Refuse a push that breaks an enumeration proof

Every enumeration proof asserts an exact set — the routes an operator
surface publishes, the API families the export ledger classifies, the
modules that may speak to a model. Adding one without naming it turns a
proof red, which is the design working. What did not work is where it
turned red: on main, discovered forty minutes into a release gate, four
separate times today, by someone who did not write the change.

The proofs are about a hundred tests and two seconds. The guard runs them
before the push, so the person who added the thing is the person told to
classify it. Proven both ways: undeclaring a provider makes the guard exit
1 naming it, a clean tree exits 0 in under three seconds.
OPENAGENTS_SKIP_PUSH_PROOFS=1 opts out.

Also declares ToolCallingTestProvider, the fourth such breakage, and adds
the persona boundary and export inventory proofs to the enumeration script
so the gate and the guard check the same set.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_01KnhfrafYx5ZGaMbzZEJQ2d

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed

by user · WAL seq 411 · 2026-08-25T15:50:16.135550Z

Changed files

• modified ops/ci/enumeration-proofs.sh
• modified ops/dev/install-push-guard.sh
• modified test/openagents/providers/persona_boundary_test.exs

Diff

3 files changed, +21 -1

  test/openagents/forge/deployment_lane_test.exs \

  test/openagents/capacity_test.exs \

  test/openagents/accounts/token_vault_test.exs \

  test/openagents/machines/token_vault_test.exs

  test/openagents/machines/token_vault_test.exs \

  test/openagents/providers/persona_boundary_test.exs \

  test/openagents/data_rights/export_inventory_test.exs

    (cd "$repo_root" && mix format --check-formatted 2>&1 | sed -n '1,20p') >&2

    exit 1

  fi

  # The enumeration proofs. Each one asserts an exact set — the routes an

  # operator surface publishes, the API families the export ledger classifies,

  # the modules that may speak to a model — so adding a route, a family, or a

  # provider without naming it turns one red. They are about a hundred tests

  # and two seconds, and they have caught four separate breakages on main in a

  # day, each of which otherwise surfaced forty minutes into a release gate.

  # Set OPENAGENTS_SKIP_PUSH_PROOFS=1 to push without them.

  if [ "${OPENAGENTS_SKIP_PUSH_PROOFS:-}" != "1" ] &&

    [ -x "$repo_root/ops/ci/enumeration-proofs.sh" ]; then

    if ! (cd "$repo_root" && sh ops/ci/enumeration-proofs.sh >/tmp/openagents-push-proofs.log 2>&1); then

      echo "Refusing the push: an enumeration proof failed." >&2

      sed -n '1,40p' /tmp/openagents-push-proofs.log >&2

      exit 1

    fi

  fi

fi

HOOK

    OpenAgents.Providers.FallbackTestProvider => :in_process,

    OpenAgents.Providers.RecordingTestProvider => :in_process,

    OpenAgents.Providers.Test => :in_process,

    OpenAgents.Providers.ToolCallingTestProvider => :in_process,

    OpenAgents.Providers.UnconfiguredTestProvider => :in_process,

    OpenAgents.Voice.OpenAI.CallClient => :outbound_http,

    OpenAgents.Voice.OpenAI.Sideband => :outbound_socket,

    OpenAgents.Providers.FallbackTestProvider => :adapter,

    OpenAgents.Providers.RecordingTestProvider => :adapter,

    OpenAgents.Providers.Test => :adapter,

    OpenAgents.Providers.ToolCallingTestProvider => :adapter,

    OpenAgents.Providers.Request => :the_struct_itself

  }