fix(tess): route bare Discord approvals

.gitignore

@@ -8,7 +8,6 @@ coverage
 .env.local
 *.tsbuildinfo
 .pnpm-store
-__pycache__/
 docs/reports/
 
 # Step-CA dev password — real file is gitignored; commit only the .example

.husky/pre-push

@@ -1 +1 @@
-pnpm preflight && pnpm typecheck && pnpm lint && pnpm format:check
+pnpm typecheck && pnpm lint && pnpm format:check

.npmrc

@@ -1,5 +1,5 @@
 @mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
-# HOME resolves to /root in the ci-base image, preserving its warmed-store path.
+# Pin the pnpm store to the same path the ci-base image warms (Dockerfile.ci),
-# Non-root checkouts use their own HOME. Override without editing this file via
+# so the pipeline `pnpm install --prefer-offline` consumes the baked store
-# NPM_CONFIG_STORE_DIR (pnpm's environment form of the store-dir setting).
+# instead of repopulating a fresh one.
-store-dir=${HOME}/.local/share/pnpm/store
+store-dir=/root/.local/share/pnpm/store

.prettierignore

@@ -4,15 +4,6 @@ pnpm-lock.yaml
 **/node_modules
 **/drizzle
 **/.next
-# Python build/test artifacts — same category as node_modules/dist/.next above.
-# Prettier must never scan generated trees; without these a local venv poisons
-# `pnpm format:check` with thousands of third-party files.
-**/venv
-**/__pycache__
-**/.mypy_cache
-**/.pytest_cache
-**/htmlcov
 .claude/
 docs/tess/TASKS.md
 docs/scratchpads/
-packages/mosaic/src/fleet/testdata/documentation-publication-v1/inline-migration-v1.json

.woodpecker/ci.yml

@@ -41,32 +41,6 @@ steps:
       # (Constitution + dispatcher + each RUNTIME.md slice). See DESIGN §7 / R9.
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh
-      # Test-membership guard (#1017): also first link of test:framework-shell.
-      # Invoked from BOTH surfaces it audits (F2, PR #1018) — the guard is link
-      # [0] of the pnpm chain, so severing that chain would silence it together
-      # with everything it guards; this direct line keeps one instrument running.
-      - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
-
-  # Blocking gate (#791): a framework upgrade must never write or delete an
-  # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
-  # survives a keep-mode reseed byte-identical (with rsync present AND absent —
-  # keep mode is a single cp-based path that must not depend on rsync), and that a
-  # corrupt/empty/missing manifest aborts fail-closed leaving operator files
-  # untouched (B2/B3). The rollback gate proves a mid-sync failure is rolled back
-  # from the pre-update snapshot (B1). The durable-snapshot gate (#791 PR2) proves
-  # the retained, operator-scoped pre-update backup is taken before any mutation
-  # (0700/0600, secret never logged, retention-pruned) and that the post-sync
-  # verify net restores any operator file a manifest bug lets the sync touch. The
-  # migration matrix pins the v2→v3 contract-file semantics. Pure bash, no
-  # node_modules — runs early alongside sanitization.
-  upgrade-guard:
-    image: *node_image
-    commands:
-      - apk add --no-cache bash rsync
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-manifest-guard.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
 
   typecheck:
     image: *node_image
@@ -76,7 +50,6 @@ steps:
     depends_on:
       - install
       - sanitization
-      - upgrade-guard
 
   # lint, format, and test are independent — run in parallel after typecheck
   lint:
@@ -103,12 +76,6 @@ steps:
       DATABASE_URL: postgresql://mosaic:mosaic@ci-postgres:5432/mosaic
     commands:
       - *enable_pnpm
-      # openssl (#912) is the wake HMAC signer: the digest H1/H2, beacon B12,
-      # and install I8 legs hard-require it in CI. It is baked into ci-base via
-      # Dockerfile.ci, but ci-base only rebuilds on push-to-main/tag — this
-      # `apk add` guarantees openssl is present on PR pipelines too (and is a
-      # fast no-op once the rebuilt image already ships it).
-      - apk add --no-cache openssl
       # postgresql-client (pg_isready) is baked into ci-base.
       # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
       - |

.woodpecker/publish.yml

@@ -1,5 +1,5 @@
 # Build, publish npm packages, and push Docker images
-# Runs on main for stable publishes and on next for integration-line prereleases/images
+# Runs only on main branch push/tag
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
@@ -23,21 +23,9 @@ variables:
           - 'docs/**'
           - '**/*.md'
           - '.woodpecker/**'
-    - event: [push, manual]
-      branch: next
-  - &main_image_build_when
-    - event: tag
-    - event: [push, manual]
-      branch: main
-      path:
-        exclude:
-          - 'packages/mosaic/**'
-          - 'docs/**'
-          - '**/*.md'
-          - '.woodpecker/**'
 
 when:
-  - branch: [main, next]
+  - branch: [main]
     event: [push, manual, tag]
 
 steps:
@@ -115,84 +103,6 @@ steps:
     depends_on:
       - build
 
-  publish-next-npm:
-    image: *node_image
-    # Durable @next integration-line publish. Runs only on next; never writes
-    # the latest dist-tag and never commits the computed prerelease versions.
-    when:
-      - event: [push, manual]
-        branch: next
-    environment:
-      NPM_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_PIPELINE_NUMBER: ${CI_PIPELINE_NUMBER}
-    commands:
-      - *enable_pnpm
-      - |
-        if [ "$CI_COMMIT_BRANCH" != "next" ]; then
-          echo "[publish-next] FATAL: publish-next-npm may only run on next (got '$CI_COMMIT_BRANCH')" >&2
-          exit 1
-        fi
-        if [ -z "$CI_PIPELINE_NUMBER" ]; then
-          echo "[publish-next] FATAL: CI_PIPELINE_NUMBER is required for prerelease versioning" >&2
-          exit 1
-        fi
-        echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
-        echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
-        DIST_TAGS_JSON="$(npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json)"
-        DIST_TAGS_JSON="$DIST_TAGS_JSON" node -e 'const tags = JSON.parse(process.env.DIST_TAGS_JSON || "{}"); if (!tags || typeof tags !== "object" || !Object.hasOwn(tags, "latest")) { throw new Error("Gitea npm registry did not return a usable dist-tags object"); } console.log("[publish-next] registry dist-tags OK: latest=" + tags.latest);'
-        node <<'NODE'
-        const fs = require('node:fs');
-        const path = require('node:path');
-
-        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
-        const roots = ['apps', 'packages', 'plugins'];
-        const updated = [];
-
-        function walk(dir) {
-          if (!fs.existsSync(dir)) return;
-          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-              const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) updatePackage(packagePath);
-              walk(fullPath);
-            }
-          }
-        }
-
-        function updatePackage(packagePath) {
-          const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-          if (!manifest.name?.startsWith('@mosaicstack/') || manifest.private) return;
-          const stableMatch = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(manifest.version);
-          if (!stableMatch) {
-            throw new Error(manifest.name + " has unsupported semver version '" + manifest.version + "'");
-          }
-          const [, major, minor, patch] = stableMatch;
-          const oldVersion = manifest.version;
-          manifest.version = major + '.' + minor + '.' + (Number(patch) + 1) + '-next.' + pipelineNumber;
-          fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
-          updated.push(manifest.name + ' ' + oldVersion + ' -> ' + manifest.version);
-        }
-
-        for (const root of roots) walk(root);
-        if (updated.length === 0) throw new Error('No publishable @mosaicstack/* packages found');
-        console.log('[publish-next] computed prerelease versions for ' + updated.length + ' packages:');
-        for (const line of updated) console.log('[publish-next] ' + line);
-        NODE
-        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" --filter "!@mosaicstack/mosaic-as" publish --no-git-checks --access public --tag next
-        EXPECTED_VERSION="$(node -p "require('./packages/mosaic/package.json').version")"
-        RESOLVED_VERSION="$(npm view @mosaicstack/mosaic@next version --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/)"
-        if [ "$RESOLVED_VERSION" != "$EXPECTED_VERSION" ]; then
-          echo "[publish-next] FATAL: @mosaicstack/mosaic@next resolved '$RESOLVED_VERSION', expected '$EXPECTED_VERSION'" >&2
-          exit 1
-        fi
-        echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
-    depends_on:
-      - build
-
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
   #   image: *node_image
@@ -224,17 +134,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next gateway publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next gateway publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: gateway image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:$CI_COMMIT_TAG"
@@ -245,7 +146,7 @@ steps:
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
+    when: *image_build_when
     environment:
       REGISTRY_USER:
         from_secret: gitea_username
@@ -271,7 +172,7 @@ steps:
 
   build-web:
     image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
+    when: *image_build_when
     environment:
       REGISTRY_USER:
         from_secret: gitea_username

CLAUDE.md

@@ -26,14 +26,13 @@ pnpm test             # Vitest (all packages)
 pnpm build            # Build all packages
 
 # Database
-pnpm --filter @mosaicstack/db db:generate  # Offline migration artifact generation only
+pnpm --filter @mosaicstack/db db:push      # Push schema to PG (dev)
-# PostgreSQL execution is held until KBN-101-00/-03/-05 land. Do not invoke a runner,
+pnpm --filter @mosaicstack/db db:generate  # Generate migrations
-# init SQL, or Compose PostgreSQL service from this checkout.
+pnpm --filter @mosaicstack/db db:migrate   # Run migrations
 
-# Dev: local PGlite data-layer work needs no PostgreSQL. Optional local queue service only:
+# Dev
-docker compose up -d valkey
+docker compose up -d                  # Start PG, Valkey, OTEL, Jaeger
-# Do not start Gateway/Web or root pnpm dev as a local PGlite route: the current unguarded dotenv
+pnpm --filter @mosaicstack/gateway exec tsx src/main.ts  # Start gateway
-# loader can inherit a daemon PostgreSQL DSN. KBN-101-02 must make that state fail closed first.
 ```
 
 ## Conventions

Dockerfile.ci

@@ -22,13 +22,10 @@
 FROM node:24-alpine
 
 # Native toolchain required to compile node-gyp deps on musl, plus the
-# postgresql-client used by the test step's pg_isready readiness probe. `bash`,
+# postgresql-client used by the test step's pg_isready readiness probe. `bash`
-# `git`, and `jq` are baked here too — framework shell tests and the shipped
+# is baked here too — the sanitization step in ci.yml otherwise does a per-run
-# Codex review wrappers require them without per-run installation in ci.yml.
+# `apk add bash`.
-# `openssl` (#912) is the non-circular HMAC signer for the wake trust layer:
+RUN apk add --no-cache python3 make g++ postgresql-client bash
-# the digest H1/H2, beacon B12, and install I8 legs hard-require it in CI so the
-# §4 G6 evidence comes from an actually-run HMAC leg, not a skipped one.
-RUN apk add --no-cache python3 make g++ postgresql-client bash git jq openssl
 
 # Pin pnpm to the repo's packageManager version via corepack.
 RUN corepack enable && corepack prepare [email protected] --activate

README.md

@@ -30,16 +30,6 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |
 
-### Install lanes
-
-| Lane                     | Command                               | Use when                                              | Source                                                                  |
-| ------------------------ | ------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main` |
-| Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Build-from-source at `next`                                             |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                  |
-
-`--next` is shorthand for the prerelease integration lane: it enables source-build mode and uses `next` unless an explicit `--ref` or `MOSAIC_REF` is provided.
-
 After install, the wizard runs automatically or you can invoke it manually:
 
 ```bash
@@ -107,10 +97,7 @@ mosaic config path           # Print config file path
 ```bash
 mosaic doctor                # Health audit — detect drift and missing files
 mosaic sync                  # Sync skills from canonical source
-mosaic skill list            # Audit Claude skill registrations and conflicts
+mosaic update                # Check for and install CLI updates
-mosaic skill register <name> # Register one canonical skill with Claude Code
-mosaic skill unregister <name> # Remove one Mosaic-owned Claude link
-mosaic update                # Update CLI/framework and auto-register canonical skills
 mosaic wizard                # Full guided setup wizard
 mosaic bootstrap <path>      # Bootstrap a repo with Mosaic standards
 mosaic coord init            # Initialize a new orchestration mission
@@ -170,12 +157,7 @@ mosaic storage status
 mosaic storage tier
 mosaic storage export
 mosaic storage import
-# Schema migration is unavailable in this release. The current storage wrapper shells
+mosaic storage migrate
-# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
-# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
-# --run → runner --verify → readiness. Tier copy uses only the separately held secure
-# migrate-tier route.
 ```
 
 ### Telemetry
@@ -210,50 +192,33 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 git clone [email protected]:mosaicstack/stack.git
 cd stack
 
-# Install dependencies. The local tier uses in-process PGlite; leave DATABASE_URL unset.
+# Start infrastructure (Postgres, Valkey, Jaeger)
-# The pnpm store defaults to $HOME/.local/share/pnpm/store. Override it without
+docker compose up -d
-# editing the checkout with NPM_CONFIG_STORE_DIR=$HOME/another-store if needed.
+
+# Install dependencies
 pnpm install
 
-# Verify dependencies and generated state before running source-quality gates.
+# Run migrations
-# Missing dependencies exit 42; stale/foreign apps/web/.next state exits 43.
+pnpm --filter @mosaicstack/db run db:migrate
-# The web build certifies its exact standalone symlink manifest; added, removed,
-# retargeted, or manifest-only-tampered generated links also exit 43. This detects
-# accidental, independent, stale, and foreign-residue mutation—the class exposed by
-# a five-month-stale .next that produced 19 phantom TS2307 errors.
-# It does NOT defend against a same-UID actor that can rewrite both manifest and
-# marker consistently (CWE-345). RM-59 tracks the required executor/spine-side
-# trust anchor outside worktree authority.
-pnpm preflight
 
-# Optional local queue service only. This does not start PostgreSQL.
+# Start all services in dev mode
-docker compose up -d valkey
+pnpm dev
-
-# The current Gateway/Web local process is held; see docs/guides/dev-guide.md.
-# Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
 ```
 
-### Held future procedure
+### Infrastructure
 
-The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
+Docker Compose provides:
-current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
-invoke initialization SQL, or treat the planned migrator as currently executable.
 
-**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
+| Service               | Port      | Purpose                |
-land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
+| --------------------- | --------- | ---------------------- |
-`mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
+| PostgreSQL (pgvector) | 5433      | Primary database       |
-this README—will provide the reviewed commands and secret-consumer interface.
+| Valkey                | 6380      | Task queue + caching   |
-
+| Jaeger                | 16686     | Distributed tracing UI |
-For local data-layer work, PGlite needs no PostgreSQL service. The optional Compose command above
+| OTEL Collector        | 4317/4318 | Telemetry ingestion    |
-starts only Valkey; OTEL Collector and Jaeger may likewise be started individually if needed,
-without starting PostgreSQL. A Gateway/Web local process is not currently a safe PGlite route:
-its unguarded dotenv loader may inherit a daemon PostgreSQL DSN. Do not use root `pnpm dev` or a
-Gateway start command until KBN-101-02 makes that state fail closed.
 
 ### Quality Gates
 
