Merge remote-tracking branch 'origin/next' into fix/1280-identity-first-resolution

# Conflicts: # packages/mosaic/package.json
Merge pull request 'fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion — unblocks every PR on next' (#1270 ) from fix/1269-ci-chain-unblock into next
2026-08-17 16:24:43 -05:00 · 2026-08-17 20:44:59 +00:00 · 2026-08-17 15:19:04 -05:00 · 2026-08-17 15:18:54 -05:00 · 2026-08-16 18:03:02 -05:00 · 2026-08-16 17:58:49 -05:00
28 changed files with 1428 additions and 1523 deletions
@@ -34,7 +34,6 @@ export default tseslint.config(
            'packages/storage/vitest.config.ts',
            'packages/mosaic/vitest.config.ts',
            'packages/mosaic/__tests__/*.ts',
-            'packages/forge/__tests__/*.ts',
            'tools/federation-harness/*.ts',
          ],
        },
@@ -539,43 +539,3 @@ Not every brief needs full Board of Directors review. The classification system
 ### Backward compatibility

 Existing briefs without a `class` field are auto-classified. The default (no matching keywords) is `strategic`, so all existing runs get the full pipeline unless keywords trigger `technical`.
-
---
-
-## Fail-Closed Execution & Explicit Simulation (SDLC-D-035)
-
-**Added:** 2026-08-17
-
-Forge fails closed when a required capability is missing. It never runs a
-pipeline with a stub executor and reports success.
-
-### Normal mode (default)
-
- No task executor wired → the CLI exits nonzero with the typed capability
-  error `FORGE_NO_EXECUTOR`. No run is created.
- A stage whose gate is approval-based (board approval, planning approvals,
-  remediation re-review, discovery/analysis attestations) records a typed
-  `waiting-for-authority` stage result and raises `FORGE_AUTHORITY_REQUIRED`.
-  It never passes vacuously.
- A stage whose gate requires an unwired provider (AI reviewer, CI pipeline)
-  records a typed `blocked` stage result and raises `FORGE_NO_REVIEWER` /
-  `FORGE_NO_CI_PIPELINE`. The synthetic echo-review approval in `06-review`
-  and all vacuous `true` gates were removed.
-
-### Explicit simulation (`--simulate`)
-
-Opts into stub/synthetic execution. Every stage result, every gate result, and
-the run manifest carry the distinct typed status `simulated` (manifest also
-records `mode: "simulated"`). `simulated` is a non-satisfying outcome:
-`isSatisfyingOutcome()` and all completion/gate consumers treat only `passed`
-as satisfying. The CLI exits 0 for a simulated run only because the caller
-explicitly passed `--simulate`, and prints a loud SIMULATED banner.
-
-### Typed outcome model
-
-Every gate/task outcome is one of the closed set
-`passed | failed | blocked | error | waiting-for-authority | simulated |
-not-applicable`, with the reason recorded on the stage status and each gate
-result in `manifest.json`. Missing implementations, missing gate evidence,
-unknown stages, process errors, and timeouts map to fail-closed members —
-never to `passed`.
@@ -1,319 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-
-import { generateBoardTasks } from '../src/board-tasks.js';
-import { STAGE_SPECS } from '../src/constants.js';
-import { ForgeCapabilityError } from '../src/errors.js';
-import {
-  evaluateStageGates,
-  gateLabel,
-  isCommandGate,
-  isSatisfyingOutcome,
-} from '../src/outcomes.js';
-import { loadManifest, runPipeline } from '../src/pipeline-runner.js';
-import type { ForgeTask, ForgeTaskResult, TaskExecutor } from '../src/types.js';
-
-/**
- * Mock real executor that returns typed results.
- *
- * Command gates are "verified" by the mock so normal-mode runs can pass
- * mechanically gated stages; authority/provider gates are never reported
- * because they have no mechanical implementation.
- */
-function createTypedExecutor(options?: {
-  failStage?: string;
-  gateOutcomes?: Record<string, 'passed' | 'failed' | 'simulated' | 'error' | 'blocked'>;
-}): TaskExecutor & { submittedTasks: ForgeTask[] } {
-  const submittedTasks: ForgeTask[] = [];
-  return {
-    submittedTasks,
-    async submitTask(task: ForgeTask) {
-      submittedTasks.push(task);
-    },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
-      const task = submittedTasks.find((t) => t.id === taskId);
-      const stageName = task?.metadata?.['stageName'] as string | undefined;
-
-      if (options?.failStage && stageName === options.failStage) {
-        return {
-          task_id: taskId,
-          outcome: 'failed',
-          reason: 'mock task failure',
-          completed_at: new Date().toISOString(),
-          exit_code: 1,
-          gate_results: [],
-        };
-      }
-
-      const gateResults = (task?.qualityGates ?? [])
-        .filter((gate) => isCommandGate(gate))
-        .map((gate) => {
-          const label = gateLabel(gate);
-          const outcome = options?.gateOutcomes?.[label] ?? 'passed';
-          return {
-            gate: label,
-            outcome,
-            reason: outcome === 'passed' ? 'mock verified' : `mock gate outcome: ${outcome}`,
-          };
-        });
-
-      return {
-        task_id: taskId,
-        outcome: 'passed',
-        reason: 'mock verified',
-        completed_at: new Date().toISOString(),
-        exit_code: 0,
-        gate_results: gateResults,
-      };
-    },
-    async getTaskStatus() {
-      return 'completed' as const;
-    },
-  };
-}
-
-describe('fail-closed: no executor wired', () => {
-  let tmpDir: string;
-  let briefPath: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-failclosed-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('throws a typed FORGE_NO_EXECUTOR capability error without --simulate', async () => {
-    await expect(
-      runPipeline(briefPath, tmpDir, {
-        // no executor, no simulate — must fail closed, never run with a stub
-        stages: ['00-intake'],
-      }),
-    ).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_EXECUTOR',
-      capability: 'task-executor',
-    });
-  });
-
-  it('does not create a run directory when failing closed on a missing executor', async () => {
-    try {
-      await runPipeline(briefPath, tmpDir, { stages: ['00-intake'] });
-    } catch {
-      // expected
-    }
-    expect(fs.existsSync(path.join(tmpDir, '.forge', 'runs'))).toBe(false);
-  });
-
-  it('completes with every result typed simulated when simulate is set', async () => {
-    const result = await runPipeline(briefPath, tmpDir, {
-      simulate: true,
-      stages: ['00-intake', '00b-discovery', '02-planning-1', '06-review'],
-    });
-
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.manifest.status).toBe('simulated');
-
-    for (const stage of result.stages) {
-      const stageStatus = result.manifest.stages[stage];
-      expect(stageStatus?.status, `stage ${stage}`).toBe('simulated');
-      expect(stageStatus?.status, `stage ${stage}`).not.toBe('passed');
-      expect(stageStatus?.reason, `stage ${stage}`).toBeTruthy();
-      for (const gateResult of stageStatus?.gateResults ?? []) {
-        expect(gateResult.outcome, `gate ${gateResult.gate} of ${stage}`).toBe('simulated');
-        expect(gateResult.outcome, `gate ${gateResult.gate} of ${stage}`).not.toBe('passed');
-      }
-    }
-
-    // The persisted manifest agrees.
-    const persisted = loadManifest(result.runDir);
-    expect(persisted.mode).toBe('simulated');
-    expect(persisted.status).toBe('simulated');
-    expect(persisted.stages['02-planning-1']?.status).toBe('simulated');
-  });
-});
-
-describe('fail-closed: typed outcome model', () => {
-  it('only passed satisfies the gate/dependency predicate', () => {
-    expect(isSatisfyingOutcome('passed')).toBe(true);
-    expect(isSatisfyingOutcome('failed')).toBe(false);
-    expect(isSatisfyingOutcome('blocked')).toBe(false);
-    expect(isSatisfyingOutcome('error')).toBe(false);
-    expect(isSatisfyingOutcome('waiting-for-authority')).toBe(false);
-    expect(isSatisfyingOutcome('simulated')).toBe(false);
-    expect(isSatisfyingOutcome('not-applicable')).toBe(false);
-  });
-
-  it('a simulated gate result cannot satisfy the stage gate evaluation', () => {
-    const evaluation = evaluateStageGates('05-coding', STAGE_SPECS['05-coding']!.qualityGates, {
-      task_id: 'FORGE-x-05',
-      outcome: 'passed',
-      reason: 'executor claims success',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [{ gate: 'pnpm lint', outcome: 'simulated', reason: 'simulated gate' }],
-    });
-    expect(isSatisfyingOutcome(evaluation.outcome)).toBe(false);
-    expect(evaluation.outcome).toBe('error');
-  });
-
-  it('a simulated task outcome cannot satisfy evaluation in normal mode', () => {
-    const evaluation = evaluateStageGates('00-intake', [], {
-      task_id: 'FORGE-x-00',
-      outcome: 'simulated',
-      reason: 'executor reported simulated',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [],
-    });
-    expect(isSatisfyingOutcome(evaluation.outcome)).toBe(false);
-  });
-
-  it('a missing gate result blocks the stage instead of passing vacuously', () => {
-    const evaluation = evaluateStageGates('05-coding', STAGE_SPECS['05-coding']!.qualityGates, {
-      task_id: 'FORGE-x-05',
-      outcome: 'passed',
-      reason: 'executor claims success',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [],
-    });
-    expect(evaluation.outcome).toBe('blocked');
-  });
-});
-
-describe('fail-closed: authority and provider gates', () => {
-  let tmpDir: string;
-  let briefPath: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-authority-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it.each(['02-planning-1', '03-planning-2', '04-planning-3', '07-remediate'])(
-    'planning/remediation stage %s yields waiting-for-authority (not passed) in normal mode',
-    async (stage) => {
-      const executor = createTypedExecutor();
-      let runDir: string | undefined;
-
-      try {
-        await runPipeline(briefPath, tmpDir, {
-          executor,
-          stages: [stage as string],
-        });
-        expect.unreachable('runPipeline should have failed closed');
-      } catch (err) {
-        expect(err).toBeInstanceOf(ForgeCapabilityError);
-        expect((err as ForgeCapabilityError).code).toBe('FORGE_AUTHORITY_REQUIRED');
-        runDir = path.join(tmpDir, '.forge', 'runs');
-      }
-
-      const runIds = fs.readdirSync(runDir!);
-      expect(runIds).toHaveLength(1);
-      const manifest = loadManifest(path.join(runDir!, runIds[0]!));
-      expect(manifest.stages[stage]?.status).toBe('waiting-for-authority');
-      expect(manifest.stages[stage]?.status).not.toBe('passed');
-      expect(manifest.status).toBe('waiting-for-authority');
-    },
-  );
-
-  it('review stage fails closed with a typed FORGE_NO_REVIEWER error in normal mode', async () => {
-    const executor = createTypedExecutor();
-
-    try {
-      await runPipeline(briefPath, tmpDir, {
-        executor,
-        stages: ['06-review'],
-      });
-      expect.unreachable('runPipeline should have failed closed');
-    } catch (err) {
-      expect(err).toBeInstanceOf(ForgeCapabilityError);
-      expect((err as ForgeCapabilityError).code).toBe('FORGE_NO_REVIEWER');
-      expect((err as ForgeCapabilityError).capability).toBe('reviewer');
-    }
-
-    const runsDir = path.join(tmpDir, '.forge', 'runs');
-    const runIds = fs.readdirSync(runsDir);
-    const manifest = loadManifest(path.join(runsDir, runIds[0]!));
-    expect(manifest.stages['06-review']?.status).toBe('blocked');
-    expect(manifest.stages['06-review']?.status).not.toBe('passed');
-    expect(manifest.status).toBe('failed');
-  });
-
-  it('review stage produces simulated results under --simulate', async () => {
-    const result = await runPipeline(briefPath, tmpDir, {
-      simulate: true,
-      stages: ['06-review'],
-    });
-
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.manifest.stages['06-review']?.status).toBe('simulated');
-    for (const gateResult of result.manifest.stages['06-review']?.gateResults ?? []) {
-      expect(gateResult.outcome).toBe('simulated');
-    }
-  });
-
-  it('deploy stage fails closed without a wired ci-pipeline provider in normal mode', async () => {
-    const executor = createTypedExecutor();
-
-    await expect(
-      runPipeline(briefPath, tmpDir, {
-        executor,
-        stages: ['09-deploy'],
-      }),
-    ).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_CI_PIPELINE',
-    });
-  });
-});
-
-describe('fail-closed: no vacuous gate commands remain', () => {
-  it('stage constants contain no echo/synthetic-approval, vacuous true, or empty gate commands', () => {
-    for (const [stageName, spec] of Object.entries(STAGE_SPECS)) {
-      for (const gate of spec.qualityGates) {
-        const serialized = JSON.stringify(gate);
-        // The echo-review synthetic approval must be gone.
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toContain('echo');
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toMatch(/"verdict"\s*:/);
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toMatch(
-          /"summary"\s*:\s*"review-pass"/,
-        );
-        // No vacuous literal `true` gate.
-        expect(gate, `stage ${stageName}`).not.toBe('true');
-        // Command gates must carry a real, non-empty command.
-        if (isCommandGate(gate)) {
-          const command = typeof gate === 'string' ? gate : gate.command;
-          expect(command.trim().length, `stage ${stageName} gate ${serialized}`).toBeGreaterThan(0);
-        }
-      }
-    }
-  });
-
-  it('board tasks contain no vacuous true gates', () => {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-board-gates-'));
-    try {
-      const tasks = generateBoardTasks('# Brief', [], tmpDir, 'BOARD-TEST');
-      for (const task of tasks) {
-        for (const gate of task.qualityGates) {
-          expect(gate, `task ${task.id}`).not.toBe('true');
-          const serialized = JSON.stringify(gate);
-          expect(serialized, `task ${task.id} gate ${serialized}`).not.toContain('echo');
-        }
-      }
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  });
-});
@@ -12,10 +12,10 @@ import {
  resumePipeline,
  getPipelineStatus,
 } from '../src/pipeline-runner.js';
-import type { ForgeTask, ForgeTaskResult, RunManifest, TaskExecutor } from '../src/types.js';
-import { gateLabel, isCommandGate } from '../src/outcomes.js';
+import type { ForgeTask, RunManifest, TaskExecutor } from '../src/types.js';
+import type { TaskResult } from '@mosaicstack/macp';

-/** Mock TaskExecutor that records submitted tasks and returns typed results. */
+/** Mock TaskExecutor that records submitted tasks and returns success. */
 function createMockExecutor(options?: {
  failStage?: string;
 }): TaskExecutor & { submittedTasks: ForgeTask[] } {
@@ -25,7 +25,7 @@ function createMockExecutor(options?: {
    async submitTask(task: ForgeTask) {
      submittedTasks.push(task);
    },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
+    async waitForCompletion(taskId: string): Promise<TaskResult> {
      const failStage = options?.failStage;
      const task = submittedTasks.find((t) => t.id === taskId);
      const stageName = task?.metadata?.['stageName'] as string | undefined;
@@ -33,8 +33,7 @@ function createMockExecutor(options?: {
      if (failStage && stageName === failStage) {
        return {
          task_id: taskId,
-          outcome: 'failed',
-          reason: 'mock task failure',
+          status: 'failed',
          completed_at: new Date().toISOString(),
          exit_code: 1,
          gate_results: [],
@@ -42,17 +41,10 @@ function createMockExecutor(options?: {
      }
      return {
        task_id: taskId,
-        outcome: 'passed',
-        reason: 'mock verified',
+        status: 'completed',
        completed_at: new Date().toISOString(),
        exit_code: 0,
-        gate_results: (task?.qualityGates ?? [])
-          .filter((gate) => isCommandGate(gate))
-          .map((gate) => ({
-            gate: gateLabel(gate),
-            outcome: 'passed' as const,
-            reason: 'mock verified',
-          })),
+        gate_results: [],
      };
    },
    async getTaskStatus() {
@@ -164,13 +156,12 @@ describe('runPipeline', () => {
    const executor = createMockExecutor();
    const result = await runPipeline(briefPath, tmpDir, {
      executor,
-      stages: ['00-intake', '05-coding'],
+      stages: ['00-intake', '00b-discovery'],
    });

    expect(result.runId).toMatch(/^\d{8}-\d{6}$/);
-    expect(result.stages).toEqual(['00-intake', '05-coding']);
+    expect(result.stages).toEqual(['00-intake', '00b-discovery']);
    expect(result.manifest.status).toBe('completed');
-    expect(result.manifest.mode).toBe('normal');
    expect(executor.submittedTasks).toHaveLength(2);
  });

@@ -189,17 +180,12 @@ describe('runPipeline', () => {
    const executor = createMockExecutor();
    const result = await runPipeline(briefPath, tmpDir, {
      executor,
-      stages: ['00-intake', '05-coding'],
+      stages: ['00-intake', '00b-discovery'],
    });

    const manifest = loadManifest(result.runDir);
    expect(manifest.stages['00-intake']?.status).toBe('passed');
-    expect(manifest.stages['05-coding']?.status).toBe('passed');
-    expect(manifest.stages['05-coding']?.gateResults?.map((g) => g.outcome)).toEqual([
-      'passed',
-      'passed',
-      'passed',
-    ]);
+    expect(manifest.stages['00b-discovery']?.status).toBe('passed');
  });

  it('respects CLI class override', async () => {
@@ -229,7 +215,7 @@ describe('runPipeline', () => {
    const executor = createMockExecutor();
    await runPipeline(briefPath, tmpDir, {
      executor,
-      stages: ['00-intake', '05-coding', '08-test'],
+      stages: ['00-intake', '00b-discovery', '02-planning-1'],
    });

    expect(executor.submittedTasks[0]!.dependsOn).toBeUndefined();
@@ -238,14 +224,14 @@ describe('runPipeline', () => {
  });

  it('handles stage failure', async () => {
-    const executor = createMockExecutor({ failStage: '05-coding' });
+    const executor = createMockExecutor({ failStage: '00b-discovery' });

    await expect(
      runPipeline(briefPath, tmpDir, {
        executor,
-        stages: ['00-intake', '05-coding'],
+        stages: ['00-intake', '00b-discovery'],
      }),
-    ).rejects.toThrow('Stage 05-coding failed');
+    ).rejects.toThrow('Stage 00b-discovery failed');
  });

  it('marks manifest as failed on stage failure', async () => {
@@ -284,143 +270,30 @@ describe('resumePipeline', () => {
    fs.rmSync(tmpDir, { recursive: true, force: true });
  });

-  it('resumes from first incomplete stage and fails closed at the next provider gate', async () => {
-    // Simulate a run whose authority stages were approved out-of-band
-    // (recorded as passed) and whose coding stage failed mechanically.
-    const runId = '20260101-000000';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    const passed = { status: 'passed' as const, startedAt: '2026-01-01T00:00:00Z' };
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '05-coding',
-      status: 'failed',
-      stages: {
-        '00-intake': passed,
-        '00b-discovery': passed,
-        '02-planning-1': passed,
-        '03-planning-2': passed,
-        '04-planning-3': passed,
-        '05-coding': { status: 'failed', reason: 'gate failed' },
-      },
-    });
+  it('resumes from first incomplete stage', async () => {
+    // First run fails on discovery
+    const executor1 = createMockExecutor({ failStage: '00b-discovery' });
+    let runDir: string;

