fix(git-tools): sanitize WP5b for the public-package gates (review identity scrub + tool index)

verify-sanitized denylist: an operator-identity token in a ci-queue-wait
comment (spec finding references genericized - the framework-PR
firewall applies to shipped files). check-tools-index: repo-decl.sh
shipped means documented in the resident index in the SAME commit, and
executable. Full sanitization CI step replayed green locally
(verify-sanitized, resident budget x2, enumeration guard, tools index
x2).

.woodpecker/ci.yml

@@ -38,12 +38,10 @@ when:
   - event: push
     branch: main
 
-# Turbo remote cache (turbo.mosaicstack.dev) is wired in publish.yml via the
-# org-level Woodpecker secret `turbo_token` (events: push/tag/cron/manual/
-# deployment — never pull_request). This PR pipeline deliberately gets no
-# remote-cache credentials: an untrusted PR must not be able to write to (or
-# poison) the shared cache. Without TURBO_* env vars turbo falls back to
-# local cache only, which is the intended behavior here.
+# Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
+# repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).
+# This avoids from_secret which is blocked on pull_request events.
+# If the env vars aren't set, turbo falls back to local cache only.
 
 steps:
   install:

.woodpecker/publish.yml

@@ -32,11 +32,6 @@ variables:
   # non-excluded change still builds, so no transitive dep can silently go stale.
   # (Woodpecker: `when` entries are OR'd; `path` applies to push/PR only — hence
   # the separate `event: tag` entry.)
-  # #1407: ONE shared anchor for all three image steps. A second main-only
-  # anchor previously gated build-web/build-appservice, so next-lane pushes
-  # published gateway sha images with no web/appservice counterpart — no
-  # sha-parity set existed for next-lane containerized deploys. Every image
-  # step now builds on next too (sha-only destinations, enforced per step).
   - &image_build_when
     - event: tag
     - event: [push, manual]
@@ -49,6 +44,16 @@ variables:
           - '.woodpecker/**'
     - event: [push, manual]
       branch: next
+  - &main_image_build_when
+    - event: tag
+    - event: [push, manual]
+      branch: main
+      path:
+        exclude:
+          - 'packages/mosaic/**'
+          - 'docs/**'
+          - '**/*.md'
+          - '.woodpecker/**'
 
 when:
   - branch: [main, next]
@@ -68,13 +73,6 @@ steps:
   # being empty) and on any incomplete verification.
   verify:
     image: *node_image
-    environment:
-      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
-      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       # (a) Commit identity: the provider's claimed SHA must equal the actual
@@ -110,13 +108,6 @@ steps:
 
   build:
     image: *node_image
-    environment:
-      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
-      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build
@@ -469,7 +460,7 @@ steps:
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
-    when: *image_build_when
+    when: *main_image_build_when
     environment:
       REGISTRY_USER:
         from_secret: REGISTRY_USERNAME
@@ -483,17 +474,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/appservice:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next appservice publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next appservice publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: appservice image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:$CI_COMMIT_TAG"
@@ -513,7 +495,7 @@ steps:
 
   build-web:
     image: gcr.io/kaniko-project/executor:debug
-    when: *image_build_when
+    when: *main_image_build_when
     environment:
       REGISTRY_USER:
         from_secret: REGISTRY_USERNAME
@@ -527,17 +509,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/web:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next web publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next web publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: web image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:$CI_COMMIT_TAG"

apps/gateway/src/main.ts

@@ -14,16 +14,10 @@ import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
 import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';
 import { resolveGatewayConfigPath } from './env.js';
-import { assertValidationPipeSeesDtoDecorators } from './validation-pipe-check.js';
 
 async function bootstrap(): Promise<void> {
   const logger = new Logger('Bootstrap');
 
-  // Fail loud BEFORE anything else if the global ValidationPipe cannot see
-  // the guarded DTOs' decorated properties (#1391): a broken metatype turns
-  // every request body into a 400 at first use; this surfaces it at boot.
-  assertValidationPipeSeesDtoDecorators();
-
   if (!process.env['BETTER_AUTH_SECRET']) {
     throw new Error('BETTER_AUTH_SECRET is required');
   }

apps/gateway/src/validation-pipe-check.spec.ts

@@ -1,104 +0,0 @@
-/**
- * Boot-time ValidationPipe metatype self-check (#1391).
- *
- * The check exists to fail loud at boot when the global pipe cannot see a
- * guarded DTO's decorated properties — the #436 class-erasure signature and
- * its dependency-graph cousins. Red/green arms:
- *
- *   GREEN  real module state: BootstrapSetupDto's three properties are
- *          decorated and visible through the globalThis-shared storage.
- *   RED    a control class with NO decorators (the erasure shape): the
- *          check throws PipeMetatypeCheckError naming every property.
- *   RED-2  a control where one property is decorated and two are not: the
- *          error names exactly the missing two — the miss list is precise,
- *          not a blanket failure.
- */
-import { describe, expect, it } from 'vitest';
-import { IsString } from 'class-validator';
-import {
-  assertValidationPipeSeesDtoDecorators,
-  PipeMetatypeCheckError,
-} from './validation-pipe-check.js';
-
-describe('assertValidationPipeSeesDtoDecorators (#1391 boot check)', () => {
-  it('GREEN: passes on real module state (decorated DTO visible to the pipe)', () => {
-    expect(() => assertValidationPipeSeesDtoDecorators()).not.toThrow();
-  });
-
-  it('RED control: a class whose properties lost their decorators throws, naming them', async () => {
-    // Simulate metatype erasure: an undecorated class standing where a
-    // decorated DTO should be. Redefine the guard table for the test by
-    // importing the module and pointing its table at the eroded class —
-    // the check reads the table at call time, so a fresh module instance
-    // with a swapped table reproduces the boot failure deterministically.
-    const { PIPE_GUARDED_DTOS } = await import('./validation-pipe-check.js');
-
-    class ErodedDto {
-      name?: string;
-      email?: string;
-      password?: string;
-    }
-
-    const original = PIPE_GUARDED_DTOS[0];
-    expect(original).toBeDefined();
-    // Swap in the eroded target (same declared properties, zero decorators).
-    (
-      PIPE_GUARDED_DTOS as unknown as Array<{ name: string; target: object; properties: string[] }>
-    ).splice(0, PIPE_GUARDED_DTOS.length, {
-      name: 'ErodedDto',
-      target: ErodedDto,
-      properties: ['name', 'email', 'password'],
-    });
-
-    try {
-      expect(() => assertValidationPipeSeesDtoDecorators()).toThrow(PipeMetatypeCheckError);
-      try {
-        assertValidationPipeSeesDtoDecorators();
-      } catch (err) {
-        const message = err instanceof Error ? err.message : '';
-        expect(message).toContain('ErodedDto.name');
-        expect(message).toContain('ErodedDto.email');
-        expect(message).toContain('ErodedDto.password');
-      }
-    } finally {
-      // Restore real module state for any later test in this file.
-      (PIPE_GUARDED_DTOS as unknown as unknown[]).splice(0, PIPE_GUARDED_DTOS.length, original);
-    }
-    // And confirm the restore is real.
-    expect(() => assertValidationPipeSeesDtoDecorators()).not.toThrow();
-  });
-
-  it('RED-2 control: a partially decorated class names exactly the missing properties', async () => {
-    const { PIPE_GUARDED_DTOS } = await import('./validation-pipe-check.js');
-
-    class HalfErodedDto {
-      @IsString()
-      name?: string;
-      email?: string;
-      password?: string;
-    }
-
-    const original = PIPE_GUARDED_DTOS[0];
-    (
-      PIPE_GUARDED_DTOS as unknown as Array<{ name: string; target: object; properties: string[] }>
-    ).splice(0, PIPE_GUARDED_DTOS.length, {
-      name: 'HalfErodedDto',
-      target: HalfErodedDto,
-      properties: ['name', 'email', 'password'],
-    });
-
-    try {
-      try {
-        assertValidationPipeSeesDtoDecorators();
-        expect.unreachable('partially decorated DTO must fail the boot check');
-      } catch (err) {
-        const message = err instanceof Error ? err.message : '';
-        expect(message).toContain('HalfErodedDto.email');
-        expect(message).toContain('HalfErodedDto.password');
-        expect(message).not.toContain('HalfErodedDto.name has no');
-      }
-    } finally {
-      (PIPE_GUARDED_DTOS as unknown as unknown[]).splice(0, PIPE_GUARDED_DTOS.length, original);
-    }
-  });
-});