 ```bash
-pnpm preflight               # Checkout/dependency/generated-state validation
 pnpm typecheck               # TypeScript type checking (all packages)
 pnpm lint                    # ESLint (all packages)
 pnpm test                    # Vitest (all packages)
@@ -266,7 +231,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
+- Database migration against a fresh Postgres
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.
@@ -371,15 +336,11 @@ The CLI also performs a background update check on every invocation (cached for
 bash tools/install.sh --check           # Version check only
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --next            # Prerelease lane: source build from next
+bash tools/install.sh --ref v1.0        # Install from a specific git ref
-bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
-bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
-
 ## Contributing
 
 ```bash

apps/gateway/src/__tests__/integration/federation-m3-list.integration.test.ts

@@ -1,519 +0,0 @@
-/**
- * Federation M3 single-gateway integration tests (FED-M3-10).
- *
- * Covers MILESTONES.md M3 acceptance:
- *  - #6: malformed certificate OIDs fail with 401; valid cert + revoked grant fails with 403.
- *  - #7: max_rows_per_query caps list results.
- *
- * Strategy:
- *  - Real PostgreSQL via @mosaicstack/db.
- *  - Mocked TLS context/Fastify request shim for FederationAuthGuard.
- *  - Direct controller calls using the real POST /api/federation/v1/list/:resource contract.
- *
- * Run:
- *   FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- \
- *     src/__tests__/integration/federation-m3-list.integration.test.ts
- */
-
-import 'reflect-metadata';
-import * as crypto from 'node:crypto';
-import type { ExecutionContext } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import {
-  and,
-  createDb,
-  eq,
-  federationGrants,
-  federationPeers,
-  inArray,
-  missionTasks,
-  missions,
-  projects,
-  tasks,
-  teamMembers,
-  teams,
-  type Db,
-  type DbHandle,
-  users,
-} from '@mosaicstack/db';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { DB } from '../../database/database.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { FederationAuthGuard } from '../../federation/server/federation-auth.guard.js';
-import { FederationScopeService } from '../../federation/server/scope.service.js';
-import { FederationListQueryService } from '../../federation/server/verbs/list-query.service.js';
-import { ListController } from '../../federation/server/verbs/list.controller.js';
-import {
-  makeMosaicIssuedCert,
-  makeSelfSignedCert,
-} from '../../federation/__tests__/helpers/test-cert.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const PG_URL = process.env['DATABASE_URL'] ?? 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const RUN_ID = `fed-m3-10-${crypto.randomUUID()}`;
-const CERT_SERIAL_HEX = crypto.randomUUID().replace(/-/g, '').toUpperCase();
-
-interface TestIds {
-  readonly subjectUserId: string;
-  readonly otherUserId: string;
-  readonly peerId: string;
-  readonly revokedPeerId: string;
-  readonly activeGrantId: string;
-  readonly revokedGrantId: string;
-  readonly subjectProjectId: string;
-  readonly subjectMissionId: string;
-  readonly otherProjectId: string;
-  readonly teamId: string;
-  readonly unauthorizedTeamId: string;
-  readonly teamProjectId: string;
-  readonly taskIds: readonly string[];
-  readonly excludedTaskIds: readonly string[];
-  readonly subjectNoteId: string;
-  readonly otherUserNoteId: string;
-}
-
-function pemToDer(pem: string): Buffer {
-  return Buffer.from(
-    pem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, ''),
-    'base64',
-  );
-}
-
-function makeFederationRequest(certPem: string): FastifyRequest {
-  return {
-    raw: {
-      socket: {
-        getPeerCertificate: () => ({
-          raw: pemToDer(certPem),
-          serialNumber: CERT_SERIAL_HEX,
-        }),
-      },
-    },
-  } as unknown as FastifyRequest;
-}
-
-function makeGuardContext(request: FastifyRequest): {
-  readonly context: ExecutionContext;
-  readonly sent: { statusCode?: number; payload?: unknown };
-} {
-  const sent: { statusCode?: number; payload?: unknown } = {};
-  const reply = {
-    status: (statusCode: number) => {
-      sent.statusCode = statusCode;
-      return {
-        header: () => ({
-          send: (payload: unknown) => {
-            sent.payload = payload;
-          },
-        }),
-      };
-    },
-  } as unknown as FastifyReply;
-
-  const context = {
-    switchToHttp: () => ({
-      getRequest: () => request,
-      getResponse: () => reply,
-    }),
-  } as unknown as ExecutionContext;
-
-  return { context, sent };
-}
-
-async function insertUser(db: Db, id: string, label: string): Promise<void> {
-  await db.insert(users).values({
-    id,
-    name: `${RUN_ID}-${label}`,
-    email: `${RUN_ID}-${label}@federation-test.invalid`,
-    emailVerified: false,
-  });
-}
-
-async function seedFixtures(db: Db): Promise<TestIds> {
-  const subjectUserId = `${RUN_ID}-subject`;
-  const otherUserId = `${RUN_ID}-other`;
-  const peerId = crypto.randomUUID();
-  const revokedPeerId = crypto.randomUUID();
-  const activeGrantId = crypto.randomUUID();
-  const revokedGrantId = crypto.randomUUID();
-  const subjectProjectId = crypto.randomUUID();
-  const subjectMissionId = crypto.randomUUID();
-  const otherProjectId = crypto.randomUUID();
-  const teamId = crypto.randomUUID();
-  const unauthorizedTeamId = crypto.randomUUID();
-  const teamProjectId = crypto.randomUUID();
-  const taskIds = [crypto.randomUUID(), crypto.randomUUID(), crypto.randomUUID()] as const;
-  const excludedTaskIds = [crypto.randomUUID(), crypto.randomUUID()] as const;
-  const subjectNoteId = crypto.randomUUID();
-  const otherUserNoteId = crypto.randomUUID();
-
-  await insertUser(db, subjectUserId, 'subject');
-  await insertUser(db, otherUserId, 'other');
-
-  await db.insert(teams).values([
-    {
-      id: teamId,
-      name: `${RUN_ID} allowed team`,
-      slug: `${RUN_ID}-allowed-team`,
-      ownerId: subjectUserId,
-      managerId: subjectUserId,
-    },
-    {
-      id: unauthorizedTeamId,
-      name: `${RUN_ID} unauthorized team`,
-      slug: `${RUN_ID}-unauthorized-team`,
-      ownerId: otherUserId,
-      managerId: otherUserId,
-    },
-  ]);
-
-  await db.insert(teamMembers).values([
-    { teamId, userId: subjectUserId, role: 'member' },
-    { teamId: unauthorizedTeamId, userId: subjectUserId, role: 'member' },
-  ]);
-
-  await db.insert(projects).values([
-    {
-      id: subjectProjectId,
-      name: `${RUN_ID} subject personal project`,
-      ownerType: 'user',
-      ownerId: subjectUserId,
-    },
-    {
-      id: otherProjectId,
-      name: `${RUN_ID} other personal project`,
-      ownerType: 'user',
-      ownerId: otherUserId,
-    },
-    {
-      id: teamProjectId,
-      name: `${RUN_ID} unauthorized team project`,
-      ownerType: 'team',
-      teamId: unauthorizedTeamId,
-    },
-  ]);
-
-  await db.insert(missions).values({
-    id: subjectMissionId,
-    name: `${RUN_ID} subject mission`,
-    projectId: subjectProjectId,
-    userId: subjectUserId,
-  });
-
-  await db.insert(tasks).values([
-    {
-      id: taskIds[0],
-      title: `${RUN_ID} visible task 1`,
-      missionId: subjectMissionId,
-      createdAt: new Date('2026-06-25T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:00:00.000Z'),
-    },
-    {
-      id: taskIds[1],
-      title: `${RUN_ID} visible task 2`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T02:00:00.000Z'),
-    },
-    {
-      id: taskIds[2],
-      title: `${RUN_ID} visible task 3`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T01:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[0],
-      title: `${RUN_ID} other user task`,
-      projectId: otherProjectId,
-      createdAt: new Date('2026-06-25T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[1],
-      title: `${RUN_ID} unauthorized team task`,
-      projectId: teamProjectId,
-      createdAt: new Date('2026-06-25T05:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T05:00:00.000Z'),
-    },
-  ]);
-
-  await db.insert(missionTasks).values([
-    {
-      id: subjectNoteId,
-      missionId: subjectMissionId,
-      userId: subjectUserId,
-      notes: `${RUN_ID} subject visible note`,
-      createdAt: new Date('2026-06-25T03:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:30:00.000Z'),
-    },
-    {
-      id: otherUserNoteId,
-      missionId: subjectMissionId,
-      userId: otherUserId,
-      notes: `${RUN_ID} other user note on subject mission`,
-      createdAt: new Date('2026-06-25T04:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:30:00.000Z'),
-    },
-  ]);
-
-  await db.insert(federationPeers).values([
-    {
-      id: peerId,
-      commonName: `${RUN_ID}-active-peer`,
-      displayName: `${RUN_ID} Active Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: CERT_SERIAL_HEX,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-    {
-      id: revokedPeerId,
-      commonName: `${RUN_ID}-revoked-peer`,
-      displayName: `${RUN_ID} Revoked Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `${CERT_SERIAL_HEX}${RUN_ID.replace(/-/g, '').slice(0, 8).toUpperCase()}`,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-  ]);
-
-  await db.insert(federationGrants).values([
-    {
-      id: activeGrantId,
-      peerId,
-      subjectUserId,
-      status: 'active',
-      scope: {
-        resources: ['tasks', 'notes'],
-        excluded_resources: [],
-        filters: {
-          tasks: { include_personal: true, include_teams: [] },
-          notes: { include_personal: true, include_teams: [] },
-        },
-        max_rows_per_query: 2,
-      },
-    },
-    {
-      id: revokedGrantId,
-      peerId,
-      subjectUserId,
-      status: 'revoked',
-      revokedAt: new Date(),
-      revokedReason: `${RUN_ID} revoked grant fixture`,
-      scope: {
-        resources: ['tasks'],
-        excluded_resources: [],
-        max_rows_per_query: 2,
-      },
-    },
-  ]);
-
-  return {
-    subjectUserId,
-    otherUserId,
-    peerId,
-    revokedPeerId,
-    activeGrantId,
-    revokedGrantId,
-    subjectProjectId,
-    subjectMissionId,
-    otherProjectId,
-    teamId,
-    unauthorizedTeamId,
-    teamProjectId,
-    taskIds,
-    excludedTaskIds,
-    subjectNoteId,
-    otherUserNoteId,
-  };
-}
-
-async function cleanupFixtures(db: Db, ids: TestIds | undefined): Promise<void> {
-  if (!ids) {
-    return;
-  }
-
-  await db
-    .delete(missionTasks)
-    .where(inArray(missionTasks.id, [ids.subjectNoteId, ids.otherUserNoteId]))
-    .catch(() => {});
-  await db
-    .delete(tasks)
-    .where(inArray(tasks.id, [...ids.taskIds, ...ids.excludedTaskIds]))
-    .catch(() => {});
-  await db
-    .delete(missions)
-    .where(eq(missions.id, ids.subjectMissionId))
-    .catch(() => {});
-  await db
-    .delete(projects)
-    .where(inArray(projects.id, [ids.subjectProjectId, ids.otherProjectId, ids.teamProjectId]))
-    .catch(() => {});
-  await db
-    .delete(teamMembers)
-    .where(
-      and(
-        eq(teamMembers.userId, ids.subjectUserId),
-        inArray(teamMembers.teamId, [ids.teamId, ids.unauthorizedTeamId]),
-      ),
-    )
-    .catch(() => {});
-  await db
-    .delete(teams)
-    .where(inArray(teams.id, [ids.teamId, ids.unauthorizedTeamId]))
-    .catch(() => {});
-  await db
-    .delete(federationGrants)
-    .where(inArray(federationGrants.id, [ids.activeGrantId, ids.revokedGrantId]))
-    .catch(() => {});
-  await db
-    .delete(federationPeers)
-    .where(inArray(federationPeers.id, [ids.peerId, ids.revokedPeerId]))
-    .catch(() => {});
-  await db
-    .delete(users)
-    .where(inArray(users.id, [ids.subjectUserId, ids.otherUserId]))
-    .catch(() => {});
-}
-
-describe.skipIf(!run)('federation M3 list verb — single-gateway integration', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let moduleRef: TestingModule;
-  let guard: FederationAuthGuard;
-  let listController: ListController;
-  let ids: TestIds | undefined;
-
-  beforeAll(async () => {
-    handle = createDb(PG_URL);
-    db = handle.db;
-    ids = await seedFixtures(db);
-
-    moduleRef = await Test.createTestingModule({
-      controllers: [ListController],
-      providers: [
-        { provide: DB, useValue: db },
-        GrantsService,
-        FederationAuthGuard,
-        FederationScopeService,
-        FederationListQueryService,
-      ],
-    }).compile();
-
-    guard = moduleRef.get(FederationAuthGuard);
-    listController = moduleRef.get(ListController);
-  }, 30_000);
-
-  afterAll(async () => {
-    await moduleRef?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await cleanupFixtures(db, ids).catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await handle?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-  });
-
-  it('#6 — rejects a client cert with malformed/missing Mosaic OIDs with 401', async () => {
-    const malformedOidCert = await makeSelfSignedCert();
-    const request = makeFederationRequest(malformedOidCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(401);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'unauthorized',
-        message: expect.stringContaining('missing required OID'),
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#6 — rejects a valid client cert when its grant is revoked with 403', async () => {
-    expect(ids).toBeDefined();
-    const revokedCert = await makeMosaicIssuedCert({
-      grantId: ids!.revokedGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(revokedCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(403);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'forbidden',
-        message: 'Federation access denied',
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#7 — enforces max_rows_per_query on POST /api/federation/v1/list/:resource', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('tasks', request, { limit: 100 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(response.items).toHaveLength(2);
-    expect(response._truncated).toBe(true);
-    expect(response.nextCursor).toEqual(expect.any(String));
-    expect(returnedIds).toEqual([ids!.taskIds[0], ids!.taskIds[1]]);
-    expect(returnedIds).not.toContain(ids!.taskIds[2]);
-    for (const excludedId of ids!.excludedTaskIds) {
-      expect(returnedIds).not.toContain(excludedId);
-    }
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('excludes another user mission task notes on the same authorized mission', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('notes', request, { limit: 10 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(returnedIds).toEqual([ids!.subjectNoteId]);
-    expect(returnedIds).not.toContain(ids!.otherUserNoteId);
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('fails closed for unsupported list resources', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    await expect(listController.list('widgets', request, {})).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is not supported',
-        },
-      },
-      status: 403,
-    });
-  });
-});

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -7,7 +7,7 @@ import {
 } from '@mosaicstack/discord-plugin';
 import { InteractionController } from '../../agent/interaction.controller.js';
 import { RuntimeProviderService } from '../../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../../agent/durable-session.service.js';
+import { TessDurableSessionService } from '../../agent/tess-durable-session.service.js';
 import { ChatGateway } from '../../chat/chat.gateway.js';
 import { CommandAuthorizationService } from '../../commands/command-authorization.service.js';
 
@@ -51,7 +51,7 @@ function authorization(): CommandAuthorizationService {
   );
 }
 
-describe('interaction Discord/CLI durable-session integration', () => {
+describe('Tess Discord/CLI durable-session integration', () => {
   afterEach(() => {
     for (const key of envKeys) {
       const value = priorEnv.get(key);
@@ -72,7 +72,6 @@ describe('interaction Discord/CLI durable-session integration', () => {
     process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
       {
         instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
         guildId: 'guild-1',
         channelId: 'channel-1',
         pairedUsers: {
@@ -81,7 +80,7 @@ describe('interaction Discord/CLI durable-session integration', () => {
       },
     ]);
 
-    const durable = new DurableSessionService(
+    const durable = new TessDurableSessionService(
       new InMemoryDurableSessionStore() as never,
       {} as never,
     );
@@ -134,7 +133,6 @@ describe('interaction Discord/CLI durable-session integration', () => {
       interactionBindings: [
         {
           instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
           guildId: 'guild-1',
           channelId: 'channel-1',
           pairedUsers: {

apps/gateway/src/admin/admin-health.controller.ts

@@ -1,11 +1,9 @@
-import { Controller, Get, Inject, Optional, UseGuards } from '@nestjs/common';
+import { Controller, Get, Inject, UseGuards } from '@nestjs/common';
 import { sql, type Db } from '@mosaicstack/db';
 import { createQueue } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { DB } from '../database/database.module.js';
 import { AgentService } from '../agent/agent.service.js';
 import { ProviderService } from '../agent/provider.service.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { AdminGuard } from './admin.guard.js';
 import type { HealthStatusDto, ServiceStatusDto } from './admin.dto.js';
 
@@ -16,9 +14,6 @@ export class AdminHealthController {
     @Inject(DB) private readonly db: Db,
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(ProviderService) private readonly providerService: ProviderService,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
   ) {}
 
   @Get()
@@ -60,14 +55,6 @@ export class AdminHealthController {
   }
 
   private async checkCache(): Promise<ServiceStatusDto> {
-    // On Local tier there is no Redis. The cache is intentionally absent, which
-    // is a healthy state for this tier — report 'ok' rather than opening a new
-    // ioredis connection on every admin health check (which would spam
-    // ECONNREFUSED and create/destroy a connection per request). latencyMs 0
-    // signals "no cache backend to measure" for this tier.
-    if (this.mosaicConfig?.queue?.type === 'local') {
-      return { status: 'ok', latencyMs: 0 };
-    }
     const start = Date.now();
     const handle = createQueue();
     try {

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -12,24 +12,18 @@ type AgentServiceInternals = {
   creating: Map<string, Promise<AgentSession>>;
 };
 
-function makeService(operatorMemory: unknown = null): AgentService {
+function makeService(): AgentService {
   return new AgentService(
-    {
+    {} as never,
-      getDefaultModel: vi.fn(() => null),
-      getRegistry: vi.fn(() => ({})),
-      findModel: vi.fn(),
-      listAvailableModels: vi.fn(() => []),
-    } as never,
     {} as never,
     {} as never,
     { available: false } as never,
     {} as never,
-    { getToolDefinitions: vi.fn(() => []) } as never,
+    {} as never,
-    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
+    {} as never,
     null,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
-    operatorMemory as never,
   );
 }
 
@@ -115,18 +109,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     await service.prompt(CONVERSATION_ID, 'owner prompt', OWNER_SCOPE);
     expect(session.piSession.prompt).toHaveBeenCalledWith('owner prompt');
-    await service.prompt(CONVERSATION_ID, '', OWNER_SCOPE, [
-      {
-        id: 'attachment-001',
-        name: 'diagram.png',
-        url: 'https://cdn.example.test/diagram.png',
-        mimeType: 'image/png',
-      },
-    ]);
-    expect(session.piSession.prompt).toHaveBeenLastCalledWith(
-      '\n\n[Untrusted channel attachments]\n' +
-        '{"id":"attachment-001","name":"diagram.png","mimeType":"image/png","url":"https://cdn.example.test/diagram.png"}',
-    );
 
     await expect(service.destroySession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
       ForbiddenException,
@@ -138,37 +120,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     expect(internals(service).sessions.has(CONVERSATION_ID)).toBe(false);
   });
 
-  it('derives the operator-memory scope on the createSession production path', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox').mockReturnValue([]);
-
-    // Session construction reaches the real scope derivation before the intentionally incomplete
-    // Pi test double rejects later in createAgentSession.
-    await service.createSession(CONVERSATION_ID, OWNER_SCOPE).catch(() => undefined);
-
-    expect(buildTools).toHaveBeenCalledWith(expect.any(String), OWNER_SCOPE.userId, {
-      tenantId: OWNER_SCOPE.tenantId,
-      ownerId: OWNER_SCOPE.userId,
-      sessionId: CONVERSATION_ID,
-    });
-  });
-
-  it('denies a foreign actor before it can obtain another session operator-memory scope', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    internals(service).sessions.set(CONVERSATION_ID, makeSession());
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox');
-
-    await expect(service.createSession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
-      ForbiddenException,
-    );
-
-    expect(buildTools).not.toHaveBeenCalled();
-    expect(plugin.capture).not.toHaveBeenCalled();
-    expect(plugin.search).not.toHaveBeenCalled();
-  });
-
   it('checks owner/tenant scope before returning an in-flight session creation', async () => {
     const service = makeService();
     const session = makeSession();

apps/gateway/src/agent/agent.module.ts

@@ -1,5 +1,5 @@
 import { Global, Module } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry, HermesRuntimeProvider } from '@mosaicstack/agent';
+import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
 import { AgentService } from './agent.service.js';
 import { ProviderService } from './provider.service.js';
 import { ProviderCredentialsService } from './provider-credentials.service.js';
@@ -11,8 +11,8 @@ import { SessionsController } from './sessions.controller.js';
 import { AgentConfigsController } from './agent-configs.controller.js';
 import { InteractionController } from './interaction.controller.js';
 import { RoutingController } from './routing/routing.controller.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
+import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
+import { TessDurableSessionService } from './tess-durable-session.service.js';
 import { CoordModule } from '../coord/coord.module.js';
 import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { SkillsModule } from '../skills/skills.module.js';
@@ -20,13 +20,6 @@ import { GCModule } from '../gc/gc.module.js';
 import { LogModule } from '../log/log.module.js';
 import { CommandsModule } from '../commands/commands.module.js';
 import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  DenyConnectorLeasePolicy,
-} from './connector-lease.service.js';
 import {
   AGENT_RUNTIME_PROVIDER_REGISTRY,
   RUNTIME_APPROVAL_VERIFIER,
@@ -35,12 +28,6 @@ import {
   RuntimeProviderService,
 } from './runtime-provider-registry.service.js';
 
-export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegistry {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(new HermesRuntimeProvider(new GatewayHermesRuntimeTransport()));
-  return registry;
-}
-
 @Global()
 @Module({
   imports: [CoordModule, McpClientModule, SkillsModule, GCModule, LogModule, CommandsModule],
@@ -50,18 +37,11 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionRepository,
+    TessDurableSessionRepository,
-    DurableSessionService,
+    TessDurableSessionService,
-    ConnectorLeaseRepository,
-    DenyConnectorLeasePolicy,
-    {
-      provide: CONNECTOR_LEASE_POLICY,
-      useExisting: DenyConnectorLeasePolicy,
-    },
-    ConnectorLeaseService,
     {
       provide: AGENT_RUNTIME_PROVIDER_REGISTRY,
-      useFactory: createGatewayRuntimeProviderRegistry,
+      useFactory: (): AgentRuntimeProviderRegistry => new AgentRuntimeProviderRegistry(),
     },
     RuntimeProviderAuditService,
     {
@@ -89,9 +69,8 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionService,
+    TessDurableSessionService,
     RuntimeProviderService,
-    ConnectorLeaseService,
     AGENT_RUNTIME_PROVIDER_REGISTRY,
   ],
 })

apps/gateway/src/agent/agent.service.ts

@@ -15,11 +15,9 @@ import {
   type ToolDefinition,
 } from '@mariozechner/pi-coding-agent';
 import type { Brain } from '@mosaicstack/brain';
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
+import type { Memory } from '@mosaicstack/memory';
-import type { Memory, OperatorMemoryPlugin } from '@mosaicstack/memory';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
-import { OPERATOR_MEMORY_PLUGIN } from '../memory/memory.module.js';
 import { EmbeddingService } from '../memory/embedding.service.js';
 import { CoordService } from '../coord/coord.service.js';
 import { ProviderService } from './provider.service.js';
@@ -44,8 +42,6 @@ export interface ConversationHistoryMessage {
   role: 'user' | 'assistant' | 'system';
   content: string;
   createdAt: Date;
-  /** Validated, URI-referenced channel attachments preserved on session resume. */
-  attachments?: readonly ChannelAttachmentDto[];
 }
 
 export interface AgentSessionOptions {
@@ -139,9 +135,6 @@ export class AgentService implements OnModuleDestroy {
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
     @Inject(SessionGCService) private readonly gc: SessionGCService,
-    @Optional()
-    @Inject(OPERATOR_MEMORY_PLUGIN)
-    private readonly operatorMemory: OperatorMemoryPlugin | null = null,
   ) {}
 
   /**
@@ -153,7 +146,6 @@ export class AgentService implements OnModuleDestroy {
   private buildToolsForSandbox(
     sandboxDir: string,
     sessionUserId: string | undefined,
-    sessionScope?: { tenantId: string; ownerId: string; sessionId: string },
   ): ToolDefinition[] {
     return [
       ...createBrainTools(this.brain),
@@ -162,9 +154,6 @@ export class AgentService implements OnModuleDestroy {
         this.memory,
         this.embeddingService.available ? this.embeddingService : null,
         sessionUserId,
-        this.operatorMemory && sessionScope
-          ? { plugin: this.operatorMemory, scope: sessionScope }
-          : undefined,
       ),
       ...createFileTools(sandboxDir),
       ...createGitTools(sandboxDir),
@@ -239,7 +228,6 @@ export class AgentService implements OnModuleDestroy {
           isAdmin: options.isAdmin,
           agentConfigId: options.agentConfigId,
           userId: options.userId,
-          tenantId: options.tenantId,
           conversationHistory: options.conversationHistory,
         };
         this.logger.log(
@@ -279,15 +267,7 @@ export class AgentService implements OnModuleDestroy {
     }
 
     // Build per-session tools scoped to the sandbox directory and authenticated user
-    const sessionUserId = mergedOptions?.userId;
+    const sandboxTools = this.buildToolsForSandbox(sandboxDir, mergedOptions?.userId);
-    const sessionTenantId = this.tenantIdFor(sessionUserId, mergedOptions?.tenantId);
-    const sandboxTools = this.buildToolsForSandbox(
-      sandboxDir,
-      sessionUserId,
-      sessionUserId && sessionTenantId
-        ? { tenantId: sessionTenantId, ownerId: sessionUserId, sessionId }
-        : undefined,
-    );
 
     // Combine static tools with dynamically discovered MCP client tools and skill tools
     const mcpTools = this.mcpClientService.getToolDefinitions();
@@ -382,7 +362,7 @@ export class AgentService implements OnModuleDestroy {
       sandboxDir,
       allowedTools,
       userId: mergedOptions?.userId,
-      tenantId: sessionTenantId,
+      tenantId: this.tenantIdFor(mergedOptions?.userId, mergedOptions?.tenantId),
       agentConfigId: mergedOptions?.agentConfigId,
       agentName: resolvedAgentName,
       metrics: {
@@ -431,7 +411,7 @@ export class AgentService implements OnModuleDestroy {
     const formatMessage = (msg: ConversationHistoryMessage): string => {
       const roleLabel =
         msg.role === 'user' ? 'User' : msg.role === 'assistant' ? 'Assistant' : 'System';
-      return `**${roleLabel}:** ${msg.content}${this.attachmentContext(msg.attachments ?? [])}`;
+      return `**${roleLabel}:** ${msg.content}`;
     };
 
     const formatted = history.map((msg) => formatMessage(msg));
@@ -490,21 +470,6 @@ export class AgentService implements OnModuleDestroy {
     return result;
   }
 
-  private attachmentContext(attachments: readonly ChannelAttachmentDto[]): string {
-    if (attachments.length === 0) return '';
-    return `\n\n[Untrusted channel attachments]\n${attachments
-      .map((attachment: ChannelAttachmentDto): string =>
-        JSON.stringify({
-          id: attachment.id,
-          name: attachment.name,
-          mimeType: attachment.mimeType,
-          url: attachment.url,
-          ...(attachment.sizeBytes !== undefined ? { sizeBytes: attachment.sizeBytes } : {}),
-        }),
-      )
-      .join('\n')}`;
-  }
-
   private resolveModel(options?: AgentSessionOptions) {
     if (!options?.provider && !options?.modelId) {
       return this.providerService.getDefaultModel() ?? null;
@@ -691,19 +656,7 @@ export class AgentService implements OnModuleDestroy {
     session.channels.delete(channel);
   }
 
-  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void>;
+  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void> {
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] | undefined,
-  ): Promise<void>;
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] = [],
-  ): Promise<void> {
     const session = this.sessions.get(sessionId);
     if (!session) {
       throw new Error(`No agent session found: ${sessionId}`);
@@ -711,16 +664,12 @@ export class AgentService implements OnModuleDestroy {
     this.assertSessionScope(session, scope);
     session.promptCount += 1;
 
-    // Channel attachments are untrusted URI references. Preserve exact,
