fix(auth): mosaic-managed auth lives under the data root, never ~/.pi (#48)

Owner direction: the stack must never impact default harness usage.
Correction to M19 as shipped (nothing had been created in ~/.pi — the
move breaks nothing).

- Mosaic-managed accounts: <dataRoot>/auth/<account>.json, perms 0600
  enforced (loose perms flagged in listings, refused by --auth — mirrors
  gitea-api.sh credential hygiene).
- ~/.pi is read-only to the stack, permanently; the only interaction
  remains the existing read-only container mount of the default
  credential. Recorded as a ROADMAP standing decision.
- auth.sh is now config-driven (data root from config.json, fail closed,
  consistent with every other tool); status reports both sources labeled.
- agent.sh --auth resolution moved after load_config (needs the data
  root); missing/symlinked/non-0600 accounts refuse.
- test-auth.sh: 15 no-Docker cases (accounts-create-nothing, loose-perms
  refusal, invalid-config refusal added). Test-authoring correction
  recorded in BUILD-LOG (fixture-state mismatch caught before running).

Suites 24/15/90/14/17 + verify green.

docs/SESSIONS.md

@@ -14,3 +14,4 @@ are never rewritten or removed; corrections are new entries.
 | 2026-09-03 | assistant (conductor) | M18 seat-role progressive capability restriction (#45): roles/<role>.json contracts (strict schema, name-filename binding, network declared), mosaic-task.mjs resolve-role, agent.sh ceiling intersection with fail-closed refusals, roles/researcher.json shipped, 14 suite cases (task 74 → 88) | scripts/mosaic-task.mjs, scripts/agent.sh, scripts/test-task.sh, roles/researcher.json, docs; suites 24/88/14/17 + verify green |
 | 2026-09-03 | owner (decision + live verification) + assistant (conductor) | M18 live verification + follow-up (#46): owner confirmed narrowing/refusal/tool-free live; seatless launch under AGENTS_DIR override discovered and made fail-closed (exit 4); task suite 88 → 90 | scripts/agent.sh, scripts/test-task.sh, docs/TOOLS.md; suites 24/90/14/17 + verify green |
 | 2026-09-03 | assistant (conductor) | M19 harness auth tooling (#47): pi auth investigation (native provider stacking, no native multi-account), scripts/auth.sh status/accounts (never prints credential material), agent.sh --auth per-launch injection via PI_AUTH_FILE, test-auth.sh suite (13 cases incl. secret-never-printed assertions) | scripts/auth.sh, scripts/agent.sh, scripts/test-auth.sh, docs/TOOLS.md, AGENTS.md; suites 24/90/14/17/13 + verify green |
+| 2026-09-03 | owner (direction) + assistant (conductor) | M19 correction (#48): mosaic-managed auth moved from ~/.pi to the data root (auth/<account>.json, 0600 enforced); ~/.pi read-only to the stack as a ROADMAP standing decision; auth.sh config-driven; test-auth 15 cases | scripts/auth.sh, scripts/agent.sh, scripts/test-auth.sh, docs/TOOLS.md, docs/plans/ROADMAP.md, README.md; suites 24/15/90/14/17 + verify green |

docs/TOOLS.md

@@ -65,14 +65,21 @@ provider; resolution order `--api-key` → `auth.json` → env → models.json).
 No credential material is ever printed — provider names, credential types,
 and env var NAMES only.
 
+Ownership rule (#48): `~/.pi` is read-only to the stack, permanently. The
+only interaction is the existing read-only container mount of the default
+credential (`PI_AUTH_FILE`, default `~/.pi/agent/auth.json`). Mosaic-managed
+accounts live under the data root: `<dataRoot>/auth/<account>.json`, perms
+0600 (mirroring `scripts/gitea-api.sh` hygiene — loose perms are flagged in
+listings and refused by `--auth`).
+
 | Command | Purpose | Notes |
 |---|---|---|
-| `scripts/auth.sh status` | Per-provider credential report | Types (`oauth`/`api_key`), perms, env-side names (informational); exit 3 when the file is missing |
-| `scripts/auth.sh accounts` | List named account files | `auth.<account>.json` beside the credential file; marks the active one |
+| `scripts/auth.sh status` | Report both credential sources | Default harness credential (read-only) + mosaic-managed accounts; never prints material |
+| `scripts/auth.sh accounts` | List mosaic-managed accounts | Under the data root; marks the active one; flags non-0600 |
 
-The file is the compose read-only mount source (`PI_AUTH_FILE`, default
-`~/.pi/agent/auth.json`); named accounts ride the same mount per launch via
-`agent.sh --auth`. Headless task runs keep the default credential.
+`agent.sh --auth <account>` injects `<dataRoot>/auth/<account>.json` as the
+launch's `PI_AUTH_FILE`; missing/symlinked/non-0600 accounts refuse.
+Headless task runs keep the default credential.
 
 ## Release
 

docs/plans/CURRENT.md

@@ -53,3 +53,4 @@ git history + Gitea issues.
 - 2026-09-03 — M18 seat-role progressive capability restriction (#45; roles resolve to contracts, ceiling ∩ seat grant, fail-closed refusals, roles/researcher.json); task suite 74 → 88
 - 2026-09-03 — M18 follow-up: fail-closed seat resolution under MOSAIC_AGENTS_DIR override (#46, owner decision after live verification); task suite 88 → 90; next action M19
 - 2026-09-03 — M19 harness auth tooling (#47; auth.sh status/accounts, agent.sh --auth per-launch injection via PI_AUTH_FILE, test-auth suite 13 cases with secret-never-printed assertions); agreed sequence M16–M19 complete, M20 owner-gated
+- 2026-09-03 — M19 correction: auth ownership moved to the data root (#48, owner direction — the stack never writes to default harness config locations; ROADMAP standing decision); auth.sh config-driven, accounts at <dataRoot>/auth, 0600 enforced; test-auth 13 → 15

docs/plans/ROADMAP.md

@@ -17,6 +17,10 @@ and BUILD-LOG phase.
   referenced from AGENTS.md.
 - **Capability restriction becomes progressive and role-based** (M18),
   porting prior Mosaic Stack concepts where they fit the file-based runtime.
+- **The stack never writes to default harness config locations** (owner,
+  2026-09-03, #48): `~/.pi` — and any future harness home — is read-only to
+  Mosaic tooling; the only interaction is the existing read-only credential
+  mount. Mosaic-managed auth lives under the data root (`<dataRoot>/auth/`).
 
 ## M16 — Release self-determination