A governance rule nothing enforces would be a contract with no proof.

Derived fields state their sources, including whose visibility.

`issue.openagents.progress` is derived from the reader's own readable boards

through `OpenAgents.Repositories.readable_by/2`, the one predicate every

repository surface composes, so a column on a board in a private repository the

reader cannot open never becomes a fact about a public issue. The filter and

the field read the same query, so a listed issue always reports the value it

was listed under.

`issue.openagents.progress` is derived from three records the reader may

already read, each through the authority that record answers to: an attempt

holding the issue in `forge_assignments`, admitted at `pulse` by

`OpenAgents.Transparency.WorkDisclosure` and withheld when its own tier is

`dark` or its artifact link is revoked; a thread bound to the issue, narrowed

by `OpenAgents.Threads.readable_by/2` (THREAD-002); and a board column, narrowed

by `OpenAgents.Repositories.readable_by/2`, the one predicate every repository

surface composes. So neither a column on a board in a private repository, nor

an owner-only session, nor a withheld attempt ever becomes a fact about a

public issue. Each input also says when it stops counting — a passed deadline,

a quiet session, a column somebody moves — so a claim cannot read as work

forever. The filter and the field compose the same expression, so a listed

issue always reports the value it was listed under.

Evidence: `OpenAgentsWeb.ApiExtensionController`, `OpenAgentsWeb.IssueJSON`,

`OpenAgents.Issues`,

  alias OpenAgents.Accounts.User

  alias OpenAgents.Agents.Agent

  alias OpenAgents.Analytics

  alias OpenAgents.Conversations.Visitor

  alias OpenAgents.Forge.Assignment

  alias OpenAgents.Issues.{Comment, Issue, IssueDependency, TaskReferences, UnknownReference}

  alias OpenAgents.Labels

  alias OpenAgents.Labels.Label

  alias OpenAgents.Repo

  alias OpenAgents.Repositories

  alias OpenAgents.Repositories.Repository

  alias OpenAgents.Threads

  alias OpenAgents.Threads.Thread

  alias OpenAgents.Transparency.ArtifactLink

  @issues_per_page 25

  @maximum_page 10_000

    "started"

  ]

  # The attempt states that hold an issue's claim. `forge_assignments` carries a

  # partial unique index over exactly these two, so at most one attempt is

  # working an issue at a time, and reaching a terminal state releases it.

  @claiming_attempt_states ~w(admitted running)

  # How long an open thread bound to an issue keeps reading as work in flight

  # after its last recorded event. See the going-quiet rule in `progress_map/2`.

  @thread_quiet_after_seconds 2 * 60 * 60

  @doc "How many issues one index page shows."

  def per_page, do: @issues_per_page

  Supported options: `:type`, `:state`, `:label`, `:assignee`, `:milestone`,

  `:q`, `:blocked`, `:progress`, `:reader`, and `:page`. Filters compose;

  counts and pages always agree because they read the same query. `:reader` is

  the user whose readable boards `:progress` derives from, and only that option

  reads it.

  the user whose readable attempts, sessions, and boards `:progress` derives

  from, and only that option reads it.

  `:type` defaults to `"issue"`, which excludes the issue rows pull requests

  are built on. Pass `"pull_request"` for only those, or `"all"` for GitHub's

  def get_issue_by_number!(%Repository{id: repository_id}, number) when is_integer(number),

    do: Repo.get_by!(Issue, repository_id: repository_id, number: number)

  @doc """

  The issue numbered `number` in `repository`, or `nil`.

  The same lookup as `get_issue_by_number!/2` for a caller resolving a

  reference somebody typed, where a number naming no issue is an ordinary

  answer rather than an exception.

  """

  @spec get_issue_by_number(Repository.t(), integer()) :: Issue.t() | nil

  def get_issue_by_number(%Repository{id: repository_id}, number) when is_integer(number),

    do: Repo.get_by(Issue, repository_id: repository_id, number: number)

  def get_issue_by_path!(owner, repository_name, number) when is_integer(number) do

    # The repository is resolved through the one read predicate rather than a

    # restated join. The copy this replaced omitted `lifecycle_state`, so an

  @doc """

  How far along each issue in `issues` is, keyed by issue id.

