detectable. The first is about replay; the second is about detection, and

neither substitutes for the other.

A receipt also depends on no key, which is what makes it survive every key

rotation this forge can perform. The chain link is unkeyed `sha256` and the

verifier was compiled against no vault, no `OpenAgents.ApiTokens`, and no

`OpenAgents.Reputation`; `test/openagents/forge/key_rotation_test.exs` asserts

both, so a receipt cannot quietly acquire a key dependency. That proof is

rehearsal 4 of `docs/forge-exit-rehearsals.md`, which had no executable proof

before #180.

Evidence: `OpenAgents.Forge.Verification`, `OpenAgents.Forge.WAL`,

`OpenAgents.Forge.Repos`, `test/openagents/forge/independence_test.exs`, and

`test/openagents/forge/key_rotation_test.exs`.

`OpenAgents.Forge.Repos`, and `test/openagents/forge/independence_test.exs`.

### EXIT-003 — Recovery comes from the WAL, and the mirror is strictly lossy

which rebuilds this table from the WAL alone. The absence is the invariant

holding, not an omission.

Two operational facts bound the claim, and the first was stated wrongly here

until #180's rehearsal 3 checked it against production. `:forge_mirror_urls` is

empty in `config/config.exs`, but `config/runtime.exs` reads

`OPENAGENTS_FORGE_MIRROR_URLS_JSON` and that variable is set in production: the

live node reports one configured mirror, and `/status` publishes its freshness.

A mirror runs. And `mirror_now/1` is a force push of every ref, so the

configured mirror overwrites what direct pushes left there rather than merging

with it, which matters more now than it did while the claim was that none ran.

#188 carries both, together with the finding that the mirror currently holds

307 commits of this repository's history the WAL never held — so for the

pre-seed history the mirror is strictly *richer* rather than strictly lossy,

which this invariant does not watch for and cannot detect, because nothing was

added to the recovery path.

Two operational facts bound the claim. `:forge_mirror_urls` is empty in

`config/config.exs` and set by no environment, so no mirror runs today and

GitHub holds whatever was last pushed to it directly, which is the trade

`REPOSITORY-002` records. And `mirror_now/1` is a force push of every ref, so

configuring a mirror overwrites what direct pushes left there rather than

merging with it.

Evidence: `OpenAgents.Forge.Sync`, `OpenAgents.Forge.Pushes`,

`OpenAgents.Forge.PushReceipt`, `OpenAgents.Forge.Verification`, and

| REPOSITORY-002 | `ops/ci/push-remote-check.sh`, `ops/dev/install-push-guard.sh`, `test/openagents/push_remote_contract_test.exs` |

| REPOSITORY-003 | `test/openagents/forge/wal_replay_test.exs`, `test/openagents/forge/sync_test.exs`, `test/openagents/forge/independence_test.exs` |

| EXIT-001 | `test/openagents/data_rights/export_inventory_test.exs`, `test/openagents/data_rights/account_export_test.exs` |

| EXIT-002 | `test/openagents/forge/independence_test.exs`, `test/openagents/forge/key_rotation_test.exs` |

| EXIT-002 | `test/openagents/forge/independence_test.exs` |

| EXIT-003 | `test/openagents/forge/independence_test.exs` |

| EXIT-004 | `test/openagents/forge/independence_test.exs` |

| EXIT-005 | `test/openagents/forge/independence_test.exs`, `test/openagents/forge/wal_test.exs`, `test/openagents/forge/git_http_test.exs`, `test/openagents_web/controllers/push_receipt_controller_test.exs`, `test/openagents_web/controllers/forge_anchor_controller_test.exs` |

| Rehearsal | Executable proof | Performed against the live forge |

| --- | --- | --- |

| 1. Restore a repository and its work history | `EXIT-004`, `EXIT-001` | 2026-08-23 — **failed**, #179; re-run 2026-08-24 — **still failed**, #187 |

