docs(#771): hold unimplemented runner routes

README.md

@@ -205,13 +205,13 @@ docker compose up -d valkey
 # Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
 ```
 
-### PostgreSQL and federated activation (held)
+### Held future procedure
 
 The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
 current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
 invoke initialization SQL, or treat the planned migrator as currently executable.
 
-**Future activation procedure — non-executable until KBN-101-00, KBN-101-03, and KBN-101-05
+**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
 land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
 `mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
 this README—will provide the reviewed commands and secret-consumer interface.
@@ -237,7 +237,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- Database migration against a fresh Postgres
+- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.

docs/PERFORMANCE.md

@@ -149,14 +149,9 @@ for any `<Image>` components added in the future.
 
 ---
 
-## How to Apply
+## Held future procedure
 
-```bash
+This report is non-operative evidence, not a current runbook. Until **KBN-101-00, KBN-101-03, and KBN-101-05** land, do not execute a PostgreSQL runner from this checkout. The approved future procedure is exactly: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Deployment will supply the reviewed runner, migration-only credentials, and TLS material; Gateway startup only verifies readiness.
-# PostgreSQL migration is a dedicated pre-runtime phase.
-# Deployment injects migration-only credentials/TLS material; Gateway startup only verifies readiness.
-mosaic-db-migrator --run
-mosaic-db-migrator --verify
-```
 
 ---
 

docs/PRD.md

@@ -143,7 +143,7 @@ PostgreSQL Gateway/storage currently uses one `DATABASE_URL` for runtime queries
 
 ### Acceptance criteria
 
-1. `AC-K101-01`: DTO/command-matrix tests prove required modes, PGlite exception, `mosaic-db-migrator --help|--run|--verify`/stable exits/argv refusal, public-import negative, every finite classified DDL/static-bypass inventory path and both harness pairs reject `DATABASE_URL`-only before connection/DDL, no migration-to-runtime fallback, and `db:push` refusal outside an allowlisted disposable DB. The active `docs/guides/migrate-tier.md` route is inventoried to KBN-101-07 and proves runner-produced `--target-url-file /run/secrets/mosaic-migrate-target-url`, fixed paired provider-version file, and `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing/private-key isolation; Vault KV-v2 same-response version provenance, separate immutable generation mounts, importer CA, JCS/Ed25519 signature/key rotation/revocation, atomic artifact, expiry/replay, safe-fd secret-version/digest, canonical TLS/CA/server/database/role/manifest/schema bindings, dedicated non-DDL importer, consumer isolation/no log-oracle, and exact no-connection versus zero-DML rejection for missing/wrong/stale/replayed/tampered/wrong-key/substituted/generation-mismatched inputs. The full current non-normative docs inventory—including user guide, federation historical task/MILESTONES status, and non-operative SETUP—has an exact safe disposition. Scanner semantic checks reject automatic first-boot/startup extension/schema/migration wording, Compose-up-before-runner, init-script authority, and production `.env`/monorepo auto-load/`EnvironmentFile=`/credential-export-or-argv/restart-as-secret-activation routes regardless of named/normative/status classification. The exact former README/dev/deployment Compose-first sequences, former SETUP wording, and exact former MILESTONES wording `pgvector extension installed + verified on startup` fail before inventory masking; only local PGlite data-layer work or non-PostgreSQL Compose is current (Gateway/Web local startup is held pending daemon/inherited/project-DSN rejection), while the held future sequence external bootstrap → TLS/roles → runner `--run` → `--verify` → Gateway/Compose readiness passes after KBN-101-00/-03/-05 artifacts land.
+1. `AC-K101-01`: DTO/command-matrix tests prove required modes, PGlite exception, `mosaic-db-migrator --help|--run|--verify`/stable exits/argv refusal, public-import negative, every finite classified DDL/static-bypass inventory path and both harness pairs reject `DATABASE_URL`-only before connection/DDL, no migration-to-runtime fallback, and `db:push` refusal outside an allowlisted disposable DB. The active `docs/guides/migrate-tier.md` route is inventoried to KBN-101-07 and proves runner-produced `--target-url-file /run/secrets/mosaic-migrate-target-url`, fixed paired provider-version file, and `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing/private-key isolation; Vault KV-v2 same-response version provenance, separate immutable generation mounts, importer CA, JCS/Ed25519 signature/key rotation/revocation, atomic artifact, expiry/replay, safe-fd secret-version/digest, canonical TLS/CA/server/database/role/manifest/schema bindings, dedicated non-DDL importer, consumer isolation/no log-oracle, and exact no-connection versus zero-DML rejection for missing/wrong/stale/replayed/tampered/wrong-key/substituted/generation-mismatched inputs. The full current non-normative docs inventory—including user guide, federation historical task/MILESTONES status, and non-operative SETUP—has an exact safe disposition. Scanner semantic checks reject automatic first-boot/startup extension/schema/migration wording, Compose-up-before-runner, init-script authority, production `.env`/monorepo auto-load/`EnvironmentFile=`/credential-export-or-argv/restart-as-secret-activation routes, and every unqualified operator-document `mosaic-db-migrator --run|--verify` hit regardless of named/normative/status classification. The exact former README/dev/deployment Compose-first sequences, former SETUP wording, exact former MILESTONES wording `pgvector extension installed + verified on startup`, former architecture-plan/PERFORMANCE/backlog runner routes, and any unqualified runner fixture fail before inventory masking. Only one `Held future procedure` Markdown section—bounded through the next equal-or-higher heading—may contain the explicit non-operative/no-current-command-authority form that names KBN-101-00/-03/-05 and preserves external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness; every runner hit outside that section fails. The README assertion for the checked-in direct CI `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` passes only as active legacy N-1, uncertified, non-authorizing-as-an-operator-route status against an isolated disposable CI database pending KBN-101-06 removal—not as an ordinary operator or approved DDL-authority route. Only local PGlite data-layer work or non-PostgreSQL Compose is current (Gateway/Web local startup is held pending daemon/inherited/project-DSN rejection).
