ARG ESBUILD_SHA256=93433b456cac3a454ee27403d3de9adce88d83e5439ba37e1471af54730c9ca7

ARG NODE_VERSION=24.15.0

ARG CODEX_VERSION=0.147.0

ARG OPENCODE_VERSION=1.18.5

ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}@sha256:ae38be7cb19bffa78adedb04732d9e6ba83a507b4cfb06983cbe711edb49da54"

ARG RUNNER_IMAGE="docker.io/debian:${DEBIAN_VERSION}@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258"

# resolve and the checksum still guards the result.

ARG TARGETARCH

ARG CODEX_VERSION

ARG OPENCODE_VERSION

ARG DEBIAN_SNAPSHOT

ARG SOURCE_DATE_EPOCH=0

ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}

  codex --version; \

  codex-code-mode-host --help >/dev/null

# OpenCode, for the SCV deployment lane (SCV-001). The Codex SCV lane already

# runs its binary as a child of this node; the OpenCode lane needs the same,

# pinned by version and checksum from the same release the SCV worker image

# uses, so both images run identical bytes.

RUN set -eu; \

  case "${TARGETARCH:-$(dpkg --print-architecture)}" in \

    amd64) opencode_arch=x64; checksum=cd4a2557a3d6550f27cb5c0257ebe8d73388bb34beda8b6121e6428a74c1eae2 ;; \

    arm64) opencode_arch=arm64; checksum=18b643362fdf0b8d5b8711b3e160dafb4e68d0bfc00288f56fd1298fd72da69d ;; \

    *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \

  esac; \

  archive="opencode-linux-${opencode_arch}.tar.gz"; \

  curl -fsSL --retry 3 -o "/tmp/${archive}" \

    "https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/${archive}"; \

  echo "${checksum}  /tmp/${archive}" | sha256sum --check --strict; \

  tar -xzf "/tmp/${archive}" -C /tmp; \

  install -D -m 0755 /tmp/opencode /usr/local/bin/opencode; \

  rm "/tmp/${archive}" /tmp/opencode; \

  opencode --version

# Set the locale

RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen \

  && locale-gen

`OpenAgents.CodingJobTest`, and the repository tool tests in

`test/openagents/tools/repository_mutation_tools_test.exs`.

### SCV-001 — An SCV spends our capacity only under operator authority and fixed bounds

Status: Current

An SCV deployment is the one lane where OpenAgents runs a coding agent on

hardware we own and pay for, rather than on a machine the person paired and

powers. Every other execution path is bounded by something outside our

control; this one is not, so its ceiling is written down and enforced rather

than assumed.

- **One entry point, and it is operator-only.** Every surface that starts an

  SCV enters `OpenAgents.SCV.Deployments.start/2`, which refuses any account

  that is not an OpenAgents operator with `:operator_required` before a row is

  written or a process is spawned. The refusal lives in the code that starts

  the run, not in whatever advertised it, so a model that calls the tool on

  behalf of a signed-in non-operator is refused exactly as an unauthenticated

  caller is. `sarah.tool.scv_deploy.v1` declares `external_effect` under the

  `explicit_operator_approval` class, and the matching receipt is minted only

  for operators, so `OpenAgents.Modules.SurfacePolicy` refuses the same call a

  second time and independently.

- **It is a work job, not a second job system.** The durable unit is a

  `work_jobs` row of kind `scv`, so an SCV inherits the seven statuses, the

  PostgreSQL transition triggers, the Horde cluster singleton, the

  `owner_node`/`generation` fence, the startup recovery sweep, cancellation,

  and the bounded report that lands in the conversation as a durable assistant

  message. An interrupted SCV is finished honestly rather than resumed: a

  killed coding-agent process has no session to re-attach, so a worker that

  adopts a row at a bumped generation ends it `interrupted` instead of paying

  for the same objective twice.

- **Four bounds, fixed at admission.** The objective is capped at 2,000 bytes;

  the wall clock and the captured-output ceiling are snapshotted onto the row

  when the run is admitted, so a configuration change mid-run cannot widen a

  run already in flight; the executor enforces the wall clock and this

  application independently backstops it; and the number of SCVs queued or

  running across the whole application is capped by configuration. A tripped

  concurrency ceiling refuses the call with `:scv_capacity_reached` rather

  than queueing unbounded work.

- **It reads; it does not write.** The run is admitted only under the

  `read_only` permission profile in the `opencode-core` environment, against a

  disposable clone of a forge repository at an exact 40-character revision

  resolved by the application. The caller names a repository the operator may

  read as `owner/name`; a filesystem path from a caller never reaches an SCV.

  The workspace is removed on every terminal path, including the one that runs

  when the worker died.

- **No job may deploy one.** `scv.deploy` is a turn authority only. Job

  authorities never include it, so neither a deep-work job, a delegation, a

  coding job, nor an SCV can start another SCV.

