returns — an offline or revoked computer, a busy target, a protected branch, a

disabled controller — is shown as itself.

**A live attempt is shown, not narrated.** `Assignments.report_claim/1`,

`report/1`, and `report_release/1` wrote the claim, the result, and the release

as Markdown comments on the issue. Every fact in them is a column of

`forge_assignments`, so the timeline derives them and the write path writes

nothing. Comments already written stay and still render; only new ones stop.

That prose was a surface asserting things nothing could contradict. "Assignment

claim released" described the credential revocation, which lives in

`forge_assignment_credentials.revoked_at` and which `finish/1` sets in the same

transaction that makes an attempt terminal — for *every* terminal state, while

the comment fired for `failed` and `cancelled` only. Nothing compared the

sentence to the row. `report_claim/1` was also load-bearing: `create/1` failed

the whole assignment as `claim_event_failed` when the comment could not be

written, so a failure of the comment table could fail agent work. Both are gone.

One thing the prose carried that no record holds is now published as a kind

rather than an id: the comments were authored by the requesting agent, so an

agent-requested attempt named the agent and a person's own attempt named

nobody at all. The attempt's `requester_kind` — `user` or `agent`, at `pulse`

— replaces it under TRANSPARENCY-001's rule that a principal's kind is

published and its id is not. The specific agent's identity is deliberately not

restored.

**The page moves when the attempt moves, and re-reads to find out how.**

`IssueShowLive` subscribes to `issue_attempts:{issue_id}` at mount.

`Assignments.announce/1` broadcasts `{:attempts_changed, issue_id}` and nothing

else — not the state, not the branch, not the row, because each of those is

disclosed at a rung and a message carrying one would carry it past the gate

that decides the rung. The subscriber marks the panel stale and re-reads

through `refresh_panel/2`, which re-resolves the repository with

`Repositories.get_visible_repository/2` and rebuilds the attempts at this

viewer's own `WorkDisclosure.viewer/2` rung, so a viewer whose membership was

removed while the socket was open loses the branch on the next announcement.

Elapsed time is a clock and not a poll: a one-second timer, armed only while an

attempt is live, that re-reads nothing and recomputes from the attempt's own

start.

**Cancelling reaches the same terminal path.** A viewer with write authority

cancels from the issue; `Assignments.cancel/2` reads that authority from the

attempt's own repository rather than from the socket, and reaches `finish/1`,

so a cancelled attempt revokes its credential, releases its issue claim, and

binds its evidence exactly as a failure does. A reader is offered no control

and a crafted event cancels nothing. An attempt that started and never finished

renders as started and nothing more: the timeline invents no terminal event.

Evidence: `OpenAgentsWeb.IssueShowLive`, `OpenAgents.Forge.Assignments`,

`OpenAgents.ComputerAgentJobs`, and

`test/openagents_web/live/issue_start_work_live_test.exs`.

`OpenAgents.ComputerAgentJobs`,

`test/openagents_web/live/issue_start_work_live_test.exs`,

`test/openagents_web/live/issue_live_work_test.exs`, and

`test/openagents/forge/assignment_test.exs`.

(Amended 2026-08-24, issue #147: an attempt was narrated in prose and shown

without moving. It is now shown, live, and narrated nowhere.)

### CAPACITY-001 — Capacity is a bounded, owner-safe quantity projection

| FORUM-001 | `test/openagents/forum/legacy_surface_test.exs`, `test/openagents_web/live/forum_live_test.exs`, `test/openagents_web/route_authority_test.exs`, `test/openagents_web/sidebar_state_test.exs` |

| ISSUE-002 | `test/openagents/issues/task_list_test.exs`, `test/openagents/issues/task_references_test.exs`, `test/openagents_web/live/issue_show_live_test.exs` |

| ISSUE-003 | `test/openagents/issues/evidence_test.exs`, `test/openagents_web/controllers/issue_controller_test.exs` |

| ISSUE-004 | `test/openagents_web/live/issue_start_work_live_test.exs` |

| ISSUE-004 | `test/openagents_web/live/issue_live_work_test.exs`, `test/openagents_web/live/issue_start_work_live_test.exs` |

   does store and says so in its own moduledoc

   (`lib/openagents_web/live/issue_show_live.ex:22`). Agent activity reaches

   the issue as Markdown comments written by `Assignments.report_claim/1`,

   `report/1`, and `report_release/1` (`assignments.ex:371`, `:338`, `:356`).