 2. `AC-K101-02`: Fixed namespace lock contention/crash/readiness/non-interference and exact manifest-v1 reconciliation tests prove no replica race/runtime auto-migration and fail closed on every missing/unknown/duplicate/ambiguous/corrupt/stale ledger state.
 3. `AC-K101-03`: Actual PostgreSQL 17 + pgvector 0.8.2 control-file, catalog, Drizzle-generation, vector-query/operator, fresh/approved-owner/legacy-shadow/partial/resume/rollback/N-1, and real deployed-role tests prove `trusted` absent/untrusted plus relocatability, external-superuser `SET ROLE` create/update/`RESET ROLE` audit, exact `rolcanlogin=false`/`rolsuper=true`/zero-membership/no-runtime-secret state, platform/schema/extension-owner/migrator/importer/runtime separation, `pg_extension.extowner` plus owner-bearing extension-member/schema/version assertions, and runtime/migrator/schema-owner/importer/all-service-role `SET ROLE`/ALTER/DROP/member-update denial. They also prove `pg_catalog,mosaic` per-session pool safety, `mosaic_extensions` qualification, identifier injection denial, ownership/membership/ledger-read/TEMP/default grants, and unsafe privilege denial.
 4. `AC-K101-04`: Disposable standalone, federated/Swarm, and two-gateway verified-TLS positives plus for both pairs missing CA/wrong CA/wrong SAN/sslmode downgrade, server/Gateway key mode, UID/GID, secret-consumer isolation, and legacy-drain/`hostssl` negatives prove server bootstrap, ordering, and readiness; PGlite is expressly excluded from this PostgreSQL evidence.

docs/SITEMAP.md

@@ -21,10 +21,10 @@
 - [Workstream index](native-kanban-sot/INDEX.md) — artifact map, lane partition, and delivery order.
 - [Mission manifest](native-kanban-sot/MISSION-MANIFEST.md) — scope, authority, invariants, and gate model.
 - [Task decomposition](native-kanban-sot/TASKS.md) — dependency-ordered implementation slices and ownership boundaries.
-- [KBN-101 database role split](native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md) — rc.14 PGlite-data-layer/non-PostgreSQL-Compose boundary with Gateway/Web startup held pending DSN isolation, non-operative production secret/deployment boundary, and unmaskable former Compose/credential-route fixtures; Vault-authenticated importer URL/version generation with fixed isolated consumers/CA, runner-signed target-bound attestation, PostgreSQL-valid pgvector owner exception, disjoint card manifests, classifier, runner, verified TLS, activation, and certification prerequisite.
+- [KBN-101 database role split](native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md) — rc.15 PGlite-only current fleet boundary; held, non-operative future runner procedure naming KBN-101-00/-03/-05 with complete bootstrap → TLS/roles → run → verify → readiness; unmaskable unqualified-runner and legacy-CI status fixtures; plus prior attestation, pgvector owner, classifier, TLS, activation, and certification prerequisite.
 - [Federated tier data migration](guides/migrate-tier.md) — active KBN-101-07 operator route: runner-produced target attestation, dedicated non-DDL importer, and paired credential-/attestation-file references only.
 - [Frozen shared contract](native-kanban-sot/SHARED-CONTRACT.md) — schema, API, Coordinator, health, recovery, and migration contracts.
-- [KBN-101 exact-head security review](reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) — retained prior REQUEST CHANGES evidence for `da742ca`; rc.14 awaits independent exact-head re-review after closing the current Compose-before-runner and production-secret-route HIGH findings.
+- [KBN-101 exact-head security review](reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) — retained prior REQUEST CHANGES evidence for `da742ca`; rc.15 awaits independent exact-head re-review after closing the current runner/legacy-CI authority HIGH finding.
 - [Initial independent review](reports/native-kanban-sot/canon-initial-review-no-go.md) — KCR-001–016 findings that blocked the first draft.
 - [Final independent re-review](reports/native-kanban-sot/canon-final-rereview-go.md) — closure evidence and GO verdict.
 - [Ultron final gate](reports/native-kanban-sot/ultron-final-go.md) — final requirements, authority, schema, migration, recovery, and evidence review.

docs/federation/MILESTONES.md

@@ -54,7 +54,7 @@ Every milestone adds tests to these layers. A milestone cannot be claimed comple
 - Add `"tier": "federated"` to `mosaic.config.json` schema and validators
 - Docker Compose `federated` profile (`docker-compose.federated.yml`) adds: Postgres+pgvector (5433), Valkey (6380), dedicated volumes
 - Tier detector in gateway bootstrap: reads config, asserts required services reachable, refuses to start otherwise
-- **Historical/status only:** the prior startup-provisioning statement is superseded. Runtime/startup extension provisioning is forbidden. The only eligible sequence is external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway readiness; this record authorizes no current DDL, Compose/init, or startup path.
+- **Historical/status only:** the prior startup-provisioning statement is superseded. Runtime/startup extension provisioning is forbidden. PostgreSQL activation remains non-operative with no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land; this record authorizes no current DDL, Compose/init, or startup path.
 - Migration logic: safe upgrade path from `local`/`standalone` → `federated` (data export/import script, one-way)
 - `mosaic doctor` reports tier + service health
 - Gateway continues to serve as a normal standalone instance (no federation yet)

docs/federation/SETUP.md

@@ -1,18 +1,21 @@
 # Federated Tier Setup Guide
 
-> **KBN-101 N-1 hold:** This page is **non-operative** until KBN-101-08 activates a
+> **KBN-101 N-1 hold:** This page is **non-operative** and grants no current command
+> authority until KBN-101-00, KBN-101-03, and KBN-101-05 land and KBN-101-08 activates a
 > reviewed release. It does not authorize a deployment operation, initialization artifacts,
 > implicit extension/schema/migration creation, raw `CREATE`, direct database initialization, or
 > a Gateway against an unverified database. The prior direct-start wording is retired; its
