172 Commits

Author	SHA1	Message	Date
Hermes Agent	e88a89f34d	fix(framework): remediate Codex review findings in VAULT-SECRETS.md ... Two should-fix findings from automated Codex review: 1. Vault KV v2 policy path — add explicit path for exact top-level `secret/data/k3s/<app>` entry alongside the wildcard `/*` sub-path rule. Without the exact path, apps reading the top-level secret get permission denied from Vault KV v2 even with the wildcard. 2. Go envconfig example — remove unused `os` import from config.go snippet (os was only referenced in a comment). Move the main() usage to a separate clearly-labelled main.go block to make both snippets copy-paste compilable. Both fixes mirrored to duplicate path: guides/ <-> packages/mosaic/framework/guides/ Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-22 12:01:29 -05:00
Hermes Agent	373e4558a3	chore(framework): canonize Vault-as-SSOT + ESO-default secrets policy ... Encodes operator-approved (Jason, 2026-05-22) secrets policy as binding framework rules across all Mosaic agent sessions and projects. Changes: - STANDARDS.md: add "Secrets handling (HARD RULE)" subsection under Non-Negotiables — Vault as SSOT, ESO bridge as default, Direct-Vault opt-in only, forbidden ${VAR:-default} for required values, forbidden .env in prod, required startup schema validation - VAULT-SECRETS.md: add four new sections — architecture decision matrix (ESO vs Direct-Vault), full ESO bridge worked example (Vault path + ExternalSecret + Deployment YAML + zod/pydantic/Go validators), Direct-Vault opt-in pattern (AppRole provisioning + ESO bootstrap for chicken-and-egg), and forbidden patterns CI lint targets - BOOTSTRAP.md: add "Secrets Bootstrap" required subsection with checklist for new apps (Vault path, README docs, ExternalSecret, secretKeyRef, schema validator, Direct-Vault justification) All duplicate file paths kept in sync (md5-equal pairs): guides/ <-> packages/mosaic/framework/guides/ packages/mosaic/framework/defaults/STANDARDS.md (single copy in repo) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-22 11:58:27 -05:00
jason.woltje	ac5650d9f9	fix(db): bootstrap migrations on local-tier gateway startup ... Fresh `mosaic gateway install` (npm) left the gateway DB schema empty — sign-in 500'd with `relation "users" does not exist`, and every entry point (auth, bootstrap setup) failed because they all query the users table first. Five stacked bugs on the local (PGlite) tier: 1. `packages/db/package.json` `files: ["dist"]` excluded the `drizzle/` SQL migrations from the published tarball. 2. `runMigrations()` only supports postgres-js — unusable for embedded PGlite. 3. `apps/gateway/src/database/database.module.ts` never invoked migrations at startup. 4. `createPgliteDb` didn't load pgvector, so migration 0001's `CREATE EXTENSION vector` failed. 5. Drizzle's PG migrator wraps every migration in one outer transaction, which trips Postgres' `check_safe_enum_use` on migration 0009 (`ALTER TYPE ADD VALUE 'pending'` → `SET DEFAULT 'pending'` in the same tx). Changes: - Ship `drizzle/` in the published tarball. - `createPgliteDb` loads `@electric-sql/pglite/vector`. - New `runPgliteMigrations(handle)` walks the Drizzle journal and runs each statement-breakpoint chunk through PGlite's `client.exec()` (autocommit per statement). Records into `drizzle.