   That is precisely what `#69` refuses: "link work jobs and commits through

   `report/1`, and `report_release/1` (`assignments.ex:371`, `:338`, `:356`)

   — all three retired in stage 3. That is precisely what `#69` refuses: "link work jobs and commits through

   stable identifiers, not free-form commit messages alone".

3. **The commit-to-receipt chain is complete and already joined — by sha, not

   by issue.** `changelog_entries` carries `push_receipt_id`,

distinction `IssueJSON` already draws for the dependency graph

(`lib/openagents_web/controllers/issue_json.ex:2`).

One duplication is now visible and is deliberate for stage 1: the same

attempt appears both as a derived timeline event and as the Markdown comment

`Assignments.report/1` writes. Stage 3 retires the comment in favor of the

derived event. Doing it in stage 1 would delete history from issues that

already carry those comments, which is a migration, not a read.

One duplication was visible and deliberate for stage 1: the same attempt

appeared both as a derived timeline event and as the Markdown comment

`Assignments.report/1` wrote. Stage 3 retired the three comments in favor of

the derived events. Doing it in stage 1 would have deleted history from issues

that already carry those comments, which is a migration, not a read — so the

write path stopped and the existing comments stayed.

---

conversation. Nothing new stores work; the button reaches the same admission.

This is E2, and `#10`'s "start bounded agent work from an issue".

### Stage 3 — live activity, and retiring the narration

### Stage 3 — live activity, and retiring the narration (shipped)

**Seam:** `IssueShowLive` and `Assignments.report*/1`.

**Size:** small, plus one backfill decision.

the derived events carry the same facts. Existing comments stay; only new ones

stop. This is E3.

What shipped, and the one thing the prose carried that no record held. The

three comments restated columns of `forge_assignments`, with two exceptions.

"Assignment claim released" described `forge_assignment_credentials.revoked_at`

— a real record in a different table — and fired for `failed` and `cancelled`

while `finish/1` revokes for every terminal state, so the sentence was narrower

than the fact and nothing compared them. And the comments were authored by the

requesting agent, so an agent-requested attempt named the agent while a

person's own attempt named nobody; the attempt now publishes `requester_kind`

at `pulse` instead, which is the kind TRANSPARENCY-001 admits and not the id it

does not. `report_claim/1` was additionally load-bearing — `create/1` failed the

assignment as `claim_event_failed` when the comment could not be written — and

that coupling is gone with it. See `INVARIANTS.md`, ISSUE-004.

### Stage 4 — bind receipts to the exact commit (shipped)

**Seam:** a new `issue_evidence` edge table, and `#130`'s extraction.

empty, so the edge must be written when the receipt is written rather than

scanned for later. This is E4 and E5.

### Stage 5 — tiers over work and receipts

### Stage 5 — tiers over work and receipts (shipped)

**Seam:** `ArtifactLink.artifact_types/0` and every issue-timeline read.

**Size:** small storage change, wide read change.

acceptance property is `#70`'s: the same viewer gets the same answer on the

web page, the API, and an export. This is E6.

What shipped: `OpenAgents.Transparency.WorkDisclosure`, a field-by-field

schedule rather than a per-record verdict, because an attempt's branch, a work

job's report, and an evidence edge's environment are not one decision. Every

column of the three tables is either the source of exactly one scheduled field

or a member of that family's never list. There was no artifact-type check

constraint to add the members to — `#70` constrained the tier only — so the

type and ref-kind vocabularies are constraints now too. `trace` is in the

vocabulary with no producer, and the enumeration says so. There is no separate

issue export, so the acceptance property is proved over the two surfaces that

exist and stated over the projection function, which a future export inherits.

See `INVARIANTS.md`, TRANSPARENCY-001.

