Remove inherited Sarah infrastructure names

4b8adbc37fa2 · Christopher David · 11d ago · parent fcb27de52c36

Remove inherited Sarah infrastructure names

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified AGENTS.md
modified assets/css/app.css
renamed assets/css/openagents.css
modified assets/test/voice_recording_test.mjs
modified assets/vendor/basecoat/README.md
modified config/config.exs
modified config/test.exs
modified docs/2026-08-20-integration-hardening-and-staging-readiness-recommendations.md
modified docs/decisions/0002-model-sarah-as-an-openagents-persona.md
modified docs/decisions/0005-use-basecoat-and-one-component-system.md
modified lib/openagents/application.ex
modified lib/openagents/changelog.ex
modified lib/openagents/changelog/backfill.ex
modified lib/openagents/cluster/ra_bootstrap.ex
modified lib/openagents/forge/boot_converge.ex
modified lib/openagents/forge/build_executor.ex
modified lib/openagents/forge/repos.ex
modified lib/openagents/forge/visibility.ex
modified lib/openagents/forge/wal.ex
modified lib/openagents/forge/wal/local.ex
modified lib/openagents/github.ex
modified lib/openagents/github_oauth.ex
modified lib/openagents/incidents/fixer.ex
modified lib/openagents/machines/token_vault.ex
modified lib/openagents/modules/metadata.ex
modified lib/openagents/network_status.ex
modified lib/openagents/observability/readback.ex
modified lib/openagents/observability/release_gate.ex
renamed lib/openagents/runtime_supervisor.ex
modified lib/openagents/tools/code_check.ex
modified lib/openagents/tools/computer_agent.ex
modified lib/openagents/tools/computer_devin.ex
modified lib/openagents/tools/computer_list.ex
modified lib/openagents/tools/computer_probe.ex
modified lib/openagents/tools/computer_run.ex
modified lib/openagents/tools/conversation_read.ex
modified lib/openagents/tools/conversation_search.ex
modified lib/openagents/tools/deep_work.ex
modified lib/openagents/tools/github_repo_list.ex
modified lib/openagents/tools/github_repo_read.ex
modified lib/openagents/tools/incident_lookup.ex
modified lib/openagents/tools/memory_contract.ex
modified lib/openagents/tools/module_discover.ex
modified lib/openagents/tools/repo_commit_push.ex
modified lib/openagents/tools/repo_edit.ex
modified lib/openagents/tools/repo_grep.ex
modified lib/openagents/tools/repo_list.ex
modified lib/openagents/tools/repo_read.ex
modified lib/openagents/tools/repo_write.ex
modified lib/openagents/tools/repository.ex
modified lib/openagents/tools/runner.ex
modified lib/openagents/voice/recording_vault.ex
modified lib/openagents_web.ex
modified lib/openagents_web/channels/computer_channel.ex
modified lib/openagents_web/component_catalog.ex
modified lib/openagents_web/components/core_components.ex
modified lib/openagents_web/components/layouts.ex
modified lib/openagents_web/components/tool_activity.ex
renamed lib/openagents_web/components/ui.ex
modified lib/openagents_web/controllers/changelog_controller.ex
modified lib/openagents_web/controllers/computers_controller.ex
modified lib/openagents_web/controllers/network_status_controller.ex
modified lib/openagents_web/live/admin_forge_live.ex
modified lib/openagents_web/live/admin_live.ex
modified lib/openagents_web/live/changelog_live.ex
modified lib/openagents_web/live/chat_live.ex
modified lib/openagents_web/live/code_blob_live.ex
modified lib/openagents_web/live/code_commit_live.ex
modified lib/openagents_web/live/code_repo_live.ex
modified lib/openagents_web/live/components_live.ex
modified lib/openagents_web/live/computers_live.ex
modified lib/openagents_web/live/leaderboard_live.ex
modified lib/openagents_web/live/network_status_live.ex
modified lib/openagents_web/live/ui_gallery_live.ex
modified lib/openagents_web/live/voice_spike_live.ex
modified lib/openagents_web/plugs/forge_git_auth.ex
modified lib/openagents_web/router.ex
modified mix.exs
added ops/ci/allowed-sarah-references.txt
added ops/ci/reference-check.sh
modified priv/icons/README.md
modified test/openagents/accounts_test.exs
modified test/openagents/admin_test.exs
modified test/openagents/blueprint_test.exs
modified test/openagents/changelog_test.exs
renamed test/openagents/cluster/basic_test.exs
modified test/openagents/cluster/chaos_test.exs
modified test/openagents/cluster/drain_test.exs
modified test/openagents/cluster/ra_cluster_test.exs
modified test/openagents/coding_job_test.exs
modified test/openagents/collective_generalizer_test.exs
modified test/openagents/collective_publication_test.exs
modified test/openagents/collective_test.exs
modified test/openagents/compensation_test.exs
modified test/openagents/computer_activity_test.exs
modified test/openagents/conversations_test.exs
modified test/openagents/data_rights/atif_export_test.exs
modified test/openagents/deep_work_tool_loop_test.exs
modified test/openagents/experience_memory_test.exs
modified test/openagents/forge/boot_converge_test.exs
modified test/openagents/forge/browse_test.exs
modified test/openagents/forge/builder_test.exs
modified test/openagents/forge/git_http_test.exs
modified test/openagents/forge/hot_loader_test.exs
modified test/openagents/forge/janitor_test.exs
modified test/openagents/forge/loop_v0_test.exs
modified test/openagents/forge/mirror_watch_test.exs
modified test/openagents/forge/receipt_replayer_test.exs
renamed test/openagents/forge/target_lifecycle_test.exs
modified test/openagents/forge/targets_test.exs
modified test/openagents/forge/visibility_test.exs
modified test/openagents/forge/wal_test.exs
modified test/openagents/github_oauth_test.exs
modified test/openagents/github_test.exs
modified test/openagents/graph_memory_test.exs
modified test/openagents/incidents/fixer_test.exs
modified test/openagents/incidents_test.exs
modified test/openagents/inference_test.exs
modified test/openagents/leaderboard_test.exs
added test/openagents/machines/token_vault_test.exs
modified test/openagents/machines_capacity_test.exs
modified test/openagents/machines_test.exs
modified test/openagents/memory/evaluation_test.exs
modified test/openagents/memory/evidence_test.exs
modified test/openagents/memory/lexical_recall_test.exs
modified test/openagents/memory/policy_and_redaction_test.exs
modified test/openagents/memory_portability_test.exs
modified test/openagents/modules/lifecycle_test.exs
modified test/openagents/modules/registry_test.exs
modified test/openagents/network_status_test.exs
modified test/openagents/observability_test.exs
modified test/openagents/preferences_test.exs
modified test/openagents/profile_memory_test.exs
modified test/openagents/program_lifecycle_test.exs
modified test/openagents/semantic_recall_test.exs
modified test/openagents/shadow_programs_test.exs
modified test/openagents/tool_step_persistence_test.exs
modified test/openagents/tools/computer_tools_test.exs
modified test/openagents/tools/conversation_recall_tools_test.exs
modified test/openagents/tools/github_repo_tools_test.exs
modified test/openagents/tools/incident_lookup_test.exs
modified test/openagents/tools/profile_memory_tools_test.exs
modified test/openagents/tools/registry_and_runner_test.exs
modified test/openagents/tools/repository_mutation_tools_test.exs
modified test/openagents/tools/repository_tools_test.exs
modified test/openagents/turn_memory_evidence_journeys_test.exs
modified test/openagents/turn_provenance_test.exs
modified test/openagents/turn_provider_events_test.exs
modified test/openagents/turn_tool_loop_test.exs
modified test/openagents/voice/recordings_test.exs
modified test/openagents/voice/release_operations_test.exs
modified test/openagents/voice_sessions_test.exs
modified test/openagents/voice_test.exs
modified test/openagents/work/handoff_test.exs
modified test/openagents/work_job_test.exs
modified test/openagents_web/account_chrome_test.exs
modified test/openagents_web/allowed_origins_test.exs
modified test/openagents_web/auth_controller_test.exs
modified test/openagents_web/auth_gate_test.exs
modified test/openagents_web/channels/computer_channel_test.exs
modified test/openagents_web/component_catalog_test.exs
modified test/openagents_web/controllers/atif_export_controller_test.exs
modified test/openagents_web/controllers/computer_agent_jobs_controller_test.exs
modified test/openagents_web/controllers/computers_controller_test.exs
modified test/openagents_web/controllers/controller_pairing_test.exs
modified test/openagents_web/controllers/data_controller_test.exs
modified test/openagents_web/controllers/health_controller_test.exs
modified test/openagents_web/controllers/inference_proxy_controller_test.exs
deleted test/openagents_web/controllers/sarah_error_html_test.exs
deleted test/openagents_web/controllers/sarah_error_json_test.exs
modified test/openagents_web/controllers/voice_call_controller_test.exs
modified test/openagents_web/controllers/voice_recording_controller_test.exs
modified test/openagents_web/controllers/voice_telemetry_controller_test.exs
modified test/openagents_web/icon_affordances_test.exs
modified test/openagents_web/icons_test.exs
modified test/openagents_web/live/admin_forge_live_test.exs
modified test/openagents_web/live/admin_live_test.exs
modified test/openagents_web/live/assignee_index_live_test.exs
modified test/openagents_web/live/changelog_live_test.exs
modified test/openagents_web/live/chat_delegation_rail_test.exs
modified test/openagents_web/live/chat_live_test.exs
modified test/openagents_web/live/chat_sidebar_sections_test.exs
modified test/openagents_web/live/code_live_test.exs
modified test/openagents_web/live/computers_access_test.exs
modified test/openagents_web/live/computers_live_test.exs
modified test/openagents_web/live/computers_navigation_test.exs
modified test/openagents_web/live/computers_pairing_errors_test.exs
modified test/openagents_web/live/issue_index_live_test.exs
modified test/openagents_web/live/issue_new_live_test.exs
modified test/openagents_web/live/issue_show_live_test.exs
modified test/openagents_web/live/label_index_live_test.exs
modified test/openagents_web/live/leaderboard_live_test.exs
modified test/openagents_web/live/milestone_index_live_test.exs
modified test/openagents_web/live/network_status_live_test.exs
modified test/openagents_web/live/project_index_live_test.exs
modified test/openagents_web/live/project_show_live_test.exs
modified test/openagents_web/live/ui_gallery_live_test.exs
modified test/openagents_web/tool_activity_test.exs
modified test/openagents_web/ui_test.exs
renamed test/support/channel_case.ex
deleted test/support/sarah_conn_case.ex
deleted test/support/sarah_data_case.ex
deleted test/support/sarah_factory.ex
deleted test/support/sarah_fixtures.ex
modified test/support/tools/test_recall.ex

Diff

205 files changed, +944 -844


- **Always use and maintain this import syntax** in the app.css file for projects generated with `phx.new`
- **Never** use `@apply` when writing raw css
- **There is exactly one component system: vendored Basecoat plus Sarah's style pack.** Basecoat lives in `assets/vendor/basecoat/components/` and carries structure (display, padding, min-height); `assets/css/sarah.css` carries OpenAgents' identity (motion tokens, radius scale, colour, the notched variant, corner frames) and must stay the last import so its declarations win.
  - **Reach for `OpenAgentsWeb.SarahUI` first.** It wraps that CSS in nineteen ready primitives — `button/1`, `card/1`, `badge/1`, `alert/1`, `input/1`, `textarea/1`, `label/1`, `field/1`, `avatar/1`, `menu/1`, `empty/1`, `kbd/1`, and the rest. Fall back to hand-written classes only when no primitive covers the shape.
- **There is exactly one component system: vendored Basecoat plus OpenAgents style pack.** Basecoat lives in `assets/vendor/basecoat/components/` and carries structure (display, padding, min-height); `assets/css/openagents.css` carries OpenAgents' identity (motion tokens, radius scale, colour, the notched variant, corner frames) and must stay the last import so its declarations win.
  - **Reach for `OpenAgentsWeb.UI` first.** It wraps that CSS in nineteen ready primitives — `button/1`, `card/1`, `badge/1`, `alert/1`, `input/1`, `textarea/1`, `label/1`, `field/1`, `avatar/1`, `menu/1`, `empty/1`, `kbd/1`, and the rest. Fall back to hand-written classes only when no primitive covers the shape.
  - **Variants are data attributes, not classes.** A control is `class="btn"` plus `data-variant="primary"` / `data-size="sm"` / `data-tone="danger"`. Never invent `btn-primary`-style variant classes; they defeat the whole point of the split.
  - **Never add a second component library — DaisyUI above all.** DaisyUI was removed deliberately. It emitted flat `.btn` rules (setting background, colour, border) from a cascade layer that outranked every `.btn[data-variant=…]` in `sarah.css`, so all eight SarahUI button variants rendered identically on staging. Any library with the same shape will do the same thing again.
  - **Never add a second component library — DaisyUI above all.** DaisyUI was removed deliberately. It emitted flat `.btn` rules (setting background, colour, border) from a cascade layer that outranked every `.btn[data-variant=…]` in `openagents.css`, so all eight UI button variants rendered identically on staging. Any library with the same shape will do the same thing again.
  - **Import Basecoat components individually**, one `@import "../vendor/basecoat/components/<name>.css"` per component a surface actually uses. Component CSS lands in `@layer components` and ships whether or not the class appears in markup, so the list is a budget. **Never** import `basecoat.css`, `basecoat-base.css`, or `basecoat-components.css` — each pulls in all 39 components at once.
  - The palette is the token ladder at the top of `app.css` (`--ink-void` / `--ink-surface` / `--ink-raised`, the text and line tiers, and the four semantic colours). It is dark-only. Prefer the Basecoat utility names built on it — `bg-background`, `bg-card`, `text-foreground`, `text-muted-foreground`, `border-border` — over the older `base-100`/`base-content` aliases, which are kept only so unconverted surfaces keep resolving.
- Add custom Tailwind only when the design is unique to OpenAgents and no primitive fits.

/* See the Tailwind configuration guide for advanced usage
   https://tailwindcss.com/docs/configuration */

/* There is exactly one component system here: Basecoat structure plus Sarah's
/* There is exactly one component system here: Basecoat structure plus OpenAgents
 * style pack. DaisyUI was removed (see AGENTS.md) — it emitted flat component
 * rules from its own cascade layer that outranked every `.btn[data-variant=…]`
 * in sarah.css, so all eight SarahUI button variants rendered identically. Do
 * in openagents.css, so all eight UI button variants rendered identically. Do
 * not reintroduce it, and do not add a second component library beside it.
 *
 * With DaisyUI gone the layer order Tailwind itself declares

 * basecoat-components.css. See assets/vendor/basecoat/README.md.
 *
 * These carry the structure (display, padding, min-height, background) that
 * sarah.css deliberately does not set — its .btn only adds gap, border,
 * openagents.css deliberately does not set — its .btn only adds gap, border,
 * radius, colour, font, and transition on top. With DaisyUI gone they are the
 * only source of that geometry, so nothing here is optional. This list is
 * Sarah's, plus `table` for `CoreComponents.table/1`. */
 * OpenAgents, plus `table` for `CoreComponents.table/1`. */
@import "../vendor/basecoat/base/base.css";
@import "../vendor/basecoat/components/button.css";
@import "../vendor/basecoat/components/input.css";

@import "../vendor/basecoat/components/kbd.css";
@import "../vendor/basecoat/components/table.css";

/* Sarah's identity. Must stay last so its declarations win. */
@import "./sarah.css";
/* OpenAgents identity. Must stay last so its declarations win. */
@import "./openagents.css";
@source "../css";
@source "../js";
@source "../../lib/openagents_web";

@plugin "../vendor/heroicons";

/* ── Token ladder ───────────────────────────────────────────────────────────
 * Ported from Sarah, where these are the two tiers of DESIGN.md "Color
 * Integrated into OpenAgents, where these are the two tiers of DESIGN.md "Color
 * Tokens": PRIMITIVES are the hand-picked Aiur oklch values; DERIVATIONS are
 * color-mix() steps off one ink, so the hover/focus/border grammar is
 * systematic rather than accumulated.
 *
 * sarah.css consumes these but does not define them — it aliases them onto
 * openagents.css consumes these but does not define them — it aliases them onto
 * the Basecoat names (`--background`, `--card`, `--primary`, `--border`, …)
 * in its own `:root`. Before this block existed those aliases resolved to
 * nothing and the DaisyUI theme was carrying the palette instead, which is
 * exactly the collision that made every SarahUI variant render identically.
 * exactly the collision that made every UI variant render identically.
 *
 * The three surfaces are a fixed relationship, not three loose colors: page
 * and sidebar sit on the darkest (--ink-void), the working canvas one step up
 * (--ink-surface), elevated components another step up (--ink-raised). New
 * surfaces take a rung; they do not invent a fourth.
 *
 * The palette is dark-only, as Sarah's is (`color-scheme: dark`). The
 * The palette is dark-only, as OpenAgents is (`color-scheme: dark`). The
 * `data-theme` plumbing in root.html.heex still runs, but there is no second
 * light palette behind it any more — DaisyUI's was the only one, and Sarah
 * light palette behind it any more — DaisyUI's was the only one, and OpenAgents
 * ships no light variant to replace it with.
 */
:root {

 * are still spoken by surfaces this change did not restyle (the component
 * catalog, the marketing home template, and the sidebar/docs/chat CSS at the
 * foot of this file). They are kept as aliases onto the three surface rungs so
 * that vocabulary keeps resolving; they are now names for Sarah tokens, not a
 * that vocabulary keeps resolving; they are now names for OpenAgents tokens, not a
 * second palette. Prefer Basecoat's own `background` / `card` / `foreground` /
 * `border` names in new markup.
 *
 * The semantic four are Sarah's, not DaisyUI's, and have no Basecoat
 * The semantic four are OpenAgents, not DaisyUI's, and have no Basecoat
 * equivalent — `--color-destructive` covers danger, but there is no success,
 * warning, or info in the Basecoat base. */
@theme {


/* This file is for your main application CSS */

/* ── Sidebar (Sarah-style layout with OpenAgents color tokens) ───────────── */
/* ── Sidebar (OpenAgents layout with OpenAgents color tokens) ───────────── */
.sidebar {
  display: flex;
  min-height: 0;

  padding: 32px;
}

/* Chat UI (Sarah-style) */
/* Chat UI (OpenAgents) */

.chat-transcript {
  display: flex;

/*
 * Sarah style pack
 * OpenAgents style pack
 *
 * Basecoat ships structure (assets/vendor/basecoat/components/*.css: layout,
 * accessibility selectors, behavior hooks - no color, no radius) separately
 * from visual style packs. We import the structure and write this pack instead
 * of adopting Vega or any other shadcn pack, so Sarah's identity is a
 * of adopting Vega or any other shadcn pack, so OpenAgents identity is a
 * first-class artifact rather than a diff against another product's defaults.
 *
 * This file is imported last. Every rule here must be traceable to DESIGN.md.

}

/* ── Token layer ───────────────────────────────────────────────────────────
 * Sarah's Aiur tokens (declared in app.css) are the authored source of truth.
 * OpenAgents Aiur tokens (declared in app.css) are the authored source of truth.
 * Basecoat's shadcn-compatible names are derived from them so both vocabularies
 * resolve to one palette. DESIGN.md's token table stays the readable contract.
 */


/* ── Surface recipes ───────────────────────────────────────────────────────
 * Shared mechanics that later phases compose by name. Each is a pattern with
 * one utility class, not a component: components stay in SarahWeb.UI.
 * one utility class, not a component: components stay in OpenAgentsWeb.UI.
 */

@layer components {

    inset: 3px;
  }

  /* Link buttons are Sarah's inline action: underlined text, not a boxed
  /* Link buttons are OpenAgents inline action: underlined text, not a boxed
     control. Size tokens must not apply. */
  .btn[data-variant="link"] {
    min-height: 0;

@layer components {
  /* One durable event as a disclosure row: chevron, status dot, quiet 13px
     one-line title, optional short status note in text, hover-revealed
     timestamp. Devin's event-header primitive over Sarah's tokens; the
     timestamp. Devin's event-header primitive over OpenAgents tokens; the
     expansion carries the bounded durable details. */
  .event-header {
    min-width: 0;

/* ── Status indicator ─────────────────────────────────────────────────────── */

@layer components {
  /* Sarah's semantic state marker: a small lit dot that reinforces a text
  /* OpenAgents semantic state marker: a small lit dot that reinforces a text
     label and never replaces it. Reserved meanings: green completed and
     connected, blue active and streaming, gold required attention, red
     failed. The halo is the state made legible at a glance, not decoration. */

  }

  /* "ended", "live", and "attention" are the sidebar status rows' lifecycle
     vocabulary (DESIGN.md, Sarah shell): an ordinarily ended call is a muted
     vocabulary (DESIGN.md, OpenAgents shell): an ordinarily ended call is a muted
     fact, a live call is blue activity, and budget/interrupted outcomes ask
     for gold attention. Each joins the existing hue group; no new color. */
  .status-indicator[data-state="idle"],

@layer components {
  /* Native controls, deliberately: the browser's transport is already keyboard
   * operable and already announced, and a hand-rolled one would have to re-earn
   * both. Only the box the transport sits in is Sarah's. */
   * both. Only the box the transport sits in is OpenAgents. */
  .audio-player {
    display: block;
    width: 100%;

/* ── Popover / menu ───────────────────────────────────────────────────────── */

@layer components {
  /* Sarah keeps the native `popover` API: no Basecoat JavaScript, and the
  /* OpenAgents keeps the native `popover` API: no Basecoat JavaScript, and the
   * control works without client-side script.
   *
   * Basecoat's own popover CSS is deliberately not imported. There, `.popover`


  const call = new CallRecorder({
    microphone: "mic-stream",
    remoteStream: "sarah-stream",
    remoteStream: "remote-stream",
    generation: "3",
    timesliceMs: 5000,
    mimeType: "audio/webm;codecs=opus",

Deliberately **not** vendored:

- `src/css/styles/*` — the Vega/Nova/Maia/Lyra/Mira/Luma/Sera/Rhea visual packs.
  Sarah writes its own pack at `assets/css/style-sarah.css`. Importing one of
  OpenAgents writes its own pack at `assets/css/openagents.css`. Importing one of
  theirs and overriding it would leave dead visual rules in the bundle and make
  Sarah's identity a diff against another product's defaults.
- `src/js/*` — no Basecoat JavaScript is loaded. The only component Sarah's
  OpenAgents identity a diff against another product's defaults.
- `src/js/*` — no Basecoat JavaScript is loaded. The only component OpenAgents
  surfaces would need it for is `dropdown-menu`, and the account menu uses the
  native `popover` API instead, which is required to work without custom
  client-side JavaScript. Taking zero Basecoat JS also removes the LiveView

`assets/css/app.css` imports `base/base.css` plus **individually named**
component files. Component CSS lives in `@layer components` and is emitted
whether or not the class appears in markup, so importing the full set costs
about 13.5 KB gzip against about 7.4 KB for the components Sarah actually uses.
about 13.5 KB gzip against about 7.4 KB for the components OpenAgents actually uses.
Never import `basecoat.css`, `basecoat-base.css`, or `basecoat-components.css`.

Adding an import is a deliberate act tied to a surface that needs it.

  forge_boot_converge_enabled: false,
  forge_deploy_lane_enabled: true,
  forge_data_dir: nil,
  forge_build_dir: "/var/lib/sarah/workspace/build",
  forge_repos: ["sarah"],
  forge_build_dir: "/var/lib/openagents/workspace/build",
  forge_repos: ["openagents.com"],
  forge_internal_git_url: "http://127.0.0.1:8080/git",
  forge_operator_token: nil,
  forge_mirror_urls: %{},

    "OpenAgents.Scratch.",
    "OpenAgents.BuildInfo"
  ],
  forge_public_visibility: %{"sarah" => :l2},
  forge_repo_owners: %{"sarah" => "OpenAgentsInc"},
  forge_public_paths: %{
    "sarah" => [
      "README.md",
      "CHANGELOG.md",
      "docs/audits/2026-08-19-public-changelog-transparency-audit.md",
      "docs/plans/2026-08-19-transparency-spec-and-roadmap.md"
    ]
  },
  forge_public_visibility: %{"openagents.com" => :l3},
  forge_repo_owners: %{"openagents.com" => "OpenAgentsInc"},
  forge_public_paths: %{"openagents.com" => []},
  dns_cluster_query: nil

# Configure the endpoint

# `OpenAgents.Forge.HotLoader` themselves.
config :openagents,
  forge_enabled: true,
  forge_repos: ["sarah", "demo"],
  forge_repos: ["openagents.com", "demo"],
  forge_operator_token: "forge_test_operator_token_0123456789",
  forge_deploy_lane_enabled: false,
  forge_repo_owners: %{"sarah" => "OpenAgentsInc", "demo" => "OpenAgentsInc"}
  forge_repo_owners: %{"openagents.com" => "OpenAgentsInc", "demo" => "OpenAgentsInc"}

config :openagents, :migrate_on_boot, false
config :openagents, :ra_enabled, false

232	232		`service domains. Maintain a small allowlist of intentional Sarah-specific`
233	233		`locations. Fail the check on every unclassified match.`
234	234
	235	+	`### Gate 2 implementation status`
	236	+
	237	+	`Completed on 2026-08-20:`
	238	+
	239	+	- Renamed the generic runtime supervisor to `OpenAgents.RuntimeSupervisor` and
	240	+	the generic web macros to `openagents_live_view`, `openagents_html`, and
	241	+	`openagents_html_helpers`.
	242	+	- Renamed the product component module to `OpenAgentsWeb.UI` and the style pack
	243	+	to `assets/css/openagents.css`. Updated the catalog, component tests, Basecoat
	244	+	`notes, and contributor instructions with the new names.`
	245	+	- Consolidated lifted connection and data tests onto `OpenAgentsWeb.ConnCase`
	246	+	and `OpenAgents.DataCase`, renamed the shared channel case, removed unused
	247	+	`lifted factory and fixture stubs, and removed duplicate lifted error tests.`
	248	+	`- Replaced inherited runtime, Ra, forge, WAL, build-sidecar, test-peer, and`
	249	+	`coding-workspace names with OpenAgents names. The default forge repository is`
	250	+	now the public `OpenAgentsInc/openagents.com` repository, represented as
	251	+	`openagents.com` in repository-scoped records and URLs.
	252	+	`- Extended repository validation to admit bounded domain-style names without`
	253	+	`admitting consecutive dots, trailing dots, path separators, uppercase`
	254	+	`names, or unconfigured repositories.`
	255	+	`- Changed generic GitHub user agents, machine wire schemas, network and`
	256	+	`changelog schemas, observability schemas, and Git authentication labels to`
	257	+	`OpenAgents names.`
	258	+	`- Versioned machine-token and voice-recording authenticated encryption. New`
	259	+	`ciphertext uses OpenAgents AAD and version 2; reads retain explicit support`
	260	+	`for legacy version-1 Sarah ciphertext so the rename does not strand existing`
	261	+	`encrypted staging data.`
	262	+	- Added `ops/ci/reference-check.sh` and a documented allowlist. `mix precommit`
	263	+	`now rejects unclassified Sarah names, retired service domains, inherited`
	264	+	`filesystem roots, source-project symbols, builder labels, and repository`
	265	+	`names. The allowlist preserves persona language, stable behavior and data`
	266	+	`contracts, persona artifacts, historical migrations, and named historical`
	267	+	`documents.`
	268	+	`- Verified the change with 15 browser tests, 1,222 default Elixir tests, and all`
	269	+	`9 isolated cluster tests, with zero failures.`
	270	+
235	271		`Exit criteria: Every remaining Sarah reference is intentional, documented,`
236	272		`and specific to Sarah rather than inherited infrastructure.`
237	273

## Final staging readiness checklist

- [x] The repository has one accurate architecture narrative.
- [ ] Every remaining Sarah reference is intentional and specific.
- [x] Every remaining Sarah reference is intentional and specific.
- [ ] All documentation links and invariant evidence resolve.
- [ ] The application has one Markdown parser, component system, and documented
      two-tier icon policy.

voice copy.