-    // authenticated metadata for the agent without treating it as authority.
-    const attachmentContext = this.attachmentContext(attachments);
-
     // Prepend session-scoped system override if present (renew TTL on each turn)
-    let effectiveMessage = `${message}${attachmentContext}`;
+    let effectiveMessage = message;
     if (this.systemOverride) {
       const override = await this.systemOverride.get(sessionId, scope);
       if (override) {
-        effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
+        effectiveMessage = `[System Override]\n${override}\n\n${message}`;
         await this.systemOverride.renew(sessionId, scope);
         this.logger.debug(`Applied system override for session ${sessionId}`);
       }

apps/gateway/src/agent/connector-lease.integration.test.ts

@@ -1,341 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Test, type TestingModule } from '@nestjs/testing';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { ConnectorExecutionContext, FencedConnectorAdapter } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  type ConnectorLeasePolicy,
-  type ConnectorLeasePolicySubject,
-} from './connector-lease.service.js';
-
-const authorize = vi.fn().mockResolvedValue(true);
-const policy: ConnectorLeasePolicy = { authorize };
-const context = {
-  actorScope: { userId: 'operator-a', tenantId: 'tenant-a' },
-  correlationId: 'correlation-acquire',
-};
-
-describe('gateway connector lease fencing integration', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let moduleRef: TestingModule;
-  let service: ConnectorLeaseService;
-  let repository: ConnectorLeaseRepository;
-
-  beforeAll(async (): Promise<void> => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-07-14T17:00:00.000Z'));
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    moduleRef = await Test.createTestingModule({
-      providers: [
-        ConnectorLeaseRepository,
-        ConnectorLeaseService,
-        { provide: DB, useValue: handle.db },
-        { provide: CONNECTOR_LEASE_POLICY, useValue: policy },
-      ],
-    }).compile();
-    service = moduleRef.get(ConnectorLeaseService);
-    repository = moduleRef.get(ConnectorLeaseRepository);
-  });
-
-  afterAll(async (): Promise<void> => {
-    vi.useRealTimers();
-    await moduleRef.close();
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('derives tenant authority at the gateway and validates a grant before side effects', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'Mos',
-        bindingId: 'operator-chat',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      context,
-    );
-    const grant = await service.issueGrant(
-      { lease, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-grant' },
-    );
-    const execute = vi.fn(async (_message: string, leaseContext: ConnectorExecutionContext) => {
-      return leaseContext.leaseEpoch;
-    });
-    const adapter: FencedConnectorAdapter<string, string> = { execute };
-
-    await expect(service.executeGrant(grant, 'runtime.send', 'hello', adapter)).resolves.toBe('1');
-    expect(execute).toHaveBeenCalledOnce();
-    expect(authorize).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        requestedScopes: ['runtime.send'],
-        requestedTtlMs: 30_000,
-      }),
-    );
-    expect(execute.mock.calls[0]?.[1]).toMatchObject({
-      identity: { tenantId: 'tenant-a', logicalAgentId: 'mos' },
-      bindingId: 'operator-chat',
-      connectorId: 'pi-worker-a',
-    });
-  });
-
-  it('normalizes lease-derived policy subjects before authorization', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-policy-setup' },
-    );
-    const aliasedLease = {
-      ...lease,
-      identity: { ...lease.identity, logicalAgentId: ' MOS ' },
-      bindingId: ' Operator-Chat-Policy ',
-      connectorId: ' PI-Worker-A ',
-      scopes: [' Runtime.Send '],
-      leaseEpoch: `00${lease.leaseEpoch}`,
-    };
-
-    await service.heartbeat(aliasedLease, 30_000, {
-      ...context,
-      correlationId: 'correlation-policy-heartbeat',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.heartbeat',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.issueGrant(
-      { lease: aliasedLease, scopes: [' Runtime.Send '], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-policy-grant' },
-    );
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.release(aliasedLease, {
-      ...context,
-      correlationId: 'correlation-policy-release',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.release',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-  });
-
-  it('denies stale, forged, expired, cross-tenant, and cross-binding grants before effects', async (): Promise<void> => {
-    const bindingId = 'operator-chat-denials';
-    const current = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-denial-setup' },
-    );
-    const stale = await service.issueGrant(
-      { lease: current, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-stale' },
-    );
-    await service.takeover(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-b',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-        expectedEpoch: current.leaseEpoch,
-      },
-      { ...context, correlationId: 'correlation-takeover' },
-    );
-    const adapter = { execute: vi.fn().mockResolvedValue(undefined) };
-
-    await expect(service.executeGrant(stale, 'runtime.send', undefined, adapter)).rejects.toThrow();
-
-    const active = await service.current('mos', bindingId, context);
-    if (!active) throw new Error('active lease fixture is unavailable');
-    const grant = await service.issueGrant(
-      { lease: active, scopes: ['runtime.send'], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-active' },
-    );
-    await expect(
-      service.executeGrant({ ...grant }, 'runtime.send', undefined, adapter),
-    ).rejects.toThrow();
-    await expect(
-      service.executeGrant(
-        { ...grant, bindingId: 'other-binding' },
-        'runtime.send',
-        undefined,
-        adapter,
-      ),
-    ).rejects.toThrow();
-    await expect(
-      service.issueGrant(
-        { lease: active, scopes: ['runtime.send'], ttlMs: 30_000 },
-        {
-          actorScope: { userId: 'operator-b', tenantId: 'tenant-b' },
-          correlationId: 'correlation-cross-tenant',
-        },
-      ),
-    ).rejects.toThrow();
-    const crossTenantAudit = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-cross-tenant'));
-    expect(crossTenantAudit).toHaveLength(1);
-    expect(crossTenantAudit[0]).toMatchObject({
-      tenantId: 'tenant-b',
-      logicalAgentId: 'untrusted',
-      bindingId: 'untrusted',
-      connectorId: 'untrusted',
-      reason: 'policy_denied',
-    });
-
-    vi.setSystemTime(new Date('2026-07-14T17:00:02.000Z'));
-    await expect(service.executeGrant(grant, 'runtime.send', undefined, adapter)).rejects.toThrow();
-    expect(adapter.execute).not.toHaveBeenCalled();
-  });
-
-  it('rejects submitted lifecycle scopes that differ from durable authority before policy or mutation', async (): Promise<void> => {
-    authorize.mockResolvedValue(true);
-    const heartbeatLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-heartbeat-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-heartbeat-scope-setup' },
-    );
-    const releaseLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-release-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-release-scope-setup' },
-    );
-    const forgedHeartbeat = { ...heartbeatLease, scopes: ['tool.execute'] };
-    const forgedRelease = { ...releaseLease, scopes: ['tool.execute'] };
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'tool.execute';
-    });
-    authorize.mockClear();
-
-    await expect(
-      service.heartbeat(forgedHeartbeat, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    await expect(
-      service.release(forgedRelease, {
-        ...context,
-        correlationId: 'correlation-release-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    expect(authorize).not.toHaveBeenCalled();
-
-    const currentHeartbeat = await repository.findCurrent({
-      identity: heartbeatLease.identity,
-      bindingId: heartbeatLease.bindingId,
-    });
-    const currentRelease = await repository.findCurrent({
-      identity: releaseLease.identity,
-      bindingId: releaseLease.bindingId,
-    });
-    expect(currentHeartbeat).toMatchObject({
-      leaseId: heartbeatLease.leaseId,
-      scopes: ['runtime.send'],
-      heartbeatAt: heartbeatLease.heartbeatAt,
-      expiresAt: heartbeatLease.expiresAt,
-    });
-    expect(currentRelease).toMatchObject({
-      leaseId: releaseLease.leaseId,
-      scopes: ['runtime.send'],
-    });
-    expect(currentRelease?.releasedAt).toBeUndefined();
-
-    const forgedAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-heartbeat-scope-forgery'));
-    expect(forgedAudits).toHaveLength(1);
-    expect(forgedAudits[0]).toMatchObject({
-      bindingId: heartbeatLease.bindingId,
-      connectorId: heartbeatLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-    const forgedReleaseAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-release-scope-forgery'));
-    expect(forgedReleaseAudits).toHaveLength(1);
-    expect(forgedReleaseAudits[0]).toMatchObject({
-      bindingId: releaseLease.bindingId,
-      connectorId: releaseLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'runtime.send';
-    });
-    await expect(
-      service.heartbeat(heartbeatLease, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-canonical',
-      }),
-    ).resolves.toMatchObject({ scopes: ['runtime.send'] });
-    await expect(
-      service.release(releaseLease, {
-        ...context,
-        correlationId: 'correlation-release-scope-canonical',
-      }),
-    ).resolves.toBeUndefined();
-  });
-});

apps/gateway/src/agent/connector-lease.postgres.integration.test.ts

@@ -1,76 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createDb,
-  eq,
-  logicalAgentConnectorLeases,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const hasPostgres = Boolean(process.env['DATABASE_URL']);
-const tenantId = `lease-test-${randomUUID()}`;
-const identity = { tenantId, logicalAgentId: 'mos' } as const;
-
-describe.skipIf(!hasPostgres)('ConnectorLeaseRepository real PostgreSQL integration', (): void => {
-  let handle: DbHandle;
-
-  beforeAll((): void => {
-    handle = createDb(process.env['DATABASE_URL']);
-  });
-
-  afterAll(async (): Promise<void> => {
-    if (!handle) return;
-    await handle.db
-      .delete(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, tenantId));
-    await handle.db
-      .delete(logicalAgentConnectorLeases)
-      .where(eq(logicalAgentConnectorLeases.tenantId, tenantId));
-    await handle.close();
-  });
-
-  it('preserves the exclusive CAS fence across a real pool close/reopen', async (): Promise<void> => {
-    const command = {
-      identity,
-      bindingId: 'operator-chat',
-      scopes: ['runtime.send'],
-      ttlMs: 60_000,
-    } as const;
-    const firstCoordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const contenders = await Promise.allSettled([
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-a',
-        correlationId: 'postgres-acquire-a',
-      }),
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-b',
-        correlationId: 'postgres-acquire-b',
-      }),
-    ]);
-    const acquired = contenders.find((result) => result.status === 'fulfilled');
-    if (!acquired || acquired.status !== 'fulfilled') throw new Error('no lease contender won');
-    expect(contenders.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-
-    await handle.close();
-    handle = createDb(process.env['DATABASE_URL']);
-    const reopened = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const persisted = await reopened.current({ identity, bindingId: 'operator-chat' });
-    expect(persisted).toMatchObject({
-      leaseId: acquired.value.leaseId,
-      leaseEpoch: '1',
-    });
-
-    const takeover = await reopened.takeover({
-      ...command,
-      connectorId: 'connector-c',
-      correlationId: 'postgres-takeover',
-      expectedEpoch: acquired.value.leaseEpoch,
-    });
-    expect(takeover).toMatchObject({ connectorId: 'connector-c', leaseEpoch: '2' });
-  });
-});

apps/gateway/src/agent/connector-lease.repository.test.ts

@@ -1,149 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator, ConnectorLeaseError } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const identity = { tenantId: 'tenant-a', logicalAgentId: 'mos' } as const;
-
-function acquireCommand(connectorId: string, correlationId: string) {
-  return {
-    identity,
-    bindingId: 'operator-chat',
-    connectorId,
-    scopes: ['runtime.send', 'tool.execute'],
-    ttlMs: 60_000,
-    correlationId,
-  };
-}
-
-describe('ConnectorLeaseRepository PostgreSQL semantics', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let now: Date;
-  let coordinator: ConnectorLeaseCoordinator;
-
-  beforeEach(async (): Promise<void> => {
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    now = new Date('2026-07-14T17:00:00.000Z');
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-  });
-
-  afterEach(async (): Promise<void> => {
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('allows only one concurrent contender to acquire a binding', async (): Promise<void> => {
-    const outcomes = await Promise.allSettled([
-      coordinator.acquire(acquireCommand('connector-a', 'correlation-a')),
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-b')),
-    ]);
-
-    expect(outcomes.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    const rejected = outcomes.find((result) => result.status === 'rejected');
-    expect(rejected).toMatchObject({
-      reason: { code: 'lease_held' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('uses compare-and-swap takeover and increments the fencing epoch monotonically', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    const results = await Promise.allSettled([
-      coordinator.takeover({
-        ...acquireCommand('connector-b', 'correlation-b'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-      coordinator.takeover({
-        ...acquireCommand('connector-c', 'correlation-c'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-    ]);
-    const winner = results.find((result) => result.status === 'fulfilled');
-
-    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    expect(winner?.status === 'fulfilled' ? winner.value.leaseEpoch : null).toBe('2');
-    expect(results.find((result) => result.status === 'rejected')).toMatchObject({
-      reason: { code: 'cas_mismatch' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('heartbeats and releases only the current connector epoch', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    now = new Date('2026-07-14T17:00:30.000Z');
-    const renewed = await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 120_000,
-      correlationId: 'correlation-renew',
-    });
-    expect(renewed.expiresAt).toBe('2026-07-14T17:02:30.000Z');
-
-    await coordinator.release({ lease: renewed, correlationId: 'correlation-release' });
-    await expect(
-      coordinator.heartbeat({
-        lease: renewed,
-        ttlMs: 120_000,
-        correlationId: 'correlation-stale',
-      }),
-    ).rejects.toMatchObject({ code: 'lease_released' } satisfies Partial<ConnectorLeaseError>);
-  });
-
-  it('survives close/reopen and requires CAS takeover to recover an expired lease', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await handle.close();
-
-    now = new Date('2026-07-14T17:02:00.000Z');
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-plain-acquire')),
-    ).rejects.toMatchObject({ code: 'takeover_required' } satisfies Partial<ConnectorLeaseError>);
-    const recovered = await coordinator.takeover({
-      ...acquireCommand('connector-b', 'correlation-takeover'),
-      expectedEpoch: acquired.leaseEpoch,
-    });
-    expect(recovered).toMatchObject({ connectorId: 'connector-b', leaseEpoch: '2' });
-  });
-
-  it('writes credential-safe lifecycle and rejection audit records', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 60_000,
-      correlationId: 'correlation-renew',
-    });
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-reject')),
-    ).rejects.toBeInstanceOf(ConnectorLeaseError);
-
-    const rows = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, identity.tenantId));
-    expect(rows.map((row) => row.event)).toEqual(
-      expect.arrayContaining(['acquire', 'renew', 'reject']),
-    );
-    const serialized = JSON.stringify(rows, (_key: string, value: unknown): unknown =>
-      typeof value === 'bigint' ? value.toString(10) : value,
-    );
-    expect(serialized).not.toContain('tool.execute');
-    expect(serialized).not.toContain('runtime.send');
-    expect(serialized).not.toMatch(/token|secret|credential/i);
-  });
-});

apps/gateway/src/agent/connector-lease.repository.ts

@@ -1,354 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  connectorLeaseAuditLog,
-  eq,
-  gt,
-  isNull,
-  logicalAgentConnectorLeases,
-  sql,
-  type Db,
-} from '@mosaicstack/db';
-import { ConnectorLeaseError } from '@mosaicstack/agent';
-import type {
-  ConnectorLease,
-  ConnectorLeaseAcquireMutation,
-  ConnectorLeaseAuditEvent,
-  ConnectorLeaseHeartbeatMutation,
-  ConnectorLeaseRejectReason,
-  ConnectorLeaseReleaseMutation,
-  ConnectorLeaseStore,
-  ConnectorLeaseTakeoverMutation,
-  LogicalAgentBinding,
-} from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-
-interface SuccessfulMutation {
-  readonly ok: true;
-  readonly lease: ConnectorLease;
-}
-
-interface FailedMutation {
-  readonly ok: false;
-  readonly reason: ConnectorLeaseRejectReason;
-}
-
-type MutationResult = SuccessfulMutation | FailedMutation;
-
-@Injectable()
-export class ConnectorLeaseRepository implements ConnectorLeaseStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async acquire(input: ConnectorLeaseAcquireMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const inserted = await tx
-          .insert(logicalAgentConnectorLeases)
-          .values({
-            leaseId: input.leaseId,
-            tenantId: input.identity.tenantId,
-            logicalAgentId: input.identity.logicalAgentId,
-            bindingId: input.bindingId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: 1n,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .onConflictDoNothing()
-          .returning();
-        const row = inserted[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'acquire'));
-          return { ok: true, lease };
-        }
-
-        const current = await findRow(tx, input);
-        if (current && current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const reason: ConnectorLeaseRejectReason =
-          current && (current.releasedAt || current.expiresAt <= new Date(input.now))
-            ? 'takeover_required'
-            : 'lease_held';
-        await insertAudit(tx, rejectionAudit(input, current ? toLease(current) : null, reason));
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async takeover(input: ConnectorLeaseTakeoverMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const current = await findRow(tx, input);
-        if (!current || current.leaseEpoch.toString(10) !== input.expectedEpoch) {
-          await insertAudit(
-            tx,
-            rejectionAudit(input, current ? toLease(current) : null, 'cas_mismatch'),
-          );
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        if (current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            leaseId: input.leaseId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: sql`${logicalAgentConnectorLeases.leaseEpoch} + 1`,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            releasedAt: null,
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input),
-              eq(logicalAgentConnectorLeases.leaseId, current.leaseId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.expectedEpoch)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (!row) {
-          await insertAudit(tx, rejectionAudit(input, toLease(current), 'cas_mismatch'));
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        const lease = toLease(row);
-        await insertAudit(tx, lifecycleAudit(input, lease, 'takeover'));
-        return { ok: true, lease };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async heartbeat(input: ConnectorLeaseHeartbeatMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'renew'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async release(input: ConnectorLeaseReleaseMutation): Promise<void> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            releasedAt: new Date(input.now),
-            expiresAt: new Date(input.now),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'release'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    unwrap(result);
-  }
-
-  async findCurrent(binding: LogicalAgentBinding): Promise<ConnectorLease | null> {
-    const row = await findRow(this.db, binding);
-    return row ? toLease(row) : null;
-  }
-
-  async recordAudit(event: ConnectorLeaseAuditEvent): Promise<void> {
-    await insertAudit(this.db, event);
-  }
-}
-
-function unwrap(result: MutationResult): ConnectorLease {
-  if (!result.ok) throw new ConnectorLeaseError(result.reason, safeErrorMessage(result.reason));
-  return result.lease;
-}
-
-function safeErrorMessage(reason: ConnectorLeaseRejectReason): string {
-  return `Connector lease mutation denied: ${reason}`;
-}
-
-function bindingPredicate(binding: LogicalAgentBinding) {
-  return and(
-    eq(logicalAgentConnectorLeases.tenantId, binding.identity.tenantId),
-    eq(logicalAgentConnectorLeases.logicalAgentId, binding.identity.logicalAgentId),
-    eq(logicalAgentConnectorLeases.bindingId, binding.bindingId),
-  );
-}
-
-async function findRow(
-  db: Pick<Db, 'select'>,
-  binding: LogicalAgentBinding,
-): Promise<typeof logicalAgentConnectorLeases.$inferSelect | null> {
-  const rows = await db
-    .select()
-    .from(logicalAgentConnectorLeases)
-    .where(bindingPredicate(binding))
-    .limit(1);
-  return rows[0] ?? null;
-}
-
-function toLease(row: typeof logicalAgentConnectorLeases.$inferSelect): ConnectorLease {
-  return Object.freeze({
-    identity: Object.freeze({ tenantId: row.tenantId, logicalAgentId: row.logicalAgentId }),
-    bindingId: row.bindingId,
-    leaseId: row.leaseId,
-    connectorId: row.connectorId,
-    scopes: Object.freeze([...row.scopes]),
-    leaseEpoch: row.leaseEpoch.toString(10),
-    acquiredAt: row.acquiredAt.toISOString(),
-    heartbeatAt: row.heartbeatAt.toISOString(),
-    expiresAt: row.expiresAt.toISOString(),
-    ...(row.releasedAt ? { releasedAt: row.releasedAt.toISOString() } : {}),
-  });
-}
-
-function classifyAuthorityFailure(
-  current: ConnectorLease | null,
-  claimed: ConnectorLease,
-  now: string,
-): ConnectorLeaseRejectReason {
-  if (!current) return 'lease_missing';
-  if (current.releasedAt) return 'lease_released';
-  if (new Date(current.expiresAt) <= new Date(now)) return 'lease_expired';
-  if (current.leaseEpoch !== claimed.leaseEpoch) return 'stale_epoch';
-  return 'connector_mismatch';
-}
-
-function lifecycleAudit(
-  input: { readonly correlationId: string; readonly now: string },
-  lease: ConnectorLease,
-  event: Exclude<ConnectorLeaseAuditEvent['event'], 'reject'>,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: lease.identity,
-    bindingId: lease.bindingId,
-    connectorId: lease.connectorId,
-    leaseId: lease.leaseId,
-    leaseEpoch: lease.leaseEpoch,
-    event,
-    outcome: 'succeeded',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-  };
-}
-
-function rejectionAudit(
-  input: {
-    readonly identity: ConnectorLease['identity'];
-    readonly bindingId: string;
-    readonly connectorId: string;
-    readonly correlationId: string;
-    readonly now: string;
-  },
-  current: ConnectorLease | null,
-  reason: ConnectorLeaseRejectReason,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: input.identity,
-    bindingId: input.bindingId,
-    connectorId: input.connectorId,
-    event: 'reject',
-    outcome: 'denied',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-    ...(current ? { leaseId: current.leaseId, leaseEpoch: current.leaseEpoch } : {}),
-    reason,
-  };
-}
-
-async function insertAudit(db: Pick<Db, 'insert'>, event: ConnectorLeaseAuditEvent): Promise<void> {
-  await db.insert(connectorLeaseAuditLog).values({
-    tenantId: event.identity.tenantId,
-    logicalAgentId: event.identity.logicalAgentId,
-    bindingId: event.bindingId,
-    connectorId: event.connectorId,
-    ...(event.leaseId ? { leaseId: event.leaseId } : {}),
-    ...(event.leaseEpoch ? { leaseEpoch: BigInt(event.leaseEpoch) } : {}),
-    event: event.event,
-    outcome: event.outcome,
-    ...(event.reason ? { reason: event.reason } : {}),
-    correlationId: event.correlationId,
-    occurredAt: new Date(event.occurredAt),
-  });
-}

apps/gateway/src/agent/connector-lease.service.ts

@@ -1,285 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { ConnectorLeaseCoordinator, normalizeConnectorLease } from '@mosaicstack/agent';
-import {
-  normalizeConnectorId,
-  normalizeConnectorScopes,
-  normalizeCorrelationId,
-  normalizeLogicalAgentIdentity,
-  normalizeLogicalBindingId,
-  type AcquireConnectorLeaseInput,
-  type ConnectorExecutionGrant,
-  type ConnectorLease,
-  type ConnectorLeaseAuditEvent,
-  type FencedConnectorAdapter,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-export const CONNECTOR_LEASE_POLICY = Symbol('CONNECTOR_LEASE_POLICY');
-
-export type ConnectorLeasePolicyAction =
-  | 'lease.acquire'
-  | 'lease.takeover'
-  | 'lease.heartbeat'
-  | 'lease.release'
-  | 'lease.read'
-  | 'grant.issue';
-
-export interface ConnectorLeaseRequestContext {
-  readonly actorScope: ActorTenantScope;
-  readonly correlationId: string;
-}
-
-export interface GatewayConnectorLeaseRequest {
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface GatewayConnectorLeaseTakeoverRequest extends GatewayConnectorLeaseRequest {
-  readonly expectedEpoch: string;
-}
-
-export interface GatewayConnectorGrantRequest {
-  readonly lease: ConnectorLease;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface ConnectorLeasePolicySubject {
-  readonly action: ConnectorLeasePolicyAction;
-  readonly actorId: string;
-  readonly tenantId: string;
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly requestedScopes: readonly string[];
-  readonly requestedTtlMs: number | null;
-}
-
-export interface ConnectorLeasePolicy {
-  authorize(subject: ConnectorLeasePolicySubject): Promise<boolean>;
-}
-
-/** M1 has no concrete cutover policy: unconfigured production use fails closed. */
-@Injectable()
-export class DenyConnectorLeasePolicy implements ConnectorLeasePolicy {
-  async authorize(_subject: ConnectorLeasePolicySubject): Promise<boolean> {
-    return false;
-  }
-}
-
-/** Gateway-owned policy surface for durable connector authority and fenced effects. */
-@Injectable()
-export class ConnectorLeaseService {
-  private readonly coordinator: ConnectorLeaseCoordinator;
-
-  constructor(
-    @Inject(ConnectorLeaseRepository) private readonly repository: ConnectorLeaseRepository,
-    @Inject(CONNECTOR_LEASE_POLICY) private readonly policy: ConnectorLeasePolicy,
-  ) {
-    this.coordinator = new ConnectorLeaseCoordinator(repository);
-  }
-
-  async acquire(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.acquire', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.acquire({ ...command, correlationId: this.correlation(context) });
-  }
-
-  async takeover(
-    request: GatewayConnectorLeaseTakeoverRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.takeover', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.takeover({
-      ...command,
-      expectedEpoch: request.expectedEpoch,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async heartbeat(
-    lease: ConnectorLease,
-    ttlMs: number,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.heartbeat', durableLease, context, durableLease.scopes, ttlMs);
-    return this.coordinator.heartbeat({
-      lease: durableLease,
-      ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async release(lease: ConnectorLease, context: ConnectorLeaseRequestContext): Promise<void> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.release', durableLease, context, durableLease.scopes, null);
-    await this.coordinator.release({
-      lease: durableLease,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async current(
-    logicalAgentId: string,
-    bindingId: string,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease | null> {
-    const binding = {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(bindingId),
-      connectorId: 'gateway',
-    };
-    await this.assertPolicy('lease.read', binding, context, [], null);
-    return this.coordinator.current(binding);
-  }
-
-  async issueGrant(
-    request: GatewayConnectorGrantRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorExecutionGrant> {
-    const lease = normalizeConnectorLease(request.lease);
-    await this.assertTenant(lease, context);
-    const scopes = normalizeConnectorScopes(request.scopes);
-    await this.assertPolicy('grant.issue', lease, context, scopes, request.ttlMs);
-    return this.coordinator.issueGrant({
-      lease,
-      scopes,
-      ttlMs: request.ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async executeGrant<TInput, TOutput>(
-    grant: ConnectorExecutionGrant,
-    requiredScope: string,
-    input: TInput,
-    adapter: FencedConnectorAdapter<TInput, TOutput>,
-  ): Promise<TOutput> {
-    return this.coordinator.executeGrant(grant, requiredScope, input, adapter);
-  }
-
-  private command(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Omit<AcquireConnectorLeaseInput, 'correlationId'> {
-    return {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId: request.logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(request.bindingId),
-      connectorId: normalizeConnectorId(request.connectorId),