### Stage 6 — close from verified outcomes

**Seam:** a durable claim record and a per-repository policy.

  alias OpenAgents.Box.ConversationBox

  alias OpenAgents.BoxRuns

  alias OpenAgents.Forge.{Assignment, AssignmentCredential, AssignmentCredentialVault}

  alias OpenAgents.Issues

  alias OpenAgents.Issues.{Evidence, Issue}

  alias OpenAgents.Repo

  alias OpenAgents.Conversations

           ),

         {:ok, assignment, plaintext} <-

           persist_assignment(target_kind, target, repository, issue, branch, principal, attrs) do

      case report_claim(assignment) do

        {:ok, _comment} ->

          start_target(assignment, target, target_kind, plaintext, attrs, owner, conversation)

        {:error, reason} ->

          _ = finish(assignment, "failed", nil, "claim_event_failed")

          {:error, reason}

      end

      _ = announce(assignment)

      start_target(assignment, target, target_kind, plaintext, attrs, owner, conversation)

    end

  end

              |> Repo.update!()

          end

        _ = announce(assignment)

        {:ok, assignment, plaintext}

      {:error, reason} ->

      |> Assignment.changeset(%{state: "running", started_at: DateTime.utc_now()})

      |> Repo.update!()

    _ = announce(assignment)

    params = %{

      "prompt" => attrs[:prompt] || attrs["prompt"] || "",

      "cwd" => attrs[:cwd] || attrs["cwd"] || "",

        # a receipt that already landed. Never load-bearing: an attempt that

        # finished is finished whether or not its evidence could be written.

        _ = Evidence.bind_attempt(updated)

        _ = report(updated)

        if updated.state in ["failed", "cancelled"], do: _ = report_release(updated)

        _ = announce(updated)

        {:ok, updated}

      {:ok, {:already_finished, current}} ->

    :ok

  end

  @doc "Returns the assignment credential metadata without exposing its secret."

  def credential(%Assignment{id: id}) do

    Repo.one(from c in AssignmentCredential, where: c.assignment_id == ^id)

  end

  @doc """

  Subscribes the caller to the attempts on one issue.

  @doc "Reports the terminal result once on the issue timeline."

  def report(%Assignment{} = assignment) do

    issue = Repo.get!(Issue, assignment.issue_id)

  The topic carries announcements, not rows. A subscriber is told that the

  attempts on an issue moved and re-reads them through its own authorized

  read, so a message can never hand anybody an attempt their repository

  membership — or their transparency tier — would have withheld.

  """

  @spec subscribe_attempts(integer()) :: :ok | {:error, term()}

  def subscribe_attempts(issue_id) when is_integer(issue_id),

    do: Phoenix.PubSub.subscribe(OpenAgents.PubSub, attempts_topic(issue_id))

    body =

      [

        "#{target_label(assignment)} assignment finished.",

        "Branch: `#{assignment.terminal_branch || assignment.branch}`.",

        "Commit: `#{assignment.terminal_commit || "none reported"}`.",

        "Result: `#{assignment.state}`.",

        if(assignment.failure_reason, do: "Reason: `#{assignment.failure_reason}`.", else: nil)

      ]

      |> Enum.reject(&is_nil/1)

      |> Enum.join("\n")

  @doc "Unsubscribes the caller from the attempts on one issue."

  @spec unsubscribe_attempts(integer()) :: :ok

  def unsubscribe_attempts(issue_id) when is_integer(issue_id),

    do: Phoenix.PubSub.unsubscribe(OpenAgents.PubSub, attempts_topic(issue_id))

    Issues.create_comment(issue, %{body: body}, author(assignment.requesting_principal))

  end

  @doc """

  Announces that the attempts on an issue moved.

  @doc "Reports the release of a failed or cancelled issue claim."

  def report_release(%Assignment{} = assignment) do

    issue = Repo.get!(Issue, assignment.issue_id)

  The message is `{:attempts_changed, issue_id}` and carries nothing else. Not

  the state, not the branch, not the attempt: every one of those is disclosed

  at a rung, and a message carrying one would carry it past the gate that

  decides the rung.