- **It is metered and visible.** Token usage is recorded into the shared

  `inference_grants` ledger, the same one the coding kind uses, so "how much

  did an SCV spend" is a query. Each run's lifecycle events reach the

  content-free public projection on the status page through the existing

  `[:openagents, :scv, :event]` telemetry, and every non-completed terminal is

  recorded as a typed incident.

- **It is off by default.** The lane is admitted only when the `scv_deploy`

  feature is enabled, which `OpenAgents.RuntimeConfig` accepts only alongside

  the work lane and tools, only with an admitted model slug and bounds, and

  only above the staging gate that admits advanced product features.

Evidence: `OpenAgents.SCV.Deployments`, `OpenAgents.Work.Scv`,

`OpenAgents.Work.ScvServer`, `OpenAgents.Tools.ScvDeploy`, `OpenAgents.Work.Job`

(the `scv` kind), `OpenAgents.RuntimeConfig`, and

`test/openagents/scv/deployments_test.exs`.

## Interface and release

### VOICE-001 — Spoken identity is admitted before media

| DEGRADE-002 | `test/openagents/tools/registry_and_runner_test.exs`, `test/openagents/tools/conversation_recall_tools_test.exs` |

| WORK-001 | `test/openagents/work_job_test.exs`, `test/openagents/deep_work_tool_loop_test.exs` |

| SELF-EDIT-001 | `test/openagents/tools/repository_mutation_tools_test.exs`, `test/openagents/coding_job_test.exs` |

| SCV-001 | `test/openagents/scv/deployments_test.exs` |

| VOICE-001 | `test/openagents/voice/config_test.exs` |

| VOICE-002 | `test/openagents_web/controllers/voice_call_controller_test.exs` |

| VOICE-003 | `test/openagents/voice_test.exs`, `test/openagents/voice_sessions_test.exs` |

    temporary_root: System.tmp_dir!(),

    client_options: []

  ],

  scv_deploy: [

    enabled: false,

    model: "opencode/x-preview-f-free",

    reasoning_effort: "low",

    opencode_api_key: nil,

    executable: nil,

    concurrency_limit: 2,

    wall_clock_ms: 900_000,

    maximum_output_bytes: 16_777_216,

    output_root: "/var/lib/openagents/scv/opencode-runs"

  ],

  tools_enabled: true,

  voice: [

    enabled: false,

    OpenAgents.Tools.CodeCheck,

    OpenAgents.Tools.RepoEdit,

    OpenAgents.Tools.RepoWrite,

    OpenAgents.Tools.RepoCommitPush

    OpenAgents.Tools.RepoCommitPush,

    OpenAgents.Tools.ScvDeploy

  ],

  conversation_reset_enabled: false,

  github_api: [

    raise "environment variable OPENAGENTS_SCV_CODEX_CREDENTIAL_REFS is required when Codex SCV accounts are enabled"

  end

  scv_deploy_enabled = parse_optional_boolean.("OPENAGENTS_FEATURE_SCV_DEPLOY")

  scv_deploy_defaults = Application.fetch_env!(:openagents, :scv_deploy)

  scv_deploy = [

    enabled: scv_deploy_enabled,

    model: optional_text.("OPENAGENTS_SCV_DEPLOY_MODEL") || scv_deploy_defaults[:model],

    reasoning_effort: scv_deploy_defaults[:reasoning_effort],

    opencode_api_key: optional_text.("OPENAGENTS_SCV_DEPLOY_OPENCODE_API_KEY"),

    executable:

      optional_text.("OPENAGENTS_SCV_DEPLOY_OPENCODE_BIN") || scv_deploy_defaults[:executable],

    concurrency_limit: scv_deploy_defaults[:concurrency_limit],

    wall_clock_ms: scv_deploy_defaults[:wall_clock_ms],

    maximum_output_bytes: scv_deploy_defaults[:maximum_output_bytes],

    output_root:

      optional_text.("OPENAGENTS_SCV_DEPLOY_OUTPUT_ROOT") || scv_deploy_defaults[:output_root]

  ]

  scv_codex = [

    enabled: scv_codex_enabled,

    execution_reaper_enabled: scv_codex_enabled,

    work: work,

    work_workers_enabled: work_enabled,

    scv_codex: scv_codex,

    scv_deploy: scv_deploy,

    semantic_index: semantic_index,

    experience_memory: experience_memory,

    graph_memory: graph_memory,

Implement ChatGPT service accounts after this individual operator flow passes

qualification. Service accounts are available only for pay-as-you-go plans.