-      scopes: normalizeConnectorScopes(request.scopes),
-      ttlMs: request.ttlMs,
-    };
-  }
-
-  private async assertTenant(
-    lease: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    if (lease.identity.tenantId !== context.actorScope.tenantId) {
-      await this.recordPolicyDenial(
-        {
-          identity: {
-            tenantId: context.actorScope.tenantId,
-            logicalAgentId: 'untrusted',
-          },
-          bindingId: 'untrusted',
-          connectorId: 'untrusted',
-        },
-        context,
-      );
-      throw new ForbiddenException('Connector authority tenant scope denied');
-    }
-  }
-
-  private async durableLifecycleLease(
-    submittedLease: ConnectorLease,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    await this.assertTenant(submittedLease, context);
-    const durableLease = await this.coordinator.current(submittedLease);
-    if (!durableLease || !hasSameLifecycleAuthority(submittedLease, durableLease)) {
-      await this.recordPolicyDenial(durableLease ?? submittedLease, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-    return durableLease;
-  }
-
-  private async assertPolicy(
-    action: ConnectorLeasePolicyAction,
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-    requestedScopes: readonly string[],
-    requestedTtlMs: number | null,
-  ): Promise<void> {
-    const allowed = await this.policy.authorize({
-      action,
-      actorId: context.actorScope.userId,
-      tenantId: subject.identity.tenantId,
-      logicalAgentId: subject.identity.logicalAgentId,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      requestedScopes: Object.freeze([...requestedScopes]),
-      requestedTtlMs,
-    });
-    if (!allowed) {
-      await this.recordPolicyDenial(subject, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-  }
-
-  private async recordPolicyDenial(
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    const event: ConnectorLeaseAuditEvent = {
-      identity: subject.identity,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-      correlationId: this.correlation(context),
-      occurredAt: new Date().toISOString(),
-    };
-    await this.repository.recordAudit(event);
-  }
-
-  private correlation(context: ConnectorLeaseRequestContext): string {
-    return normalizeCorrelationId(context.correlationId);
-  }
-}
-
-function hasSameLifecycleAuthority(
-  submittedLease: ConnectorLease,
-  durableLease: ConnectorLease,
-): boolean {
-  return (
-    submittedLease.identity.tenantId === durableLease.identity.tenantId &&
-    submittedLease.identity.logicalAgentId === durableLease.identity.logicalAgentId &&
-    submittedLease.bindingId === durableLease.bindingId &&
-    submittedLease.leaseId === durableLease.leaseId &&
-    submittedLease.connectorId === durableLease.connectorId &&
-    submittedLease.leaseEpoch === durableLease.leaseEpoch &&
-    submittedLease.scopes.length === durableLease.scopes.length &&
-    submittedLease.scopes.every((scope: string, index: number): boolean => {
-      return scope === durableLease.scopes[index];
-    })
-  );
-}

apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts

@@ -1,176 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { HermesRuntimeProvider } from '@mosaicstack/agent';
-import { AgentModule } from './agent.module.js';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { BRAIN } from '../brain/brain.tokens.js';
-import { DB } from '../database/database.module.js';
-import { CoordModule } from '../coord/coord.module.js';
-import { McpClientModule } from '../mcp-client/mcp-client.module.js';
-import { SkillsModule } from '../skills/skills.module.js';
-import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-} from './runtime-provider-registry.service.js';
-import { DurableSessionService } from './durable-session.service.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { AgentService } from './agent.service.js';
-import { ProviderService } from './provider.service.js';
-import { ProviderCredentialsService } from './provider-credentials.service.js';
-import { RoutingService } from './routing.service.js';
-import { RoutingEngineService } from './routing/routing-engine.service.js';
-import { SkillLoaderService } from './skill-loader.service.js';
-
-const authenticatedUser = { id: 'operator-1', tenantId: 'tenant-1' };
-
-@Module({})
-class EmptyAgentDependencyModule {}
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: authenticatedUser, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-    { provide: BRAIN, useValue: {} },
-    { provide: DB, useValue: {} },
-  ],
-  exports: [AUTH, AuthGuard, BRAIN, DB],
-})
-class AuthenticatedRequestModule {}
-
-/**
- * This is deliberately an HTTP test rather than a controller unit test: it
- * exercises AgentModule's actual provider factory, Nest DI, and AuthGuard.
- */
-describe('Hermes runtime provider reachability', (): void => {
-  let app: NestFastifyApplication | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule, AgentModule],
-    })
-      .overrideModule(CoordModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(McpClientModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(SkillsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(GCModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(LogModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(CommandsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideProvider(RuntimeProviderAuditService)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_PROVIDER_AUDIT_SINK)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_APPROVAL_VERIFIER)
-      .useValue({ consume: vi.fn().mockResolvedValue(false) })
-      .overrideProvider(DurableSessionService)
-      .useValue({})
-      .overrideProvider(DurableSessionRepository)
-      .useValue({})
-      .overrideProvider(AgentService)
-      .useValue({})
-      .overrideProvider(ProviderService)
-      .useValue({})
-      .overrideProvider(ProviderCredentialsService)
-      .useValue({})
-      .overrideProvider(RoutingService)
-      .useValue({})
-      .overrideProvider(RoutingEngineService)
-      .useValue({})
-      .overrideProvider(SkillLoaderService)
-      .useValue({})
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  afterAll(async (): Promise<void> => {
-    await app?.close();
-  });
-
-  it('returns gateway denial responses from the actual guarded interaction routes', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-
-    const attachDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/attach',
-      headers: { 'x-correlation-id': 'correlation-1' },
-      payload: { mode: 'read' },
-    });
-    expect(attachDenied.statusCode).toBe(401);
-
-    const sendDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/send',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(sendDenied.statusCode).toBe(403);
-    expect(sendDenied.json()).toMatchObject({
-      message: 'Content and idempotency key are required',
-    });
-
-    const stopDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/stop',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(stopDenied.statusCode).toBe(403);
-    expect(stopDenied.json()).toMatchObject({ message: 'Exact-action approval is required' });
-  });
-
-  it('requires authentication and reaches the Hermes provider registered by AgentModule', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-    const registry = app.get(AGENT_RUNTIME_PROVIDER_REGISTRY);
-    expect(registry.get('runtime.hermes')).toBeInstanceOf(HermesRuntimeProvider);
-
-    const denied = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { 'x-correlation-id': 'correlation-1' },
-    });
-    expect(denied.statusCode).toBe(401);
-
-    const response = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-    });
-    expect(response.statusCode).toBe(200);
-    expect(response.json()).toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-
-const scope = {
-  actorId: 'owner-1',
-  tenantId: 'tenant-1',
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-describe('GatewayHermesRuntimeTransport', () => {
-  it('preserves a configured path prefix and authenticates the concrete runtime request', async () => {
-    const fetchFn = vi
-      .fn()
-      .mockResolvedValue(new Response(JSON.stringify(['session.list']), { status: 200 }));
-    const transport = new GatewayHermesRuntimeTransport(
-      'https://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).resolves.toEqual(['session.list']);
-
-    expect(fetchFn).toHaveBeenCalledWith(
-      new URL('https://runtime.example.test/hermes/capabilities'),
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          authorization: 'Bearer test-service-token',
-          'x-mosaic-channel-id': 'cli',
-        }),
-      }),
-    );
-  });
-
-  it('rejects non-loopback HTTP runtime endpoints before sending identity headers', async () => {
-    const fetchFn = vi.fn();
-    const transport = new GatewayHermesRuntimeTransport(
-      'http://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).rejects.toThrow('requires HTTPS');
-    expect(fetchFn).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.ts

@@ -1,121 +0,0 @@
-import type { HermesLegacySession, HermesRuntimeTransport } from '@mosaicstack/agent';
-import type {
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-
-/** Concrete HTTP transport for a configured legacy Hermes runtime endpoint. */
-export class GatewayHermesRuntimeTransport implements HermesRuntimeTransport {
-  constructor(
-    private readonly baseUrl = process.env['MOSAIC_HERMES_RUNTIME_URL']?.trim(),
-    private readonly serviceToken = process.env['MOSAIC_HERMES_RUNTIME_TOKEN']?.trim(),
-    private readonly fetchFn: typeof fetch = fetch,
-  ) {}
-
-  async capabilities(scope: RuntimeScope): Promise<string[]> {
-    return this.request<string[]>('/capabilities', scope);
-  }
-
-  async health(scope: RuntimeScope): Promise<{ status: string; detail?: string }> {
-    return this.request<{ status: string; detail?: string }>('/health', scope);
-  }
-
-  async sessions(scope: RuntimeScope): Promise<HermesLegacySession[]> {
-    return this.request<HermesLegacySession[]>('/sessions', scope);
-  }
-
-  async *stream(
-    sessionId: string,
-    cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const params = new URLSearchParams(cursor ? { cursor } : {});
-    const events = await this.request<RuntimeStreamEvent[]>(
-      `/sessions/${encodeURIComponent(sessionId)}/stream?${params.toString()}`,
-      scope,
-    );
-    yield* events;
-  }
-
-  async send(sessionId: string, message: RuntimeMessage, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/messages`, scope, {
-      method: 'POST',
-      body: message,
-    });
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    return this.request<RuntimeAttachHandle>(
-      `/sessions/${encodeURIComponent(sessionId)}/attach`,
-      scope,
-      {
-        method: 'POST',
-        body: { mode },
-      },
-    );
-  }
-
-  async detach(attachmentId: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/attachments/${encodeURIComponent(attachmentId)}`, scope, {
-      method: 'DELETE',
-    });
-  }
-
-  async terminate(sessionId: string, approvalRef: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/terminate`, scope, {
-      method: 'POST',
-      body: { approvalRef },
-    });
-  }
-
-  private async request<T>(
-    path: string,
-    scope: RuntimeScope,
-    init: { method?: string; body?: unknown } = {},
-  ): Promise<T> {
-    if (!this.baseUrl || !this.serviceToken) {
-      throw new Error(
-        'MOSAIC_HERMES_RUNTIME_URL and MOSAIC_HERMES_RUNTIME_TOKEN must configure Hermes transport',
-      );
-    }
-    const endpoint = new URL(this.baseUrl);
-    if (endpoint.protocol !== 'https:' && !isLoopbackHttp(endpoint)) {
-      throw new Error('Hermes runtime transport requires HTTPS outside loopback');
-    }
-    const response = await this.fetchFn(
-      new URL(path.replace(/^\//, ''), `${endpoint.toString().replace(/\/$/, '')}/`),
-      {
-        method: init.method ?? 'GET',
-        headers: {
-          accept: 'application/json',
-          authorization: `Bearer ${this.serviceToken}`,
-          'x-mosaic-actor-id': scope.actorId,
-          'x-mosaic-tenant-id': scope.tenantId,
-          'x-mosaic-channel-id': scope.channelId,
-          'x-correlation-id': scope.correlationId,
-          ...(init.body ? { 'content-type': 'application/json' } : {}),
-        },
-        ...(init.body ? { body: JSON.stringify(init.body) } : {}),
-      },
-    );
-    if (!response.ok) throw new Error(`Hermes runtime request failed: ${response.status}`);
-    if (response.status === 204) return undefined as T;
-    return (await response.json()) as T;
-  }
-}
-
-function isLoopbackHttp(endpoint: URL): boolean {
-  return (
-    endpoint.protocol === 'http:' &&
-    (endpoint.hostname === 'localhost' ||
-      endpoint.hostname === '127.0.0.1' ||
-      endpoint.hostname === '::1')
-  );
-}

apps/gateway/src/agent/interaction.controller.test.ts

@@ -1,10 +1,6 @@
-import { createGatewayRuntimeProviderRegistry } from './agent.module.js';
 import { firstValueFrom } from 'rxjs';
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import {
+import { RuntimeApprovalDeniedError } from './runtime-provider-registry.service.js';
-  RuntimeApprovalDeniedError,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
 import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
 import { InteractionController } from './interaction.controller.js';
 
@@ -43,32 +39,6 @@ describe('InteractionController', (): void => {
     else process.env['MOSAIC_AGENT_NAME'] = prior;
   });
 
-  it('reaches the registered Hermes provider through the authenticated transitional matrix route', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const registry = createGatewayRuntimeProviderRegistry();
-    const runtime = new RuntimeProviderService(
-      registry,
-      { record: vi.fn().mockResolvedValue(undefined) },
-      { consume: vi.fn().mockResolvedValue(false) },
-    );
-    const controller = new InteractionController(runtime, {} as never);
-
-    await expect(
-      controller.transitionalCapabilities(
-        'Nova',
-        'runtime.hermes',
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-
   it('rejects a request without the non-simple correlation header', async () => {
     process.env['MOSAIC_AGENT_NAME'] = 'Nova';
     const controller = new InteractionController({ listSessions: vi.fn() } as never, {} as never);

apps/gateway/src/agent/interaction.controller.ts

@@ -17,7 +17,7 @@ import { Observable } from 'rxjs';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
 import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { DurableSessionService } from './durable-session.service.js';
+import { TessDurableSessionService } from './tess-durable-session.service.js';
 import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
 import {
   RuntimeProviderService,
@@ -34,7 +34,7 @@ import {
 export class InteractionController {
   constructor(
     @Inject(RuntimeProviderService) private readonly runtime: RuntimeProviderService,
-    @Inject(DurableSessionService) private readonly durable: DurableSessionService,
+    @Inject(TessDurableSessionService) private readonly durable: TessDurableSessionService,
   ) {}
 
   @Get('sessions')
@@ -51,20 +51,6 @@ export class InteractionController {
     );
   }
 
-  @Get('transitional-capabilities')
-  async transitionalCapabilities(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.transitionalCapabilityMatrix(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
   @Get('tree')
   async tree(
     @Param('agentName') agentName: string,

apps/gateway/src/agent/runtime-provider-registry.service.ts

@@ -17,8 +17,6 @@ import type {
   RuntimeSession,
   RuntimeSessionTree,
   RuntimeStreamEvent,
-  TransitionalCapabilityInventoryEntry,
-  TransitionalCapabilityInventoryProvider,
 } from '@mosaicstack/types';
 import type { ActorTenantScope } from '../auth/session-scope.js';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -30,8 +28,7 @@ export const RUNTIME_APPROVAL_VERIFIER = Symbol('RUNTIME_APPROVAL_VERIFIER');
 export type RuntimeProviderOperation =
   | RuntimeCapability
   | 'runtime.capabilities'
-  | 'runtime.health'
+  | 'runtime.health';
-  | 'runtime.transitional-capabilities';
 export type RuntimeProviderAuditOutcome = 'requested' | 'succeeded' | 'denied' | 'failed';
 
 /** Trusted server-side context only; it intentionally excludes client-provided identity fields. */
@@ -74,15 +71,6 @@ export interface RuntimeApprovalVerifier {
   consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean>;
 }
 
-function isTransitionalInventoryProvider(
-  provider: AgentRuntimeProvider,
-): provider is AgentRuntimeProvider & TransitionalCapabilityInventoryProvider {
-  return (
-    typeof (provider as Partial<TransitionalCapabilityInventoryProvider>)
-      .transitionalCapabilityMatrix === 'function'
-  );
-}
-
 function configuredAgentName(): string {
   const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
   if (!agentName) throw new RuntimeApprovalDeniedError();
@@ -163,25 +151,6 @@ export class RuntimeProviderService {
     );
   }
 
-  async transitionalCapabilityMatrix(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<TransitionalCapabilityInventoryEntry[]> {
-    return this.execute(
-      providerId,
-      'runtime.transitional-capabilities',
-      undefined,
-      undefined,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope) => {
-        if (!isTransitionalInventoryProvider(provider)) {
-          throw new NotFoundException('Runtime provider has no transitional capability inventory');
-        }
-        return provider.transitionalCapabilityMatrix(scope);
-      },
-    );
-  }
-
   async listSessions(
     providerId: string,
     context: RuntimeProviderRequestContext,

apps/gateway/src/agent/tess-durable-session.dto.ts

@@ -1,7 +1,7 @@
 import type { RuntimeProviderRequestContext } from './runtime-provider-registry.service.js';
 
 /** Server-side request for a replay-safe provider message. */
-export interface ProviderOutboxDto {
+export interface TessProviderOutboxDto {
   sessionId: string;
   idempotencyKey: string;
   correlationId: string;

apps/gateway/src/agent/tess-durable-session.repository.test.ts

@@ -6,8 +6,8 @@ import { eq, sql, interactionCheckpoints, interactionInbox } from '@mosaicstack/
 import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createPgliteDb, runPgliteMigrations, type DbHandle } from '@mosaicstack/db';
-import { DurableSessionRepository } from './durable-session.repository.js';
+import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
+import { TessDurableSessionService } from './tess-durable-session.service.js';
 
 const IDENTITY: DurableSessionIdentity = {
   agentName: 'Nova',
@@ -18,7 +18,7 @@ const IDENTITY: DurableSessionIdentity = {
   runtimeSessionId: 'nova',
 };
 
-describe('DurableSessionRepository', () => {
+describe('TessDurableSessionRepository', () => {
   let dataDir: string | undefined;
   let handle: DbHandle;
   let previousAuthSecret: string | undefined;
@@ -48,7 +48,9 @@ describe('DurableSessionRepository', () => {
   });
 
   it('survives a full PGlite close/reopen mid-session without duplicate inbox or outbox side effects', async () => {
-    const beforeRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const beforeRestart = new DurableSessionCoordinator(
+      new TessDurableSessionRepository(handle.db),
+    );
     await beforeRestart.create(IDENTITY);
     await beforeRestart.receive({
       sessionId: IDENTITY.sessionId,
@@ -90,7 +92,7 @@ describe('DurableSessionRepository', () => {
     await handle.close();
     handle = createPgliteDb(dataDir!);
 
-    const afterRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const afterRestart = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     const recovered = await afterRestart.recover(IDENTITY.sessionId);
     const resumedHandoff = await afterRestart.resumeHandoff('handoff-before-kill');
     const handled: string[] = [];
@@ -118,7 +120,7 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('redacts sensitive durable payloads before persistence', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     await coordinator.create(IDENTITY);
     await coordinator.receive({
       sessionId: IDENTITY.sessionId,
@@ -155,7 +157,7 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('fails closed when the configured idempotency secret is unavailable', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     await coordinator.create(IDENTITY);
     const secret = process.env['BETTER_AUTH_SECRET'];
     delete process.env['BETTER_AUTH_SECRET'];
@@ -175,7 +177,7 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('uses keyed pre-redaction digests to reject distinct sensitive checkpoint payloads', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     await coordinator.create(IDENTITY);
     const input = {
       sessionId: IDENTITY.sessionId,
@@ -225,7 +227,7 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('rejects distinct sensitive inbox and outbox payloads under reused idempotency keys', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     await coordinator.create(IDENTITY);
     const inbox = {
       sessionId: IDENTITY.sessionId,
@@ -253,7 +255,7 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('rejects database inbox and outbox idempotency-key conflicts', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
+    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
     await coordinator.create(IDENTITY);
     await coordinator.receive({
       sessionId: IDENTITY.sessionId,
@@ -291,10 +293,10 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('does not requeue a live outbox claim during a normal scoped dispatch', async () => {
-    const repository = new DurableSessionRepository(handle.db);
+    const repository = new TessDurableSessionRepository(handle.db);
     const coordinator = new DurableSessionCoordinator(repository);
     const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
+    const service = new TessDurableSessionService(repository, runtimeProviders as never);
     const input = {
       sessionId: IDENTITY.sessionId,
       idempotencyKey: 'live-effect',
@@ -331,10 +333,10 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('rejects an outbox correlation mismatch before claiming the pending effect', async () => {
-    const repository = new DurableSessionRepository(handle.db);
+    const repository = new TessDurableSessionRepository(handle.db);
     const coordinator = new DurableSessionCoordinator(repository);
     const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
+    const service = new TessDurableSessionService(repository, runtimeProviders as never);
     const input = {
       sessionId: IDENTITY.sessionId,
       idempotencyKey: 'mismatch-effect',
@@ -364,10 +366,10 @@ describe('DurableSessionRepository', () => {
   }, 30_000);
 
   it('dispatches only the outbox record bound to the supplied correlation and channel', async () => {
-    const repository = new DurableSessionRepository(handle.db);
+    const repository = new TessDurableSessionRepository(handle.db);
     const coordinator = new DurableSessionCoordinator(repository);
     const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
+    const service = new TessDurableSessionService(repository, runtimeProviders as never);
     const first = {
       sessionId: IDENTITY.sessionId,
       idempotencyKey: 'scoped-effect-one',

apps/gateway/src/agent/tess-durable-session.repository.ts

@@ -33,7 +33,7 @@ import type {
 import { DB } from '../database/database.module.js';
 
 @Injectable()
-export class DurableSessionRepository implements DurableSessionStore {
+export class TessDurableSessionRepository implements DurableSessionStore {
   constructor(@Inject(DB) private readonly db: Db) {}
 
   async create(identity: DurableSessionIdentity): Promise<void> {
@@ -51,7 +51,7 @@ export class DurableSessionRepository implements DurableSessionStore {
 
     const existing = await this.session(identity.sessionId);
     if (!existing || !sameEnrollmentScope(existing, identity)) {
-      throw new Error(`Durable session identity conflict: ${identity.sessionId}`);
+      throw new Error(`Durable Tess session identity conflict: ${identity.sessionId}`);
     }
     // A recovered/re-enrolled runtime can receive a new provider session ID;
     // the conversation handle and owner scope remain immutable.
@@ -135,13 +135,13 @@ export class DurableSessionRepository implements DurableSessionStore {
         ),
       )
       .limit(1);
-    if (!existing[0]) throw new Error(`Durable inbox enqueue failed: ${input.idempotencyKey}`);
+    if (!existing[0]) throw new Error(`Durable Tess inbox enqueue failed: ${input.idempotencyKey}`);
     const entry = toInbox(existing[0]);
     if (
       !sameInbox(entry, record) ||
       !matchesContentDigest(existing[0].contentDigest, input.content)
     ) {
-      throw new Error(`Durable inbox idempotency conflict: ${input.idempotencyKey}`);
+      throw new Error(`Durable Tess inbox idempotency conflict: ${input.idempotencyKey}`);
     }
     return { accepted: false, status: entry.status };
   }
@@ -224,13 +224,14 @@ export class DurableSessionRepository implements DurableSessionStore {
         ),
       )
       .limit(1);
-    if (!existing[0]) throw new Error(`Durable outbox enqueue failed: ${input.idempotencyKey}`);
+    if (!existing[0])
+      throw new Error(`Durable Tess outbox enqueue failed: ${input.idempotencyKey}`);
     const entry = toOutbox(existing[0]);
     if (
       !sameOutbox(entry, record) ||
       !matchesContentDigest(existing[0].contentDigest, input.content)
     ) {
-      throw new Error(`Durable outbox idempotency conflict: ${input.idempotencyKey}`);
+      throw new Error(`Durable Tess outbox idempotency conflict: ${input.idempotencyKey}`);
     }
     return { accepted: false, status: entry.status };
   }
@@ -337,7 +338,7 @@ export class DurableSessionRepository implements DurableSessionStore {
       !sameCheckpoint(toCheckpoint(existing[0]), checkpoint) ||
       !matchesCheckpointDigest(existing[0].contentDigest, digest)
     ) {
-      throw new Error(`Durable checkpoint identity conflict: ${input.checkpointId}`);
+      throw new Error(`Durable Tess checkpoint identity conflict: ${input.checkpointId}`);
     }
   }
 
@@ -359,7 +360,7 @@ export class DurableSessionRepository implements DurableSessionStore {
   async handoff(input: DurableHandoffInput): Promise<void> {
     const checkpoint = await this.findCheckpoint(input.sessionId, input.checkpointId);
     if (!checkpoint) {
-      throw new Error(`Durable handoff checkpoint is unavailable: ${input.checkpointId}`);
+      throw new Error(`Durable Tess handoff checkpoint is unavailable: ${input.checkpointId}`);
     }
     const inserted = await this.db
       .insert(interactionHandoffs)
@@ -370,7 +371,7 @@ export class DurableSessionRepository implements DurableSessionStore {
 
     const existing = await this.findHandoff(input.handoffId);
     if (!existing || !sameHandoff(existing, input)) {
-      throw new Error(`Durable handoff identity conflict: ${input.handoffId}`);
+      throw new Error(`Durable Tess handoff identity conflict: ${input.handoffId}`);
     }
   }
 

apps/gateway/src/agent/tess-durable-session.service.ts

@@ -1,23 +1,23 @@
 import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
 import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import type { ProviderOutboxDto } from './durable-session.dto.js';
+import type { TessProviderOutboxDto } from './tess-durable-session.dto.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
+import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
 import {
   RuntimeProviderService,
   type RuntimeProviderRequestContext,
 } from './runtime-provider-registry.service.js';
 
 /**
- * Scoped gateway boundary for the canonical durable session state machine. It deliberately
+ * Scoped gateway boundary for the canonical Tess state machine. It deliberately
  * uses composition: raw state methods cannot be injected into channel, CLI, or
  * MCP adapters without a server-derived actor/tenant/correlation context.
  */
 @Injectable()
-export class DurableSessionService {
+export class TessDurableSessionService {
   private readonly coordinator: DurableSessionCoordinator;
 
   constructor(
-    @Inject(DurableSessionRepository) repository: DurableSessionRepository,
+    @Inject(TessDurableSessionRepository) repository: TessDurableSessionRepository,
     @Inject(RuntimeProviderService) private readonly runtimeProviders: RuntimeProviderService,
   ) {
     this.coordinator = new DurableSessionCoordinator(repository);
@@ -32,12 +32,12 @@ export class DurableSessionService {
       identity.ownerId !== context.actorScope.userId ||
       identity.tenantId !== context.actorScope.tenantId
     ) {
-      throw new ForbiddenException('Durable session enrollment scope mismatch');
+      throw new ForbiddenException('Durable Tess enrollment scope mismatch');
     }
     await this.coordinator.create(identity);
   }
 
-  async queueProviderSend(input: ProviderOutboxDto): Promise<void> {
+  async queueProviderSend(input: TessProviderOutboxDto): Promise<void> {
     const snapshot = await this.coordinator.snapshot(input.sessionId);
     this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
     await this.coordinator.enqueueOutbox({
@@ -50,9 +50,9 @@ export class DurableSessionService {
     });
   }
 
-  async dispatchProviderOutbox(sessionId: string, input: ProviderOutboxDto): Promise<void> {
+  async dispatchProviderOutbox(sessionId: string, input: TessProviderOutboxDto): Promise<void> {
     if (sessionId !== input.sessionId) {
-      throw new ForbiddenException('Durable outbox session mismatch');
+      throw new ForbiddenException('Durable Tess outbox session mismatch');
     }
     const snapshot = await this.coordinator.snapshot(sessionId);
     this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
@@ -92,7 +92,7 @@ export class DurableSessionService {
   }
 
