not repaired in place, because a link the operator writes over their own store

is not evidence.

The direction is also what keeps a column *out* of this table. `ISSUE-003` gave

`forge_builds` and `forge_deploys` a `repository_id` because their `repo` string

is a repository name two repositories can share. `forge_pushes.repo` is a

storage key, which is unique, so it already names exactly one repository — and a

key only PostgreSQL could produce would not survive `reconcile_receipts/1`,

which rebuilds this table from the WAL alone. The absence is the invariant

holding, not an omission.

Two operational facts bound the claim. `:forge_mirror_urls` is empty in

`config/config.exs` and set by no environment, so no mirror runs today and

GitHub holds whatever was last pushed to it directly, which is the trade

the receipt's own terminal word in `result`. An issue's history is what

happened, not what worked.

**A receipt names its repository, and a name it cannot settle stays unsettled.**

`forge_builds.repo` and `forge_deploys.repo` hold `Target.repo`, a repository

*name* or an `owner/name` path, and `repositories` is unique on

`{namespace_id, name_key}` rather than on `name` — so one string can answer for

two repositories, and #148 recorded no evidence at all when it did. Both tables

carry `repository_id` now (#181): every receipt written since names its

repository, and the evidence chain reads that key rather than a name. The

string survives as the fallback for the rows the backfill could not settle, and

it is read only for those rows, so a shared name can no longer pull one

repository's receipts into another's answer. The refusal survives where it

still applies: an unsettled name resolves to nothing, and nothing resolves to

no evidence rather than to a guess. A null key means "not settled", never "no

repository".

`forge_pushes` deliberately has no such key. Its `repo` is

`Repository.storage_key`, which carries a unique index, so a push receipt

already names exactly one repository — and `EXIT-003` requires every column

there to be re-derivable from the WAL by

`OpenAgents.Forge.Pushes.reconcile_receipts/1`. A key only PostgreSQL can

produce would make the database a second opinion about a record the WAL alone

decides, which is the thing `EXIT-002` and `EXIT-005` exist to prevent.

**The two deployment planes stay distinct.** An issue in this repository is

evidenced by `forge_deploys` on the `forge` plane, whose one environment is the

fleet. An issue in a tenant repository is evidenced by `deployment_runs` on the

Evidence: `OpenAgents.Issues.Evidence`, `OpenAgents.Issues.EvidenceEntry`,

`OpenAgents.Issues.ClosingReferences`, `OpenAgents.Forge.Assignments`,

`test/openagents/issues/evidence_test.exs`, and

`OpenAgents.Forge.ReceiptRepository`,

`test/openagents/issues/evidence_test.exs`,

`test/openagents/forge/receipt_repository_test.exs`, and

`test/openagents_web/controllers/issue_controller_test.exs`.

### ISSUE-004 — Agent work on an issue starts through one admission

**The mirror stays separate.** It is an export with no read path, and folding it into the store would only couple the WAL to a third party's availability. Separate does not mean unguarded: because it force-pushes and cannot detect a mirror that is ahead (section 3.1), the boundary needs a lease, not just a direction.

**Two repositories can produce the same receipt `repo` string, and which string decides depends on the table.** `#181` asked this question of this audit, so here is the answer. `forge_pushes.repo` is written from `Repository.storage_key` on both paths that reach it — `GitHTTP.receive_pack/3` (`lib/openagents/forge/git_http.ex:109`) and `Pushes.reconcile_receipts/1` (`lib/openagents/forge/janitor.ex:122`) — and `storage_key` carries a unique index, so a push receipt names exactly one repository and always will. `forge_builds.repo` and `forge_deploys.repo` are written from `Target.repo`, which `Targets.validate_deployable_repo/1` (`lib/openagents/forge/targets.ex:945`) constrains to a member of `:forge_repos` *or* to `"#{owner}/#{allowed}"` — a repository **name**, or an `owner/name` path. Repository names are unique only within a namespace (`unique_index(:repositories, [:namespace_id, :name_key])`), so `alice/demo` and `bob/demo` are both legal and both produce the string `demo`. That collision is real today for every repository except the grandfathered one, whose name and storage key happen to be the same literal.

The consequence is that the three `repo` columns are not one identifier space, and `Pushes.receipt_repo_keys/1` exists to bridge them. `#181` settled it by giving `forge_builds` and `forge_deploys` a nullable `repository_id`, backfilled where a name resolved to exactly one repository, and by leaving `forge_pushes` alone for the reason `EXIT-003` gives: every column there must be re-derivable from the WAL, and a key only PostgreSQL can produce would make the database a second opinion about a push.

---

## 3. Failure modes, ranked

  `forge_builds` and `forge_deploys`. A commit's age therefore never changes

  the answer. Evidence written before this change does not exist, so there is

  no backfill to size; the earliest edge is the first receipt after deployment.

