independently (an unreachable node reports as unreachable; a failed count is

absent), and the per-node fan-out is time-bounded and briefly cached so page

traffic cannot become an rpc storm. Legacy JSON pollers of `/status` keep the

old health payload via content negotiation until they migrate to `/healthz`

old health payload via content negotiation until they migrate to `/health`

or `/api/status`.

Evidence: `OpenAgents.NetworkStatus`, `OpenAgentsWeb.NetworkStatusLive`,

- Added `ops/ci/release-smoke.sh`. It requires an explicitly acknowledged

  disposable PostgreSQL URL, generates throwaway runtime secrets, builds the

  production assets and release, starts the real release, waits for the bounded

  `/healthz` response, and terminates the release cleanly.

  `/health` response, and terminates the release cleanly.

- Fixed `mix assets.deploy` to compile Phoenix's colocated assets before

  Tailwind resolves them. The release smoke exposed this production-only build

  failure and now passes against a fresh PostgreSQL 18 container.

  cycle. A late-joining or replaced node leaves readiness while a target is

  deploying or as soon as a newer live target exists, then converges before it

  serves that revision.

- Made `/healthz` return `503` while boot code or a deployment participant is

- Made `/health` return `503` while boot code or a deployment participant is

  divergent. Added a bounded, content-free boot and deployment projection to

  `/status`, and made its quorum calculation honor the configured forge fleet

  size even when Ra is disabled.

7. Snapshot the actual staging database.

8. Deploy the candidate to the web acceptance lane with high-risk features

   disabled.

9. Confirm migration completion, `/healthz`, `/status`, database connectivity,

9. Confirm migration completion, `/health`, `/status`, database connectivity,

   LiveView connection, and revision identity.

10. Hard-reload persistent browser sessions so they connect to the new revision.

11. Enable one gated subsystem at a time and run its regression group.

  Fresh current-lineage databases were missing the constraint even though the

  changeset named it; prior-lineage databases already have it and remain

  unchanged.

- Rehearsed the bridge and all 20 remaining current migrations on a disposable

- Rehearsed the bridge and all 21 remaining current migrations on a disposable

  copy of the complete 57-version prior schema. Account, message, forge target,

  build receipt, and deploy receipt probes remained present. Both the candidate

  application and the last-known-good application started against the migrated

### Public and browser surfaces

- `/healthz`, `/status`, `/api/status`, and `/favicon.ico` return their bounded

- `/health`, `/status`, `/api/status`, and `/favicon.ico` return their bounded

  expected responses.

- `/`, `/leaderboard`, `/changelog`, `/docs`, `/components`, and configured

  public forge pages render without an authenticated session where intended.

   artifacts or receipts.

6. Publishes a bounded convergence state and enters readiness.

If image code does not match the live target and convergence fails, `/healthz`

If image code does not match the live target and convergence fails, `/health`

returns `503` and `/status` reports a content-free degraded state. The worker

retries indefinitely with exponential backoff capped by

`OPENAGENTS_FORGE_BOOT_RETRY_MAX_MS`. A missing live target is the only normal

  drop build history if replayed.

- Four reconciliation migrations run normally because they are guarded or

  idempotent.

- 16 versions are genuinely new and run normally after the baseline.

- 17 versions are genuinely new and run normally after the baseline.

The bridge adds only the nullable `users.browser_key_hash` column and its

partial unique index. It then records the 14 reviewed versions. It preserves

8. Run `bin/migration-lineage check` again and require `prior_baselined` with

   zero missing facts.

9. Start the candidate release with high-risk features disabled. Require

   configuration readiness, database connectivity, `/healthz`, and `/status`.

   configuration readiness, database connectivity, `/health`, and `/status`.

10. Start the last-known-good release against the migrated copy with traffic and

    workers disabled. This verifies that the additive schema remains rollback

    compatible.