apps/gateway/src/validation-pipe-check.ts

@@ -1,94 +0,0 @@
-import 'reflect-metadata';
-import { getMetadataStorage } from 'class-validator';
-import { BootstrapSetupDto } from './admin/bootstrap.dto.js';
-
-/**
- * Boot-time self-check: the global ValidationPipe must be able to SEE the
- * decorated properties of the DTOs it guards (#1391, #436 class).
- *
- * WHY THIS EXISTS. When Nest resolves a @Body() metatype to Object — via
- * `import type` class erasure (#436), or a dependency graph where the
- * controller's decorators and the application's route enhancers disagree
- * (#1391's hypothesized dual-@nestjs/common on a mixed install) — the
- * ValidationPipe's whitelist treats every property as forbidden. The first
- * symptom is a 400 on the FIRST bootstrap attempt of a fresh install, the
- * worst place to discover wiring damage: the operator cannot tell a broken
- * payload from a broken daemon.
- *
- * This check fails LOUD at boot instead: if the pipe cannot see the DTO's
- * decorated properties, the gateway refuses to start with a named cause.
- * It catches the whole class — erasure, decorator metadata loss — on every
- * host, at the moment the damage exists rather than at first use.
- *
- * Storage sharing note: class-validator keys its metadata storage on
- * globalThis, so duplicate package copies do NOT hide metadata (measured,
- * #1391 diagnosis). What hides it is losing the metatype itself, which is
- * what this asserts against.
- */
-
-/**
- * DTOs the global pipe guards, mapped to the properties the whitelist must
- * admit. Target is the CONSTRUCTOR (the object class itself): class-validator
- * decorators register metadata keyed on the constructor, and its executor
- * looks up `object.constructor` (ValidationExecutor.js:50) — the probe
- * through `prototype` returns zero. Extend when adding DTOs to the app.
- */
-export const PIPE_GUARDED_DTOS: Array<{
-  name: string;
-  target: abstract new (...args: never[]) => unknown;
-  properties: string[];
-}> = [
-  {
-    name: 'BootstrapSetupDto',
-    target: BootstrapSetupDto,
-    properties: ['name', 'email', 'password'],
-  },
-];
-
-export class PipeMetatypeCheckError extends Error {
-  constructor(missing: string[]) {
-    super(
-      'ValidationPipe metatype check failed: ' +
-        missing.join('; ') +
-        '. The global ValidationPipe cannot see decorated DTO properties — ' +
-        'every request body would be rejected as non-whitelisted. ' +
-        'Check for import-type erasure or decorator metadata loss in the ' +
-        'dependency graph (see issues #436, #1391).',
-    );
-    this.name = 'PipeMetatypeCheckError';
-  }
-}
-
-/**
- * Assert the pipe's whitelist can see every guarded DTO's decorated
- * properties. Throws PipeMetatypeCheckError (fail-loud at boot) listing
- * each miss. Pure function of module state: no I/O, safe to call twice.
- */
-export function assertValidationPipeSeesDtoDecorators(): void {
-  const storage = getMetadataStorage();
-  const missing: string[] = [];
-
-  for (const dto of PIPE_GUARDED_DTOS) {
-    // class-validator records constraints keyed on the DTO's constructor
-    // (decorators run on the class), and its executor resolves them via
-    // object.constructor. A property with no recorded metadata is invisible
-    // to the whitelist — whatever the cause — and fails here.
-    // Signature mirrors ValidationExecutor.js:50 — (constructor, schema, always,
-    // strictGroups, groups?). No schema, always=true, no groups: every
-    // constraint regardless of grouping, which is what the whitelist sees.
-    const metadatas = storage.getTargetValidationMetadatas(dto.target, '', true, false);
-    const decorated = new Set(metadatas.map((m) => m.propertyName));
-
-    for (const property of dto.properties) {
-      if (!decorated.has(property)) {
-        missing.push(
-          `${dto.name}.${property} has no class-validator constraints visible to the pipe`,
-        );
-      }
-    }
-  }
-
-  if (missing.length > 0) {
-    throw new PipeMetatypeCheckError(missing);
-  }
-}

apps/gateway/src/workspace/teams.controller.spec.ts

@@ -1,123 +0,0 @@
-import 'reflect-metadata';
-import { type CanActivate, type ExecutionContext, type INestApplication } from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { Test } from '@nestjs/testing';
-import request from 'supertest';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { TeamsController } from './teams.controller.js';
-import { TeamsService } from './teams.service.js';
-
-const teamAlpha = { id: 'team-alpha', name: 'Alpha' };
-const teamBeta = { id: 'team-beta', name: 'Beta' };
-
-// user-1 is a member of team-alpha only; admin-1 has role admin.
-let currentUser: { id: string; role?: string } = { id: 'user-1' };
-
-const teamsServiceMock = {
-  findAll: vi.fn(() => Promise.resolve([teamAlpha, teamBeta])),
-  findAllForUser: vi.fn((userId: string) =>
-    Promise.resolve(userId === 'user-1' ? [teamAlpha] : []),
-  ),
-  findById: vi.fn((id: string) => Promise.resolve([teamAlpha, teamBeta].find((t) => t.id === id))),
-  listMembers: vi.fn(() => Promise.resolve([{ teamId: 'team-alpha', userId: 'user-1' }])),
-  isMember: vi.fn((teamId: string, userId: string) =>
-    Promise.resolve(teamId === 'team-alpha' && userId === 'user-1'),
-  ),
-};
-
-const authGuard: CanActivate = {
-  canActivate(context: ExecutionContext): boolean {
-    const requestContext = context
-      .switchToHttp()
-      .getRequest<{ user?: { id: string; role?: string } }>();
-    requestContext.user = currentUser;
-    return true;
-  },
-};
-
-describe('teams endpoints are scoped to membership', () => {
-  let app: INestApplication;
-
-  beforeAll(async () => {
-    const moduleRef = await Test.createTestingModule({
-      controllers: [TeamsController],
-      providers: [{ provide: TeamsService, useValue: teamsServiceMock }],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue(authGuard)
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  beforeEach(() => {
-    currentUser = { id: 'user-1' };
-    vi.clearAllMocks();
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it('GET /api/teams returns only the teams the user belongs to', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams');
-    expect(response.status).toBe(200);
-    expect(response.body).toEqual([teamAlpha]);
-    expect(teamsServiceMock.findAll).not.toHaveBeenCalled();
-  });
-
-  it('GET /api/teams returns every team for an admin', async () => {
-    currentUser = { id: 'admin-1', role: 'admin' };
-    const response = await request(app.getHttpServer()).get('/api/teams');
-    expect(response.status).toBe(200);
-    expect(response.body).toEqual([teamAlpha, teamBeta]);
-    expect(teamsServiceMock.findAllForUser).not.toHaveBeenCalled();
-  });
-
-  it('GET /api/teams/:teamId returns 403 for a non-member', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams/team-beta');
-    expect(response.status).toBe(403);
-  });
-
-  it('GET /api/teams/:teamId returns 404 for a missing team', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams/team-missing');
-    expect(response.status).toBe(404);
-  });
-
-  it('GET /api/teams/:teamId returns the team for a member', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams/team-alpha');
-    expect(response.status).toBe(200);
-    expect(response.body).toEqual(teamAlpha);
-  });
-
-  it('GET /api/teams/:teamId/members returns 403 for a non-member and members for a member', async () => {
-    const denied = await request(app.getHttpServer()).get('/api/teams/team-beta/members');
-    expect(denied.status).toBe(403);
-    expect(teamsServiceMock.listMembers).not.toHaveBeenCalled();
-
-    const allowed = await request(app.getHttpServer()).get('/api/teams/team-alpha/members');
-    expect(allowed.status).toBe(200);
-    expect(allowed.body).toEqual([{ teamId: 'team-alpha', userId: 'user-1' }]);
-  });
-
-  it('GET /api/teams/:teamId/members/:userId allows a self-lookup on any team', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams/team-beta/members/user-1');
-    expect(response.status).toBe(200);
-    expect(response.body).toEqual({ isMember: false });
-  });
-
-  it('GET /api/teams/:teamId/members/:userId denies looking up another user on a foreign team', async () => {
-    const response = await request(app.getHttpServer()).get('/api/teams/team-beta/members/user-2');
-    expect(response.status).toBe(403);
-  });
-
-  it('an admin can look up any membership', async () => {
-    currentUser = { id: 'admin-1', role: 'admin' };
-    const response = await request(app.getHttpServer()).get('/api/teams/team-alpha/members/user-1');
-    expect(response.status).toBe(200);
-    expect(response.body).toEqual({ isMember: true });
-  });
-});

apps/gateway/src/workspace/teams.controller.ts

@@ -1,68 +1,30 @@
-import {
-  Controller,
-  ForbiddenException,
-  Get,
-  NotFoundException,
-  Param,
-  UseGuards,
-} from '@nestjs/common';
+import { Controller, Get, Param, UseGuards } from '@nestjs/common';
 import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
 import { TeamsService } from './teams.service.js';
 