## SCV deployment settings

The `scv_deploy` feature admits one bounded OpenCode run per SCV on OpenAgents

capacity, started only by an operator through `OpenAgents.SCV.Deployments`. See

INVARIANTS.md SCV-001. Bounds live in configuration rather than in a caller's

arguments, and the compiled defaults are the safe values.

| Environment setting | Requirement |

| --- | --- |

| `OPENAGENTS_FEATURE_SCV_DEPLOY` | `true` to admit the lane; otherwise `false` or empty |

| `OPENAGENTS_SCV_DEPLOY_MODEL` | Model slug as `provider/model`; defaults to the free OpenCode Zen model `opencode/x-preview-f-free` |

| `OPENAGENTS_SCV_DEPLOY_OPENCODE_BIN` | Absolute path to the pinned OpenCode executable; the release image uses `/usr/local/bin/opencode` |

| `OPENAGENTS_SCV_DEPLOY_OPENCODE_API_KEY` | Optional OpenCode gateway key; the default model runs without one |

| `OPENAGENTS_SCV_DEPLOY_OUTPUT_ROOT` | Durable directory for run artifacts; must not be under `/tmp` |

The compiled defaults cap concurrency at two simultaneous SCVs, the wall clock

at 15 minutes, and captured output at 16 MB. The lane runs read-only against a

disposable clone of a forge repository at an exact revision.

## Required release settings

All settings in this section are mandatory in a production release unless

| Tool embeddings | `OPENAGENTS_FEATURE_TOOL_EMBEDDINGS` | Off | Off | 14 |

| Conversation reset | `OPENAGENTS_FEATURE_CONVERSATION_RESET` | Off | Off | 14 |

| Incident fixer | `OPENAGENTS_FEATURE_INCIDENT_FIXER` | Off | Off | 14 |

| SCV deployment | `OPENAGENTS_FEATURE_SCV_DEPLOY` | Off | Off | 14 |

| Turn recovery | `OPENAGENTS_FEATURE_TURN_RECOVERY` | Off | Off | 8 |

| Forge Git service | `OPENAGENTS_FEATURE_FORGE` | Off | Off | 12 |

| Forge deployment | `OPENAGENTS_FEATURE_FORGE_DEPLOY` | Off | Off | 13 |

Invalid combinations fail closed. Recording requires voice and its encryption

key; retention requires recording; work and its recovery worker move together;

the incident fixer requires computers; deployment requires the forge; boot

the incident fixer requires computers; SCV deployment requires the work lane,

the tool catalog, and admitted bounds; deployment requires the forge; boot

convergence requires deployment; and distributed features require Horde,

discovery, node identity, cookie, and bounded distribution ports.

         {:ok, conversation_reset?} <-

           required_boolean(settings, :conversation_reset_enabled),

         {:ok, incident_fixer?} <- required_boolean(settings, :incident_fixer_enabled),

         {:ok, scv_deploy?} <- nested_boolean(settings, :scv_deploy, :enabled),

         {:ok, ra?} <- required_boolean(settings, :ra_enabled) do

      features = %{

        tools: tools?,

        work_workers: work_workers?,

        conversation_reset: conversation_reset?,

        incident_fixer: incident_fixer?,

        scv_deploy: scv_deploy?,

        ra: ra?

      }

          :shadow_programs,

          :tool_embeddings,

          :conversation_reset,

          :incident_fixer

          :incident_fixer,

          :scv_deploy

        ],

        &features[&1]

      )

      features.incident_fixer and not features.computers ->

        error(:incident_fixer_enabled, "requires computers")

      # An SCV deployment IS a work job (SCV-001): without the work lane there

      # is no durable row, no recovery sweep, and no report back into the

      # conversation, so the run would spend our capacity unaccountably.

      features.scv_deploy and not features.work ->

        error(:scv_deploy, "requires the work lane")

      features.scv_deploy and not features.tools ->

        error(:scv_deploy, "requires tools")

      features.scv_deploy and not valid_scv_deploy?(Map.get(settings, :scv_deploy)) ->

        error(:scv_deploy, "requires an admitted model, bounds, and output root")

      features.forge_deploy and not features.forge ->

        error(:forge_deploy_lane_enabled, "requires the forge")

  defp encryption_key?(_value), do: false

  # The SCV deploy lane spends our own capacity, so its ceiling is configuration

  # rather than a runtime argument: a bounded model slug, a bounded concurrency

  # limit, a wall clock, an output cap, and a durable place to keep artifacts.

  defp valid_scv_deploy?(settings) when is_list(settings) do

    model = keyword_value(settings, :model)

    is_binary(model) and byte_size(model) in 3..128 and

      Regex.match?(~r{\A[a-zA-Z0-9_.:-]+/[a-zA-Z0-9_.:-]+\z}, model) and

      keyword_integer_in?(settings, :concurrency_limit, 1..8) and

      keyword_integer_in?(settings, :wall_clock_ms, 60_000..3_600_000) and

      keyword_integer_in?(settings, :maximum_output_bytes, 65_536..67_108_864) and

      durable_path?(keyword_value(settings, :output_root))

  end

  defp valid_scv_deploy?(_settings), do: false

  defp durable_path?(path) when is_binary(path) do

    Path.type(path) == :absolute and path != "/" and

      not (path == "/tmp" or String.starts_with?(path, "/tmp/"))

defmodule OpenAgents.SCV.Deployments do

  @moduledoc """

  The one admitted entry point for deploying an SCV on our own capacity

  (SCV-001).

