feat(wake): W7 A10 idempotent installer + mosaic-wake.service (component-manifest, Gate-A, blank-reset retire, snapshot-guard, fail-closed install-validate) (#911)

Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-26 04:19:09 +00:00
parent 003cdaa1a6
commit 2378665eaf
9 changed files with 951 additions and 9 deletions
--- a/packages/mosaic/src/framework/manifest-parity.spec.ts
+++ b/packages/mosaic/src/framework/manifest-parity.spec.ts
@@ -81,6 +81,17 @@ const PROBE_PATHS = [
  'skills/mosaic-context-refresh/SKILL.md',
  'tools/git/pr-create.sh',
  'tools/_lib/manifest.sh',
+  // #892 W7 (Gate A): every wake component candidate the component installer may
+  // write MUST resolve framework-owned on BOTH resolvers. If either drifted to
+  // operator, the component install would refuse a legitimate write (or, worse,
+  // a divergent resolver could authorize one the SSOT forbids). These prove the
+  // wake component authorizes nothing outside framework-manifest ownership.
+  'tools/wake/beacon.sh',
+  'tools/wake/wake-install.sh',
+  'tools/wake/manifest.txt',
+  'tools/wake/test-wake-install.sh',
+  'systemd/user/mosaic-wake.service',
+  'defaults/wake-watch-list.schema.json',
  'defaults/SOUL.md',
  'fleet/README.md',
  'fleet/roles/coder.md',