-type RequestUser = { id: string; role?: string };
-
 @Controller('api/teams')
 @UseGuards(AuthGuard)
 export class TeamsController {
   constructor(private readonly teams: TeamsService) {}
 
   @Get()
-  async list(@CurrentUser() user: RequestUser) {
-    if (user.role === 'admin') {
-      return this.teams.findAll();
-    }
-    return this.teams.findAllForUser(user.id);
+  async list() {
+    return this.teams.findAll();
   }
 
   @Get(':teamId')
-  async findOne(@Param('teamId') teamId: string, @CurrentUser() user: RequestUser) {
-    return this.getAccessibleTeam(teamId, user);
+  async findOne(@Param('teamId') teamId: string) {
+    return this.teams.findById(teamId);
   }
 
   @Get(':teamId/members')
-  async listMembers(@Param('teamId') teamId: string, @CurrentUser() user: RequestUser) {
-    await this.getAccessibleTeam(teamId, user);
+  async listMembers(@Param('teamId') teamId: string) {
     return this.teams.listMembers(teamId);
   }
 
   @Get(':teamId/members/:userId')
-  async checkMembership(
-    @Param('teamId') teamId: string,
-    @Param('userId') userId: string,
-    @CurrentUser() user: RequestUser,
-  ) {
-    // A user may always ask about their own membership; anything else is
-    // team-scoped like the other routes.
-    if (userId !== user.id) {
-      await this.getAccessibleTeam(teamId, user);
-    }
+  async checkMembership(@Param('teamId') teamId: string, @Param('userId') userId: string) {
     const isMember = await this.teams.isMember(teamId, userId);
     return { isMember };
   }
-
-  /**
-   * Team-scoped access: admins see any team; everyone else only teams they
-   * are a member of. NotFoundException when the team does not exist and
-   * ForbiddenException when the user lacks access (same convention as the
-   * projects controller).
-   */
-  private async getAccessibleTeam(teamId: string, user: RequestUser) {
-    const team = await this.teams.findById(teamId);
-    if (!team) throw new NotFoundException('Team not found');
-    if (user.role === 'admin') return team;
-    const isMember = await this.teams.isMember(teamId, user.id);
-    if (!isMember) throw new ForbiddenException('Not a member of this team');
-    return team;
-  }
 }

apps/gateway/src/workspace/teams.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { eq, and, inArray, type Db, teams, teamMembers, projects } from '@mosaicstack/db';
+import { eq, and, type Db, teams, teamMembers, projects } from '@mosaicstack/db';
 import { DB } from '../database/database.module.js';
 
 @Injectable()
@@ -56,21 +56,6 @@ export class TeamsService {
     return this.db.select().from(teams);
   }
 
-  /**
-   * List only the teams the user is a member of.
-   */
-  async findAllForUser(userId: string) {
-    const memberRows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, userId));
-
-    const teamIds = memberRows.map((r) => r.teamId);
-    if (teamIds.length === 0) return [];
-
-    return this.db.select().from(teams).where(inArray(teams.id, teamIds));
-  }
-
   /**
    * Find a team by ID.
    */

docs/ROADMAP.md

@@ -1,77 +0,0 @@
----
-kind: spec
-status: active
----
-
-# Mosaic Stack Roadmap
-
-Companion to [docs/PRD.md](./PRD.md). Governed by the D11 rule: **every planned
-phase appears here from day one, even as a placeholder** — nothing exists only
-in heads. A phase marked _placeholder_ is a commitment to design it, not a
-design; scoping one requires its own PRD section or requirements doc plus
-review.
-
-Phases are product phases. The in-flight platform workstreams (KBN-100/101
-kanban SOT implementation, FCM #758, FCOM #766, TESS, RI #1275, and the other
-Part II contracts in the PRD) run as parallel tracks under their own issues
-and are prerequisites where noted.
-
-| Phase | Scope                                                                          | Status                                    |
-| ----- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| P0    | Current state on `next`: read-only dashboard, chat, auth/SSO login, admin tabs | shipped, evolving                         |
-| P1    | **v1 slice** (PRD Part I §9)                                                   | next up                                   |
-| P2    | Connectors + comms + wizard expansion                                          | placeholder                               |
-| P3    | Full onboarding profile + M365                                                 | placeholder                               |
-| P4    | Enterprise mode + one-way conversion                                           | placeholder                               |
-| P5    | Federation                                                                     | placeholder (deliberately undesigned, D3) |
-
-## P0 — current state
-
-What exists on `next` today: web dashboard (login/register/SSO, chat,
-read-only projects/tasks, settings, admin user/system-health tabs), the
-Gateway, the CLI-first framework tooling, and the fleet control plane. The
-webUI audit (USC estate, webui-audit lane) measures the gap between this and
-P1.
-
-## P1 — v1 slice (D11)
-
-1. Standalone onboarding wizard: system/company name, component choices,
-   initial user, initial estate + project, seeded examples, re-runnable.
-2. Hierarchy core: company → estate → project → workspace → kanban, read-only
-   task bubble-up (kanban SOT Amendment A1 is the schema contract).
-3. Basic RBAC on the hierarchy.
-4. Minimal agent enrollment: one harness, API key, name/persona.
-
-Prerequisites: KBN-100/101 schema foundation; the D8 tool inventory and
-webUI→tool mapping (any missing tool is built first, D12).
-
-## P2 — connectors + comms + wizard expansion (placeholder)
-
-Email and drive connectors (Gmail/IMAP, Google Drive/OneDrive/Dropbox) with
-granular agentic-access consent; comms integrations (Matrix/Discord/Slack)
-including agent auto-enroll. Wizard gains the corresponding tabs (D4), plus
-the D4 capabilities deferred out of P1's minimal slice: expanded agent
-enrollment (OAuth login, multi-account, model choice with recommendation,
-account assignment, comms auto-enroll) and the Standalone SSO/OIDC
-configuration tab.
-
-## P3 — full onboarding profile + M365 (placeholder)
-
-Complete user onboarding profile (communication-style capture, optional
-voice-matching interview) under the D14 custody rule; M365 connectors,
-available to both deployment modes as ordinary connectors (same consent model
-as the P2 connector class). The Enterprise install flow's M365 prominence
-(D4) arrives with the Enterprise phase, P4.
-
-## P4 — Enterprise mode + conversion (placeholder)
-
-Enterprise install flow (org chart, RBAC focus, immediate OIDC, SSO
-prominent); per-user brains with architectural isolation (D14); Vault
-required; the one-way Standalone → Enterprise conversion (D3).
-
-## P5 — federation (placeholder)
-
-Connecting deployments: system-level config, assigned users, rights and
-data-access control, trusts with boundaries, strict data access, exfiltration
-monitoring. Explicitly not designed yet (D3); nothing in earlier phases may
-foreclose it. Requires its own PRD + threat model before any scoping.

docs/requirements/native-kanban-sot.md

@@ -372,87 +372,3 @@ The P0–P3 canon does not authorize:
 ## 7. Global release evidence
 