  """

  @spec announce(Assignment.t()) :: :ok

  def announce(%Assignment{issue_id: issue_id}) when is_integer(issue_id),

    do:

      Phoenix.PubSub.broadcast(

        OpenAgents.PubSub,

        attempts_topic(issue_id),

        {:attempts_changed, issue_id}

      )

  def announce(%Assignment{}), do: :ok

    body =

      [

        "#{target_label(assignment)} assignment claim released.",

        "Branch: `#{assignment.branch}`.",

        "Assignment: `#{assignment.id}`."

      ]

      |> Enum.join("\n")

  defp attempts_topic(issue_id), do: "issue_attempts:#{issue_id}"

    Issues.create_comment(issue, %{body: body}, author(assignment.requesting_principal))

  @doc """

  Cancels a live attempt on behalf of a viewer with write authority.

  The authority is read from the attempt's own repository rather than from

  whatever the caller believes about itself, so a stale socket assign cannot

  cancel anybody's work. It reaches `finish/1` — the one terminal path — so a

  cancelled attempt revokes its credential, releases its issue claim, and binds

  its evidence exactly as a failure does.

  """

  @spec cancel(String.t(), OpenAgents.Accounts.User.t() | nil) ::

          {:ok, Assignment.t()} | {:error, atom()}

  def cancel(assignment_id, user) when is_binary(assignment_id) do

    case Repo.get(Assignment, assignment_id) do

      nil ->

        {:error, :assignment_not_found}

      %Assignment{} = assignment ->

        cond do

          Assignment.terminal?(assignment) ->

            {:error, :assignment_not_live}

          not writable_by?(assignment, user) ->

            {:error, :repository_not_writable}

          true ->

            finish(assignment, "cancelled", nil, "cancelled_by_viewer")

        end

    end

  end

  @doc "Reports the claim before the Box run starts."

  def report_claim(%Assignment{} = assignment) do

    issue = Repo.get!(Issue, assignment.issue_id)

  def cancel(_assignment_id, _user), do: {:error, :assignment_not_found}

    body =

      [

        "#{target_label(assignment)} assignment claimed.",

        "Branch: `#{assignment.branch}`.",

        "Assignment: `#{assignment.id}`."

      ]

      |> Enum.join("\n")

  defp writable_by?(%Assignment{repository_id: repository_id}, user) do

    case Repo.get(Repository, repository_id) do

      %Repository{} = repository -> OpenAgents.Repositories.writable?(repository, user)

      nil -> false

    end

  end

    Issues.create_comment(issue, %{body: body}, author(assignment.requesting_principal))

  @doc "Returns the assignment credential metadata without exposing its secret."

  def credential(%Assignment{id: id}) do

    Repo.one(from c in AssignmentCredential, where: c.assignment_id == ^id)

  end

  defp persist_assignment(target_kind, target, repository, issue, branch, principal, attrs) do

  defp usable?(_), do: false

  defp author(%{"actor_type" => "agent", "actor_id" => id}), do: Repo.get!(Agent, id)

  defp author(_), do: nil

  defp target_label(%Assignment{target_kind: "computer"}), do: "Computer"

  defp target_label(_), do: "Box"

  defp digest(value), do: :crypto.hash(:sha256, value)

end

    # move as well.

    if connected?(socket) do

      Repositories.subscribe_issues(repository.id)

      Assignments.subscribe_attempts(issue.id)

      Labels.subscribe_labels(repository.id)

      Milestones.subscribe_milestones(repository.id)

    end

    end)

  end

  def handle_event("cancel_work", _params, socket) do

    with_authority(socket, :can_write, "You cannot cancel work on this issue.", fn socket ->

      {:noreply, cancel_work(socket)}

    end)

  end

  def handle_event("toggle_label", %{"name" => name}, socket) do

    with_authority(

      socket,

      when message in [:labels_changed, :milestones_changed],

      do: {:noreply, socket}

  # An attempt moved. The message carries the issue id and nothing else, so

  # this re-reads through `refresh_panel/2` — which re-resolves the repository

  # for this viewer and rebuilds the attempts at this viewer's rung — rather

  # than assigning anything the announcement handed it.

  def handle_info({:attempts_changed, issue_id}, socket)

      when issue_id == socket.assigns.issue.id,

      do: {:noreply, LiveRefresh.mark_stale(socket, :issue, &refresh_panel/2)}

  def handle_info({:attempts_changed, _other_issue}, socket), do: {:noreply, socket}

