chore(orchestrator): add MS22 PRD, mark P1a+P1b done

Reviewed-on: #607

.mosaic/orchestrator/mission.json

@@ -75,6 +75,16 @@
       "milestone_at_end": "",
       "tasks_completed": [],
       "last_task_id": ""
+    },
+    {
+      "session_id": "sess-002",
+      "runtime": "unknown",
+      "started_at": "2026-02-28T20:30:13Z",
+      "ended_at": "",
+      "ended_reason": "",
+      "milestone_at_end": "",
+      "tasks_completed": [],
+      "last_task_id": ""
     }
   ]
 }

.mosaic/orchestrator/session.lock

@@ -1,8 +1,8 @@
 {
-  "session_id": "sess-001",
+  "session_id": "sess-002",
   "runtime": "unknown",
-  "pid": 2396592,
+  "pid": 3178395,
-  "started_at": "2026-02-28T17:48:51Z",
+  "started_at": "2026-02-28T20:30:13Z",
-  "project_path": "/tmp/ms21-api-003",
+  "project_path": "/tmp/ms21-ui-001",
   "milestone_id": ""
 }

.trivyignore

@@ -34,3 +34,9 @@ CVE-2026-26996  # HIGH: minimatch DoS via specially crafted glob patterns (needs
 # OpenBao 2.5.0 compiled with Go 1.25.6, fix needs Go >= 1.25.7.
 # Cannot build OpenBao from source (large project). Waiting for upstream release.
 CVE-2025-68121  # CRITICAL: crypto/tls session resumption
+
+# === multer CVEs (upstream via @nestjs/platform-express) ===
+# multer <2.1.0 — waiting on NestJS to update their dependency
+# These are DoS vulnerabilities in file upload handling
+GHSA-xf7r-hgr6-v32p  # HIGH: DoS via incomplete cleanup
+GHSA-v52c-386h-88mc  # HIGH: DoS via resource exhaustion

.woodpecker/api.yml

@@ -1,232 +0,0 @@
-# API Pipeline - Mosaic Stack
-# Quality gates, build, and Docker publish for @mosaic/api
-#
-# Triggers on: apps/api/**, packages/**, root configs
-# Security chain: source audit + Trivy container scan
-
-when:
-  - event: [push, pull_request, manual]
-    path:
-      include:
-        - "apps/api/**"
-        - "packages/**"
-        - "pnpm-lock.yaml"
-        - "pnpm-workspace.yaml"
-        - "turbo.json"
-        - "package.json"
-        - ".woodpecker/api.yml"
-        - ".trivyignore"
-
-variables:
-  - &node_image "node:24-alpine"
-  - &install_deps |
-    corepack enable
-    pnpm install --frozen-lockfile
-  - &use_deps |
-    corepack enable
-  - &turbo_env
-    TURBO_API:
-      from_secret: turbo_api
-    TURBO_TOKEN:
-      from_secret: turbo_token
-    TURBO_TEAM:
-      from_secret: turbo_team
-  - &kaniko_setup |
-    mkdir -p /kaniko/.docker
-    echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
-
-services:
-  postgres:
-    image: postgres:17.7-alpine3.22
-    environment:
-      POSTGRES_DB: test_db
-      POSTGRES_USER: test_user
-      POSTGRES_PASSWORD: test_password
-
-steps:
-  # === Quality Gates ===
-
-  install:
-    image: *node_image
-    commands:
-      - *install_deps
-
-  security-audit:
-    image: *node_image
-    commands:
-      - *use_deps
-      - pnpm audit --audit-level=high
-    depends_on:
-      - install
-
-  prisma-generate:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-    commands:
-      - *use_deps
-      - pnpm --filter "@mosaic/api" prisma:generate
-    depends_on:
-      - install
-
-  lint:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo lint --filter=@mosaic/api
-    depends_on:
-      - prisma-generate
-
-  typecheck:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo typecheck --filter=@mosaic/api
-    depends_on:
-      - prisma-generate
-
-  prisma-migrate:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/test_db?schema=public"
-    commands:
-      - *use_deps
-      - pnpm --filter "@mosaic/api" prisma migrate deploy
-    depends_on:
-      - prisma-generate
-
-  test:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/test_db?schema=public"
-      ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-    commands:
-      - *use_deps
-      - pnpm --filter "@mosaic/api" exec vitest run --exclude 'src/auth/auth-rls.integration.spec.ts' --exclude 'src/credentials/user-credential.model.spec.ts' --exclude 'src/job-events/job-events.performance.spec.ts' --exclude 'src/knowledge/services/fulltext-search.spec.ts' --exclude 'src/mosaic-telemetry/mosaic-telemetry.module.spec.ts'
-    depends_on:
-      - prisma-migrate
-
-  # === Build ===
-
-  build:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      NODE_ENV: "production"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo build --filter=@mosaic/api
-    depends_on:
-      - lint
-      - typecheck
-      - test
-      - security-audit
-
-  # === Docker Build & Push ===
-
-  docker-build-api:
-    image: gcr.io/kaniko-project/executor:debug
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - *kaniko_setup
-      - |
-        DESTINATIONS=""
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:$CI_COMMIT_TAG"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:latest"
-        fi
-        /kaniko/executor --context . --dockerfile apps/api/Dockerfile --snapshot-mode=redo $DESTINATIONS
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - build
-
-  # === Container Security Scan ===
-
-  security-trivy-api:
-    image: aquasec/trivy:latest
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - |
-        if [ -n "$$CI_COMMIT_TAG" ]; then
-          SCAN_TAG="$$CI_COMMIT_TAG"
-        elif [ "$$CI_COMMIT_BRANCH" = "main" ]; then
-          SCAN_TAG="latest"
-        else
-          SCAN_TAG="latest"
-        fi
-        mkdir -p ~/.docker
-        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
-          --ignorefile .trivyignore \
-          git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - docker-build-api
-
-  # === Package Linking ===
-
-  link-packages:
-    image: alpine:3
-    environment:
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - apk add --no-cache curl
-      - sleep 10
-      - |
-        set -e
-        link_package() {
-          PKG="$$1"
-          echo "Linking $$PKG..."
-          for attempt in 1 2 3; do
-            STATUS=$$(curl -s -o /tmp/link-response.txt -w "%{http_code}" -X POST \
-              -H "Authorization: token $$GITEA_TOKEN" \
-              "https://git.mosaicstack.dev/api/v1/packages/mosaic/container/$$PKG/-/link/stack")
-            if [ "$$STATUS" = "201" ] || [ "$$STATUS" = "204" ]; then
-              echo "  Linked $$PKG"
-              return 0
-            elif [ "$$STATUS" = "400" ]; then
-              echo "  $$PKG already linked"
-              return 0
-            elif [ "$$STATUS" = "404" ] && [ $$attempt -lt 3 ]; then
-              echo "  $$PKG not found yet, retrying in 5s (attempt $$attempt/3)..."
-              sleep 5
-            else
-              echo "  FAILED: $$PKG status $$STATUS"
-              cat /tmp/link-response.txt
-              return 1
-            fi
-          done
-        }
-        link_package "stack-api"
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - security-trivy-api

.woodpecker/ci.yml

@@ -0,0 +1,337 @@
+# Unified CI Pipeline - Mosaic Stack
+# Single install, parallel quality gates, sequential deploy
+#
+# Replaces: api.yml, orchestrator.yml, web.yml
+# Keeps: coordinator.yml (Python), infra.yml (separate concerns)
+#
+# Flow:
+#   install → security-audit
+#           → prisma-generate → lint + typecheck (parallel)
+#                              → prisma-migrate → test
+#           → build (after all gates pass)
+#           → docker builds (main only, parallel)
+#           → trivy scans (main only, parallel)
+#           → package linking (main only)
+
+when:
+  - event: [push, pull_request, manual]
+    path:
+      include:
+        - "apps/api/**"
+        - "apps/orchestrator/**"
+        - "apps/web/**"
+        - "packages/**"
+        - "pnpm-lock.yaml"
+        - "pnpm-workspace.yaml"
+        - "turbo.json"
+        - "package.json"
+        - ".woodpecker/ci.yml"
+        - ".trivyignore"
+
+variables:
+  - &node_image "node:24-alpine"
+  - &install_deps |
+    corepack enable
+    pnpm install --frozen-lockfile
+  - &use_deps |
+    corepack enable
+  - &turbo_env
+    TURBO_API:
+      from_secret: turbo_api
+    TURBO_TOKEN:
+      from_secret: turbo_token
+    TURBO_TEAM:
+      from_secret: turbo_team
+  - &kaniko_setup |
+    mkdir -p /kaniko/.docker
+    echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
+
+services:
+  postgres:
+    image: postgres:17.7-alpine3.22
+    environment:
+      POSTGRES_DB: test_db
+      POSTGRES_USER: test_user
+      POSTGRES_PASSWORD: test_password
+
+steps:
+  # ─── Install (once) ─────────────────────────────────────────
+  install:
+    image: *node_image
+    commands:
+      - *install_deps
+
+  # ─── Security Audit (once) ──────────────────────────────────
+  security-audit:
+    image: *node_image
+    commands:
+      - *use_deps
+      - pnpm audit --audit-level=high
+    depends_on:
+      - install
+
+  # ─── Prisma Generate ────────────────────────────────────────
+  prisma-generate:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+    commands:
+      - *use_deps
+      - pnpm --filter "@mosaic/api" prisma:generate
+    depends_on:
+      - install
+
+  # ─── Lint (all packages) ────────────────────────────────────
+  lint:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+      <<: *turbo_env
+    commands:
+      - *use_deps
+      - pnpm turbo lint
+    depends_on:
+      - prisma-generate
+
+  # ─── Typecheck (all packages, parallel with lint) ───────────
+  typecheck:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+      <<: *turbo_env
+    commands:
+      - *use_deps
+      - pnpm turbo typecheck
+    depends_on:
+      - prisma-generate
+
+  # ─── Prisma Migrate (test DB) ──────────────────────────────
+  prisma-migrate:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+      DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/test_db?schema=public"
+    commands:
+      - *use_deps
+      - pnpm --filter "@mosaic/api" prisma migrate deploy
+    depends_on:
+      - prisma-generate
+
+  # ─── Test (all packages) ───────────────────────────────────
+  test:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+      DATABASE_URL: "postgresql://test_user:test_password@postgres:5432/test_db?schema=public"
+      ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+      <<: *turbo_env
+    commands:
+      - *use_deps
+      - pnpm --filter "@mosaic/api" exec vitest run --exclude 'src/auth/auth-rls.integration.spec.ts' --exclude 'src/credentials/user-credential.model.spec.ts' --exclude 'src/job-events/job-events.performance.spec.ts' --exclude 'src/knowledge/services/fulltext-search.spec.ts' --exclude 'src/mosaic-telemetry/mosaic-telemetry.module.spec.ts'
+      - pnpm turbo test --filter=@mosaic/orchestrator --filter=@mosaic/web
+    depends_on:
+      - prisma-migrate
+
+  # ─── Build (all packages) ──────────────────────────────────
+  build:
+    image: *node_image
+    environment:
+      SKIP_ENV_VALIDATION: "true"
+      NODE_ENV: "production"
+      <<: *turbo_env
+    commands:
+      - *use_deps
+      - pnpm turbo build
+    depends_on:
+      - lint
+      - typecheck
+      - test
+      - security-audit
+
+  # ─── Docker Builds (main only, parallel) ───────────────────
+
+  docker-build-api:
+    image: gcr.io/kaniko-project/executor:debug
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - *kaniko_setup
+      - |
+        DESTINATIONS=""
+        if [ -n "$CI_COMMIT_TAG" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:$CI_COMMIT_TAG"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:latest"
+        fi
+        /kaniko/executor --context . --dockerfile apps/api/Dockerfile --snapshot-mode=redo $DESTINATIONS
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - build
+
+  docker-build-orchestrator:
+    image: gcr.io/kaniko-project/executor:debug
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - *kaniko_setup
+      - |
+        DESTINATIONS=""
+        if [ -n "$CI_COMMIT_TAG" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-orchestrator:$CI_COMMIT_TAG"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-orchestrator:latest"
+        fi
+        /kaniko/executor --context . --dockerfile apps/orchestrator/Dockerfile --snapshot-mode=redo $DESTINATIONS
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - build
+
+  docker-build-web:
+    image: gcr.io/kaniko-project/executor:debug
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - *kaniko_setup
+      - |
+        DESTINATIONS=""
+        if [ -n "$CI_COMMIT_TAG" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-web:$CI_COMMIT_TAG"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-web:latest"
+        fi
+        /kaniko/executor --context . --dockerfile apps/web/Dockerfile --snapshot-mode=redo --build-arg NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev $DESTINATIONS
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - build
+
+  # ─── Container Security Scans (main only) ──────────────────
+
+  security-trivy-api:
+    image: aquasec/trivy:latest
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - |
+        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
+        mkdir -p ~/.docker
+        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-api:$$SCAN_TAG
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - docker-build-api
+
+  security-trivy-orchestrator:
+    image: aquasec/trivy:latest
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - |
+        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
+        mkdir -p ~/.docker
+        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - docker-build-orchestrator
+
+  security-trivy-web:
+    image: aquasec/trivy:latest
+    environment:
+      GITEA_USER:
+        from_secret: gitea_username
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+    commands:
+      - |
+        if [ -n "$$CI_COMMIT_TAG" ]; then SCAN_TAG="$$CI_COMMIT_TAG"; else SCAN_TAG="latest"; fi
+        mkdir -p ~/.docker
+        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
+        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --ignorefile .trivyignore git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - docker-build-web
+
+  # ─── Package Linking (main only, once) ─────────────────────
+
+  link-packages:
+    image: alpine:3
+    environment:
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - apk add --no-cache curl
+      - sleep 10
+      - |
+        set -e
+        link_package() {
+          PKG="$$1"
+          echo "Linking $$PKG..."
+          for attempt in 1 2 3; do
+            STATUS=$$(curl -s -o /tmp/link-response.txt -w "%{http_code}" -X POST \
+              -H "Authorization: token $$GITEA_TOKEN" \
+              "https://git.mosaicstack.dev/api/v1/packages/mosaic/container/$$PKG/-/link/stack")
+            if [ "$$STATUS" = "201" ] || [ "$$STATUS" = "204" ]; then
+              echo "  Linked $$PKG"
+              return 0
+            elif [ "$$STATUS" = "400" ]; then
+              echo "  $$PKG already linked"
+              return 0
+            elif [ "$$STATUS" = "404" ] && [ $$attempt -lt 3 ]; then
+              echo "  $$PKG not found yet, retrying in 5s (attempt $$attempt/3)..."
+              sleep 5
+            else
+              echo "  FAILED: $$PKG status $$STATUS"
+              cat /tmp/link-response.txt
+              return 1
+            fi
+          done
+        }
+        link_package "stack-api"
+        link_package "stack-orchestrator"
+        link_package "stack-web"
+    when:
+      - branch: [main]
+        event: [push, manual, tag]
+    depends_on:
+      - security-trivy-api
+      - security-trivy-orchestrator
+      - security-trivy-web

.woodpecker/orchestrator.yml

@@ -1,202 +0,0 @@
-# Orchestrator Pipeline - Mosaic Stack
-# Quality gates, build, and Docker publish for @mosaic/orchestrator
-#
-# Triggers on: apps/orchestrator/**, packages/**, root configs
-# Security chain: source audit + Trivy container scan
-
-when:
-  - event: [push, pull_request, manual]
-    path:
-      include:
-        - "apps/orchestrator/**"
-        - "packages/**"
-        - "pnpm-lock.yaml"
-        - "pnpm-workspace.yaml"
-        - "turbo.json"
-        - "package.json"
-        - ".woodpecker/orchestrator.yml"
-        - ".trivyignore"
-
-variables:
-  - &node_image "node:24-alpine"
-  - &install_deps |
-    corepack enable
-    pnpm install --frozen-lockfile
-  - &use_deps |
-    corepack enable
-  - &turbo_env
-    TURBO_API:
-      from_secret: turbo_api
-    TURBO_TOKEN:
-      from_secret: turbo_token
-    TURBO_TEAM:
-      from_secret: turbo_team
-  - &kaniko_setup |
-    mkdir -p /kaniko/.docker
-    echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
-
-steps:
-  # === Quality Gates ===
-
-  install:
-    image: *node_image
-    commands:
-      - *install_deps
-
-  security-audit:
-    image: *node_image
-    commands:
-      - *use_deps
-      - pnpm audit --audit-level=high
-    depends_on:
-      - install
-
-  lint:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo lint --filter=@mosaic/orchestrator
-    depends_on:
-      - install
-
-  typecheck:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo typecheck --filter=@mosaic/orchestrator
-    depends_on:
-      - install
-
-  test:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo test --filter=@mosaic/orchestrator
-    depends_on:
-      - install
-
-  # === Build ===
-
-  build:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      NODE_ENV: "production"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo build --filter=@mosaic/orchestrator
-    depends_on:
-      - lint
-      - typecheck
-      - test
-      - security-audit
-
-  # === Docker Build & Push ===
-
-  docker-build-orchestrator:
-    image: gcr.io/kaniko-project/executor:debug
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - *kaniko_setup
-      - |
-        DESTINATIONS=""
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-orchestrator:$CI_COMMIT_TAG"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-orchestrator:latest"
-        fi
-        /kaniko/executor --context . --dockerfile apps/orchestrator/Dockerfile --snapshot-mode=redo $DESTINATIONS
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - build
-
-  # === Container Security Scan ===
-
-  security-trivy-orchestrator:
-    image: aquasec/trivy:latest
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - |
-        if [ -n "$$CI_COMMIT_TAG" ]; then
-          SCAN_TAG="$$CI_COMMIT_TAG"
-        elif [ "$$CI_COMMIT_BRANCH" = "main" ]; then
-          SCAN_TAG="latest"
-        else
-          SCAN_TAG="latest"
-        fi
-        mkdir -p ~/.docker
-        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
-          --ignorefile .trivyignore \
-          git.mosaicstack.dev/mosaic/stack-orchestrator:$$SCAN_TAG
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - docker-build-orchestrator
-
-  # === Package Linking ===
-
-  link-packages:
-    image: alpine:3
-    environment:
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - apk add --no-cache curl
-      - sleep 10
-      - |
-        set -e
-        link_package() {
-          PKG="$$1"
-          echo "Linking $$PKG..."
-          for attempt in 1 2 3; do
-            STATUS=$$(curl -s -o /tmp/link-response.txt -w "%{http_code}" -X POST \
-              -H "Authorization: token $$GITEA_TOKEN" \
-              "https://git.mosaicstack.dev/api/v1/packages/mosaic/container/$$PKG/-/link/stack")
-            if [ "$$STATUS" = "201" ] || [ "$$STATUS" = "204" ]; then
-              echo "  Linked $$PKG"
-              return 0
-            elif [ "$$STATUS" = "400" ]; then
-              echo "  $$PKG already linked"
-              return 0
-            elif [ "$$STATUS" = "404" ] && [ $$attempt -lt 3 ]; then
-              echo "  $$PKG not found yet, retrying in 5s (attempt $$attempt/3)..."
-              sleep 5
-            else
-              echo "  FAILED: $$PKG status $$STATUS"
-              cat /tmp/link-response.txt
-              return 1
-            fi
-          done
-        }
-        link_package "stack-orchestrator"
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - security-trivy-orchestrator

.woodpecker/web.yml

@@ -1,202 +0,0 @@
-# Web Pipeline - Mosaic Stack
-# Quality gates, build, and Docker publish for @mosaic/web
-#
-# Triggers on: apps/web/**, packages/**, root configs
-# Security chain: source audit + Trivy container scan
-
-when:
-  - event: [push, pull_request, manual]
-    path:
-      include:
-        - "apps/web/**"
-        - "packages/**"
-        - "pnpm-lock.yaml"
-        - "pnpm-workspace.yaml"
-        - "turbo.json"
-        - "package.json"
-        - ".woodpecker/web.yml"
-        - ".trivyignore"
-
-variables:
-  - &node_image "node:24-alpine"
-  - &install_deps |
-    corepack enable
-    pnpm install --frozen-lockfile
-  - &use_deps |
-    corepack enable
-  - &turbo_env
-    TURBO_API:
-      from_secret: turbo_api
-    TURBO_TOKEN:
-      from_secret: turbo_token
-    TURBO_TEAM:
-      from_secret: turbo_team
-  - &kaniko_setup |
-    mkdir -p /kaniko/.docker
-    echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$GITEA_USER\",\"password\":\"$GITEA_TOKEN\"}}}" > /kaniko/.docker/config.json
-
-steps:
-  # === Quality Gates ===
-
-  install:
-    image: *node_image
-    commands:
-      - *install_deps
-
-  security-audit:
-    image: *node_image
-    commands:
-      - *use_deps
-      - pnpm audit --audit-level=high
-    depends_on:
-      - install
-
-  lint:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo lint --filter=@mosaic/web
-    depends_on:
-      - install
-
-  typecheck:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo typecheck --filter=@mosaic/web
-    depends_on:
-      - install
-
-  test:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo test --filter=@mosaic/web
-    depends_on:
-      - install
-
-  # === Build ===
-
-  build:
-    image: *node_image
-    environment:
-      SKIP_ENV_VALIDATION: "true"
-      NODE_ENV: "production"
-      <<: *turbo_env
-    commands:
-      - *use_deps
-      - pnpm turbo build --filter=@mosaic/web
-    depends_on:
-      - lint
-      - typecheck
-      - test
-      - security-audit
-
-  # === Docker Build & Push ===
-
-  docker-build-web:
-    image: gcr.io/kaniko-project/executor:debug
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - *kaniko_setup
-      - |
-        DESTINATIONS=""
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-web:$CI_COMMIT_TAG"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-web:latest"
-        fi
-        /kaniko/executor --context . --dockerfile apps/web/Dockerfile --snapshot-mode=redo --build-arg NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev $DESTINATIONS
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - build
-
-  # === Container Security Scan ===
-
-  security-trivy-web:
-    image: aquasec/trivy:latest
-    environment:
-      GITEA_USER:
-        from_secret: gitea_username
-      GITEA_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-    commands:
-      - |
-        if [ -n "$$CI_COMMIT_TAG" ]; then
-          SCAN_TAG="$$CI_COMMIT_TAG"
-        elif [ "$$CI_COMMIT_BRANCH" = "main" ]; then
-          SCAN_TAG="latest"
-        else
-          SCAN_TAG="latest"
-        fi
-        mkdir -p ~/.docker
-        echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$$GITEA_USER\",\"password\":\"$$GITEA_TOKEN\"}}}" > ~/.docker/config.json
-        trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed \
-          --ignorefile .trivyignore \
-          git.mosaicstack.dev/mosaic/stack-web:$$SCAN_TAG
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - docker-build-web
-
-  # === Package Linking ===
-
-  link-packages:
-    image: alpine:3
-    environment:
-      GITEA_TOKEN:
-        from_secret: gitea_token
-    commands:
-      - apk add --no-cache curl
-      - sleep 10
-      - |
-        set -e
-        link_package() {
-          PKG="$$1"
-          echo "Linking $$PKG..."
-          for attempt in 1 2 3; do
-            STATUS=$$(curl -s -o /tmp/link-response.txt -w "%{http_code}" -X POST \
-              -H "Authorization: token $$GITEA_TOKEN" \
-              "https://git.mosaicstack.dev/api/v1/packages/mosaic/container/$$PKG/-/link/stack")
-            if [ "$$STATUS" = "201" ] || [ "$$STATUS" = "204" ]; then
-              echo "  Linked $$PKG"
-              return 0
-            elif [ "$$STATUS" = "400" ]; then
-              echo "  $$PKG already linked"
-              return 0
-            elif [ "$$STATUS" = "404" ] && [ $$attempt -lt 3 ]; then
-              echo "  $$PKG not found yet, retrying in 5s (attempt $$attempt/3)..."
-              sleep 5
-            else
-              echo "  FAILED: $$PKG status $$STATUS"
-              cat /tmp/link-response.txt
-              return 1
-            fi
-          done
-        }
-        link_package "stack-web"
-    when:
-      - branch: [main]
-        event: [push, manual, tag]
-    depends_on:
-      - security-trivy-web

apps/api/prisma/migrations/20260228000000_ms22_agent_memory/migration.sql

@@ -0,0 +1,24 @@
+-- CreateTable
+CREATE TABLE "agent_memories" (
+    "id" UUID NOT NULL,
+    "workspace_id" UUID NOT NULL,
+    "agent_id" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "value" JSONB NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "agent_memories_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "agent_memories_workspace_id_agent_id_key_key" ON "agent_memories"("workspace_id", "agent_id", "key");
+
+-- CreateIndex
+CREATE INDEX "agent_memories_workspace_id_idx" ON "agent_memories"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "agent_memories_agent_id_idx" ON "agent_memories"("agent_id");
+
+-- AddForeignKey
+ALTER TABLE "agent_memories" ADD CONSTRAINT "agent_memories_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;

apps/api/prisma/migrations/20260228000000_ms22_conversation_archive/migration.sql

@@ -0,0 +1,33 @@
+-- CreateTable
+CREATE TABLE "conversation_archives" (
+    "id" UUID NOT NULL,
+    "workspace_id" UUID NOT NULL,
+    "session_id" TEXT NOT NULL,
+    "agent_id" TEXT NOT NULL,
+    "messages" JSONB NOT NULL,
+    "message_count" INTEGER NOT NULL,
+    "summary" TEXT NOT NULL,
+    "embedding" vector(1536),
+    "started_at" TIMESTAMPTZ NOT NULL,
+    "ended_at" TIMESTAMPTZ,
+    "metadata" JSONB NOT NULL DEFAULT '{}',
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "conversation_archives_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "conversation_archives_workspace_id_session_id_key" ON "conversation_archives"("workspace_id", "session_id");
+
+-- CreateIndex
+CREATE INDEX "conversation_archives_workspace_id_idx" ON "conversation_archives"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "conversation_archives_agent_id_idx" ON "conversation_archives"("agent_id");
+
+-- CreateIndex
+CREATE INDEX "conversation_archives_started_at_idx" ON "conversation_archives"("started_at");
+
+-- AddForeignKey
+ALTER TABLE "conversation_archives" ADD CONSTRAINT "conversation_archives_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;

apps/api/prisma/migrations/20260301144006_ms22_agent_fleet_schema/migration.sql

@@ -0,0 +1,109 @@
+-- CreateTable
+CREATE TABLE "SystemConfig" (
+    "id" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "value" TEXT NOT NULL,
+    "encrypted" BOOLEAN NOT NULL DEFAULT false,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "SystemConfig_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "BreakglassUser" (
+    "id" TEXT NOT NULL,
+    "username" TEXT NOT NULL,
+    "passwordHash" TEXT NOT NULL,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "BreakglassUser_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "LlmProvider" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "displayName" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "baseUrl" TEXT,
+    "apiKey" TEXT,
+    "apiType" TEXT NOT NULL DEFAULT 'openai-completions',
+    "models" JSONB NOT NULL DEFAULT '[]',
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "LlmProvider_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "UserContainer" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "containerId" TEXT,
+    "containerName" TEXT NOT NULL,
+    "gatewayPort" INTEGER,
+    "gatewayToken" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'stopped',
+    "lastActiveAt" TIMESTAMP(3),
+    "idleTimeoutMin" INTEGER NOT NULL DEFAULT 30,
+    "config" JSONB NOT NULL DEFAULT '{}',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "UserContainer_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SystemContainer" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "role" TEXT NOT NULL,
+    "containerId" TEXT,
+    "gatewayPort" INTEGER,
+    "gatewayToken" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'stopped',
+    "primaryModel" TEXT NOT NULL,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "SystemContainer_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "UserAgentConfig" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "primaryModel" TEXT,
+    "fallbackModels" JSONB NOT NULL DEFAULT '[]',
+    "personality" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "UserAgentConfig_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SystemConfig_key_key" ON "SystemConfig"("key");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "BreakglassUser_username_key" ON "BreakglassUser"("username");
+
+-- CreateIndex
+CREATE INDEX "LlmProvider_userId_idx" ON "LlmProvider"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "LlmProvider_userId_name_key" ON "LlmProvider"("userId", "name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "UserContainer_userId_key" ON "UserContainer"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SystemContainer_name_key" ON "SystemContainer"("name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "UserAgentConfig_userId_key" ON "UserAgentConfig"("userId");

apps/api/prisma/migrations/20260301194500_add_findings/migration.sql

@@ -0,0 +1,37 @@
+-- CreateTable
+CREATE TABLE "findings" (
+    "id" UUID NOT NULL,
+    "workspace_id" UUID NOT NULL,
+    "task_id" UUID,
+    "agent_id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "data" JSONB NOT NULL,
+    "summary" TEXT NOT NULL,
+    "embedding" vector(1536),
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "findings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "findings_id_workspace_id_key" ON "findings"("id", "workspace_id");
+
+-- CreateIndex
+CREATE INDEX "findings_workspace_id_idx" ON "findings"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "findings_agent_id_idx" ON "findings"("agent_id");
+
+-- CreateIndex
+CREATE INDEX "findings_type_idx" ON "findings"("type");
+
+-- CreateIndex
+CREATE INDEX "findings_task_id_idx" ON "findings"("task_id");
+
+-- AddForeignKey
+ALTER TABLE "findings" ADD CONSTRAINT "findings_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "findings" ADD CONSTRAINT "findings_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "agent_tasks"("id") ON DELETE SET NULL ON UPDATE CASCADE;

apps/api/prisma/migrations/20260301211000_ms22_task_assigned_agent/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "tasks" ADD COLUMN "assigned_agent" TEXT;

apps/api/prisma/schema.prisma

@@ -298,6 +298,8 @@ model Workspace {
   agents                       Agent[]
   agentSessions                AgentSession[]
   agentTasks                   AgentTask[]
+  findings                     Finding[]
+  agentMemories                AgentMemory[]
   userLayouts                  UserLayout[]
   knowledgeEntries             KnowledgeEntry[]
   knowledgeTags                KnowledgeTag[]
@@ -312,6 +314,7 @@ model Workspace {
   llmUsageLogs                 LlmUsageLog[]
   userCredentials              UserCredential[]
   terminalSessions             TerminalSession[]
+  conversationArchives         ConversationArchive[]
 
   @@index([ownerId])
   @@map("workspaces")
@@ -376,6 +379,7 @@ model Task {
   creatorId   String       @map("creator_id") @db.Uuid
   projectId   String?      @map("project_id") @db.Uuid
   parentId    String?      @map("parent_id") @db.Uuid
+  assignedAgent String?    @map("assigned_agent")
   domainId    String?      @map("domain_id") @db.Uuid
   sortOrder   Int          @default(0) @map("sort_order")
   metadata    Json         @default("{}")
@@ -689,6 +693,7 @@ model AgentTask {
   createdBy   User        @relation("AgentTaskCreator", fields: [createdById], references: [id], onDelete: Cascade)
   createdById String      @map("created_by_id") @db.Uuid
   runnerJobs  RunnerJob[]
+  findings    Finding[]
 
   @@unique([id, workspaceId])
   @@index([workspaceId])
@@ -698,6 +703,33 @@ model AgentTask {
   @@map("agent_tasks")
 }
 
+model Finding {
+  id          String  @id @default(uuid()) @db.Uuid
+  workspaceId String  @map("workspace_id") @db.Uuid
+  taskId      String? @map("task_id") @db.Uuid
+
+  agentId String @map("agent_id")
+  type    String
+  title   String
+  data    Json
+  summary String @db.Text
+  // Note: vector dimension (1536) must match EMBEDDING_DIMENSION constant in @mosaic/shared
+  embedding Unsupported("vector(1536)")?
+
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  task      AgentTask? @relation(fields: [taskId], references: [id], onDelete: SetNull)
+
+  @@unique([id, workspaceId])
+  @@index([workspaceId])
+  @@index([agentId])
+  @@index([type])
+  @@index([taskId])
+  @@map("findings")
+}
+
 model AgentSession {
   id          String  @id @default(uuid()) @db.Uuid
   workspaceId String  @map("workspace_id") @db.Uuid
@@ -735,6 +767,23 @@ model AgentSession {
   @@map("agent_sessions")
 }
 
+model AgentMemory {
+  id          String   @id @default(uuid()) @db.Uuid
+  workspaceId String   @map("workspace_id") @db.Uuid
+  agentId     String   @map("agent_id")
+  key         String
+  value       Json
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@unique([workspaceId, agentId, key])
+  @@index([workspaceId])
+  @@index([agentId])
+  @@map("agent_memories")
+}
+
 model WidgetDefinition {
   id String @id @default(uuid()) @db.Uuid
 
@@ -1546,3 +1595,111 @@ model TerminalSession {
   @@index([workspaceId, status])
   @@map("terminal_sessions")
 }
+
+// ============================================
+// CONVERSATION ARCHIVE MODULE
+// ============================================
+
+model ConversationArchive {
+  id           String                       @id @default(uuid()) @db.Uuid
+  workspaceId  String                       @map("workspace_id") @db.Uuid
+  sessionId    String                       @map("session_id")
+  agentId      String                       @map("agent_id")
+  messages     Json
+  messageCount Int                          @map("message_count")
+  summary      String                       @db.Text
+  // Note: vector dimension (1536) must match EMBEDDING_DIMENSION constant in @mosaic/shared
+  embedding    Unsupported("vector(1536)")?
+  startedAt    DateTime                     @map("started_at") @db.Timestamptz
+  endedAt      DateTime?                    @map("ended_at") @db.Timestamptz
+  metadata     Json                         @default("{}")
+  createdAt    DateTime                     @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt    DateTime                     @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@unique([workspaceId, sessionId])
+  @@index([workspaceId])
+  @@index([agentId])
+  @@index([startedAt])
+  @@map("conversation_archives")
+}
+
+// ============================================
+// AGENT FLEET MODULE
+// ============================================
+
+model SystemConfig {
+  id        String   @id @default(cuid())
+  key       String   @unique
+  value     String
+  encrypted Boolean  @default(false)
+  updatedAt DateTime @updatedAt
+}
+
+model BreakglassUser {
+  id           String   @id @default(cuid())
+  username     String   @unique
+  passwordHash String
+  isActive     Boolean  @default(true)
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+}
+
+model LlmProvider {
+  id          String   @id @default(cuid())
+  userId      String
+  name        String
+  displayName String
+  type        String
+  baseUrl     String?
+  apiKey      String?
+  apiType     String   @default("openai-completions")
+  models      Json     @default("[]")
+  isActive    Boolean  @default(true)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@unique([userId, name])
+  @@index([userId])
+}
+
+model UserContainer {
+  id             String   @id @default(cuid())
+  userId         String   @unique
+  containerId    String?
+  containerName  String
+  gatewayPort    Int?
+  gatewayToken   String
+  status         String   @default("stopped")
+  lastActiveAt   DateTime?
+  idleTimeoutMin Int      @default(30)
+  config         Json     @default("{}")
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}
+
+model SystemContainer {
+  id           String   @id @default(cuid())
+  name         String   @unique
+  role         String
+  containerId  String?
+  gatewayPort  Int?
+  gatewayToken String
+  status       String   @default("stopped")
+  primaryModel String
+  isActive     Boolean  @default(true)
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+}
+
+model UserAgentConfig {
+  id             String   @id @default(cuid())
+  userId         String   @unique
+  primaryModel   String?
+  fallbackModels Json     @default("[]")
+  personality    String?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}

apps/api/src/admin/admin.service.spec.ts

@@ -24,7 +24,15 @@ describe("AdminService", () => {
     workspaceMember: {
       create: vi.fn(),
     },
-    $transaction: vi.fn(),
+    session: {
+      deleteMany: vi.fn(),
+    },
+    $transaction: vi.fn(async (ops) => {
+      if (typeof ops === "function") {
+        return ops(mockPrismaService);
+      }
+      return Promise.all(ops);
+    }),
   };
 
   const mockAdminId = "550e8400-e29b-41d4-a716-446655440001";
@@ -82,10 +90,6 @@ describe("AdminService", () => {
     service = module.get<AdminService>(AdminService);
 
     vi.clearAllMocks();
-
-    mockPrismaService.$transaction.mockImplementation(async (fn: (tx: unknown) => unknown) => {
-      return fn(mockPrismaService);
-    });
   });
 
   it("should be defined", () => {
@@ -325,12 +329,13 @@ describe("AdminService", () => {
   });
 
   describe("deactivateUser", () => {
-    it("should set deactivatedAt on the user", async () => {
+    it("should set deactivatedAt and invalidate sessions", async () => {
       mockPrismaService.user.findUnique.mockResolvedValue(mockUser);
       mockPrismaService.user.update.mockResolvedValue({
         ...mockUser,
         deactivatedAt: new Date(),
       });
+      mockPrismaService.session.deleteMany.mockResolvedValue({ count: 3 });
 
       const result = await service.deactivateUser(mockUserId);
 
@@ -341,6 +346,7 @@ describe("AdminService", () => {
           data: { deactivatedAt: expect.any(Date) },
         })
       );
+      expect(mockPrismaService.session.deleteMany).toHaveBeenCalledWith({ where: { userId: mockUserId } });
     });
 
     it("should throw NotFoundException if user does not exist", async () => {

apps/api/src/admin/admin.service.ts

@@ -192,19 +192,22 @@ export class AdminService {
       throw new BadRequestException(`User ${id} is already deactivated`);
     }
 
-    const user = await this.prisma.user.update({
+    const [user] = await this.prisma.$transaction([
-      where: { id },
+      this.prisma.user.update({
-      data: { deactivatedAt: new Date() },
+        where: { id },
-      include: {
+        data: { deactivatedAt: new Date() },
-        workspaceMemberships: {
+        include: {
-          include: {
+          workspaceMemberships: {
-            workspace: { select: { id: true, name: true } },
+            include: {
+              workspace: { select: { id: true, name: true } },
+            },
           },
         },
-      },
+      }),
-    });
+      this.prisma.session.deleteMany({ where: { userId: id } }),
+    ]);
 
-    this.logger.log(`User deactivated: ${id}`);
+    this.logger.log(`User deactivated and sessions invalidated: ${id}`);
 
     return {
       id: user.id,

apps/api/src/agent-memory/agent-memory.controller.spec.ts

@@ -0,0 +1,102 @@
+import { Test, TestingModule } from "@nestjs/testing";
+import { AgentMemoryController } from "./agent-memory.controller";
+import { AgentMemoryService } from "./agent-memory.service";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+describe("AgentMemoryController", () => {
+  let controller: AgentMemoryController;
+
+  const mockAgentMemoryService = {
+    upsert: vi.fn(),
+    findAll: vi.fn(),
+    findOne: vi.fn(),
+    remove: vi.fn(),
+  };
+
+  const mockGuard = { canActivate: vi.fn(() => true) };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      controllers: [AgentMemoryController],
+      providers: [
+        {
+          provide: AgentMemoryService,
+          useValue: mockAgentMemoryService,
+        },
+      ],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue(mockGuard)
+      .overrideGuard(WorkspaceGuard)
+      .useValue(mockGuard)
+      .overrideGuard(PermissionGuard)
+      .useValue(mockGuard)
+      .compile();
+
+    controller = module.get<AgentMemoryController>(AgentMemoryController);
+
+    vi.clearAllMocks();
+  });
+
+  const workspaceId = "workspace-1";
+  const agentId = "agent-1";
+  const key = "context";
+
+  describe("upsert", () => {
+    it("should upsert a memory entry", async () => {
+      const dto = { value: { foo: "bar" } };
+      const mockEntry = { id: "mem-1", workspaceId, agentId, key, value: dto.value };
+
+      mockAgentMemoryService.upsert.mockResolvedValue(mockEntry);
+
+      const result = await controller.upsert(agentId, key, dto, workspaceId);
+
+      expect(mockAgentMemoryService.upsert).toHaveBeenCalledWith(workspaceId, agentId, key, dto);
+      expect(result).toEqual(mockEntry);
+    });
+  });
+
+  describe("findAll", () => {
+    it("should list all memory entries for an agent", async () => {
+      const mockEntries = [
+        { id: "mem-1", key: "a", value: 1 },
+        { id: "mem-2", key: "b", value: 2 },
+      ];
+
+      mockAgentMemoryService.findAll.mockResolvedValue(mockEntries);
+
+      const result = await controller.findAll(agentId, workspaceId);
+
+      expect(mockAgentMemoryService.findAll).toHaveBeenCalledWith(workspaceId, agentId);
+      expect(result).toEqual(mockEntries);
+    });
+  });
+
+  describe("findOne", () => {
+    it("should get a single memory entry", async () => {
+      const mockEntry = { id: "mem-1", key, value: "v" };
+
+      mockAgentMemoryService.findOne.mockResolvedValue(mockEntry);
+
+      const result = await controller.findOne(agentId, key, workspaceId);
+
+      expect(mockAgentMemoryService.findOne).toHaveBeenCalledWith(workspaceId, agentId, key);
+      expect(result).toEqual(mockEntry);
+    });
+  });
+
+  describe("remove", () => {
+    it("should delete a memory entry", async () => {
+      const mockResponse = { message: "Memory entry deleted successfully" };
+
+      mockAgentMemoryService.remove.mockResolvedValue(mockResponse);
+
+      const result = await controller.remove(agentId, key, workspaceId);
+
+      expect(mockAgentMemoryService.remove).toHaveBeenCalledWith(workspaceId, agentId, key);
+      expect(result).toEqual(mockResponse);
+    });
+  });
+});

apps/api/src/agent-memory/agent-memory.controller.ts

@@ -0,0 +1,89 @@
+import {
+  Controller,
+  Get,
+  Put,
+  Delete,
+  Body,
+  Param,
+  UseGuards,
+  HttpCode,
+  HttpStatus,
+} from "@nestjs/common";
+import { AgentMemoryService } from "./agent-memory.service";
+import { UpsertAgentMemoryDto } from "./dto";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Workspace, Permission, RequirePermission } from "../common/decorators";
+
+/**
+ * Controller for per-agent key/value memory endpoints.
+ * All endpoints require authentication and workspace context.
+ *
+ * Guards are applied in order:
+ * 1. AuthGuard - Verifies user authentication
+ * 2. WorkspaceGuard - Validates workspace access
+ * 3. PermissionGuard - Checks role-based permissions
+ */
+@Controller("agents/:agentId/memory")
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+export class AgentMemoryController {
+  constructor(private readonly agentMemoryService: AgentMemoryService) {}
+
+  /**
+   * PUT /api/agents/:agentId/memory/:key
+   * Upsert a memory entry for an agent
+   * Requires: MEMBER role or higher
+   */
+  @Put(":key")
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async upsert(
+    @Param("agentId") agentId: string,
+    @Param("key") key: string,
+    @Body() dto: UpsertAgentMemoryDto,
+    @Workspace() workspaceId: string
+  ) {
+    return this.agentMemoryService.upsert(workspaceId, agentId, key, dto);
+  }
+
+  /**
+   * GET /api/agents/:agentId/memory
+   * List all memory entries for an agent
+   * Requires: Any workspace member (including GUEST)
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findAll(@Param("agentId") agentId: string, @Workspace() workspaceId: string) {
+    return this.agentMemoryService.findAll(workspaceId, agentId);
+  }
+
+  /**
+   * GET /api/agents/:agentId/memory/:key
+   * Get a single memory entry by key
+   * Requires: Any workspace member (including GUEST)
+   */
+  @Get(":key")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findOne(
+    @Param("agentId") agentId: string,
+    @Param("key") key: string,
+    @Workspace() workspaceId: string
+  ) {
+    return this.agentMemoryService.findOne(workspaceId, agentId, key);
+  }
+
+  /**
+   * DELETE /api/agents/:agentId/memory/:key
+   * Remove a memory entry
+   * Requires: MEMBER role or higher
+   */
+  @Delete(":key")
+  @HttpCode(HttpStatus.OK)
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async remove(
+    @Param("agentId") agentId: string,
+    @Param("key") key: string,
+    @Workspace() workspaceId: string
+  ) {
+    return this.agentMemoryService.remove(workspaceId, agentId, key);
+  }
+}

apps/api/src/agent-memory/agent-memory.integration.spec.ts

@@ -0,0 +1,198 @@
+import { beforeAll, beforeEach, describe, expect, it, afterAll } from "vitest";
+import { randomUUID as uuid } from "crypto";
+import { Test, TestingModule } from "@nestjs/testing";
+import { NotFoundException } from "@nestjs/common";
+import { PrismaClient } from "@prisma/client";
+import { AgentMemoryService } from "./agent-memory.service";
+import { PrismaService } from "../prisma/prisma.service";
+
+const shouldRunDbIntegrationTests =
+  process.env.RUN_DB_TESTS === "true" && Boolean(process.env.DATABASE_URL);
+const describeFn = shouldRunDbIntegrationTests ? describe : describe.skip;
+
+async function createWorkspace(
+  prisma: PrismaClient,
+  label: string
+): Promise<{ workspaceId: string; ownerId: string }> {
+  const workspace = await prisma.workspace.create({
+    data: {
+      name: `${label} ${Date.now()}`,
+      owner: {
+        create: {
+          email: `${label.toLowerCase().replace(/\s+/g, "-")}-${Date.now()}@example.com`,
+          name: `${label} Owner`,
+        },
+      },
+    },
+  });
+
+  return {
+    workspaceId: workspace.id,
+    ownerId: workspace.ownerId,
+  };
+}
+
+describeFn("AgentMemoryService Integration", () => {
+  let moduleRef: TestingModule;
+  let prisma: PrismaClient;
+  let service: AgentMemoryService;
+  let setupComplete = false;
+
+  let workspaceAId: string;
+  let workspaceAOwnerId: string;
+  let workspaceBId: string;
+  let workspaceBOwnerId: string;
+
+  beforeAll(async () => {
+    prisma = new PrismaClient();
+    await prisma.$connect();
+
+    const workspaceA = await createWorkspace(prisma, "Agent Memory Integration A");
+    workspaceAId = workspaceA.workspaceId;
+    workspaceAOwnerId = workspaceA.ownerId;
+
+    const workspaceB = await createWorkspace(prisma, "Agent Memory Integration B");
+    workspaceBId = workspaceB.workspaceId;
+    workspaceBOwnerId = workspaceB.ownerId;
+
+    moduleRef = await Test.createTestingModule({
+      providers: [
+        AgentMemoryService,
+        {
+          provide: PrismaService,
+          useValue: prisma,
+        },
+      ],
+    }).compile();
+
+    service = moduleRef.get<AgentMemoryService>(AgentMemoryService);
+    setupComplete = true;
+  });
+
+  beforeEach(async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    await prisma.agentMemory.deleteMany({
+      where: {
+        workspaceId: {
+          in: [workspaceAId, workspaceBId],
+        },
+      },
+    });
+  });
+
+  afterAll(async () => {
+    if (!prisma) {
+      return;
+    }
+
+    const workspaceIds = [workspaceAId, workspaceBId].filter(
+      (id): id is string => typeof id === "string"
+    );
+    const ownerIds = [workspaceAOwnerId, workspaceBOwnerId].filter(
+      (id): id is string => typeof id === "string"
+    );
+
+    if (workspaceIds.length > 0) {
+      await prisma.agentMemory.deleteMany({
+        where: {
+          workspaceId: {
+            in: workspaceIds,
+          },
+        },
+      });
+      await prisma.workspace.deleteMany({ where: { id: { in: workspaceIds } } });
+    }
+
+    if (ownerIds.length > 0) {
+      await prisma.user.deleteMany({ where: { id: { in: ownerIds } } });
+    }
+
+    if (moduleRef) {
+      await moduleRef.close();
+    }
+    await prisma.$disconnect();
+  });
+
+  it("upserts and lists memory entries", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const agentId = `agent-${uuid()}`;
+
+    const entry = await service.upsert(workspaceAId, agentId, "session-context", {
+      value: { intent: "create-tests", depth: "integration" },
+    });
+
+    expect(entry.workspaceId).toBe(workspaceAId);
+    expect(entry.agentId).toBe(agentId);
+    expect(entry.key).toBe("session-context");
+
+    const listed = await service.findAll(workspaceAId, agentId);
+
+    expect(listed).toHaveLength(1);
+    expect(listed[0]?.id).toBe(entry.id);
+    expect(listed[0]?.value).toMatchObject({ intent: "create-tests" });
+  });
+
+  it("updates existing key via upsert without creating duplicates", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const agentId = `agent-${uuid()}`;
+
+    const first = await service.upsert(workspaceAId, agentId, "preferences", {
+      value: { model: "fast" },
+    });
+
+    const second = await service.upsert(workspaceAId, agentId, "preferences", {
+      value: { model: "accurate" },
+    });
+
+    expect(second.id).toBe(first.id);
+    expect(second.value).toMatchObject({ model: "accurate" });
+
+    const rowCount = await prisma.agentMemory.count({
+      where: {
+        workspaceId: workspaceAId,
+        agentId,
+        key: "preferences",
+      },
+    });
+
+    expect(rowCount).toBe(1);
+  });
+
+  it("lists keys in sorted order and isolates by workspace", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const agentId = `agent-${uuid()}`;
+
+    await service.upsert(workspaceAId, agentId, "beta", { value: { v: 2 } });
+    await service.upsert(workspaceAId, agentId, "alpha", { value: { v: 1 } });
+    await service.upsert(workspaceBId, agentId, "alpha", { value: { v: 99 } });
+
+    const workspaceAEntries = await service.findAll(workspaceAId, agentId);
+    const workspaceBEntries = await service.findAll(workspaceBId, agentId);
+
+    expect(workspaceAEntries.map((row) => row.key)).toEqual(["alpha", "beta"]);
+    expect(workspaceBEntries).toHaveLength(1);
+    expect(workspaceBEntries[0]?.value).toMatchObject({ v: 99 });
+  });
+
+  it("throws NotFoundException when requesting unknown key", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    await expect(service.findOne(workspaceAId, `agent-${uuid()}`, "missing")).rejects.toThrow(
+      NotFoundException
+    );
+  });
+});