__drizzle_migrations` for interop with the postgres-js path. Per-statement try/catch surfaces which statement of which migration failed. - `DatabaseModule` runs migrations in `OnModuleInit` before `app.listen()`. Local tier: explicit `runPgliteMigrations` then `storageAdapter.migrate()`. Postgres tier: just `storageAdapter.migrate()`, which already calls `runMigrations(url)` internally — no double-call. - Removed `packages/storage/src/test-utils/pglite-with-vector.ts`. The "intentionally not exported" rationale is moot now that migration 0001 forces pgvector load anyway. The integration test uses `createPgliteDb` + `runPgliteMigrations` from `@mosaicstack/db`. Tests: BetterAuth tables exist after migrate; idempotent (re-runs 0009); partial-failure surfaces statement-level context and leaves no ledger row. QA on a fresh PGlite install: - `Applying PGlite schema migrations...` then `Initializing storage adapter (pglite)...` in startup log. - `GET /api/bootstrap/status` → `{"needsSetup":true}` HTTP 200 (was 500). - `POST /api/bootstrap/setup` reaches Zod validator (was 500). Scope: this PR fixes the local (PGlite) tier. Postgres-tier first install still has the outer-transaction problem and a journal ordering bug (0009's `when` < 0008's). Documented inline as TODO and in the scratchpad — needs a separate change with real-Postgres validation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-04 17:06:50 -05:00
jason.woltje	ee3f2defd9	feat(types): federation v1 DTOs (FED-M3-01) (#506)	2026-04-24 02:54:40 +00:00
jason.woltje	74fe60d8d6	feat(federation): admin controller + CLI federation commands (FED-M2-08) (#498)	2026-04-22 04:39:46 +00:00
jason.woltje	0bfaa56e9e	feat(federation): enrollment controller + single-use token flow (FED-M2-07) (#497)	2026-04-22 04:23:19 +00:00
jason.woltje	01dd6b9fa1	feat(federation): grants service CRUD + status transitions (FED-M2-06) (#496)	2026-04-22 03:57:12 +00:00
jason.woltje	bf082d95a0	feat(federation): seal federation peer client keys at rest (FED-M2-05) (#495)	2026-04-22 03:10:20 +00:00
jason.woltje	54c278b871	feat(db): federation schema — grants/peers/audit_log [FED-M2-01] (#486)	2026-04-22 02:02:21 +00:00
jason.woltje	45e8f02c91	feat(mosaic-portainer): PORTAINER_INSECURE flag for self-signed TLS (#484)	2026-04-22 01:21:54 +00:00
jason.woltje	dc4afee848	fix(storage): redact credentials in driver errors + advisory lock (FED-M1-10) (#479)	2026-04-20 02:02:57 +00:00
jason.woltje	15d849c166	test(storage): integration test for migrate-tier (FED-M1-08) + camelCase column fix (#477)	2026-04-20 01:40:02 +00:00
jason.woltje	1a4b1ebbf1	feat(gateway,storage): mosaic gateway doctor with tier health JSON (FED-M1-06) (#475)	2026-04-20 01:00:39 +00:00
jason.woltje	ccad30dd27	feat(storage): mosaic storage migrate-tier with dry-run + idempotency (FED-M1-05) (#474)	2026-04-20 00:35:08 +00:00
jason.woltje	58169f9979	feat(storage): pgvector adapter support gated on tier=federated (FED-M1-03) (#472)	2026-04-19 23:42:18 +00:00
jason.woltje	9c89c32684	feat(config): add federated tier + rename team→standalone (FED-M1-01) (#470)	2026-04-19 23:11:11 +00:00
Jason Woltje	5f03c05523	chore(release): @mosaicstack/mosaic 0.0.30 (#459) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-12 02:18:17 +00:00
Jason Woltje	c3f810bbd1	fix(mosaic): seed TOOLS.md from defaults on install (#458) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-12 02:02:21 +00:00
Jason Woltje	b2cec8c6ba	fix(mosaic): stop yolo runtime from leaking runtime name as first user message (#455) ... Fixes mosaicstack/stack#454 Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-11 16:57:43 +00:00
Jason Woltje	81c1775a03	chore(release): @mosaicstack/mosaic 0.0.29 (#453) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-08 00:42:54 +00:00