 P0–P3 may close only when requirements traceability maps every requirement above to automated and situational evidence, including cross-workspace denials, DB/Valkey fault injection, concurrent leases, stale fencing, generated-file immutability, UI conflict/reconnect behavior, migration reconciliation, independent review, mandatory SecReview, and final Certifier evidence.
-
-## 8. Amendment A1 — hierarchy parentage and RBAC chain above workspaces
-
-**Status:** amendment to the ratified canon, added by reviewed PR under
-decision D13 (operator ruling, 2026-08-25; decision owner Jason). It adds
-parent structure ABOVE workspaces. Sections 1–7, every invariant in §3, and
-every REQ above remain binding verbatim, with exactly one express modification:
-the narrow portfolio-analytics carve-out stated in §8.2.4. Nothing else below
-this line is weakened.
-
-### 8.1 What is added
-
-1. A platform hierarchy exists above workspaces:
-   **company/organization → estate → platform-project → workspace**. Each
-   workspace belongs to exactly one platform-project, each platform-project to
-   exactly one estate, each estate to exactly one company.
-2. **Record class.** Hierarchy records (company, estate, platform-project,
-   their parentage edges, and hierarchy-level access grants) are a new,
-   explicitly named record class: **tenancy/authorization structure records**.
-   They are not business or orchestration records, so §3 invariant 10 and
-   REQ-TEN-001 do not apply to them and are not weakened by them — those two
-   requirements bind business/orchestration rows exactly as before.
-   Constraints on the new class:
-   - Hierarchy tables MUST NOT carry task, plan, or any other
-     business/orchestration payload — parentage, naming, and grant data only.
-   - A hierarchy record can never be the subject of work: it cannot be
-     claimed, ordered, gated, or referenced as a dependency by any
-     business/orchestration row.
-   - Hierarchy mutations flow through the same sole-writable-SOT, fail-closed,
-     audited mutation path as everything else (§8.2.3).
-3. The hierarchy serves exactly two runtime functions, plus audited
-   maintenance of its own structure:
-   - **RBAC evaluation:** access grants are declared per company, estate, or
-     platform-project and evaluate down the chain to workspace-scoped
-     authorization. Tenant context continues to be derived from authenticated
-     authority (REQ-TEN-001); the chain adds where grants can be declared,
-     not a bypass of workspace authorization.
-   - **Read-only roll-ups:** task and status visualization bubbles up the
-     hierarchy as aggregation over workspaces the reader is authorized on.
-   - **Chain maintenance (not a third runtime function):** re-parenting an
-     asset — moving a workspace to another platform-project, a
-     platform-project to another estate, and so on ("assets are transferable
-     subject to the structure", PRD Part I §4) — is an audited edit of the
-     hierarchy records themselves under §8.3. It never modifies
-     business/orchestration rows and never crosses a workspace boundary for
-     them; the workspace's contents move with the workspace untouched.
-4. Naming: this amendment says **platform-project** for the hierarchy level
-   above workspaces, because §5 REQ-PLAN-001 already defines `projects` as
-   planning entities INSIDE a workspace. The two are different objects. Final
-   terminology (rename of one or the other) is an implementation-PR decision
-   under this amendment's review; the schema MUST NOT merge them.
-
-### 8.2 What is explicitly unchanged
-
-1. `workspace_id` remains the hard mechanical isolation unit (§2 D2,
-   REQ-TEN-001). Hierarchy tables carry parentage; they do not create
-   cross-workspace relationships between business/orchestration rows, which
-   remain rejected (§3 invariant 10).
-2. Roll-up is **never a write**: no aggregation path may mutate, claim, order,
-   or gate work in any workspace. Bubble-up views are generated projections in
-   the sense of §3 invariant 5 — non-authoritative and never import sources.
-3. Fail-closed mutation health (§3 invariants 3–4), sole writable PostgreSQL
-   SOT, fencing, audit, and the Coordinator/Certifier authority rules are
-   untouched.
-4. No §6 non-goal is authorized, with one express, narrow carve-out that this
-   amendment makes to the "portfolio analytics" non-goal: the read-only
-   roll-up of §8.1 — per-workspace task counts and statuses aggregated up the
-   parent chain, over workspaces the reader is authorized on — is in scope.
-   Everything beyond that boundary (metrics, trends, forecasting, scoring,
-   dashboards computed across workspaces, any derived analytic that is not a
-   direct count/status aggregation) remains a non-goal. This is an explicit
-   narrowing by amendment, not a claim that §6 is unchanged; every other §6
-   non-goal is untouched.
-
-### 8.3 Acceptance (binding on the implementing PRs)
-
-- Schema tests prove each workspace resolves to exactly one
-  platform-project/estate/company chain and that chain edits are audited.
-- Authorization tests prove a grant at each hierarchy level yields exactly the
-  workspace permissions the chain implies, and that revocation up the chain
-  propagates.
-- Negative tests prove roll-up endpoints cannot mutate state and that a
-  reader sees aggregates only over workspaces they are authorized on
-  (no cross-tenant existence oracles).