- **Should the receipt tables gain a repository foreign key? Still open, and

  stage 4 refuses rather than guesses.** `forge_pushes`, `forge_builds`, and

  `forge_deploys` all key on `repo` as a string. `Evidence` resolves that

  string through `Pushes.receipt_repo_keys/1`

  (`lib/openagents/forge/pushes.ex:295`) and records an edge only when exactly

  one repository answers to the name; two candidates record nothing rather than

  attaching a receipt to the wrong issue. That is safe but lossy, and a

  repository foreign key on the three receipt tables would remove the case

  entirely. `#181` carries that work; settle the name question first with

  `docs/2026-08-21-repository-storage-architecture-audit.md`.

- **Should the receipt tables gain a repository foreign key? Settled by `#181`,

  and the answer is two tables, not three.** The three `repo` columns do not

  hold the same kind of value. `forge_pushes.repo` is `Repository.storage_key`,

  which carries a unique index, so a push receipt already names exactly one

  repository; it gained no key, because `EXIT-003` requires every column there

  to be re-derivable from the WAL and a key only PostgreSQL can produce would

  make the database a second opinion. `forge_builds.repo` and

  `forge_deploys.repo` hold `Target.repo` — a repository name, or an

  `owner/name` path — and `repositories` is unique on `{namespace_id,

  name_key}` rather than on `name`, so one string can answer for two

  repositories. Both gained a nullable `repository_id`, backfilled where the

  name settled to exactly one repository. Stage 4's refusal survives where it

  still applies: an unsettled name resolves to nothing, and nothing resolves to

  no evidence rather than to a guess.

- **Does the tenant deployment plane or the forge deployment plane own an

  issue's deployment evidence? Settled: both, and the row says which.** Stage 4

  records `plane` on every edge — `forge` for a `forge_deploys` receipt, whose

  import Ecto.Query

  alias OpenAgents.Changelog.Entry

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, PushReceipt, Visibility}

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, PushReceipt, ReceiptRepository, Visibility}

  alias OpenAgents.Repo

  alias OpenAgents.Transparency

  alias OpenAgents.Transparency.ArtifactLink

    |> Repo.all()

  end

  # `forge_pushes.repo` is `Repository.storage_key`, which is unique, so a push

  # receipt is already keyed. Build and deploy receipts hold a repository name,

  # so they match on `repository_id` where they have one and on the name only

  # where the #181 backfill could not settle them.

  defp receipt_index(repo) do

    repository = ReceiptRepository.resolve(repo)

    %{

      pushes:

        PushReceipt

        |> Repo.all(),

      builds:

        BuildReceipt

        |> where([r], r.repo == ^repo)

        |> ReceiptRepository.scope(repository, [repo])

        |> order_by([r], desc: r.inserted_at)

        |> limit(@receipt_scan)

        |> Repo.all(),

      deploys:

        DeployReceipt

        |> where([r], r.repo == ^repo)

        |> ReceiptRepository.scope(repository, [repo])

        |> order_by([r], desc: r.inserted_at)

        |> limit(@receipt_scan)

        |> Repo.all()

  import Ecto.Query

  alias OpenAgents.Forge.{Pushes, PushReceipt}

  alias OpenAgents.Forge.{Pushes, PushReceipt, ReceiptRepository}

  alias OpenAgents.Repo

  @doc "Whether the forge endpoint is enabled (default true; env-gated in prod)."

    |> Repo.all()

  end

  @doc "Recent deploy receipts for one repo, newest first, bounded."

  @doc """

  Recent deploy receipts for one repo, newest first, bounded.

  A receipt that names its repository is matched by that key; `repo` is read

  only for a row the #181 backfill could not settle.

  """

  def recent_deploys(repo, limit \\ 20) do

    OpenAgents.Forge.DeployReceipt

    |> where([d], d.repo == ^repo)

    |> ReceiptRepository.scope(ReceiptRepository.resolve(repo), [repo])

    |> order_by([d], desc: d.inserted_at)

    |> limit(^limit)

    |> Repo.all()

  end

  @doc "Recent build receipts for one repo, newest first, bounded."

  @doc """

  Recent build receipts for one repo, newest first, bounded.

  Keyed the same way `recent_deploys/2` is.

  """

  def recent_builds(repo, limit \\ 20) do

    OpenAgents.Forge.BuildReceipt

    |> where([b], b.repo == ^repo)

    |> ReceiptRepository.scope(ReceiptRepository.resolve(repo), [repo])

    |> order_by([b], desc: b.inserted_at)

    |> limit(^limit)

    |> Repo.all()

  schema "forge_builds" do

    field :repo, :string

    field :repository_id, :binary_id

    field :sha, :string

    field :target_id, :binary_id

    field :status, :string, default: "running"

  @doc "Create the durable `running` row before handing work to the sidecar."

