}

  end

  def gate_receipts_for(repo, sha, opts \\ []) when is_binary(repo) and is_binary(sha) do

    git_common_dir = Keyword.get(opts, :git_common_dir, OpenAgents.Forge.Repos.bare_path(repo))

    case OpenAgents.Forge.GateReceipt.verify(sha, git_common_dir: git_common_dir) do

      {:ok, receipt} -> %{gates: [receipt]}

      _ -> %{gates: []}

    end

  end

  @doc "Prefix-match two shas in either direction (short vs full), ≥7 chars."

  def sha_match?(a, b) when is_binary(a) and is_binary(b) do

    min(byte_size(a), byte_size(b)) >= 7 and

  @doc "Return the default receipt path for an exact Git SHA."

  def path(sha, opts \\ []) do

    root = Keyword.get_lazy(opts, :repo_root, &repo_root!/0)

    Path.join([root, ".git", "openagents", "release-gate-receipts", "#{sha}.json"])

    case Keyword.fetch(opts, :git_common_dir) do

      {:ok, git_common_dir} ->

        Path.join([git_common_dir, "openagents", "release-gate-receipts", "#{sha}.json"])

      :error ->

        root = Keyword.get_lazy(opts, :repo_root, &repo_root!/0)

        Path.join([root, ".git", "openagents", "release-gate-receipts", "#{sha}.json"])

    end

  end

  defp verify_receipt(sha, opts) do

defmodule OpenAgents.Issues.Activity do

  @moduledoc """

  The agent work and forge receipts that name an issue, scoped to a reader.

  The read is assembled from records that already exist. Threads that named the

  issue are read through `OpenAgents.Threads.list_for_issue/2`, so a thread's

  own visibility rules stay in force. Receipts are reached from the commit

  references an issue already claims through `OpenAgents.Issues.ClosingReferences`,

  using `OpenAgents.Forge.receipts_for/2` to scan the commit's push, build,

  target, and deployment receipts. No new work record, no new linkage table, and

  no new repository authority: the repository is checked once and the thread

  authority is composed rather than restated.

  """

  alias OpenAgents.Accounts.User

  alias OpenAgents.Forge

  alias OpenAgents.Issues.{ClosingReferences, Issue}

  alias OpenAgents.Repositories

  alias OpenAgents.Repositories.Repository

  alias OpenAgents.Threads

  @doc """

  The threads and receipts that name `issue` and that `reader` may read.

  Returns `%{threads: [...], receipts: [...]}`. An issue with no closing

  references or no matching receipts returns an empty `:receipts` list, and an

  issue with no readable threads returns an empty `:threads` list.

  """

  @spec for_issue(Issue.t(), User.t() | nil) :: %{

          threads: [Threads.Thread.t()],

          receipts: [map()]

        }

  def for_issue(%Issue{} = issue, %User{} = reader), do: do_for_issue(issue, reader)

  def for_issue(%Issue{} = issue, _reader), do: do_for_issue(issue, nil)

  def for_issue(%Issue{} = issue), do: do_for_issue(issue, nil)

  defp do_for_issue(%Issue{} = issue, reader) do

    repository = visible_repository(issue, reader)

    threads = if reader, do: Threads.list_for_issue(issue, reader), else: []

    receipts =

      if repository do

        issue |> ClosingReferences.for_issue() |> receipts_for_references(repository)

      else

        []

      end

    %{threads: threads, receipts: receipts}

  end

  defp visible_repository(%Issue{repository_id: repository_id}, reader) do

    case Repositories.get_visible_repository(repository_id, reader) do

      %Repository{} = repository -> repository

      _not_visible -> nil

    end

  end

  defp receipts_for_references(references, %Repository{} = repository) do

    Enum.flat_map(references, fn reference ->

      sha = reference.commit_sha

      db_receipts =

        repository.storage_key

        |> Forge.receipts_for(sha)

        |> flatten_receipts(sha)

      gate_receipts =

        repository.storage_key

        |> Forge.gate_receipts_for(sha)

        |> flatten_receipts(sha)

      db_receipts ++ gate_receipts

    end)

  end

  defp flatten_receipts(receipts_by_family, sha) do

    for {family, receipts} <- receipts_by_family,

        receipt <- receipts,

        do: %{family: to_string(family), sha: sha, receipt: receipt}

  end

end

      "get /api/v1/repos/:owner/:repo/issues" => {:optional_bearer, :issue, :envelope},