docs/requirements/rbac-grant-model.md

@@ -1,259 +0,0 @@
-# RBAC Grant Model Contract
-
-Status: DRAFT — awaiting ratification (webui-audit S2, contract 2 of 9).
-Authority: PRD Part I §4 ("Granular RBAC: admins restrict access per company,
-estate, and project; grants are evaluated down the chain") and the
-native-kanban SOT Amendment A1 (§8.1.3 RBAC evaluation, §8.3 acceptance 2).
-This document defines the grant vocabulary, evaluation semantics, and
-revocation propagation that the hierarchy schema contract
-(`docs/requirements/hierarchy-schema.md`, contract 1) attaches to. Contract 1
-pins the `hierarchy_grants` table shape and defers the `role` vocabulary and
-the meaning of "authority" here; the identity contract
-(`docs/requirements/identity-lifecycle.md` §1.4) pins that account creation
-grants nothing.
-
-Revision 2 (independent review, GLM 5.3): §1.1 consequence analysis
-completed — the two existing platform-admin bypass code paths are named as
-non-conformant and §7.4 retires them; team grant subjects suspended pending
-a team contract (§1.4, §3.3–3.4, §7.5); no-self-escalation restated with
-its true rationale and a constructible observable (§4.2, §7.7);
-node-creation seeding scoped to the bootstrap path, resolving the §7.7/§4.3
-contradiction; A1 quotation corrected; audit-field provenance corrected;
-principal-position consequence named (§1.3); membership-row,
-fail-closed-fault, and existence-oracle observables added (§7);
-role-string namespacing rule added (§4.5); ruling request now names the
-interpretive resolution of PRD "admins".
-
-Scope: the roles that can appear in `hierarchy_grants.role`, what a grant at
-each hierarchy level confers, how grants evaluate down the chain, how
-revocation propagates, and who may manage grants. Out of scope: the hierarchy
-tables themselves (contract 1), workspace-internal membership and its
-role/capability vocabulary (native-kanban SOT REQ-ID-001 and its implementing
-schema), roll-up projection semantics (contract 8), wizard seeding
-(contract 3), the team model (suspended here; see §1.4).
-
-## 1. Three authority layers, none substitutable
-
-1. **Platform role** (`users.role`, better-auth: `member` | `admin`) governs
-   instance administration — user management, system settings, provider
-   configuration. It is not tenancy authority: holding platform `admin`
-   confers **no implicit hierarchy grant and no workspace authorization**.
-   An operator who should see tenant content holds an explicit, audited
-   grant like anyone else. This is the deny-by-default consequence of A1
-   §8.1.3 ("not a bypass of workspace authorization"). `AdminGuard`'s
-   `role === 'admin'` check on admin endpoints stays the platform role's
-   only meaning. **Two shipped code paths violate this rule today and are
-   implementation defects this contract makes non-conformant:** (a) the
-   command authorization service short-circuits every command scope to
-   allowed for platform admins
-   (`apps/gateway/src/commands/command-authorization.service.ts`,
-   `hasScope` returning true when `role === 'admin'`), and (b) the MCP
-   scope derivation maps platform `admin` to tenant-admin MCP scopes
-   including task create/update
-   (`apps/gateway/src/mcp/mcp.service.ts`,
-   `deriveMcpToolScopesForUser`). Ratifying this contract revokes both;
-   §7.4 names them as the surfaces the deny-by-default test retires.
-2. **Hierarchy grants** (`hierarchy_grants`, contract 1 §3) declare tenancy
-   authority at company, estate, or platform-project scope and evaluate down
-   the chain to workspace-scoped authorization (§3 below).
-3. **Workspace membership** (SOT REQ-ID-001) remains its own mechanism.
-   A chain grant confers command authorization over descendant workspaces;
-   it does not create membership rows, and row-level principal positions
-   (task owner, proposer, decision actor) still require ACTIVE workspace
-   membership exactly as REQ-TEN-001/REQ-ID-001 acceptance states.
-   Consequence, stated so implementing PRs do not weaken REQ-TEN-001 to
-   remove the friction: a chain-granted actor who is not a workspace member
-   may issue the write commands their role implies but cannot occupy a
-   principal position — any command taking a principal argument must name
-   an ACTIVE member of the target workspace (§7.2 enumerates this cell).
-4. **Team grant subjects are suspended.** Contract 1 §3.1 reserves a
-   `team_id` attachment point, but no ratified contract yet defines the
-   team it would bind: the only existing `teams` table is the legacy global
-   Brain table (own authority columns, no workspace binding, not
-   repurposed per contract 1 §1.3), while the SOT's teams are
-   workspace-bound (REQ-ID-001) — and a workspace-bound team holding a
-   company-level grant would be a cross-workspace authority group nothing
-   has ratified. Until a team contract defines the subject (which table,
-   which membership rows, and its relation to D2/REQ-ID-001), creating a
-   grant with a team subject MUST be refused at the command surface (the
-   schema column remains, per contract 1). §3's evaluation semantics for
-   team-conferred grants are specified now so the team contract activates
-   them without amending this one.
-
-## 2. Role vocabulary
-
-One vocabulary at every hierarchy level, totally ordered — a higher role
-includes everything below it:
-
-1. `viewer` — read: sees the node, its subtree structure, and the roll-up
-   aggregates over descendant workspaces (within contract 8's carve-out
-   bounds); read access to descendant workspace content per the SOT's read
-   command families. No mutation of anything.
-2. `member` — work: everything `viewer` has, plus write authorization for
-   business/orchestration command families in descendant workspaces (the
-   concrete command-family mapping is implementation work under SOT
-   REQ-ID-001; this contract pins that `member` maps to the workspace write
-   families and nothing structural).
-3. `owner` — structure: everything `member` has, plus hierarchy mutations on
-   the subtree (create/rename/delete child nodes, transfers per §5), and
-   grant management on the node and its subtree (§4).
-
-No other value is valid in `hierarchy_grants.role`; the column is
-constraint-checked against exactly these three. Extending the vocabulary is a
-contract amendment, not an implementation decision.
-
-## 3. Evaluation semantics
-
-1. **Deny by default.** No grant on any ancestor → no authority. There are
-   no implicit grants: not from platform role (§1.1), not from creating a
-   node (§4.3), not from workspace membership (membership without a chain
-   grant confers exactly what the SOT's own membership rules confer inside
-   that workspace, nothing up the chain).
-2. **Down-the-chain only.** A grant on a node applies to that node and its
-   entire descendant subtree. Nothing evaluates upward or sideways: a grant
-   on an estate says nothing about the parent company or sibling estates.
-3. **Effective role = maximum.** A subject's effective role at any node is
-   the highest role among grants held directly by the subject's user on
-   that node or any ancestor — and, once the team contract activates team
-   subjects (§1.4), grants held by any team the user is a member of on that
-   node or any ancestor. Roles never subtract — there is no negative/deny
-   grant in this model; revocation is deletion (§6).
-4. **Team grants follow live membership** (specified now, active only per
-   §1.4). A team grant confers its role on the team's current members,
-   evaluated at decision time. Leaving the team is loss of the grant with
-   §6's propagation bound.
-5. **Live evaluation, fail closed.** Authorization decisions derive from the
-   live grant and team-membership rows (or from a cache that is invalidated
-   in the same transaction as any grant/membership/hierarchy mutation). A
-   decision path that cannot read grant state denies. No materialized ACL is
-   ever authoritative.
-6. **Tenant context stays derived from authenticated authority**
-   (REQ-TEN-001). The chain adds where grants can be declared; a workspace
-   request is still authorized against that workspace, with the chain
-   contributing the effective role — never letting the chain become what A1
-   §8.1.3 forbids: "a bypass of workspace authorization".
-
-## 4. Grant management
-
-1. Creating, changing, or revoking a grant on a node requires effective
-   `owner` on that node (directly or via any ancestor).
-2. **No self-escalation.** A grant manager cannot create a grant with a role
-   higher than their own effective role on the target node. Under the §2
-   vocabulary this rule is currently implied by §4.1 (managers are `owner`,
-   the top role — no constructible grant exceeds it); it is stated
-   explicitly so it survives any future amendment that decouples
-   grant-management authority from role height. Its observable is the §7.7
-   audit invariant, not a refusal test.
-3. **Bootstrap of authority is explicit; inheritance covers the rest.**
-   Creating the first company (the wizard path, contract 3) and any
-   top-level company creation MUST name the initial `owner` grant in the
-   same audited operation — a top-level node has no ancestor to inherit
-   from, so without this the node would be unownable. Creating a child node
-   (estate, platform-project, workspace) requires effective `owner` on the
-   parent (§2.3) and confers no automatic grant; the creator's authority
-   over the new node already follows from §3.2 down-the-chain evaluation.
-   The creating command MAY additionally name an explicit initial grant for
-   a child node; it is not required to.
-4. Every grant mutation is a semantic audit event under contract 1 §5.2's
-   guarantees, extended by this contract with two further fields: the event
-   carries actor, verb, target, **subject, and role** (subject and role are
-   this contract's addition; contract 1 §5.2 does not enumerate them).
-5. **Role strings are namespaced.** `viewer`/`member` exist at hierarchy
-   level, `member`/`admin` on `users.role`, and the current command layer
-   uses a third `viewer|member|admin` vocabulary — same strings, different
-   meanings. Any serialized role string (audit events per §4.4, API
-   responses, logs) MUST identify its layer (e.g. `hierarchy:owner`,
-   `platform:admin`); a bare role string in a serialized artifact is
-   non-conformant.
-
-## 5. Transfer authority (completes contract 1 §4.2)
-
-"Authority over BOTH the source and the destination parent" means: effective
-`owner` on the current parent node (or an ancestor) AND effective `owner` on
-the destination parent node (or an ancestor), evaluated at transfer time in
-the transfer's own transaction. One subject must hold both; two cooperating
-half-authorized subjects are not a transfer protocol this contract defines.
-
-## 6. Revocation propagation
-
-1. Revoking a grant (deleting the row), removing a user from a team that
-   carries a grant (once team subjects activate, §1.4), or the cascade
-   deletion of a node's grants during node deletion (contract 1 §3.3) all
-   propagate identically: the authority derived from that grant is gone for
-   every descendant workspace.
-2. **Bound:** the next authorization decision on any affected transport
-   decides against the revoked grant. Concretely: no new HTTP/MCP command
-   authorized by the revoked grant after the revoking transaction commits;
-   an open Socket.IO connection whose subscriptions depend on the revoked
-   grant is re-evaluated within 30 seconds or at its next inbound message,
-   whichever comes first (same bound as the identity contract's §7.1
-   deactivation rule; same mechanism may serve both).
-3. Revocation is subtractive only in effect, not in representation: the
-   evaluator never needs tombstones; deletion of the row is the revocation.
-
-## 7. Verification requirements
-
-Binding on the implementing PRs (extends A1 §8.3 acceptance 2–3 and
-contract 1 §6):
-
-1. Vocabulary: the role CHECK constraint rejects any value outside
-   `viewer|member|owner` (real-PostgreSQL witness, `ci-postgres` service in
-   the `test` CI step).
-2. Per-level conferral: for each of the three levels × three roles, a grant
-   yields exactly the implied workspace authorization in a descendant
-   workspace and nothing in a non-descendant workspace (the A1 §8.3
-   "exactly the permissions the chain implies" matrix, enumerated). The
-   matrix includes: a chain grant creates zero workspace-membership rows
-   (assert row counts); a chain-granted non-member is refused as the
-   principal argument of any principal-taking command while their
-   non-principal writes succeed (§1.3); structure reads leak no existence
-   of nodes the reader holds no grant on (no cross-tenant existence
-   oracle, A1 §8.3 acceptance 3).
-3. Ordering: `owner` ⊇ `member` ⊇ `viewer` behaviorally — each higher role
-   passes every lower role's positive cases.
-4. Deny-by-default: platform `admin` with no grant reaches no tenant
-   content — asserted against the two §1.1 non-conformant surfaces after
-   their retirement: the command-authorization admin short-circuit and the
-   MCP tenant-admin scope derivation both gone (a platform admin with no
-   grant is refused workspace commands and receives no tenant MCP scopes);
-   workspace member with no chain grant gains nothing outside SOT
-   membership semantics; fresh account reaches nothing (identity contract
-   §1.4 cross-check).
-5. Team subjects: while suspended (§1.4), creating a team-subject grant is
-   refused at the command surface. On activation by the team contract:
-   user-direct and team-conferred grants combine to the maximum; team-leave
-   drops authority within the §6.2 bound; decision-time evaluation
-   witnessed (grant added → next decision allows; no restart or re-login
-   required).
-6. Revocation: each revocation path in §6.1 denies the next command on
-   every transport; the socket bound is measured; a cached-authorization
-   implementation proves transactional invalidation (grant revoked and
-   decision made on two distinct physical connections). Fail-closed fault
-   witness for §3.5: with grant state unreadable (fault injection), the
-   decision denies.
-7. Grant management: non-`owner` cannot mutate grants; top-level company
-   creation without the named initial `owner` grant is refused, while child
-   node creation under ancestor authority succeeds without one (§4.3 both
-   directions); every mutation produces its audit event with the §4.4
-   fields. Self-escalation observable: over the audit event stream, every
-   grant-create/change event's role is ≤ the acting user's effective role
-   on the target at event time (reconstructable invariant, not a refusal
-   test — see §4.2).
-8. Transfer: both-sides `owner` accepted, each single-side case refused
-   (completing contract 1 §6.5).
-
-## Ruling request
-
-Ratify sections 1–7 as written, with one decision embedded and one
-interpretive resolution named:
-
-- Decision: platform `admin` confers no implicit tenant access — operators
-  see tenant content only through explicit, audited grants (§1.1), which
-  retires the two existing admin bypass paths named there. Say "agreed" or
-  name the implicit access you want platform admins to keep.
-- Interpretive resolution (for visibility, not a separate question): PRD
-  Part I §4 says "admins restrict access per company, estate, and project";
-  this contract resolves "admins" as hierarchy `owner`s (§4.1), not
-  platform admins. A1 §8.1.3 does not attribute grant declaration to
-  platform admins, and the §1.1 decision above is what makes this reading
-  binding.