  def start_changeset(receipt, attrs) do

    receipt

    |> cast(attrs, [:repo, :sha, :target_id, :baseline_manifest])

    |> cast(attrs, [:repo, :repository_id, :sha, :target_id, :baseline_manifest])

    |> put_change(:status, "running")

    |> validate_required([:repo, :sha, :target_id, :status])

    |> validate_format(:sha, ~r/^[0-9a-f]{40}$/)

    |> foreign_key_constraint(:repository_id)

    |> unique_constraint(:target_id, name: :forge_builds_one_running_attempt_per_target)

  end

    receipt

    |> cast(attrs, [

      :repo,

      :repository_id,

      :sha,

      :target_id,

      :status,

  alias OpenAgents.Forge.BuildArtifact

  alias OpenAgents.Forge.BuildExecutor

  alias OpenAgents.Forge.BuildProtocol

  alias OpenAgents.Forge.ReceiptRepository

  alias OpenAgents.Forge.BuildReceipt

  alias OpenAgents.Forge.Repos

  alias OpenAgents.Forge.Target

      %BuildReceipt{id: build_id}

      |> BuildReceipt.start_changeset(%{

        repo: target.repo,

        # Resolved once, here, where an unsettled name records nothing rather

        # than a guess. Every read afterwards uses the key.

        repository_id: ReceiptRepository.resolve_id(target.repo),

        sha: target.sha,

        target_id: target.id,

        baseline_manifest: baseline_manifest

  schema "forge_deploys" do

    field :repo, :string

    field :repository_id, :binary_id

    field :sha, :string

    field :target_id, :binary_id

    field :deployment_id, :binary_id

    receipt

    |> cast(attrs, [

      :repo,

      :repository_id,

      :sha,

      :target_id,

      :deployment_id,

    |> validate_length(:canary, max: 255)

    |> validate_length(:error_code, max: 128)

    |> validate_node_results()

    |> foreign_key_constraint(:repository_id)

    |> unique_constraint(:deployment_id)

    |> check_constraint(:result, name: :forge_deploys_result)

    |> check_constraint(:deployment_type, name: :forge_deploys_deployment_type)

  alias OpenAgents.Forge.BuildArtifact

  alias OpenAgents.Forge.Deployment

  alias OpenAgents.Forge.DeploymentLane

  alias OpenAgents.Forge.ReceiptRepository

  alias OpenAgents.Forge.DeployReceipt

  alias OpenAgents.Forge.{Pushes, PushReceipt}

  alias OpenAgents.Forge.Targets

    %DeployReceipt{}

    |> DeployReceipt.changeset(%{

      repo: repo,

      repository_id: ReceiptRepository.resolve_id(repo),

      sha: sha,

      target_id: target_id,

      modules: modules,

defmodule OpenAgents.Forge.ReceiptRepository do

  @moduledoc """

  Which repository a forge receipt belongs to.

  `forge_builds.repo` and `forge_deploys.repo` hold `Target.repo`, which

  `OpenAgents.Forge.Targets` constrains to a member of `:forge_repos` — a

  repository *name*, or `owner/name`. `repositories` is unique on

  `{namespace_id, name_key}` rather than on `name`, so a name can answer for

  two repositories and a receipt keyed only by that name names neither.

  `forge_pushes.repo` is a different value with a different property: it is

  `Repository.storage_key`, which carries a unique index, so a push receipt

  already names exactly one repository. It has no `repository_id` and does not

  need one — see `EXIT-003`, which requires every `forge_pushes` column to be

  re-derivable from the WAL.

  Two operations, and they are deliberately asymmetric:

    * `resolve/1` runs once, at receipt time, and turns a string into a

      repository or into nothing. A name two repositories answer to resolves to

      nothing, so the receipt records a null key rather than a guess.

    * `scope/3` runs at read time and does not consult a string at all for a

      receipt that carries a key. The string stays as the fallback for the rows

      the backfill could not settle, and it is read only for those rows, so a

      shared name can no longer pull one repository's receipts into another's

      answer.

  """

  import Ecto.Query

  alias OpenAgents.Repo

  alias OpenAgents.Repositories.Repository

  @doc """

  The one repository `repo` names, or `nil`.

  Zero candidates and two candidates are the same answer on purpose: attaching

  a receipt to the wrong repository is worse than attaching it to none.

  """

  @spec resolve(term()) :: Repository.t() | nil

  def resolve(repo) when is_binary(repo) do

    Repository

    |> where(

      [repository],

      repository.storage_key == ^repo or repository.name == ^repo or

        fragment("? || '/' || ?", repository.owner, repository.name) == ^repo

    )

    |> limit(2)

    |> Repo.all()

    |> case do

      [%Repository{} = repository] -> repository

      _ambiguous_or_absent -> nil

    end

  end

  def resolve(_repo), do: nil

  @doc "The id of the one repository `repo` names, or `nil`."

  @spec resolve_id(term()) :: Ecto.UUID.t() | nil

  def resolve_id(repo) do

    case resolve(repo) do

      %Repository{id: id} -> id

      nil -> nil

    end

  end

  @doc """

  Narrows a `forge_builds` or `forge_deploys` query to one repository.

  With a repository in hand, a receipt matches on its key, and the string is

  consulted only for a receipt that has no key. Without one — a name that

  settles to nothing — the string is all there is, which is the same answer

  this surface gave before the key existed.

