feat(869-c2): install-ordering enforcement-hook guard (Part of #869)

Part of #869 Mos (id-11) Gate-16 merge: independent APPROVE @b6f36564 (8/8, verified vs real production settings template), author id2 != approver id11, clean mosaic-coder author, CI green wp1988. Co-authored-by: jason.woltje <[email protected]> Co-committed-by: jason.woltje <[email protected]>
2026-07-23 18:48:33 +00:00
parent 76b86a246e
commit d351caad36
8 changed files with 1004 additions and 17 deletions
@@ -18,12 +18,33 @@ set -Eeuo pipefail
 #   MOSAIC_INSTALL_MODE      — prompt|keep|overwrite (default: prompt)
 #   MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING — 1 to bypass MCP check
 #   MOSAIC_SKIP_SKILLS_SYNC  — 1 to skip skill sync
+#
+# Flags (CLI args, NOT environment variables — see #869 Point-1 C2):
+#   --allow-inactive-enforcement  Explicit, per-invocation opt-out that lets the
+#                                 lease-enforcement hooks (mutator-gate.py,
+#                                 receipt-observer-client.py) be wired into
+#                                 ~/.claude/settings.json even when this host
+#                                 cannot confirm it can ACTIVATE them. Loud on
+#                                 use (see mosaic-link-runtime-assets). Default
+#                                 (flag absent) is fail-loud: the enforcement
+#                                 hooks are NOT wired and the framework's
+#                                 runtime-asset-link step reports a failure.
 # ──────────────────────────────────────────────────────────────────────────────

 SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET_DIR="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 INSTALL_MODE="${MOSAIC_INSTALL_MODE:-prompt}"

+# Deliberately parsed from "$@" (a real, explicit, per-invocation argument) —
+# never an environment variable — so this opt-out can never sit silently
+# inherited in a shell profile. See #869 Point-1 C2.
+ALLOW_INACTIVE_ENFORCEMENT=0
+for _arg in "$@"; do
+  case "$_arg" in
+    --allow-inactive-enforcement) ALLOW_INACTIVE_ENFORCEMENT=1 ;;
+  esac
+done
+
 # Shared framework path-ownership manifest reader (#791). Parity with
 # packages/mosaic/src/framework/manifest.ts — both consume framework-manifest.txt.
 # Sourcing does not run its CLI dispatch (guarded by BASH_SOURCE==$0).
@@ -670,10 +691,15 @@ step "Post-install tasks"
 SCRIPTS="$TARGET_DIR/tools/_scripts"

 if [[ -x "$SCRIPTS/mosaic-link-runtime-assets" ]]; then
-  if "$SCRIPTS/mosaic-link-runtime-assets" >/dev/null 2>&1; then
+  link_args=()
+  [[ "$ALLOW_INACTIVE_ENFORCEMENT" == "1" ]] && link_args+=(--allow-inactive-enforcement)
+  # stdout is suppressed as before, but stderr is left connected: the
+  # install-ordering guard's FAIL LOUD message (#869 Point-1 C2) must reach
+  # the operator, not be swallowed silently.
+  if "$SCRIPTS/mosaic-link-runtime-assets" "${link_args[@]}" >/dev/null; then
    ok "Runtime assets linked"
  else
-    warn "Runtime asset linking failed (non-fatal)"
+    warn "Runtime asset linking failed (non-fatal) — see message above for details."
  fi
 fi