docs(prd): PRD draft 0.4 with PRDY round 3; lead decision 53

Tokens by hand from a runbook, Gitea bot users per role, slice 1 agents
as Jason's OS user, DMs through the existing connector, digest at 08:00
Central, Gate E with the slice 1 WebUI step. Approval as 1.0 is still
open.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/prd/mosaic-stack.md

@@ -1,13 +1,13 @@
 # PRD: Mosaic Stack
 
-- Status: draft, version 0.3. Jason approves it, and once approved it is
+- Status: draft, version 0.4. Jason approves it, and once approved it is
   never edited in place. Changes after approval are a new version.
 - Owner: Jason. Sage writes it from the PRDY interview.
 - Template: PRDY "software" (`v1/packages/prdy/src/templates.ts`), filled
   by hand until PRDY is ported.
 - Interview record: Sage's thread 1ef1e4f8. Round 1 is lead decision 45.
-  Round 2 is lead decision 48. Design inputs are lead decisions 43, 44,
-  46, 47 and 49.
+  Round 2 is lead decision 48. Round 3 is lead decision 53. Design
+  inputs are lead decisions 43, 44, 46, 47 and 49 to 52.
 
 ## Introduction
 
@@ -119,8 +119,13 @@ parent requirement is refused.
 ### Credentials
 
 - **REQ-CRED-1.** Every role instance has its own token for each service
-  (Gitea, Vikunja). In v1 Jason creates these tokens by hand. The broker
-  holds them, and they never enter an agent's environment or files.
+  (Gitea, Vikunja). The broker holds them, and they never enter an agent's
+  environment or files. In v1 Jason creates them by hand from a runbook
+  Sage writes (round 3, 1A):
+  - in Gitea, a new bot user per role: pm-bot, cto-bot, coder-bot and
+    reviewer-bot (round 3, 2A);
+  - in Vikunja, a `bot-<role>` user per role, plus one read-only
+    `bot-<business>-sync` that does all polling (lead decision 52).
 - **REQ-CRED-2.** A session that finds only founder credentials stops.
 
 ### Decisions
@@ -142,8 +147,9 @@ parent requirement is refused.
   started outside any agent run. Agents reach the decision store only
   through a broker. The broker stamps role and run from the launch record.
 - **REQ-DEC-4.** A gated decision that blocks work reaches Jason right
-  away: in the CLI inbox, plus a Discord DM. Everything else goes into one
-  daily digest. (Round 2, answers 2A and 3A.)
+  away: in the CLI inbox, plus a Discord DM sent through the existing
+  connector (#1509). Everything else goes into one daily digest at 08:00
+  Central. (Round 2, answers 2A and 3A; round 3, 4A and 5A.)
 
 ### Messages
 
@@ -159,8 +165,11 @@ parent requirement is refused.
   and the assigned role writes the task's state. Vikunja's token scopes
   cover whole route groups, so the broker's verbs enforce this, not the
   tokens. A person's edits come in as events.
-- **REQ-TASK-2.** Polling for changes since the last check is the source
-  of truth, with an hourly full reconcile. Slice 1 uses no webhooks.
+- **REQ-TASK-2.** Polling is the source of truth. Every 30 seconds the
+  sync bot reads each project's open-task board and the tasks updated
+  since the last check, so column moves and deletions of open tasks show
+  up within one poll. An hourly full reconcile catches the rest. Slice 1
+  uses no webhooks. (Lead decisions 51 and 52.)
 - **REQ-TASK-3.** The installer offers two choices: point at an existing
   Vikunja, or deploy the bundled one. The bundled one is the unmodified
   upstream image. No Vikunja code enters the repository.
@@ -250,14 +259,18 @@ piece:
 
 ## Risks and open questions
 
-Round 3 sets these. Known so far:
-- Agents running as the same OS user as Jason can write anything that
-  user can write. Until seats run as another user or in a container, the
-  broker is a rule they follow, not a wall.
+- In slice 1, agents run as Jason's OS user (round 3, 3A). They can
+  write anything that user can write. Until seats run in a container,
+  which comes next, the broker is a rule they follow, not a wall. What
+  does hold in slice 1 is that agents never hold service tokens.
+- Vikunja doesn't enforce `If-Match`. The broker compares before it
+  writes, and a person editing in the same moment can still be
+  overwritten in an owned field (lead decision 51).
 - The Vikunja owner password and Gitea token creation are gated. Jason
   holds them.
 
 ## Milestones
 
 Slice 1, in the order on the foundation direction page. The slice 1 brief
-maps each step to requirement ids.
+maps each step to requirement ids. CHAT-03's Gate E demonstration happens
+during the slice 1 WebUI step, not separately (round 3, 7B).