forge_wal_dir: nil,

  forge_wal_bucket: nil,

  forge_gcs_token_provider: nil,

  # Hot-load allowlist: MODULE names, not repo paths. An entry ending in `.`

  # is a prefix; any other entry is an exact module name (see

  # `OpenAgents.Forge.HotLoader.allowlisted?/2`). The narrow list was never

  # the safety — the canary node + smoke check + revert is — so the code-only

  # web layer ships in seconds instead of a ~25 minute rolling replace.

  forge_hot_load_allowlist: [

    "lib/openagents",

    "lib/openagents_web",

    "priv/sarah",

    "config",

    "mix.exs"

    "OpenAgentsWeb.",

    "OpenAgents.Forge.Browse",

    "OpenAgents.Changelog",

    "OpenAgents.Scratch.",

    "OpenAgents.BuildInfo"

  ],

  forge_public_visibility: %{"sarah" => :l2},

  forge_repo_owners: %{"sarah" => "OpenAgentsInc"},

config :phoenix,

  sort_verified_routes_query_params: true

# The forge runs for real in the test suite — real git over real HTTP against

# a temporary data dir — so the pipeline is proven end to end without a network

# or a hosted git server. `demo` is the throwaway repo the e2e tests push to.

# The deploy lane is off by default: the tests that exercise it start

# `OpenAgents.Forge.HotLoader` themselves.

config :openagents,

  forge_enabled: true,

  forge_repos: ["sarah", "demo"],

  forge_operator_token: "forge_test_operator_token_0123456789",

  forge_deploy_lane_enabled: false,

  forge_repo_owners: %{"sarah" => "OpenAgentsInc", "demo" => "OpenAgentsInc"}

config :openagents, :migrate_on_boot, false

config :openagents, :ra_enabled, false

    target

    |> cast(attrs, [:repo, :sha, :promoted_by, :status, :details])

    |> validate_required([:repo, :sha, :promoted_by, :status])

    |> validate_format(:sha, ~r/^[0-9a-f]{7,40}$/)

    |> validate_details()

    |> check_constraint(:status, name: :forge_fleet_target_status)

  end

  Promote a pushed commit as the fleet target for `repo`. `operator` is the

  promoting identity (immutable operator id or a test principal).

  Verifies the SHA is actually in the WAL-backed repo — only pushed commits

  are ever promotable (SELF-EDIT precondition, enforced from day one).

  `commit_store` is an optional `{repo, sha} -> :ok | :error | {:error, reason}`

  function that enforces the "only pushed commits are promotable" rule. In test

  it defaults to `:ok`, so tests can exercise promotion without cloning.

  function that decides *existence*. It defaults to the real WAL-backed repo

  check in every environment, test included: an env-dependent bypass would

  mean the precondition is never actually exercised. The SHA *format* check

  is not part of the store and always runs, so an injected store can never

  widen what a well-formed SHA is.

  """

  def promote(repo, sha, operator, opts \\ [])

      when is_binary(repo) and is_binary(sha) and is_list(opts) do

    commit_store = Keyword.get(opts, :commit_store, &default_commit_store/2)

    commit_store = Keyword.get(opts, :commit_store, &commit_exists_store/2)

    details = Keyword.get(opts, :details, %{}) || %{}

    with :ok <- with_commit_store(repo, sha, commit_store) do

    with :ok <- validate_sha_format(sha),

         :ok <- with_commit_store(repo, sha, commit_store) do

      %Target{}

      |> Target.changeset(%{

        repo: repo,

  def current(repo) do

    Target

    |> where([t], t.repo == ^repo)

    |> order_by([t], desc: t.id)

    |> order_by([t], desc: t.inserted_at)

    |> limit(1)

    |> Repo.one()

  end

            {:error, :not_found}

          %Target{status: current} = target ->

            allowed = Map.get(@transitions, current, [])

            cond do

              allowed == [] ->

                {:error, {:terminal, current}}

              status in allowed ->

                target

                |> Target.status_changeset(status, bounded_details(details))

                |> Repo.update()

