BEAM identity. Only a fully verified fleet restoration records `reverted`;

  an unreachable or divergent node records `failed` and remains out of

  readiness.

- Made pre-token and partial-prepare failures rollback only participants that

  actually issued tokens. These failures now return bounded outcomes instead

  of raising on a missing token, and failed fleet snapshots retain their

  per-node health diagnostics.

- Added a database transaction that advances the target to `live` only in the

  same commit that inserts its terminal deployment receipt. The receipt binds

  deployment, artifact, manifest, expected membership, bounded per-node

  immutability; boot tests for cold-cache fetch, cache retention, stale-target

  refusal, and degraded retry; and real three-node tests for success, remote

  failure with exact rollback, rollback refusal, timeout, and membership loss.

- Passed 107 default forge tests and five real three-node deployment tests.

  The full precommit gate passed 17 browser tests and 1,318 default Elixir

  tests, with 14 distributed tests excluded from the default lane. The pinned

  Elixir 1.20.3 and OTP 29.0.5 `forge-builder` target also built the production

- Passed the exact-SHA baseline with 17 browser tests, 1,339 default Elixir

  tests, 14 distributed tests, 83.15% merged coverage, and packaged release

  startup against a disposable PostgreSQL database. The distributed lane

  includes five real three-node deployment scenarios. See the

  [Gate 10 evidence](evidence/gate-10/6999983b4487c0fe0acdb73c10b34327cdb0de5a/README.md).

- Built the pinned Elixir 1.20.3 and OTP 29.0.5 `forge-builder` production

  release without application warnings.

- Documented the operator contract in the

  [transactional deployment runbook](operations/forge-transactional-deployment.md).

Gate 10 is complete locally. Keep the deploy and boot-convergence features

disabled until Gate 11 supplies relup and rolling-replacement fallbacks and

Gate 12 provides an isolated distributed staging lane. No staging or

production environment was changed.

Gate 10 is complete locally with exact-commit evidence. Keep the deploy and

boot-convergence features disabled until Gate 11 supplies relup and

rolling-replacement fallbacks and Gate 12 provides an isolated distributed

staging lane. No staging or production environment was changed.

## Gate 11: Complete relup and rolling replacement

# Gate 10 transactional fleet deployment evidence

Date: 2026-08-20

Implementation SHA: `6999983b4487c0fe0acdb73c10b34327cdb0de5a`

Gate 10 passed locally on the exact implementation commit. This evidence set

is content-free and contains no credentials, database URLs, hostnames, private

repository content, conversation content, or staging data.

## Evidence

- `baseline-receipt.json` is the immutable result copied from the owned

  exact-SHA gate receipt. Precommit, merged coverage, all 14 distributed

  tests, 17 browser tests, and packaged production-release startup passed

  without retries.

- `migration-rehearsal.json` records a populated forward, reverse, and second

  forward rehearsal of the deployment-receipt migration. It verifies legacy

  receipt backfill, immutable receipt enforcement, data preservation across

  rollback, and repeatable forward migration.

- `transactional-fleet-proof.json` identifies the real three-node scenarios

  included in the distributed lane: successful commit, exact fleet rollback,

  unverified rollback refusal, participant timeout, and membership loss.

The release startup and migration rehearsal used newly provisioned disposable

PostgreSQL roles and databases. Cleanup checks confirmed that both databases

and both roles were removed. No staging or production deployment occurred.

{

  "schema": "openagents.baseline-gate.v1",

  "git_sha": "6999983b4487c0fe0acdb73c10b34327cdb0de5a",

  "status": "passed",

  "started_at": "2026-08-20T10:53:22Z",

  "completed_at": "2026-08-20T10:55:02Z",

  "total_duration_seconds": 100,

  "automatic_retries": 0,

  "stages": {

    "precommit": {"status": "passed", "duration_seconds": 22},

    "coverage": {"status": "passed", "duration_seconds": 68},

    "release_smoke": {"status": "passed", "duration_seconds": 10}

  },

  "tests": {

    "javascript": 17,

    "default": 1339,

    "cluster": 14,

    "excluded_from_default": 14

  },

  "coverage_percent": 83.15

}

{

  "schema": "openagents.migration-rehearsal.v1",

  "git_sha": "6999983b4487c0fe0acdb73c10b34327cdb0de5a",

  "status": "passed",

  "migration": "20260820140000_harden_forge_deployment_transactions",

  "starting_version": 20260820130000,

  "fixture_counts": {

    "forge_fleet_targets": 1,

    "legacy_forge_deploys": 1

  },

  "checks": {

    "forward_identity_backfill": "passed",

    "expected_membership_backfill": "passed",

    "bounded_node_results_backfill": "passed",

    "timestamp_backfill": "passed",

    "immutable_update_refusal": "passed",

    "reverse_data_preservation": "passed",

    "second_forward_backfill": "passed"

  },

  "automatic_retries_in_successful_run": 0,

  "database_class": "disposable",

  "database_removed_after_run": true,

  "staging_changed": false,

  "production_changed": false

}

{

  "schema": "openagents.forge.transactional-fleet-proof.v1",

  "git_sha": "6999983b4487c0fe0acdb73c10b34327cdb0de5a",

  "status": "passed",

  "expected_nodes": 3,

  "real_three_node_scenarios": [

    "prepare_canary_verify_commit_finalize",

    "remote_apply_failure_exact_rollback",

    "unverified_rollback_fences_readiness",

    "participant_timeout_blocks_live",

    "membership_loss_aborts_commit"

  ],

  "distributed_tests_in_exact_sha_baseline": 14,

  "automatic_retries_in_successful_run": 0,

  "staging_changed": false,

  "production_changed": false

}