Use OpenAgents names for generic supervisors, web helpers, style packs,
runtime paths, build services, test cases, and configuration. Gate 2 performs
that semantic rename and adds an allowlist for intentional references.
runtime paths, build services, test cases, and configuration. Gate 2 completed
that semantic rename and added an executable allowlist for intentional
references.

## Consequences


module and use those components before adding surface-specific markup.

Do not add DaisyUI, another component library, remote fonts, icon fonts, or a
second Markdown presentation stack. Rename the generic `SarahUI` module and
style pack during Gate 2 without changing Sarah-specific visual copy.
second Markdown presentation stack. The generic component module is
`OpenAgentsWeb.UI`, and the product style pack is `assets/css/openagents.css`.
Keep Sarah-specific visual copy only where it identifies the persona.

## Consequences


      OpenAgents.Repo,
      {DNSCluster, query: Application.get_env(:openagents, :dns_cluster_query) || :ignore},
      {Phoenix.PubSub, name: OpenAgents.PubSub},
      OpenAgents.Sarah.Supervisor,
      OpenAgents.RuntimeSupervisor,
      # Start a worker by calling: OpenAgents.Worker.start_link(arg)
      # {OpenAgents.Worker, arg},
      # Start to serve requests, typically the last entry

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, PushReceipt, Visibility}
  alias OpenAgents.Repo

  @schema_version "sarah.changelog.v1"
  @schema_version "openagents.changelog.v1"
  @cache_key {__MODULE__, :cache}
  @cache_ttl_ms 5_000
  @entry_limit 200


  alias OpenAgents.Changelog

  @repo "sarah"
  @repo "openagents.com"

  @doc "Boot entrypoint: seed if configured, never raise."
  def boot do


  @impl true
  def init(_opts) do
    data_dir = Application.get_env(:openagents, :ra_data_dir, "/tmp/sarah_ra")
    data_dir = Application.get_env(:openagents, :ra_data_dir, "/tmp/openagents_ra")
    expected = Application.get_env(:openagents, :ra_expected_size, 3)

    Ra.start_in(data_dir)

  end

  @doc false
  def converge(repo \\ "sarah") do
  def converge(repo \\ "openagents.com") do
    outcome =
      try do
        attempt(repo)

  the set of changed `.beam` binaries for that commit.

  The production adapter is `OpenAgents.Forge.BuildExecutor.Sidecar`, which
  talks to the `sarah-builder` sidecar container through a file queue on
  talks to the `openagents-builder` sidecar container through a file queue on
  the shared workspace volume. Tests use `OpenAgents.Forge.FakeBuildExecutor`.
  The adapter is selected via the `:forge_build_executor` application env
  (see `OpenAgents.Forge.Builder`).


defmodule OpenAgents.Forge.BuildExecutor.Sidecar do
  @moduledoc """
  Production build adapter: talks to the `sarah-builder` sidecar container
  through a file queue on the shared workspace volume. The Sarah release
  Production build adapter: talks to the `openagents-builder` sidecar container
  through a file queue on the shared workspace volume. The OpenAgents release
  container runs unprivileged with no docker socket, so it cannot exec
  into the sidecar — the queue is the whole interface. Protocol (the
  watcher script lives in `ops/fleet/fleet-startup.sh`):

  """
  def warm? do
    build_dir =
      Application.get_env(:openagents, :forge_build_dir, "/var/lib/sarah/workspace/build")
      Application.get_env(:openagents, :forge_build_dir, "/var/lib/openagents/workspace/build")

    File.exists?(Path.join(build_dir, ".forge-manifest"))
  end

    Application.get_env(
      :openagents,
      :forge_build_queue_dir,
      "/var/lib/sarah/workspace/build-queue"
      "/var/lib/openagents/workspace/build-queue"
    )
  end


  ever carry request data.
  """

  @name_pattern ~r/^[a-z0-9][a-z0-9_-]{0,63}$/
  @name_pattern ~r/^[a-z0-9](?:[a-z0-9_-]|\.(?=[a-z0-9])){0,63}$/

  @doc "The forge data directory (bare repos + WAL cache + beam artifacts)."
  def data_dir do
    Application.get_env(:openagents, :forge_data_dir) ||
      Path.join(System.tmp_dir!(), "sarah_forge_data")
      Path.join(System.tmp_dir!(), "openagents_forge_data")
  end

  @doc "Repositories this forge serves. Bounded, config-owned."
  def allowed_repos do
    Application.get_env(:openagents, :forge_repos, ["sarah"])
    Application.get_env(:openagents, :forge_repos, ["openagents.com"])
  end

  def valid_name?(name) when is_binary(name) do


  @doc "The WAL sequence this bare repo has applied (cache freshness marker)."
  def applied_seq(repo) do
    case File.read(Path.join(bare_path(repo), "sarah-wal-seq")) do
    case File.read(Path.join(bare_path(repo), "openagents-wal-seq")) do
      {:ok, contents} ->
        case Integer.parse(String.trim(contents)) do
          {seq, _} -> seq

  end

  def record_applied_seq!(repo, seq) when is_integer(seq) do
    File.write!(Path.join(bare_path(repo), "sarah-wal-seq"), Integer.to_string(seq))
    File.write!(Path.join(bare_path(repo), "openagents-wal-seq"), Integer.to_string(seq))
  end

  @doc "Run git with `--git-dir` pinned to the bare repo. Returns {output, status}."

  @doc """
  The owning account for `repo` — the first path segment of its public URL,
  so a forge URL is shaped exactly like the GitHub one it replaces
  (`/OpenAgentsInc/sarah/blob/main/README.md`). Operator-owned config.
  (`/OpenAgentsInc/openagents.com/blob/main/README.md`). Operator-owned config.
  """
  def owner(repo) when is_binary(repo) do
    :openagents

48	48		`@callback put_object(repo, object_key :: String.t(), payload :: binary()) ::`
49	49		`{:ok, String.t()} \| {:error, term}`
50	50
51		-	`@repo_pattern ~r/^[a-z0-9][a-z0-9_-]*$/`
	51	+	`@repo_pattern ~r/^[a-z0-9](?:[a-z0-9_-]\|\.(?=[a-z0-9]))*$/`
52	52		`@entry_key_pattern ~r/^entries\/[0-9]{8}-[0-9a-f]{12}$/`
53	53		`@artifact_key_pattern ~r/^artifacts\/[0-9a-f]{7,40}\.tar$/`
54	54

  Filesystem adapter for `OpenAgents.Forge.WAL` — the development and test backend.

  Layout under the base directory (`Application.get_env(:openagents, :forge_wal_dir)`,
  defaulting to `sarah_forge_wal` inside `System.tmp_dir!/0`):
  defaulting to `openagents_forge_wal` inside `System.tmp_dir!/0`):

      <base>/<repo>/index.json
      <base>/<repo>/entries/<key>


  defp base_dir do
    Application.get_env(:openagents, :forge_wal_dir) ||
      Path.join(System.tmp_dir!(), "sarah_forge_wal")
      Path.join(System.tmp_dir!(), "openagents_forge_wal")
  end
end

  @moduledoc "Server-side GitHub REST API access using the signed-in user's OAuth token."

  @github_api_version "2022-11-28"
  @user_agent "OpenAgents-Sarah"
  @user_agent "OpenAgents"
  @full_name_regex ~r/\A[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+\z/
  @maximum_file_bytes 65_536


  @default_user_url "https://api.github.com/user"
  @default_attempt_ttl_seconds 600
  @github_api_version "2022-11-28"
  @user_agent "OpenAgents-Sarah"
  @user_agent "OpenAgents"

  @type attempt :: %{required(String.t()) => String.t() | integer()}


    context: #{context}

    Delegate to a coding agent on the paired computer. Reproduce the failure in
    the OpenAgentsInc/sarah repo if you can, diagnose the root cause, and propose
    the OpenAgentsInc/openagents.com repo if you can, diagnose the root cause, and propose
    a MINIMAL patch by opening a pull request. Do NOT deploy and do NOT push to
    main directly — propose only. Report what you found and what you changed.
    """

defmodule OpenAgents.Machines.TokenVault do
  @moduledoc "AES-256-GCM sealing for machine tokens awaiting pairing claim."

  @aad "sarah.machine_token.v1"
  @version 2
  @legacy_version 1
  @aad "openagents.machine_token.v2"
  @legacy_aad "sarah.machine_token.v1"
  @nonce_bytes 12
  @tag_bytes 16
  @maximum_token_bytes 512

      {ciphertext, tag} =
        :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, token, @aad, true)

      {:ok, <<1, nonce::binary, tag::binary, ciphertext::binary>>}
      {:ok, <<@version, nonce::binary, tag::binary, ciphertext::binary>>}
    end
  end



  @spec open(binary()) :: {:ok, String.t()} | {:error, atom()}
  def open(
        <<1, nonce::binary-size(@nonce_bytes), tag::binary-size(@tag_bytes), ciphertext::binary>>
      ) do
        <<version, nonce::binary-size(@nonce_bytes), tag::binary-size(@tag_bytes),
          ciphertext::binary>>
      )
      when version in [@legacy_version, @version] do
    with {:ok, key} <- key() do
      case :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, ciphertext, @aad, tag, false) do
      aad = if version == @version, do: @aad, else: @legacy_aad

      case :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, ciphertext, aad, tag, false) do
        token when is_binary(token) -> {:ok, token}
        :error -> {:error, :token_unsealable}
      end

      },
      "publisher" => "OpenAgentsInc",
      "provenance" => %{
        "source" => "https://github.com/OpenAgentsInc/sarah",
        "source" => "https://github.com/OpenAgentsInc/openagents.com",
        "admission" => "reviewed_first_party_release"
      },
      "compatibility" => %{

  up/down and the status page's slow tick call `broadcast/0`).
  """

  @schema "sarah.network_status.v1"
  @schema "openagents.network_status.v1"
  @topic "network_status"
  @cache_key {__MODULE__, :cache}
  @cache_ms 2_000

  # Every read degrades to nil/[] — forge disabled or DB down renders as
  # "no deploys yet", never an error.
  defp forge_section do
    repo = safely(fn -> List.first(OpenAgents.Forge.Repos.allowed_repos()) end) || "sarah"
    repo =
      safely(fn -> List.first(OpenAgents.Forge.Repos.allowed_repos()) end) || "openagents.com"

    targets = safely(fn -> OpenAgents.Forge.Targets.recent(repo, 10) end) || []
    deploys = safely(fn -> OpenAgents.Forge.recent_deploys(repo, 10) end) || []


    voice_config = OpenAgents.Voice.Config.current!()

    %{
      schema: "sarah.observability.readback.v1",
      schema: "openagents.observability.readback.v1",
      captured_at: DateTime.utc_now() |> DateTime.to_iso8601(),
      persona_id: OpenAgents.Persona.current!().id,
      persona_digest: OpenAgents.Persona.current!().digest,

    warnings = exceeded(integrity, @warnings)

    %{
      schema: "sarah.observability.release_gate.v1",
      schema: "openagents.observability.release_gate.v1",
      status: if(blockers == [], do: "passed", else: "blocked"),
      blockers: blockers,
      warnings: warnings,

defmodule OpenAgents.Sarah.Supervisor do
defmodule OpenAgents.RuntimeSupervisor do
  @moduledoc """
  Supervisor for the ported Sarah subsystems.
  Supervisor for the integrated OpenAgents runtime subsystems.

  Starts the registries and supervisors used by turns, work, voice, and
  memory workers. Heavy recovery and retention workers are gated by feature

      required_authority: "code.execute",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, parsing candidate code in a throwaway process"
        disclosure: "the OpenAgents runtime, parsing candidate code in a throwaway process"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "application_process",

      },
      maintainer: "OpenAgents",
      attribution: [
        "OpenAgentsInc/sarah",
        "OpenAgentsInc/openagents.com",
        "OpenAgentsInc/sarah-computer-controller",
        "agentclientprotocol/agent-client-protocol"
      ],

      },
      maintainer: "OpenAgents",
      attribution: [
        "OpenAgentsInc/sarah",
        "OpenAgentsInc/openagents.com",
        "OpenAgentsInc/sarah-computer-controller",
        "agentclientprotocol/agent-client-protocol"
      ],

        disclosure: "Paired machine records for the signed-in owner"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "application_process",

        disclosure: "Read-only discovery on the user's paired computer"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah", "OpenAgentsInc/sarah-computer-controller"],
      attribution: ["OpenAgentsInc/openagents.com", "OpenAgentsInc/sarah-computer-controller"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "operator_machine",

        disclosure: "Command execution on the user's paired computer, bounded by its local policy"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah", "OpenAgentsInc/sarah-computer-controller"],
      attribution: ["OpenAgentsInc/openagents.com", "OpenAgentsInc/sarah-computer-controller"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "operator_machine",

        disclosure: "Sarah conversation recall"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "application_postgres"

        disclosure: "Sarah conversation recall"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "application_postgres",

      required_authority: "work.delegate",
      executor: %{id: "sarah.work.jobs", disclosure: "Sarah durable work jobs"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "application_postgres",

      required_authority: "github.read",
      executor: %{id: "sarah.github.api", disclosure: "GitHub API with the user's authorization"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "application_process",

      required_authority: "github.read",
      executor: %{id: "sarah.github.api", disclosure: "GitHub API with the user's authorization"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "application_process",

        disclosure: "Durable failure records for the signed-in owner"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "application_process",

      required_authority: authority,
      executor: %{id: "sarah.postgres.profile_memory", disclosure: "Sarah profile memory"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah", "OpenResponses/2026-04-24"],
      attribution: ["OpenAgentsInc/openagents.com", "OpenResponses/2026-04-24"],
      policy_facets: %{
        "privacy" => "signed_browser_owner",
        "residency" => "application_postgres",

      required_authority: "module.discover",
      executor: %{id: "sarah.module.discovery", disclosure: "Sarah module discovery"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "public_catalog_metadata_only",
        "residency" => "application_process"

defmodule OpenAgents.Tools.RepoCommitPush do
  @moduledoc """
  Commits this job's clone and pushes to the job's own `sarah/job-<id>`
  branch on Sarah's own forge — never GitHub, never another ref
  Commits this job's clone and pushes to the job's own `openagents/job-<id>`
  branch on the OpenAgents forge — never GitHub, never another ref
  (SELF-EDIT-001). The commit SHA lands in the tool outcome receipt; the
  forge's WAL entry for the push is the durable artifact digest.
  """

      version: 1,
      description:
        "Commits all changes in this coding job's clone and pushes them to this job's own " <>
          "branch on Sarah's forge. Pass message as the commit message. The push branch is " <>
          "branch on the OpenAgents forge. Pass message as the commit message. The push branch is " <>
          "fixed to this job; any other branch is refused. Returns the commit sha.",
      input_schema: %{
        "type" => "object",

      required_authority: "repository.write",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, pushing this job's branch to her own forge"
        disclosure: "the OpenAgents runtime, pushing this job's branch to her own forge"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

      required_authority: "repository.write",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, editing this job's clone of her repository"
        disclosure: "the OpenAgents runtime, editing this job's clone of her repository"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

defmodule OpenAgents.Tools.RepoGrep do
  @moduledoc "Searches Sarah's own source for a pattern, bounded, without shelling out."
  @moduledoc "Searches OpenAgents source for a pattern, bounded, without shelling out."

  @behaviour OpenAgents.Tools.Tool


      name: "repo_grep",
      version: 1,
      description:
        "Searches Sarah's own source code for a regular expression. Returns matching " <>
        "Searches OpenAgents source code for a regular expression. Returns matching " <>
          "path:line:text rows, bounded. Optional glob filters files (e.g. \"lib/**/*.ex\"); " <>
          "from selects \"image\" (running source, default) or \"workspace\" (this job's clone).",
      input_schema: %{

      required_authority: "repository.read",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, searching her running source"
        disclosure: "the OpenAgents runtime, searching her running source"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

defmodule OpenAgents.Tools.RepoList do
  @moduledoc "Lists a directory of Sarah's own source tree, bounded."
  @moduledoc "Lists a directory of OpenAgents source tree, bounded."

  @behaviour OpenAgents.Tools.Tool


      name: "repo_list",
      version: 1,
      description:
        "Lists files and directories in Sarah's own source tree. Pass path relative to the " <>
        "Lists files and directories in OpenAgents source tree. Pass path relative to the " <>
          "repository root (default: the root). from selects \"image\" (running source, " <>
          "default) or \"workspace\" (this job's clone).",
      input_schema: %{

      required_authority: "repository.read",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, listing her running source"
        disclosure: "the OpenAgents runtime, listing her running source"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

defmodule OpenAgents.Tools.RepoRead do
  @moduledoc "Reads one file from Sarah's own source (baked image tree or the job's clone)."
  @moduledoc "Reads one file from OpenAgents source (baked image tree or the job's clone)."

  @behaviour OpenAgents.Tools.Tool


      name: "repo_read",
      version: 1,
      description:
        "Reads one file from Sarah's own source code. Pass path relative to the repository " <>
        "Reads one file from OpenAgents source code. Pass path relative to the repository " <>
          "root. from selects the tree: \"image\" (default) reads the source of the code " <>
          "currently running; \"workspace\" reads this job's editable clone.",
      input_schema: %{

      required_authority: "repository.read",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, reading her running source"
        disclosure: "the OpenAgents runtime, reading her running source"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

      required_authority: "repository.write",
      executor: %{
        id: "sarah.repository.self",
        disclosure: "Sarah's own runtime, writing in this job's clone of her repository"
        disclosure: "the OpenAgents runtime, writing in this job's clone of her repository"
      },
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{
        "privacy" => "browser_conversation",
        "residency" => "host",

  - **Per-job clone** (`workspace_dir/1`): a working tree cloned from the
    local forge bare repo (origin is never GitHub) under the job's own
    directory. The ONLY place mutation tools may act, and pushes from it go
    only to that job's `sarah/job-<id>` branch. Removed when the job ends.
    only to that job's `openagents/job-<id>` branch. Removed when the job ends.

  Path handling fails closed: every path is resolved and verified to stay
  inside its root before any filesystem call.

  alias OpenAgents.Forge.Repos
  alias OpenAgents.Forge.Sync

  @repo "sarah"
  @repo "openagents.com"

  @doc "The baked source root (the running code's own tree)."
  def source_dir do
    Application.get_env(:openagents, :sarah_source_dir, File.cwd!())
    Application.get_env(:openagents, :source_repo_dir, File.cwd!())
  end

  @doc "The workspace root that holds all per-job clones."

    Application.get_env(
      :openagents,
      :coding_jobs_dir,
      Path.join(System.tmp_dir!(), "sarah-coding-jobs")
      Path.join(System.tmp_dir!(), "openagents-coding-jobs")
    )
  end


  def workspace_dir("work-job:" <> job_id), do: Path.join(jobs_dir(), "job-" <> job_id)

  @doc "This job's push branch — the only ref it may ever push."
  def job_branch("work-job:" <> job_id), do: "sarah/job-" <> job_id
  def job_branch("work-job:" <> job_id), do: "openagents/job-" <> job_id

  @doc """
  Ensure the per-job clone exists, cloning from the LOCAL forge bare repo

  Approval receipts for the repository mutation modules, minted for a coding
  job. Starting the coding job is the person's exact current consent for the
  reversible writes inside the job's own clone; the operator posture for the
  one external effect (a push to the job's own branch on Sarah's own forge)
  one external effect (a push to the job's own branch on the OpenAgents forge)
  is host policy: the branch is sandboxed and promotion stays operator-only
  (SELF-EDIT-001).
  """

    do: "old_string matches more than once — include more surrounding context or set replace_all."

  defp error_message(:branch_refused),
    do: "A coding job may push only to its own sarah/job-<id> branch."
    do: "A coding job may push only to its own openagents/job-<id> branch."

  defp error_message(:nothing_to_commit), do: "The workspace has no changes to commit."
  defp error_message(:commit_failed), do: "git commit failed in the job workspace."


  @nonce_bytes 12
  @tag_bytes 16
  @version 1
  @version 2
  @legacy_version 1

  @spec configured?() :: boolean()
  def configured?, do: match?({:ok, _key}, key())

             is_integer(sequence) and sequence > 0 do
    with {:ok, key} <- key() do
      nonce = :crypto.strong_rand_bytes(@nonce_bytes)
      aad = aad(recording_id, sequence)
      aad = aad(@version, recording_id, sequence)

      {ciphertext, tag} =
        :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, plaintext, aad, true)


  @spec open(binary(), Ecto.UUID.t(), pos_integer()) :: {:ok, binary()} | {:error, atom()}
  def open(
        <<@version, nonce::binary-size(@nonce_bytes), tag::binary-size(@tag_bytes),
        <<version, nonce::binary-size(@nonce_bytes), tag::binary-size(@tag_bytes),
          ciphertext::binary>>,
        recording_id,
        sequence
      )
      when is_binary(recording_id) and is_integer(sequence) and sequence > 0 do
      when version in [@legacy_version, @version] and is_binary(recording_id) and
             is_integer(sequence) and sequence > 0 do
    with {:ok, key} <- key() do
      case :crypto.crypto_one_time_aead(
             :aes_256_gcm,
             key,
             nonce,
             ciphertext,
             aad(recording_id, sequence),
             aad(version, recording_id, sequence),
             tag,
             false
           ) do


  def open(_sealed, _recording_id, _sequence), do: {:error, :chunk_unsealable}

  defp aad(recording_id, sequence),
  defp aad(@version, recording_id, sequence),
    do: "openagents.voice_recording_chunk.v2:#{recording_id}:#{sequence}"

  defp aad(@legacy_version, recording_id, sequence),
    do: "sarah.voice_recording_chunk.v1:#{recording_id}:#{sequence}"

  defp key do

    end
  end

  def sarah_live_view do
  def openagents_live_view do
    quote do
      use Phoenix.LiveView

      unquote(sarah_html_helpers())
      unquote(openagents_html_helpers())

      import OpenAgentsWeb.Components.RepoHeader
    end
  end

  def sarah_html do
  def openagents_html do
    quote do
      use Phoenix.Component

      unquote(sarah_html_helpers())
      unquote(openagents_html_helpers())
    end
  end


    end
  end

  defp sarah_html_helpers do
  defp openagents_html_helpers do
    quote do
      # HTML escaping functionality
      import Phoenix.HTML
      # Sarah interface primitives
      import OpenAgentsWeb.SarahUI
      # OpenAgents interface primitives
      import OpenAgentsWeb.UI

      # Common modules used in templates
      alias Phoenix.LiveView.JS

defmodule OpenAgentsWeb.ComputerChannel do
  @moduledoc """
  `sarah.computer.v1` — the live channel a paired controller keeps open.
  `openagents.computer.v1` — the live channel a paired controller keeps open.

  Server to controller: `probe`, `run`, `agent`, `devin`, and `cancel` (each correlated
  by a server-minted `request_id`). Controller to server: `hello` (agent

            {:ok, _owner} ->
              Phoenix.PubSub.subscribe(OpenAgents.PubSub, "machine:#{machine.id}")
              Machines.record_seen(machine)
              {:ok, %{"protocol" => "sarah.computer.v1"}, assign(socket, :machine, machine)}
              {:ok, %{"protocol" => "openagents.computer.v1"}, assign(socket, :machine, machine)}

            # A prior registration (usually from a node that just died) hasn't
            # been pruned yet — refuse the join; the controller's reconnect


    * `OpenAgentsWeb.CoreComponents` — the Phoenix-generated set, restyled onto
      basecoat. Imported by `use OpenAgentsWeb, :live_view`.
    * `OpenAgentsWeb.SarahUI` — the Sarah interface primitives, imported
      separately via `sarah_html_helpers`. `button`, `input`, and `icon` exist
      in both sets, which is why the SarahUI slugs are prefixed `sarah-`.
    * `OpenAgentsWeb.UI` — the OpenAgents interface primitives, imported
      separately via `openagents_html_helpers`. `button`, `input`, and `icon` exist
      in both sets, which is why the UI slugs are prefixed `openagents-`.