              true ->

                {:error, {:invalid_transition, current, status}}

            if status in Map.get(@transitions, current, []) do

              target

              |> Target.status_changeset(status, bounded_details(details))

              |> Repo.update()

            else

              {:error, {:invalid_transition, current, status}}

            end

        end

      end)

    end

  end

  # In test we skip the WAL-backed repo check so unit tests can exercise the

  # lifecycle without cloning. In dev/prod we verify the commit exists in the

  # bare repo before allowing promotion.

  defp default_commit_store(repo, sha) do

    if function_exported?(Mix, :env, 0) and Mix.env() == :test do

      :ok

    else

      validate_git_commit(repo, sha)

    end

  defp validate_sha_format(sha) do

    if Regex.match?(~r/^[0-9a-f]{7,40}$/, sha), do: :ok, else: {:error, :invalid_sha}

  end

  defp validate_git_commit(repo, sha) do

    cond do

      not Regex.match?(~r/^[0-9a-f]{7,40}$/, sha) ->

        {:error, :invalid_sha}

      not commit_exists?(repo, sha) ->

        {:error, :unknown_sha}

      true ->

        :ok

    end

  # The promotable set is exactly what the WAL-backed repo contains.

  defp commit_exists_store(repo, sha) do

    if commit_exists?(repo, sha), do: :ok, else: {:error, :unknown_sha}

  end

  defp commit_exists?(repo, sha) do

defmodule OpenAgents.Repo.Migrations.AlignForgeBuildsAndTargets do

  @moduledoc """

  Aligns the deploy-lane tables with the schemas that actually read them.

  `forge_builds` was created in an earlier, unrelated shape (bigserial id,

  `source_sha`, `toolchain_identity`, `module_changes`, `artifact_path`,

  `artifact_digest`, `output`). No module ever mapped to those columns —

  `OpenAgents.Forge.BuildReceipt` maps `{repo, sha, target_id, modules,

  warnings, tests, duration_ms, artifact}` — so every build receipt insert

  raised, the Builder rescued it as "builder crashed", and the deploy lane

  could never reach `built`. The table has no readers or writers, so it is

  recreated in the shape the receipt requires, with the idempotency index

  (`{repo, sha, target_id}`) the Builder's `on_conflict` names.

  `forge_fleet_targets` got second-resolution timestamps from a bare

  `timestamps()`. `OpenAgents.Forge.Targets.current/1` is "newest row for

  this repo", so any two promotions inside the same second tie and the

  current fleet target becomes arbitrary — a pin-back could silently fail

  to take effect. The schema declares `utc_datetime_usec`; the columns now

  match. The status check constraint that `Target.changeset/2` names is

  added here too, so an illegal status is refused by the database and

  surfaces as a changeset error rather than a silent write.

  """

  use Ecto.Migration

  def up do

    drop table(:forge_builds)

    create table(:forge_builds, primary_key: false) do

      add :id, :binary_id, primary_key: true

      add :repo, :string, null: false

      add :sha, :string, null: false

      add :target_id, :binary_id, null: false

      add :modules, {:array, :string}, null: false, default: []

      add :warnings, :text

      add :tests, :text

      add :duration_ms, :integer

      add :artifact, :string

      timestamps(type: :utc_datetime_usec, updated_at: false)

    end

    create unique_index(:forge_builds, [:repo, :sha, :target_id])

    create index(:forge_builds, [:repo, :inserted_at])

    execute("""

    ALTER TABLE forge_fleet_targets

      ALTER COLUMN inserted_at TYPE timestamp(6) without time zone,

      ALTER COLUMN updated_at TYPE timestamp(6) without time zone

    """)

    create index(:forge_fleet_targets, [:repo, :inserted_at])

    create constraint(:forge_fleet_targets, :forge_fleet_target_status,

             check:

               "status IN ('promoted','building','built','deploying','live','failed','reverted','needs_rolling_replace')"

           )

  end

  def down do

    drop constraint(:forge_fleet_targets, :forge_fleet_target_status)

    drop index(:forge_fleet_targets, [:repo, :inserted_at])

    execute("""