  Progress is derived, never stored. An issue is `"done"` when it is closed,

  because closing an issue is the act that finishes it. An open issue is

  `"in_progress"` when a board `reader` can read places it in a started column,

  and `"to_do"` otherwise — including when the only board saying otherwise is

  one the reader cannot open, so a private board's column never becomes a fact

  about a public issue.

  Progress is derived, never stored. Nothing here reads a column somebody had

  to remember to set: every input below is a record some other act already

  wrote, which is why the value can be trusted without anybody maintaining it.

  An issue is `"done"` when it is closed, because closing an issue is the act

  that finishes it. An open issue is `"in_progress"` when any one of three

  records the `reader` may read says work is under way on it, and `"to_do"`

  otherwise.

  ## The three ways work starts

    * **An attempt holds the issue.** `forge_assignments` is the one record

      binding an issue to work: `OpenAgents.Forge.Assignments.create/1` claims

      the issue, and a partial unique index over the claiming states keeps that

      claim singular. An attempt in `admitted` or `running` is work in flight.

    * **A session is bound to the issue.** A coding session opens a thread, and

      a thread whose objective named an issue in its own repository carries

      that issue's id (`OpenAgents.Threads.open/3`). An open thread that has

      recorded something recently is an agent working right now. This is the

      input that matters most here, because it is the one the workflow that

      produces almost all the movement actually writes.

    * **A board says so.** A project board the reader can open places the issue

      in a started column. This was the only input, and is now one of three,

      because nothing in how work begins here touches a board (issue #254).

  A `Done` column on an open issue reads `"to_do"`: the board and the issue

  disagree, and the issue's own state is the one both the UI and the API

  already treat as authoritative.

  One query serves a whole page, so rendering a list never walks the boards

  ## The going-quiet rule

  A claim that never lapses would say work is under way forever, so each input

  says when it stops counting, and each says it from a clock that record

  already keeps:

    * An **attempt** counts while it holds the claim and its `deadline_at` has

      not passed. `OpenAgents.Forge.AssignmentExpiry` reaps past-deadline

      attempts every minute, and the deadline is read here too, so a reader

      never sees a claim the reaper has not yet reached.

    * A **thread** counts while it is open and something was recorded on it

      within #{div(@thread_quiet_after_seconds, 3600)} hours. Every appended

      event advances the thread's `updated_at`, so that column is the session's

      heartbeat. A session records a turn and every tool it runs; silence that

      long is not a slow step, it is a session nobody came back to. The thread

      stays open — a thread holds its admission slot until it finishes or its

      authority is spent, and waiting alone reaches neither — but it stops

      claiming an issue.

    * A **board column** has no clock and is given none. It is a statement

      somebody made deliberately, and it stands until somebody moves it.

  ## Visibility

  Every input is read through the authority that record already answers to, so

  a private claim never becomes a public fact about an issue:

    * A **board item** is evidence only for a reader who could open the board it

      sits on, through the one readable predicate every repository surface

      composes.

    * A **thread** is evidence only for a reader who may read it, through

      `OpenAgents.Threads.readable_by/2` — its owner, or anybody when the

      thread was opened at a tier wider than owner-only (THREAD-002).

    * An **attempt** is evidence only when its transparency tier is not `dark`

      and its artifact link is not revoked. That an attempt of some shape is

      running is a `pulse` fact for any reader who reached the issue

      (`OpenAgents.Transparency.WorkDisclosure`), and the two conditions here

      are the two ways that projection resolves to `dark` instead.

  Nothing about *who* is working reaches this value. It answers "is work under

  way", never whose thread, whose board, or whose attempt.

  One query serves a whole page, so rendering a list never walks these records

  once per row.

