Moves seat credential minting out of a brain-local fleet/bin into
packages/mosaic/framework/tools/fleet/, parameterized for any deployment:
- MOSAIC_ADMIN_SEAT (or --admin-seat) names the seat whose admin token calls
the Gitea admin API; no seat name is hardcoded.
- MOSAIC_GITEA_INSTANCES / MOSAIC_GITEA_URL_<INSTANCE> select and override
instances, the same convention seat-logins.sh already uses.
- MOSAIC_SEAT_EMAIL_DOMAIN sets the account email domain.
- tea projection calls the sibling seat-logins.sh, not a brain-local copy.
Hermetic suite test-mint-seat-credential.sh (mock curl, sandboxed brain home,
no tea, no network) pins: slot written from the mint response at mode 600;
admin seat must be configured (rc=3) and its token present (rc=1, no API
call); instance selection and URL override; admin token value never echoed.
Joins ci.yml and the verify-release canonical list. Adds tools/fleet/README.md.
Plan: docs/plans/2026-08-21_git-operations-toolkit.md step 6 (first of three
scripts; new-seat.sh and launch-seat.sh need a design ruling, see the plan).
Per ops-ci-01's procedure (comments 23386/23394, brain D27): pipeline config
travels with the commit under test, so the controlled rerun requires the pinned
anchor in the PR head itself. This merge absorbs everything next took since the
original merge parent (1bdeed62): the ci-base pin (cb9a0d1, lock-9cb7ffcd8828),
the legacy-credential removal (#1325), and the ci-queue-wait statuses:null fix
(#1129 — the branch from the divergence analysis, now landed).
One conflict, same file as round 1: test:framework-shell union — our 54-entry
chain plus next's new test-ci-queue-wait-no-status.sh entry at its position
(55 entries, every target existence-verified). Enumeration guard green:
population 61, enumerated 46, excluded (signed) 16.
Squash-merged by topher (jarvis principal) via break-glass: pr-merge.sh hard-codes main-only merge targets and cannot express this repo's next trunk. Gates: CI 2476 green at head 46784c8d, review 177 APPROVED (fred) at pinned head. First gated publish: every publish step now depends on verify-release at the exact commit.
invariant_r_unittest.py (landing with the lease-remediation stack, PR
#1109) hard-requires an installed `pi` binary pinned to the measured
version: it boots Pi's real tool registry and proves the broker's
read-only carve-out resolves to real, unshadowed builtins. Absent
runtime fails loud by design — so CI must provide it.
Install @earendil-works/[email protected].1 (the canonical Pi;
@mariozechner/* is embedded-legacy) at step level in the test step.
Step-level rather than baked into Dockerfile.ci because ci-image
publishes are currently blocked on registry UNAUTHORIZED; baking it in
is the follow-up once registry auth is fixed, at which point this line
degrades to a fast no-op guard like the openssl line above it.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh
Each step was re-running pnpm install independently, and all quality
steps (typecheck, lint, format, test) ran in parallel. On merge commits
with more accumulated code this pushed the CI runner over its memory
limit (exit code 254 = OOM kill).
Fix:
- install once, share node_modules via Woodpecker workspace volume
- sequential execution: install → typecheck → lint → format → test → build
- corepack enable in each step (fresh container) but no redundant install
fred
fredandgate-merge-01
ops-ci-01
ops-01
jarvis
jason.woltjeandMos