packages/mosaic/src/commands/gateway.ts

@@ -172,10 +172,9 @@ export function registerGatewayCommand(program: Command): void {
     .command('recover-token')
     .description('Recover an admin token — prompts for login if no valid session exists')
     .option('-g, --gateway <url>', 'Gateway URL (overrides meta.json)')
-    .option('-e, --email <email>', 'Headless: account email (password read from stdin line 2)')
-    .action(async (cmdOpts: { gateway?: string; email?: string }) => {
+    .action(async (cmdOpts: { gateway?: string }) => {
       const { runRecoverToken } = await import('./gateway/token-ops.js');
-      await runRecoverToken(cmdOpts.gateway, cmdOpts.email);
+      await runRecoverToken(cmdOpts.gateway);
     });
 
   // ─── logs ───────────────────────────────────────────────────────────────
@@ -203,14 +202,9 @@ export function registerGatewayCommand(program: Command): void {
 
   gw.command('uninstall')
     .description('Uninstall the gateway daemon and optionally remove data')
-    .option(
-      '-y, --yes',
-      'Headless: skip the confirmation prompt (required when stdin is not a TTY)',
-    )
-    .option('--remove-data', 'Also remove all gateway data (never implied by --yes)')
-    .action(async (cmdOpts: { yes?: boolean; removeData?: boolean }) => {
+    .action(async () => {
       const { runUninstall } = await import('./gateway/uninstall.js');
-      await runUninstall(cmdOpts);
+      await runUninstall();
     });
 
   // ─── doctor ─────────────────────────────────────────────────────────────────

packages/mosaic/src/commands/gateway/install.ts

@@ -95,17 +95,11 @@ export async function runInstall(opts: InstallOpts): Promise<void> {
     // fatal (#1392): an install that reports success over an empty/partial
     // database is the exact T63 failure this command must never reproduce.
     let verifyResult: VerifyResult | undefined;
-    let verificationThrew = false;
     try {
       const { runPostInstallVerification } = await import('./verify.js');
       verifyResult = await runPostInstallVerification(configResult.host, configResult.port);
-    } catch (err) {
-      // Health/token/bootstrap courtesy failures are non-fatal, but a THROWN
-      // schema verification must not let install report success either (N2,
-      // rev-code-02 review 285): mark it and treat as fatal below.
-      verificationThrew = true;
-      const msg = err instanceof Error ? err.message : String(err);
-      prompter.warn(`Post-install verification errored: ${msg}`);
+    } catch {
+      // Non-fatal — verification is a courtesy
     }
     if (verifyResult && verifyResult.schemaMigrated === false) {
       prompter.warn(
@@ -113,12 +107,6 @@ export async function runInstall(opts: InstallOpts): Promise<void> {
       );
       process.exit(1);
     }
-    if (verificationThrew) {
-      prompter.warn(
-        'Gateway install ABORTED: post-install verification errored (see above); refusing to report success on an unverified database.',
-      );
-      process.exit(1);
-    }
   } catch (err) {
     // Stages normally return structured results for expected failures.
     // Anything that reaches here is an unexpected runtime error — render a

packages/mosaic/src/commands/gateway/piped-credentials.spec.ts

@@ -1,31 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { Readable } from 'node:stream';
-import { readCredentialsFromPipedStdin } from './piped-credentials.js';
-
-describe('readCredentialsFromPipedStdin — #1394 stdin dual path (real streams)', () => {
-  it('reads exactly two lines; email trimmed, password as-is', async () => {
-    const r = await readCredentialsFromPipedStdin(
-      Readable.from(['  [email protected]  \n', 'pw with spaces \n']),
-    );
-    expect(r.email).toBe('[email protected]');
-    expect(r.password).toBe('pw with spaces ');
-  });
-
-  it('empty stdin → nulls (the headless-no-credentials shape)', async () => {
-    const r = await readCredentialsFromPipedStdin(Readable.from(['']));
-    expect(r).toEqual({ email: null, password: null });
-  });
-
-  it('single line only → email set, password null', async () => {
-    const r = await readCredentialsFromPipedStdin(Readable.from(['only-email\n']));
-    expect(r.email).toBe('only-email');
-    expect(r.password).toBeNull();
-  });
-
-  it('stops after two lines even if more follow', async () => {
-    const r = await readCredentialsFromPipedStdin(
-      Readable.from(['[email protected]\n', 'pw\n', 'extra\n', 'more\n']),
-    );
-    expect(r).toEqual({ email: '[email protected]', password: 'pw' });
-  });
-});

packages/mosaic/src/commands/gateway/piped-credentials.ts

@@ -1,26 +0,0 @@
-import { createInterface } from 'node:readline';
-
-/**
- * Read email + password as two lines from non-TTY stdin (the headless dual
- * path for callers that cannot pass argv: printf 'email\npassword\n' | …).
- * Caller gates on !isTTY; the password line is kept as-is (no trim —
- * whitespace may be intentional).
- *
- * Separate module (not login.ts) so tests can exercise the REAL reader
- * against real streams while token-ops specs mock this seam cleanly.
- */
-export function readCredentialsFromPipedStdin(
-  input: NodeJS.ReadableStream = process.stdin,
-): Promise<{ email: string | null; password: string | null }> {
-  return new Promise((resolve) => {
-    const lines: string[] = [];
-    const rl = createInterface({ input });
-    rl.on('line', (l) => {
-      lines.push(l);
-      if (lines.length >= 2) rl.close();
-    });
-    rl.on('close', () => {
-      resolve({ email: (lines[0] ?? '').trim() || null, password: lines[1] ?? null });
-    });
-  });
-}

packages/mosaic/src/commands/gateway/recover-token.spec.ts

@@ -16,20 +16,11 @@ vi.mock('./daemon.js', () => ({
 
 vi.mock('./login.js', () => ({
   getGatewayUrl: vi.fn().mockReturnValue('http://localhost:14242'),
-  // promptLine/promptSecret are used by ensureSession on the TTY path; return fixed
-  // values so tests never block on stdin.
+  // promptLine/promptSecret are used by ensureSession; return fixed values so tests don't block on stdin
   promptLine: vi.fn().mockResolvedValue('[email protected]'),
   promptSecret: vi.fn().mockResolvedValue('test-password'),
 }));
 
-// #1394: non-TTY runs resolve credentials from piped stdin instead of prompts.
-vi.mock('./piped-credentials.js', () => ({
-  readCredentialsFromPipedStdin: vi.fn().mockResolvedValue({
-    email: '[email protected]',
-    password: 'test-password',
-  }),
-}));
-
 const mockFetch = vi.fn();
 vi.stubGlobal('fetch', mockFetch);
 
@@ -74,7 +65,7 @@ describe('ensureSession', () => {
     expect(mockSignIn).not.toHaveBeenCalled();
   });
 
-  it('resolves piped-stdin credentials and signs in when stored session is invalid', async () => {
+  it('prompts for credentials and signs in when stored session is invalid', async () => {
     mockLoadSession.mockReturnValueOnce({ cookie: 'old-cookie', userId: 'u1', email: '[email protected]' });
     mockValidateSession.mockResolvedValueOnce(false);
     const newAuth = { cookie: fakeCookie, userId: 'u2', email: '[email protected]' };
@@ -85,7 +76,7 @@ describe('ensureSession', () => {
     expect(mockSaveSession).toHaveBeenCalledWith(baseUrl, newAuth);
   });
 
-  it('resolves piped-stdin credentials when no session exists', async () => {
+  it('prompts for credentials when no session exists', async () => {
     mockLoadSession.mockReturnValueOnce(null);
     const newAuth = { cookie: fakeCookie, userId: 'u2', email: '[email protected]' };
     mockSignIn.mockResolvedValueOnce(newAuth);
@@ -93,10 +84,6 @@ describe('ensureSession', () => {
     const cookie = await ensureSession(baseUrl);
     expect(cookie).toBe(fakeCookie);
     expect(mockSignIn).toHaveBeenCalled();
-    // The non-TTY path resolves credentials from the piped-stdin seam, not prompts.
-    expect(
-      vi.mocked(await import('./piped-credentials.js')).readCredentialsFromPipedStdin,
-    ).toHaveBeenCalled();
   });
 
   it('exits non-zero when signIn fails', async () => {
@@ -124,7 +111,7 @@ describe('runRecoverToken', () => {
     vi.spyOn(console, 'error').mockImplementation(() => {});
   });
 