   /** Startup/recovery-only path; normal queue/dispatch methods never requeue live work. */
-  async recoverProviderSession(sessionId: string, input: ProviderOutboxDto): Promise<void> {
+  async recoverProviderSession(sessionId: string, input: TessProviderOutboxDto): Promise<void> {
     const snapshot = await this.coordinator.snapshot(sessionId);
     this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
     await this.coordinator.recover(sessionId);
@@ -100,24 +100,24 @@ export class DurableSessionService {
 
   private assertOutboxScope(
     entry: { kind: string; correlationId: string; channelId: string },
-    input: ProviderOutboxDto,
+    input: TessProviderOutboxDto,
   ): void {
     if (
       entry.kind !== 'provider.send' ||
       entry.correlationId !== input.correlationId ||
       entry.channelId !== input.context.channelId
     ) {
-      throw new ForbiddenException('Durable outbox scope or correlation mismatch');
+      throw new ForbiddenException('Durable Tess outbox scope or correlation mismatch');
     }
   }
 
-  private assertScope(ownerId: string, tenantId: string, input: ProviderOutboxDto): void {
+  private assertScope(ownerId: string, tenantId: string, input: TessProviderOutboxDto): void {
     if (
       input.context.actorScope.userId !== ownerId ||
       input.context.actorScope.tenantId !== tenantId ||
       input.context.correlationId !== input.correlationId
     ) {
-      throw new ForbiddenException('Durable session scope or correlation mismatch');
+      throw new ForbiddenException('Durable Tess session scope or correlation mismatch');
     }
   }
 }

apps/gateway/src/agent/tools/memory-tools.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { createMemoryTools } from './memory-tools.js';
-
-describe('createMemoryTools operator retrieval binding', () => {
-  const memory = {
-    insights: { searchByEmbedding: vi.fn(), create: vi.fn() },
-    preferences: { findByUserAndCategory: vi.fn(), findByUser: vi.fn(), upsert: vi.fn() },
-  };
-  const scope = { tenantId: 'tenant-a', ownerId: 'owner-a', sessionId: 'session-a' };
-
-  it('uses the configured plugin with the server-derived scope for retrieval and capture', async () => {
-    const plugin = {
-      search: vi.fn(async () => []),
-      capture: vi.fn(async () => ({ id: 'insight-1' })),
-    };
-    const tools = createMemoryTools(memory as never, null, 'owner-a', {
-      plugin: plugin as never,
-      scope,
-    });
-
-    await tools
-      .find((tool) => tool.name === 'memory_search')!
-      .execute('call-1', { query: 'plans' }, undefined, undefined, {} as never);
-    await tools
-      .find((tool) => tool.name === 'memory_save_insight')!
-      .execute(
-        'call-2',
-        { content: 'secret', category: 'decision' },
-        undefined,
-        undefined,
-        {} as never,
-      );
-
-    expect(plugin.search).toHaveBeenCalledWith(scope, 'plans', 5);
-    expect(plugin.capture).toHaveBeenCalledWith(scope, {
-      content: 'secret',
-      source: 'agent',
-      category: 'decision',
-    });
-  });
-});

apps/gateway/src/agent/tools/memory-tools.ts

@@ -1,11 +1,7 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import type {
+import type { Memory } from '@mosaicstack/memory';
-  EmbeddingProvider,
+import type { EmbeddingProvider } from '@mosaicstack/memory';
-  Memory,
-  OperatorMemoryPlugin,
-  OperatorMemoryScope,
-} from '@mosaicstack/memory';
 
 /**
  * Create memory tools bound to the session's authenticated userId.
@@ -17,10 +13,8 @@ import type {
 export function createMemoryTools(
   memory: Memory,
   embeddingProvider: EmbeddingProvider | null,
-  /** Authenticated user ID from the session. All preference operations are scoped to this user. */
+  /** Authenticated user ID from the session. All memory operations are scoped to this user. */
   sessionUserId: string | undefined,
-  /** Optional configured retrieval plugin, bound to a server-derived session scope. */
-  operatorMemory?: { plugin: OperatorMemoryPlugin; scope: OperatorMemoryScope },
 ): ToolDefinition[] {
   /** Return an error result when no session user is bound. */
   function noUserError() {
@@ -52,14 +46,6 @@ export function createMemoryTools(
         limit?: number;
       };
 
-      if (operatorMemory) {
-        const results = await operatorMemory.plugin.search(operatorMemory.scope, query, limit ?? 5);
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(results, null, 2) }],
-          details: undefined,
-        };
-      }
-
       if (!embeddingProvider) {
         return {
           content: [
@@ -172,18 +158,6 @@ export function createMemoryTools(
       };
       type Cat = 'decision' | 'learning' | 'preference' | 'fact' | 'pattern' | 'general';
 
-      if (operatorMemory) {
-        const insight = await operatorMemory.plugin.capture(operatorMemory.scope, {
-          content,
-          source: 'agent',
-          category: category ?? 'learning',
-        });
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(insight, null, 2) }],
-          details: undefined,
-        };
-      }
-
       let embedding: number[] | null = null;
       if (embeddingProvider) {
         embedding = await embeddingProvider.embed(content);

apps/gateway/src/app.module.spec.ts

@@ -1,624 +0,0 @@
-import 'reflect-metadata';
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
-import * as nodeOs from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import * as nodeUrl from 'node:url';
-import { MODULE_METADATA } from '@nestjs/common/constants.js';
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-
-interface ComposedModuleGraph {
-  imports: readonly unknown[];
-  federationModule: unknown;
-  bootLogLines: readonly string[];
-  mosaicConfig: MosaicConfig;
-  resolvedConfigPath: string;
-}
-
-type StorageTier = 'local' | 'standalone' | 'federated';
-
-interface ModuleGraphFixture {
-  tempRoot: string;
-  anchor: string;
-  homePath: string;
-  cwdPath: string;
-  monorepoRootEnvPath: string;
-  gatewayLocalEnvPath: string;
-  daemonEnvPath: string;
-  monorepoRootConfigPath: string;
-  gatewayLocalConfigPath: string;
-}
-
-interface ModuleGraphFixtureOptions {
-  rootEnvMode?: 'present' | 'absent';
-  rootTier?: StorageTier;
-  rootEnvContents?: string;
-  redactionMarker?: string;
-  gatewayLocalTier?: StorageTier;
-  gatewayLocalEnvContents?: string;
-  daemonEnvContents?: string;
-  inheritedTier?: StorageTier;
-  expectedProcessTier?: string;
-  setup?: (fixture: ModuleGraphFixture) => Promise<void>;
-}
-
-// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
-const MODULE_IMPORT_TIMEOUT_MS = 120_000;
-const MONOREPO_ROOT_DOTENV_LABEL = 'monorepo-root .env';
-const DAEMON_DOTENV_LABEL = 'daemon .env';
-
-function configJson(tier: StorageTier): string {
-  if (tier === 'local') {
-    return JSON.stringify({
-      tier,
-      storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
-      queue: { type: 'local', dataDir: '.mosaic/queue' },
-      memory: { type: 'keyword' },
-    });
-  }
-
-  return JSON.stringify({
-    tier,
-    storage: { type: 'postgres', url: 'postgresql://fixture.invalid/mosaic' },
-    queue: { type: 'bullmq' },
-    memory: { type: tier === 'federated' ? 'pgvector' : 'keyword' },
-  });
-}
-
-function snapshotProcessEnv(): Record<string, string | undefined> {
-  return { ...process.env };
-}
-
-function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
-  for (const key of Object.keys(process.env)) {
-    if (!(key in snapshot)) {
-      delete process.env[key];
-    }
-  }
-
-  for (const [key, value] of Object.entries(snapshot)) {
-    if (value === undefined) {
-      delete process.env[key];
-      continue;
-    }
-
-    process.env[key] = value;
-  }
-}
-
-function expectPathUnderTempRoot(path: string, tempRoot: string): void {
-  const relativePath = relative(tempRoot, path);
-  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
-    true,
-  );
-}
-
-async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
-  expectPathUnderTempRoot(path, tempRoot);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, contents, 'utf8');
-}
-
-interface ConfigModuleProvider {
-  provide: string;
-  useFactory: () => MosaicConfig;
-}
-
-function isConfigModuleProvider(value: unknown): value is ConfigModuleProvider {
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-
-  if (!('provide' in value) || typeof value.provide !== 'string') {
-    return false;
-  }
-
-  return 'useFactory' in value && typeof value.useFactory === 'function';
-}
-
-function singleBootLogLine(bootLogLines: readonly string[]): string {
-  expect(bootLogLines).toHaveLength(1);
-  const [bootLogLine] = bootLogLines;
-  if (bootLogLine === undefined) {
-    throw new Error('Expected a single boot log line');
-  }
-
-  return bootLogLine;
-}
-
-function expectBootLogLine(
-  bootLogLines: readonly string[],
-  tier: StorageTier,
-  source: string,
-): void {
-  const bootLogLine = singleBootLogLine(bootLogLines);
-
-  expect(bootLogLine).toContain(`storage tier=${tier}`);
-  expect(bootLogLine).toContain(`source=${source}`);
-}
-
-async function loadModuleGraphFromDotenv(
-  options: ModuleGraphFixtureOptions,
-): Promise<ComposedModuleGraph> {
-  const originalEnv = snapshotProcessEnv();
-  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-module-'));
-  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
-
-  try {
-    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
-    const homePath = join(tempRoot, 'home');
-    const cwdPath = join(tempRoot, 'ambient', 'parent', 'cwd');
-    const fixture: ModuleGraphFixture = {
-      tempRoot,
-      anchor,
-      homePath,
-      cwdPath,
-      monorepoRootEnvPath: resolve(anchor, '../../..', '.env'),
-      gatewayLocalEnvPath: resolve(anchor, '..', '.env'),
-      daemonEnvPath: join(homePath, '.config', 'mosaic', 'gateway', '.env'),
-      monorepoRootConfigPath: resolve(anchor, '../../..', 'mosaic.config.json'),
-      gatewayLocalConfigPath: resolve(anchor, '..', 'mosaic.config.json'),
-    };
-    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
-
-    for (const path of Object.values(fixture)) {
-      expectPathUnderTempRoot(path, tempRoot);
-    }
-
-    await mkdir(anchor, { recursive: true });
-    await mkdir(cwdPath, { recursive: true });
-
-    if ((options.rootEnvMode ?? 'present') === 'absent') {
-      if (
-        options.rootEnvContents !== undefined ||
-        options.rootTier !== undefined ||
-        options.redactionMarker !== undefined
-      ) {
-        throw new Error('Expected no root env fixture values when rootEnvMode is absent');
-      }
-    } else {
-      if (options.rootEnvContents === undefined && options.rootTier === undefined) {
-        throw new Error('Expected rootTier or rootEnvContents');
-      }
-
-      const rootFixture = options.rootEnvContents ?? `MOSAIC_STORAGE_TIER=${options.rootTier}\n`;
-      const rootFixtureWithMarker = options.redactionMarker
-        ? `${rootFixture}BETTER_AUTH_SECRET=${options.redactionMarker}\n`
-        : rootFixture;
-      await writeFixture(fixture.monorepoRootEnvPath, rootFixtureWithMarker, tempRoot);
-    }
-
-    if (options.daemonEnvContents !== undefined) {
-      await writeFixture(fixture.daemonEnvPath, options.daemonEnvContents, tempRoot);
-    }
-
-    if (options.gatewayLocalEnvContents !== undefined) {
-      await writeFixture(fixture.gatewayLocalEnvPath, options.gatewayLocalEnvContents, tempRoot);
-    } else if (options.gatewayLocalTier !== undefined) {
-      await writeFixture(
-        fixture.gatewayLocalEnvPath,
-        `MOSAIC_STORAGE_TIER=${options.gatewayLocalTier}\n`,
-        tempRoot,
-      );
-    }
-
-    process.env['HOME'] = homePath;
-    delete process.env['MOSAIC_STORAGE_TIER'];
-    delete process.env['DATABASE_URL'];
-    delete process.env['VALKEY_URL'];
-    delete process.env['MOSAIC_GATEWAY_HOME'];
-
-    await options.setup?.(fixture);
-
-    if (options.inheritedTier !== undefined) {
-      process.env['MOSAIC_STORAGE_TIER'] = options.inheritedTier;
-    }
-
-    vi.resetModules();
-    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
-    vi.doMock('node:url', () => ({
-      ...nodeUrl,
-      fileURLToPath: (url: string | URL): string => {
-        const actualPath = nodeUrl.fileURLToPath(url);
-        if (
-          actualPath.endsWith('/apps/gateway/src/env.ts') ||
-          actualPath.endsWith('/apps/gateway/src/env.js')
-        ) {
-          return join(anchor, 'env.ts');
-        }
-        return actualPath;
-      },
-    }));
-    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
-
-    if (options.inheritedTier === undefined) {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBeUndefined();
-    } else {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBe(options.inheritedTier);
-    }
-
-    const envModule = await import('./env.js');
-    expect(process.env['MOSAIC_STORAGE_TIER']).toBe(
-      options.expectedProcessTier ?? options.rootTier,
-    );
-
-    const { AppModule } = await import('./app.module.js');
-    const { FederationModule } = await import('./federation/federation.module.js');
-    const imports: unknown = Reflect.getMetadata(MODULE_METADATA.IMPORTS, AppModule);
-
-    if (!Array.isArray(imports)) {
-      throw new Error('AppModule imports metadata is not an array');
-    }
-
-    const { ConfigModule, MOSAIC_CONFIG } = await import('./config/config.module.js');
-    const providers: unknown = Reflect.getMetadata(MODULE_METADATA.PROVIDERS, ConfigModule);
-
-    if (!Array.isArray(providers)) {
-      throw new Error('ConfigModule providers metadata is not an array');
-    }
-
-    const configProvider = providers
-      .filter(isConfigModuleProvider)
-      .find((provider: ConfigModuleProvider): boolean => provider.provide === MOSAIC_CONFIG);
-
-    if (!configProvider) {
-      throw new Error('MOSAIC_CONFIG provider factory not found');
-    }
-
-    return {
-      imports,
-      federationModule: FederationModule,
-      bootLogLines: consoleInfoSpy.mock.calls.map((args: readonly unknown[]): string =>
-        args.map((value: unknown): string => String(value)).join(' '),
-      ),
-      mosaicConfig: configProvider.useFactory(),
-      resolvedConfigPath: envModule.resolveGatewayConfigPath(),
-    };
-  } finally {
-    cwdSpy?.mockRestore();
-    vi.doUnmock('node:url');
-    vi.doUnmock('node:os');
-    vi.resetModules();
-    consoleInfoSpy?.mockRestore();
-    restoreProcessEnv(originalEnv);
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-}
-
-describe('AppModule federation gating', (): void => {
-  it('loads dotenv before tracing and AppModule evaluation', async (): Promise<void> => {
-    const mainSource = await readFile(new URL('./main.ts', import.meta.url), 'utf8');
-    const envImportIndex = mainSource.indexOf("import './env.js';");
-    const tracingImportIndex = mainSource.indexOf("import './tracing.js';");
-    const appModuleImportIndex = mainSource.indexOf("import { AppModule } from './app.module.js';");
-
-    expect(envImportIndex).toBeGreaterThan(-1);
-    expect(envImportIndex).toBeLessThan(tracingImportIndex);
-    expect(envImportIndex).toBeLessThan(appModuleImportIndex);
-  });
-
-  it(
-    'ignores ambient cwd/.env and cwd/../.env files',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-          await writeFixture(
-            resolve(fixture.cwdPath, '..', '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/../../mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            resolve(fixture.cwdPath, '../..', 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'anchored gateway-local config wins monorepo-root config and registers FederationModule',
-    async (): Promise<void> => {
-      let gatewayLocalConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          gatewayLocalConfigPath = fixture.gatewayLocalConfigPath;
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(gatewayLocalConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'resolves the daemon-installed GATEWAY_HOME/mosaic.config.json ahead of gateway-local and monorepo-root configs',
-    async (): Promise<void> => {
-      let daemonConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          const externalGatewayHome = join(fixture.tempRoot, 'external-gateway-home');
-          daemonConfigPath = join(externalGatewayHome, 'mosaic.config.json');
-          await writeFixture(daemonConfigPath, configJson('federated'), fixture.tempRoot);
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('standalone'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-          process.env['MOSAIC_GATEWAY_HOME'] = externalGatewayHome;
-          process.env['DATABASE_URL'] = 'postgresql://fixture.invalid/mosaic';
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(daemonConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs mosaic.config.json when anchored config and env tiers are both federated',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs standalone from a monorepo-root .env DATABASE_URL fallback',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'DATABASE_URL=fixture-database-url\n',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes an invalid monorepo-root dotenv tier to the default',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'MOSAIC_STORAGE_TIER=invalid\n',
-        expectedProcessTier: 'invalid',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', 'default');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes DATABASE_URL fallback to daemon .env ahead of inherited local tier',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        daemonEnvContents: 'DATABASE_URL=fixture-database-url\n',
-        inheritedTier: 'local',
-        expectedProcessTier: 'local',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'daemon .env wins over monorepo-root and gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=standalone\n',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'inherits process.env.MOSAIC_STORAGE_TIER over daemon, monorepo-root, and gateway-local dotenv values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=federated\n',
-        inheritedTier: 'standalone',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', 'process environment');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'gateway-local .env configures the tier and source when the monorepo-root .env is absent',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        gatewayLocalTier: 'federated',
-        expectedProcessTier: 'federated',
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'gateway-local .env');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'monorepo-root .env wins over gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'standalone',
-        gatewayLocalTier: 'federated',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it.each(['local', 'standalone'] as const)(
-    'does not register FederationModule for the %s tier',
-    async (tier): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({ rootTier: tier });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, tier, MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'registers FederationModule when federated tier is supplied by the anchored monorepo root .env',
-    async (): Promise<void> => {
-      const redactionMarker = 'redaction-fixture-marker';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        redactionMarker,
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', MONOREPO_ROOT_DOTENV_LABEL);
-      expect(singleBootLogLine(graph.bootLogLines)).not.toContain(redactionMarker);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider ignores an ambient cwd/mosaic.config.json config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            JSON.stringify({
-              tier: 'federated',
-              storage: {
-                type: 'postgres',
-                url: 'postgresql://ambient-attacker.invalid/mosaic',
-                enableVector: true,
-              },
-              queue: { type: 'bullmq' },
-              memory: { type: 'pgvector' },
-            }),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('local');
-      expect(graph.mosaicConfig.storage).not.toEqual(
-        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider resolves from the anchored monorepo-root mosaic.config.json',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.mosaicConfig.storage).toEqual(
-        expect.objectContaining({ url: 'postgresql://fixture.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-});

apps/gateway/src/app.module.ts

@@ -26,16 +26,6 @@ import { WorkspaceModule } from './workspace/workspace.module.js';
 import { QueueModule } from './queue/queue.module.js';
 import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
-import { loadConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from './env.js';
-
-// Federation (step-ca client, enrollment, federation verbs) is only wired for
-// tier 'federated' — CaService hard-requires STEP_CA_* at construction, which
-// must not gate standalone/local boots (docker-compose.federated.yml: the
-// federation profile "must not start in non-federated dev"). The gateway
-// entrypoint loads env.ts before evaluating this module so dotenv-backed tier
-// configuration is visible here.
-const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'federated';
 
 @Module({
   imports: [
@@ -63,7 +53,7 @@ const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'feder
     QueueModule,
     ReloadModule,
     WorkspaceModule,
-    ...(federationEnabled ? [FederationModule] : []),
+    FederationModule,
   ],
   controllers: [HealthController],
   providers: [

apps/gateway/src/chat/chat.dto.ts

@@ -1,4 +1,3 @@
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
 import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
 
 export class ChatRequestDto {
@@ -33,7 +32,4 @@ export class ChatSocketMessageDto {
   @IsOptional()
   @IsUUID()
   agentId?: string;
-
-  /** Validated channel attachment references; binary content is not embedded. */
-  attachments?: readonly ChannelAttachmentDto[];
 }

apps/gateway/src/chat/chat.gateway-redaction.spec.ts

@@ -4,10 +4,6 @@ import { ChatGateway } from './chat.gateway.js';
 const CONVERSATION_ID = 'conversation-1';
 const CANARY = 'sk_canary12345678';
 
-function clientConversationKey(clientId: string, conversationId: string): string {
-  return `${clientId}\u0000${conversationId}`;
-}
-
 type GatewayInternals = {
   clientSessions: Map<string, unknown>;
   relayEvent(client: unknown, conversationId: string, event: unknown): void;
@@ -44,7 +40,6 @@ describe('ChatGateway redaction boundary', (): void => {
       emit: vi.fn(),
     };
     const session = {
-      clientId: client.id,
       conversationId: CONVERSATION_ID,
       cleanup: vi.fn(),
       assistantText: '',
@@ -52,7 +47,7 @@ describe('ChatGateway redaction boundary', (): void => {
       pendingToolCalls: new Map(),
       scope: { userId: 'user-1', tenantId: 'tenant-1' },
     };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), session);
+    gateway.clientSessions.set(client.id, session);
 
     gateway.relayEvent(client, CONVERSATION_ID, {
       type: 'message_update',
@@ -144,51 +139,6 @@ describe('ChatGateway redaction boundary', (): void => {
     });
   });
 
-  it('isolates concurrent conversation streams sharing one Discord socket', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'discord-client',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const firstConversation = 'Nova:discord:thread-1';
-    const secondConversation = 'Nova:discord:thread-2';
-    const createSession = (conversationId: string) => ({
-      clientId: client.id,
-      conversationId,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-    const firstSession = createSession(firstConversation);
-    const secondSession = createSession(secondConversation);
-    gateway.clientSessions.set(clientConversationKey(client.id, firstConversation), firstSession);
-    gateway.clientSessions.set(clientConversationKey(client.id, secondConversation), secondSession);
-
-    gateway.relayEvent(client, firstConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'first response ' },
-    });
-    gateway.relayEvent(client, secondConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'second response ' },
-    });
-
-    expect(firstSession.assistantText).toBe('first response ');
-    expect(secondSession.assistantText).toBe('second response ');
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: firstConversation,
-      text: 'first response ',
-    });
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: secondConversation,
-      text: 'second response ',
-    });
-  });
-
   it('persists only redacted assistant content with classifications', (): void => {
     const { gateway, brain } = buildGateway();
     const client = {
@@ -197,8 +147,7 @@ describe('ChatGateway redaction boundary', (): void => {
       data: { user: { id: 'user-1' } },
       emit: vi.fn(),
     };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), {
+    gateway.clientSessions.set(client.id, {
-      clientId: client.id,
       conversationId: CONVERSATION_ID,
       cleanup: vi.fn(),
       assistantText: CANARY,

apps/gateway/src/chat/chat.gateway.ts

@@ -17,7 +17,6 @@ import {
   parseDiscordInteractionBindings,
   resolveDiscordInteractionActorId,
   resolveDiscordInteractionBinding,
-  type DiscordAttachment,
   type DiscordIngressEnvelope,
   type DiscordIngressPayload,
 } from '@mosaicstack/discord-plugin';
@@ -31,7 +30,6 @@ import type {
   SystemReloadPayload,
   RoutingDecisionInfo,
   AbortPayload,
-  ChannelAttachmentDto,
 } from '@mosaicstack/types';
 import { AgentService, type ConversationHistoryMessage } from '../agent/agent.service.js';
 import {
@@ -39,7 +37,7 @@ import {
   RuntimeProviderService,
   type RuntimeAuditSink,
 } from '../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../agent/durable-session.service.js';
+import { TessDurableSessionService } from '../agent/tess-durable-session.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
 import {
   scopeFromUser,
@@ -58,7 +56,6 @@ import { DiscordReplayProtector } from '../plugin/discord-replay-protector.js';
 
 /** Per-client state tracking streaming accumulation for persistence. */
 interface ClientSession {
-  clientId: string;
   conversationId: string;
   cleanup: () => void;
   /** Accumulated assistant response text for the current turn. */
@@ -79,68 +76,6 @@ interface ClientSession {
  */
 const modelOverrides = new Map<string, string>();
 const MAX_REDACTION_BUFFER_LENGTH = 8_192;
-const MAX_CHANNEL_ATTACHMENTS = 10;
-const MAX_ATTACHMENT_METADATA_BYTES = 16_384;
-const MAX_ATTACHMENT_ID_LENGTH = 128;
-const MAX_ATTACHMENT_NAME_LENGTH = 255;
-const MAX_ATTACHMENT_URL_LENGTH = 2_048;
-const MAX_ATTACHMENT_MIME_LENGTH = 255;
-
-function isSafeAttachmentUrl(value: string): boolean {
-  if (value.length === 0 || value.length > MAX_ATTACHMENT_URL_LENGTH) return false;
-  try {
-    const url = new URL(value);
-    return (
-      url.protocol === 'https:' &&
-      !url.username &&
-      !url.password &&
-      !url.hash &&
-      url.search.length === 0
-    );
-  } catch {
-    return false;
-  }
-}
-
-function hasValidAttachmentBounds(value: {
-  id: string;
-  name: string;
-  url: string;
-  sizeBytes?: number;
-}): boolean {
-  return (
-    value.id.length > 0 &&
-    value.id.length <= MAX_ATTACHMENT_ID_LENGTH &&
-    value.name.length > 0 &&
-    value.name.length <= MAX_ATTACHMENT_NAME_LENGTH &&
-    isSafeAttachmentUrl(value.url) &&
-    (value.sizeBytes === undefined || (Number.isFinite(value.sizeBytes) && value.sizeBytes >= 0))
-  );
-}
-
-function isDiscordAttachment(value: unknown): value is DiscordAttachment {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<DiscordAttachment>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.contentType === null ||
-      (typeof attachment.contentType === 'string' &&
-        attachment.contentType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as DiscordAttachment)
-  );
-}
-
-function hasValidAttachmentArray(value: unknown, guard: (attachment: unknown) => boolean): boolean {
-  return (
-    Array.isArray(value) &&
-    value.length <= MAX_CHANNEL_ATTACHMENTS &&
-    JSON.stringify(value).length <= MAX_ATTACHMENT_METADATA_BYTES &&
-    value.every(guard)
-  );
-}
 
 function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelope {
   if (typeof value !== 'object' || value === null) return false;
@@ -153,8 +88,7 @@ function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelo
     return false;
   }
   const payload = envelope.payload as Record<string, unknown>;
-  return (
+  return [
-    [
     payload['correlationId'],
     payload['messageId'],
     payload['guildId'],
@@ -162,40 +96,15 @@ function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelo
     payload['userId'],
     payload['conversationId'],
     payload['content'],
-    ].every((field: unknown): boolean => typeof field === 'string') &&
+  ].every((field: unknown): boolean => typeof field === 'string');
-    (payload['threadId'] === undefined || typeof payload['threadId'] === 'string') &&
-    (payload['attachments'] === undefined ||
-      hasValidAttachmentArray(payload['attachments'], isDiscordAttachment))
-  );
-}
-
-function isChannelAttachment(value: unknown): value is ChannelAttachmentDto {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<ChannelAttachmentDto>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.mimeType === null ||
-      (typeof attachment.mimeType === 'string' &&
-        attachment.mimeType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as ChannelAttachmentDto)
-  );
 }
 
 function isChatSocketMessage(value: unknown): value is ChatSocketMessageDto {
   if (typeof value !== 'object' || value === null) return false;
-  const payload = value as {
+  const payload = value as { content?: unknown; conversationId?: unknown };
-    content?: unknown;
-    conversationId?: unknown;
-    attachments?: unknown;
-  };
   return (
     typeof payload.content === 'string' &&
-    (payload.conversationId === undefined || typeof payload.conversationId === 'string') &&
