Merge M7: operator ergonomics + release 0.0.6

Closes #24

BUILD-LOG.md

@@ -221,4 +221,58 @@ Release model and safe updates verified by drills. `main` merged with M3 and tag
 
 Adapter seam verified; harness boundary is now additive by construction. `main` merged with M4 and tagged `adapter-seam-v1`.
 
+---
+
+## Phase 9: Workspaces + capability envelope (M5)
+
+### Entry 9.1 — before
+
+- Timestamp: 2026-09-03
+- Intended action: Optional task workspace (absent / ":run" ephemeral / named persistent) and capabilities.tools allowlist (pi built-ins); runner plumbing via MOSAIC_WORKSPACE/MOSAIC_TOOLS; pi adapter maps to cwd + --tools; mock adapter logs delivered MOSAIC_* vars for deterministic assertions (Gitea #20, #21).
+- Reason: Agents that only answer text cannot do work; the workspace+tools pair is the smallest real capability step, bounded by the container.
+- Expected result: plumbing asserted via run-record stderr; live pi writes a host-visible file.
+
+### Entry 9.2 — after
+
+- Timestamp: 2026-09-03
+- Commands run: build; mock plumbing run; validate negatives; full task suite; live workspace demo.
+- Observed result: task suite 32/32; MOSAIC_WORKSPACE/MOSAIC_TOOLS asserted in run record; dataRoot/workspaces/<name> created host-side; live pi used bash to write proof.txt into the demo workspace (host-visible).
+- Failure or correction: (1) batch edit dropped SUPPORTED_TOOLS const (runtime ReferenceError, exit 1 instead of 2) — restored; (2) mock env dump used `export` which this dash prints as `export K='v'` — switched to `env`; (3) selftest fed a mismatching mock response to the plain-task case — test bug, fixed.
+
+## Phase 10: Named sessions (M6)
+
+### Entry 10.1 — before
+
+- Timestamp: 2026-09-03
+- Intended action: Optional task.session name -> persistent session dir dataRoot/sessions/<name> via pi --session-dir; resume most recent with -c when present; isolation per name; teach/recall demo fixtures (Gitea #22, #23).
+- Reason: L1 persistence is the prerequisite for any multi-step agent work.
+- Expected result: session dir populated after first run; second run recalls taught context.
+
+### Entry 10.2 — after
+
+- Timestamp: 2026-09-03
+- Commands run: build; mock plumbing run; live teach/recall E2E; task suite.
+- Observed result: task suite 32/32; teach run replied REMEMBERED and session JSONL persisted host-side; recall run resumed (-c) and answered exactly 'mosaico'; single continued session file (no duplicate sessions).
+- Failure or correction: none. Design note: ephemeral (--no-session) remains the default when no session is declared.
+
+## Phase 11: Operator ergonomics (M7)
+
+### Entry 11.1 — before
+
+- Timestamp: 2026-09-03
+- Intended action: mosaic-task.mjs show <runId> (full record + snapshots + artifacts, traversal-safe), list with workspace/session columns, RELEASE -> 0.0.6, package + health-gated activate, docs (Gitea #24).
+- Reason: Run records are only as valuable as they are inspectable; release activation closes the loop on container-content changes.
+- Expected result: show works for real/missing/traversal ids; suites green; 0.0.6 active.
+
+### Entry 11.2 — after
+
+- Timestamp: 2026-09-03
+- Commands run: build; show on real/missing/traversal ids; full sweep; release package + activate.
+- Observed result: config 24/24, task 32/32, release 14/14, verify PASS; 0.0.6 packaged and activated via exact-marker health gate.
+- Failure or correction: showRun initially rejected valid run ids (lowercase-only regex vs uppercase timestamp) and crashed on missing ids (uncaught readdir) — both fixed and covered.
+
+## Autonomous run result
+
+M5 tagged `workspace-capabilities-v1`, M6 tagged `sessions-v1`, M7 tagged `operator-ergonomics-v1`; release 0.0.6 active. Tracker: docs/plans/2026-09-03_autonomous-run.md.
+
 

README.md

@@ -119,6 +119,31 @@ adapters/<name>/adapter.sh   env in: MOSAIC_SYSTEM_PROMPT_FILE, MOSAIC_REQUEST,
 
 See `adapters/README.md` for the full contract.
 