-    // Resume re-runs 05-coding (the first non-passed stage), then fails
-    // closed at 06-review because no reviewer provider is wired.
-    const executor = createMockExecutor();
-    await expect(resumePipeline(runDir, executor)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_REVIEWER',
-    });
-
-    const manifest = loadManifest(runDir);
-    expect(manifest.stages['05-coding']?.status).toBe('passed');
-    expect(manifest.stages['06-review']?.status).toBe('blocked');
-    expect(manifest.status).toBe('failed');
-  });
-
-  it('resumes to completion as simulated under explicit simulate', async () => {
-    const runId = '20260101-000003';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    const passed = { status: 'passed' as const, startedAt: '2026-01-01T00:00:00Z' };
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '05-coding',
-      status: 'failed',
-      stages: {
-        '00-intake': passed,
-        '00b-discovery': passed,
-        '02-planning-1': passed,
-        '03-planning-2': passed,
-        '04-planning-3': passed,
-        '05-coding': { status: 'failed', reason: 'gate failed' },
-      },
-    });
-
-    const result = await resumePipeline(runDir, undefined, { simulate: true });
-
-    expect(result.manifest.status).toBe('simulated');
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.stages[0]).toBe('05-coding');
-    for (const stage of result.stages) {
-      expect(result.manifest.stages[stage]?.status).toBe('simulated');
+    try {
+      await runPipeline(briefPath, tmpDir, {
+        executor: executor1,
+        stages: ['00-intake', '00b-discovery', '02-planning-1'],
+      });
+    } catch {
+      // expected
    }
-  });

-  it('fails closed on resume when the next stage needs authority sign-off', async () => {
-    const runId = '20260101-000001';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '00-intake',
-      status: 'in_progress',
-      stages: {
-        '00-intake': { status: 'passed' },
-      },
-    });
+    const runsDir = path.join(tmpDir, '.forge', 'runs');
+    runDir = path.join(runsDir, fs.readdirSync(runsDir)[0]!);

-    const executor = createMockExecutor();
-    await expect(resumePipeline(runDir, executor)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_AUTHORITY_REQUIRED',
-    });
+    // Resume should pick up from 00b-discovery
+    const executor2 = createMockExecutor();
+    const result = await resumePipeline(runDir, executor2);

-    const manifest = loadManifest(runDir);
-    expect(manifest.stages['00b-discovery']?.status).toBe('waiting-for-authority');
-    expect(manifest.status).toBe('waiting-for-authority');
-  });
-
-  it('fails closed on resume without an executor or --simulate', async () => {
-    const runId = '20260101-000002';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '00-intake',
-      status: 'in_progress',
-      stages: {
-        '00-intake': { status: 'passed' },
-      },
-    });
-
-    await expect(resumePipeline(runDir)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_EXECUTOR',
-    });
+    expect(result.manifest.status).toBe('completed');
+    // Should have re-run from 00b-discovery onward
+    expect(result.stages[0]).toBe('00b-discovery');
  });
 });

@@ -95,14 +95,7 @@ export function generateBoardTasks(
      briefPath,
      resultPath: resultRelPath,
      timeoutSeconds: 120,
-      qualityGates: [
-        {
-          kind: 'authority',
-          capability: 'board-approval',
-          reason:
-            'persona evaluation is judged by board synthesis (authority review); no mechanical gate exists',
-        },
-      ],
+      qualityGates: ['true'],
      metadata: {
        personaName: persona.name,
        personaSlug: persona.slug,
@@ -128,13 +121,7 @@ export function generateBoardTasks(
    timeoutSeconds: 120,
    dependsOn: personaTaskIds,
    dependsOnPolicy: 'all_terminal',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'board-approval',
-        reason: 'board synthesis is an authority decision; no mechanical gate exists',
-      },
-    ],
+    qualityGates: ['true'],
    metadata: {
      resultOutputPath: synthesisResult,
      inputResultPaths: personaResultPaths,
@@ -1,11 +1,7 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
 import { Command } from 'commander';
-import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { describe, expect, it } from 'vitest';

 import { registerForgeCommand } from './cli.js';
-import { loadManifest } from './pipeline-runner.js';

 describe('registerForgeCommand', () => {
  it('registers a "forge" command on the parent program', () => {
@@ -59,94 +55,3 @@ describe('registerForgeCommand', () => {
    }).not.toThrow();
  });
 });
-
-describe('forge run fail-closed behavior (SDLC-D-035)', () => {
-  let tmpDir: string;
-  let briefPath: string;
-  let errSpy: ReturnType<typeof vi.spyOn>;
-  let logSpy: ReturnType<typeof vi.spyOn>;
-  let prevExitCode: string | number | null | undefined;
-
-  const parse = (args: string[]) => {
-    const program = new Command();
-    registerForgeCommand(program);
-    return program.parseAsync(['forge', ...args], { from: 'user' });
-  };
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-cli-failclosed-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-    errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    prevExitCode = process.exitCode;
-  });
-
-  afterEach(() => {
-    errSpy.mockRestore();
-    logSpy.mockRestore();
-    process.exitCode = prevExitCode;
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('exits nonzero with a typed FORGE_NO_EXECUTOR error when no executor is wired and --simulate is absent', async () => {
-    await parse(['run', '--brief', briefPath, '--codebase', tmpDir]);
-
-    expect(process.exitCode).toBe(1);
-    const errText = errSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(errText).toContain('FORGE_NO_EXECUTOR');
-    // It must never run the pipeline with a stub and report success.
-    expect(fs.existsSync(path.join(tmpDir, '.forge', 'runs'))).toBe(false);
-  });
-
-  it('completes with typed simulated results and exit 0 under explicit --simulate', async () => {
-    await parse(['run', '--brief', briefPath, '--codebase', tmpDir, '--simulate']);
-
-    expect(process.exitCode).toBeUndefined();
-
-    // Loud simulated-mode summary.
-    const logText = logSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(logText).toContain('SIMULATED');
-
-    // Manifest records the mode and simulated per-result statuses.
-    const runsDir = path.join(tmpDir, '.forge', 'runs');
-    const runIds = fs.readdirSync(runsDir);
-    expect(runIds).toHaveLength(1);
-    const manifest = loadManifest(path.join(runsDir, runIds[0]!));
-    expect(manifest.mode).toBe('simulated');
-    expect(manifest.status).toBe('simulated');
-    for (const stageStatus of Object.values(manifest.stages)) {
-      expect(stageStatus?.status).toBe('simulated');
-      for (const gateResult of stageStatus?.gateResults ?? []) {
-        expect(gateResult.outcome).toBe('simulated');
-      }
-    }
-  });
-
-  it('resume exits nonzero with a typed FORGE_NO_EXECUTOR error without --simulate', async () => {
-    const runDir = path.join(tmpDir, '.forge', 'runs', '20260101-000000');
-    fs.mkdirSync(runDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(runDir, 'manifest.json'),
-      JSON.stringify({
-        runId: '20260101-000000',
-        brief: briefPath,
-        codebase: tmpDir,
-        briefClass: 'hotfix',
-        classSource: 'frontmatter',
-        forceBoard: false,
-        createdAt: '2026-01-01T00:00:00Z',
-        updatedAt: '2026-01-01T00:00:00Z',
-        currentStage: '00-intake',
-        status: 'in_progress',
-        stages: { '00-intake': { status: 'passed' } },
-      }),
-    );
-
-    await parse(['resume', '20260101-000000', '--project', tmpDir]);
-
-    expect(process.exitCode).toBe(1);
-    const errText = errSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(errText).toContain('FORGE_NO_EXECUTOR');
-  });
-});
@@ -5,47 +5,37 @@ import type { Command } from 'commander';

 import { classifyBrief } from './brief-classifier.js';
 import { STAGE_LABELS, STAGE_SEQUENCE } from './constants.js';
-import { ForgeCapabilityError } from './errors.js';
 import { getEffectivePersonas, loadBoardPersonas } from './persona-loader.js';
 import { generateRunId, getPipelineStatus, loadManifest, runPipeline } from './pipeline-runner.js';
-import { createSimulatedExecutor } from './simulated-executor.js';
-import type { PipelineOptions, RunManifest, RunMode } from './types.js';
+import type { PipelineOptions, RunManifest, TaskExecutor } from './types.js';
+
+// ---------------------------------------------------------------------------
+// Stub executor — used when no real executor is wired at CLI invocation time.
+// ---------------------------------------------------------------------------
+
+const stubExecutor: TaskExecutor = {
+  async submitTask(task) {
+    console.log(`  [forge] stage submitted: ${task.id} (${task.title})`);
+  },
+  async waitForCompletion(taskId, _timeoutMs) {
+    console.log(`  [forge] stage complete:  ${taskId}`);
+    return {
+      task_id: taskId,
+      status: 'completed' as const,
+      completed_at: new Date().toISOString(),
+      exit_code: 0,
+      gate_results: [],
+    };
+  },
+  async getTaskStatus(_taskId) {
+    return 'completed' as const;
+  },
+};

 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

-/** Resolve a run's effective mode, defaulting legacy manifests to normal. */
-function runModeOf(manifest: RunManifest): RunMode {
-  return manifest.mode ?? 'normal';
-}
-
-/** Print a loud banner so a simulated run can never be misread as verified. */
-function printSimulatedBanner(): void {
-  console.log('');
-  console.log('[forge] ===============================================================');
-  console.log('[forge] MODE: SIMULATED — no stage or gate was really executed.');
-  console.log('[forge] All results are synthetic and MUST NOT be read as verified');
-  console.log('[forge] success. Wire a real executor/providers and re-run to verify.');
-  console.log('[forge] ===============================================================');
-}
-
-/** Print a typed error line for fail-closed capability errors. */
-function printCapabilityError(err: ForgeCapabilityError): void {
-  console.error(`[forge] error ${err.code}: ${err.message}`);
-  console.error(`[forge] missing capability: ${err.capability}`);
-}
-
-/** Handle a pipeline error uniformly: typed capability errors get their code. */
-function handlePipelineError(err: unknown): void {
-  if (err instanceof ForgeCapabilityError) {
-    printCapabilityError(err);
-  } else {
-    console.error(`[forge] pipeline failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  process.exitCode = 1;
-}
-
 function formatDuration(startedAt?: string, completedAt?: string): string {
  if (!startedAt || !completedAt) return '-';
  const ms = new Date(completedAt).getTime() - new Date(startedAt).getTime();
@@ -54,24 +44,19 @@ function formatDuration(startedAt?: string, completedAt?: string): string {
 }

 function printManifestTable(manifest: RunManifest): void {
-  const mode = runModeOf(manifest);
  console.log(`\nRun ID : ${manifest.runId}`);
  console.log(`Status : ${manifest.status}`);
-  console.log(`Mode   : ${mode}`);
-  if (mode === 'simulated') {
-    console.log('WARNING: SIMULATED RUN — results are synthetic, not verified success.');
-  }
  console.log(`Brief  : ${manifest.brief}`);
  console.log(`Class  : ${manifest.briefClass} (${manifest.classSource})`);
  console.log(`Updated: ${manifest.updatedAt}`);
  console.log('');
-  console.log('Stage'.padEnd(22) + 'Status'.padEnd(24) + 'Duration');
-  console.log('-'.repeat(60));
+  console.log('Stage'.padEnd(22) + 'Status'.padEnd(14) + 'Duration');
+  console.log('-'.repeat(50));
  for (const stage of STAGE_SEQUENCE) {
    const s = manifest.stages[stage];
    if (!s) continue;
    const label = (STAGE_LABELS[stage] ?? stage).padEnd(22);
-    const status = s.status.padEnd(24);
+    const status = s.status.padEnd(14);
    const dur = formatDuration(s.startedAt, s.completedAt);
    console.log(`${label}${status}${dur}`);
  }
@@ -105,58 +90,23 @@ function listRecentRuns(projectRoot?: string): void {
  }

  console.log('\nRecent runs:');
-  console.log('Run ID'.padEnd(22) + 'Status'.padEnd(24) + 'Mode'.padEnd(12) + 'Brief');
-  console.log('-'.repeat(80));
+  console.log('Run ID'.padEnd(22) + 'Status'.padEnd(14) + 'Brief');
+  console.log('-'.repeat(70));

  for (const runId of entries) {
    const runDir = path.join(runsDir, runId);
    try {
      const manifest = loadManifest(runDir);
-      const status = manifest.status.padEnd(24);
-      const mode = runModeOf(manifest).padEnd(12);
+      const status = manifest.status.padEnd(14);
      const brief = path.basename(manifest.brief);
-      console.log(`${runId.padEnd(22)}${status}${mode}${brief}`);
+      console.log(`${runId.padEnd(22)}${status}${brief}`);
    } catch {
-      console.log(`${runId.padEnd(22)}${'(unreadable)'.padEnd(24)}`);
+      console.log(`${runId.padEnd(22)}${'(unreadable)'.padEnd(14)}`);
    }
  }
  console.log('');
 }

-/**
- * Apply the exit-code policy for a finished pipeline run (SDLC-D-035):
- *
- * - exit 0 only for a verified `completed` normal run, or for an overall
- *   `simulated` run when the caller explicitly passed --simulate;
- * - anything else exits nonzero so it can never be read as success.
- */
-function applyRunExitPolicy(result: { manifest: RunManifest; runDir: string }, simulate: boolean) {
-  const { manifest } = result;
-
-  if (runModeOf(manifest) === 'simulated') {
-    if (!simulate || manifest.status !== 'simulated') {
-      console.error(
-        '[forge] error FORGE_MODE_MISMATCH: run reports simulated results without an explicit, ' +
-          'consistent --simulate request; refusing to report success.',
-      );
-      process.exitCode = 1;
-      return;
-    }
-    printSimulatedBanner();
-    console.log(`[forge] run directory: ${result.runDir}`);
-    return; // exit 0 — the caller explicitly opted into simulation
-  }
-
-  if (manifest.status !== 'completed') {
-    console.error(`[forge] run did not complete: terminal status '${manifest.status}'`);
-    process.exitCode = 1;
-    return;
-  }
-
-  console.log(`[forge] pipeline complete (mode: normal): ${manifest.runId}`);
-  console.log(`[forge] run directory: ${result.runDir}`);
-}
-
 // ---------------------------------------------------------------------------
 // Register function
 // ---------------------------------------------------------------------------
@@ -179,11 +129,6 @@ export function registerForgeCommand(parent: Command): void {
    .option('--config <path>', 'Path to forge config file (.forge/config.yaml)')
    .option('--codebase <path>', 'Codebase root to pass to the pipeline', process.cwd())
    .option('--dry-run', 'Print planned stages without executing', false)
-    .option(
-      '--simulate',
-      'Simulate execution without real providers (every result is typed simulated, never verified)',
-      false,
-    )
    .action(
      async (opts: {
        brief: string;
@@ -192,7 +137,6 @@ export function registerForgeCommand(parent: Command): void {
        config?: string;
        codebase: string;
        dryRun: boolean;
-        simulate: boolean;
      }) => {
        const briefPath = path.resolve(opts.brief);

@@ -205,22 +149,14 @@ export function registerForgeCommand(parent: Command): void {
        const briefContent = fs.readFileSync(briefPath, 'utf-8');
        const briefClass = classifyBrief(briefContent);
        const projectRoot = opts.codebase;
-        // A real executor is never wired at CLI invocation time today, so the
-        // only executor we may construct is the explicitly-requested simulated
-        // one. Normal mode fails closed with FORGE_NO_EXECUTOR.
-        const executor = opts.simulate ? createSimulatedExecutor() : undefined;

        if (opts.resume) {
          const runId = opts.runId ?? generateRunId();
          const runDir = resolveRunDir(runId, projectRoot);
          console.log(`[forge] resuming run: ${runId}`);
-          try {
-            const { resumePipeline } = await import('./pipeline-runner.js');
-            const result = await resumePipeline(runDir, executor, { simulate: opts.simulate });
-            applyRunExitPolicy(result, opts.simulate);
-          } catch (err) {
-            handlePipelineError(err);
-          }
+          const { resumePipeline } = await import('./pipeline-runner.js');
+          const result = await resumePipeline(runDir, stubExecutor);
+          console.log(`[forge] pipeline complete: ${result.runId}`);
          return;
        }

@@ -228,8 +164,7 @@ export function registerForgeCommand(parent: Command): void {
          briefClass,
          codebase: projectRoot,
          dryRun: opts.dryRun,
-          executor,
-          simulate: opts.simulate,
+          executor: stubExecutor,
        };

        if (opts.dryRun) {
@@ -245,15 +180,16 @@ export function registerForgeCommand(parent: Command): void {

        console.log(`[forge] starting pipeline for brief: ${briefPath}`);
        console.log(`[forge] classified as: ${briefClass}`);
-        if (opts.simulate) {
-          console.log('[forge] mode: SIMULATED (explicit --simulate)');
-        }

        try {
          const result = await runPipeline(briefPath, projectRoot, pipelineOptions);
-          applyRunExitPolicy(result, opts.simulate);
+          console.log(`[forge] pipeline complete: ${result.runId}`);
+          console.log(`[forge] run directory: ${result.runDir}`);
        } catch (err) {
-          handlePipelineError(err);
+          console.error(
+            `[forge] pipeline failed: ${err instanceof Error ? err.message : String(err)}`,
+          );
+          process.exitCode = 1;
        }
      },
    );
@@ -288,12 +224,7 @@ export function registerForgeCommand(parent: Command): void {
    .command('resume <runId>')
    .description('Resume a stopped or failed pipeline run')
    .option('--project <path>', 'Project root (defaults to cwd)', process.cwd())
-    .option(
-      '--simulate',
-      'Simulate execution without real providers (every result is typed simulated, never verified)',
-      false,
-    )
-    .action(async (runId: string, opts: { project: string; simulate: boolean }) => {
+    .action(async (runId: string, opts: { project: string }) => {
      const runDir = resolveRunDir(runId, opts.project);

      if (!fs.existsSync(runDir)) {
@@ -303,20 +234,15 @@ export function registerForgeCommand(parent: Command): void {
      }

      console.log(`[forge] resuming run: ${runId}`);
-      if (opts.simulate) {
-        console.log('[forge] mode: SIMULATED (explicit --simulate)');
-      }
-
-      // No real executor is wired at CLI invocation time; only the explicitly
-      // requested simulated executor may be constructed (fail closed otherwise).
-      const executor = opts.simulate ? createSimulatedExecutor() : undefined;

      try {
        const { resumePipeline } = await import('./pipeline-runner.js');
-        const result = await resumePipeline(runDir, executor, { simulate: opts.simulate });
-        applyRunExitPolicy(result, opts.simulate);
+        const result = await resumePipeline(runDir, stubExecutor);
+        console.log(`[forge] pipeline complete: ${result.runId}`);
+        console.log(`[forge] run directory: ${result.runDir}`);
      } catch (err) {
-        handlePipelineError(err);
+        console.error(`[forge] resume failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
      }
    });

@@ -9,16 +9,7 @@ export const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.
 /** Pipeline asset directory (stages, agents, rails, gates, templates). */
 export const PIPELINE_DIR = path.join(PACKAGE_ROOT, 'pipeline');