  "$report" public-001 passed public-smoke "$smoke_receipt"

```

The smoke checks `/healthz`, `/status`, `/api/status`, `/favicon.ico`, `/`,

The smoke checks `/health`, `/status`, `/api/status`, `/favicon.ico`, `/`,

`/leaderboard`, `/changelog`, `/docs`, and `/components`. JSON endpoints must

report the candidate SHA. The home response must bind the CSP nonce to the

theme bootstrap and publish the microphone permissions policy. The receipt

contains no response bodies or header values.

Use `/health` for every public Cloud Run check. Cloud Run reserves some paths

that end in `z`, so `/healthz` can return a platform `404` before the request

reaches Phoenix. The application retains `/healthz` as a compatibility alias

for direct and distributed fleet traffic.

The receipt proves all of `public-001` and only the automated portions of

`public-002` and `public-005`. Complete the configured forge, browser-policy,

cookie, origin, image, microphone, and manual browser checks before marking

where possible:

- the new regression test remains green against the packaged or live target;

- `/healthz` and deployment readiness remain healthy;

- `/health` and deployment readiness remain healthy;

- fleet revision and artifact identities remain consistent;

- affected error codes do not regress;

- latency, memory, mailbox, and restart measurements remain within an admitted

  constraints = "~> 7.41"

  hashes = [

    "h1:5bwzwKa/bvJmUkVMkrF18v9AfFeJ/wjR230oY+4LHrc=",

    "h1:FGFsRBzfeyq56BUAcb/WT676NieMX3NRfR4DBj2eEqk=",

    "zh:0f33485d068e39b1661d4ad789dfac353134b99cb5746e463e7719c053d70c06",

    "zh:162335c448b15125924c3451dc0a411635138c00e36784d9586b9df61bc8a3d7",

    "zh:172c9e4902e9a01b1111bbbb9063a47804ec5f4207b2221df9c398239ff3b350",

keep it out of shell history, and use the same value when Gate 13 creates the

staging runtime secret. Never reuse a production credential.

Authenticate both the Cloud CLI and Terraform provider:

Authenticate the Cloud CLI. Application Default Credentials are preferred for

Terraform because they can refresh during a long operation:

```sh

gcloud auth login

gcloud auth application-default login

```

If Application Default Credentials have expired, the wrapper uses a fresh,

process-only Cloud CLI access token. Terraform cannot renew that token, so each

`plan`, `apply`, or `output` command must complete within one hour. The wrapper

never writes the token to a plan, Terraform state, or command output.

## Provision the boundary

1. Review the project bootstrap targets without changing cloud state:

defmodule Mix.Tasks.Openagents.Atif.Export do

  @shortdoc "Export one account's conversation as an ATIF v1.7 trajectory file"

  @moduledoc """

  Exports the same ATIF document as `GET /data/export/atif` without starting

  the OpenAgents supervision tree or its recovery workers.

      mix openagents.atif.export --github-id 14167547 --out /tmp/atif.json \

        --database-url postgres://openagents_app:URL_ENCODED_PASSWORD@127.0.0.1:5433/openagents

  """

  use Mix.Task

  import Ecto.Query

  @requirements ["app.config"]

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} =

      OptionParser.parse(arguments,

        strict: [github_id: :integer, out: :string, database_url: :string]

      )

    if remaining != [] or invalid != [], do: Mix.raise("invalid ATIF export options")

    github_id =

      Keyword.get(options, :github_id) || Mix.raise("--github-id GITHUB_NUMERIC_ID is required")

    start_repo_only(Keyword.get(options, :database_url))

    user =

      OpenAgents.Repo.get_by(OpenAgents.Accounts.User, github_id: github_id) ||

        Mix.raise("no user with GitHub ID #{github_id}")

    conversation =

      OpenAgents.Repo.one(

        from(conversation in OpenAgents.Conversations.Conversation,

          join: visitor in OpenAgents.Conversations.Visitor,

          on: visitor.id == conversation.visitor_id,

          where: visitor.user_id == ^user.id,

          order_by: [asc: conversation.inserted_at],

          limit: 1

        )

      ) || Mix.raise("user #{github_id} has no conversation")

    visitor = OpenAgents.Repo.get!(OpenAgents.Conversations.Visitor, conversation.visitor_id)

    {:ok, export} = OpenAgents.DataRights.AtifExport.build(user, visitor, conversation)

    output = Keyword.get(options, :out, "openagents-conversation-#{conversation.id}-atif.json")

    File.write!(output, Jason.encode!(export, pretty: true))

    steps = export["steps"]

    tool_calls = steps |> Enum.flat_map(&(&1["tool_calls"] || [])) |> length()

    Mix.shell().info(

      "wrote #{output}: #{length(steps)} steps, #{tool_calls} tool calls, " <>

        "final_metrics=#{Jason.encode!(export["final_metrics"])}"

    )

  end

  defp start_repo_only(database_url) do

    {:ok, _apps} = Application.ensure_all_started(:ssl)

    {:ok, _apps} = Application.ensure_all_started(:postgrex)

    {:ok, _apps} = Application.ensure_all_started(:ecto_sql)

    _snapshot = OpenAgents.Tools.Registry.install!(Application.fetch_env!(:openagents, :tools))

    repo_options =

      case database_url do

        nil -> [pool_size: 2]

        url when is_binary(url) -> [url: url, pool_size: 2, ssl: false]

      end

    case OpenAgents.Repo.start_link(repo_options) do

      {:ok, _repo} -> :ok

      {:error, {:already_started, _repo}} -> :ok

      {:error, reason} -> Mix.raise("repo start failed: #{inspect(reason)}")

    end

  end

end

defmodule Mix.Tasks.Openagents.Eval.Persona do

  use Mix.Task

  @shortdoc "Run the provider-backed Sarah persona regression corpus"

  @moduledoc """

  Runs the committed Sarah persona corpus through the configured OpenAgents

  provider. This task makes billable provider requests.

      mix openagents.eval.persona --output tmp/persona-report.json

  """

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} =

      OptionParser.parse(arguments, strict: [output: :string, model: :string])

    if remaining != [] or invalid != [] do

      Mix.raise("usage: mix openagents.eval.persona [--model MODEL] [--output PATH]")

    end

    Mix.Task.run("app.start")

    provider = Application.fetch_env!(:openagents, :provider)

    model_id = options[:model] || Application.fetch_env!(:openagents, :openai_model)

    output = options[:output] || "tmp/openagents-persona-eval.json"

    case OpenAgents.Persona.Evaluation.Runner.run(provider, model_id) do

      {:ok, report} ->

        write_report!(output, report)

        if report["passed"] do

          Mix.shell().info("persona regression passed: #{report["score"]} (#{output})")

        else