+## Workspaces, capabilities, sessions (M5/M6)
+
+Optional task fields extend what an agent can do — all defaulting to the previous behavior:
+
+```json
+{
+  "workspace": "demo",                          // ":run" ephemeral, or persistent dataRoot/workspaces/<name>
+  "capabilities": { "tools": ["bash", "read"] }, // pi tool allowlist; absent = no tools
+  "session": "demo"                             // persistent session at dataRoot/sessions/<name>
+}
+```
+
+- The adapter runs inside the workspace; files it writes are host-visible (`dataRoot/workspaces/<name>`).
+- Sessions persist via pi's documented `--session-dir`; a follow-up run in the same session resumes the conversation (`-c`) and can recall prior context. Distinct names never share state. Ephemeral (`--no-session`) remains the default when no session is declared.
+- Selection authority: config for adapter/provider/model; the task file for workspace/capabilities/session.
+
+Inspect anything:
+
+```bash
+node scripts/mosaic-task.mjs list                # runs with task/workspace/session columns
+node scripts/mosaic-task.mjs show <runId>        # full record + snapshots + artifacts
+```
+
+Demo fixtures: `tasks/workspace-demo.json`, `tasks/session-demo-1.json` + `tasks/session-demo-2.json`.
+
 See `docs/plans/2026-09-02_atomic-mosaic-foundation.md` for the full plan.
 
 Inside the container:

RELEASE

@@ -1 +1 @@
-0.0.5
+0.0.6

adapters/mock/adapter.sh

@@ -10,4 +10,7 @@ set -eu
 [ -r "$MOSAIC_SYSTEM_PROMPT_FILE" ] || { echo "mock adapter: system prompt not readable: $MOSAIC_SYSTEM_PROMPT_FILE" >&2; exit 2; }
 
 echo "mock adapter: responding verbatim from MOSAIC_MOCK_RESPONSE" >&2
+# Deterministic plumbing evidence: which MOSAIC_* variables did the
+# orchestrator actually deliver? (Auth secrets are not MOSAIC_-prefixed.)
+(env | grep '^MOSAIC_' | sort) >&2 2>/dev/null || true
 printf '%s\n' "${MOSAIC_MOCK_RESPONSE:-}"

adapters/pi/adapter.sh

@@ -12,21 +12,43 @@ set -eu
 : "${PI_PROVIDER:?pi adapter: PI_PROVIDER is required}"
 : "${PI_MODEL:?pi adapter: PI_MODEL is required}"
 
+# Workspace (M5): run inside the provided workspace when present.
+if [ -n "${MOSAIC_WORKSPACE:-}" ]; then
+    mkdir -p "$MOSAIC_WORKSPACE"
+    cd "$MOSAIC_WORKSPACE"
+fi
+
+# Session (M6): persistent named session directory; resume the most recent
+# session in that directory when one exists (pi documented flags).
+# Default remains ephemeral (--no-session) when no session is declared.
+SESSION_FLAGS="--no-session"
+if [ -n "${MOSAIC_SESSION_DIR:-}" ]; then
+    mkdir -p "$MOSAIC_SESSION_DIR"
+    SESSION_FLAGS="--session-dir $MOSAIC_SESSION_DIR"
+    if [ -n "$(ls -A "$MOSAIC_SESSION_DIR" 2>/dev/null)" ]; then
+        SESSION_FLAGS="$SESSION_FLAGS -c"
+    fi
+fi
+
+# Capabilities (M5): explicit allowlist or no tools.
+TOOLS_FLAG="--no-tools"
+[ -n "${MOSAIC_TOOLS:-}" ] && TOOLS_FLAG="--tools $MOSAIC_TOOLS"
+
 # All flags documented in the pi package README (CLI Reference):
 #   -p/--print     noninteractive: print the response and exit
 #   --system-prompt  replace the default prompt with the generated one
 #   --no-*         no ambient context/skills/extensions/templates/themes
-#   --no-session   ephemeral; --no-tools  this runtime needs no tools
+#   --no-session   ephemeral; TOOLS_FLAG per capabilities
 #   --offline      no startup network operations (update checks/telemetry)
 exec pi \
     --offline \
-    --no-session \
     --no-extensions \
     --no-skills \
     --no-prompt-templates \
     --no-themes \
     --no-context-files \
-    --no-tools \
+    $TOOLS_FLAG \
+    $SESSION_FLAGS \
     --provider "$PI_PROVIDER" \
     --model "$PI_MODEL" \
     --system-prompt "$(cat "$MOSAIC_SYSTEM_PROMPT_FILE")" \