-  it('signs in via piped stdin, mints a token, and persists it when no session exists', async () => {
+  it('prompts for login, mints a token, and persists it when no session exists', async () => {
     mockLoadSession.mockReturnValueOnce(null);
     const newAuth = { cookie: fakeCookie, userId: 'u2', email: '[email protected]' };
     mockSignIn.mockResolvedValueOnce(newAuth);

packages/mosaic/src/commands/gateway/schema-check.spec.ts

@@ -153,29 +153,4 @@ describe('resolveSchemaCheckConfigPath', () => {
       if (prevHome !== undefined) vi.stubEnv('HOME', prevHome);
     }
   });
-
-  it('gives MOSAIC_CONFIG NO authority (N1, review 285): env never overrides file resolution', async () => {
-    const { resolveSchemaCheckConfigPath } = await import('./schema-check.js');
-    const daemonDir = mkdtempSync(join(tmpdir(), 'schema-check-env-'));
-    tmpDirs.push(daemonDir);
-    const daemonHome = join(daemonDir, '.config', 'mosaic', 'gateway');
-    mkdirSync(daemonHome, { recursive: true });
-    writeFileSync(join(daemonHome, 'mosaic.config.json'), JSON.stringify(LOCAL_CFG));
-    // A stale env var pointing at a DIFFERENT file must be ignored entirely:
-    const decoyDir = mkdtempSync(join(tmpdir(), 'schema-check-decoy-'));
-    tmpDirs.push(decoyDir);
-    const decoyPath = join(decoyDir, 'mosaic.config.json');
-    writeFileSync(decoyPath, JSON.stringify(STANDALONE_CFG));
-
-    const prevHome = process.env['HOME'];
-    vi.stubEnv('HOME', daemonDir);
-    vi.stubEnv('MOSAIC_CONFIG', decoyPath);
-    try {
-      const resolved = resolveSchemaCheckConfigPath();
-      expect(resolved).toBe(join(daemonHome, 'mosaic.config.json'));
-      expect(resolved).not.toBe(decoyPath);
-    } finally {
-      if (prevHome !== undefined) vi.stubEnv('HOME', prevHome);
-    }
-  });
 });

packages/mosaic/src/commands/gateway/schema-check.ts

@@ -53,11 +53,8 @@ export const SCHEMA_FAIL_REMEDIATION = [
  */
 export function resolveSchemaCheckConfigPath(explicit?: string): string | undefined {
   if (explicit) return resolve(explicit);
-  // NOTE: no env-var candidate, deliberately. apps/gateway/src/env.ts gives env
-  // NO config authority (a stale MOSAIC_CONFIG could verify a database the
-  // daemon never reads — rev-code-02 review 285, note N1). Resolution order
-  // mirrors the daemon's file priorities only.
   const candidates = [
+    process.env['MOSAIC_CONFIG'],
     join(homedir(), '.config', 'mosaic', 'gateway', 'mosaic.config.json'), // daemon-written
     resolve(process.cwd(), 'mosaic.config.json'),
     join(homedir(), '.mosaic', 'mosaic.config.json'),

packages/mosaic/src/commands/gateway/token-ops.spec.ts

@@ -1,101 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-vi.mock('../../auth.js', () => ({
-  loadSession: vi.fn(),
-  validateSession: vi.fn(),
-  signIn: vi.fn(),
-  saveSession: vi.fn(),
-}));
-
-vi.mock('./login.js', () => ({
-  getGatewayUrl: vi.fn().mockReturnValue('http://localhost:14242'),
-  promptLine: vi.fn(),
-  promptSecret: vi.fn(),
-}));
-
-vi.mock('./piped-credentials.js', () => ({
-  readCredentialsFromPipedStdin: vi.fn(),
-}));
-
-vi.mock('./daemon.js', () => ({
-  readMeta: vi.fn(),
-  writeMeta: vi.fn(),
-}));
-
-import { ensureSession } from './token-ops.js';
-import { loadSession, validateSession, signIn, saveSession } from '../../auth.js';
-import { promptLine, promptSecret } from './login.js';
-import { readCredentialsFromPipedStdin } from './piped-credentials.js';
-
-const URL = 'http://localhost:14242';
-
-function asNonTTY(): void {
-  Object.defineProperty(process.stdin, 'isTTY', { value: false, configurable: true });
-}
-
-describe('ensureSession — #1394 credential precedence (flag > piped stdin > prompt)', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    vi.mocked(loadSession).mockReturnValue(null);
-    asNonTTY();
-  });
-
-  it('stored valid session wins; no credentials touched', async () => {
-    vi.mocked(loadSession).mockReturnValue({ cookie: 'SESS', email: '[email protected]' } as never);
-    vi.mocked(validateSession).mockResolvedValue(true);
-    await expect(ensureSession(URL)).resolves.toBe('SESS');
-    expect(signIn).not.toHaveBeenCalled();
-  });
-
-  it('flag email + stdin password: FLAG wins for email, stdin supplies the password', async () => {
-    vi.mocked(signIn).mockResolvedValue({ cookie: 'NEW', email: '[email protected]' } as never);
-    vi.mocked(readCredentialsFromPipedStdin).mockResolvedValue({
-      email: '[email protected]',
-      password: 'stdin-pw',
-    });
-
-    await ensureSession(URL, { email: '[email protected]' });
-
-    expect(signIn).toHaveBeenCalledWith(URL, '[email protected]', 'stdin-pw');
-    expect(promptLine).not.toHaveBeenCalled();
-    expect(promptSecret).not.toHaveBeenCalled();
-  });
-
-  it('stdin-only path (no flag): both credentials from piped lines', async () => {
-    vi.mocked(signIn).mockResolvedValue({ cookie: 'NEW2', email: '[email protected]' } as never);
-    vi.mocked(readCredentialsFromPipedStdin).mockResolvedValue({
-      email: '[email protected]',
-      password: 'spw',
-    });
-
-    await ensureSession(URL);
-    expect(signIn).toHaveBeenCalledWith(URL, '[email protected]', 'spw');
-  });
-
-  it('no credentials headless → exit(2) with --email guidance; signIn untouched', async () => {
-    vi.mocked(readCredentialsFromPipedStdin).mockResolvedValue({ email: null, password: null });
-    const exit = vi.spyOn(process, 'exit').mockImplementation((() => {
-      throw new Error('EXIT');
-    }) as never);
-    const err = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    await expect(ensureSession(URL)).rejects.toThrow('EXIT');
-    expect(exit).toHaveBeenCalledWith(2);
-    expect(err).toHaveBeenCalledWith(expect.stringContaining('--email'));
-    expect(signIn).not.toHaveBeenCalled();
-
-    exit.mockRestore();
-    err.mockRestore();
-  });
-
-  it('successful sign-in persists the session', async () => {
-    vi.mocked(signIn).mockResolvedValue({ cookie: 'C', email: '[email protected]' } as never);
-    vi.mocked(readCredentialsFromPipedStdin).mockResolvedValue({
-      email: '[email protected]',
-      password: 'pw',
-    });
-
-    await ensureSession(URL);
-    expect(saveSession).toHaveBeenCalledWith(URL, expect.anything());
-  });
-});

packages/mosaic/src/commands/gateway/token-ops.ts

@@ -1,7 +1,6 @@
 import { loadSession, validateSession, signIn, saveSession } from '../../auth.js';
 import { readMeta, writeMeta } from './daemon.js';
 import { getGatewayUrl, promptLine, promptSecret } from './login.js';
-import { readCredentialsFromPipedStdin } from './piped-credentials.js';
 
 interface MintedToken {
   id: string;
@@ -108,24 +107,8 @@ export async function requireSession(gatewayUrl: string): Promise<string> {
  * Ensure a valid session for the gateway, prompting for credentials if needed.
  * On sign-in failure, prints the error and exits non-zero.
  * Returns the session cookie.
- *
- * Credential precedence when sign-in is needed (#1394):
- *   1. explicit opts (--email flag; highest)
- *   2. non-TTY stdin — first line email, second line password (headless dual
- *      path for callers without argv access: printf 'email\npassword\n' | …)
- *   3. interactive prompt (TTY only)
  */
-export interface SessionCredentialOptions {
-  /** Email from an explicit flag (argv). Highest precedence. */
-  email?: string;
-  /** Password from an explicit source. Rare; passwords normally come via stdin/prompt. */
-  password?: string;
-}
-
-export async function ensureSession(
-  gatewayUrl: string,
-  opts: SessionCredentialOptions = {},
-): Promise<string> {
+export async function ensureSession(gatewayUrl: string): Promise<string> {
   // Try the stored session first
   const session = loadSession(gatewayUrl);
   if (session) {
@@ -136,25 +119,10 @@ export async function ensureSession(
     console.log(`No session found for ${gatewayUrl}. Please sign in.`);
   }
 
-  let email = opts.email;
-  let password = opts.password;
-  if ((!email || !password) && !process.stdin.isTTY) {
-    const piped = await readCredentialsFromPipedStdin();
-    email = email ?? piped.email ?? undefined;
-    password = password ?? piped.password ?? undefined;
-  }
-  if (!email || !password) {
-    if (!process.stdin.isTTY) {
-      console.error(
-        'No valid session and no credentials available headlessly. Provide --email plus ' +
-          "a password line on stdin (printf 'email\\npassword\\n' | …), or run interactively.",
-      );
-      process.exit(2);
-    }
-    email = await promptLine('Email: ');
-    // Do not trim password — it may contain intentional leading/trailing whitespace
-    password = await promptSecret('Password: ');
-  }
+  // Prompt for credentials — password must not be echoed to the terminal
+  const email = await promptLine('Email: ');
+  // Do not trim password — it may contain intentional leading/trailing whitespace
+  const password = await promptSecret('Password: ');
 
   const auth = await signIn(gatewayUrl, email, password).catch((err: unknown) => {
     console.error(err instanceof Error ? err.message : String(err));
@@ -178,12 +146,11 @@ export async function runRotateToken(gatewayUrl?: string): Promise<void> {
 }
 