  """

  def progress_map(issues, reader \\ nil)

  defp started_issue_ids([], _reader), do: MapSet.new()

  defp started_issue_ids(ids, reader) do

    reader

    |> started_item_query()

    |> where([item], item.issue_id in ^ids)

    |> select([item], item.issue_id)

    from(issue in Issue, as: :issue, where: issue.id in ^ids, select: issue.id)

    |> where(^started_dynamic(reader))

    |> Repo.all()

    |> MapSet.new()

  end

  # The one place "work has started" is defined. Both the derived field and the

  # `?progress=` filter compose this expression against a query that binds the

  # issue as `:issue`, so the value the API serves and the rows the filter

  # returns cannot disagree about the same issue.

  defp started_dynamic(reader) do

    dynamic(

      exists(claiming_attempt_query()) or

        exists(bound_thread_query(reader)) or

        exists(started_item_query(reader))

    )

  end

  # An attempt that holds the issue's claim and whose deadline has not passed,

  # withheld when its own projection resolves to `dark`.

  defp claiming_attempt_query do

    now = DateTime.utc_now()

    from(attempt in Assignment,

      left_join: link in ArtifactLink,

      on: link.id == attempt.artifact_link_id,

      where: attempt.issue_id == parent_as(:issue).id,

      where: attempt.state in ^@claiming_attempt_states,

      where: attempt.deadline_at > ^now,

      where: attempt.transparency_tier != "dark",

      where: is_nil(attempt.artifact_link_id) or is_nil(link.revoked_at),

      select: 1

    )

  end

  # An open thread bound to the issue that has not gone quiet, narrowed to what

  # the reader may read by the thread context's own predicate rather than a

  # restatement of it.

  defp bound_thread_query(reader) do

    quiet_before = DateTime.add(DateTime.utc_now(), -@thread_quiet_after_seconds, :second)

    from(thread in Thread,

      as: :thread,

      join: owner in Visitor,

      as: :owner,

      on: owner.id == thread.owner_visitor_id,

      where: thread.issue_id == parent_as(:issue).id,

      where: thread.status == "open",

      where: thread.updated_at > ^quiet_before,

      select: 1

    )

    |> Threads.readable_by(reader)

  end

  # A board item is only evidence for a reader who could open the board it sits

  # on, so the board repository passes through the one readable predicate every

  # repository surface composes.

      from(repository in Repositories.readable_by(Repository, reader), select: repository.id)

    from(item in ProjectItem,

      where: item.issue_id == parent_as(:issue).id,

      where: item.repository_id in subquery(readable),

      where:

        fragment("lower(btrim(coalesce(? ->> 'Status', '')))", item.values) in ^@started_columns

        fragment("lower(btrim(coalesce(? ->> 'Status', '')))", item.values) in ^@started_columns,

      select: 1

    )

  end

  defp maybe_filter_progress(query, nil, _reader), do: query

  # The filter reads the same closed-issue rule and the same started-column

  # query the derived field does, so `?progress=` and `issue.openagents.progress`

  # The filter reads the same closed-issue rule and the same started expression

  # the derived field does, so `?progress=` and `issue.openagents.progress`

  # cannot disagree about the same issue.

  defp maybe_filter_progress(query, "done", _reader),

    do: where(query, [issue], issue.state == "closed")

  defp maybe_filter_progress(query, "in_progress", reader) do

    query

    |> where([issue], issue.state == "open")

    |> where([], exists(started_exists_query(reader)))

    |> where(^started_dynamic(reader))

  end

  defp maybe_filter_progress(query, "to_do", reader) do

    started = started_dynamic(reader)

    query

    |> where([issue], issue.state == "open")

    |> where([], not exists(started_exists_query(reader)))

  end

  defp started_exists_query(reader) do

    reader

    |> started_item_query()

    |> where([item], item.issue_id == parent_as(:issue).id)

    |> select([], 1)

    |> where(^dynamic(not (^started)))

  end

  defp maybe_filter_search(query, nil), do: query

  alias OpenAgents.Chat.OpenRouter

  alias OpenAgents.Conversations

  alias OpenAgents.Conversations.Visitor

  alias OpenAgents.Forge.CommitReferences

  alias OpenAgents.Inference

  alias OpenAgents.Inference.{Credit, Grant, Models, Pricing}

  alias OpenAgents.Issues

  alias OpenAgents.Issues.Issue

  alias OpenAgents.Repo

  alias OpenAgents.Repositories

  alias OpenAgents.Repositories.Repository

  alias OpenAgents.Threads.Event

  alias OpenAgents.Threads.Thread

  an account already at `maximum_open_per_account/0` is refused with

  `:thread_quota_reached` rather than given a further grant.