+    (payload.conversationId === undefined || typeof payload.conversationId === 'string')
-    (payload.attachments === undefined ||
-      hasValidAttachmentArray(payload.attachments, isChannelAttachment))
   );
 }
 
@@ -231,8 +140,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @Inject(RuntimeProviderService)
     private readonly runtimeRegistry: RuntimeProviderService | null = null,
     @Optional()
-    @Inject(DurableSessionService)
+    @Inject(TessDurableSessionService)
-    private readonly durableSessions: DurableSessionService | null = null,
+    private readonly durableSessions: TessDurableSessionService | null = null,
     @Optional()
     @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
     private readonly runtimeAudit: RuntimeAuditSink | null = null,
@@ -265,24 +174,20 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   handleDisconnect(client: Socket): void {
     this.logger.log(`Client disconnected: ${client.id}`);
-    for (const [key, session] of this.clientSessions) {
+    const session = this.clientSessions.get(client.id);
-      if (session.clientId !== client.id) continue;
+    if (session) {
       session.cleanup();
       this.agentService.removeChannel(
         session.conversationId,
         `websocket:${client.id}`,
         session.scope,
       );
-      this.clientSessions.delete(key);
+      this.clientSessions.delete(client.id);
-      this.textEgressBuffers.delete(key);
-      this.thinkingEgressBuffers.delete(key);
-      this.overflowedEgress.delete(`${key}:agent:text`);
-      this.overflowedEgress.delete(`${key}:agent:thinking`);
     }
-  }
+    this.textEgressBuffers.delete(client.id);
-
+    this.thinkingEgressBuffers.delete(client.id);
-  private clientConversationKey(client: Pick<Socket, 'id'>, conversationId: string): string {
+    this.overflowedEgress.delete(this.egressKey(client, 'agent:text'));
-    return `${client.id}\u0000${conversationId}`;
+    this.overflowedEgress.delete(this.egressKey(client, 'agent:thinking'));
   }
 
   private getClientScope(client: Socket): ActorTenantScope | null {
@@ -313,25 +218,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       }
       discordIngress = this.resolveDiscordIngress(client, rawData);
       if (!discordIngress) return;
-      data = {
+      data = { conversationId: discordIngress.conversationId, content: discordIngress.content };
-        conversationId: discordIngress.conversationId,
-        content: discordIngress.content,
-        ...(discordIngress.attachments
-          ? {
-              attachments: discordIngress.attachments.map(
-                (attachment): ChannelAttachmentDto => ({
-                  id: attachment.id,
-                  name: attachment.name,
-                  url: attachment.url,
-                  mimeType: attachment.contentType,
-                  ...(attachment.sizeBytes !== undefined
-                    ? { sizeBytes: attachment.sizeBytes }
-                    : {}),
-                }),
-              ),
-            }
-          : {}),
-      };
     } else {
       if (!isChatSocketMessage(rawData)) {
         this.logger.warn(`Rejected malformed chat message from ${client.id}`);
@@ -340,7 +227,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       data = rawData;
     }
     const conversationId = data.conversationId ?? uuid();
-    const clientConversationKey = this.clientConversationKey(client, conversationId);
     const discordServiceUserId = process.env['DISCORD_SERVICE_USER_ID'];
     if (discordIngress && !discordServiceUserId) {
       this.logger.warn(
@@ -395,7 +281,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           this.logger.log(
             `Using /model override "${modelOverride}" for conversation=${conversationId}`,
           );
-        } else if (!resolvedProvider && !resolvedModelId && !discordIngress) {
+        } else if (!resolvedProvider && !resolvedModelId) {
           // No explicit provider/model from client — use routing engine (M4-012)
           try {
             const routingDecision = await this.routingEngine.resolve(data.content, userId);
@@ -418,24 +304,12 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           }
         }
 
-        let resolvedAgentConfigId = data.agentId;
-        if (discordIngress) {
-          const binding = this.discordBindingFor(discordIngress, 'send');
-          const agentConfig = binding
-            ? await this.brain.agents.findById(binding.agentConfigId)
-            : undefined;
-          if (!binding || !agentConfig || agentConfig.name !== binding.instanceId) {
-            throw new Error('Configured Discord logical agent is not provisioned');
-          }
-          resolvedAgentConfigId = agentConfig.id;
-        }
-
         // M5-004: Use existingSessionId as sessionId when available (session reuse)
         const sessionIdToCreate = existingSessionId ?? conversationId;
         agentSession = await this.agentService.createSession(sessionIdToCreate, {
           provider: resolvedProvider,
           modelId: resolvedModelId,
-          agentConfigId: resolvedAgentConfigId,
+          agentConfigId: data.agentId,
           userId,
           tenantId: scope.tenantId,
           conversationHistory: conversationHistory.length > 0 ? conversationHistory : undefined,
@@ -486,17 +360,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
                     discordUserId: discordIngress?.userId,
                   }
                 : {}),
-              ...(data.attachments && data.attachments.length > 0
-                ? {
-                    channelAttachments: data.attachments.map(
-                      (attachment): ChannelAttachmentDto => ({
-                        ...attachment,
-                        name: redactSensitiveContent(attachment.name).content,
-                        url: redactSensitiveContent(attachment.url).content,
-                      }),
-                    ),
-                  }
-                : {}),
               classifications: redactSensitiveContent(data.content).classifications,
             },
           },
@@ -511,7 +374,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
 
     // Always clean up previous listener to prevent leak
-    const existing = this.clientSessions.get(clientConversationKey);
+    const existing = this.clientSessions.get(client.id);
     if (existing) {
       existing.cleanup();
     }
@@ -526,11 +389,10 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     );
 
     // Preserve routing decision from the existing client session if we didn't get a new one
-    const prevClientSession = this.clientSessions.get(clientConversationKey);
+    const prevClientSession = this.clientSessions.get(client.id);
     const routingDecisionToStore = sessionRoutingDecision ?? prevClientSession?.lastRoutingDecision;
 
-    this.clientSessions.set(clientConversationKey, {
+    this.clientSessions.set(client.id, {
-      clientId: client.id,
       conversationId,
       cleanup,
       assistantText: '',
@@ -576,7 +438,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
     // Dispatch to agent
     try {
-      await this.agentService.prompt(conversationId, data.content, scope, data.attachments);
+      await this.agentService.prompt(conversationId, data.content, scope);
     } catch (err) {
       this.logger.error(
         `Agent prompt failed for client=${client.id}, conversation=${conversationId}`,
@@ -783,9 +645,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     };
 
     // Emit to all clients currently subscribed to this conversation
-    for (const session of this.clientSessions.values()) {
+    for (const [clientId, session] of this.clientSessions) {
       if (session.conversationId === conversationId && this.scopesEqual(session.scope, scope)) {
-        const socket = this.server.sockets.sockets.get(session.clientId);
+        const socket = this.server.sockets.sockets.get(clientId);
         if (socket?.connected) {
           socket.emit('session:info', payload);
         }
@@ -815,10 +677,16 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       !this.durableSessions
     )
       return;
-    const binding = this.discordBindingFor(ingress, 'approve');
+    const binding = resolveDiscordInteractionBinding(
+      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
+      ingress.guildId,
+      ingress.channelId,
+      ingress.userId,
+      'approve',
+    );
     const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    const agentName = binding?.instanceId;
+    const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
-    if (!actorId || !agentName) {
+    if (!actorId || !agentName || binding.instanceId !== agentName) {
       this.logger.warn(
         `Rejected Discord approval without a matching runtime agent from ${client.id}`,
       );
@@ -906,7 +774,13 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
     if (!ingress || !approvalRef || !tenantId || !this.runtimeRegistry || !this.durableSessions)
       return;
-    const binding = this.discordBindingFor(ingress, 'stop');
+    const binding = resolveDiscordInteractionBinding(
+      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
+      ingress.guildId,
+      ingress.channelId,
+      ingress.userId,
+      'stop',
+    );
     const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
     if (!actorId) return;
 
@@ -980,18 +854,17 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       return null;
     }
     try {
-      const binding = this.discordBindingFor(payload, operation);
+      const binding = resolveDiscordInteractionBinding(
+        parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
+        payload.guildId,
+        payload.channelId,
+        payload.userId,
+        operation,
+      );
       if (!binding) {
         this.logger.warn(`Rejected unpaired Discord ingress from ${client.id}`);
         return null;
       }
-      const expectedConversationId = `${binding.instanceId}:discord:${payload.threadId ?? payload.channelId}`;
-      if (payload.conversationId !== expectedConversationId) {
-        this.logger.warn(
-          `Rejected Discord ingress for a different logical agent from ${client.id}`,
-        );
-        return null;
-      }
     } catch {
       this.logger.warn(
         `Rejected Discord ingress without valid binding configuration from ${client.id}`,
@@ -1007,19 +880,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     return payload;
   }
 
-  private discordBindingFor(
-    payload: DiscordIngressPayload,
-    operation: 'send' | 'approve' | 'stop',
-  ) {
-    return resolveDiscordInteractionBinding(
-      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-      payload.guildId,
-      payload.channelId,
-      payload.userId,
-      operation,
-    );
-  }
-
   private readDiscordAllowlist(name: string): string[] {
     return (process.env[name] ?? '')
       .split(',')
@@ -1098,15 +958,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       const messages = await this.brain.conversations.findMessages(conversationId, userId);
       if (messages.length === 0) return [];
 
-      return messages.map((msg) => {
+      return messages.map((msg) => ({
-        const attachments = this.persistedChannelAttachments(msg.metadata);
-        return {
         role: msg.role as 'user' | 'assistant' | 'system',
         content: msg.content,
         createdAt: msg.createdAt,
-          ...(attachments ? { attachments } : {}),
+      }));
-        };
-      });
     } catch (err) {
       this.logger.error(
         `Failed to load conversation history for conversation=${conversationId}`,
@@ -1116,14 +972,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
   }
 
-  private persistedChannelAttachments(metadata: unknown): readonly ChannelAttachmentDto[] | null {
-    if (typeof metadata !== 'object' || metadata === null) return null;
-    const attachments = (metadata as { channelAttachments?: unknown }).channelAttachments;
-    return hasValidAttachmentArray(attachments, isChannelAttachment)
-      ? (attachments as readonly ChannelAttachmentDto[])
-      : null;
-  }
-
   private appendAndFlushRedactedEgress(
     client: Socket,
     conversationId: string,
@@ -1131,19 +979,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     buffers: Map<string, string>,
     delta: string,
   ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
+    const key = this.egressKey(client, eventName);
-    const key = this.egressKey(client, conversationId, eventName);
     if (this.overflowedEgress.has(key)) return;
 
-    const buffered = `${buffers.get(sessionKey) ?? ''}${delta}`;
+    const buffered = `${buffers.get(client.id) ?? ''}${delta}`;
     if (buffered.length > MAX_REDACTION_BUFFER_LENGTH) {
-      buffers.delete(sessionKey);
+      buffers.delete(client.id);
       this.overflowedEgress.add(key);
       client.emit(eventName, { conversationId, text: '[REDACTED_STREAM_OVERFLOW]' });
       return;
     }
 
-    buffers.set(sessionKey, buffered);
+    buffers.set(client.id, buffered);
     this.flushRedactedEgress(client, conversationId, eventName, buffers, false);
   }
 
@@ -1159,22 +1006,21 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     buffers: Map<string, string>,
     final: boolean,
   ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
+    const key = this.egressKey(client, eventName);
-    const key = this.egressKey(client, conversationId, eventName);
     if (this.overflowedEgress.has(key)) {
       if (final) this.overflowedEgress.delete(key);
       return;
     }
 
-    const buffered = buffers.get(sessionKey) ?? '';
+    const buffered = buffers.get(client.id) ?? '';
     const releaseLength = final ? buffered.length : this.safeRedactionPrefixLength(buffered);
     const released = buffered.slice(0, releaseLength);
     const pending = buffered.slice(releaseLength);
 
     if (pending) {
-      buffers.set(sessionKey, pending);
+      buffers.set(client.id, pending);
     } else {
-      buffers.delete(sessionKey);
+      buffers.delete(client.id);
     }
 
     if (released) {
@@ -1243,12 +1089,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     return retainedFrom;
   }
 
-  private egressKey(
+  private egressKey(client: Socket, eventName: 'agent:text' | 'agent:thinking'): string {
-    client: Socket,
+    return `${client.id}:${eventName}`;
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-  ): string {
-    return `${this.clientConversationKey(client, conversationId)}:${eventName}`;
   }
 
   private relayEvent(client: Socket, conversationId: string, event: AgentSessionEvent): void {
@@ -1259,27 +1101,26 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       return;
     }
 
-    const sessionKey = this.clientConversationKey(client, conversationId);
     switch (event.type) {
       case 'agent_start': {
         // Reset accumulation buffers for the new turn
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.assistantText = '';
           cs.toolCalls = [];
           cs.pendingToolCalls.clear();
         }
-        this.textEgressBuffers.set(sessionKey, '');
+        this.textEgressBuffers.set(client.id, '');
-        this.thinkingEgressBuffers.set(sessionKey, '');
+        this.thinkingEgressBuffers.set(client.id, '');
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:text'));
+        this.overflowedEgress.delete(this.egressKey(client, 'agent:text'));
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:thinking'));
+        this.overflowedEgress.delete(this.egressKey(client, 'agent:thinking'));
         client.emit('agent:start', { conversationId });
         break;
       }
 
       case 'agent_end': {
         // Gather usage stats from the Pi session
-        const activeClientSession = this.clientSessions.get(sessionKey);
+        const activeClientSession = this.clientSessions.get(client.id);
         const agentSession = activeClientSession
           ? this.agentService.getSession(conversationId, activeClientSession.scope)
           : undefined;
@@ -1332,7 +1173,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         }
 
         // Persist the assistant message with metadata
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         const userId = (client.data.user as { id: string } | undefined)?.id;
         if (cs && userId && cs.assistantText.trim().length > 0) {
           const metadata: Record<string, unknown> = {
@@ -1384,7 +1225,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         const assistantEvent = event.assistantMessageEvent;
         if (assistantEvent.type === 'text_delta') {
           // Keep raw stream material in memory only; persist and emit only redacted text.
-          const cs = this.clientSessions.get(sessionKey);
+          const cs = this.clientSessions.get(client.id);
           if (cs) {
             cs.assistantText += assistantEvent.delta;
           }
@@ -1409,7 +1250,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
       case 'tool_execution_start': {
         // Track pending tool call for later recording
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.pendingToolCalls.set(event.toolCallId, {
             toolName: event.toolName,
@@ -1426,7 +1267,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
       case 'tool_execution_end': {
         // Finalise tool call record
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           const pending = cs.pendingToolCalls.get(event.toolCallId);
           cs.toolCalls.push({

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -72,13 +72,13 @@ const mockChatGateway = {
   broadcastSessionInfo: vi.fn(),
 };
 
-function buildService(redis: typeof mockRedis | null = mockRedis): CommandExecutorService {
+function buildService(): CommandExecutorService {
   return new CommandExecutorService(
     mockRegistry as never,
     mockAgentService as never,
     mockSystemOverride as never,
     mockSessionGC as never,
-    redis as never,
+    mockRedis as never,
     mockBrain as never,
     null,
     mockChatGateway as never,
@@ -131,22 +131,6 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(ttl).toBe(300);
   });
 
-  it('/provider login remains available without Redis on the local tier', async () => {
-    const localService = buildService(null);
-    const payload: SlashCommandPayload = {
-      command: 'provider',
-      args: 'login anthropic',
-      conversationId,
-    };
-
-    const result = await localService.execute(payload, userScope);
-
-    expect(result.success).toBe(true);
-    expect(result.message).not.toContain('token=');
-    expect(result.data).toEqual({ provider: 'anthropic' });
-    expect(mockRedis.set).not.toHaveBeenCalled();
-  });
-
   // /provider with no args — returns usage
   it('/provider with no args returns usage message', async () => {
     const payload: SlashCommandPayload = { command: 'provider', conversationId };

apps/gateway/src/commands/command-executor.service.ts

@@ -23,10 +23,7 @@ export class CommandExecutorService {
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(SystemOverrideService) private readonly systemOverride: SystemOverrideService,
     @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
-    // On Local tier COMMANDS_REDIS is null — provider login caching is skipped.
+    @Inject(COMMANDS_REDIS) private readonly redis: QueueHandle['redis'],
-    @Optional()
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
     @Inject(BRAIN) private readonly brain: Brain,
     @Optional()
     @Inject(forwardRef(() => ReloadService))
@@ -446,7 +443,6 @@ export class CommandExecutorService {
           byte.toString(16).padStart(2, '0'),
         ).join('');
         const key = `mosaic:auth:poll:${tokenHash}`;
-        if (this.redis) {
         // Persist only a short-lived token digest. The raw token is delivered only by
         // the authenticated dashboard flow, never in chat output or command metadata.
         await this.redis.set(
@@ -455,7 +451,6 @@ export class CommandExecutorService {
           'EX',
           300,
         );
-        }
         return {
           command: 'provider',
           success: true,

apps/gateway/src/commands/commands.module.ts

@@ -1,7 +1,5 @@
-import { forwardRef, Inject, Module, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { forwardRef, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
@@ -18,17 +16,13 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
   providers: [
     {
       provide: COMMANDS_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
+      useFactory: (): QueueHandle => {
-        // On Local tier there is no Redis — skip the ioredis connection.
-        // CommandExecutorService falls back to no-cache for /provider login on local.
-        if (config?.queue?.type === 'local') return null;
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: COMMANDS_REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
@@ -44,13 +38,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
   ],
 })
 export class CommandsModule implements OnApplicationShutdown {
-  constructor(
+  constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
-    @Optional()
-    @Inject(COMMANDS_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/config/config.module.ts

@@ -1,6 +1,5 @@
 import { Global, Module } from '@nestjs/common';
 import { loadConfig, type MosaicConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from '../env.js';
 
 export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
 
@@ -9,7 +8,7 @@ export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
   providers: [
     {
       provide: MOSAIC_CONFIG,
-      useFactory: (): MosaicConfig => loadConfig(resolveGatewayConfigPath()),
+      useFactory: (): MosaicConfig => loadConfig(),
     },
   ],
   exports: [MOSAIC_CONFIG],

apps/gateway/src/coord/coord.module.ts

@@ -1,32 +1,10 @@
 import { Module } from '@nestjs/common';
-import { InMemoryInteractionCoordinationPort } from '@mosaicstack/coord';
 import { CoordService } from './coord.service.js';
 import { CoordController } from './coord.controller.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import {
-  COORDINATION_CONFIG,
-  COORDINATION_PORT,
-  InteractionCoordinationService,
-} from './interaction-coordination.service.js';
 
 @Module({
-  providers: [
+  providers: [CoordService],
-    CoordService,
+  controllers: [CoordController],
-    {
+  exports: [CoordService],
-      provide: COORDINATION_PORT,
-      useFactory: (): InMemoryInteractionCoordinationPort =>
-        new InMemoryInteractionCoordinationPort(),
-    },
-    {
-      provide: COORDINATION_CONFIG,
-      useFactory: () => ({
-        interactionAgentId: process.env['MOSAIC_AGENT_NAME'],
-        orchestrationAgentId: process.env['MOSAIC_ORCHESTRATOR_AGENT_NAME'],
-      }),
-    },
-    InteractionCoordinationService,
-  ],
-  controllers: [CoordController, InteractionCoordinationController],
-  exports: [CoordService, InteractionCoordinationService],
 })
 export class CoordModule {}

apps/gateway/src/coord/interaction-coordination.controller.test.ts

@@ -1,47 +0,0 @@
-const PATH_METADATA = 'path';
-import { describe, expect, it, vi } from 'vitest';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-
-const user = { id: 'operator-1', tenantId: 'tenant-a' };
-
-describe('InteractionCoordinationController', () => {
-  it('exposes the neutral canonical route and Mos compatibility alias over identical handlers', () => {
-    expect(Reflect.getMetadata(PATH_METADATA, InteractionCoordinationController)).toEqual([
-      'api/coord/interaction',
-      'api/coord/mos',
-    ]);
-    expect(InteractionCoordinationController.prototype.handoff).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.observe).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.result).toBeTypeOf('function');
-  });
-
-  it('derives actor and tenant from the authenticated user rather than handoff input', async () => {
-    const coordination = {
-      handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, 'corr-1');
-
-    expect(coordination.handoff).toHaveBeenCalledWith(
-      { idempotencyKey: 'request-1', summary: 'Implement' },
-      expect.objectContaining({
-        actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-        channelId: 'cli',
-        correlationId: 'corr-1',
-      }),
-    );
-  });
-
-  it('requires a correlation header before invoking the coordination service', async () => {
-    const coordination = { handoff: vi.fn(), observe: vi.fn(), result: vi.fn() };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await expect(
-      controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, undefined),
-    ).rejects.toThrow('X-Correlation-Id is required');
-    expect(coordination.handoff).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/coord/interaction-coordination.controller.ts

@@ -1,75 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Inject,
-  Param,
-  Post,
-  UseGuards,
-} from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type {
-  InteractionCoordinationObservationDto,
-  InteractionCoordinationResponseDto,
-  InteractionCoordinationResultDto,
-  CreateHandoffDto,
-} from './interaction-coordination.dto.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-/** Authenticated interaction-plane boundary for the handoff/observe/result-only interaction coordination contract. */
-/** `api/coord/interaction` is canonical; the Mos path remains a compatibility alias. */
-@Controller(['api/coord/interaction', 'api/coord/mos'])
-@UseGuards(AuthGuard)
-export class InteractionCoordinationController {
-  constructor(
-    @Inject(InteractionCoordinationService)
-    private readonly coordination: InteractionCoordinationService,
-  ) {}
-
-  @Post('handoff')
-  async handoff(
-    @Body() request: CreateHandoffDto,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResponseDto> {
-    return { receipt: await this.coordination.handoff(request, this.context(user, correlationId)) };
-  }
-
-  @Get(':handoffId/observe')
-  async observe(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationObservationDto> {
-    return {
-      observation: await this.coordination.observe(handoffId, this.context(user, correlationId)),
-    };
-  }
-
-  @Get(':handoffId/result')
-  async result(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResultDto> {
-    return { result: await this.coordination.result(handoffId, this.context(user, correlationId)) };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    if (!requestCorrelationId) throw new ForbiddenException('X-Correlation-Id is required');
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-}

apps/gateway/src/coord/interaction-coordination.dto.ts

@@ -1,25 +0,0 @@
-import type {
-  CoordinationObservation,
-  CoordinationResult,
-  HandoffReceipt,
-} from '@mosaicstack/coord';
-
-/** Input accepted at the gateway coordination boundary. Agent identity is not caller-controlled. */
-export interface CreateHandoffDto {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-export interface InteractionCoordinationResponseDto {
-  receipt: HandoffReceipt;
-}
-
-export interface InteractionCoordinationObservationDto {
-  observation: CoordinationObservation;
-}
-
-export interface InteractionCoordinationResultDto {
-  result: CoordinationResult;
-}

apps/gateway/src/coord/interaction-coordination.routing.e2e.test.ts

@@ -1,88 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: { id: 'operator-1', tenantId: 'tenant-1' }, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-  ],
-  exports: [AUTH, AuthGuard],
-})
-class AuthenticatedRequestModule {}
-
-describe('InteractionCoordinationController route aliases', (): void => {
-  let app: NestFastifyApplication | undefined;
-  const coordination = {
-    handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-    observe: vi.fn(async () => ({ status: 'running' })),
-    result: vi.fn(async () => ({ status: 'completed' })),
-  };
-
-  beforeAll(async (): Promise<void> => {
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule],
-      controllers: [InteractionCoordinationController],
-      providers: [{ provide: InteractionCoordinationService, useValue: coordination }],
-    }).compile();
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-  afterAll(async (): Promise<void> => app?.close());
-
-  it('routes handoff, observe, and result through the same AuthGuard-protected service for both prefixes', async (): Promise<void> => {
-    if (!app) throw new Error('test app was not initialized');
-    for (const prefix of ['/api/coord/interaction', '/api/coord/mos']) {
-      const headers = { cookie: 'session=trusted', 'x-correlation-id': `corr-${prefix}` };
-      expect(
-        (
-          await app.inject({
-            method: 'POST',
-            url: `${prefix}/handoff`,
-            headers,
-            payload: { idempotencyKey: `key-${prefix}`, summary: 'handoff' },
-          })
-        ).statusCode,
-      ).toBe(201);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/observe`, headers }))
-          .statusCode,
-      ).toBe(200);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/result`, headers }))
-          .statusCode,
-      ).toBe(200);
-    }
-    expect(coordination.handoff).toHaveBeenCalledTimes(2);
-    expect(coordination.observe).toHaveBeenCalledTimes(2);
-    expect(coordination.result).toHaveBeenCalledTimes(2);
-    expect(
-      (
-        await app.inject({
-          method: 'POST',
-          url: '/api/coord/interaction/handoff',
-          payload: { idempotencyKey: 'denied', summary: 'x' },
-        })
-      ).statusCode,
-    ).toBe(401);
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.test.ts

@@ -1,217 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import {
-  InMemoryInteractionCoordinationPort,
-  type InteractionCoordinationPort,
-  type Handoff,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import {
-  InteractionCoordinationService,
-  type InteractionCoordinationConfig,
-  type InteractionCoordinationGatewayError,
-} from './interaction-coordination.service.js';
-
-const context: RuntimeProviderRequestContext = {
-  actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-  channelId: 'cli',