  Every surface that can start an SCV — Sarah's `scv_deploy` tool today, an

  operator surface tomorrow — enters here, so operator authority, the

  repository's identity, the exact revision, the objective bound, and the

  concurrency ceiling cannot drift apart between callers. This mirrors

  `OpenAgents.ComputerAgentJobs`, which does the same job for delegations to a

  person's own machine.

  Two facts make this lane different from every other tool Sarah holds, and

  both are enforced here rather than described:

  - **It spends our capacity, not the caller's.** A delegation ends on hardware

    the person owns and powers; an SCV ends on ours. So the authority required

    is operator authority — `OpenAgents.Accounts.admin?/1` — checked against the

    account behind the conversation, in the code that starts the run, not only

    in whatever advertised the tool.

  - **It is bounded before it starts.** The objective is capped, the wall clock

    and output ceiling are snapshotted onto the row at admission, and the number

    of SCVs running at once across the whole application is capped, so a model

    that decides to deploy in a loop is refused at the second or third call

    rather than at the invoice.

  The run itself is a `work_jobs` row of kind `scv`; nothing here is a second

  job system.

  """

  import Ecto.Query

  alias OpenAgents.Accounts

  alias OpenAgents.Accounts.User

  alias OpenAgents.Forge.Repos

  alias OpenAgents.Repo

  alias OpenAgents.Repositories.Membership

  alias OpenAgents.Repositories.Repository

  alias OpenAgents.Work

  alias OpenAgents.Work.Job

  alias OpenAgents.Work.Scv

  @active_statuses ~w(queued running)

  @doc """

  Start one bounded SCV deployment for an operator.

  Returns `{:ok, job}` with a queued-or-running `work_jobs` row, or a typed

  refusal. The caller acknowledges the job reference immediately; the run

  reports back into the conversation when it ends.

  """

  @spec start(User.t(), map()) :: {:ok, Job.t()} | {:error, atom()}

  def start(%User{} = user, attributes) when is_map(attributes) do

    with :ok <- feature_enabled(),

         :ok <- operator(user),

         {:ok, objective} <- objective(attributes),

         {:ok, conversation_id} <- identifier(attributes, :conversation_id),

         {:ok, owner_visitor_id} <- identifier(attributes, :owner_visitor_id),

         {:ok, repository} <- repository(user, attributes),

         {:ok, revision} <- revision(repository),

         :ok <- capacity() do

      Work.start_scv(%{

        conversation_id: conversation_id,

        owner_visitor_id: owner_visitor_id,

        surface: surface(attributes),

        goal: objective,

        delegation: %{

          "objective" => objective,

          "repository_path" => "#{repository.owner}/#{repository.name}"

        },

        authority_snapshot:

          Scv.authority_snapshot(%{owner: user, repository: repository, revision: revision}),

        budget_snapshot: Scv.budget_snapshot()

      })

    end

  end

  def start(_user, _attributes), do: {:error, :operator_required}

  @doc "How many SCV deployments are queued or running right now."

  @spec active_count() :: non_neg_integer()

  def active_count do

    Repo.aggregate(

      from(job in Job, where: job.kind == ^Scv.kind() and job.status in ^@active_statuses),

      :count

    )

  end

  @doc """

  The approval receipts that admit the SCV deployment module for one operator.

  Operating the SCV lane is an operator act, so the receipt carries

  `explicit_operator_approval` and points at the operator account. A

  non-operator receives no receipt at all, which is what makes

  `OpenAgents.Modules.SurfacePolicy` refuse the call a second time,

  independently of the check in `start/2`.

  """

  @spec approval_receipts(User.t() | nil, String.t()) :: [map()]

  def approval_receipts(user, scope_ref) when is_binary(scope_ref) do

    if Accounts.admin?(user) do

      [

        %{

          "schema" => "sarah.module_approval.v1",

          "approval_class" => "explicit_operator_approval",

          "module_id" => "sarah.tool.scv_deploy.v1",

          "version" => 1,

          "scope_ref" => scope_ref,

          "explicit" => true,

          "actor_type" => "operator",

          "receipt_ref" => "operator:#{user.id}"

        }

      ]

    else

      []

    end

  end

  # ── admission ──────────────────────────────────────────────────────────────

  defp feature_enabled do

    if Scv.enabled?(), do: :ok, else: {:error, :scv_deploy_disabled}

  end

  defp operator(user) do

    if Accounts.admin?(user), do: :ok, else: {:error, :operator_required}

  end

  defp objective(attributes) do

    case Map.get(attributes, :objective) do

      value when is_binary(value) ->

        trimmed = String.trim(value)

        if trimmed != "" and byte_size(trimmed) <= Scv.maximum_objective_bytes(),

          do: {:ok, trimmed},

          else: {:error, :scv_objective_invalid}

      _missing ->

        {:error, :scv_objective_invalid}

    end

  end

  defp identifier(attributes, key) do

    case Map.get(attributes, key) do

      value when is_binary(value) -> {:ok, value}

      _missing -> {:error, :scope_refused}

    end

  end

  defp surface(attributes) do

    case Map.get(attributes, :surface) do

      value when value in ["text", "voice"] -> value

      _other -> "text"

    end

  end

  # The repository is named the way a person names it, and resolved to a row

  # the operator may actually read. An SCV never reaches a repository through a

  # filesystem path the caller supplied.

  defp repository(user, attributes) do

    with path when is_binary(path) <- Map.get(attributes, :repository),

         [owner, name] <- String.split(String.trim(path), "/", parts: 2),

         %Repository{lifecycle_state: "ready"} = repository <- readable(user, owner, name) do