 > regression fixture is owned by KBN-101-06.
 
-## Activation-only sequence
+## Held future procedure
+
+This section is non-operative and grants no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land.
 
 The deployment control plane—not an operator shell or deployment lifecycle hook—performs this
-exact sequence after activation authorization:
+exact held future sequence after activation authorization: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness.
 
-1. External privileged bootstrap provisions the approved database/extension prerequisites.
+1. External bootstrap provisions the approved database/extension prerequisites.
-2. The renderer installs the generation-pinned verified-TLS materials and roles.
+2. TLS/roles are installed through the generation-pinned renderer.
 3. The dedicated one-shot runner executes `mosaic-db-migrator --run`.
 4. The same runner executes `mosaic-db-migrator --verify`, including readiness and the
    importer-target attestation where that route is enabled.

docs/fleet/backlog-conventions.md

@@ -24,7 +24,7 @@ PGlite is real Postgres semantics in-process — including the row locks the ato
 claim relies on — so the **same code** runs on a laptop (embedded, single-host
 default) and on a full Postgres deployment. Switching tiers is config-only.
 
-For embedded PGlite only, the local backlog routine may prepare its local schema on first use. PostgreSQL never migrates on CLI first use: it requires the dedicated `mosaic-db-migrator --run` phase and its read-only runtime readiness check before `mosaic fleet backlog` connects.
+For embedded PGlite only, the local backlog routine may prepare its local schema on first use. **Current operator behavior is PGlite-only.** The PostgreSQL path is held until KBN-101 activation; no current PostgreSQL CLI route, runner, or first-use migration is available or authorized. A future activated PostgreSQL runtime may connect only after its separately certified readiness gate.
 
 ### Update safety
 

docs/guides/deployment.md

@@ -20,7 +20,7 @@ This command intentionally does not start PostgreSQL. Do not run a broad Compose
 PostgreSQL initialization mount, infer that current Compose is a production/federated route, or
 start Gateway/Web until KBN-101-02 supplies fail-closed local-tier/DSN isolation.
 
-## PostgreSQL and federated activation (future procedure)
+## Held future procedure
 
 PostgreSQL local, federated, Compose, and bare-metal production activation are held until these
 artifacts land and pass their independent gates:
@@ -29,12 +29,9 @@ artifacts land and pass their independent gates:
 2. **KBN-101-03** sole `mosaic-db-migrator` runner and verified-readiness artifact; and
 3. **KBN-101-05** Vault/secret-renderer-backed deployment and consumer-isolation artifact.
 
-The required future order is:
+The required future order is external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness.
 
-> external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
+This is a held, non-operative future activation specification with no current command authority. Do not invoke the named
-> `mosaic-db-migrator --verify` → Gateway/Compose readiness
-
-This is a future activation specification, not an executable procedure. Do not invoke the named
 runner, start PostgreSQL, or substitute a Compose/init/manual-SQL route until the owned artifacts
 are implemented and reviewed.
 
@@ -61,8 +58,8 @@ consumer-isolation, mode/owner, and no-mixed-generation evidence—not improvise
 ## Readiness and troubleshooting status
 
 Until the future procedure is implemented, do not diagnose PostgreSQL with ad hoc SQL, connection
-strings, or initialization scripts. The future sanitized `mosaic-db-migrator --verify` readiness
+strings, or initialization scripts. The future sanitized runner-verification readiness artifact is
-artifact is the required PostgreSQL readiness authority after its bootstrap/TLS prerequisites pass.
+the required PostgreSQL readiness authority after its bootstrap/TLS prerequisites pass.
 For local PGlite development, diagnose application behavior without introducing a PostgreSQL
 connection.
 

docs/guides/dev-guide.md

@@ -116,11 +116,11 @@ until KBN-101-02 rejects a daemon, inherited, root, or app-local PostgreSQL DSN
 tier before connection or DDL; KBN-101-05 then supplies the production renderer/Vault process-exec
 or `LoadCredential` boundary.
 
-### 4. PostgreSQL and federated activation (held)
+### Held future procedure
 
 PostgreSQL local and federated deployment are held until KBN-101-00 (external bootstrap),
 KBN-101-03 (runner), and KBN-101-05 (renderer-backed deployment) land. The following is the
-**future activation order, not a command sequence that is currently executable**:
+**held, non-operative future activation order with no current command authority**:
 
 external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
 `mosaic-db-migrator --verify` → Gateway/Compose readiness.

docs/guides/migrate-tier.md

@@ -1,15 +1,16 @@
 # Migrating to the Federated Tier
 
 > **KBN-101-07 ownership:** This active documentation is a **non-operative KBN-101
-> contract** until KBN-101-02/-03/-05/-06 land and KBN-101-08 activates an exact reviewed
+> contract** with no current command authority until KBN-101-00, KBN-101-02, KBN-101-03, KBN-101-05, and KBN-101-06 land and
-> release. The commands below describe the produced interface only. Do not run them on the
+> KBN-101-08 activates an exact reviewed release. The commands below describe the produced interface only. Do not run them on the
 > current branch or replace them with direct PostgreSQL, raw SQL, legacy storage migration, or
 > credential-on-argv procedures.
 
-## Required activation sequence
+## Held future procedure
 
-The deployment control plane executes, in order: external privileged bootstrap; verified TLS and
+This section is non-operative and grants no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land.
-roles; `mosaic-db-migrator --run`; `mosaic-db-migrator --verify`; then Gateway readiness. The
+
+The deployment control plane executes the complete held future procedure, in order: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. The
 runner is the only attestation producer after its verified TLS, identity, manifest, and schema
 checks. A data importer is never a schema bootstrap, extension installer, repair command, or DDL
 consumer.
@@ -43,15 +44,14 @@ fd. It neither logs nor exposes a URL/version/attestation/key oracle.
 After activation and only after approved target preparation, the future interface is:
 