          Mix.raise("persona regression failed: #{report["score"]} (#{output})")

        end

      {:error, reason} ->

        Mix.raise("persona regression could not run: #{inspect(reason)}")

    end

  end

  defp write_report!(path, report) do

    path |> Path.dirname() |> File.mkdir_p!()

    File.write!(path, Jason.encode_to_iodata!(report, pretty: true))

  end

end

defmodule Mix.Tasks.Openagents.Eval.Recall do

  use Mix.Task

  @shortdoc "Run the deterministic PostgreSQL recall release evaluation"

  @moduledoc """

  Runs the committed synthetic recall corpus and writes a revision-bound

  report. The runner rolls back every fixture row.

      mix openagents.eval.recall --output tmp/openagents-recall-eval.json

  """

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} = OptionParser.parse(arguments, strict: [output: :string])

    if remaining != [] or invalid != [] do

      Mix.raise("usage: mix openagents.eval.recall [--output PATH]")

    end

    Mix.Task.run("app.start")

    Logger.configure(level: :warning)

    output = options[:output] || "tmp/openagents-recall-eval.json"

    case OpenAgents.Memory.Evaluation.Runner.run() do

      {:ok, report} ->

        write_report!(output, report)

        if report["passed"] do

          Mix.shell().info("recall evaluation passed (#{output})")

        else

          Mix.raise("recall evaluation failed (#{output})")

        end

      {:error, reason} ->

        Mix.raise("recall evaluation could not run: #{inspect(reason)}")

    end

  end

  defp write_report!(path, report) do

    path |> Path.dirname() |> File.mkdir_p!()

    File.write!(path, Jason.encode_to_iodata!(report, pretty: true))

  end

end

defmodule Mix.Tasks.Openagents.Icons.Vendor do

  @shortdoc "Convert the Apps SDK UI React icon set into vendored SVG files"

  @moduledoc """

  Vendors the `openai/apps-sdk-ui` icon set into `priv/icons`.

      mix openagents.icons.vendor ~/work/projects/repos/apps-sdk-ui

  The converter accepts only the JSX forms in the pinned upstream set. It

  fails when upstream introduces an unsupported expression instead of writing

  a malformed glyph.

  """

  use Mix.Task

  @icon_subpath "src/components/Icon/svg"

  @output "priv/icons"

  @attribute_names %{

    "fillRule" => "fill-rule",

    "clipRule" => "clip-rule",

    "clipPath" => "clip-path",

    "strokeWidth" => "stroke-width",

    "strokeLinecap" => "stroke-linecap",

    "strokeLinejoin" => "stroke-linejoin",

    "strokeMiterlimit" => "stroke-miterlimit",

    "fillOpacity" => "fill-opacity",

    "strokeOpacity" => "stroke-opacity",

    "stopColor" => "stop-color",

    "stopOpacity" => "stop-opacity",

    "className" => "class",

    "xmlnsXlink" => "xmlns:xlink",

    "xlinkHref" => "xlink:href"

  }

  @impl Mix.Task

  def run(arguments) do

    source = arguments |> List.first() |> source_directory!()

    File.mkdir_p!(@output)

    clear_previous_icons()

    written =

      source

      |> File.ls!()

      |> Enum.filter(&String.ends_with?(&1, ".tsx"))

      |> Enum.sort()

      |> Enum.map(&convert(source, &1))

    Mix.shell().info("Vendored #{length(written)} icons into #{@output}/")

    case Enum.filter(written, &(&1.ids != [])) do

      [] ->

        :ok

      namespaced ->

        Mix.shell().info(

          "Namespaced element IDs in #{length(namespaced)} icons: " <>

            Enum.map_join(namespaced, ", ", & &1.name)

        )

    end

  end

  defp source_directory!(nil) do

    Mix.raise("usage: mix openagents.icons.vendor PATH_TO_APPS_SDK_UI")

  end

  defp source_directory!(path) do

    directory = path |> Path.expand() |> Path.join(@icon_subpath)

    if File.dir?(directory) do

      directory

    else

      Mix.raise("#{directory} does not contain the Apps SDK UI icon source")

    end

  end

  defp clear_previous_icons do

    @output |> Path.join("*.svg") |> Path.wildcard() |> Enum.each(&File.rm!/1)

  end

  defp convert(source, file) do

    component = Path.basename(file, ".tsx")

    name = kebab_case(component)

    svg =

      source

      |> Path.join(file)

      |> File.read!()

      |> extract_svg!(component)

      |> drop_props_spread()

      |> rewrite_attribute_names()

      |> rewrite_expression_values!(component)

      |> namespace_ids(name)

      |> normalize_whitespace()

    File.write!(Path.join(@output, "#{name}.svg"), svg <> "\n")

    %{name: name, ids: Regex.scan(~r/\sid="([^"]+)"/, svg)}

  end

  defp extract_svg!(contents, component) do