apps/api/src/agent-memory/agent-memory.module.ts

@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { AgentMemoryController } from "./agent-memory.controller";
+import { AgentMemoryService } from "./agent-memory.service";
+import { PrismaModule } from "../prisma/prisma.module";
+import { AuthModule } from "../auth/auth.module";
+
+@Module({
+  imports: [PrismaModule, AuthModule],
+  controllers: [AgentMemoryController],
+  providers: [AgentMemoryService],
+  exports: [AgentMemoryService],
+})
+export class AgentMemoryModule {}

apps/api/src/agent-memory/agent-memory.service.spec.ts

@@ -0,0 +1,126 @@
+import { Test, TestingModule } from "@nestjs/testing";
+import { AgentMemoryService } from "./agent-memory.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { NotFoundException } from "@nestjs/common";
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+describe("AgentMemoryService", () => {
+  let service: AgentMemoryService;
+
+  const mockPrismaService = {
+    agentMemory: {
+      upsert: vi.fn(),
+      findMany: vi.fn(),
+      findUnique: vi.fn(),
+      delete: vi.fn(),
+    },
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        AgentMemoryService,
+        {
+          provide: PrismaService,
+          useValue: mockPrismaService,
+        },
+      ],
+    }).compile();
+
+    service = module.get<AgentMemoryService>(AgentMemoryService);
+
+    vi.clearAllMocks();
+  });
+
+  const workspaceId = "workspace-1";
+  const agentId = "agent-1";
+  const key = "session-context";
+
+  describe("upsert", () => {
+    it("should upsert a memory entry", async () => {
+      const dto = { value: { data: "some context" } };
+      const mockEntry = {
+        id: "mem-1",
+        workspaceId,
+        agentId,
+        key,
+        value: dto.value,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockPrismaService.agentMemory.upsert.mockResolvedValue(mockEntry);
+
+      const result = await service.upsert(workspaceId, agentId, key, dto);
+
+      expect(mockPrismaService.agentMemory.upsert).toHaveBeenCalledWith({
+        where: { workspaceId_agentId_key: { workspaceId, agentId, key } },
+        create: { workspaceId, agentId, key, value: dto.value },
+        update: { value: dto.value },
+      });
+      expect(result).toEqual(mockEntry);
+    });
+  });
+
+  describe("findAll", () => {
+    it("should return all memory entries for an agent", async () => {
+      const mockEntries = [
+        { id: "mem-1", key: "a", value: 1 },
+        { id: "mem-2", key: "b", value: 2 },
+      ];
+
+      mockPrismaService.agentMemory.findMany.mockResolvedValue(mockEntries);
+
+      const result = await service.findAll(workspaceId, agentId);
+
+      expect(mockPrismaService.agentMemory.findMany).toHaveBeenCalledWith({
+        where: { workspaceId, agentId },
+        orderBy: { key: "asc" },
+      });
+      expect(result).toEqual(mockEntries);
+    });
+  });
+
+  describe("findOne", () => {
+    it("should return a memory entry by key", async () => {
+      const mockEntry = { id: "mem-1", workspaceId, agentId, key, value: "ctx" };
+
+      mockPrismaService.agentMemory.findUnique.mockResolvedValue(mockEntry);
+
+      const result = await service.findOne(workspaceId, agentId, key);
+
+      expect(mockPrismaService.agentMemory.findUnique).toHaveBeenCalledWith({
+        where: { workspaceId_agentId_key: { workspaceId, agentId, key } },
+      });
+      expect(result).toEqual(mockEntry);
+    });
+
+    it("should throw NotFoundException when key not found", async () => {
+      mockPrismaService.agentMemory.findUnique.mockResolvedValue(null);
+
+      await expect(service.findOne(workspaceId, agentId, key)).rejects.toThrow(NotFoundException);
+    });
+  });
+
+  describe("remove", () => {
+    it("should delete a memory entry", async () => {
+      const mockEntry = { id: "mem-1", workspaceId, agentId, key, value: "x" };
+
+      mockPrismaService.agentMemory.findUnique.mockResolvedValue(mockEntry);
+      mockPrismaService.agentMemory.delete.mockResolvedValue(mockEntry);
+
+      const result = await service.remove(workspaceId, agentId, key);
+
+      expect(mockPrismaService.agentMemory.delete).toHaveBeenCalledWith({
+        where: { workspaceId_agentId_key: { workspaceId, agentId, key } },
+      });
+      expect(result).toEqual({ message: "Memory entry deleted successfully" });
+    });
+
+    it("should throw NotFoundException when key not found", async () => {
+      mockPrismaService.agentMemory.findUnique.mockResolvedValue(null);
+
+      await expect(service.remove(workspaceId, agentId, key)).rejects.toThrow(NotFoundException);
+    });
+  });
+});

apps/api/src/agent-memory/agent-memory.service.ts

@@ -0,0 +1,79 @@
+import { Injectable, NotFoundException } from "@nestjs/common";
+import { PrismaService } from "../prisma/prisma.service";
+import { Prisma } from "@prisma/client";
+import type { UpsertAgentMemoryDto } from "./dto";
+
+@Injectable()
+export class AgentMemoryService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  /**
+   * Upsert a memory entry for an agent.
+   */
+  async upsert(workspaceId: string, agentId: string, key: string, dto: UpsertAgentMemoryDto) {
+    return this.prisma.agentMemory.upsert({
+      where: {
+        workspaceId_agentId_key: { workspaceId, agentId, key },
+      },
+      create: {
+        workspaceId,
+        agentId,
+        key,
+        value: dto.value as Prisma.InputJsonValue,
+      },
+      update: {
+        value: dto.value as Prisma.InputJsonValue,
+      },
+    });
+  }
+
+  /**
+   * List all memory entries for an agent in a workspace.
+   */
+  async findAll(workspaceId: string, agentId: string) {
+    return this.prisma.agentMemory.findMany({
+      where: { workspaceId, agentId },
+      orderBy: { key: "asc" },
+    });
+  }
+
+  /**
+   * Get a single memory entry by key.
+   */
+  async findOne(workspaceId: string, agentId: string, key: string) {
+    const entry = await this.prisma.agentMemory.findUnique({
+      where: {
+        workspaceId_agentId_key: { workspaceId, agentId, key },
+      },
+    });
+
+    if (!entry) {
+      throw new NotFoundException(`Memory key "${key}" not found for agent "${agentId}"`);
+    }
+
+    return entry;
+  }
+
+  /**
+   * Delete a memory entry by key.
+   */
+  async remove(workspaceId: string, agentId: string, key: string) {
+    const entry = await this.prisma.agentMemory.findUnique({
+      where: {
+        workspaceId_agentId_key: { workspaceId, agentId, key },
+      },
+    });
+
+    if (!entry) {
+      throw new NotFoundException(`Memory key "${key}" not found for agent "${agentId}"`);
+    }
+
+    await this.prisma.agentMemory.delete({
+      where: {
+        workspaceId_agentId_key: { workspaceId, agentId, key },
+      },
+    });
+
+    return { message: "Memory entry deleted successfully" };
+  }
+}

apps/api/src/agent-memory/dto/index.ts

@@ -0,0 +1 @@
+export * from "./upsert-agent-memory.dto";

apps/api/src/agent-memory/dto/upsert-agent-memory.dto.ts

@@ -0,0 +1,10 @@
+import { IsNotEmpty } from "class-validator";
+
+/**
+ * DTO for upserting an agent memory entry.
+ * The value accepts any JSON-serializable data.
+ */
+export class UpsertAgentMemoryDto {
+  @IsNotEmpty({ message: "value must not be empty" })
+  value!: unknown;
+}

apps/api/src/app.module.ts

@@ -27,6 +27,8 @@ import { LlmUsageModule } from "./llm-usage/llm-usage.module";
 import { BrainModule } from "./brain/brain.module";
 import { CronModule } from "./cron/cron.module";
 import { AgentTasksModule } from "./agent-tasks/agent-tasks.module";
+import { FindingsModule } from "./findings/findings.module";
+import { AgentMemoryModule } from "./agent-memory/agent-memory.module";
 import { ValkeyModule } from "./valkey/valkey.module";
 import { BullMqModule } from "./bullmq/bullmq.module";
 import { StitcherModule } from "./stitcher/stitcher.module";
@@ -37,6 +39,7 @@ import { JobStepsModule } from "./job-steps/job-steps.module";
 import { CoordinatorIntegrationModule } from "./coordinator-integration/coordinator-integration.module";
 import { FederationModule } from "./federation/federation.module";
 import { CredentialsModule } from "./credentials/credentials.module";
+import { CryptoModule } from "./crypto/crypto.module";
 import { MosaicTelemetryModule } from "./mosaic-telemetry";
 import { SpeechModule } from "./speech/speech.module";
 import { DashboardModule } from "./dashboard/dashboard.module";
@@ -45,6 +48,8 @@ import { PersonalitiesModule } from "./personalities/personalities.module";
 import { WorkspacesModule } from "./workspaces/workspaces.module";
 import { AdminModule } from "./admin/admin.module";
 import { TeamsModule } from "./teams/teams.module";
+import { ImportModule } from "./import/import.module";
+import { ConversationArchiveModule } from "./conversation-archive/conversation-archive.module";
 import { RlsContextInterceptor } from "./common/interceptors/rls-context.interceptor";
 
 @Module({
@@ -99,12 +104,15 @@ import { RlsContextInterceptor } from "./common/interceptors/rls-context.interce
     BrainModule,
     CronModule,
     AgentTasksModule,
+    FindingsModule,
+    AgentMemoryModule,
     RunnerJobsModule,
     JobEventsModule,
     JobStepsModule,
     CoordinatorIntegrationModule,
     FederationModule,
     CredentialsModule,
+    CryptoModule,
     MosaicTelemetryModule,
     SpeechModule,
     DashboardModule,
@@ -113,6 +121,8 @@ import { RlsContextInterceptor } from "./common/interceptors/rls-context.interce
     WorkspacesModule,
     AdminModule,
     TeamsModule,
+    ImportModule,
+    ConversationArchiveModule,
   ],
   controllers: [AppController, CsrfController],
   providers: [

apps/api/src/conversation-archive/conversation-archive.controller.ts

@@ -0,0 +1,69 @@
+import { Controller, Post, Get, Body, Param, Query, UseGuards } from "@nestjs/common";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Workspace, RequirePermission, Permission } from "../common/decorators";
+import { ConversationArchiveService } from "./conversation-archive.service";
+import { IngestConversationDto, SearchConversationDto, ListConversationsDto } from "./dto";
+
+/**
+ * Controller for conversation archive endpoints.
+ * All endpoints require workspace membership.
+ */
+@Controller("conversations")
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+export class ConversationArchiveController {
+  constructor(private readonly service: ConversationArchiveService) {}
+
+  /**
+   * POST /api/conversations/ingest
+   * Ingest a conversation session log and auto-embed for semantic search.
+   * Requires: MEMBER or higher
+   */
+  @Post("ingest")
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async ingest(
+    @Workspace() workspaceId: string,
+    @Body() dto: IngestConversationDto
+  ): Promise<{ id: string }> {
+    return this.service.ingest(workspaceId, dto);
+  }
+
+  /**
+   * POST /api/conversations/search
+   * Vector similarity search across archived conversations.
+   * Requires: Any workspace member
+   */
+  @Post("search")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async search(
+    @Workspace() workspaceId: string,
+    @Body() dto: SearchConversationDto
+  ): Promise<unknown> {
+    return this.service.search(workspaceId, dto);
+  }
+
+  /**
+   * GET /api/conversations
+   * List conversation archives with filtering and pagination.
+   * Requires: Any workspace member
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findAll(
+    @Workspace() workspaceId: string,
+    @Query() query: ListConversationsDto
+  ): Promise<unknown> {
+    return this.service.findAll(workspaceId, query);
+  }
+
+  /**
+   * GET /api/conversations/:id
+   * Get a single conversation archive by ID (includes full messages).
+   * Requires: Any workspace member
+   */
+  @Get(":id")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findOne(@Workspace() workspaceId: string, @Param("id") id: string): Promise<unknown> {
+    return this.service.findOne(workspaceId, id);
+  }
+}

apps/api/src/conversation-archive/conversation-archive.integration.spec.ts

@@ -0,0 +1,239 @@
+import { beforeAll, beforeEach, describe, expect, it, afterAll, vi } from "vitest";
+import { randomUUID as uuid } from "crypto";
+import { Test, TestingModule } from "@nestjs/testing";
+import { ConflictException } from "@nestjs/common";
+import { PrismaClient, Prisma } from "@prisma/client";
+import { EMBEDDING_DIMENSION } from "@mosaic/shared";
+import { ConversationArchiveService } from "./conversation-archive.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+
+const shouldRunDbIntegrationTests =
+  process.env.RUN_DB_TESTS === "true" && Boolean(process.env.DATABASE_URL);
+const describeFn = shouldRunDbIntegrationTests ? describe : describe.skip;
+
+function vector(value: number): number[] {
+  return Array.from({ length: EMBEDDING_DIMENSION }, () => value);
+}
+
+function toVectorLiteral(input: number[]): string {
+  return `[${input.join(",")}]`;
+}
+
+describeFn("ConversationArchiveService Integration", () => {
+  let moduleRef: TestingModule;
+  let prisma: PrismaClient;
+  let service: ConversationArchiveService;
+  let workspaceId: string;
+  let ownerId: string;
+  let setupComplete = false;
+
+  const embeddingServiceMock = {
+    isConfigured: vi.fn(),
+    generateEmbedding: vi.fn(),
+  };
+
+  beforeAll(async () => {
+    prisma = new PrismaClient();
+    await prisma.$connect();
+
+    const workspace = await prisma.workspace.create({
+      data: {
+        name: `Conversation Archive Integration ${Date.now()}`,
+        owner: {
+          create: {
+            email: `conversation-archive-integration-${Date.now()}@example.com`,
+            name: "Conversation Archive Integration Owner",
+          },
+        },
+      },
+    });
+
+    workspaceId = workspace.id;
+    ownerId = workspace.ownerId;
+
+    moduleRef = await Test.createTestingModule({
+      providers: [
+        ConversationArchiveService,
+        {
+          provide: PrismaService,
+          useValue: prisma,
+        },
+        {
+          provide: EmbeddingService,
+          useValue: embeddingServiceMock,
+        },
+      ],
+    }).compile();
+
+    service = moduleRef.get<ConversationArchiveService>(ConversationArchiveService);
+    setupComplete = true;
+  });
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    embeddingServiceMock.isConfigured.mockReturnValue(false);
+
+    if (!setupComplete) {
+      return;
+    }
+
+    await prisma.conversationArchive.deleteMany({ where: { workspaceId } });
+  });
+
+  afterAll(async () => {
+    if (!prisma) {
+      return;
+    }
+
+    if (workspaceId) {
+      await prisma.conversationArchive.deleteMany({ where: { workspaceId } });
+      await prisma.workspace.deleteMany({ where: { id: workspaceId } });
+    }
+    if (ownerId) {
+      await prisma.user.deleteMany({ where: { id: ownerId } });
+    }
+
+    if (moduleRef) {
+      await moduleRef.close();
+    }
+    await prisma.$disconnect();
+  });
+
+  it("ingests a conversation log", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const sessionId = `session-${uuid()}`;
+
+    const result = await service.ingest(workspaceId, {
+      sessionId,
+      agentId: "agent-conversation-ingest",
+      messages: [
+        { role: "user", content: "Can you summarize deployment issues?" },
+        { role: "assistant", content: "Yes, three retries timed out in staging." },
+      ],
+      summary: "Deployment retry failures discussed",
+      startedAt: "2026-02-28T21:00:00.000Z",
+      endedAt: "2026-02-28T21:05:00.000Z",
+      metadata: { source: "integration-test" },
+    });
+
+    expect(result.id).toBeDefined();
+
+    const stored = await prisma.conversationArchive.findUnique({
+      where: {
+        id: result.id,
+      },
+    });
+
+    expect(stored).toBeTruthy();
+    expect(stored?.workspaceId).toBe(workspaceId);
+    expect(stored?.sessionId).toBe(sessionId);
+    expect(stored?.messageCount).toBe(2);
+    expect(stored?.summary).toBe("Deployment retry failures discussed");
+  });
+
+  it("rejects duplicate session ingest per workspace", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const sessionId = `session-${uuid()}`;
+    const dto = {
+      sessionId,
+      agentId: "agent-conversation-duplicate",
+      messages: [{ role: "user", content: "hello" }],
+      summary: "simple conversation",
+      startedAt: "2026-02-28T22:00:00.000Z",
+    };
+
+    await service.ingest(workspaceId, dto);
+
+    await expect(service.ingest(workspaceId, dto)).rejects.toThrow(ConflictException);
+  });
+
+  it("rejects semantic search when embeddings are disabled", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    embeddingServiceMock.isConfigured.mockReturnValue(false);
+
+    await expect(
+      service.search(workspaceId, {
+        query: "deployment retries",
+      })
+    ).rejects.toThrow(ConflictException);
+  });
+
+  it("searches archived conversations by vector similarity", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const near = vector(0.02);
+    const far = vector(0.85);
+
+    const matching = await prisma.conversationArchive.create({
+      data: {
+        workspaceId,
+        sessionId: `session-search-${uuid()}`,
+        agentId: "agent-conversation-search-a",
+        messages: [
+          { role: "user", content: "What caused deployment retries?" },
+          { role: "assistant", content: "A connection pool timeout." },
+        ] as unknown as Prisma.InputJsonValue,
+        messageCount: 2,
+        summary: "Deployment retries caused by connection pool timeout",
+        startedAt: new Date("2026-02-28T23:00:00.000Z"),
+        metadata: { channel: "cli" } as Prisma.InputJsonValue,
+      },
+    });
+
+    const nonMatching = await prisma.conversationArchive.create({
+      data: {
+        workspaceId,
+        sessionId: `session-search-${uuid()}`,
+        agentId: "agent-conversation-search-b",
+        messages: [
+          { role: "user", content: "How is billing configured?" },
+        ] as unknown as Prisma.InputJsonValue,
+        messageCount: 1,
+        summary: "Billing and quotas conversation",
+        startedAt: new Date("2026-02-28T23:10:00.000Z"),
+        metadata: { channel: "cli" } as Prisma.InputJsonValue,
+      },
+    });
+
+    await prisma.$executeRaw`
+      UPDATE conversation_archives
+      SET embedding = ${toVectorLiteral(near)}::vector(${EMBEDDING_DIMENSION})
+      WHERE id = ${matching.id}::uuid
+    `;
+    await prisma.$executeRaw`
+      UPDATE conversation_archives
+      SET embedding = ${toVectorLiteral(far)}::vector(${EMBEDDING_DIMENSION})
+      WHERE id = ${nonMatching.id}::uuid
+    `;
+
+    embeddingServiceMock.isConfigured.mockReturnValue(true);
+    embeddingServiceMock.generateEmbedding.mockResolvedValue(near);
+
+    const result = await service.search(workspaceId, {
+      query: "deployment retries timeout",
+      agentId: "agent-conversation-search-a",
+      similarityThreshold: 0,
+      limit: 10,
+    });
+
+    const rows = result.data as Array<{ id: string; agent_id: string; similarity: number }>;
+
+    expect(result.pagination.total).toBe(1);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.id).toBe(matching.id);
+    expect(rows[0]?.agent_id).toBe("agent-conversation-search-a");
+    expect(rows[0]?.similarity).toBeGreaterThan(0);
+  });
+});

apps/api/src/conversation-archive/conversation-archive.module.ts

@@ -0,0 +1,14 @@
+import { Module } from "@nestjs/common";
+import { PrismaModule } from "../prisma/prisma.module";
+import { AuthModule } from "../auth/auth.module";
+import { KnowledgeModule } from "../knowledge/knowledge.module";
+import { ConversationArchiveService } from "./conversation-archive.service";
+import { ConversationArchiveController } from "./conversation-archive.controller";
+
+@Module({
+  imports: [PrismaModule, AuthModule, KnowledgeModule],
+  controllers: [ConversationArchiveController],
+  providers: [ConversationArchiveService],
+  exports: [ConversationArchiveService],
+})
+export class ConversationArchiveModule {}

apps/api/src/conversation-archive/conversation-archive.service.spec.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { Test, TestingModule } from "@nestjs/testing";
+import { ConflictException, NotFoundException } from "@nestjs/common";
+import { ConversationArchiveService } from "./conversation-archive.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+
+const mockPrisma = {
+  conversationArchive: {
+    findUnique: vi.fn(),
+    create: vi.fn(),
+    count: vi.fn(),
+    findMany: vi.fn(),
+    findFirst: vi.fn(),
+  },
+  $queryRaw: vi.fn(),
+  $executeRaw: vi.fn(),
+};
+
+const mockEmbedding = {
+  isConfigured: vi.fn(),
+  generateEmbedding: vi.fn(),
+};
+
+describe("ConversationArchiveService", () => {
+  let service: ConversationArchiveService;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        ConversationArchiveService,
+        { provide: PrismaService, useValue: mockPrisma },
+        { provide: EmbeddingService, useValue: mockEmbedding },
+      ],
+    }).compile();
+
+    service = module.get<ConversationArchiveService>(ConversationArchiveService);
+  });
+
+  describe("ingest", () => {
+    const workspaceId = "ws-1";
+    const dto = {
+      sessionId: "sess-abc",
+      agentId: "agent-xyz",
+      messages: [
+        { role: "user", content: "Hello" },
+        { role: "assistant", content: "Hi there!" },
+      ],
+      summary: "A greeting conversation",
+      startedAt: "2026-02-28T10:00:00Z",
+    };
+
+    it("creates a conversation archive and returns id", async () => {
+      mockPrisma.conversationArchive.findUnique.mockResolvedValue(null);
+      mockPrisma.conversationArchive.create.mockResolvedValue({ id: "conv-1" });
+      mockEmbedding.isConfigured.mockReturnValue(false);
+
+      const result = await service.ingest(workspaceId, dto);
+
+      expect(result).toEqual({ id: "conv-1" });
+      expect(mockPrisma.conversationArchive.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            workspaceId,
+            sessionId: dto.sessionId,
+            agentId: dto.agentId,
+            messageCount: 2,
+          }),
+        })
+      );
+    });
+
+    it("throws ConflictException when session already exists", async () => {
+      mockPrisma.conversationArchive.findUnique.mockResolvedValue({ id: "existing" });
+
+      await expect(service.ingest(workspaceId, dto)).rejects.toThrow(ConflictException);
+    });
+  });
+
+  describe("findAll", () => {
+    const workspaceId = "ws-1";
+
+    it("returns paginated list", async () => {
+      mockPrisma.conversationArchive.count.mockResolvedValue(5);
+      mockPrisma.conversationArchive.findMany.mockResolvedValue([
+        { id: "conv-1", sessionId: "sess-1" },
+      ]);
+
+      const result = await service.findAll(workspaceId, { page: 1, limit: 10 });
+
+      expect(result.pagination.total).toBe(5);
+      expect(result.data).toHaveLength(1);
+    });
+
+    it("uses default pagination when not provided", async () => {
+      mockPrisma.conversationArchive.count.mockResolvedValue(0);
+      mockPrisma.conversationArchive.findMany.mockResolvedValue([]);
+
+      const result = await service.findAll(workspaceId, {});
+
+      expect(result.pagination.page).toBe(1);
+      expect(result.pagination.limit).toBe(20);
+    });
+  });
+
+  describe("findOne", () => {
+    const workspaceId = "ws-1";
+
+    it("returns record when found", async () => {
+      const record = { id: "conv-1", workspaceId, sessionId: "sess-1" };
+      mockPrisma.conversationArchive.findFirst.mockResolvedValue(record);
+
+      const result = await service.findOne(workspaceId, "conv-1");
+
+      expect(result).toEqual(record);
+    });
+
+    it("throws NotFoundException when record does not exist", async () => {
+      mockPrisma.conversationArchive.findFirst.mockResolvedValue(null);
+
+      await expect(service.findOne(workspaceId, "missing")).rejects.toThrow(NotFoundException);
+    });
+  });
+
+  describe("search", () => {
+    it("throws ConflictException when embedding is not configured", async () => {
+      mockEmbedding.isConfigured.mockReturnValue(false);
+
+      await expect(service.search("ws-1", { query: "test query" })).rejects.toThrow(
+        ConflictException
+      );
+    });
+
+    it("performs vector search when configured", async () => {
+      mockEmbedding.isConfigured.mockReturnValue(true);
+      mockEmbedding.generateEmbedding.mockResolvedValue(new Array(1536).fill(0.1));
+      mockPrisma.$queryRaw
+        .mockResolvedValueOnce([{ id: "conv-1", similarity: 0.9 }])
+        .mockResolvedValueOnce([{ count: BigInt(1) }]);
+
+      const result = await service.search("ws-1", { query: "greetings" });
+
+      expect(result.data).toHaveLength(1);
+      expect(result.pagination.total).toBe(1);
+    });
+  });
+});

apps/api/src/conversation-archive/conversation-archive.service.ts

@@ -0,0 +1,277 @@
+import { Injectable, Logger, NotFoundException, ConflictException } from "@nestjs/common";
+import { Prisma } from "@prisma/client";
+import { EMBEDDING_DIMENSION } from "@mosaic/shared";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+import type { IngestConversationDto, SearchConversationDto, ListConversationsDto } from "./dto";
+
+/**
+ * Shape of a raw conversation archive row from $queryRaw vector search
+ */
+interface RawConversationResult {
+  id: string;
+  workspace_id: string;
+  session_id: string;
+  agent_id: string;
+  messages: unknown;
+  message_count: number;
+  summary: string;
+  started_at: Date;
+  ended_at: Date | null;
+  metadata: unknown;
+  created_at: Date;
+  updated_at: Date;
+  similarity: number;
+}
+
+/**
+ * Paginated response wrapper
+ */
+export interface PaginatedConversations<T> {
+  data: T[];
+  pagination: {
+    page: number;
+    limit: number;
+    total: number;
+    totalPages: number;
+  };
+}
+
+@Injectable()
+export class ConversationArchiveService {
+  private readonly logger = new Logger(ConversationArchiveService.name);
+  private readonly defaultSimilarityThreshold = 0.5;
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly embedding: EmbeddingService
+  ) {}
+
+  /**
+   * Ingest a conversation session log.
+   * Generates a vector embedding from the summary + message content and stores it alongside the record.
+   */
+  async ingest(workspaceId: string, dto: IngestConversationDto): Promise<{ id: string }> {
+    // Verify no duplicate session in this workspace
+    const existing = await this.prisma.conversationArchive.findUnique({
+      where: { workspaceId_sessionId: { workspaceId, sessionId: dto.sessionId } },
+      select: { id: true },
+    });
+
+    if (existing) {
+      throw new ConflictException(
+        `Conversation session '${dto.sessionId}' already exists in this workspace`
+      );
+    }
+
+    const messageCount = dto.messages.length;
+
+    // Create record first to get ID for embedding
+    const record = await this.prisma.conversationArchive.create({
+      data: {
+        workspaceId,
+        sessionId: dto.sessionId,
+        agentId: dto.agentId,
+        messages: dto.messages as unknown as Prisma.InputJsonValue,
+        messageCount,
+        summary: dto.summary,
+        startedAt: new Date(dto.startedAt),
+        endedAt: dto.endedAt ? new Date(dto.endedAt) : null,
+        metadata: (dto.metadata ?? {}) as Prisma.InputJsonValue,
+      },
+      select: { id: true },
+    });
+
+    // Generate and store embedding asynchronously (non-blocking for ingest)
+    if (this.embedding.isConfigured()) {
+      const textForEmbedding = this.buildEmbeddingText(dto.summary, dto.messages);
+      this.storeEmbedding(record.id, textForEmbedding).catch((err: unknown) => {
+        this.logger.error(`Failed to store embedding for conversation ${record.id}`, err);
+      });
+    }
+
+    this.logger.log(`Ingested conversation ${record.id} (session: ${dto.sessionId})`);
+    return { id: record.id };
+  }
+
+  /**
+   * Semantic vector search across conversation archives in a workspace.
+   */
+  async search(
+    workspaceId: string,
+    dto: SearchConversationDto
+  ): Promise<PaginatedConversations<RawConversationResult>> {
+    if (!this.embedding.isConfigured()) {
+      throw new ConflictException("Semantic search requires OpenAI API key to be configured");
+    }
+
+    const limit = dto.limit ?? 20;
+    const threshold = dto.similarityThreshold ?? this.defaultSimilarityThreshold;
+    const distanceThreshold = 1 - threshold;
+
+    const queryEmbedding = await this.embedding.generateEmbedding(dto.query);
+    const embeddingStr = `[${queryEmbedding.join(",")}]`;
+
+    const agentFilter = dto.agentId ? Prisma.sql`AND ca.agent_id = ${dto.agentId}` : Prisma.sql``;
+
+    const rows = await this.prisma.$queryRaw<RawConversationResult[]>`
+      SELECT
+        ca.id,
+        ca.workspace_id,
+        ca.session_id,
+        ca.agent_id,
+        ca.messages,
+        ca.message_count,
+        ca.summary,
+        ca.started_at,
+        ca.ended_at,
+        ca.metadata,
+        ca.created_at,
+        ca.updated_at,
+        (1 - (ca.embedding <=> ${embeddingStr}::vector(${EMBEDDING_DIMENSION}))) AS similarity
+      FROM conversation_archives ca
+      WHERE ca.workspace_id = ${workspaceId}::uuid
+        AND ca.embedding IS NOT NULL
+        AND (ca.embedding <=> ${embeddingStr}::vector(${EMBEDDING_DIMENSION})) <= ${distanceThreshold}
+        ${agentFilter}
+      ORDER BY ca.embedding <=> ${embeddingStr}::vector(${EMBEDDING_DIMENSION})
+      LIMIT ${limit}
+    `;
+
+    const countResult = await this.prisma.$queryRaw<[{ count: bigint }]>`
+      SELECT COUNT(*) AS count
+      FROM conversation_archives ca
+      WHERE ca.workspace_id = ${workspaceId}::uuid
+        AND ca.embedding IS NOT NULL
+        AND (ca.embedding <=> ${embeddingStr}::vector(${EMBEDDING_DIMENSION})) <= ${distanceThreshold}
+        ${agentFilter}
+    `;
+
+    const total = Number(countResult[0].count);
+
+    return {
+      data: rows,
+      pagination: {
+        page: 1,
+        limit,
+        total,
+        totalPages: Math.ceil(total / limit),
+      },
+    };
+  }
+
+  /**
+   * List conversation archives with filtering and pagination.
+   */
+  async findAll(
+    workspaceId: string,
+    query: ListConversationsDto
+  ): Promise<PaginatedConversations<object>> {
+    const page = query.page ?? 1;
+    const limit = query.limit ?? 20;
+    const skip = (page - 1) * limit;
+
+    const where: Prisma.ConversationArchiveWhereInput = {
+      workspaceId,
+      ...(query.agentId ? { agentId: query.agentId } : {}),
+      ...(query.startedAfter || query.startedBefore
+        ? {
+            startedAt: {
+              ...(query.startedAfter ? { gte: new Date(query.startedAfter) } : {}),
+              ...(query.startedBefore ? { lte: new Date(query.startedBefore) } : {}),
+            },
+          }
+        : {}),
+    };
+
+    const [total, records] = await Promise.all([
+      this.prisma.conversationArchive.count({ where }),
+      this.prisma.conversationArchive.findMany({
+        where,
+        select: {
+          id: true,
+          workspaceId: true,
+          sessionId: true,
+          agentId: true,
+          messageCount: true,
+          summary: true,
+          startedAt: true,
+          endedAt: true,
+          metadata: true,
+          createdAt: true,
+          updatedAt: true,
+        },
+        orderBy: { startedAt: "desc" },
+        skip,
+        take: limit,
+      }),
+    ]);
+
+    return {
+      data: records,
+      pagination: {
+        page,
+        limit,
+        total,
+        totalPages: Math.ceil(total / limit),
+      },
+    };
+  }
+
+  /**
+   * Get a single conversation archive by ID.
+   */
+  async findOne(workspaceId: string, id: string): Promise<object> {
+    const record = await this.prisma.conversationArchive.findFirst({
+      where: { id, workspaceId },
+      select: {
+        id: true,
+        workspaceId: true,
+        sessionId: true,
+        agentId: true,
+        messages: true,
+        messageCount: true,
+        summary: true,
+        startedAt: true,
+        endedAt: true,
+        metadata: true,
+        createdAt: true,
+        updatedAt: true,
+      },
+    });
+
+    if (!record) {
+      throw new NotFoundException(`Conversation archive '${id}' not found`);
+    }
+
+    return record;
+  }
+
+  /**
+   * Build text content for embedding from summary and messages.
+   */
+  private buildEmbeddingText(
+    summary: string,
+    messages: { role: string; content: string }[]
+  ): string {
+    const messageText = messages.map((m) => `${m.role}: ${m.content}`).join("\n");
+    return `${summary}\n\n${messageText}`.trim();
+  }
+
+  /**
+   * Generate embedding and store it on the conversation_archives row.
+   */
+  private async storeEmbedding(id: string, text: string): Promise<void> {
+    const vector = await this.embedding.generateEmbedding(text);
+    const embeddingStr = `[${vector.join(",")}]`;
+
+    await this.prisma.$executeRaw`
+      UPDATE conversation_archives
+      SET embedding = ${embeddingStr}::vector(${EMBEDDING_DIMENSION}),
+          updated_at = NOW()
+      WHERE id = ${id}::uuid
+    `;
+
+    this.logger.log(`Stored embedding for conversation ${id}`);
+  }
+}

apps/api/src/conversation-archive/dto/index.ts

@@ -0,0 +1,3 @@
+export { IngestConversationDto, ConversationMessageDto } from "./ingest-conversation.dto";
+export { SearchConversationDto } from "./search-conversation.dto";
+export { ListConversationsDto } from "./list-conversations.dto";

apps/api/src/conversation-archive/dto/ingest-conversation.dto.ts

@@ -0,0 +1,64 @@
+import {
+  IsString,
+  IsArray,
+  IsOptional,
+  IsDateString,
+  MinLength,
+  MaxLength,
+  IsObject,
+  ValidateNested,
+  ArrayMinSize,
+} from "class-validator";
+import { Type } from "class-transformer";
+
+/**
+ * Represents a single message in a conversation session
+ */
+export class ConversationMessageDto {
+  @IsString()
+  role!: string;
+
+  @IsString()
+  @MinLength(1)
+  content!: string;
+
+  @IsOptional()
+  @IsDateString()
+  timestamp?: string;
+}
+
+/**
+ * DTO for ingesting a conversation session log
+ */
+export class IngestConversationDto {
+  @IsString()
+  @MinLength(1)
+  @MaxLength(500)
+  sessionId!: string;
+
+  @IsString()
+  @MinLength(1)
+  @MaxLength(500)
+  agentId!: string;
+
+  @IsArray()
+  @ArrayMinSize(1)
+  @ValidateNested({ each: true })
+  @Type(() => ConversationMessageDto)
+  messages!: ConversationMessageDto[];
+
+  @IsString()
+  @MinLength(1)
+  summary!: string;
+
+  @IsDateString()
+  startedAt!: string;
+
+  @IsOptional()
+  @IsDateString()
+  endedAt?: string;
+
+  @IsOptional()
+  @IsObject()
+  metadata?: Record<string, unknown>;
+}

apps/api/src/conversation-archive/dto/list-conversations.dto.ts

@@ -0,0 +1,33 @@
+import { IsString, IsOptional, MaxLength, IsInt, Min, Max, IsDateString } from "class-validator";
+import { Type } from "class-transformer";
+
+/**
+ * DTO for listing/filtering conversation archives
+ */
+export class ListConversationsDto {
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  agentId?: string;
+
+  @IsOptional()
+  @IsDateString()
+  startedAfter?: string;
+
+  @IsOptional()
+  @IsDateString()
+  startedBefore?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  page?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number;
+}

apps/api/src/conversation-archive/dto/search-conversation.dto.ts

@@ -0,0 +1,40 @@
+import {
+  IsString,
+  IsOptional,
+  MinLength,
+  MaxLength,
+  IsInt,
+  Min,
+  Max,
+  IsNumber,
+} from "class-validator";
+import { Type } from "class-transformer";
+
+/**
+ * DTO for semantic search across conversation archives
+ */
+export class SearchConversationDto {
+  @IsString()
+  @MinLength(1)
+  @MaxLength(1000)
+  query!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  agentId?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber()
+  @Min(0)
+  @Max(1)
+  similarityThreshold?: number;
+}

apps/api/src/crypto/crypto.module.ts

@@ -0,0 +1,10 @@
+import { Module } from "@nestjs/common";
+import { ConfigModule } from "@nestjs/config";
+import { CryptoService } from "./crypto.service";
+
+@Module({
+  imports: [ConfigModule],
+  providers: [CryptoService],
+  exports: [CryptoService],
+})
+export class CryptoModule {}

apps/api/src/crypto/crypto.service.spec.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { ConfigService } from "@nestjs/config";
+import { CryptoService } from "./crypto.service";
+
+function createConfigService(secret?: string): ConfigService {
+  return {
+    get: (key: string) => {
+      if (key === "MOSAIC_SECRET_KEY") {
+        return secret;
+      }
+      return undefined;
+    },
+  } as unknown as ConfigService;
+}
+
+describe("CryptoService", () => {
+  let service: CryptoService;
+
+  beforeEach(() => {
+    service = new CryptoService(createConfigService("this-is-a-test-secret-key-with-32+chars"));
+  });
+
+  it("encrypt -> decrypt roundtrip", () => {
+    const plaintext = "my-secret-api-key";
+
+    const encrypted = service.encrypt(plaintext);
+    const decrypted = service.decrypt(encrypted);
+
+    expect(encrypted.startsWith("enc:")).toBe(true);
+    expect(decrypted).toBe(plaintext);
+  });
+
+  it("decrypt rejects tampered ciphertext", () => {
+    const encrypted = service.encrypt("sensitive-token");
+    const payload = encrypted.slice(4);
+    const bytes = Buffer.from(payload, "base64");
+
+    bytes[bytes.length - 1] = bytes[bytes.length - 1]! ^ 0xff;
+
+    const tampered = `enc:${bytes.toString("base64")}`;
+
+    expect(() => service.decrypt(tampered)).toThrow();
+  });
+
+  it("decrypt rejects non-encrypted string", () => {
+    expect(() => service.decrypt("plain-text-value")).toThrow();
+  });
+
+  it("isEncrypted detects prefix correctly", () => {
+    expect(service.isEncrypted("enc:abc")).toBe(true);
+    expect(service.isEncrypted("ENC:abc")).toBe(false);
+    expect(service.isEncrypted("plain-text")).toBe(false);
+  });
+
+  it("generateToken returns 64-char hex string", () => {
+    const token = service.generateToken();
+
+    expect(token).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("different plaintexts produce different ciphertexts (random IV)", () => {
+    const encryptedA = service.encrypt("value-a");
+    const encryptedB = service.encrypt("value-b");
+
+    expect(encryptedA).not.toBe(encryptedB);
+  });
+
+  it("missing MOSAIC_SECRET_KEY throws on construction", () => {
+    expect(() => new CryptoService(createConfigService(undefined))).toThrow();
+  });
+});

apps/api/src/crypto/crypto.service.ts

@@ -0,0 +1,82 @@
+import { Injectable } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const ENCRYPTED_PREFIX = "enc:";
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const DERIVED_KEY_LENGTH = 32;
+const HKDF_SALT = "mosaic.crypto.v1";
+const HKDF_INFO = "mosaic-db-secret-encryption";
+
+@Injectable()
+export class CryptoService {
+  private readonly key: Buffer;
+
+  constructor(private readonly config: ConfigService) {
+    const secret = this.config.get<string>("MOSAIC_SECRET_KEY");
+
+    if (!secret) {
+      throw new Error("MOSAIC_SECRET_KEY environment variable is required");
+    }
+
+    if (secret.length < 32) {
+      throw new Error("MOSAIC_SECRET_KEY must be at least 32 characters");
+    }
+
+    this.key = Buffer.from(
+      hkdfSync(
+        "sha256",
+        Buffer.from(secret, "utf8"),
+        Buffer.from(HKDF_SALT, "utf8"),
+        Buffer.from(HKDF_INFO, "utf8"),
+        DERIVED_KEY_LENGTH
+      )
+    );
+  }
+
+  encrypt(plaintext: string): string {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const payload = Buffer.concat([iv, ciphertext, authTag]).toString("base64");
+
+    return `${ENCRYPTED_PREFIX}${payload}`;
+  }
+
+  decrypt(encrypted: string): string {
+    if (!this.isEncrypted(encrypted)) {
+      throw new Error("Value is not encrypted");
+    }
+
+    const payloadBase64 = encrypted.slice(ENCRYPTED_PREFIX.length);
+
+    try {
+      const payload = Buffer.from(payloadBase64, "base64");
+      if (payload.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+        throw new Error("Encrypted payload is too short");
+      }
+
+      const iv = payload.subarray(0, IV_LENGTH);
+      const authTag = payload.subarray(payload.length - AUTH_TAG_LENGTH);
+      const ciphertext = payload.subarray(IV_LENGTH, payload.length - AUTH_TAG_LENGTH);
+
+      const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+      decipher.setAuthTag(authTag);
+
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    } catch {
+      throw new Error("Failed to decrypt value");
+    }
+  }
+
+  isEncrypted(value: string): boolean {
+    return value.startsWith(ENCRYPTED_PREFIX);
+  }
+
+  generateToken(): string {
+    return randomBytes(32).toString("hex");
+  }
+}

apps/api/src/findings/dto/create-finding.dto.ts

@@ -0,0 +1,33 @@
+import { IsObject, IsOptional, IsString, IsUUID, MaxLength, MinLength } from "class-validator";
+
+/**
+ * DTO for creating a finding
+ */
+export class CreateFindingDto {
+  @IsOptional()
+  @IsUUID("4", { message: "taskId must be a valid UUID" })
+  taskId?: string;
+
+  @IsString({ message: "agentId must be a string" })
+  @MinLength(1, { message: "agentId must not be empty" })
+  @MaxLength(255, { message: "agentId must not exceed 255 characters" })
+  agentId!: string;
+
+  @IsString({ message: "type must be a string" })
+  @MinLength(1, { message: "type must not be empty" })
+  @MaxLength(100, { message: "type must not exceed 100 characters" })
+  type!: string;
+
+  @IsString({ message: "title must be a string" })
+  @MinLength(1, { message: "title must not be empty" })
+  @MaxLength(255, { message: "title must not exceed 255 characters" })
+  title!: string;
+
+  @IsObject({ message: "data must be an object" })
+  data!: Record<string, unknown>;
+
+  @IsString({ message: "summary must be a string" })
+  @MinLength(1, { message: "summary must not be empty" })
+  @MaxLength(20000, { message: "summary must not exceed 20000 characters" })
+  summary!: string;
+}

apps/api/src/findings/dto/index.ts

@@ -0,0 +1,3 @@
+export { CreateFindingDto } from "./create-finding.dto";
+export { QueryFindingsDto } from "./query-findings.dto";
+export { SearchFindingsDto } from "./search-findings.dto";

apps/api/src/findings/dto/query-findings.dto.ts

@@ -0,0 +1,32 @@
+import { Type } from "class-transformer";
+import { IsInt, IsOptional, IsString, IsUUID, Max, Min } from "class-validator";
+
+/**
+ * DTO for querying findings with filters and pagination
+ */
+export class QueryFindingsDto {
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt({ message: "page must be an integer" })
+  @Min(1, { message: "page must be at least 1" })
+  page?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt({ message: "limit must be an integer" })
+  @Min(1, { message: "limit must be at least 1" })
+  @Max(100, { message: "limit must not exceed 100" })
+  limit?: number;
+
+  @IsOptional()
+  @IsString({ message: "agentId must be a string" })
+  agentId?: string;
+
+  @IsOptional()
+  @IsString({ message: "type must be a string" })
+  type?: string;
+
+  @IsOptional()
+  @IsUUID("4", { message: "taskId must be a valid UUID" })
+  taskId?: string;
+}

apps/api/src/findings/dto/search-findings.dto.ts

@@ -0,0 +1,52 @@
+import { Type } from "class-transformer";
+import {
+  IsInt,
+  IsNumber,
+  IsOptional,
+  IsString,
+  IsUUID,
+  Max,
+  MaxLength,
+  Min,
+} from "class-validator";
+
+/**
+ * DTO for finding semantic similarity search
+ */
+export class SearchFindingsDto {
+  @IsString({ message: "query must be a string" })
+  @MaxLength(1000, { message: "query must not exceed 1000 characters" })
+  query!: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt({ message: "page must be an integer" })
+  @Min(1, { message: "page must be at least 1" })
+  page?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt({ message: "limit must be an integer" })
+  @Min(1, { message: "limit must be at least 1" })
+  @Max(100, { message: "limit must not exceed 100" })
+  limit?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsNumber({}, { message: "similarityThreshold must be a number" })
+  @Min(0, { message: "similarityThreshold must be at least 0" })
+  @Max(1, { message: "similarityThreshold must not exceed 1" })
+  similarityThreshold?: number;
+
+  @IsOptional()
+  @IsString({ message: "agentId must be a string" })
+  agentId?: string;
+
+  @IsOptional()
+  @IsString({ message: "type must be a string" })
+  type?: string;
+
+  @IsOptional()
+  @IsUUID("4", { message: "taskId must be a valid UUID" })
+  taskId?: string;
+}