compose.yaml

@@ -15,6 +15,11 @@ services:
       # Mission directives injection point (set by the task runner when the
       # task references a mission; container path of the run snapshot)
       MOSAIC_MISSION_FILE: ${MOSAIC_MISSION_FILE:-}
+      # Workspace + capabilities (set by the task runner; M5)
+      MOSAIC_WORKSPACE: ${MOSAIC_WORKSPACE:-}
+      MOSAIC_TOOLS: ${MOSAIC_TOOLS:-}
+      # Persistent named session dir (set by the task runner; M6)
+      MOSAIC_SESSION_DIR: ${MOSAIC_SESSION_DIR:-}
       # mock adapter only: verbatim response for deterministic seam tests
       MOSAIC_MOCK_RESPONSE: ${MOSAIC_MOCK_RESPONSE:-}
       # Documented container auth alternative: provider API key via

docs/plans/2026-09-03_autonomous-run.md

@@ -0,0 +1,81 @@
+# Autonomous Work Run — 2026-09-03
+
+**Status:** COMPLETED (single-session batch; see Results at bottom)
+**Constraint:** The assistant cannot run unattended. This was one long interactive session, not 12 wall-clock hours. Everything below was completed, committed, and pushed during that session.
+
+## Objective
+
+Advance the Mosaic Stack rebuild several verified layers in one batch, focused on Pi, ending in a state the owner can test and review alone: green suites, activated release, recorded drills, and this document as the single entry point.
+
+## Scope decided for this run
+
+| Milestone | Theme | Status |
+|---|---|---|
+| M5 | Task workspaces + capability envelope (tools allowlist) | DONE |
+| M6 | Named sessions — persistence and resume (L1) | DONE |
+| M7 | Operator ergonomics: run inspection commands | DONE |
+| — | Releases 0.0.5+0.0.6 packaged; 0.0.6 health-gated activated | DONE |
+
+Explicitly deferred (do not mistake for forgotten):
+- Claude/Codex/OpenCode adapters (owner: focus on Pi for now)
+- Network policy engine (container boundary is the current control)
+- Fine-grained read restrictions (excluded by the original brief)
+- Config/state migrations (no schema breaks so far; keep it that way)
+
+## Design decisions taken during this run
+
+1. **Workspace** (`task.workspace`, optional):
+   - absent → tool-free text-only run (previous behavior, unchanged)
+   - `":run"` → ephemeral per-run workspace at `<dataRoot>/runs/<runId>/workspace`
+   - named (validated id) → persistent shared workspace at `<dataRoot>/workspaces/<name>`
+   - Container path passed via `MOSAIC_WORKSPACE` env; adapter cds into it. No new mounts (dataRoot is already mounted).
+2. **Capabilities** (`task.capabilities.tools`, optional): allowlist from pi's documented tool set (`read write edit bash grep find ls`). Absent → `--no-tools` (previous behavior). Passed via `MOSAIC_TOOLS` env; pi adapter maps to `--tools`.
+3. **Adapter diagnostics for deterministic testing**: the mock adapter writes all received `MOSAIC_*` variables (never secrets — auth is not MOSAIC_-prefixed) to stderr, which lands in the run record. This lets selftests assert orchestrator→adapter plumbing without parsing model output.
+4. **Sessions** (`task.session`, optional named): persisted under `<dataRoot>/sessions/<name>/` via pi's documented `--session-dir`; resume semantics: continue most recent session in that directory when one exists (`-c`).
+5. **Selection authority unchanged**: config file for adapter/provider/model; task file for workspace/capabilities/session; env vars are internal plumbing only.
+6. **configVersion stays 1**; all new task fields are optional. Old tasks/configs remain valid.
+
+## Test plan (what "done" means per milestone)
+
