; this surface is the scoreboard

  that capability work (models, plugins, harness changes) is read against.

  Operator-gated the same way `/chat` is: the route sits behind the

  `:operator` pipeline, the mount re-checks, and every event re-checks,

  because a long-lived socket outlives the decision that opened it.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Accounts

  alias OpenAgents.Gym

  alias OpenAgents.Gym.Run

  @impl true

  def mount(_params, _session, socket) do

    if Accounts.admin?(socket.assigns.current_user) do

      {:ok, load(socket, nil)}

    else

      {:ok, redirect(socket, to: ~p"/")}

    end

  end

  @impl true

  def handle_event("filter", %{"suite" => suite}, socket) do

    if Accounts.admin?(socket.assigns.current_user) do

      {:noreply, load(socket, presence(suite))}

    else

      {:noreply, redirect(socket, to: ~p"/")}

    end

  end

  defp presence(""), do: nil

  defp presence(suite) when is_binary(suite), do: suite

  defp load(socket, suite) do

    runs = Gym.list_runs(suite: suite)

    socket

    |> assign(:page_title, "Gym")

    |> assign(:suite, suite)

    |> assign(:suites, Gym.suites())

    |> assign(:runs_empty?, runs == [])

    |> stream(:runs, runs, reset: true)

  end

  defp percent(nil), do: "—"

  defp percent(score), do: "#{Float.round(score * 100, 1)}%"

  defp dollars(nil), do: "—"

  defp dollars(microusd), do: "$#{Float.round(microusd / 1_000_000, 4)}"

  defp tokens(nil, nil), do: "—"

  defp tokens(input, output), do: "#{format_count(input)} in / #{format_count(output)} out"

  defp format_count(nil), do: "—"

  defp format_count(count) when count >= 1_000_000, do: "#{Float.round(count / 1_000_000, 1)}M"

  defp format_count(count) when count >= 1_000, do: "#{Float.round(count / 1_000, 1)}k"

  defp format_count(count), do: Integer.to_string(count)

  @impl true

  def render(assigns) do

    ~H"""

    <Layouts.app

      flash={@flash}

      sidebar_sections={assigns[:sidebar_sections]}

      current_scope={@current_scope}

    >

      <div class="mx-auto max-w-6xl space-y-6">

        <.header>

          Gym

          <:subtitle>

            Graded benchmark runs, newest first. The harness posts results;

            this page reads them. Operator-only.

          </:subtitle>

        </.header>

        <form id="gym-suite-filter" phx-change="filter">

          <select name="suite" class="select" data-size="sm">

            <option value="" selected={@suite == nil}>All suites</option>

            <option :for={suite <- @suites} value={suite} selected={@suite == suite}>

              {suite}

            </option>

          </select>

        </form>

        <div :if={@runs_empty?}>

          <.empty title="No runs recorded yet">

            No graded runs have been posted. The harness records one with

            <code>POST /api/v3/gym/runs</code>

            — see <code>docs/2026-08-24-harbor-terminal-bench-plan.md</code>.

          </.empty>

        </div>

        <div :if={!@runs_empty?} class="overflow-x-auto">

          <table class="table">

            <thead>

              <tr>

                <th>Recorded</th>

                <th>Suite</th>

                <th>Agent</th>

                <th>Model</th>

                <th>Lane</th>

                <th>Score</th>

                <th>Tasks</th>

                <th>Tokens</th>

                <th>Cost</th>

              </tr>

            </thead>

            <tbody id="gym-runs" phx-update="stream">

              <tr :for={{id, run} <- @streams.runs} id={id}>

                <td class="whitespace-nowrap">

                  {Calendar.strftime(run.inserted_at, "%Y-%m-%d %H:%M")}

                </td>

                <td class="font-mono text-sm">{run.suite}</td>

                <td>

                  {run.agent}

                  <span :if={run.agent_version} class="text-muted-foreground">

                    @{run.agent_version}

                  </span>

                </td>

                <td class="font-mono text-sm">{run.model}</td>

                <td>{run.lane || "—"}</td>

                <td class="font-semibold">{percent(Run.score(run))}</td>

                <td>{run.tasks_passed}/{run.tasks_total}</td>

                <td class="whitespace-nowrap text-sm">

                  {tokens(run.input_tokens, run.output_tokens)}

                </td>

                <td>{dollars(run.cost_microusd)}</td>

              </tr>

            </tbody>

          </table>

        </div>

      </div>

    </Layouts.app>

    """