| 2. Detect a forged, missing, reordered, or mismatched receipt | `EXIT-002`, `EXIT-005` | 2026-08-24 — **performed, and the result is worse than a failure**: #187, #190 |

| 3. Mirror divergence | `EXIT-003` | 2026-08-24 — **performed, failed**: #188, #189 |

| 4. Key rotation | `test/openagents/forge/key_rotation_test.exs` | 2026-08-24 — **performed, partly failed**: #191, #192 |

| 5. Operator loss | `EXIT-003` | 2026-08-24 — **performed as far as it can be**; the blocking half is named below |

| 6. Partial export | `EXIT-001` | 2026-08-24 — **performed, failed**: #187 |

All six have now been run against the live forge. Five of them found something,

and one finding is common to three of them: `main` is 57 commits ahead of the

deployed revision `6d421b3c7ffe`, and the exit surfaces #94 audits are all in

those 57 commits. #187 carries that.

The general lesson is the one #179 already taught, now with five more

instances. Every invariant `EXIT-001` through `EXIT-006` was green throughout,

because each runs against a forge the test process builds. A rehearsal runs

against the forge people use, and that is the entire difference.

| 1. Restore a repository and its work history | `EXIT-004`, `EXIT-001` | 2026-08-23 — **failed**, see #179 |

| 2. Detect a forged, missing, reordered, or mismatched receipt | `EXIT-002`, `EXIT-005` | No |

| 3. Mirror divergence | `EXIT-003` | No |

| 4. Key rotation | None | No |

| 5. Operator loss | `EXIT-003` | No |

| 6. Partial export | `EXIT-001` | No |

Five of the six have never been run outside the test suite, which #180 carries.

That is the honest state, and the one that was run failed.

## 1. Restore a repository and its bounded work history

`OpenAgents.Forge.Sync` reconciles the graft against the objects a projection

actually holds, so a repository that cannot be walked repairs itself from the

WAL. The pre-seed history remains outside this forge and is not recoverable

from it.

### Re-run, 2026-08-24

**Step 1 failed again, and it will keep failing until a release is promoted.**

The repair is on `main`; the live forge runs `6d421b3c7ffe`, which predates

it. Verbatim:

```

$ git clone https://openagents.com/OpenAgentsInc/openagents.com.git restored

Cloning into 'restored'...

remote: error: Could not read c91327d60c520d11133ddcc6cb3304784f2f0481

remote: fatal: Failed to traverse parents of commit eda094c6ae9f100060b96cd93bad9e4ecd117e94

remote: aborting due to possible repository corruption on the remote side.

fatal: early EOF

fatal: fetch-pack: invalid index-pack output

```

Four of the five branches #179 recorded still fail at depth 2:

`codex/github-backed-repositories`, `codex/posthog-integration`,

`components-gallery`, and `repos-ui`. `codex/admin-posthog-analytics` now

succeeds, because something pushed across its boundary in the interval.

**One sentence of #179's diagnosis is wrong, and rehearsal 2 is what found

it.** #179 says the seed "was written before WAL entries carried a `shallow`

key. The log therefore records no boundary." The live WAL says otherwise. Its

seq 0 entry carries a `shallow` key naming five boundary commits, `eda094c6`

among them, and the served projection has no `shallow` file at all:

```

File.exists?("/var/lib/openagents/forge/repos/ecd89cf6-….git/shallow")

#=> false

```

The log holds the boundary; the projection does not. The deployed replay does

write the graft — `OpenAgents.Forge.Sync.write_shallow_boundaries/2` exists at

`6d421b3c7ffe` — but only while applying an entry, and this cache was

materialized before that code existed and has applied nothing since that would

rewrite it. So the repair `main` carries is the right one, and the reason it is

needed is a stale projection rather than a silent log.