  """

  @spec scope(Ecto.Queryable.t(), Repository.t() | nil, [String.t()]) :: Ecto.Query.t()

  def scope(query, nil, repo_keys) do

    from receipt in query, where: receipt.repo in ^repo_keys

  end

  def scope(query, %Repository{id: repository_id}, repo_keys) do

    from receipt in query,

      where:

        receipt.repository_id == ^repository_id or

          (is_nil(receipt.repository_id) and receipt.repo in ^repo_keys)

  end

  @doc """

  Fills `repository_id` for the rows of `table` whose `repo` string settles.

  The migration that added the column runs exactly this statement, and it lives

  here rather than inside the migration so the rule is proven by a test instead

  of asserted by a comment. It is idempotent: a row that already carries a key

  is left alone, and a row whose name answers for two repositories, or for

  none, is left null. A null means "not settled", never "no repository".

  `forge_deploys` carries the `forge_deploy_receipts_immutable` trigger, which

  refuses every `UPDATE`. The caller suspends it; this function does not, so a

  backfill cannot quietly acquire the authority to rewrite a receipt.

  """

  @spec backfill!(String.t()) :: non_neg_integer()

  def backfill!(table) when table in ~w(forge_builds forge_deploys) do

    %Postgrex.Result{num_rows: filled} =

      Repo.query!("""

      WITH candidate AS (

        SELECT

          receipt.id AS receipt_id,

          repository.id AS repository_id,

          count(*) OVER (PARTITION BY receipt.id) AS matches

        FROM #{table} AS receipt

        JOIN repositories AS repository

          ON repository.storage_key = receipt.repo

          OR repository.name = receipt.repo

          OR repository.owner || '/' || repository.name = receipt.repo

      )

      UPDATE #{table} AS receipt

      SET repository_id = candidate.repository_id

      FROM candidate

      WHERE candidate.receipt_id = receipt.id

        AND candidate.matches = 1

        AND receipt.repository_id IS NULL

      """)

    filled

  end

end

  alias OpenAgents.Analytics

  alias OpenAgents.Forge.BuildReceipt

  alias OpenAgents.Forge.DeployReceipt

  alias OpenAgents.Forge.ReceiptRepository

  alias OpenAgents.Forge.{Pushes, Target}

  alias OpenAgents.Repo

            receipt_attrs

            |> Map.put(:target_id, target.id)

            |> Map.put(:repo, target.repo)

            |> Map.put(:repository_id, ReceiptRepository.resolve_id(target.repo))

            |> Map.put(:sha, target.sha)

            |> Map.put(:result, status)

              end),

            push_to_live_ms: relup.duration_ms,

            repo: target.repo,

            repository_id: build.repository_id,

            result: relup.status,

            rollback_verified:

              relup.status == "failed" and

            node_results: rolling.node_results,

            nodes: Enum.map(rolling.expected_nodes, &"#{&1}=#{rolling.node_results[&1]}"),

            repo: target.repo,

            repository_id: build.repository_id,

            result: rolling.status,

            rollback_verified:

              rolling.status == "failed" and rolling.recovery == "last_known_good_restored",

  alias OpenAgents.Deployments.Request, as: DeploymentRequest

  alias OpenAgents.Deployments.Run, as: DeploymentRun

  alias OpenAgents.Forge.{Assignment, BuildReceipt, DeployReceipt, PushReceipt}

  alias OpenAgents.Forge.ReceiptRepository

  alias OpenAgents.Issues.{ClosingReference, EvidenceEntry, Issue}

  alias OpenAgents.Repo

  alias OpenAgents.Repositories.Repository

  defp receipt_facts("build", id) do

    case Repo.get(BuildReceipt, id) do

      %BuildReceipt{} = receipt ->

        with %Repository{} = repository <- repository_for(receipt.repo) do

        with %Repository{} = repository <- repository_for(receipt) do

          {:ok,

           %{

             repository: repository,

  end

  defp forge_deployment_facts(%DeployReceipt{} = receipt) do

    case repository_for(receipt.repo) do

    case repository_for(receipt) do

      %Repository{} = repository ->

        {:ok,

         %{

    )

  end

  # `forge_builds` and `forge_deploys` key on `repo` as a string rather than a

  # repository foreign key, so this join inherits that ambiguity. It is resolved

  # only when exactly one repository answers to the name; two candidates record

  # nothing rather than guessing which issue the receipt belongs to.

  defp repository_for(repo) when is_binary(repo) do

    keys = OpenAgents.Forge.Pushes.receipt_repo_keys(repo)

  # A receipt written since #181 carries `repository_id`, so the evidence chain

  # no longer depends on a name resolving to exactly one repository. The string

  # is read only for a row the backfill could not settle, and there it keeps the

  # old refusal: two candidates record nothing rather than guessing which issue

  # the receipt belongs to.

  defp repository_for(%{repository_id: repository_id}) when is_binary(repository_id) do