-/** Stage specifications — defines every pipeline stage.
- *\n * Gate semantics (SDLC-D-035): every gate is one of
- * - a real command string / GateEntry a mechanical runner can execute,
- * - an `authority` gate (human/board sign-off; produces waiting-for-authority),
- * - a `provider` gate (requires a wired provider such as a reviewer or CI pipeline).
- *
- * Vacuous gates (`true`, echo'd synthetic approvals, placeholder ci-pipeline
- * commands) are forbidden: a stage whose gate has no real implementation
- * fails closed instead of passing.
- */
+/** Stage specifications — defines every pipeline stage. */
 export const STAGE_SPECS: Record<string, StageSpec> = {
  '00-intake': {
    number: '00',
@@ -36,13 +27,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'research',
    gate: 'discovery-complete',
    promptFile: '00b-discovery.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'discovery-complete',
-        reason: 'discovery completion is attested by an authority; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '01-board': {
    number: '01',
@@ -51,13 +36,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'review',
    gate: 'board-approval',
    promptFile: '01-board.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'board-approval',
-        reason: 'board approval is a board/human decision; no mechanical gate exists',
-      },
-    ],
+    qualityGates: [{ type: 'ci-pipeline', command: 'board-approval (via board-tasks)' }],
  },
  '01b-brief-analyzer': {
    number: '01b',
@@ -66,13 +45,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'research',
    gate: 'brief-analysis-complete',
    promptFile: '01-board.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'brief-analysis-complete',
-        reason: 'brief analysis completion is attested by an authority; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '02-planning-1': {
    number: '02',
@@ -81,13 +54,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'research',
    gate: 'architecture-approval',
    promptFile: '02-planning-1-architecture.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'architecture-approval',
-        reason: 'ADR approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '03-planning-2': {
    number: '03',
@@ -96,14 +63,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'research',
    gate: 'implementation-approval',
    promptFile: '03-planning-2-implementation.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'implementation-approval',
-        reason:
-          'implementation spec approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '04-planning-3': {
    number: '04',
@@ -112,14 +72,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'research',
    gate: 'decomposition-approval',
    promptFile: '04-planning-3-decomposition.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'decomposition-approval',
-        reason:
-          'task decomposition approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '05-coding': {
    number: '05',
@@ -139,10 +92,9 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    promptFile: '06-review.md',
    qualityGates: [
      {
-        kind: 'provider',
-        capability: 'reviewer',
-        reason:
-          'review verdicts require a wired reviewer provider; synthetic approvals are not permitted',
+        type: 'ai-review',
+        command:
+          'echo \'{"summary":"review-pass","verdict":"approve","findings":[],"stats":{"blockers":0,"should_fix":0,"suggestions":0}}\'',
      },
    ],
  },
@@ -153,13 +105,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'coding',
    gate: 're-review',
    promptFile: '07-remediate.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 're-review',
-        reason: 'remediation re-review is an approval-based gate; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
  },
  '08-test': {
    number: '08',
@@ -177,13 +123,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
    type: 'deploy',
    gate: 'deploy-verification',
    promptFile: '09-deploy.md',
-    qualityGates: [
-      {
-        kind: 'provider',
-        capability: 'ci-pipeline',
-        reason: 'deploy verification requires a wired CI pipeline provider',
-      },
-    ],
+    qualityGates: [{ type: 'ci-pipeline', command: 'deploy-verification' }],
  },
 };

@@ -1,46 +0,0 @@
-/**
- * Typed fail-closed capability errors (SDLC-D-035).
- *
- * A Forge run must fail closed when a required capability (executor, reviewer
- * provider, CI pipeline, authority sign-off) is missing. These typed errors
- * name the missing capability so callers can distinguish "not wired" from
- * ordinary execution failures.
- */
-
-/** Closed set of typed Forge capability error codes. */
-export const FORGE_ERROR_CODES = [
-  'FORGE_NO_EXECUTOR',
-  'FORGE_NO_REVIEWER',
-  'FORGE_NO_CI_PIPELINE',
-  'FORGE_NO_PROVIDER',
-  'FORGE_AUTHORITY_REQUIRED',
-] as const;
-
-export type ForgeErrorCode = (typeof FORGE_ERROR_CODES)[number];
-
-/** Raised when a required capability is missing and the pipeline must fail closed. */
-export class ForgeCapabilityError extends Error {
-  /** Typed error code from the closed FORGE_ERROR_CODES set. */
-  readonly code: ForgeErrorCode;
-  /** The missing capability, e.g. `task-executor`, `reviewer`, `board-approval`. */
-  readonly capability: string;
-
-  constructor(code: ForgeErrorCode, capability: string, message: string) {
-    super(message);
-    this.name = 'ForgeCapabilityError';
-    this.code = code;
-    this.capability = capability;
-  }
-}
-
-/** Map a provider gate capability to its typed error code. */
-export function providerErrorCode(capability: string): ForgeErrorCode {
-  switch (capability) {
-    case 'reviewer':
-      return 'FORGE_NO_REVIEWER';
-    case 'ci-pipeline':
-      return 'FORGE_NO_CI_PIPELINE';
-    default:
-      return 'FORGE_NO_PROVIDER';
-  }
-}
@@ -5,13 +5,6 @@ export type {
  StageSpec,
  BriefClass,
  ClassSource,
-  ForgeOutcome,
-  AuthorityGate,
-  ProviderGate,
-  ForgeGate,
-  ForgeGateResult,
-  ForgeTaskResult,
-  RunMode,
  StageStatus,
  RunManifest,
  ForgeTaskStatus,
@@ -88,24 +81,5 @@ export {
  getPipelineStatus,
 } from './pipeline-runner.js';

-// Fail-closed errors and typed outcome model (SDLC-D-035)
-export { FORGE_ERROR_CODES, ForgeCapabilityError, providerErrorCode } from './errors.js';
-export type { ForgeErrorCode } from './errors.js';
-export {
-  isSatisfyingOutcome,
-  isCapabilityGate,
-  isCommandGate,
-  gateLabel,
-  uniformGateResults,
-  simulatedGateResults,
-  waitingGateResults,
-  blockedGateResults,
-  evaluateStageGates,
-} from './outcomes.js';
-export type { StageEvaluation } from './outcomes.js';
-
-// Simulated executor (explicit --simulate only)
-export { createSimulatedExecutor } from './simulated-executor.js';
-
 // CLI
 export { registerForgeCommand } from './cli.js';
@@ -1,147 +0,0 @@
-import type { GateEntry } from '@mosaicstack/macp';
-
-import type {
-  AuthorityGate,
-  ForgeGate,
-  ForgeGateResult,
-  ForgeOutcome,
-  ForgeTaskResult,
-  ProviderGate,
-} from './types.js';
-
-/**
- * Gate and dependency satisfaction predicate (SDLC-D-035).
- *
- * ONLY a verified `passed` outcome satisfies. Every other member of the closed
- * outcome set — including `simulated` — is non-satisfying, so a simulated or
- * authority-blocked result can never be read as success-by-verification.
- */
-export function isSatisfyingOutcome(outcome: ForgeOutcome): boolean {
-  return outcome === 'passed';
-}
-
-/** Whether a gate is an authority or provider gate (capability-based, command-less). */
-export function isCapabilityGate(gate: ForgeGate): gate is AuthorityGate | ProviderGate {
-  if (typeof gate !== 'object' || gate === null) return false;
-  const kind = (gate as Record<string, unknown>)['kind'];
-  return kind === 'authority' || kind === 'provider';
-}
-
-/** Whether a gate definition carries a real command a mechanical runner can execute. */
-export function isCommandGate(gate: ForgeGate): gate is string | GateEntry {
-  if (typeof gate === 'string') {
-    return gate.trim().length > 0;
-  }
-  if (isCapabilityGate(gate)) {
-    // Authority and provider gates are satisfied by a capability, not a command.
-    return false;
-  }
-  return typeof gate.command === 'string' && gate.command.trim().length > 0;
-}
-
-/** Typed label identifying a gate in results and logs. */
-export function gateLabel(gate: ForgeGate): string {
-  if (typeof gate === 'string') return gate;
-  if (isCapabilityGate(gate)) return `${gate.kind}:${gate.capability}`;
-  return gate.command || gate.type || 'unnamed-gate';
-}
-
-/** Reason string stamped on every simulated gate result. */
-export const SIMULATED_GATE_REASON =
-  'simulated execution (--simulate): gate was not evaluated by a real implementation';
-
-/** Build typed gate results with a uniform outcome for a stage's declared gates. */
-export function uniformGateResults(
-  gates: ForgeGate[],
-  outcome: ForgeOutcome,
-  reason: string,
-): ForgeGateResult[] {
-  return gates.map((gate) => ({ gate: gateLabel(gate), outcome, reason }));
-}
-
-/** Typed simulated gate results — used exclusively in `--simulate` runs. */
-export function simulatedGateResults(gates: ForgeGate[]): ForgeGateResult[] {
-  return uniformGateResults(gates, 'simulated', SIMULATED_GATE_REASON);
-}
-
-/** Typed waiting-for-authority gate results for approval-based stages. */
-export function waitingGateResults(gates: ForgeGate[], reason: string): ForgeGateResult[] {
-  return uniformGateResults(gates, 'waiting-for-authority', reason);
-}
-
-/** Typed blocked gate results for stages whose provider capability is not wired. */
-export function blockedGateResults(gates: ForgeGate[], reason: string): ForgeGateResult[] {
-  return uniformGateResults(gates, 'blocked', reason);
-}
-
-/** Outcome of evaluating a completed stage in normal mode. */
-export interface StageEvaluation {
-  outcome: ForgeOutcome;
-  reason: string;
-  gateResults: ForgeGateResult[];
-}
-
-/**
- * Evaluate a stage's declared gates against the executor's typed result.
- *
- * Fail-closed mapping:
- * - a `simulated` task or gate outcome in normal mode maps to `error`
- * - a missing gate result for a required command gate maps to `blocked`
- * - a non-passing task outcome propagates as the stage outcome
- * - only verified `passed` task and gate outcomes yield a `passed` stage
- */
-export function evaluateStageGates(
-  stageName: string,
-  gates: ForgeGate[],
-  result: ForgeTaskResult,
-): StageEvaluation {
-  const gateResults = result.gate_results ?? [];
-
-  if (result.outcome === 'simulated') {
-    return {
-      outcome: 'error',
-      reason: `executor reported a simulated outcome for stage '${stageName}' in normal mode — refusing to treat simulated results as verified`,
-      gateResults,
-    };
-  }
-
-  if (!isSatisfyingOutcome(result.outcome)) {
-    return {
-      outcome: result.outcome,
-      reason: `task outcome is '${result.outcome}': ${result.reason}`,
-      gateResults,
-    };
-  }
-
-  for (const gate of gates) {
-    // Authority and provider gates are pre-flighted before execution; they have
-    // no mechanical result to verify here.
-    if (!isCommandGate(gate)) continue;
-
-    const label = gateLabel(gate);
-    const gateResult = gateResults.find((r) => r.gate === label);
-    if (!gateResult) {
-      return {
-        outcome: 'blocked',
-        reason: `no gate result was reported for required gate '${label}' (stage '${stageName}')`,
-        gateResults,
-      };
-    }
-    if (!isSatisfyingOutcome(gateResult.outcome)) {
-      return {
-        outcome: gateResult.outcome === 'simulated' ? 'error' : gateResult.outcome,
-        reason: `gate '${label}' outcome is '${gateResult.outcome}': ${gateResult.reason}`,
-        gateResults,
-      };
-    }
-  }
-
-  return {
-    outcome: 'passed',
-    reason:
-      gates.length === 0
-        ? "stage declares no gates; task outcome 'passed' accepted"
-        : 'all declared gates verified passed',
-    gateResults,
-  };
-}
@@ -1,33 +1,18 @@
 import fs from 'node:fs';
 import path from 'node:path';

-import { STAGE_SEQUENCE, STAGE_SPECS } from './constants.js';
+import { STAGE_SEQUENCE } from './constants.js';
 import { determineBriefClass, stagesForClass } from './brief-classifier.js';
-import { ForgeCapabilityError, providerErrorCode } from './errors.js';
-import {
-  blockedGateResults,
-  evaluateStageGates,
-  isCapabilityGate,
-  simulatedGateResults,
-  waitingGateResults,
-} from './outcomes.js';
 import { mapStageToTask } from './stage-adapter.js';
-import { createSimulatedExecutor } from './simulated-executor.js';
 import type {
  ForgeTask,
-  ForgeTaskResult,
  PipelineOptions,
  PipelineResult,
  RunManifest,
-  RunMode,
  StageStatus,
  TaskExecutor,
 } from './types.js';

-/** Reason stamped on stages that complete under explicit simulation. */
-const SIMULATED_STAGE_REASON =
-  'simulated execution (--simulate): stage was not executed by a real executor';
-
 /**
 * Generate a timestamp-based run ID.
 */
@@ -62,7 +47,6 @@ function createManifest(opts: {
  briefClass: RunManifest['briefClass'];
  classSource: RunManifest['classSource'];
  forceBoard: boolean;
-  mode: RunMode;
  runDir: string;
 }): RunManifest {
  const ts = nowISO();
@@ -73,7 +57,6 @@ function createManifest(opts: {
    briefClass: opts.briefClass,
    classSource: opts.classSource,
    forceBoard: opts.forceBoard,
-    mode: opts.mode,
    createdAt: ts,
    updatedAt: ts,
    currentStage: '',
@@ -125,199 +108,20 @@ export function selectStages(stages?: string[], skipTo?: string): string[] {
  return selected.slice(skipIndex);
 }

-/**
- * Fail closed when the required executor capability is missing (SDLC-D-035).
- */
-function requireExecutor(executor: TaskExecutor | undefined, simulate: boolean): TaskExecutor {
-  if (executor) return executor;
-  if (simulate) return createSimulatedExecutor({ log: false });
-  throw new ForgeCapabilityError(
-    'FORGE_NO_EXECUTOR',
-    'task-executor',
-    'no task executor is wired; refusing to run the pipeline with a stub executor (fail closed). ' +
-      'Pass --simulate to opt into explicitly simulated execution.',
-  );
-}
-
-/**
- * Pre-flight a stage's gates in normal mode (fail closed, SDLC-D-035).
- *
- * - authority gates: record a typed `waiting-for-authority` stage result and
- *   raise FORGE_AUTHORITY_REQUIRED — approval-based gates never pass vacuously.
- * - provider gates: record a typed `blocked` stage result and raise the typed
- *   capability error for the missing provider.
- *
- * Returns the stage status to record when the pre-flight blocks, or undefined
- * when the stage may proceed.
- */
-function preflightStageGates(
-  stageName: string,
-  manifest: RunManifest,
-): { status: StageStatus; error: ForgeCapabilityError } | undefined {
-  const spec = STAGE_SPECS[stageName];
-  if (!spec) throw new Error(`Unknown Forge stage: ${stageName}`);
-
-  for (const gate of spec.qualityGates) {
-    if (!isCapabilityGate(gate)) continue;
-
-    const startedAt = manifest.stages[stageName]?.startedAt;
-    const completedAt = nowISO();
-
-    if (gate.kind === 'authority') {
-      const reason = `gate '${gate.capability}' requires authority sign-off; no mechanical implementation exists (${gate.reason})`;
-      return {
-        status: {
-          status: 'waiting-for-authority',
-          reason,
-          startedAt,
-          completedAt,
-          gateResults: waitingGateResults(spec.qualityGates, reason),
-        },
-        error: new ForgeCapabilityError(
-          'FORGE_AUTHORITY_REQUIRED',
-          gate.capability,
-          `stage '${stageName}' is blocked on authority gate '${gate.capability}': ${gate.reason}. ` +
-            'The pipeline fails closed instead of passing vacuously. Record the approval out-of-band ' +
-            'or run with --simulate for explicitly simulated execution.',
-        ),
-      };
-    }
-
-    const reason = `gate '${gate.capability}' requires provider '${gate.capability}' and none is wired (${gate.reason})`;
-    return {
-      status: {
-        status: 'blocked',
-        reason,
-        startedAt,
-        completedAt,
-        gateResults: blockedGateResults(spec.qualityGates, reason),
-      },
-      error: new ForgeCapabilityError(
-        providerErrorCode(gate.capability),
-        gate.capability,
-        `stage '${stageName}' requires provider '${gate.capability}' which is not wired: ${gate.reason}. ` +
-          'The pipeline fails closed instead of passing vacuously.',
-      ),
-    };
-  }
-
-  return undefined;
-}
-
-/**
- * Execute the given stage tasks sequentially, updating the manifest.
- *
- * Normal mode requires a real executor and evaluates every declared command
- * gate through the typed outcome model; any non-verified result fails closed.
- * Simulate mode types every stage and gate result as `simulated`.
- */
-async function executeStages(opts: {
-  manifest: RunManifest;
-  runDir: string;
-  tasks: ForgeTask[];
-  stageNames: string[];
-  executor: TaskExecutor;
-  simulate: boolean;
-}): Promise<void> {
-  const { manifest, runDir, tasks, stageNames, executor, simulate } = opts;
-
-  for (let i = 0; i < tasks.length; i++) {
-    const task = tasks[i]!;
-    const stageName = stageNames[i]!;
-    const spec = STAGE_SPECS[stageName];
-    if (!spec) throw new Error(`Unknown Forge stage: ${stageName}`);
-
-    // Update manifest: stage in progress
-    manifest.currentStage = stageName;
-    manifest.stages[stageName] = {
-      status: 'in_progress',
-      startedAt: nowISO(),
-    };
-    saveManifest(runDir, manifest);
-
-    // Fail-closed pre-flight (normal mode only): authority/provider gates have
-    // no mechanical implementation and must never pass vacuously.
-    if (!simulate) {
-      const blocked = preflightStageGates(stageName, manifest);
-      if (blocked) {
-        manifest.stages[stageName] = blocked.status;
-        manifest.status =
-          blocked.status.status === 'waiting-for-authority' ? 'waiting-for-authority' : 'failed';
-        saveManifest(runDir, manifest);
-        throw blocked.error;
-      }
-    }
-
-    let result: ForgeTaskResult;
-    try {
-      await executor.submitTask(task);
-      result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
-    } catch (error) {
-      // Process errors (including timeouts) map to the fail-closed `error` outcome.
-      const reason = error instanceof Error ? error.message : String(error);
-      manifest.stages[stageName] = {
-        status: 'error',
-        reason: `executor error: ${reason}`,
-        startedAt: manifest.stages[stageName]?.startedAt,
-        completedAt: nowISO(),
-        gateResults: [],
-      };
-      manifest.status = 'failed';
-      saveManifest(runDir, manifest);
-      throw error instanceof Error ? error : new Error(reason);
-    }
-
-    if (simulate) {
-      manifest.stages[stageName] = {
-        status: 'simulated',
-        reason: SIMULATED_STAGE_REASON,
-        startedAt: manifest.stages[stageName]?.startedAt,
-        completedAt: nowISO(),
-        gateResults: simulatedGateResults(spec.qualityGates),
-      };
-      saveManifest(runDir, manifest);
-      continue;
-    }
-
-    const evaluation = evaluateStageGates(stageName, spec.qualityGates, result);
-    manifest.stages[stageName] = {
-      status: evaluation.outcome,
-      reason: evaluation.reason,
-      startedAt: manifest.stages[stageName]?.startedAt,
-      completedAt: nowISO(),
-      gateResults: evaluation.gateResults,
-    };
-
-    if (evaluation.outcome !== 'passed') {
-      manifest.status =
-        evaluation.outcome === 'waiting-for-authority' ? 'waiting-for-authority' : 'failed';
-      saveManifest(runDir, manifest);
-      throw new Error(`Stage ${stageName} ${evaluation.outcome}: ${evaluation.reason}`);
-    }
-
-    saveManifest(runDir, manifest);
-  }
-}
-
 /**
 * Run the Forge pipeline.
 *
- * 1. Fail closed unless a real executor is wired or simulation is explicit
- * 2. Classify the brief
- * 3. Generate a run ID and create run directory
- * 4. Map stages to tasks and submit to TaskExecutor
- * 5. Track manifest with typed stage outcomes
- * 6. Return pipeline result
+ * 1. Classify the brief
+ * 2. Generate a run ID and create run directory
+ * 3. Map stages to tasks and submit to TaskExecutor
+ * 4. Track manifest with stage statuses
+ * 5. Return pipeline result
 */
 export async function runPipeline(
  briefPath: string,
  projectRoot: string,
  options: PipelineOptions,
 ): Promise<PipelineResult> {
-  const simulate = options.simulate ?? false;
-  const executor = requireExecutor(options.executor, simulate);
-  const mode: RunMode = simulate ? 'simulated' : 'normal';
-
  const resolvedRoot = path.resolve(projectRoot);
  const resolvedBrief = path.resolve(briefPath);
  const briefContent = fs.readFileSync(resolvedBrief, 'utf-8');
@@ -342,7 +146,6 @@ export async function runPipeline(
    briefClass,
    classSource,
    forceBoard: options.forceBoard ?? false,
-    mode,
    runDir,
  });