  Icon names are drawn from the vendored Apps SDK set (`OpenAgentsWeb.Icons`).
  """

      ]
    },
    %{
      title: "Sarah UI",
      title: "OpenAgents UI",
      items: [
        %{
          slug: "sarah-button",
          slug: "openagents-button",
          title: "Button",
          icon: "cube",
          source: "OpenAgentsWeb.SarahUI.button/1",
          source: "OpenAgentsWeb.UI.button/1",
          summary: "Eight variants, four sizes, and a danger tone."
        },
        %{
          slug: "sarah-text-button",
          slug: "openagents-text-button",
          title: "Text button",
          icon: "text",
          source: "OpenAgentsWeb.SarahUI.text_button/1",
          source: "OpenAgentsWeb.UI.text_button/1",
          summary: "Borderless action for inline and secondary affordances."
        },
        %{
          slug: "sarah-input",
          slug: "openagents-input",
          title: "Input",
          icon: "square-text",
          source: "OpenAgentsWeb.SarahUI.input/1",
          source: "OpenAgentsWeb.UI.input/1",
          summary: "Bare text input primitive, unwrapped by a form field."
        },
        %{
          slug: "sarah-textarea",
          slug: "openagents-textarea",
          title: "Textarea",
          icon: "text",
          source: "OpenAgentsWeb.SarahUI.textarea/1",
          source: "OpenAgentsWeb.UI.textarea/1",
          summary: "Multi-line text primitive."
        },
        %{
          slug: "sarah-label",
          slug: "openagents-label",
          title: "Label",
          icon: "tag",
          source: "OpenAgentsWeb.SarahUI.label/1",
          source: "OpenAgentsWeb.UI.label/1",
          summary: "Form label bound to a control by id."
        },
        %{
          slug: "sarah-field",
          slug: "openagents-field",
          title: "Field",
          icon: "file-document",
          source: "OpenAgentsWeb.SarahUI.field/1",
          source: "OpenAgentsWeb.UI.field/1",
          summary: "Wrapper that stacks a label and its control."
        },
        %{
          slug: "sarah-alert",
          slug: "openagents-alert",
          title: "Alert",
          icon: "warning",
          source: "OpenAgentsWeb.SarahUI.alert/1",
          source: "OpenAgentsWeb.UI.alert/1",
          summary: "Four variants across box, row, and notice appearances."
        },
        %{
          slug: "sarah-badge",
          slug: "openagents-badge",
          title: "Badge",
          icon: "tag",
          source: "OpenAgentsWeb.SarahUI.badge/1",
          source: "OpenAgentsWeb.UI.badge/1",
          summary: "Status pill in six variants."
        },
        %{
          slug: "sarah-card",
          slug: "openagents-card",
          title: "Card",
          icon: "square-image",
          source: "OpenAgentsWeb.SarahUI.card/1",
          source: "OpenAgentsWeb.UI.card/1",
          summary: "Content container with an optional corner frame and danger variant."
        },
        %{
          slug: "sarah-avatar",
          slug: "openagents-avatar",
          title: "Avatar",
          icon: "user",
          source: "OpenAgentsWeb.SarahUI.avatar/1",
          source: "OpenAgentsWeb.UI.avatar/1",
          summary: "Image or initials fallback in three sizes."
        },
        %{
          slug: "sarah-item",
          slug: "openagents-item",
          title: "Item",
          icon: "dot",
          source: "OpenAgentsWeb.SarahUI.item/1",
          source: "OpenAgentsWeb.UI.item/1",
          summary: "Status, label, and detail row for activity lists."
        },
        %{
          slug: "sarah-event-header",
          slug: "openagents-event-header",
          title: "Event header",
          icon: "info",
          source: "OpenAgentsWeb.SarahUI.event_header/1",
          source: "OpenAgentsWeb.UI.event_header/1",
          summary: "Titled event row with status, timestamp, and chip slot."
        },
        %{
          slug: "sarah-empty",
          slug: "openagents-empty",
          title: "Empty state",
          icon: "circle",
          source: "OpenAgentsWeb.SarahUI.empty/1",
          source: "OpenAgentsWeb.UI.empty/1",
          summary: "Placeholder for lists and panels with nothing to show."
        },
        %{
          slug: "sarah-kbd",
          slug: "openagents-kbd",
          title: "Keyboard key",
          icon: "keyboard",
          source: "OpenAgentsWeb.SarahUI.kbd/1",
          source: "OpenAgentsWeb.UI.kbd/1",
          summary: "Rendered keycap for shortcut documentation."
        },
        %{
          slug: "sarah-menu",
          slug: "openagents-menu",
          title: "Menu",
          icon: "menu",
          source: "OpenAgentsWeb.SarahUI.menu/1",
          source: "OpenAgentsWeb.UI.menu/1",
          summary: "Popover menu surface used by the account control."
        },
        %{
          slug: "sarah-frame",
          slug: "openagents-frame",
          title: "Frame",
          icon: "grid",
          source: "OpenAgentsWeb.SarahUI.frame/1",
          source: "OpenAgentsWeb.UI.frame/1",
          summary: "Corner-bracket decoration around arbitrary content."
        },
        %{
          slug: "sarah-status-indicator",
          slug: "openagents-status-indicator",
          title: "Status indicator",
          icon: "check-circle",
          source: "OpenAgentsWeb.SarahUI.status_indicator/1",
          source: "OpenAgentsWeb.UI.status_indicator/1",
          summary: "Labelled state dot, optionally decorative."
        },
        %{
          slug: "sarah-audio-player",
          slug: "openagents-audio-player",
          title: "Audio player",
          icon: "play",
          source: "OpenAgentsWeb.SarahUI.audio_player/1",
          source: "OpenAgentsWeb.UI.audio_player/1",
          summary: "Labelled audio element for recordings."
        },
        %{
          slug: "sarah-icon",
          slug: "openagents-icon",
          title: "Icon",
          icon: "sparkle",
          source: "OpenAgentsWeb.SarahUI.icon/1",
          source: "OpenAgentsWeb.UI.icon/1",
          summary: "Apps SDK glyph with an optional accessible label."
        }
      ]

  def documented_modules do
    %{
      OpenAgentsWeb.CoreComponents => [],
      OpenAgentsWeb.SarahUI => [],
      OpenAgentsWeb.UI => [],
      OpenAgentsWeb.Layouts => [:app, :flash_group]
    }
  end


  The foundation for styling is Tailwind CSS, a utility-first CSS framework,
  on top of the vendored Basecoat component structure in
  `assets/vendor/basecoat/components/` and Sarah's style pack in
  `assets/css/sarah.css`. Basecoat expresses variants as data attributes
  `assets/vendor/basecoat/components/` and OpenAgents style pack in
  `assets/css/openagents.css`. Basecoat expresses variants as data attributes
  (`data-variant`, `data-size`), so a control is `class="btn"` plus a data
  attribute rather than a stack of variant classes. There is no second
  component library — DaisyUI was removed, and reintroducing it would put flat
  `.btn`-style rules back above `.btn[data-variant=…]`. Here are useful
  references:

    * `OpenAgentsWeb.SarahUI` - nineteen ready primitives over that CSS
    * `OpenAgentsWeb.UI` - nineteen ready primitives over that CSS
      (`button/1`, `card/1`, `badge/1`, `alert/1`, `input/1`, …). Prefer them
      to hand-written component classes.


      class="fixed top-4 right-4 z-50 flex flex-col items-end gap-2"
      {@rest}
    >
      <%!-- Basecoat/Sarah `.alert` is a three-column grid: leading marker,
      <%!-- Basecoat/OpenAgents `.alert` is a three-column grid: leading marker,
      body `<section>`, trailing action. Keeping exactly three children is what
      lets the close control sit in the third column instead of wrapping. --%>
      <div

  @doc """
  Renders a button with navigation support.

  A thin wrapper over the Basecoat/Sarah `.btn` recipe: the class is always
  A thin wrapper over the Basecoat/OpenAgents `.btn` recipe: the class is always
  `btn` and the look comes from `data-variant`, never from a stack of variant
  classes. `class` adds layout utilities alongside it rather than replacing it,
  so a caller cannot accidentally drop the component styling.

  `OpenAgentsWeb.SarahUI.button/1` is the fuller control (eight variants, three
  `OpenAgentsWeb.UI.button/1` is the fuller control (eight variants, three
  sizes, a danger tone). This one exists so surfaces on `CoreComponents` alone
  still get the same two shapes.


    ~H"""
    <%!-- Basecoat's `.table` carries structure only — widths, alignment, and
    the row rule. Rhythm and colour are utilities here rather than a zebra
    variant: Sarah separates rows with the hairline, not with alternating
    variant: OpenAgents separates rows with the hairline, not with alternating
    fills. --%>
    <div class="table-container">
      <table class="table text-sm">

  """
  use OpenAgentsWeb, :html

  alias OpenAgentsWeb.SarahUI, as: UI
  alias OpenAgentsWeb.UI, as: UI

  # Embed all files in layouts/* within this module.
  # The default root.html.heex file contains the HTML

  end

  @doc """
  The Sarah-style command bar: brand lockup on the left, account controls on the
  The OpenAgents command bar: brand lockup on the left, account controls on the
  right. `current_user` is optional because public surfaces are anonymous.
  """
  attr :aria_label, :string, required: true

  defp account_dropdown(assigns) do
    ~H"""
    <%!-- A native <details> disclosure rather than a JavaScript dropdown, for
    the same reason `SarahUI.menu/1` uses the popover API: the account control
    the same reason `UI.menu/1` uses the popover API: the account control
    has to work before any client script has run. --%>
    <details class="relative">
      <summary class="btn list-none cursor-pointer !p-1" data-variant="ghost">

  The `data-theme` segmented control.

  The attribute plumbing in `root.html.heex` still runs, but since DaisyUI was
  removed there is only one palette behind it: Sarah's token ladder is
  removed there is only one palette behind it: OpenAgents token ladder is
  dark-only (`color-scheme: dark` in app.css) and ships no light variant. The
  control therefore moves its indicator without repainting the page. Keep it or
  remove it deliberately — do not reintroduce a second theme to make it work.

  def subject("computer_devin"), do: "a Devin coding task on your computer"
  def subject("computer_agent"), do: "a coding agent task on your computer"
  def subject("module_discover"), do: "a check of what Sarah can do"
  def subject("repo_read"), do: "a read of Sarah's own source code"
  def subject("repo_grep"), do: "a search of Sarah's own source code"
  def subject("repo_list"), do: "a listing of Sarah's own source tree"
  def subject("repo_read"), do: "a read of OpenAgents source code"
  def subject("repo_grep"), do: "a search of OpenAgents source code"
  def subject("repo_list"), do: "a listing of the OpenAgents source tree"
  def subject("code_check"), do: "a syntax and compile check of candidate code"
  def subject("repo_edit"), do: "an edit in this job's clone of Sarah's repository"
  def subject("repo_write"), do: "a file written in this job's clone of Sarah's repository"
  def subject("repo_commit_push"), do: "a commit pushed to this job's branch on Sarah's forge"
  def subject("repo_edit"), do: "an edit in this job's clone of the OpenAgents repository"
  def subject("repo_write"), do: "a file written in this job's OpenAgents repository clone"

  def subject("repo_commit_push"),
    do: "a commit pushed to this job's branch on the OpenAgents forge"

  def subject(tool_name), do: "the #{humanized_tool(tool_name)} step"

  @doc "Bounded pretty JSON of the step's durable raw arguments, or nil."

defmodule OpenAgentsWeb.SarahUI do
defmodule OpenAgentsWeb.UI do
  @moduledoc """
  Sarah's interface primitives.
  OpenAgents interface primitives.

  Every component here wraps a vendored Basecoat class and exposes Sarah's
  Every component here wraps a vendored Basecoat class and exposes OpenAgents
  vocabulary rather than Basecoat's. Product surfaces build interface only from
  these components; they do not author component-level CSS classes. See
  `DESIGN.md`, `assets/css/style-sarah.css`, and
  `docs/decisions/0003-basecoat-component-library.md`.
  `assets/css/openagents.css` and
  `docs/decisions/0005-use-basecoat-and-one-component-system.md`.

  Basecoat expresses variants as data attributes (`data-variant`, `data-size`),
  so each `attr` maps straight onto the DOM with no class-merging utility.

  @doc """
  A boxed control.

  `:link` renders Sarah's inline underlined action rather than a boxed button
  `:link` renders OpenAgents inline underlined action rather than a boxed button
  and ignores `size`; pair it with `tone={:danger}` for a destructive inline
  action.


  @doc """
  A short typographic status label.

  Sarah states status as text; the badge carries the reserved semantic color
  OpenAgents states status as text; the badge carries the reserved semantic color
  and never stands in for the words.
  """
  attr :variant, :atom,

  Render the matching trigger with `button/1` and
  `popovertarget={id} popovertargetaction="toggle"`.

  Carries Sarah's own `.menu` class rather than Basecoat's `.popover`. In
  Carries OpenAgents own `.menu` class rather than Basecoat's `.popover`. In
  Basecoat, `.popover` is the *anchor* (`position: relative`) and the floating
  panel is `[data-popover]`, positioned by its JavaScript. Putting `.popover` on
  the panel gave it author-origin `display: inline-flex`, which outranks the
  user agent's `[popover]:not(:popover-open) { display: none }` and leaves the
  menu permanently open and in flow. Sarah styles the native element directly.
  menu permanently open and in flow. OpenAgents styles the native element directly.
  """
  attr :id, :string, required: true
  attr :label, :string, default: nil

  @doc """
  A native audio player for one stored recording.

  Basecoat has no audio component and Sarah does not ship a custom transport, so
  Basecoat has no audio component and OpenAgents does not ship a custom transport, so
  this wraps the browser's own `<audio controls>` rather than rebuilding play,
  pause, and volume in JavaScript. Native controls are already keyboard operable
  and already announced, which a hand-rolled transport would have to re-earn.

defmodule OpenAgentsWeb.ChangelogController do
  @moduledoc """
  `GET /api/changelog` — the machine-readable changelog
  (schema `sarah.changelog.v1`), the superset of the public `/changelog`
  (schema `openagents.changelog.v1`), the superset of the public `/changelog`
  page including receipt row ids so agents can cross-check every claim
  against the receipt chain. Same posture as `/api/status`: public,
  read-only, bounded, no identity state.

  use OpenAgentsWeb, :controller

  def show(conn, params) do
    repo = Map.get(params, "repo", "sarah")
    repo = Map.get(params, "repo", "openagents.com")

    case OpenAgents.Changelog.projection(repo) do
      {:ok, payload} ->

      |> Enum.map(&computer_projection/1)

    json(conn, %{
      "schema" => "sarah.computers.v1",
      "schema" => "openagents.computers.v1",
      "pairing_enabled" => Computer.enabled?(),
      "computers" => computers
    })

defmodule OpenAgentsWeb.NetworkStatusController do
  @moduledoc """
  `GET /api/status` — the full machine-readable network-state projection
  (schema `sarah.network_status.v1`, see `OpenAgents.NetworkStatus`). A superset of
  (schema `openagents.network_status.v1`, see `OpenAgents.NetworkStatus`). A superset of
  the legacy `/status` payload (`status`/`revision` keys are preserved), so
  pollers migrate here without a translation step. Public, bounded,
  content-free (STATUS-001).

  live off the forge PubSub topics.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Accounts
  alias OpenAgents.Forge

  end

  defp primary_repo do
    OpenAgents.Forge.Repos.allowed_repos() |> List.first() || "sarah"
    OpenAgents.Forge.Repos.allowed_repos() |> List.first() || "openagents.com"
  end

  defp git_store(repo, sha) do

      separate decision from cross-account listening.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Accounts
  alias OpenAgents.Admin


  Same public posture as the leaderboard and status pages (UI-001 lineage,
  TRANSPARENCY-001): read-only, mounts without a session, cannot invoke
  Sarah, renders only `OpenAgentsWeb.UI` primitives (UI-003), and updates live
  OpenAgents, renders only `OpenAgentsWeb.UI` primitives (UI-003), and updates live
  off the forge PubSub — a hot-load appears here seconds after it lands.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Changelog

  @repo "sarah"
  @repo "openagents.com"
  @forge_topics ["forge:pushes", "forge:target", "forge:builds", "forge:deploys"]

  @impl true


    {:ok,
     socket
     |> assign(:page_title, "Changelog · Sarah")
     |> assign(:page_title, "Changelog · OpenAgents")
     |> assign(:repo, @repo)
     |> assign(:base, OpenAgents.Forge.Visibility.repo_path(@repo) || "")
     |> assign(:rows, rows)

    ~H"""
    <Layouts.app flash={@flash}>
      <main id="changelog-page" class="app-shell changelog-shell">
        <Layouts.command_bar aria_label="Sarah changelog" current_user={@current_user}>
        <Layouts.command_bar aria_label="OpenAgents changelog" current_user={@current_user}>
          <:lockup>
            <.button
              :if={@current_user}

            <div>
              <h1>Changelog</h1>
              <p>
                Every change to Sarah, two layers deep: what changed in plain
                Every change to OpenAgents, two layers deep: what changed in plain
                words, and — expand any entry — the receipts: the commit, the
                modules hot-loaded, and the measured push→live time. Sarah
                modules hot-loaded, and the measured push→live time. OpenAgents
                ships her own code through her own forge; this page is how
                you watch her do it.
              </p>

defmodule OpenAgentsWeb.ChatLive do
  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.{
    Accounts,

    ~H"""
    <Layouts.app flash={@flash} title="Chat" current_scope={@current_scope}>
      <div
        id="sarah-app"
        id="openagents-app"
        class="app-shell chat-shell"
        data-mobile-open="false"
        phx-hook=".SidebarShell"

  the leaderboard: read-only, no session required, cannot invoke OpenAgents.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Forge.{Browse, Visibility}


  the other projections: read-only, sessionless, cannot invoke OpenAgents.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Forge
  alias OpenAgents.Forge.{Browse, Visibility}

  projections; data comes from `OpenAgents.Forge.Browse`'s bounded plumbing.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Forge
  alias OpenAgents.Forge.{Browse, Visibility}

    ~H"""
    <Layouts.app flash={@flash}>
      <main id="code-repo-page" class="app-shell code-shell">
        <Layouts.command_bar aria_label="Sarah code" current_user={@current_user}>
        <Layouts.command_bar aria_label="OpenAgents code" current_user={@current_user}>
          <:lockup>
            <.button
              :if={@current_user}

  use OpenAgentsWeb, :live_view

  alias OpenAgentsWeb.ComponentCatalog
  alias OpenAgentsWeb.SarahUI, as: UI
  alias OpenAgentsWeb.UI, as: UI

  @sample_rows [
    %{id: 1, owner: "OpenAgentsInc", repo: "openagents.com", state: "open"},
    %{id: 2, owner: "OpenAgentsInc", repo: "sarah", state: "open"},
    %{id: 2, owner: "OpenAgentsInc", repo: "openagents.com", state: "open"},
    %{id: 3, owner: "OpenAgentsInc", repo: "arcade", state: "closed"}
  ]


    hero-arrow-path hero-sun-micro hero-moon-micro hero-computer-desktop-micro
  )

  # SarahUI.icon/1 renders the vendored Apps SDK set, not heroicons.
  @sarah_icons ~w(sparkle compass folder document user bell play star)
  # UI.icon/1 renders the vendored Apps SDK set, not heroicons.
  @openagents_icons ~w(sparkle compass folder document user bell play star)

  # account_control/1 and command_bar/1 read three fields off the current user.
  # A plain map is enough and keeps the catalog page free of database access.

     |> assign(:form, form)
     |> assign(:rows, @sample_rows)
     |> assign(:icons, @icons)
     |> assign(:sarah_icons, @sarah_icons)
     |> assign(:openagents_icons, @openagents_icons)
     |> assign(:demo_user, @demo_user)}
  end


      <p class="text-base-content/70 mb-8 text-pretty max-w-[68ch]">
        Live examples of every reusable function component in this repository, drawn from
        <code>OpenAgentsWeb.CoreComponents</code>
        (the Phoenix set, restyled onto basecoat), <code>OpenAgentsWeb.SarahUI</code>
        (the Sarah interface primitives), and <code>OpenAgentsWeb.Layouts</code>. <code>button</code>, <code>input</code>, and
        (the Phoenix set, restyled onto basecoat), <code>OpenAgentsWeb.UI</code>
        (the OpenAgents interface primitives), and <code>OpenAgentsWeb.Layouts</code>. <code>button</code>, <code>input</code>, and
        <code>icon</code>
        exist in both component sets, so the SarahUI entries are listed separately.
        exist in both component sets, so the UI entries are listed separately.
        A test asserts this page covers every public component in those modules.
        Planned GitHub-shaped components are listed in <code>docs/component-library.md</code>.
      </p>

  attr :form, :any, default: nil
  attr :rows, :list, default: []
  attr :icons, :list, default: []
  attr :sarah_icons, :list, default: []
  attr :openagents_icons, :list, default: []
  attr :demo_user, :map, default: nil

  defp component_demo(%{item: %{slug: "button"}} = assigns) do

    """
  end

  # --- Sarah UI -------------------------------------------------------------
  # SarahUI is imported by `sarah_html_helpers`, not by `:live_view`, so these
  # --- OpenAgents UI -------------------------------------------------------------
  # UI is imported by `openagents_html_helpers`, not by `:live_view`, so these
  # are called with the full module prefix. That also documents provenance on a
  # page whose whole job is showing where a component comes from.

  defp component_demo(%{item: %{slug: "sarah-button"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-button"}} = assigns) do
    ~H"""
    <div class="space-y-4">
      <div class="flex flex-wrap items-center gap-3">

    """
  end

  defp component_demo(%{item: %{slug: "sarah-text-button"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-text-button"}} = assigns) do
    ~H"""
    <div class="flex flex-wrap items-center gap-4">
      <UI.text_button>Default</UI.text_button>

    """
  end

  defp component_demo(%{item: %{slug: "sarah-input"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-input"}} = assigns) do
    ~H"""
    <div class="space-y-3 max-w-sm">
      <UI.input id="sarah-input-demo" name="demo" value="Ship the catalog" />
      <UI.input id="sarah-input-demo-empty" name="demo_empty" placeholder="Placeholder text" />
      <UI.input id="sarah-input-demo-disabled" name="demo_disabled" value="Disabled" disabled />
      <UI.input id="openagents-input-demo" name="demo" value="Ship the catalog" />
      <UI.input id="openagents-input-demo-empty" name="demo_empty" placeholder="Placeholder text" />
      <UI.input id="openagents-input-demo-disabled" name="demo_disabled" value="Disabled" disabled />
    </div>
    """
  end

  defp component_demo(%{item: %{slug: "sarah-textarea"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-textarea"}} = assigns) do
    ~H"""
    <div class="max-w-sm">
      <UI.textarea
        id="sarah-textarea-demo"
        id="openagents-textarea-demo"
        name="demo_body"
        value="Multi-line text primitive."
        rows="4"

    """
  end

  defp component_demo(%{item: %{slug: "sarah-label"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-label"}} = assigns) do
    ~H"""
    <div class="space-y-2 max-w-sm">
      <UI.label for="sarah-label-target">Repository name</UI.label>
      <UI.input id="sarah-label-target" name="repo" value="openagents.com" />
      <UI.label for="openagents-label-target">Repository name</UI.label>
      <UI.input id="openagents-label-target" name="repo" value="openagents.com" />
    </div>
    """
  end

  defp component_demo(%{item: %{slug: "sarah-field"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-field"}} = assigns) do
    ~H"""
    <div class="max-w-sm space-y-4">
      <UI.field>
        <UI.label for="sarah-field-title">Title</UI.label>
        <UI.input id="sarah-field-title" name="title" value="Ship the component catalog" />
        <UI.label for="openagents-field-title">Title</UI.label>
        <UI.input id="openagents-field-title" name="title" value="Ship the component catalog" />
      </UI.field>
      <UI.field>
        <UI.label for="sarah-field-body">Body</UI.label>
        <UI.textarea id="sarah-field-body" name="body" rows="3" />
        <UI.label for="openagents-field-body">Body</UI.label>
        <UI.textarea id="openagents-field-body" name="body" rows="3" />
      </UI.field>
    </div>
    """
  end

  defp component_demo(%{item: %{slug: "sarah-alert"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-alert"}} = assigns) do
    ~H"""
    <div class="space-y-6">
      <div class="space-y-3">

    """
  end

  defp component_demo(%{item: %{slug: "sarah-badge"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-badge"}} = assigns) do
    ~H"""
    <div class="flex flex-wrap items-center gap-3">
      <UI.badge :for={v <- ~w(default info success warning danger dim)a} variant={v}>

    """
  end

  defp component_demo(%{item: %{slug: "sarah-card"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-card"}} = assigns) do
    ~H"""
    <div class="grid gap-4 sm:grid-cols-2">
      <UI.card id="sarah-card-default">
      <UI.card id="openagents-card-default">
        <p class="font-medium">Default</p>
        <p class="text-sm text-base-content/70">A plain content container.</p>
      </UI.card>
      <UI.card id="sarah-card-corners" frame={:corners}>
      <UI.card id="openagents-card-corners" frame={:corners}>
        <p class="font-medium">Corner frame</p>
        <p class="text-sm text-base-content/70">With bracket decoration.</p>
      </UI.card>
      <UI.card id="sarah-card-danger" variant={:danger}>
      <UI.card id="openagents-card-danger" variant={:danger}>
        <p class="font-medium">Danger</p>
        <p class="text-sm text-base-content/70">For destructive context.</p>
      </UI.card>

    """
  end

  defp component_demo(%{item: %{slug: "sarah-avatar"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-avatar"}} = assigns) do
    ~H"""
    <div class="flex flex-wrap items-end gap-6">
      <UI.avatar :for={sz <- ~w(sm default lg)a} size={sz} fallback="OA" label={"size #{sz}"} />

    """
  end

  defp component_demo(%{item: %{slug: "sarah-item"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-item"}} = assigns) do
    ~H"""
    <div class="space-y-2">
      <UI.item status="ok" label="Fleet node 1" detail="converged" />

    """
  end

  defp component_demo(%{item: %{slug: "sarah-event-header"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-event-header"}} = assigns) do
    ~H"""
    <UI.event_header
      id="sarah-event-header-demo"
      id="openagents-event-header-demo"
      status="ok"
      title="repo_commit_push"
      status_note="completed"

    """
  end

  defp component_demo(%{item: %{slug: "sarah-empty"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-empty"}} = assigns) do
    ~H"""
    <UI.empty id="sarah-empty-demo" title="No delegations yet">
    <UI.empty id="openagents-empty-demo" title="No delegations yet">
      Work you delegate to a paired machine will appear here.
    </UI.empty>
    """
  end

  defp component_demo(%{item: %{slug: "sarah-kbd"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-kbd"}} = assigns) do
    ~H"""
    <p class="flex flex-wrap items-center gap-2 text-sm">
      Press

    """
  end

  defp component_demo(%{item: %{slug: "sarah-menu"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-menu"}} = assigns) do
    ~H"""
    <div class="space-y-3">
      <UI.button popovertarget="sarah-demo-menu" popovertargetaction="toggle">
      <UI.button popovertarget="openagents-demo-menu" popovertargetaction="toggle">
        Open menu
      </UI.button>
      <UI.menu id="sarah-demo-menu" label="Demo menu">
      <UI.menu id="openagents-demo-menu" label="Demo menu">
        <UI.text_button>Profile</UI.text_button>
        <UI.text_button>Settings</UI.text_button>
        <UI.text_button tone={:danger}>Sign out</UI.text_button>

    """
  end

  defp component_demo(%{item: %{slug: "sarah-frame"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-frame"}} = assigns) do
    ~H"""
    <UI.frame>
      <div class="p-6">

    """
  end

  defp component_demo(%{item: %{slug: "sarah-status-indicator"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-status-indicator"}} = assigns) do
    ~H"""
    <div class="flex flex-wrap items-center gap-6">
      <UI.status_indicator state="ok" label="Healthy" />

    """
  end

  defp component_demo(%{item: %{slug: "sarah-audio-player"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-audio-player"}} = assigns) do
    ~H"""
    <div class="space-y-2">
      <UI.audio_player
        id="sarah-audio-demo"
        id="openagents-audio-demo"
        src="/audio/does-not-exist.wav"
        label="Voice recording (demo source, nothing to play)"
      />

    """
  end

  defp component_demo(%{item: %{slug: "sarah-icon"}} = assigns) do
  defp component_demo(%{item: %{slug: "openagents-icon"}} = assigns) do
    ~H"""
    <ul id="sarah-demo-icons" role="list" class="flex flex-wrap gap-4">
      <li :for={name <- @sarah_icons} class="flex flex-col items-center gap-2 w-28">
    <ul id="openagents-demo-icons" role="list" class="flex flex-wrap gap-4">
      <li :for={name <- @openagents_icons} class="flex flex-col items-center gap-2 w-28">
        <UI.icon name={name} class="size-6" />
        <p class="text-center text-sm text-base-content/70">{name}</p>
      </li>

  Approve controller pairing codes and manage this account's paired computers.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Computer
  alias OpenAgents.Machines

  be rendered here by accident.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.Leaderboard
  alias OpenAgents.Leaderboard.Entry

  full fleet to render — it is most useful precisely when something is down.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  alias OpenAgents.NetworkStatus



    {:ok,
     socket
     |> assign(:page_title, "Network status · Sarah")
     |> assign(:page_title, "Network status · OpenAgents")
     |> assign(:events, [])
     |> assign_projection(NetworkStatus.projection())}
  end

    ~H"""
    <Layouts.app flash={@flash}>
      <main id="network-status-page" class="app-shell status-shell">
        <Layouts.command_bar aria_label="Sarah network status" current_user={@current_user}>
        <Layouts.command_bar aria_label="OpenAgents network status" current_user={@current_user}>
          <:lockup>
            <.button
              :if={@current_user}

            <div>
              <h1>Network status</h1>
              <p>
                The Sarah fleet — a quorum cluster that survives node loss and
                The OpenAgents fleet — a quorum cluster that survives node loss and
                upgrades in place. Owned sessions dropped per node loss or
                upgrade: 0; the release gate refuses anything that breaks that.
              </p>

          <.card id="status-forge">
            <h2>Rapid deploys</h2>
            <p class="status-forge__intro">
              Code moves through Sarah's own forge: a push is promoted by an
              Code moves through the OpenAgents forge: a push is promoted by an
              operator, built into just the changed modules, and hot-loaded
              across the fleet without a restart — watch it sweep the nodes
              above.