  # The clock, not a poll. It re-reads nothing: elapsed time is `now` minus the

  # attempt's own start, and the attempt itself moves only when its topic says

  # so. The timer stops itself when the attempt ends.

  def handle_info(:attempt_tick, socket) do

    if socket.assigns[:live_attempt] do

      {:noreply, socket |> assign(:now, DateTime.utc_now()) |> schedule_tick()}

    else

      {:noreply, assign(socket, :ticking?, false)}

    end

  end

  def handle_info(:live_refresh, socket),

    do: {:noreply, LiveRefresh.run(socket, &refresh_panel/2)}

  defp refusal(_reason, _socket), do: "Work was refused."

  # The control is hidden without write authority and the event is refused

  # without it too: `Assignments.cancel/2` reads the authority from the

  # attempt's own repository, so a socket that kept a stale `can_write` cannot

  # end anybody's work.

  defp cancel_work(socket) do

    case live_attempt(socket.assigns[:attempts] || []) do

      %{id: id} ->

        case Assignments.cancel(id, socket.assigns.current_user) do

          {:ok, _assignment} ->

            socket

            |> put_flash(:info, "Work cancelled.")

            |> load(socket.assigns.issue)

          {:error, reason} ->

            put_flash(socket, :error, cancel_refusal(reason))

        end

      nil ->

        put_flash(socket, :error, "No work is running on this issue.")

    end

  end

  defp cancel_refusal(:assignment_not_live), do: "That work already finished."

  defp cancel_refusal(:assignment_not_found), do: "That work no longer exists."

  defp cancel_refusal(:repository_not_writable),

    do: "You cannot cancel work on this repository."

  defp cancel_refusal(_reason), do: "Work could not be cancelled."

  defp schedule_tick(socket) do

    Process.send_after(self(), :attempt_tick, 1_000)

    socket

  end

  # How long the live attempt has been running, from the fields `pulse`

  # already publishes. A reader who cannot see the branch can still see this.

  defp elapsed(%{} = attempt, %DateTime{} = now) do

    case attempt[:started_at] || attempt[:admitted_at] do

      %DateTime{} = start -> humanize_seconds(max(DateTime.diff(now, start, :second), 0))

      _unknown -> nil

    end

  end

  defp elapsed(_attempt, _now), do: nil

  defp humanize_seconds(seconds) when seconds < 60, do: "#{seconds}s"

  defp humanize_seconds(seconds) when seconds < 3_600,

    do: "#{div(seconds, 60)}m #{rem(seconds, 60)}s"

  defp humanize_seconds(seconds), do: "#{div(seconds, 3_600)}h #{div(rem(seconds, 3_600), 60)}m"

  # One place rebuilds everything derived from the issue, so a write cannot

  # leave the timeline describing the previous version of the page.

  defp load(socket, issue) do

    |> assign(:form, to_form(Issues.change_issue(issue)))

    |> assign(:events, timeline(issue, comments, attempts, references, syncs, base))

    |> assign(:subscribed?, subscribed?(issue, socket.assigns.current_user))

    |> assign(:now, DateTime.utc_now())

    |> arm_tick()

  end

  # The clock is armed only while an attempt is live, so an issue nobody is

  # working on costs no timer at all, and only on the transition into a live

  # attempt, so a re-read cannot stack timers.

  defp arm_tick(socket) do

    live? = not is_nil(socket.assigns[:live_attempt])

    ticking? = socket.assigns[:ticking?] == true

    cond do

      live? and not ticking? and connected?(socket) ->

        socket |> assign(:ticking?, true) |> schedule_tick()

      not live? ->

        assign(socket, :ticking?, false)

      true ->

        socket

    end

  end

  defp subscribed?(_issue, nil), do: false

          <%!-- Outside the properties panel too, and for the opposite

          reason: everything in that panel edits the issue record, and this

          starts an execution somewhere else. It needs write authority, which

          is what `Assignments.create/1` re-checks server-side, so the control

          is hidden and the event is refused rather than only hidden. --%>

          <section :if={@can_write} id="issue-work" class="properties-panel__group">

          starts an execution somewhere else. Starting and cancelling need

          write authority, which `Assignments.create/1` and

          `Assignments.cancel/2` re-check server-side, so each control is

          hidden and its event is refused rather than only hidden. That a live

          attempt exists, and how long it has run, is not a write and is shown

          to any reader who reached the issue. --%>

          <section :if={@can_write or @live_attempt} id="issue-work" class="properties-panel__group">