      {:ok, repository}

    else

      _unavailable -> {:error, :scv_repository_not_found}

    end

  end

  defp readable(%User{id: user_id}, owner, name) do

    owner_key = String.downcase(owner)

    name_key = String.downcase(name)

    Repo.one(

      from repository in Repository,

        left_join: membership in Membership,

        on: membership.repository_id == repository.id and membership.user_id == ^user_id,

        where:

          repository.owner_key == ^owner_key and repository.name_key == ^name_key and

            (repository.visibility == "public" or not is_nil(membership.user_id))

    )

  end

  defp revision(%Repository{} = repository) do

    if Repos.valid_storage_key?(repository.storage_key) do

      refs = Repos.refs(repository.storage_key)

      case Map.get(refs, "refs/heads/#{repository.default_branch}") do

        sha when is_binary(sha) ->

          if Regex.match?(~r/\A[0-9a-f]{40}\z/, sha),

            do: {:ok, sha},

            else: {:error, :scv_repository_revision_unavailable}

        _missing ->

          {:error, :scv_repository_revision_unavailable}

      end

    else

      {:error, :scv_repository_not_found}

    end

  end

  defp capacity do

    if active_count() < Scv.concurrency_limit(),

      do: :ok,

      else: {:error, :scv_capacity_reached}

  end

end

    run_id = Keyword.get(options, :run_id, Ecto.UUID.generate())

    output_root = Keyword.get(options, :output_root, default_output_root())

    api_key = Keyword.get(options, :api_key, System.get_env("OPENAI_API_KEY"))

    opencode_api_key = Keyword.get(options, :opencode_api_key)

    models_fetch = Keyword.get(options, :models_fetch, false)

    executable = Keyword.get(options, :executable, default_executable())

    config_seed = Keyword.get(options, :config_seed)

    diagnostic_logs = Keyword.get(options, :diagnostic_logs, false)

         :ok <- validate_permissions(permissions),

         :ok <- validate_run_id(run_id),

         {:ok, output_root} <- validate_output_root(output_root),

         :ok <- validate_api_key(api_key),

         :ok <- validate_api_key(model, api_key),

         :ok <- validate_optional_api_key(opencode_api_key),

         :ok <- validate_boolean(models_fetch, :models_fetch_invalid),

         :ok <- validate_boolean(diagnostic_logs, :diagnostic_logs_invalid),

         :ok <-

           validate_integer(

         run_id: run_id,

         output_root: output_root,

         api_key: api_key,

         opencode_api_key: opencode_api_key,

         models_fetch: models_fetch,

         executable: executable,

         config_seed: config_seed,

         diagnostic_logs: diagnostic_logs,

      input.sample_interval_ms,

      input.maximum_output_bytes,

      sample_fun,

      [input.api_key]

      [input.api_key, input.opencode_api_key]

    )

  rescue

    error ->

        executable: input.executable,

        model: input.model,

        reasoning_effort: input.reasoning_effort,

        models_fetch: input.models_fetch,

        diagnostic_logs: input.diagnostic_logs,

        config_seeded: not is_nil(input.config_seed),

        permission_profile: Atom.to_string(input.permissions),

      "LC_ALL" => "C.UTF-8",

      "LOGNAME" => "scv",

      "NO_COLOR" => "1",

      "OPENAI_API_KEY" => input.api_key,

      "OPENCODE_CLIENT" => "scv",

      "OPENCODE_CONFIG_CONTENT" => Jason.encode!(config),

      "OPENCODE_CONFIG_DIR" => paths.config,

      "OPENCODE_DISABLE_EMBEDDED_WEB_UI" => "1",

      "OPENCODE_DISABLE_EXTERNAL_SKILLS" => "1",

      "OPENCODE_DISABLE_LSP_DOWNLOAD" => "1",

      "OPENCODE_DISABLE_MODELS_FETCH" => "1",

      "OPENCODE_DISABLE_MODELS_FETCH" => if(input.models_fetch, do: "0", else: "1"),

      "OPENCODE_DISABLE_PROJECT_CONFIG" => "1",

      "OPENCODE_DISABLE_SHARE" => "1",

      "OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER" => "1",

    System.get_env()

    |> Map.new(fn {key, _value} -> {key, false} end)

    |> Map.merge(safe)

    |> put_credential("OPENAI_API_KEY", input.api_key)

    |> put_credential("OPENCODE_API_KEY", input.opencode_api_key)

  end

  # A credential this run does not hold stays scrubbed to `false` rather than

  # exported empty, so the child process cannot mistake "" for a usable key.

  defp put_credential(environment, key, value) when is_binary(value) and value != "",

