A mirror is configured in production, and it holds 307 commits the forge cannot serve #188

Closing. All three criteria are met. The third was a decision, and it is made
and recorded; performing it is a production write that is tracked separately and
named below.

1. The contracts state what is configured

Already true when this pass started, and confirmed rather than redone.
INVARIANTS.md EXIT-003 says :forge_mirror_urls is set from the environment
and that production sets it for openagents.com; CLAUDE.md says production
mirrors to GitHub with a force push of every ref; and
test/openagents/forge/independence_test.exs fails if either re-asserts "set by
no environment", "no mirror runs today", or "Automatic mirroring to GitHub is
not configured".

One file was still carrying the old sentence: docs/forge-operator-independence.md
said ":forge_mirror_urls is empty in config/config.exs and set by no
environment, so no mirror runs today". That is where the mirror contract is
written in prose, and the first pass corrected the two files a test named while
leaving the third to be found by hand a second time. It is corrected, and it has
joined the guarded set, so it cannot drift back either.

2. The mirror and the pre-seed history

Recorded in docs/forge-operator-independence.md, under a heading of its own,
with both halves of the relation and the boundary between them.

• From the seed forward — everything the WAL records — the mirror is
  strictly lossy and is never an input. It carries objects and refs and no
  evidence. That is EXIT-003 and it is the load-bearing direction.
• Before the seed — 307 commits — the relation is inverted. The log was
  seeded from a --depth=1 fetch (#179), so no rebuild can produce them, and
  the mirror is the only copy.

Re-measured 2026-08-25, both sides cloned fresh:

The counts are at different tips because the forge was ahead of the mirror when
they were read; the gap is unchanged at 307, and git rev-list --count eda094c6
on the mirror is 308 — the seed and its 307 ancestors.

Two things changed since this issue was filed, and both are now recorded. The
full clone from the forge succeeds — it aborted when this was written — and
it is grafted rather than truncated: it writes a shallow file naming five
reconciled boundaries and passes git fsck. So EXIT-004 is not violated by
the gap. Its #179 amendment already admits a grafted repository as clean,
because history that says where it stops is servable and history that dangles is
not. I looked for a disagreement between that proof and the deployment and did
not find one; what is true is narrower and is now said without softening — the
forge is canonical for its own history only from the seed forward.

EXIT-003 carries an amendment saying that "strictly lossy" is a claim about
evidence and was being read as a claim about objects.

3. The decision

Import the objects; do not manufacture the evidence. Recorded in
docs/forge-operator-independence.md with the two rejected shapes.

Fabricating WAL entries for the 307 commits would invent evidence: an entry
carries a sequence, a principal, and a time, and
OpenAgents.Forge.Pushes.reconcile_receipts/1 derives a receipt from every one,
so it would publish receipts for pushes nobody made — in a log whose whole value
is that a receipt derives from the WAL and never from a second authority.

Recording "canonical from the seed forward" and stopping is true of the present
and is not enough as an end state: it leaves the forge's own authority holding
less than its mirror does, and leaves the only copy of this repository's first
year on an account the operator does not control.

So: the log gains the bytes and gains no assertion about who pushed them.
OpenAgents.Forge.Backfill.import_history/3 is that operation and it already
exists — it appends the bundle as a git_bundle entry with the ref map
unchanged, an empty shallow set, and a principal recording who authorized the
import; it proves the bundle against a throwaway repository borrowing the
projection's objects and refuses to write unless every boundary's parents
resolve and the union walks. Six tests cover it, including a rebuild from
sequence zero afterwards. It takes a file an operator supplies rather than
reaching for a mirror, so EXIT-003's proof is untouched.

The bundle is built and verified: the mirror holds all five boundaries' parents
(fdd00d4c, e0e61fb1, 0fcbbbb8, f8a7822a, c91327d6), one bundle closes
all five, it is 7.2 MB, and git bundle verify reports a complete history. The
recipe and the invocation are now step 5 of rehearsal 3 in
docs/forge-exit-rehearsals.md.

The import itself was not performed, and that is the one thing this issue
does not close. A WAL append cannot be undone — EXIT-005 makes removing an
entry a rewrite of the whole suffix — and if a node cannot materialize the
entry, Sync falls back to a full rebuild from sequence zero, which rehearsal 3
records as never having been run against the live projection. That is an
attended operation on a forge people are pushing to. It is a separate unit of
work with its own acceptance criteria and is tracked as the follow-up linked
below, with the bundle recipe, the boundary table, and the convergence checks
already written out.

Follow-up: #256.