apps/api/src/findings/findings.controller.spec.ts

@@ -0,0 +1,195 @@
+import { Test, TestingModule } from "@nestjs/testing";
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { FindingsController } from "./findings.controller";
+import { FindingsService } from "./findings.service";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { CreateFindingDto, QueryFindingsDto, SearchFindingsDto } from "./dto";
+
+describe("FindingsController", () => {
+  let controller: FindingsController;
+  let service: FindingsService;
+
+  const mockFindingsService = {
+    create: vi.fn(),
+    findAll: vi.fn(),
+    findOne: vi.fn(),
+    search: vi.fn(),
+    remove: vi.fn(),
+  };
+
+  const mockAuthGuard = {
+    canActivate: vi.fn(() => true),
+  };
+
+  const mockWorkspaceGuard = {
+    canActivate: vi.fn(() => true),
+  };
+
+  const mockPermissionGuard = {
+    canActivate: vi.fn(() => true),
+  };
+
+  const workspaceId = "550e8400-e29b-41d4-a716-446655440001";
+  const findingId = "550e8400-e29b-41d4-a716-446655440002";
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      controllers: [FindingsController],
+      providers: [
+        {
+          provide: FindingsService,
+          useValue: mockFindingsService,
+        },
+      ],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue(mockAuthGuard)
+      .overrideGuard(WorkspaceGuard)
+      .useValue(mockWorkspaceGuard)
+      .overrideGuard(PermissionGuard)
+      .useValue(mockPermissionGuard)
+      .compile();
+
+    controller = module.get<FindingsController>(FindingsController);
+    service = module.get<FindingsService>(FindingsService);
+
+    vi.clearAllMocks();
+  });
+
+  it("should be defined", () => {
+    expect(controller).toBeDefined();
+  });
+
+  describe("create", () => {
+    it("should create a finding", async () => {
+      const createDto: CreateFindingDto = {
+        agentId: "research-agent",
+        type: "security",
+        title: "SQL injection risk",
+        data: { severity: "high" },
+        summary: "Potential SQL injection in search endpoint.",
+      };
+
+      const createdFinding = {
+        id: findingId,
+        workspaceId,
+        taskId: null,
+        ...createDto,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockFindingsService.create.mockResolvedValue(createdFinding);
+
+      const result = await controller.create(createDto, workspaceId);
+
+      expect(result).toEqual(createdFinding);
+      expect(service.create).toHaveBeenCalledWith(workspaceId, createDto);
+    });
+  });
+
+  describe("findAll", () => {
+    it("should return paginated findings", async () => {
+      const query: QueryFindingsDto = {
+        page: 1,
+        limit: 10,
+        type: "security",
+      };
+
+      const response = {
+        data: [],
+        meta: {
+          total: 0,
+          page: 1,
+          limit: 10,
+          totalPages: 0,
+        },
+      };
+
+      mockFindingsService.findAll.mockResolvedValue(response);
+
+      const result = await controller.findAll(query, workspaceId);
+
+      expect(result).toEqual(response);
+      expect(service.findAll).toHaveBeenCalledWith(workspaceId, query);
+    });
+  });
+
+  describe("findOne", () => {
+    it("should return a finding", async () => {
+      const finding = {
+        id: findingId,
+        workspaceId,
+        taskId: null,
+        agentId: "research-agent",
+        type: "security",
+        title: "SQL injection risk",
+        data: { severity: "high" },
+        summary: "Potential SQL injection in search endpoint.",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockFindingsService.findOne.mockResolvedValue(finding);
+
+      const result = await controller.findOne(findingId, workspaceId);
+
+      expect(result).toEqual(finding);
+      expect(service.findOne).toHaveBeenCalledWith(findingId, workspaceId);
+    });
+  });
+
+  describe("search", () => {
+    it("should perform semantic search", async () => {
+      const searchDto: SearchFindingsDto = {
+        query: "sql injection",
+        limit: 5,
+      };
+
+      const response = {
+        data: [
+          {
+            id: findingId,
+            workspaceId,
+            taskId: null,
+            agentId: "research-agent",
+            type: "security",
+            title: "SQL injection risk",
+            data: { severity: "high" },
+            summary: "Potential SQL injection in search endpoint.",
+            createdAt: new Date(),
+            updatedAt: new Date(),
+            score: 0.91,
+          },
+        ],
+        meta: {
+          total: 1,
+          page: 1,
+          limit: 5,
+          totalPages: 1,
+        },
+        query: "sql injection",
+      };
+
+      mockFindingsService.search.mockResolvedValue(response);
+
+      const result = await controller.search(searchDto, workspaceId);
+
+      expect(result).toEqual(response);
+      expect(service.search).toHaveBeenCalledWith(workspaceId, searchDto);
+    });
+  });
+
+  describe("remove", () => {
+    it("should delete a finding", async () => {
+      const response = { message: "Finding deleted successfully" };
+      mockFindingsService.remove.mockResolvedValue(response);
+
+      const result = await controller.remove(findingId, workspaceId);
+
+      expect(result).toEqual(response);
+      expect(service.remove).toHaveBeenCalledWith(findingId, workspaceId);
+    });
+  });
+});

apps/api/src/findings/findings.controller.ts

@@ -0,0 +1,81 @@
+import { Body, Controller, Delete, Get, Param, Post, Query, UseGuards } from "@nestjs/common";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Workspace, Permission, RequirePermission } from "../common/decorators";
+import { CreateFindingDto, QueryFindingsDto, SearchFindingsDto } from "./dto";
+import {
+  FindingsService,
+  FindingsSearchResponse,
+  PaginatedFindingsResponse,
+} from "./findings.service";
+
+/**
+ * Controller for findings endpoints
+ * All endpoints require authentication and workspace context
+ */
+@Controller("findings")
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+export class FindingsController {
+  constructor(private readonly findingsService: FindingsService) {}
+
+  /**
+   * POST /api/findings
+   * Create a new finding and embed its summary
+   * Requires: MEMBER role or higher
+   */
+  @Post()
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
+  async create(@Body() createFindingDto: CreateFindingDto, @Workspace() workspaceId: string) {
+    return this.findingsService.create(workspaceId, createFindingDto);
+  }
+
+  /**
+   * GET /api/findings
+   * Get paginated findings with optional filters
+   * Requires: Any workspace member
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findAll(
+    @Query() query: QueryFindingsDto,
+    @Workspace() workspaceId: string
+  ): Promise<PaginatedFindingsResponse> {
+    return this.findingsService.findAll(workspaceId, query);
+  }
+
+  /**
+   * GET /api/findings/:id
+   * Get a single finding by ID
+   * Requires: Any workspace member
+   */
+  @Get(":id")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findOne(@Param("id") id: string, @Workspace() workspaceId: string) {
+    return this.findingsService.findOne(id, workspaceId);
+  }
+
+  /**
+   * POST /api/findings/search
+   * Semantic search findings by vector similarity
+   * Requires: Any workspace member
+   */
+  @Post("search")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async search(
+    @Body() searchDto: SearchFindingsDto,
+    @Workspace() workspaceId: string
+  ): Promise<FindingsSearchResponse> {
+    return this.findingsService.search(workspaceId, searchDto);
+  }
+
+  /**
+   * DELETE /api/findings/:id
+   * Delete a finding
+   * Requires: ADMIN role or higher
+   */
+  @Delete(":id")
+  @RequirePermission(Permission.WORKSPACE_ADMIN)
+  async remove(@Param("id") id: string, @Workspace() workspaceId: string) {
+    return this.findingsService.remove(id, workspaceId);
+  }
+}

apps/api/src/findings/findings.integration.spec.ts

@@ -0,0 +1,226 @@
+import { beforeAll, beforeEach, describe, expect, it, afterAll, vi } from "vitest";
+import { randomUUID as uuid } from "crypto";
+import { Test, TestingModule } from "@nestjs/testing";
+import { BadRequestException, NotFoundException } from "@nestjs/common";
+import { PrismaClient, Prisma } from "@prisma/client";
+import { FindingsService } from "./findings.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+
+const shouldRunDbIntegrationTests =
+  process.env.RUN_DB_TESTS === "true" && Boolean(process.env.DATABASE_URL);
+const describeFn = shouldRunDbIntegrationTests ? describe : describe.skip;
+
+const EMBEDDING_DIMENSION = 1536;
+
+function vector(value: number): number[] {
+  return Array.from({ length: EMBEDDING_DIMENSION }, () => value);
+}
+
+function toVectorLiteral(input: number[]): string {
+  return `[${input.join(",")}]`;
+}
+
+describeFn("FindingsService Integration", () => {
+  let moduleRef: TestingModule;
+  let prisma: PrismaClient;
+  let service: FindingsService;
+  let workspaceId: string;
+  let ownerId: string;
+  let setupComplete = false;
+
+  const embeddingServiceMock = {
+    isConfigured: vi.fn(),
+    generateEmbedding: vi.fn(),
+  };
+
+  beforeAll(async () => {
+    prisma = new PrismaClient();
+    await prisma.$connect();
+
+    const workspace = await prisma.workspace.create({
+      data: {
+        name: `Findings Integration ${Date.now()}`,
+        owner: {
+          create: {
+            email: `findings-integration-${Date.now()}@example.com`,
+            name: "Findings Integration Owner",
+          },
+        },
+      },
+    });
+
+    workspaceId = workspace.id;
+    ownerId = workspace.ownerId;
+
+    moduleRef = await Test.createTestingModule({
+      providers: [
+        FindingsService,
+        {
+          provide: PrismaService,
+          useValue: prisma,
+        },
+        {
+          provide: EmbeddingService,
+          useValue: embeddingServiceMock,
+        },
+      ],
+    }).compile();
+
+    service = moduleRef.get<FindingsService>(FindingsService);
+    setupComplete = true;
+  });
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    embeddingServiceMock.isConfigured.mockReturnValue(false);
+  });
+
+  afterAll(async () => {
+    if (!prisma) {
+      return;
+    }
+
+    if (workspaceId) {
+      await prisma.finding.deleteMany({ where: { workspaceId } });
+      await prisma.workspace.deleteMany({ where: { id: workspaceId } });
+    }
+    if (ownerId) {
+      await prisma.user.deleteMany({ where: { id: ownerId } });
+    }
+
+    if (moduleRef) {
+      await moduleRef.close();
+    }
+    await prisma.$disconnect();
+  });
+
+  it("creates, lists, fetches, and deletes findings", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const created = await service.create(workspaceId, {
+      agentId: "agent-findings-crud",
+      type: "security",
+      title: "Unescaped SQL fragment",
+      data: { severity: "high" },
+      summary: "Potential injection risk in dynamic query path.",
+    });
+
+    expect(created.id).toBeDefined();
+    expect(created.workspaceId).toBe(workspaceId);
+    expect(created.taskId).toBeNull();
+
+    const listed = await service.findAll(workspaceId, {
+      page: 1,
+      limit: 10,
+      agentId: "agent-findings-crud",
+    });
+
+    expect(listed.meta.total).toBeGreaterThanOrEqual(1);
+    expect(listed.data.some((row) => row.id === created.id)).toBe(true);
+
+    const found = await service.findOne(created.id, workspaceId);
+    expect(found.id).toBe(created.id);
+    expect(found.title).toBe("Unescaped SQL fragment");
+
+    await expect(service.findOne(created.id, uuid())).rejects.toThrow(NotFoundException);
+
+    await expect(service.remove(created.id, workspaceId)).resolves.toEqual({
+      message: "Finding deleted successfully",
+    });
+
+    await expect(service.findOne(created.id, workspaceId)).rejects.toThrow(NotFoundException);
+  });
+
+  it("rejects create when taskId does not exist in workspace", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    await expect(
+      service.create(workspaceId, {
+        taskId: uuid(),
+        agentId: "agent-findings-missing-task",
+        type: "bug",
+        title: "Invalid task id",
+        data: { source: "integration-test" },
+        summary: "Should fail when task relation is not found.",
+      })
+    ).rejects.toThrow(NotFoundException);
+  });
+
+  it("rejects vector search when embeddings are disabled", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    embeddingServiceMock.isConfigured.mockReturnValue(false);
+
+    await expect(
+      service.search(workspaceId, {
+        query: "security issue",
+      })
+    ).rejects.toThrow(BadRequestException);
+  });
+
+  it("searches findings by vector similarity with filters", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const near = vector(0.01);
+    const far = vector(0.9);
+
+    const matchedFinding = await prisma.finding.create({
+      data: {
+        workspaceId,
+        agentId: "agent-findings-search-a",
+        type: "incident",
+        title: "Authentication bypass",
+        data: { score: 0.9 } as Prisma.InputJsonValue,
+        summary: "Bypass risk found in login checks.",
+      },
+    });
+
+    const otherFinding = await prisma.finding.create({
+      data: {
+        workspaceId,
+        agentId: "agent-findings-search-b",
+        type: "incident",
+        title: "Retry timeout",
+        data: { score: 0.2 } as Prisma.InputJsonValue,
+        summary: "Timeout issue in downstream retries.",
+      },
+    });
+
+    await prisma.$executeRaw`
+      UPDATE findings
+      SET embedding = ${toVectorLiteral(near)}::vector(1536)
+      WHERE id = ${matchedFinding.id}::uuid
+    `;
+    await prisma.$executeRaw`
+      UPDATE findings
+      SET embedding = ${toVectorLiteral(far)}::vector(1536)
+      WHERE id = ${otherFinding.id}::uuid
+    `;
+
+    embeddingServiceMock.isConfigured.mockReturnValue(true);
+    embeddingServiceMock.generateEmbedding.mockResolvedValue(near);
+
+    const result = await service.search(workspaceId, {
+      query: "authentication bypass risk",
+      agentId: "agent-findings-search-a",
+      limit: 10,
+      similarityThreshold: 0,
+    });
+
+    expect(result.query).toBe("authentication bypass risk");
+    expect(result.meta.total).toBe(1);
+    expect(result.data).toHaveLength(1);
+    expect(result.data[0]?.id).toBe(matchedFinding.id);
+    expect(result.data[0]?.agentId).toBe("agent-findings-search-a");
+    expect(result.data.find((row) => row.id === otherFinding.id)).toBeUndefined();
+  });
+});

apps/api/src/findings/findings.module.ts

@@ -0,0 +1,14 @@
+import { Module } from "@nestjs/common";
+import { PrismaModule } from "../prisma/prisma.module";
+import { AuthModule } from "../auth/auth.module";
+import { KnowledgeModule } from "../knowledge/knowledge.module";
+import { FindingsController } from "./findings.controller";
+import { FindingsService } from "./findings.service";
+
+@Module({
+  imports: [PrismaModule, AuthModule, KnowledgeModule],
+  controllers: [FindingsController],
+  providers: [FindingsService],
+  exports: [FindingsService],
+})
+export class FindingsModule {}

apps/api/src/findings/findings.service.spec.ts

@@ -0,0 +1,300 @@
+import { Test, TestingModule } from "@nestjs/testing";
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { BadRequestException, NotFoundException } from "@nestjs/common";
+import { FindingsService } from "./findings.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+
+describe("FindingsService", () => {
+  let service: FindingsService;
+  let prisma: PrismaService;
+  let embeddingService: EmbeddingService;
+
+  const mockWorkspaceId = "550e8400-e29b-41d4-a716-446655440001";
+  const mockFindingId = "550e8400-e29b-41d4-a716-446655440002";
+  const mockTaskId = "550e8400-e29b-41d4-a716-446655440003";
+
+  const mockPrismaService = {
+    finding: {
+      create: vi.fn(),
+      findMany: vi.fn(),
+      findUnique: vi.fn(),
+      count: vi.fn(),
+      delete: vi.fn(),
+    },
+    agentTask: {
+      findUnique: vi.fn(),
+    },
+    $queryRaw: vi.fn(),
+    $executeRaw: vi.fn(),
+  };
+
+  const mockEmbeddingService = {
+    isConfigured: vi.fn(),
+    generateEmbedding: vi.fn(),
+  };
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        FindingsService,
+        {
+          provide: PrismaService,
+          useValue: mockPrismaService,
+        },
+        {
+          provide: EmbeddingService,
+          useValue: mockEmbeddingService,
+        },
+      ],
+    }).compile();
+
+    service = module.get<FindingsService>(FindingsService);
+    prisma = module.get<PrismaService>(PrismaService);
+    embeddingService = module.get<EmbeddingService>(EmbeddingService);
+
+    vi.clearAllMocks();
+  });
+
+  it("should be defined", () => {
+    expect(service).toBeDefined();
+  });
+
+  describe("create", () => {
+    it("should create a finding and store embedding when configured", async () => {
+      const createDto = {
+        taskId: mockTaskId,
+        agentId: "research-agent",
+        type: "security",
+        title: "SQL injection risk",
+        data: { severity: "high" },
+        summary: "Potential SQL injection in search endpoint.",
+      };
+
+      const createdFinding = {
+        id: mockFindingId,
+        workspaceId: mockWorkspaceId,
+        ...createDto,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockPrismaService.agentTask.findUnique.mockResolvedValue({
+        id: mockTaskId,
+        workspaceId: mockWorkspaceId,
+      });
+      mockPrismaService.finding.create.mockResolvedValue(createdFinding);
+      mockPrismaService.finding.findUnique.mockResolvedValue(createdFinding);
+      mockEmbeddingService.isConfigured.mockReturnValue(true);
+      mockEmbeddingService.generateEmbedding.mockResolvedValue([0.1, 0.2, 0.3]);
+      mockPrismaService.$executeRaw.mockResolvedValue(1);
+
+      const result = await service.create(mockWorkspaceId, createDto);
+
+      expect(result).toEqual(createdFinding);
+      expect(prisma.finding.create).toHaveBeenCalledWith({
+        data: expect.objectContaining({
+          workspaceId: mockWorkspaceId,
+          taskId: mockTaskId,
+          agentId: "research-agent",
+          type: "security",
+          title: "SQL injection risk",
+        }),
+        select: expect.any(Object),
+      });
+      expect(embeddingService.generateEmbedding).toHaveBeenCalledWith(createDto.summary);
+      expect(prisma.$executeRaw).toHaveBeenCalled();
+    });
+
+    it("should create a finding without embedding when not configured", async () => {
+      const createDto = {
+        agentId: "research-agent",
+        type: "security",
+        title: "SQL injection risk",
+        data: { severity: "high" },
+        summary: "Potential SQL injection in search endpoint.",
+      };
+
+      const createdFinding = {
+        id: mockFindingId,
+        workspaceId: mockWorkspaceId,
+        taskId: null,
+        ...createDto,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockPrismaService.finding.create.mockResolvedValue(createdFinding);
+      mockEmbeddingService.isConfigured.mockReturnValue(false);
+
+      const result = await service.create(mockWorkspaceId, createDto);
+
+      expect(result).toEqual(createdFinding);
+      expect(embeddingService.generateEmbedding).not.toHaveBeenCalled();
+      expect(prisma.$executeRaw).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("findAll", () => {
+    it("should return paginated findings with filters", async () => {
+      const findings = [
+        {
+          id: mockFindingId,
+          workspaceId: mockWorkspaceId,
+          taskId: null,
+          agentId: "research-agent",
+          type: "security",
+          title: "SQL injection risk",
+          data: { severity: "high" },
+          summary: "Potential SQL injection in search endpoint.",
+          createdAt: new Date(),
+          updatedAt: new Date(),
+        },
+      ];
+
+      mockPrismaService.finding.findMany.mockResolvedValue(findings);
+      mockPrismaService.finding.count.mockResolvedValue(1);
+
+      const result = await service.findAll(mockWorkspaceId, {
+        page: 1,
+        limit: 10,
+        type: "security",
+        agentId: "research-agent",
+      });
+
+      expect(result).toEqual({
+        data: findings,
+        meta: {
+          total: 1,
+          page: 1,
+          limit: 10,
+          totalPages: 1,
+        },
+      });
+      expect(prisma.finding.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: {
+            workspaceId: mockWorkspaceId,
+            type: "security",
+            agentId: "research-agent",
+          },
+        })
+      );
+    });
+  });
+
+  describe("findOne", () => {
+    it("should return a finding", async () => {
+      const finding = {
+        id: mockFindingId,
+        workspaceId: mockWorkspaceId,
+        taskId: null,
+        agentId: "research-agent",
+        type: "security",
+        title: "SQL injection risk",
+        data: { severity: "high" },
+        summary: "Potential SQL injection in search endpoint.",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      };
+
+      mockPrismaService.finding.findUnique.mockResolvedValue(finding);
+
+      const result = await service.findOne(mockFindingId, mockWorkspaceId);
+
+      expect(result).toEqual(finding);
+      expect(prisma.finding.findUnique).toHaveBeenCalledWith({
+        where: {
+          id: mockFindingId,
+          workspaceId: mockWorkspaceId,
+        },
+        select: expect.any(Object),
+      });
+    });
+
+    it("should throw when finding does not exist", async () => {
+      mockPrismaService.finding.findUnique.mockResolvedValue(null);
+
+      await expect(service.findOne(mockFindingId, mockWorkspaceId)).rejects.toThrow(
+        NotFoundException
+      );
+    });
+  });
+
+  describe("search", () => {
+    it("should throw BadRequestException when embeddings are not configured", async () => {
+      mockEmbeddingService.isConfigured.mockReturnValue(false);
+
+      await expect(
+        service.search(mockWorkspaceId, {
+          query: "sql injection",
+        })
+      ).rejects.toThrow(BadRequestException);
+    });
+
+    it("should return similarity-ranked search results", async () => {
+      mockEmbeddingService.isConfigured.mockReturnValue(true);
+      mockEmbeddingService.generateEmbedding.mockResolvedValue([0.1, 0.2, 0.3]);
+      mockPrismaService.$queryRaw
+        .mockResolvedValueOnce([
+          {
+            id: mockFindingId,
+            workspace_id: mockWorkspaceId,
+            task_id: null,
+            agent_id: "research-agent",
+            type: "security",
+            title: "SQL injection risk",
+            data: { severity: "high" },
+            summary: "Potential SQL injection in search endpoint.",
+            created_at: new Date(),
+            updated_at: new Date(),
+            score: 0.91,
+          },
+        ])
+        .mockResolvedValueOnce([{ count: BigInt(1) }]);
+
+      const result = await service.search(mockWorkspaceId, {
+        query: "sql injection",
+        page: 1,
+        limit: 5,
+        similarityThreshold: 0.5,
+      });
+
+      expect(result.query).toBe("sql injection");
+      expect(result.data).toHaveLength(1);
+      expect(result.data[0].score).toBe(0.91);
+      expect(result.meta.total).toBe(1);
+      expect(prisma.$queryRaw).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe("remove", () => {
+    it("should delete a finding", async () => {
+      mockPrismaService.finding.findUnique.mockResolvedValue({
+        id: mockFindingId,
+        workspaceId: mockWorkspaceId,
+      });
+      mockPrismaService.finding.delete.mockResolvedValue({
+        id: mockFindingId,
+      });
+
+      const result = await service.remove(mockFindingId, mockWorkspaceId);
+
+      expect(result).toEqual({ message: "Finding deleted successfully" });
+      expect(prisma.finding.delete).toHaveBeenCalledWith({
+        where: {
+          id: mockFindingId,
+          workspaceId: mockWorkspaceId,
+        },
+      });
+    });
+
+    it("should throw when finding does not exist", async () => {
+      mockPrismaService.finding.findUnique.mockResolvedValue(null);
+
+      await expect(service.remove(mockFindingId, mockWorkspaceId)).rejects.toThrow(
+        NotFoundException
+      );
+    });
+  });
+});

apps/api/src/findings/findings.service.ts

@@ -0,0 +1,337 @@
+import { BadRequestException, Injectable, Logger, NotFoundException } from "@nestjs/common";
+import { Prisma } from "@prisma/client";
+import { PrismaService } from "../prisma/prisma.service";
+import { EmbeddingService } from "../knowledge/services/embedding.service";
+import type { CreateFindingDto, QueryFindingsDto, SearchFindingsDto } from "./dto";
+
+const findingSelect = {
+  id: true,
+  workspaceId: true,
+  taskId: true,
+  agentId: true,
+  type: true,
+  title: true,
+  data: true,
+  summary: true,
+  createdAt: true,
+  updatedAt: true,
+} satisfies Prisma.FindingSelect;
+
+type FindingRecord = Prisma.FindingGetPayload<{ select: typeof findingSelect }>;
+
+interface RawFindingSearchResult {
+  id: string;
+  workspace_id: string;
+  task_id: string | null;
+  agent_id: string;
+  type: string;
+  title: string;
+  data: Prisma.JsonValue;
+  summary: string;
+  created_at: Date;
+  updated_at: Date;
+  score: number;
+}
+
+export interface FindingSearchResult extends FindingRecord {
+  score: number;
+}
+
+interface PaginatedMeta {
+  total: number;
+  page: number;
+  limit: number;
+  totalPages: number;
+}
+
+export interface PaginatedFindingsResponse {
+  data: FindingRecord[];
+  meta: PaginatedMeta;
+}
+
+export interface FindingsSearchResponse {
+  data: FindingSearchResult[];
+  meta: PaginatedMeta;
+  query: string;
+  similarityThreshold: number;
+}
+
+/**
+ * Service for managing structured findings with vector search support
+ */
+@Injectable()
+export class FindingsService {
+  private readonly logger = new Logger(FindingsService.name);
+  private readonly defaultSimilarityThreshold: number;
+
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly embeddingService: EmbeddingService
+  ) {
+    const parsedThreshold = Number.parseFloat(process.env.FINDINGS_SIMILARITY_THRESHOLD ?? "0.5");
+
+    this.defaultSimilarityThreshold =
+      Number.isFinite(parsedThreshold) && parsedThreshold >= 0 && parsedThreshold <= 1
+        ? parsedThreshold
+        : 0.5;
+  }
+
+  /**
+   * Create a finding and generate its embedding from the summary when available
+   */
+  async create(workspaceId: string, createFindingDto: CreateFindingDto): Promise<FindingRecord> {
+    if (createFindingDto.taskId) {
+      const task = await this.prisma.agentTask.findUnique({
+        where: {
+          id: createFindingDto.taskId,
+          workspaceId,
+        },
+        select: { id: true },
+      });
+
+      if (!task) {
+        throw new NotFoundException(`Agent task with ID ${createFindingDto.taskId} not found`);
+      }
+    }
+
+    const createInput: Prisma.FindingUncheckedCreateInput = {
+      workspaceId,
+      agentId: createFindingDto.agentId,
+      type: createFindingDto.type,
+      title: createFindingDto.title,
+      data: createFindingDto.data as Prisma.InputJsonValue,
+      summary: createFindingDto.summary,
+    };
+
+    if (createFindingDto.taskId) {
+      createInput.taskId = createFindingDto.taskId;
+    }
+
+    const finding = await this.prisma.finding.create({
+      data: createInput,
+      select: findingSelect,
+    });
+
+    await this.generateAndStoreEmbedding(finding.id, workspaceId, finding.summary);
+
+    if (this.embeddingService.isConfigured()) {
+      return this.findOne(finding.id, workspaceId);
+    }
+
+    return finding;
+  }
+
+  /**
+   * Get paginated findings with optional filters
+   */
+  async findAll(workspaceId: string, query: QueryFindingsDto): Promise<PaginatedFindingsResponse> {
+    const page = query.page ?? 1;
+    const limit = query.limit ?? 50;
+    const skip = (page - 1) * limit;
+
+    const where: Prisma.FindingWhereInput = {
+      workspaceId,
+    };
+
+    if (query.agentId) {
+      where.agentId = query.agentId;
+    }
+
+    if (query.type) {
+      where.type = query.type;
+    }
+
+    if (query.taskId) {
+      where.taskId = query.taskId;
+    }
+
+    const [data, total] = await Promise.all([
+      this.prisma.finding.findMany({
+        where,
+        select: findingSelect,
+        orderBy: {
+          createdAt: "desc",
+        },
+        skip,
+        take: limit,
+      }),
+      this.prisma.finding.count({ where }),
+    ]);
+
+    return {
+      data,
+      meta: {
+        total,
+        page,
+        limit,
+        totalPages: Math.ceil(total / limit),
+      },
+    };
+  }
+
+  /**
+   * Get a single finding by ID
+   */
+  async findOne(id: string, workspaceId: string): Promise<FindingRecord> {
+    const finding = await this.prisma.finding.findUnique({
+      where: {
+        id,
+        workspaceId,
+      },
+      select: findingSelect,
+    });
+
+    if (!finding) {
+      throw new NotFoundException(`Finding with ID ${id} not found`);
+    }
+
+    return finding;
+  }
+
+  /**
+   * Semantic search findings using vector similarity
+   */
+  async search(workspaceId: string, searchDto: SearchFindingsDto): Promise<FindingsSearchResponse> {
+    if (!this.embeddingService.isConfigured()) {
+      throw new BadRequestException(
+        "Finding vector search requires OPENAI_API_KEY to be configured"
+      );
+    }
+
+    const page = searchDto.page ?? 1;
+    const limit = searchDto.limit ?? 20;
+    const offset = (page - 1) * limit;
+    const similarityThreshold = searchDto.similarityThreshold ?? this.defaultSimilarityThreshold;
+    const distanceThreshold = 1 - similarityThreshold;
+
+    const queryEmbedding = await this.embeddingService.generateEmbedding(searchDto.query);
+    const embeddingString = `[${queryEmbedding.join(",")}]`;
+
+    const agentFilter = searchDto.agentId
+      ? Prisma.sql`AND f.agent_id = ${searchDto.agentId}`
+      : Prisma.sql``;
+    const typeFilter = searchDto.type ? Prisma.sql`AND f.type = ${searchDto.type}` : Prisma.sql``;
+    const taskFilter = searchDto.taskId
+      ? Prisma.sql`AND f.task_id = ${searchDto.taskId}::uuid`
+      : Prisma.sql``;
+
+    const searchResults = await this.prisma.$queryRaw<RawFindingSearchResult[]>`
+      SELECT
+        f.id,
+        f.workspace_id,
+        f.task_id,
+        f.agent_id,
+        f.type,
+        f.title,
+        f.data,
+        f.summary,
+        f.created_at,
+        f.updated_at,
+        (1 - (f.embedding <=> ${embeddingString}::vector)) AS score
+      FROM findings f
+      WHERE f.workspace_id = ${workspaceId}::uuid
+        AND f.embedding IS NOT NULL
+        ${agentFilter}
+        ${typeFilter}
+        ${taskFilter}
+        AND (f.embedding <=> ${embeddingString}::vector) <= ${distanceThreshold}
+      ORDER BY f.embedding <=> ${embeddingString}::vector
+      LIMIT ${limit}
+      OFFSET ${offset}
+    `;
+
+    const countResult = await this.prisma.$queryRaw<[{ count: bigint }]>`
+      SELECT COUNT(*) as count
+      FROM findings f
+      WHERE f.workspace_id = ${workspaceId}::uuid
+        AND f.embedding IS NOT NULL
+        ${agentFilter}
+        ${typeFilter}
+        ${taskFilter}
+        AND (f.embedding <=> ${embeddingString}::vector) <= ${distanceThreshold}
+    `;
+
+    const total = Number(countResult[0].count);
+
+    const data: FindingSearchResult[] = searchResults.map((row) => ({
+      id: row.id,
+      workspaceId: row.workspace_id,
+      taskId: row.task_id,
+      agentId: row.agent_id,
+      type: row.type,
+      title: row.title,
+      data: row.data,
+      summary: row.summary,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      score: row.score,
+    }));
+
+    return {
+      data,
+      meta: {
+        total,
+        page,
+        limit,
+        totalPages: Math.ceil(total / limit),
+      },
+      query: searchDto.query,
+      similarityThreshold,
+    };
+  }
+
+  /**
+   * Delete a finding
+   */
+  async remove(id: string, workspaceId: string): Promise<{ message: string }> {
+    const existingFinding = await this.prisma.finding.findUnique({
+      where: {
+        id,
+        workspaceId,
+      },
+      select: { id: true },
+    });
+
+    if (!existingFinding) {
+      throw new NotFoundException(`Finding with ID ${id} not found`);
+    }
+
+    await this.prisma.finding.delete({
+      where: {
+        id,
+        workspaceId,
+      },
+    });
+
+    return { message: "Finding deleted successfully" };
+  }
+
+  /**
+   * Generate and persist embedding for a finding summary
+   */
+  private async generateAndStoreEmbedding(
+    findingId: string,
+    workspaceId: string,
+    summary: string
+  ): Promise<void> {
+    if (!this.embeddingService.isConfigured()) {
+      return;
+    }
+
+    try {
+      const embedding = await this.embeddingService.generateEmbedding(summary);
+      const embeddingString = `[${embedding.join(",")}]`;
+
+      await this.prisma.$executeRaw`
+        UPDATE findings
+        SET embedding = ${embeddingString}::vector,
+            updated_at = NOW()
+        WHERE id = ${findingId}::uuid
+          AND workspace_id = ${workspaceId}::uuid
+      `;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`Failed to generate embedding for finding ${findingId}: ${message}`);
+    }
+  }
+}

apps/api/src/import/dto/import-project.dto.ts

@@ -0,0 +1,89 @@
+import { IsNumber, IsOptional, IsString, MaxLength, MinLength } from "class-validator";
+
+/**
+ * DTO for a single jarvis-brain project record.
+ * This matches the project object shape consumed by scripts/migrate-brain.ts.
+ */
+export class ImportProjectDto {
+  @IsString({ message: "id must be a string" })
+  @MinLength(1, { message: "id must not be empty" })
+  @MaxLength(255, { message: "id must not exceed 255 characters" })
+  id!: string;
+
+  @IsString({ message: "name must be a string" })
+  @MinLength(1, { message: "name must not be empty" })
+  @MaxLength(255, { message: "name must not exceed 255 characters" })
+  name!: string;
+
+  @IsOptional()
+  @IsString({ message: "description must be a string" })
+  description?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "domain must be a string" })
+  domain?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "status must be a string" })
+  status?: string | null;
+
+  // jarvis-brain project priority can be a number, string, or null
+  @IsOptional()
+  priority?: number | string | null;
+
+  @IsOptional()
+  @IsNumber({}, { message: "progress must be a number" })
+  progress?: number | null;
+
+  @IsOptional()
+  @IsString({ message: "repo must be a string" })
+  repo?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "branch must be a string" })
+  branch?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "current_milestone must be a string" })
+  current_milestone?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "next_milestone must be a string" })
+  next_milestone?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "blocker must be a string" })
+  blocker?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "owner must be a string" })
+  owner?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "docs_path must be a string" })
+  docs_path?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "created must be a string" })
+  created?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "updated must be a string" })
+  updated?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "target_date must be a string" })
+  target_date?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "notes must be a string" })
+  notes?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "notes_nontechnical must be a string" })
+  notes_nontechnical?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "parent must be a string" })
+  parent?: string | null;
+}

apps/api/src/import/dto/import-response.dto.ts

@@ -0,0 +1,5 @@
+export interface ImportResponseDto {
+  imported: number;
+  skipped: number;
+  errors: string[];
+}

apps/api/src/import/dto/import-task.dto.ts

@@ -0,0 +1,76 @@
+import { IsArray, IsNumber, IsOptional, IsString, MaxLength, MinLength } from "class-validator";
+
+/**
+ * DTO for a single jarvis-brain task record.
+ * This matches the task object shape consumed by scripts/migrate-brain.ts.
+ */
+export class ImportTaskDto {
+  @IsString({ message: "id must be a string" })
+  @MinLength(1, { message: "id must not be empty" })
+  @MaxLength(255, { message: "id must not exceed 255 characters" })
+  id!: string;
+
+  @IsString({ message: "title must be a string" })
+  @MinLength(1, { message: "title must not be empty" })
+  @MaxLength(255, { message: "title must not exceed 255 characters" })
+  title!: string;
+
+  @IsOptional()
+  @IsString({ message: "domain must be a string" })
+  domain?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "project must be a string" })
+  project?: string | null;
+
+  @IsOptional()
+  @IsArray({ message: "related must be an array" })
+  @IsString({ each: true, message: "related items must be strings" })
+  related?: string[];
+
+  @IsOptional()
+  @IsString({ message: "priority must be a string" })
+  priority?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "status must be a string" })
+  status?: string | null;
+
+  @IsOptional()
+  @IsNumber({}, { message: "progress must be a number" })
+  progress?: number | null;
+
+  @IsOptional()
+  @IsString({ message: "due must be a string" })
+  due?: string | null;
+
+  @IsOptional()
+  @IsArray({ message: "blocks must be an array" })
+  @IsString({ each: true, message: "blocks items must be strings" })
+  blocks?: string[];
+
+  @IsOptional()
+  @IsArray({ message: "blocked_by must be an array" })
+  @IsString({ each: true, message: "blocked_by items must be strings" })
+  blocked_by?: string[];
+
+  @IsOptional()
+  @IsString({ message: "assignee must be a string" })
+  assignee?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "created must be a string" })
+  created?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "updated must be a string" })
+  updated?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "notes must be a string" })
+  notes?: string | null;
+
+  @IsOptional()
+  @IsString({ message: "notes_nontechnical must be a string" })
+  notes_nontechnical?: string | null;
+}

apps/api/src/import/dto/index.ts

@@ -0,0 +1,3 @@
+export { ImportTaskDto } from "./import-task.dto";
+export { ImportProjectDto } from "./import-project.dto";
+export type { ImportResponseDto } from "./import-response.dto";

apps/api/src/import/import.controller.ts

@@ -0,0 +1,33 @@
+import { Body, Controller, ParseArrayPipe, Post, UseGuards } from "@nestjs/common";
+import type { AuthUser } from "@mosaic/shared";
+import { CurrentUser } from "../auth/decorators/current-user.decorator";
+import { AdminGuard } from "../auth/guards/admin.guard";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { Workspace } from "../common/decorators";
+import { WorkspaceGuard } from "../common/guards";
+import { ImportProjectDto, type ImportResponseDto, ImportTaskDto } from "./dto";
+import { ImportService } from "./import.service";
+
+@Controller("import")
+@UseGuards(AuthGuard, WorkspaceGuard, AdminGuard)
+export class ImportController {
+  constructor(private readonly importService: ImportService) {}
+
+  @Post("tasks")
+  async importTasks(
+    @Body(new ParseArrayPipe({ items: ImportTaskDto })) taskPayload: ImportTaskDto[],
+    @Workspace() workspaceId: string,
+    @CurrentUser() user: AuthUser
+  ): Promise<ImportResponseDto> {
+    return this.importService.importTasks(workspaceId, user.id, taskPayload);
+  }
+
+  @Post("projects")
+  async importProjects(
+    @Body(new ParseArrayPipe({ items: ImportProjectDto })) projectPayload: ImportProjectDto[],
+    @Workspace() workspaceId: string,
+    @CurrentUser() user: AuthUser
+  ): Promise<ImportResponseDto> {
+    return this.importService.importProjects(workspaceId, user.id, projectPayload);
+  }
+}

apps/api/src/import/import.module.ts

@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { AuthModule } from "../auth/auth.module";
+import { PrismaModule } from "../prisma/prisma.module";
+import { ImportController } from "./import.controller";
+import { ImportService } from "./import.service";
+
+@Module({
+  imports: [PrismaModule, AuthModule],
+  controllers: [ImportController],
+  providers: [ImportService],
+  exports: [ImportService],
+})
+export class ImportModule {}

apps/api/src/import/import.service.spec.ts

@@ -0,0 +1,251 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { Test, TestingModule } from "@nestjs/testing";
+import { ProjectStatus, TaskPriority, TaskStatus } from "@prisma/client";
+import { ImportService } from "./import.service";
+import { PrismaService } from "../prisma/prisma.service";
+
+describe("ImportService", () => {
+  let service: ImportService;
+
+  const mockPrismaService = {
+    withWorkspaceContext: vi.fn(),
+    domain: {
+      findUnique: vi.fn(),
+      create: vi.fn(),
+    },
+    project: {
+      findFirst: vi.fn(),
+      create: vi.fn(),
+    },
+    task: {
+      findFirst: vi.fn(),
+      create: vi.fn(),
+    },
+  };
+
+  const workspaceId = "550e8400-e29b-41d4-a716-446655440001";
+  const userId = "550e8400-e29b-41d4-a716-446655440002";
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        ImportService,
+        {
+          provide: PrismaService,
+          useValue: mockPrismaService,
+        },
+      ],
+    }).compile();
+
+    service = module.get<ImportService>(ImportService);
+    vi.clearAllMocks();
+
+    mockPrismaService.withWorkspaceContext.mockImplementation(
+      async (_userId: string, _workspaceId: string, fn: (client: unknown) => Promise<unknown>) => {
+        return fn(mockPrismaService);
+      }
+    );
+  });
+
+  it("should be defined", () => {
+    expect(service).toBeDefined();
+  });
+
+  describe("importTasks", () => {
+    it("maps status/priority/domain and imports a task", async () => {
+      mockPrismaService.task.findFirst.mockResolvedValue(null);
+      mockPrismaService.domain.findUnique.mockResolvedValue(null);
+      mockPrismaService.domain.create.mockResolvedValue({ id: "domain-id" });
+      mockPrismaService.project.findFirst.mockResolvedValue(null);
+      mockPrismaService.task.create.mockResolvedValue({ id: "task-id" });
+
+      const result = await service.importTasks(workspaceId, userId, [
+        {
+          id: "task-1",
+          title: "Import me",
+          domain: "Platform Ops",
+          status: "in-progress",
+          priority: "critical",
+          project: null,
+          related: [],
+          blocks: [],
+          blocked_by: [],
+          progress: 42,
+          due: "2026-03-15",
+          created: "2026-03-01T10:00:00.000Z",
+          updated: "2026-03-05T12:00:00.000Z",
+          assignee: null,
+          notes: "notes",
+          notes_nontechnical: "non technical",
+        },
+      ]);
+
+      expect(result).toEqual({ imported: 1, skipped: 0, errors: [] });
+      expect(mockPrismaService.task.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            title: "Import me",
+            status: TaskStatus.IN_PROGRESS,
+            priority: TaskPriority.HIGH,
+            domainId: "domain-id",
+          }),
+        })
+      );
+    });
+
+    it("skips existing task by brainId", async () => {
+      mockPrismaService.task.findFirst.mockResolvedValue({ id: "existing-task-id" });
+
+      const result = await service.importTasks(workspaceId, userId, [
+        {
+          id: "task-1",
+          title: "Existing",
+          domain: null,
+          status: "pending",
+          priority: "medium",
+          project: null,
+          related: [],
+          blocks: [],
+          blocked_by: [],
+          progress: null,
+          due: null,
+          created: null,
+          updated: null,
+          assignee: null,
+          notes: null,
+          notes_nontechnical: null,
+        },
+      ]);
+
+      expect(result.imported).toBe(0);
+      expect(result.skipped).toBe(1);
+      expect(mockPrismaService.task.create).not.toHaveBeenCalled();
+    });
+
+    it("collects mapping/missing-project errors while importing", async () => {
+      mockPrismaService.task.findFirst.mockResolvedValue(null);
+      mockPrismaService.project.findFirst.mockResolvedValue(null);
+      mockPrismaService.task.create.mockResolvedValue({ id: "task-id" });
+
+      const result = await service.importTasks(workspaceId, userId, [
+        {
+          id: "task-1",
+          title: "Needs project",
+          domain: null,
+          status: "mystery-status",
+          priority: "mystery-priority",
+          project: "brain-project-1",
+          related: [],
+          blocks: [],
+          blocked_by: [],
+          progress: null,
+          due: null,
+          created: null,
+          updated: null,
+          assignee: null,
+          notes: null,
+          notes_nontechnical: null,
+        },
+      ]);
+
+      expect(result.imported).toBe(1);
+      expect(result.errors).toEqual(
+        expect.arrayContaining([
+          expect.stringContaining('Unknown task status "mystery-status"'),
+          expect.stringContaining('Unknown task priority "mystery-priority"'),
+          expect.stringContaining('referenced project "brain-project-1" not found'),
+        ])
+      );
+      expect(mockPrismaService.task.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            status: TaskStatus.NOT_STARTED,
+            priority: TaskPriority.MEDIUM,
+            projectId: null,
+          }),
+        })
+      );
+    });
+  });
+
+  describe("importProjects", () => {
+    it("maps status/domain and imports a project", async () => {
+      mockPrismaService.project.findFirst.mockResolvedValue(null);
+      mockPrismaService.domain.findUnique.mockResolvedValue(null);
+      mockPrismaService.domain.create.mockResolvedValue({ id: "domain-id" });
+      mockPrismaService.project.create.mockResolvedValue({ id: "project-id" });
+
+      const result = await service.importProjects(workspaceId, userId, [
+        {
+          id: "project-1",
+          name: "Project One",
+          description: "desc",
+          domain: "Backend",
+          status: "in-progress",
+          priority: "high",
+          progress: 50,
+          repo: "git@example.com/repo",
+          branch: "main",
+          current_milestone: "MS21",
+          next_milestone: "MS22",
+          blocker: null,
+          owner: "owner",
+          docs_path: "docs/PRD.md",
+          created: "2026-03-01",
+          updated: "2026-03-05",
+          target_date: "2026-04-01",
+          notes: "notes",
+          notes_nontechnical: "non tech",
+          parent: null,
+        },
+      ]);
+
+      expect(result).toEqual({ imported: 1, skipped: 0, errors: [] });
+      expect(mockPrismaService.project.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            name: "Project One",
+            status: ProjectStatus.ACTIVE,
+            domainId: "domain-id",
+          }),
+        })
+      );
+    });
+
+    it("captures create failures as errors", async () => {
+      mockPrismaService.project.findFirst.mockResolvedValue(null);
+      mockPrismaService.project.create.mockRejectedValue(new Error("db failed"));
+
+      const result = await service.importProjects(workspaceId, userId, [
+        {
+          id: "project-1",
+          name: "Project One",
+          description: null,
+          domain: null,
+          status: "planning",
+          priority: null,
+          progress: null,
+          repo: null,
+          branch: null,
+          current_milestone: null,
+          next_milestone: null,
+          blocker: null,
+          owner: null,
+          docs_path: null,
+          created: null,
+          updated: null,
+          target_date: null,
+          notes: null,
+          notes_nontechnical: null,
+          parent: null,
+        },
+      ]);
+
+      expect(result.imported).toBe(0);
+      expect(result.skipped).toBe(1);
+      expect(result.errors).toEqual([
+        expect.stringContaining("project project-1: failed to import: db failed"),
+      ]);
+    });
+  });
+});