+- M5: mock-adapter cases asserting workspace path and tools arrive via run-record stderr; live pi case writing/reading a file in a persistent workspace; validation negatives (bad tool name, bad workspace name)
+- M6: session directory deterministically populated after first run; second run resumes (continuation asserted by session dir state and, in live E2E, by model recall); sandbox isolation between two named sessions
+- M7: `show <runId>` prints a complete run record; `list` gains workspace/session columns
+- Final: full sweep (config/task/release), verify, package + activate 0.0.6, config checksum unchanged
+
+## Review checklist for the owner
+
+1. `cat docs/plans/2026-09-03_autonomous-run.md` (this file)
+2. `scripts/release.sh status` → 0.0.6 active
+3. `scripts/test-config.sh && scripts/test-task.sh && scripts/test-release.sh && scripts/verify.sh`
+4. Try a workspace task:
+   ```bash
+   scripts/run-task.sh run tasks/workspace-demo.json
+   ls ~/.mosaic-dev/workspaces/demo/
+   ```
+5. Try the session demo:
+   ```bash
+   scripts/run-task.sh run tasks/session-demo-1.json   # teaches a word
+   scripts/run-task.sh run tasks/session-demo-2.json   # recalls it
+   ```
+6. Inspect any run: `node scripts/mosaic-task.mjs show <runId>`
+7. Gitea: milestones M5/M6/M7 closed; issues referenced by merge commits
+
+## Results
+
+- M5 merged on `main` (merge commit `ddb1554`), tagged `workspace-capabilities-v1`
+- M6 merged on `main` (merge commit `4e2a413`), tagged `sessions-v1`
+- M7 merged on `main`, tagged `operator-ergonomics-v1`
+- Release 0.0.6 packaged, health-gated activated, full sweep green
+- Suites at end of run: config 24/24, task 32/32, release 14/14, verify PASS
+- Build log: Phases 9 (M5), 10 (M6), 11 (M7) appended with corrections
+- Corrections encountered: dropped constant from a failed atomic edit batch (SUPPORTED_TOOLS); dash `export` output format vs `env`; three selftest authoring defects; showRun id-regex case sensitivity + missing-run crash. All fixed and covered by tests.
+- Commits pushed incrementally; nothing left uncommitted
+- Live proof: workspace file host-visible; session teach/recall ('mosaico') verified
+
+## Next steps after this run (not started)
+
+1. Owner review + hands-on testing of workspaces, capabilities, sessions
+2. Decision: capability defaults per mission (mission-level policy) — natural M8
+3. Second real adapter remains available whenever wanted
+4. Consider run-record pruning/retention policy once run volume grows
+5. Consider a `mosaic-task.mjs retry <runId>` convenience for failed runs

scripts/mosaic-task.mjs

@@ -38,6 +38,7 @@ const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)),
 const RUNS_DIRNAME = "runs";
 const ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 const DEFAULT_TIMEOUT_SECONDS = 120;
+const SUPPORTED_TOOLS = ["read", "write", "edit", "bash", "grep", "find", "ls"]; // pi documented built-ins
 
 function fail(exitCode, message) {
   process.stderr.write(`mosaic-task: ${message}\n`);
@@ -105,7 +106,7 @@ function validateMission(document, file) {
 
 function validateTask(document, file) {
   if (!isPlainObject(document)) fail(2, "task must be a JSON object");
-  rejectUnknownKeys(document, ["taskVersion", "id", "prompt", "mission", "expectExact", "timeoutSeconds"], "task");
+  rejectUnknownKeys(document, ["taskVersion", "id", "prompt", "mission", "expectExact", "timeoutSeconds", "workspace", "capabilities", "session"], "task");
   if (document.taskVersion !== 1) {
     fail(2, `unsupported taskVersion: ${JSON.stringify(document.taskVersion)} (supported: 1)`);
   }
@@ -144,6 +145,50 @@ function validateTask(document, file) {
     timeoutSeconds = document.timeoutSeconds;
   }
 