  end

end

  defp policy(%{path: "/chat"}),

    do: declaration(:operator, "configured operator GitHub ID", "chat:preview", false)

  defp policy(%{path: "/gym"}),

    do: declaration(:operator, "configured operator GitHub ID", "gym:read", false)

  defp policy(%{path: "/admin/analytics"}),

    do: declaration(:operator, "configured operator GitHub ID", "analytics:read", false)

        {OpenAgentsWeb.UserAuth, :ensure_admin}

      ] do

      live "/chat", ChatConsoleLive, :index

      # The Gym: graded benchmark runs of our agents

      # (docs/2026-08-24-harbor-terminal-bench-plan.md). Operator-only for

      # now — the whitelist is the operator allowlist, deliberately, rather

      # than a second gating mechanism. Widening it is a decision, not a

      # default.

      live "/gym", GymLive, :index

    end

  end

    delete "/agents/:handle/box-control", AgentController, :revoke_box_control

    post "/agents/:handle/computer-control", AgentController, :grant_computer_control

    delete "/agents/:handle/computer-control", AgentController, :revoke_computer_control

    # The Gym's ingest and read: an ordinary forge:write bearer carries the

    # request, and the controller rechecks live operator standing on every

    # call — the fleet-promotion shape without a privileged scope, because

    # recording a benchmark row moves no money and deploys nothing.

    post "/gym/runs", GymRunController, :create

    get "/gym/runs", GymRunController, :index

  end

  scope "/api/v3", OpenAgentsWeb do

    20260824203139,

    20260824204740,

    20260824210500,

    20260824230007

    20260824230007,

    20260824230730

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.CreateGymRuns do

  use Ecto.Migration

  def change do

    create table(:gym_runs, primary_key: false) do

      add :id, :binary_id, primary_key: true

      add :suite, :text, null: false

      add :agent, :text, null: false

      add :agent_version, :text

      add :model, :text, null: false

      add :lane, :text

      add :tasks_total, :integer, null: false

      add :tasks_passed, :integer, null: false

      add :input_tokens, :bigint

      add :output_tokens, :bigint

      add :cost_microusd, :bigint

      add :duration_seconds, :integer

      add :recipe_digest, :text, null: false

      add :report, :map, null: false, default: %{}

      timestamps(type: :utc_datetime_usec, updated_at: false)

    end

    create constraint(:gym_runs, :gym_runs_task_counts_check,

             check: "tasks_total >= 0 AND tasks_passed >= 0 AND tasks_passed <= tasks_total"

           )

    create constraint(:gym_runs, :gym_runs_suite_bound_check,

             check: "octet_length(suite) BETWEEN 1 AND 200"

           )

    create constraint(:gym_runs, :gym_runs_agent_bound_check,

             check: "octet_length(agent) BETWEEN 1 AND 200"

           )

    create constraint(:gym_runs, :gym_runs_model_bound_check,

             check: "octet_length(model) BETWEEN 1 AND 200"

           )

    create constraint(:gym_runs, :gym_runs_recipe_digest_bound_check,

             check: "octet_length(recipe_digest) BETWEEN 1 AND 200"

           )

    # One row per exact run of an exact recipe: a re-submitted result replays

    # rather than duplicating, so trend lines never double-count a run.

    create unique_index(:gym_runs, [:recipe_digest])

    create index(:gym_runs, [:suite, :inserted_at])

  end

end

defmodule OpenAgents.GymTest do

  use OpenAgents.DataCase, async: true

  alias OpenAgents.Gym

  alias OpenAgents.Gym.Run

  defp attributes(overrides \\ %{}) do

    Map.merge(

      %{

        "suite" => "terminal-bench@2.0",

        "agent" => "openagents-coder",

        "agent_version" => "0.3.5",

        "model" => "ox-alpha",

        "lane" => "proxy",

        "tasks_total" => 20,

        "tasks_passed" => 13,

        "input_tokens" => 1_200_000,

        "output_tokens" => 240_000,

        "cost_microusd" => 1_850_000,

        "duration_seconds" => 3_600,

        "recipe_digest" => "sha256:" <> String.duplicate("a", 64)