    case Regex.run(~r|(<svg\b.*</svg>)|s, contents) do

      [_, svg] -> svg

      _missing -> Mix.raise("#{component}: could not find an <svg> element")

    end

  end

  defp drop_props_spread(svg), do: String.replace(svg, ~r/\s*\{\.\.\.props\}/, "")

  defp rewrite_attribute_names(svg) do

    Enum.reduce(@attribute_names, svg, fn {jsx_name, svg_name}, current ->

      String.replace(current, ~r/(\s)#{jsx_name}=/, "\\1#{svg_name}=")

    end)

  end

  defp rewrite_expression_values!(svg, component) do

    Regex.replace(~r/=\{([^}]*)\}/, svg, fn _match, value ->

      value = String.trim(value)

      if Regex.match?(~r/^-?\d+(\.\d+)?$/, value) do

        ~s(="#{value}")

      else

        Mix.raise("#{component}: unsupported JSX expression value #{inspect(value)}")

      end

    end)

  end

  defp namespace_ids(svg, name) do

    svg

    |> then(&Regex.replace(~r/\sid="([^"]+)"/, &1, ~s( id="#{name}-\\1")))

    |> then(&Regex.replace(~r/url\(#([^)]+)\)/, &1, "url(##{name}-\\1)"))

  end

  defp normalize_whitespace(svg) do

    svg

    |> String.replace(~r/\s*\n\s*/, " ")

    |> String.replace(~r/\s+/, " ")

    |> String.replace(" >", ">")

    |> String.replace("/ >", "/>")

    |> String.trim()

  end

  defp kebab_case(component) do

    component

    |> String.replace(~r/([a-z0-9])([A-Z])/, "\\1-\\2")

    |> String.replace(~r/([A-Z])([A-Z][a-z])/, "\\1-\\2")

    |> String.downcase()

  end

end

defmodule Mix.Tasks.Openagents.Persona.VerifyPromotion do

  use Mix.Task

  @shortdoc "Verify persona source and regression evidence before promotion"

  @impl Mix.Task

  def run([report_path]) do

    Mix.Task.run("app.start")

    with {:ok, contents} <- File.read(report_path),

         {:ok, report} <- Jason.decode(contents),

         manifest <- OpenAgents.Persona.SourceManifest.load!(),

         persona <- OpenAgents.Persona.current!(),

         corpus <- OpenAgents.Persona.Evaluation.Corpus.load!(),

         :ok <-

           OpenAgents.Persona.Evaluation.ReleaseGate.validate(persona, manifest, corpus, report) do

      Mix.shell().info("promotion evidence passed for #{persona.id} on #{report["model_id"]}")

    else

      {:error, reason} -> Mix.raise("persona promotion blocked: #{inspect(reason)}")

    end

  end

  def run(_arguments),

    do: Mix.raise("usage: mix openagents.persona.verify_promotion REPORT_PATH")

end

defmodule Mix.Tasks.Openagents.Voice.LoadProbe do

  use Mix.Task

  @shortdoc "Run a bounded readiness load probe"

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} =

      OptionParser.parse(arguments,

        strict: [url: :string, requests: :integer, concurrency: :integer, output: :string]

      )

    if invalid != [] or remaining != [], do: Mix.raise("invalid load-probe arguments")

    url = Keyword.fetch!(options, :url)

    requests = Keyword.get(options, :requests, 100)

    concurrency = Keyword.get(options, :concurrency, 10)

    case Application.ensure_all_started(:req) do

      {:ok, _applications} -> :ok

      {:error, reason} -> Mix.raise("could not start Req: #{inspect(reason)}")

    end

    report = OpenAgents.Voice.Operations.LoadProbe.run(url, requests, concurrency)

    encoded = Jason.encode_to_iodata!(report, pretty: true)

    case Keyword.get(options, :output) do

      nil ->

        Mix.shell().info(encoded)

      path ->

        File.write!(path, encoded)

        Mix.shell().info("wrote #{path}")

    end

  end

end

defmodule Mix.Tasks.Openagents.Voice.ReleaseControl do

  use Mix.Task

  @shortdoc "Append a governed voice admission state"

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} =

      OptionParser.parse(arguments,

        strict: [state: :string, reason: :string, actor: :string, revision: :string]

      )

    if invalid != [] or remaining != [], do: Mix.raise("invalid release-control arguments")

    start_operational_application()

    case OpenAgents.Voice.ReleaseControl.append(%{

           state: Keyword.get(options, :state),

           reason: Keyword.get(options, :reason),

           actor: Keyword.get(options, :actor),

           source_revision: Keyword.get(options, :revision)

         }) do

      {:ok, control} ->

        Mix.shell().info(

          Jason.encode!(%{

            schema: "openagents.voice_release_control_result.v1",

            id: control.id,

            state: control.state,

            inserted_at: control.inserted_at

          })

        )

      {:error, changeset} ->