    ALTER TABLE forge_fleet_targets

      ALTER COLUMN inserted_at TYPE timestamp(0) without time zone,

      ALTER COLUMN updated_at TYPE timestamp(0) without time zone

    """)

    drop table(:forge_builds)

    create table(:forge_builds) do

      add :target_id, :uuid, null: false

      add :source_sha, :string, null: false

      add :toolchain_identity, :string

      add :baseline_sha, :string

      add :module_changes, :map, null: false, default: "{}"

      add :artifact_path, :string

      add :artifact_digest, :string

      add :output, :text

      add :duration_ms, :integer

      add :details, :map, null: false, default: "{}"

      timestamps()

    end

    create index(:forge_builds, [:target_id])

    create index(:forge_builds, [:source_sha])

  end

end

    assert Enum.all?(steps, &(&1.status == "succeeded"))

    push_step = List.last(steps)

    assert "forge-commit:openagents:#{sha}" in push_step.target_receipt_refs

    # The middle segment is the forge repo the coding lane edits

    # (`OpenAgents.Tools.Repository.repo/0`) — still `sarah`, the same name

    # the push receipt below is looked up under.

    assert "forge-commit:sarah:#{sha}" in push_step.target_receipt_refs

    # The push is WAL-receipted on the forge, on the job's own branch.

    assert [push_receipt | _rest] = Forge.recent_pushes("sarah")

defmodule OpenAgents.Forge.TargetsTest do

  @moduledoc """

  The two surfaces of `OpenAgents.Forge.Targets` that the end-to-end

  lifecycle test (`OpenAgents.Forge.SarahTargetsTest`, which drives a real

  bare repo) does not reach: the injectable `commit_store`, and the bounded

  `details` map.

  Promotability and the transition table are deliberately NOT re-asserted

  here — they have one contract and one home. This file used to promote

  never-pushed SHAs like `"abc123"` through a test-environment bypass, which

  contradicted that contract ("only pushed commits are ever promotable") and

  meant the precondition was never actually exercised anywhere.

  """

  use OpenAgents.DataCase, async: false

  alias OpenAgents.Forge.Target

  alias OpenAgents.Forge.Targets

  test "promote a target" do

    assert {:ok, %Target{} = target} =

             Targets.promote("OpenAgents/openagents.com", "abc123", "operator-1")

    assert target.repo == "OpenAgents/openagents.com"

    assert target.sha == "abc123"

    assert target.promoted_by == "operator-1"

    assert target.status == "promoted"

  end

  @repo "OpenAgents/openagents.com"

  test "refuse promotion of an unknown SHA" do

    bad_store = fn _repo, _sha -> :error end

  # A SHA that is well-formed but not in any repo, so only the injected

  # store decides whether it is promotable.

  defp sha, do: 20 |> :crypto.strong_rand_bytes() |> Base.encode16(case: :lower)

    assert {:error, :unknown_sha} =

             Targets.promote(

               "OpenAgents/openagents.com",

               "badsha",

               "operator-1",

               commit_store: bad_store

             )

  defp promote(attrs \\ []) do

    Targets.promote(

      Keyword.get(attrs, :repo, @repo),

      Keyword.get(attrs, :sha, sha()),

      Keyword.get(attrs, :operator, "operator-1"),

      Keyword.take(attrs, [:commit_store, :details])

      |> Keyword.put_new(:commit_store, fn _repo, _sha -> :ok end)

    )

  end

  test "complete lifecycle from promoted to live" do

    {:ok, target} = Targets.promote("OpenAgents/openagents.com", "abc123", "operator-1")

  test "an accepting commit store promotes the commit" do

    sha = sha()

    for status <- ["building", "built", "deploying", "live"] do

      assert {:ok, %Target{} = updated} = Targets.transition(target.id, status)

      assert updated.status == status

    end

    assert {:ok, %Target{} = target} = promote(sha: sha)

    assert target.repo == @repo

    assert target.sha == sha

    assert target.promoted_by == "operator-1"

    assert target.status == "promoted"

  end

  test "refuse invalid transitions" do

    {:ok, target} = Targets.promote("OpenAgents/openagents.com", "abc123", "operator-1")