  `:issue_id` binds the thread to the issue it is work for. A caller that names

  none gets one derived: when `:repository` is given and the objective names an

  issue in that repository the opener can read, the thread carries that issue's

  id. An agent is launched with a prompt that names the issue it is to work,

  and that prompt is the objective, so the binding needs no second act — which

  is what lets an issue read `In progress` while a session is on it

  (`OpenAgents.Issues.progress_map/2`, issue #254).

  `:visibility` is the thread's transparency tier and defaults to

  `OpenAgents.Threads.Thread.default_visibility/0`, owner-only. A wider tier

  given here is recorded in the transcript as `thread.visibility_set`

  def open(%Visitor{id: visitor_id} = owner, objective, options) when is_binary(objective) do

    _reaped = reap_expired(owner)

    insert_thread(visitor_id, objective, options)

    insert_thread(visitor_id, objective, bind_issue(owner, objective, options))

  end

  # An agent is launched with a prompt that names the issue it is to work, and

  # that prompt is the thread's objective. Resolving the reference once, here,

  # is what gives `threads.issue_id` a writer — and what lets an issue read

  # `In progress` while a session is on it without anybody marking a board or

  # keeping a second field by hand (issue #254).

  #

  # The reference is read by `OpenAgents.Forge.CommitReferences`, which is the

  # one place a `#N` reference is defined here, so an objective and a commit

  # message mean the same thing by `#254`. The boundaries are the ones the

  # closing-reference path already draws: the thread must name the repository

  # it runs in, only a bare `#N` or that same `owner/name#N` resolves, and the

  # issue must be one the opener could already read. A caller that passed an

  # explicit `:issue_id` has said which issue it means, and is left alone.

  defp bind_issue(%Visitor{} = owner, objective, options) do

    if Keyword.has_key?(options, :issue_id) do

      options

    else

      case referenced_issue(owner, objective, Keyword.get(options, :repository)) do

        %Issue{id: id} -> Keyword.put(options, :issue_id, id)

        nil -> options

      end

    end

  end

  defp referenced_issue(_owner, _objective, path) when not is_binary(path), do: nil

  defp referenced_issue(%Visitor{user_id: user_id}, objective, path) do

    with [owner, name] <- String.split(String.trim(path), "/", parts: 2),

         number when is_integer(number) <- referenced_number(objective, owner, name),

         %Repository{} = repository <-

           Repositories.visible_by_path(owner, name, reader(user_id)) do

      Issues.get_issue_by_number(repository, number)

    else

      _unresolved -> nil

    end

  end

  defp reader(nil), do: nil

  defp reader(user_id), do: Repo.get(User, user_id)

  # The first reference in the objective that names this thread's own

  # repository, bare or qualified. A reference to another repository resolves

  # to nothing, the same boundary `OpenAgents.Issues.ClosingReferences` draws:

  # binding across repositories asks a second authority question this does not

  # answer.

  defp referenced_number(objective, owner, name) do

    objective

    |> CommitReferences.all()

    |> Enum.find_value(fn reference ->

      if same_repository?(reference, owner, name), do: reference.number

    end)

  end

  defp same_repository?(%{owner: nil, repository: nil}, _owner, _name), do: true

  defp same_repository?(%{owner: owner, repository: name}, path_owner, path_name)

       when is_binary(owner) and is_binary(name) do

    String.downcase(owner) == String.downcase(path_owner) and

      String.downcase(name) == String.downcase(path_name)

  end

  defp same_repository?(_reference, _owner, _name), do: false

  @doc """

  Open a thread and mint its authority, or leave nothing behind.

    with {:ok, id} <- Ecto.UUID.cast(thread_id),

         {%Thread{} = thread, owner_user_id} <-

           Repo.one(

             from(t in Thread,

               join: v in Visitor,

               on: v.id == t.owner_visitor_id,

               where: t.id == ^id,

               select: {t, v.user_id}

             from(thread in Thread,

               as: :thread,

               join: owner in Visitor,

               as: :owner,

               on: owner.id == thread.owner_visitor_id,

               where: thread.id == ^id,

               select: {thread, owner.user_id}

             )

             |> readable_for(user)

             |> readable_by(user)