That distinction matters for what is recoverable. The graft is recoverable from

the WAL, so the repository becomes cloneable, with history that honestly stops

at the boundary. The 307 pre-seed commits are not in the WAL and are not

recoverable from it. See rehearsal 3 for where they are.

from it. Rerun step 1 to confirm the live forge serves a full clone.

## 2. Detect a forged, missing, reordered, or mismatched receipt

   A rewritten prefix reports `anchor_mismatch`. Without the anchor argument

   the same log reports clean, which is the whole point of publishing one.

### Result, 2026-08-24

Performed on `sarah-fleet-1` through

`docker exec openagents /app/bin/openagents rpc`. Steps 1 and 2 ran. Step 3

could not.

**Step 1 does not work as written.** The rehearsal says `{storage_key}` and the

forge answers with a name:

```

> OpenAgents.Forge.Repos.allowed_repos()

["openagents.com"]

> OpenAgents.Forge.Verification.verify("openagents.com")

{:error, %{entries: 0, repo: "openagents.com",

           findings: [%{code: "wal_unreadable", detail: %{"reason" => ":not_found"}}]}}

```

`wal_unreadable` is what a verifier says when the write-ahead log is gone. The

log is intact; the name is wrong. The served repository is keyed by a UUID, and

a stale bare repository sits under the name holding one ref at a commit `main`

passed long ago. Filed as #190.

**Step 2 reports clean on a repository that cannot be cloned.**

```

> OpenAgents.Forge.Verification.verify("ecd89cf6-f602-479f-9f47-266307345aaa")

tag=:ok

entries=275

finding_count=0

codes=%{}

```

Zero findings, at the same hour a full clone of that repository aborts. This is

the sharpest available statement of why rehearsals exist. The deployed verifier

checks that every ref tip resolves, and every ref tip does; it does not walk

the tips into their ancestors, because the walk is part of the `EXIT-004`

amendment on `main`. A green verifier and an unservable repository, at the same

moment, on the same node.

**The chain `EXIT-005` describes is not running.** Of the 275 entries in the

live log, **none carries a link** — including the entry written twelve minutes

before the check:

```

> entries=275 linked=0

> last=%{"format" => "receive_pack", "object" => "entries/00000274-3f1807e0e409",

         "principal" => "user:af9e…", "pushed_at" => "2026-08-24T03:53:33.604547Z", "seq" => 274}

```

Confirmed independently: `OpenAgents.Forge.WAL.chain_link/2` and `entry_link/1`

do not exist on the deployed build, with the module loaded first, because

`function_exported?/3` answers `false` for a module nobody has loaded and that

is an easy way to draw the wrong conclusion.

**Step 3 could not be performed at all.** The deployed `Verification.verify`

has arity 1:

```

> OpenAgents.Forge.Verification.__info__(:functions) |> Keyword.get_values(:verify)

[1]

```

There is no `:anchor` option to pass, and there would be nothing to pass to it:

an anchor is a `link`, and no entry has one. The one check that distinguishes

`EXIT-005`'s tamper-evidence from `EXIT-002`'s "the operator agrees with the

operator" is unavailable on the live forge. `Application.get_env(:openagents,

:forge_wal_anchor)` is `nil`, which is what `EXIT-006` would publish if

`EXIT-006` were deployed; `OpenAgents.Forge.Independence` does not load on the

node either. Filed as #187.

**What this rehearsal proves today:** that `verify/1` runs against production

storage without a database and reports the shape it promises. That is real and

it is less than the rehearsal claims. Every disagreement it can detect other

than the five ref-and-entry findings is unavailable here.

## 3. Mirror divergence

**Proves:** the GitHub mirror is never an input to recovery, and divergence is

   The rebuild path takes no mirror input. `EXIT-003` turns red if one is

   added.

### Result, 2026-08-24

**Step 1: no divergence, and that is not the good news it sounds like.** The

two ref maps are identical — 25 refs, same shas, `refs/heads/main` at

`773ad680` on both.