      "get /api/v1/repos/:owner/:repo/issues/:issue_number" =>

        {:optional_bearer, :issue, :envelope},

      "get /api/v1/repos/:owner/:repo/issues/:issue_number/activity" =>

        {:optional_bearer, :issue_activity, :envelope},

      "get /api/v1/repos/:owner/:repo/issues/:issue_number/dependencies" =>

        {:optional_bearer, :issue_dependency, :envelope},

      "get /api/v1/repos/:owner/:repo/pulls" => {:optional_bearer, :pull_request, :legacy},

  alias OpenAgents.Accounts.User

  alias OpenAgents.Forge.Assignments

  alias OpenAgents.Issues

  alias OpenAgents.Issues.Activity

  alias OpenAgents.Issues.Capture

  alias OpenAgents.Issues.CompletionClaims

  alias OpenAgents.Issues.Evidence

  defp threads_by_issue(_issues, _reader), do: %{}

  def activity(conn, %{

        "owner" => owner,

        "repo" => repo,

        "issue_number" => issue_number

      }) do

    reader = conn.assigns[:current_user]

    with {:ok, repository} <-

           lookup(fn -> Repositories.get_visible_by_path!(owner, repo, reader) end),

         {:ok, issue} <-

           lookup(fn ->

             Issues.get_issue_by_number!(repository, integer_param!(issue_number))

           end) do

      conn

      |> put_status(:ok)

      |> put_extensions_header()

      |> render(:activity,

        owner: owner,

        repo: repo,

        issue: issue,

        activity: Activity.for_issue(issue, reader)

      )

    else

      {:error, :not_found} -> not_found(conn)

    end

  end

  # The extension namespace is discoverable from the response itself, so a

  # client never has to infer which OpenAgents fields this deployment sends.

  defp put_extensions_header(conn),

    issue_json(issue, assigns)

  end

  def render("activity.json", %{activity: activity} = assigns) do

    url_base = url_base(assigns)

    %{

      threads: Enum.map(activity.threads, &thread_json(&1, url_base)),

      receipts: Enum.map(activity.receipts, &receipt_json/1)

    }

  end

  defp issue_json(issue, assigns) do

    owner = Map.get(assigns, :owner, "OpenAgents")

    repo = Map.get(assigns, :repo, "openagents")

  defp evidence_json(entry), do: entry

  defp receipt_json(%{family: family, sha: sha, receipt: receipt}) do

    base =

      if is_struct(receipt) do

        receipt

        |> Map.from_struct()

        |> Map.delete(:__meta__)

      else

        receipt

      end

    base

    |> Map.put(:family, family)

    |> Map.put(:sha, sha)

  end

  defp attempt_json(attempt) do

    attempt

    |> Map.drop([:work_job])

  @optional_forge_read_paths [

    "/api/v1/repos/:owner/:repo/issues",

    "/api/v1/repos/:owner/:repo/issues/:issue_number",

    "/api/v1/repos/:owner/:repo/issues/:issue_number/activity",

    "/api/v1/repos/:owner/:repo/issues/:issue_number/dependencies",

    "/api/v1/repos/:owner/:repo/issues/:issue_number/comments",

    "/api/v1/repos/:owner/:repo/issues/comments/:id",

    get "/repos/:owner/:repo/issues", IssueController, :index

    get "/repos/:owner/:repo/issues/:issue_number", IssueController, :show

    get "/repos/:owner/:repo/issues/:issue_number/activity",

        IssueController,

        :activity

    get "/repos/:owner/:repo/issues/:issue_number/dependencies",

        IssueDependencyController,

        :index

             GateReceipt.verify(String.duplicate("b", 40), repo_root: root)

  end

  test "accepts a git common dir override" do

    root = temporary_root()

    common_dir = Path.join(root, "repo.git")

    File.mkdir_p!(common_dir)

    path = GateReceipt.path(@sha, git_common_dir: common_dir)

    File.mkdir_p!(Path.dirname(path))

    receipt = %{

      "schema" => "openagents.release-gate.v1",

      "git_sha" => @sha,

      "status" => "passed",

      "stages" => Map.new(@stages, &{&1, %{"status" => "passed"}})

    }

    File.write!(path, Jason.encode!(receipt))

    assert {:ok, ^receipt} = GateReceipt.verify(@sha, git_common_dir: common_dir)

    assert {:error, :missing_gate_receipt} =

             GateReceipt.verify(String.duplicate("b", 40), git_common_dir: common_dir)

  end

  test "rejects an incomplete receipt" do

    root = temporary_root()

    path = GateReceipt.path(@sha, repo_root: root)

defmodule OpenAgents.Issues.ActivityTest do

  @moduledoc """

  Acceptance for the issue activity read: threads an issue names that a reader

  may read, and receipts reachable from the commits that reference the issue.