+  // Workspace (M5): absent = none; ":run" = ephemeral per-run; otherwise a
+  // persistent named workspace under <dataRoot>/workspaces/<name>.
+  let workspace = null;
+  if (document.workspace !== undefined && document.workspace !== null) {
+    if (typeof document.workspace !== "string" || document.workspace.length === 0) {
+      fail(2, 'task "workspace" must be a non-empty string when present');
+    }
+    if (document.workspace !== ":run") {
+      validateId(document.workspace, "task workspace");
+    }
+    workspace = document.workspace;
+  }
+
+  // Session (M6): optional named persistent session under
+  // <dataRoot>/sessions/<name>. Distinct names never share state.
+  let session = null;
+  if (document.session !== undefined && document.session !== null) {
+    if (typeof document.session !== "string" || document.session.length === 0) {
+      fail(2, 'task "session" must be a non-empty string when present');
+    }
+    validateId(document.session, "task session");
+    session = document.session;
+  }
+
+  // Capabilities (M5): optional tools allowlist mapped by adapters to their
+  // native permission flags. Absent = no tools.
+  let tools = null;
+  if (document.capabilities !== undefined && document.capabilities !== null) {
+    if (!isPlainObject(document.capabilities)) fail(2, '"capabilities" must be a JSON object');
+    rejectUnknownKeys(document.capabilities, ["tools"], '"capabilities"');
+    if (!Array.isArray(document.capabilities.tools) || document.capabilities.tools.length === 0) {
+      fail(2, '"capabilities.tools" must be a non-empty array of tool names');
+    }
+    const seen = new Set();
+    for (const tool of document.capabilities.tools) {
+      if (!SUPPORTED_TOOLS.includes(tool)) {
+        fail(2, `unsupported tool: ${JSON.stringify(tool)} (supported: ${SUPPORTED_TOOLS.join(", ")})`);
+      }
+      if (seen.has(tool)) fail(2, `duplicate tool in capabilities.tools: ${tool}`);
+      seen.add(tool);
+    }
+    tools = [...seen];
+  }
+
   return {
     taskVersion: document.taskVersion,
     id: document.id,
@@ -153,6 +198,9 @@ function validateTask(document, file) {
     missionSnapshot,
     expectExact,
     timeoutSeconds,
+    workspace,
+    tools,
+    session,
   };
 }
 
@@ -223,6 +271,24 @@ function runTask(taskFile) {
     spawnEnv.MOSAIC_MISSION_FILE = `/var/lib/mosaic/${relative.split(path.sep).join("/")}/mission.json`;
   }
 
+  // Workspace (M5): create host-side, pass the CONTAINER path.
+  let workspaceContainerPath = null;
+  if (task.workspace === ":run") {
+    fs.mkdirSync(path.join(runDir, "workspace"), { recursive: true });
+    workspaceContainerPath = `/var/lib/mosaic/runs/${runId}/workspace`;
+  } else if (task.workspace) {
+    fs.mkdirSync(path.join(resolved.dataRoot, "workspaces", task.workspace), { recursive: true });
+    workspaceContainerPath = `/var/lib/mosaic/workspaces/${task.workspace}`;
+  }
+  if (workspaceContainerPath) spawnEnv.MOSAIC_WORKSPACE = workspaceContainerPath;
+  spawnEnv.MOSAIC_TOOLS = task.tools ? task.tools.join(",") : "";
+
+  // Session (M6): persistent named session dir, passed as container path.
+  if (task.session) {
+    fs.mkdirSync(path.join(resolved.dataRoot, "sessions", task.session), { recursive: true });
+    spawnEnv.MOSAIC_SESSION_DIR = `/var/lib/mosaic/sessions/${task.session}`;
+  }
+
   const proc = spawnSync(
     "docker",
     ["compose", "run", "--rm", "-T", "mosaic-agent", task.prompt],
@@ -269,6 +335,9 @@ function runTask(taskFile) {
     request: task.prompt,
     response,
     expectedExact: expected,
+    workspace: task.workspace,
+    tools: task.tools,
+    session: task.session,
     exitCode: proc.status,
     signal: proc.signal ?? null,
     provider: resolved.execution.provider,
@@ -296,17 +365,69 @@ function listRuns() {
   for (const runId of entries) {
     let status = "unknown";
     let taskId = "-";
+    let workspace = "-";
+    let session = "-";
     try {
       const result = JSON.parse(fs.readFileSync(path.join(root, runId, "result.json"), "utf8"));
       status = result.status;
       taskId = result.taskId;
+      workspace = result.workspace ?? "-";
+      session = result.session ?? "-";
     } catch {
       // Incomplete run record; report as unknown.
     }
-    process.stdout.write(`${runId}  ${status.padEnd(9)}  ${taskId}\n`);
+    process.stdout.write(`${runId}  ${status.padEnd(9)}  task=${taskId.padEnd(18)} ws=${String(workspace).padEnd(10)} session=${session}\n`);
   }
 }
 