          <footer class="status-footer">
            <p>
              Machine-readable: <code>GET /api/status</code>
              (schema <code>sarah.network_status.v1</code>) ·
              (schema <code>openagents.network_status.v1</code>) ·
              probe: <code>GET /healthz</code>. This page updates live.
            </p>
          </footer>

  UI-001 still forbids navigation chrome in the shipped interface.

  Check this page after re-vendoring Basecoat or editing
  `assets/css/style-sarah.css` — the shared corner radius, the sanctioned depth
  `assets/css/openagents.css` — the shared corner radius, the sanctioned depth
  tokens, reserved semantic colors, Geist rendering rather than a system
  fallback, and a visible focus ring on every control.
  """

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  @statuses ~w(idle connected requested running succeeded failed cancelled interrupted refused unavailable)
  @voice_states ~w(idle requesting connecting listening speaking interrupted reconnecting muted blocked failed ending)

          </.section>

          <.section title="Audio player">
            <%!-- Native controls in Sarah's box. The source is deliberately
            <%!-- Native controls in the OpenAgents box. The source is deliberately
                  absent: this is a look at the transport's chrome in the dark
                  theme, not a playback test. --%>
            <.audio_player class="max-w-sm" src="" label="Recording of a voice call" />

defmodule OpenAgentsWeb.VoiceSpikeLive do
  @moduledoc false

  use OpenAgentsWeb, :sarah_live_view
  use OpenAgentsWeb, :openagents_live_view

  @impl true
  def mount(_params, _session, socket) do

    else
      _ ->
        conn
        |> put_resp_header("www-authenticate", ~s(Basic realm="sarah-forge"))
        |> put_resp_header("www-authenticate", ~s(Basic realm="openagents-forge"))
        |> send_resp(401, "authentication required")
        |> halt()
    end


  # The public forge web UI (TRANSPARENCY-001), addressed exactly the way the
  # GitHub URL it replaces is:
  # openagents.com/OpenAgentsInc/sarah/blob/main/README.md.
  # openagents.com/OpenAgentsInc/openagents.com/blob/main/README.md.
  #
  # The owner is a LITERAL scope segment, not a `:owner` pattern: a wildcard
  # first segment would match every two-segment path on the domain (/dev/ui,

        "compile --warnings-as-errors",
        "deps.unlock --unused",
        "format",
        "cmd ops/ci/reference-check.sh",
        "assets.test",
        "test --warnings-as-errors"
      ]

1	+	`# Persona source, evaluation, and program artifacts.`
2	+	`^priv/sarah/`
3	+
4	+	`# Historical migration identity. Never rename a migration that may have run.`
5	+	`^priv/repo/migrations/[0-9]+_.sarah.\.exs:`
6	+
7	+	`# Dated migration plans and audits retain exact historical names and findings.`
8	+	`^docs/2026-08-19-gap-implementation-plan\.md:`
9	+	`^docs/2026-08-20-integration-hardening-and-staging-readiness-recommendations\.md:`
10	+	`^docs/2026-08-20-test-coverage-audit\.md:`
11	+	`^docs/chat-inference-plan\.md:`
12	+	`^docs/component-library\.md:`
13	+	`^docs/github-auth-plan\.md:`
14	+	`^docs/issues-projects-ui-roadmap\.md:`
15	+	`^docs/sarah-integration-plan\.md:`
16	+
17	+	`# Current architecture and decisions discuss the Sarah persona boundary.`
18	+	`^docs/architecture\.md:`
19	+	`^docs/decisions/0001-integrate-the-complete-public-application\.md:`
20	+	`^docs/decisions/0002-model-sarah-as-an-openagents-persona\.md:`
21	+	`^docs/decisions/0005-use-basecoat-and-one-component-system\.md:`
22	+
23	+	`# The invariant ledger includes Sarah-specific persona and behavior contracts.`
24	+	`^INVARIANTS\.md:`
25	+
26	+	`# Natural-language Sarah references describe the visible persona or her actions.`
27	+	`^(assets\|lib\|test)/.:[0-9]+:.(^\|[^A-Za-z0-9_])[Ss][Aa][Rr][Aa][Hh]([^A-Za-z0-9_]\|$)`
28	+	`^assets/js/voice_controller\.js:[0-9]+:.*interruptSarah`
29	+
30	+	`# Versioned Sarah behavior, tool, evaluation, and persisted-data identifiers are`
31	+	`# stable artifact contracts. Rename them only through an explicit data migration.`
32	+	`^(assets\|lib\|test)/.:[0-9]+:.sarah\.[A-Za-z0-9_#{}.-]+`
33	+
34	+	`# Persona artifact paths, names, and stable database table names.`
35	+	`^(assets\|lib\|test)/.:[0-9]+:.(priv/)?sarah/(evals\|persona\|programs)/`
36	+	`^(assets\|lib\|test)/.:[0-9]+:.sarah\.v1\.(md\|sources\.json)`
37	+	`^(assets\|lib\|test)/.:[0-9]+:.sarah_blueprint_(facts\|revisions)`
38	+
39	+	`# User-facing Sarah data export names and the persona's commit identity.`
40	+	`^(assets\|lib\|test)/.:[0-9]+:.sarah-(account-data\|conversation-\|memory-account)`
41	+	`^(assets\|lib\|test)/.:[0-9]+:.sarah@openagents\.com`
42	+
43	+	`# Persona-specific recording layout and source-manifest vocabulary.`
44	+	`^(assets\|lib\|test)/.:[0-9]+:.mic_left_sarah_right`
45	+	`^(assets\|lib\|test)/.:[0-9]+:.(sarah_authored_speech\|(final\|prepared)_sarah_script\|sarah-(corpus\|runbook\|contracts\|knowledge))`

1	+	`#!/usr/bin/env bash`
2	+	`set -euo pipefail`
3	+
4	+	`repo_root=$(git rev-parse --show-toplevel)`
5	+	`cd "$repo_root"`
6	+
7	+	`allowlist="ops/ci/allowed-sarah-references.txt"`
8	+	`matches=$(mktemp /tmp/openagents-reference-matches.XXXXXX)`
9	+	`patterns=$(mktemp /tmp/openagents-reference-patterns.XXXXXX)`
10	+	`unclassified=$(mktemp /tmp/openagents-reference-unclassified.XXXXXX)`
11	+
12	+	`cleanup() {`
13	+	`unlink "$matches" 2>/dev/null \|\| true`
14	+	`unlink "$patterns" 2>/dev/null \|\| true`
15	+	`unlink "$unclassified" 2>/dev/null \|\| true`
16	+	`}`
17	+
18	+	`trap cleanup EXIT`
19	+
20	+	`# Generic infrastructure names are never valid in active source, tests,`
21	+	`# configuration, or assets. Historical documents are classified separately.`
22	+	`banned_in_active='OpenAgents\.Sarah(\.\|$)\|Sarah(UI\|ConnCase\|DataCase\|ChannelCase\|Factory\|Fixtures\|ClusterTest\|TargetsTest)\|sarah_(live_view\|html\|html_helpers\|source_dir\|forge)\|(^\|/)(style-)?sarah\.css\|/(var/lib\|tmp)/sarah\|OpenAgents-Sarah\|sarah[-_]builder\|sarah[-_]forge\|sarah-wal-seq\|sarah/job-'`
23	+
24	+	`if rg --line-number --no-heading --color never --ignore-case \`
25	+	`"$banned_in_active" AGENTS.md README.md assets config lib test; then`
26	+	`echo "Unclassified Sarah infrastructure reference found in active code." >&2`
27	+	`exit 1`
28	+	`fi`
29	+
30	+	`awk 'NF && $1 !~ /^#/' "$allowlist" >"$patterns"`
31	+
32	+	`rg --line-number --no-heading --color never --ignore-case \`
33	+	`--glob '!ops/ci/allowed-sarah-references.txt' \`
34	+	`--glob '!ops/ci/reference-check.sh' \`
35	+	`'sarah\|/var/lib/sarah\|/tmp/sarah\|pro\.openagents\.com\|api\.openagents\.com' \`
36	+	`AGENTS.md INVARIANTS.md README.md assets config docs lib ops test >"$matches" \|\| true`
37	+
38	+	`grep --extended-regexp --invert-match --file="$patterns" "$matches" >"$unclassified" \|\| true`
39	+
40	+	`if test -s "$unclassified"; then`
41	+	`echo "Unclassified Sarah or retired-service references:" >&2`
42	+	`sed -n '1,200p' "$unclassified" >&2`
43	+	`exit 1`
44	+	`fi`
45	+
46	+	`echo "Sarah reference classification passed"`

Upstream ships one React component per glyph under
`src/components/Icon/svg/`, each drawing a `currentColor` SVG sized at `1em`.
Sarah has no React and no `node_modules`, so the components cannot be consumed
as published. `mix sarah.icons.vendor <path-to-apps-sdk-ui>` converts them:
as published. `mix openagents.icons.vendor <path-to-apps-sdk-ui>` converts them:

- JSX attribute names become their SVG spelling (`fillRule` → `fill-rule`, and
  the rest);

## Upgrading

1. Pull the upstream checkout to the new commit.
2. Re-run `mix sarah.icons.vendor <path>`. It clears the previous set first, so
2. Re-run `mix openagents.icons.vendor <path>`. It clears the previous set first, so
   glyphs deleted upstream do not linger.
3. Update the commit and date above.
4. Run `mix precommit`. The icon tests fail if a glyph a surface depends on has

defmodule OpenAgents.AccountsTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Accounts
  alias OpenAgents.Conversations


  and that a call with no audio is still a row.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Accounts
  alias OpenAgents.Admin
  alias OpenAgents.Admin.Call

defmodule OpenAgents.BlueprintTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.Blueprint
  alias OpenAgents.Blueprint.Revision
  alias OpenAgents.Conversations

  backfill seed.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Changelog
  alias OpenAgents.Changelog.{Backfill, Entry}
  alias OpenAgents.Forge.{DeployReceipt, PushReceipt}

  defp entry_attrs(overrides) do
    Map.merge(
      %{
        repo: "sarah",
        repo: "openagents.com",
        sha: full_sha("feed0001"),
        summary: "A test entry",
        category: "ui",

      |> DeployReceipt.changeset(
        Map.merge(
          %{
            repo: "sarah",
            repo: "openagents.com",
            target_id: Ecto.UUID.generate(),
            result: "live",
            modules: ["Elixir.OpenAgents.Something"],

    end

    test "a repo configured :l2 returns entries newest first" do
      override_visibility(%{"sarah" => :l2})
      override_visibility(%{"openagents.com" => :l2})

      now = DateTime.utc_now()


      {:ok, _} =
        Changelog.record(entry_attrs(%{sha: full_sha("feed0002"), summary: "Newer entry"}))

      assert {:ok, [newer, older]} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, [newer, older]} = Changelog.timeline("openagents.com", refresh: true)
      assert newer.summary == "Newer entry"
      assert older.summary == "Older entry"
      assert Enum.all?([newer, older], &(&1.kind == :entry))

          })
        )

      assert {:ok, [row]} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, [row]} = Changelog.timeline("openagents.com", refresh: true)
      assert row.summary == "Security fix under embargo"
      assert row.sha == nil
      assert row.short_sha == nil

          })
        )

      assert {:ok, [row]} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, [row]} = Changelog.timeline("openagents.com", refresh: true)
      assert row.sha == sha
      assert row.short_sha == String.slice(sha, 0, 12)
    end

    test "a receipted deploy with no authored entry appears as a bare :receipt row" do
      deploy = insert_deploy!(%{sha: full_sha("feed0005")})

      assert {:ok, [row]} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, [row]} = Changelog.timeline("openagents.com", refresh: true)
      assert row.kind == :receipt
      assert row.summary == nil
      assert row.sha == deploy.sha


      deploy = insert_deploy!(%{sha: full_sha("feed0006"), push_to_live_ms: 5_540})

      assert {:ok, [row]} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, [row]} = Changelog.timeline("openagents.com", refresh: true)
      assert row.kind == :entry
      assert row.summary == "Short-sha entry from backfill lane"
      assert row.deploy.push_to_live_ms == 5_540

      {:ok, push} =
        %PushReceipt{}
        |> PushReceipt.changeset(%{
          repo: "sarah",
          repo: "openagents.com",
          wal_seq: 1,
          principal: "operator:abc123",
          refs: %{"refs/heads/main" => %{"new" => sha}}
        })
        |> Repo.insert()

      assert {:ok, payload} = Changelog.projection("sarah", refresh: true)
      assert {:ok, payload} = Changelog.projection("openagents.com", refresh: true)

      assert payload["schema"] == "sarah.changelog.v1"
      assert payload["repo"] == "sarah"
      assert payload["schema"] == "openagents.changelog.v1"
      assert payload["repo"] == "openagents.com"

      assert [entry] = payload["entries"]
      assert entry["summary"] == "Projected entry"
      assert entry["receipt_ids"]["push"] == push.id
      assert entry["commit_url"] == "/OpenAgentsInc/sarah/commit/#{String.slice(sha, 0, 12)}"

      assert entry["commit_url"] ==
               "/OpenAgentsInc/openagents.com/commit/#{String.slice(sha, 0, 12)}"

      assert entry["push"]["principal_role"] == "operator"
      assert entry["push"]["wal_seq"] == 1


      Backfill.run()
      assert Repo.aggregate(Entry, :count) == seeded

      assert {:ok, rows} = Changelog.timeline("sarah", refresh: true)
      assert {:ok, rows} = Changelog.timeline("openagents.com", refresh: true)
      assert Enum.any?(rows, &(&1.source == "backfill"))
    end
  end

1		-	`defmodule OpenAgents.SarahClusterTest do`
	1	+	`defmodule OpenAgents.Cluster.BasicTest do`
2	2		`# Not async: it manipulates node-global distribution state.`
3	3		`use ExUnit.Case, async: false`
4	4		`alias OpenAgents.Cluster`


  test "zero owned sessions are dropped across sequential node losses" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_chaos1, cookie)
    {peer2, node2} = start_peer(:sarah_chaos2, cookie)
    {peer1, node1} = start_peer(:openagents_chaos1, cookie)
    {peer2, node2} = start_peer(:openagents_chaos2, cookie)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    assert eventually(fn ->


  test "a drained node leaves Raft; survivors keep quorum and keep committing" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_drain1, cookie)
    {peer2, node2} = start_peer(:sarah_drain2, cookie)
    {peer1, node1} = start_peer(:openagents_drain1, cookie)
    {peer2, node2} = start_peer(:openagents_drain2, cookie)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    Ra.start_in(data_dir(node()))

  # ── helpers ──────────────────────────────────────────────────────────────

  defp data_dir(node) do
    base = Path.join(System.tmp_dir!(), "sarah_drain_test")
    base = Path.join(System.tmp_dir!(), "openagents_drain_test")
    short = node |> Atom.to_string() |> String.replace(~r/[^a-zA-Z0-9]/, "_")
    Path.join(base, "#{short}_#{System.unique_integer([:positive])}")
  end


  test "3-node Raft: cross-node commit, linearizable reads, fence, and quorum survival" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_ra_peer1, cookie)
    {peer2, node2} = start_peer(:sarah_ra_peer2, cookie)
    {peer1, node1} = start_peer(:openagents_ra_peer1, cookie)
    {peer2, node2} = start_peer(:openagents_ra_peer2, cookie)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    nodes = [node(), node1, node2]


  test "a node joins an existing cluster via Ra.join and becomes a voting member" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_ra_join1, cookie)
    {peer2, node2} = start_peer(:sarah_ra_join2, cookie)
    {peer1, node1} = start_peer(:openagents_ra_join1, cookie)
    {peer2, node2} = start_peer(:openagents_ra_join2, cookie)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    Ra.start_in(data_dir(node()))


  test "a phantom member (local server down, still in config) restarts and rejoins" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_ra_phantom1, cookie)
    {peer2, node2} = start_peer(:sarah_ra_phantom2, cookie)
    {peer1, node1} = start_peer(:openagents_ra_phantom1, cookie)
    {peer2, node2} = start_peer(:openagents_ra_phantom2, cookie)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    Ra.start_in(data_dir(node()))


    # Stop peer2's local Raft server, leaving it in the cluster config but not
    # running here — the phantom-member state an ungraceful restart produces.
    # The Ra cluster atom was renamed `:sarah_sessions` -> `:openagents_sessions`
    # in `OpenAgents.Cluster.Ra`, but this line kept the old name. `:ra.stop_server`
    # answers `:ok` for a server id it does not know, so the stop silently did
    # nothing and peer2's real server stayed up. Ask the module for the id so the
    # test can never drift from the cluster name again.
    # Ask the module for the server ID so this test cannot drift from the
    # configured cluster name.
    :ok = :erpc.call(node2, :ra, :stop_server, [:default, Ra.server_id(node2)])

    assert eventually(fn -> :erpc.call(node2, Ra, :members, [node2]) == [] end),

    cookie = :erlang.get_cookie()
    # standard_io control channels: the peers must survive losing their dist
    # connection to us — that loss IS the partition under test.
    {peer1, node1} = start_peer(:sarah_ra_part1, cookie, connection: :standard_io)
    {peer2, node2} = start_peer(:sarah_ra_part2, cookie, connection: :standard_io)
    {peer1, node1} = start_peer(:openagents_ra_part1, cookie, connection: :standard_io)
    {peer2, node2} = start_peer(:openagents_ra_part2, cookie, connection: :standard_io)
    on_exit(fn -> for p <- [peer1, peer2], do: safe_stop(p) end)

    Ra.start_in(data_dir(node()))

  end

  defp data_dir(node) do
    base = Path.join(System.tmp_dir!(), "sarah_ra_test")
    base = Path.join(System.tmp_dir!(), "openagents_ra_test")

    short =
      node |> Atom.to_string() |> String.replace(~r/[^a-zA-Z0-9]/, "_")

  action and is covered by the forge suite.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  import Ecto.Query

  alias OpenAgents.{Conversations, Work}

    Application.put_env(
      :openagents,
      :forge_self_push_url,
      "http://x:#{@operator_token}@127.0.0.1:#{port}/sarah.git"
      "http://x:#{@operator_token}@127.0.0.1:#{port}/openagents.com.git"
    )

    seed_repo!()

  end

  defp seed_repo! do
    path = Repos.ensure_repo!("sarah")
    path = Repos.ensure_repo!("openagents.com")
    {blob, 0} = plumb(path, ["hash-object", "-w", "--stdin"], "original content\n")
    {tree, 0} = plumb(path, ["mktree"], "100644 blob #{String.trim(blob)}\tnote.txt\n")


    # The report names the pushed commit — the operator promotes from it.
    assert job.report =~ "Coding report: pushed "
    assert [_, sha] = Regex.run(~r/pushed ([0-9a-f]{40})/, job.report)
    assert job.report =~ "sarah/job-#{job.id}"
    assert job.report =~ "openagents/job-#{job.id}"

    # Step receipts: all four tools succeeded, executor disclosed, and the
    # push step carries the commit SHA in its target receipt refs


    push_step = List.last(steps)
    # The middle segment is the forge repo the coding lane edits
    # (`OpenAgents.Tools.Repository.repo/0`) — still `sarah`, the same name
    # (`OpenAgents.Tools.Repository.repo/0`) — now `openagents.com`, the same repository
    # the push receipt below is looked up under.
    assert "forge-commit:sarah:#{sha}" in push_step.target_receipt_refs
    assert "forge-commit:openagents.com:#{sha}" in push_step.target_receipt_refs

    # The push is WAL-receipted on the forge, on the job's own branch.
    assert [push_receipt | _rest] = Forge.recent_pushes("sarah")
    assert [push_receipt | _rest] = Forge.recent_pushes("openagents.com")
    assert is_integer(push_receipt.wal_seq)
    branch_ref = "refs/heads/sarah/job-#{job.id}"
    branch_ref = "refs/heads/openagents/job-#{job.id}"
    assert %{"new" => ^sha} = Map.get(push_receipt.refs, branch_ref)

    # Only the job branch moved — main is untouched (promotion is a human).
    path = Repos.bare_path("sarah")
    path = Repos.bare_path("openagents.com")
    {main_sha, 0} = Repos.git(path, ["rev-parse", "refs/heads/main"])
    refute String.trim(main_sha) == sha


defmodule OpenAgents.CollectiveGeneralizerTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.Collective
  alias OpenAgents.Collective.Generalizer
  alias OpenAgents.Conversations

defmodule OpenAgents.CollectivePublicationTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Collective

  alias OpenAgents.Collective.{

defmodule OpenAgents.CollectiveTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.Collective
  alias OpenAgents.Collective.{Candidate, ConsentReceipt}
  alias OpenAgents.Conversations

defmodule OpenAgents.CompensationTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Compensation, Context.Composer, Conversations}
  alias OpenAgents.Compensation.{Event, Statement}
  alias OpenAgents.Providers.Request

    assert event.classification == "eligible"
    assert event.technical_units == 100
    assert event.eligible_units == 100
    assert share.contribution_ref == "OpenAgentsInc/sarah"
    assert share.contribution_ref == "OpenAgentsInc/openagents.com"
    assert share.allocated_units == 100

    assert {:ok, %{event: same, shares: [same_share]}} = Compensation.account(step.id, policy)

    register!(policy, artifact())

    assert {:ok, statement} =
             Compensation.reconcile("OpenAgentsInc/sarah", policy, operator("empty-statement"))
             Compensation.reconcile(
               "OpenAgentsInc/openagents.com",
               policy,
               operator("empty-statement")
             )

    assert_raise Postgrex.Error, fn ->
      statement |> Ecto.Changeset.change(net_units: 999) |> Repo.update!()

             Compensation.register_module(
               policy,
               artifact,
               [%{"contribution_ref" => "OpenAgentsInc/sarah", "allocation_ppm" => 1_000_000}],
               [
                 %{
                   "contribution_ref" => "OpenAgentsInc/openagents.com",
                   "allocation_ppm" => 1_000_000
                 }
               ],
               operator("module-allocation")
             )
  end

      "result" => %{"private" => private_result},
      "error" => nil,
      "target_receipt_refs" => ["message:opaque"],
      "attribution_refs" => ["OpenAgentsInc/sarah"],
      "attribution_refs" => ["OpenAgentsInc/openagents.com"],
      "started_at" => "2026-08-16T20:00:00Z",
      "completed_at" => "2026-08-16T20:00:01Z"
    }

defmodule OpenAgents.ComputerActivityTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Accounts, Computer, ComputerActivity, Conversations, Machines}
  alias OpenAgents.Support.FakeController


defmodule OpenAgents.ConversationsTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.Conversations
  alias OpenAgents.Conversations.{Message, Visitor}


defmodule OpenAgents.DataRights.AtifExportTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  alias OpenAgents.DataRights.AtifExport
  alias OpenAgents.Voice.ProviderEvent

defmodule OpenAgents.DeepWorkToolLoopTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  import Ecto.Query

  alias OpenAgents.{Conversations, Turns, Work}

defmodule OpenAgents.ExperienceMemoryTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Context.Composer, Conversations, ExperienceMemory}
  alias OpenAgents.ExperienceMemory.{Bank, BankItem, DeletionReceipt, EvidenceRef, Pattern}
  alias OpenAgents.Providers.Request

      "result" => %{"verified" => true},
      "error" => nil,
      "target_receipt_refs" => [target_ref],
      "attribution_refs" => ["OpenAgentsInc/sarah"],
      "attribution_refs" => ["OpenAgentsInc/openagents.com"],
      "started_at" => "2026-08-16T20:00:00Z",
      "completed_at" => "2026-08-16T20:00:01Z"
    }

  module — never a refusal to boot.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.BootConverge
  alias OpenAgents.Forge.Repos
  alias OpenAgents.Forge.Target

  shape gates that keep request data from ever becoming a git flag.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.{Browse, Repos}

  @second_message """

      File.rm_rf(base)
    end)

    seed_repo("sarah")
    seed_repo("openagents.com")
  end

  # Two chained commits in the bare repo via plumbing (no clone, no WAL):

  defp seed_repo(repo) do
    path = Repos.ensure_repo!(repo)

    readme = write_blob(path, "# Sarah test repo\n\nFixture readme.\n")
    readme = write_blob(path, "# OpenAgents test repo\n\nFixture readme.\n")
    file_v1 = write_blob(path, "hello\n")

    tree_one =


  describe "resolve_commit/2" do
    test "resolves a branch name, a full sha, and a short sha", %{second: second} do
      assert {:ok, ^second} = Browse.resolve_commit("sarah", "main")
      assert {:ok, ^second} = Browse.resolve_commit("sarah", second)
      assert {:ok, ^second} = Browse.resolve_commit("sarah", String.slice(second, 0, 8))
      assert {:ok, ^second} = Browse.resolve_commit("openagents.com", "main")
      assert {:ok, ^second} = Browse.resolve_commit("openagents.com", second)
      assert {:ok, ^second} = Browse.resolve_commit("openagents.com", String.slice(second, 0, 8))
    end

    test "an unknown ref or sha is :not_found" do
      assert {:error, :not_found} = Browse.resolve_commit("sarah", "no-such-branch")
      assert {:error, :not_found} = Browse.resolve_commit("sarah", "deadbeefdeadbeef")
      assert {:error, :not_found} = Browse.resolve_commit("openagents.com", "no-such-branch")
      assert {:error, :not_found} = Browse.resolve_commit("openagents.com", "deadbeefdeadbeef")
    end

    test "a malformed ref never reaches git" do
      assert {:error, :not_found} = Browse.resolve_commit("sarah", "-evil")
      assert {:error, :not_found} = Browse.resolve_commit("sarah", "a..b")
      assert {:error, :not_found} = Browse.resolve_commit("openagents.com", "-evil")
      assert {:error, :not_found} = Browse.resolve_commit("openagents.com", "a..b")
    end
  end

  describe "commit/2" do
    test "returns subject, author, parents, and parsed trailers — never an email",
         %{first: first, second: second} do
      assert {:ok, commit} = Browse.commit("sarah", String.slice(second, 0, 8))
      assert {:ok, commit} = Browse.commit("openagents.com", String.slice(second, 0, 8))

      assert commit.sha == second
      assert commit.subject == "Second commit"


  test "changed_files/2 lists the second commit's additions and modifications",
       %{second: second} do
    assert {:ok, files} = Browse.changed_files("sarah", second)
    assert {:ok, files} = Browse.changed_files("openagents.com", second)

    assert %{status: "A", path: "docs/note.md"} in files
    assert %{status: "M", path: "file.txt"} in files
  end

  test "diff/2 returns the patch with an honest truncation flag", %{second: second} do
    assert {:ok, diff, false} = Browse.diff("sarah", second)
    assert {:ok, diff, false} = Browse.diff("openagents.com", second)

    assert diff =~ "docs/note.md"
    assert diff =~ "Body of the note."


