set -eu

repo_root=$(git rev-parse --show-toplevel)

# Where the push is going, before what it costs to check the push itself.

"$repo_root/ops/ci/push-remote-check.sh" "$@"

exec "$repo_root/ops/ci/gate.sh"

- Avoid jargon, buzzwords, metaphors, exclamation marks, and phrases like `simply` or `just`.

- Avoid `please` in instructions.

## Git remotes

Push to the forge, never to GitHub:

```sh

git push openagents HEAD:main

```

The `openagents` remote is the forge at `openagents.com`, which records every

push in the durable WAL and mirrors `main` to GitHub itself. The `origin`

remote is that GitHub mirror; pushing to it directly leaves the forge behind

its own mirror, and nothing reports the divergence until a clone disagrees

with the site. `ops/ci/push-remote-check.sh` refuses a non-forge push, and

`.githooks/pre-push` runs it. See `INVARIANTS.md`, REPOSITORY-002.

## Project guidelines

- Use `mix precommit` alias when you are done with all changes and fix any pending issues

`test/openagents_web/controllers/repository_controller_test.exs`, and

`test/openagents/forge/git_http_test.exs`.

### REPOSITORY-002 — Development pushes go to the forge, never to the mirror

Status: Current

This repository's own commits reach the forge first. The forge records each

push in the durable WAL and mirrors `main` to GitHub itself, so GitHub is a

projection of the forge in the same sense that a slug is a projection of a

GitHub ID. A push sent straight to GitHub inverts that: the WAL never sees the

objects, the mirror watch compares the forge against a mirror that is ahead of

it, and nothing reports the divergence until a clone disagrees with the site.

`ops/ci/push-remote-check.sh` admits only forge hosts and refuses every other

remote, whatever URL form it takes. `.githooks/pre-push` runs it before the

release gate, since where a push is going costs nothing to check and the gate

costs minutes. A bounded, logged override exists for operator-directed

recovery, such as mirroring by hand while the forge is unreachable.

The check is a guard, not a deployment: it refuses a wrong destination and

makes no claim about the candidate. Enforcement requires `core.hooksPath`,

which also enables the release gate on every push.

Evidence: `ops/ci/push-remote-check.sh`, `.githooks/pre-push`,

`OpenAgents.Forge.Pushes`, `OpenAgents.Forge.MirrorWatch`, and

`test/openagents/push_remote_contract_test.exs`.

## Executable proof index

This index is part of the ledger. Every `Current` invariant has at least one

| STATUS-001 | `test/openagents/network_status_test.exs`, `test/openagents_web/live/network_status_live_test.exs` |

| TRANSPARENCY-001 | `test/openagents/forge/visibility_test.exs`, `test/openagents/forge/browse_test.exs`, `test/openagents_web/live/code_live_test.exs` |

| REPOSITORY-001 | `test/openagents/repository_lifecycle_test.exs`, `test/openagents/repositories/provisioner_test.exs`, `test/openagents_web/controllers/repository_controller_test.exs`, `test/openagents/forge/git_http_test.exs` |

| REPOSITORY-002 | `ops/ci/push-remote-check.sh`, `test/openagents/push_remote_contract_test.exs` |

git config core.hooksPath .githooks

```

The hook refuses any push aimed somewhere other than the forge before it

considers the gate, so an installed hook enforces REPOSITORY-002 as well.

Provision a disposable PostgreSQL database with pgvector already installed,

then run the complete exact-SHA gate:

#!/bin/sh

set -eu

# Refuses a push to anything but the OpenAgents forge.

#

# The forge is the authority for this repository. It records every push in the

# durable WAL, and it mirrors `main` to GitHub itself

# (`OpenAgents.Forge.Pushes.mirror_now/1`, watched by

# `OpenAgents.Forge.MirrorWatch`). A push sent straight to GitHub arrives

# behind the forge's back: the WAL never sees those objects, the mirror watch

# compares the forge against a mirror that is now ahead of it, and the

# divergence stays invisible until a clone disagrees with the site.

#

# Git hands a pre-push hook the remote's name and URL on argv. Called directly,

# take the same two arguments; a name alone is resolved through `git remote`.

remote_name=${1:-}

remote_url=${2:-}

if [ -z "$remote_url" ] && [ -n "$remote_name" ]; then

  remote_url=$(git remote get-url "$remote_name" 2>/dev/null || printf '%s' "$remote_name")

fi

case "$remote_url" in

  https://openagents.com/* | https://*.openagents.com/* | \

  https://*@openagents.com/* | https://*@*.openagents.com/* | \

  ssh://*openagents.com/* | git@openagents.com:* | git@*.openagents.com:*)

    exit 0

    ;;

esac

# Bounded and loud, for operator-directed recovery: mirroring by hand while the

# forge is down is a real need, and a refusal with no way through invites

# someone to delete the hook instead.

if [ "${OPENAGENTS_ALLOW_NON_FORGE_PUSH:-}" = "1" ]; then

  echo "push_remote_override remote=${remote_name:-unnamed} url=$remote_url" >&2

  exit 0

fi

cat >&2 <<MESSAGE

Refusing to push to ${remote_name:-this remote} ($remote_url).

Pushes go to the OpenAgents forge, which records them in the WAL and mirrors

main to GitHub itself. Pushing to GitHub directly leaves the forge behind its

own mirror.

  git push openagents HEAD:main

Set OPENAGENTS_ALLOW_NON_FORGE_PUSH=1 for operator-directed recovery only.

MESSAGE

exit 1

defmodule OpenAgents.PushRemoteContractTest do

  use ExUnit.Case, async: true

  @script "ops/ci/push-remote-check.sh"

  defp check(arguments, environment \\ []) do

    System.cmd("sh", [@script | arguments], env: environment, stderr_to_stdout: true)

  end

  test "a GitHub remote is refused, whatever its URL form" do

    for url <- [

          "git@github.com:OpenAgentsInc/openagents.com.git",

          "https://github.com/OpenAgentsInc/openagents.com.git",

          "ssh://git@github.com/OpenAgentsInc/openagents.com.git"

        ] do

      assert {output, 1} = check(["origin", url])

      assert output =~ "Refusing to push"

      assert output =~ "git push openagents HEAD:main"

    end

  end

  test "the forge is admitted over HTTPS and SSH" do

    for url <- [

          "https://openagents.com/OpenAgentsInc/openagents.com.git",

          "https://staging.openagents.com/OpenAgentsInc/openagents.com.git",

          "git@openagents.com:OpenAgentsInc/openagents.com.git"

        ] do

      assert {_output, 0} = check(["openagents", url])

    end

  end

  # A host that merely ends in the forge's name is a different host.

  test "a lookalike host is refused" do

    assert {_output, 1} = check(["origin", "https://openagents.com.example.net/x.git"])

  end

  test "the override admits one push and says so" do

    assert {output, 0} =

             check(

               ["origin", "git@github.com:OpenAgentsInc/openagents.com.git"],

               [{"OPENAGENTS_ALLOW_NON_FORGE_PUSH", "1"}]

             )

    assert output =~ "push_remote_override"

  end

  test "the pre-push hook runs the check before the release gate" do

    hook = File.read!(".githooks/pre-push")

    assert hook =~ "ops/ci/push-remote-check.sh"

    assert hook =~ "ops/ci/gate.sh"

    [check_at, gate_at] =

      for marker <- ["push-remote-check.sh", "gate.sh"] do

        hook |> String.split(marker) |> hd() |> String.length()

      end

    assert check_at < gate_at

  end

end