        Mix.raise("release control refused: #{inspect(changeset.errors)}")

    end

  end

  defp start_operational_application do

    Application.put_env(:openagents, :turn_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_retention_worker_enabled, false)

    Mix.Task.run("app.start")

  end

end

defmodule Mix.Tasks.Openagents.Voice.Report do

  use Mix.Task

  @shortdoc "Write a transcript-free aggregate voice release report"

  @impl Mix.Task

  def run(arguments) do

    {options, remaining, invalid} =

      OptionParser.parse(arguments, strict: [since_hours: :integer, output: :string])

    if invalid != [] or remaining != [], do: Mix.raise("invalid voice-report options")

    hours = Keyword.get(options, :since_hours, 24)

    if hours not in 1..2_160, do: Mix.raise("--since-hours must be between 1 and 2160")

    start_read_only_application()

    report =

      OpenAgents.Voice.Operations.Report.build(DateTime.add(DateTime.utc_now(), -hours, :hour))

    encoded = Jason.encode_to_iodata!(report, pretty: true)

    case Keyword.get(options, :output) do

      nil ->

        Mix.shell().info(encoded)

      path ->

        File.write!(path, encoded)

        Mix.shell().info("wrote #{path}")

    end

  end

  defp start_read_only_application do

    Application.put_env(:openagents, :turn_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_retention_worker_enabled, false)

    Mix.Task.run("app.start")

  end

end

defmodule Mix.Tasks.Openagents.Voice.Retention do

  use Mix.Task

  @shortdoc "Run the bounded voice operational-retention purge"

  @impl Mix.Task

  def run([]) do

    Application.put_env(:openagents, :turn_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_recovery_worker_enabled, false)

    Application.put_env(:openagents, :voice_retention_worker_enabled, false)

    Mix.Task.run("app.start")

    case OpenAgents.Voice.Retention.purge_expired() do

      {:ok, count} -> Mix.shell().info(Jason.encode!(%{purged_sessions: count}))

      {:error, reason} -> Mix.raise("voice retention failed: #{inspect(reason)}")

    end

  end

  def run(_arguments), do: Mix.raise("this task accepts no arguments")

end

defmodule OpenAgentsWeb.AdminRecordingController do

  @moduledoc """

  Streams one call recording to an authenticated operator.

  The reader sends the complete ordered recording because later WebM, Ogg, and

  MP4 chunks depend on the first chunk's container header. It advertises no

  range support, unseals one chunk at a time, and never loads a complete call

  into memory.

  """

  use OpenAgentsWeb, :controller

  import Plug.Conn

  alias OpenAgents.Admin

  alias OpenAgents.Repo

  alias OpenAgents.Voice.Recordings

  def show(conn, %{"id" => id}) do

    case Admin.get_recording(id) do

      {:ok, recording, _owner} ->

        if recording.chunk_count > 0 and

             recording.status in OpenAgents.Voice.Recording.playable_statuses() do

          stream_recording(conn, recording)

        else

          send_resp(conn, :not_found, "")

        end

      {:error, :not_found} ->

        send_resp(conn, :not_found, "")

    end

  end

  defp stream_recording(conn, recording) do

    conn =

      conn

      |> put_resp_content_type(Recordings.content_type(recording), nil)

      |> put_resp_header("cache-control", "no-store")

      |> put_resp_header("accept-ranges", "none")

      |> put_resp_header("content-disposition", "inline")

      |> put_resp_header("x-content-type-options", "nosniff")

      |> send_chunked(:ok)

    {:ok, final_conn} =

      Repo.transaction(

        fn ->

          recording

          |> Recordings.stream()

          |> Enum.reduce_while(conn, fn recording_chunk, current_conn ->

            case chunk(current_conn, recording_chunk) do

              {:ok, next_conn} -> {:cont, next_conn}

              {:error, :closed} -> {:halt, current_conn}

            end

          end)

        end,

        timeout: :infinity

      )

    final_conn

  end

end

    websocket: [connect_info: [session: @session_options]],

    longpoll: [connect_info: [session: @session_options]]

  socket "/controller", OpenAgentsWeb.ControllerSocket,

  socket "/controller/socket", OpenAgentsWeb.ControllerSocket,

    websocket: [connect_info: [session: @session_options]],

    longpoll: [connect_info: [session: @session_options]]

defmodule OpenAgentsWeb.AdminRecordingsLive do

  @moduledoc """

  Lists bounded voice-call metadata and operator-only recording playback.

  The account panel remains the primary operator surface. This focused page