+function showRun(runId) {
+  if (!/^r-[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(runId)) {
+    fail(4, `invalid run id: ${JSON.stringify(runId)} (expected r-<id>)`);
+  }
+  const resolved = loadConfig();
+  const dir = path.join(runsRoot(resolved), runId);
+  if (!fs.existsSync(dir)) {
+    fail(4, `run not found: ${runId} (under ${runsRoot(resolved)})`);
+  }
+
+  const read = (name) => {
+    try {
+      return JSON.parse(fs.readFileSync(path.join(dir, name), "utf8"));
+    } catch {
+      return null;
+    }
+  };
+  const result = read("result.json");
+  const task = read("task.json");
+  const mission = read("mission.json");
+
+  process.stdout.write(`run:       ${runId}\n`);
+  if (result) {
+    process.stdout.write(
+      [
+        `status:    ${result.status}${result.reason ? ` (${result.reason})` : ""}`,
+        `task:      ${result.taskId}`,
+        result.missionId ? `mission:   ${result.missionId}` : null,
+        result.workspace ? `workspace: ${result.workspace}` : null,
+        result.session ? `session:   ${result.session}` : null,
+        result.tools ? `tools:     ${result.tools.join(", ")}` : null,
+        `adapter:   ${"(see config)"} provider=${result.provider} model=${result.model}`,
+        `request:   ${JSON.stringify(result.request)}`,
+        `response:  ${JSON.stringify(result.response)}`,
+        result.expectedExact !== null && result.expectedExact !== undefined ? `expected:  ${JSON.stringify(result.expectedExact)}` : null,
+        `timing:    ${result.startedAt} -> ${result.finishedAt} (${result.durationMs} ms)`,
+        `exit:      ${result.exitCode}${result.signal ? ` signal=${result.signal}` : ""}`,
+      ].filter((line) => line !== null).join("\n") + "\n",
+    );
+  } else {
+    process.stdout.write("result.json: (missing or unreadable)\n");
+  }
+  if (task) process.stdout.write(`task snapshot: ${"task.json"} present\n`);
+  if (mission) process.stdout.write(`mission snapshot: ${mission.id} - ${mission.objective}\n`);
+  process.stdout.write(`artifacts: ${fs.readdirSync(dir).map((f) => `${f}`).join(", ")}\n`);
+  process.exit(0);
+}
+
 const operation = process.argv[2];
 const target = process.argv[3];
 
@@ -323,9 +444,13 @@ switch (operation) {
     if (!target) fail(4, "usage: mosaic-task.mjs run <taskFile>");
     runTask(path.resolve(target));
     break;
+  case "show":
+    if (!target) fail(4, "usage: mosaic-task.mjs show <runId>");
+    showRun(target);
+    break;
   case "list":
     listRuns();
     process.exit(0);
   default:
-    fail(4, `unknown operation: ${JSON.stringify(operation ?? "")} (expected validate | run | list)`);
+    fail(4, `unknown operation: ${JSON.stringify(operation ?? "")} (expected validate | run | show | list)`);
 }

scripts/test-task.sh

@@ -146,6 +146,38 @@ else
     echo "skip adapter seam cases (docker daemon unavailable)"
 fi
 