  """

  use OpenAgents.DataCase, async: true

  import OpenAgents.AccountsFixtures

  alias OpenAgents.Forge.BuildReceipt

  alias OpenAgents.Issues

  alias OpenAgents.Issues.Activity

  alias OpenAgents.Issues.ClosingReference

  alias OpenAgents.Repo

  alias OpenAgents.Threads

  @sha String.duplicate("ab", 20)

  @stages ~w(

    compile

    production_compile

    precommit

    cluster

    javascript

    direct_transaction

    relup_topology

    relup

    version_chain

    interrupted_install

    rolling_replacement

    contracts

    staging_infra

    release_smoke

  )

  setup do

    user = repository_user_fixture("activity-reader")

    repository = repository_with_member_fixture(user, %{visibility: "private"}, "owner")

    {:ok, issue} = Issues.create_issue(repository, %{title: "Activity test issue"})

    %{user: user, repository: repository, issue: issue}

  end

  describe "issue activity" do

    test "an issue with no references lists empty threads and receipts", %{

      issue: issue

    } do

      activity = Activity.for_issue(issue)

      assert activity.threads == []

      assert activity.receipts == []

    end

    test "an issue with a referencing commit that has a gate receipt lists it", %{

      repository: repository,

      issue: issue,

      user: user

    } do

      closing_reference(%{repository: repository, issue: issue, user: user}, @sha)

      forge_data =

        Path.join(

          System.tmp_dir!(),

          "openagents-activity-gate-#{System.unique_integer([:positive])}"

        )

      previous = Application.get_env(:openagents, :forge_data_dir)

      Application.put_env(:openagents, :forge_data_dir, forge_data)

      on_exit(fn ->

        if previous,

          do: Application.put_env(:openagents, :forge_data_dir, previous),

          else: Application.delete_env(:openagents, :forge_data_dir)

        File.rm_rf!(forge_data)

      end)

      _receipt = gate_receipt(repository, @sha)

      activity = Activity.for_issue(issue, user)

      assert [entry] = Enum.filter(activity.receipts, &(&1.family == "gates"))

      assert entry.sha == @sha

      assert entry.receipt["schema"] == "openagents.release-gate.v1"

      assert entry.receipt["git_sha"] == @sha

    end

    test "an issue with a referencing commit that has a receipt lists that receipt", %{

      repository: repository,

      issue: issue,

      user: user

    } do

      closing_reference(%{repository: repository, issue: issue, user: user}, @sha)

      build = build_receipt(repository, @sha)

      activity = Activity.for_issue(issue, user)

      assert [entry] = activity.receipts

      assert entry.family == "builds"

      assert entry.sha == @sha

      assert entry.receipt.id == build.id

      assert activity.threads == []

    end

    test "a caller who cannot see the repository does not see its receipts", %{

      repository: repository,

      issue: issue,

      user: user

    } do

      other = repository_user_fixture("activity-stranger")

      closing_reference(%{repository: repository, issue: issue, user: user}, @sha)

      _build = build_receipt(repository, @sha)

      activity = Activity.for_issue(issue, other)

      assert activity.receipts == []

      assert activity.threads == []

    end

    test "issue agent activity includes readable threads and excludes unreadable ones", %{

      issue: issue,

      user: user

    } do

      {:ok, readable} =

        Threads.open(user, "work for this issue", issue_id: issue.id)

      other = repository_user_fixture("other-thread-owner")

      {:ok, _unreadable} =

        Threads.open(other, "someone else's work", issue_id: issue.id)

      activity = Activity.for_issue(issue, user)

      assert [thread] = activity.threads

      assert thread.id == readable.id

      assert activity.receipts == []

    end

  end

  defp closing_reference(%{repository: repository, issue: issue, user: user}, sha) do

    %ClosingReference{}

    |> ClosingReference.changeset(%{

      repository_id: repository.id,

      issue_id: issue.id,

      commit_sha: sha,

      principal: "user:#{user.id}",

      verb: "closes",

      closed: true,

      closed_by_user_id: user.id

    })

    |> Repo.insert!()

  end

  defp build_receipt(repository, sha) do

    %BuildReceipt{}

    |> BuildReceipt.start_changeset(%{

      repo: repository.storage_key,

      sha: sha,

      target_id: Ecto.UUID.generate()

    })

    |> Ecto.Changeset.put_change(:status, "complete")

    |> Repo.insert!()

  end

  defp gate_receipt(repository, sha) do

    bare = OpenAgents.Forge.Repos.bare_path(repository.storage_key)

    path = Path.join([bare, "openagents", "release-gate-receipts", "#{sha}.json"])

    File.mkdir_p!(Path.dirname(path))

    receipt = %{

      "schema" => "openagents.release-gate.v1",

      "git_sha" => sha,

      "status" => "passed",

      "stages" => Map.new(@stages, &{&1, %{"status" => "passed"}})

    }

    File.write!(path, Jason.encode!(receipt))

    receipt

  end

end