Make the reference check fail when it cannot run

Make the reference check fail when it cannot run

Two CI checks could not fail at their own job. The reference check's
ripgrep calls end in a swallowed failure, and the gate's tool check
required jq, mix, and npm but never rg — so on a builder without
ripgrep the scan found nothing, reported nothing, and passed. It now
refuses to start without rg, and the gate checks for it alongside the
others. Verified both ways: green with ripgrep on PATH, exit 1 with it
hidden.

ops/ci/stack-contracts.sh is deleted. STACK-001 cited it as evidence
and nothing invoked it — no gate stage, no caller — and all it did was
run a test file the suite already runs. The evidence line and proof
index now name that test directly, so the contract points at something
that executes.

Built by a Devin child through the openagents coder's delegate tool.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GoYpb8FEmdxVErsv7ABCYi

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GoYpb8FEmdxVErsv7ABCYi

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

pushed: by user · WAL seq 339 · 2026-08-25T05:22:47.378646Z

Changed files

modified INVARIANTS.md
modified ops/ci/gate.sh
modified ops/ci/reference-check.sh
deleted ops/ci/stack-contracts.sh

Diff

4 files changed, +8 -13


Evidence: `OpenAgents.Stacks`, `OpenAgents.Stacks.Stack`,
`OpenAgents.Stacks.StackEntry`, `OpenAgents.Stacks.OID`,
`ops/ci/stack-contracts.sh`, and `test/openagents/stacks_test.exs`.
and `test/openagents/stacks_test.exs`.

### ISSUE-001 — A commit closes an issue only from the default branch


| EXIT-004 | `test/openagents/forge/independence_test.exs` |
| EXIT-005 | `test/openagents/forge/independence_test.exs`, `test/openagents/forge/wal_test.exs`, `test/openagents/forge/git_http_test.exs`, `test/openagents_web/controllers/push_receipt_controller_test.exs`, `test/openagents_web/controllers/forge_anchor_controller_test.exs` |
| EXIT-006 | `test/openagents/forge/independence_disclosure_test.exs`, `test/openagents/data_rights/age_test.exs` |
| STACK-001 | `ops/ci/stack-contracts.sh`, `test/openagents/stacks_test.exs` |
| STACK-001 | `test/openagents/stacks_test.exs` |
| ISSUE-001 | `test/openagents/forge/commit_references_test.exs`, `test/openagents/issues/closing_references_test.exs`, `test/openagents/forge/push_closes_issues_test.exs` |
| FORUM-001 | `test/openagents/forum/legacy_surface_test.exs`, `test/openagents_web/live/forum_live_test.exs`, `test/openagents_web/route_authority_test.exs`, `test/openagents_web/sidebar_state_test.exs` |
| ISSUE-002 | `test/openagents/issues/task_list_test.exs`, `test/openagents/issues/task_references_test.exs`, `test/openagents_web/live/issue_show_live_test.exs` |

  exit 1
fi

for command_name in jq mix npm; do
for command_name in jq mix npm rg; do
  if ! command -v "$command_name" >/dev/null 2>&1; then
    echo "$command_name is required for the release gate" >&2
    exit 1

repo_root=$(git rev-parse --show-toplevel)
cd "$repo_root"

if ! command -v rg >/dev/null 2>&1; then
  echo "rg is required for the reference check" >&2
  exit 1
fi

allowlist="ops/ci/allowed-sarah-references.txt"
matches=$(mktemp /tmp/openagents-reference-matches.XXXXXX)
patterns=$(mktemp /tmp/openagents-reference-patterns.XXXXXX)

#!/bin/sh
set -eu

script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)

cd "$repo_root"

MIX_ENV=test mix test --warnings-as-errors \
  test/openagents/stacks_test.exs

4644	4644
4645	4645		Evidence: `OpenAgents.Stacks`, `OpenAgents.Stacks.Stack`,
4646	4646		`OpenAgents.Stacks.StackEntry`, `OpenAgents.Stacks.OID`,
4647		-	`ops/ci/stack-contracts.sh`, and `test/openagents/stacks_test.exs`.
	4647	+	and `test/openagents/stacks_test.exs`.
4648	4648
4649	4649		`### ISSUE-001 — A commit closes an issue only from the default branch`
4650	4650

5273	5273		\| EXIT-004 \| `test/openagents/forge/independence_test.exs` \|
5274	5274		\| EXIT-005 \| `test/openagents/forge/independence_test.exs`, `test/openagents/forge/wal_test.exs`, `test/openagents/forge/git_http_test.exs`, `test/openagents_web/controllers/push_receipt_controller_test.exs`, `test/openagents_web/controllers/forge_anchor_controller_test.exs` \|
5275	5275		\| EXIT-006 \| `test/openagents/forge/independence_disclosure_test.exs`, `test/openagents/data_rights/age_test.exs` \|
5276		-	\| STACK-001 \| `ops/ci/stack-contracts.sh`, `test/openagents/stacks_test.exs` \|
	5276	+	\| STACK-001 \| `test/openagents/stacks_test.exs` \|
5277	5277		\| ISSUE-001 \| `test/openagents/forge/commit_references_test.exs`, `test/openagents/issues/closing_references_test.exs`, `test/openagents/forge/push_closes_issues_test.exs` \|
5278	5278		\| FORUM-001 \| `test/openagents/forum/legacy_surface_test.exs`, `test/openagents_web/live/forum_live_test.exs`, `test/openagents_web/route_authority_test.exs`, `test/openagents_web/sidebar_state_test.exs` \|
5279	5279		\| ISSUE-002 \| `test/openagents/issues/task_list_test.exs`, `test/openagents/issues/task_references_test.exs`, `test/openagents_web/live/issue_show_live_test.exs` \|

68	68		`exit 1`
69	69		`fi`
70	70
71		-	`for command_name in jq mix npm; do`
	71	+	`for command_name in jq mix npm rg; do`
72	72		`if ! command -v "$command_name" >/dev/null 2>&1; then`
73	73		`echo "$command_name is required for the release gate" >&2`
74	74		`exit 1`

4	4		`repo_root=$(git rev-parse --show-toplevel)`
5	5		`cd "$repo_root"`
6	6
	7	+	`if ! command -v rg >/dev/null 2>&1; then`
	8	+	`echo "rg is required for the reference check" >&2`
	9	+	`exit 1`
	10	+	`fi`
	11	+
7	12		`allowlist="ops/ci/allowed-sarah-references.txt"`
8	13		`matches=$(mktemp /tmp/openagents-reference-matches.XXXXXX)`
9	14		`patterns=$(mktemp /tmp/openagents-reference-patterns.XXXXXX)`

1	-	`#!/bin/sh`
2	-	`set -eu`
3	-
4	-	`script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)`
5	-	`repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)`
6	-
7	-	`cd "$repo_root"`
8	-
9	-	`MIX_ENV=test mix test --warnings-as-errors \`
10	-	`test/openagents/stacks_test.exs`