    Repo.get(Repository, repository_id)

  end

    Repository

    |> where([repository], repository.storage_key in ^keys or repository.name in ^keys)

    |> limit(2)

    |> Repo.all()

    |> case do

      [%Repository{} = repository] -> repository

      _ambiguous_or_absent -> nil

    end

  defp repository_for(%{repo: repo}), do: repository_by_name(repo)

  defp repository_by_name(repo) when is_binary(repo) do

    ReceiptRepository.resolve(repo)

  end

  defp repository_for(_repo), do: nil

  defp repository_by_name(_repo), do: nil

  defp sweep(%Repository{} = repository, commit_sha, %Assignment{} = assignment) do

    # The receipt tables key on `repo` as a string. Restricting the sweep to

    # this repository's own keys keeps a receipt for another repository's

    # identical sha out of the answer before the repository resolution runs.

    # A receipt that names this repository is matched by its key. The string is

    # the fallback for a row the backfill could not settle, and restricting it

    # to this repository's own keys keeps a receipt for another repository's

    # identical sha out of the answer.

    keys = OpenAgents.Forge.Pushes.receipt_repo_keys(repository.storage_key)

    builds =

      Repo.all(

        from build in BuildReceipt,

          where: build.sha == ^commit_sha and build.repo in ^keys,

          select: build.id,

          limit: @claimant_limit

      )

      BuildReceipt

      |> ReceiptRepository.scope(repository, keys)

      |> where([build], build.sha == ^commit_sha)

      |> select([build], build.id)

      |> limit(@claimant_limit)

      |> Repo.all()

      |> Enum.map(&%{family: "build", receipt_id: &1})

    deploys =

      Repo.all(

        from deploy in DeployReceipt,

          where: deploy.sha == ^commit_sha and deploy.repo in ^keys,

          select: deploy.id,

          limit: @claimant_limit

      )

      DeployReceipt

      |> ReceiptRepository.scope(repository, keys)

      |> where([deploy], deploy.sha == ^commit_sha)

      |> select([deploy], deploy.id)

      |> limit(@claimant_limit)

      |> Repo.all()

      |> Enum.map(&%{family: "deployment", receipt_id: &1})

    checks =

    20260824010826,

    20260824011303,

    20260824024146,

    20260824031651,

    20260824032226

  ],

  "required_tables": [

defmodule OpenAgents.Repo.Migrations.AddRepositoryKeyToForgeBuildAndDeployReceipts do

  use Ecto.Migration

  @moduledoc """

  Names the repository a build or deploy receipt belongs to.

  `forge_builds.repo` and `forge_deploys.repo` hold `Target.repo`, which

  `OpenAgents.Forge.Targets` constrains to a member of `:forge_repos` — a

  repository *name*, or `owner/name`. `repositories` is unique on

  `{namespace_id, name_key}` rather than on `name`, so two repositories can

  answer to one receipt string, and `OpenAgents.Issues.Evidence` records no

  evidence at all when they do.

  `forge_pushes.repo` is deliberately left alone. It holds

  `Repository.storage_key`, which carries a unique index, so it already names

  exactly one repository. Adding a key there would buy no disambiguation and

  would cost something: `EXIT-003` requires every `forge_pushes` column to be

  re-derivable from the WAL by `Pushes.reconcile_receipts/1`, and a column only

  PostgreSQL can produce would make the database a second opinion about a push

  record the WAL alone decides.

  The backfill statement itself lives in

  `OpenAgents.Forge.ReceiptRepository.backfill!/1` rather than inline here, so

  the rule it applies is proven by a test rather than asserted by a comment. It

  resolves a name only when exactly one repository answers to it.

  A row it cannot settle keeps a null key and stays readable by its string. A

  null here means "not settled", never "no repository", and no row is attached

  to a guess.

  `forge_deploys` carries the `forge_deploy_receipts_immutable` trigger, which

  refuses every `UPDATE`. The backfill suspends it for the length of this

  migration's transaction and restores it in the same transaction. What the

  backfill writes is a derived key beside the receipt, not a change to anything

  the receipt claims: `repo`, `sha`, `result`, the digests, and the node results

  are untouched.

  """

  def up do

    alter table(:forge_builds) do

      add :repository_id, references(:repositories, type: :binary_id, on_delete: :nothing)

    end

    alter table(:forge_deploys) do

      add :repository_id, references(:repositories, type: :binary_id, on_delete: :nothing)

    end

    create index(:forge_builds, [:repository_id, :sha])

    create index(:forge_deploys, [:repository_id, :sha])

    flush()

    OpenAgents.Forge.ReceiptRepository.backfill!("forge_builds")

    repo().query!("ALTER TABLE forge_deploys DISABLE TRIGGER forge_deploy_receipts_immutable")