      },

      overrides

    )

  end

  test "records a run and derives its score" do

    assert {:ok, %Run{} = run, false} = Gym.record_run(attributes())

    assert run.tasks_passed == 13

    assert Run.score(run) == 13 / 20

  end

  test "an empty suite has no score rather than a perfect one" do

    {:ok, run, false} =

      Gym.record_run(attributes(%{"tasks_total" => 0, "tasks_passed" => 0}))

    assert Run.score(run) == nil

  end

  test "a resubmitted recipe digest replays the first row" do

    {:ok, first, false} = Gym.record_run(attributes())

    {:ok, second, true} =

      Gym.record_run(attributes(%{"tasks_passed" => 1}))

    assert second.id == first.id

    assert second.tasks_passed == 13

    assert length(Gym.list_runs()) == 1

  end

  test "passed cannot exceed total" do

    assert {:error, changeset} =

             Gym.record_run(attributes(%{"tasks_passed" => 21}))

    assert %{tasks_passed: [_message]} = errors_on(changeset)

  end

  test "listing filters by suite and bounds the page" do

    {:ok, _one, false} = Gym.record_run(attributes())

    {:ok, _two, false} =

      Gym.record_run(

        attributes(%{

          "suite" => "swebench@lite",

          "recipe_digest" => "sha256:" <> String.duplicate("b", 64)

        })

      )

    assert [%Run{suite: "swebench@lite"}] = Gym.list_runs(suite: "swebench@lite")

    assert length(Gym.list_runs()) == 2

    assert Gym.suites() == ["swebench@lite", "terminal-bench@2.0"]

    assert [_only] = Gym.list_runs(limit: 1)

  end

  test "an oversized report is refused" do

    huge = %{"rows" => String.duplicate("x", 300_000)}

    assert {:error, changeset} = Gym.record_run(attributes(%{"report" => huge}))

    assert %{report: [_message]} = errors_on(changeset)

  end

end

defmodule OpenAgentsWeb.GymRunControllerTest do

  @moduledoc """

  The Gym's ingest door authenticates a `forge:write` bearer and then

  rechecks live operator standing on every request. An ordinary account with

  the same scope is refused with a typed `not_operator`, and nothing is

  recorded for it.

  """

  use OpenAgentsWeb.ConnCase, async: false

  alias OpenAgents.Gym

  @digest "sha256:" <> String.duplicate("c", 64)

  defp payload(overrides \\ %{}) do

    Map.merge(

      %{

        "suite" => "terminal-bench@2.0",

        "agent" => "openagents-coder",

        "model" => "ox-alpha",

        "tasks_total" => 10,

        "tasks_passed" => 7,

        "recipe_digest" => @digest

      },

      overrides

    )

  end

  defp operator_token(conn, key) do

    user = github_user("api-token-" <> key)

    grant_operator(user)

    put_forge_api_token(conn, key)

  end

  test "an operator records a run and a retry replays it", %{conn: conn} do

    authenticated = operator_token(conn, "gym-operator")

    created =

      authenticated

      |> post(~p"/api/v3/gym/runs", payload())

      |> json_response(201)

    assert created["run"]["score"] == 0.7

    assert created["replayed"] == false

    replayed =

      authenticated

      |> post(~p"/api/v3/gym/runs", payload(%{"tasks_passed" => 1}))

      |> json_response(200)

    assert replayed["replayed"] == true

    assert replayed["run"]["id"] == created["run"]["id"]

    assert replayed["run"]["tasks_passed"] == 7

  end

  test "an ordinary forge:write token is refused and records nothing", %{conn: conn} do