    do: Map.put(environment, key, value)

  defp put_credential(environment, _key, _value), do: environment

  defp port_environment(environment) do

    Enum.map(environment, fn

      {key, false} -> {String.to_charlist(key), false}

  defp validate_output_root(_output_root), do: {:error, :output_root_invalid}

  defp validate_api_key(api_key) when is_binary(api_key) and byte_size(api_key) in 8..16_384,

    do: :ok

  # The OpenAI key is a per-provider credential, not a precondition of running

  # OpenCode. An `openai/...` model cannot answer without it; a model served by

  # any other provider (the OpenCode Zen gateway, for instance) must not be

  # blocked on a credential it never reads.

  defp validate_api_key("openai/" <> _model, api_key), do: validate_provider_key(api_key)

  defp validate_api_key(_model, nil), do: :ok

  defp validate_api_key(_model, api_key), do: validate_provider_key(api_key)

  defp validate_provider_key(api_key)

       when is_binary(api_key) and byte_size(api_key) in 8..16_384,

       do: :ok

  defp validate_provider_key(_api_key), do: {:error, :openai_api_key_missing}

  defp validate_optional_api_key(nil), do: :ok

  defp validate_optional_api_key(api_key)

       when is_binary(api_key) and byte_size(api_key) in 8..16_384,

       do: :ok

  defp validate_api_key(_api_key), do: {:error, :openai_api_key_missing}

  defp validate_optional_api_key(_api_key), do: {:error, :opencode_api_key_invalid}

  defp validate_config_seed(nil), do: {:ok, nil}

defmodule OpenAgents.Tools.ScvDeploy do

  @moduledoc """

  First-party `scv_deploy.v1`: deploys an OpenCode SCV on OpenAgents capacity.

  Every other way Sarah runs code ends on a machine the person owns. This one

  ends on ours: a bounded OpenCode run against an exact revision of a

  repository in our own forge, under the read-only permission profile, on the

  admitted model. Because it spends our capacity rather than the caller's, it

  is operator-only, and the refusal lives in

  `OpenAgents.SCV.Deployments.start/2` — the code that starts the run — not in

  this tool's description.

  The call returns immediately with a job reference. The SCV works in a durable

  background job and its bounded report lands back in the conversation as a

  message when it ends.

  """

  @behaviour OpenAgents.Tools.Tool

  alias OpenAgents.Modules.Metadata

  alias OpenAgents.SCV.Deployments

  alias OpenAgents.Tools.{ExecutionResult, OwnerContext, Tool}

  alias OpenAgents.Work.Scv

  @impl true

  def specification do

    %Tool{

      module_id: "sarah.tool.scv_deploy.v1",

      name: "scv_deploy",

      version: 1,

      description:

        "Deploys an SCV — a bounded OpenCode coding agent that runs on OpenAgents " <>

          "capacity rather than on anyone's own computer — against a repository in " <>

          "the OpenAgents forge. OPERATOR ONLY: a request from anyone who is not an " <>

          "OpenAgents operator is refused. Name the repository as owner/name; it runs " <>

          "read-only against the current head of its default branch. Returns " <>

          "immediately with a job reference: acknowledge briefly, do NOT wait, and " <>

          "the SCV's report posts back into this conversation when it finishes. " <>

          "Prefer computer_agent when the person wants work on their own machine.",

      input_schema: input_schema(),

      output_schema: output_schema(),

      side_effect: :external_effect,

      required_scope: "browser_conversation",

      required_authority: "scv.deploy",

      executor: %{

        id: "sarah.scv.opencode",

        disclosure: "A bounded OpenCode SCV running on OpenAgents capacity"

      },

      maintainer: "OpenAgents",

      attribution: ["OpenAgentsInc/openagents.com", "anomalyco/opencode"],

      policy_facets: %{

        "privacy" => "signed_browser_owner",

        "residency" => "openagents_capacity",

        "consent" => "operator_authority"

      },

      module_metadata:

        Metadata.first_party("scv.deploy", "browser_conversation",

          effect: :external_effect,

          approval_class: "explicit_operator_approval",

          privacy: "signed_browser_owner",

          residency: "openagents_capacity"

        ),

      timeout_ms: 15_000,

      maximum_input_bytes: 4_096,

      maximum_output_bytes: 4_096,

      implementation: __MODULE__,

      tags: ~w(scv deploy opencode coding agent capacity operator admin)

    }

  end

  @impl true

  def execute(%{"repository" => repository, "objective" => objective}, context)

      when is_binary(repository) and is_binary(objective) do

    # The owner behind this conversation is resolved from the application's own

    # records, never from an argument the model supplied.

    with {:ok, user} <- OwnerContext.resolve(context) do

      case Deployments.start(user, %{

             conversation_id: context.conversation_id,

             owner_visitor_id: context.owner_visitor_id,

             surface: context.surface,

             repository: repository,

             objective: objective

           }) do

        {:ok, job} ->

          {:ok,

           %ExecutionResult{

             result: %{

               "schema" => "sarah.scv_deploy_started.v1",

               "job_ref" => "work-job:#{job.id}",

               "status" => "started",

               "repository" => repository,

               "model" => Scv.model()