           ) do

      {:ok, thread, if(owner_user_id == user.id, do: :owner, else: :reader)}

    else

  """

  @spec list_for_issue(Issue.t(), User.t()) :: [Thread.t()]

  def list_for_issue(%Issue{id: issue_id}, %User{} = reader) do

    from(t in Thread,

      join: v in Visitor,

      on: v.id == t.owner_visitor_id,

      where: t.issue_id == ^issue_id,

      order_by: [desc: t.inserted_at, desc: t.id],

    from(thread in Thread,

      as: :thread,

      join: owner in Visitor,

      as: :owner,

      on: owner.id == thread.owner_visitor_id,

      where: thread.issue_id == ^issue_id,

      order_by: [desc: thread.inserted_at, desc: thread.id],

      limit: ^@maximum_listed

    )

    |> readable_for(reader)

    |> readable_by(reader)

    |> Repo.all()

  end

  defp readable_for(query, %User{id: user_id}) do

  @doc """

  Narrows a thread query to the threads `reader` may read.

  A thread is admitted when the reader owns it, or when it was opened at a tier

  wider than owner-only, because a thread's transcript is private until its

  owner says otherwise (THREAD-002). An anonymous reader owns nothing, so only

  the wide tiers reach them.

  This is public so a caller outside this context composes the thread's own

  authority rather than restating it — `OpenAgents.Issues.progress_map/2`

  derives "an agent is working this issue" from a bound thread and must not

  invent a second answer to who may see one. The query must bind the thread as

  `:thread` and its owner visitor as `:owner`.

  """

  @spec readable_by(Ecto.Queryable.t(), User.t() | nil) :: Ecto.Query.t()

  def readable_by(query, reader)

  def readable_by(query, %User{id: user_id}) do

    wide = Thread.wide_visibilities()

    where(query, [t, v], v.user_id == ^user_id or t.visibility in ^wide)

    where(

      query,

      [thread: thread, owner: owner],

      owner.user_id == ^user_id or thread.visibility in ^wide

    )

  end

  def readable_by(query, nil) do

    where(query, [thread: thread], thread.visibility in ^Thread.wide_visibilities())

  end

  defp in_repository(query, repository) when is_binary(repository),

  reason with a distinct reading, so it keeps the cancelled glyph; every other

  close is the purple check-circle.

  The exception is `in_progress`. An open issue a board says someone has

  started takes Circle's `:started` arc, which is the shape the component set

  has always drawn and never had data for. The value is the same derived

  The exception is `in_progress`. An open issue somebody has started takes

  Circle's `:started` arc — an attempt holding the issue, a session bound to

  it, or a board column saying so, whichever the reader may see

  (`OpenAgents.Issues.progress_map/2`). The value is the same derived

  `issue.openagents.progress` the API serves, read through the same reader's

  visibility, so the list and the API cannot show different work as underway.

  A caller that has not read progress passes none and gets GitHub's two states.

          "enum" => OpenAgents.Issues.progress_values(),

          "description" =>

            "How far along the issue is. Derived: a closed issue is done, and " <>

              "an open issue is in_progress while a board the reader can open " <>

              "places it in a started column."

              "an open issue is in_progress while an attempt holds it, a " <>

              "session the reader can read is bound to it, or a board the " <>

              "reader can open places it in a started column."

        },

        "work" => %{

          "type" => "array",

derived, never stored:

- A closed issue is `done`. Closing an issue is the act that finishes it.

- An open issue is `in_progress` while a project board the reader can open

  places it in a started column — `In Progress`, `In review`, or `Started`,

  matched without regard to case or separators.

- An open issue is `in_progress` while any one of three records says work is

  under way on it:

  - **An attempt holds it.** An execution attempt against the issue is

    `admitted` or `running` and its deadline has not passed.

  - **A session is bound to it.** A coding session the reader may read is open

    on the issue and has recorded something in the last two hours. A session

    binds itself: a thread whose objective names an issue in its own

    repository carries that issue.

  - **A board says so.** A project board the reader can open places the issue

    in a started column — `In Progress`, `In review`, or `Started`, matched

    without regard to case or separators.

- Every other open issue is `to_do`, including one whose only board column is

  `Done`, because the issue is still open.