  describe "tree/3" do
    test "lists root entries with directories first" do
      assert {:ok, entries} = Browse.tree("sarah", "main")
      assert {:ok, entries} = Browse.tree("openagents.com", "main")

      assert Enum.map(entries, & &1.name) == ["docs", "README.md", "file.txt"]
      assert [%{kind: "tree", size: nil} | blobs] = entries

    end

    test "lists a subdirectory" do
      assert {:ok, [%{name: "note.md", kind: "blob"}]} = Browse.tree("sarah", "main", "docs")
      assert {:ok, [%{name: "note.md", kind: "blob"}]} =
               Browse.tree("openagents.com", "main", "docs")
    end
  end

  describe "blob/3" do
    test "returns bounded content with size" do
      assert {:ok, blob} = Browse.blob("sarah", "main", "file.txt")
      assert {:ok, blob} = Browse.blob("openagents.com", "main", "file.txt")

      assert blob.content == "hello world\n"
      assert blob.size == byte_size("hello world\n")

    end

    test "a missing path is :not_found" do
      assert {:error, :not_found} = Browse.blob("sarah", "main", "missing.txt")
      assert {:error, :not_found} = Browse.blob("openagents.com", "main", "missing.txt")
    end

    test "an unknown repo name is :not_found before any git runs" do

  end

  test "readme/2 finds README.md at a ref" do
    assert {:ok, "README.md", blob} = Browse.readme("sarah", "main")
    assert {:ok, "README.md", blob} = Browse.readme("openagents.com", "main")
    assert blob.content =~ "Fixture readme."
  end

  test "log/3 returns both commits newest first", %{first: first, second: second} do
    assert {:ok, [newest, oldest]} = Browse.log("sarah", "main", 30)
    assert {:ok, [newest, oldest]} = Browse.log("openagents.com", "main", 30)

    assert newest.sha == second
    assert newest.subject == "Second commit"

defmodule OpenAgents.Forge.BuilderTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.BuildExecutor
  alias OpenAgents.Forge.BuildExecutor.Sidecar
  alias OpenAgents.Forge.BuildReceipt


  describe "pure Sidecar adapter pieces" do
    test "render_job serializes the two env-style lines the watcher sources" do
      assert Sidecar.render_job("abc123", "http://x:tok@127.0.0.1:8080/git/sarah.git") ==
               "SHA=abc123\nREPO_URL=http://x:tok@127.0.0.1:8080/git/sarah.git\n"
      assert Sidecar.render_job("abc123", "http://x:tok@127.0.0.1:8080/git/openagents.com.git") ==
               "SHA=abc123\nREPO_URL=http://x:tok@127.0.0.1:8080/git/openagents.com.git\n"
    end

    test "parse_result reads env-style lines, tolerating garbage" do

      unless Process.whereis(Builder), do: start_supervised!({Builder, []})

      Phoenix.PubSub.subscribe(OpenAgents.PubSub, "forge:builds")
      %{sha: seeded_commit("sarah"), data_dir: Path.join(base, "data")}
      %{sha: seeded_commit("openagents.com"), data_dir: Path.join(base, "data")}
    end

    test "promotion builds, writes artifact tar + receipt, advances to built",

        {:ok, %{beams: beams, warnings: "warn: something minor", tests: nil, duration_ms: 123}}
      )

      {:ok, target} = Targets.promote("sarah", sha, "test-operator")
      {:ok, target} = Targets.promote("openagents.com", sha, "test-operator")

      assert_receive {:forge_build_ready,
                      %{
                        repo: "sarah",
                        repo: "openagents.com",
                        sha: ^sha,
                        target_id: target_id,
                        artifact: artifact,

      assert binary == beam.binary

      # Receipt row.
      receipt = Repo.get_by!(BuildReceipt, repo: "sarah", sha: sha)
      receipt = Repo.get_by!(BuildReceipt, repo: "openagents.com", sha: sha)
      assert receipt.target_id == target.id
      assert receipt.modules == [module]
      assert receipt.warnings == "warn: something minor"

        {:error, "boom\n" <> String.duplicate("x", 20_000)}
      )

      {:ok, target} = Targets.promote("sarah", sha, "test-operator")
      {:ok, target} = Targets.promote("openagents.com", sha, "test-operator")

      failed = await_status(target, "failed")
      assert failed.status == "failed"

        {:ok, %{beams: beams, warnings: "", tests: nil, duration_ms: 1}}
      )

      {:ok, target2} = Targets.promote("sarah", sha, "test-operator")
      {:ok, target2} = Targets.promote("openagents.com", sha, "test-operator")
      target2_id = target2.id
      assert_receive {:forge_build_ready, %{sha: ^sha, target_id: ^target2_id}}, 5_000
    end

  the roadmap, minus the fleet.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge
  alias OpenAgents.Forge.{Repos, WAL}


defmodule OpenAgents.Forge.HotLoaderTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  @moduletag :capture_log

  alias OpenAgents.Forge.DeployReceipt

    {:ok, target} =
      %Target{}
      |> Target.changeset(%{
        repo: "sarah",
        repo: "openagents.com",
        sha: sha,
        promoted_by: "test-op",
        status: status

    Phoenix.PubSub.subscribe(OpenAgents.PubSub, @deploys_topic)

    broadcast_build_ready(loader, %{
      repo: "sarah",
      repo: "openagents.com",
      sha: sha,
      target_id: target.id,
      artifact: artifact,


    receipt = deploy_receipt(sha)
    assert receipt.result == "live"
    assert receipt.repo == "sarah"
    assert receipt.repo == "openagents.com"
    assert receipt.target_id == target.id
    assert receipt.modules == [name]
    assert receipt.canary == "ok"
    assert receipt.nodes == ["#{Node.self()}=ok"]

    assert_receive {:forge_deploy, %{repo: "sarah", sha: ^sha, result: "live"}}
    assert_receive {:forge_deploy, %{repo: "openagents.com", sha: ^sha, result: "live"}}
  end

  test "allowlist refusal: off-allowlist module means needs_rolling_replace and no load", %{

    Phoenix.PubSub.subscribe(OpenAgents.PubSub, @deploys_topic)

    broadcast_build_ready(loader, %{
      repo: "sarah",
      repo: "openagents.com",
      sha: sha,
      target_id: target.id,
      artifact: artifact,

    offenders = Repo.get!(Target, target.id).details["modules"]
    assert offenders == ["OpenAgents.Turns.Whatever"]

    assert_receive {:forge_deploy, %{repo: "sarah", sha: ^sha, result: "needs_rolling_replace"}}
    assert_receive {:forge_deploy,
                    %{repo: "openagents.com", sha: ^sha, result: "needs_rolling_replace"}}
  end

  test "canary revert: a corrupt beam reverts the whole artifact", %{loader: loader} do

    Phoenix.PubSub.subscribe(OpenAgents.PubSub, @deploys_topic)

    broadcast_build_ready(loader, %{
      repo: "sarah",
      repo: "openagents.com",
      sha: sha,
      target_id: target.id,
      artifact: artifact,

    assert Repo.get!(Target, target.id).status == "reverted"
    assert deploy_receipt(sha).result == "reverted"

    assert_receive {:forge_deploy, %{repo: "sarah", sha: ^sha, result: "reverted"}}
    assert_receive {:forge_deploy, %{repo: "openagents.com", sha: ^sha, result: "reverted"}}
  end

  test "push_to_live_ms is measured from the matching push receipt", %{loader: loader} do

    {:ok, _push} =
      %PushReceipt{}
      |> PushReceipt.changeset(%{
        repo: "sarah",
        repo: "openagents.com",
        wal_seq: System.unique_integer([:positive]),
        principal: "test-op",
        refs: %{"refs/heads/main" => %{"old" => String.duplicate("0", 40), "new" => sha}}

      |> Repo.insert()

    broadcast_build_ready(loader, %{
      repo: "sarah",
      repo: "openagents.com",
      sha: sha,
      target_id: target.id,
      artifact: artifact,

    artifact = tar_artifact([{name, binary}])

    broadcast_build_ready(loader, %{
      repo: "sarah",
      repo: "openagents.com",
      sha: sha,
      target_id: target.id,
      artifact: artifact,

defmodule OpenAgents.Forge.JanitorTest do
  @moduledoc "Cache retention (#123): stale clones and non-live artifacts are pruned; truth never is."

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.Janitor
  alias OpenAgents.Forge.Repos
  alias OpenAgents.Forge.Target

    File.write!(Path.join(base, "data/beams/oldjunk.tar"), "junk")

    %Target{}
    |> Target.changeset(%{repo: "sarah", sha: live_sha, promoted_by: "op:t", status: "promoted"})
    |> Target.changeset(%{
      repo: "openagents.com",
      sha: live_sha,
      promoted_by: "op:t",
      status: "promoted"
    })
    |> Repo.insert!()
    |> Ecto.Changeset.change(%{
      status: "live",

  rolling-replace verification; this is the loop itself.)
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.{FakeBuildExecutor, Targets}

  defmodule TestPipeline do

      File.rm_rf(base)
    end)

    %{base: base, url: "http://x:#{@operator_token}@127.0.0.1:#{port}/sarah.git"}
    %{base: base, url: "http://x:#{@operator_token}@127.0.0.1:#{port}/openagents.com.git"}
  end

  # Restoring a nil via put_env stores literal nil, which then shadows


    # 2. Promote (the operator approval).
    Phoenix.PubSub.subscribe(OpenAgents.PubSub, "forge:deploys")
    assert {:ok, target} = Targets.promote("sarah", sha, "operator:loop-test")
    assert {:ok, target} = Targets.promote("openagents.com", sha, "operator:loop-test")

    # 3–4. Build + hot-load run off the PubSub signals; wait for live.
    assert_receive {:forge_deploy, %{repo: "sarah", sha: ^sha, result: "live"}}, 10_000
    assert_receive {:forge_deploy, %{repo: "openagents.com", sha: ^sha, result: "live"}}, 10_000

    # The module is actually live in this runtime.
    module = Module.concat([module_name])
    assert module.revision() == "loop-v0"

    # Target walked the full lifecycle.
    assert Targets.current("sarah").status == "live"
    assert Targets.current("sarah").id == target.id
    assert Targets.current("openagents.com").status == "live"
    assert Targets.current("openagents.com").id == target.id

    # The loop time is first-class: measured from the push receipt.
    assert [deploy] = OpenAgents.Forge.recent_deploys("sarah")
    assert [deploy] = OpenAgents.Forge.recent_deploys("openagents.com")
    assert deploy.result == "live"
    assert is_integer(deploy.push_to_live_ms) and deploy.push_to_live_ms >= 0
    assert deploy.sha == sha

    sha = String.trim(sha)

    Phoenix.PubSub.subscribe(OpenAgents.PubSub, "forge:deploys")
    {:ok, target} = Targets.promote("sarah", sha, "operator:loop-test")
    {:ok, target} = Targets.promote("openagents.com", sha, "operator:loop-test")

    assert_receive {:forge_deploy, %{sha: ^sha, result: "needs_rolling_replace"}}, 10_000
    refute Code.ensure_loaded?(Module.concat([module_name]))
    assert Targets.current("sarah").id == target.id
    assert Targets.current("sarah").status == "needs_rolling_replace"
    assert Targets.current("openagents.com").id == target.id
    assert Targets.current("openagents.com").status == "needs_rolling_replace"
  end
end

  the unreachable-mirror posture (forge unaffected, nothing reported).
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  import Ecto.Query

  alias OpenAgents.Forge.{MirrorWatch, Repos}

    # A local bare repo stands in for GitHub.
    mirror = Path.join(base, "github-mirror.git")
    {_, 0} = System.cmd("git", ["init", "--bare", "--quiet", mirror])
    Application.put_env(:openagents, :forge_mirror_urls, %{"sarah" => mirror})
    Application.put_env(:openagents, :forge_mirror_urls, %{"openagents.com" => mirror})

    # Seed the forge repo with one commit on main.
    path = Repos.ensure_repo!("sarah")
    path = Repos.ensure_repo!("openagents.com")
    seed_commit!(path, "one")

    on_exit(fn ->

  test "sustained lag records ONE degraded incident per episode" do
    # Make the mirror un-pushable but still readable: replace it with a
    # bare repo whose receive hook rejects everything.
    mirror = Application.fetch_env!(:openagents, :forge_mirror_urls)["sarah"]
    mirror = Application.fetch_env!(:openagents, :forge_mirror_urls)["openagents.com"]
    hook = Path.join(mirror, "hooks/pre-receive")
    File.write!(hook, "#!/bin/sh\nexit 1\n")
    File.chmod!(hook, 0o755)
    # Diverge the forge past the mirror.
    seed_commit!(Repos.bare_path("sarah"), "diverge")
    seed_commit!(Repos.bare_path("openagents.com"), "diverge")

    now = System.monotonic_time(:millisecond)
    state = MirrorWatch.check_all(fresh_state(), now)

    _state = MirrorWatch.check_all(fresh_state())
    assert MirrorWatch.state()["state"] == "off"

    Application.put_env(:openagents, :forge_mirror_urls, %{"sarah" => "/nonexistent/mirror.git"})
    Application.put_env(:openagents, :forge_mirror_urls, %{
      "openagents.com" => "/nonexistent/mirror.git"
    })

    _state = MirrorWatch.check_all(fresh_state())
    assert incident_count() == 0
  end

  rows are never duplicated or rewritten; refs never live in Postgres.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  import Ecto.Query

  alias OpenAgents.Forge

defmodule OpenAgents.Forge.SarahTargetsTest do
  use OpenAgents.SarahDataCase, async: false
defmodule OpenAgents.Forge.TargetLifecycleTest do
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.{Repos, Targets}

  setup do

defmodule OpenAgents.Forge.TargetsTest do
  @moduledoc """
  The two surfaces of `OpenAgents.Forge.Targets` that the end-to-end
  lifecycle test (`OpenAgents.Forge.SarahTargetsTest`, which drives a real
  lifecycle test (`OpenAgents.Forge.TargetLifecycleTest`, which drives a real
  bare repo) does not reach: the injectable `commit_store`, and the bounded
  `details` map.


  each capability has an explicit minimum level.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Forge.Visibility

  defp override_visibility(map) do

  end

  test "the configured level is read from :forge_public_visibility" do
    # config.exs ships "sarah" at :l2 — it is a private repository.
    assert Visibility.level("sarah") == :l2
    # config.exs ships "openagents.com" at :l3 — it is a public repository.
    assert Visibility.level("openagents.com") == :l3

    override_visibility(%{"sarah" => :l1, "demo" => :l2})
    assert Visibility.level("sarah") == :l1
    override_visibility(%{"openagents.com" => :l1, "demo" => :l2})
    assert Visibility.level("openagents.com") == :l1
    assert Visibility.level("demo") == :l2
  end



  describe "published documents (a private repo publishes files, not history)" do
    test "published?/2 reads the operator-owned allowlist" do
      override_paths(%{"sarah" => ["docs/a.md", "CHANGELOG.md"]})
      override_paths(%{"openagents.com" => ["docs/a.md", "CHANGELOG.md"]})

      assert Visibility.published?("sarah", "docs/a.md")
      assert Visibility.published?("sarah", "CHANGELOG.md")
      refute Visibility.published?("sarah", "lib/secret.ex")
      assert Visibility.published?("openagents.com", "docs/a.md")
      assert Visibility.published?("openagents.com", "CHANGELOG.md")
      refute Visibility.published?("openagents.com", "lib/secret.ex")
      refute Visibility.published?("other", "docs/a.md")
    end

    test "allows_file?/4 serves a published path only at head below :l3" do
      override_visibility(%{"sarah" => :l2})
      override_paths(%{"sarah" => ["docs/a.md"]})
      override_visibility(%{"openagents.com" => :l2})
      override_paths(%{"openagents.com" => ["docs/a.md"]})

      assert Visibility.allows_file?("sarah", "docs/a.md", "headsha", "headsha")
      assert Visibility.allows_file?("openagents.com", "docs/a.md", "headsha", "headsha")
      # An older ref for the same published path is refused: publishing a
      # document must not publish its history.
      refute Visibility.allows_file?("sarah", "docs/a.md", "oldsha", "headsha")
      refute Visibility.allows_file?("openagents.com", "docs/a.md", "oldsha", "headsha")
      # A path that was never published is refused at any ref.
      refute Visibility.allows_file?("sarah", "lib/secret.ex", "headsha", "headsha")
      refute Visibility.allows_file?("openagents.com", "lib/secret.ex", "headsha", "headsha")
    end

    test "allows_file?/4 serves anything at :l3, at any ref" do
      override_visibility(%{"sarah" => :l3})
      override_paths(%{"sarah" => []})
      override_visibility(%{"openagents.com" => :l3})
      override_paths(%{"openagents.com" => []})

      assert Visibility.allows_file?("sarah", "lib/anything.ex", "oldsha", "headsha")
      assert Visibility.allows_file?("openagents.com", "lib/anything.ex", "oldsha", "headsha")
    end

    test "a dark repo publishes nothing even with an allowlist" do
      override_visibility(%{"sarah" => :l0})
      override_paths(%{"sarah" => ["docs/a.md"]})
      override_visibility(%{"openagents.com" => :l0})
      override_paths(%{"openagents.com" => ["docs/a.md"]})

      refute Visibility.allows?("sarah", :ledger)
      refute Visibility.allows?("openagents.com", :ledger)
      # allows_file?/4 still honors the explicit publication decision; the
      # surfaces gate on the level first, which is what makes :l0 dark.
      assert Visibility.published?("sarah", "docs/a.md")
      assert Visibility.published?("openagents.com", "docs/a.md")
    end
  end


  use ExUnit.Case, async: false
  alias OpenAgents.Forge.WAL

  @repo "sarah"
  @repo "openagents.com"

  setup do
    tmp_dir =
      Path.join(
        System.tmp_dir!(),
        "sarah_forge_wal_test_#{System.unique_integer([:positive])}"
        "openagents_forge_wal_test_#{System.unique_integer([:positive])}"
      )

    File.mkdir_p!(tmp_dir)


  describe "repo validation" do
    test "rejects invalid repo names on every dispatcher function" do
      for bad <- ["Sarah", "a/b", "", "-lead", "sarah.git", :openagents] do
      for bad <- ["Uppercase", "a/b", "", "-lead", "bad..git", :openagents] do
        assert {:error, :invalid_repo} = WAL.read_index(bad)
        assert {:error, :invalid_repo} = WAL.cas_index(bad, :none, WAL.new_index())
        assert {:error, :invalid_repo} = WAL.put_entry(bad, 0, "x")

    end

    test "object naming helpers" do
      assert OpenAgents.Forge.WAL.Gcs.prefix("sarah") == "forge/wal/sarah/"
      assert OpenAgents.Forge.WAL.Gcs.index_object("sarah") == "forge/wal/sarah/index.json"
      assert OpenAgents.Forge.WAL.Gcs.prefix("openagents.com") == "forge/wal/openagents.com/"

      assert OpenAgents.Forge.WAL.Gcs.object_name("sarah", "entries/00000000-0123456789ab") ==
               "forge/wal/sarah/entries/00000000-0123456789ab"
      assert OpenAgents.Forge.WAL.Gcs.index_object("openagents.com") ==
               "forge/wal/openagents.com/index.json"

      assert OpenAgents.Forge.WAL.Gcs.object_name(
               "openagents.com",
               "entries/00000000-0123456789ab"
             ) ==
               "forge/wal/openagents.com/entries/00000000-0123456789ab"
    end
  end
end

defmodule OpenAgents.GitHubOAuthTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{GitHubOAuth, Repo}
  alias OpenAgents.Accounts.OAuthAttempt


    Req.Test.expect(__MODULE__, fn conn ->
      assert conn.request_path == "/login/oauth/access_token"
      assert ["application/json"] = Plug.Conn.get_req_header(conn, "accept")
      assert ["OpenAgents-Sarah"] = Plug.Conn.get_req_header(conn, "user-agent")
      assert ["OpenAgents"] = Plug.Conn.get_req_header(conn, "user-agent")
      body = Req.Test.raw_body(conn)
      assert body =~ "client_id=test-github-client-id"
      assert body =~ "client_secret=test-github-client-secret"

      assert ["Bearer gho_listing-token"] = Plug.Conn.get_req_header(conn, "authorization")
      assert ["application/vnd.github+json"] = Plug.Conn.get_req_header(conn, "accept")
      assert ["2022-11-28"] = Plug.Conn.get_req_header(conn, "x-github-api-version")
      assert ["OpenAgents-Sarah"] = Plug.Conn.get_req_header(conn, "user-agent")
      assert ["OpenAgents"] = Plug.Conn.get_req_header(conn, "user-agent")

      query = URI.decode_query(conn.query_string)
      assert query["per_page"] == "5"

defmodule OpenAgents.GraphMemoryTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Conversations, ExperienceMemory, GraphMemory}

  alias OpenAgents.GraphMemory.{

defmodule OpenAgents.Incidents.FixerTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Incidents
  alias OpenAgents.Incidents.Fixer

defmodule OpenAgents.IncidentsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.Incidents
  alias OpenAgents.Incidents.Triage
  alias OpenAgents.{Accounts, Conversations, Repo}

defmodule OpenAgents.InferenceTest do
  use OpenAgents.SarahDataCase, async: false
  import OpenAgentsWeb.SarahConnCase, only: [github_user: 1]
  use OpenAgents.DataCase, async: false
  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  alias OpenAgents.Inference
  alias OpenAgents.Inference.Grant

  counted twice.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Accounts
  alias OpenAgents.Context.Composer
  alias OpenAgents.Conversations

1	+	`defmodule OpenAgents.Machines.TokenVaultTest do`
2	+	`use ExUnit.Case, async: true`
3	+
4	+	`alias OpenAgents.Machines.TokenVault`
5	+
6	+	`test "seals new tokens with the OpenAgents version" do`
7	+	`assert {:ok, <<2, _rest::binary>> = sealed} = TokenVault.seal("smct_current")`
8	+	`assert {:ok, "smct_current"} = TokenVault.open(sealed)`
9	+	`end`
10	+
11	+	`test "opens legacy Sarah version-1 tokens during migration" do`
12	+	`token = "smct_legacy"`
13	+	`nonce = :crypto.strong_rand_bytes(12)`
14	+	`{:ok, key} = Base.decode64(Application.fetch_env!(:openagents, :github_token_encryption_key))`
15	+
16	+	`{ciphertext, tag} =`
17	+	`:crypto.crypto_one_time_aead(`
18	+	`:aes_256_gcm,`
19	+	`key,`
20	+	`nonce,`
21	+	`token,`
22	+	`"sarah.machine_token.v1",`
23	+	`true`
24	+	`)`
25	+
26	+	`assert {:ok, ^token} = TokenVault.open(<<1, nonce::binary, tag::binary, ciphertext::binary>>)`
27	+	`end`
28	+
29	+	`test "refuses unknown versions" do`
30	+	`assert {:error, :token_unsealable} = TokenVault.open(<<3, 0::256>>)`
31	+	`end`
32	+	`end`

defmodule OpenAgents.MachinesCapacityTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Machines
  alias OpenAgents.Machines.Machine


defmodule OpenAgents.MachinesTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.Machines
  alias OpenAgents.Machines.Pairing


defmodule OpenAgents.Memory.EvaluationTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Memory.Evaluation.{Corpus, ReleaseGate, Report, Runner}


defmodule OpenAgents.Memory.EvidenceTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.{Context.Composer, Conversations, Repo}
  alias OpenAgents.Conversations.Message

defmodule OpenAgents.Memory.LexicalRecallTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.{Context.Composer, Conversations, Repo}
  alias OpenAgents.Conversations.Message

defmodule OpenAgents.Memory.PolicyAndRedactionTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  import ExUnit.CaptureLog


defmodule OpenAgents.MemoryPortabilityTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  import ExUnit.CaptureLog

  alias OpenAgents.{Conversations, ProfileMemory}

defmodule OpenAgents.Modules.LifecycleTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true

  alias OpenAgents.Modules.{Discovery, Lifecycle, LifecycleReceipt, Metadata}
  alias OpenAgents.Tools.{Registry, Tool}

      required_authority: "conversation.read",
      executor: %{id: "sarah.test", disclosure: "Sarah lifecycle test"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{"privacy" => "test", "residency" => "test"},
      module_metadata:
        Metadata.first_party("conversation.read", "browser_conversation",

      required_authority: "conversation.read",
      executor: %{id: "sarah.local", disclosure: "Sarah local module test"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{"privacy" => "browser_scoped", "residency" => "host"},
      module_metadata:
        Metadata.first_party("conversation.read", "browser_conversation",

defmodule OpenAgents.NetworkStatusTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.NetworkStatus

  test "the projection is bounded, content-free, and schema-versioned (STATUS-001)" do
    projection = NetworkStatus.projection(refresh: true)

    assert projection["schema"] == "sarah.network_status.v1"
    assert projection["schema"] == "openagents.network_status.v1"
    # Legacy /status compatibility keys survive in the superset.
    assert projection["status"] in ["ok", "degraded"]
    assert is_binary(projection["revision"])

      target =
        %Target{}
        |> Target.changeset(%{
          repo: "sarah",
          repo: "openagents.com",
          sha: sha,
          promoted_by: "operator:99887766",
          status: "promoted"