            <h3 class="properties-panel__heading">Agent work</h3>

            <p :if={@live_attempt} class="properties-panel__none" id="issue-work-live">

              Work is running{live_attempt_branch(@live_attempt)}. One attempt may be live

              on an issue at a time.

            </p>

            <div :if={@live_attempt} id="issue-work-live">

              <p class="properties-panel__none">

                Work is <span id="issue-work-state">{@live_attempt.state}</span>{live_attempt_branch(

                  @live_attempt

                )}, for <span id="issue-work-elapsed">{elapsed(@live_attempt, @now)}</span>.

                One attempt may be live on an issue at a time.

              </p>

              <.button

                :if={@can_write}

                id="issue-work-cancel"

                variant={:ghost}

                size={:sm}

                data-tone="danger"

                phx-click="cancel_work"

              >

                Cancel work

              </.button>

            </div>

            <p

              :if={is_nil(@live_attempt) and @work_computers == []}

              :if={@can_write and is_nil(@live_attempt) and @work_computers == []}

              class="properties-panel__none"

              id="issue-work-unavailable"

            >

            </p>

            <.form

              :if={is_nil(@live_attempt) and @work_computers != []}

              :if={@can_write and is_nil(@live_attempt) and @work_computers != []}

              for={@work_form}

              id="issue-work-form"

              phx-change="preview_work"

             GitReceivePack.refs(pkt_line("malformed\n") <> "0000")

  end

  test "assignment claim and release are visible on the issue timeline" do

  test "an attempt narrates nothing, and its terminal record carries what the prose did" do

    user = repository_user_fixture("assignment-timeline")

    {:ok, repository} =

      })

      |> Repo.insert!()

    assert {:ok, _comment} = OpenAgents.Forge.Assignments.report_claim(assignment)

    assert {:ok, _finished} =

    %AssignmentCredential{}

    |> AssignmentCredential.changeset(%{

      assignment_id: assignment.id,

      token_digest: :crypto.hash(:sha256, "oa_assignment_timeline"),

      last_four: "abcd",

      repository_id: repository.id,

      branch: "agent/timeline",

      expires_at: DateTime.add(now, 60, :second)

    })

    |> Repo.insert!()

    assert {:ok, finished} =

             OpenAgents.Forge.Assignments.finish(assignment, "failed", nil, "test")

    bodies =

      Repo.all(

        from comment in Comment,

          where: comment.issue_id == ^issue.id,

          order_by: [asc: comment.created_at],

          select: comment.body

      )

    assert Enum.any?(bodies, &String.contains?(&1, "Box assignment claimed."))

    assert Enum.any?(bodies, &String.contains?(&1, "claim released."))

    # The claim, the result, and the release were three Markdown comments the

    # attempt wrote about itself. Every fact in them is in this row, so the

    # timeline derives them and the write path writes nothing.

    assert Repo.all(from comment in Comment, where: comment.issue_id == ^issue.id) == []

    assert finished.state == "failed"

    assert finished.failure_reason == "test"

    assert finished.finished_at

    assert finished.terminal_branch == "agent/timeline"

    # "Claim released" described the credential revocation, and this is the

    # record it described. `finish/1` revokes in the same transaction that

    # makes the attempt terminal, for every terminal state — the comment fired

    # for only two of the three, and nothing compared the two.

    assert [%{revoked_at: revoked_at}] =

             Repo.all(

               from credential in AssignmentCredential,

                 where: credential.assignment_id == ^assignment.id

             )

    assert revoked_at

    assert Repo.get!(OpenAgents.Issues.Issue, issue.id).state == "open"

  end

    assert assignment.requesting_principal["type"] == "agent"

    assert assignment.requesting_principal["id"] == agent.id

    assert Agents.box_control_owner(agent).id == owner.id

    assert %Comment{author_agent_id: agent_id} = Repo.get_by(Comment, issue_id: issue.id)

    assert agent_id == agent.id

    # The agent that asked is on the attempt, which is where it belongs. It

    # used to be read from the author of a narration comment; that comment is

    # retired (#147) and the issue carries none.

    assert is_nil(Repo.get_by(Comment, issue_id: issue.id))

  end

  test "a foreign box returns 404 without an outbound provider request", %{conn: conn} do

defmodule OpenAgentsWeb.IssueLiveWorkTest do

  @moduledoc """