             },

             target_receipt_refs: ["work-job:#{job.id}"]

           }}

        {:error, reason} when is_atom(reason) ->

          {:error, reason}

        {:error, _changeset} ->

          {:error, :scv_deploy_start_failed}

      end

    end

  end

  def execute(_arguments, _context), do: {:error, :scv_deploy_request_invalid}

  defp input_schema do

    %{

      "type" => "object",

      "properties" => %{

        "repository" => %{

          "type" => "string",

          "maxLength" => 128,

          "description" =>

            "The forge repository to work in, as owner/name, for example OpenAgentsInc/openagents.com"

        },

        "objective" => %{

          "type" => "string",

          "maxLength" => Scv.maximum_objective_bytes(),

          "description" =>

            "The complete objective for the SCV, self-contained enough to run without this conversation"

        }

      },

      "required" => ["repository", "objective"],

      "additionalProperties" => false

    }

  end

  defp output_schema do

    %{

      "type" => "object",

      "properties" => %{

        "schema" => string(64),

        "job_ref" => string(128),

        "status" => string(16),

        "repository" => string(128),

        "model" => string(128)

      },

      "required" => ["schema", "job_ref", "status", "repository", "model"],

      "additionalProperties" => false

    }

  end

  defp string(maximum), do: %{"type" => "string", "maxLength" => maximum}

end

    }

  end

  # Approval receipts admitted for this turn's owner: one per paired machine

  # (the pairing IS the operator approval), plus the SCV deployment receipt

  # when — and only when — this account is an OpenAgents operator. A

  # non-operator turn simply carries no SCV receipt, so `SurfacePolicy` refuses

  # the call independently of the check inside `SCV.Deployments.start/2`.

  defp machine_approval_receipts(state) do

    Machines.approval_receipts(

      state.owner.user_id,

      "conversation:#{state.turn.conversation_id}"

    )

    scope_ref = "conversation:#{state.turn.conversation_id}"

    Machines.approval_receipts(state.owner.user_id, scope_ref) ++

      OpenAgents.SCV.Deployments.approval_receipts(owner_account(state), scope_ref)

  end

  defp owner_account(%{owner: %{user_id: user_id}}) when is_binary(user_id),

    do: OpenAgents.Repo.get(OpenAgents.Accounts.User, user_id)

  defp owner_account(_state), do: nil

  defp execution_authorities,

    do:

      MapSet.new([

        "memory.read",

        "memory.write",

        "module.discover",

        "scv.deploy",

        "work.delegate"

      ])

    start_job(Map.put(attributes, :kind, "coding"))

  end

  @doc """

  Start a durable SCV deployment (SCV-001): one bounded OpenCode run on our own

  capacity, driven by `OpenAgents.Work.ScvServer` rather than by the model

  loop, sharing the same row, statuses, fence, recovery sweep, and

  report-into-conversation ending as every other kind.

  Admission belongs to `OpenAgents.SCV.Deployments.start/2`; this only creates

  the row and starts the worker.

  """

  def start_scv(attributes) when is_map(attributes) do

    with {:ok, job} <- create_job(Map.put(attributes, :kind, "scv")) do

      case start_worker(OpenAgents.Work.ScvServer, job.id) do

        {:ok, _pid} ->

          {:ok, job}

        {:error, reason} ->

          _failure = finish_job(job.id, "failed", error_code: "worker_start_failed")

          {:error, reason}

      end

    end

  end

  # Start a job's worker as a cluster-wide singleton under Horde. Horde routes

  # the child to whichever member `choose_node` picks and relocates it to a

  # survivor if that node dies. `{:already_started, pid}` is success: the

      |> Multi.run(:coding_grant, fn _repo, %{job: job} ->

        OpenAgents.Work.Coding.settle_grant(job)

      end)

      |> Multi.run(:scv_grant, fn _repo, %{job: job} ->

        OpenAgents.Work.Scv.settle_grant(job)

      end)

      |> Repo.transaction()

    case result do

        broadcast_job(job)

        _injection = deliver_live_voice_report(job, message)

        # Kind-specific terminal cleanup (this path runs even when the worker

        # died): a coding job removes its clone and settles its grant.

        # died): a coding job removes its clone and settles its grant, and an

        # SCV deployment removes its disposable workspace.

        :ok = OpenAgents.Work.Coding.on_terminal(job)

        :ok = OpenAgents.Work.Scv.on_terminal(job)