      %DeployReceipt{}
      |> DeployReceipt.changeset(%{
        repo: "sarah",
        repo: "openagents.com",
        sha: sha,
        target_id: target.id,
        modules: ["Elixir.OpenAgents.VerySecretModule"],


      target =
        %Target{}
        |> Target.changeset(%{repo: "sarah", sha: sha, promoted_by: "operator:1", status: "live"})
        |> Target.changeset(%{
          repo: "openagents.com",
          sha: sha,
          promoted_by: "operator:1",
          status: "live"
        })
        |> Repo.insert!()

      for {result, ms} <- [{"live", 30_000}, {"failed", nil}, {"live", 20_000}, {"live", 10_000}] do
        %DeployReceipt{}
        |> DeployReceipt.changeset(%{
          repo: "sarah",
          repo: "openagents.com",
          sha: sha,
          target_id: target.id,
          result: result,

defmodule OpenAgents.ObservabilityTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Observability
  alias OpenAgents.Observability.{Readback, ReleaseGate}


  test "read-back is aggregate-only and the zero-tolerance gate is explicit" do
    readback = Readback.snapshot()

    assert readback.schema == "sarah.observability.readback.v1"
    assert readback.schema == "openagents.observability.readback.v1"

    assert Map.keys(readback.planes) |> Enum.sort() ==
             ~w(collective evaluation memory module provider tool)

defmodule OpenAgents.PreferencesTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Context.Composer, Conversations, Preferences}
  alias OpenAgents.Conversations.Message
  alias OpenAgents.Providers.Request

defmodule OpenAgents.ProfileMemoryTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.{Conversations, ProfileMemory, Repo}
  alias OpenAgents.Conversations.{Message, Visitor}
  alias OpenAgents.ProfileMemory.Source

defmodule OpenAgents.ProgramLifecycleTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.ProgramArtifacts.Reader
  alias OpenAgents.ProgramLifecycle
  alias OpenAgents.ProgramLifecycle.Event

end

defmodule OpenAgents.SemanticRecallTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.Conversations
  alias OpenAgents.Conversations.Message


defmodule OpenAgents.ShadowProgramsTest do
  use OpenAgents.SarahDataCase, async: true
  use OpenAgents.DataCase, async: true
  alias OpenAgents.{Conversations, ProgramArtifacts, ShadowPrograms}
  alias OpenAgents.Context.Composer
  alias OpenAgents.ProfileMemory.Record

defmodule OpenAgents.ToolStepPersistenceTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  import Ecto.Query

  alias OpenAgents.{Context.Composer, Conversations}

      "result" => result,
      "error" => nil,
      "target_receipt_refs" => ["message:1"],
      "attribution_refs" => ["OpenAgentsInc/sarah"],
      "attribution_refs" => ["OpenAgentsInc/openagents.com"],
      "started_at" => "2026-08-16T20:00:00Z",
      "completed_at" => "2026-08-16T20:00:01Z"
    }

defmodule OpenAgents.Tools.ComputerToolsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Conversations.Message
  alias OpenAgents.Incidents

                 "machine_id" => machine.id,
                 "agent_id" => "claude",
                 "prompt" => "first pass",
                 "cwd" => "/Users/test/work/sarah"
                 "cwd" => "/Users/test/work/openagents.com"
               }),
               context(scope)
             )

                 "machine_id" => machine.id,
                 "agent_id" => "claude",
                 "prompt" => "retry the same work",
                 "cwd" => "/Users/test/work/sarah"
                 "cwd" => "/Users/test/work/openagents.com"
               }),
               context(scope)
             )

    machine = probed_agent_machine(scope.user, "infer-box", ["claude"])

    connect(machine.id, fn {:agent, request_id, payload, caller} ->
      assert payload["cwd"] == "/Users/christopherdavid/work/sarah"
      assert payload["cwd"] == "/Users/test/work/openagents.com"

      FakeController.exit(caller, request_id, %{
        "status" => "completed",

               call_raw("computer_agent", %{
                 "agent_id" => "claude",
                 "prompt" =>
                   "Work only in /Users/christopherdavid/work/sarah. Do not touch openagents."
                   "Work only in /Users/test/work/openagents.com. Do not touch openagents."
               }),
               context(scope)
             )

    assert outcome["result"]["status"] == "started"
    assert outcome["result"]["cwd"] == "/Users/christopherdavid/work/sarah"
    assert outcome["result"]["cwd"] == "/Users/test/work/openagents.com"
    await_delegation(outcome)
  end


  end

  defp call("computer_agent", arguments) do
    call_raw("computer_agent", Map.put_new(arguments, "cwd", "/Users/test/work/sarah"))
    call_raw("computer_agent", Map.put_new(arguments, "cwd", "/Users/test/work/openagents.com"))
  end

  defp call(name, arguments), do: call_raw(name, arguments)

defmodule OpenAgents.Tools.ConversationRecallToolsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.{Context.Composer, Conversations, Repo, Voice}
  alias OpenAgents.Conversations.Message

      "result" => result,
      "error" => nil,
      "target_receipt_refs" => [],
      "attribution_refs" => ["OpenAgentsInc/sarah"],
      "attribution_refs" => ["OpenAgentsInc/openagents.com"],
      "started_at" => "2026-08-16T20:00:00Z",
      "completed_at" => "2026-08-16T20:00:01Z"
    }

defmodule OpenAgents.Tools.GitHubRepoToolsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Conversations.Message
  alias OpenAgents.Tools.{ExecutionContext, Registry, Runner}

    scope = github_scope("repo-reader", "gho_stored-for-reading")

    Req.Test.expect(__MODULE__, fn conn ->
      assert conn.request_path == "/repos/repo-reader/sarah/contents/mix.exs"
      assert conn.request_path == "/repos/repo-reader/demo/contents/mix.exs"

      Req.Test.json(conn, %{
        "type" => "file",
        "path" => "mix.exs",
        "size" => 20,
        "encoding" => "base64",
        "content" => Base.encode64("defmodule Sarah do")
        "content" => Base.encode64("defmodule Demo do")
      })
    end)


             Runner.run(
               snapshot,
               call("github_repo_read", %{
                 "repository" => "repo-reader/sarah",
                 "repository" => "repo-reader/demo",
                 "path" => "mix.exs",
                 "ref" => ""
               }),


    assert outcome["status"] == "succeeded"
    assert outcome["result"]["type"] == "file"
    assert outcome["result"]["content"] == "defmodule Sarah do"
    assert outcome["result"]["content"] == "defmodule Demo do"
    refute inspect(outcome) =~ "gho_stored-for-reading"
  end


defmodule OpenAgents.Tools.IncidentLookupTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Incidents
  alias OpenAgents.Tools.{ExecutionContext, Registry, Runner}

defmodule OpenAgents.Tools.ProfileMemoryToolsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase

  alias OpenAgents.Conversations.{Message, Visitor}
  alias OpenAgents.Memory.Consent

    assert outcome["module_ref"]["module_id"] == "sarah.tool.echo"
    assert outcome["executor_ref"]["disclosure"] == "Sarah's local test executor"
    assert outcome["target_receipt_refs"] == ["message:1"]
    assert outcome["attribution_refs"] == ["OpenAgentsInc/sarah"]
    assert outcome["attribution_refs"] == ["OpenAgentsInc/openagents.com"]
  end

  test "unknown tools, incompatible versions, and schema failures are bounded" do

      required_authority: "conversation.read",
      executor: %{id: "sarah.local", disclosure: "Sarah's local test executor"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{"privacy" => "browser_scoped", "residency" => "host"},
      module_metadata:
        Metadata.first_party("conversation.read", "browser_conversation",

  discipline — plus every refusal the invariant promises.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  alias OpenAgents.Forge
  alias OpenAgents.Forge.Repos

    Application.put_env(
      :openagents,
      :forge_self_push_url,
      "http://x:#{@operator_token}@127.0.0.1:#{port}/sarah.git"
      "http://x:#{@operator_token}@127.0.0.1:#{port}/openagents.com.git"
    )

    # Seed the forge's "sarah" repo with one commit so clones have a base.
    # Seed the forge's "openagents.com" repo with one commit so clones have a base.
    seed_repo!()

    on_exit(fn ->

  end

  defp seed_repo! do
    path = Repos.ensure_repo!("sarah")
    path = Repos.ensure_repo!("openagents.com")

    {blob, 0} = plumb(path, ["hash-object", "-w", "--stdin"], "original content\n")
    {tree, 0} = plumb(path, ["mktree"], "100644 blob #{String.trim(blob)}\tnote.txt\n")

    sha = pushed["result"]["sha"]
    assert sha =~ ~r/^[0-9a-f]{40}$/
    branch = pushed["result"]["branch"]
    assert branch == "sarah/job-11111111-2222-3333-4444-555555555555"
    assert branch == "openagents/job-11111111-2222-3333-4444-555555555555"

    # The commit SHA is in the outcome receipt refs (SELF-EDIT-001). The
    # middle segment is the forge repo the coding lane edits
    # (`OpenAgents.Tools.Repository.repo/0`), which is still `sarah` — the
    # same name this test uses for the branch, the push receipt, and the
    # (`OpenAgents.Tools.Repository.repo/0`), which is now `openagents.com` — the
    # same repository this test uses for the branch, the push receipt, and the
    # bare path below. Renaming the forge repo is a separate whole-repo
    # change (config `forge_repos`, visibility, public paths, git URL).
    assert "forge-commit:sarah:#{sha}" in pushed["target_receipt_refs"]
    assert "forge-commit:openagents.com:#{sha}" in pushed["target_receipt_refs"]

    # The push is receipted with a WAL sequence, and the ref exists on the
    # forge with exactly that sha.
    assert [receipt | _rest] = Forge.recent_pushes("sarah")
    assert [receipt | _rest] = Forge.recent_pushes("openagents.com")
    assert is_integer(receipt.wal_seq)
    assert %{"new" => ^sha} = Map.get(receipt.refs, "refs/heads/" <> branch)

    path = Repos.bare_path("sarah")
    path = Repos.bare_path("openagents.com")
    {out, 0} = Repos.git(path, ["rev-parse", "refs/heads/" <> branch])
    assert String.trim(out) == sha


  refusals that keep the family inside SELF-EDIT-001.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  alias OpenAgents.Tools.{
    CodeCheck,

    File.mkdir_p!(Path.join(source, "lib"))
    File.write!(Path.join(source, "lib/sample.ex"), "defmodule RepoToolsFixtureSample do\nend\n")
    File.write!(Path.join(source, "README.md"), "hello forge sample\n")
    previous = Application.get_env(:openagents, :sarah_source_dir)
    Application.put_env(:openagents, :sarah_source_dir, source)
    previous = Application.get_env(:openagents, :source_repo_dir)
    Application.put_env(:openagents, :source_repo_dir, source)

    on_exit(fn ->
      if previous,
        do: Application.put_env(:openagents, :sarah_source_dir, previous),
        else: Application.delete_env(:openagents, :sarah_source_dir)
        do: Application.put_env(:openagents, :source_repo_dir, previous),
        else: Application.delete_env(:openagents, :source_repo_dir)

      File.rm_rf(source)
    end)

defmodule OpenAgents.TurnMemoryEvidenceJourneysTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  import Ecto.Query

  alias OpenAgents.{Conversations, Repo, Turns}

defmodule OpenAgents.TurnProvenanceTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.{Context.Composer, Conversations, Turns}
  alias OpenAgents.Conversations.{ProviderStep, TurnReceipt}
  alias OpenAgents.Provenance.Canonical

defmodule OpenAgents.TurnProviderEventsTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.{Conversations, Turns}
  alias OpenAgents.Conversations.ProviderStep
  alias OpenAgents.Incidents.Incident

defmodule OpenAgents.TurnToolLoopTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  import Ecto.Query

  alias OpenAgents.{Conversations, Turns}

  things that keeps honest: ordering, fencing, ceilings, and sealing.
  """

  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  alias OpenAgents.Conversations
  alias OpenAgents.Repo

      assert {:error, :chunk_unsealable} = RecordingVault.open(sealed, recording_id, 4)
    end

    test "legacy Sarah version-1 chunks remain readable during migration" do
      recording_id = Ecto.UUID.generate()
      sequence = 3
      nonce = :crypto.strong_rand_bytes(12)

      {:ok, key} =
        Base.decode64(Application.fetch_env!(:openagents, :voice_recording_encryption_key))

      aad = "sarah.voice_recording_chunk.v1:#{recording_id}:#{sequence}"

      {ciphertext, tag} =
        :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, "legacy audio", aad, true)

      sealed = <<1, nonce::binary, tag::binary, ciphertext::binary>>
      assert {:ok, "legacy audio"} = RecordingVault.open(sealed, recording_id, sequence)
    end

    test "a wrong key fails closed" do
      recording_id = Ecto.UUID.generate()
      assert {:ok, sealed} = RecordingVault.seal("audio", recording_id, 1)

        Application.put_env(
          :openagents,
          :voice_recording_encryption_key,
          Base.encode64("sarah-test-voice-recording-OTHER")
          Base.encode64(String.duplicate("x", 32))
        )

        assert {:error, :chunk_unsealable} = RecordingVault.open(sealed, recording_id, 1)

defmodule OpenAgents.Voice.ReleaseOperationsTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  import ExUnit.CaptureLog


defmodule OpenAgents.VoiceSessionsTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Conversations, Voice, VoiceSessions}
  alias OpenAgents.Voice.ProviderEvent



    assert_receive {:sideband_started, _sideband, _sideband_session}

    typed = "Check https://github.com/OpenAgentsInc/sarah please"
    typed = "Check https://github.com/OpenAgentsInc/openagents.com please"
    assert {:ok, message} = Conversations.create_voice_context_message(conversation, typed)
    assert message.status == "complete"
    assert message.role == "user"

defmodule OpenAgents.VoiceTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false
  alias OpenAgents.{Conversations, Voice}
  alias OpenAgents.Tools.{ExecutionContext, Registry, Runner}
  alias OpenAgents.Voice.{Config, ProviderEvent, Session}


  test "a Horde singleton relocates to a survivor when its node dies, staying unique" do
    cookie = :erlang.get_cookie()
    {peer1, node1} = start_peer(:sarah_handoff_peer1, cookie)
    {peer2, node2} = start_peer(:sarah_handoff_peer2, cookie)
    {peer1, node1} = start_peer(:openagents_handoff_peer1, cookie)
    {peer2, node2} = start_peer(:openagents_handoff_peer2, cookie)

    on_exit(fn ->
      for p <- [peer1, peer2], do: safe_stop(p)

defmodule OpenAgents.WorkJobTest do
  use OpenAgents.SarahDataCase
  use OpenAgents.DataCase
  alias OpenAgents.{Conversations, Work}
  alias OpenAgents.Conversations.Message
  alias OpenAgents.Work.{Job, JobServer}

  the connection marker must actually be driven by the socket.
  """

  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  alias OpenAgents.Accounts


  test "includes the primary host and configured Cloud Run aliases" do
    assert AllowedOrigins.for_production(
             "sarah.example",
             "https://sarah-123.run.app, https://sarah.example"
           ) == ["https://sarah.example", "https://sarah-123.run.app"]
             "openagents.example",
             "https://openagents-123.run.app, https://openagents.example"
           ) == ["https://openagents.example", "https://openagents-123.run.app"]
  end

  test "rejects origins containing paths or an insecure scheme" do
    assert_raise ArgumentError, fn ->
      AllowedOrigins.for_production("sarah.example", "https://other.example/path")
      AllowedOrigins.for_production("openagents.example", "https://other.example/path")
    end

    assert_raise ArgumentError, fn ->
      AllowedOrigins.for_production("sarah.example", "http://other.example")
      AllowedOrigins.for_production("openagents.example", "http://other.example")
    end
  end
end

defmodule OpenAgentsWeb.AuthControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.{Accounts, Conversations}

defmodule OpenAgentsWeb.AuthGateTest do
  use OpenAgentsWeb.SarahConnCase, async: true
  use OpenAgentsWeb.ConnCase, async: true
  import Ecto.Query

  alias OpenAgents.Conversations.{Conversation, Visitor}

defmodule OpenAgentsWeb.ComputerChannelTest do
  use OpenAgents.SarahDataCase, async: false
  use OpenAgents.DataCase, async: false

  import Phoenix.ChannelTest
  import OpenAgentsWeb.SarahConnCase, only: [github_user: 1]
  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  @endpoint OpenAgentsWeb.Endpoint


    assert {:error, %{"reason" => "machine_mismatch"}} =
             subscribe_and_join(socket, "computer:#{Ecto.UUID.generate()}", %{})

    assert {:ok, %{"protocol" => "sarah.computer.v1"}, _joined} =
    assert {:ok, %{"protocol" => "openagents.computer.v1"}, _joined} =
             subscribe_and_join(socket, "computer:#{machine.id}", %{})
  end


  @moduledoc """
  Guards the catalog against silently falling behind the code.

  The catalog was originally hand-written and drifted: nineteen SarahUI
  The catalog was originally hand-written and drifted: nineteen UI
  components shipped without ever appearing on the components page. This test
  makes that failure mode loud — adding a public function component to a
  documented module fails the suite until it is catalogued or explicitly

defmodule OpenAgentsWeb.AtifExportControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Conversations.Visitor

defmodule OpenAgentsWeb.ComputerAgentJobsControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Machines
  alias OpenAgents.Support.FakeController
  alias OpenAgents.Work

  @root "/tmp/sarah-agent-api"
  @root "/tmp/openagents-agent-api"

  test "an API-started Codex job streams into ChatLive and posts its terminal report", %{
    conn: conn

defmodule OpenAgentsWeb.ComputersControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  alias OpenAgents.Computer
  alias OpenAgents.Machines
  alias OpenAgents.Machines.Pairing

    "tier" => "curated",
    "platform" => "linux-x64",
    "agent_version" => "0.4.0",
    "roots" => ["/tmp/sarah-api-canary"]
    "roots" => ["/tmp/openagents-api-canary"]
  }

  test "the API drives pairing, claim, presence, inventory, and revoke without exposing tokens",

      |> json_response(200)

    assert %{
             "schema" => "sarah.computers.v1",
             "schema" => "openagents.computers.v1",
             "pairing_enabled" => true,
             "computers" => [listed]
           } = inventory

defmodule OpenAgentsWeb.ControllerPairingTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  alias OpenAgents.Machines

  @create_params %{

defmodule OpenAgentsWeb.DataControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Ecto.Query
  import Phoenix.LiveViewTest


defmodule OpenAgentsWeb.HealthControllerTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase

  test "reports healthy when PostgreSQL is reachable", %{conn: conn} do
    conn = get(conn, ~p"/status")

defmodule OpenAgentsWeb.InferenceProxyControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  alias OpenAgents.Inference
  alias OpenAgents.Inference.Grant
  alias OpenAgents.Machines

defmodule OpenAgentsWeb.SarahErrorHTMLTest do
  use OpenAgentsWeb.SarahConnCase, async: true
  # Bring render_to_string/4 for testing custom views
  import Phoenix.Template, only: [render_to_string: 4]

  test "renders 404.html" do
    assert render_to_string(OpenAgentsWeb.ErrorHTML, "404", "html", []) == "Not Found"
  end

  test "renders 500.html" do
    assert render_to_string(OpenAgentsWeb.ErrorHTML, "500", "html", []) == "Internal Server Error"
  end
end

defmodule OpenAgentsWeb.SarahErrorJSONTest do
  use OpenAgentsWeb.SarahConnCase, async: true

  test "renders 404" do
    assert OpenAgentsWeb.ErrorJSON.render("404.json", %{}) == %{errors: %{detail: "Not Found"}}
  end

  test "renders 500" do
    assert OpenAgentsWeb.ErrorJSON.render("500.json", %{}) ==
             %{errors: %{detail: "Internal Server Error"}}
  end
end

defmodule OpenAgentsWeb.VoiceCallControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false

  setup do
    previous_voice = Application.fetch_env!(:openagents, :voice)

  container outside the allowlist, and another account's call.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  alias OpenAgents.Conversations
  alias OpenAgents.Voice
  alias OpenAgents.Voice.Config

defmodule OpenAgentsWeb.VoiceTelemetryControllerTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Ecto.Query

  alias OpenAgents.{Conversations, Repo, Voice}

  rather than reviewed by eye.
  """

  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  describe "icon-only controls" do

    test "no surface hand-writes an svg outside the vendored set" do
      # Every glyph must come from `priv/icons` through `icon/1`. A pasted
      # `<svg>` in a template is how a second, unmanaged icon set starts.
      #
      # Ported from Sarah, where this globbed `lib/sarah_web/**` and carried a
      # documented exemption for Sarah's landing template
      # (`lib/sarah_web/controllers/home_html/show.html.heex`), whose
      # `landing-grid` is a background pattern rather than an icon. That
      # exemption is dropped rather than repointed: the OpenAgents home is
      # `OpenAgentsWeb.HomeLive` ("The Agent Forge"), it renders no background
      # SVG, and Sarah's landing template is deliberately not part of this app.
      # If a background pattern is ever added here, re-add the exemption WITH
      # the staleness assertion that guarded it.
      #
      # The exempt files are the ones that IMPLEMENT the vendored set:
      # `icons.ex` holds it, and `icon/1` is defined in both `sarah_ui.ex` (which
      # matches the `ui.ex` suffix Sarah used) and `core_components.ex`. The
      # assertions below fail loudly if either stops being icon plumbing, so the
      # exemption cannot silently become a hole.
      # The exempt files implement the vendored set. `icons.ex` holds the
      # embedded SVG markup, while `ui.ex` and `core_components.ex` render it.
      # The assertions below fail if an exemption stops being icon plumbing.
      renderers = ["lib/openagents_web/components/core_components.ex"]

      for renderer <- renderers do

  @moduledoc """
  Contract tests for the vendored icon set.

  The set is generated by `mix sarah.icons.vendor`, so these guard the
  The set is generated by `mix openagents.icons.vendor`, so these guard the
  conversion and the glyphs the product depends on: a bad re-vendor must fail
  the build rather than silently emptying an affordance.
  """

  use ExUnit.Case, async: true
  import Phoenix.Component
  import Phoenix.LiveViewTest
  import OpenAgentsWeb.SarahUI
  import OpenAgentsWeb.UI

  alias OpenAgentsWeb.Icons

  # Every glyph a Sarah surface renders. If a re-vendor drops one of these, the
  # Every glyph a OpenAgents surface renders. If a re-vendor drops one of these, the
  # control loses its affordance, so name them explicitly.
  @in_use ~w(
    arrow-up stop history memory-on-remember arrow-left chevron-down logout

  operator identity; only WAL-pushed SHAs are promotable.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Forge.{Repos, Targets}

  end

  test "promote records the operator identity and broadcasts", %{conn: conn} do
    # "sarah" is the primary configured repo in test config.
    sha = seeded_commit("sarah")
    # "openagents.com" is the primary configured repo in test config.
    sha = seeded_commit("openagents.com")
    Phoenix.PubSub.subscribe(OpenAgents.PubSub, "forge:target")

    conn = log_in_admin_user(conn, "forge-promoter")


    render_hook(view, "promote", %{"sha" => sha})

    assert_receive {:forge_target, %{repo: "sarah", sha: ^sha}}
    target = Targets.current("sarah")
    assert_receive {:forge_target, %{repo: "openagents.com", sha: ^sha}}
    target = Targets.current("openagents.com")
    assert target.sha == sha
    assert target.promoted_by =~ "operator:"
    assert render(view) =~ String.slice(sha, 0, 12)
  end

  test "promoting a commit that is not in the forge is refused honestly", %{conn: conn} do
    Repos.ensure_repo!("sarah")
    Repos.ensure_repo!("openagents.com")
    conn = log_in_admin_user(conn, "forge-refuser")
    {:ok, view, _html} = live(conn, ~p"/admin/forge")


    # targets written by another test's async builder can leak past the
    # sandbox and land in the table, which made the global-emptiness form
    # flaky under the full suite.)
    refute Enum.any?(Targets.recent("sarah", 50), &(&1.sha == refused_sha))
    refute Enum.any?(Targets.recent("openagents.com", 50), &(&1.sha == refused_sha))
    assert render(view) =~ "only pushed commits are promotable"
  end
end

  what the page is allowed to show once it renders.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Conversations

  end

  test "mounts with an honest empty state when no issue has an assignee", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/assignees")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/assignees")

    assert html =~ "Assignees"
    assert has_element?(view, ~s{[role="status"]}, "No assignees have been assigned")

    # A closed issue still counts: the view lists `state: "all"`.
    {:ok, _} = Issues.update_issue(third, %{"state" => "closed"})

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/assignees")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/assignees")

    assert has_element?(view, "#assignees")
    refute html =~ "No assignees have been assigned"


  test "an anonymous visitor is redirected away from the assignee list" do
    assert {:error, {:redirect, %{to: to}}} =
             live(build_conn(), ~p"/OpenAgentsInc/sarah/assignees")
             live(build_conn(), ~p"/OpenAgentsInc/openagents.com/assignees")

    refute to == "/OpenAgentsInc/sarah/assignees"
    refute to == "/OpenAgentsInc/openagents.com/assignees"
  end
end

  repo.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Changelog


    {:ok, entry} =
      Changelog.record(%{
        repo: "sarah",
        repo: "openagents.com",
        sha: "abcdef1",
        summary: "Moved the mic button test entry",
        category: "ui",

    {:ok, _view, html} = live(conn, ~p"/changelog")

    assert html =~ "abcdef1"
    assert html =~ "/OpenAgentsInc/sarah/commit/abcdef1"
    assert html =~ "/OpenAgentsInc/openagents.com/commit/abcdef1"
  end

  test "carries the shared command bar without account controls for a visitor", %{conn: conn} do

    conn = get(conn, ~p"/api/changelog")
    payload = json_response(conn, 200)

    assert payload["schema"] == "sarah.changelog.v1"
    assert payload["repo"] == "sarah"
    assert payload["schema"] == "openagents.changelog.v1"
    assert payload["repo"] == "openagents.com"

    assert Enum.any?(
             payload["entries"],

defmodule OpenAgentsWeb.ChatDelegationRailTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  alias OpenAgents.{Computer, Conversations, Machines}

defmodule OpenAgentsWeb.ChatLiveTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest
  import Ecto.Query


             render(view) =~ ~s(data-server-status="listening")
           end)

    typed = "Read https://github.com/OpenAgentsInc/sarah while we talk."
    typed = "Read https://github.com/OpenAgentsInc/openagents.com while we talk."

    view
    |> form("#message-form", chat: %{message: typed})

    assert eventually(fn ->
             rendered = render(view)

             rendered =~ "Read https://github.com/OpenAgentsInc/sarah" and
             rendered =~ "Read https://github.com/OpenAgentsInc/openagents.com" and
               rendered =~ ~s(data-server-status="listening")
           end)


defmodule OpenAgentsWeb.ChatSidebarSectionsTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  alias OpenAgents.{Conversations, Work}

  missing path, and a flag-shaped ref 404 indistinguishably.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Forge.{DeployReceipt, Repos}

    # explicitly via `browsable/0`.
    previous_vis = Application.get_env(:openagents, :forge_public_visibility)
    previous_paths = Application.get_env(:openagents, :forge_public_paths)
    Application.put_env(:openagents, :forge_public_visibility, %{"sarah" => :l2})
    Application.put_env(:openagents, :forge_public_paths, %{"sarah" => ["docs/audit.md"]})
    Application.put_env(:openagents, :forge_public_visibility, %{"openagents.com" => :l2})

    Application.put_env(:openagents, :forge_public_paths, %{"openagents.com" => ["docs/audit.md"]})

    on_exit(fn ->
      if previous_data,

      File.rm_rf(base)
    end)

    seed_repo("sarah")
    seed_repo("openagents.com")
  end

  defp browsable,
    do: Application.put_env(:openagents, :forge_public_visibility, %{"sarah" => :l3})
    do: Application.put_env(:openagents, :forge_public_visibility, %{"openagents.com" => :l3})