 ```bash
-mosaic-db-migrator --run
+# Deployment control plane has already completed the held runner procedure above.
-mosaic-db-migrator --verify
 mosaic storage migrate-tier --to federated \
   --target-url-file /run/secrets/mosaic-migrate-target-url \
   --target-attestation-file /run/mosaic-attestations/migrate-target.v1.json \
   --dry-run
 ```
 
-The provider-version file is fixed deployment material, not argv. This connecting dry-run consumes its nonce; before an actual copy, obtain fresh `mosaic-db-migrator --verify` and a new sealed handoff. The runner uses its migration
+The provider-version file is fixed deployment material, not argv. This connecting dry-run consumes its nonce; before an actual copy, the deployment control plane must provide fresh runner verification and a new sealed handoff. The runner uses its migration
 identity; the importer connects only as non-DDL `mosaic_data_importer` and only after all
 pre-connect validation. After verified TLS and before DML it compares PostgreSQL system ID,
 database OID, `current_user`, CA/SPKI, and manifest/schema fingerprints to the artifact.
@@ -77,7 +77,7 @@ verification.
 After reviewed dry-run, obtain the required fresh verification/attestation generation, then use:
 
 ```bash
-mosaic-db-migrator --verify
+# Deployment control plane has supplied fresh runner verification and attestation.
 mosaic storage migrate-tier --to federated \
   --target-url-file /run/secrets/mosaic-migrate-target-url \
   --target-attestation-file /run/mosaic-attestations/migrate-target.v1.json \

docs/native-kanban-sot/INDEX.md

@@ -1,17 +1,17 @@
 # Native Kanban/SOT Canon
 
-**Status:** KCR-001–016 independently cleared; KBN-101 rc.14 current-document Compose/production-secret remediation awaits independent exact-head re-review under issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771)
+**Status:** KCR-001–016 independently cleared; KBN-101 rc.15 current-document runner/legacy-CI authority remediation awaits independent exact-head re-review under issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771)
 **Date:** 2026-07-14
 **Implementation hold:** no feature implementation starts until this canon is squash-merged to `main` with terminal-green CI; after merge, every slice remains held until its KBN prerequisite graph is satisfied.
 