    OpenAgents.Forge.ReceiptRepository.backfill!("forge_deploys")

    repo().query!("ALTER TABLE forge_deploys ENABLE TRIGGER forge_deploy_receipts_immutable")

  end

  def down do

    drop index(:forge_builds, [:repository_id, :sha])

    drop index(:forge_deploys, [:repository_id, :sha])

    alter table(:forge_builds) do

      remove :repository_id

    end

    alter table(:forge_deploys) do

      remove :repository_id

    end

  end

end

  use OpenAgents.DataCase, async: false

  alias OpenAgents.Changelog

  alias OpenAgents.Changelog.{Backfill, Entry}

  alias OpenAgents.Forge.{DeployReceipt, PushReceipt}

  alias OpenAgents.Forge

  alias OpenAgents.Forge.{DeployReceipt, PushReceipt, ReceiptRepository}

  alias OpenAgents.Transparency.ArtifactLink

  setup do

    end

  end

  describe "which repository a receipt belongs to" do

    # `forge_builds.repo` and `forge_deploys.repo` hold a repository *name*, and

    # `Targets.promote/4` admits both the bare name and the `owner/name` path.

    # Before #181 the changelog matched the string exactly, so a receipt written

    # under one form was invisible to a projection asking for the other, even

    # though both settle to the same repository. The key settles it.

    test "a receipt written under the owner/name path reaches the bare-name projection" do

      sha = full_sha("feed0181")

      {:ok, _entry} = Changelog.record(entry_attrs(%{sha: sha, summary: "Keyed receipt"}))

      repository = ReceiptRepository.resolve("openagents.com")

      assert repository.id == "00000000-0000-4000-8000-000000000001"

      deploy =

        insert_deploy!(%{

          repo: "OpenAgentsInc/openagents.com",

          repository_id: repository.id,

          sha: sha

        })

      assert {:ok, payload} = Changelog.projection("openagents.com", refresh: true)

      assert [entry] = payload["entries"]

      assert entry["receipt_ids"]["deploy"] == deploy.id

      # `OpenAgents.Forge.receipts_for/2` reads the same way.

      assert Enum.any?(Forge.receipts_for("openagents.com", sha), fn

               {:deploys, deploys} -> Enum.any?(deploys, &(&1.id == deploy.id))

               _other -> false

             end)

    end

    # A receipt whose name the backfill could not settle still reads. It keeps

    # a null key, and the string is what finds it.

    test "a receipt with no key still reaches the projection by its string" do

      sha = full_sha("feed0182")

      {:ok, _entry} = Changelog.record(entry_attrs(%{sha: sha, summary: "Unkeyed receipt"}))

      deploy = insert_deploy!(%{repo: "openagents.com", repository_id: nil, sha: sha})

      assert {:ok, payload} = Changelog.projection("openagents.com", refresh: true)

      assert [entry] = payload["entries"]

      assert entry["receipt_ids"]["deploy"] == deploy.id

    end

  end

  describe "projection/2" do

    test "publishes the schema version, receipt ids, commit_url — and only the push role" do

      sha = full_sha("feed0007")

  alias OpenAgents.Forge.BuildExecutor.Sidecar

  alias OpenAgents.Forge.BuildReceipt

  alias OpenAgents.Forge.Builder

  alias OpenAgents.Forge.ReceiptRepository

  alias OpenAgents.Forge.FakeBuildExecutor

  alias OpenAgents.Forge.Repos

  alias OpenAgents.Forge.Target

      # Receipt row.

      receipt = Repo.get_by!(BuildReceipt, repo: "openagents.com", sha: sha)

      assert receipt.target_id == target.id

      # #181: a receipt written after the key exists names its repository, so

      # no reader has to resolve `repo` back to one. Removing `repository_id`

      # from `Builder`'s start changeset turns this red.

      assert receipt.repository_id == ReceiptRepository.resolve_id("openagents.com")

      assert receipt.repository_id == "00000000-0000-4000-8000-000000000001"

      assert receipt.modules == [module]

      assert receipt.warnings == "warn: something minor"

      assert receipt.tests == nil

    assert receipt.result == "live"

    assert receipt.repo == "openagents.com"

    # #181: a deploy receipt written after the key exists names its repository,

    # so `Changelog` and `Evidence` read a key rather than resolve a name.

    assert receipt.repository_id == "00000000-0000-4000-8000-000000000001"

    assert receipt.target_id == target.id

    assert receipt.modules == [name]

    assert receipt.canary == "ok"

    assert Repo.get!(Target, target.id).status == "failed"

    assert deploy_receipt(sha).result == "failed"

    # #181: the failed-load path writes its own receipt, and it names the

    # repository too. Dropping the key from `HotLoader.insert_receipt/9` turns

    # this red.

    assert deploy_receipt(sha).repository_id == "00000000-0000-4000-8000-000000000001"

    assert_receive {:forge_deploy, %{repo: "openagents.com", sha: ^sha, result: "failed"}}

  end

defmodule OpenAgents.Forge.ReceiptRepositoryTest do

  @moduledoc """

  Which repository a build or deploy receipt belongs to, #181.

  `forge_builds.repo` and `forge_deploys.repo` hold a repository *name*, and

  `repositories` is unique on `{namespace_id, name_key}` rather than on `name`,

  so a name can answer for two repositories. This file pins what the string

  could not decide and what the key now does.