+# ---------- workspace + capabilities (M5): deterministic mock cases ----------
+if docker info >/dev/null 2>&1; then
+    printf '{"taskVersion":1,"id":"t-ws","prompt":"ignored","workspace":"suitews","capabilities":{"tools":["read","bash"]}}' > "$SANDBOX/ws-task.json"
+    expect_exit "workspace+tools task runs via mock" 0 -- \
+        env MOSAIC_CONFIG="$SANDBOX/mock-adapters.json" MOSAIC_MOCK_RESPONSE=MOCKED \
+        scripts/run-task.sh run "$SANDBOX/ws-task.json"
+    WSL="$(ls -dt "$SANDBOX/data/runs"/r-* 2>/dev/null | head -1)"
+    grep -q '^MOSAIC_WORKSPACE=/var/lib/mosaic/workspaces/suitews$' "$WSL/stderr.txt" 2>/dev/null \
+        && grep -q '^MOSAIC_TOOLS=read,bash$' "$WSL/stderr.txt" 2>/dev/null \
+        && check "workspace path + tools delivered to adapter" 0 \
+        || check "workspace path + tools delivered to adapter" 1
+    [ -d "$SANDBOX/data/workspaces/suitews" ] \
+        && check "persistent workspace created on host" 0 \
+        || check "persistent workspace created on host" 1
+
+    expect_exit "plain task still runs (no workspace/tools)" 0 -- \
+        env MOSAIC_CONFIG="$SANDBOX/mock-adapters.json" MOSAIC_MOCK_RESPONSE=MOSAIC_HELLO_OK \
+        scripts/run-task.sh run "$SANDBOX/ok.json"
+    PL="$(ls -dt "$SANDBOX/data/runs"/r-* 2>/dev/null | head -1)"
+    grep -q '^MOSAIC_WORKSPACE=$' "$PL/stderr.txt" 2>/dev/null \
+        && check "workspace var present but empty when absent" 0 || check "workspace var present but empty when absent" 1
+    grep -q '^MOSAIC_TOOLS=$' "$PL/stderr.txt" 2>/dev/null \
+        && check "tools empty when absent" 0 || check "tools empty when absent" 1
+
+    printf '{"taskVersion":1,"id":"t-badtool","prompt":"x","capabilities":{"tools":["sudo"]}}' > "$SANDBOX/badtool.json"
+    expect_exit "unknown tool exits 2" 2 -- $TASK validate "$SANDBOX/badtool.json"
+    printf '{"taskVersion":1,"id":"t-badws","prompt":"x","workspace":"../escape"}' > "$SANDBOX/badws.json"
+    expect_exit "workspace traversal exits 2" 2 -- $TASK validate "$SANDBOX/badws.json"
+else
+    echo "skip workspace/capability cases (docker daemon unavailable)"
+fi
+
 # ---------- live: real runs (Docker + credentials required) ----------
 # On failure, surface the run record + agent stderr BEFORE the sandbox
 # cleanup destroys them. Never let a wrong-exit mask the real reason.

tasks/session-demo-1.json

@@ -0,0 +1,8 @@
+{
+  "taskVersion": 1,
+  "id": "t-session-teach",
+  "prompt": "Remember this code word for later: mosaico. Reply with exactly: REMEMBERED",
+  "session": "demo",
+  "expectExact": "REMEMBERED",
+  "timeoutSeconds": 180
+}

tasks/session-demo-2.json

@@ -0,0 +1,7 @@
+{
+  "taskVersion": 1,
+  "id": "t-session-recall",
+  "prompt": "What code word did I ask you to remember earlier in this session? Reply with only the code word.",
+  "session": "demo",
+  "timeoutSeconds": 180
+}

tasks/workspace-demo.json

@@ -0,0 +1,9 @@
+{
+  "taskVersion": 1,
+  "id": "t-workspace-demo",
+  "prompt": "Use the bash tool to create a file named proof.txt in the current directory containing exactly the text: workspace works. Then reply with exactly: WORKSPACE_OK",
+  "workspace": "demo",
+  "capabilities": { "tools": ["bash", "read", "write"] },
+  "expectExact": "WORKSPACE_OK",
+  "timeoutSeconds": 180
+}