-  correlationId: 'corr-1',
-};
-
-const config: InteractionCoordinationConfig = {
-  interactionAgentId: 'Nova',
-  orchestrationAgentId: 'Conductor',
-};
-
-function service(
-  port: InteractionCoordinationPort = new InMemoryInteractionCoordinationPort(),
-  options: {
-    config?: InteractionCoordinationConfig;
-    handoffIdFactory?: () => string;
-  } = {},
-): InteractionCoordinationService {
-  return new InteractionCoordinationService(
-    port,
-    options.config ?? config,
-    options.handoffIdFactory ?? (() => 'handoff-1'),
-  );
-}
-
-describe('InteractionCoordinationService authority boundary', (): void => {
-  it('derives identity and actor/tenant scope server-side, then round-trips the native adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const coordination = service(adapter);
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).resolves.toEqual({
-      handoffId: 'handoff-1',
-      targetAgentId: 'Conductor',
-      status: 'queued',
-      correlationId: 'corr-1',
-    });
-
-    adapter.recordActivity('handoff-1', 'running', 'Orchestrator accepted the request');
-    adapter.recordResult('handoff-1', 'completed', 'Merged by orchestrator');
-
-    const followUpContext = { ...context, correlationId: 'corr-2' };
-    await expect(coordination.observe('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-    });
-    await expect(coordination.result('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-      summary: 'Merged by orchestrator',
-    });
-  });
-
-  it('fails closed without calling a port when the interaction requester is unconfigured', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: '', orchestrationAgentId: 'Conductor' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({
-      code: 'unconfigured_requester',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('rejects self-delegation configuration before delivering work', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: 'Nova', orchestrationAgentId: 'Nova' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toThrow('Interaction and orchestration identities must differ');
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('denies cross-tenant observe and result before calling the adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const observe = vi.spyOn(adapter, 'observe');
-    const result = vi.spyOn(adapter, 'result');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    const otherTenant = {
-      ...context,
-      actorScope: { ...context.actorScope, tenantId: 'tenant-b' },
-    };
-    await expect(coordination.observe('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(coordination.result('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(observe).not.toHaveBeenCalled();
-    expect(result).not.toHaveBeenCalled();
-  });
-
-  it('scopes idempotency by actor and joins concurrent retries without duplicate delivery', async (): Promise<void> => {
-    let handoffSequence = 0;
-    let release: (() => void) | undefined;
-    const delivered = new Promise<void>((resolve: () => void): void => {
-      release = resolve;
-    });
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => {
-        await delivered;
-        return {
-          handoffId: handoff.handoffId,
-          targetAgentId: handoff.targetAgentId,
-          status: 'queued' as const,
-          correlationId: handoff.scope.correlationId,
-        };
-      }),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const coordination = service(adapter, {
-      handoffIdFactory: (): string => `handoff-${++handoffSequence}`,
-    });
-    const request = { idempotencyKey: 'request-1', summary: 'Implement the requested feature' };
-
-    const first = coordination.handoff(request, context);
-    const retry = coordination.handoff(request, context);
-    expect(adapter.handoff).toHaveBeenCalledTimes(1);
-    release?.();
-    await expect(Promise.all([first, retry])).resolves.toEqual([
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-    ]);
-
-    await expect(
-      coordination.handoff(request, {
-        ...context,
-        actorScope: { ...context.actorScope, userId: 'operator-2' },
-      }),
-    ).resolves.toMatchObject({ handoffId: 'handoff-2' });
-    expect(adapter.handoff).toHaveBeenCalledTimes(2);
-  });
-
-  it('rejects idempotency-key payload drift and malformed handoff input before delivery', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-1', summary: 'Different work' }, context),
-    ).rejects.toMatchObject({
-      code: 'handoff_conflict',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-2', summary: '' }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-3', summary: 'x'.repeat(2_049) }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).toHaveBeenCalledTimes(1);
-  });
-
-  it('fails closed when the port reports a target that drifts from configuration', async (): Promise<void> => {
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => ({
-        handoffId: handoff.handoffId,
-        targetAgentId: 'Unexpected',
-        status: 'accepted' as const,
-        correlationId: handoff.scope.correlationId,
-      })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-
-    await expect(
-      service(adapter).handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({ code: 'target_drift' });
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.ts

@@ -1,303 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  InteractionCoordinationClient,
-  type CoordinationObservation,
-  type CoordinationResult,
-  type CoordinationScope,
-  type InteractionCoordinationIdentity,
-  type InteractionCoordinationPort,
-  type HandoffReceipt,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type { CreateHandoffDto } from './interaction-coordination.dto.js';
-
-export const COORDINATION_PORT = Symbol('COORDINATION_PORT');
-export const COORDINATION_CONFIG = Symbol('COORDINATION_CONFIG');
-
-const HANDOFF_TRACKING_TTL_MS = 60 * 60 * 1_000;
-const MAX_TRACKED_HANDOFFS = 1_000;
-const MAX_IDEMPOTENCY_KEY_LENGTH = 128;
-const MAX_SUMMARY_LENGTH = 2_048;
-const MAX_CONTEXT_LENGTH = 8_192;
-const MAX_MISSION_ID_LENGTH = 128;
-
-export interface InteractionCoordinationConfig {
-  interactionAgentId?: string;
-  orchestrationAgentId?: string;
-}
-
-interface HandoffOwner {
-  actorId: string;
-  tenantId: string;
-  requesterAgentId: string;
-  correlationId: string;
-  expiresAt: number;
-}
-
-interface NormalizedHandoffRequest {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-interface TrackedHandoff {
-  request: NormalizedHandoffRequest;
-  receipt: Promise<HandoffReceipt>;
-  expiresAt: number;
-}
-
-/**
- * Gateway authority boundary for the interaction agent. It derives requester,
- * actor, and tenant from trusted server configuration and authentication; no
- * channel request can name a target or gain orchestrator-owned orchestration verbs.
- */
-@Injectable()
-export class InteractionCoordinationService {
-  private readonly owners = new Map<string, HandoffOwner>();
-  private readonly handoffsByIdempotencyKey = new Map<string, TrackedHandoff>();
-
-  constructor(
-    @Inject(COORDINATION_PORT) private readonly port: InteractionCoordinationPort,
-    @Inject(COORDINATION_CONFIG) private readonly config: InteractionCoordinationConfig,
-    private readonly handoffIdFactory: () => string = (): string => crypto.randomUUID(),
-  ) {}
-
-  async handoff(
-    request: CreateHandoffDto,
-    context: RuntimeProviderRequestContext,
-  ): Promise<HandoffReceipt> {
-    this.pruneExpiredTracking();
-    const normalized = this.normalizeRequest(request);
-    const scope = this.scope(context);
-    const idempotencyKey = this.idempotencyKey(normalized.idempotencyKey, scope);
-    const existing = this.handoffsByIdempotencyKey.get(idempotencyKey);
-    if (existing !== undefined) {
-      if (!sameRequest(existing.request, normalized)) {
-        throw new InteractionCoordinationGatewayError(
-          'handoff_conflict',
-          'Handoff idempotency key is already bound to different immutable input',
-        );
-      }
-      return existing.receipt;
-    }
-
-    const pending = this.deliverHandoff(this.handoffIdFactory(), normalized, scope);
-    const tracked: TrackedHandoff = {
-      request: normalized,
-      receipt: pending,
-      expiresAt: this.expiresAt(),
-    };
-    this.handoffsByIdempotencyKey.set(idempotencyKey, tracked);
-    this.enforceTrackingLimit(this.handoffsByIdempotencyKey);
-    try {
-      return await pending;
-    } catch (error: unknown) {
-      if (this.handoffsByIdempotencyKey.get(idempotencyKey) === tracked) {
-        this.handoffsByIdempotencyKey.delete(idempotencyKey);
-      }
-      throw error;
-    }
-  }
-
-  async observe(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationObservation> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().observe(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  async result(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationResult> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().result(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  private async deliverHandoff(
-    handoffId: string,
-    request: NormalizedHandoffRequest,
-    scope: CoordinationScope,
-  ): Promise<HandoffReceipt> {
-    const receipt = await this.client((): string => handoffId).handoff(request, scope);
-    const owner: HandoffOwner = {
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      requesterAgentId: scope.requesterAgentId,
-      correlationId: scope.correlationId,
-      expiresAt: this.expiresAt(),
-    };
-    const existing = this.owners.get(receipt.handoffId);
-    if (existing !== undefined && !sameOwner(existing, owner)) {
-      throw new InteractionCoordinationGatewayError(
-        'handoff_conflict',
-        'Handoff ID is already bound to a different authenticated scope',
-      );
-    }
-    this.owners.set(receipt.handoffId, owner);
-    this.enforceTrackingLimit(this.owners);
-    return receipt;
-  }
-
-  private client(handoffIdFactory?: () => string): InteractionCoordinationClient {
-    return new InteractionCoordinationClient(this.identity(), this.port, handoffIdFactory);
-  }
-
-  private identity(): InteractionCoordinationIdentity {
-    const interactionAgentId = this.config.interactionAgentId?.trim();
-    const orchestrationAgentId = this.config.orchestrationAgentId?.trim();
-    if (!interactionAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_requester',
-        'Interaction agent identity is not configured',
-      );
-    }
-    if (!orchestrationAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_target',
-        'Orchestration agent identity is not configured',
-      );
-    }
-    return { interactionAgentId, orchestrationAgentId };
-  }
-
-  private scope(context: RuntimeProviderRequestContext): CoordinationScope {
-    const identity = this.identity();
-    return Object.freeze({
-      actorId: context.actorScope.userId,
-      tenantId: context.actorScope.tenantId,
-      correlationId: context.correlationId,
-      requesterAgentId: identity.interactionAgentId,
-    });
-  }
-
-  private normalizeRequest(request: CreateHandoffDto): NormalizedHandoffRequest {
-    if (typeof request !== 'object' || request === null) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        'Handoff request is invalid',
-      );
-    }
-    const idempotencyKey = this.requiredString(
-      request.idempotencyKey,
-      'idempotency key',
-      MAX_IDEMPOTENCY_KEY_LENGTH,
-    );
-    const summary = this.requiredString(request.summary, 'summary', MAX_SUMMARY_LENGTH);
-    const context = this.optionalString(request.context, 'context', MAX_CONTEXT_LENGTH);
-    const missionId = this.optionalString(request.missionId, 'mission ID', MAX_MISSION_ID_LENGTH);
-    return Object.freeze({
-      idempotencyKey,
-      summary,
-      ...(context === undefined ? {} : { context }),
-      ...(missionId === undefined ? {} : { missionId }),
-    });
-  }
-
-  private idempotencyKey(requestKey: string, scope: CoordinationScope): string {
-    return `${scope.tenantId}\u0000${scope.actorId}\u0000${scope.requesterAgentId}\u0000${requestKey}`;
-  }
-
-  private requiredString(value: unknown, field: string, maximumLength: number): string {
-    if (typeof value !== 'string') {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} must be a string`,
-      );
-    }
-    const normalized = value.trim();
-    if (normalized.length === 0 || normalized.length > maximumLength) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} is invalid`,
-      );
-    }
-    return normalized;
-  }
-
-  private optionalString(value: unknown, field: string, maximumLength: number): string | undefined {
-    if (value === undefined) return undefined;
-    return this.requiredString(value, field, maximumLength);
-  }
-
-  private expiresAt(): number {
-    return Date.now() + HANDOFF_TRACKING_TTL_MS;
-  }
-
-  private pruneExpiredTracking(): void {
-    const now = Date.now();
-    for (const [key, tracked] of this.handoffsByIdempotencyKey) {
-      if (tracked.expiresAt <= now) this.handoffsByIdempotencyKey.delete(key);
-    }
-    for (const [key, owner] of this.owners) {
-      if (owner.expiresAt <= now) this.owners.delete(key);
-    }
-  }
-
-  private enforceTrackingLimit<T>(entries: Map<string, T>): void {
-    while (entries.size > MAX_TRACKED_HANDOFFS) {
-      const oldest = entries.keys().next().value;
-      if (typeof oldest !== 'string') return;
-      entries.delete(oldest);
-    }
-  }
-
-  private ownerFor(handoffId: string, scope: CoordinationScope): HandoffOwner {
-    const owner = this.owners.get(handoffId);
-    if (owner === undefined) {
-      throw new InteractionCoordinationGatewayError('not_found', 'Handoff was not found');
-    }
-    if (
-      owner.tenantId !== scope.tenantId ||
-      owner.actorId !== scope.actorId ||
-      owner.requesterAgentId !== scope.requesterAgentId
-    ) {
-      throw new InteractionCoordinationGatewayError(
-        'cross_tenant_forbidden',
-        'Handoff is outside the authenticated scope',
-      );
-    }
-    return owner;
-  }
-}
-
-export type InteractionCoordinationGatewayErrorCode =
-  | 'cross_tenant_forbidden'
-  | 'handoff_conflict'
-  | 'invalid_request'
-  | 'not_found'
-  | 'unconfigured_requester'
-  | 'unconfigured_target';
-
-function sameOwner(left: HandoffOwner, right: HandoffOwner): boolean {
-  return (
-    left.actorId === right.actorId &&
-    left.tenantId === right.tenantId &&
-    left.requesterAgentId === right.requesterAgentId
-  );
-}
-
-function sameRequest(left: NormalizedHandoffRequest, right: NormalizedHandoffRequest): boolean {
-  return (
-    left.idempotencyKey === right.idempotencyKey &&
-    left.summary === right.summary &&
-    left.context === right.context &&
-    left.missionId === right.missionId
-  );
-}
-
-export class InteractionCoordinationGatewayError extends Error {
-  constructor(
-    readonly code: InteractionCoordinationGatewayErrorCode,
-    message: string,
-  ) {
-    super(message);
-    this.name = InteractionCoordinationGatewayError.name;
-  }
-}

apps/gateway/src/env.ts

@@ -1,133 +0,0 @@
-import { config } from 'dotenv';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { detectFromEnv, loadConfig } from '@mosaicstack/config';
-
-type TierSource =
-  | 'process environment'
-  | 'daemon .env'
-  | 'monorepo-root .env'
-  | 'gateway-local .env'
-  | 'default';
-
-type BootSource = TierSource | 'mosaic.config.json';
-
-export interface GatewayDotenvPaths {
-  daemonEnv: string;
-  monorepoRootEnv: string;
-  gatewayLocalEnv: string;
-}
-
-const here = dirname(fileURLToPath(import.meta.url));
-
-export function resolveGatewayDotenvPaths(
-  anchor: string = here,
-  homeBase: string = homedir(),
-): GatewayDotenvPaths {
-  return {
-    daemonEnv: join(homeBase, '.config', 'mosaic', 'gateway', '.env'),
-    monorepoRootEnv: resolve(anchor, '../../..', '.env'),
-    gatewayLocalEnv: resolve(anchor, '..', '.env'),
-  };
-}
-
-export function resolveGatewayConfigPath(anchor: string = here): string {
-  // GATEWAY_HOME is daemon-created 0700; its env override adds no authority because env can set MOSAIC_STORAGE_TIER.
-  const gatewayHome = resolve(
-    process.env['MOSAIC_GATEWAY_HOME'] ?? join(homedir(), '.config', 'mosaic', 'gateway'),
-  );
-  const daemonConfig = join(gatewayHome, 'mosaic.config.json');
-  const gatewayLocalConfig = resolve(anchor, '..', 'mosaic.config.json');
-  const monorepoRootConfig = resolve(anchor, '../../..', 'mosaic.config.json');
-
-  if (existsSync(daemonConfig)) {
-    return daemonConfig;
-  }
-  if (existsSync(gatewayLocalConfig)) {
-    return gatewayLocalConfig;
-  }
-  if (existsSync(monorepoRootConfig)) {
-    return monorepoRootConfig;
-  }
-
-  return monorepoRootConfig;
-}
-
-export function loadGatewayEnv(anchor: string = here, homeBase: string = homedir()): void {
-  const { daemonEnv, monorepoRootEnv, gatewayLocalEnv } = resolveGatewayDotenvPaths(
-    anchor,
-    homeBase,
-  );
-  const inheritedTier = process.env['MOSAIC_STORAGE_TIER'];
-  let tierSource: TierSource = inheritedTier === undefined ? 'default' : 'process environment';
-  const inheritedDatabaseUrl = process.env['DATABASE_URL'];
-  let databaseUrlSource: TierSource =
-    inheritedDatabaseUrl === undefined ? 'default' : 'process environment';
-
-  function loadAnchoredDotenv(
-    path: string,
-    sourceLabel: Exclude<TierSource, 'process environment' | 'default'>,
-  ): void {
-    if (!existsSync(path)) {
-      return;
-    }
-
-    const beforeTier = process.env['MOSAIC_STORAGE_TIER'];
-    const beforeDatabaseUrl = process.env['DATABASE_URL'];
-    config({ path, quiet: true });
-
-    if (
-      beforeTier === undefined &&
-      process.env['MOSAIC_STORAGE_TIER'] !== undefined &&
-      tierSource === 'default'
-    ) {
-      tierSource = sourceLabel;
-    }
-
-    if (
-      beforeDatabaseUrl === undefined &&
-      process.env['DATABASE_URL'] !== undefined &&
-      databaseUrlSource === 'default'
-    ) {
-      databaseUrlSource = sourceLabel;
-    }
-  }
-
-  // Load .env from daemon config dir (global install / daemon mode) first.
-  // It takes precedence over file-based local-dev configuration.
-  loadAnchoredDotenv(daemonEnv, 'daemon .env');
-
-  // Load .env from the anchored monorepo root, then fill any remaining values
-  // from apps/gateway/.env when present.
-  loadAnchoredDotenv(monorepoRootEnv, 'monorepo-root .env');
-  loadAnchoredDotenv(gatewayLocalEnv, 'gateway-local .env');
-
-  const envOnlyTier = detectFromEnv().tier;
-  const configPath = resolveGatewayConfigPath(anchor);
-  const anchoredConfigExists = existsSync(configPath);
-  const resolvedTier = loadConfig(configPath).tier;
-  const configuredTier = process.env['MOSAIC_STORAGE_TIER'];
-  const databaseUrlDeterminesTier = envOnlyTier === 'standalone' && configuredTier !== 'standalone';
-  const recognizedTierDeterminesTier =
-    (configuredTier === 'federated' ||
-      configuredTier === 'standalone' ||
-      configuredTier === 'local') &&
-    configuredTier === envOnlyTier;
-
-  let source: BootSource;
-  if (anchoredConfigExists) {
-    source = 'mosaic.config.json';
-  } else if (databaseUrlDeterminesTier && databaseUrlSource !== 'default') {
-    source = databaseUrlSource;
-  } else if (recognizedTierDeterminesTier && tierSource !== 'default') {
-    source = tierSource;
-  } else {
-    source = 'default';
-  }
-
-  console.info(`[gateway env] storage tier=${resolvedTier} source=${source}`);
-}
-
-loadGatewayEnv();

apps/gateway/src/federation/federation.module.ts

@@ -5,8 +5,6 @@ import { EnrollmentController } from './enrollment.controller.js';
 import { EnrollmentService } from './enrollment.service.js';
 import { FederationController } from './federation.controller.js';
 import { CapabilitiesController } from './server/verbs/capabilities.controller.js';
-import { GetController } from './server/verbs/get.controller.js';
-import { FederationGetQueryService } from './server/verbs/get-query.service.js';
 import { GrantsService } from './grants.service.js';
 import { FederationClientService, QuerySourceService } from './client/index.js';
 import { FederationAuthGuard, FederationScopeService } from './server/index.js';
@@ -14,13 +12,7 @@ import { ListController } from './server/verbs/list.controller.js';
 import { FederationListQueryService } from './server/verbs/list-query.service.js';
 
 @Module({
-  controllers: [
+  controllers: [EnrollmentController, FederationController, CapabilitiesController, ListController],
-    EnrollmentController,
-    FederationController,
-    CapabilitiesController,
-    ListController,
-    GetController,
-  ],
   providers: [
     AdminGuard,
     CaService,
@@ -31,7 +23,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
   exports: [
     CaService,
@@ -42,7 +33,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
 })
 export class FederationModule {}

apps/gateway/src/federation/server/verbs/__tests__/get-query.service.spec.ts

@@ -1,348 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-  createPgliteDb,
-  missionTasks,
-  missions,
-  projects,
-  runPgliteMigrations,
-  teams,
-  users,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { FederationScopeQueryFilter } from '../../scope.service.js';
-import { FederationGetQueryService } from '../get-query.service.js';
-
-const CREDENTIAL_FILTER: FederationScopeQueryFilter = {
-  resource: 'credentials',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: [],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-const SUBJECT_USER_ID = 'fed-m3-06-subject';
-const OTHER_USER_ID = 'fed-m3-06-other';
-const TEAM_ID = '06000000-0000-4000-8000-000000000001';
-const UNAUTHORIZED_TEAM_ID = '06000000-0000-4000-8000-000000000002';
-const PERSONAL_PROJECT_ID = '06000000-0000-4000-8000-000000000101';
-const TEAM_PROJECT_ID = '06000000-0000-4000-8000-000000000102';
-const UNAUTHORIZED_PROJECT_ID = '06000000-0000-4000-8000-000000000103';
-const PERSONAL_MISSION_ID = '06000000-0000-4000-8000-000000000201';
-const TEAM_MISSION_ID = '06000000-0000-4000-8000-000000000202';
-const UNAUTHORIZED_MISSION_ID = '06000000-0000-4000-8000-000000000203';
-const SUBJECT_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000301';
-const OTHER_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000302';
-const SUBJECT_PERSONAL_NOTE_ID = '06000000-0000-4000-8000-000000000303';
-const SUBJECT_UNAUTHORIZED_NOTE_ID = '06000000-0000-4000-8000-000000000304';
-
-let dbHandle: DbHandle | undefined;
-
-function makeService() {
-  return new FederationGetQueryService({} as Db);
-}
-
-function makeDbService() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-  return new FederationGetQueryService(dbHandle.db);
-}
-
-async function seedNotesFixture() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-
-  await dbHandle.db.insert(users).values([
-    {
-      id: SUBJECT_USER_ID,
-      name: 'Federation Subject',
-      email: `${SUBJECT_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-    {
-      id: OTHER_USER_ID,
-      name: 'Federation Other',
-      email: `${OTHER_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-  ]);
-
-  await dbHandle.db.insert(teams).values([
-    {
-      id: TEAM_ID,
-      name: 'FED-M3-06 Team',
-      slug: 'fed-m3-06-team',
-      ownerId: SUBJECT_USER_ID,
-      managerId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_TEAM_ID,
-      name: 'FED-M3-06 Unauthorized Team',
-      slug: 'fed-m3-06-unauthorized-team',
-      ownerId: OTHER_USER_ID,
-      managerId: OTHER_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(projects).values([
-    {
-      id: PERSONAL_PROJECT_ID,
-      name: 'FED-M3-06 Personal Project',
-      ownerId: SUBJECT_USER_ID,
-      ownerType: 'user',
-    },
-    {
-      id: TEAM_PROJECT_ID,
-      name: 'FED-M3-06 Team Project',
-      teamId: TEAM_ID,
-      ownerType: 'team',
-    },
-    {
-      id: UNAUTHORIZED_PROJECT_ID,
-      name: 'FED-M3-06 Unauthorized Project',
-      teamId: UNAUTHORIZED_TEAM_ID,
-      ownerType: 'team',
-    },
-  ]);
-
-  await dbHandle.db.insert(missions).values([
-    {
-      id: PERSONAL_MISSION_ID,
-      name: 'FED-M3-06 Personal Mission',
-      projectId: PERSONAL_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: TEAM_MISSION_ID,
-      name: 'FED-M3-06 Team Mission',
-      projectId: TEAM_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_MISSION_ID,
-      name: 'FED-M3-06 Unauthorized Mission',
-      projectId: UNAUTHORIZED_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(missionTasks).values([
-    {
-      id: SUBJECT_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on team mission',
-      createdAt: new Date('2026-06-24T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T03:00:00.000Z'),
-    },
-    {
-      id: OTHER_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: OTHER_USER_ID,
-      notes: 'other user note on team mission',
-      createdAt: new Date('2026-06-24T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T02:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_PERSONAL_NOTE_ID,
-      missionId: PERSONAL_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on personal mission',
-      createdAt: new Date('2026-06-24T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T01:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      missionId: UNAUTHORIZED_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note outside grant-visible missions',
-      createdAt: new Date('2026-06-24T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T04:00:00.000Z'),
-    },
-  ]);
-}
-
-describe('FederationGetQueryService', () => {
-  beforeAll(async () => {
-    dbHandle = createPgliteDb(`memory://fed-m3-06-get-${Date.now()}`);
-    await runPgliteMigrations(dbHandle);
-    await seedNotesFixture();
-  });
-
-  afterAll(async () => {
-    await dbHandle?.close();
-    dbHandle = undefined;
-  });
-
-  it('denies sensitive resources in native RBAC for M3 get reads', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'credentials',
-      }),
-    ).resolves.toMatchObject({
-      allowed: false,
-      reason: 'credentials federation get access is not implemented in M3',
-    });
-  });
-
-  it('allows personal memory reads without requiring team lookup', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'memory',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-  });
-
-  it('uses subject team membership as the native RBAC upper bound for task and note reads', async () => {
-    const service = makeService();
-    const listSubjectTeamIds = vi.fn().mockResolvedValue(['team-1', 'team-2']);
-    (
-      service as unknown as {
-        listSubjectTeamIds: (subjectUserId: string) => Promise<string[]>;
-      }
-    ).listSubjectTeamIds = listSubjectTeamIds;
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'tasks',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-    });
-    expect(listSubjectTeamIds).toHaveBeenCalledWith('user-1');
-  });
-
-  it('does not query storage for sensitive get resources even if scope allowed them', async () => {
-    const service = makeService();
-
-    await expect(service.get({ filter: CREDENTIAL_FILTER, id: 'cred-1' })).resolves.toEqual({
-      status: 'denied',
-      reason: 'credentials federation get is not implemented',
-    });
-  });
-
-  it('fails closed for unsupported resources instead of returning undefined', async () => {
-    const service = makeService();
-
-    await expect(
-      service.get({
-        filter: {
-          ...CREDENTIAL_FILTER,
-          resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-        },
-        id: 'row-1',
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Unsupported federation get resource: unknown-resource',
-    });
-  });
-
-  it('does not leak another user mission task note through team-scoped get reads', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: OTHER_TEAM_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('does not return subject notes from missions outside the grant-visible project set', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: true,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('returns a subject note only when subject ownership and authorized mission intersect', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_TEAM_NOTE_ID,
-      }),
-    ).resolves.toMatchObject({
-      status: 'found',
-      item: {
-        id: SUBJECT_TEAM_NOTE_ID,
-        missionId: TEAM_MISSION_ID,
-        content: 'subject note on team mission',
-      },
-    });
-  });
-
-  it('does not return subject personal notes when includePersonal is false', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_PERSONAL_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-});

apps/gateway/src/federation/server/verbs/__tests__/get.controller.spec.ts

@@ -1,207 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import type {
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from '../../scope.service.js';
-import { GetController } from '../get.controller.js';
-import type { FederationGetQueryResult } from '../get-query.service.js';
-
-const FEDERATION_CONTEXT = {
-  grantId: 'grant-1',
-  peerId: 'peer-1',
-  subjectUserId: 'user-1',
-  scope: { resources: ['tasks'], max_rows_per_query: 25 },
-};
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: ['team-1'],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-function makeRequest(): FastifyRequest {
-  return { federationContext: FEDERATION_CONTEXT } as unknown as FastifyRequest;
-}
-
-function allowedScope(
-  filter: FederationScopeQueryFilter = TASK_FILTER,
-): FederationScopeEvaluationResult {
-  return { allowed: true, filter };
-}
-
-function makeController(opts?: {
-  scopeResult?: FederationScopeEvaluationResult;
-  queryResult?: FederationGetQueryResult;
-}) {
-  const scope = {
-    evaluateAccess: vi.fn().mockResolvedValue(opts?.scopeResult ?? allowedScope()),
-  };
-  const query = {
-    evaluateReadAccess: vi.fn(),
-    get: vi.fn().mockResolvedValue(
-      opts?.queryResult ?? {
-        status: 'found',
-        item: {