  """

  use OpenAgents.DataCase, async: false

  import Ecto.Query

  alias OpenAgents.AccountsFixtures

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, ReceiptRepository}

  alias OpenAgents.Repo

  alias OpenAgents.Repositories.Repository

  describe "what each receipt column actually holds" do

    test "a push receipt's repo is a storage key, which is already unambiguous" do

      # `forge_pushes` deliberately has no `repository_id`. This is the reason:

      # its `repo` is `Repository.storage_key`, which carries a unique index,

      # so it names exactly one repository already. EXIT-003 keeps every column

      # there re-derivable from the WAL, and a key only PostgreSQL can produce

      # would make the database a second opinion about a push.

      %{rows: [[unique?]]} =

        Repo.query!("""

        SELECT count(*) = 1

        FROM pg_indexes

        WHERE tablename = 'repositories'

          AND indexdef LIKE 'CREATE UNIQUE INDEX%(storage_key)'

        """)

      assert unique?

      refute :repository_id in OpenAgents.Forge.PushReceipt.__schema__(:fields)

      %{rows: [[present]]} =

        Repo.query!("""

        SELECT count(*) FROM information_schema.columns

        WHERE table_name = 'forge_pushes' AND column_name = 'repository_id'

        """)

      assert present == 0

    end

    test "a build or deploy receipt's repo is a name, which two repositories can share" do

      first = AccountsFixtures.repository_fixture(%{owner: "FirstOrg", name: "shared-name"})

      second = AccountsFixtures.repository_fixture(%{owner: "SecondOrg", name: "shared-name"})

      assert first.name == second.name

      refute first.storage_key == second.storage_key

      assert Repo.aggregate(from(r in Repository, where: r.name == "shared-name"), :count) == 2

    end

  end

  describe "resolve/1" do

    test "answers for a storage key, a bare name, and an owner/name path" do

      repository = AccountsFixtures.repository_fixture(%{owner: "ResolveOrg", name: "resolvable"})

      assert ReceiptRepository.resolve(repository.storage_key).id == repository.id

      assert ReceiptRepository.resolve("resolvable").id == repository.id

      assert ReceiptRepository.resolve("ResolveOrg/resolvable").id == repository.id

    end

    test "refuses a name two repositories answer to, and a name none answers to" do

      AccountsFixtures.repository_fixture(%{owner: "AmbiguousA", name: "two-answers"})

      AccountsFixtures.repository_fixture(%{owner: "AmbiguousB", name: "two-answers"})

      assert ReceiptRepository.resolve("two-answers") == nil

      assert ReceiptRepository.resolve("no-such-repository") == nil

      assert ReceiptRepository.resolve(nil) == nil

    end

  end

  describe "scope/3" do

    test "a keyed receipt is matched by its key and never by another repository's name" do

      mine = AccountsFixtures.repository_fixture(%{owner: "ScopeMine", name: "collide"})

      theirs = AccountsFixtures.repository_fixture(%{owner: "ScopeTheirs", name: "collide"})

      ours = build_receipt!("collide", mine.id)

      not_ours = build_receipt!("collide", theirs.id)

      found =

        BuildReceipt

        |> ReceiptRepository.scope(mine, ["collide"])

        |> select([b], b.id)

        |> Repo.all()

      assert ours.id in found

      refute not_ours.id in found

    end

    test "a receipt with no key still reads by its string" do

      repository = AccountsFixtures.repository_fixture(%{owner: "ScopeOld", name: "historical"})

      unkeyed = build_receipt!("historical", nil)

      found =

        BuildReceipt

        |> ReceiptRepository.scope(repository, ["historical"])

        |> select([b], b.id)

        |> Repo.all()

      assert unkeyed.id in found

    end

    test "with no repository to name, the string is all there is" do

      unkeyed = build_receipt!("unsettled-name", nil)

      found =

        BuildReceipt

        |> ReceiptRepository.scope(nil, ["unsettled-name"])

        |> select([b], b.id)

        |> Repo.all()

      assert found == [unkeyed.id]

    end

  end

  describe "backfill!/1" do

    test "fills a name exactly one repository answers to and leaves the rest null" do

      repository = AccountsFixtures.repository_fixture(%{owner: "FillOrg", name: "fillable"})

      AccountsFixtures.repository_fixture(%{owner: "ClashA", name: "clashing"})

      AccountsFixtures.repository_fixture(%{owner: "ClashB", name: "clashing"})

      by_name = build_receipt!("fillable", nil)

      by_path = build_receipt!("FillOrg/fillable", nil)

      by_storage_key = build_receipt!(repository.storage_key, nil)

      ambiguous = build_receipt!("clashing", nil)

      absent = build_receipt!("gone-from-the-forge", nil)

      assert ReceiptRepository.backfill!("forge_builds") >= 3

      assert reload(by_name).repository_id == repository.id

      assert reload(by_path).repository_id == repository.id

      assert reload(by_storage_key).repository_id == repository.id

      # A backfill that guesses is worse than a null. Both of these stay null,

      # and a null means "not settled", never "no repository".

      assert reload(ambiguous).repository_id == nil

      assert reload(absent).repository_id == nil

    end

    test "it is idempotent and never re-points a receipt that already names one" do

      first = AccountsFixtures.repository_fixture(%{owner: "IdemA", name: "idempotent"})

      second = AccountsFixtures.repository_fixture(%{owner: "IdemB", name: "elsewhere"})