  # Two chained commits: the first seeds README.md + file.txt, the second
  # adds docs/audit.md (a markdown heading the tests can recognize) with the

  defp seed_repo(repo) do
    path = Repos.ensure_repo!(repo)

    readme = write_blob(path, "# Sarah test repo\n\nFixture readme.\n")
    readme = write_blob(path, "# OpenAgents test repo\n\nFixture readme.\n")
    file = write_blob(path, "hello\n")

    tree_one =

    {:ok, deploy} =
      %DeployReceipt{}
      |> DeployReceipt.changeset(%{
        repo: "sarah",
        repo: "openagents.com",
        sha: sha,
        target_id: Ecto.UUID.generate(),
        result: "live",


  describe "/code/:repo" do
    test "a private repo below :l3 does not expose a browsable repo home", %{conn: conn} do
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn -> live(conn, "/OpenAgentsInc/sarah") end
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/openagents.com")
      end
    end

    test "renders the repo home for a visitor with no session", %{conn: conn, short: short} do
      browsable()
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com")

      assert html =~ "<h1>OpenAgentsInc/sarah</h1>"
      assert html =~ "<h1>OpenAgentsInc/openagents.com</h1>"
      assert html =~ "Add the transparency audit fixture"
      assert html =~ "First commit"
      assert html =~ ~s(id="repo-refs")


    test "publishes no node internals and no account controls anonymously", %{conn: conn} do
      browsable()
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com")

      refute html =~ to_string(node())
      refute html =~ ~s(id="account-menu-trigger")

    test "the repo is reachable only under its owning account", %{conn: conn} do
      browsable()
      # The GitHub-identical URL works...
      {:ok, _view, _html} = live(conn, "/OpenAgentsInc/sarah")
      {:ok, _view, _html} = live(conn, "/OpenAgentsInc/openagents.com")
      # ...and no other account segment is even routed (no wildcard owner), so
      # a two-segment path that is not ours 404s without reaching a LiveView.
      assert conn |> get("/someoneelse/sarah") |> Map.fetch!(:status) == 404
      assert conn |> get("/someoneelse/demo") |> Map.fetch!(:status) == 404
      # The old /code/* shape is gone.
      assert conn |> get("/code/sarah") |> Map.fetch!(:status) == 404
      assert conn |> get("/code/demo") |> Map.fetch!(:status) == 404
    end

    test "a dark repo and an unknown repo 404 indistinguishably", %{conn: conn} do


  describe "/code/:repo/blob/:ref/*path" do
    test "renders markdown as HTML, not source", %{conn: conn} do
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/main/docs/audit.md")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/blob/main/docs/audit.md")

      assert html =~ @audit_heading
      refute html =~ "# #{@audit_heading}"

    end

    test "?plain=1 renders the raw markdown source", %{conn: conn} do
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/main/docs/audit.md?plain=1")
      {:ok, _view, html} =
        live(conn, "/OpenAgentsInc/openagents.com/blob/main/docs/audit.md?plain=1")

      assert html =~ "# #{@audit_heading}"
      assert html =~ ~s(class="code-source")

      short: short
    } do
      browsable()
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/#{short}/docs/audit.md")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/blob/#{short}/docs/audit.md")

      assert html =~ @audit_heading
      refute html =~ "# #{@audit_heading}"

      second: second
    } do
      # Head: served (it is on the allowlist).
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/main/docs/audit.md")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/blob/main/docs/audit.md")
      assert html =~ @audit_heading

      # The same path pinned to an older commit: 404. Publishing one document
      # must not publish every past revision of it.
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/sarah/blob/#{first}/docs/audit.md")
        live(conn, "/OpenAgentsInc/openagents.com/blob/#{first}/docs/audit.md")
      end

      # Pinning to the head sha itself is fine — it is the same content.
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/#{second}/docs/audit.md")
      {:ok, _view, html} =
        live(conn, "/OpenAgentsInc/openagents.com/blob/#{second}/docs/audit.md")

      assert html =~ @audit_heading
    end

    test "a path that is not on the published allowlist 404s below :l3", %{conn: conn} do
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/sarah/blob/main/README.md")
        live(conn, "/OpenAgentsInc/openagents.com/blob/main/README.md")
      end

      # …and is served once the repo is browsable.
      browsable()
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/blob/main/README.md")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/blob/main/README.md")
      assert html =~ "Fixture readme."
    end

    test "a missing path 404s", %{conn: conn} do
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/sarah/blob/main/missing.txt")
        live(conn, "/OpenAgentsInc/openagents.com/blob/main/missing.txt")
      end
    end

    test "a flag-shaped ref 404s without reaching git", %{conn: conn} do
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/sarah/blob/-evil/file.txt")
        live(conn, "/OpenAgentsInc/openagents.com/blob/-evil/file.txt")
      end
    end
  end

      conn: conn,
      short: short
    } do
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/commit/#{short}")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/commit/#{short}")

      assert html =~ "Add the transparency audit fixture"
      assert html =~ "Claude-Session"


    test "the diff is published once the repo is browsable", %{conn: conn, short: short} do
      browsable()
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/commit/#{short}")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/commit/#{short}")

      assert html =~ "diff --git"
      assert html =~ @audit_heading
    end

    test "a commit with no receipts says so honestly", %{conn: conn, short: short} do
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/sarah/commit/#{short}")
      {:ok, _view, html} = live(conn, "/OpenAgentsInc/openagents.com/commit/#{short}")

      assert html =~ "Not deployed through the forge lane"
      refute html =~ "push→live"

    } do
      insert_deploy!(second)

      {:ok, view, html} = live(conn, "/OpenAgentsInc/sarah/commit/#{short}")
      {:ok, view, html} = live(conn, "/OpenAgentsInc/openagents.com/commit/#{short}")

      refute html =~ "Not deployed through the forge lane"



    test "an unknown sha 404s", %{conn: conn} do
      assert_raise OpenAgentsWeb.PublicNotFoundError, fn ->
        live(conn, "/OpenAgentsInc/sarah/commit/deadbeefdead")
        live(conn, "/OpenAgentsInc/openagents.com/commit/deadbeefdead")
      end
    end
  end

defmodule OpenAgentsWeb.ComputersAccessTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Machines

               "tier" => "probe",
               "platform" => "linux-x64",
               "agent_version" => "0.4.0",
               "roots" => ["/home/sarah/work"]
               "roots" => ["/home/test/work"]
             })

    assert {:ok, machine} = Machines.approve_pairing(owner, pairing.code)

defmodule OpenAgentsWeb.ComputersLiveTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Computer

               "tier" => "curated",
               "platform" => "linux-x64",
               "agent_version" => "0.4.0",
               "roots" => ["/home/sarah/work"]
               "roots" => ["/home/test/work"]
             })

    pairing

defmodule OpenAgentsWeb.ComputersNavigationTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  test "the canonical Computers surface carries authenticated application chrome", %{conn: conn} do

defmodule OpenAgentsWeb.ComputersPairingErrorsTest do
  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Machines

               "tier" => "curated",
               "platform" => "linux-x64",
               "agent_version" => "0.4.0",
               "roots" => ["/home/sarah/work"]
               "roots" => ["/home/test/work"]
             })

    pairing

  end

  test "mounts with zeroed counts and an empty state", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")

    assert html =~ "No open issues"
    assert html =~ "Issues will show up here once they are created."
    refute has_element?(view, "#issues")

    # The default filter is `open`, and it is the one marked current.
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/issues?state=open"][aria-current]})
    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=open"][aria-current]}
           )

    refute has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/issues?state=closed"][aria-current]}
             ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=closed"][aria-current]}
           )

    assert has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/issues/new"]}, "New issue")
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/openagents.com/issues/new"]}, "New issue")
  end

  test "lists open issues with their number, author, labels, and assignees", %{conn: conn} do

        "assignees" => ["grace"]
      })

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")

    refute html =~ "No open issues"
    assert has_element?(view, "#issues")

    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/issues/#{issue.number}"]},
             ~s{a[href="/OpenAgentsInc/openagents.com/issues/#{issue.number}"]},
             "Streaming stalls"
           )


  test "an issue with no author falls back to anonymous", %{conn: conn} do
    {:ok, _} = Issues.create_issue(%{"title" => "Orphaned"})

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")

    assert html =~ "Orphaned"
    assert html =~ "anonymous"

  test "the comment count only renders once an issue has comments", %{conn: conn} do
    {:ok, issue} = Issues.create_issue(%{"title" => "Chatty"})

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")
    refute html =~ "hero-chat-bubble-left"

    {:ok, _} =

        user: %{"login" => "ada"}
      })

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")
    assert html =~ "hero-chat-bubble-left"
  end


    {:ok, closed} = Issues.create_issue(%{"title" => "Closed one"})
    {:ok, _} = Issues.update_issue(closed, %{"state" => "closed"})

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")
    assert html =~ "Open one"
    refute html =~ "Closed one"

    html =
      view
      |> element(~s{a[href="/OpenAgentsInc/sarah/issues?state=closed"]})
      |> element(~s{a[href="/OpenAgentsInc/openagents.com/issues?state=closed"]})
      |> render_click()

    assert html =~ "Closed one"


    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/issues?state=closed"][aria-current]}
             ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=closed"][aria-current]}
           )

    refute has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/issues?state=open"][aria-current]})
    refute has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=open"][aria-current]}
           )
  end

  test "the closed filter has its own empty-state wording", %{conn: conn} do
    {:ok, _open} = Issues.create_issue(%{"title" => "Open one"})

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues?state=closed")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues?state=closed")

    assert html =~ "No closed issues"
    refute html =~ "No open issues"

    {:ok, _} = Issues.update_issue(c, %{"state" => "closed"})

    for state <- ["open", "closed"] do
      {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues?state=#{state}")
      {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues?state=#{state}")

      assert has_element?(
               view,
               ~s{a[href="/OpenAgentsInc/sarah/issues?state=open"]},
               ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=open"]},
               "2 Open"
             )

      assert has_element?(
               view,
               ~s{a[href="/OpenAgentsInc/sarah/issues?state=closed"]},
               ~s{a[href="/OpenAgentsInc/openagents.com/issues?state=closed"]},
               "1 Closed"
             )
    end
  end

  test "an anonymous visitor is redirected away from the issue list" do
    assert {:error, {:redirect, %{to: to}}} = live(build_conn(), ~p"/OpenAgentsInc/sarah/issues")
    refute to == "/OpenAgentsInc/sarah/issues"
    assert {:error, {:redirect, %{to: to}}} =
             live(build_conn(), ~p"/OpenAgentsInc/openagents.com/issues")

    refute to == "/OpenAgentsInc/openagents.com/issues"
  end
end

  end

  test "mounts with an empty form and a cancel link back to the list", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    assert html =~ "New issue"
    assert has_element?(view, "#new-issue-form")
    assert has_element?(view, "#issue_title")
    assert has_element?(view, "#issue_body")
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/issues"]}, "Cancel")
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/openagents.com/issues"]}, "Cancel")
  end

  test "the milestone and label selects offer the seeded records", %{conn: conn} do
    milestone = milestone_fixture(%{title: "v1.0", due_on: nil})
    label_fixture(%{name: "bug", color: "d73a4a"})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    assert has_element?(view, ~s{#issue_milestone option[value="#{milestone.number}"]}, "v1.0")
    assert has_element?(view, ~s{#issue_labels option[value="bug"]}, "bug")

  end

  test "with no milestones or labels the selects render only the prompt", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    assert has_element?(view, "#issue_milestone")
    refute has_element?(view, ~s{#issue_labels option})
  end

  test "submitting a title creates the issue and navigates to it", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    result =
      view

    assert issue.body == "Please"

    {:ok, _show, html} =
      follow_redirect(result, conn, ~p"/OpenAgentsInc/sarah/issues/#{issue.number}")
      follow_redirect(result, conn, ~p"/OpenAgentsInc/openagents.com/issues/#{issue.number}")

    assert html =~ "Issue created"
    assert html =~ "Add a runbook"

    milestone = milestone_fixture(%{title: "v1.0", due_on: nil})
    label_fixture(%{name: "bug", color: "d73a4a"})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    assert {:error, {:live_redirect, _}} =
             view

  test "an empty label and milestone selection leaves the issue bare", %{conn: conn} do
    label_fixture(%{name: "bug", color: "d73a4a"})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    assert {:error, {:live_redirect, _}} =
             view

  end

  test "a blank title re-renders the form with an error and creates nothing", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/issues/new")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues/new")

    html =
      view

    issue
  end

  defp path(issue), do: ~p"/OpenAgentsInc/sarah/issues/#{issue.number}"
  defp path(issue), do: ~p"/OpenAgentsInc/openagents.com/issues/#{issue.number}"

  test "mounts and renders the title, number, state, and body", %{conn: conn} do
    issue =

    assert html =~ "bug"
    assert html =~ "Assignees"
    assert has_element?(view, ~s{[title="grace"]})
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/milestones"]}, "v1.0")
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/openagents.com/milestones"]}, "v1.0")
  end

  test "a missing issue number raises rather than rendering an empty page", %{conn: conn} do
    assert_raise Ecto.NoResultsError, fn ->
      live(conn, ~p"/OpenAgentsInc/sarah/issues/9999")
      live(conn, ~p"/OpenAgentsInc/openagents.com/issues/9999")
    end
  end


    issue = issue!(%{"title" => "Private"})

    assert {:error, {:redirect, %{to: to}}} = live(build_conn(), path(issue))
    refute to == "/OpenAgentsInc/sarah/issues/#{issue.number}"
    refute to == "/OpenAgentsInc/openagents.com/issues/#{issue.number}"
  end
end

  end

  test "mounts with the create form and an empty state", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/labels")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/labels")

    assert html =~ "Labels"
    assert has_element?(view, "#new-label-form")

    label_fixture(%{name: "bug", color: "d73a4a", description: "Something is broken"})
    label_fixture(%{name: "docs", color: "0075ca", description: nil})

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/labels")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/labels")

    refute html =~ "No labels yet"
    assert has_element?(view, "#labels")

  end

  test "submitting the form creates a label and re-renders the table", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/labels")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/labels")

    html =
      view

  end

  test "a label missing its required color re-renders the form with an error", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/labels")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/labels")

    html =
      view

  test "deleting a label removes it and returns the empty state", %{conn: conn} do
    label = label_fixture(%{name: "wontfix", color: "ffffff"})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/labels")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/labels")
    assert has_element?(view, "#labels td", "wontfix")

    html =

  carry anything past the published projection.
  """

  use OpenAgentsWeb.SarahConnCase, async: false
  use OpenAgentsWeb.ConnCase, async: false
  import Phoenix.LiveViewTest

  alias OpenAgents.Accounts

  end

  test "mounts with the create form and an empty state", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    assert html =~ "Milestones"
    assert has_element?(view, "#new-milestone-form")

  test "lists seeded milestones with their state and due date", %{conn: conn} do
    milestone_fixture(%{title: "v1.0", state: "open", due_on: "2026-12-31", description: "Ship"})

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    refute html =~ "No milestones yet"
    assert html =~ "v1.0"

    {:ok, done_issue} = Issues.set_milestone(done_issue, milestone.number)
    {:ok, _} = Issues.update_issue(done_issue, %{"state" => "closed"})

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    assert has_element?(
             view,

  test "a milestone with no issues reports zero progress", %{conn: conn} do
    milestone_fixture(%{title: "Empty", due_on: nil})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    assert has_element?(
             view,

  end

  test "submitting the form creates a milestone", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    html =
      view

  end

  test "a milestone with no title re-renders the form with an error", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    html =
      view

  test "closing a milestone flips its state and hides the close button", %{conn: conn} do
    milestone = milestone_fixture(%{title: "Closeable", state: "open", due_on: nil})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")
    assert has_element?(view, ~s{button[phx-click="close"][phx-value-id="#{milestone.id}"]})

    html =

  test "deleting a milestone returns the empty state", %{conn: conn} do
    milestone = milestone_fixture(%{title: "Deletable", due_on: nil})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/milestones")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/milestones")

    html =
      view

defmodule OpenAgentsWeb.NetworkStatusLiveTest do
  use OpenAgentsWeb.SarahConnCase
  use OpenAgentsWeb.ConnCase
  import Phoenix.LiveViewTest

  test "renders publicly for an anonymous browser visitor", %{conn: conn} do

       %{conn: conn} do
    response = conn |> get(~p"/api/status") |> json_response(200)

    assert response["schema"] == "sarah.network_status.v1"
    assert response["schema"] == "openagents.network_status.v1"
    assert response["status"] in ["ok", "degraded"]
    assert is_binary(response["revision"])
    assert is_list(response["nodes"])

  defp seed_target(status, opts \\ []) do
    %Target{}
    |> Target.changeset(%{
      repo: "sarah",
      repo: "openagents.com",
      sha: Keyword.get(opts, :sha, String.duplicate("c", 40)),
      promoted_by: Keyword.get(opts, :promoted_by, "operator:31337"),
      status: status

        OpenAgents.PubSub,
        "forge:target",
        {:forge_target_status,
         %{repo: "sarah", sha: target.sha, target_id: target.id, status: "building"}}
         %{repo: "openagents.com", sha: target.sha, target_id: target.id, status: "building"}}
      )

      html = render(view)

      Phoenix.PubSub.broadcast(
        OpenAgents.PubSub,
        "forge:deploys",
        {:forge_deploy, %{repo: "sarah", sha: target.sha, result: "live"}}
        {:forge_deploy, %{repo: "openagents.com", sha: target.sha, result: "live"}}
      )

      assert render(view) =~ "hot deploy #{String.duplicate("c", 12)}: live"


      %DeployReceipt{}
      |> DeployReceipt.changeset(%{
        repo: "sarah",
        repo: "openagents.com",
        sha: target.sha,
        target_id: target.id,
        modules: ["Elixir.OpenAgents.HiddenModuleName"],

  end

  test "mounts with the create form and an empty state", %{conn: conn} do
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    assert html =~ "Projects"
    assert has_element?(view, "#new-project-form")

  test "lists projects owned by the URL owner and links to each board", %{conn: conn} do
    project = project_fixture(%{title: "Roadmap", owner: "OpenAgentsInc", state: "open"})

    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    refute html =~ "No projects yet"
    assert html =~ "Roadmap"

    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/projects/#{project.number}"]},
             ~s{a[href="/OpenAgentsInc/openagents.com/projects/#{project.number}"]},
             "Roadmap"
           )

    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/projects/#{project.number}"]},
             ~s{a[href="/OpenAgentsInc/openagents.com/projects/#{project.number}"]},
             "View"
           )
  end

  test "a project owned by someone else is filtered out", %{conn: conn} do
    project_fixture(%{title: "Someone elses", owner: "other-org"})

    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, _view, html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    refute html =~ "Someone elses"
    assert html =~ "No projects yet"
  end

  test "submitting the form creates a project owned by the URL owner", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    html =
      view

  end

  test "a project with no title re-renders the form with an error", %{conn: conn} do
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    html =
      view

  test "deleting a project returns the empty state", %{conn: conn} do
    project = project_fixture(%{title: "Doomed", owner: "OpenAgentsInc"})

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/sarah/projects")
    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/projects")

    html =
      view


  defp project!, do: project_fixture(%{title: "Roadmap", owner: "OpenAgentsInc"})

  defp path(project), do: ~p"/OpenAgentsInc/sarah/projects/#{project.number}"
  defp path(project), do: ~p"/OpenAgentsInc/openagents.com/projects/#{project.number}"

  test "mounts and renders every board column plus the add form", %{conn: conn} do
    project = project!()

    assert html =~ "In Progress"
    assert html =~ "Done"
    assert has_element?(view, "#new-project-item-form")
    assert has_element?(view, ~s{a[href="/OpenAgentsInc/sarah/projects"]}, "Back to projects")

    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/openagents.com/projects"]},
             "Back to projects"
           )
  end

  test "an empty board renders the columns with no cards", %{conn: conn} do


    {:ok, view, _html} = live(conn, path(project))

    refute has_element?(view, ~s{a[href^="/OpenAgentsInc/sarah/issues/"]})
    refute has_element?(view, ~s{a[href^="/OpenAgentsInc/openagents.com/issues/"]})
    # With no issues in the repo the issue select carries only its prompt.
    refute has_element?(view, ~s{#item_issue_number option:not([value=""])})
  end


    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/issues/#{issue.number}"]},
             ~s{a[href="/OpenAgentsInc/openagents.com/issues/#{issue.number}"]},
             "Fix the parser"
           )
  end


    assert has_element?(
             view,
             ~s{a[href="/OpenAgentsInc/sarah/issues/#{issue.number}"]},
             ~s{a[href="/OpenAgentsInc/openagents.com/issues/#{issue.number}"]},
             "Ship the runbook"
           )


    # Cards are grouped by column; the "Done" column is the third section.
    assert has_element?(
             view,
             ~s{section:nth-of-type(3) a[href="/OpenAgentsInc/sarah/issues/#{issue.number}"]},
             ~s{section:nth-of-type(3) a[href="/OpenAgentsInc/openagents.com/issues/#{issue.number}"]},
             "Fixture-placed"
           )

    refute has_element?(
             view,
             ~s{section:nth-of-type(1) a[href="/OpenAgentsInc/sarah/issues/#{issue.number}"]}
             ~s{section:nth-of-type(1) a[href="/OpenAgentsInc/openagents.com/issues/#{issue.number}"]}
           )
  end

  test "a missing project number raises rather than rendering an empty board", %{conn: conn} do
    assert_raise Ecto.NoResultsError, fn ->
      live(conn, ~p"/OpenAgentsInc/sarah/projects/9999")
      live(conn, ~p"/OpenAgentsInc/openagents.com/projects/9999")
    end
  end
end

defmodule OpenAgentsWeb.UIGalleryLiveTest do
  @moduledoc """
  The gallery is routed only under `:dev_routes`, so it is mounted in isolation
  here. Rendering it exercises every `OpenAgentsWeb.SarahUI` component in every variant
  here. Rendering it exercises every `OpenAgentsWeb.UI` component in every variant
  and state at once, which catches a primitive that unit tests render in
  isolation but that breaks inside a real LiveView.
  """

  use OpenAgentsWeb.SarahConnCase, async: true
  use OpenAgentsWeb.ConnCase, async: true
  import Phoenix.LiveViewTest

  test "renders every component variant without raising", %{conn: conn} do

    test "github_repo_read is read repository/path" do
      step =
        activity("github_repo_read", %{
          "repository" => "OpenAgentsInc/sarah",
          "repository" => "OpenAgentsInc/openagents.com",
          "path" => "DESIGN.md",
          "ref" => "main"
        })

      assert ToolActivity.title(step) == "read OpenAgentsInc/sarah/DESIGN.md"
      assert ToolActivity.title(step) == "read OpenAgentsInc/openagents.com/DESIGN.md"
    end

    test "conversation_search is search with the quoted query" do

defmodule OpenAgentsWeb.UITest do
  @moduledoc """
  Contract tests for Sarah's interface primitives.
  Contract tests for OpenAgents interface primitives.