  Stage 3 of `#10`: show a running attempt live, and stop narrating it.

  The narration went because it was a surface asserting things nothing could

  contradict. Three Markdown comments restated `forge_assignments` in prose,

  one of them — "claim released" — describing a credential revocation in a

  different table, for two of the three terminal states, while `finish/1`

  revokes for all three. Nothing compared the sentence to the row.

  What replaces it is the row. These tests hold the three properties that makes

  possible: the page moves when the attempt moves, the announcement that moves

  it carries an id and nothing else, and the re-read it triggers goes through

  the viewer's own authorization rather than through whatever the socket last

  believed.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Ecto.Query

  import Phoenix.LiveViewTest

  alias OpenAgents.Forge.{Assignment, Assignments}

  alias OpenAgents.Issues

  alias OpenAgents.Repo

  alias OpenAgents.Repositories

  @sha String.duplicate("ab", 20)

  setup %{conn: conn} do

    repository = Repositories.get_by_path!("OpenAgentsInc", "openagents.com")

    member = github_user("issue-live-work-member")

    {:ok, _} = Repositories.add_member(repository, member, "maintainer")

    {:ok, issue} = Issues.create_issue(repository, %{title: "Watch the work"})

    %{

      conn: Plug.Test.init_test_session(conn, %{"user_id" => member.id}),

      member: member,

      repository: repository,

      issue: issue

    }

  end

  defp path(issue), do: ~p"/OpenAgentsInc/openagents.com/issues/#{issue.number}"

  describe "the announcement" do

    test "carries the issue id and nothing else", context do

      :ok = Assignments.subscribe_attempts(context.issue.id)

      attempt = attempt(context)

      Assignments.announce(attempt)

      issue_id = context.issue.id

      assert_receive {:attempts_changed, ^issue_id}

      # Nothing else arrives, so nothing carried the branch, the state, the

      # revision, or the row. A subscriber that wants any of those must re-read

      # for them, which is the only place a gate can run.

      refute_receive {:attempts_changed, _issue_id, _anything}

      refute_receive %Assignment{}

    end

    test "reaches only the issue it names", context do

      {:ok, other} = Issues.create_issue(context.repository, %{title: "Elsewhere"})

      :ok = Assignments.subscribe_attempts(other.id)

      Assignments.announce(attempt(context))

      refute_receive {:attempts_changed, _issue_id}

    end

  end

  describe "a running attempt on the page" do

    test "renders its state and how long it has been running", context do

      attempt(context, started_at: DateTime.add(DateTime.utc_now(), -90, :second))

      {:ok, view, _html} = live(context.conn, path(context.issue))

      assert has_element?(view, "#issue-work-live")

      assert render(view) =~ "running"

      assert has_element?(view, "#issue-work-elapsed")

      assert render(view) =~ "1m 3"

    end

    test "lands its terminal event without a reload", context do

      attempt = attempt(context)

      {:ok, view, _html} = live(context.conn, path(context.issue))

      assert has_element?(view, "#issue-work-live")

      refute render(view) =~ "finished this work"

      # The production terminal path, which announces on the topic the page

      # subscribed to at mount. Nothing here touches the view.

      {:ok, _finished} = Assignments.finish(attempt, "completed", @sha)

      html = render(view)

      assert html =~ "finished this work at #{String.slice(@sha, 0, 7)}"

      refute has_element?(view, "#issue-work-live")

    end

    test "an attempt that started and never finished renders as started only", context do

      attempt(context)