@@ -369,10 +172,54 @@ export async function runPipeline(
  }

  // Execute stages
-  await executeStages({ manifest, runDir, tasks, stageNames: selectedStages, executor, simulate });
+  const { executor } = options;
+  for (let i = 0; i < tasks.length; i++) {
+    const task = tasks[i]!;
+    const stageName = selectedStages[i]!;

-  // All stages reached a terminal state for this mode
-  manifest.status = simulate ? 'simulated' : 'completed';
+    // Update manifest: stage in progress
+    manifest.currentStage = stageName;
+    manifest.stages[stageName] = {
+      status: 'in_progress',
+      startedAt: nowISO(),
+    };
+    saveManifest(runDir, manifest);
+
+    try {
+      await executor.submitTask(task);
+      const result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
+
+      // Update manifest: stage completed or failed
+      const stageStatus: StageStatus = {
+        status: result.status === 'completed' ? 'passed' : 'failed',
+        startedAt: manifest.stages[stageName]!.startedAt,
+        completedAt: nowISO(),
+      };
+      manifest.stages[stageName] = stageStatus;
+
+      if (result.status !== 'completed') {
+        manifest.status = 'failed';
+        saveManifest(runDir, manifest);
+        throw new Error(`Stage ${stageName} failed with status: ${result.status}`);
+      }
+
+      saveManifest(runDir, manifest);
+    } catch (error) {
+      if (!manifest.stages[stageName]?.completedAt) {
+        manifest.stages[stageName] = {
+          status: 'failed',
+          startedAt: manifest.stages[stageName]?.startedAt,
+          completedAt: nowISO(),
+        };
+      }
+      manifest.status = 'failed';
+      saveManifest(runDir, manifest);
+      throw error;
+    }
+  }
+
+  // All stages passed
+  manifest.status = 'completed';
  saveManifest(runDir, manifest);

  return {
@@ -387,30 +234,22 @@ export async function runPipeline(
 }

 /**
- * Resume a pipeline from the last non-passed stage.
+ * Resume a pipeline from the last incomplete stage.
 */
 export async function resumePipeline(
  runDir: string,
-  executor?: TaskExecutor,
-  options?: { simulate?: boolean },
+  executor: TaskExecutor,
 ): Promise<PipelineResult> {
-  const simulate = options?.simulate ?? false;
-  const wiredExecutor = requireExecutor(executor, simulate);
-  const mode: RunMode = simulate ? 'simulated' : 'normal';
-
  const manifest = loadManifest(runDir);
  const resolvedRoot = path.dirname(path.dirname(path.dirname(runDir))); // .forge/runs/{id} → project root

  const briefContent = fs.readFileSync(manifest.brief, 'utf-8');
  const allStages = stagesForClass(manifest.briefClass, manifest.forceBoard);

-  manifest.mode = mode;
-
-  // Find first non-satisfying stage (only a verified `passed` counts as done;
-  // simulated and waiting-for-authority stages are re-run).
+  // Find first non-passed stage
  const resumeFrom = allStages.find((s) => manifest.stages[s]?.status !== 'passed');
  if (!resumeFrom) {
-    manifest.status = mode === 'simulated' ? 'simulated' : 'completed';
+    manifest.status = 'completed';
    saveManifest(runDir, manifest);
    return {
      runId: manifest.runId,
@@ -445,16 +284,49 @@ export async function resumePipeline(
    tasks.push(task);
  }

-  await executeStages({
-    manifest,
-    runDir,
-    tasks,
-    stageNames: remainingStages,
-    executor: wiredExecutor,
-    simulate,
-  });
+  for (let i = 0; i < tasks.length; i++) {
+    const task = tasks[i]!;
+    const stageName = remainingStages[i]!;

-  manifest.status = simulate ? 'simulated' : 'completed';
+    manifest.currentStage = stageName;
+    manifest.stages[stageName] = {
+      status: 'in_progress',
+      startedAt: nowISO(),
+    };
+    saveManifest(runDir, manifest);
+
+    try {
+      await executor.submitTask(task);
+      const result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
+
+      manifest.stages[stageName] = {
+        status: result.status === 'completed' ? 'passed' : 'failed',
+        startedAt: manifest.stages[stageName]!.startedAt,
+        completedAt: nowISO(),
+      };
+
+      if (result.status !== 'completed') {
+        manifest.status = 'failed';
+        saveManifest(runDir, manifest);
+        throw new Error(`Stage ${stageName} failed with status: ${result.status}`);
+      }
+
+      saveManifest(runDir, manifest);
+    } catch (error) {
+      if (!manifest.stages[stageName]?.completedAt) {
+        manifest.stages[stageName] = {
+          status: 'failed',
+          startedAt: manifest.stages[stageName]?.startedAt,
+          completedAt: nowISO(),
+        };
+      }
+      manifest.status = 'failed';
+      saveManifest(runDir, manifest);
+      throw error;
+    }
+  }
+
+  manifest.status = 'completed';
  saveManifest(runDir, manifest);

  return {
@@ -1,32 +0,0 @@
-import type { ForgeTask, ForgeTaskResult, TaskExecutor } from './types.js';
-
-/**
- * Simulated executor — used ONLY when the caller explicitly passes --simulate.
- *
- * It submits no real work and returns typed `simulated` results so a simulated
- * run can never be confused with a verified one. In normal mode (no --simulate)
- * the CLI refuses to run at all with FORGE_NO_EXECUTOR instead of wiring this
- * stub (fail closed, SDLC-D-035).
- */
-export function createSimulatedExecutor(options?: { log?: boolean }): TaskExecutor {
-  const log = options?.log ?? true;
-  return {
-    async submitTask(task: ForgeTask) {
-      if (log) console.log(`  [forge:simulated] stage submitted: ${task.id} (${task.title})`);
-    },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
-      if (log) console.log(`  [forge:simulated] stage complete:  ${taskId}`);
-      return {
-        task_id: taskId,
-        outcome: 'simulated',
-        reason: 'no executor wired; simulated execution requested via --simulate',
-        completed_at: new Date().toISOString(),
-        exit_code: 0,
-        gate_results: [],
-      };
-    },
-    async getTaskStatus() {
-      return 'completed' as const;
-    },
-  };
-}
@@ -1,4 +1,4 @@
-import type { GateEntry } from '@mosaicstack/macp';
+import type { GateEntry, TaskResult } from '@mosaicstack/macp';

 /** Stage dispatch mode. */
 export type StageDispatch = 'exec' | 'yolo' | 'pi';
@@ -6,58 +6,6 @@ export type StageDispatch = 'exec' | 'yolo' | 'pi';
 /** Stage type — determines agent selection and gate requirements. */
 export type StageType = 'research' | 'review' | 'coding' | 'deploy';

-/**
- * Typed outcome for every gate and stage evaluation — closed set (SDLC-D-035).
- *
- * Only `passed` means "verified by a real implementation". `simulated` is
- * produced exclusively in explicit `--simulate` runs and is never satisfying.
- */
-export type ForgeOutcome =
-  | 'passed'
-  | 'failed'
-  | 'blocked'
-  | 'error'
-  | 'waiting-for-authority'
-  | 'simulated'
-  | 'not-applicable';
-
-/** A gate that requires authority (human/board) sign-off; no mechanical command can satisfy it. */
-export interface AuthorityGate {
-  kind: 'authority';
-  capability: string;
-  reason: string;
-}
-
-/** A gate that requires a wired provider (e.g. an AI reviewer, CI pipeline) to evaluate. */
-export interface ProviderGate {
-  kind: 'provider';
-  capability: string;
-  reason: string;
-}
-
-/** Forge quality gate: a real command, an authority sign-off, or a provider-backed check. */
-export type ForgeGate = string | GateEntry | AuthorityGate | ProviderGate;
-
-/** Typed result of evaluating a single quality gate. */
-export interface ForgeGateResult {
-  gate: string;
-  outcome: ForgeOutcome;
-  reason: string;
-  exitCode?: number;
-  output?: string;
-  timedOut?: boolean;
-}
-
-/** Typed result of a task/stage execution returned by a TaskExecutor. */
-export interface ForgeTaskResult {
-  task_id: string;
-  outcome: ForgeOutcome;
-  reason: string;
-  completed_at: string;
-  exit_code: number;
-  gate_results: ForgeGateResult[];
-}
-
 /** Stage specification — defines a single pipeline stage. */
 export interface StageSpec {
  number: string;
@@ -66,7 +14,7 @@ export interface StageSpec {
  type: StageType;
  gate: string;
  promptFile: string;
-  qualityGates: ForgeGate[];
+  qualityGates: (string | GateEntry)[];
 }

 /** Brief classification. */
@@ -77,18 +25,11 @@ export type ClassSource = 'cli' | 'frontmatter' | 'auto';

 /** Per-stage status within a run manifest. */
 export interface StageStatus {
-  status: 'pending' | 'in_progress' | ForgeOutcome;
-  /** Why the stage reached its current (terminal) outcome, when applicable. */
-  reason?: string;
+  status: 'pending' | 'in_progress' | 'passed' | 'failed';
  startedAt?: string;
  completedAt?: string;
-  /** Typed per-gate results recorded alongside the stage outcome. */
-  gateResults?: ForgeGateResult[];
 }

-/** Execution mode of a run. */
-export type RunMode = 'normal' | 'simulated';
-
 /** Run manifest — persisted to disk as manifest.json. */
 export interface RunManifest {
  runId: string;
@@ -97,23 +38,10 @@ export interface RunManifest {
  briefClass: BriefClass;
  classSource: ClassSource;
  forceBoard: boolean;
-  /**
-   * Execution mode. `simulated` runs stub execution; their results are typed
-   * `simulated` and must never be read as verified success. Optional because
-   * manifests written before this field existed default to `normal`.
-   */
-  mode?: RunMode;
  createdAt: string;
  updatedAt: string;
  currentStage: string;
-  status:
-    | 'in_progress'
-    | 'completed'
-    | 'failed'
-    | 'interrupted'
-    | 'rejected'
-    | 'simulated'
-    | 'waiting-for-authority';
+  status: 'in_progress' | 'completed' | 'failed' | 'interrupted' | 'rejected';
  stages: Record<string, StageStatus>;
 }

@@ -137,7 +65,7 @@ export interface ForgeTask {
  briefPath: string;
  resultPath: string;
  timeoutSeconds: number;
-  qualityGates: ForgeGate[];
+  qualityGates: (string | GateEntry)[];
  worktree?: string;
  command?: string;
  dependsOn?: string[];
@@ -148,7 +76,7 @@ export interface ForgeTask {
 /** Abstract task executor — decouples from packages/coord. */
 export interface TaskExecutor {
  submitTask(task: ForgeTask): Promise<void>;
-  waitForCompletion(taskId: string, timeoutMs: number): Promise<ForgeTaskResult>;
+  waitForCompletion(taskId: string, timeoutMs: number): Promise<TaskResult>;
  getTaskStatus(taskId: string): Promise<ForgeTaskStatus>;
 }

@@ -194,16 +122,7 @@ export interface PipelineOptions {
  stages?: string[];
  skipTo?: string;
  dryRun?: boolean;
-  /**
-   * Real task executor. Required in normal mode: the pipeline fails closed
-   * with FORGE_NO_EXECUTOR when it is absent.
-   */
-  executor?: TaskExecutor;
-  /**
-   * Explicit opt-in to simulated execution. Every stage and gate result is
-   * typed `simulated` and is never satisfying.
-   */
-  simulate?: boolean;
+  executor: TaskExecutor;
 }

 /** Pipeline run result. */
@@ -30,7 +30,7 @@ The Gitea API token is **never passed on a curl command line.** An `Authorizatio

 ### `--login` override

-Both `pr-review.sh` and `issue-comment.sh` accept an optional `--login <name>` flag that overrides the automatically detected Gitea login for that single invocation. The override selects **which credential the REST write, the `/user` identity lookup, and the read-back all use** — its token is resolved from the tea config for that login name (`get_gitea_token_for_login`), falling back to the repo host's credential when no login is named. The resolved login is **host- and port-bound**: the login's configured URL host **and effective port** (the scheme's default port — 80 for `http`, 443 for `https` — applies when a port is omitted, symmetrically on both sides) must match the repo remote's, so a login name shared across hosts (or an override configured for a different Gitea, including one on a different port of the same host) can never send one host's credential to another — a host or port mismatch fails closed rather than leaking a cross-host token. Resolving the acting identity and the read-back from the _same_ login that performs the write is essential: a write performed under an overridden login must be verified against that login's identity, not the host default's. Callers who need a different login than the host default should pass `--login <reviewer-login>`.
+Both `pr-review.sh` and `issue-comment.sh` accept an optional `--login <name>` flag that overrides the automatically detected Gitea login for that single invocation (as of #1280, `pr-create.sh`, `pr-merge.sh` and `issue-create.sh` accept it too, and it wins over `MOSAIC_GIT_IDENTITY` everywhere). The override selects **which credential the REST write, the `/user` identity lookup, and the read-back all use** — its token is resolved from the tea config for that login name (`get_gitea_token_for_login`), falling back to the repo host's credential when no login is named. The resolved login is **host- and port-bound**: the login's configured URL host **and effective port** (the scheme's default port — 80 for `http`, 443 for `https` — applies when a port is omitted, symmetrically on both sides) must match the repo remote's, so a login name shared across hosts (or an override configured for a different Gitea, including one on a different port of the same host) can never send one host's credential to another — a host or port mismatch fails closed rather than leaking a cross-host token. Resolving the acting identity and the read-back from the _same_ login that performs the write is essential: a write performed under an overridden login must be verified against that login's identity, not the host default's. Callers who need a different login than the host default should pass `--login <reviewer-login>`.

 As a durable successor to this mechanism, consider giving each reviewer/approver slot its own dedicated Gitea login credential, so that author≠reviewer holds at the credential level rather than relying on wrapper-level `--login` bookkeeping. This is a recommendation for future hardening, not something implemented by this flag.

@@ -58,6 +58,36 @@ token file present, both tools fall through to the existing shared-account path
 unchanged, so this feature is a no-op on any host that hasn't provisioned per-slot
 tokens.

+### Identity-first principal resolution in the wrappers (#1280)
+
+`resolve_gitea_principal()` (detect-platform.sh) gives the write wrappers —
+`pr-create.sh`, `pr-merge.sh`, `pr-review.sh`, `issue-create.sh`, `issue-comment.sh` —
+ONE precedence for choosing the acting principal:
+
+1. an explicit `--login <name>` (now accepted by all five; operator intent beats
+   environment), then
+2. the per-agent identity above (`MOSAIC_GIT_IDENTITY` env / worktree
+   `mosaic.gitIdentity`) when a per-slot token exists — the wrapper then writes via the
+   REST API with that identity's token and never consults `tea`, so the tea login list
+   cannot shadow the requested principal, then
+3. the tea login list — the LAST resort, never the first, because it enumerates
+   whatever logins the host happens to hold and knows nothing about which seat is
+   calling.
+
+A requested identity whose per-slot token is absent, or a `--login` whose token cannot
+resolve host-bound, **fails loud** (nonzero, naming the identity/login and the expected
+slot) instead of silently writing under whatever account `tea` has configured — that
+silent fallthrough is defect #1280 (reviews, comments, merges, PRs and issues filed
+under the wrong account). `pr-merge.sh --dry-run` reports the principal the merge would
+act as, resolved exactly as the real merge resolves it. ⚠ A **workstation-global**
+`mosaic.gitIdentity` shadows every seat on that host (a fresh clone with no local value
+resolves the global one) — set it per-worktree, not with `--global`.
+
+The resolver is covered by `test-gitea-principal-resolution.sh`; the happy-path
+ordering (identity arm REACHED, not sitting behind a tea failure) by
+`test-pr-create-identity-first.sh`; merge credential binding by
+`test-pr-merge-principal-resolution.sh`.
+
 ### Enabling it for a clone

 The framework installer syncs `git-credential-mosaic` to
@@ -497,6 +497,32 @@ get_gitea_url_for_host() {
    return 1
 }

+# Map a Gitea host to the per-agent identity-token slot PREFIX ("gitea-usc" /
+# "gitea-mosaicstack") used by identity-first principal resolution
+# (MOSAIC_GIT_IDENTITY / git config mosaic.gitIdentity; #1280). Returns 1 for
+# hosts with no per-slot scheme — callers treat that as "identity does not
+# bind here" and fall through to existing behavior, never as an error. This is
+# the single source of truth for the slot layout: get_gitea_token and
+# resolve_gitea_principal both derive their slot paths from here, so the two
+# resolutions can never disagree about where an identity's credential lives.
+gitea_identity_slot_prefix() {
+    case "$1" in
+        git.uscllc.com)      echo "gitea-usc" ;;
+        git.mosaicstack.dev) echo "gitea-mosaicstack" ;;
+        *) return 1 ;;
+    esac
+}
+
+# Resolve the per-slot token FILE PATH for an identity on a host. Prints the
+# absolute path on success; returns 1 (no output) when the host has no per-slot
+# scheme. Prints a PATH only — never a token value.
+gitea_identity_token_slot() {
+    local identity="$1" host="$2" prefix
+    [[ -n "$identity" ]] || return 1
+    prefix=$(gitea_identity_slot_prefix "$host") || return 1
+    printf '%s\n' "$HOME/.config/mosaic/secrets/gitea-tokens/${prefix}-${identity}.token"
+}
+
 # Resolve a Gitea API token for the given host.
 # Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials
 get_gitea_token() {
@@ -517,13 +543,8 @@ get_gitea_token() {
        _ident_src="git config mosaic.gitIdentity"
    fi
    if [[ -n "$_ident" ]]; then
-        local _idpfx=""
-        case "$host" in
-            git.uscllc.com)      _idpfx=gitea-usc ;;
-            git.mosaicstack.dev) _idpfx=gitea-mosaicstack ;;
-        esac
-        if [[ -n "$_idpfx" ]]; then
-            local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
+        local _idtok=""
+        if _idtok="$(gitea_identity_token_slot "$_ident" "$host" 2>/dev/null)"; then
            if [[ -r "$_idtok" ]]; then
                cat "$_idtok"
                return 0
@@ -1465,6 +1486,81 @@ raise SystemExit(1)
 PY
 }