Board visibility is the reader's own. A column on a board in a private

repository the reader is not a member of never becomes a fact about the issue.

Each input says when it stops counting, so a claim never reads as work

forever: an attempt's deadline passes, a session goes quiet, or somebody moves

the board column.

Visibility is the reader's own for every input. A column on a board in a

private repository the reader is not a member of, an owner-only session, and

an attempt withheld at its own transparency tier all leave the issue reading

`to_do`. Nothing here says *who* is working, only that work is under way.

```text

GET /api/v1/repos/:owner/:repo/issues?progress=in_progress

defmodule OpenAgents.IssueProgressTest do

  use OpenAgents.DataCase

  import Ecto.Query

  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  alias OpenAgents.Forge.Assignment

  alias OpenAgents.Issues

  alias OpenAgents.ProjectItems

  alias OpenAgents.Projects

  alias OpenAgents.Threads

  alias OpenAgents.Threads.Thread

  alias OpenAgents.Transparency.ArtifactLink

  setup do

    {:ok, repository: repository_fixture()}

    end

  end

  describe "an attempt holding the issue" do

    test "starts the issue with no board anywhere", %{repository: repository} do

      {:ok, issue} = Issues.create_issue(repository, %{title: "Picked up"})

      {:ok, untouched} = Issues.create_issue(repository, %{title: "Nobody has touched this"})

      attempt(repository, issue, state: "running")

      assert Issues.progress(issue) == "in_progress"

      assert Issues.progress(untouched) == "to_do"

    end

    test "an admitted attempt has started it too", %{repository: repository} do

      {:ok, issue} = Issues.create_issue(repository, %{title: "Admitted"})

      attempt(repository, issue, state: "admitted")

      assert Issues.progress(issue) == "in_progress"

    end

    test "a terminal attempt has released the claim", %{repository: repository} do

      for state <- ~w(completed failed cancelled) do

        {:ok, issue} = Issues.create_issue(repository, %{title: "Attempt #{state}"})

        attempt(repository, issue, state: state)

        assert Issues.progress(issue) == "to_do", "expected #{state} to stop claiming"

      end

    end

    test "an attempt past its deadline stops claiming work", %{repository: repository} do

      {:ok, issue} = Issues.create_issue(repository, %{title: "Ran over"})

      attempt(repository, issue,

        state: "running",

        deadline_at: DateTime.add(DateTime.utc_now(), -60, :second)

      )

      assert Issues.progress(issue) == "to_do"

    end

    test "a dark attempt is withheld rather than published as progress", %{

      repository: repository

    } do

      {:ok, issue} = Issues.create_issue(repository, %{title: "Withheld"})

      attempt(repository, issue, state: "running", transparency_tier: "dark")

      assert Issues.progress(issue) == "to_do"

    end

    test "a revoked artifact link takes the attempt out of the projection", %{

      repository: repository

    } do

      user = github_user("issue-progress-revoked")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Revoked"})

      link =

        Repo.insert!(%ArtifactLink{

          account_id: user.id,

          artifact_type: "changelog",

          artifact_ref: "sha",

          repository_id: repository.id,

          tier: "ledger",

          revoked_at: DateTime.utc_now()

        })

      attempt(repository, issue, state: "running", artifact_link_id: link.id)

      assert Issues.progress(issue) == "to_do"

    end

    test "the filter lists exactly what the derived value calls started", %{

      repository: repository

    } do

      {:ok, started} = Issues.create_issue(repository, %{title: "Started"})

      {:ok, _queued} = Issues.create_issue(repository, %{title: "Queued"})

      attempt(repository, started, state: "running")

      assert {[found], 1} = Issues.list_issues_page(repository, progress: "in_progress")

      assert found.id == started.id

      {queued, _total} = Issues.list_issues_page(repository, progress: "to_do")

      assert Enum.map(queued, & &1.title) == ["Queued"]

    end

  end

  describe "a session bound to the issue" do

    test "an open thread starts the issue for the account running it", %{

      repository: repository

    } do

      user = github_user("issue-progress-owner")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Being worked"})

      {:ok, untouched} = Issues.create_issue(repository, %{title: "Untouched"})