 ## Artifacts
 
 | Artifact                                                                                                       | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | [Canonical requirements](../requirements/native-kanban-sot.md)                                                 | Canonical P0–P3 requirements, all seven ratified decisions, fixed invariants, thin MVP, recovery tiers, non-goals, and per-requirement acceptance criteria                                                                                                                                                                                                                                                                                                                                                                     |
 | [`MISSION-MANIFEST.md`](./MISSION-MANIFEST.md)                                                                 | Mission/authority boundaries, exact role chain, gate model, mandatory SecReview triggers, Certifier final/no-merge rule, and collision-free slice ownership                                                                                                                                                                                                                                                                                                                                                                    |
 | [`TASKS.md`](./TASKS.md)                                                                                       | Dependency-ordered, bounded P0–P3 slices with IN/OUT scope, dependencies, shared contracts, file ownership, evidence, and USC coder2/3/4/5 parallelization                                                                                                                                                                                                                                                                                                                                                                     |
-| [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md)                                                       | rc.14 PGlite-data-layer/non-PostgreSQL-Compose boundary with Gateway/Web startup held pending DSN isolation, non-operative production deployment/secret boundary, exact former Compose and credential-route semantic fixtures; PostgreSQL-valid pgvector owner exception; Vault-authenticated importer URL/version generation with fixed isolated consumers/CA and sealed producer-to-importer attestation handoff, runner-signed target-bound attestation, exhaustive operator-route inventory; exact disjoint card manifests, mechanical DDL classifier, executable `mosaic-db-migrator`, two-gateway TLS/bootstrap, role/search-path, atomic activation, and certification contract; foundation prerequisite of KBN-100 and real-role gate before KBN-105 |
+| [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md)                                                       | rc.15 PGlite-only current fleet behavior; held/non-operative future runner procedure naming KBN-101-00/-03/-05 and complete bootstrap → TLS/roles → run → verify → readiness sequence; unmaskable unqualified-runner and legacy-CI status fixtures; plus prior non-operative production boundary, pgvector owner exception, attestation, exhaustive inventory, disjoint manifests, DDL classifier, TLS/bootstrap, activation, and certification contract; foundation prerequisite of KBN-100 and real-role gate before KBN-105 |
 | [`SHARED-CONTRACT.md`](./SHARED-CONTRACT.md)                                                                   | Remediated v1 integration contract: proof authority, exact failures/routes/DTOs/MCP ownership, concrete current-main field migration map, relational invariants, Coordinator split, recovery delivery                                                                                                                                                                                                                                                                                                                          |
 | [`contracts/kanban-schema.v1.ts`](./contracts/kanban-schema.v1.ts)                                             | Drizzle target declarations including exact owner/principal membership, project congruence, tags/archive, proposals, persisted assignments, monotonic fences, durable retry, immutable evidence/audit                                                                                                                                                                                                                                                                                                                          |
 | [`contracts/mechanical-coordinator.v1.ts`](./contracts/mechanical-coordinator.v1.ts)                           | Pure snapshot decision engine separated from persistence/service adapter; ID-bound approvals, bigint-safe fences, durable retry/quarantine, artifact-backed checkpoints, exact failures                                                                                                                                                                                                                                                                                                                                        |
@@ -19,7 +19,7 @@
 | [`contracts/recovery-posture.v1.ts`](./contracts/recovery-posture.v1.ts)                                       | Provider-neutral shape schema plus normative runtime refinement, cross-field constraints, and Lite/Standard/High-assurance defaults                                                                                                                                                                                                                                                                                                                                                                                            |
 | [`tsconfig.json`](./tsconfig.json)                                                                             | Strict no-emit project scope for linting and compiling the four frozen TypeScript contracts against the current Stack Drizzle declarations                                                                                                                                                                                                                                                                                                                                                                                     |
 | [`DOCUMENTATION-CHECKLIST.md`](./DOCUMENTATION-CHECKLIST.md)                                                   | Publication documentation gate and implementation-slice deferrals                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| [KBN-101 exact-head security review](../reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) | Historical `da742ca` REQUEST CHANGES report retained as prior closure evidence; rc.14 awaits independent exact-head re-review after closing the current Compose-before-runner and production-secret-route HIGH findings                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| [KBN-101 exact-head security review](../reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) | Historical `da742ca` REQUEST CHANGES report retained as prior closure evidence; rc.15 awaits independent exact-head re-review after closing the current runner/legacy-CI authority HIGH finding                                                                                                                                                                                                                                                                                                                                |
 | [Initial independent review](../reports/native-kanban-sot/canon-initial-review-no-go.md)                       | KCR-001–016 findings that blocked the first draft                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | [Final independent re-review](../reports/native-kanban-sot/canon-final-rereview-go.md)                         | Closure matrix, reproducible validation evidence, and GO verdict                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | [Ultron final gate](../reports/native-kanban-sot/ultron-final-go.md)                                           | Final requirements, authority, schema, migration, recovery, decomposition, and evidence review GO                                                                                                                                                                                                                                                                                                                                                                                                                              |