        {:ok, job}

      {:error, :admission, {:already_terminal, job}, _changes} ->

  defp recovery_error_code(_reason), do: "worker_start_failed"

  defp worker_module("delegation"), do: OpenAgents.Work.DelegationServer

  defp worker_module("scv"), do: OpenAgents.Work.ScvServer

  defp worker_module(_kind), do: OpenAgents.Work.JobServer

  @doc """

    end

  end

  # An SCV deployment has no LLM steps of its own either — its work happened in

  # an OpenCode process on our capacity — so it gets a report that names the

  # repository and the outcome rather than a step summary that would be empty.

  defp fallback_report(_repo, %Job{kind: "scv"} = locked_job, status) do

    authority = locked_job.authority_snapshot || %{}

    path = authority["repository_path"] || "the repository"

    case status do

      "interrupted" ->

        "SCV deployment on #{path} was interrupted by a server restart before it " <>

          "finished. An SCV has no session to resume; deploy it again to continue. " <>

          "Objective: #{locked_job.goal}"

      "cancelled" ->

        "SCV deployment on #{path} was cancelled. Objective: #{locked_job.goal}"

      _other ->

        "SCV deployment on #{path} ended #{status} before reporting a result. " <>

          "Objective: #{locked_job.goal}"

    end

  end

  defp fallback_report(repo, locked_job, status) do

    steps =

      repo.all(

  @statuses ~w(queued running completed failed interrupted budget_exhausted cancelled)

  @terminal_statuses ~w(completed failed interrupted budget_exhausted cancelled)

  @surfaces ~w(text voice)

  @kinds ~w(deep_work delegation coding)

  @kinds ~w(deep_work delegation coding scv)

  @machine_tiers ~w(probe curated shell)

  @maximum_goal_bytes 2_000

  @maximum_context_hint_bytes 2_000

  # The same read-oriented text authorities as a turn, minus `memory.write`

  # (a job has no current user message to satisfy MEMORY-005 consent) and

  # minus `work.delegate` (no recursion).

  # minus `work.delegate` and `scv.deploy` (no recursion, and no job may spend

  # our own capacity on a second runtime).

  defp execution_authorities(job) do

    base =

      MapSet.new([

defmodule OpenAgents.Work.Scv do

  @moduledoc """

  The `scv` job kind's lifecycle edges (SCV-001): the bounds an SCV run is

  admitted under, the runtime options handed to the OpenCode driver, the

  disposable workspace's terminal cleanup, and metering the run's token usage

  into the same grant ledger as every other kind (`inference_grants`).

  The job itself is an ordinary `work_jobs` row driven by

  `OpenAgents.Work.ScvServer`, exactly as a computer delegation is driven by

  `OpenAgents.Work.DelegationServer`. This module only answers the

  kind-specific questions that loop asks, the way `OpenAgents.Work.Coding`

  does for the coding kind.

  """

  require Logger

  alias OpenAgents.Inference

  alias OpenAgents.Repo

  alias OpenAgents.SCV.Workspace

  alias OpenAgents.Work.Job

  @kind "scv"

  # An objective is a prompt, not a corpus. The bound is the same one a

  # delegated goal carries, so an SCV cannot smuggle in a larger instruction

  # than any other job kind.

  @maximum_objective_bytes 2_000

  @doc "Whether a job row is an SCV deployment."

  def scv?(%Job{kind: @kind}), do: true

  def scv?(_job), do: false

  @doc "The job kind string."

  def kind, do: @kind

  @doc "The largest admitted objective, in bytes."

  def maximum_objective_bytes, do: @maximum_objective_bytes

  @doc "The configured SCV deployment settings."

  def settings, do: Application.fetch_env!(:openagents, :scv_deploy)

  @doc "Whether the SCV deployment lane is admitted in this runtime."

  def enabled?, do: Keyword.fetch!(settings(), :enabled) == true

  @doc "The admitted OpenCode model slug, `provider/model`."

  def model, do: Keyword.fetch!(settings(), :model)

  @doc "How many SCV deployments may run at once across the whole application."

  def concurrency_limit, do: Keyword.fetch!(settings(), :concurrency_limit)

  @doc "The wall clock one SCV deployment is admitted for, in milliseconds."

  def wall_clock_ms, do: Keyword.fetch!(settings(), :wall_clock_ms)

  @doc "The largest process output one SCV deployment may capture, in bytes."

  def maximum_output_bytes, do: Keyword.fetch!(settings(), :maximum_output_bytes)

  @doc """

  The bounded execution budget recorded on the job row at admission.

  The job reads its wall clock from this immutable snapshot rather than from

  configuration, so a configuration change mid-run cannot widen a run that was

  already admitted.

  """

  def budget_snapshot do

    %{

      "wall_clock_ms" => wall_clock_ms(),

      "maximum_objective_bytes" => @maximum_objective_bytes,

      "maximum_output_bytes" => maximum_output_bytes(),

      "maximum_report_bytes" => Job.maximum_report_bytes()

    }

  end

  @doc "The runtime authority recorded on the job row at admission."

  def authority_snapshot(%{owner: owner, repository: repository, revision: revision}) do

    %{

      "driver" => "opencode",

      "environment" => "opencode-core",

      "permission_profile" => "read_only",

      "model" => model(),

      "repository_id" => repository.id,

      "repository_path" => "#{repository.owner}/#{repository.name}",

      "repository_revision" => revision,