apps/api/src/import/import.service.ts

@@ -0,0 +1,496 @@
+import { Injectable } from "@nestjs/common";
+import { Prisma, PrismaClient, ProjectStatus, TaskPriority, TaskStatus } from "@prisma/client";
+import { PrismaService } from "../prisma/prisma.service";
+import type { ImportProjectDto, ImportResponseDto, ImportTaskDto } from "./dto";
+
+interface TaskStatusMapping {
+  status: TaskStatus;
+  issue: string | null;
+}
+
+interface TaskPriorityMapping {
+  priority: TaskPriority;
+  issue: string | null;
+}
+
+interface ProjectStatusMapping {
+  status: ProjectStatus;
+  issue: string | null;
+}
+
+@Injectable()
+export class ImportService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async importTasks(
+    workspaceId: string,
+    userId: string,
+    taskPayload: ImportTaskDto[]
+  ): Promise<ImportResponseDto> {
+    const errors: string[] = [];
+    let imported = 0;
+    let skipped = 0;
+
+    const importTimestamp = new Date().toISOString();
+    const seenBrainTaskIds = new Set<string>();
+    const domainIdBySlug = new Map<string, string>();
+    const projectIdByBrainId = new Map<string, string | null>();
+
+    await this.prisma.withWorkspaceContext(userId, workspaceId, async (tx: PrismaClient) => {
+      for (const [index, task] of taskPayload.entries()) {
+        const brainId = task.id.trim();
+
+        if (seenBrainTaskIds.has(brainId)) {
+          skipped += 1;
+          errors.push(`task ${brainId}: duplicate item in request body`);
+          continue;
+        }
+        seenBrainTaskIds.add(brainId);
+
+        try {
+          const existingTask = await tx.task.findFirst({
+            where: {
+              workspaceId,
+              metadata: {
+                path: ["brainId"],
+                equals: brainId,
+              },
+            },
+            select: { id: true },
+          });
+
+          if (existingTask) {
+            skipped += 1;
+            continue;
+          }
+
+          const mappedStatus = this.mapTaskStatus(task.status ?? null);
+          if (mappedStatus.issue) {
+            errors.push(`task ${brainId}: ${mappedStatus.issue}`);
+          }
+
+          const mappedPriority = this.mapTaskPriority(task.priority ?? null);
+          if (mappedPriority.issue) {
+            errors.push(`task ${brainId}: ${mappedPriority.issue}`);
+          }
+
+          const projectBrainId = task.project?.trim() ? task.project.trim() : null;
+          const projectId = await this.resolveProjectId(
+            tx,
+            workspaceId,
+            projectBrainId,
+            projectIdByBrainId,
+            brainId,
+            errors
+          );
+
+          const domainId = await this.resolveDomainId(
+            tx,
+            workspaceId,
+            task.domain ?? null,
+            importTimestamp,
+            domainIdBySlug
+          );
+
+          const createdAt =
+            this.normalizeDate(task.created ?? null, `task ${brainId}.created`, errors) ??
+            new Date();
+          const updatedAt =
+            this.normalizeDate(task.updated ?? null, `task ${brainId}.updated`, errors) ??
+            createdAt;
+          const dueDate = this.normalizeDate(task.due ?? null, `task ${brainId}.due`, errors);
+          const completedAt = mappedStatus.status === TaskStatus.COMPLETED ? updatedAt : null;
+
+          const metadata = this.asJsonValue({
+            source: "jarvis-brain",
+            brainId,
+            brainDomain: task.domain ?? null,
+            brainProjectId: projectBrainId,
+            rawStatus: task.status ?? null,
+            rawPriority: task.priority ?? null,
+            related: task.related ?? [],
+            blocks: task.blocks ?? [],
+            blockedBy: task.blocked_by ?? [],
+            assignee: task.assignee ?? null,
+            progress: task.progress ?? null,
+            notes: task.notes ?? null,
+            notesNonTechnical: task.notes_nontechnical ?? null,
+            importedAt: importTimestamp,
+          });
+
+          await tx.task.create({
+            data: {
+              workspaceId,
+              title: task.title,
+              description: task.notes ?? null,
+              status: mappedStatus.status,
+              priority: mappedPriority.priority,
+              dueDate,
+              creatorId: userId,
+              projectId,
+              domainId,
+              metadata,
+              createdAt,
+              updatedAt,
+              completedAt,
+            },
+          });
+
+          imported += 1;
+        } catch (error) {
+          skipped += 1;
+          errors.push(
+            `task ${brainId || `index-${String(index)}`}: failed to import: ${this.getErrorMessage(error)}`
+          );
+        }
+      }
+    });
+
+    return {
+      imported,
+      skipped,
+      errors,
+    };
+  }
+
+  async importProjects(
+    workspaceId: string,
+    userId: string,
+    projectPayload: ImportProjectDto[]
+  ): Promise<ImportResponseDto> {
+    const errors: string[] = [];
+    let imported = 0;
+    let skipped = 0;
+
+    const importTimestamp = new Date().toISOString();
+    const seenBrainProjectIds = new Set<string>();
+    const domainIdBySlug = new Map<string, string>();
+
+    await this.prisma.withWorkspaceContext(userId, workspaceId, async (tx: PrismaClient) => {
+      for (const [index, project] of projectPayload.entries()) {
+        const brainId = project.id.trim();
+
+        if (seenBrainProjectIds.has(brainId)) {
+          skipped += 1;
+          errors.push(`project ${brainId}: duplicate item in request body`);
+          continue;
+        }
+        seenBrainProjectIds.add(brainId);
+
+        try {
+          const existingProject = await tx.project.findFirst({
+            where: {
+              workspaceId,
+              metadata: {
+                path: ["brainId"],
+                equals: brainId,
+              },
+            },
+            select: { id: true },
+          });
+
+          if (existingProject) {
+            skipped += 1;
+            continue;
+          }
+
+          const mappedStatus = this.mapProjectStatus(project.status ?? null);
+          if (mappedStatus.issue) {
+            errors.push(`project ${brainId}: ${mappedStatus.issue}`);
+          }
+
+          const domainId = await this.resolveDomainId(
+            tx,
+            workspaceId,
+            project.domain ?? null,
+            importTimestamp,
+            domainIdBySlug
+          );
+
+          const createdAt =
+            this.normalizeDate(project.created ?? null, `project ${brainId}.created`, errors) ??
+            new Date();
+          const updatedAt =
+            this.normalizeDate(project.updated ?? null, `project ${brainId}.updated`, errors) ??
+            createdAt;
+          const startDate = this.normalizeDate(
+            project.created ?? null,
+            `project ${brainId}.startDate`,
+            errors
+          );
+          const endDate = this.normalizeDate(
+            project.target_date ?? null,
+            `project ${brainId}.target_date`,
+            errors
+          );
+
+          const metadata = this.asJsonValue({
+            source: "jarvis-brain",
+            brainId,
+            brainDomain: project.domain ?? null,
+            rawStatus: project.status ?? null,
+            rawPriority: project.priority ?? null,
+            progress: project.progress ?? null,
+            repo: project.repo ?? null,
+            branch: project.branch ?? null,
+            currentMilestone: project.current_milestone ?? null,
+            nextMilestone: project.next_milestone ?? null,
+            blocker: project.blocker ?? null,
+            owner: project.owner ?? null,
+            docsPath: project.docs_path ?? null,
+            targetDate: project.target_date ?? null,
+            notes: project.notes ?? null,
+            notesNonTechnical: project.notes_nontechnical ?? null,
+            parent: project.parent ?? null,
+            importedAt: importTimestamp,
+          });
+
+          await tx.project.create({
+            data: {
+              workspaceId,
+              name: project.name,
+              description: project.description ?? null,
+              status: mappedStatus.status,
+              startDate,
+              endDate,
+              creatorId: userId,
+              domainId,
+              metadata,
+              createdAt,
+              updatedAt,
+            },
+          });
+
+          imported += 1;
+        } catch (error) {
+          skipped += 1;
+          errors.push(
+            `project ${brainId || `index-${String(index)}`}: failed to import: ${this.getErrorMessage(error)}`
+          );
+        }
+      }
+    });
+
+    return {
+      imported,
+      skipped,
+      errors,
+    };
+  }
+
+  private async resolveProjectId(
+    tx: PrismaClient,
+    workspaceId: string,
+    projectBrainId: string | null,
+    projectIdByBrainId: Map<string, string | null>,
+    taskBrainId: string,
+    errors: string[]
+  ): Promise<string | null> {
+    if (!projectBrainId) {
+      return null;
+    }
+
+    if (projectIdByBrainId.has(projectBrainId)) {
+      return projectIdByBrainId.get(projectBrainId) ?? null;
+    }
+
+    const existingProject = await tx.project.findFirst({
+      where: {
+        workspaceId,
+        metadata: {
+          path: ["brainId"],
+          equals: projectBrainId,
+        },
+      },
+      select: { id: true },
+    });
+
+    if (!existingProject) {
+      projectIdByBrainId.set(projectBrainId, null);
+      errors.push(`task ${taskBrainId}: referenced project "${projectBrainId}" not found`);
+      return null;
+    }
+
+    projectIdByBrainId.set(projectBrainId, existingProject.id);
+    return existingProject.id;
+  }
+
+  private async resolveDomainId(
+    tx: PrismaClient,
+    workspaceId: string,
+    rawDomain: string | null,
+    importTimestamp: string,
+    domainIdBySlug: Map<string, string>
+  ): Promise<string | null> {
+    const domainSlug = this.normalizeDomain(rawDomain);
+    if (!domainSlug) {
+      return null;
+    }
+
+    const cachedId = domainIdBySlug.get(domainSlug);
+    if (cachedId) {
+      return cachedId;
+    }
+
+    const existingDomain = await tx.domain.findUnique({
+      where: {
+        workspaceId_slug: {
+          workspaceId,
+          slug: domainSlug,
+        },
+      },
+      select: { id: true },
+    });
+
+    if (existingDomain) {
+      domainIdBySlug.set(domainSlug, existingDomain.id);
+      return existingDomain.id;
+    }
+
+    const trimmedDomainName = rawDomain?.trim();
+    const domainName =
+      trimmedDomainName && trimmedDomainName.length > 0 ? trimmedDomainName : domainSlug;
+    const createdDomain = await tx.domain.create({
+      data: {
+        workspaceId,
+        slug: domainSlug,
+        name: domainName,
+        metadata: this.asJsonValue({
+          source: "jarvis-brain",
+          brainId: domainName,
+          sourceValues: [domainName],
+          importedAt: importTimestamp,
+        }),
+      },
+      select: { id: true },
+    });
+
+    domainIdBySlug.set(domainSlug, createdDomain.id);
+    return createdDomain.id;
+  }
+
+  private normalizeKey(value: string | null | undefined): string {
+    return value?.trim().toLowerCase() ?? "";
+  }
+
+  private mapTaskStatus(rawStatus: string | null): TaskStatusMapping {
+    const statusKey = this.normalizeKey(rawStatus);
+
+    switch (statusKey) {
+      case "done":
+        return { status: TaskStatus.COMPLETED, issue: null };
+      case "in-progress":
+        return { status: TaskStatus.IN_PROGRESS, issue: null };
+      case "backlog":
+      case "pending":
+      case "scheduled":
+      case "not-started":
+      case "planned":
+        return { status: TaskStatus.NOT_STARTED, issue: null };
+      case "blocked":
+      case "on-hold":
+        return { status: TaskStatus.PAUSED, issue: null };
+      case "cancelled":
+        return { status: TaskStatus.ARCHIVED, issue: null };
+      default:
+        return {
+          status: TaskStatus.NOT_STARTED,
+          issue: `Unknown task status "${rawStatus ?? "null"}" mapped to NOT_STARTED`,
+        };
+    }
+  }
+
+  private mapTaskPriority(rawPriority: string | null): TaskPriorityMapping {
+    const priorityKey = this.normalizeKey(rawPriority);
+
+    switch (priorityKey) {
+      case "critical":
+      case "high":
+        return { priority: TaskPriority.HIGH, issue: null };
+      case "medium":
+        return { priority: TaskPriority.MEDIUM, issue: null };
+      case "low":
+        return { priority: TaskPriority.LOW, issue: null };
+      default:
+        return {
+          priority: TaskPriority.MEDIUM,
+          issue: `Unknown task priority "${rawPriority ?? "null"}" mapped to MEDIUM`,
+        };
+    }
+  }
+
+  private mapProjectStatus(rawStatus: string | null): ProjectStatusMapping {
+    const statusKey = this.normalizeKey(rawStatus);
+
+    switch (statusKey) {
+      case "active":
+      case "in-progress":
+        return { status: ProjectStatus.ACTIVE, issue: null };
+      case "backlog":
+      case "planning":
+        return { status: ProjectStatus.PLANNING, issue: null };
+      case "paused":
+      case "blocked":
+        return { status: ProjectStatus.PAUSED, issue: null };
+      case "archived":
+      case "maintenance":
+        return { status: ProjectStatus.ARCHIVED, issue: null };
+      default:
+        return {
+          status: ProjectStatus.PLANNING,
+          issue: `Unknown project status "${rawStatus ?? "null"}" mapped to PLANNING`,
+        };
+    }
+  }
+
+  private normalizeDomain(rawDomain: string | null | undefined): string | null {
+    if (!rawDomain) {
+      return null;
+    }
+
+    const trimmed = rawDomain.trim();
+    if (trimmed.length === 0) {
+      return null;
+    }
+
+    const slug = trimmed
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "");
+
+    return slug.length > 0 ? slug : null;
+  }
+
+  private normalizeDate(rawValue: string | null, context: string, errors: string[]): Date | null {
+    if (!rawValue) {
+      return null;
+    }
+
+    const trimmed = rawValue.trim();
+    if (trimmed.length === 0) {
+      return null;
+    }
+
+    const value = /^\d{4}-\d{2}-\d{2}$/.test(trimmed) ? `${trimmed}T00:00:00.000Z` : trimmed;
+    const parsedDate = new Date(value);
+
+    if (Number.isNaN(parsedDate.getTime())) {
+      errors.push(`${context}: invalid date "${rawValue}"`);
+      return null;
+    }
+
+    return parsedDate;
+  }
+
+  private asJsonValue(value: Record<string, unknown>): Prisma.InputJsonValue {
+    return value as Prisma.InputJsonValue;
+  }
+
+  private getErrorMessage(error: unknown): string {
+    if (error instanceof Error) {
+      return error.message;
+    }
+
+    return String(error);
+  }
+}

apps/api/src/tasks/dto/create-task.dto.ts

@@ -50,6 +50,12 @@ export class CreateTaskDto {
   @IsUUID("4", { message: "parentId must be a valid UUID" })
   parentId?: string;
 
+  @IsOptional()
+  @IsString({ message: "assignedAgent must be a string" })
+  @MinLength(1, { message: "assignedAgent must not be empty" })
+  @MaxLength(255, { message: "assignedAgent must not exceed 255 characters" })
+  assignedAgent?: string;
+
   @IsOptional()
   @IsInt({ message: "sortOrder must be an integer" })
   @Min(0, { message: "sortOrder must be at least 0" })

apps/api/src/tasks/dto/update-task.dto.ts

@@ -52,6 +52,12 @@ export class UpdateTaskDto {
   @IsUUID("4", { message: "parentId must be a valid UUID" })
   parentId?: string | null;
 
+  @IsOptional()
+  @IsString({ message: "assignedAgent must be a string" })
+  @MinLength(1, { message: "assignedAgent must not be empty" })
+  @MaxLength(255, { message: "assignedAgent must not exceed 255 characters" })
+  assignedAgent?: string | null;
+
   @IsOptional()
   @IsInt({ message: "sortOrder must be an integer" })
   @Min(0, { message: "sortOrder must be at least 0" })

apps/api/src/tasks/tasks.assigned-agent.integration.spec.ts

@@ -0,0 +1,162 @@
+import { beforeAll, beforeEach, describe, expect, it, afterAll, vi } from "vitest";
+import { randomUUID as uuid } from "crypto";
+import { Test, TestingModule } from "@nestjs/testing";
+import { PrismaClient } from "@prisma/client";
+import { TasksService } from "./tasks.service";
+import { PrismaService } from "../prisma/prisma.service";
+import { ActivityService } from "../activity/activity.service";
+
+const shouldRunDbIntegrationTests =
+  process.env.RUN_DB_TESTS === "true" && Boolean(process.env.DATABASE_URL);
+const describeFn = shouldRunDbIntegrationTests ? describe : describe.skip;
+
+describeFn("TasksService assignedAgent Integration", () => {
+  let moduleRef: TestingModule;
+  let prisma: PrismaClient;
+  let service: TasksService;
+  let workspaceId: string;
+  let ownerId: string;
+  let setupComplete = false;
+
+  const activityServiceMock = {
+    logTaskCreated: vi.fn().mockResolvedValue(undefined),
+    logTaskUpdated: vi.fn().mockResolvedValue(undefined),
+    logTaskDeleted: vi.fn().mockResolvedValue(undefined),
+    logTaskCompleted: vi.fn().mockResolvedValue(undefined),
+    logTaskAssigned: vi.fn().mockResolvedValue(undefined),
+  };
+
+  beforeAll(async () => {
+    prisma = new PrismaClient();
+    await prisma.$connect();
+
+    const workspace = await prisma.workspace.create({
+      data: {
+        name: `Tasks Assigned Agent Integration ${Date.now()}`,
+        owner: {
+          create: {
+            email: `tasks-assigned-agent-integration-${Date.now()}@example.com`,
+            name: "Tasks Assigned Agent Integration Owner",
+          },
+        },
+      },
+    });
+
+    workspaceId = workspace.id;
+    ownerId = workspace.ownerId;
+
+    moduleRef = await Test.createTestingModule({
+      providers: [
+        TasksService,
+        {
+          provide: PrismaService,
+          useValue: prisma,
+        },
+        {
+          provide: ActivityService,
+          useValue: activityServiceMock,
+        },
+      ],
+    }).compile();
+
+    service = moduleRef.get<TasksService>(TasksService);
+    setupComplete = true;
+  });
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+
+    if (!setupComplete) {
+      return;
+    }
+
+    await prisma.task.deleteMany({ where: { workspaceId } });
+  });
+
+  afterAll(async () => {
+    if (!prisma) {
+      return;
+    }
+
+    if (workspaceId) {
+      await prisma.task.deleteMany({ where: { workspaceId } });
+      await prisma.workspace.deleteMany({ where: { id: workspaceId } });
+    }
+    if (ownerId) {
+      await prisma.user.deleteMany({ where: { id: ownerId } });
+    }
+
+    if (moduleRef) {
+      await moduleRef.close();
+    }
+    await prisma.$disconnect();
+  });
+
+  it("persists assignedAgent on create", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const task = await service.create(workspaceId, ownerId, {
+      title: `Assigned agent create ${uuid()}`,
+      assignedAgent: "fleet-worker-1",
+    });
+
+    expect(task.assignedAgent).toBe("fleet-worker-1");
+
+    const stored = await prisma.task.findUnique({
+      where: {
+        id: task.id,
+      },
+      select: {
+        id: true,
+        assignedAgent: true,
+      },
+    });
+
+    expect(stored).toMatchObject({
+      id: task.id,
+      assignedAgent: "fleet-worker-1",
+    });
+
+    const listed = await service.findAll({ workspaceId, page: 1, limit: 10 }, ownerId);
+    const listedTask = listed.data.find((row) => row.id === task.id);
+
+    expect(listedTask?.assignedAgent).toBe("fleet-worker-1");
+  });
+
+  it("updates and clears assignedAgent", async () => {
+    if (!setupComplete) {
+      return;
+    }
+
+    const created = await service.create(workspaceId, ownerId, {
+      title: `Assigned agent update ${uuid()}`,
+    });
+
+    expect(created.assignedAgent).toBeNull();
+
+    const updated = await service.update(created.id, workspaceId, ownerId, {
+      assignedAgent: "fleet-worker-2",
+    });
+
+    expect(updated.assignedAgent).toBe("fleet-worker-2");
+
+    const cleared = await service.update(created.id, workspaceId, ownerId, {
+      assignedAgent: null,
+    });
+
+    expect(cleared.assignedAgent).toBeNull();
+
+    const stored = await prisma.task.findUnique({
+      where: {
+        id: created.id,
+      },
+      select: {
+        assignedAgent: true,
+      },
+    });
+
+    expect(stored?.assignedAgent).toBeNull();
+  });
+});

apps/api/src/tasks/tasks.service.spec.ts

@@ -48,6 +48,7 @@ describe("TasksService", () => {
     creatorId: mockUserId,
     projectId: null,
     parentId: null,
+    assignedAgent: null,
     sortOrder: 0,
     metadata: {},
     createdAt: new Date(),
@@ -158,6 +159,28 @@ describe("TasksService", () => {
         })
       );
     });
+
+    it("should include assignedAgent when provided", async () => {
+      const createDto = {
+        title: "Agent-owned Task",
+        assignedAgent: "fleet-worker-1",
+      };
+
+      mockPrismaService.task.create.mockResolvedValue({
+        ...mockTask,
+        assignedAgent: createDto.assignedAgent,
+      });
+
+      await service.create(mockWorkspaceId, mockUserId, createDto);
+
+      expect(prisma.task.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            assignedAgent: createDto.assignedAgent,
+          }),
+        })
+      );
+    });
   });
 
   describe("findAll", () => {
@@ -469,6 +492,26 @@ describe("TasksService", () => {
         service.update(mockTaskId, mockWorkspaceId, mockUserId, { title: "Test" })
       ).rejects.toThrow(NotFoundException);
     });
+
+    it("should update assignedAgent when provided", async () => {
+      const updateDto = { assignedAgent: "fleet-worker-2" };
+
+      mockPrismaService.task.findUnique.mockResolvedValue(mockTask);
+      mockPrismaService.task.update.mockResolvedValue({
+        ...mockTask,
+        assignedAgent: updateDto.assignedAgent,
+      });
+
+      await service.update(mockTaskId, mockWorkspaceId, mockUserId, updateDto);
+
+      expect(prisma.task.update).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            assignedAgent: updateDto.assignedAgent,
+          }),
+        })
+      );
+    });
   });
 
   describe("remove", () => {

apps/api/src/tasks/tasks.service.ts

@@ -67,6 +67,9 @@ export class TasksService {
       metadata: createTaskDto.metadata
         ? (createTaskDto.metadata as unknown as Prisma.InputJsonValue)
         : {},
+      ...(createTaskDto.assignedAgent !== undefined && {
+        assignedAgent: createTaskDto.assignedAgent,
+      }),
       ...(assigneeConnection && { assignee: assigneeConnection }),
       ...(projectConnection && { project: projectConnection }),
       ...(parentConnection && { parent: parentConnection }),
@@ -291,6 +294,9 @@ export class TasksService {
         if (updateTaskDto.parentId !== undefined && updateTaskDto.parentId !== null) {
           data.parent = { connect: { id: updateTaskDto.parentId } };
         }
+        if (updateTaskDto.assignedAgent !== undefined) {
+          data.assignedAgent = updateTaskDto.assignedAgent;
+        }
 
         // Handle completedAt based on status changes
         if (updateTaskDto.status) {

apps/web/src/app/(authenticated)/settings/page.tsx

@@ -1,7 +1,10 @@
 "use client";
 
-import { useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import type { ReactElement, ReactNode } from "react";
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { useAuth } from "@/lib/auth/auth-context";
+import { fetchUserWorkspaces } from "@/lib/api/workspaces";
 import Link from "next/link";
 
 interface CategoryConfig {
@@ -11,6 +14,7 @@ interface CategoryConfig {
   accent: string;
   iconBg: string;
   icon: ReactNode;
+  adminOnly?: boolean;
 }
 
 interface SettingsCategoryCardProps {
@@ -196,6 +200,58 @@ const categories: CategoryConfig[] = [
       </svg>
     ),
   },
+  {
+    title: "Users",
+    description: "Invite, manage roles, and deactivate users across your workspaces.",
+    href: "/settings/users",
+    adminOnly: true,
+    accent: "var(--ms-green-400)",
+    iconBg: "rgba(34, 197, 94, 0.12)",
+    icon: (
+      <svg
+        width="20"
+        height="20"
+        viewBox="0 0 20 20"
+        fill="none"
+        stroke="currentColor"
+        strokeWidth="1.5"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        aria-hidden="true"
+      >
+        <circle cx="8" cy="7" r="2.5" />
+        <circle cx="13.5" cy="8.5" r="2" />
+        <path d="M3.5 16c0-2.5 2-4.5 4.5-4.5s4.5 2 4.5 4.5" />
+        <path d="M12 13.8c.5-.8 1.4-1.3 2.5-1.3 1.7 0 3 1.3 3 3" />
+      </svg>
+    ),
+  },
+  {
+    title: "Teams",
+    description: "Create and manage teams within your active workspace.",
+    href: "/settings/teams",
+    adminOnly: true,
+    accent: "var(--ms-blue-400)",
+    iconBg: "rgba(47, 128, 255, 0.12)",
+    icon: (
+      <svg
+        width="20"
+        height="20"
+        viewBox="0 0 20 20"
+        fill="none"
+        stroke="currentColor"
+        strokeWidth="1.5"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+        aria-hidden="true"
+      >
+        <circle cx="7" cy="7" r="2.25" />
+        <circle cx="13" cy="7" r="2.25" />
+        <path d="M3 15c0-2.2 1.8-4 4-4s4 1.8 4 4" />
+        <path d="M9 15c0-2.2 1.8-4 4-4s4 1.8 4 4" />
+      </svg>
+    ),
+  },
   {
     title: "Workspaces",
     description:
@@ -227,7 +283,30 @@ const categories: CategoryConfig[] = [
   },
 ];
 
+const ADMIN_ROLES: WorkspaceMemberRole[] = [WorkspaceMemberRole.OWNER, WorkspaceMemberRole.ADMIN];
+
 export default function SettingsPage(): ReactElement {
+  const { user } = useAuth();
+  const [isAdmin, setIsAdmin] = useState<boolean>(false);
+
+  const checkRole = useCallback(async (): Promise<void> => {
+    if (user === null) return;
+    try {
+      const workspaces = await fetchUserWorkspaces();
+      const hasAdminRole = workspaces.some((ws) => ADMIN_ROLES.includes(ws.role));
+      setIsAdmin(hasAdminRole);
+    } catch {
+      // Fail open — show all items if we can't determine role
+      setIsAdmin(true);
+    }
+  }, [user]);
+
+  useEffect(() => {
+    void checkRole();
+  }, [checkRole]);
+
+  const visibleCategories = categories.filter((c) => c.adminOnly !== true || isAdmin);
+
   return (
     <div className="max-w-6xl mx-auto p-6">
       {/* Page header */}
@@ -255,7 +334,7 @@ export default function SettingsPage(): ReactElement {
 
       {/* Category grid */}
       <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-        {categories.map((category) => (
+        {visibleCategories.map((category) => (
           <SettingsCategoryCard key={category.href} category={category} />
         ))}
       </div>

apps/web/src/app/(authenticated)/settings/teams/page.test.tsx

@@ -0,0 +1,190 @@
+import type { ReactElement, ReactNode } from "react";
+import type { TeamRecord } from "@/lib/api/teams";
+
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createTeam, deleteTeam, fetchTeams, updateTeam } from "@/lib/api/teams";
+import { fetchUserWorkspaces } from "@/lib/api/workspaces";
+
+import TeamsSettingsPage from "./page";
+
+vi.mock("next/link", () => ({
+  default: function LinkMock({
+    children,
+    href,
+  }: {
+    children: ReactNode;
+    href: string;
+  }): ReactElement {
+    return <a href={href}>{children}</a>;
+  },
+}));
+
+vi.mock("@/lib/api/teams", () => ({
+  fetchTeams: vi.fn(),
+  createTeam: vi.fn(),
+  updateTeam: vi.fn(),
+  deleteTeam: vi.fn(),
+}));
+
+vi.mock("@/lib/api/workspaces", () => ({
+  fetchUserWorkspaces: vi.fn(),
+}));
+
+const fetchTeamsMock = vi.mocked(fetchTeams);
+const createTeamMock = vi.mocked(createTeam);
+const updateTeamMock = vi.mocked(updateTeam);
+const deleteTeamMock = vi.mocked(deleteTeam);
+const fetchUserWorkspacesMock = vi.mocked(fetchUserWorkspaces);
+
+const baseTeam: TeamRecord = {
+  id: "team-1",
+  workspaceId: "workspace-1",
+  name: "Platform Team",
+  description: "Owns platform services",
+  metadata: {},
+  createdAt: "2026-02-01T00:00:00.000Z",
+  updatedAt: "2026-02-01T00:00:00.000Z",
+  _count: {
+    members: 3,
+  },
+};
+
+describe("TeamsSettingsPage", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    fetchTeamsMock.mockResolvedValue([]);
+    fetchUserWorkspacesMock.mockResolvedValue([
+      {
+        id: "workspace-1",
+        name: "Personal Workspace",
+        ownerId: "owner-1",
+        role: WorkspaceMemberRole.OWNER,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    ]);
+  });
+
+  it("shows access denied to non-admin users", async () => {
+    fetchUserWorkspacesMock.mockResolvedValueOnce([
+      {
+        id: "workspace-1",
+        name: "Personal Workspace",
+        ownerId: "owner-1",
+        role: WorkspaceMemberRole.MEMBER,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    ]);
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Access Denied")).toBeInTheDocument();
+    expect(fetchTeamsMock).not.toHaveBeenCalled();
+  });
+
+  it("loads and renders teams from the API", async () => {
+    fetchTeamsMock.mockResolvedValue([baseTeam]);
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Team Directory")).toBeInTheDocument();
+    expect(screen.getByText("Platform Team")).toBeInTheDocument();
+    expect(fetchTeamsMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("shows empty state when the API returns no teams", async () => {
+    fetchTeamsMock.mockResolvedValue([]);
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("No Teams Yet")).toBeInTheDocument();
+    expect(screen.getByText("Create the first team to get started.")).toBeInTheDocument();
+  });
+
+  it("shows error state and does not show empty state", async () => {
+    fetchTeamsMock.mockRejectedValue(new Error("Unable to load teams"));
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Unable to load teams")).toBeInTheDocument();
+  });
+
+  it("creates a team from the create dialog", async () => {
+    const user = userEvent.setup();
+    fetchTeamsMock.mockResolvedValue([baseTeam]);
+    createTeamMock.mockResolvedValue({
+      ...baseTeam,
+      id: "team-2",
+      name: "Design Team",
+      description: "Owns design quality",
+    });
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Platform Team")).toBeInTheDocument();
+
+    const triggerButton = screen.getByRole("button", { name: "Create Team" });
+    await user.click(triggerButton);
+
+    await user.type(screen.getByLabelText("Name"), "Design Team");
+    await user.type(screen.getByLabelText("Description"), "Owns design quality");
+
+    const submitButton = screen.getAllByRole("button", { name: "Create Team" })[1];
+    if (!submitButton) {
+      throw new Error("Expected create-team submit button to be rendered");
+    }
+    await user.click(submitButton);
+
+    await waitFor(() => {
+      expect(createTeamMock).toHaveBeenCalledWith({
+        name: "Design Team",
+        description: "Owns design quality",
+      });
+    });
+  });
+
+  it("opens team details and updates name", async () => {
+    const user = userEvent.setup();
+    fetchTeamsMock.mockResolvedValue([baseTeam]);
+    updateTeamMock.mockResolvedValue({
+      ...baseTeam,
+      name: "Platform Engineering",
+    });
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Platform Team")).toBeInTheDocument();
+
+    await user.click(screen.getByText("Platform Team"));
+
+    const nameInput = await screen.findByLabelText("Name");
+    await user.clear(nameInput);
+    await user.type(nameInput, "Platform Engineering");
+    await user.click(screen.getByRole("button", { name: "Save Changes" }));
+
+    await waitFor(() => {
+      expect(updateTeamMock).toHaveBeenCalledWith("team-1", {
+        name: "Platform Engineering",
+      });
+    });
+  });
+
+  it("deletes a team from the confirmation dialog", async () => {
+    const user = userEvent.setup();
+    fetchTeamsMock.mockResolvedValue([baseTeam]);
+    deleteTeamMock.mockResolvedValue();
+
+    render(<TeamsSettingsPage />);
+
+    expect(await screen.findByText("Platform Team")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Delete" }));
+    await user.click(screen.getByRole("button", { name: "Delete Team" }));
+
+    await waitFor(() => {
+      expect(deleteTeamMock).toHaveBeenCalledWith("team-1");
+    });
+  });
+});

apps/web/src/app/(authenticated)/settings/teams/page.tsx

@@ -0,0 +1,582 @@
+"use client";
+
+import {
+  useCallback,
+  useEffect,
+  useState,
+  type ChangeEvent,
+  type KeyboardEvent,
+  type ReactElement,
+  type SyntheticEvent,
+} from "react";
+import Link from "next/link";
+import { Plus, Trash2, Users } from "lucide-react";
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { SettingsAccessDenied } from "@/components/settings/SettingsAccessDenied";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import {
+  createTeam,
+  deleteTeam,
+  fetchTeams,
+  updateTeam,
+  type CreateTeamDto,
+  type TeamRecord,
+  type UpdateTeamDto,
+} from "@/lib/api/teams";
+import { fetchUserWorkspaces } from "@/lib/api/workspaces";
+
+const INITIAL_CREATE_FORM = {
+  name: "",
+  description: "",
+};
+
+const INITIAL_DETAIL_FORM = {
+  name: "",
+  description: "",
+};
+
+interface DetailInitialState {
+  name: string;
+  description: string;
+}
+
+function toMemberLabel(count: number): string {
+  return `${String(count)} member${count === 1 ? "" : "s"}`;
+}
+
+export default function TeamsSettingsPage(): ReactElement {
+  const [teams, setTeams] = useState<TeamRecord[]>([]);
+  const [isLoading, setIsLoading] = useState<boolean>(true);
+  const [isRefreshing, setIsRefreshing] = useState<boolean>(false);
+  const [error, setError] = useState<string | null>(null);
+  const [isAdmin, setIsAdmin] = useState<boolean | null>(null);
+
+  const [isCreateOpen, setIsCreateOpen] = useState<boolean>(false);
+  const [createForm, setCreateForm] = useState(INITIAL_CREATE_FORM);
+  const [createError, setCreateError] = useState<string | null>(null);
+  const [isCreating, setIsCreating] = useState<boolean>(false);
+
+  const [detailTarget, setDetailTarget] = useState<TeamRecord | null>(null);
+  const [detailForm, setDetailForm] = useState(INITIAL_DETAIL_FORM);
+  const [detailInitial, setDetailInitial] = useState<DetailInitialState | null>(null);
+  const [detailError, setDetailError] = useState<string | null>(null);
+  const [isSavingDetails, setIsSavingDetails] = useState<boolean>(false);
+
+  const [deleteTarget, setDeleteTarget] = useState<TeamRecord | null>(null);
+  const [isDeleting, setIsDeleting] = useState<boolean>(false);
+
+  const loadTeams = useCallback(async (showLoadingState: boolean): Promise<void> => {
+    try {
+      if (showLoadingState) {
+        setIsLoading(true);
+      } else {
+        setIsRefreshing(true);
+      }
+
+      const data = await fetchTeams();
+      setTeams(data);
+      setError(null);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to load teams");
+    } finally {
+      setIsLoading(false);
+      setIsRefreshing(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetchUserWorkspaces()
+      .then((workspaces) => {
+        const adminRoles: WorkspaceMemberRole[] = [
+          WorkspaceMemberRole.OWNER,
+          WorkspaceMemberRole.ADMIN,
+        ];
+
+        setIsAdmin(workspaces.some((workspace) => adminRoles.includes(workspace.role)));
+      })
+      .catch(() => {
+        setIsAdmin(true); // fail open
+      });
+  }, []);
+
+  useEffect(() => {
+    if (isAdmin !== true) {
+      return;
+    }
+
+    void loadTeams(true);
+  }, [isAdmin, loadTeams]);
+
+  function resetCreateForm(): void {
+    setCreateForm(INITIAL_CREATE_FORM);
+    setCreateError(null);
+  }
+
+  function openTeamDetails(team: TeamRecord): void {
+    const nextDetailForm = {
+      name: team.name,
+      description: team.description ?? "",
+    };
+
+    setDetailTarget(team);
+    setDetailForm(nextDetailForm);
+    setDetailInitial({
+      name: nextDetailForm.name,
+      description: nextDetailForm.description,
+    });
+    setDetailError(null);
+  }
+
+  function resetTeamDetails(): void {
+    setDetailTarget(null);
+    setDetailForm(INITIAL_DETAIL_FORM);
+    setDetailInitial(null);
+    setDetailError(null);
+  }
+
+  function handleTeamRowKeyDown(event: KeyboardEvent<HTMLDivElement>, team: TeamRecord): void {
+    if (event.key === "Enter" || event.key === " ") {
+      event.preventDefault();
+      openTeamDetails(team);
+    }
+  }
+
+  async function handleCreateSubmit(event: SyntheticEvent): Promise<void> {
+    event.preventDefault();
+    setCreateError(null);
+
+    const name = createForm.name.trim();
+    if (!name) {
+      setCreateError("Name is required.");
+      return;
+    }
+
+    const description = createForm.description.trim();
+    const dto: CreateTeamDto = { name };
+    if (description) {
+      dto.description = description;
+    }
+
+    try {
+      setIsCreating(true);
+      await createTeam(dto);
+      setIsCreateOpen(false);
+      resetCreateForm();
+      await loadTeams(false);
+    } catch (err: unknown) {
+      setCreateError(err instanceof Error ? err.message : "Failed to create team");
+    } finally {
+      setIsCreating(false);
+    }
+  }
+
+  async function handleDetailSubmit(event: SyntheticEvent): Promise<void> {
+    event.preventDefault();
+
+    if (detailTarget === null || detailInitial === null) {
+      return;
+    }
+
+    const name = detailForm.name.trim();
+    if (!name) {
+      setDetailError("Name is required.");
+      return;
+    }
+
+    const nextDescription = detailForm.description.trim();
+    const normalizedNextDescription = nextDescription.length > 0 ? nextDescription : null;
+    const normalizedInitialDescription =
+      detailInitial.description.trim().length > 0 ? detailInitial.description.trim() : null;
+
+    const dto: UpdateTeamDto = {};
+
+    if (name !== detailInitial.name) {
+      dto.name = name;
+    }
+
+    if (normalizedNextDescription !== normalizedInitialDescription) {
+      dto.description = normalizedNextDescription;
+    }
+
+    if (Object.keys(dto).length === 0) {
+      resetTeamDetails();
+      return;
+    }
+
+    try {
+      setIsSavingDetails(true);
+      setDetailError(null);
+      await updateTeam(detailTarget.id, dto);
+      resetTeamDetails();
+      await loadTeams(false);
+    } catch (err: unknown) {
+      setDetailError(err instanceof Error ? err.message : "Failed to update team");
+    } finally {
+      setIsSavingDetails(false);
+    }
+  }
+
+  async function confirmDelete(): Promise<void> {
+    if (!deleteTarget) {
+      return;
+    }
+
+    try {
+      setIsDeleting(true);
+      await deleteTeam(deleteTarget.id);
+      setDeleteTarget(null);
+      await loadTeams(false);
+      setError(null);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to delete team");
+    } finally {
+      setIsDeleting(false);
+    }
+  }
+
+  if (isAdmin === null) {
+    return (
+      <Card className="max-w-2xl mx-auto mt-8">
+        <CardContent className="py-12 text-center text-muted-foreground">
+          Checking permissions...
+        </CardContent>
+      </Card>
+    );
+  }
+
+  if (!isAdmin) {
+    return <SettingsAccessDenied message="You need Admin or Owner role to manage teams." />;
+  }
+
+  return (
+    <div className="max-w-6xl mx-auto p-6 space-y-6">
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <div className="flex items-center gap-3">
+            <h1 className="text-3xl font-bold">Teams</h1>
+            <Badge variant="outline">{teams.length} total</Badge>
+          </div>
+          <p className="text-muted-foreground mt-1">Create and manage workspace teams</p>
+        </div>
+
+        <div className="flex items-center gap-2">
+          <Button
+            variant="outline"
+            onClick={() => {
+              void loadTeams(false);
+            }}
+            disabled={isLoading || isRefreshing}
+          >
+            {isRefreshing ? "Refreshing..." : "Refresh"}
+          </Button>
+
+          <Dialog
+            open={isCreateOpen}
+            onOpenChange={(open) => {
+              if (!open && !isCreating) {
+                resetCreateForm();
+              }
+              setIsCreateOpen(open);
+            }}
+          >
+            <DialogTrigger asChild>
+              <Button>
+                <Plus className="h-4 w-4 mr-2" />
+                Create Team
+              </Button>
+            </DialogTrigger>
+            <DialogContent>
+              <DialogHeader>
+                <DialogTitle>Create Team</DialogTitle>
+                <DialogDescription>
+                  Create a team in the active workspace to organize members and permissions.
+                </DialogDescription>
+              </DialogHeader>
+
+              <form
+                onSubmit={(event) => {
+                  void handleCreateSubmit(event);
+                }}
+                className="space-y-4"
+              >
+                <div className="space-y-2">
+                  <Label htmlFor="create-name">Name</Label>
+                  <Input
+                    id="create-name"
+                    value={createForm.name}
+                    onChange={(event: ChangeEvent<HTMLInputElement>) => {
+                      setCreateForm((prev) => ({ ...prev, name: event.target.value }));
+                    }}
+                    placeholder="Platform Team"
+                    maxLength={100}
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="create-description">Description</Label>
+                  <Textarea
+                    id="create-description"
+                    value={createForm.description}
+                    onChange={(event: ChangeEvent<HTMLTextAreaElement>) => {
+                      setCreateForm((prev) => ({ ...prev, description: event.target.value }));
+                    }}
+                    placeholder="Owns platform services and infrastructure"
+                    maxLength={500}
+                    rows={4}
+                  />
+                </div>
+
+                {createError ? (
+                  <p className="text-sm text-destructive" role="alert">
+                    {createError}
+                  </p>
+                ) : null}
+
+                <DialogFooter>
+                  <Button
+                    type="button"
+                    variant="outline"
+                    onClick={() => {
+                      if (!isCreating) {
+                        setIsCreateOpen(false);
+                        resetCreateForm();
+                      }
+                    }}
+                    disabled={isCreating}
+                  >
+                    Cancel
+                  </Button>
+                  <Button type="submit" disabled={isCreating}>
+                    {isCreating ? "Creating..." : "Create Team"}
+                  </Button>
+                </DialogFooter>
+              </form>
+            </DialogContent>
+          </Dialog>
+        </div>
+      </div>
+
+      <div>
+        <Link href="/settings" className="text-sm text-blue-600 hover:text-blue-700">
+          ← Back to Settings
+        </Link>
+      </div>
+
+      {error ? (
+        <Card>
+          <CardContent className="py-4">
+            <p className="text-sm text-destructive" role="alert">
+              {error}
+            </p>
+          </CardContent>
+        </Card>
+      ) : null}
+
+      {isLoading ? (
+        <Card>
+          <CardContent className="py-12 text-center text-muted-foreground">
+            Loading teams...
+          </CardContent>
+        </Card>
+      ) : teams.length === 0 ? (
+        <Card>
+          <CardHeader>
+            <CardTitle>No Teams Yet</CardTitle>
+            <CardDescription>Create the first team to get started.</CardDescription>
+          </CardHeader>
+        </Card>
+      ) : (
+        <Card>
+          <CardHeader>
+            <CardTitle>Team Directory</CardTitle>
+            <CardDescription>
+              Click a team to view details or edit name and description.
+            </CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            {teams.map((team) => {
+              const memberCount = team._count?.members ?? 0;
+              const description = team.description?.trim();
+
+              return (
+                <div
+                  key={team.id}
+                  className="rounded-md border p-4 flex flex-col gap-3 md:flex-row md:items-center md:justify-between cursor-pointer hover:bg-muted/30"
+                  role="button"
+                  tabIndex={0}
+                  onClick={() => {
+                    openTeamDetails(team);
+                  }}
+                  onKeyDown={(event) => {
+                    handleTeamRowKeyDown(event, team);
+                  }}
+                >
+                  <div className="space-y-1 min-w-0">
+                    <p className="font-semibold truncate">{team.name}</p>
+                    <p className="text-sm text-muted-foreground truncate">
+                      {description && description.length > 0 ? description : "No description"}
+                    </p>
+                  </div>
+
+                  <div className="flex items-center gap-2 flex-wrap md:justify-end">
+                    <Badge variant="outline">
+                      <Users className="h-3.5 w-3.5 mr-1" />
+                      {toMemberLabel(memberCount)}
+                    </Badge>
+                    <Badge variant="secondary">
+                      Created {new Date(team.createdAt).toLocaleDateString()}
+                    </Badge>
+                    <Button
+                      variant="destructive"
+                      size="sm"
+                      onClick={(event) => {
+                        event.stopPropagation();
+                        setDeleteTarget(team);
+                      }}
+                    >
+                      <Trash2 className="h-4 w-4 mr-2" />
+                      Delete
+                    </Button>
+                  </div>
+                </div>
+              );
+            })}
+          </CardContent>
+        </Card>
+      )}
+
+      <Dialog
+        open={detailTarget !== null}
+        onOpenChange={(open) => {
+          if (!open && !isSavingDetails) {
+            resetTeamDetails();
+          }
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Team Details</DialogTitle>
+            <DialogDescription>
+              Edit team details for {detailTarget?.name ?? "selected team"}.
+            </DialogDescription>
+          </DialogHeader>
+
+          <form
+            onSubmit={(event) => {
+              void handleDetailSubmit(event);
+            }}
+            className="space-y-4"
+          >
+            <div className="space-y-2">
+              <Label htmlFor="detail-name">Name</Label>
+              <Input
+                id="detail-name"
+                value={detailForm.name}
+                onChange={(event: ChangeEvent<HTMLInputElement>) => {
+                  setDetailForm((prev) => ({ ...prev, name: event.target.value }));
+                }}
+                placeholder="Team name"
+                maxLength={100}
+                disabled={isSavingDetails}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="detail-description">Description</Label>
+              <Textarea
+                id="detail-description"
+                value={detailForm.description}
+                onChange={(event: ChangeEvent<HTMLTextAreaElement>) => {
+                  setDetailForm((prev) => ({ ...prev, description: event.target.value }));
+                }}
+                placeholder="Describe this team"
+                maxLength={500}
+                rows={4}
+                disabled={isSavingDetails}
+              />
+            </div>
+
+            {detailError !== null ? (
+              <p className="text-sm text-destructive" role="alert">
+                {detailError}
+              </p>
+            ) : null}
+
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => {
+                  if (!isSavingDetails) {
+                    resetTeamDetails();
+                  }
+                }}
+                disabled={isSavingDetails}
+              >
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isSavingDetails}>
+                {isSavingDetails ? "Saving..." : "Save Changes"}
+              </Button>
+            </DialogFooter>
+          </form>
+        </DialogContent>
+      </Dialog>
+
+      <AlertDialog
+        open={deleteTarget !== null}
+        onOpenChange={(open) => {
+          if (!open && !isDeleting) {
+            setDeleteTarget(null);
+          }
+        }}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Delete Team</AlertDialogTitle>
+            <AlertDialogDescription>
+              Delete {deleteTarget?.name}? Team members will be removed from this team assignment.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isDeleting}>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              disabled={isDeleting}
+              onClick={() => {
+                void confirmDelete();
+              }}
+            >
+              {isDeleting ? "Deleting..." : "Delete Team"}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  );
+}