  These assert the rules `DESIGN.md` and `INVARIANTS.md` place on the component
  library itself, so a surface cannot inherit a violation from a primitive.

  import ExUnit.CaptureIO
  import Phoenix.Component
  import Phoenix.LiveViewTest
  import OpenAgentsWeb.SarahUI
  import OpenAgentsWeb.UI

  describe "button/1" do
    test "defaults to a primary control and omits unset variant attributes" do

          Code.compile_string("""
          defmodule OpenAgentsWeb.UITest.IconSize do
            use Phoenix.Component
            import OpenAgentsWeb.SarahUI
            import OpenAgentsWeb.UI

            def render(assigns), do: ~H"<.button size={:icon}>X</.button>"
          end

          Code.compile_string("""
          defmodule OpenAgentsWeb.UITest.BogusVariant do
            use Phoenix.Component
            import OpenAgentsWeb.SarahUI
            import OpenAgentsWeb.UI

            def render(assigns), do: ~H"<.button variant={:bogus}>X</.button>"
          end

      # and recall content must never reach the browser. The component's
      # signature is the enforcement point.
      declared =
        OpenAgentsWeb.SarahUI.__components__()
        OpenAgentsWeb.UI.__components__()
        |> Map.fetch!(:item)
        |> Map.fetch!(:attrs)
        |> Enum.map(& &1.name)


    test "requires a name, because a page of recordings is a page of identical players" do
      declared =
        OpenAgentsWeb.SarahUI.__components__()
        OpenAgentsWeb.UI.__components__()
        |> Map.fetch!(:audio_player)
        |> Map.fetch!(:attrs)


  describe "status_indicator/1" do
    test "requires a label so color never carries state alone" do
      declared =
        OpenAgentsWeb.SarahUI.__components__()
        OpenAgentsWeb.UI.__components__()
        |> Map.fetch!(:status_indicator)
        |> Map.fetch!(:attrs)


defmodule OpenAgentsWeb.SarahChannelCase do
defmodule OpenAgentsWeb.ChannelCase do
  @moduledoc """
  Sarah-specific channel case used by the lifted Sarah channel tests.
  Shared channel case for authenticated OpenAgents channel tests.
  """

  use ExUnit.CaseTemplate

      use OpenAgentsWeb, :verified_routes

      import Phoenix.ChannelTest
      import OpenAgentsWeb.SarahConnCase, only: [github_user: 1]
      import OpenAgentsWeb.SarahChannelCase
      import OpenAgentsWeb.ConnCase, only: [github_user: 1]
      import OpenAgentsWeb.ChannelCase
    end
  end


defmodule OpenAgentsWeb.SarahConnCase do
  @moduledoc """
  Sarah-specific connection case used by the lifted Sarah web tests.
  """

  use ExUnit.CaseTemplate

  using do
    quote do
      @endpoint OpenAgentsWeb.Endpoint

      use OpenAgentsWeb, :verified_routes

      import Plug.Conn
      import Phoenix.ConnTest
      import OpenAgentsWeb.SarahConnCase
    end
  end

  setup tags do
    OpenAgents.DataCase.setup_sandbox(tags)
    {:ok, conn: Phoenix.ConnTest.build_conn()}
  end

  def github_user(key) when is_binary(key) do
    digest = :crypto.hash(:sha256, key)
    github_id = digest |> binary_part(0, 7) |> :binary.decode_unsigned()
    login_suffix = digest |> Base.encode16(case: :lower) |> binary_part(0, 12)

    {:ok, user} =
      OpenAgents.Accounts.upsert_github_user(%{
        github_id: github_id,
        github_login: "test-#{login_suffix}",
        github_avatar_url: "https://avatars.githubusercontent.com/u/#{github_id}?v=4"
      })

    user
  end

  def log_in_github_user(conn, key) when is_binary(key) do
    user = github_user(key)
    Plug.Test.init_test_session(conn, %{"user_id" => user.id})
  end

  def log_in_admin_user(conn, key) when is_binary(key) do
    user = github_user(key)
    grant_operator(user)
    Plug.Test.init_test_session(conn, %{"user_id" => user.id})
  end

  def grant_operator(%OpenAgents.Accounts.User{github_id: github_id}) do
    original = Application.get_env(:openagents, :admin_github_ids, [])
    Application.put_env(:openagents, :admin_github_ids, [github_id | original])

    ExUnit.Callbacks.on_exit(fn ->
      Application.put_env(:openagents, :admin_github_ids, original)
    end)

    :ok
  end

  def revoke_operator do
    Application.put_env(:openagents, :admin_github_ids, [])
    :ok
  end
end

defmodule OpenAgents.SarahDataCase do
  @moduledoc """
  Sarah-specific data case used by the lifted Sarah test suite.
  """

  use ExUnit.CaseTemplate

  using do
    quote do
      alias OpenAgents.Repo

      import Ecto
      import Ecto.Changeset
      import Ecto.Query
      import OpenAgents.DataCase
    end
  end

  setup tags do
    OpenAgents.DataCase.setup_sandbox(tags)
    :ok
  end
end

defmodule OpenAgents.SarahFactory do
  @moduledoc """
  Stub factory used by the lifted Sarah test suite.
  """
end

defmodule OpenAgents.SarahFixtures do
  @moduledoc """
  Stub fixtures used by the lifted Sarah test suite.
  """
end

      required_authority: "conversation.read",
      executor: %{id: "sarah.local.recall", disclosure: "Sarah local conversation recall"},
      maintainer: "OpenAgents",
      attribution: ["OpenAgentsInc/sarah"],
      attribution: ["OpenAgentsInc/openagents.com"],
      policy_facets: %{"privacy" => "browser_scoped"},
      module_metadata:
        Metadata.first_party("conversation.read", "browser_conversation",

1	1		`/* See the Tailwind configuration guide for advanced usage`
2	2		`https://tailwindcss.com/docs/configuration */`
3	3
4		-	`/* There is exactly one component system here: Basecoat structure plus Sarah's`
	4	+	`/* There is exactly one component system here: Basecoat structure plus OpenAgents`
5	5		`* style pack. DaisyUI was removed (see AGENTS.md) — it emitted flat component`
6	6		* rules from its own cascade layer that outranked every `.btn[data-variant=…]`
7		-	`* in sarah.css, so all eight SarahUI button variants rendered identically. Do`
	7	+	`* in openagents.css, so all eight UI button variants rendered identically. Do`
8	8		`* not reintroduce it, and do not add a second component library beside it.`
9	9		`*`
10	10		`* With DaisyUI gone the layer order Tailwind itself declares`

135	135		`* are still spoken by surfaces this change did not restyle (the component`
136	136		`* catalog, the marketing home template, and the sidebar/docs/chat CSS at the`
137	137		`* foot of this file). They are kept as aliases onto the three surface rungs so`
138		-	`* that vocabulary keeps resolving; they are now names for Sarah tokens, not a`
	138	+	`* that vocabulary keeps resolving; they are now names for OpenAgents tokens, not a`
139	139		* second palette. Prefer Basecoat's own `background` / `card` / `foreground` /
140	140		* `border` names in new markup.
141	141		`*`
142		-	`* The semantic four are Sarah's, not DaisyUI's, and have no Basecoat`
	142	+	`* The semantic four are OpenAgents, not DaisyUI's, and have no Basecoat`
143	143		* equivalent — `--color-destructive` covers danger, but there is no success,
144	144		`* warning, or info in the Basecoat base. */`
145	145		`@theme {`

167	167
168	168		`/* This file is for your main application CSS */`
169	169
170		-	`/* ── Sidebar (Sarah-style layout with OpenAgents color tokens) ───────────── */`
	170	+	`/* ── Sidebar (OpenAgents layout with OpenAgents color tokens) ───────────── */`
171	171		`.sidebar {`
172	172		`display: flex;`
173	173		`min-height: 0;`

396	396		`padding: 32px;`
397	397		`}`
398	398
399		-	`/* Chat UI (Sarah-style) */`
	399	+	`/* Chat UI (OpenAgents) */`
400	400
401	401		`.chat-transcript {`
402	402		`display: flex;`

1	1		`/*`
2		-	`* Sarah style pack`
	2	+	`* OpenAgents style pack`
3	3		`*`
4	4		`* Basecoat ships structure (assets/vendor/basecoat/components/*.css: layout,`
5	5		`* accessibility selectors, behavior hooks - no color, no radius) separately`
6	6		`* from visual style packs. We import the structure and write this pack instead`
7		-	`* of adopting Vega or any other shadcn pack, so Sarah's identity is a`
	7	+	`* of adopting Vega or any other shadcn pack, so OpenAgents identity is a`
8	8		`* first-class artifact rather than a diff against another product's defaults.`
9	9		`*`
10	10		`* This file is imported last. Every rule here must be traceable to DESIGN.md.`

42	42
43	43		- Always use and maintain this import syntax in the app.css file for projects generated with `phx.new`
44	44		- Never use `@apply` when writing raw css
45		-	- There is exactly one component system: vendored Basecoat plus Sarah's style pack. Basecoat lives in `assets/vendor/basecoat/components/` and carries structure (display, padding, min-height); `assets/css/sarah.css` carries OpenAgents' identity (motion tokens, radius scale, colour, the notched variant, corner frames) and must stay the last import so its declarations win.
46		-	- Reach for `OpenAgentsWeb.SarahUI` first. It wraps that CSS in nineteen ready primitives — `button/1`, `card/1`, `badge/1`, `alert/1`, `input/1`, `textarea/1`, `label/1`, `field/1`, `avatar/1`, `menu/1`, `empty/1`, `kbd/1`, and the rest. Fall back to hand-written classes only when no primitive covers the shape.
	45	+	- There is exactly one component system: vendored Basecoat plus OpenAgents style pack. Basecoat lives in `assets/vendor/basecoat/components/` and carries structure (display, padding, min-height); `assets/css/openagents.css` carries OpenAgents' identity (motion tokens, radius scale, colour, the notched variant, corner frames) and must stay the last import so its declarations win.
	46	+	- Reach for `OpenAgentsWeb.UI` first. It wraps that CSS in nineteen ready primitives — `button/1`, `card/1`, `badge/1`, `alert/1`, `input/1`, `textarea/1`, `label/1`, `field/1`, `avatar/1`, `menu/1`, `empty/1`, `kbd/1`, and the rest. Fall back to hand-written classes only when no primitive covers the shape.
47	47		- Variants are data attributes, not classes. A control is `class="btn"` plus `data-variant="primary"` / `data-size="sm"` / `data-tone="danger"`. Never invent `btn-primary`-style variant classes; they defeat the whole point of the split.
48		-	- Never add a second component library — DaisyUI above all. DaisyUI was removed deliberately. It emitted flat `.btn` rules (setting background, colour, border) from a cascade layer that outranked every `.btn[data-variant=…]` in `sarah.css`, so all eight SarahUI button variants rendered identically on staging. Any library with the same shape will do the same thing again.
	48	+	- Never add a second component library — DaisyUI above all. DaisyUI was removed deliberately. It emitted flat `.btn` rules (setting background, colour, border) from a cascade layer that outranked every `.btn[data-variant=…]` in `openagents.css`, so all eight UI button variants rendered identically on staging. Any library with the same shape will do the same thing again.
49	49		- Import Basecoat components individually, one `@import "../vendor/basecoat/components/<name>.css"` per component a surface actually uses. Component CSS lands in `@layer components` and ships whether or not the class appears in markup, so the list is a budget. Never import `basecoat.css`, `basecoat-base.css`, or `basecoat-components.css` — each pulls in all 39 components at once.
50	50		- The palette is the token ladder at the top of `app.css` (`--ink-void` / `--ink-surface` / `--ink-raised`, the text and line tiers, and the four semantic colours). It is dark-only. Prefer the Basecoat utility names built on it — `bg-background`, `bg-card`, `text-foreground`, `text-muted-foreground`, `border-border` — over the older `base-100`/`base-content` aliases, which are kept only so unconverted surfaces keep resolving.
51	51		`- Add custom Tailwind only when the design is unique to OpenAgents and no primitive fits.`

20	20		`* basecoat-components.css. See assets/vendor/basecoat/README.md.`
21	21		`*`
22	22		`* These carry the structure (display, padding, min-height, background) that`
23		-	`* sarah.css deliberately does not set — its .btn only adds gap, border,`
	23	+	`* openagents.css deliberately does not set — its .btn only adds gap, border,`
24	24		`* radius, colour, font, and transition on top. With DaisyUI gone they are the`
25	25		`* only source of that geometry, so nothing here is optional. This list is`
26		-	* Sarah's, plus `table` for `CoreComponents.table/1`. */
	26	+	* OpenAgents, plus `table` for `CoreComponents.table/1`. */
27	27		`@import "../vendor/basecoat/base/base.css";`
28	28		`@import "../vendor/basecoat/components/button.css";`
29	29		`@import "../vendor/basecoat/components/input.css";`

40	40		`@import "../vendor/basecoat/components/kbd.css";`
41	41		`@import "../vendor/basecoat/components/table.css";`
42	42
43		-	`/* Sarah's identity. Must stay last so its declarations win. */`
44		-	`@import "./sarah.css";`
	43	+	`/* OpenAgents identity. Must stay last so its declarations win. */`
	44	+	`@import "./openagents.css";`
45	45		`@source "../css";`
46	46		`@source "../js";`
47	47		`@source "../../lib/openagents_web";`

53	53		`@plugin "../vendor/heroicons";`
54	54
55	55		`/* ── Token ladder ───────────────────────────────────────────────────────────`
56		-	`* Ported from Sarah, where these are the two tiers of DESIGN.md "Color`
	56	+	`* Integrated into OpenAgents, where these are the two tiers of DESIGN.md "Color`
57	57		`* Tokens": PRIMITIVES are the hand-picked Aiur oklch values; DERIVATIONS are`
58	58		`* color-mix() steps off one ink, so the hover/focus/border grammar is`
59	59		`* systematic rather than accumulated.`
60	60		`*`
61		-	`* sarah.css consumes these but does not define them — it aliases them onto`
	61	+	`* openagents.css consumes these but does not define them — it aliases them onto`
62	62		* the Basecoat names (`--background`, `--card`, `--primary`, `--border`, …)
63	63		* in its own `:root`. Before this block existed those aliases resolved to
64	64		`* nothing and the DaisyUI theme was carrying the palette instead, which is`
65		-	`* exactly the collision that made every SarahUI variant render identically.`
	65	+	`* exactly the collision that made every UI variant render identically.`
66	66		`*`
67	67		`* The three surfaces are a fixed relationship, not three loose colors: page`
68	68		`* and sidebar sit on the darkest (--ink-void), the working canvas one step up`
69	69		`* (--ink-surface), elevated components another step up (--ink-raised). New`
70	70		`* surfaces take a rung; they do not invent a fourth.`
71	71		`*`
72		-	* The palette is dark-only, as Sarah's is (`color-scheme: dark`). The
	72	+	* The palette is dark-only, as OpenAgents is (`color-scheme: dark`). The
73	73		* `data-theme` plumbing in root.html.heex still runs, but there is no second
74		-	`* light palette behind it any more — DaisyUI's was the only one, and Sarah`
	74	+	`* light palette behind it any more — DaisyUI's was the only one, and OpenAgents`
75	75		`* ships no light variant to replace it with.`
76	76		`*/`
77	77		`:root {`

108	108		`}`
109	109
110	110		`/* ── Token layer ───────────────────────────────────────────────────────────`
111		-	`* Sarah's Aiur tokens (declared in app.css) are the authored source of truth.`
	111	+	`* OpenAgents Aiur tokens (declared in app.css) are the authored source of truth.`
112	112		`* Basecoat's shadcn-compatible names are derived from them so both vocabularies`
113	113		`* resolve to one palette. DESIGN.md's token table stays the readable contract.`
114	114		`*/`

182	182
183	183		`/* ── Surface recipes ───────────────────────────────────────────────────────`
184	184		`* Shared mechanics that later phases compose by name. Each is a pattern with`
185		-	`* one utility class, not a component: components stay in SarahWeb.UI.`
	185	+	`* one utility class, not a component: components stay in OpenAgentsWeb.UI.`
186	186		`*/`
187	187
188	188		`@layer components {`

792	792		`inset: 3px;`
793	793		`}`
794	794
795		-	`/* Link buttons are Sarah's inline action: underlined text, not a boxed`
	795	+	`/* Link buttons are OpenAgents inline action: underlined text, not a boxed`
796	796		`control. Size tokens must not apply. */`
797	797		`.btn[data-variant="link"] {`
798	798		`min-height: 0;`

1229	1229		`@layer components {`
1230	1230		`/* One durable event as a disclosure row: chevron, status dot, quiet 13px`
1231	1231		`one-line title, optional short status note in text, hover-revealed`
1232		-	`timestamp. Devin's event-header primitive over Sarah's tokens; the`
	1232	+	`timestamp. Devin's event-header primitive over OpenAgents tokens; the`
1233	1233		`expansion carries the bounded durable details. */`
1234	1234		`.event-header {`
1235	1235		`min-width: 0;`

1509	1509		`/* ── Status indicator ─────────────────────────────────────────────────────── */`
1510	1510
1511	1511		`@layer components {`
1512		-	`/* Sarah's semantic state marker: a small lit dot that reinforces a text`
	1512	+	`/* OpenAgents semantic state marker: a small lit dot that reinforces a text`
1513	1513		`label and never replaces it. Reserved meanings: green completed and`
1514	1514		`connected, blue active and streaming, gold required attention, red`
1515	1515		`failed. The halo is the state made legible at a glance, not decoration. */`

1524	1524		`}`
1525	1525
1526	1526		`/* "ended", "live", and "attention" are the sidebar status rows' lifecycle`
1527		-	`vocabulary (DESIGN.md, Sarah shell): an ordinarily ended call is a muted`
	1527	+	`vocabulary (DESIGN.md, OpenAgents shell): an ordinarily ended call is a muted`
1528	1528		`fact, a live call is blue activity, and budget/interrupted outcomes ask`
1529	1529		`for gold attention. Each joins the existing hue group; no new color. */`
1530	1530		`.status-indicator[data-state="idle"],`

80	80
81	81		`const call = new CallRecorder({`
82	82		`microphone: "mic-stream",`
83		-	`remoteStream: "sarah-stream",`
	83	+	`remoteStream: "remote-stream",`
84	84		`generation: "3",`
85	85		`timesliceMs: 5000,`
86	86		`mimeType: "audio/webm;codecs=opus",`

147	147		`forge_boot_converge_enabled: false,`
148	148		`forge_deploy_lane_enabled: true,`
149	149		`forge_data_dir: nil,`
150		-	`forge_build_dir: "/var/lib/sarah/workspace/build",`
151		-	`forge_repos: ["sarah"],`
	150	+	`forge_build_dir: "/var/lib/openagents/workspace/build",`
	151	+	`forge_repos: ["openagents.com"],`
152	152		`forge_internal_git_url: "http://127.0.0.1:8080/git",`
153	153		`forge_operator_token: nil,`
154	154		`forge_mirror_urls: %{},`

168	168		`"OpenAgents.Scratch.",`
169	169		`"OpenAgents.BuildInfo"`
170	170		`],`
171		-	`forge_public_visibility: %{"sarah" => :l2},`
172		-	`forge_repo_owners: %{"sarah" => "OpenAgentsInc"},`
173		-	`forge_public_paths: %{`
174		-	`"sarah" => [`
175		-	`"README.md",`
176		-	`"CHANGELOG.md",`
177		-	`"docs/audits/2026-08-19-public-changelog-transparency-audit.md",`
178		-	`"docs/plans/2026-08-19-transparency-spec-and-roadmap.md"`
179		-	`]`
180		-	`},`
	171	+	`forge_public_visibility: %{"openagents.com" => :l3},`
	172	+	`forge_repo_owners: %{"openagents.com" => "OpenAgentsInc"},`
	173	+	`forge_public_paths: %{"openagents.com" => []},`
181	174		`dns_cluster_query: nil`
182	175
183	176		`# Configure the endpoint`

62	62		# `OpenAgents.Forge.HotLoader` themselves.
63	63		`config :openagents,`
64	64		`forge_enabled: true,`
65		-	`forge_repos: ["sarah", "demo"],`
	65	+	`forge_repos: ["openagents.com", "demo"],`
66	66		`forge_operator_token: "forge_test_operator_token_0123456789",`
67	67		`forge_deploy_lane_enabled: false,`
68		-	`forge_repo_owners: %{"sarah" => "OpenAgentsInc", "demo" => "OpenAgentsInc"}`
	68	+	`forge_repo_owners: %{"openagents.com" => "OpenAgentsInc", "demo" => "OpenAgentsInc"}`
69	69
70	70		`config :openagents, :migrate_on_boot, false`
71	71		`config :openagents, :ra_enabled, false`

1596	1596		`@layer components {`
1597	1597		`/* Native controls, deliberately: the browser's transport is already keyboard`
1598	1598		`* operable and already announced, and a hand-rolled one would have to re-earn`
1599		-	`* both. Only the box the transport sits in is Sarah's. */`
	1599	+	`* both. Only the box the transport sits in is OpenAgents. */`
1600	1600		`.audio-player {`
1601	1601		`display: block;`
1602	1602		`width: 100%;`

1615	1615		`/* ── Popover / menu ───────────────────────────────────────────────────────── */`
1616	1616
1617	1617		`@layer components {`
1618		-	/* Sarah keeps the native `popover` API: no Basecoat JavaScript, and the
	1618	+	/* OpenAgents keeps the native `popover` API: no Basecoat JavaScript, and the
1619	1619		`* control works without client-side script.`
1620	1620		`*`
1621	1621		* Basecoat's own popover CSS is deliberately not imported. There, `.popover`

19	19		`Deliberately not vendored:`
20	20
21	21		- `src/css/styles/*` — the Vega/Nova/Maia/Lyra/Mira/Luma/Sera/Rhea visual packs.
22		-	Sarah writes its own pack at `assets/css/style-sarah.css`. Importing one of
	22	+	OpenAgents writes its own pack at `assets/css/openagents.css`. Importing one of
23	23		`theirs and overriding it would leave dead visual rules in the bundle and make`
24		-	`Sarah's identity a diff against another product's defaults.`
25		-	- `src/js/*` — no Basecoat JavaScript is loaded. The only component Sarah's
	24	+	`OpenAgents identity a diff against another product's defaults.`
	25	+	- `src/js/*` — no Basecoat JavaScript is loaded. The only component OpenAgents
26	26		surfaces would need it for is `dropdown-menu`, and the account menu uses the
27	27		native `popover` API instead, which is required to work without custom
28	28		`client-side JavaScript. Taking zero Basecoat JS also removes the LiveView`

34	34		`assets/css/app.css` imports `base/base.css` plus individually named
35	35		component files. Component CSS lives in `@layer components` and is emitted
36	36		`whether or not the class appears in markup, so importing the full set costs`
37		-	`about 13.5 KB gzip against about 7.4 KB for the components Sarah actually uses.`
	37	+	`about 13.5 KB gzip against about 7.4 KB for the components OpenAgents actually uses.`
38	38		Never import `basecoat.css`, `basecoat-base.css`, or `basecoat-components.css`.
39	39
40	40		`Adding an import is a deliberate act tied to a surface that needs it.`

1050	1086		`## Final staging readiness checklist`
1051	1087
1052	1088		`- [x] The repository has one accurate architecture narrative.`
1053		-	`- [ ] Every remaining Sarah reference is intentional and specific.`
	1089	+	`- [x] Every remaining Sarah reference is intentional and specific.`
1054	1090		`- [ ] All documentation links and invariant evidence resolve.`
1055	1091		`- [ ] The application has one Markdown parser, component system, and documented`
1056	1092		`two-tier icon policy.`

19	19		`voice copy.`
20	20
21	21		`Use OpenAgents names for generic supervisors, web helpers, style packs,`
22		-	`runtime paths, build services, test cases, and configuration. Gate 2 performs`
23		-	`that semantic rename and adds an allowlist for intentional references.`
	22	+	`runtime paths, build services, test cases, and configuration. Gate 2 completed`
	23	+	`that semantic rename and added an executable allowlist for intentional`
	24	+	`references.`
24	25
25	26		`## Consequences`
26	27

18	18		`module and use those components before adding surface-specific markup.`
19	19
20	20		`Do not add DaisyUI, another component library, remote fonts, icon fonts, or a`
21		-	second Markdown presentation stack. Rename the generic `SarahUI` module and
22		-	`style pack during Gate 2 without changing Sarah-specific visual copy.`
	21	+	`second Markdown presentation stack. The generic component module is`
	22	+	`OpenAgentsWeb.UI`, and the product style pack is `assets/css/openagents.css`.
	23	+	`Keep Sarah-specific visual copy only where it identifies the persona.`
23	24
24	25		`## Consequences`
25	26

30	30		`OpenAgents.Repo,`
31	31		`{DNSCluster, query: Application.get_env(:openagents, :dns_cluster_query) \|\| :ignore},`
32	32		`{Phoenix.PubSub, name: OpenAgents.PubSub},`
33		-	`OpenAgents.Sarah.Supervisor,`
	33	+	`OpenAgents.RuntimeSupervisor,`
34	34		`# Start a worker by calling: OpenAgents.Worker.start_link(arg)`
35	35		`# {OpenAgents.Worker, arg},`
36	36		`# Start to serve requests, typically the last entry`

19	19		`alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, PushReceipt, Visibility}`
20	20		`alias OpenAgents.Repo`
21	21
22		-	`@schema_version "sarah.changelog.v1"`
	22	+	`@schema_version "openagents.changelog.v1"`
23	23		`@cache_key {__MODULE__, :cache}`
24	24		`@cache_ttl_ms 5_000`
25	25		`@entry_limit 200`

14	14
15	15		`alias OpenAgents.Changelog`
16	16
17		-	`@repo "sarah"`
	17	+	`@repo "openagents.com"`
18	18
19	19		`@doc "Boot entrypoint: seed if configured, never raise."`
20	20		`def boot do`

33	33
34	34		`@impl true`
35	35		`def init(_opts) do`
36		-	`data_dir = Application.get_env(:openagents, :ra_data_dir, "/tmp/sarah_ra")`
	36	+	`data_dir = Application.get_env(:openagents, :ra_data_dir, "/tmp/openagents_ra")`
37	37		`expected = Application.get_env(:openagents, :ra_expected_size, 3)`
38	38
39	39		`Ra.start_in(data_dir)`

46	46		`end`
47	47
48	48		`@doc false`
49		-	`def converge(repo \\ "sarah") do`
	49	+	`def converge(repo \\ "openagents.com") do`
50	50		`outcome =`
51	51		`try do`
52	52		`attempt(repo)`

4	4		the set of changed `.beam` binaries for that commit.
5	5
6	6		The production adapter is `OpenAgents.Forge.BuildExecutor.Sidecar`, which
7		-	talks to the `sarah-builder` sidecar container through a file queue on
	7	+	talks to the `openagents-builder` sidecar container through a file queue on
8	8		the shared workspace volume. Tests use `OpenAgents.Forge.FakeBuildExecutor`.
9	9		The adapter is selected via the `:forge_build_executor` application env
10	10		(see `OpenAgents.Forge.Builder`).

42	42
43	43		`defmodule OpenAgents.Forge.BuildExecutor.Sidecar do`
44	44		`@moduledoc """`
45		-	Production build adapter: talks to the `sarah-builder` sidecar container
46		-	`through a file queue on the shared workspace volume. The Sarah release`
	45	+	Production build adapter: talks to the `openagents-builder` sidecar container
	46	+	`through a file queue on the shared workspace volume. The OpenAgents release`
47	47		`container runs unprivileged with no docker socket, so it cannot exec`
48	48		`into the sidecar — the queue is the whole interface. Protocol (the`
49	49		watcher script lives in `ops/fleet/fleet-startup.sh`):

198	198		`"""`
199	199		`def warm? do`
200	200		`build_dir =`
201		-	`Application.get_env(:openagents, :forge_build_dir, "/var/lib/sarah/workspace/build")`
	201	+	`Application.get_env(:openagents, :forge_build_dir, "/var/lib/openagents/workspace/build")`
202	202
203	203		`File.exists?(Path.join(build_dir, ".forge-manifest"))`
204	204		`end`

207	207		`Application.get_env(`
208	208		`:openagents,`
209	209		`:forge_build_queue_dir,`
210		-	`"/var/lib/sarah/workspace/build-queue"`
	210	+	`"/var/lib/openagents/workspace/build-queue"`
211	211		`)`
212	212		`end`
213	213

8	8		`ever carry request data.`
9	9		`"""`
10	10
11		-	`@name_pattern ~r/^[a-z0-9][a-z0-9_-]{0,63}$/`
	11	+	`@name_pattern ~r/^[a-z0-9](?:[a-z0-9_-]\|\.(?=[a-z0-9])){0,63}$/`
12	12
13	13		`@doc "The forge data directory (bare repos + WAL cache + beam artifacts)."`
14	14		`def data_dir do`
15	15		`Application.get_env(:openagents, :forge_data_dir) \|\|`
16		-	`Path.join(System.tmp_dir!(), "sarah_forge_data")`
	16	+	`Path.join(System.tmp_dir!(), "openagents_forge_data")`
17	17		`end`
18	18
19	19		`@doc "Repositories this forge serves. Bounded, config-owned."`
20	20		`def allowed_repos do`
21		-	`Application.get_env(:openagents, :forge_repos, ["sarah"])`
	21	+	`Application.get_env(:openagents, :forge_repos, ["openagents.com"])`
22	22		`end`
23	23
24	24		`def valid_name?(name) when is_binary(name) do`

84	84
85	85		`@doc "The WAL sequence this bare repo has applied (cache freshness marker)."`
86	86		`def applied_seq(repo) do`
87		-	`case File.read(Path.join(bare_path(repo), "sarah-wal-seq")) do`
	87	+	`case File.read(Path.join(bare_path(repo), "openagents-wal-seq")) do`
88	88		`{:ok, contents} ->`
89	89		`case Integer.parse(String.trim(contents)) do`
90	90		`{seq, _} -> seq`

97	97		`end`
98	98
99	99		`def record_applied_seq!(repo, seq) when is_integer(seq) do`
100		-	`File.write!(Path.join(bare_path(repo), "sarah-wal-seq"), Integer.to_string(seq))`
	100	+	`File.write!(Path.join(bare_path(repo), "openagents-wal-seq"), Integer.to_string(seq))`
101	101		`end`
102	102
103	103		@doc "Run git with `--git-dir` pinned to the bare repo. Returns {output, status}."

84	84		`@doc """`
85	85		The owning account for `repo` — the first path segment of its public URL,
86	86		`so a forge URL is shaped exactly like the GitHub one it replaces`
87		-	(`/OpenAgentsInc/sarah/blob/main/README.md`). Operator-owned config.
	87	+	(`/OpenAgentsInc/openagents.com/blob/main/README.md`). Operator-owned config.
88	88		`"""`
89	89		`def owner(repo) when is_binary(repo) do`
90	90		`:openagents`