docs/native-kanban-sot/SHARED-CONTRACT.md

@@ -1,13 +1,19 @@
 # Native Kanban/SOT — Remediated Shared Contract v1
 
-**Status:** CONTROL-PLANE rc.14 KBN-101 current-document Compose/production-secret remediation complete; awaiting independent exact-head re-review. Prior KCR-001–016 and rc.4 SI-001 decisions retained; KBN-101 foundation certification precedes KBN-100 and real immutable-operation certification precedes KBN-105
+**Status:** CONTROL-PLANE rc.15 KBN-101 current-document runner/legacy-CI authority remediation complete; awaiting independent exact-head re-review. Prior KCR-001–016 and rc.4 SI-001 decisions retained; KBN-101 foundation certification precedes KBN-100 and real immutable-operation certification precedes KBN-105
-**Version:** 1.0.0-rc.14
+**Version:** 1.0.0-rc.15
 **Date:** 2026-07-15
 **Change authority:** Mosaic control plane/Jason only
 **SI-001 amendment authority:** `web1:mosaic-100` control-plane decision under issue #753
 
 ## Amendment record
 
+### 1.0.0-rc.15 — Held runner and legacy-CI authority closure
+
+- **Held runner only:** Current operator documents cannot advertise `mosaic-db-migrator --run|--verify` as executable. The sole passing future form is one `Held future procedure` Markdown section, bounded through its next equal-or-higher heading, that explicitly says non-operative/no-current-command-authority, names KBN-101-00/-03/-05, and preserves external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Any runner hit outside that section fails before inventory/ownership/status masking.
+- **PGlite/current-CI boundary:** Fleet backlog current behavior is PGlite-only; PostgreSQL CLI/runner authority remains held until activation. README classifies the checked-in direct `db:migrate` CI job as active legacy N-1, uncertified, non-authorizing as an operator route, and pending KBN-101-06 removal; it is a known direct-DDL exception against an isolated disposable CI database, not approved ordinary behavior. The -06 fixture asserts every required status term and rejects ordinary-authority presentation.
+- **Non-effect:** prior Compose, production-secret, attestation, pgvector, manifest, lock, TLS, activation, and serial-gate closures remain unchanged.
+
 ### 1.0.0-rc.14 — Current Compose and production-secret route closure
 
 - **Current developer boundary:** `README.md` and `docs/guides/dev-guide.md` permit only in-process PGlite data-layer work and explicitly selected non-PostgreSQL Compose services. Gateway/Web local start is held because the current unguarded loader can inherit a daemon/project PostgreSQL DSN and reach runtime DDL; KBN-101-02 must reject it before connection. The current PostgreSQL Compose mount is legacy/unqualified; PostgreSQL and federated activation are held until KBN-101-00/-03/-05 and then follow external bootstrap → TLS/roles → runner `--run` → `--verify` → Gateway/Compose readiness.

docs/native-kanban-sot/TASKS.md

@@ -95,13 +95,13 @@ No consumer implementation begins before KBN-105. No schema work begins before K
 
