OpenAgents

Commit

Record the completed Gate 5 readiness proof

e37d303aabb7 · Christopher David · · parent 5351e62b3b1a 

Record the completed Gate 5 readiness proof

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

  • modified docs/2026-08-20-integration-hardening-and-staging-readiness-recommendations.md
  • added docs/evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.json
  • added docs/evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.receipt

Diff

3 files changed, +79 -1

docs/2026-08-20-integration-hardening-and-staging-readiness-recommendations.md modified +30 -1

@@ -509,6 +509,35 @@ boots without its tools or rejects every direct load is not ready.

509 509 
**Exit criteria:** A staging release either starts with a valid, reviewed
510 510 
configuration or exits before serving traffic with a redacted diagnostic.
511 511
512 
**Gate 5 status (2026-08-20): complete.**
513
514 
- Added `OpenAgents.RuntimeConfig` as the typed boundary for endpoint,
515 
  database, GitHub, provider, feature, forge, storage, Horde, Ra, discovery,
516 
  node, and distribution settings. It validates before migrations, supervised
517 
  workers, or the endpoint and names only the invalid setting in failures.
518 
- Replaced provider-side process-environment reads with the boundary's
519 
  centralized OpenAI secret accessor. GitHub OAuth scopes are now configured
520 
  once and validated against the implemented retained-token tool model.
521 
- Added an explicit Gate 5 staging profile with every feature boolean set.
522 
  Staging-gate fences refuse advanced product features before Gate 14, forge
523 
  deployment and boot convergence before Gate 13, and Ra before Gate 12.
524 
  Production remains separately locked.
525 
- Removed inherited temporary-directory fallbacks for Ra, forge data, forge
526 
  WAL, build queues, artifacts, and coding jobs. Enabled staging features must
527 
  use explicit absolute storage paths outside `/tmp`.
528 
- Added content-free Mix and release readiness commands plus startup behavior
529 
  checks for the executable tool catalog and hot-load examples. The release
530 
  wrapper now generates Castle runtime configuration before either readiness
531 
  or migrations, fixing a fresh-release preboot ordering defect.
532 
- Exact committed SHA `5351e62b3b1ab1734c810779860344d611ebd0bd`
533 
  passed 1,237 default Elixir tests, all 9 distributed tests, 17 browser tests,
534 
  the documentation and dependency gates, the redacted release readiness
535 
  check, migrations, and startup against a disposable PostgreSQL database.
536 
  The retained [readiness report](evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.json)
537 
  and [receipt](evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.receipt)
538 
  contain no credentials, URLs, hosts, paths, node names, or tokens. No staging
539 
  deployment or production action occurred.
540
512 541 
## Gate 6: Harden identity, authorization, and secrets
513 542
514 543 
### Decide GitHub token retention deliberately

@@ -1156,7 +1185,7 @@ each handoff.

1156 1185 
- [x] The application has one Markdown parser, component system, and documented
1157 1186 
      two-tier icon policy.
1158 1187 
- [x] The dark-only palette has no nonfunctional theme control.
1159 
- [ ] Runtime configuration is typed, redacted, and staging-specific.
1188 
- [x] Runtime configuration is typed, redacted, and staging-specific.
1160 1189 
- [ ] Every route has an explicit authority class.
1161 1190 
- [ ] GitHub token behavior matches code, UI disclosure, and data rights.
1162 1191 
- [ ] Issues and Projects are scoped by repository in code and PostgreSQL.
docs/evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.json added +38

@@ -0,0 +1,38 @@

1 
{
2 
  "environment": "staging",
3 
  "features": {
4 
    "boot_convergence": false,
5 
    "computers": false,
6 
    "conversation_reset": false,
7 
    "experience_memory": false,
8 
    "forge": false,
9 
    "forge_deploy": false,
10 
    "graph_memory": false,
11 
    "incident_fixer": false,
12 
    "memory_portability": false,
13 
    "ra": false,
14 
    "semantic_memory": false,
15 
    "shadow_programs": false,
16 
    "tool_embeddings": false,
17 
    "tools": true,
18 
    "turn_recovery": false,
19 
    "voice": false,
20 
    "voice_recording": false,
21 
    "voice_recovery": false,
22 
    "voice_retention": false,
23 
    "work": false,
24 
    "work_workers": false
25 
  },
26 
  "groups": {
27 
    "cluster": "ready",
28 
    "database": "ready",
29 
    "endpoint": "ready",
30 
    "features": "ready",
31 
    "forge": "ready",
32 
    "github": "ready",
33 
    "providers": "ready"
34 
  },
35 
  "schema": "openagents.runtime_configuration.v1",
36 
  "staging_gate": 5,
37 
  "status": "ready"
38 
}
docs/evidence/gate-5/5351e62b3b1ab1734c810779860344d611ebd0bd/runtime-readiness.receipt added +11

@@ -0,0 +1,11 @@

1 
source_commit=5351e62b3b1ab1734c810779860344d611ebd0bd
2 
source_tree=e201c78c38bc03645bda33c3abdf3d692d205df9
3 
profile_sha256=c05d37778d2bbc34d6fd996fda3b0543be2eb4d3b2e0a317397f59d70e518995
4 
readiness_sha256=c3a540b980de44e97a9a77bea5e5a6805c4a6037aa1217773c8aa4d820c26cc3
5 
generated_at=2026-08-20T07:34:06Z
6 
readiness_status=ready
7 
release_smoke=passed
8 
default_elixir_tests=1237
9 
cluster_elixir_tests=9
10 
browser_tests=17
11 
production_action=none

This page updates live while a promote is in flight · changelog