**Step 2 contradicts the contract.** `EXIT-003` states as an operational fact

that `:forge_mirror_urls` "is empty in `config/config.exs` and set by no

environment, so no mirror runs today", and `CLAUDE.md` repeats it. The live

node disagrees:

```

> Application.get_env(:openagents, :forge_mirror_urls, %{}) |> Map.keys()

["openagents.com"]

```

`GET /api/status` says so too, publishing `forge.mirror` as

`{"repo": "openagents.com", "state": "current"}`, which

`OpenAgents.Forge.MirrorWatch` emits only for a configured repo. A mirror runs,

and `mirror_now/1` is a force push of every ref. Filed as #188.

**And the mirror is the only complete copy of half this repository.**

| Source | `main` commits | `git fsck` | Holds `c91327d6` |

| --- | --- | --- | --- |

| GitHub mirror | 603 | clean | yes |

| The forge | 296, from the seed forward | full clone aborts | no |

307 commits — 51% of `main` — exist on GitHub and nowhere else this forge can

reach. They are not in the WAL, so no rebuild produces them. `EXIT-003` says

recovery comes from the WAL and the mirror is strictly lossy; for the pre-seed

history the relation is inverted, and the mirror is strictly richer. That is

the outcome `EXIT-003` exists to prevent, arrived at from a direction the

invariant does not watch: not a fallback someone added to the recovery path,

but a projection that never held the history in the first place. Also #188.

**Step 3 could not be performed, because the function does not exist.**

```

> OpenAgents.Forge.Sync.__info__(:functions) |> Keyword.keys()

[:ensure_cluster_fresh, :ensure_fresh, :ensure_fresh!, :replay_missing, :with_repo_lock]

```

`OpenAgents.Forge.Sync.rebuild/1` is not on the deployed build and is not on

`main`. This document and #179 both instruct an operator to run it. Filed as

#189.

## 4. Key rotation

**Proves:** that no forge receipt depends on any key this forge holds, so no

rotation can invalidate one; and, for each key-like secret, whether rotating it

loses data and whether the wrong order is refused.

**Executable proof:** `test/openagents/forge/key_rotation_test.exs`, added by

#180. This rehearsal had none until then.

**Proves:** nothing yet. This rehearsal is written and has never been

performed.

The forge holds several key-like secrets and they rotate differently:

every already-issued receipt verifiable, and that a rotation performed in the

wrong order is refused rather than silently invalidating history.

### Result, 2026-08-24

The first half holds everywhere. The second holds in one family of four.

| Family | Rotation loses nothing | Wrong order refused |

| --- | --- | --- |

| Forge operator token | yes | not applicable — there is no order |

| Account `oa_pat_` tokens | yes | not applicable |

| Reputation issuer key | forward, yes | **no** — #191 |

| GitHub token vault | yes | yes |

| Machine pairing vault | **no** — #192 | no |

| Voice recording vault | **no** | no |

**No forge receipt depends on a key at all**, which makes the positive claim

true and worth stating plainly rather than triumphantly. `OpenAgents.Forge.WAL`'s

chain link is unkeyed `sha256` over a domain tag and the entry's own fields,

and `OpenAgents.Forge.Verification` was compiled against no vault, no

`OpenAgents.ApiTokens`, and no `OpenAgents.Reputation`. The proof rotates every

key-like secret in the application underneath a computed link and asserts the

link is unmoved. A push made with the operator token records the literal

`operator:forge-token`, which is written at push time rather than derived from

the secret, so no rotation makes a past push attributable to a person or takes

attribution away.

**The reputation issuer key fails the second half.** `retire_key/2` accepts any

timestamp and validates it against nothing. Retiring a key at a moment at or

before an attestation it already signed flips that attestation to

`"verified" => false` while `"signature" => %{"valid" => true}` — a valid

signature over an unaltered claim, reported as unverified, by one `UPDATE`

against a row the operator controls. The forward edge *is* guarded:

`require_active_key/2` refuses issuance under a key that is not yet active.