 ### KBN-101 — PostgreSQL runtime/migration role split and deployed-role certification
 
-- **Status:** IN PROGRESS — issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771); rc.14 closes the exact-head current-document HIGH findings: README/dev guide permit only PGlite data-layer work or non-PostgreSQL Compose; Gateway/Web local start is held until -02 rejects daemon/inherited/project DSNs; deployment is non-operative for production until -00/-03/-05; and -06 has unmaskable former Compose-first and production credential-route negatives. It awaits independent exact-head re-review; implementation remains held.
+- **Status:** IN PROGRESS — issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771); rc.15 closes HIGH-1 current-document runner/legacy-CI authority: operator runner mentions are held/non-operative until -00/-03/-05 with the complete bootstrap → TLS/roles → run → verify → readiness sequence; PostgreSQL fleet CLI behavior is held/PGlite-only; and README classifies current direct CI `db:migrate` as legacy N-1, uncertified, non-authorizing, pending -06 removal. The -06 fixture rejects any unqualified runner/current-CI authority before masking. It awaits independent exact-head re-review; implementation remains held.
 - **Owner:** Mos integration control plane; independently reviewed by security/Ultron.
 - **Mode:** SERIAL foundation certificate blocks KBN-100; its post-KBN-100 real immutable-operation certificate blocks KBN-105.
 - **IN:** Exact `DATABASE_URL` non-owner runtime versus `DATABASE_MIGRATION_URL` owner/migrator connection contract; sole published `mosaic-db-migrator --run|--verify` PostgreSQL DDL path and all legacy/future entrypoint closure; active migrate-tier destination only after runner prepare/verify through exact `--target-url-file /run/secrets/mosaic-migrate-target-url`, paired authenticated provider-version file, and signed `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing key/public-key isolation; canonical Vault KV-v2 target URL/version, generation-pinned renderer, importer CA/public-key/attestation plus privileged sealed producer-to-importer handoff, safe-fd/consumer-isolation/no-log-oracle, TLS/server/database/role/manifest/schema binding, expiry/replay/provider-rotation/TOCTOU/no-DML controls, and dedicated non-DDL importer; finite exact-path scanner/allowlist/active-route review plus unsuppressible automatic-startup/init/Compose-before-runner semantic negatives and every-path before-connect denial matrix; `DATABASE_TLS_CA_CERT_PATH` plus operator/IaC CA/server-key/cert lifecycle, exact service-DNS SANs, Vault/compose/Swarm mount modes, TLS server/bootstrap/rotation/rollback; PGlite exception; fixed two-int advisory lock; manifest-v1 logical-index/tag/exact-byte-SHA-256 ledger reconciliation including safe `0009`; fixed `mosaic` schema and exact `pg_catalog,mosaic` pooled session path; platform/schema/`NOLOGIN SUPERUSER` extension-owner/migrator/importer/runtime roles; approved-owner versus legacy-owner shadow pgvector transition; ownership, zero membership/no runtime secret, TEMP/ledger-read/default privilege and immutable grant proof; N-1 inactive prepared cards then atomic activation/rollback authority; Vault/redaction/observability/operator runbooks; one-card/one-PR implementation DAG.
 - **OUT:** Production mutation in this planning card; KBN-100 tables/data backfill; application API behavior; KBN-105 route/DTO freeze.
 - **Depends on:** KBN-010 completed.
-- **Contract surfaces:** [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md); `SHARED-CONTRACT.md` rc.14 amendment.
+- **Contract surfaces:** [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md); `SHARED-CONTRACT.md` rc.15 amendment.
 - **Evidence:** foundation: exact `--help|--run|--verify`/exit/argv/import-negative plus DTO entrypoint negatives for every finite classified current DDL/static-bypass path (including `DATABASE_URL`-only, runner fixture, retired init, sanitized current operator guidance, both harness pairs, and `db:push` refusal); active migrate-tier paired URL/version/attestation files, signing/public-key isolation, canonical Vault KV-v2 authenticated version, generation-pinned renderer, importer CA, safe fd/TOCTOU/consumer-isolation/no-log-oracle, atomic JCS/Ed25519, digest/TLS/server/database/role/manifest/schema binding, expiry/replay/provider rotation/revocation, zero-connection versus zero-DML, prepared-target/importer/no-DDL negatives; clean/pre-0009/skipped/applied-late/duplicate/unknown/missing/corrupt/stale/backup plus public-to-`mosaic`/partial/reverse runner proof; fixed-lock contention/crash/readiness/unrelated-key tests; runtime cannot invoke migrations/DDL/TEMP; actual pgvector 0.8.2 control metadata, fresh/approved-owner existing/legacy-owner shadow/partial-resume-rollback/N-1 pgvector evidence with `rolcanlogin=false`, `rolsuper=true`, zero members, external-superuser `SET ROLE`/`RESET ROLE` audit, `pg_extension.extowner`, owner-bearing member/schema/version and runtime/migrator/schema-owner/importer/all-service-role `SET ROLE`/ALTER/DROP/member-update denial; disposable standalone, federated/Swarm, and two-gateway verified-TLS positives plus both-pair CA/SAN/downgrade/key mode/UID-GID/URL-secret consumer-isolation and legacy-drain/`hostssl` zero-plaintext negatives; exclusive bootstrap/renderer/manifest ownership test; catalog relocation/vector-query/operator/Drizzle-only-`mosaic`, role/grant/search-path/pool-reset/identifier checks; N-1/atomic TLS-only rollback/no-force-on-red rehearsal; named Vault/bootstrap-control-plane/CA-overlap/redaction/operator evidence; independent author≠reviewer security GO. Post-KBN-100: real deployed non-owner INSERT/SELECT and UPDATE/DELETE denial for immutable event/artifact/evidence relations plus Ultron GO.
 