  restores recording qualification without exposing transcripts, prompts,

  provider identifiers, or recording bytes to ordinary accounts.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Accounts

  alias OpenAgents.Admin

  alias OpenAgents.Admin.Call

  alias OpenAgents.Voice.Recordings

  @page_size 25

  @impl true

  def mount(_params, _session, socket) do

    if Accounts.admin?(socket.assigns.current_user) do

      {:ok,

       socket

       |> assign(:page_title, "Voice recordings · OpenAgents")

       |> assign(:offset, 0)

       |> assign(:page_size, @page_size)

       |> assign(:recording_config, Recordings.config())

       |> stream_configure(:calls, dom_id: &"admin-call-#{&1.session_id}")

       |> load_page()}

    else

      {:ok, redirect(socket, to: ~p"/")}

    end

  end

  @impl true

  def handle_event(event, _params, socket) when event in ["next_page", "previous_page"] do

    if Accounts.admin?(socket.assigns.current_user) do

      paginate(event, socket)

    else

      {:noreply, redirect(socket, to: ~p"/")}

    end

  end

  defp paginate("next_page", socket) do

    offset = socket.assigns.offset + @page_size

    if offset < socket.assigns.totals.calls do

      {:noreply, socket |> assign(:offset, offset) |> load_page()}

    else

      {:noreply, socket}

    end

  end

  defp paginate("previous_page", socket) do

    offset = max(socket.assigns.offset - @page_size, 0)

    {:noreply, socket |> assign(:offset, offset) |> load_page()}

  end

  defp load_page(socket) do

    calls = Admin.list_calls(limit: @page_size, offset: socket.assigns.offset)

    socket

    |> assign(:totals, Admin.recording_totals())

    |> assign(:calls_empty?, calls == [])

    |> assign(:page_count, length(calls))

    |> stream(:calls, calls, reset: true)

  end

  @impl true

  def render(assigns) do

    ~H"""

    <Layouts.app flash={@flash} current_scope={@current_scope} title="Voice recordings" wide>

      <section id="admin-recordings-page" class="panel" aria-label="Voice call recordings">

        <header class="panel__header">

          <div>

            <h1 class="panel__title">Voice recordings</h1>

            <p class="text-muted-foreground">

              Audio is stored {sealed_label(@recording_config)} and deleted {@recording_config.retention_days} days after a call ends.

            </p>

          </div>

          <div class="admin-totals">

            <.badge variant={:dim}>{@totals.calls} calls</.badge>

            <.badge variant={:info}>{@totals.recorded} with audio</.badge>

            <.badge variant={:dim}>{format_bytes(@totals.byte_size)} stored</.badge>

          </div>

        </header>

        <div id="admin-recording-calls" phx-update="stream" class="admin-rows">

          <.empty

            :if={@calls_empty?}

            id="admin-recordings-empty"

            title="No voice calls yet"

          >

            Calls appear here after an account uses voice.

          </.empty>

          <.card :for={{dom_id, call} <- @streams.calls} id={dom_id}>

            <div class="admin-row">

              <div class="admin-identity">

                <.avatar

                  src={call.github_avatar_url}

                  alt=""

                  size={:sm}

                  fallback={String.first(call.github_login)}

                />

                <span>

                  <strong :if={Call.display_name(call)}>{Call.display_name(call)}</strong>

                  <span>@{call.github_login}</span>

                </span>

              </div>

              <div class="admin-state">

                <.badge variant={status_variant(call.status)}>{String.upcase(call.status)}</.badge>

                <.badge :if={call.termination_reason} variant={:dim}>

                  {call.termination_reason}

                </.badge>

                <.badge :if={call.failure_code} variant={:danger}>{call.failure_code}</.badge>

              </div>

              <dl class="admin-meta">

                <div>

                  <dt>Started</dt><dd>{format_timestamp(call.started_at)}</dd>

                </div>

                <div>

                  <dt>Call length</dt><dd>{format_call_length(call)}</dd>

                </div>

                <div>

                  <dt>Model</dt><dd>{call.model_id}</dd>

                </div>

                <div>

                  <dt>Tokens</dt><dd>{format_count(call.total_tokens)}</dd>

                </div>

                <div>