      {:ok, _thread} = Threads.open(user, "Implement it", issue_id: issue.id)

      assert Issues.progress(issue, user) == "in_progress"

      assert Issues.progress(untouched, user) == "to_do"

    end

    test "a thread that has gone quiet stops claiming the issue", %{repository: repository} do

      user = github_user("issue-progress-quiet")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Walked away from"})

      {:ok, thread} = Threads.open(user, "Implement it", issue_id: issue.id)

      assert Issues.progress(issue, user) == "in_progress"

      go_quiet(thread)

      assert Issues.progress(issue, user) == "to_do"

      assert Repo.get!(Thread, thread.id).status == "open"

    end

    test "a finished thread stops claiming the issue", %{repository: repository} do

      user = github_user("issue-progress-finished")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Session over"})

      {:ok, thread} = Threads.open(user, "Implement it", issue_id: issue.id)

      {:ok, _cancelled} = Threads.cancel(thread, "Done with it.")

      assert Issues.progress(issue, user) == "to_do"

    end

    test "an owner-only thread never becomes another reader's fact", %{repository: repository} do

      user = github_user("issue-progress-private")

      stranger = github_user("issue-progress-stranger")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Privately worked"})

      {:ok, _dark} = Threads.open(user, "Implement it", issue_id: issue.id)

      assert Issues.progress(issue, user) == "in_progress"

      assert Issues.progress(issue, stranger) == "to_do"

      assert Issues.progress(issue, nil) == "to_do"

    end

    test "a thread opened at a wider tier reaches every reader", %{repository: repository} do

      user = github_user("issue-progress-wide")

      stranger = github_user("issue-progress-wide-stranger")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Openly worked"})

      {:ok, _ledger} =

        Threads.open(user, "Implement it", issue_id: issue.id, visibility: "ledger")

      assert Issues.progress(issue, user) == "in_progress"

      assert Issues.progress(issue, stranger) == "in_progress"

      assert Issues.progress(issue, nil) == "in_progress"

    end

    test "the filter reads the same threads the derived value does", %{repository: repository} do

      user = github_user("issue-progress-filter")

      stranger = github_user("issue-progress-filter-stranger")

      {:ok, started} = Issues.create_issue(repository, %{title: "Started"})

      {:ok, _queued} = Issues.create_issue(repository, %{title: "Queued"})

      {:ok, _thread} = Threads.open(user, "Implement it", issue_id: started.id)

      assert {[found], 1} =

               Issues.list_issues_page(repository, progress: "in_progress", reader: user)

      assert found.id == started.id

      assert {[], 0} =

               Issues.list_issues_page(repository, progress: "in_progress", reader: stranger)

      {queued, _total} =

        Issues.list_issues_page(repository, progress: "to_do", reader: stranger)

      assert Enum.map(queued, & &1.title) |> Enum.sort() == ["Queued", "Started"]

    end

  end

  describe "binding a session to the issue its objective names" do

    test "an objective naming an issue in the thread's repository binds it", %{

      repository: repository

    } do

      user = github_user("issue-bind-owner")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Named by the prompt"})

      path = "#{repository.owner}/#{repository.name}"

      {:ok, thread} =

        Threads.open(user, "Implement issue ##{issue.number} and close it", repository: path)

      assert thread.issue_id == issue.id

      assert Issues.progress(issue, user) == "in_progress"

    end

    test "the qualified form binds when it names the same repository", %{

      repository: repository

    } do

      user = github_user("issue-bind-qualified")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Named in full"})

      path = "#{repository.owner}/#{repository.name}"

      {:ok, thread} = Threads.open(user, "Work #{path}##{issue.number}", repository: path)

      assert thread.issue_id == issue.id

    end

    test "a reference to another repository binds nothing", %{repository: repository} do

      user = github_user("issue-bind-cross")

      other = repository_fixture()

      {:ok, elsewhere} = Issues.create_issue(other, %{title: "Somewhere else"})

      {:ok, thread} =

        Threads.open(

          user,