+# resolve_gitea_principal — identity-first acting-principal resolution shared by
+# the git wrappers (#1280). The defect this fixes: wrappers resolved their
+# acting principal from tea's login list FIRST, and that list enumerates
+# whatever logins happen to be configured on the host — it knows nothing about
+# which seat is calling — so a wrapper invoked with MOSAIC_GIT_IDENTITY=fargo
+# still wrote under whichever account tea held (mos-dt-0), and the correct
+# identity-aware code sat behind arms that only ran when the tea path failed.
+# Precedence here is the contract:
+#   1. an explicit login override ($1, the wrapper's --login) — operator intent
+#      beats environment;
+#   2. MOSAIC_GIT_IDENTITY env, else per-worktree `git config mosaic.gitIdentity`
+#      (mirroring get_gitea_token exactly, so resolver and token resolution can
+#      never disagree) — binds only on hosts with a per-slot token scheme;
+#   3. the tea login list — LAST resort, never the first.
+#
+# Prints exactly one line, three tab-separated fields (machine-readable for
+# wrapper dispatch and tests):
+#   mode        "login" | "identity" | "default"
+#   principal   login name (login) | identity name (identity) | tea login or "" (default)
+#   source      "tea-login:<name>" | "identity-slot:<path>" | "tea-default" | "host-credential"
+#
+# Fails LOUD (nonzero, empty stdout, stderr diagnostic) when an explicit
+# override cannot be honored — a refusal is a good day; silently falling
+# through to whoever tea has configured is the exact defect this resolves:
+#   - login mode: no host-bound token for that tea login. The existence check
+#     runs the same tea-config lookup tea itself uses; the token VALUE is
+#     discarded (never printed, never used).
+#   - identity mode: no per-slot token file for that identity on a recognized
+#     host — the diagnostic names the identity, its source, and the expected
+#     slot path. An identity requested on a host with NO per-slot scheme does
+#     not bind (matching get_gitea_token's containment) and falls to default.
+#
+# NEVER prints a token value — principal names and slot paths only.
+# $1 = explicit login override ("" when absent), $2 = host (default: the
+# origin remote's host).
+resolve_gitea_principal() {
+    local login_override="${1:-}" host="${2:-}" ident ident_src slot login
+    [[ -n "$host" ]] || { host=$(get_remote_host) || return 1; }
+
+    if [[ -n "$login_override" ]]; then
+        get_gitea_token_for_login "$login_override" "$host" >/dev/null || {
+            echo "Error: --login '$login_override' has no host-matched token on host '$host' (tea config lookup); refusing to fall back to any other principal (#1280 identity-first resolution)." >&2
+            return 1
+        }
+        printf 'login\t%s\ttea-login:%s\n' "$login_override" "$login_override"
+        return 0
+    fi
+
+    ident="${MOSAIC_GIT_IDENTITY:-}"
+    ident_src="MOSAIC_GIT_IDENTITY"
+    if [[ -z "$ident" ]]; then
+        ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
+        ident_src="git config mosaic.gitIdentity"
+    fi
+    if [[ -n "$ident" ]] && slot="$(gitea_identity_token_slot "$ident" "$host" 2>/dev/null)"; then
+        if [[ -r "$slot" ]]; then
+            printf 'identity\t%s\tidentity-slot:%s\n' "$ident" "$slot"
+            return 0
+        fi
+        echo "Error: git identity '$ident' requested (via $ident_src) for host '$host', but no per-slot token at $slot (#1280 identity-first resolution)." >&2
+        echo "       Refusing to fall back to the tea login list or shared credentials. Provision the per-slot token, or unset the identity." >&2
+        return 1
+    fi
+
+    # No override requested: tea's login list is the LAST resort. Absence is
+    # not an error here — callers fall back to the host credential, exactly as
+    # they did before this resolver existed (preserved behavior).
+    if login=$(get_gitea_login_for_host "$host" 2>/dev/null); then
+        printf 'default\t%s\ttea-default\n' "$login"
+    else
+        printf 'default\t\thost-credential\n'
+    fi
+    return 0
+}
+
 # Resolve HTTPS basic auth credentials for a Gitea host from ~/.git-credentials.
 # Prints "username:password" for direct curl -u consumption. Callers must not log it.
 get_gitea_basic_auth() {
@@ -76,27 +76,36 @@ fi
 detect_platform >/dev/null

 # Resolve and cache the Gitea REST endpoint + token for the current remote,
-# bound to a SPECIFIC login identity ($1). Populates GITEA_API_ROOT (…/api/v1),
-# GITEA_API_BASE (…/api/v1/repos/<slug>), and GITEA_API_TOKEN.
+# bound to a SPECIFIC acting principal ($1) selected identity-first (#1280):
+# an explicit --login wins, else MOSAIC_GIT_IDENTITY / git config
+# mosaic.gitIdentity binds the per-slot credential, else the tea login list
+# (last resort). Populates GITEA_API_ROOT (…/api/v1), GITEA_API_BASE
+# (…/api/v1/repos/<slug>), and GITEA_API_TOKEN.
 #
-# The token is resolved for the EFFECTIVE login (the --login override when
-# given, otherwise the detected default) so that the single credential used for
-# the write ALSO drives the /user identity read and the read-back — write token
-# and read-back token are the same identity by construction (this is the
-# credential-ordering fix: a --login override is no longer written under one
-# credential and verified under a different default one). Falls back to the
-# host-scoped credential ONLY when NO --login override was supplied (the
-# best-effort default path). When $2 is "explicit" the login came from a
-# caller-supplied --login: that exact login's token MUST resolve, and we FAIL
-# CLOSED rather than silently downgrading the write to the host default
-# identity — otherwise a caller relying on a dedicated per-role credential would
-# be told the write succeeded as requested while it was attributed to the shared
-# default. Returns non-zero (clear stderr) on any resolution failure.
+# The token is resolved for the EFFECTIVE principal so that the single
+# credential used for the write ALSO drives the /user identity read and the
+# read-back — write token and read-back token are the same identity by
+# construction (this is the credential-ordering fix: a --login override is no
+# longer written under one credential and verified under a different default
+# one). When $2 is "identity" the principal ($1) is a requested git identity:
+# the token MUST resolve from that identity's per-slot token (get_gitea_token's
+# identity arm), failing closed rather than borrowing the tea default login —
+# the tea login list must never shadow a requested identity (#1280). When $2
+# is "explicit" the principal came from a caller-supplied --login: that exact
+# login's token MUST resolve, and we FAIL CLOSED rather than silently
+# downgrading the write to the host default identity. Otherwise the best-effort
+# default path applies (per-login token, else the host-scoped credential).
+# Returns non-zero (clear stderr) on any resolution failure.
 gitea_resolve_api_for_login() {
    local effective_login="$1" override_explicit="${2:-}" host configured_url repo

    host=$(get_remote_host)
-    if [[ -n "$override_explicit" ]]; then
+    if [[ "$override_explicit" == "identity" ]]; then
+        GITEA_API_TOKEN=$(get_gitea_token "$host") || {
+            echo "Error: could not resolve the per-slot token for requested git identity '$effective_login' on host '$host'; refusing to fall back to the tea login list or shared credentials (comment write/read-back, #1280)." >&2
+            return 1
+        }
+    elif [[ -n "$override_explicit" ]]; then
        GITEA_API_TOKEN=$(get_gitea_token_for_login "$effective_login" "$host") || {
            echo "Error: could not resolve a host-matched Gitea token for --login '$effective_login' on host '$host'; refusing to fall back to the host default identity or a cross-host credential (comment write/read-back)" >&2
            return 1
@@ -318,23 +327,31 @@ if [[ "$PLATFORM" == "github" ]]; then
    gh issue comment "$ISSUE_NUMBER" --body "$COMMENT"
    echo "Added comment to GitHub issue #$ISSUE_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
-    # Resolve the login this comment should be attributed to: the --login
-    # override when given, otherwise the detected default for this repo's host.
-    # A --login override always wins. Otherwise name this repo host's login only
-    # as a best effort: the login name merely selects a per-login token, and
-    # gitea_resolve_api_for_login falls back to the host credential
-    # (get_gitea_token) when no tea login is named, so the default credential
-    # still resolves even when the host tea has no matching login entry.
-    EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
-    [[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login 2>/dev/null || true)
+    # Resolve the acting principal identity-first (#1280): an explicit --login
+    # wins; otherwise MOSAIC_GIT_IDENTITY / git config mosaic.gitIdentity
+    # selects the principal when a per-slot token exists (fail-loud when it
+    # does not); the tea login list is the LAST resort — it knows nothing about
+    # which seat is calling, so resolving from it first wrote under whichever
+    # account tea had configured (the #1280 family).
+    principal_host=$(get_remote_host)
+    if ! principal_resolved="$(resolve_gitea_principal "$LOGIN_OVERRIDE" "$principal_host")"; then
+        # resolve_gitea_principal already printed the fail-loud diagnostic.
+        exit 1
+    fi
+    PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
+    PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"

-    # Bind the REST endpoint + token to the effective login, then derive the
+    # Bind the REST endpoint + token to the resolved principal, then derive the
    # acting identity from that SAME credential (GET /user). The write below and
    # its read-back both use this credential, so the write is verified against
-    # the identity that actually performed it. Passing "explicit" when --login
-    # was supplied forbids the host-default fallback: an unresolvable explicit
-    # override fails closed instead of writing under the default identity.
-    gitea_resolve_api_for_login "$EFFECTIVE_LOGIN" "${LOGIN_OVERRIDE:+explicit}" || exit 1
+    # the identity that actually performed it.
+    if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+        gitea_resolve_api_for_login "$PRINCIPAL_NAME" identity || exit 1
+    elif [[ "$PRINCIPAL_MODE" == "login" ]]; then
+        gitea_resolve_api_for_login "$PRINCIPAL_NAME" explicit || exit 1
+    else
+        gitea_resolve_api_for_login "$PRINCIPAL_NAME" "" || exit 1
+    fi
    ACTING_LOGIN=$(gitea_authenticated_login) || exit 1

    comment_id=$(gitea_create_comment_verified "$ISSUE_NUMBER" "$COMMENT" "$ACTING_LOGIN") || {
@@ -1,6 +1,15 @@
 #!/bin/bash
 # issue-create.sh - Create issues on Gitea or GitHub
-# Usage: issue-create.sh -t "Title" [-b "Body"] [-l "label1,label2"] [-m "milestone"]
+# Usage: issue-create.sh -t "Title" [-b "Body"] [-l "label1,label2"] [-m "milestone"] [--login <name>]
+#
+# Acting principal is resolved identity-first (#1280): an explicit --login
+# wins; otherwise MOSAIC_GIT_IDENTITY / per-worktree git config
+# mosaic.gitIdentity selects the principal when a per-slot token exists (and
+# the wrapper then creates the issue through the REST API with that identity's
+# token — tea is never invoked, so the tea login list cannot shadow the
+# requested principal); the tea login list is the LAST resort. A requested
+# identity with no per-slot token fails LOUD rather than writing under
+# whichever account tea happens to hold.

 set -e

@@ -16,6 +25,14 @@ INTERACTIVE=false

 # get_remote_host and get_gitea_token are provided by detect-platform.sh

+# Acting-principal mode set in the Gitea branch below (from
+# resolve_gitea_principal): "login" when --login was given, "identity" when a
+# git identity bound, "default" otherwise. PRINCIPAL_MODE=login makes the API
+# arm resolve the --login principal's token too, so an explicit --login keeps
+# winning even on the tea-FAILURE fallback arm.
+PRINCIPAL_MODE=""
+PRINCIPAL_NAME=""
+
 gitea_issue_create_api() {
    local host repo token url payload
    host=$(get_remote_host) || {
@@ -26,10 +43,19 @@ gitea_issue_create_api() {
        echo "Error: could not determine repo owner/name for API fallback" >&2
        return 1
    }
-    token=$(get_gitea_token "$host") || {
-        echo "Error: Gitea token not found for API fallback (set GITEA_TOKEN or configure ~/.git-credentials)" >&2
-        return 1
-    }
+    if [[ "$PRINCIPAL_MODE" == "login" ]]; then
+        token=$(get_gitea_token_for_login "$PRINCIPAL_NAME" "$host") || {
+            echo "Error: could not resolve a host-matched Gitea token for --login '$PRINCIPAL_NAME' on host '$host' (API path)" >&2
+            return 1
+        }
+    else
+        # Identity-first when MOSAIC_GIT_IDENTITY / git config mosaic.gitIdentity
+        # is set (per-slot token, fail-loud on absence); shared default otherwise.
+        token=$(get_gitea_token "$host") || {
+            echo "Error: Gitea token not found for API fallback (set GITEA_TOKEN or configure ~/.git-credentials)" >&2
+            return 1
+        }
+    fi

    if [[ -n "$LABELS" || -n "$MILESTONE" ]]; then
        echo "Warning: API fallback currently applies title/body only; labels/milestone require authenticated tea setup." >&2
@@ -67,6 +93,7 @@ Options:
    -b, --body BODY         Issue body/description
    -l, --labels LABELS     Comma-separated labels (e.g., "bug,feature")
    -m, --milestone NAME    Milestone name to assign
+        --login NAME        Act as this Gitea tea login (wins over MOSAIC_GIT_IDENTITY)
    -i, --interactive       Prompt for missing issue fields
    -h, --help              Show this help message

@@ -97,6 +124,10 @@ while [[ $# -gt 0 ]]; do
            MILESTONE="$2"
            shift 2
            ;;
+        --login)
+            LOGIN_OVERRIDE="$2"
+            shift 2
+            ;;
        -i|--interactive)
            INTERACTIVE=true
            shift
@@ -134,13 +165,37 @@ case "$PLATFORM" in
        "${CMD[@]}"
        ;;
    gitea)
+        # Resolve the acting principal identity-first (#1280). The tea login
+        # list is the LAST resort: it knows nothing about which seat is calling,
+        # and a login resolved from it first is what attributed issues to the
+        # wrong account even when MOSAIC_GIT_IDENTITY was set.
+        principal_host=$(get_remote_host 2>/dev/null || true)
+        if ! principal_resolved="$(resolve_gitea_principal "${LOGIN_OVERRIDE:-}" "$principal_host")"; then
+            # resolve_gitea_principal already printed the fail-loud diagnostic.
+            exit 1
+        fi
+        PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
+        PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"
+
+        if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+            # HAPPY PATH for a requested identity: create through the REST API
+            # with the per-slot token and never invoke tea — the identity arm
+            # must be REACHED, not sit behind a tea failure (#1280).
+            gitea_issue_create_api
+            exit $?
+        fi
+
        if command -v tea >/dev/null 2>&1; then
            REPO_SLUG=$(get_repo_slug)
-            GITEA_LOGIN_NAME=$(get_gitea_login) || {
-                echo "Warning: could not resolve Gitea login for tea; trying Gitea API fallback..." >&2
-                gitea_issue_create_api
-                exit $?
-            }
+            if [[ "$PRINCIPAL_MODE" == "login" ]]; then
+                GITEA_LOGIN_NAME="$PRINCIPAL_NAME"
+            else
+                GITEA_LOGIN_NAME=$(get_gitea_login) || {
+                    echo "Warning: could not resolve Gitea login for tea; trying Gitea API fallback..." >&2
+                    gitea_issue_create_api
+                    exit $?
+                }
+            fi
            if ! get_gitea_authenticated_user "$GITEA_LOGIN_NAME" >/dev/null; then
                echo "Warning: Tea authenticated-user validation failed (possible stale user/login); trying Gitea API fallback..." >&2
                gitea_issue_create_api
@@ -1,6 +1,15 @@
 #!/bin/bash
 # pr-create.sh - Create pull requests on Gitea or GitHub
-# Usage: pr-create.sh -t "Title" [-b "Body"] [-B base] [-H head] [-l "labels"] [-m "milestone"]
+# Usage: pr-create.sh -t "Title" [-b "Body"] [-B base] [-H head] [-l "labels"] [-m "milestone"] [--login <name>]
+#
+# Acting principal is resolved identity-first (#1280): an explicit --login
+# wins; otherwise MOSAIC_GIT_IDENTITY / per-worktree git config
+# mosaic.gitIdentity selects the principal when a per-slot token exists (and
+# the wrapper then creates the PR through the REST API with that identity's
+# token — tea is never invoked, so the tea login list cannot shadow the
+# requested principal); the tea login list is the LAST resort. A requested
+# identity with no per-slot token fails LOUD rather than writing under
+# whichever account tea happens to hold.

 set -e

@@ -19,6 +28,15 @@ ISSUE=""

 # get_remote_host, get_gitea_token, get_repo_info, and get_gitea_repo_args are provided by detect-platform.sh

+# Acting-principal mode set in the Gitea branch below (from
+# resolve_gitea_principal): "login" when --login was given, "identity" when a
+# git identity bound, "default" otherwise. PRINCIPAL_MODE=login makes the API
+# arm resolve the --login principal's token too, so an explicit --login keeps
+# winning even on the tea-FAILURE fallback arm (otherwise the fallback would
+# silently re-resolve to the environment identity or shared credential).
+PRINCIPAL_MODE=""
+PRINCIPAL_NAME=""
+
 gitea_pr_create_api() {
    local host repo token url payload
    host=$(get_remote_host) || {
@@ -29,10 +47,19 @@ gitea_pr_create_api() {
        echo "Error: could not determine repo owner/name for API fallback" >&2
        return 1
    }
-    token=$(get_gitea_token "$host") || {
-        echo "Error: Gitea token not found for API fallback (set GITEA_TOKEN or configure ~/.git-credentials)" >&2
-        return 1
-    }
+    if [[ "$PRINCIPAL_MODE" == "login" ]]; then
+        token=$(get_gitea_token_for_login "$PRINCIPAL_NAME" "$host") || {
+            echo "Error: could not resolve a host-matched Gitea token for --login '$PRINCIPAL_NAME' on host '$host' (API path)" >&2
+            return 1
+        }
+    else
+        # Identity-first when MOSAIC_GIT_IDENTITY / git config mosaic.gitIdentity
+        # is set (per-slot token, fail-loud on absence); shared default otherwise.
+        token=$(get_gitea_token "$host") || {
+            echo "Error: Gitea token not found for API fallback (set GITEA_TOKEN or configure ~/.git-credentials)" >&2
+            return 1
+        }
+    fi

    if [[ -n "$LABELS" || -n "$MILESTONE" || "$DRAFT" == true ]]; then
        echo "Warning: API fallback applies title/body/head/base only; labels/milestone/draft require authenticated tea setup." >&2
@@ -76,6 +103,7 @@ Options:
    -H, --head BRANCH       Head branch with changes (default: current branch)
    -l, --labels LABELS     Comma-separated labels
    -m, --milestone NAME    Milestone name
+        --login NAME        Act as this Gitea tea login (wins over MOSAIC_GIT_IDENTITY)
    -i, --issue NUMBER      Link to issue (auto-generates title if not provided)
    -d, --draft             Create as draft PR
    -h, --help              Show this help message
@@ -116,6 +144,10 @@ while [[ $# -gt 0 ]]; do
            MILESTONE="$2"
            shift 2
            ;;
+        --login)
+            LOGIN_OVERRIDE="$2"
+            shift 2
+            ;;
        -i|--issue)
            ISSUE="$2"
            shift 2
@@ -174,15 +206,41 @@ case "$PLATFORM" in
        "${CMD[@]}"
        ;;
    gitea)
+        # Resolve the acting principal identity-first (#1280). The tea login
+        # list is the LAST resort: it knows nothing about which seat is calling,
+        # and a login resolved from it first is what attributed PRs to the wrong
+        # account even when MOSAIC_GIT_IDENTITY was set.
+        principal_host=$(get_remote_host 2>/dev/null || true)
+        if ! principal_resolved="$(resolve_gitea_principal "${LOGIN_OVERRIDE:-}" "$principal_host")"; then
+            # resolve_gitea_principal already printed the fail-loud diagnostic.
+            exit 1
+        fi
+        PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
+        PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"
+
+        if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+            # HAPPY PATH for a requested identity: the per-slot token IS the
+            # credential, so create through the REST API directly and never
+            # invoke tea — the identity arm must be REACHED, not sit behind a
+            # tea failure (#1280). Fail-loud on a missing slot already happened
+            # in resolve_gitea_principal.
+            gitea_pr_create_api
+            exit $?
+        fi
+
        # tea pull create syntax. Always pass --repo because tea repo inference
        # is unreliable in Mosaic worktrees/profile shells. Use arrays instead
        # of eval so markdown backticks/body content are not shell-executed.
        REPO_SLUG=$(get_repo_slug)
-        GITEA_LOGIN_NAME=$(get_gitea_login) || {
-            echo "Warning: could not resolve Gitea login for tea; trying Gitea API fallback..." >&2
-            gitea_pr_create_api
-            exit $?
-        }
+        if [[ "$PRINCIPAL_MODE" == "login" ]]; then
+            GITEA_LOGIN_NAME="$PRINCIPAL_NAME"
+        else
+            GITEA_LOGIN_NAME=$(get_gitea_login) || {
+                echo "Warning: could not resolve Gitea login for tea; trying Gitea API fallback..." >&2
+                gitea_pr_create_api
+                exit $?
+            }
+        fi
        if ! get_gitea_authenticated_user "$GITEA_LOGIN_NAME" >/dev/null; then
            echo "Warning: Tea authenticated-user validation failed (possible stale user/login); trying Gitea API fallback..." >&2
            gitea_pr_create_api
@@ -1,6 +1,13 @@
 #!/bin/bash
 # pr-merge.sh - Merge pull requests on Gitea or GitHub
-# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--expect-head SHA] [--co-author-trailers --escalate-to PRINCIPAL]
+# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--expect-head SHA] [--co-author-trailers --escalate-to PRINCIPAL] [--login <name>]
+#
+# Acting principal is resolved identity-first (#1280): an explicit --login
+# wins; otherwise MOSAIC_GIT_IDENTITY / per-worktree git config
+# mosaic.gitIdentity selects the credential (per-slot token, fail-loud when
+# absent); the shared host credential is the last resort. The merge is
+# performed with the resolved credential only — never a cross-principal
+# fallback (an HTTP 401 from the identity-bound token is a hard stop).