Only retirement is open. Filed as #191.

**The machine pairing vault fails the first half, and the coupling is not

written down anywhere.** `OpenAgents.Machines.TokenVault.key/0` reads

`:github_token_encryption_key` — the GitHub vault's *active* key — and its

envelope carries no key id and consults no keyring. So the documented GitHub

rotation in `docs/github-auth-plan.md`, performed in the documented order,

makes every outstanding pairing ciphertext permanently unopenable. The blast

radius is bounded: pairings live ten minutes and both terminal transitions null

the column, so at most ten minutes of unclaimed pairings are lost. Filed as

#192. `OpenAgents.Voice.RecordingVault` has the same shape with its own key and

no rewrap path; `test/openagents/voice/recordings_test.exs:319` already pins

that a wrong key fails closed, so what was missing was the statement that

rotating it is unrecoverable rather than the behaviour.

**The GitHub token vault is the one that gets this right**, and it is worth

saying why rather than only that it does. The key id is inside the envelope and

bound into the AAD, up to sixteen prior keys stay readable, `rotate_github_tokens!/0`

rewraps inside one transaction, and an invalid keyring raises at boot in `:prod`.

Performed in the wrong order it fails closed and the rewrap rolls back, rather

than writing a row nobody can open.

Both failures are pinned by tests that name their issue, so a fix turns the

test red instead of passing unnoticed. Each pin was mutation-checked by

implementing the fix and confirming the pin failed.

## 5. Operator loss

**Proves:** nothing yet outside `EXIT-003`, which shows recovery comes from the

WAL at all. It lives in storage the current operator controls, and this

repository contains nothing that changes that.

### Result, 2026-08-24

Performed as far as it goes, which is not far, and the boundary is now concrete

rather than abstract.

**What a second operator would need, named exactly.** The WAL adapter is

`OpenAgents.Forge.WAL.Gcs` and the bucket is `sarah-forge-wal`, in the Google

Cloud project the current operator owns. There is no second custodian, no

escrow, no copy anywhere else, and no mechanism in this repository by which one

could be established. A second operator starting from nothing obtains **no

refs, no objects, no sequences, no principals, and no push times**, because all

of it lives behind one IAM boundary.

**What that leaves them.** The GitHub mirror, which carries every commit, tree,

blob, tag, and advertised ref and no record of who pushed what or when — and

which, as rehearsal 3 found, currently carries 307 commits of history the WAL

never held. So a second operator restoring from the mirror alone would today

recover *more source* and *no provenance*: a complete-looking repository with

no evidence attached to any of it. `EXIT-003` proves both halves of that trade

in a test process; this rehearsal is where it becomes a fact about this forge.

**The metadata half was not exercised**, because the account export it depends

on returns `404` on the live forge — see rehearsal 6. **The credential half was

not exercised**, because it depends on rehearsal 4, which found two families

that do not survive rotation at all.

**This rehearsal cannot be completed from here.** Completing it needs a WAL

copy held somewhere the current operator does not solely control, which is an

owner action and an infrastructure decision, not a code change. It is the same

missing thing `#151` and `#168` name for the anchor, one level up: an anchor

proves the log was not rewritten, and a second custodian is what makes the log

obtainable at all. Neither exists today and no rehearsal changes that.

## 6. Partial export

**Proves:** an export that cannot return everything says so rather than

   enforces against the surface in both directions, and against the same

   counts published at `GET /api/status` under `independence.export`.

### Result, 2026-08-24

**Step 1 could not be performed. The route does not exist on the live forge.**

```

$ curl -s -o /dev/null -w '%{http_code}\n' https://openagents.com/data/export/account

404

$ curl -s -o /dev/null -w '%{http_code}\n' https://openagents.com/data/export

302

```

`302` is the sign-in redirect, which is what an authenticated route answers to

an anonymous caller. `404` is what a route that was never compiled answers.