 /**
- * `mosaic gateway config recover-token` — signs in if no session exists.
- * Passes the --email flag through to ensureSession (#1394 dual path).
+ * `mosaic gateway config recover-token` — prompts for login if no session exists.
  */
-export async function runRecoverToken(gatewayUrl?: string, email?: string): Promise<void> {
+export async function runRecoverToken(gatewayUrl?: string): Promise<void> {
   const url = getGatewayUrl(gatewayUrl);
-  const cookie = await ensureSession(url, { email });
+  const cookie = await ensureSession(url);
   const label = `CLI recovery token (${new Date().toISOString().slice(0, 16).replace('T', ' ')})`;
   const minted = await mintAdminToken(url, cookie, label);
   persistToken(url, minted);

packages/mosaic/src/commands/gateway/uninstall.spec.ts

@@ -1,86 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { mkdirSync } from 'node:fs';
-
-vi.mock('./daemon.js', () => ({
-  GATEWAY_HOME: '/tmp/u-test-gateway-home',
-  getDaemonPid: vi.fn().mockReturnValue(null),
-  readMeta: vi.fn(),
-  stopDaemon: vi.fn(),
-  uninstallGatewayPackage: vi.fn(),
-}));
-
-import { runUninstall } from './uninstall.js';
-import { readMeta, uninstallGatewayPackage } from './daemon.js';
-
-describe('gateway uninstall — #1390 headless semantics', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('non-TTY without --yes FAILS LOUD (exit 1, nothing touched)', async () => {
-    vi.mocked(readMeta).mockReturnValue({
-      version: '0.0.7',
-      installedAt: '',
-      entryPoint: '',
-      host: 'localhost',
-      port: 14242,
-    });
-    const exit = vi.spyOn(process, 'exit').mockImplementation((() => {
-      throw new Error('EXIT');
-    }) as never);
-    const err = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    await expect(runUninstall()).rejects.toThrow('EXIT');
-    expect(exit).toHaveBeenCalledWith(1);
-    expect(err).toHaveBeenCalledWith(expect.stringContaining('stdin is not a TTY'));
-    expect(uninstallGatewayPackage).not.toHaveBeenCalled();
-
-    exit.mockRestore();
-    err.mockRestore();
-  });
-
-  it('--yes proceeds headlessly WITHOUT removing data (never implied)', async () => {
-    const meta = {
-      version: '0.0.7',
-      installedAt: '',
-      entryPoint: '',
-      host: 'localhost',
-      port: 14242,
-    };
-    vi.mocked(readMeta).mockReturnValue(meta);
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    await runUninstall({ yes: true });
-
-    expect(uninstallGatewayPackage).toHaveBeenCalledTimes(1);
-    expect(log).toHaveBeenCalledWith(expect.stringContaining('Gateway data kept'));
-    log.mockRestore();
-  });
-
-  it('--yes --remove-data removes data headlessly', async () => {
-    vi.mocked(readMeta).mockReturnValue({
-      version: '0.0.7',
-      installedAt: '',
-      entryPoint: '',
-      host: 'localhost',
-      port: 14242,
-    });
-    mkdirSync('/tmp/u-test-gateway-home', { recursive: true }); // existsSync gate
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    await runUninstall({ yes: true, removeData: true });
-
-    expect(uninstallGatewayPackage).toHaveBeenCalledTimes(1);
-    expect(log).toHaveBeenCalledWith(expect.stringContaining('Gateway data removed'));
-    log.mockRestore();
-  });
-
-  it('no meta → clean no-op even with --yes', async () => {
-    vi.mocked(readMeta).mockReturnValue(null);
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
-    await runUninstall({ yes: true });
-    expect(log).toHaveBeenCalledWith('Gateway is not installed.');
-    expect(uninstallGatewayPackage).not.toHaveBeenCalled();
-    log.mockRestore();
-  });
-});

packages/mosaic/src/commands/gateway/uninstall.ts

@@ -8,65 +8,30 @@ import {
   uninstallGatewayPackage,
 } from './daemon.js';
 
-export interface UninstallOptions {
-  /** Skip the confirmation prompt (headless/scripted uninstall). */
-  yes?: boolean;
-  /** Also remove all gateway data at GATEWAY_HOME (never implied by --yes). */
-  removeData?: boolean;
-}
-
-export async function runUninstall(opts: UninstallOptions = {}): Promise<void> {
-  const nonInteractive = Boolean(opts.yes) || process.env['MOSAIC_ASSUME_YES'] === '1';
-
-  // Non-TTY without explicit consent must FAIL LOUD, not quietly do nothing:
-  // the pre-fix behavior (prompt on a closed stdin → default No → exit 0,
-  // gateway untouched) reported success-by-silence to every scripted caller
-  // (#1390). An explicit refusal beats a silent no-op.
-  if (!nonInteractive && !process.stdin.isTTY) {
-    console.error(
-      'gateway uninstall: stdin is not a TTY and no --yes was given — refusing to ' +
-        'run an interactive uninstall headlessly (nothing was changed). ' +
-        'Use --yes (and --remove-data to also delete gateway data), or run from a terminal.',
-    );
-    process.exit(1);
-  }
-
-  const rl = nonInteractive
-    ? null
-    : createInterface({ input: process.stdin, output: process.stdout });
+export async function runUninstall(): Promise<void> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    await doUninstall(rl as NonNullable<typeof rl>, opts, nonInteractive);
+    await doUninstall(rl);
   } finally {
-    rl?.close();
+    rl.close();
   }
 }
 
-function prompt(
-  rl: NonNullable<ReturnType<typeof createInterface>>,
-  question: string,
-): Promise<string> {
+function prompt(rl: ReturnType<typeof createInterface>, question: string): Promise<string> {
   return new Promise((resolve) => rl.question(question, resolve));
 }
 
-async function doUninstall(
-  rl: ReturnType<typeof createInterface>,
-  opts: UninstallOptions,
-  nonInteractive: boolean,
-): Promise<void> {
+async function doUninstall(rl: ReturnType<typeof createInterface>): Promise<void> {
   const meta = readMeta();
   if (!meta) {
     console.log('Gateway is not installed.');
     return;
   }
 
-  if (nonInteractive) {
-    console.log(`Uninstalling Mosaic Gateway (--yes${opts.removeData ? ' --remove-data' : ''})...`);
-  } else {
-    const answer = await prompt(rl, 'Uninstall Mosaic Gateway? [y/N] ');
-    if (answer.toLowerCase() !== 'y') {
-      console.log('Aborted.');
-      return;
-    }
+  const answer = await prompt(rl, 'Uninstall Mosaic Gateway? [y/N] ');
+  if (answer.toLowerCase() !== 'y') {
+    console.log('Aborted.');
+    return;
   }
 
   // Stop if running
@@ -80,20 +45,13 @@ async function doUninstall(
     }
   }
 
-  // Remove config/data. Interactive: ask. Headless: only with the explicit
-  // flag — destructive recursion is never implied by --yes alone (#1390).
-  let removeData = Boolean(opts.removeData);
-  if (!nonInteractive) {
-    const answer = await prompt(rl, `Remove all gateway data at ${GATEWAY_HOME}? [y/N] `);
-    removeData = answer.toLowerCase() === 'y';
-  }
-  if (removeData) {
+  // Remove config/data
+  const removeData = await prompt(rl, `Remove all gateway data at ${GATEWAY_HOME}? [y/N] `);
+  if (removeData.toLowerCase() === 'y') {
     if (existsSync(GATEWAY_HOME)) {
       rmSync(GATEWAY_HOME, { recursive: true, force: true });
       console.log('Gateway data removed.');
     }
-  } else {
-    console.log(`Gateway data kept at ${GATEWAY_HOME}.`);
   }
 
   // Uninstall npm package

packages/mosaic/src/commands/gateway/verify.ts

@@ -101,7 +101,7 @@ export async function runPostInstallVerification(
     const { runMigrations, getMigrationStatus } = await import('@mosaicstack/db');
     const result = await checkDatabaseSchema(
       { runMigrations, getMigrationStatus },
-      undefined, // resolver mirrors daemon file priorities; env has no config authority (N1)
+      process.env['MOSAIC_CONFIG'],
     );
     if (result.status === 'ok') {
       ok(result.detail);