Owner direction: the stack must never impact default harness usage.
Correction to M19 as shipped (nothing had been created in ~/.pi — the
move breaks nothing).
- Mosaic-managed accounts: <dataRoot>/auth/<account>.json, perms 0600
enforced (loose perms flagged in listings, refused by --auth — mirrors
gitea-api.sh credential hygiene).
- ~/.pi is read-only to the stack, permanently; the only interaction
remains the existing read-only container mount of the default
credential. Recorded as a ROADMAP standing decision.
- auth.sh is now config-driven (data root from config.json, fail closed,
consistent with every other tool); status reports both sources labeled.
- agent.sh --auth resolution moved after load_config (needs the data
root); missing/symlinked/non-0600 accounts refuse.
- test-auth.sh: 15 no-Docker cases (accounts-create-nothing, loose-perms
refusal, invalid-config refusal added). Test-authoring correction
recorded in BUILD-LOG (fixture-state mismatch caught before running).
Suites 24/15/90/14/17 + verify green.
- verify.sh now calls bootstrap_runtime_dir after load_config; previously a
reset-then-verify flow let Docker auto-create a root-owned mount source
- common.sh: fail with clear guidance when data root exists but is not writable
- README: configuration section, bootstrap usage, selftest entry point
- BUILD-LOG: Phase 5 entries with corrections
E2E (clean slate): 20/20 selftests; bootstrap idempotent; config-driven
hello/verify MOSAIC_HELLO_OK; negative marker exit 1; reset + rerun green;
config checksum unchanged across the entire flow.
Closes#4
jason.woltje