    refused =

      conn

      |> put_forge_api_token("gym-ordinary")

      |> post(~p"/api/v3/gym/runs", payload())

      |> json_response(403)

    assert refused["code"] == "not_operator"

    assert Gym.list_runs() == []

  end

  test "an invalid run refuses with field errors", %{conn: conn} do

    refused =

      conn

      |> operator_token("gym-invalid")

      |> post(~p"/api/v3/gym/runs", payload(%{"tasks_passed" => 99}))

      |> json_response(422)

    assert refused["errors"]["tasks_passed"]

  end

  test "listing is operator-only and filters by suite", %{conn: conn} do

    authenticated = operator_token(conn, "gym-lister")

    _created =

      authenticated |> post(~p"/api/v3/gym/runs", payload()) |> json_response(201)

    listed = authenticated |> get(~p"/api/v3/gym/runs") |> json_response(200)

    assert [%{"suite" => "terminal-bench@2.0"}] = listed["runs"]

    filtered =

      authenticated

      |> get(~p"/api/v3/gym/runs?suite=swebench@lite")

      |> json_response(200)

    assert filtered["runs"] == []

    refused =

      conn

      |> put_forge_api_token("gym-list-ordinary")

      |> get(~p"/api/v3/gym/runs")

      |> json_response(403)

    assert refused["code"] == "not_operator"

  end

end

defmodule OpenAgentsWeb.GymLiveTest do

  @moduledoc """

  `/gym` gates like every operator surface: the operator sees the

  scoreboard, an ordinary account is redirected and told nothing, and the

  sidebar shows the Gym row only to operators.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  alias OpenAgents.Gym

  defp record_run(suite, digest_letter) do

    {:ok, run, false} =

      Gym.record_run(%{

        "suite" => suite,

        "agent" => "openagents-coder",

        "agent_version" => "0.3.5",

        "model" => "ox-alpha",

        "lane" => "proxy",

        "tasks_total" => 10,

        "tasks_passed" => 8,

        "recipe_digest" => "sha256:" <> String.duplicate(digest_letter, 64)

      })

    run

  end

  describe "access" do

    test "the operator reaches the surface", %{conn: conn} do

      conn = log_in_admin_user(conn, "gym-operator")

      {:ok, _view, html} = live(conn, ~p"/gym")

      assert html =~ "Gym"

      assert html =~ "No runs recorded yet"

    end

    test "an ordinary authenticated account is redirected", %{conn: conn} do

      conn = log_in_github_user(conn, "gym-ordinary")

      assert {:error, {:redirect, %{to: "/"}}} = live(conn, ~p"/gym")

    end

    test "an unauthenticated visitor is redirected", %{conn: conn} do

      assert {:error, {:redirect, %{to: "/"}}} = live(conn, ~p"/gym")

    end

  end

  describe "sidebar" do

    test "the Gym row shows for the operator and not for an ordinary account", %{conn: conn} do

      operator = log_in_admin_user(conn, "gym-nav-operator")

      operator_home = operator |> get(~p"/repositories") |> html_response(200)

      assert operator_home =~ ~p"/gym"

      ordinary = log_in_github_user(conn, "gym-nav-ordinary")

      ordinary_home = ordinary |> get(~p"/repositories") |> html_response(200)

      refute ordinary_home =~ ~p"/gym"

    end

  end

  describe "runs" do

    test "recorded runs render with score, and the suite filter narrows", %{conn: conn} do

      _bench = record_run("terminal-bench@2.0", "d")

      _swe = record_run("swebench@lite", "e")

      conn = log_in_admin_user(conn, "gym-runs-operator")

      {:ok, view, html} = live(conn, ~p"/gym")

      assert html =~ "terminal-bench@2.0"

      assert html =~ "swebench@lite"

      assert html =~ "80.0%"

      assert html =~ "8/10"

      filtered =

        view

        |> element("#gym-suite-filter")

        |> render_change(%{"suite" => "swebench@lite"})

      assert filtered =~ "swebench@lite"

      refute filtered =~ "terminal-bench@2.0</td>"

    end

  end

end