                  <dt>Transcript</dt><dd>{format_count(call.transcript_item_count)} items</dd>

                </div>

                <div :if={call.recording}>

                  <dt>Audio</dt>

                  <dd>{format_bytes(call.recording.byte_size)} · {Call.completeness(call)}</dd>

                </div>

              </dl>

              <.audio_player

                :if={Call.playable?(call)}

                id={"admin-audio-#{call.session_id}"}

                src={~p"/admin/recordings/#{call.recording.id}/audio"}

                label={"Call with @#{call.github_login} on #{format_timestamp(call.started_at)}"}

              />

              <p :if={!Call.playable?(call)} class="admin-absence">{Call.absence_reason(call)}</p>

            </div>

          </.card>

        </div>

        <nav :if={@totals.calls > @page_size} class="admin-pager" aria-label="Call pages">

          <.button

            id="admin-recordings-previous"

            variant={:secondary}

            size={:sm}

            disabled={@offset == 0}

            phx-click="previous_page"

          >

            Previous

          </.button>

          <span>{@offset + 1}–{@offset + @page_count} of {@totals.calls}</span>

          <.button

            id="admin-recordings-next"

            variant={:secondary}

            size={:sm}

            disabled={@offset + @page_size >= @totals.calls}

            phx-click="next_page"

          >

            Next

          </.button>

        </nav>

      </section>

    </Layouts.app>

    """

  end

  defp sealed_label(%{sealed?: true}), do: "encrypted"

  defp sealed_label(%{sealed?: false}), do: "unencrypted"

  defp status_variant("ended"), do: :dim

  defp status_variant("failed"), do: :danger

  defp status_variant(_active), do: :success

  defp format_call_length(%Call{recording: %{client_duration_ms: ms}}) when is_integer(ms),

    do: format_duration_ms(ms)

  defp format_call_length(%Call{started_at: started, ended_at: ended})

       when not is_nil(started) and not is_nil(ended),

       do: started |> DateTime.diff(ended, :millisecond) |> abs() |> format_duration_ms()

  defp format_call_length(%Call{}), do: "—"

  defp format_duration_ms(ms) do

    total_seconds = div(ms, 1_000)

    "#{div(total_seconds, 60)}:#{total_seconds |> rem(60) |> Integer.to_string() |> String.pad_leading(2, "0")}"

  end

  defp format_timestamp(nil), do: "—"

  defp format_timestamp(%DateTime{} = at) do

    at |> DateTime.truncate(:second) |> Calendar.strftime("%Y-%m-%d %H:%M:%S UTC")

  end

  defp format_bytes(bytes) when is_integer(bytes) and bytes < 1_024, do: "#{bytes} B"

  defp format_bytes(bytes) when is_integer(bytes) and bytes < 1_048_576,

    do: "#{Float.round(bytes / 1_024, 1)} KB"

  defp format_bytes(bytes) when is_integer(bytes),

    do: "#{Float.round(bytes / 1_048_576, 1)} MB"

  defp format_bytes(_bytes), do: "0 B"

  defp format_count(count) when is_integer(count) do

    count

    |> Integer.to_string()

    |> String.reverse()

    |> String.replace(~r/(\d{3})(?=\d)/, "\\1,")

    |> String.reverse()

  end

end

            <p>

              Machine-readable: <code>GET /api/status</code>

              (schema <code>openagents.network_status.v1</code>) ·

              probe: <code>GET /healthz</code>. This page updates live.

              probe: <code>GET /health</code>. This page updates live.

            </p>

          </footer>

        </section>

    "/components/:slug",

    "/docs",

    "/docs/:slug",

    "/health",

    "/healthz"

  ]

      %{

        transport: :websocket,

        verb: "connect",

        path: "/controller",

        path: "/controller/socket",

        handler: "OpenAgentsWeb.ControllerSocket",

        action: "connect",

        class: :machine,

  defp policy(%{path: "/admin/scv/accounts"}),

    do: declaration(:operator, "configured operator GitHub ID", "scv:account:connect", true)

  defp policy(%{path: "/admin/recordings"}),

    do: declaration(:operator, "configured operator GitHub ID", "voice:recording:list", false)

  defp policy(%{path: "/admin/recordings/:id/audio"}),

    do: declaration(:operator, "configured operator GitHub ID", "voice:recording:read", false)

  defp policy(%{path: "/admin"}),

    do: declaration(:operator, "configured operator GitHub ID", "voice:metadata:read", false)

    plug OpenAgentsWeb.Plugs.ApiTokenAuth, scope: "forge:write"

  end

  pipeline :forge_git do

    plug OpenAgentsWeb.Plugs.ForgeGitAuth

  end