apps/web/src/app/(authenticated)/settings/users/page.test.tsx

@@ -0,0 +1,352 @@
+import type { ReactElement, ReactNode } from "react";
+
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+  type AdminUser,
+  deactivateUser,
+  fetchAdminUsers,
+  inviteUser,
+  updateUser,
+  type AdminUsersResponse,
+} from "@/lib/api/admin";
+import { useAuth } from "@/lib/auth/auth-context";
+import { fetchUserWorkspaces, updateWorkspaceMemberRole } from "@/lib/api/workspaces";
+import UsersSettingsPage from "./page";
+
+vi.mock("next/link", () => ({
+  default: function LinkMock({
+    children,
+    href,
+  }: {
+    children: ReactNode;
+    href: string;
+  }): ReactElement {
+    return <a href={href}>{children}</a>;
+  },
+}));
+
+vi.mock("@/lib/api/admin", () => ({
+  fetchAdminUsers: vi.fn(),
+  inviteUser: vi.fn(),
+  updateUser: vi.fn(),
+  deactivateUser: vi.fn(),
+}));
+
+vi.mock("@/lib/api/workspaces", () => ({
+  fetchUserWorkspaces: vi.fn(),
+  updateWorkspaceMemberRole: vi.fn(),
+}));
+
+vi.mock("@/lib/auth/auth-context", () => ({
+  useAuth: vi.fn(),
+}));
+
+const fetchAdminUsersMock = vi.mocked(fetchAdminUsers);
+const inviteUserMock = vi.mocked(inviteUser);
+const updateUserMock = vi.mocked(updateUser);
+const deactivateUserMock = vi.mocked(deactivateUser);
+const fetchUserWorkspacesMock = vi.mocked(fetchUserWorkspaces);
+const updateWorkspaceMemberRoleMock = vi.mocked(updateWorkspaceMemberRole);
+const useAuthMock = vi.mocked(useAuth);
+
+function makeAdminUser(overrides?: Partial<AdminUser>): AdminUser {
+  return {
+    id: "user-1",
+    name: "Alice",
+    email: "alice@example.com",
+    emailVerified: true,
+    image: null,
+    createdAt: "2026-01-01T00:00:00.000Z",
+    deactivatedAt: null,
+    isLocalAuth: false,
+    invitedAt: null,
+    invitedBy: null,
+    workspaceMemberships: [
+      {
+        workspaceId: "workspace-1",
+        workspaceName: "Personal Workspace",
+        role: WorkspaceMemberRole.ADMIN,
+        joinedAt: "2026-01-01T00:00:00.000Z",
+      },
+    ],
+    ...overrides,
+  };
+}
+
+function makeAdminUsersResponse(options?: {
+  data?: AdminUser[];
+  page?: number;
+  totalPages?: number;
+  total?: number;
+  limit?: number;
+}): AdminUsersResponse {
+  const data = options?.data ?? [makeAdminUser()];
+  return {
+    data,
+    meta: {
+      total: options?.total ?? data.length,
+      page: options?.page ?? 1,
+      limit: options?.limit ?? 50,
+      totalPages: options?.totalPages ?? 1,
+    },
+  };
+}
+
+function makeAuthState(userId: string): ReturnType<typeof useAuth> {
+  return {
+    user: { id: userId, email: `${userId}@example.com`, name: "Current User" },
+    isLoading: false,
+    isAuthenticated: true,
+    authError: null,
+    sessionExpiring: false,
+    sessionMinutesRemaining: 0,
+    signOut: vi.fn(() => Promise.resolve()),
+    refreshSession: vi.fn(() => Promise.resolve()),
+  };
+}
+
+describe("UsersSettingsPage", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    const adminUsersResponse = makeAdminUsersResponse();
+
+    fetchAdminUsersMock.mockResolvedValue(adminUsersResponse);
+    fetchUserWorkspacesMock.mockResolvedValue([
+      {
+        id: "workspace-1",
+        name: "Personal Workspace",
+        ownerId: "owner-1",
+        role: WorkspaceMemberRole.OWNER,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    ]);
+    inviteUserMock.mockResolvedValue({
+      userId: "user-2",
+      invitationToken: "token-1",
+      email: "new@example.com",
+      invitedAt: "2026-01-02T00:00:00.000Z",
+    });
+    const firstUser = adminUsersResponse.data[0] ?? makeAdminUser();
+
+    updateUserMock.mockResolvedValue(firstUser);
+    deactivateUserMock.mockResolvedValue(firstUser);
+    updateWorkspaceMemberRoleMock.mockResolvedValue({
+      workspaceId: "workspace-1",
+      userId: "user-1",
+      role: WorkspaceMemberRole.ADMIN,
+      joinedAt: "2026-01-01T00:00:00.000Z",
+      user: {
+        id: "user-1",
+        email: "alice@example.com",
+        name: "Alice",
+        image: null,
+      },
+    });
+
+    useAuthMock.mockReturnValue(makeAuthState("user-current"));
+  });
+
+  it("shows access denied to non-admin users", async () => {
+    fetchUserWorkspacesMock.mockResolvedValueOnce([
+      {
+        id: "workspace-1",
+        name: "Personal Workspace",
+        ownerId: "owner-1",
+        role: WorkspaceMemberRole.MEMBER,
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    ]);
+
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("Access Denied")).toBeInTheDocument();
+    expect(fetchAdminUsersMock).not.toHaveBeenCalled();
+  });
+
+  it("invites a user with email and role from the dialog", async () => {
+    const user = userEvent.setup();
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("User Directory")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Invite User" }));
+    await user.type(screen.getByLabelText("Email"), "new@example.com");
+    await user.click(screen.getByRole("button", { name: "Send Invite" }));
+
+    await waitFor(() => {
+      expect(inviteUserMock).toHaveBeenCalledWith({
+        email: "new@example.com",
+        role: WorkspaceMemberRole.MEMBER,
+        workspaceId: "workspace-1",
+      });
+    });
+  });
+
+  it("opens user detail dialog from row click and saves edited profile fields", async () => {
+    const user = userEvent.setup();
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("alice@example.com")).toBeInTheDocument();
+
+    await user.click(screen.getByText("Alice"));
+
+    const nameInput = await screen.findByLabelText("Name");
+    await user.clear(nameInput);
+    await user.type(nameInput, "Alice Updated");
+
+    await user.click(screen.getByRole("button", { name: "Save Changes" }));
+
+    await waitFor(() => {
+      expect(updateUserMock).toHaveBeenCalledWith("user-1", { name: "Alice Updated" });
+    });
+
+    expect(updateWorkspaceMemberRoleMock).not.toHaveBeenCalled();
+  });
+
+  it("caps pagination to the last valid page after deactivation shrinks the dataset", async () => {
+    const user = userEvent.setup();
+    const pageOneUser = makeAdminUser({
+      id: "user-1",
+      name: "Alice",
+      email: "alice@example.com",
+    });
+    const pageTwoUser = makeAdminUser({
+      id: "user-2",
+      name: "Bob",
+      email: "bob@example.com",
+    });
+
+    fetchAdminUsersMock.mockReset();
+    const responses = [
+      {
+        expectedPage: 1,
+        response: makeAdminUsersResponse({
+          data: [pageOneUser],
+          page: 1,
+          totalPages: 2,
+          total: 2,
+        }),
+      },
+      {
+        expectedPage: 2,
+        response: makeAdminUsersResponse({
+          data: [pageTwoUser],
+          page: 2,
+          totalPages: 2,
+          total: 2,
+        }),
+      },
+      {
+        expectedPage: 2,
+        response: makeAdminUsersResponse({
+          data: [],
+          page: 2,
+          totalPages: 1,
+          total: 1,
+        }),
+      },
+      {
+        expectedPage: 1,
+        response: makeAdminUsersResponse({
+          data: [pageOneUser],
+          page: 1,
+          totalPages: 1,
+          total: 1,
+        }),
+      },
+    ];
+
+    fetchAdminUsersMock.mockImplementation((page = 1) => {
+      const next = responses.shift();
+      if (!next) {
+        throw new Error("Unexpected fetchAdminUsers call in pagination-cap test");
+      }
+
+      expect(page).toBe(next.expectedPage);
+      return Promise.resolve(next.response);
+    });
+
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("alice@example.com")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Next" }));
+    expect(await screen.findByText("bob@example.com")).toBeInTheDocument();
+
+    const pageTwoRow = screen.getByText("bob@example.com").closest('[role="button"]');
+    if (!(pageTwoRow instanceof HTMLElement)) {
+      throw new Error("Expected Bob's row to exist");
+    }
+
+    await user.click(within(pageTwoRow).getByRole("button", { name: "Deactivate" }));
+    const deactivateButtons = await screen.findAllByRole("button", { name: "Deactivate" });
+    const confirmDeactivateButton = deactivateButtons[deactivateButtons.length - 1];
+    if (!confirmDeactivateButton) {
+      throw new Error("Expected confirmation deactivate button to be rendered");
+    }
+    await user.click(confirmDeactivateButton);
+
+    expect(await screen.findByText("alice@example.com")).toBeInTheDocument();
+    expect(screen.queryByText("No Users Yet")).not.toBeInTheDocument();
+    expect(deactivateUserMock).toHaveBeenCalledWith("user-2");
+    const requestedPages = fetchAdminUsersMock.mock.calls.map(([requestedPage]) => requestedPage);
+    expect(requestedPages.slice(-2)).toEqual([2, 1]);
+  });
+
+  it("shows the API error state without rendering the empty-state message", async () => {
+    fetchAdminUsersMock.mockRejectedValueOnce(new Error("Unable to load users"));
+
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("Unable to load users")).toBeInTheDocument();
+    expect(screen.queryByText("No Users Yet")).not.toBeInTheDocument();
+    expect(screen.queryByText("Invite the first user to get started.")).not.toBeInTheDocument();
+  });
+
+  it("prevents the current user from deactivating their own account", async () => {
+    useAuthMock.mockReturnValue(makeAuthState("user-1"));
+
+    const selfUser = makeAdminUser({
+      id: "user-1",
+      name: "Alice",
+      email: "alice@example.com",
+    });
+    const otherUser = makeAdminUser({
+      id: "user-2",
+      name: "Bob",
+      email: "bob@example.com",
+    });
+
+    fetchAdminUsersMock.mockResolvedValueOnce(
+      makeAdminUsersResponse({
+        data: [selfUser, otherUser],
+        page: 1,
+        totalPages: 1,
+        total: 2,
+      })
+    );
+
+    render(<UsersSettingsPage />);
+
+    expect(await screen.findByText("alice@example.com")).toBeInTheDocument();
+    expect(screen.getByText("bob@example.com")).toBeInTheDocument();
+
+    const selfRow = screen.getByText("alice@example.com").closest('[role="button"]');
+    if (!(selfRow instanceof HTMLElement)) {
+      throw new Error("Expected current-user row to exist");
+    }
+    expect(within(selfRow).queryByRole("button", { name: "Deactivate" })).not.toBeInTheDocument();
+
+    const otherRow = screen.getByText("bob@example.com").closest('[role="button"]');
+    if (!(otherRow instanceof HTMLElement)) {
+      throw new Error("Expected other-user row to exist");
+    }
+    expect(within(otherRow).getByRole("button", { name: "Deactivate" })).toBeInTheDocument();
+    expect(deactivateUserMock).not.toHaveBeenCalled();
+  });
+});

apps/web/src/app/(authenticated)/settings/users/page.tsx

@@ -0,0 +1,763 @@
+"use client";
+
+import {
+  useCallback,
+  useEffect,
+  useState,
+  type ChangeEvent,
+  type KeyboardEvent,
+  type ReactElement,
+  type SyntheticEvent,
+} from "react";
+import Link from "next/link";
+import { UserPlus, UserX } from "lucide-react";
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { isValidEmail } from "@/components/workspace/validation";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import {
+  deactivateUser,
+  fetchAdminUsers,
+  inviteUser,
+  updateUser,
+  type AdminUser,
+  type AdminUsersResponse,
+  type AdminWorkspaceMembership,
+  type InviteUserDto,
+  type UpdateUserDto,
+} from "@/lib/api/admin";
+import { useAuth } from "@/lib/auth/auth-context";
+import { fetchUserWorkspaces, updateWorkspaceMemberRole } from "@/lib/api/workspaces";
+import { SettingsAccessDenied } from "@/components/settings/SettingsAccessDenied";
+
+const ROLE_PRIORITY: Record<WorkspaceMemberRole, number> = {
+  [WorkspaceMemberRole.OWNER]: 4,
+  [WorkspaceMemberRole.ADMIN]: 3,
+  [WorkspaceMemberRole.MEMBER]: 2,
+  [WorkspaceMemberRole.GUEST]: 1,
+};
+
+const INITIAL_INVITE_FORM = {
+  email: "",
+  role: WorkspaceMemberRole.MEMBER,
+};
+
+const INITIAL_DETAIL_FORM = {
+  name: "",
+  email: "",
+  role: WorkspaceMemberRole.MEMBER,
+  workspaceId: null as string | null,
+  workspaceName: null as string | null,
+};
+const USERS_PAGE_SIZE = 50;
+
+interface DetailInitialState {
+  name: string;
+  email: string;
+  role: WorkspaceMemberRole;
+  workspaceId: string | null;
+}
+
+function toRoleLabel(role: WorkspaceMemberRole): string {
+  return `${role.charAt(0)}${role.slice(1).toLowerCase()}`;
+}
+
+function getPrimaryMembership(user: AdminUser): AdminWorkspaceMembership | null {
+  const [firstMembership, ...restMemberships] = user.workspaceMemberships;
+  if (!firstMembership) {
+    return null;
+  }
+
+  return restMemberships.reduce((highest, membership) => {
+    if (ROLE_PRIORITY[membership.role] > ROLE_PRIORITY[highest.role]) {
+      return membership;
+    }
+    return highest;
+  }, firstMembership);
+}
+
+export default function UsersSettingsPage(): ReactElement {
+  const { user: authUser } = useAuth();
+
+  const [users, setUsers] = useState<AdminUser[]>([]);
+  const [meta, setMeta] = useState<AdminUsersResponse["meta"] | null>(null);
+  const [page, setPage] = useState<number>(1);
+  const [isLoading, setIsLoading] = useState<boolean>(true);
+  const [isRefreshing, setIsRefreshing] = useState<boolean>(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const [defaultWorkspaceId, setDefaultWorkspaceId] = useState<string | null>(null);
+  const [isAdmin, setIsAdmin] = useState<boolean | null>(null);
+
+  const [isInviteOpen, setIsInviteOpen] = useState<boolean>(false);
+  const [inviteForm, setInviteForm] = useState(INITIAL_INVITE_FORM);
+  const [inviteError, setInviteError] = useState<string | null>(null);
+  const [isInviting, setIsInviting] = useState<boolean>(false);
+
+  const [detailTarget, setDetailTarget] = useState<AdminUser | null>(null);
+  const [detailForm, setDetailForm] = useState(INITIAL_DETAIL_FORM);
+  const [detailInitial, setDetailInitial] = useState<DetailInitialState | null>(null);
+  const [detailError, setDetailError] = useState<string | null>(null);
+  const [isSavingDetails, setIsSavingDetails] = useState<boolean>(false);
+
+  const [deactivateTarget, setDeactivateTarget] = useState<AdminUser | null>(null);
+  const [isDeactivating, setIsDeactivating] = useState<boolean>(false);
+
+  const loadUsers = useCallback(
+    async (showLoadingState: boolean): Promise<void> => {
+      try {
+        if (showLoadingState) {
+          setIsLoading(true);
+        } else {
+          setIsRefreshing(true);
+        }
+
+        const response = await fetchAdminUsers(page, USERS_PAGE_SIZE);
+        const lastValidPage = Math.max(1, response.meta.totalPages);
+
+        if (page > lastValidPage) {
+          setPage(lastValidPage);
+          return;
+        }
+
+        setUsers(response.data);
+        setMeta(response.meta);
+        setError(null);
+      } catch (err: unknown) {
+        setError(err instanceof Error ? err.message : "Failed to load admin users");
+      } finally {
+        setIsLoading(false);
+        setIsRefreshing(false);
+      }
+    },
+    [page]
+  );
+
+  useEffect(() => {
+    fetchUserWorkspaces()
+      .then((workspaces) => {
+        const adminRoles: WorkspaceMemberRole[] = [
+          WorkspaceMemberRole.OWNER,
+          WorkspaceMemberRole.ADMIN,
+        ];
+
+        setDefaultWorkspaceId(workspaces[0]?.id ?? null);
+        setIsAdmin(workspaces.some((workspace) => adminRoles.includes(workspace.role)));
+      })
+      .catch(() => {
+        setDefaultWorkspaceId(null);
+        setIsAdmin(true); // fail open
+      });
+  }, []);
+
+  useEffect(() => {
+    if (isAdmin !== true) {
+      return;
+    }
+
+    void loadUsers(true);
+  }, [isAdmin, loadUsers, page]);
+
+  function resetInviteForm(): void {
+    setInviteForm(INITIAL_INVITE_FORM);
+    setInviteError(null);
+  }
+
+  function openUserDetails(user: AdminUser): void {
+    const primaryMembership = getPrimaryMembership(user);
+
+    const nextDetailForm = {
+      name: user.name,
+      email: user.email,
+      role: primaryMembership?.role ?? WorkspaceMemberRole.MEMBER,
+      workspaceId: primaryMembership?.workspaceId ?? null,
+      workspaceName: primaryMembership?.workspaceName ?? null,
+    };
+
+    setDetailTarget(user);
+    setDetailForm(nextDetailForm);
+    setDetailInitial({
+      name: nextDetailForm.name,
+      email: nextDetailForm.email,
+      role: nextDetailForm.role,
+      workspaceId: nextDetailForm.workspaceId,
+    });
+    setDetailError(null);
+  }
+
+  function resetUserDetails(): void {
+    setDetailTarget(null);
+    setDetailForm(INITIAL_DETAIL_FORM);
+    setDetailInitial(null);
+    setDetailError(null);
+  }
+
+  function handleUserRowKeyDown(event: KeyboardEvent<HTMLDivElement>, user: AdminUser): void {
+    if (event.key === "Enter" || event.key === " ") {
+      event.preventDefault();
+      openUserDetails(user);
+    }
+  }
+
+  async function handleInviteSubmit(event: SyntheticEvent): Promise<void> {
+    event.preventDefault();
+    setInviteError(null);
+
+    const email = inviteForm.email.trim();
+    if (!email) {
+      setInviteError("Email is required.");
+      return;
+    }
+
+    if (!isValidEmail(email)) {
+      setInviteError("Please enter a valid email address.");
+      return;
+    }
+
+    const dto: InviteUserDto = {
+      email,
+      role: inviteForm.role,
+    };
+
+    if (defaultWorkspaceId) {
+      dto.workspaceId = defaultWorkspaceId;
+    }
+
+    try {
+      setIsInviting(true);
+      await inviteUser(dto);
+      setIsInviteOpen(false);
+      resetInviteForm();
+      await loadUsers(false);
+    } catch (err: unknown) {
+      setInviteError(err instanceof Error ? err.message : "Failed to invite user");
+    } finally {
+      setIsInviting(false);
+    }
+  }
+
+  async function handleDetailSubmit(event: SyntheticEvent): Promise<void> {
+    event.preventDefault();
+
+    if (detailTarget === null || detailInitial === null) {
+      return;
+    }
+
+    const name = detailForm.name.trim();
+    const email = detailForm.email.trim();
+
+    if (!name) {
+      setDetailError("Name is required.");
+      return;
+    }
+
+    if (!email) {
+      setDetailError("Email is required.");
+      return;
+    }
+
+    if (!isValidEmail(email)) {
+      setDetailError("Please enter a valid email address.");
+      return;
+    }
+
+    const didUpdateUser = name !== detailInitial.name || email !== detailInitial.email;
+    const didUpdateRole =
+      detailForm.workspaceId !== null &&
+      detailForm.workspaceId === detailInitial.workspaceId &&
+      detailForm.role !== detailInitial.role;
+
+    if (!didUpdateUser && !didUpdateRole) {
+      resetUserDetails();
+      return;
+    }
+
+    try {
+      setIsSavingDetails(true);
+      setDetailError(null);
+
+      if (didUpdateUser) {
+        const dto: UpdateUserDto = {};
+
+        if (name !== detailInitial.name) {
+          dto.name = name;
+        }
+
+        if (email !== detailInitial.email) {
+          dto.email = email;
+        }
+
+        await updateUser(detailTarget.id, dto);
+      }
+
+      if (didUpdateRole && detailForm.workspaceId !== null) {
+        await updateWorkspaceMemberRole(detailForm.workspaceId, detailTarget.id, {
+          role: detailForm.role,
+        });
+      }
+
+      resetUserDetails();
+      await loadUsers(false);
+    } catch (err: unknown) {
+      setDetailError(err instanceof Error ? err.message : "Failed to update user");
+    } finally {
+      setIsSavingDetails(false);
+    }
+  }
+
+  async function confirmDeactivate(): Promise<void> {
+    if (!deactivateTarget) {
+      return;
+    }
+
+    if (authUser?.id === deactivateTarget.id) {
+      setDeactivateTarget(null);
+      setError("You cannot deactivate your own account.");
+      return;
+    }
+
+    try {
+      setIsDeactivating(true);
+      await deactivateUser(deactivateTarget.id);
+      setDeactivateTarget(null);
+      await loadUsers(false);
+      setError(null);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to deactivate user");
+    } finally {
+      setIsDeactivating(false);
+    }
+  }
+
+  if (isAdmin === null) {
+    return (
+      <Card className="max-w-2xl mx-auto mt-8">
+        <CardContent className="py-12 text-center text-muted-foreground">
+          Checking permissions...
+        </CardContent>
+      </Card>
+    );
+  }
+
+  if (!isAdmin) {
+    return <SettingsAccessDenied message="You need Admin or Owner role to manage users." />;
+  }
+
+  return (
+    <div className="max-w-6xl mx-auto p-6 space-y-6">
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <div className="flex items-center gap-3">
+            <h1 className="text-3xl font-bold">Users</h1>
+            {meta ? <Badge variant="outline">{meta.total} total</Badge> : null}
+          </div>
+          <p className="text-muted-foreground mt-1">Invite and manage workspace users</p>
+        </div>
+
+        <div className="flex items-center gap-2">
+          <Button
+            variant="outline"
+            onClick={() => {
+              void loadUsers(false);
+            }}
+            disabled={isLoading || isRefreshing}
+          >
+            {isRefreshing ? "Refreshing..." : "Refresh"}
+          </Button>
+
+          <Dialog
+            open={isInviteOpen}
+            onOpenChange={(open) => {
+              if (!open && !isInviting) {
+                resetInviteForm();
+              }
+              setIsInviteOpen(open);
+            }}
+          >
+            <DialogTrigger asChild>
+              <Button>
+                <UserPlus className="h-4 w-4 mr-2" />
+                Invite User
+              </Button>
+            </DialogTrigger>
+            <DialogContent>
+              <DialogHeader>
+                <DialogTitle>Invite User</DialogTitle>
+                <DialogDescription>
+                  Invite a new user and assign their role for your default workspace.
+                </DialogDescription>
+              </DialogHeader>
+
+              <form
+                onSubmit={(event) => {
+                  void handleInviteSubmit(event);
+                }}
+                className="space-y-4"
+              >
+                <div className="space-y-2">
+                  <Label htmlFor="invite-email">Email</Label>
+                  <Input
+                    id="invite-email"
+                    type="email"
+                    value={inviteForm.email}
+                    onChange={(event: ChangeEvent<HTMLInputElement>) => {
+                      setInviteForm((prev) => ({ ...prev, email: event.target.value }));
+                    }}
+                    placeholder="user@example.com"
+                    maxLength={255}
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="invite-role">Role</Label>
+                  <Select
+                    value={inviteForm.role}
+                    onValueChange={(value) => {
+                      setInviteForm((prev) => ({ ...prev, role: value as WorkspaceMemberRole }));
+                    }}
+                  >
+                    <SelectTrigger id="invite-role">
+                      <SelectValue placeholder="Select role" />
+                    </SelectTrigger>
+                    <SelectContent>
+                      {Object.values(WorkspaceMemberRole).map((role) => (
+                        <SelectItem key={role} value={role}>
+                          {toRoleLabel(role)}
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                  {defaultWorkspaceId ? (
+                    <p className="text-xs text-muted-foreground">Role will be applied on invite.</p>
+                  ) : (
+                    <p className="text-xs text-muted-foreground">
+                      No default workspace found. User will be invited without workspace assignment.
+                    </p>
+                  )}
+                </div>
+
+                {inviteError ? (
+                  <p className="text-sm text-destructive" role="alert">
+                    {inviteError}
+                  </p>
+                ) : null}
+
+                <DialogFooter>
+                  <Button
+                    type="button"
+                    variant="outline"
+                    onClick={() => {
+                      if (!isInviting) {
+                        setIsInviteOpen(false);
+                        resetInviteForm();
+                      }
+                    }}
+                    disabled={isInviting}
+                  >
+                    Cancel
+                  </Button>
+                  <Button type="submit" disabled={isInviting}>
+                    {isInviting ? "Inviting..." : "Send Invite"}
+                  </Button>
+                </DialogFooter>
+              </form>
+            </DialogContent>
+          </Dialog>
+        </div>
+      </div>
+
+      <div>
+        <Link href="/settings" className="text-sm text-blue-600 hover:text-blue-700">
+          ← Back to Settings
+        </Link>
+      </div>
+
+      {isLoading ? (
+        <Card>
+          <CardContent className="py-12 text-center text-muted-foreground">
+            Loading users...
+          </CardContent>
+        </Card>
+      ) : error ? (
+        <Card>
+          <CardContent className="py-4">
+            <p className="text-sm text-destructive" role="alert">
+              {error}
+            </p>
+          </CardContent>
+        </Card>
+      ) : users.length === 0 ? (
+        <Card>
+          <CardHeader>
+            <CardTitle>No Users Yet</CardTitle>
+            <CardDescription>Invite the first user to get started.</CardDescription>
+          </CardHeader>
+        </Card>
+      ) : (
+        <Card>
+          <CardHeader>
+            <CardTitle>User Directory</CardTitle>
+            <CardDescription>Click a user to view details or edit profile fields.</CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            {users.map((user) => {
+              const primaryMembership = getPrimaryMembership(user);
+              const isActive = user.deactivatedAt === null;
+              const isCurrentUser = authUser?.id === user.id;
+
+              return (
+                <div
+                  key={user.id}
+                  className="rounded-md border p-4 flex flex-col gap-3 md:flex-row md:items-center md:justify-between cursor-pointer hover:bg-muted/30"
+                  role="button"
+                  tabIndex={0}
+                  onClick={() => {
+                    openUserDetails(user);
+                  }}
+                  onKeyDown={(event) => {
+                    handleUserRowKeyDown(event, user);
+                  }}
+                >
+                  <div className="space-y-1 min-w-0">
+                    <p className="font-semibold truncate">
+                      {user.name || "Unnamed User"}
+                      {isCurrentUser ? (
+                        <span className="ml-2 text-xs font-normal text-muted-foreground">
+                          (You)
+                        </span>
+                      ) : null}
+                    </p>
+                    <p className="text-sm text-muted-foreground truncate">{user.email}</p>
+                  </div>
+
+                  <div className="flex items-center gap-2 flex-wrap md:justify-end">
+                    <Badge variant="outline">
+                      {primaryMembership ? toRoleLabel(primaryMembership.role) : "No role"}
+                    </Badge>
+                    <Badge variant={isActive ? "secondary" : "destructive"}>
+                      {isActive ? "Active" : "Inactive"}
+                    </Badge>
+                    {isActive && !isCurrentUser ? (
+                      <Button
+                        variant="destructive"
+                        size="sm"
+                        onClick={(event) => {
+                          event.stopPropagation();
+                          setDeactivateTarget(user);
+                        }}
+                      >
+                        <UserX className="h-4 w-4 mr-2" />
+                        Deactivate
+                      </Button>
+                    ) : null}
+                  </div>
+                </div>
+              );
+            })}
+
+            {meta && meta.totalPages > 1 ? (
+              <div className="flex items-center justify-between pt-3 mt-1 border-t">
+                <p className="text-sm text-muted-foreground">
+                  Page {page} of {meta.totalPages}
+                </p>
+                <div className="flex gap-2">
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    disabled={page === 1}
+                    onClick={() => {
+                      setPage((previousPage) => Math.max(1, previousPage - 1));
+                    }}
+                  >
+                    Previous
+                  </Button>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    disabled={page >= meta.totalPages}
+                    onClick={() => {
+                      setPage((previousPage) => Math.min(meta.totalPages, previousPage + 1));
+                    }}
+                  >
+                    Next
+                  </Button>
+                </div>
+              </div>
+            ) : null}
+          </CardContent>
+        </Card>
+      )}
+
+      <Dialog
+        open={detailTarget !== null}
+        onOpenChange={(open) => {
+          if (!open && !isSavingDetails) {
+            resetUserDetails();
+          }
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>User Details</DialogTitle>
+            <DialogDescription>
+              Edit profile details for {detailTarget?.email ?? "selected user"}.
+            </DialogDescription>
+          </DialogHeader>
+
+          <form
+            onSubmit={(event) => {
+              void handleDetailSubmit(event);
+            }}
+            className="space-y-4"
+          >
+            <div className="space-y-2">
+              <Label htmlFor="detail-name">Name</Label>
+              <Input
+                id="detail-name"
+                value={detailForm.name}
+                onChange={(event: ChangeEvent<HTMLInputElement>) => {
+                  setDetailForm((prev) => ({ ...prev, name: event.target.value }));
+                }}
+                placeholder="Full name"
+                maxLength={255}
+                disabled={isSavingDetails}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="detail-email">Email</Label>
+              <Input
+                id="detail-email"
+                type="email"
+                value={detailForm.email}
+                onChange={(event: ChangeEvent<HTMLInputElement>) => {
+                  setDetailForm((prev) => ({ ...prev, email: event.target.value }));
+                }}
+                placeholder="user@example.com"
+                maxLength={255}
+                disabled={isSavingDetails}
+                required
+              />
+            </div>
+
+            <div className="space-y-2">
+              <Label htmlFor="detail-role">Role</Label>
+              <Select
+                value={detailForm.role}
+                disabled={detailForm.workspaceId === null || isSavingDetails}
+                onValueChange={(value) => {
+                  setDetailForm((prev) => ({ ...prev, role: value as WorkspaceMemberRole }));
+                }}
+              >
+                <SelectTrigger id="detail-role">
+                  <SelectValue placeholder="Select role" />
+                </SelectTrigger>
+                <SelectContent>
+                  {Object.values(WorkspaceMemberRole).map((role) => (
+                    <SelectItem key={role} value={role}>
+                      {toRoleLabel(role)}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+              {detailForm.workspaceName ? (
+                <p className="text-xs text-muted-foreground">
+                  Role updates apply to: {detailForm.workspaceName}
+                </p>
+              ) : (
+                <p className="text-xs text-muted-foreground">
+                  This user has no workspace membership. Role cannot be updated.
+                </p>
+              )}
+            </div>
+
+            {detailError !== null ? (
+              <p className="text-sm text-destructive" role="alert">
+                {detailError}
+              </p>
+            ) : null}
+
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() => {
+                  if (!isSavingDetails) {
+                    resetUserDetails();
+                  }
+                }}
+                disabled={isSavingDetails}
+              >
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isSavingDetails}>
+                {isSavingDetails ? "Saving..." : "Save Changes"}
+              </Button>
+            </DialogFooter>
+          </form>
+        </DialogContent>
+      </Dialog>
+
+      <AlertDialog
+        open={deactivateTarget !== null}
+        onOpenChange={(open) => {
+          if (!open && !isDeactivating) {
+            setDeactivateTarget(null);
+          }
+        }}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Deactivate User</AlertDialogTitle>
+            <AlertDialogDescription>
+              Deactivate {deactivateTarget?.email}? They will no longer be able to access the
+              system.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isDeactivating}>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              disabled={isDeactivating}
+              onClick={() => {
+                void confirmDeactivate();
+              }}
+            >
+              {isDeactivating ? "Deactivating..." : "Deactivate"}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  );
+}

apps/web/src/app/(authenticated)/settings/workspaces/[id]/page.test.tsx

@@ -0,0 +1,64 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import WorkspaceDetailPage from "./page";
+import * as workspacesApi from "@/lib/api/workspaces";
+
+vi.mock("next/navigation", () => ({
+  useParams: (): { id: string } => ({ id: "ws-test-1" }),
+}));
+
+vi.mock("@/lib/auth/auth-context", () => ({
+  useAuth: (): { user: { id: string } } => ({ user: { id: "u1" } }),
+}));
+
+vi.mock("@/lib/api/workspaces");
+
+vi.mock("@/components/workspace/MemberList", () => ({
+  MemberList: ({ members }: { members: unknown[] }): React.ReactElement => (
+    <div data-testid="member-list">Members: {members.length}</div>
+  ),
+}));
+
+const mockWorkspace = {
+  id: "ws-test-1",
+  name: "Test Workspace",
+  ownerId: "u1",
+  role: "OWNER",
+  createdAt: "2024-01-01",
+};
+
+const mockMembers = [
+  {
+    workspaceId: "ws-test-1",
+    userId: "u1",
+    role: "OWNER",
+    joinedAt: "2024-01-01",
+    user: { id: "u1", email: "a@b.com", name: "Alice", image: null },
+  },
+];
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("WorkspaceDetailPage", () => {
+  it("loads and renders member list", async (): Promise<void> => {
+    vi.mocked(workspacesApi.fetchUserWorkspaces).mockResolvedValue([mockWorkspace] as never);
+    vi.mocked(workspacesApi.fetchWorkspaceMembers).mockResolvedValue(mockMembers as never);
+    render(<WorkspaceDetailPage />);
+    await waitFor(() => {
+      expect(screen.getByTestId("member-list")).toBeInTheDocument();
+    });
+    expect(screen.getByText("Test Workspace")).toBeInTheDocument();
+  });
+
+  it("shows error state on fetch failure, not member list", async (): Promise<void> => {
+    vi.mocked(workspacesApi.fetchUserWorkspaces).mockRejectedValue(new Error("Network error"));
+    vi.mocked(workspacesApi.fetchWorkspaceMembers).mockRejectedValue(new Error("Network error"));
+    render(<WorkspaceDetailPage />);
+    await waitFor(() => {
+      expect(screen.getByRole("alert")).toBeInTheDocument();
+    });
+    expect(screen.queryByTestId("member-list")).not.toBeInTheDocument();
+  });
+});

apps/web/src/app/(authenticated)/settings/workspaces/[id]/page.tsx

@@ -1,196 +1,148 @@
 "use client";
 
-import { useState } from "react";
+import { useCallback, useEffect, useState } from "react";
-import { useRouter } from "next/navigation";
+import { useParams } from "next/navigation";
-import { WorkspaceSettings } from "@/components/workspace/WorkspaceSettings";
-import { MemberList } from "@/components/workspace/MemberList";
-import { InviteMember } from "@/components/workspace/InviteMember";
-import { WorkspaceMemberRole } from "@mosaic/shared";
-import type { Workspace, WorkspaceMemberWithUser } from "@mosaic/shared";
 import Link from "next/link";
+import { MemberList } from "@/components/workspace/MemberList";
+import { useAuth } from "@/lib/auth/auth-context";
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import {
+  fetchWorkspaceMembers,
+  fetchUserWorkspaces,
+  updateWorkspaceMemberRole,
+  removeWorkspaceMember,
+  type WorkspaceMemberEntry,
+  type UserWorkspace,
+} from "@/lib/api/workspaces";
+import type { WorkspaceMemberWithUser } from "@/components/workspace/MemberList";
 
-interface WorkspaceDetailPageProps {
+function getErrorMessage(error: unknown, fallback: string): string {
-  params: {
+  if (error instanceof Error) return error.message;
-    id: string;
+  return fallback;
+}
+
+function toMemberWithUser(m: WorkspaceMemberEntry): WorkspaceMemberWithUser {
+  return {
+    workspaceId: m.workspaceId,
+    userId: m.userId,
+    role: m.role,
+    joinedAt: new Date(m.joinedAt),
+    user: {
+      id: m.user.id,
+      email: m.user.email,
+      name: m.user.name ?? "",
+      image: m.user.image,
+      emailVerified: true,
+      authProviderId: null,
+      preferences: {},
+      deactivatedAt: null,
+      isLocalAuth: false,
+      passwordHash: null,
+      invitedBy: null,
+      invitationToken: null,
+      invitedAt: null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    },
   };
 }
 
-// Mock data - TODO: Replace with real API calls
+export default function WorkspaceDetailPage(): React.ReactElement {
-const mockWorkspace: Workspace = {
+  const params = useParams<{ id: string }>();
-  id: "ws-1",
+  const workspaceId = params.id;
-  name: "Personal Workspace",
+  const { user: authUser } = useAuth();
-  ownerId: "user-1",
-  settings: {},
-  createdAt: new Date("2024-01-15"),
-  updatedAt: new Date("2024-01-15"),
-};
 
-const mockMembers: WorkspaceMemberWithUser[] = [
+  const [workspace, setWorkspace] = useState<UserWorkspace | null>(null);
-  {
+  const [members, setMembers] = useState<WorkspaceMemberEntry[]>([]);
-    workspaceId: "ws-1",
+  const [isLoading, setIsLoading] = useState(true);
-    userId: "user-1",
+  const [error, setError] = useState<string | null>(null);
-    role: WorkspaceMemberRole.OWNER,
+
-    joinedAt: new Date("2024-01-15"),
+  const load = useCallback(async (): Promise<void> => {
-    user: {
+    setIsLoading(true);
-      id: "user-1",
+    setError(null);
-      email: "owner@example.com",
+    try {
-      name: "John Doe",
+      const [workspaces, memberList] = await Promise.all([
-      emailVerified: true,
+        fetchUserWorkspaces(),
-      image: null,
+        fetchWorkspaceMembers(workspaceId),
-      authProviderId: null,
+      ]);
-      preferences: {},
+      const ws = workspaces.find((w) => w.id === workspaceId) ?? null;
-      deactivatedAt: null,
+      setWorkspace(ws);
-      isLocalAuth: false,
+      setMembers(memberList);
-      passwordHash: null,
+    } catch (err) {
-      invitedBy: null,
+      setError(getErrorMessage(err, "Failed to load workspace"));
-      invitationToken: null,
+    } finally {
-      invitedAt: null,
+      setIsLoading(false);
-      createdAt: new Date("2024-01-15"),
+    }
-      updatedAt: new Date("2024-01-15"),
+  }, [workspaceId]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const handleRoleChange = useCallback(
+    async (userId: string, newRole: WorkspaceMemberRole): Promise<void> => {
+      await updateWorkspaceMemberRole(workspaceId, userId, { role: newRole });
+      await load();
     },
-  },
+    [workspaceId, load]
-  {
+  );
-    workspaceId: "ws-1",
+
-    userId: "user-2",
+  const handleRemove = useCallback(
-    role: WorkspaceMemberRole.ADMIN,
+    async (userId: string): Promise<void> => {
-    joinedAt: new Date("2024-01-16"),
+      await removeWorkspaceMember(workspaceId, userId);
-    user: {
+      await load();
-      id: "user-2",
-      email: "admin@example.com",
-      name: "Jane Smith",
-      emailVerified: true,
-      image: null,
-      authProviderId: null,
-      preferences: {},
-      deactivatedAt: null,
-      isLocalAuth: false,
-      passwordHash: null,
-      invitedBy: null,
-      invitationToken: null,
-      invitedAt: null,
-      createdAt: new Date("2024-01-16"),
-      updatedAt: new Date("2024-01-16"),
     },
-  },
+    [workspaceId, load]
-  {
+  );
-    workspaceId: "ws-1",
-    userId: "user-3",
-    role: WorkspaceMemberRole.MEMBER,
-    joinedAt: new Date("2024-01-17"),
-    user: {
-      id: "user-3",
-      email: "member@example.com",
-      name: "Bob Johnson",
-      emailVerified: true,
-      image: null,
-      authProviderId: null,
-      preferences: {},
-      deactivatedAt: null,
-      isLocalAuth: false,
-      passwordHash: null,
-      invitedBy: null,
-      invitationToken: null,
-      invitedAt: null,
-      createdAt: new Date("2024-01-17"),
-      updatedAt: new Date("2024-01-17"),
-    },
-  },
-];
 
-export default function WorkspaceDetailPage({
+  if (isLoading) {
-  params,
+    return (
-}: WorkspaceDetailPageProps): React.JSX.Element {
+      <div className="p-8 text-center text-gray-500" role="status" aria-label="Loading workspace">
-  const router = useRouter();
+        Loading workspace…
-  const [workspace, setWorkspace] = useState<Workspace>(mockWorkspace);
+      </div>
-  const [members, setMembers] = useState<WorkspaceMemberWithUser[]>(mockMembers);
-  const currentUserId = "user-1"; // TODO: Get from auth context
-  const currentUserRole: WorkspaceMemberRole = WorkspaceMemberRole.OWNER; // TODO: Get from API
-
-  // TODO: Replace with actual role check when API is implemented
-  // Currently hardcoded to OWNER in mock data (line 89)
-  const canInvite =
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-    currentUserRole === WorkspaceMemberRole.OWNER || currentUserRole === WorkspaceMemberRole.ADMIN;
-
-  const handleUpdateWorkspace = async (name: string): Promise<void> => {
-    // TODO: Replace with real API call
-    console.log("Updating workspace:", { id: params.id, name });
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    setWorkspace({ ...workspace, name, updatedAt: new Date() });
-  };
-
-  const handleDeleteWorkspace = async (): Promise<void> => {
-    // TODO: Replace with real API call
-    console.log("Deleting workspace:", params.id);
-    await new Promise((resolve) => setTimeout(resolve, 1000));
-    router.push("/settings/workspaces");
-  };
-
-  const handleRoleChange = async (userId: string, newRole: WorkspaceMemberRole): Promise<void> => {
-    // TODO: Replace with real API call
-    console.log("Changing role:", { userId, newRole });
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    setMembers(
-      members.map((member) => (member.userId === userId ? { ...member, role: newRole } : member))
     );
-  };
+  }
 
-  const handleRemoveMember = async (userId: string): Promise<void> => {
+  if (error) {
-    // TODO: Replace with real API call
+    return (
-    console.log("Removing member:", userId);
+      <div className="p-8">
-    await new Promise((resolve) => setTimeout(resolve, 500));
+        <div className="rounded-lg border border-red-200 bg-red-50 p-4 text-red-700" role="alert">
-    setMembers(members.filter((member) => member.userId !== userId));
+          <p className="font-medium">Failed to load workspace</p>
-  };
+          <p className="mt-1 text-sm">Please try again later.</p>
+        </div>
+        <Link
+          href="/settings/workspaces"
+          className="mt-4 inline-block text-sm text-blue-600 hover:underline"
+        >
+          ← Back to Workspaces
+        </Link>
+      </div>
+    );
+  }
 
-  const handleInviteMember = async (email: string, role: WorkspaceMemberRole): Promise<void> => {
+  const currentUserId = authUser?.id ?? "";
-    // TODO: Replace with real API call
+  const currentMember = members.find((m) => m.userId === currentUserId);
-    console.log("Inviting member:", { email, role, workspaceId: params.id });
+  const currentUserRole = currentMember?.role ?? workspace?.role ?? WorkspaceMemberRole.MEMBER;
-    await new Promise((resolve) => setTimeout(resolve, 1000));
+  const ownerId =
-    // In real implementation, this would send an invitation email
+    members.find((m) => m.role === WorkspaceMemberRole.OWNER)?.userId ?? workspace?.ownerId ?? "";
-  };
 
   return (
-    <main className="container mx-auto px-4 py-8 max-w-5xl">
+    <div className="p-8 max-w-3xl">
-      <div className="mb-8">
+      <div className="mb-6">
-        <div className="flex items-center justify-between mb-2">
+        <Link href="/settings/workspaces" className="text-sm text-gray-500 hover:text-gray-700">
-          <h1 className="text-3xl font-bold text-gray-900">{workspace.name}</h1>
+          ← Back to Workspaces
-          <Link href="/settings/workspaces" className="text-sm text-blue-600 hover:text-blue-700">
+        </Link>
-            ← Back to Workspaces
+        <h1 className="mt-2 text-2xl font-bold text-gray-900">{workspace?.name ?? "Workspace"}</h1>
-          </Link>
-        </div>
-        <p className="text-gray-600">Manage workspace settings and team members</p>
       </div>
 
-      <div className="space-y-6">
+      <MemberList
-        {/* Workspace Settings */}
+        members={members.map(toMemberWithUser)}
-        <WorkspaceSettings
+        currentUserId={currentUserId}
-          workspace={workspace}
+        currentUserRole={currentUserRole}
-          userRole={currentUserRole}
+        workspaceOwnerId={ownerId}
-          onUpdate={handleUpdateWorkspace}
+        onRoleChange={handleRoleChange}
-          onDelete={handleDeleteWorkspace}
+        onRemove={handleRemove}
-        />
+      />
-
+    </div>
-        {/* Members Section */}
-        <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
-          <div className="lg:col-span-2">
-            <MemberList
-              members={members}
-              currentUserId={currentUserId}
-              currentUserRole={currentUserRole}
-              workspaceOwnerId={workspace.ownerId}
-              onRoleChange={handleRoleChange}
-              onRemove={handleRemoveMember}
-            />
-          </div>
-
-          {/* Invite Member */}
-          {canInvite && (
-            <div className="lg:col-span-2">
-              <InviteMember onInvite={handleInviteMember} />
-            </div>
-          )}
-        </div>
-      </div>
-    </main>
   );
 }

apps/web/src/app/(authenticated)/settings/workspaces/page.test.tsx

@@ -1,60 +1,159 @@
-/**
+import type { UserWorkspace, WorkspaceMemberEntry } from "@/lib/api/workspaces";
- * Workspaces Page Tests
+import type { ReactElement, ReactNode } from "react";
- * Tests for page structure and component integration
- */
 
-import { describe, it, expect, vi } from "vitest";
+import { WorkspaceMemberRole } from "@mosaic/shared";
-import { render, screen } from "@testing-library/react";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { createWorkspace, fetchUserWorkspaces, fetchWorkspaceMembers } from "@/lib/api/workspaces";
+import WorkspacesPage from "./page";
 
-// Mock next/link
 vi.mock("next/link", () => ({
-  default: ({ children, href }: { children: React.ReactNode; href: string }): React.JSX.Element => (
+  default: function LinkMock({
-    <a href={href}>{children}</a>
+    children,
-  ),
+    href,
+  }: {
+    children: ReactNode;
+    href: string;
+  }): ReactElement {
+    return <a href={href}>{children}</a>;
+  },
 }));
 
-// Mock the WorkspaceCard component
+vi.mock("@/lib/api/workspaces", () => ({
-vi.mock("@/components/workspace/WorkspaceCard", () => ({
+  fetchUserWorkspaces: vi.fn(),
-  WorkspaceCard: (): React.JSX.Element => <div data-testid="workspace-card">WorkspaceCard</div>,
+  createWorkspace: vi.fn(),
+  fetchWorkspaceMembers: vi.fn(),
+  addWorkspaceMember: vi.fn(),
+  removeWorkspaceMember: vi.fn(),
 }));
 
-describe("WorkspacesPage", (): void => {
+vi.mock("@/lib/api/admin", () => ({
-  // Note: NODE_ENV is "test" during test runs, which triggers the Coming Soon view
+  fetchAdminUsers: vi.fn(),
-  // This tests the production-like behavior where mock data is hidden
+}));
 
-  it("should render the Coming Soon view in non-development environments", async (): Promise<void> => {
+const fetchUserWorkspacesMock = vi.mocked(fetchUserWorkspaces);
-    const { default: WorkspacesPage } = await import("./page");
+const createWorkspaceMock = vi.mocked(createWorkspace);
-    render(<WorkspacesPage />);
+const fetchWorkspaceMembersMock = vi.mocked(fetchWorkspaceMembers);
 
-    // In test mode (non-development), should show Coming Soon
+const workspaceA: UserWorkspace = {
-    expect(screen.getByText("Coming Soon")).toBeInTheDocument();
+  id: "workspace-1",
-    expect(screen.getByText("Workspace Management")).toBeInTheDocument();
+  name: "Personal Workspace",
+  ownerId: "owner-1",
+  role: WorkspaceMemberRole.OWNER,
+  createdAt: "2026-01-01T00:00:00.000Z",
+};
+
+const workspaceB: UserWorkspace = {
+  id: "workspace-2",
+  name: "Client Workspace",
+  ownerId: "owner-2",
+  role: WorkspaceMemberRole.ADMIN,
+  createdAt: "2026-01-02T00:00:00.000Z",
+};
+
+const membersA: WorkspaceMemberEntry[] = [
+  {
+    workspaceId: "workspace-1",
+    userId: "user-a",
+    role: WorkspaceMemberRole.OWNER,
+    joinedAt: "2026-01-03T00:00:00.000Z",
+    user: {
+      id: "user-a",
+      email: "alice@example.com",
+      name: "Alice",
+      image: null,
+    },
+  },
+];
+
+const membersB: WorkspaceMemberEntry[] = [
+  {
+    workspaceId: "workspace-2",
+    userId: "user-b",
+    role: WorkspaceMemberRole.MEMBER,
+    joinedAt: "2026-01-04T00:00:00.000Z",
+    user: {
+      id: "user-b",
+      email: "bob@example.com",
+      name: "Bob",
+      image: null,
+    },
+  },
+];
+
+describe("WorkspacesPage", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
   });
 
-  it("should display appropriate description for workspace feature", async (): Promise<void> => {
+  it("loads workspaces and fetches members for the first workspace", async () => {
-    const { default: WorkspacesPage } = await import("./page");
+    fetchUserWorkspacesMock.mockResolvedValue([workspaceA, workspaceB]);
+    fetchWorkspaceMembersMock.mockResolvedValue(membersA);
+
     render(<WorkspacesPage />);
 
-    expect(
+    expect(await screen.findByText("Your Workspaces (2)")).toBeInTheDocument();
-      screen.getByText(/create and manage workspaces to organize your projects/i)
+    expect(await screen.findByText("Personal Workspace Members")).toBeInTheDocument();
-    ).toBeInTheDocument();
+
+    await waitFor(() => {
+      expect(fetchWorkspaceMembersMock).toHaveBeenCalledWith("workspace-1");
+    });
+
+    expect(screen.getByText("alice@example.com")).toBeInTheDocument();
   });
 
-  it("should not render mock workspace data in Coming Soon view", async (): Promise<void> => {
+  it("switches selected workspace and reloads member list", async () => {
-    const { default: WorkspacesPage } = await import("./page");
+    fetchUserWorkspacesMock.mockResolvedValue([workspaceA, workspaceB]);
+    fetchWorkspaceMembersMock.mockResolvedValueOnce(membersA).mockResolvedValueOnce(membersB);
+
+    const user = userEvent.setup();
     render(<WorkspacesPage />);
 
-    // Should not show workspace cards or create form in non-development mode
+    expect(await screen.findByText("Personal Workspace Members")).toBeInTheDocument();
-    expect(screen.queryByTestId("workspace-card")).not.toBeInTheDocument();
+
-    expect(screen.queryByText("Create New Workspace")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: /client workspace/i }));
+
+    await waitFor(() => {
+      expect(fetchWorkspaceMembersMock).toHaveBeenLastCalledWith("workspace-2");
+    });
+
+    expect(await screen.findByText("Client Workspace Members")).toBeInTheDocument();
+    expect(screen.getByText("bob@example.com")).toBeInTheDocument();
   });
 