          "Work #{other.owner}/#{other.name}##{elsewhere.number}",

          repository: "#{repository.owner}/#{repository.name}"

        )

      assert is_nil(thread.issue_id)

    end

    test "a thread naming no repository binds nothing", %{repository: repository} do

      user = github_user("issue-bind-unscoped")

      {:ok, issue} = Issues.create_issue(repository, %{title: "Unreachable"})

      {:ok, thread} = Threads.open(user, "Implement issue ##{issue.number}")

      assert is_nil(thread.issue_id)

    end

    test "an issue the opener cannot read binds nothing" do

      private = repository_fixture(%{visibility: "private"})

      outsider = github_user("issue-bind-outsider")

      {:ok, issue} = Issues.create_issue(private, %{title: "Private work"})

      {:ok, thread} =

        Threads.open(outsider, "Implement issue ##{issue.number}",

          repository: "#{private.owner}/#{private.name}"

        )

      assert is_nil(thread.issue_id)

    end

    test "a number naming no issue binds nothing", %{repository: repository} do

      user = github_user("issue-bind-missing")

      {:ok, thread} =

        Threads.open(user, "Implement issue #999999",

          repository: "#{repository.owner}/#{repository.name}"

        )

      assert is_nil(thread.issue_id)

    end

  end

  defp attempt(repository, issue, overrides) do

    now = DateTime.utc_now()

    defaults = [

      repository_id: repository.id,

      issue_id: issue.id,

      target_kind: "computer",

      requesting_principal: %{"kind" => "test"},

      branch: "work/#{issue.number}-#{System.unique_integer([:positive])}",

      state: "running",

      transparency_tier: "ledger",

      deadline_at: DateTime.add(now, 3600, :second),

      admitted_at: now,

      started_at: now

    ]

    Repo.insert!(struct!(Assignment, Keyword.merge(defaults, overrides)))

  end

  # Silence, not a status change: the thread stays open and simply records

  # nothing for longer than the quiet window.

  defp go_quiet(%Thread{id: id}) do

    quiet = DateTime.add(DateTime.utc_now(), -3 * 60 * 60, :second)

    {1, _} =

      Repo.update_all(from(thread in Thread, where: thread.id == ^id),

        set: [updated_at: quiet]

      )

  end

  defp place(board_repository, issue, column) do

    {:ok, project} =

      Projects.create_project(board_repository, %{title: "Board", owner: "OpenAgents"})

    {:open_and_mint, 2} => :returns_plaintext_token,

    {:open_and_mint, 3} => :returns_plaintext_token,

    {:open_count, 1} => :scoped_by_owner,

    # Narrows a query rather than resolving anything. It is the tier predicate

    # `fetch_readable/2` and `list_for_issue/2` both compose, exported so a

    # caller outside this context — `OpenAgents.Issues.progress_map/2` — reads

    # threads through the same rule instead of writing a second one. It takes

    # no identifier and returns no thread, so it hands a caller nothing it did

    # not already have authority to ask for.

    {:readable_by, 2} => :tier_predicate,

    {:reap_expired, 1} => :scoped_by_owner,

    {:record_event, 3} => :thread_struct,

    {:record_events, 2} => :thread_struct,

    refute has_element?(view, ~s{#issues-#{queued.id} .issue-status[data-category="started"]})

  end

  # The workflow that produces almost all the movement here never opens a

  # board: an agent picks an issue up, works it, pushes, and closes it. The row

  # has to say so anyway (issue #254).

  test "a session working an issue renders the started arc with no board", %{conn: conn} do

    {:ok, started} = Issues.create_issue(repository(), %{"title" => "Being worked"})

    {:ok, queued} = Issues.create_issue(repository(), %{"title" => "Nobody has touched this"})

    # The reader is the account the setup logged in: the owner running the

    # session is the one looking at the list.

    {:ok, _thread} =

      OpenAgents.Threads.open(github_user("issue-index"), "Work it", issue_id: started.id)

    {:ok, view, _html} = live(conn, ~p"/OpenAgentsInc/openagents.com/issues")

    assert has_element?(

             view,

             ~s{#issues-#{started.id} .issue-status[data-category="started"] .issue-status__arc}

           )

    assert has_element?(view, ~s{#issues-#{queued.id} .issue-status[data-category="open"]})

    refute has_element?(view, ~s{#issues-#{queued.id} .issue-status[data-category="started"]})

  end

  defp repository do

    OpenAgents.Repositories.get_by_path!("OpenAgentsInc", "openagents.com")

  end