 ### KBN-100 — Unified Drizzle schema and concrete N-1 migration

docs/plans/2026-03-15-agent-platform-architecture.md

@@ -1460,14 +1460,11 @@ Add to `packages/db/src/schema.ts` in the `preferences` table definition:
 mutable: boolean('mutable').notNull().default(true),
 ```
 
-Generate and apply:
+### Held future procedure
 
-```bash
+This historical architecture plan grants **no current command authority**. PostgreSQL execution is non-operative until **KBN-101-00, KBN-101-03, and KBN-101-05** land; do not invoke a PostgreSQL runner from this checkout. After those cards land, the approved future procedure is exactly: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Offline migration artifact generation belongs to its owning implementation card and does not activate PostgreSQL execution.
-pnpm --filter @mosaicstack/db db:generate  # generates migration SQL
-mosaic-db-migrator --run                   # sole PostgreSQL migration runner
-```
 
-> **KBN-101 supersession:** `pnpm --filter @mosaicstack/db db:migrate` is superseded and MUST NOT be used. The runner receives only deployment-injected migration credentials; it accepts no URL, SQL, schema, or role argv.
+> **KBN-101 supersession:** `pnpm --filter @mosaicstack/db db:migrate` is superseded and MUST NOT be used. The future runner receives only deployment-injected migration credentials; it accepts no URL, SQL, schema, or role argv.
 
 Platform enforcement keys (seeded with `mutable = false` by gateway `PreferencesService.onModuleInit()`):
 

docs/scratchpads/771-kbn101-db-role-split.md

@@ -164,3 +164,11 @@ Independent Codex review found two blockers and security review found two medium
 - **Validation:** Prettier PASS (12 changed docs); local-link resolver PASS (71 links); `pnpm exec tsc --noEmit -p docs/native-kanban-sot/tsconfig.json` PASS; full README/CLAUDE/docs inventory PASS (104 documents, 0 active non-normative Compose/init/production-credential violations); manifest reconstruction PASS (10 cards, 95 declared path tokens, 0 overlaps); `git diff --check` PASS. Pre-existing `.mosaic/orchestrator/{mission.json,session.lock}` remains intentionally unstaged.
 - **Final route correction:** Held the residual MCP environment/restart and historical TUI smoke-test routes after review showed they could bypass the Gateway local-start hold; no bearer-token-over-HTTP or Gateway restart route remains in this remediation scope.
 - **Delivery:** committed `7cc156b777189ee89448e4d569a8b3f69560a240` (`docs(#771): hold unsafe database startup routes`) and `d8f935c20ade835aa3ec03fe5d6961885d8b5f0b` (`docs(#771): record final route correction`). Push queue guard returned `state=unknown` without failure; both pushes completed and the remote matched `d8f935c` before this final delivery-evidence append. `.mosaic/orchestrator/{mission.json,session.lock}` remains pre-existing and unstaged. Await a fresh independent exact-head re-review/Ultron verification.
+
+## 2026-07-15 — rc.15 exact one-finding runner/legacy-CI remediation intake
+
+- **Objective / scope:** Close only HIGH-1 in `/home/hermes/agent-work/reviews/771-kbn101-contract-rereview9-be0ebfd.md` against `be0ebfdc6a2b32a0ab6989117ebbb12f43854d71`. Documentation/tracking only: no source, Compose, CI, deployment, migration, Vault, reports, or `.mosaic` edit.
+- **Plan:** Replace imperative current runner routes in the architecture plan and PERFORMANCE with one explicit non-operative future procedure; make fleet backlog current behavior PGlite-only and PostgreSQL held; classify README's checked-in direct CI `db:migrate` as legacy N-1/uncertified/non-authorizing pending KBN-101-06 removal; then extend the future KBN-101-06 lexical/semantic inventory contract so unqualified runner/current-CI authority fails before masking while only the complete named held procedure passes. Synchronize required contract/PRD/shared/task/index/sitemap state, run full docs scan and document gates, stage docs only, commit, queue-guard, push, and verify remote SHA.
+- **TDD decision:** not applicable: the user authorizes documentation only and the named -06 fixture/inventory files do not yet exist; the contract records their required future implementation evidence.
+- **Remediation / review closure:** Architecture, PERFORMANCE, federation SETUP/MILESTONES, deployment/dev/migrate-tier, and README now use one Markdown-bounded `Held future procedure` form where needed: non-operative/no-current-command-authority; KBN-101-00/-03/-05; external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Any runner hit outside that section is a -06 semantic failure. Fleet backlog current behavior is PGlite-only. README accurately records the checked-in direct CI migration as an active, isolated-disposable-database, uncertified legacy N-1 DDL exception that is non-authorizing as an operator route and pending -06 removal; it no longer falsely claims the current CI role lacks DDL capability. Independent Codex review found and this pass closed the readiness-endpoint, standalone-verify, CI-factuality, and scanner-boundary findings. Its only residual finding concerns pre-existing tracked `.mosaic/orchestrator` runtime state, which is explicitly excluded and unstaged by task scope; security review found no vulnerability.
+- **Validation:** changed-doc Prettier PASS; `pnpm exec tsc --noEmit -p docs/native-kanban-sot/tsconfig.json` PASS; changed-doc local links 72/0; `git diff --check` PASS; full README/CLAUDE/docs lexical+semantic scan outside reports/scratchpads PASS (106 Markdown documents; 7 operator documents with runner tokens; zero unqualified future-runner/current-CI authority routes); KBN-101 manifest check PASS (10 dependency-ordered cards; -07 docs/-06 fixtures disjoint); docs-only allowlist PASS (16 docs, pre-existing `.mosaic` excluded).