 set -euo pipefail

@@ -16,6 +23,7 @@ DRY_RUN=false
 EXPECT_HEAD=""
 CO_AUTHOR_TRAILERS=false
 ESCALATE_TO=""
+LOGIN_OVERRIDE=""

 usage() {
    cat <<EOF
@@ -31,6 +39,7 @@ Options:
        --expect-head SHA   Refuse unless the PR head matches this full commit SHA
        --co-author-trailers Build verified trailers from linked PR commit authors
        --escalate-to NAME  Named principal for an unresolved-author BLOCK
+        --login NAME        Act as this Gitea tea login (wins over MOSAIC_GIT_IDENTITY)
    -h, --help              Show this help message

 Examples:
@@ -39,6 +48,7 @@ Examples:
    $(basename "$0") -n 42 -d                 # Squash merge and delete branch
    $(basename "$0") -n 42 --expect-head 0123456789abcdef0123456789abcdef01234567
    $(basename "$0") -n 42 --co-author-trailers --escalate-to tl-mosaic
+    $(basename "$0") -n 42 --login fred-ms    # Merge under the fred-ms tea login
 EOF
    exit "${1:-1}"
 }
@@ -82,6 +92,14 @@ while [[ $# -gt 0 ]]; do
            ESCALATE_TO="$2"
            shift 2
            ;;
+        --login|-l)
+            if [[ $# -lt 2 ]]; then
+                echo "Error: --login requires one tea login name." >&2
+                exit 1
+            fi
+            LOGIN_OVERRIDE="$2"
+            shift 2
+            ;;
        -h|--help)
            usage 0
            ;;
@@ -572,9 +590,22 @@ PY
 merge_gitea_with_api() {
    local host="$1" token attempt_rc

-    if ! token=$(get_gitea_token "$host"); then
-        echo "Error: Could not resolve the required Gitea token; refusing merge without changing principals." >&2
-        return 1
+    # Identity-first principal resolution (#1280): an explicit --login wins
+    # over MOSAIC_GIT_IDENTITY (operator intent beats environment); otherwise
+    # get_gitea_token resolves the identity's per-slot token when an identity
+    # is requested (fail-loud when absent) and the shared host credential only
+    # when no identity is set. No cross-principal fallback: whatever resolves
+    # here is the ONLY credential the merge is attempted with.
+    if [[ -n "$LOGIN_OVERRIDE" ]]; then
+        if ! token=$(get_gitea_token_for_login "$LOGIN_OVERRIDE" "$host"); then
+            echo "Error: --login '$LOGIN_OVERRIDE' has no host-matched token on host '$host'; refusing to merge under any other principal (#1280 identity-first resolution)." >&2
+            return 1
+        fi
+    else
+        if ! token=$(get_gitea_token "$host"); then
+            echo "Error: Could not resolve the required Gitea token; refusing merge without changing principals." >&2
+            return 1
+        fi
    fi
    if [[ -z "$token" ]]; then
        echo "Error: Required Gitea token resolved empty; refusing merge without changing principals." >&2
@@ -602,10 +633,25 @@ if [[ "$DRY_RUN" == true ]]; then
            echo "Error: Cannot determine host from origin remote URL" >&2
            exit 1
        }
+        # Report the acting principal the merge WOULD use, resolved the same
+        # way the real merge resolves it (#1280) — a dry run that names a
+        # different principal than the merge would act as is a lie.
+        if ! principal_resolved="$(resolve_gitea_principal "$LOGIN_OVERRIDE" "$HOST")"; then
+            # Fail-loud diagnostic already printed (unresolvable --login or a
+            # requested identity with no per-slot token).
+            exit 1
+        fi
+        DRY_PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
+        DRY_PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"
+        case "$DRY_PRINCIPAL_MODE" in
+            login)    DRY_PRINCIPAL_DESC="tea login '$DRY_PRINCIPAL_NAME'" ;;
+            identity) DRY_PRINCIPAL_DESC="git identity '$DRY_PRINCIPAL_NAME' (per-slot credential)" ;;
+            *)        DRY_PRINCIPAL_DESC="default host credential" ;;
+        esac
        if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
-            echo "Dry run: would verify PR commit authors and merge PR #$PR_NUMBER on $HOST with authenticated Gitea API message fields (base=$BASE_BRANCH, method=squash)."
+            echo "Dry run: would verify PR commit authors and merge PR #$PR_NUMBER on $HOST as $DRY_PRINCIPAL_DESC with authenticated Gitea API message fields (base=$BASE_BRANCH, method=squash)."
        else
-            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with the authenticated exact-head Gitea API path (base=$BASE_BRANCH, method=squash)."
+            echo "Dry run: would merge PR #$PR_NUMBER on $HOST as $DRY_PRINCIPAL_DESC with the authenticated exact-head Gitea API path (base=$BASE_BRANCH, method=squash)."
        fi
    else
        echo "Dry run: would merge PR #$PR_NUMBER on $PLATFORM (base=$BASE_BRANCH, method=squash)."
@@ -76,7 +76,7 @@ while [[ $# -gt 0 ]]; do
            echo "  -n, --number   PR number (required)"
            echo "  -a, --action   Review action: approve, request-changes, comment (required)"
            echo "  -c, --comment  Review comment (required for request-changes)"
-            echo "  -l, --login    Override the detected Gitea tea login (approve/request-changes only)"
+            echo "  -l, --login    Override the detected Gitea tea login (all actions; wins over MOSAIC_GIT_IDENTITY)"
            echo "  -r, --repo     Explicit owner/repo slug (skips git-remote slug inference)"
            echo "  -H, --host     Explicit Gitea host (skips remote-host inference)"
            echo "  -h, --help     Show this help"
@@ -346,7 +346,14 @@ gitea_resolve_api_for_login() {
    else
        host=$(get_remote_host)
    fi
-    if [[ -n "$override_explicit" ]]; then
+    if [[ "$override_explicit" == "identity" ]]; then
+        # Requested git identity (#1280): the per-slot token MUST resolve via
+        # get_gitea_token's identity arm; never borrow the tea default login.
+        GITEA_API_TOKEN=$(get_gitea_token "$host") || {
+            echo "Error: could not resolve the per-slot token for requested git identity '$effective_login' on host '$host'; refusing to fall back to the tea login list or shared credentials (review write/read-back, #1280)." >&2
+            return 1
+        }
+    elif [[ -n "$override_explicit" ]]; then
        GITEA_API_TOKEN=$(get_gitea_token_for_login "$effective_login" "$host") || {
            echo "Error: could not resolve a host-matched Gitea token for --login '$effective_login' on host '$host'; refusing to fall back to the host default identity or a cross-host credential (review write/read-back)" >&2
            return 1
@@ -676,29 +683,32 @@ if [[ "$PLATFORM" == "github" ]]; then
            ;;
    esac
 elif [[ "$PLATFORM" == "gitea" ]]; then
+    # Resolve the acting principal ONCE for every action, identity-first
+    # (#1280): an explicit --login wins; otherwise MOSAIC_GIT_IDENTITY /
+    # per-worktree git config mosaic.gitIdentity selects the principal when a
+    # per-slot token exists (fail-loud when it does not); the tea login list is
+    # the LAST resort — it enumerates whatever logins this host happens to hold
+    # and knows nothing about which seat is calling, so resolving from it first
+    # wrote under whichever account tea had configured (the #1280 family).
+    principal_host="${HOST_OVERRIDE:-$(get_remote_host 2>/dev/null || true)}"
+    if ! principal_resolved="$(resolve_gitea_principal "$LOGIN_OVERRIDE" "$principal_host")"; then
+        # resolve_gitea_principal already printed the fail-loud diagnostic.
+        exit 1
+    fi
+    PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
+    PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"
    case $ACTION in
        approve)
-            # Best-effort host for the tea-login GUESS only (gitea_resolve_api_for_login
-            # below re-derives the real host from HOST_OVERRIDE/remote independently and
-            # is authoritative). Prefer an explicit -H/--host; otherwise best-effort
-            # git-remote inference, tolerating its ABSENCE (a bare `get_remote_host` here
-            # under `set -e`, with no origin and no -H, previously killed the script
-            # SILENTLY — exit 1, zero output — even though -r/-H are exactly the flags
-            # that support running with no usable origin at all).
-            host="${HOST_OVERRIDE:-$(get_remote_host 2>/dev/null || true)}"
-            # A --login override always wins. Otherwise name this host's login
-            # only as a best effort: the login name merely selects a per-login
-            # token, and gitea_resolve_api_for_login falls back to the host
-            # credential (get_gitea_token) when no tea login is named — so a host
-            # tea's login list need not enumerate exotic (e.g. ported) hosts for
-            # the default credential to resolve. The single resolved token is
-            # then used for the write, the /user identity, and the read-back.
-            EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
-            [[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login_for_host "$host" 2>/dev/null || true)
-            # Bind the REST endpoint + token to the effective login, then derive
-            # the acting identity from that SAME credential so the review submit
-            # and its read-back verify against the identity that performed them.
-            gitea_resolve_api_for_login "$EFFECTIVE_LOGIN" "${LOGIN_OVERRIDE:+explicit}" || exit 1
+            # Identity-first principal resolution (#1280): PRINCIPAL_MODE /
+            # PRINCIPAL_NAME were resolved once above from --login >
+            # MOSAIC_GIT_IDENTITY / git config > tea login list (last resort).
+            if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" identity || exit 1
+            elif [[ "$PRINCIPAL_MODE" == "login" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" explicit || exit 1
+            else
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" "" || exit 1
+            fi
            ACTING_LOGIN=$(gitea_authenticated_login) || exit 1
            head_sha=$(gitea_pr_head_sha "$PR_NUMBER") || exit 1
            # The review body (if any) travels with the review itself in the REST
@@ -715,24 +725,16 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
                echo "Error: Comment required for request-changes"
                exit 1
            fi
-            # Best-effort host for the tea-login GUESS only (gitea_resolve_api_for_login
-            # below re-derives the real host from HOST_OVERRIDE/remote independently and
-            # is authoritative). Prefer an explicit -H/--host; otherwise best-effort
-            # git-remote inference, tolerating its ABSENCE (a bare `get_remote_host` here
-            # under `set -e`, with no origin and no -H, previously killed the script
-            # SILENTLY — exit 1, zero output — even though -r/-H are exactly the flags
-            # that support running with no usable origin at all).
-            host="${HOST_OVERRIDE:-$(get_remote_host 2>/dev/null || true)}"
-            # A --login override always wins. Otherwise name this host's login
-            # only as a best effort: the login name merely selects a per-login
-            # token, and gitea_resolve_api_for_login falls back to the host
-            # credential (get_gitea_token) when no tea login is named — so a host
-            # tea's login list need not enumerate exotic (e.g. ported) hosts for
-            # the default credential to resolve. The single resolved token is
-            # then used for the write, the /user identity, and the read-back.
-            EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
-            [[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login_for_host "$host" 2>/dev/null || true)
-            gitea_resolve_api_for_login "$EFFECTIVE_LOGIN" "${LOGIN_OVERRIDE:+explicit}" || exit 1
+            # Identity-first principal resolution (#1280): PRINCIPAL_MODE /
+            # PRINCIPAL_NAME were resolved once above from --login >
+            # MOSAIC_GIT_IDENTITY / git config > tea login list (last resort).
+            if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" identity || exit 1
+            elif [[ "$PRINCIPAL_MODE" == "login" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" explicit || exit 1
+            else
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" "" || exit 1
+            fi
            ACTING_LOGIN=$(gitea_authenticated_login) || exit 1
            head_sha=$(gitea_pr_head_sha "$PR_NUMBER") || exit 1
            review_id=$(gitea_submit_review_verified "$PR_NUMBER" "REQUEST_CHANGES" "$COMMENT" "$ACTING_LOGIN" "$head_sha") || {
@@ -746,24 +748,16 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
                echo "Error: Comment required"
                exit 1
            fi
-            # Best-effort host for the tea-login GUESS only (gitea_resolve_api_for_login
-            # below re-derives the real host from HOST_OVERRIDE/remote independently and
-            # is authoritative). Prefer an explicit -H/--host; otherwise best-effort
-            # git-remote inference, tolerating its ABSENCE (a bare `get_remote_host` here
-            # under `set -e`, with no origin and no -H, previously killed the script
-            # SILENTLY — exit 1, zero output — even though -r/-H are exactly the flags
-            # that support running with no usable origin at all).
-            host="${HOST_OVERRIDE:-$(get_remote_host 2>/dev/null || true)}"
-            # A --login override always wins. Otherwise name this host's login
-            # only as a best effort: the login name merely selects a per-login
-            # token, and gitea_resolve_api_for_login falls back to the host
-            # credential (get_gitea_token) when no tea login is named — so a host
-            # tea's login list need not enumerate exotic (e.g. ported) hosts for
-            # the default credential to resolve. The single resolved token is
-            # then used for the write, the /user identity, and the read-back.
-            EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
-            [[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login_for_host "$host" 2>/dev/null || true)
-            gitea_resolve_api_for_login "$EFFECTIVE_LOGIN" "${LOGIN_OVERRIDE:+explicit}" || exit 1
+            # Identity-first principal resolution (#1280): PRINCIPAL_MODE /
+            # PRINCIPAL_NAME were resolved once above from --login >
+            # MOSAIC_GIT_IDENTITY / git config > tea login list (last resort).
+            if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" identity || exit 1
+            elif [[ "$PRINCIPAL_MODE" == "login" ]]; then
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" explicit || exit 1
+            else
+                gitea_resolve_api_for_login "$PRINCIPAL_NAME" "" || exit 1
+            fi
            ACTING_LOGIN=$(gitea_authenticated_login) || exit 1
            comment_id=$(gitea_create_comment_verified "$PR_NUMBER" "$COMMENT" "$ACTING_LOGIN") || {
                echo "Error: could not create and verify a comment on Gitea PR #$PR_NUMBER via a provider-returned created id (#865)." >&2
@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# Regression harness for detect-platform.sh's resolve_gitea_principal() — the
+# identity-first acting-principal resolution shared by the git wrappers
+# (mosaicstack/stack #1280).
+#
+# The contract under test (precedence: --login > MOSAIC_GIT_IDENTITY /
+# git config mosaic.gitIdentity > tea login list, which is the LAST resort):
+#   1. identity env + per-slot token present -> mode=identity, principal=
+#      identity name, source names the identity's slot PATH (never a token
+#      value).
+#   2. identity env + per-slot token ABSENT -> FAIL LOUD: nonzero, empty
+#      stdout, stderr naming the identity and the expected slot path.
+#   3. identity env + --login -> --login wins (login mode resolves even when
+#      the identity has no slot — operator intent beats environment).
+#   4. identity unset + no --login -> default mode: the tea login list
+#      resolves the principal exactly as before (preserved behavior).
+#   5. no identity + no host-matching tea login -> default/host-credential
+#      (preserved behavior; absence is not an error on the default path).
+#   6. identity on an UNRECOGNIZED host (no per-slot scheme) -> does not bind;
+#      default mode (containment, mirroring get_gitea_token).
+#   7. --login with no host-bound token for that login -> FAIL LOUD, stderr
+#      naming the login and the host.
+#   8. git config mosaic.gitIdentity is honored when the env var is unset.
+#   9. The resolver NEVER emits a token value — stdout/stderr of every
+#      successful resolution must not contain the slot file's contents.
+#
+# Uses a stubbed tea binary, stubbed tea config.yml, stubbed credentials.json
+# and stubbed per-slot token files under a fake HOME. NEVER reads real secrets.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/gitea-principal-resolution}"
+FAKE_HOME="$WORK_DIR/home"
+REPO_DIR="$WORK_DIR/repo"
+BIN_DIR="$WORK_DIR/bin"
+CREDENTIALS_FILE="$FAKE_HOME/.config/mosaic/credentials.json"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" "$FAKE_HOME/.config/tea" "$REPO_DIR" "$BIN_DIR"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
+
+cat > "$CREDENTIALS_FILE" <<'JSON'
+{
+  "gitea": {
+    "mosaicstack": {
+      "url": "https://git.mosaicstack.dev",
+      "token": "shared-mosaicstack-token"
+    },
+    "usc": {
+      "url": "https://git.uscllc.com",
+      "token": "shared-usc-token"
+    }
+  }
+}
+JSON
+
+# tea's own config store: the source get_gitea_token_for_login reads. Logins
+# "alice" (mosaicstack) and "bob-usc" (usc) carry sentinel token values that
+# the assertions prove are NEVER emitted by the resolver.
+cat > "$FAKE_HOME/.config/tea/config.yml" <<'YAML'
+logins:
+- name: alice
+  url: https://git.mosaicstack.dev
+  token: SECRET-alice-tea-token
+- name: bob-usc
+  url: https://git.uscllc.com
+  token: SECRET-bob-usc-tea-token
+YAML
+
+# Stubbed tea: only what login resolution needs (`login list --output json`).
+cat > "$BIN_DIR/tea" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$*" == "login list --output json" ]]; then
+    cat <<'JSON'
+[
+  {"name":"alice","url":"https://git.mosaicstack.dev","default":true},
+  {"name":"bob-usc","url":"https://git.uscllc.com"}
+]
+JSON
+    exit 0
+fi
+exit 0
+SH
+chmod +x "$BIN_DIR/tea"
+
+# Per-slot identity token with a sentinel value the assertions prove is never
+# emitted (proving "token came from the identity's slot BY PATH, not by value").
+echo -n "SECRET-agentX-slot-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentX.token"
+
+fail=0
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [[ "$expected" != "$actual" ]]; then
+    echo "FAIL: $desc — expected '$expected', got '$actual'" >&2
+    fail=1
+  fi
+}
+assert_contains() {
+  local desc="$1" haystack="$2" needle="$3"
+  if [[ "$haystack" != *"$needle"* ]]; then
+    echo "FAIL: $desc — missing '$needle' in: $haystack" >&2
+    fail=1
+  fi
+}
+assert_not_contains() {
+  local desc="$1" haystack="$2" needle="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    echo "FAIL: $desc — must not contain '$needle', got: $haystack" >&2
+    fail=1
+  fi
+}
+
+# Runs resolve_gitea_principal for $1=login_override $2=host inside REPO_DIR
+# (per-worktree git config resolves there) under a fake HOME, stubbed tea, and
+# stubbed credentials. Extra env (e.g. MOSAIC_GIT_IDENTITY) via $@.
+call_resolver() {
+  local login="$1" host="$2"; shift 2
+  (
+    cd "$REPO_DIR"
+    env -i HOME="$FAKE_HOME" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
+      DETECT_PLATFORM_SH="$SCRIPT_DIR/detect-platform.sh" "$@" \
+      bash -c 'source "$DETECT_PLATFORM_SH"; resolve_gitea_principal "$1" "$2"' _ "$login" "$host"
+  )
+}
+
+field() { printf '%s' "$1" | cut -f"$2"; }
+
+# ---------------------------------------------------------------------------
+# 1. Identity env + slot present -> identity mode, slot named BY PATH, and no
+#    token value ever emitted.
+# ---------------------------------------------------------------------------
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
+out=$(call_resolver "" "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentX)
+assert_eq "identity mode"            "identity" "$(field "$out" 1)"
+assert_eq "identity principal"       "agentX"   "$(field "$out" 2)"
+assert_eq "identity slot source" \
+  "identity-slot:$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentX.token" \
+  "$(field "$out" 3)"
+assert_not_contains "identity stdout leaks token" "$out" "SECRET"
+
+# ---------------------------------------------------------------------------
+# 2. Identity env + slot ABSENT -> fail loud: nonzero, empty stdout, stderr
+#    naming the identity and the expected slot path.
+# ---------------------------------------------------------------------------
+stderr_file="$WORK_DIR/stderr.tmp"
+set +e
+out=$(call_resolver "" "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentNoSlot 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]]; then
+  echo "FAIL: missing slot — expected nonzero return, got 0 (stdout='$out')" >&2
+  fail=1
+fi
+if [[ -n "$out" ]]; then
+  echo "FAIL: missing slot — expected empty stdout, got '$out'" >&2
+  fail=1
+fi
+err=$(cat "$stderr_file")
+assert_contains "missing slot names identity"  "$err" "agentNoSlot"
+assert_contains "missing slot names slot path" "$err" \
+  "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentNoSlot.token"
+assert_not_contains "missing-slot stderr leaks token" "$err" "SECRET"
+
+# ---------------------------------------------------------------------------
+# 3. Identity + --login -> --login wins. Also wins when the identity has NO
+#    slot (no identity check may veto an explicit login).
+# ---------------------------------------------------------------------------
+out=$(call_resolver "alice" "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentX)
+assert_eq "login beats identity (mode)"      "login" "$(field "$out" 1)"
+assert_eq "login beats identity (principal)" "alice" "$(field "$out" 2)"
+assert_eq "login source" "tea-login:alice" "$(field "$out" 3)"
+out=$(call_resolver "alice" "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentNoSlot)
+assert_eq "login beats slot-less identity" "login" "$(field "$out" 1)"
+
+# ---------------------------------------------------------------------------
+# 4. No identity, no --login -> default mode via the tea login list
+#    (preserved behavior).
+# ---------------------------------------------------------------------------
+out=$(call_resolver "" "git.mosaicstack.dev")
+assert_eq "default mode"          "default" "$(field "$out" 1)"
+assert_eq "default principal"     "alice"   "$(field "$out" 2)"
+assert_eq "default source"        "tea-default" "$(field "$out" 3)"
+
+# ---------------------------------------------------------------------------
+# 5. No identity, no --login, no host-matching tea login -> default with the
+#    host credential (absence is not an error on the default path).
+# ---------------------------------------------------------------------------
+out=$(call_resolver "" "git.unknown.test")
+assert_eq "no-match default mode"  "default" "$(field "$out" 1)"
+assert_eq "no-match default principal" "" "$(field "$out" 2)"
+assert_eq "no-match default source" "host-credential" "$(field "$out" 3)"
+
+# ---------------------------------------------------------------------------
+# 6. Identity on an UNRECOGNIZED host -> does not bind; default mode
+#    (containment, mirroring get_gitea_token's scope).
+# ---------------------------------------------------------------------------
+out=$(call_resolver "" "github.com" MOSAIC_GIT_IDENTITY=agentX)
+assert_eq "unrecognized host falls to default" "default" "$(field "$out" 1)"
+
+# ---------------------------------------------------------------------------
+# 7. --login with no host-bound token for that login -> fail loud, stderr
+#    naming the login and the host.
+# ---------------------------------------------------------------------------
+: > "$stderr_file"
+set +e
+out=$(call_resolver "ghost-login" "git.mosaicstack.dev" 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]]; then
+  echo "FAIL: unknown --login — expected nonzero return, got 0 (stdout='$out')" >&2
+  fail=1
+fi
+err=$(cat "$stderr_file")
+assert_contains "unknown login names login" "$err" "ghost-login"
+assert_contains "unknown login names host"  "$err" "git.mosaicstack.dev"
+# A cross-host login (exists, but for usc) must ALSO fail loud for mosaicstack.
+set +e
+out=$(call_resolver "bob-usc" "git.mosaicstack.dev" 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]]; then
+  echo "FAIL: cross-host --login — expected nonzero return, got 0" >&2
+  fail=1
+fi
+
+# ---------------------------------------------------------------------------
+# 8. git config mosaic.gitIdentity honored when env is unset.
+# ---------------------------------------------------------------------------
+git -C "$REPO_DIR" config mosaic.gitIdentity agentX
+out=$(call_resolver "" "git.mosaicstack.dev")
+assert_eq "git-config identity mode" "identity" "$(field "$out" 1)"
+assert_eq "git-config identity principal" "agentX" "$(field "$out" 2)"
+git -C "$REPO_DIR" config --unset mosaic.gitIdentity
+
+# ---------------------------------------------------------------------------
+# 9. Cross-host slot layout: the usc slot path is chosen for the usc host.
+# ---------------------------------------------------------------------------
+echo -n "SECRET-agentX-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentX.token"
+out=$(call_resolver "" "git.uscllc.com" MOSAIC_GIT_IDENTITY=agentX)
+assert_eq "usc identity mode" "identity" "$(field "$out" 1)"
+assert_eq "usc slot source" \
+  "identity-slot:$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentX.token" \
+  "$(field "$out" 3)"
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "resolve_gitea_principal identity-first resolution regression passed"
+fi
+
+exit "$fail"
@@ -77,12 +77,30 @@ exit 0
 SH
 chmod +x "$BIN_DIR/tea"