      # Deliberately pointed at the repository its name does not name.

      receipt = build_receipt!("idempotent", second.id)

      assert ReceiptRepository.backfill!("forge_builds") >= 0

      assert reload(receipt).repository_id == second.id

      refute reload(receipt).repository_id == first.id

    end

    test "it does not carry the authority to rewrite a deploy receipt" do

      repository = AccountsFixtures.repository_fixture(%{owner: "TriggerOrg", name: "triggered"})

      receipt = deploy_receipt!("triggered", nil)

      # `forge_deploys` refuses every UPDATE. The migration suspends the trigger

      # for the length of its own transaction; `backfill!/1` does not, so a

      # caller cannot quietly acquire that authority.

      assert_raise Postgrex.Error, ~r/forge deployment receipts are immutable/, fn ->

        ReceiptRepository.backfill!("forge_deploys")

      end

      Repo.query!("ALTER TABLE forge_deploys DISABLE TRIGGER forge_deploy_receipts_immutable")

      assert ReceiptRepository.backfill!("forge_deploys") >= 1

      Repo.query!("ALTER TABLE forge_deploys ENABLE TRIGGER forge_deploy_receipts_immutable")

      assert Repo.get(DeployReceipt, receipt.id).repository_id == repository.id

    end

  end

  ## helpers

  defp build_receipt!(repo, repository_id) do

    %BuildReceipt{}

    |> BuildReceipt.changeset(%{

      repo: repo,

      repository_id: repository_id,

      sha: String.duplicate("a", 40),

      target_id: Ecto.UUID.generate(),

      status: "complete"

    })

    |> Repo.insert!()

  end

  defp deploy_receipt!(repo, repository_id) do

    %DeployReceipt{}

    |> DeployReceipt.changeset(%{

      repo: repo,

      repository_id: repository_id,

      sha: String.duplicate("b", 40),

      target_id: Ecto.UUID.generate(),

      result: "live"

    })

    |> Repo.insert!()

  end

  defp reload(%BuildReceipt{id: id}), do: Repo.get!(BuildReceipt, id)

end

  use OpenAgents.DataCase, async: false

  import OpenAgents.AccountsFixtures

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, Repos, Targets}

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, ReceiptRepository, Repos, Targets}

  @rolling_nodes ["openagents@10.42.0.11", "openagents@10.42.0.12"]

  @rolling_digest "sha256:" <> String.duplicate("c", 64)

    assert Repo.get!(OpenAgents.Forge.Target, target.id).status == "deploying"

  end

  test "a fleet commit names the repository its target's name settles to", %{sha: sha} do

    {:ok, target} = Targets.promote("demo", sha, "operator:test")

    {:ok, _building} = Targets.advance(target.id, "building")

    {:ok, _built} = Targets.advance(target.id, "built")

    {:ok, _deploying} = Targets.begin_deployment(target.id)

    # Created after promotion: a repository answering to `demo` also changes

    # what `Pushes.mirror_storage_key/1` returns, and promotion resolves the

    # bare cache through it. The receipt key is resolved at settlement.

    demo = repository_fixture(%{owner: "FleetDemoOrg", name: "demo"})

    assert ReceiptRepository.resolve("demo").id == demo.id

    deployment_id = Ecto.UUID.generate()

    assert {:ok, %{receipt: receipt}} =

             Targets.finish_deployment(

               target.id,

               "live",

               %{"deployment_id" => deployment_id},

               %{deployment_id: deployment_id, expected_nodes: [], nodes: [], node_results: %{}}

             )

    assert receipt.repo == "demo"

    assert receipt.repository_id == demo.id

  end

  test "fleet commit writes the live target and terminal receipt atomically", %{sha: sha} do

    {:ok, target} = Targets.promote("demo", sha, "operator:test")

    {:ok, _building} = Targets.advance(target.id, "building")

    assert live.status == "live"

    assert receipt.result == "live"

    # #181: `demo` is an allowlist name no repository on this forge answers to,

    # so the receipt records a null key rather than a guess. A null here means

    # "not settled", never "no repository".

    assert receipt.repo == "demo"

    assert receipt.repository_id == nil

    assert OpenAgents.Forge.ReceiptRepository.resolve("demo") == nil

    assert receipt.deployment_id == deployment_id

    assert receipt.artifact_digest == digest

    assert receipt.manifest_digest == manifest_digest

    {:ok, _built} = Targets.advance(target.id, "built")

    {:ok, _rolling} = Targets.advance(target.id, "needs_rolling_replace")

    repository = repository_fixture()

    artifact_digest = String.duplicate("a", 64)