`GET /data/export/account` landed in `b061b99`, after the deployed revision.

**Step 3 could not be performed either**, for the same reason one level up:

`/api/status` publishes no `independence` section, because

`OpenAgents.Forge.Independence` is not on the deployed build. So the counts

this step says to compare against do not exist, and neither does the

`independence.export.gaps` list. Filed as #187.

**What was exercised instead.** The bounds and `not_included` properties this

rehearsal checks are proven in

`test/openagents/data_rights/account_export_test.exs` against the ledger in

both directions, and that proof is green. What a green proof cannot tell you is

whether the route is reachable, and that is the whole content of this result:

`EXIT-001` is the most thoroughly proven of the six exit invariants, and the

document it proves cannot be downloaded from the forge it describes.

**One thing changed here rather than only being found.** #178 landed while this

rehearsal was being performed, so the route now accepts an `age` recipient and

returns a document encrypted to a key the operator does not hold. That widens

what step 1 will check once a release carries it: the export can now be taken

without the operator being able to read the file that carries it. The store it

was built from stays plaintext, which `GET /api/status` publishes beside it —

see `docs/2026-08-24-private-export-encryption.md`.

## What these rehearsals do not cover

- **Withholding.** No rehearsal detects an operator who serves nothing or

  serves stale state.

- **Confidentiality of the store.** The account export can now be encrypted to

  a key the recipient holds (#178), which protects the file and not the

  database it was read from. No column in this repository is encrypted at rest

  (#193), so the operator holds the plaintext every export is built from.

- **Confidentiality.** No export is encrypted to a key the recipient holds, and

  no column in this repository is encrypted at rest (#178).

- **Attribution of operator reads.** No operator read is audited, so no

  rehearsal can show one did not happen.

- **The gap between a proven invariant and a deployed one.** Nothing reports

  it. Five of the six rehearsals above ran into it, and each found it by hand.

  #187.

  hand-rolled vaults seal three specific fields — GitHub access tokens, machine

  pairing tokens, and voice recording chunks — and each takes its key from the

  application environment, which is the operator's environment. They defend

  against a stolen database dump, not against the operator. Only one of the

  three can be rotated without losing what it sealed (#192). #193 carries the

  at-rest question, and #178 decided the export path separately because losing

  an export key costs nothing while losing a storage key would be permanent.

  against a stolen database dump, not against the operator.

- **Every repository's contents.** Git objects live unencrypted in the node's

  bare repositories and in the WAL. Whatever protection exists is disk-level

  and object-storage-level, which is to say transparent to whoever runs the

`docs/forge-exit-rehearsals.md` defines six rehearsals — restore, receipt

verification, mirror divergence, key rotation, operator loss, and partial

export — with what each proves, what it cannot, and whether anyone has run it.

All six have now been run against the live forge (#180, 2026-08-24). Five found

something. The restore rehearsal found that a full clone of this repository

aborts on a missing object (#179); the receipt rehearsal found that the

verifier reports zero findings on that same repository at the same hour, and

that no entry in the live log carries the chain link `EXIT-005` describes; the

mirror rehearsal found a configured mirror two contracts said did not exist,

and 307 commits that live only on it (#188); the rotation rehearsal found two

key families that lose data or history when rotated (#191, #192); and the

export rehearsal found that `GET /data/export/account` answers `404` on the

live forge (#187). The operator-loss rehearsal cannot be completed from inside

this repository at all, and says so.

Every one of `EXIT-001` through `EXIT-006` was green throughout. Each runs

against a forge the test process builds; a rehearsal runs against the forge

people use, and that is the entire difference.

Five of the six have never been run outside the test suite, and the one that

was run against the live forge failed: a full clone of this repository aborts

on a missing object 275 commits behind `main` (#179). `EXIT-004` was green

throughout, because it runs against a forge the test builds and never against

the one people clone from.