+# TRIPWIRE provider stub: this harness tests argv construction, so ANY curl
+# call is a failure of that contract (and, before this stub existed, a LIVE
+# write — the #1282–#1287 incident: the seat's real HOME leaked a global
+# mosaic.gitIdentity, flipping the wrapper into identity mode whose real
+# per-slot token created real issues on the forge). Fail loudly instead.
+cat > "$BIN_DIR/curl" <<'SH'
+#!/usr/bin/env bash
+echo "FAIL: body-safety harness reached a provider request — this test must never curl" >&2
+exit 99
+SH
+chmod +x "$BIN_DIR/curl"
+
+# Hermetic invocation: fake HOME (no credentials, no tea config, no token
+# slots) and GIT_CONFIG_GLOBAL severed — `git config --get mosaic.gitIdentity`
+# otherwise resolves the WORKSTATION's global identity (mos-dt-0 on the seat
+# that wrote this) and reroutes the wrapper into identity mode (#1280 family).
 (
    cd "$REPO_DIR"
-    PATH="$BIN_DIR:$PATH" \
-    MOSAIC_TEST_RECEIVED="$RECEIVED_FILE" \
-    "$SCRIPT_DIR/issue-create.sh" -t "Body safety test" -b "$BODY"
+    env -i HOME="$WORK_DIR/home" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_TEST_RECEIVED="$RECEIVED_FILE" \
+      "$SCRIPT_DIR/issue-create.sh" -t "Body safety test" -b "$BODY"
 ) >/dev/null
+mkdir -p "$WORK_DIR/home"

 # 1. No command substitution executed anywhere in the pipeline.
 if [[ -e "$SENTINEL" ]]; then
@@ -47,14 +47,31 @@ SH
 chmod +x "$BIN_DIR/tea" "$BIN_DIR/curl"

 run_wrapper() {
+  # Hermetic: fake HOME (fixture credentials only, no token slots, no tea
+  # config) and GIT_CONFIG_GLOBAL severed — `git config --get
+  # mosaic.gitIdentity` otherwise resolves the WORKSTATION's global identity
+  # and reroutes the wrapper into identity mode before the tea paths this
+  # harness exercises (#1280 family; see test-issue-create-body-safety.sh).
+  # An `env …` prefix (used for MOSAIC_TEA_STALE_USER) is re-wrapped, not
+  # doubled: arguments beginning with "env" are shifted past.
+  local env_pairs=()
+  if [[ "${1:-}" == "env" ]]; then
+    shift
+    while [[ "$#" -gt 0 && "$1" == *=* ]]; do
+      env_pairs+=("$1")
+      shift
+    done
+  fi
  (
    cd "$REPO_DIR"
-    PATH="$BIN_DIR:$PATH" \
-    MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
-    MOSAIC_TEST_LOG="$LOG_FILE" \
-    "$@"
+    env -i HOME="$WORK_DIR/home" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
+      MOSAIC_TEST_LOG="$LOG_FILE" "${env_pairs[@]}" \
+      "$@"
  )
 }
+mkdir -p "$WORK_DIR/home"