Jason Woltje	f64ec12f39	fix(installer): preserve credentials dir and seed STANDARDS.md (#452) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-08 00:40:49 +00:00
Jason Woltje	026382325c	feat(framework): superpowers enforcement, typecheck hook, file-ownership rules (#451) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-04-07 00:44:22 +00:00
jason.woltje	1bfd8570d6	chore(release): @mosaicstack/mosaic 0.0.28 (#450)	2026-04-06 00:46:31 +00:00
jason.woltje	312acd8bad	chore: sweep mosaicstack/mosaic-stack → mosaicstack/stack + add short install URL (#448)	2026-04-06 00:39:56 +00:00
jason.woltje	d08b969918	fix(mosaic): mask password input in TUI login prompt (#449)	2026-04-06 00:33:54 +00:00
jason.woltje	bd76df1a50	feat(mosaic): drill-down main menu + provider-first flow + quick start (#446)	2026-04-06 00:15:23 +00:00
jason.woltje	172bacb30f	feat(mosaic): IUV-M02 — CORS/FQDN UX polish + skill installer rework (#444)	2026-04-05 23:44:07 +00:00
jason.woltje	0ae932ab34	fix: bootstrap hotfix — DTO erasure, wizard failure, port prefill, Pi SDK copy (mosaic-v0.0.26) (#440)	2026-04-05 21:43:30 +00:00
jason.woltje	a4c94d9a90	chore(release): @mosaicstack/mosaic 0.0.25 (#435)	2026-04-05 20:53:19 +00:00
jason.woltje	732f8a49cf	feat: unified first-run flow — merge wizard + gateway install (IUH-M03) (#433)	2026-04-05 19:13:02 +00:00
jason.woltje	cd8b1f666d	feat: wizard remediation — password mask, hooks preview, headless (IUH-M02) (#431)	2026-04-05 17:47:53 +00:00
jason.woltje	25cada7735	feat: mosaic uninstall (IUH-M01) (#429)	2026-04-05 17:06:21 +00:00
jason.woltje	417805f330	fix: bump memory/queue/storage to 0.0.4 to force republish (#423)	2026-04-05 14:39:15 +00:00
jason.woltje	2472ce52e8	fix: bump stale sub-package versions (brain/forge/log) (#422)	2026-04-05 14:26:30 +00:00
jason.woltje	597eb232d7	fix: revert mosaic to 0.0.22 alpha + republish macp (#421)	2026-04-05 14:15:46 +00:00
jason.woltje	b9d464de61	docs: CLI unification release v0.1.0 (M8) (#419)	2026-04-05 07:46:00 +00:00
jason.woltje	872c124581	feat(mosaic): unified first-run UX wizard -> gateway install -> verify (#418)	2026-04-05 07:29:17 +00:00
jason.woltje	a531029c5b	feat(mosaic): mosaic telemetry command (M6 CU-06-01..05) (#417)	2026-04-05 07:06:42 +00:00
jason.woltje	831193cdd8	fix(macp): align exports + add CLI smoke test (#415)	2026-04-05 06:57:42 +00:00
jason.woltje	df460d5a49	feat(macp): mosaic macp CLI surface (#410)	2026-04-05 06:33:52 +00:00
jason.woltje	119ff0eb1b	fix(mosaic): gateway token recovery review remediations (#414)	2026-04-05 06:13:29 +00:00
jason.woltje	641e4604d5	feat(forge): mosaic forge CLI surface (#412)	2026-04-05 06:08:50 +00:00
jason.woltje	4ebce3422d	feat(log): mosaic log CLI surface (#407)	2026-04-05 05:57:22 +00:00
jason.woltje	751e0ee330	feat(storage): mosaic storage CLI surface (#405)	2026-04-05 05:48:13 +00:00
jason.woltje	54b2920ef3	feat(memory): mosaic memory CLI surface (#406)	2026-04-05 05:44:06 +00:00
jason.woltje	5917016509	feat(mosaic): gateway token recovery via BetterAuth cookie (#411)	2026-04-05 05:43:49 +00:00
jason.woltje	7b4f1d249d	feat(mosaic): top-level mosaic config command (#408)	2026-04-05 05:37:05 +00:00
jason.woltje	5425f9268e	feat(queue): mosaic queue CLI surface (#404)	2026-04-05 05:27:59 +00:00
jason.woltje	febd866098	feat(brain): mosaic brain CLI surface (#403)	2026-04-05 05:20:44 +00:00
jason.woltje	2446593fff	feat(mosaic): alphabetize and group mosaic --help output (#402)	2026-04-05 05:12:32 +00:00