-  it("should include link back to settings", async (): Promise<void> => {
+  it("creates a workspace and refreshes the list", async () => {
-    const { default: WorkspacesPage } = await import("./page");
+    fetchUserWorkspacesMock
+      .mockResolvedValueOnce([workspaceA])
+      .mockResolvedValueOnce([workspaceA, workspaceB]);
+    fetchWorkspaceMembersMock.mockResolvedValue(membersA);
+    createWorkspaceMock.mockResolvedValue({
+      id: "workspace-2",
+      name: "Client Workspace",
+      ownerId: "owner-2",
+      settings: {},
+      createdAt: "2026-01-02T00:00:00.000Z",
+      updatedAt: "2026-01-02T00:00:00.000Z",
+      memberCount: 1,
+    });
+
+    const user = userEvent.setup();
     render(<WorkspacesPage />);
 
-    const link = screen.getByRole("link", { name: /back to settings/i });
+    expect(await screen.findByText("Your Workspaces (1)")).toBeInTheDocument();
-    expect(link).toBeInTheDocument();
+
-    expect(link).toHaveAttribute("href", "/settings");
+    await user.type(screen.getByPlaceholderText("Enter workspace name..."), "Client Workspace");
+    await user.click(screen.getByRole("button", { name: "Create Workspace" }));
+
+    await waitFor(() => {
+      expect(createWorkspaceMock).toHaveBeenCalledWith({ name: "Client Workspace" });
+    });
+
+    await waitFor(() => {
+      expect(fetchUserWorkspacesMock).toHaveBeenCalledTimes(2);
+    });
+
+    expect(await screen.findByText("Your Workspaces (2)")).toBeInTheDocument();
   });
 });

apps/web/src/app/(authenticated)/settings/workspaces/page.tsx

@@ -1,172 +1,569 @@
 "use client";
 
-import type { ReactElement } from "react";
+import type { ReactElement, SyntheticEvent } from "react";
 
-import { useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
-import { WorkspaceCard } from "@/components/workspace/WorkspaceCard";
-import { ComingSoon } from "@/components/ui/ComingSoon";
-import { WorkspaceMemberRole } from "@mosaic/shared";
 import Link from "next/link";
+import { UserPlus, UserX } from "lucide-react";
+import { WorkspaceMemberRole } from "@mosaic/shared";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from "@/components/ui/dialog";
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import {
+  addWorkspaceMember,
+  createWorkspace,
+  fetchUserWorkspaces,
+  fetchWorkspaceMembers,
+  removeWorkspaceMember,
+  type UserWorkspace,
+  type WorkspaceMemberEntry,
+} from "@/lib/api/workspaces";
+import { fetchAdminUsers, type AdminUser } from "@/lib/api/admin";
 
-// Check if we're in development mode
+function getErrorMessage(error: unknown, fallback: string): string {
-const isDevelopment = process.env.NODE_ENV === "development";
+  if (error instanceof Error) {
+    return error.message;
+  }
 
-// Mock data - TODO: Replace with real API calls (development only)
+  return fallback;
-const mockWorkspaces = [
+}
-  {
-    id: "ws-1",
-    name: "Personal Workspace",
-    ownerId: "user-1",
-    settings: {},
-    createdAt: new Date("2024-01-15"),
-    updatedAt: new Date("2024-01-15"),
-  },
-  {
-    id: "ws-2",
-    name: "Team Alpha",
-    ownerId: "user-2",
-    settings: {},
-    createdAt: new Date("2024-01-20"),
-    updatedAt: new Date("2024-01-20"),
-  },
-];
 
-const mockMemberships = [
+function toRoleLabel(role: WorkspaceMemberRole): string {
-  { workspaceId: "ws-1", role: WorkspaceMemberRole.OWNER, memberCount: 1 },
+  return `${role.charAt(0)}${role.slice(1).toLowerCase()}`;
-  { workspaceId: "ws-2", role: WorkspaceMemberRole.MEMBER, memberCount: 5 },
+}
-];
+
+interface RemoveMemberTarget {
+  userId: string;
+  email: string;
+}
+
+const ROLE_BADGE_CLASS: Record<WorkspaceMemberRole, string> = {
+  [WorkspaceMemberRole.OWNER]: "border-purple-200 bg-purple-50 text-purple-700",
+  [WorkspaceMemberRole.ADMIN]: "border-blue-200 bg-blue-50 text-blue-700",
+  [WorkspaceMemberRole.MEMBER]: "border-green-200 bg-green-50 text-green-700",
+  [WorkspaceMemberRole.GUEST]: "border-gray-200 bg-gray-50 text-gray-700",
+};
+
+export default function WorkspacesPage(): ReactElement {
+  const [workspaces, setWorkspaces] = useState<UserWorkspace[]>([]);
+  const [selectedWorkspaceId, setSelectedWorkspaceId] = useState<string | null>(null);
+
+  const [isLoading, setIsLoading] = useState(true);
+  const [loadError, setLoadError] = useState<string | null>(null);
 
-/**
- * Workspaces Page Content - Development Only
- * Shows mock workspace data for development purposes
- */
-function WorkspacesPageContent(): ReactElement {
   const [isCreating, setIsCreating] = useState(false);
   const [newWorkspaceName, setNewWorkspaceName] = useState("");
+  const [createError, setCreateError] = useState<string | null>(null);
 
-  // TODO: Replace with real API call
+  const [members, setMembers] = useState<WorkspaceMemberEntry[]>([]);
-  const workspacesWithRoles = mockWorkspaces.map((workspace) => {
+  const [isMembersLoading, setIsMembersLoading] = useState(false);
-    const membership = mockMemberships.find((m) => m.workspaceId === workspace.id);
+  const [membersError, setMembersError] = useState<string | null>(null);
-    return {
-      ...workspace,
-      userRole: membership?.role ?? WorkspaceMemberRole.GUEST,
-      memberCount: membership?.memberCount ?? 0,
-    };
-  });
 
-  const handleCreateWorkspace = async (e: React.SyntheticEvent<HTMLFormElement>): Promise<void> => {
+  const [isAddMemberOpen, setIsAddMemberOpen] = useState(false);
-    e.preventDefault();
+  const [isAddingMember, setIsAddingMember] = useState(false);
-    if (!newWorkspaceName.trim()) return;
+  const [addMemberError, setAddMemberError] = useState<string | null>(null);
+  const [memberUserId, setMemberUserId] = useState<string>("");
+  const [memberRole, setMemberRole] = useState<WorkspaceMemberRole>(WorkspaceMemberRole.MEMBER);
+  const [availableUsers, setAvailableUsers] = useState<AdminUser[]>([]);
+  const [isLoadingUsers, setIsLoadingUsers] = useState(false);
+
+  const [removeTarget, setRemoveTarget] = useState<RemoveMemberTarget | null>(null);
+  const [isRemovingMember, setIsRemovingMember] = useState(false);
+
+  const selectedWorkspace = useMemo(
+    () => workspaces.find((workspace) => workspace.id === selectedWorkspaceId) ?? null,
+    [selectedWorkspaceId, workspaces]
+  );
+
+  const loadWorkspaces = useCallback(async (): Promise<void> => {
+    setIsLoading(true);
+
+    try {
+      const data = await fetchUserWorkspaces();
+      setWorkspaces(data);
+      setLoadError(null);
+      setSelectedWorkspaceId((current) => {
+        if (current && data.some((workspace) => workspace.id === current)) {
+          return current;
+        }
+
+        return data[0]?.id ?? null;
+      });
+    } catch (error) {
+      setLoadError(getErrorMessage(error, "Failed to load workspaces"));
+      setSelectedWorkspaceId(null);
+    } finally {
+      setIsLoading(false);
+    }
+  }, []);
+
+  const loadMembers = useCallback(async (workspaceId: string): Promise<void> => {
+    setIsMembersLoading(true);
+    setMembersError(null);
+
+    try {
+      const data = await fetchWorkspaceMembers(workspaceId);
+      setMembers(data);
+    } catch (error) {
+      setMembersError(getErrorMessage(error, "Failed to load workspace members"));
+      setMembers([]);
+    } finally {
+      setIsMembersLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void loadWorkspaces();
+  }, [loadWorkspaces]);
+
+  useEffect(() => {
+    if (!selectedWorkspaceId) {
+      setMembers([]);
+      setMembersError(null);
+      return;
+    }
+
+    void loadMembers(selectedWorkspaceId);
+  }, [loadMembers, selectedWorkspaceId]);
+
+  const handleCreateWorkspace = async (event: SyntheticEvent<HTMLFormElement>): Promise<void> => {
+    event.preventDefault();
+
+    const workspaceName = newWorkspaceName.trim();
+    if (!workspaceName) {
+      return;
+    }
 
     setIsCreating(true);
+    setCreateError(null);
+
     try {
-      // TODO: Replace with real API call
+      await createWorkspace({ name: workspaceName });
-      await new Promise((resolve) => setTimeout(resolve, 1000)); // Simulate API call
-      alert(`Workspace "${newWorkspaceName}" created successfully!`);
       setNewWorkspaceName("");
-    } catch (_error) {
+      await loadWorkspaces();
-      console.error("Failed to create workspace:", _error);
+    } catch (error) {
-      alert("Failed to create workspace");
+      setCreateError(getErrorMessage(error, "Failed to create workspace"));
     } finally {
       setIsCreating(false);
     }
   };
 
+  const eligibleUsers = useMemo(() => {
+    const memberIds = new Set(members.map((member) => member.userId));
+    return availableUsers.filter((user) => !memberIds.has(user.id));
+  }, [availableUsers, members]);
+
+  const loadAvailableUsers = useCallback(async (): Promise<void> => {
+    setIsLoadingUsers(true);
+
+    try {
+      const response = await fetchAdminUsers(1, 200);
+      const activeUsers = response.data.filter((user) => user.deactivatedAt === null);
+      setAvailableUsers(activeUsers);
+
+      if (memberUserId && activeUsers.some((user) => user.id === memberUserId)) {
+        return;
+      }
+
+      const memberIds = new Set(members.map((member) => member.userId));
+      const firstEligible = activeUsers.find((user) => !memberIds.has(user.id));
+      setMemberUserId(firstEligible?.id ?? "");
+    } catch (error) {
+      setAddMemberError(getErrorMessage(error, "Failed to load users for member assignment"));
+      setAvailableUsers([]);
+      setMemberUserId("");
+    } finally {
+      setIsLoadingUsers(false);
+    }
+  }, [memberUserId, members]);
+
+  const openAddMemberDialog = async (): Promise<void> => {
+    setAddMemberError(null);
+    setMemberRole(WorkspaceMemberRole.MEMBER);
+    setIsAddMemberOpen(true);
+    await loadAvailableUsers();
+  };
+
+  const handleAddMember = async (event: SyntheticEvent<HTMLFormElement>): Promise<void> => {
+    event.preventDefault();
+
+    if (!selectedWorkspaceId) {
+      setAddMemberError("Select a workspace before adding members.");
+      return;
+    }
+
+    if (!memberUserId) {
+      setAddMemberError("Select a user to add.");
+      return;
+    }
+
+    setIsAddingMember(true);
+    setAddMemberError(null);
+
+    try {
+      await addWorkspaceMember(selectedWorkspaceId, {
+        userId: memberUserId,
+        role: memberRole,
+      });
+      setIsAddMemberOpen(false);
+      await loadMembers(selectedWorkspaceId);
+    } catch (error) {
+      setAddMemberError(getErrorMessage(error, "Failed to add member"));
+    } finally {
+      setIsAddingMember(false);
+    }
+  };
+
+  const handleRemoveMember = async (): Promise<void> => {
+    if (!selectedWorkspaceId || !removeTarget) {
+      return;
+    }
+
+    setIsRemovingMember(true);
+
+    try {
+      await removeWorkspaceMember(selectedWorkspaceId, removeTarget.userId);
+      setRemoveTarget(null);
+      await loadMembers(selectedWorkspaceId);
+    } catch (error) {
+      setMembersError(getErrorMessage(error, "Failed to remove member"));
+    } finally {
+      setIsRemovingMember(false);
+    }
+  };
+
   return (
-    <main className="container mx-auto px-4 py-8 max-w-5xl">
+    <main className="max-w-6xl mx-auto p-6 space-y-6">
-      <div className="mb-8">
+      <div className="flex items-start justify-between gap-4">
-        <div className="flex items-center justify-between mb-2">
+        <div>
-          <h1 className="text-3xl font-bold text-gray-900">Workspaces</h1>
+          <h1 className="text-3xl font-bold">Workspaces</h1>
-          <Link href="/settings" className="text-sm text-blue-600 hover:text-blue-700">
+          <p className="text-muted-foreground mt-1">Manage workspaces and workspace members</p>
-            ← Back to Settings
-          </Link>
         </div>
-        <p className="text-gray-600">Manage your workspaces and collaborate with your team</p>
+        <Link href="/settings" className="text-sm text-blue-600 hover:text-blue-700">
+          ← Back to Settings
+        </Link>
       </div>
 
-      {/* Create New Workspace */}
+      <Card>
-      <div className="bg-white rounded-lg shadow-sm border border-gray-200 p-6 mb-6">
+        <CardHeader>
-        <h2 className="text-lg font-semibold text-gray-900 mb-4">Create New Workspace</h2>
+          <CardTitle>Create New Workspace</CardTitle>
-        <form onSubmit={handleCreateWorkspace} className="flex gap-3">
+          <CardDescription>Create a workspace for a new team or project.</CardDescription>
-          <input
+        </CardHeader>
-            type="text"
+        <CardContent>
-            value={newWorkspaceName}
+          <form onSubmit={handleCreateWorkspace} className="flex gap-3">
-            onChange={(e) => {
+            <Input
-              setNewWorkspaceName(e.target.value);
+              type="text"
-            }}
+              value={newWorkspaceName}
-            placeholder="Enter workspace name..."
+              onChange={(event) => {
-            disabled={isCreating}
+                setNewWorkspaceName(event.target.value);
-            className="flex-1 px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-transparent disabled:bg-gray-100"
+              }}
-          />
+              placeholder="Enter workspace name..."
-          <button
+              disabled={isCreating}
-            type="submit"
+            />
-            disabled={isCreating || !newWorkspaceName.trim()}
+            <Button type="submit" disabled={isCreating || !newWorkspaceName.trim()}>
-            className="px-6 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed font-medium"
+              {isCreating ? "Creating..." : "Create Workspace"}
-          >
+            </Button>
-            {isCreating ? "Creating..." : "Create Workspace"}
+          </form>
-          </button>
+          {createError !== null ? (
-        </form>
+            <p className="mt-3 text-sm text-destructive" role="alert">
+              {createError}
+            </p>
+          ) : null}
+        </CardContent>
+      </Card>
+
+      {loadError !== null ? (
+        <Card>
+          <CardContent className="py-4">
+            <p className="text-sm text-destructive" role="alert">
+              {loadError}
+            </p>
+          </CardContent>
+        </Card>
+      ) : null}
+
+      <div className="grid grid-cols-1 lg:grid-cols-5 gap-6">
+        <Card className="lg:col-span-2">
+          <CardHeader>
+            <CardTitle>Your Workspaces ({isLoading ? "..." : workspaces.length})</CardTitle>
+            <CardDescription>Click a workspace to manage its members.</CardDescription>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            {isLoading ? (
+              <p className="text-sm text-muted-foreground">Loading workspaces...</p>
+            ) : workspaces.length === 0 ? (
+              <p className="text-sm text-muted-foreground">
+                No workspaces yet. Create one to begin.
+              </p>
+            ) : (
+              workspaces.map((workspace) => {
+                const isSelected = selectedWorkspaceId === workspace.id;
+
+                return (
+                  <button
+                    key={workspace.id}
+                    type="button"
+                    onClick={() => {
+                      setSelectedWorkspaceId(workspace.id);
+                    }}
+                    className={`w-full rounded-lg border p-4 text-left transition-colors ${
+                      isSelected ? "border-primary bg-muted/40" : "border-border hover:bg-muted/20"
+                    }`}
+                  >
+                    <div className="flex items-start justify-between gap-3">
+                      <div className="min-w-0">
+                        <p className="font-semibold truncate">{workspace.name}</p>
+                        <p className="text-xs text-muted-foreground mt-1">
+                          Created {new Date(workspace.createdAt).toLocaleDateString()}
+                        </p>
+                      </div>
+                      <Badge variant="outline">{toRoleLabel(workspace.role)}</Badge>
+                    </div>
+                  </button>
+                );
+              })
+            )}
+          </CardContent>
+        </Card>
+
+        <Card className="lg:col-span-3">
+          <CardHeader>
+            <div className="flex items-start justify-between gap-3">
+              <div>
+                <CardTitle>
+                  {selectedWorkspace ? `${selectedWorkspace.name} Members` : "Workspace Members"}
+                </CardTitle>
+                <CardDescription>
+                  {selectedWorkspace
+                    ? "Manage member roles and access for this workspace."
+                    : "Select a workspace to view its members."}
+                </CardDescription>
+              </div>
+
+              <Dialog
+                open={isAddMemberOpen}
+                onOpenChange={(open) => {
+                  if (!open && !isAddingMember) {
+                    setIsAddMemberOpen(false);
+                    setAddMemberError(null);
+                  }
+                }}
+              >
+                <DialogTrigger asChild>
+                  <Button
+                    onClick={() => {
+                      void openAddMemberDialog();
+                    }}
+                    disabled={!selectedWorkspace}
+                  >
+                    <UserPlus className="h-4 w-4 mr-2" />
+                    Add Member
+                  </Button>
+                </DialogTrigger>
+                <DialogContent>
+                  <DialogHeader>
+                    <DialogTitle>Add Workspace Member</DialogTitle>
+                    <DialogDescription>
+                      Add an existing user to {selectedWorkspace?.name ?? "this workspace"}.
+                    </DialogDescription>
+                  </DialogHeader>
+
+                  <form
+                    onSubmit={(event) => {
+                      void handleAddMember(event);
+                    }}
+                    className="space-y-4"
+                  >
+                    <div className="space-y-2">
+                      <Label htmlFor="member-user">User</Label>
+                      <Select
+                        value={memberUserId}
+                        onValueChange={(value) => {
+                          setMemberUserId(value);
+                        }}
+                        disabled={isLoadingUsers || eligibleUsers.length === 0 || isAddingMember}
+                      >
+                        <SelectTrigger id="member-user">
+                          <SelectValue
+                            placeholder={
+                              isLoadingUsers
+                                ? "Loading users..."
+                                : eligibleUsers.length === 0
+                                  ? "No eligible users"
+                                  : "Select a user"
+                            }
+                          />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {eligibleUsers.map((user) => (
+                            <SelectItem key={user.id} value={user.id}>
+                              {user.name} ({user.email})
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    </div>
+
+                    <div className="space-y-2">
+                      <Label htmlFor="member-role">Role</Label>
+                      <Select
+                        value={memberRole}
+                        onValueChange={(value) => {
+                          setMemberRole(value as WorkspaceMemberRole);
+                        }}
+                        disabled={isAddingMember}
+                      >
+                        <SelectTrigger id="member-role">
+                          <SelectValue placeholder="Select role" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {Object.values(WorkspaceMemberRole)
+                            .filter((role) => role !== WorkspaceMemberRole.OWNER)
+                            .map((role) => (
+                              <SelectItem key={role} value={role}>
+                                {toRoleLabel(role)}
+                              </SelectItem>
+                            ))}
+                        </SelectContent>
+                      </Select>
+                    </div>
+
+                    {addMemberError !== null ? (
+                      <p className="text-sm text-destructive" role="alert">
+                        {addMemberError}
+                      </p>
+                    ) : null}
+
+                    <DialogFooter>
+                      <Button
+                        type="button"
+                        variant="outline"
+                        onClick={() => {
+                          if (!isAddingMember) {
+                            setIsAddMemberOpen(false);
+                            setAddMemberError(null);
+                          }
+                        }}
+                        disabled={isAddingMember}
+                      >
+                        Cancel
+                      </Button>
+                      <Button type="submit" disabled={isAddingMember || !memberUserId}>
+                        {isAddingMember ? "Adding..." : "Add Member"}
+                      </Button>
+                    </DialogFooter>
+                  </form>
+                </DialogContent>
+              </Dialog>
+            </div>
+          </CardHeader>
+
+          <CardContent className="space-y-3">
+            {selectedWorkspace === null ? (
+              <p className="text-sm text-muted-foreground">Select a workspace to view members.</p>
+            ) : membersError !== null ? (
+              <p className="text-sm text-destructive" role="alert">
+                {membersError}
+              </p>
+            ) : isMembersLoading ? (
+              <p className="text-sm text-muted-foreground">Loading members...</p>
+            ) : members.length === 0 ? (
+              <p className="text-sm text-muted-foreground">No members found for this workspace.</p>
+            ) : (
+              members.map((member) => (
+                <div
+                  key={member.userId}
+                  className="rounded-md border p-4 flex flex-col gap-3 md:flex-row md:items-center md:justify-between"
+                >
+                  <div className="space-y-1 min-w-0">
+                    <p className="font-semibold truncate">{member.user.name ?? "Unnamed User"}</p>
+                    <p className="text-sm text-muted-foreground truncate">{member.user.email}</p>
+                  </div>
+
+                  <div className="flex items-center gap-2 md:justify-end">
+                    <Badge variant="outline" className={ROLE_BADGE_CLASS[member.role]}>
+                      {toRoleLabel(member.role)}
+                    </Badge>
+
+                    <Button
+                      type="button"
+                      variant="destructive"
+                      size="sm"
+                      onClick={() => {
+                        setRemoveTarget({
+                          userId: member.userId,
+                          email: member.user.email,
+                        });
+                      }}
+                    >
+                      <UserX className="h-4 w-4 mr-2" />
+                      Remove
+                    </Button>
+                  </div>
+                </div>
+              ))
+            )}
+          </CardContent>
+        </Card>
       </div>
 
-      {/* Workspace List */}
+      <AlertDialog
-      <div className="space-y-4">
+        open={removeTarget !== null}
-        <h2 className="text-xl font-semibold text-gray-900">
+        onOpenChange={(open) => {
-          Your Workspaces ({workspacesWithRoles.length})
+          if (!open && !isRemovingMember) {
-        </h2>
+            setRemoveTarget(null);
-        {workspacesWithRoles.length === 0 ? (
+          }
-          <div className="bg-white rounded-lg shadow-sm border border-gray-200 p-12 text-center">
+        }}
-            <svg
+      >
-              className="mx-auto h-12 w-12 text-gray-400 mb-4"
+        <AlertDialogContent>
-              fill="none"
+          <AlertDialogHeader>
-              stroke="currentColor"
+            <AlertDialogTitle>Remove Workspace Member</AlertDialogTitle>
-              viewBox="0 0 24 24"
+            <AlertDialogDescription>
+              Remove {removeTarget?.email} from {selectedWorkspace?.name}? They will lose access to
+              this workspace.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isRemovingMember}>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              disabled={isRemovingMember}
+              onClick={() => {
+                void handleRemoveMember();
+              }}
             >
-              <path
+              {isRemovingMember ? "Removing..." : "Remove"}
-                strokeLinecap="round"
+            </AlertDialogAction>
-                strokeLinejoin="round"
+          </AlertDialogFooter>
-                strokeWidth={2}
+        </AlertDialogContent>
-                d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4"
+      </AlertDialog>
-              />
-            </svg>
-            <h3 className="text-lg font-medium text-gray-900 mb-2">No workspaces yet</h3>
-            <p className="text-gray-600">Create your first workspace to get started</p>
-          </div>
-        ) : (
-          <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
-            {workspacesWithRoles.map((workspace) => (
-              <WorkspaceCard
-                key={workspace.id}
-                workspace={workspace}
-                userRole={workspace.userRole}
-                memberCount={workspace.memberCount}
-              />
-            ))}
-          </div>
-        )}
-      </div>
     </main>
   );
 }
-
-/**
- * Workspaces Page Entry Point
- * Shows development content or Coming Soon based on environment
- */
-export default function WorkspacesPage(): ReactElement {
-  // In production, show Coming Soon placeholder
-  if (!isDevelopment) {
-    return (
-      <ComingSoon
-        feature="Workspace Management"
-        description="Create and manage workspaces to organize your projects and collaborate with your team. This feature is currently under development."
-      >
-        <Link href="/settings" className="text-sm text-blue-600 hover:text-blue-700">
-          Back to Settings
-        </Link>
-      </ComingSoon>
-    );
-  }
-
-  // In development, show the full page with mock data
-  return <WorkspacesPageContent />;
-}

apps/web/src/app/settings/workspaces/[id]/teams/[teamId]/page.tsx

@@ -2,136 +2,25 @@
 
 import type { ReactElement } from "react";
 
-import { useState } from "react";
+import { useParams } from "next/navigation";
-import { useParams, useRouter } from "next/navigation";
+import { ComingSoon } from "@/components/ui/ComingSoon";
-import { TeamSettings } from "@/components/team/TeamSettings";
-import { TeamMemberList } from "@/components/team/TeamMemberList";
-import { mockTeamWithMembers } from "@/lib/api/teams";
-import type { User } from "@mosaic/shared";
-import type { TeamMemberRole } from "@mosaic/shared";
 import Link from "next/link";
 
-// Mock available users for adding to team
-const mockAvailableUsers: User[] = [
-  {
-    id: "user-3",
-    email: "alice@example.com",
-    name: "Alice Johnson",
-    emailVerified: true,
-    image: null,
-    authProviderId: null,
-    preferences: {},
-    deactivatedAt: null,
-    isLocalAuth: false,
-    passwordHash: null,
-    invitedBy: null,
-    invitationToken: null,
-    invitedAt: null,
-    createdAt: new Date("2026-01-17"),
-    updatedAt: new Date("2026-01-17"),
-  },
-  {
-    id: "user-4",
-    email: "bob@example.com",
-    name: "Bob Wilson",
-    emailVerified: true,
-    image: null,
-    authProviderId: null,
-    preferences: {},
-    deactivatedAt: null,
-    isLocalAuth: false,
-    passwordHash: null,
-    invitedBy: null,
-    invitationToken: null,
-    invitedAt: null,
-    createdAt: new Date("2026-01-18"),
-    updatedAt: new Date("2026-01-18"),
-  },
-];
-
 export default function TeamDetailPage(): ReactElement {
   const params = useParams();
-  const router = useRouter();
   const workspaceId = params.id as string;
-  // const teamId = params.teamId as string; // Will be used for API calls
-
-  // TODO: Replace with real API call when backend is ready
-  // const { data: team, isLoading } = useQuery({
-  //   queryKey: ["team", workspaceId, params.teamId],
-  //   queryFn: () => fetchTeam(workspaceId, params.teamId as string),
-  // });
-
-  const [team] = useState(mockTeamWithMembers);
-  const [isLoading] = useState(false);
-
-  const handleUpdateTeam = (data: { name?: string; description?: string }): Promise<void> => {
-    // TODO: Replace with real API call
-    // await updateTeam(workspaceId, teamId, data);
-    console.log("Updating team:", data);
-    // TODO: Refetch team data
-    return Promise.resolve();
-  };
-
-  const handleDeleteTeam = (): Promise<void> => {
-    // TODO: Replace with real API call
-    // await deleteTeam(workspaceId, teamId);
-    console.log("Deleting team");
-
-    // Navigate back to teams list
-    router.push(`/settings/workspaces/${workspaceId}/teams`);
-    return Promise.resolve();
-  };
-
-  const handleAddMember = (userId: string, role?: TeamMemberRole): Promise<void> => {
-    // TODO: Replace with real API call
-    // await addTeamMember(workspaceId, teamId, { userId, role });
-    console.log("Adding member:", { userId, role });
-    // TODO: Refetch team data
-    return Promise.resolve();
-  };
-
-  const handleRemoveMember = (userId: string): Promise<void> => {
-    // TODO: Replace with real API call
-    // await removeTeamMember(workspaceId, teamId, userId);
-    console.log("Removing member:", userId);
-    // TODO: Refetch team data
-    return Promise.resolve();
-  };
-
-  if (isLoading) {
-    return (
-      <main className="container mx-auto px-4 py-8">
-        <div className="flex justify-center items-center p-8">
-          <div className="animate-spin rounded-full h-8 w-8 border-b-2 border-gray-900"></div>
-          <span className="ml-3 text-gray-600">Loading team...</span>
-        </div>
-      </main>
-    );
-  }
 
   return (
-    <main className="container mx-auto px-4 py-8">
+    <ComingSoon
-      <div className="mb-8">
+      feature="Team Details"
-        <Link
+      description="Team member management is being migrated to live API-backed data."
-          href={`/settings/workspaces/${workspaceId}/teams`}
+    >
-          className="text-blue-600 hover:text-blue-700 text-sm mb-2 inline-block"
+      <Link
-        >
+        href={`/settings/workspaces/${workspaceId}/teams`}
-          ← Back to Teams
+        className="text-sm text-blue-600 hover:text-blue-700"
-        </Link>
+      >
-        <h1 className="text-3xl font-bold text-gray-900">{team.name}</h1>
+        {"<-"} Back to Teams
-        {team.description && <p className="text-gray-600 mt-2">{team.description}</p>}
+      </Link>
-      </div>
+    </ComingSoon>
-
-      <div className="space-y-6">
-        <TeamSettings team={team} onUpdate={handleUpdateTeam} onDelete={handleDeleteTeam} />
-
-        <TeamMemberList
-          members={team.members}
-          onAddMember={handleAddMember}
-          onRemoveMember={handleRemoveMember}
-          availableUsers={mockAvailableUsers}
-        />
-      </div>
-    </main>
   );
 }

apps/web/src/app/settings/workspaces/[id]/teams/page.tsx

@@ -2,63 +2,90 @@
 
 import type { ReactElement } from "react";
 
-import { useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import { useParams } from "next/navigation";
 import { TeamCard } from "@/components/team/TeamCard";
 import { ComingSoon } from "@/components/ui/ComingSoon";
 import { Button, Input, Modal } from "@mosaic/ui";
-import { mockTeams } from "@/lib/api/teams";
+import { createTeam, fetchTeams, type CreateTeamDto, type TeamRecord } from "@/lib/api/teams";
 import Link from "next/link";
 
-// Check if we're in development mode
 const isDevelopment = process.env.NODE_ENV === "development";
 
-/**
+function getErrorMessage(error: unknown, fallback: string): string {
- * Teams Page Content - Development Only
+  if (error instanceof Error) {
- * Shows mock team data for development purposes
+    return error.message;
- */
+  }
+
+  return fallback;
+}
+
 function TeamsPageContent(): ReactElement {
   const params = useParams();
   const workspaceId = params.id as string;
 
-  // TODO: Replace with real API call when backend is ready
+  const [teams, setTeams] = useState<TeamRecord[]>([]);
-  // const { data: teams, isLoading } = useQuery({
+  const [isLoading, setIsLoading] = useState(true);
-  //   queryKey: ["teams", workspaceId],
+  const [loadError, setLoadError] = useState<string | null>(null);
-  //   queryFn: () => fetchTeams(workspaceId),
-  // });
-
-  const [teams] = useState(mockTeams);
-  const [isLoading] = useState(false);
   const [isCreating, setIsCreating] = useState(false);
   const [showCreateModal, setShowCreateModal] = useState(false);
   const [newTeamName, setNewTeamName] = useState("");
   const [newTeamDescription, setNewTeamDescription] = useState("");
+  const [createError, setCreateError] = useState<string | null>(null);
 
-  const handleCreateTeam = (): void => {
+  const loadTeams = useCallback(async (): Promise<void> => {
-    if (!newTeamName.trim()) return;
+    setIsLoading(true);
+
+    try {
+      const data = await fetchTeams(workspaceId);
+      setTeams(data);
+      setLoadError(null);
+    } catch (error) {
+      setLoadError(getErrorMessage(error, "Failed to load teams"));
+    } finally {
+      setIsLoading(false);
+    }
+  }, [workspaceId]);
+
+  useEffect(() => {
+    void loadTeams();
+  }, [loadTeams]);
+
+  const handleCreateTeam = async (): Promise<void> => {
+    const teamName = newTeamName.trim();
+    if (!teamName) return;
 
     setIsCreating(true);
-    try {
+    setCreateError(null);
-      // TODO: Replace with real API call
+
-      // await createTeam(workspaceId, {
+    try {
-      //   name: newTeamName,
+      const description = newTeamDescription.trim();
-      //   description: newTeamDescription || undefined,
+      const dto: CreateTeamDto = {
-      // });
+        name: teamName,
+      };
+      if (description.length > 0) {
+        dto.description = description;
+      }
+
+      await createTeam(dto, workspaceId);
 
-      // Reset form
       setNewTeamName("");
       setNewTeamDescription("");
       setShowCreateModal(false);
-
+      await loadTeams();
-      // TODO: Refresh teams list
+    } catch (error) {
-    } catch (_error) {
+      setCreateError(getErrorMessage(error, "Failed to create team"));
-      console.error("Failed to create team:", _error);
-      alert("Failed to create team. Please try again.");
     } finally {
       setIsCreating(false);
     }
   };
 
+  const teamsForCards = teams.map((team) => ({
+    ...team,
+    createdAt: new Date(team.createdAt),
+    updatedAt: new Date(team.updatedAt),
+  }));
+
   if (isLoading) {
     return (
       <main className="container mx-auto px-4 py-8">
@@ -80,6 +107,7 @@ function TeamsPageContent(): ReactElement {
         <Button
           variant="primary"
           onClick={() => {
+            setCreateError(null);
             setShowCreateModal(true);
           }}
         >
@@ -87,7 +115,11 @@ function TeamsPageContent(): ReactElement {
         </Button>
       </div>
 
-      {teams.length === 0 ? (
+      {loadError !== null ? (
+        <div className="rounded-md border border-red-200 bg-red-50 px-4 py-3 text-red-700">
+          {loadError}
+        </div>
+      ) : teamsForCards.length === 0 ? (
         <div className="text-center p-12 bg-gray-50 rounded-lg">
           <p className="text-lg text-gray-500 mb-4">No teams yet</p>
           <p className="text-sm text-gray-400 mb-6">
@@ -96,6 +128,7 @@ function TeamsPageContent(): ReactElement {
           <Button
             variant="primary"
             onClick={() => {
+              setCreateError(null);
               setShowCreateModal(true);
             }}
           >
@@ -104,13 +137,12 @@ function TeamsPageContent(): ReactElement {
         </div>
       ) : (
         <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
-          {teams.map((team) => (
+          {teamsForCards.map((team) => (
             <TeamCard key={team.id} team={team} workspaceId={workspaceId} />
           ))}
         </div>
       )}
 
-      {/* Create Team Modal */}
       {showCreateModal && (
         <Modal
           isOpen={showCreateModal}
@@ -143,6 +175,11 @@ function TeamsPageContent(): ReactElement {
               fullWidth
               disabled={isCreating}
             />
+            {createError !== null && (
+              <div className="rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700">
+                {createError}
+              </div>
+            )}
             <div className="flex gap-2 justify-end pt-4">
               <Button
                 variant="ghost"
@@ -155,7 +192,7 @@ function TeamsPageContent(): ReactElement {
               </Button>
               <Button
                 variant="primary"
-                onClick={handleCreateTeam}
+                onClick={() => void handleCreateTeam()}
                 disabled={!newTeamName.trim() || isCreating}
               >
                 {isCreating ? "Creating..." : "Create Team"}
@@ -168,12 +205,7 @@ function TeamsPageContent(): ReactElement {
   );
 }
 
-/**
- * Teams Page Entry Point
- * Shows development content or Coming Soon based on environment
- */
 export default function TeamsPage(): ReactElement {
-  // In production, show Coming Soon placeholder
   if (!isDevelopment) {
     return (
       <ComingSoon
@@ -187,6 +219,5 @@ export default function TeamsPage(): ReactElement {
     );
   }
 
-  // In development, show the full page with mock data
   return <TeamsPageContent />;
 }

apps/web/src/components/layout/AppSidebar.tsx

@@ -1,9 +1,11 @@
 "use client";
 
+import { useEffect, useState } from "react";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
 import Image from "next/image";
 import { useAuth } from "@/lib/auth/auth-context";
+import { fetchUserWorkspaces } from "@/lib/api/workspaces";
 import { useSidebar } from "./SidebarContext";
 
 // ---------------------------------------------------------------------------
@@ -461,10 +463,26 @@ interface UserCardProps {
 
 function UserCard({ collapsed }: UserCardProps): React.JSX.Element {
   const { user } = useAuth();
+  const [roleLabel, setRoleLabel] = useState<string>("Member");
+
+  useEffect(() => {
+    if (user === null) return;
+    fetchUserWorkspaces()
+      .then((workspaces) => {
+        if (workspaces.length === 0) return;
+        const first = workspaces[0];
+        if (!first) return;
+        const role = first.role;
+        setRoleLabel(role.charAt(0) + role.slice(1).toLowerCase());
+      })
+      .catch(() => {
+        // keep default
+      });
+  }, [user]);
 
   const displayName = user?.name ?? "User";
   const initials = getInitials(displayName);
-  const role = "Member";
+  const role = roleLabel;
 
   return (
     <footer

apps/web/src/components/settings/SettingsAccessDenied.tsx

@@ -0,0 +1,16 @@
+import type { ReactElement } from "react";
+
+interface SettingsAccessDeniedProps {
+  message: string;
+}
+
+export function SettingsAccessDenied({ message }: SettingsAccessDeniedProps): ReactElement {
+  return (
+    <div className="p-8 max-w-2xl">
+      <div className="rounded-lg border border-red-200 bg-red-50 p-6 text-center">
+        <p className="text-lg font-semibold text-red-700">Access Denied</p>
+        <p className="mt-2 text-sm text-red-600">{message}</p>
+      </div>
+    </div>
+  );
+}

apps/web/src/lib/api/admin.test.ts

@@ -0,0 +1,60 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as client from "./client";
+import { fetchAdminUsers, inviteUser, updateUser, deactivateUser } from "./admin";
+
+vi.mock("./client");
+
+beforeEach((): void => {
+  vi.clearAllMocks();
+});
+
+describe("fetchAdminUsers", (): void => {
+  it("calls admin/users endpoint without params when none provided", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce({ data: [], meta: {} } as never);
+    await fetchAdminUsers();
+    expect(client.apiGet).toHaveBeenCalledWith("/api/admin/users");
+  });
+
+  it("appends page and limit params when provided", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce({ data: [], meta: {} } as never);
+    await fetchAdminUsers(2, 50);
+    expect(client.apiGet).toHaveBeenCalledWith("/api/admin/users?page=2&limit=50");
+  });
+
+  it("throws on API error", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockRejectedValueOnce(new Error("Network error"));
+    await expect(fetchAdminUsers()).rejects.toThrow("Network error");
+  });
+});
+
+describe("inviteUser", (): void => {
+  it("posts to invite endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiPost).mockResolvedValueOnce({ id: "inv-1" } as never);
+    await inviteUser({
+      email: "a@b.com",
+      name: "Alice",
+      workspaceId: "ws-1",
+      role: "MEMBER" as never,
+    });
+    expect(client.apiPost).toHaveBeenCalledWith(
+      "/api/admin/users/invite",
+      expect.objectContaining({ email: "a@b.com" })
+    );
+  });
+});
+
+describe("updateUser", (): void => {
+  it("patches correct endpoint with dto", async (): Promise<void> => {
+    vi.mocked(client.apiPatch).mockResolvedValueOnce({ id: "u1", name: "Bob" } as never);
+    await updateUser("u1", { name: "Bob" });
+    expect(client.apiPatch).toHaveBeenCalledWith("/api/admin/users/u1", { name: "Bob" });
+  });
+});
+
+describe("deactivateUser", (): void => {
+  it("deletes correct endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiDelete).mockResolvedValueOnce({} as never);
+    await deactivateUser("u1");
+    expect(client.apiDelete).toHaveBeenCalledWith("/api/admin/users/u1");
+  });
+});

apps/web/src/lib/api/admin.ts

@@ -0,0 +1,99 @@
+/**
+ * Admin API Client
+ * Handles admin user management requests
+ */
+
+import type { WorkspaceMemberRole } from "@mosaic/shared";
+import { apiGet, apiPatch, apiPost, apiDelete } from "./client";
+
+export interface AdminWorkspaceMembership {
+  workspaceId: string;
+  workspaceName: string;
+  role: WorkspaceMemberRole;
+  joinedAt: string;
+}
+
+export interface AdminUser {
+  id: string;
+  name: string;
+  email: string;
+  emailVerified: boolean;
+  image: string | null;
+  createdAt: string;
+  deactivatedAt: string | null;
+  isLocalAuth: boolean;
+  invitedAt: string | null;
+  invitedBy: string | null;
+  workspaceMemberships: AdminWorkspaceMembership[];
+}
+
+export interface AdminUsersResponse {
+  data: AdminUser[];
+  meta: {
+    total: number;
+    page: number;
+    limit: number;
+    totalPages: number;
+  };
+}
+
+export interface InviteUserDto {
+  email: string;
+  name?: string;
+  workspaceId?: string;
+  role?: WorkspaceMemberRole;
+}
+
+export interface InvitationResponse {
+  userId: string;
+  invitationToken: string;
+  email: string;
+  invitedAt: string;
+}
+
+export interface UpdateUserDto {
+  name?: string;
+  email?: string;
+  deactivatedAt?: string | null;
+  emailVerified?: boolean;
+  preferences?: Record<string, unknown>;
+}
+
+/**
+ * Fetch paginated admin users
+ */
+export async function fetchAdminUsers(page?: number, limit?: number): Promise<AdminUsersResponse> {
+  const params = new URLSearchParams();
+
+  if (page !== undefined) {
+    params.append("page", String(page));
+  }
+
+  if (limit !== undefined) {
+    params.append("limit", String(limit));
+  }
+
+  const endpoint = `/api/admin/users${params.toString() ? `?${params.toString()}` : ""}`;
+  return apiGet<AdminUsersResponse>(endpoint);
+}
+
+/**
+ * Invite a user by email
+ */
+export async function inviteUser(dto: InviteUserDto): Promise<InvitationResponse> {
+  return apiPost<InvitationResponse>("/api/admin/users/invite", dto);
+}
+
+/**
+ * Update admin user fields
+ */
+export async function updateUser(id: string, dto: UpdateUserDto): Promise<AdminUser> {
+  return apiPatch<AdminUser>(`/api/admin/users/${id}`, dto);
+}
+
+/**
+ * Deactivate a user account
+ */
+export async function deactivateUser(id: string): Promise<AdminUser> {
+  return apiDelete<AdminUser>(`/api/admin/users/${id}`);
+}

apps/web/src/lib/api/index.ts

@@ -16,3 +16,4 @@ export * from "./telemetry";
 export * from "./dashboard";
 export * from "./projects";
 export * from "./workspaces";
+export * from "./admin";

apps/web/src/lib/api/teams.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as client from "./client";
+import { fetchTeams, createTeam, fetchTeamMembers, updateTeam, deleteTeam } from "./teams";
+
+vi.mock("./client");
+
+const localStorageMock = {
+  getItem: vi.fn().mockReturnValue("ws-1"),
+  setItem: vi.fn(),
+  clear: vi.fn(),
+  removeItem: vi.fn(),
+  length: 0,
+  key: vi.fn(),
+};
+Object.defineProperty(window, "localStorage", { value: localStorageMock });
+
+beforeEach((): void => {
+  vi.clearAllMocks();
+  localStorageMock.getItem.mockReturnValue("ws-1");
+});
+
+describe("fetchTeams", (): void => {
+  it("calls teams endpoint for active workspace", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce([] as never);
+    await fetchTeams();
+    expect(client.apiGet).toHaveBeenCalledWith("/api/workspaces/ws-1/teams", "ws-1");
+  });
+
+  it("throws if no workspace id in localStorage", async (): Promise<void> => {
+    localStorageMock.getItem.mockReturnValue(null);
+    await expect(fetchTeams()).rejects.toThrow();
+  });
+});
+
+describe("createTeam", (): void => {
+  it("posts to teams endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiPost).mockResolvedValueOnce({ id: "t1", name: "Dev" } as never);
+    await createTeam({ name: "Dev" });
+    expect(client.apiPost).toHaveBeenCalledWith(
+      "/api/workspaces/ws-1/teams",
+      expect.objectContaining({ name: "Dev" }),
+      "ws-1"
+    );
+  });
+});
+
+describe("updateTeam", (): void => {
+  it("patches team endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiPatch).mockResolvedValueOnce({ id: "t1", name: "Platform" } as never);
+    await updateTeam("t1", { name: "Platform" });
+    expect(client.apiPatch).toHaveBeenCalledWith(
+      "/api/workspaces/ws-1/teams/t1",
+      expect.objectContaining({ name: "Platform" }),
+      "ws-1"
+    );
+  });
+});
+
+describe("fetchTeamMembers", (): void => {
+  it("calls members endpoint for team", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce([] as never);
+    await fetchTeamMembers("t-1");
+    expect(client.apiGet).toHaveBeenCalledWith("/api/workspaces/ws-1/teams/t-1/members", "ws-1");
+  });
+});
+
+describe("deleteTeam", (): void => {
+  it("deletes team endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiDelete).mockResolvedValueOnce(undefined as never);
+    await deleteTeam("t1");
+    expect(client.apiDelete).toHaveBeenCalledWith("/api/workspaces/ws-1/teams/t1", "ws-1");
+  });
+});

apps/web/src/lib/api/teams.ts

@@ -1,14 +1,53 @@
 /**
  * Teams API Client
- * Handles team-related API requests
+ * Handles workspace-scoped team API requests.
  */
 
-import type { Team, TeamMember, User } from "@mosaic/shared";
+import type { TeamMemberRole } from "@mosaic/shared";
-import { TeamMemberRole } from "@mosaic/shared";
+import { apiDelete, apiGet, apiPatch, apiPost } from "./client";
-import { apiGet, apiPost, apiPatch, apiDelete, type ApiResponse } from "./client";
 
-export interface TeamWithMembers extends Team {
+const WORKSPACE_STORAGE_KEY = "mosaic-workspace-id";
-  members: (TeamMember & { user: User })[];
+
+function resolveWorkspaceId(explicitWorkspaceId?: string): string {
+  if (explicitWorkspaceId !== undefined) {
+    return explicitWorkspaceId;
+  }
+
+  if (typeof window === "undefined") {
+    throw new Error("Workspace context is unavailable outside the browser");
+  }
+
+  const workspaceId = window.localStorage.getItem(WORKSPACE_STORAGE_KEY);
+  if (!workspaceId) {
+    throw new Error("No active workspace selected");
+  }
+
+  return workspaceId;
+}
+
+export interface TeamRecord {
+  id: string;
+  workspaceId: string;
+  name: string;
+  description: string | null;
+  metadata: Record<string, unknown>;
+  createdAt: string;
+  updatedAt: string;
+  _count?: {
+    members: number;
+  };
+}
+
+export interface TeamMemberRecord {
+  teamId: string;
+  userId: string;
+  role: TeamMemberRole;
+  joinedAt: string;
+  user?: {
+    id: string;
+    name: string;
+    email: string;
+  };
 }
 
 export interface CreateTeamDto {
@@ -18,7 +57,7 @@ export interface CreateTeamDto {
 
 export interface UpdateTeamDto {
   name?: string;
-  description?: string;
+  description?: string | null;
 }
 
 export interface AddTeamMemberDto {
@@ -27,189 +66,91 @@ export interface AddTeamMemberDto {
 }
 
 /**
- * Fetch all teams for a workspace
+ * Fetch all teams in the active workspace.
  */
-export async function fetchTeams(workspaceId: string): Promise<Team[]> {
+export async function fetchTeams(workspaceId?: string): Promise<TeamRecord[]> {
-  const response = await apiGet<ApiResponse<Team[]>>(`/api/workspaces/${workspaceId}/teams`);
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
-  return response.data;
+  return apiGet<TeamRecord[]>(`/api/workspaces/${resolvedWorkspaceId}/teams`, resolvedWorkspaceId);
 }
 