## Open gaps

| Gap | Issue |

| --- | --- |

| The live forge cannot serve a full clone of its own repository | #179 |

| The exit surfaces are proven on `main` and absent from the deployed forge | #187 |

| The published WAL anchor is served by the operator and witnessed by nobody, so a consistent rewrite is caught only by a reader who kept a copy | #151 |

| No column is encrypted at rest, so the operator reads the source every export is built from | #193 |

| A mirror is configured while two contracts say none is, and it holds 307 commits the forge cannot serve | #188 |

| The documented WAL rebuild command does not exist | #189 |

| `verify/1` cannot be reached from the repository name the configuration admits | #190 |

| A backdated issuer-key retirement silently unverifies attestations | #191 |

| The machine pairing vault cannot survive a GitHub key rotation | #192 |

| No WAL copy exists outside storage the operator solely controls, so operator loss is unrehearsable | #151, #168 |

| Five of six exit rehearsals have never been performed | #180 |

# Persona-specific recording layout and source-manifest vocabulary.

^(assets|lib|test)/.*:[0-9]+:.*mic_left_sarah_right

^(assets|lib|test)/.*:[0-9]+:.*(sarah_authored_speech|(final|prepared)_sarah_script|sarah-(corpus|runbook|contracts|knowledge))

# Production infrastructure still carries pre-rename names: the fleet instances

# behind openagents.com are sarah-fleet-1..3, the WAL bucket is sarah-forge-wal,

# and the Cloud SQL instance is sarah-postgres. The exit rehearsals record where

# the WAL actually lives and which host each command ran on, because "a second

# operator obtains nothing" is a claim about a named bucket in a named project

# rather than a general sentiment. Renaming the infrastructure is a separate

# operator action; naming it accurately here is not optional.

^docs/forge-exit-rehearsals\.md:[0-9]+:.*sarah-(fleet-[0-9]|forge-wal|postgres)

    test "each axis of the disclosure decides degraded on its own", _context do

      clean_export = %{"gaps" => []}

      encrypted = %{"exports_encrypted" => true}

      unencrypted = %{"exports_encrypted" => false}

      # #178 split the private-data axis in two: an export encrypted to a

      # recipient-held key, and a store that is still plaintext. Both have to

      # be clean before the axis is, so the "private" side of this table

      # varies each of them.

      private_clean = %{

        "export_recipient_encryption" => true,

        "encrypted_at_rest" => true

      }

      unencrypted_export = %{private_clean | "export_recipient_encryption" => false}

      plaintext_store = %{private_clean | "encrypted_at_rest" => false}

      published_unwitnessed = %{"anchor_published" => true, "anchor_witnessed" => false}

      witnessed = %{"anchor_published" => true, "anchor_witnessed" => true}

      unpublished = %{"anchor_published" => false, "anchor_witnessed" => false}

      # Publishing the anchor is not witnessing it, and the disclosure has to

      # keep reporting degraded on the second. Every other axis is clean here,

      # so this asserts the witness disjunct rather than riding on a constant.

      assert Independence.degraded?(clean_export, published_unwitnessed, encrypted)

      assert Independence.degraded?(clean_export, unpublished, encrypted)

      assert Independence.degraded?(clean_export, witnessed, unencrypted)

      assert Independence.degraded?(%{"gaps" => [%{}]}, witnessed, encrypted)

      refute Independence.degraded?(clean_export, witnessed, encrypted)

      assert Independence.degraded?(clean_export, published_unwitnessed, private_clean)

      assert Independence.degraded?(clean_export, unpublished, private_clean)

      assert Independence.degraded?(clean_export, witnessed, unencrypted_export)

      assert Independence.degraded?(clean_export, witnessed, plaintext_store)

      assert Independence.degraded?(%{"gaps" => [%{}]}, witnessed, private_clean)

      refute Independence.degraded?(clean_export, witnessed, private_clean)

    end

  end