      {:ok, view, _html} = live(context.conn, path(context.issue))

      html = render(view)

      assert html =~ "started work on a box"

      refute html =~ "finished this work"

      refute html =~ "stopped this work"

      refute html =~ "cancelled this work"

    end

  end

  describe "cancelling" do

    test "a viewer with write authority ends the attempt through the terminal path",

         context do

      attempt = attempt(context)

      {:ok, view, _html} = live(context.conn, path(context.issue))

      assert has_element?(view, "#issue-work-cancel")

      render_click(view, "cancel_work", %{})

      cancelled = Repo.get!(Assignment, attempt.id)

      assert cancelled.state == "cancelled"

      assert cancelled.failure_reason == "cancelled_by_viewer"

      assert cancelled.finished_at

      refute has_element?(view, "#issue-work-live")

      assert render(view) =~ "cancelled this work"

    end

    test "a reader without write authority is offered no control and refused the event",

         context do

      attempt = attempt(context)

      {:ok, view, _html} = live(build_conn(), path(context.issue))

      refute has_element?(view, "#issue-work-cancel")

      render_click(view, "cancel_work", %{})

      assert Repo.get!(Assignment, attempt.id).state == "running"

    end

    test "is refused for an attempt that already finished", context do

      attempt = attempt(context)

      {:ok, _} = Assignments.finish(attempt, "completed", @sha)

      assert {:error, :assignment_not_live} = Assignments.cancel(attempt.id, context.member)

    end

    test "reads its authority from the attempt's own repository", context do

      attempt = attempt(context)

      stranger = github_user("issue-live-work-stranger")

      assert {:error, :repository_not_writable} = Assignments.cancel(attempt.id, stranger)

      assert {:error, :repository_not_writable} = Assignments.cancel(attempt.id, nil)

      assert Repo.get!(Assignment, attempt.id).state == "running"

    end

  end

  describe "the re-read the announcement triggers" do

    test "runs through this viewer's own authority, not the one it mounted with",

         context do

      attempt(context)

      {:ok, view, _html} = live(context.conn, path(context.issue))

      # A member reads the attempt at `ledger`, so the branch is on the page.

      assert render(view) =~ "agent/watched"

      # Authority changes underneath a mounted socket. Nothing tells the view.

      Repo.delete_all(

        from membership in OpenAgents.Repositories.Membership,

          where:

            membership.repository_id == ^context.repository.id and

              membership.user_id == ^context.member.id

      )

      Assignments.announce(Repo.get!(Assignment, attempt_id(context)))

      # The re-read went through `Repositories.get_visible_repository/2` and

      # `WorkDisclosure.viewer/2` again, so the reader dropped to `pulse` and

      # the branch left the page. A message that carried the attempt would have

      # put it back.

      html = render(view)

      refute html =~ "agent/watched"

      refute has_element?(view, "#issue-work-cancel")

    end

  end

  defp attempt_id(context) do

    Repo.one!(from a in Assignment, where: a.issue_id == ^context.issue.id, select: a.id)

  end

  defp attempt(context, opts \\ []) do

    now = DateTime.utc_now() |> DateTime.truncate(:microsecond)

    started_at = Keyword.get(opts, :started_at, now) |> DateTime.truncate(:microsecond)

    %Assignment{}

    |> Assignment.changeset(%{

      target_kind: "box",

      conversation_box_id: box(context).id,

      repository_id: context.repository.id,

      issue_id: context.issue.id,

      requesting_principal: %{

        "type" => "user",

        "id" => context.member.id,

        "actor_type" => "user",

        "actor_id" => context.member.id

      },

      branch: "agent/watched",

      state: "running",

      admitted_at: started_at,

      started_at: started_at,

      deadline_at: DateTime.add(now, 3_600, :second)

    })

    |> Repo.insert!()

  end

  defp box(context) do

    {:ok, conversation} = OpenAgents.Conversations.ensure_conversation(context.member)

    {:ok, box} =

      %OpenAgents.Box.ConversationBox{}

      |> OpenAgents.Box.ConversationBox.changeset(%{

        conversation_id: conversation.id,

        box_id: "bx_live_work_#{System.unique_integer([:positive])}",

        state: "ready",

        setup_status: "done"

      })

      |> Repo.insert()

    box

  end

end