 /**
- * Fetch a single team with members
+ * Create a team in the active workspace.
  */
-export async function fetchTeam(workspaceId: string, teamId: string): Promise<TeamWithMembers> {
+export async function createTeam(dto: CreateTeamDto, workspaceId?: string): Promise<TeamRecord> {
-  const response = await apiGet<ApiResponse<TeamWithMembers>>(
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
-    `/api/workspaces/${workspaceId}/teams/${teamId}`
+  return apiPost<TeamRecord>(
+    `/api/workspaces/${resolvedWorkspaceId}/teams`,
+    dto,
+    resolvedWorkspaceId
   );
-  return response.data;
 }
 
 /**
- * Create a new team
+ * Update a team in the active workspace.
- */
-export async function createTeam(workspaceId: string, data: CreateTeamDto): Promise<Team> {
-  const response = await apiPost<ApiResponse<Team>>(`/api/workspaces/${workspaceId}/teams`, data);
-  return response.data;
-}
-
-/**
- * Update a team
  */
 export async function updateTeam(
-  workspaceId: string,
   teamId: string,
-  data: UpdateTeamDto
+  dto: UpdateTeamDto,
-): Promise<Team> {
+  workspaceId?: string
-  const response = await apiPatch<ApiResponse<Team>>(
+): Promise<TeamRecord> {
-    `/api/workspaces/${workspaceId}/teams/${teamId}`,
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
-    data
+  return apiPatch<TeamRecord>(
+    `/api/workspaces/${resolvedWorkspaceId}/teams/${teamId}`,
+    dto,
+    resolvedWorkspaceId
   );
-  return response.data;
 }
 
 /**
- * Delete a team
+ * Fetch team members for a team in the active workspace.
+ * The current backend route shape is workspace-scoped team membership.
  */
-export async function deleteTeam(workspaceId: string, teamId: string): Promise<void> {
+export async function fetchTeamMembers(
-  await apiDelete(`/api/workspaces/${workspaceId}/teams/${teamId}`);
+  teamId: string,
+  workspaceId?: string
+): Promise<TeamMemberRecord[]> {
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
+  return apiGet<TeamMemberRecord[]>(
+    `/api/workspaces/${resolvedWorkspaceId}/teams/${teamId}/members`,
+    resolvedWorkspaceId
+  );
 }
 
 /**
- * Add a member to a team
+ * Delete a team in the active workspace.
+ */
+export async function deleteTeam(teamId: string, workspaceId?: string): Promise<void> {
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
+  await apiDelete(`/api/workspaces/${resolvedWorkspaceId}/teams/${teamId}`, resolvedWorkspaceId);
+}
+
+/**
+ * Add a member to a team in the active workspace.
  */
 export async function addTeamMember(
-  workspaceId: string,
   teamId: string,
-  data: AddTeamMemberDto
+  data: AddTeamMemberDto,
-): Promise<TeamMember> {
+  workspaceId?: string
-  const response = await apiPost<ApiResponse<TeamMember>>(
+): Promise<TeamMemberRecord> {
-    `/api/workspaces/${workspaceId}/teams/${teamId}/members`,
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
-    data
+  return apiPost<TeamMemberRecord>(
+    `/api/workspaces/${resolvedWorkspaceId}/teams/${teamId}/members`,
+    data,
+    resolvedWorkspaceId
   );
-  return response.data;
 }
 
 /**
- * Remove a member from a team
+ * Remove a member from a team in the active workspace.
  */
 export async function removeTeamMember(
-  workspaceId: string,
-  teamId: string,
-  userId: string
-): Promise<void> {
-  await apiDelete(`/api/workspaces/${workspaceId}/teams/${teamId}/members/${userId}`);
-}
-
-/**
- * Update a team member's role
- */
-export async function updateTeamMemberRole(
-  workspaceId: string,
   teamId: string,
   userId: string,
-  role: TeamMemberRole
+  workspaceId?: string
-): Promise<TeamMember> {
+): Promise<void> {
-  const response = await apiPatch<ApiResponse<TeamMember>>(
+  const resolvedWorkspaceId = resolveWorkspaceId(workspaceId);
-    `/api/workspaces/${workspaceId}/teams/${teamId}/members/${userId}`,
+  await apiDelete(
-    { role }
+    `/api/workspaces/${resolvedWorkspaceId}/teams/${teamId}/members/${userId}`,
+    resolvedWorkspaceId
   );
-  return response.data;
 }
-
-/**
- * Mock teams for development (until backend endpoints are ready)
- */
-export const mockTeams: Team[] = [
-  {
-    id: "team-1",
-    workspaceId: "workspace-1",
-    name: "Engineering",
-    description: "Product development team",
-    metadata: {},
-    createdAt: new Date("2026-01-20"),
-    updatedAt: new Date("2026-01-20"),
-  },
-  {
-    id: "team-2",
-    workspaceId: "workspace-1",
-    name: "Design",
-    description: "UI/UX design team",
-    metadata: {},
-    createdAt: new Date("2026-01-22"),
-    updatedAt: new Date("2026-01-22"),
-  },
-  {
-    id: "team-3",
-    workspaceId: "workspace-1",
-    name: "Marketing",
-    description: null,
-    metadata: {},
-    createdAt: new Date("2026-01-25"),
-    updatedAt: new Date("2026-01-25"),
-  },
-];
-
-/**
- * Mock team with members for development
- */
-const baseTeam = mockTeams[0];
-if (!baseTeam) {
-  throw new Error("Mock team not found");
-}
-export const mockTeamWithMembers: TeamWithMembers = {
-  id: baseTeam.id,
-  workspaceId: baseTeam.workspaceId,
-  name: baseTeam.name,
-  description: baseTeam.description,
-  metadata: baseTeam.metadata,
-  createdAt: baseTeam.createdAt,
-  updatedAt: baseTeam.updatedAt,
-  members: [
-    {
-      teamId: "team-1",
-      userId: "user-1",
-      role: TeamMemberRole.OWNER,
-      joinedAt: new Date("2026-01-20"),
-      user: {
-        id: "user-1",
-        email: "john@example.com",
-        name: "John Doe",
-        emailVerified: true,
-        image: null,
-        authProviderId: null,
-        preferences: {},
-        deactivatedAt: null,
-        isLocalAuth: false,
-        passwordHash: null,
-        invitedBy: null,
-        invitationToken: null,
-        invitedAt: null,
-        createdAt: new Date("2026-01-15"),
-        updatedAt: new Date("2026-01-15"),
-      },
-    },
-    {
-      teamId: "team-1",
-      userId: "user-2",
-      role: TeamMemberRole.MEMBER,
-      joinedAt: new Date("2026-01-21"),
-      user: {
-        id: "user-2",
-        email: "jane@example.com",
-        name: "Jane Smith",
-        emailVerified: true,
-        image: null,
-        authProviderId: null,
-        preferences: {},
-        deactivatedAt: null,
-        isLocalAuth: false,
-        passwordHash: null,
-        invitedBy: null,
-        invitationToken: null,
-        invitedAt: null,
-        createdAt: new Date("2026-01-16"),
-        updatedAt: new Date("2026-01-16"),
-      },
-    },
-  ],
-};

apps/web/src/lib/api/workspaces.test.ts

@@ -0,0 +1,65 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as client from "./client";
+import {
+  fetchUserWorkspaces,
+  fetchWorkspaceMembers,
+  addWorkspaceMember,
+  updateWorkspaceMemberRole,
+  removeWorkspaceMember,
+} from "./workspaces";
+
+vi.mock("./client");
+
+beforeEach((): void => {
+  vi.clearAllMocks();
+});
+
+describe("fetchUserWorkspaces", (): void => {
+  it("calls correct endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce([] as never);
+    await fetchUserWorkspaces();
+    expect(client.apiGet).toHaveBeenCalledWith("/api/workspaces");
+  });
+});
+
+describe("fetchWorkspaceMembers", (): void => {
+  it("calls correct endpoint with workspace id", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockResolvedValueOnce([] as never);
+    await fetchWorkspaceMembers("ws-1");
+    expect(client.apiGet).toHaveBeenCalledWith("/api/workspaces/ws-1/members");
+  });
+
+  it("throws on error", async (): Promise<void> => {
+    vi.mocked(client.apiGet).mockRejectedValueOnce(new Error("Forbidden"));
+    await expect(fetchWorkspaceMembers("ws-1")).rejects.toThrow("Forbidden");
+  });
+});
+
+describe("addWorkspaceMember", (): void => {
+  it("posts to correct endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiPost).mockResolvedValueOnce({} as never);
+    await addWorkspaceMember("ws-1", { userId: "u1", role: "MEMBER" as never });
+    expect(client.apiPost).toHaveBeenCalledWith("/api/workspaces/ws-1/members", {
+      userId: "u1",
+      role: "MEMBER",
+    });
+  });
+});
+
+describe("updateWorkspaceMemberRole", (): void => {
+  it("patches correct endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiPatch).mockResolvedValueOnce({} as never);
+    await updateWorkspaceMemberRole("ws-1", "u1", { role: "ADMIN" as never });
+    expect(client.apiPatch).toHaveBeenCalledWith("/api/workspaces/ws-1/members/u1", {
+      role: "ADMIN",
+    });
+  });
+});
+
+describe("removeWorkspaceMember", (): void => {
+  it("calls delete on correct endpoint", async (): Promise<void> => {
+    vi.mocked(client.apiDelete).mockResolvedValueOnce(undefined as never);
+    await removeWorkspaceMember("ws-1", "u1");
+    expect(client.apiDelete).toHaveBeenCalledWith("/api/workspaces/ws-1/members/u1");
+  });
+});

apps/web/src/lib/api/workspaces.ts

@@ -3,24 +3,82 @@
  * User-scoped workspace discovery — does NOT require X-Workspace-Id header.
  */
 
-import { apiGet } from "./client";
+import type { WorkspaceMemberRole } from "@mosaic/shared";
+import { apiDelete, apiGet, apiPatch, apiPost } from "./client";
 
-/**
- * A workspace entry from the user's membership list.
- * Matches WorkspaceResponseDto from the API.
- */
 export interface UserWorkspace {
   id: string;
   name: string;
   ownerId: string;
-  role: string;
+  role: WorkspaceMemberRole;
   createdAt: string;
 }
 
-/**
+export interface CreateWorkspaceDto {
- * Fetch all workspaces the authenticated user is a member of.
+  name: string;
- * The API auto-provisions a default workspace if the user has none.
+}
- */
+
+export interface CreatedWorkspace {
+  id: string;
+  name: string;
+  ownerId: string;
+  settings: Record<string, unknown>;
+  createdAt: string;
+  updatedAt: string;
+  memberCount: number;
+}
+
+export interface WorkspaceMemberUser {
+  id: string;
+  email: string;
+  name: string | null;
+  image: string | null;
+}
+
+export interface WorkspaceMemberEntry {
+  workspaceId: string;
+  userId: string;
+  role: WorkspaceMemberRole;
+  joinedAt: string;
+  user: WorkspaceMemberUser;
+}
+
+export interface AddMemberDto {
+  userId: string;
+  role: WorkspaceMemberRole;
+}
+
+export interface UpdateMemberRoleDto {
+  role: WorkspaceMemberRole;
+}
+
 export async function fetchUserWorkspaces(): Promise<UserWorkspace[]> {
   return apiGet<UserWorkspace[]>("/api/workspaces");
 }
+
+export async function createWorkspace(dto: CreateWorkspaceDto): Promise<CreatedWorkspace> {
+  return apiPost<CreatedWorkspace>("/api/admin/workspaces", dto);
+}
+
+export async function fetchWorkspaceMembers(workspaceId: string): Promise<WorkspaceMemberEntry[]> {
+  return apiGet<WorkspaceMemberEntry[]>(`/api/workspaces/${workspaceId}/members`);
+}
+
+export async function addWorkspaceMember(
+  workspaceId: string,
+  dto: AddMemberDto
+): Promise<WorkspaceMemberEntry> {
+  return apiPost<WorkspaceMemberEntry>(`/api/workspaces/${workspaceId}/members`, dto);
+}
+
+export async function updateWorkspaceMemberRole(
+  workspaceId: string,
+  userId: string,
+  dto: UpdateMemberRoleDto
+): Promise<WorkspaceMemberEntry> {
+  return apiPatch<WorkspaceMemberEntry>(`/api/workspaces/${workspaceId}/members/${userId}`, dto);
+}
+
+export async function removeWorkspaceMember(workspaceId: string, userId: string): Promise<void> {
+  await apiDelete<unknown>(`/api/workspaces/${workspaceId}/members/${userId}`);
+}

apps/web/src/lib/auth/auth-context.test.tsx

@@ -3,6 +3,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { render, screen, waitFor } from "@testing-library/react";
 import { AuthProvider, useAuth } from "./auth-context";
 import type { AuthUser } from "@mosaic/shared";
+import { WorkspaceMemberRole } from "@mosaic/shared";
 
 // Mock the API client
 vi.mock("../api/client", () => ({
@@ -761,7 +762,7 @@ describe("AuthContext", (): void => {
           id: "ws-1",
           name: "My Workspace",
           ownerId: "user-1",
-          role: "OWNER",
+          role: WorkspaceMemberRole.OWNER,
           createdAt: "2026-01-01",
         },
       ]);
@@ -795,14 +796,14 @@ describe("AuthContext", (): void => {
           id: "ws-abc-123",
           name: "My Workspace",
           ownerId: "user-1",
-          role: "OWNER",
+          role: WorkspaceMemberRole.OWNER,
           createdAt: "2026-01-01",
         },
         {
           id: "ws-def-456",
           name: "Second Workspace",
           ownerId: "other",
-          role: "MEMBER",
+          role: WorkspaceMemberRole.MEMBER,
           createdAt: "2026-02-01",
         },
       ]);
@@ -892,7 +893,7 @@ describe("AuthContext", (): void => {
           id: "ws-1",
           name: "My Workspace",
           ownerId: "user-1",
-          role: "OWNER",
+          role: WorkspaceMemberRole.OWNER,
           createdAt: "2026-01-01",
         },
       ]);

docker/openbao/Dockerfile

@@ -1,4 +1,4 @@
-FROM quay.io/openbao/openbao:2.5.0
+FROM quay.io/openbao/openbao:2.5.1
 
 LABEL maintainer="Mosaic Stack <dev@mosaic.local>"
 LABEL description="OpenBao secrets management for Mosaic Stack"

docs/PRD-MS22.md

@@ -0,0 +1,114 @@
+# PRD: MS22 — Fleet Evolution (DB-Centric Agent Architecture)
+
+## Metadata
+
+- Owner: Jason Woltje
+- Date: 2026-03-01
+- Status: in-progress
+- Design Doc: `docs/design/MS22-DB-CENTRIC-ARCHITECTURE.md`
+
+## Problem Statement
+
+Mosaic Stack needs a multi-user agent fleet where each user gets their own isolated OpenClaw instance with their own LLM provider credentials and agent config. The system must be Docker-first with minimal environment variables and all configuration managed through the WebUI.
+
+## Objectives
+
+1. **Minimal bootstrap** — 2 env vars (`DATABASE_URL`, `MOSAIC_SECRET_KEY`) to start the entire stack
+2. **DB-centric config** — All runtime config in Postgres, managed via WebUI
+3. **Per-user isolation** — Each user gets their own OpenClaw container with own API keys, memory, sessions
+4. **Onboarding wizard** — First-boot experience: breakglass admin → OIDC → LLM provider → agent config
+5. **Settings UI** — Runtime management of providers, agents, and auth config
+6. **Mosaic as gatekeeper** — Users never talk to OpenClaw directly; Mosaic proxies all requests
+7. **Zero cross-user access** — Full container, volume, and DB isolation between users
+
+## Security Requirements
+
+- User A cannot access User B's API keys, chat history, or agent memory
+- All API keys stored encrypted (AES-256-GCM) in database
+- Breakglass admin always works as OIDC fallback
+- OIDC config stored in DB (not env vars) — configured via settings UI
+- Container-to-container communication blocked by default
+- Admin cannot decrypt other users' API keys
+
+## Phase 0: Knowledge Layer — COMPLETE
+
+- Findings API (pgvector, CRUD, similarity search)
+- AgentMemory API (key/value store)
+- ConversationArchive API (pgvector, ingest, search)
+- OpenClaw mosaic skill
+- Session log ingestion pipeline
+
+## Phase 1: DB-Centric Agent Fleet
+
+### Phase 1a: DB Schema — COMPLETE
+
+- SystemConfig, BreakglassUser, LlmProvider, UserContainer, SystemContainer, UserAgentConfig tables
+
+### Phase 1b: Encryption Service — COMPLETE
+
+- CryptoService (AES-256-GCM using MOSAIC_SECRET_KEY)
+
+### Phase 1c: Internal Config API
+
+- `GET /api/internal/agent-config/:id` — assembles openclaw.json from DB
+- Auth: bearer token (container's own gateway token)
+- Returns complete openclaw.json with decrypted provider credentials
+
+### Phase 1d: Container Lifecycle Manager
+
+- Docker API integration via `dockerode` npm package
+- Start/stop/health-check/reap user containers
+- Auto-generate gateway tokens, assign ports
+- Docker socket access required (`/var/run/docker.sock`)
+
+### Phase 1e: Onboarding API
+
+- First-boot detection (`SystemConfig.onboarding.completed`)
+- `POST /api/onboarding/breakglass` — create admin user
+- `POST /api/onboarding/oidc` — save OIDC provider config
+- `POST /api/onboarding/provider` — add LLM provider + test connection
+- `POST /api/onboarding/complete` — mark done
+
+### Phase 1f: Onboarding Wizard UI
+
+- Multi-step wizard component
+- Skip-able OIDC step
+- LLM provider connection test
+
+### Phase 1g: Settings API
+
+- CRUD: LLM providers (per-user scoped)
+- CRUD: Agent config (model assignments, personalities)
+- CRUD: OIDC config (admin only)
+- Breakglass password reset (admin only)
+
+### Phase 1h: Settings UI
+
+- Settings/Providers page
+- Settings/Agent Config page
+- Settings/Auth page (OIDC + breakglass)
+
+### Phase 1i: Chat Proxy
+
+- Route WebUI chat to user's OpenClaw container
+- SSE streaming pass-through
+- Ensure container is running before proxying (auto-start)
+
+### Phase 1j: Docker Compose + Entrypoint
+
+- Simplified compose (core services only — user containers are dynamic)
+- Entrypoint: fetch config from API, write openclaw.json, start gateway
+- Health check integration
+
+### Phase 1k: Idle Reaper
+
+- Cron job to stop inactive user containers
+- Configurable idle timeout (default 30min)
+- Preserve state volumes
+
+## Future Phases (out of scope)
+
+- Phase 2: Agent fleet standup (predefined agent roles)
+- Phase 3: WebUI chat + task management integration
+- Phase 4: Multi-LLM provider management UI (advanced)
+- Team workspaces (shared agent contexts) — explicitly out of scope

docs/TASKS.md

@@ -1,38 +1,91 @@
 # Tasks — MS21 Multi-Tenant RBAC Data Migration
 
 > Single-writer: orchestrator (Jarvis/OpenClaw) only. Workers read but never modify.
+> Schema: id | status | milestone | description | issue | repo | branch | depends_on | blocks | agent | started_at | completed_at | estimate | used | notes
 
-| id | status | milestone | description | pr | agent | notes |
+| id             | status      | milestone | description                                                                       | issue    | repo  | branch                         | depends_on                                                  | blocks                     | agent           | started_at | completed_at | estimate | used | notes                                                                                                                 |
-|----|--------|-----------|-------------|----|-------|-------|
+| -------------- | ----------- | --------- | --------------------------------------------------------------------------------- | -------- | ----- | ------------------------------ | ----------------------------------------------------------- | -------------------------- | --------------- | ---------- | ------------ | -------- | ---- | --------------------------------------------------------------------------------------------------------------------- |
-| MS21-PLAN-001 | done | phase-1 | Write PRD, init mission, populate TASKS.md | #552 | orchestrator | CI: #552 green |
+| MS21-PLAN-001  | done        | phase-1   | Write PRD, init mission, populate TASKS.md                                        | TASKS:P1 | stack | chore/ms21-init                | —                                                           | MS21-DB-001                | orchestrator    | 2026-02-28 | 2026-02-28   | 10K      | 12K  | PR #552, CI green                                                                                                     |
-| MS21-DB-001 | done | phase-1 | Prisma migration: add user fields | #553 | claude-worker-1 | CI: #684 green |
+| MS21-DB-001    | done        | phase-1   | Prisma migration: add user fields                                                 | TASKS:P1 | api   | feat/ms21-schema               | MS21-PLAN-001                                               | MS21-API-001               | claude-worker-1 | 2026-02-28 | 2026-02-28   | 10K      | 9K   | PR #553, CI green                                                                                                     |
-| MS21-API-001 | done | phase-1 | AdminModule with user/workspace admin endpoints | #555 | claude-worker-2 | CI: #689 green |
+| MS21-API-001   | done        | phase-1   | AdminModule with user/workspace admin endpoints                                   | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | MS21-TEST-001              | claude-worker-2 | 2026-02-28 | 2026-02-28   | 20K      | 18K  | PR #555, CI green                                                                                                     |
-| MS21-API-002 | done | phase-1 | Admin user endpoints (list, invite, update, deactivate) | #555 | claude-worker-2 | Combined with API-001 |
+| MS21-API-002   | done        | phase-1   | Admin user endpoints (list, invite, update, deactivate)                           | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | MS21-TEST-001              | claude-worker-2 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with API-001                                                                                                 |
-| MS21-API-003 | done | phase-1 | Workspace member management endpoints | #556 | codex-worker-1 | CI: #700 green |
+| MS21-API-003   | done        | phase-1   | Workspace member management endpoints                                             | TASKS:P1 | api   | feat/ms21-workspace-members    | MS21-DB-001                                                 | —                          | codex-worker-1  | 2026-02-28 | 2026-02-28   | 15K      | 14K  | PR #556, CI green                                                                                                     |
-| MS21-API-004 | done | phase-1 | Team management module | #564 | codex-worker-2 | CI: #707 green |
+| MS21-API-004   | done        | phase-1   | Team management module                                                            | TASKS:P1 | api   | feat/ms21-teams                | MS21-DB-001                                                 | —                          | codex-worker-2  | 2026-02-28 | 2026-02-28   | 15K      | 13K  | PR #564, CI green                                                                                                     |
-| MS21-API-005 | done | phase-1 | Admin workspace endpoints | #555 | claude-worker-2 | Combined with API-001 |
+| MS21-API-005   | done        | phase-1   | Admin workspace endpoints                                                         | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | —                          | claude-worker-2 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with API-001                                                                                                 |
-| MS21-TEST-001 | done | phase-1 | Unit tests for AdminService and AdminController | #555 | claude-worker-2 | 26 tests included |
+| MS21-TEST-001  | done        | phase-1   | Unit tests for AdminService and AdminController                                   | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-API-001                                                | —                          | claude-worker-2 | 2026-02-28 | 2026-02-28   | 15K      | —    | PR #555, 26 tests                                                                                                     |
-| MS21-AUTH-001 | done | phase-2 | LocalAuthModule: break-glass auth | #559 | claude-worker-3 | CI: #691 green |
+| MS21-FIX-001   | done        | phase-1   | Fix flaky CI tests (rate limit timeout + log sanitizer)                           | TASKS:P1 | api   | fix/ms21-flaky-ci              | MS21-API-001                                                | —                          | codex-worker-3  | 2026-02-28 | 2026-02-28   | 8K       | 7K   | PR #562, CI green                                                                                                     |
-| MS21-AUTH-002 | done | phase-2 | Break-glass setup endpoint | #559 | claude-worker-3 | Combined with AUTH-001 |
+| MS21-AUTH-001  | done        | phase-2   | LocalAuthModule: break-glass auth                                                 | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-DB-001                                                 | MS21-TEST-002              | claude-worker-3 | 2026-02-28 | 2026-02-28   | 20K      | 19K  | PR #559, CI green                                                                                                     |
-| MS21-AUTH-003 | done | phase-2 | Break-glass login endpoint | #559 | claude-worker-3 | Combined with AUTH-001 |
+| MS21-AUTH-002  | done        | phase-2   | Break-glass setup endpoint                                                        | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with AUTH-001                                                                                                |
-| MS21-AUTH-004 | not-started | phase-2 | Deactivation session invalidation | — | — | Deferred |
+| MS21-AUTH-003  | done        | phase-2   | Break-glass login endpoint                                                        | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with AUTH-001                                                                                                |
-| MS21-TEST-002 | done | phase-2 | Unit tests for LocalAuth | #559 | claude-worker-3 | 27 tests included |
+| MS21-AUTH-004  | not-started | phase-2   | Deactivation session invalidation                                                 | TASKS:P2 | api   | feat/ms21-session-invalidation | MS21-AUTH-001                                               | —                          | —               | —          | —            | 10K      | —    | Deferred; do after Phase 4                                                                                            |
-| MS21-MIG-001 | done | phase-3 | Migration script: scripts/migrate-brain.ts | #554 | codex-worker-1 | CI: #688 (test flaky, code clean) |
+| MS21-TEST-002  | done        | phase-2   | Unit tests for LocalAuth                                                          | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | 15K      | —    | PR #559, 27 tests                                                                                                     |
-| MS21-MIG-002 | done | phase-3 | Migration mapping: status/priority/domain mapping | #554 | codex-worker-1 | Included in MIG-001 |
+| MS21-MIG-001   | done        | phase-3   | Migration script: scripts/migrate-brain.ts                                        | #568     | api   | feat/ms21-migration            | MS21-DB-001                                                 | MS21-MIG-002,MS21-TEST-003 | codex-worker-1  | 2026-02-28 | 2026-02-28   | 25K      | 22K  | PR #554                                                                                                               |
-| MS21-MIG-003 | not-started | phase-3 | Migration execution: run on production database | — | — | Needs deploy |
+| MS21-MIG-002   | done        | phase-3   | Migration mapping: status/priority/domain                                         | #568     | api   | feat/ms21-migration            | MS21-MIG-001                                                | —                          | codex-worker-1  | 2026-02-28 | 2026-02-28   | —        | —    | Included in MIG-001                                                                                                   |
-| MS21-MIG-004 | not-started | phase-3 | Import API endpoints | — | — | |
+| MS21-TEST-003  | done        | phase-3   | Migration script unit tests (9/9 passing)                                         | #568     | api   | test/ms21-migration-tests      | MS21-MIG-001                                                | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | 17K  | PR #566 merged, CI green. Review: 0 blockers, 2 should-fix (brittle harness), 0 sec issues.                           |
-| MS21-TEST-003 | not-started | phase-3 | Migration script tests | — | — | |
+| MS21-MIG-003   | not-started | phase-3   | Run migration on production database                                              | #568     | api   | —                              | MS21-MIG-001,MS21-TEST-003                                  | MS21-VER-001               | —               | —          | —            | 5K       | —    | Needs deploy coordination; not automatable                                                                            |
-| MS21-UI-001 | not-started | phase-4 | Settings/users page | — | — | |
+| MS21-MIG-004   | done        | phase-3   | Import API endpoints (6/6 tests)                                                  | #568     | api   | feat/ms21-import-api           | MS21-DB-001                                                 | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | 24K  | PR #567 merged, CI green. Review: 0 blockers, 4 should-fix, 1 medium sec (no audit log).                              |
-| MS21-UI-002 | not-started | phase-4 | User detail/edit and invite dialogs | — | — | |
+| MS21-UI-001    | done        | phase-4   | Settings/users page                                                               | #569     | web   | feat/ms21-ui-users             | MS21-API-001,MS21-API-002                                   | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | ~30K | PR #573 merged. Review: 0 blockers, 4 should-fix → MS21-UI-001-QA                                                     |
-| MS21-UI-003 | not-started | phase-4 | Settings/workspaces page (wire to real API) | — | — | Mock data exists |
+| MS21-UI-001-QA | done        | phase-4   | QA: fix 4 review findings (pagination, error state, self-deactivate guard, tests) | #569     | web   | fix/ms21-ui-001-qa             | MS21-UI-001                                                 | —                          | —               | —          | —            | 15K      | —    | 0 blockers; merged per framework. Should-fix: pagination cap, error/empty collision, self-deactivate guard, no tests. |
-| MS21-UI-004 | not-started | phase-4 | Workspace member management UI | — | — | Components exist |
+| MS21-UI-002    | done        | phase-4   | User detail/edit and invite dialogs                                               | #569     | web   | feat/ms21-ui-users             | MS21-UI-001                                                 | —                          | —               | —          | —            | 15K      | —    |                                                                                                                       |
-| MS21-UI-005 | not-started | phase-4 | Settings/teams page | — | — | |
+| MS21-UI-003    | done        | phase-4   | Settings/workspaces page (wire to real API)                                       | #569     | web   | feat/ms21-ui-workspaces        | MS21-API-003                                                | —                          | codex           | 2026-02-28 | 2026-02-28   | 15K      | ~25K | PR #574 merged. Review: 0 critical, 1 low (raw errors in UI)                                                          |
-| MS21-TEST-004 | not-started | phase-4 | Frontend component tests | — | — | |
+| MS21-UI-004    | done        | phase-4   | Workspace member management UI                                                    | #569     | web   | feat/ms21-ui-workspaces        | MS21-UI-003,MS21-API-003                                    | —                          | —               | —          | —            | 15K      | —    | Components exist                                                                                                      |
-| MS21-RBAC-001 | not-started | phase-5 | Sidebar navigation role gating | — | — | |
+| MS21-UI-005    | done        | phase-4   | Settings/teams page                                                               | #569     | web   | feat/ms21-ui-teams             | MS21-API-004                                                | —                          | —               | —          | —            | 15K      | —    |                                                                                                                       |
-| MS21-RBAC-002 | not-started | phase-5 | Settings page access restriction | — | — | |
+| MS21-TEST-004  | done        | phase-4   | Frontend component tests                                                          | #569     | web   | test/ms21-ui                   | MS21-UI-001,MS21-UI-002,MS21-UI-003,MS21-UI-004,MS21-UI-005 | —                          | —               | —          | —            | 20K      | —    |                                                                                                                       |
-| MS21-RBAC-003 | not-started | phase-5 | Action button permission gating | — | — | |
+| MS21-RBAC-001  | done        | phase-5   | Sidebar navigation role gating                                                    | #570     | web   | feat/ms21-rbac                 | MS21-UI-001                                                 | —                          | —               | —          | —            | 10K      | —    |                                                                                                                       |
-| MS21-RBAC-004 | not-started | phase-5 | User profile role display | — | — | |
+| MS21-RBAC-002  | done        | phase-5   | Settings page access restriction                                                  | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 8K       | —    |                                                                                                                       |
-| MS21-VER-001 | not-started | phase-6 | Full quality gate pass | — | — | |
+| MS21-RBAC-003  | done        | phase-5   | Action button permission gating                                                   | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 8K       | —    |                                                                                                                       |
-| MS21-VER-002 | not-started | phase-6 | Deploy and smoke test | — | — | |
+| MS21-RBAC-004  | done        | phase-5   | User profile role display                                                         | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 5K       | —    |                                                                                                                       |
-| MS21-VER-003 | not-started | phase-6 | Tag v0.0.21 | — | — | |
+| MS21-VER-001   | done        | phase-6   | Full quality gate pass                                                            | #571     | stack | —                              | MS21-TEST-004,MS21-RBAC-004,MS21-MIG-003                    | MS21-VER-002               | —               | —          | —            | 5K       | —    |                                                                                                                       |
-| MS21-FIX-001 | done | phase-1 | Fix flaky CI tests (rate limit timeout + log sanitizer) | #562 | codex-worker-3 | CI: #705 green |
+| MS21-VER-002   | done        | phase-6   | Deploy and smoke test                                                             | #571     | stack | —                              | MS21-VER-001                                                | MS21-VER-003               | —               | —          | —            | 5K       | —    |                                                                                                                       |
+| MS21-VER-003   | done        | phase-6   | Tag v0.0.21                                                                       | #571     | stack | —                              | MS21-VER-002                                                | —                          | —               | —          | —            | 2K       | —    |                                                                                                                       |
+
+## Budget Summary
+
+| Phase                  | Tasks  | Done   | Estimate  | Used      |
+| ---------------------- | ------ | ------ | --------- | --------- |
+| Phase 1 (Schema + API) | 9      | 9      | ~113K     | ~93K      |
+| Phase 2 (Auth)         | 4      | 3      | ~45K      | ~19K      |
+| Phase 3 (Migration)    | 5      | 3      | ~70K      | ~63K      |
+| Phase 4 (UI)           | 6      | 0      | ~100K     | —         |
+| Phase 5 (RBAC)         | 4      | 0      | ~31K      | —         |
+| Phase 6 (Verification) | 3      | 0      | ~12K      | —         |
+| **Total**              | **31** | **15** | **~371K** | **~175K** |
+
+Remaining estimate: ~143K tokens (Codex budget).
+
+## MS22 — Fleet Evolution (Phase 0: Knowledge Layer)
+
+| id              | status | milestone    | description                                                  | issue    | repo  | branch                         | depends_on                                                | blocks        | agent        | started_at | completed_at | estimate | used | notes                                         |
+| --------------- | ------ | ------------ | ------------------------------------------------------------ | -------- | ----- | ------------------------------ | --------------------------------------------------------- | ------------- | ------------ | ---------- | ------------ | -------- | ---- | --------------------------------------------- |
+| MS22-PLAN-001   | done   | p0-knowledge | PRD + mission bootstrap + TASKS.md                           | TASKS:P0 | stack | feat/ms22-knowledge-schema     | —                                                         | MS22-DB-001   | orchestrator | 2026-02-28 | 2026-02-28   | 10K      | 8K   | PRD-MS22.md, mission fleet-evolution-20260228 |
+| MS22-DB-001     | done   | p0-knowledge | Findings module (pgvector, CRUD, similarity search)          | TASKS:P0 | api   | feat/ms22-findings             | MS22-PLAN-001                                             | —             | codex        | 2026-02-28 | 2026-02-28   | 20K      | ~22K | PR #585 merged, CI green                      |
+| MS22-API-001    | done   | p0-knowledge | Findings API endpoints                                       | TASKS:P0 | api   | feat/ms22-findings             | MS22-DB-001                                               | —             | codex        | 2026-02-28 | 2026-02-28   | —        | —    | Combined with DB-001                          |
+| MS22-DB-002     | done   | p0-knowledge | AgentMemory module (key/value store, upsert)                 | TASKS:P0 | api   | feat/ms22-agent-memory         | MS22-DB-001                                               | —             | codex        | 2026-02-28 | 2026-02-28   | 15K      | ~16K | PR #586 merged, CI green                      |
+| MS22-API-002    | done   | p0-knowledge | AgentMemory API endpoints                                    | TASKS:P0 | api   | feat/ms22-agent-memory         | MS22-DB-002                                               | —             | codex        | 2026-02-28 | 2026-02-28   | —        | —    | Combined with DB-002                          |
+| MS22-DB-004     | done   | p0-knowledge | ConversationArchive module (pgvector, ingest, search)        | TASKS:P0 | api   | feat/ms22-conversation-archive | MS22-DB-001                                               | —             | codex        | 2026-02-28 | 2026-02-28   | 20K      | ~18K | PR #587 merged, CI green                      |
+| MS22-API-004    | done   | p0-knowledge | ConversationArchive API endpoints                            | TASKS:P0 | api   | feat/ms22-conversation-archive | MS22-DB-004                                               | —             | codex        | 2026-02-28 | 2026-02-28   | —        | —    | Combined with DB-004                          |
+| MS22-API-005    | done   | p0-knowledge | EmbeddingService (reuse existing KnowledgeModule)            | TASKS:P0 | api   | —                              | —                                                         | —             | orchestrator | 2026-02-28 | 2026-02-28   | 0        | 0    | Already existed; no work needed               |
+| MS22-DB-003     | done   | p0-knowledge | Task model: add assigned_agent field + migration             | TASKS:P0 | api   | feat/ms22-task-agent           | MS22-DB-001                                               | MS22-API-003  | —            | —          | —            | 8K       | —    | Small schema + migration only                 |
+| MS22-API-003    | done   | p0-knowledge | Task API: expose assigned_agent in CRUD                      | TASKS:P0 | api   | feat/ms22-task-agent           | MS22-DB-003                                               | MS22-TEST-001 | —            | —          | —            | 8K       | —    | Extend existing TaskModule                    |
+| MS22-TEST-001   | done   | p0-knowledge | Integration tests: Findings + AgentMemory + ConvArchive      | TASKS:P0 | api   | test/ms22-integration          | MS22-API-001,MS22-API-002,MS22-API-004                    | MS22-VER-P0   | —            | —          | —            | 20K      | —    | E2E with live postgres                        |
+| MS22-SKILL-001  | done   | p0-knowledge | OpenClaw mosaic skill (agents read/write findings/memory)    | TASKS:P0 | stack | feat/ms22-openclaw-skill       | MS22-API-001,MS22-API-002                                 | MS22-VER-P0   | —            | —          | —            | 15K      | —    | Skill in ~/.agents/skills/mosaic/             |
+| MS22-INGEST-001 | done   | p0-knowledge | Session log ingestion pipeline (OpenClaw logs → ConvArchive) | TASKS:P0 | stack | feat/ms22-ingest               | MS22-API-004                                              | MS22-VER-P0   | —            | —          | —            | 20K      | —    | Script to batch-ingest existing logs          |
+| MS22-VER-P0     | done   | p0-knowledge | Phase 0 verification: all modules deployed + smoke tested    | TASKS:P0 | stack | —                              | MS22-TEST-001,MS22-SKILL-001,MS22-INGEST-001,MS22-API-003 | —             | —            | —          | —            | 5K       | —    |                                               |
+
+## MS22 Phase 1: DB-Centric Agent Fleet (reworked)
+
+Design doc: `docs/design/MS22-DB-CENTRIC-ARCHITECTURE.md`
+
+| Task ID  | Status      | Phase    | Description                                                                                                           | Issue | Scope   | Branch                       | Depends On | Blocks          | Assigned Worker | Started | Completed | Est Tokens | Act Tokens | Notes |
+| -------- | ----------- | -------- | --------------------------------------------------------------------------------------------------------------------- | ----- | ------- | ---------------------------- | ---------- | --------------- | --------------- | ------- | --------- | ---------- | ---------- | ----- |
+| MS22-P1a | done        | phase-1a | Prisma schema: SystemConfig, BreakglassUser, LlmProvider, UserContainer, SystemContainer, UserAgentConfig + migration | —     | api     | feat/ms22-p1a-schema         | —          | P1b,P1c,P1d,P1e | —               | —       | —         | 20K        | —          |       |
+| MS22-P1b | done        | phase-1b | Encryption service (AES-256-GCM) for API keys and tokens                                                              | —     | api     | feat/ms22-p1b-crypto         | —          | P1c,P1e,P1g     | —               | —       | —         | 15K        | —          |       |
+| MS22-P1c | not-started | phase-1c | Internal config endpoint: assemble openclaw.json from DB                                                              | —     | api     | feat/ms22-p1c-config-api     | P1a,P1b    | P1i,P1j         | —               | —       | —         | 20K        | —          |       |
+| MS22-P1d | not-started | phase-1d | ContainerLifecycleService: Docker API (dockerode) start/stop/health/reap                                              | —     | api     | feat/ms22-p1d-container-mgr  | P1a        | P1i,P1k         | —               | —       | —         | 25K        | —          |       |
+| MS22-P1e | not-started | phase-1e | Onboarding API: breakglass, OIDC, provider, agents, complete                                                          | —     | api     | feat/ms22-p1e-onboarding-api | P1a,P1b    | P1f             | —               | —       | —         | 20K        | —          |       |
+| MS22-P1f | not-started | phase-1f | Onboarding wizard WebUI (multi-step form)                                                                             | —     | web     | feat/ms22-p1f-onboarding-ui  | P1e        | —               | —               | —       | —         | 25K        | —          |       |
+| MS22-P1g | not-started | phase-1g | Settings API: CRUD providers, agent config, OIDC, breakglass                                                          | —     | api     | feat/ms22-p1g-settings-api   | P1a,P1b    | P1h             | —               | —       | —         | 20K        | —          |       |
+| MS22-P1h | not-started | phase-1h | Settings UI: Providers, Agent Config, Auth pages                                                                      | —     | web     | feat/ms22-p1h-settings-ui    | P1g        | —               | —               | —       | —         | 25K        | —          |       |
+| MS22-P1i | not-started | phase-1i | Chat proxy: route WebUI chat to user's OpenClaw container (SSE)                                                       | —     | api+web | feat/ms22-p1i-chat-proxy     | P1c,P1d    | —               | —               | —       | —         | 20K        | —          |       |
+| MS22-P1j | not-started | phase-1j | Docker entrypoint + health checks + core compose                                                                      | —     | docker  | feat/ms22-p1j-docker         | P1c        | —               | —               | —       | —         | 10K        | —          |       |
+| MS22-P1k | not-started | phase-1k | Idle reaper cron: stop inactive user containers                                                                       | —     | api     | feat/ms22-p1k-idle-reaper    | P1d        | —               | —               | —       | —         | 10K        | —          |       |