 : > "$LOG_FILE"
 printf 'Interactive title\nInteractive body\nlabel-a,label-b\nM1\n' | run_wrapper "$SCRIPT_DIR/issue-create.sh" -i >/dev/null
@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+# Load-bearing regression harness for pr-create.sh identity-first principal
+# resolution (mosaicstack/stack #1280).
+#
+# The failure this harness is written down to catch: `MOSAIC_GIT_IDENTITY=fargo
+# pr-create.sh …` produces a PR attributed to `mos-dt-0` (whichever account the
+# tea login list happens to hold). Before #1280 the identity-aware code existed
+# but sat on the API arm that only ran when the tea path FAILED — tea succeeded,
+# so the identity arm never executed, and every test that did not check ORDERING
+# passed. This harness checks ordering directly:
+#
+#   1. identity set + slot present -> the PR is created via the REST API with
+#      the identity's per-slot token (asserted by sentinel value AT the fake
+#      provider), and tea's `pr create` is NEVER invoked.
+#   2. identity set + slot ABSENT -> nonzero, stderr naming the identity and
+#      the expected slot path; neither tea `pr create` nor any API request
+#      fires. No silent fallback to the tea login list.
+#   3. identity set + --login -> --login wins: tea runs WITH the explicit
+#      --login, no API request.
+#   4. nothing set -> preserved behavior: tea path with the tea-list login.
+#
+# Uses a stubbed tea, a stubbed curl provider, stubbed credentials.json and
+# per-slot token under a fake HOME. NEVER reads real secrets or hits a live
+# forge — all assertions are against the stubs' logs.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-create-identity-first}"
+FAKE_HOME="$WORK_DIR/home"
+REPO_DIR="$WORK_DIR/repo"
+TOOLS_DIR="$WORK_DIR/tools"
+BIN_DIR="$WORK_DIR/bin"
+LOG_FILE="$WORK_DIR/calls.log"
+CREDENTIALS_FILE="$FAKE_HOME/.config/mosaic/credentials.json"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" "$FAKE_HOME/.config/tea" \
+  "$REPO_DIR" "$TOOLS_DIR/git" "$TOOLS_DIR/_lib" "$BIN_DIR"
+
+# Fixture: the real scripts under test, copied so sibling stubs (and the
+# ../_lib credential loader) resolve inside the fixture tree.
+cp "$SCRIPT_DIR/pr-create.sh" "$TOOLS_DIR/git/pr-create.sh"
+cp "$SCRIPT_DIR/detect-platform.sh" "$TOOLS_DIR/git/detect-platform.sh"
+cp "$SCRIPT_DIR/../_lib/credentials.sh" "$TOOLS_DIR/_lib/credentials.sh"
+chmod +x "$TOOLS_DIR/git/pr-create.sh"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
+
+cat > "$CREDENTIALS_FILE" <<'JSON'
+{
+  "gitea": {
+    "mosaicstack": {
+      "url": "https://git.mosaicstack.dev",
+      "token": "shared-mosaicstack-token"
+    }
+  }
+}
+JSON
+
+cat > "$FAKE_HOME/.config/tea/config.yml" <<'YAML'
+logins:
+- name: alice
+  url: https://git.mosaicstack.dev
+  token: SECRET-alice-tea-token
+YAML
+
+echo -n "SECRET-agentX-slot-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentX.token"
+
+: > "$LOG_FILE"
+
+# Stubbed tea: records every invocation; `login list` feeds login resolution;
+# `api --login <n> /user` feeds get_gitea_authenticated_user; `pr create` marks
+# the marker file (its presence fails the identity-mode assertions).
+cat > "$BIN_DIR/tea" <<SH
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'TEA: %s\n' "\$*" >> "$LOG_FILE"
+if [[ "\$*" == "login list --output json" ]]; then
+    cat <<'JSON'
+[
+  {"name":"alice","url":"https://git.mosaicstack.dev","default":true}
+]
+JSON
+    exit 0
+fi
+if [[ "\${1:-}" == "api" ]]; then
+    printf '%s\n' '{"login":"alice"}'
+    exit 0
+fi
+if [[ "\$*" == pr\ create* ]]; then
+    echo "TEA-PR-CREATE-INVOKED" >> "$LOG_FILE"
+    exit 0
+fi
+exit 0
+SH
+chmod +x "$BIN_DIR/tea"
+
+# Stubbed provider: records the URL and the Authorization header VALUE it
+# received, answers 201 with a created-PR object. The sentinel token values are
+# synthetic fixtures — asserting them at the provider proves WHICH slot's
+# credential carried the write.
+cat > "$BIN_DIR/curl" <<SH
+#!/usr/bin/env bash
+set -euo pipefail
+url=""
+auth=""
+while [[ \$# -gt 0 ]]; do
+    case "\$1" in
+        -H)
+            case "\$2" in
+                Authorization*) auth="\$2" ;;
+            esac
+            shift 2
+            ;;
+        *)  [[ -n "\$1" && "\$1" != -* ]] && url="\$1"
+            shift
+            ;;
+    esac
+done
+printf 'CURL-URL: %s\nCURL-AUTH: %s\n' "\$url" "\$auth" >> "$LOG_FILE"
+cat <<'JSON'
+{"number": 1299, "html_url": "https://git.mosaicstack.dev/mosaicstack/stack/pulls/1299"}
+JSON
+exit 0
+SH
+chmod +x "$BIN_DIR/curl"
+
+fail=0
+assert_contains() {
+  local desc="$1" needle="$2"
+  if ! grep -qF -- "$needle" "$LOG_FILE"; then
+    echo "FAIL: $desc — log does not contain '$needle':" >&2
+    cat "$LOG_FILE" >&2
+    fail=1
+  fi
+}
+assert_not_contains() {
+  local desc="$1" needle="$2"
+  if grep -qF -- "$needle" "$LOG_FILE"; then
+    echo "FAIL: $desc — log must not contain '$needle':" >&2
+    cat "$LOG_FILE" >&2
+    fail=1
+  fi
+}
+
+EXTRA_ARGS=""
+run_pr_create() {
+  # "$@" carries ONLY environment assignments (VAR=value); EXTRA_ARGS (if
+  # set) carries wrapper arguments, so `env` never mistakes a wrapper flag
+  # like --login for one of its own.
+  (
+    cd "$REPO_DIR"
+    # shellcheck disable=SC2086 # EXTRA_ARGS is deliberately word-split wrapper args
+    env -i HOME="$FAKE_HOME" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" "$@" \
+      bash "$TOOLS_DIR/git/pr-create.sh" -t "Test PR" -B next -H fix/test $EXTRA_ARGS
+  )
+}
+
+# ---------------------------------------------------------------------------
+# 1. HAPPY PATH (the load-bearing ordering test): identity set + slot present
+#    -> REST API with the per-slot token; tea `pr create` NEVER invoked.
+# ---------------------------------------------------------------------------
+set +e
+out=$(run_pr_create MOSAIC_GIT_IDENTITY=agentX 2>"$WORK_DIR/stderr-1.tmp")
+rc=$?
+set -e
+if [[ "$rc" -ne 0 ]]; then
+  echo "FAIL: identity happy path — expected rc=0, got $rc" >&2
+  cat "$WORK_DIR/stderr-1.tmp" >&2
+  fail=1
+fi
+assert_contains "identity happy path reaches the API" "CURL-URL: https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/pulls"
+assert_contains "identity happy path carries the slot token" "CURL-AUTH: Authorization: token SECRET-agentX-slot-token"
+assert_not_contains "identity happy path must NOT invoke tea pr create" "TEA-PR-CREATE-INVOKED"
+
+# ---------------------------------------------------------------------------
+# 2. Identity set + slot ABSENT -> fail loud BEFORE any write: nonzero, stderr
+#    naming identity + slot path, no tea pr create, no API request.
+# ---------------------------------------------------------------------------
+: > "$LOG_FILE"
+set +e
+out=$(run_pr_create MOSAIC_GIT_IDENTITY=agentNoSlot 2>"$WORK_DIR/stderr-2.tmp")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]]; then
+  echo "FAIL: missing slot — expected nonzero return, got 0 (stdout='$out')" >&2
+  fail=1
+fi
+err=$(cat "$WORK_DIR/stderr-2.tmp")
+if [[ "$err" != *"agentNoSlot"* ]]; then
+  echo "FAIL: missing slot — stderr does not name the identity:" >&2
+  echo "$err" >&2
+  fail=1
+fi
+if [[ "$err" != *"$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentNoSlot.token"* ]]; then
+  echo "FAIL: missing slot — stderr does not name the expected slot path:" >&2
+  echo "$err" >&2
+  fail=1
+fi
+assert_not_contains "missing slot must not reach tea pr create" "TEA-PR-CREATE-INVOKED"
+assert_not_contains "missing slot must not reach the API" "CURL-URL"
+
+# ---------------------------------------------------------------------------
+# 3. Identity set + --login -> --login wins: tea runs WITH the explicit login.
+# ---------------------------------------------------------------------------
+: > "$LOG_FILE"
+EXTRA_ARGS="--login alice"
+set +e
+out=$(run_pr_create MOSAIC_GIT_IDENTITY=agentX 2>"$WORK_DIR/stderr-3.tmp")
+rc=$?
+set -e
+EXTRA_ARGS=""
+if [[ "$rc" -ne 0 ]]; then
+  echo "FAIL: login override — expected rc=0, got $rc" >&2
+  cat "$WORK_DIR/stderr-3.tmp" >&2
+  fail=1
+fi
+assert_contains "login override drives tea with the explicit login" "TEA: pr create --repo mosaicstack/stack --login alice"
+assert_not_contains "login override must not hit the API" "CURL-URL"
+
+# ---------------------------------------------------------------------------
+# 4. Nothing set -> preserved behavior: tea path with the tea-list login.
+# ---------------------------------------------------------------------------
+: > "$LOG_FILE"
+set +e
+out=$(run_pr_create 2>"$WORK_DIR/stderr-4.tmp")
+rc=$?
+set -e
+if [[ "$rc" -ne 0 ]]; then
+  echo "FAIL: default path — expected rc=0, got $rc" >&2
+  cat "$WORK_DIR/stderr-4.tmp" >&2
+  fail=1
+fi
+assert_contains "default path still uses the tea-list login" "TEA: pr create --repo mosaicstack/stack --login alice"
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "pr-create identity-first happy-path regression passed"
+fi
+
+exit "$fail"
@@ -0,0 +1,247 @@
+#!/usr/bin/env bash
+# Regression harness for pr-merge.sh identity-first principal resolution
+# (mosaicstack/stack #1280).
+#
+# Covers:
+#   1. --dry-run reports the acting principal the merge WOULD use, resolved the
+#      same way the real merge resolves it: --login > MOSAIC_GIT_IDENTITY /
+#      git config mosaic.gitIdentity > shared host credential. (The pre-#1280
+#      deployed copy reported a tea login that the merge would not act as.)
+#   2. --dry-run fails closed when the requested principal has no credential:
+#      unknown --login, or an identity with no per-slot token (stderr names
+#      the login / the identity and its slot path).
+#   3. The real merge POST carries the resolved principal's credential and no
+#      other: --login merges with that login's tea-config token; an identity
+#      merges with the per-slot token; an unresolvable --login never reaches
+#      the provider.
+#
+# Fixture pattern from test-pr-merge-head-pin.sh: the scripts under test are
+# copied into a fixture tree with stubbed pr-metadata.sh / ci-queue-wait.sh
+# siblings; the provider is a stubbed curl that records the credential it
+# received. NEVER reads real secrets or hits a live forge.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-principal-resolution}"
+FAKE_HOME="$WORK_DIR/home"
+REPO_DIR="$WORK_DIR/repo"
+TOOLS_DIR="$WORK_DIR/tools"
+BIN_DIR="$WORK_DIR/bin"
+LOG_FILE="$WORK_DIR/calls.log"
+CREDENTIALS_FILE="$FAKE_HOME/.config/mosaic/credentials.json"
+SHA=0123456789abcdef0123456789abcdef01234567
+
+rm -rf "$WORK_DIR"
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" "$FAKE_HOME/.config/tea" \
+  "$REPO_DIR" "$TOOLS_DIR/git" "$TOOLS_DIR/_lib" "$BIN_DIR"
+
+cp "$SCRIPT_DIR/pr-merge.sh" "$TOOLS_DIR/git/pr-merge.sh"
+cp "$SCRIPT_DIR/detect-platform.sh" "$TOOLS_DIR/git/detect-platform.sh"
+cp "$SCRIPT_DIR/../_lib/credentials.sh" "$TOOLS_DIR/_lib/credentials.sh"
+chmod +x "$TOOLS_DIR/git/pr-merge.sh"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
+
+# Stubbed siblings pr-merge.sh resolves relative to its own SCRIPT_DIR.
+cat > "$TOOLS_DIR/git/pr-metadata.sh" <<SH
+#!/usr/bin/env bash
+printf '%s\n' '{"baseRefName":"next","headRefName":"fix/pinned","headRefOid":"$SHA","headRepository":"mosaicstack/stack","title":"Test PR","author":{"login":"contributor"}}'
+SH
+cat > "$TOOLS_DIR/git/ci-queue-wait.sh" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+chmod +x "$TOOLS_DIR/git/pr-metadata.sh" "$TOOLS_DIR/git/ci-queue-wait.sh"
+
+cat > "$CREDENTIALS_FILE" <<'JSON'
+{
+  "gitea": {
+    "mosaicstack": {
+      "url": "https://git.mosaicstack.dev",
+      "token": "shared-mosaicstack-token"
+    }
+  }
+}
+JSON
+
+cat > "$FAKE_HOME/.config/tea/config.yml" <<'YAML'
+logins:
+- name: fred-ms
+  url: https://git.mosaicstack.dev
+  token: SECRET-fred-ms-tea-token
+YAML
+
+echo -n "SECRET-agentX-slot-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentX.token"
+
+: > "$LOG_FILE"
+
+# Stubbed tea for login-list resolution only.
+cat > "$BIN_DIR/tea" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$*" == "login list --output json" ]]; then
+    cat <<'JSON'
+[
+  {"name":"fred-ms","url":"https://git.mosaicstack.dev","default":true}
+]
+JSON
+    exit 0
+fi
+exit 0
+SH
+chmod +x "$BIN_DIR/tea"
+
+# Stubbed provider. pr-merge passes curl config on STDIN with -K -; the stub
+# reads stdin, records the Authorization header it received, answers 200.
+cat > "$BIN_DIR/curl" <<SH
+#!/usr/bin/env bash
+set -euo pipefail
+url=""
+out_file=""
+stdin_config=""
+if [[ ! -t 0 ]]; then
+    stdin_config="\$(cat || true)"
+fi
+while [[ \$# -gt 0 ]]; do
+    case "\$1" in
+        -o) out_file="\$2"; shift 2 ;;
+        -K|-w|--max-filesize|--max-time|--connect-timeout|-sS) shift 2 ;;
+        *)  [[ -n "\$1" && "\$1" != -* && -z "\$url" ]] && url="\$1"
+            shift
+            ;;
+    esac
+done
+auth="\$(printf '%s' "\$stdin_config" | grep -o 'Authorization: token [^"]*' || true)"
+printf 'CURL-URL: %s\nCURL-AUTH: %s\n' "\$url" "\$auth" >> "$LOG_FILE"
+[[ -n "\$out_file" ]] && printf '{}' > "\$out_file"
+printf '200\n'
+exit 0
+SH
+chmod +x "$BIN_DIR/curl"
+
+fail=0
+assert_contains_log() {
+  local desc="$1" needle="$2"
+  if ! grep -qF -- "$needle" "$LOG_FILE"; then
+    echo "FAIL: $desc — log does not contain '$needle':" >&2
+    cat "$LOG_FILE" >&2
+    fail=1
+  fi
+}
+assert_not_contains_log() {
+  local desc="$1" needle="$2"
+  if grep -qF -- "$needle" "$LOG_FILE"; then
+    echo "FAIL: $desc — log must not contain '$needle':" >&2
+    cat "$LOG_FILE" >&2
+    fail=1
+  fi
+}
+
+run_pr_merge() {
+  local extra_args="$1"; shift
+  (
+    cd "$REPO_DIR"
+    # shellcheck disable=SC2086 # extra_args is deliberately word-split wrapper args
+    env -i HOME="$FAKE_HOME" PATH="$BIN_DIR:$PATH" \
+      GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null \
+      MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" "$@" \
+      bash "$TOOLS_DIR/git/pr-merge.sh" -n 42 $extra_args
+  )
+}
+
+# ---------------------------------------------------------------------------
+# 1. --dry-run reports the resolved acting principal truthfully.
+# ---------------------------------------------------------------------------
+out=$(run_pr_merge "--dry-run" MOSAIC_GIT_IDENTITY=agentX)
+if [[ "$out" != *"as git identity 'agentX' (per-slot credential)"* ]]; then
+  echo "FAIL: dry-run identity — principal not reported: $out" >&2
+  fail=1
+fi
+
+out=$(run_pr_merge "--dry-run --login fred-ms" MOSAIC_GIT_IDENTITY=agentX)
+if [[ "$out" != *"as tea login 'fred-ms'"* ]]; then
+  echo "FAIL: dry-run login override — login not reported (must beat env identity): $out" >&2
+  fail=1
+fi
+
+out=$(run_pr_merge "--dry-run")
+if [[ "$out" != *"as default host credential"* ]]; then
+  echo "FAIL: dry-run default — not reported: $out" >&2
+  fail=1
+fi
+
+# ---------------------------------------------------------------------------
+# 2. --dry-run fails closed when the requested principal has no credential.
+# ---------------------------------------------------------------------------
+stderr_file="$WORK_DIR/stderr.tmp"
+set +e
+out=$(run_pr_merge "--dry-run --login ghost" 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]] || [[ "$(cat "$stderr_file")" != *"ghost"* ]]; then
+  echo "FAIL: dry-run unknown --login — expected fail-loud naming 'ghost', rc=$rc" >&2
+  cat "$stderr_file" >&2
+  fail=1
+fi
+
+: > "$stderr_file"
+set +e
+out=$(run_pr_merge "--dry-run" MOSAIC_GIT_IDENTITY=agentNoSlot 2>"$stderr_file")
+rc=$?
+set -e
+err=$(cat "$stderr_file")
+if [[ "$rc" -eq 0 ]] || [[ "$err" != *"agentNoSlot"* ]] \
+  || [[ "$err" != *"$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentNoSlot.token"* ]]; then
+  echo "FAIL: dry-run identity without slot — expected fail-loud naming identity + slot path, rc=$rc" >&2
+  echo "$err" >&2
+  fail=1
+fi
+
+# ---------------------------------------------------------------------------
+# 3. The real merge POST carries the resolved principal's credential ONLY.
+# ---------------------------------------------------------------------------
+: > "$LOG_FILE"
+set +e
+out=$(run_pr_merge "--login fred-ms" MOSAIC_GIT_IDENTITY=agentX 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -ne 0 ]]; then
+  echo "FAIL: merge with --login — expected rc=0, got $rc" >&2
+  cat "$stderr_file" >&2
+  fail=1
+fi
+assert_contains_log "merge --login uses the login token" "CURL-AUTH: Authorization: token SECRET-fred-ms-tea-token"
+assert_not_contains_log "merge --login must not use the identity slot token" "SECRET-agentX-slot-token"
+assert_not_contains_log "merge --login must not use the shared token" "shared-mosaicstack-token"
+
+: > "$LOG_FILE"
+set +e
+out=$(run_pr_merge "" MOSAIC_GIT_IDENTITY=agentX 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -ne 0 ]]; then
+  echo "FAIL: merge with identity — expected rc=0, got $rc" >&2
+  cat "$stderr_file" >&2
+  fail=1
+fi
+assert_contains_log "merge identity uses the per-slot token" "CURL-AUTH: Authorization: token SECRET-agentX-slot-token"
+assert_not_contains_log "merge identity must not use the shared token" "shared-mosaicstack-token"
+
+: > "$LOG_FILE"
+set +e
+out=$(run_pr_merge "--login ghost" 2>"$stderr_file")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 ]]; then
+  echo "FAIL: merge with unknown --login — expected nonzero, got 0" >&2
+  fail=1
+fi
+assert_not_contains_log "merge with unknown --login must not reach the provider" "CURL-URL"
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "pr-merge identity-first principal resolution regression passed"
+fi
+
+exit "$fail"
@@ -39,3 +39,20 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
+
+# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
+# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
+# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
+# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
+# real system path, so on a host that installs those binaries the missing-binary
+# cases cannot be measured at all. The suite's own guard (line 103) says so and
+# fails rather than reporting a pass it cannot back. That guard is correct.
+# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
+# dropped this exclusion, and the CI image provides `pi` in the system path, so
+# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
+# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
+# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
+# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
+# Because test:framework-shell is one && chain and this sat at position 44 of 48,
+# the four suites after it had not run at all since the merge.
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-gitea-principal-resolution.sh && bash framework/tools/git/test-pr-create-identity-first.sh && bash framework/tools/git/test-pr-merge-principal-resolution.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
Author	SHA1	Message	Date
fargo	8eb8e7cfce	Merge remote-tracking branch 'origin/next' into fix/1280-identity-first-resolution ci/woodpecker/pr/ci Pipeline was successful Details # Conflicts: # packages/mosaic/package.json	2026-08-17 16:24:43 -05:00
jason.woltje	8199261caa	Merge pull request 'fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion — unblocks every PR on next' (#1270 ) from fix/1269-ci-chain-unblock into next ci/woodpecker/push/publish Pipeline failed Details Reviewed-on: #1270	2026-08-17 20:44:59 +00:00
fargo	d789a43cae	test(git): hermetic fixtures for issue-create harnesses (#1282-#1287) ci/woodpecker/pr/ci Pipeline was canceled Details test-issue-create-body-safety.sh and test-issue-create-interactive-auth.sh inherited the seat's real HOME and global git config. With the #1280 fix activating identity mode BEFORE the tea path, a workstation-global mosaic.gitIdentity resolved inside the fixture repo, and the wrapper's API fallback posted to the LIVE forge with a real per-slot token — six real issues (#1282-#1287, authored mos-dt-0, closed with provenance by fred within the hour). Neutralize the source the resolver actually reads, and prove it by making the resolution fail. A control that does not make the thing fail has not been shown to control it. The earlier attempted neutralization pinned MOSAIC_CREDENTIALS_FILE to a fake — a real guard aimed at an adjacent input: the identity arm reads the per-slot token file directly and never consults credentials.json. Hence env -i with a fake HOME and GIT_CONFIG_GLOBAL=/dev/null (severing the global identity) rather than one more targeted variable, plus a curl tripwire stub in the body-safety harness so ANY provider request is a loud test failure instead of a live write.	2026-08-17 15:19:04 -05:00
fargo	19ad93999f	fix(git): identity-first principal resolution across write wrappers (#1280 ) MOSAIC_GIT_IDENTITY=fargo produced objects attributed to mos-dt-0: every write wrapper resolved its acting principal from tea's login list, which enumerates whatever logins the host happens to hold and knows nothing about which seat is calling. The identity-aware code was present and correct but unreachable on the happy path — it sat on arms that only ran when tea failed. One shared resolver, not twenty patches: resolve_gitea_principal() in detect-platform.sh implements the precedence (explicit --login beats MOSAIC_GIT_IDENTITY / worktree git config mosaic.gitIdentity; the tea login list is the LAST resort), fails loud (nonzero, naming the identity or login and the expected slot path) when the requested principal has no credential, and never prints a token value. gitea_identity_token_slot() is the single source of truth for the slot layout, shared with get_gitea_token, so resolver and token resolution cannot disagree. Call-site conversions (the proving five): pr-review.sh (principal resolved once for every action; the comment action now honors --login), issue-comment.sh, pr-create.sh (identity mode reaches the REST API on the HAPPY path — tea is never consulted, so the login list cannot shadow the identity; --login wins even on the tea-failure fallback arm), issue-create.sh (same), pr-merge.sh (gains --login; --dry-run reports the principal the merge WOULD act as, resolved exactly as the merge resolves it; no cross-principal fallback — an identity-bound 401 is a hard stop). Remaining wrappers are call-site conversions onto the same resolver, measured: write-path issue-assign, issue-close, issue-edit, issue-reopen, milestone-close, milestone-create, pr-close; read-path issue-list, milestone-list, pr-list, pr-view (issue-view mixed). pr-diff, pr-metadata, pr-ci-wait and ci-queue-wait already inherit identity-first resolution via get_gitea_token. Known interaction: on a host with a workstation-GLOBAL mosaic.gitIdentity, this fix activates identity mode for every seat that has not set a local one — correct behavior driven by a wrong configuration (measured: #1282-#1287, six accidental live issues, closed with provenance by fred). Set mosaic.gitIdentity per-worktree, never --global. Tests: test-gitea-principal-resolution.sh (resolver matrix — identity present/absent, --login precedence, env vs git-config, unrecognized-host containment, slot-path-by-path-never-by-value); test-pr-create-identity- first.sh (the load-bearing ordering test: identity arm REACHED on the happy path with tea never invoked, fail-loud BEFORE any write on a missing slot, --login wins, default preserved); test-pr-merge-principal- resolution.sh (dry-run truthfulness, merge credential binding, unknown --login never reaches the provider). All wired into test:framework-shell. Sabotage control: precedence inverted to tea-list-first inside the resolver -> exactly the three new suites redden with the #1280 signatures (identity resolves to the tea-list account; missing slot returns rc=0 with silent fallthrough) while all 11 pre-existing git suites stay green; restored byte-identical (sha256 verified); all 14 green again.	2026-08-17 15:18:54 -05:00
fred	57a2f2b40e	docs(ci): point the exclusion at tracking issue #1271 , not the closed first filing ci/woodpecker/pr/ci Pipeline was successful Details The first PR for this change was filed under the retired mos-dt-0 principal (pr-create.sh has no --login flag and find_tea_login_for_host returns the first host match) and was closed and refiled as #1270. That left in-tree references pointing at a closed duplicate PR rather than at the burn-down issue, which is the wrong target for them anyway: the open design question belongs on #1271.	2026-08-16 18:03:02 -05:00
fred	93c1de51e1	fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion (#1269 ) ci/woodpecker/pr/ci Pipeline was canceled Details The `test` step has failed on every `next` pipeline since #1017 on exactly one assertion, and it is the same one on unrelated PRs: FAIL: host provides 'pi' in the system path; missing-binary cases are not measurable here (framework/tools/fleet/test-start-agent-session.sh:103) Measured 2026-08-16 across pipelines 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in each full log, identical, this line. Control `zzz-not-present-zzz` -> 0 on all three. Cause. #1241 (`5c35a250`) added the guard: the suite shims fake mosaic/pi/npm into $FAKE_BIN, but the constructed PANE_PATH always ends in the real system path, so on a host that installs those binaries the missing-binary cases cannot be measured and a green run would mean nothing. The guard says so instead of passing. Its own pipeline 2430 was green only because the suite was CI-excluded at the time, so the guard had never run in CI. #1017 (`c56483eb`) then enumerated it and dropped the exclusion. The CI image installs @earendil-works/[email protected].1 on purpose, so the precondition is unsatisfiable there. Both commits are mine. The guard is correct and is not being softened. A check that cannot measure its property and reports success is the failure mode this repo has been cataloguing all week; the error was wiring the suite into an image that violates its precondition, so the wiring is what gets reverted. Second effect, which is the reason this cost a day rather than an hour: test:framework-shell is one && chain and this sat at position 44 of 48, so glpi/test-list-http-status.sh, orchestrator/test-board-roll.sh, woodpecker/test-ci-wait-exit-matrix.sh and _scripts/test-fleet-transport-check.sh have not run at all since the merge. The pipeline reported one failure, never "one failure plus four unrun". All four are green when run directly on sb-it-1-dt, so the mask hid nothing broken -- but that is a local result on one host, not a CI-image result. Verification, with controls: - enumeration guard OK (population 52, enumerated 36, signed-excluded 16). - control A, exclusion line removed while unwired -> FAIL UNENUMERATED. - control B, exclusion line kept while rewired -> FAIL CONTRADICTORY EXCLUSION. The gate discriminates in both directions, so its OK is load-bearing. - the four formerly-masked suites: rc=0 each, run directly. - the full chain cannot be run to completion on sb-it-1-dt: it stops earlier, at the lease-broker Invariant R test, because this host carries the quarantined operator-global pi 0.84.2 against a measured 0.84.1. That is host-specific and out of scope here -- CI pins 0.84.1, and the single FAIL line in those three pipelines proves positions 1-43 passed there. Burn-down is to control the tail of PANE_PATH inside the test, not to remove pi from the image. Recorded in the exclusion reason and in #1269.	2026-08-16 17:58:49 -05:00