    assert {:error, {:invalid_transition, "promoted", "live"}} =

             Targets.transition(target.id, "live")

  test "a refusing commit store refuses the promotion" do

    assert {:error, :unknown_sha} = promote(commit_store: fn _repo, _sha -> :error end)

  end

  test "refuse transitions out of a terminal state" do

    {:ok, target} = Targets.promote("OpenAgents/openagents.com", "abc123", "operator-1")

    assert {:ok, %Target{} = built} = Targets.transition(target.id, "building")

    assert {:ok, %Target{} = built} = Targets.transition(built.id, "built")

    assert {:ok, %Target{} = deploying} = Targets.transition(built.id, "deploying")

    assert {:ok, %Target{} = live} = Targets.transition(deploying.id, "live")

    assert {:error, {:terminal, "live"}} = Targets.transition(live.id, "reverted")

  test "a commit store may name its own reason" do

    store = fn _repo, _sha -> {:error, :mirror_behind} end

    assert {:error, :mirror_behind} = promote(commit_store: store)

  end

  test "pinning back to an older SHA creates a new latest target" do

    repo = "OpenAgents/openagents.com"

    {:ok, first} = Targets.promote(repo, "sha-1", "operator-1")

    {:ok, second} = Targets.promote(repo, "sha-2", "operator-1")

    assert Targets.latest(repo).id == second.id

  test "a malformed SHA is refused before the store is consulted" do

    store = fn _repo, _sha -> flunk("commit store must not be consulted") end

    {:ok, third} = Targets.promote(repo, "sha-1", "operator-1")

    assert Targets.latest(repo).id == third.id

    assert third.sha == "sha-1"

    refute third.id == first.id

    assert {:error, :invalid_sha} =

             Targets.promote(@repo, "not-a-sha!", "operator-1", commit_store: store)

  end

  test "bound details to 100 keys and 32KB" do

  test "details are bounded to 100 keys and 32KB per value" do

    too_many = Map.new(0..100, fn i -> {"key#{i}", "value"} end)

    assert {:error, {:invalid, %Ecto.Changeset{} = changeset}} =

             Targets.promote("OpenAgents/openagents.com", "abc123", "operator-1",

               details: too_many

             )

    assert {:error, {:invalid, %Ecto.Changeset{} = changeset}} = promote(details: too_many)

    assert "exceeds the 100-key bound" in errors_on(changeset).details

    huge_string = String.duplicate("x", 40_000)

    huge = String.duplicate("x", 40_000)

    assert {:error, {:invalid, %Ecto.Changeset{} = changeset}} =

             Targets.promote("OpenAgents/openagents.com", "def456", "operator-1",

               details: %{data: huge_string}

             )

             promote(details: %{data: huge})

    assert "exceeds the 32KB bound" in errors_on(changeset).details

  end

  test "latest/1 and transition/2 are the current/advance aliases" do

    {:ok, first} = promote()

    {:ok, second} = promote()

    assert Targets.latest(@repo).id == second.id

    assert {:ok, %Target{status: "building"}} = Targets.transition(first.id, "building")

    assert {:error, {:invalid_transition, "promoted", "live"}} =

             Targets.transition(second.id, "live")

  end

end

    branch = pushed["result"]["branch"]

    assert branch == "sarah/job-11111111-2222-3333-4444-555555555555"

    # The commit SHA is in the outcome receipt refs (SELF-EDIT-001).

    assert "forge-commit:openagents:#{sha}" in pushed["target_receipt_refs"]

    # The commit SHA is in the outcome receipt refs (SELF-EDIT-001). The

    # middle segment is the forge repo the coding lane edits

    # (`OpenAgents.Tools.Repository.repo/0`), which is still `sarah` — the

    # same name this test uses for the branch, the push receipt, and the

    # bare path below. Renaming the forge repo is a separate whole-repo

    # change (config `forge_repos`, visibility, public paths, git URL).

    assert "forge-commit:sarah:#{sha}" in pushed["target_receipt_refs"]

    # The push is receipted with a WAL sequence, and the ref exists on the

    # forge with exactly that sha.