docs/design/MS22-DB-CENTRIC-ARCHITECTURE.md

@@ -0,0 +1,413 @@
+# MS22 Phase 1: DB-Centric Multi-User Agent Architecture
+
+## Design Principles
+
+1. **2 env vars to bootstrap** — `DATABASE_URL` + `MOSAIC_SECRET_KEY`
+2. **DB-centric config** — All runtime config in Postgres, managed via WebUI
+3. **Mosaic is the gatekeeper** — Users authenticate to Mosaic, never to OpenClaw directly
+4. **Per-user agent isolation** — Each user gets their own OpenClaw container(s) with their own credentials
+5. **Onboarding-first** — Breakglass user + wizard on first boot
+6. **Generic product** — No hardcoded names, models, providers, or endpoints
+
+## Architecture Overview
+
+```
+┌─────────────────────────────────────────────────────┐
+│                    MOSAIC WEBUI                      │
+│  (Auth: breakglass local + OIDC via settings)       │
+└──────────────────────┬──────────────────────────────┘
+                       │
+                       ▼
+┌─────────────────────────────────────────────────────┐
+│                    MOSAIC API                        │
+│                                                     │
+│  ┌──────────────┐  ┌────────────────┐  ┌─────────┐ │
+│  │ Onboarding   │  │ Container      │  │ Config  │ │
+│  │ Wizard       │  │ Lifecycle Mgr  │  │ Store   │ │
+│  └──────────────┘  └───────┬────────┘  └─────────┘ │
+│                            │                        │
+└────────────────────────────┼────────────────────────┘
+                             │ Docker API
+          ┌──────────────────┼──────────────────┐
+          │                  │                  │
+          ▼                  ▼                  ▼
+   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
+   │  OpenClaw   │   │  OpenClaw   │   │  OpenClaw   │
+   │  User A     │   │  User B     │   │  System     │
+   │             │   │             │   │  (admin)    │
+   │ Claude Max  │   │ Z.ai key   │   │ Shared key  │
+   │ own memory  │   │ own memory  │   │ monitoring  │
+   └─────────────┘   └─────────────┘   └─────────────┘
+    Scale to zero      Scale to zero     Always on
+    after idle         after idle
+```
+
+## Container Lifecycle
+
+### User containers (on-demand)
+
+1. User logs in → Mosaic checks `UserContainer` table
+2. No running container → Mosaic calls Docker API to create one
+3. Injects user's encrypted API keys via config endpoint
+4. Routes chat requests to user's container
+5. Idle timeout (configurable, default 30min) → scale to zero
+6. State volume persists (sessions, memory, auth tokens)
+7. Next request → container restarts, picks up state from volume
+
+### System containers (always-on, optional)
+
+- Admin-provisioned for system tasks (monitoring, scheduled jobs)
+- Use admin-configured shared API keys
+- Not tied to any user
+
+## Auth Layers
+
+| Flow                            | Method                                                                 |
+| ------------------------------- | ---------------------------------------------------------------------- |
+| User → Mosaic WebUI             | Breakglass (local) or OIDC (configured in settings)                    |
+| Mosaic API → OpenClaw container | Bearer token (auto-generated per container, stored encrypted in DB)    |
+| OpenClaw → LLM providers        | User's own API keys (delivered via config endpoint, decrypted from DB) |
+| Admin → System settings         | RBAC (admin role required)                                             |
+| Internal config endpoint        | Bearer token (container authenticates to fetch its config)             |
+
+## Database Schema
+
+### System Tables
+
+```prisma
+model SystemConfig {
+  id        String   @id @default(cuid())
+  key       String   @unique  // "oidc.issuerUrl", "oidc.clientId", "onboarding.completed"
+  value     String             // plaintext or encrypted (prefix: "enc:")
+  encrypted Boolean  @default(false)
+  updatedAt DateTime @updatedAt
+}
+
+model BreakglassUser {
+  id           String   @id @default(cuid())
+  username     String   @unique
+  passwordHash String   // bcrypt
+  isActive     Boolean  @default(true)
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+}
+```
+
+### Provider Tables (per-user)
+
+```prisma
+model LlmProvider {
+  id          String   @id @default(cuid())
+  userId      String             // owner — each user manages their own providers
+  name        String             // "my-zai", "work-openai", "local-ollama"
+  displayName String             // "Z.ai", "OpenAI (Work)", "Local Ollama"
+  type        String             // "zai" | "openai" | "anthropic" | "ollama" | "custom"
+  baseUrl     String?            // null for built-in, URL for custom/ollama
+  apiKey      String?            // encrypted
+  apiType     String   @default("openai-completions")
+  models      Json     @default("[]")  // [{id, name, contextWindow, maxTokens}]
+  isActive    Boolean  @default(true)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@unique([userId, name])
+}
+```
+
+### Container Tables
+
+```prisma
+model UserContainer {
+  id              String    @id @default(cuid())
+  userId          String    @unique
+  containerId     String?   // Docker container ID (null = not running)
+  containerName   String    // "mosaic-user-{userId}"
+  gatewayPort     Int?      // assigned port (null = not running)
+  gatewayToken    String    // encrypted — auto-generated
+  status          String    @default("stopped")  // "running" | "stopped" | "starting" | "error"
+  lastActiveAt    DateTime?
+  idleTimeoutMin  Int       @default(30)
+  config          Json      @default("{}")  // cached openclaw.json for this user
+  createdAt       DateTime  @default(now())
+  updatedAt       DateTime  @updatedAt
+}
+
+model SystemContainer {
+  id              String   @id @default(cuid())
+  name            String   @unique  // "mosaic-system-ops", "mosaic-system-monitor"
+  role            String   // "operations" | "monitor" | "scheduler"
+  containerId     String?
+  gatewayPort     Int?
+  gatewayToken    String   // encrypted
+  status          String   @default("stopped")
+  providerId      String?  // references admin-level LlmProvider
+  primaryModel    String   // "zai/glm-5", etc.
+  isActive        Boolean  @default(true)
+  createdAt       DateTime @default(now())
+  updatedAt       DateTime @updatedAt
+}
+```
+
+### User Agent Preferences
+
+```prisma
+model UserAgentConfig {
+  id             String  @id @default(cuid())
+  userId         String  @unique
+  primaryModel   String?           // user's preferred model
+  fallbackModels Json    @default("[]")
+  personality    String?           // custom SOUL.md content
+  providerId     String?           // default provider for this user
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}
+```
+
+## Internal Config Endpoint
+
+`GET /api/internal/agent-config/:containerType/:id`
+
+- Auth: Bearer token (container's own gateway token)
+- Returns: Complete `openclaw.json` generated from DB
+- For user containers: includes user's providers, model prefs, personality
+- For system containers: includes admin provider config
+
+Response assembles openclaw.json dynamically:
+
+```json
+{
+  "gateway": { "mode": "local", "port": 18789, "bind": "lan", "auth": { "mode": "token" } ... },
+  "agents": { "defaults": { "model": { "primary": "<from UserAgentConfig>" } } },
+  "models": { "providers": { "<from LlmProvider rows>": { ... } } }
+}
+```
+
+## Container Lifecycle Manager
+
+NestJS service that manages Docker containers:
+
+```typescript
+class ContainerLifecycleService {
+  // Create and start a user's OpenClaw container
+  async ensureRunning(userId: string): Promise<{ url: string; token: string }>;
+
+  // Stop idle containers (called by cron/scheduler)
+  async reapIdle(): Promise<number>;
+
+  // Stop a specific user's container
+  async stop(userId: string): Promise<void>;
+
+  // Health check all running containers
+  async healthCheckAll(): Promise<HealthStatus[]>;
+
+  // Restart container with updated config
+  async restart(userId: string): Promise<void>;
+}
+```
+
+Uses Docker Engine API (`/var/run/docker.sock` or TCP) via `dockerode` npm package.
+
+## Onboarding Wizard
+
+### First-Boot Detection
+
+- API checks: `SystemConfig.get("onboarding.completed")` → null = first boot
+- WebUI redirects to `/onboarding` if not completed
+
+### Steps
+
+**Step 1: Create Breakglass Admin**
+
+- Username + password → bcrypt → `BreakglassUser` table
+- This user always works, even if OIDC is misconfigured
+
+**Step 2: Configure Authentication (optional)**
+
+- OIDC: provider URL, client ID, client secret → encrypted in `SystemConfig`
+- Skip = breakglass-only auth (can add OIDC later in settings)
+
+**Step 3: Add Your First LLM Provider**
+
+- Pick type → enter API key/endpoint → test connection → save to `LlmProvider`
+- This becomes the admin's default provider
+
+**Step 4: System Agents (optional)**
+
+- Configure always-on system agents for monitoring/ops
+- Or skip — users can just use their own personal agents
+
+**Step 5: Complete**
+
+- Sets `SystemConfig("onboarding.completed") = true`
+- Redirects to dashboard
+
+### Post-Onboarding: User Self-Service
+
+- Each user adds their own LLM providers in profile settings
+- Each user configures their preferred model, personality
+- First chat request triggers container creation
+
+## Docker Compose (final)
+
+```yaml
+services:
+  mosaic-api:
+    image: mosaic/api:latest
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+      MOSAIC_SECRET_KEY: ${MOSAIC_SECRET_KEY}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # Docker API access
+    networks:
+      - internal
+
+  mosaic-web:
+    image: mosaic/web:latest
+    environment:
+      NEXT_PUBLIC_API_URL: http://mosaic-api:4000
+    networks:
+      - internal
+
+  postgres:
+    image: postgres:17
+    environment:
+      POSTGRES_DB: mosaic
+      POSTGRES_USER: mosaic
+      POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    networks:
+      - internal
+
+  # System agent (optional, admin-provisioned)
+  # mosaic-system:
+  #   image: alpine/openclaw:latest
+  #   ... (managed by ContainerLifecycleService)
+
+  # User containers are NOT in this file —
+  # they are dynamically created by ContainerLifecycleService
+  # via the Docker API at runtime.
+
+networks:
+  internal:
+    driver: overlay
+
+volumes:
+  postgres-data:
+```
+
+Note: User OpenClaw containers are **not** defined in docker-compose. They are
+created dynamically by the `ContainerLifecycleService` when users start chatting.
+
+## Entrypoint (for dynamically created containers)
+
+```sh
+#!/bin/sh
+set -e
+: "${MOSAIC_API_URL:?required}"
+: "${AGENT_TOKEN:?required}"
+: "${AGENT_ID:?required}"
+
+# Fetch config from Mosaic API
+curl -sf "${MOSAIC_API_URL}/api/internal/agent-config/${AGENT_ID}" \
+  -H "Authorization: Bearer ${AGENT_TOKEN}" \
+  -o /tmp/openclaw.json
+
+export OPENCLAW_CONFIG_PATH=/tmp/openclaw.json
+exec openclaw gateway run --bind lan --auth token
+```
+
+Container env vars (injected by ContainerLifecycleService):
+
+- `MOSAIC_API_URL` — internal API URL
+- `AGENT_TOKEN` — this container's bearer token (from DB)
+- `AGENT_ID` — container ID for config lookup
+
+## Config Update Strategy
+
+When a user changes settings (model, provider, personality):
+
+1. Mosaic API updates DB
+2. API calls `ContainerLifecycleService.restart(userId)`
+3. Container restarts, fetches fresh config from API
+4. OpenClaw gateway starts with new config
+5. State volume preserves sessions/memory across restarts
+
+## Task Breakdown
+
+| Task     | Phase          | Scope                                                                                                                 | Dependencies |
+| -------- | -------------- | --------------------------------------------------------------------------------------------------------------------- | ------------ |
+| MS22-P1a | Schema         | Prisma models: SystemConfig, BreakglassUser, LlmProvider, UserContainer, SystemContainer, UserAgentConfig. Migration. | —            |
+| MS22-P1b | Crypto         | Encryption service for API keys/tokens (AES-256-GCM using MOSAIC_SECRET_KEY)                                          | P1a          |
+| MS22-P1c | Config API     | Internal config endpoint: assembles openclaw.json from DB                                                             | P1a, P1b     |
+| MS22-P1d | Container Mgr  | ContainerLifecycleService: Docker API integration (dockerode), start/stop/health/reap                                 | P1a          |
+| MS22-P1e | Onboarding API | Onboarding endpoints: breakglass, OIDC, provider, complete                                                            | P1a, P1b     |
+| MS22-P1f | Onboarding UI  | Multi-step wizard in WebUI                                                                                            | P1e          |
+| MS22-P1g | Settings API   | CRUD: providers, agent config, OIDC, breakglass                                                                       | P1a, P1b     |
+| MS22-P1h | Settings UI    | Settings pages: Providers, Agent Config, Auth                                                                         | P1g          |
+| MS22-P1i | Chat Proxy     | Route WebUI chat → user's OpenClaw container (SSE)                                                                    | P1c, P1d     |
+| MS22-P1j | Docker         | Entrypoint script, health checks, compose for core services                                                           | P1c          |
+| MS22-P1k | Idle Reaper    | Cron service to stop idle user containers                                                                             | P1d          |
+
+## Open Questions (Resolved)
+
+1. ~~Config updates → restart?~~ **Yes.** Mosaic restarts the container, fresh config on boot.
+2. ~~CLI alternative for breakglass?~~ **Yes.** Both WebUI wizard and CLI (`mosaic admin create-breakglass`).
+3. ~~Config cache TTL?~~ **Yes.** Config fetched once at startup, changes trigger restart.
+
+## Security Isolation Model
+
+### Core Principle: ZERO cross-user access
+
+Every user is fully sandboxed. No exceptions.
+
+### Container Isolation
+
+- Each user gets their **own** OpenClaw container (separate process, PID namespace)
+- Each container has its **own** Docker volume (sessions, memory, workspace)
+- Containers run on an **internal-only** Docker network — no external exposure
+- Users NEVER talk to OpenClaw directly — Mosaic proxies all requests
+- Container gateway tokens are unique per-user and single-purpose
+
+### Data Isolation (enforced at API + DB level)
+
+| Data             | Isolation                 | Enforcement                                                                       |
+| ---------------- | ------------------------- | --------------------------------------------------------------------------------- |
+| LLM API keys     | Per-user, encrypted       | `LlmProvider.userId` — all queries scoped by authenticated user                   |
+| Chat history     | Per-user container volume | Separate Docker volume per user, not shared                                       |
+| Agent memory     | Per-user container volume | Separate Docker volume per user                                                   |
+| Agent config     | Per-user                  | `UserAgentConfig.userId` — scoped queries                                         |
+| Container access | Per-user                  | `UserContainer.userId` — Mosaic validates user owns the container before proxying |
+
+### API Enforcement
+
+- **All user-facing endpoints** include `WHERE userId = authenticatedUser.id`
+- **No admin endpoint** exposes another user's API keys (even to admins)
+- **Chat proxy** validates: authenticated user → owns target container → forwards request
+- **Config endpoint** validates: container token matches the container requesting config
+- **Provider CRUD** is fully user-scoped — User A cannot list, read, or modify User B's providers
+
+### What admins CAN see
+
+- Container status (running/stopped) — not contents
+- User list and roles
+- System-level config (OIDC, system agents)
+- Aggregate usage metrics (not individual conversations)
+
+### What admins CANNOT see
+
+- Other users' API keys (encrypted, no decrypt endpoint)
+- Other users' chat history (in container volumes, not in Mosaic DB)
+- Other users' agent memory/workspace contents
+
+### Future: Team Workspaces (NOT in scope)
+
+Team/shared workspaces are a potential future feature where users opt-in to
+shared agent contexts. This requires explicit consent, shared-key management,
+and a different isolation model. **Not designed here. Not built now.**
+
+### Attack Surface Notes
+
+- Docker socket access (`/var/run/docker.sock`) is required by Mosaic API for container management. This is a privileged operation — the Mosaic API container must be trusted.
+- `MOSAIC_SECRET_KEY` is the root of trust for encryption. Rotation requires re-encrypting all secrets in DB.
+- Container-to-container communication is blocked by default (no shared network between user containers unless explicitly configured).

docs/scratchpads/ms21-multi-tenant-rbac-data-migration-20260228.md

@@ -47,3 +47,19 @@ USC employees.
 ## Corrections
 
 (none yet)
+| S2 | 2026-02-28 | Phase 3 | MS21-TEST-003, MS21-MIG-004 | PRs #566 and #567 merged, CI green. Post-coding reviews run (0 blockers both). |
+
+## E2E Compliance — Session 2 Remediation (2026-02-28)
+
+Identified and corrected gaps from session 1:
+
+- Phase issues created: #568 (P3), #569 (P4), #570 (P5), #571 (P6)
+- TASKS.md schema updated with all required columns (depends_on, blocks, estimate, used, started_at, completed_at, issue, branch)
+- MS21-TEST-003 and MS21-MIG-004 correctly marked `done` with PR/CI evidence
+- Post-coding reviews confirmed: 0 blockers on both tasks
+- CI verified green: f99107f (head of main after both merges)
+
+### Review Evidence
+
+- MS21-TEST-003: code review verdict=request-changes, 0 blockers, 2 should-fix (brittle harness), security=none
+- MS21-MIG-004: code review verdict=request-changes, 0 blockers, 4 should-fix (race conditions, validation gaps), security=medium (no audit logging — not blocking)

docs/scratchpads/ms22-agent-memory.md

@@ -0,0 +1,64 @@
+# MS22 Agent Memory Module
+
+## Objective
+
+Add per-agent key/value store: AgentMemory model + NestJS module with CRUD endpoints.
+
+## Issues
+
+- MS22-DB-002: Add AgentMemory schema model
+- MS22-API-002: Add agent-memory NestJS module
+
+## Plan
+
+1. AgentMemory model → schema.prisma (after AgentSession, line 736)
+2. Add `agentMemories AgentMemory[]` relation to Workspace model
+3. Create apps/api/src/agent-memory/ with service, controller, DTOs, specs
+4. Register in app.module.ts
+5. Migrate: `prisma migrate dev --name ms22_agent_memory`
+6. lint + build
+7. Commit
+
+## Endpoints
+
+- PUT /api/agents/:agentId/memory/:key (upsert)
+- GET /api/agents/:agentId/memory (list all)
+- GET /api/agents/:agentId/memory/:key (get one)
+- DELETE /api/agents/:agentId/memory/:key (remove)
+
+## Auth
+
+- @UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+- @Workspace() decorator for workspaceId
+- Permission.WORKSPACE_MEMBER for write ops
+- Permission.WORKSPACE_ANY for read ops
+
+## Schema
+
+```prisma
+model AgentMemory {
+  id          String   @id @default(uuid()) @db.Uuid
+  workspaceId String   @map("workspace_id") @db.Uuid
+  agentId     String   @map("agent_id")
+  key         String
+  value       Json
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+
+  @@unique([workspaceId, agentId, key])
+  @@index([workspaceId])
+  @@index([agentId])
+  @@map("agent_memories")
+}
+```
+
+## Progress
+
+- [ ] Schema
+- [ ] Module files
+- [ ] app.module.ts
+- [ ] Migration
+- [ ] lint/build
+- [ ] Commit

docs/scratchpads/ms22-conversation-archive.md

@@ -0,0 +1,48 @@
+# MS22 — Conversation Archive Module
+
+## Objective
+
+Implement ConversationArchive module: ingest OpenClaw session logs, store with vector embeddings for semantic search.
+
+## Deliverables
+
+1. ConversationArchive Prisma model
+2. NestJS module at apps/api/src/conversation-archive/
+3. Endpoints: ingest, search, list, get-by-id
+4. Register in app.module.ts
+5. Migrate, lint, build, commit
+
+## Plan
+
+- Add model to schema.prisma (end of file)
+- Add relation to Workspace model
+- Create module structure: dto/, service, controller, spec, module
+- Use EmbeddingService from knowledge module (import KnowledgeModule or just PrismaModule + embed inline)
+- Follow pattern: AuthGuard + WorkspaceGuard + PermissionGuard
+- Endpoint prefix: conversations (maps to /api/conversations)
+- Vector search: $queryRaw with <=> operator (cosine distance)
+
+## Assumptions
+
+- ASSUMPTION: Embedding is stored inline on ConversationArchive (not a separate table) — simpler and sufficient for this use case, matches MemoryEmbedding pattern
+- ASSUMPTION: Import KnowledgeModule to reuse EmbeddingService (it exports it)
+- ASSUMPTION: messageCount computed server-side from messages array length on ingest
+- ASSUMPTION: Permission level WORKSPACE_MEMBER for ingest/search, WORKSPACE_ANY for list/get
+
+## Progress
+
+- [ ] Schema model
+- [ ] Migration
+- [ ] DTOs
+- [ ] Service
+- [ ] Controller
+- [ ] Spec
+- [ ] Module
+- [ ] app.module.ts registration
+- [ ] Lint + build
+- [ ] Commit
+
+## Risks
+
+- EmbeddingService exports from knowledge.module — need to import KnowledgeModule
+- Migration requires live DB (may need --skip-generate flag if no DB access)

package.json

@@ -35,7 +35,8 @@
     "docker:ps": "docker compose ps",
     "docker:build": "docker compose build",
     "docker:restart": "docker compose restart",
-    "prepare": "husky || true"
+    "prepare": "husky || true",
+    "ingest:sessions": "tsx scripts/ingest-openclaw-sessions.ts"
   },
   "devDependencies": {
     "@typescript-eslint/eslint-plugin": "^8.26.0",
@@ -74,7 +75,8 @@
       "tough-cookie": ">=4.1.3",
       "undici": ">=6.23.0",
       "rollup": ">=4.59.0",
-      "serialize-javascript": ">=7.0.3"
+      "serialize-javascript": ">=7.0.3",
+      "multer": ">=2.1.0"
     }
   }
 }

pnpm-lock.yaml

@@ -17,6 +17,7 @@ overrides:
   undici: '>=6.23.0'
   rollup: '>=4.59.0'
   serialize-javascript: '>=7.0.3'
+  multer: '>=2.1.0'
 
 importers:
 
@@ -1603,6 +1604,7 @@ packages:
 
   '@mosaicstack/telemetry-client@0.1.1':
     resolution: {integrity: sha512-1udg6p4cs8rhQgQ2pKCfi7EpRlJieRRhA5CIqthRQ6HQZLgQ0wH+632jEulov3rlHSM1iplIQ+AAe5DWrvSkEA==, tarball: https://git.mosaicstack.dev/api/packages/mosaic/npm/%40mosaicstack%2Ftelemetry-client/-/0.1.1/telemetry-client-0.1.1.tgz}
+    engines: {node: '>=18'}
 
   '@mrleebo/prisma-ast@0.13.1':
     resolution: {integrity: sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==}
@@ -5805,10 +5807,6 @@ packages:
   mkdirp-classic@0.5.3:
     resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==}
 
-  mkdirp@0.5.6:
-    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
-    hasBin: true
-
   mkdirp@3.0.1:
     resolution: {integrity: sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==}
     engines: {node: '>=10'}
@@ -5837,8 +5835,8 @@ packages:
   msgpackr@1.11.5:
     resolution: {integrity: sha512-UjkUHN0yqp9RWKy0Lplhh+wlpdt9oQBYgULZOiFhV3VclSF1JnSQWZ5r9gORQlNYaUKQoR8itv7g7z1xDDuACA==}
 
-  multer@2.0.2:
+  multer@2.1.0:
-    resolution: {integrity: sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==}
+    resolution: {integrity: sha512-TBm6j41rxNohqawsxlsWsNNh/VdV4QFXcBvRcPhXaA05EZ79z0qJ2bQFpync6JBoHTeNY5Q1JpG7AlTjdlfAEA==}
     engines: {node: '>= 10.16.0'}
 
   mute-stream@2.0.0:
@@ -8842,7 +8840,7 @@ snapshots:
       '@nestjs/core': 11.1.12(@nestjs/common@11.1.12(class-transformer@0.5.1)(class-validator@0.14.3)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/platform-express@11.1.12)(@nestjs/websockets@11.1.12)(reflect-metadata@0.2.2)(rxjs@7.8.2)
       cors: 2.8.5
       express: 5.2.1
-      multer: 2.0.2
+      multer: 2.1.0
       path-to-regexp: 8.3.0
       tslib: 2.8.1
     transitivePeerDependencies:
@@ -13391,10 +13389,6 @@ snapshots:
 
   mkdirp-classic@0.5.3: {}
 
-  mkdirp@0.5.6:
-    dependencies:
-      minimist: 1.2.8
-
   mkdirp@3.0.1: {}
 
   mlly@1.8.0:
@@ -13436,15 +13430,12 @@ snapshots:
     optionalDependencies:
       msgpackr-extract: 3.0.3
 
-  multer@2.0.2:
+  multer@2.1.0:
     dependencies:
       append-field: 1.0.0
       busboy: 1.6.0
       concat-stream: 2.0.0
-      mkdirp: 0.5.6
-      object-assign: 4.1.1
       type-is: 1.6.18
-      xtend: 4.0.2
 
   mute-stream@2.0.0: {}
 

scripts/__tests__/migrate-brain.spec.ts

@@ -0,0 +1,429 @@
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Script, createContext } from "node:vm";
+
+import { describe, expect, it, vi, afterEach } from "vitest";
+import { ModuleKind, ScriptTarget, transpileModule } from "typescript";
+
+interface CliOptions {
+  brainPath: string;
+  workspaceId: string;
+  userId: string;
+  apply: boolean;
+}
+
+interface MockDirent {
+  name: string;
+  isFile: () => boolean;
+}
+
+interface ScriptInternals {
+  parseCliArgs: (args: string[]) => CliOptions;
+  mapTaskStatus: (rawStatus: string | null) => { status: string; issue: string | null };
+  mapTaskPriority: (rawPriority: string | null) => { priority: string; issue: string | null };
+  mapProjectStatus: (rawStatus: string | null) => { status: string; issue: string | null };
+  normalizeDomain: (rawDomain: string | null | undefined) => string | null;
+  listJsonFiles: (directoryPath: string) => Promise<string[]>;
+  parseTaskFile: (
+    rawFile: unknown,
+    sourceFile: string,
+    parseIssues: string[]
+  ) => {
+    version: string;
+    domain: string;
+    sourceFile: string;
+    tasks: Array<{ id: string; title: string }>;
+  } | null;
+  parseProjectFile: (
+    rawFile: unknown,
+    sourceFile: string,
+    parseIssues: string[]
+  ) => {
+    version: string;
+    sourceFile: string;
+    project: { id: string; name: string };
+  } | null;
+  loadTaskFiles: (
+    taskDirectory: string,
+    parseIssues: string[],
+    rootPath: string
+  ) => Promise<
+    Array<{
+      version: string;
+      domain: string;
+      sourceFile: string;
+      tasks: Array<{ id: string; title: string }>;
+    }>
+  >;
+  main: () => Promise<void>;
+}
+
+interface LoaderOptions {
+  argv?: string[];
+  homeDirectory?: string;
+  readdirImpl?: (directoryPath: string, options: unknown) => Promise<MockDirent[]>;
+  readFileImpl?: (filePath: string, encoding: string) => Promise<string>;
+}
+
+interface LoaderResult {
+  internals: ScriptInternals;
+  readdirMock: ReturnType<typeof vi.fn>;
+  readFileMock: ReturnType<typeof vi.fn>;
+  prismaClientConstructor: ReturnType<typeof vi.fn>;
+}
+
+const testDir = path.dirname(fileURLToPath(import.meta.url));
+const scriptPath = path.resolve(testDir, "..", "migrate-brain.ts");
+const nativeRequire = createRequire(import.meta.url);
+
+const makeDirent = (name: string, isFile: boolean): MockDirent => ({
+  name,
+  isFile: () => isFile,
+});
+
+function buildInstrumentedSource(source: string): string {
+  const invocationMarker = "main().catch((error: unknown) => {";
+  const markerIndex = source.lastIndexOf(invocationMarker);
+  if (markerIndex < 0) {
+    throw new Error("Could not find main invocation in migrate-brain.ts");
+  }
+
+  const sourceWithoutMain = source.slice(0, markerIndex);
+  return `${sourceWithoutMain}
+module.exports.__test = {
+  parseCliArgs,
+  mapTaskStatus,
+  mapTaskPriority,
+  mapProjectStatus,
+  normalizeDomain,
+  listJsonFiles,
+  parseTaskFile,
+  parseProjectFile,
+  loadTaskFiles,
+  main,
+};
+`;
+}
+
+function loadMigrateBrainModule(options: LoaderOptions = {}): LoaderResult {
+  const source = readFileSync(scriptPath, "utf8");
+  const instrumentedSource = buildInstrumentedSource(source);
+
+  const transpiled = transpileModule(instrumentedSource, {
+    compilerOptions: {
+      module: ModuleKind.CommonJS,
+      target: ScriptTarget.ES2022,
+      esModuleInterop: true,
+    },
+    fileName: scriptPath,
+  });
+
+  const readdirMock = vi.fn(options.readdirImpl ?? (async (): Promise<MockDirent[]> => []));
+  const readFileMock = vi.fn(options.readFileImpl ?? (async (): Promise<string> => "{}"));
+
+  const prismaClientConstructor = vi.fn(() => ({
+    $disconnect: vi.fn(async () => undefined),
+  }));
+
+  const processMock = Object.create(process) as NodeJS.Process;
+  processMock.argv = options.argv ?? [
+    "node",
+    scriptPath,
+    "--workspace-id",
+    "workspace-1",
+    "--user-id",
+    "user-1",
+  ];
+
+  const prismaClientModule = {
+    ActivityAction: { CREATED: "CREATED" },
+    EntityType: { DOMAIN: "DOMAIN", PROJECT: "PROJECT", TASK: "TASK" },
+    Prisma: {},
+    PrismaClient: prismaClientConstructor,
+    ProjectStatus: {
+      ACTIVE: "ACTIVE",
+      PLANNING: "PLANNING",
+      PAUSED: "PAUSED",
+      ARCHIVED: "ARCHIVED",
+    },
+    TaskPriority: {
+      HIGH: "HIGH",
+      MEDIUM: "MEDIUM",
+      LOW: "LOW",
+    },
+    TaskStatus: {
+      COMPLETED: "COMPLETED",
+      IN_PROGRESS: "IN_PROGRESS",
+      NOT_STARTED: "NOT_STARTED",
+      PAUSED: "PAUSED",
+      ARCHIVED: "ARCHIVED",
+    },
+  };
+
+  const module = { exports: {} as Record<string, unknown> };
+
+  const requireFromScript = (specifier: string): unknown => {
+    if (specifier === "node:fs/promises") {
+      return {
+        readdir: readdirMock,
+        readFile: readFileMock,
+      };
+    }
+    if (specifier === "node:os") {
+      return {
+        homedir: () => options.homeDirectory ?? "/home/tester",
+      };
+    }
+    if (specifier === "node:process") {
+      return processMock;
+    }
+    if (specifier === "../apps/api/node_modules/@prisma/client") {
+      return prismaClientModule;
+    }
+    return nativeRequire(specifier);
+  };
+
+  const context = createContext({
+    module,
+    exports: module.exports,
+    require: requireFromScript,
+    __dirname: path.dirname(scriptPath),
+    __filename: scriptPath,
+    console,
+    process: processMock,
+    setTimeout,
+    clearTimeout,
+    setInterval,
+    clearInterval,
+    Buffer,
+  });
+
+  new Script(transpiled.outputText, { filename: scriptPath }).runInContext(context);
+
+  const exported = module.exports as { __test?: ScriptInternals };
+  if (!exported.__test) {
+    throw new Error("Failed to expose migrate-brain internals for tests");
+  }
+
+  return {
+    internals: exported.__test,
+    readdirMock,
+    readFileMock,
+    prismaClientConstructor,
+  };
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("migrate-brain mapping helpers", () => {
+  it("maps statuses and priorities, including unknown-value fallbacks", () => {
+    const { internals } = loadMigrateBrainModule();
+
+    expect(internals.mapTaskStatus("done")).toEqual({
+      status: "COMPLETED",
+      issue: null,
+    });
+    expect(internals.mapTaskStatus("mystery")).toEqual({
+      status: "NOT_STARTED",
+      issue: 'Unknown task status "mystery" mapped to NOT_STARTED',
+    });
+
+    expect(internals.mapTaskPriority("critical")).toEqual({
+      priority: "HIGH",
+      issue: null,
+    });
+    expect(internals.mapTaskPriority(null)).toEqual({
+      priority: "MEDIUM",
+      issue: 'Unknown task priority "null" mapped to MEDIUM',
+    });
+
+    expect(internals.mapProjectStatus("in-progress")).toEqual({
+      status: "ACTIVE",
+      issue: null,
+    });
+    expect(internals.mapProjectStatus("untracked")).toEqual({
+      status: "PLANNING",
+      issue: 'Unknown project status "untracked" mapped to PLANNING',
+    });
+  });
+
+  it("normalizes domain strings into lowercase slugs", () => {
+    const { internals } = loadMigrateBrainModule();
+
+    expect(internals.normalizeDomain(" Platform Core ")).toBe("platform-core");
+    expect(internals.normalizeDomain("###")).toBeNull();
+    expect(internals.normalizeDomain(undefined)).toBeNull();
+  });
+});
+
+describe("migrate-brain CLI parsing", () => {
+  it("parses required arguments and default brain path", () => {
+    const { internals } = loadMigrateBrainModule({ homeDirectory: "/opt/home" });
+
+    const parsed = internals.parseCliArgs([
+      "--workspace-id",
+      "workspace-abc",
+      "--user-id",
+      "user-xyz",
+    ]);
+
+    expect(parsed).toEqual({
+      brainPath: path.resolve("/opt/home/src/jarvis-brain"),
+      workspaceId: "workspace-abc",
+      userId: "user-xyz",
+      apply: false,
+    });
+  });
+
+  it("supports inline flags and apply mode", () => {
+    const { internals } = loadMigrateBrainModule({ homeDirectory: "/opt/home" });
+
+    const parsed = internals.parseCliArgs([
+      "--brain-path=~/custom-brain",
+      "--workspace-id=workspace-1",
+      "--user-id=user-1",
+      "--apply",
+    ]);
+
+    expect(parsed).toEqual({
+      brainPath: path.resolve("/opt/home/custom-brain"),
+      workspaceId: "workspace-1",
+      userId: "user-1",
+      apply: true,
+    });
+  });
+
+  it("throws on missing required flags and unknown flags", () => {
+    const { internals } = loadMigrateBrainModule();
+
+    expect(() => internals.parseCliArgs(["--workspace-id", "workspace-1"])).toThrowError(
+      "Both --workspace-id and --user-id are required"
+    );
+
+    expect(() =>
+      internals.parseCliArgs(["--workspace-id", "workspace-1", "--user-id", "user-1", "--nope"])
+    ).toThrowError("Unknown flag: --nope");
+  });
+});
+
+describe("migrate-brain file discovery", () => {
+  it("returns only .json files in sorted order", async () => {
+    const readdirImpl = async (): Promise<MockDirent[]> => [
+      makeDirent("z.json", true),
+      makeDirent("notes.md", true),
+      makeDirent("nested", false),
+      makeDirent("a.json", true),
+    ];
+
+    const { internals, readdirMock } = loadMigrateBrainModule({ readdirImpl });
+
+    const files = await internals.listJsonFiles("/tmp/brain/data/tasks");
+
+    expect(files).toEqual([
+      path.join("/tmp/brain/data/tasks", "a.json"),
+      path.join("/tmp/brain/data/tasks", "z.json"),
+    ]);
+    expect(readdirMock).toHaveBeenCalledWith("/tmp/brain/data/tasks", {
+      withFileTypes: true,
+    });
+  });
+});
+
+describe("migrate-brain parsing and validation", () => {
+  it("loads task files and tracks validation issues for invalid task records", async () => {
+    const taskDirectory = "/tmp/brain/data/tasks";
+    const taskFilePath = path.join(taskDirectory, "core.json");
+
+    const readdirImpl = async (): Promise<MockDirent[]> => [makeDirent("core.json", true)];
+    const readFileImpl = async (filePath: string): Promise<string> => {
+      if (filePath === taskFilePath) {
+        return JSON.stringify({
+          version: "1",
+          domain: "core",
+          tasks: [{ id: "TASK-1", title: "Valid" }, { id: "TASK-2" }],
+        });
+      }
+
+      throw new Error(`Unexpected file read: ${filePath}`);
+    };
+
+    const { internals, readFileMock } = loadMigrateBrainModule({
+      readdirImpl,
+      readFileImpl,
+    });
+
+    const parseIssues: string[] = [];
+    const loaded = await internals.loadTaskFiles(taskDirectory, parseIssues, "/tmp/brain");
+
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]).toMatchObject({
+      version: "1",
+      domain: "core",
+      sourceFile: path.join("data", "tasks", "core.json"),
+    });
+    expect(loaded[0].tasks).toHaveLength(1);
+    expect(parseIssues).toContain(
+      'data/tasks/core.json task[1]: required field "title" missing or invalid'
+    );
+    expect(readFileMock).toHaveBeenCalledWith(taskFilePath, "utf8");
+  });
+
+  it("rejects invalid project payloads", () => {
+    const { internals } = loadMigrateBrainModule();
+
+    const parseIssues: string[] = [];
+    const parsed = internals.parseProjectFile(
+      {
+        version: "1",
+        project: {
+          name: "Project without ID",
+        },
+      },
+      "data/projects/project.json",
+      parseIssues
+    );
+
+    expect(parsed).toBeNull();
+    expect(parseIssues).toContain(
+      'data/projects/project.json project: required field "id" missing or invalid'
+    );
+  });
+});
+
+describe("migrate-brain dry-run behavior", () => {
+  it("does not instantiate Prisma client when --apply is omitted", async () => {
+    const brainPath = "/tmp/brain";
+    const readdirImpl = async (): Promise<MockDirent[]> => [];
+
+    const { internals, prismaClientConstructor, readdirMock } = loadMigrateBrainModule({
+      argv: [
+        "node",
+        scriptPath,
+        "--brain-path",
+        brainPath,
+        "--workspace-id",
+        "workspace-1",
+        "--user-id",
+        "user-1",
+      ],
+      readdirImpl,
+    });
+
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await internals.main();
+
+    expect(prismaClientConstructor).not.toHaveBeenCalled();
+    expect(readdirMock).toHaveBeenCalledWith(path.join(brainPath, "data", "tasks"), {
+      withFileTypes: true,
+    });
+    expect(readdirMock).toHaveBeenCalledWith(path.join(brainPath, "data", "projects"), {
+      withFileTypes: true,
+    });
+    expect(logSpy).toHaveBeenCalledWith("Dry-run complete. Re-run with --apply to write records.");
+  });
+});

scripts/ingest-openclaw-sessions.ts

@@ -0,0 +1,621 @@
+import { createReadStream, constants as fsConstants } from "node:fs";
+import { access, readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import * as path from "node:path";
+import * as process from "node:process";
+import { createInterface } from "node:readline";
+
+const DEFAULT_ENDPOINT = "https://mosaic-api.woltje.com/conversation-archive/ingest";
+
+type IngestRole = "user" | "assistant";
+
+interface IngestMessage {
+  role: IngestRole;
+  content: string;
+  timestamp?: string;
+}
+
+interface IngestPayload {
+  sessionId: string;
+  workspaceId: string;
+  title: string;
+  messages: IngestMessage[];
+  agentId?: string;
+}
+
+interface CliOptions {
+  workspaceId: string;
+  agentId?: string;
+  since?: Date;
+  sessionsDir?: string;
+  endpoint: string;
+}
+
+interface ParsedSession {
+  sessionId: string;
+  title: string;
+  messages: IngestMessage[];
+  startedAt?: string;
+  endedAt?: string;
+  parseErrors: number;
+  inferredAgentId?: string;
+}
+
+interface SendResult {
+  ok: boolean;
+  status: number;
+  body: string;
+}
+
+interface IngestSummary {
+  discovered: number;
+  processed: number;
+  ingested: number;
+  skippedSince: number;
+  skippedEmpty: number;
+  skippedDuplicate: number;
+  failed: number;
+}
+
+function printUsage(): void {
+  console.log(
+    [
+      "Usage:",
+      "  pnpm ingest:sessions --workspace-id <id> [--agent-id <id>] [--since <ISO date>] [--sessions-dir <path>] [--endpoint <url>]",
+      "",
+      "Required:",
+      "  --workspace-id   Target Mosaic workspace ID",
+      "",
+      "Optional:",
+      "  --agent-id       Agent ID to include in each ingest payload",
+      "  --since          Skip sessions before this date/time (ISO8601 or YYYY-MM-DD)",
+      "  --sessions-dir   Override session directory path",
+      `  --endpoint       Ingest endpoint (default: ${DEFAULT_ENDPOINT})`,
+    ].join("\n")
+  );
+}
+
+function expandHomePath(inputPath: string): string {
+  if (inputPath === "~") {
+    return homedir();
+  }
+  if (inputPath.startsWith("~/")) {
+    return path.join(homedir(), inputPath.slice(2));
+  }
+  return inputPath;
+}
+
+function parseSinceDate(rawDate: string): Date {
+  const parsed = new Date(rawDate);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new Error(`Invalid --since date: "${rawDate}". Use ISO8601 or YYYY-MM-DD.`);
+  }
+  return parsed;
+}
+
+function parseCliArgs(args: string[]): CliOptions {
+  let workspaceId: string | null = null;
+  let agentId: string | undefined;
+  let since: Date | undefined;
+  let sessionsDir: string | undefined;
+  let endpoint = DEFAULT_ENDPOINT;
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+
+    if (arg === "--help" || arg === "-h") {
+      printUsage();
+      process.exit(0);
+    }
+
+    if (arg.startsWith("--workspace-id=")) {
+      workspaceId = arg.slice("--workspace-id=".length);
+      continue;
+    }
+    if (arg === "--workspace-id") {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error("Missing value for --workspace-id");
+      }
+      workspaceId = value;
+      index += 1;
+      continue;
+    }
+
+    if (arg.startsWith("--agent-id=")) {
+      agentId = arg.slice("--agent-id=".length);
+      continue;
+    }
+    if (arg === "--agent-id") {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error("Missing value for --agent-id");
+      }
+      agentId = value;
+      index += 1;
+      continue;
+    }
+
+    if (arg.startsWith("--since=")) {
+      since = parseSinceDate(arg.slice("--since=".length));
+      continue;
+    }
+    if (arg === "--since") {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error("Missing value for --since");
+      }
+      since = parseSinceDate(value);
+      index += 1;
+      continue;
+    }
+
+    if (arg.startsWith("--sessions-dir=")) {
+      sessionsDir = arg.slice("--sessions-dir=".length);
+      continue;
+    }
+    if (arg === "--sessions-dir") {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error("Missing value for --sessions-dir");
+      }
+      sessionsDir = value;
+      index += 1;
+      continue;
+    }
+
+    if (arg.startsWith("--endpoint=")) {
+      endpoint = arg.slice("--endpoint=".length);
+      continue;
+    }
+    if (arg === "--endpoint") {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error("Missing value for --endpoint");
+      }
+      endpoint = value;
+      index += 1;
+      continue;
+    }
+
+    throw new Error(`Unknown flag: ${arg}`);
+  }
+
+  if (!workspaceId || workspaceId.trim().length === 0) {
+    throw new Error("--workspace-id is required");
+  }
+
+  return {
+    workspaceId: workspaceId.trim(),
+    agentId: agentId?.trim(),
+    since,
+    sessionsDir: sessionsDir ? path.resolve(expandHomePath(sessionsDir)) : undefined,
+    endpoint,
+  };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" ? value : null;
+}
+
+function normalizeIsoTimestamp(value: unknown): string | null {
+  if (typeof value === "string") {
+    const parsed = new Date(value);
+    if (!Number.isNaN(parsed.getTime())) {
+      return parsed.toISOString();
+    }
+    return null;
+  }
+
+  if (typeof value === "number" && Number.isFinite(value)) {
+    const millis = value >= 1_000_000_000_000 ? value : value * 1000;
+    const parsed = new Date(millis);
+    if (!Number.isNaN(parsed.getTime())) {
+      return parsed.toISOString();
+    }
+  }
+
+  return null;
+}
+
+function truncate(value: string, maxLength: number): string {
+  if (value.length <= maxLength) {
+    return value;
+  }
+  return `${value.slice(0, maxLength - 3)}...`;
+}
+
+function deriveTitle(content: string, fallbackSessionId: string): string {
+  const firstLine = content
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .find((line) => line.length > 0);
+
+  if (!firstLine) {
+    return `OpenClaw session ${fallbackSessionId}`;
+  }
+
+  const normalized = firstLine.replace(/\s+/gu, " ").trim();
+  return truncate(normalized, 140);
+}
+
+function extractTextContent(content: unknown): string {
+  if (typeof content === "string") {
+    return content.trim();
+  }
+
+  if (Array.isArray(content)) {
+    const parts: string[] = [];
+    for (const item of content) {
+      if (typeof item === "string") {
+        const trimmed = item.trim();
+        if (trimmed.length > 0) {
+          parts.push(trimmed);
+        }
+        continue;
+      }
+      if (!isRecord(item)) {
+        continue;
+      }
+      const itemType = asString(item.type);
+      if (itemType !== null && itemType !== "text") {
+        continue;
+      }
+      const textValue = asString(item.text);
+      if (textValue && textValue.trim().length > 0) {
+        parts.push(textValue.trim());
+      }
+    }
+    return parts.join("\n\n").trim();
+  }
+
+  if (isRecord(content)) {
+    const textValue = asString(content.text);
+    if (textValue) {
+      return textValue.trim();
+    }
+  }
+
+  return "";
+}
+
+function inferAgentIdFromPath(filePath: string): string | null {
+  const pathParts = filePath.split(path.sep);
+  const agentsIndex = pathParts.lastIndexOf("agents");
+  if (agentsIndex < 0) {
+    return null;
+  }
+  const candidate = pathParts[agentsIndex + 1];
+  return candidate && candidate.trim().length > 0 ? candidate : null;
+}
+
+async function parseSessionFile(filePath: string): Promise<ParsedSession> {
+  const fallbackSessionId = path.basename(filePath, path.extname(filePath));
+  const inferredAgentId = inferAgentIdFromPath(filePath) ?? undefined;
+
+  let sessionId = fallbackSessionId;
+  let title: string | null = null;
+  let startedAt: string | undefined;
+  let endedAt: string | undefined;
+  let parseErrors = 0;
+  const messages: IngestMessage[] = [];
+
+  const readStream = createReadStream(filePath, { encoding: "utf8" });
+  const lineReader = createInterface({
+    input: readStream,
+    crlfDelay: Number.POSITIVE_INFINITY,
+  });
+
+  for await (const rawLine of lineReader) {
+    const line = rawLine.trim();
+    if (line.length === 0) {
+      continue;
+    }
+
+    let parsedLine: unknown;
+    try {
+      parsedLine = JSON.parse(line) as unknown;
+    } catch {
+      parseErrors += 1;
+      continue;
+    }
+
+    if (!isRecord(parsedLine)) {
+      parseErrors += 1;
+      continue;
+    }
+
+    const eventType = asString(parsedLine.type);
+    if (eventType === "session") {
+      const rawSessionId = asString(parsedLine.id);
+      if (rawSessionId && rawSessionId.trim().length > 0) {
+        sessionId = rawSessionId;
+      }
+
+      const sessionTimestamp = normalizeIsoTimestamp(parsedLine.timestamp);
+      if (sessionTimestamp) {
+        startedAt ??= sessionTimestamp;
+      }
+      continue;
+    }
+
+    if (eventType !== "message") {
+      continue;
+    }
+
+    const messageRecord = parsedLine.message;
+    if (!isRecord(messageRecord)) {
+      continue;
+    }
+
+    const role = asString(messageRecord.role);
+    if (role !== "user" && role !== "assistant") {
+      continue;
+    }
+
+    const content = extractTextContent(messageRecord.content);
+    if (content.length === 0) {
+      continue;
+    }
+
+    const timestamp =
+      normalizeIsoTimestamp(messageRecord.timestamp) ?? normalizeIsoTimestamp(parsedLine.timestamp);
+
+    const message: IngestMessage = {
+      role,
+      content,
+      timestamp: timestamp ?? undefined,
+    };
+    messages.push(message);
+
+    if (!title && role === "user") {
+      title = deriveTitle(content, sessionId);
+    }
+    if (!startedAt && timestamp) {
+      startedAt = timestamp;
+    }
+    if (timestamp) {
+      endedAt = timestamp;
+    }
+  }
+
+  return {
+    sessionId,
+    title: title ?? `OpenClaw session ${sessionId}`,
+    messages,
+    startedAt,
+    endedAt,
+    parseErrors,
+    inferredAgentId,
+  };
+}
+
+async function pathExists(candidatePath: string): Promise<boolean> {
+  try {
+    await access(candidatePath, fsConstants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function discoverSessionDirectories(overrideDir?: string): Promise<string[]> {
+  if (overrideDir) {
+    if (!(await pathExists(overrideDir))) {
+      throw new Error(`Provided --sessions-dir does not exist: ${overrideDir}`);
+    }
+    return [overrideDir];
+  }
+
+  const defaultDir = path.join(homedir(), ".openclaw", "sessions");
+  if (await pathExists(defaultDir)) {
+    return [defaultDir];
+  }
+
+  const agentsRoot = path.join(homedir(), ".openclaw", "agents");
+  if (!(await pathExists(agentsRoot))) {
+    return [];
+  }
+
+  const agentEntries = await readdir(agentsRoot, { withFileTypes: true });
+  const directories: string[] = [];
+  for (const entry of agentEntries) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const sessionsDir = path.join(agentsRoot, entry.name, "sessions");
+    if (await pathExists(sessionsDir)) {
+      directories.push(sessionsDir);
+    }
+  }
+
+  return directories.sort((left, right) => left.localeCompare(right));
+}
+
+async function discoverSessionFiles(overrideDir?: string): Promise<string[]> {
+  const directories = await discoverSessionDirectories(overrideDir);
+  const files: string[] = [];
+
+  for (const directory of directories) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".jsonl")) {
+        continue;
+      }
+      files.push(path.join(directory, entry.name));
+    }
+  }
+
+  return files.sort((left, right) => left.localeCompare(right));
+}
+
+async function resolveSessionTimestamp(session: ParsedSession, filePath: string): Promise<Date> {
+  const sessionTimestamp = session.startedAt ?? session.endedAt;
+  if (sessionTimestamp) {
+    const parsed = new Date(sessionTimestamp);
+    if (!Number.isNaN(parsed.getTime())) {
+      return parsed;
+    }
+  }
+
+  const fileStat = await stat(filePath);
+  return fileStat.mtime;
+}
+
+function buildPayload(
+  options: CliOptions,
+  session: ParsedSession,
+  fallbackAgentId: string | undefined
+): IngestPayload {
+  const payload: IngestPayload = {
+    sessionId: session.sessionId,
+    workspaceId: options.workspaceId,
+    title: session.title,
+    messages: session.messages,
+  };
+
+  const selectedAgentId = options.agentId ?? fallbackAgentId;
+  if (selectedAgentId && selectedAgentId.trim().length > 0) {
+    payload.agentId = selectedAgentId.trim();
+  }
+
+  return payload;
+}
+
+async function sendIngestRequest(
+  endpoint: string,
+  token: string,
+  payload: IngestPayload
+): Promise<SendResult> {
+  const response = await fetch(endpoint, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(payload),
+  });
+
+  const body = await response.text();
+  return {
+    ok: response.ok,
+    status: response.status,
+    body,
+  };
+}
+
+function summarizeFailureBody(body: string): string {
+  const compact = body.replace(/\s+/gu, " ").trim();
+  if (compact.length === 0) {
+    return "(empty response body)";
+  }
+  return truncate(compact, 220);
+}
+
+async function main(): Promise<void> {
+  const options = parseCliArgs(process.argv.slice(2));
+  const token = process.env.MOSAIC_API_TOKEN;
+  if (!token || token.trim().length === 0) {
+    throw new Error("MOSAIC_API_TOKEN environment variable is required.");
+  }
+
+  const sessionFiles = await discoverSessionFiles(options.sessionsDir);
+  if (sessionFiles.length === 0) {
+    console.log("No OpenClaw session files found.");
+    return;
+  }
+
+  console.log(`Discovered ${sessionFiles.length} session file(s).`);
+  if (options.since) {
+    console.log(`Applying --since filter at ${options.since.toISOString()}.`);
+  }
+
+  const summary: IngestSummary = {
+    discovered: sessionFiles.length,
+    processed: 0,
+    ingested: 0,
+    skippedSince: 0,
+    skippedEmpty: 0,
+    skippedDuplicate: 0,
+    failed: 0,
+  };
+
+  for (const [index, filePath] of sessionFiles.entries()) {
+    const position = `${index + 1}/${sessionFiles.length}`;
+    const parsedSession = await parseSessionFile(filePath);
+    summary.processed += 1;
+
+    if (parsedSession.messages.length === 0) {
+      summary.skippedEmpty += 1;
+      console.log(
+        `[${position}] Skipped ${parsedSession.sessionId}: no user/assistant text messages.`
+      );
+      continue;
+    }
+
+    const sessionDate = await resolveSessionTimestamp(parsedSession, filePath);
+    if (options.since && sessionDate.getTime() < options.since.getTime()) {
+      summary.skippedSince += 1;
+      console.log(
+        `[${position}] Skipped ${parsedSession.sessionId}: session is before --since (${sessionDate.toISOString()}).`
+      );
+      continue;
+    }
+
+    const payload = buildPayload(options, parsedSession, parsedSession.inferredAgentId);
+    let result: SendResult;
+
+    try {
+      result = await sendIngestRequest(options.endpoint, token, payload);
+    } catch (error) {
+      summary.failed += 1;
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[${position}] Failed ${parsedSession.sessionId}: request error: ${message}`);
+      continue;
+    }
+
+    if (result.ok) {
+      summary.ingested += 1;
+      const note =
+        parsedSession.parseErrors > 0 ? ` (parse warnings: ${parsedSession.parseErrors})` : "";
+      console.log(
+        `[${position}] Ingested ${parsedSession.sessionId} (${parsedSession.messages.length} messages)${note}.`
+      );
+      continue;
+    }
+
+    if (result.status === 409) {
+      summary.skippedDuplicate += 1;
+      console.log(`[${position}] Skipped ${parsedSession.sessionId}: already exists (409).`);
+      continue;
+    }
+
+    summary.failed += 1;
+    console.error(
+      `[${position}] Failed ${parsedSession.sessionId}: HTTP ${result.status} ${summarizeFailureBody(result.body)}`
+    );
+  }
+
+  console.log("\nIngestion summary:");
+  console.log(`  Discovered: ${summary.discovered}`);
+  console.log(`  Processed: ${summary.processed}`);
+  console.log(`  Ingested: ${summary.ingested}`);
+  console.log(`  Skipped (--since): ${summary.skippedSince}`);
+  console.log(`  Skipped (empty): ${summary.skippedEmpty}`);
+  console.log(`  Skipped (duplicate): ${summary.skippedDuplicate}`);
+  console.log(`  Failed: ${summary.failed}`);
+
+  if (summary.failed > 0) {
+    process.exit(1);
+  }
+}
+
+main().catch((error: unknown) => {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(`Fatal error: ${message}`);
+  process.exit(1);
+});