-          id: 'task-1',
-          title: 'Federated task',
-          createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        },
-      },
-    ),
-  };
-
-  return {
-    controller: new GetController(scope as never, query as never),
-    scope,
-    query,
-  };
-}
-
-describe('GetController', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('declares POST /api/federation/v1/get/:resource/:id protected only by FederationAuthGuard', () => {
-    expect(Reflect.getMetadata('path', GetController)).toBe('api/federation/v1/get');
-    expect(Reflect.getMetadata('path', GetController.prototype.get)).toBe(':resource/:id');
-    expect(Reflect.getMetadata('method', GetController.prototype.get)).toBe(RequestMethod.POST);
-    expect(Reflect.getMetadata('__guards__', GetController)).toEqual([FederationAuthGuard]);
-  });
-
-  it('runs AuthGuard context through ScopeService and returns one local-source tagged row', async () => {
-    const { controller, scope, query } = makeController();
-
-    const response = await controller.get('tasks', 'task-1', makeRequest());
-
-    expect(scope.evaluateAccess).toHaveBeenCalledWith({
-      context: FEDERATION_CONTEXT,
-      resource: 'tasks',
-      requestedLimit: 1,
-      nativeRbac: query,
-    });
-    expect(query.get).toHaveBeenCalledWith({ filter: TASK_FILTER, id: 'task-1' });
-    expect(response).toEqual({
-      item: {
-        id: 'task-1',
-        title: 'Federated task',
-        createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        _source: 'local',
-      },
-    });
-  });
-
-  it('returns a federation error envelope when auth guard context is missing', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(
-      controller.get('tasks', 'task-1', {} as unknown as FastifyRequest),
-    ).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'unauthorized',
-          message: 'Federation context missing',
-        },
-      },
-      status: 401,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns a federation error envelope when scope evaluation denies access', async () => {
-    const { controller, query } = makeController({
-      scopeResult: {
-        allowed: false,
-        deny: {
-          code: 'resource_excluded',
-          stage: 'resource_exclusion',
-          statusCode: 403,
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-          grantId: 'grant-1',
-          peerId: 'peer-1',
-          subjectUserId: 'user-1',
-          resource: 'credentials',
-        },
-      },
-    });
-
-    await expect(controller.get('credentials', 'cred-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-        },
-      },
-      status: 403,
-    });
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns 404 when the scoped query layer cannot find the resource id', async () => {
-    const { controller } = makeController({ queryResult: { status: 'not_found' } });
-
-    await expect(controller.get('tasks', 'missing-task', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'not_found' } },
-      status: 404,
-    });
-  });
-
-  it('returns 403 when the resource exists outside the RBAC/scope intersection', async () => {
-    const { controller } = makeController({
-      queryResult: { status: 'denied', reason: 'Task is outside the federated scope' },
-    });
-
-    await expect(controller.get('tasks', 'task-2', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Task is outside the federated scope',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('fails closed when the query layer denies an unsupported resource', async () => {
-    const unsupportedFilter: FederationScopeQueryFilter = {
-      ...TASK_FILTER,
-      resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-    };
-    const { controller } = makeController({
-      scopeResult: allowedScope(unsupportedFilter),
-      queryResult: {
-        status: 'denied',
-        reason: 'Unsupported federation get resource: unknown-resource',
-      },
-    });
-
-    await expect(controller.get('unknown-resource', 'row-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Unsupported federation get resource: unknown-resource',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('rejects empty ids before evaluating scope', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(controller.get('tasks', '   ', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/federation/server/verbs/get-query.service.ts

@@ -1,311 +0,0 @@
-/**
- * Federation get query layer (FED-M3-06).
- *
- * Read-only DB adapter used by GetController after FederationAuthGuard and
- * FederationScopeService have established the subject user, allowed resource,
- * native-RBAC intersection, and row cap. Audit writes are intentionally
- * deferred to M4.
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  eq,
-  inArray,
-  insights,
-  or,
-  missionTasks,
-  missions,
-  preferences,
-  projects,
-  tasks,
-  teamMembers,
-  type Db,
-} from '@mosaicstack/db';
-import { DB } from '../../../database/database.module.js';
-import type {
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeQueryFilter,
-} from '../scope.service.js';
-
-export interface FederationGetQueryRequest {
-  readonly filter: FederationScopeQueryFilter;
-  readonly id: string;
-}
-
-export interface FederationGetQueryFoundResult<T extends object = Record<string, unknown>> {
-  readonly status: 'found';
-  readonly item: T;
-}
-
-export interface FederationGetQueryNotFoundResult {
-  readonly status: 'not_found';
-}
-
-export interface FederationGetQueryDeniedResult {
-  readonly status: 'denied';
-  readonly reason: string;
-}
-
-export type FederationGetQueryResult<T extends object = Record<string, unknown>> =
-  | FederationGetQueryFoundResult<T>
-  | FederationGetQueryNotFoundResult
-  | FederationGetQueryDeniedResult;
-
-type RowObject = Record<string, unknown>;
-
-function firstRow<T>(rows: T[]): T | undefined {
-  return rows[0];
-}
-
-function rowBelongsToAccessibleProjectOrMission(
-  row: { projectId?: string | null; missionId?: string | null },
-  projectIds: readonly string[],
-  missionIds: readonly string[],
-): boolean {
-  return (
-    (typeof row.projectId === 'string' && projectIds.includes(row.projectId)) ||
-    (typeof row.missionId === 'string' && missionIds.includes(row.missionId))
-  );
-}
-
-@Injectable()
-export class FederationGetQueryService implements FederationNativeRbacEvaluator {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async evaluateReadAccess(
-    request: FederationNativeRbacRequest,
-  ): Promise<FederationNativeRbacResult> {
-    if (request.resource === 'credentials' || request.resource === 'api_keys') {
-      return {
-        allowed: false,
-        reason: `${request.resource} federation get access is not implemented in M3`,
-        details: { resource: request.resource },
-      };
-    }
-
-    if (request.resource === 'memory') {
-      return { allowed: true, access: { includePersonal: true, teamIds: [] } };
-    }
-
-    const teamIds = await this.listSubjectTeamIds(request.subjectUserId);
-    return { allowed: true, access: { includePersonal: true, teamIds } };
-  }
-
-  async get<T extends RowObject = RowObject>(
-    request: FederationGetQueryRequest,
-  ): Promise<FederationGetQueryResult<T>> {
-    return this.getByResource(request.filter, request.id) as Promise<FederationGetQueryResult<T>>;
-  }
-
-  private async getByResource(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    switch (filter.resource) {
-      case 'tasks':
-        return this.getTask(filter, id);
-      case 'notes':
-        return this.getNote(filter, id);
-      case 'memory':
-        return this.getMemory(filter, id);
-      case 'credentials':
-      case 'api_keys':
-        return { status: 'denied', reason: `${filter.resource} federation get is not implemented` };
-      default:
-        return {
-          status: 'denied',
-          reason: `Unsupported federation get resource: ${String(filter.resource)}`,
-        };
-    }
-  }
-
-  private async listSubjectTeamIds(subjectUserId: string): Promise<string[]> {
-    const rows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, subjectUserId));
-
-    return rows.map((row) => row.teamId);
-  }
-
-  private async listAccessibleProjectIds(filter: FederationScopeQueryFilter): Promise<string[]> {
-    const clauses = [];
-    if (filter.includePersonal) {
-      clauses.push(and(eq(projects.ownerType, 'user'), eq(projects.ownerId, filter.subjectUserId)));
-    }
-    if (filter.teamIds.length > 0) {
-      // Project team ownership follows TeamsService.canAccessProject: team-owned
-      // rows are authorized through projects.teamId, while ownerId remains the
-      // user who created/bootstrapped the project.
-      clauses.push(
-        and(eq(projects.ownerType, 'team'), inArray(projects.teamId, [...filter.teamIds])),
-      );
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: projects.id })
-      .from(projects)
-      .where(clauses.length === 1 ? clauses[0] : or(...clauses));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listMissionIds(projectIds: readonly string[]): Promise<string[]> {
-    if (projectIds.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: missions.id })
-      .from(missions)
-      .where(inArray(missions.projectId, [...projectIds]));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async getTask(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: tasks.id,
-          title: tasks.title,
-          description: tasks.description,
-          status: tasks.status,
-          priority: tasks.priority,
-          projectId: tasks.projectId,
-          missionId: tasks.missionId,
-          assignee: tasks.assignee,
-          tags: tasks.tags,
-          dueDate: tasks.dueDate,
-          metadata: tasks.metadata,
-          createdAt: tasks.createdAt,
-          updatedAt: tasks.updatedAt,
-        })
-        .from(tasks)
-        .where(eq(tasks.id, id))
-        .limit(1),
-    );
-
-    if (!row) {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-    if (!rowBelongsToAccessibleProjectOrMission(row, projectIds, missionIds)) {
-      return { status: 'denied', reason: 'Task is outside the federated scope' };
-    }
-
-    return { status: 'found', item: row as RowObject };
-  }
-
-  private async getNote(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: missionTasks.id,
-          missionId: missionTasks.missionId,
-          taskId: missionTasks.taskId,
-          userId: missionTasks.userId,
-          status: missionTasks.status,
-          content: missionTasks.notes,
-          createdAt: missionTasks.createdAt,
-          updatedAt: missionTasks.updatedAt,
-        })
-        .from(missionTasks)
-        .where(eq(missionTasks.id, id))
-        .limit(1),
-    );
-
-    if (!row || row.content === null || row.content === '') {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-
-    // mission_tasks rows are user-scoped even when the mission belongs to a team.
-    // Scope-visible missions must intersect with subject ownership; team scope
-    // narrows mission IDs but never widens note reads to another user's rows.
-    if (row.userId !== filter.subjectUserId || !missionIds.includes(row.missionId)) {
-      return { status: 'denied', reason: 'Note is outside the federated scope' };
-    }
-
-    const item = { ...row } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-
-  private async getMemory(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const [insightRow, preferenceRow] = await Promise.all([
-      this.db
-        .select({
-          id: insights.id,
-          userId: insights.userId,
-          kind: insights.source,
-          content: insights.content,
-          category: insights.category,
-          relevanceScore: insights.relevanceScore,
-          metadata: insights.metadata,
-          createdAt: insights.createdAt,
-          updatedAt: insights.updatedAt,
-        })
-        .from(insights)
-        .where(eq(insights.id, id))
-        .limit(1)
-        .then(firstRow),
-      this.db
-        .select({
-          id: preferences.id,
-          userId: preferences.userId,
-          kind: preferences.category,
-          key: preferences.key,
-          value: preferences.value,
-          source: preferences.source,
-          mutable: preferences.mutable,
-          createdAt: preferences.createdAt,
-          updatedAt: preferences.updatedAt,
-        })
-        .from(preferences)
-        .where(eq(preferences.id, id))
-        .limit(1)
-        .then(firstRow),
-    ]);
-
-    const candidates = [insightRow, preferenceRow].filter(
-      (row): row is NonNullable<typeof row> => row !== undefined,
-    );
-    if (candidates.length === 0) {
-      return { status: 'not_found' };
-    }
-
-    if (!filter.includePersonal) {
-      return { status: 'denied', reason: 'Memory personal rows are outside the federated scope' };
-    }
-
-    const accessible = candidates.find((row) => row.userId === filter.subjectUserId);
-    if (!accessible) {
-      return { status: 'denied', reason: 'Memory row belongs to another subject user' };
-    }
-
-    const item = { ...accessible } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-}

apps/gateway/src/federation/server/verbs/get.controller.ts

@@ -1,100 +0,0 @@
-/**
- * Federation get verb (FED-M3-06).
- *
- * POST /api/federation/v1/get/:resource/:id
- *
- * Pipeline: FederationAuthGuard attaches the active grant context, then
- * FederationScopeService enforces grant scope + native RBAC intersection, then
- * the read-only query layer fetches one local row and tags it with `_source`.
- * Read audit-log writes are deferred to M4; this controller does not persist
- * request or response bodies.
- */
-
-import { Controller, HttpException, Inject, Param, Post, Req, UseGuards } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FederationInvalidRequestError,
-  FederationNotFoundError,
-  FederationScopeViolationError,
-  FederationUnauthorizedError,
-  SOURCE_LOCAL,
-  type FederationGetResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-import { FederationScopeService } from '../scope.service.js';
-import { FederationGetQueryService } from './get-query.service.js';
-
-type FederatedRow = Record<string, unknown> & SourceTag;
-
-function scopeDenyToHttpException(deny: {
-  readonly statusCode: 400 | 403;
-  readonly message: string;
-}): HttpException {
-  const ErrorClass =
-    deny.statusCode === 400 ? FederationInvalidRequestError : FederationScopeViolationError;
-  return new HttpException(new ErrorClass(deny.message, deny).toEnvelope(), deny.statusCode);
-}
-
-@Controller('api/federation/v1/get')
-@UseGuards(FederationAuthGuard)
-export class GetController {
-  constructor(
-    @Inject(FederationScopeService) private readonly scope: FederationScopeService,
-    @Inject(FederationGetQueryService) private readonly query: FederationGetQueryService,
-  ) {}
-
-  @Post(':resource/:id')
-  async get(
-    @Param('resource') resource: string,
-    @Param('id') id: string,
-    @Req() request: FastifyRequest,
-  ): Promise<FederationGetResponse<FederatedRow>> {
-    if (!request.federationContext) {
-      throw new HttpException(
-        new FederationUnauthorizedError('Federation context missing').toEnvelope(),
-        401,
-      );
-    }
-    if (id.trim().length === 0) {
-      throw new HttpException(
-        new FederationInvalidRequestError('Federation get id must not be empty').toEnvelope(),
-        400,
-      );
-    }
-
-    const scopeResult = await this.scope.evaluateAccess({
-      context: request.federationContext,
-      resource,
-      requestedLimit: 1,
-      nativeRbac: this.query,
-    });
-
-    if (!scopeResult.allowed) {
-      throw scopeDenyToHttpException(scopeResult.deny);
-    }
-
-    const result = await this.query.get({ filter: scopeResult.filter, id });
-    if (result.status === 'not_found') {
-      throw new HttpException(
-        new FederationNotFoundError('Requested federation resource was not found').toEnvelope(),
-        404,
-      );
-    }
-    if (result.status === 'denied') {
-      throw new HttpException(
-        new FederationScopeViolationError(result.reason, {
-          resource,
-          id,
-          grantId: request.federationContext.grantId,
-          peerId: request.federationContext.peerId,
-          subjectUserId: request.federationContext.subjectUserId,
-        }).toEnvelope(),
-        403,
-      );
-    }
-
-    return { item: { ...result.item, _source: SOURCE_LOCAL } };
-  }
-}

apps/gateway/src/gc/gc.module.ts

@@ -1,7 +1,5 @@
-import { Module, type OnApplicationShutdown, Inject, Optional } from '@nestjs/common';
+import { Module, type OnApplicationShutdown, Inject } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { SessionGCService } from './session-gc.service.js';
 import { REDIS } from './gc.tokens.js';
 
@@ -11,17 +9,13 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   providers: [
     {
       provide: GC_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
+      useFactory: (): QueueHandle => {
-        // On Local tier there is no Redis — skip the ioredis connection entirely.
-        // The Valkey GC sweep is a no-op on Local (no session keys stored there).
-        if (config?.queue?.type === 'local') return null;
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [GC_QUEUE_HANDLE],
     },
     SessionGCService,
@@ -29,13 +23,9 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   exports: [SessionGCService],
 })
 export class GCModule implements OnApplicationShutdown {
-  constructor(
+  constructor(@Inject(GC_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
-    @Optional()
-    @Inject(GC_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -119,19 +119,6 @@ describe('SessionGCService', () => {
     ).resolves.toEqual({ allowed: true });
   });
 
-  it('collect() skips Valkey but still demotes only the requested session on local tier', async () => {
-    const localService = new SessionGCService(null, mockLogService as unknown as LogService);
-
-    const result = await localService.collect('local-session');
-
-    expect(result.sessionId).toBe('local-session');
-    expect(result.cleaned.valkeyKeys).toBeUndefined();
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
-      'local-session',
-      expect.any(Date),
-    );
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -21,10 +21,7 @@ function escapeRedisGlobLiteral(value: string): string {
 @Injectable()
 export class SessionGCService {
   constructor(
-    // Local tier has no Redis; lifecycle cleanup still demotes this session's logs.
+    @Inject(REDIS) private readonly redis: QueueHandle['redis'],
-    @Optional()
-    @Inject(REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
@@ -32,10 +29,8 @@ export class SessionGCService {
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
    * duration, which can cause latency spikes under production key volumes.
-   * Returns an empty population on the Local tier where Redis is disabled.
    */
   private async scanKeys(pattern: string): Promise<string[]> {
-    if (!this.redis) return [];
     const collected: string[] = [];
     let cursor = '0';
     do {
@@ -52,15 +47,13 @@ export class SessionGCService {
   async collect(sessionId: string): Promise<GCResult> {
     const result: GCResult = { sessionId, cleaned: {} };
 
-    // 1. Valkey: delete all session-scoped keys (skipped on Local tier).
+    // 1. Valkey: delete all session-scoped keys
-    if (this.redis) {
     const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
     const valkeyKeys = await this.scanKeys(pattern);
     if (valkeyKeys.length > 0) {
       await this.redis.del(...valkeyKeys);
       result.cleaned.valkeyKeys = valkeyKeys.length;
     }
-    }
 
     // 2. PG: demote hot-tier agent logs for this session only.
     const cutoff = new Date();

apps/gateway/src/log/cron.service.ts

@@ -18,7 +18,7 @@ import type { MosaicJobData } from '../queue/queue.service.js';
 @Injectable()
 export class CronService implements OnModuleInit, OnModuleDestroy {
   private readonly logger = new Logger(CronService.name);
-  private readonly registeredWorkers: Array<Worker<MosaicJobData>> = [];
+  private readonly registeredWorkers: Worker<MosaicJobData>[] = [];
 
   constructor(
     @Inject(SummarizationService) private readonly summarization: SummarizationService,
@@ -26,12 +26,6 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
   ) {}
 
   async onModuleInit(): Promise<void> {
-    // Local tier deliberately has no BullMQ consumers or repeatable jobs.
-    if (!this.queueService.isEnabled()) {
-      this.logger.log('CronService: BullMQ disabled on local tier — no jobs will be scheduled');
-      return;
-    }
-
     const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
     const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
 
@@ -45,7 +39,7 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     const summarizationWorker = this.queueService.registerWorker(QUEUE_SUMMARIZATION, async () => {
       await this.summarization.runSummarization();
     });
-    if (summarizationWorker) this.registeredWorkers.push(summarizationWorker);
+    this.registeredWorkers.push(summarizationWorker);
 
     // M6-005: Tier management repeatable job
     await this.queueService.addRepeatableJob(
@@ -57,7 +51,7 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     const tierWorker = this.queueService.registerWorker(QUEUE_TIER_MANAGEMENT, async () => {
       await this.summarization.runTierManagement();
     });
-    if (tierWorker) this.registeredWorkers.push(tierWorker);
+    this.registeredWorkers.push(tierWorker);
 
     // Retire any repeatable global GC schedule created by older deployments.
     // Session cleanup is now triggered only by an authorized session lifecycle operation.

apps/gateway/src/main.spec.ts

@@ -1,164 +0,0 @@
-import 'reflect-metadata';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import * as nodeOs from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import * as nodeUrl from 'node:url';
-import type { MosaicConfig } from '@mosaicstack/config';
-import type * as MosaicStorage from '@mosaicstack/storage';
-import { describe, expect, it, vi, type MockInstance } from 'vitest';
-
-// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
-const MODULE_IMPORT_TIMEOUT_MS = 120_000;
-
-function snapshotProcessEnv(): Record<string, string | undefined> {
-  return { ...process.env };
-}
-
-function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
-  for (const key of Object.keys(process.env)) {
-    if (!(key in snapshot)) {
-      delete process.env[key];
-    }
-  }
-
-  for (const [key, value] of Object.entries(snapshot)) {
-    if (value === undefined) {
-      delete process.env[key];
-      continue;
-    }
-
-    process.env[key] = value;
-  }
-}
-
-function expectPathUnderTempRoot(path: string, tempRoot: string): void {
-  const relativePath = relative(tempRoot, path);
-  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
-    true,
-  );
-}
-
-async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
-  expectPathUnderTempRoot(path, tempRoot);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, contents, 'utf8');
-}
-
-interface BootstrapPreflightResult {
-  capturedConfig: MosaicConfig | undefined;
-}
-
-async function runBootstrapPreflight(
-  anchoredConfigContents: string,
-  ambientConfigContents: string,
-): Promise<BootstrapPreflightResult> {
-  const originalEnv = snapshotProcessEnv();
-  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-main-preflight-'));
-  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let exitSpy: MockInstance<typeof process.exit> | undefined;
-  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let capturedConfig: MosaicConfig | undefined;
-
-  try {
-    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
-    const homePath = join(tempRoot, 'home');
-    const cwdPath = join(tempRoot, 'ambient', 'cwd');
-    const monorepoRootConfigPath = resolve(anchor, '../../..', 'mosaic.config.json');
-
-    await mkdir(anchor, { recursive: true });
-    await mkdir(cwdPath, { recursive: true });
-
-    await writeFixture(monorepoRootConfigPath, anchoredConfigContents, tempRoot);
-    await writeFixture(join(cwdPath, 'mosaic.config.json'), ambientConfigContents, tempRoot);
-
-    process.env['HOME'] = homePath;
-    process.env['BETTER_AUTH_SECRET'] = 'fixture-secret';
-    delete process.env['MOSAIC_STORAGE_TIER'];
-    delete process.env['DATABASE_URL'];
-    delete process.env['VALKEY_URL'];
-
-    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
-    const exitMock = vi.fn<typeof process.exit>();
-    exitSpy = vi.spyOn(process, 'exit').mockImplementation(exitMock);
-
-    vi.resetModules();
-    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
-    vi.doMock('node:url', () => ({
-      ...nodeUrl,
-      fileURLToPath: (url: string | URL): string => {
-        const actualPath = nodeUrl.fileURLToPath(url);
-        if (
-          actualPath.endsWith('/apps/gateway/src/env.ts') ||
-          actualPath.endsWith('/apps/gateway/src/env.js')
-        ) {
-          return join(anchor, 'env.ts');
-        }
-        return actualPath;
-      },
-    }));
-    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
-    vi.doMock('./tracing.js', () => ({}));
-
-    const preflightSentinel = new Error('preflight-capture-sentinel');
-    vi.doMock('@mosaicstack/storage', async () => {
-      const actual = await vi.importActual<typeof MosaicStorage>('@mosaicstack/storage');
-      return {
-        ...actual,
-        detectAndAssertTier: vi.fn((config: MosaicConfig): Promise<void> => {
-          capturedConfig = config;
-          throw preflightSentinel;
-        }),
-      };
-    });
-
-    await import('./main.js');
-    await vi.waitFor((): void => {
-      expect(exitSpy).toHaveBeenCalled();
-    });
-
-    return { capturedConfig };
-  } finally {
-    cwdSpy?.mockRestore();
-    exitSpy?.mockRestore();
-    consoleInfoSpy?.mockRestore();
-    vi.doUnmock('@mosaicstack/storage');
-    vi.doUnmock('./tracing.js');
-    vi.doUnmock('node:url');
-    vi.doUnmock('node:os');
-    vi.resetModules();
-    restoreProcessEnv(originalEnv);
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-}
-
-describe('main bootstrap preflight config anchoring', (): void => {
-  it(
-    'passes the anchored monorepo-root config to detectAndAssertTier, not an ambient cwd config',
-    async (): Promise<void> => {
-      const anchoredConfig = JSON.stringify({
-        tier: 'local',
-        storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
-        queue: { type: 'local', dataDir: '.mosaic/queue' },
-        memory: { type: 'keyword' },
-      });
-      const ambientConfig = JSON.stringify({
-        tier: 'federated',
-        storage: {
-          type: 'postgres',
-          url: 'postgresql://ambient-attacker.invalid/mosaic',
-          enableVector: true,
-        },
-        queue: { type: 'bullmq' },
-        memory: { type: 'pgvector' },
-      });
-
-      const { capturedConfig } = await runBootstrapPreflight(anchoredConfig, ambientConfig);
-
-      expect(capturedConfig?.tier).toBe('local');
-      expect(capturedConfig?.storage).not.toEqual(
-        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-});

apps/gateway/src/main.ts

@@ -1,5 +1,18 @@
 #!/usr/bin/env node
-import './env.js';
+import { config } from 'dotenv';
+import { existsSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+
+// Load .env from daemon config dir (global install / daemon mode).
+// Loaded first so monorepo .env can override for local dev.
+const daemonEnv = join(homedir(), '.config', 'mosaic', 'gateway', '.env');
+if (existsSync(daemonEnv)) config({ path: daemonEnv });
+
+// Load .env from monorepo root (cwd is apps/gateway when run via pnpm filter)
+config({ path: resolve(process.cwd(), '../../.env') });
+config(); // Also load apps/gateway/.env if present (overrides)
+
 import './tracing.js';
 import 'reflect-metadata';
 import { NestFactory } from '@nestjs/core';
@@ -13,7 +26,6 @@ import { mountAuthHandler } from './auth/auth.controller.js';
 import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
 import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';
-import { resolveGatewayConfigPath } from './env.js';
 
 async function bootstrap(): Promise<void> {
   const logger = new Logger('Bootstrap');
@@ -25,7 +37,7 @@ async function bootstrap(): Promise<void> {
   // Pre-flight: assert all external services required by the configured tier
   // are reachable. Runs before NestFactory.create() so failures are visible
   // immediately with actionable remediation hints.
-  const mosaicConfig = loadConfig(resolveGatewayConfigPath());
+  const mosaicConfig = loadConfig();
   try {
     await detectAndAssertTier(mosaicConfig);
   } catch (err) {

apps/gateway/src/memory/memory.module.ts

@@ -3,10 +3,8 @@ import {
   createMemory,
   type Memory,
   createMemoryAdapter,
-  createOperatorMemoryPlugin,
   type MemoryAdapter,
   type MemoryConfig,
-  type OperatorMemoryPlugin,
 } from '@mosaicstack/memory';
 import type { Db } from '@mosaicstack/db';
 import type { StorageAdapter } from '@mosaicstack/storage';
@@ -16,9 +14,6 @@ import { DB, STORAGE_ADAPTER } from '../database/database.module.js';
 import { MEMORY } from './memory.tokens.js';
 import { MemoryController } from './memory.controller.js';
 import { EmbeddingService } from './embedding.service.js';
-import { redactSensitiveContent } from '@mosaicstack/log';
-
-export const OPERATOR_MEMORY_PLUGIN = 'OPERATOR_MEMORY_PLUGIN';
 
 export const MEMORY_ADAPTER = 'MEMORY_ADAPTER';
 
@@ -43,24 +38,9 @@ function buildMemoryConfig(config: MosaicConfig, storageAdapter: StorageAdapter)
         createMemoryAdapter(buildMemoryConfig(config, storageAdapter)),
       inject: [MOSAIC_CONFIG, STORAGE_ADAPTER],
     },
-    {
-      provide: OPERATOR_MEMORY_PLUGIN,
-      useFactory: (adapter: MemoryAdapter): OperatorMemoryPlugin | null => {
-        const instanceId = process.env['MOSAIC_OPERATOR_MEMORY_INSTANCE_ID']?.trim();
-        const namespace = process.env['MOSAIC_OPERATOR_MEMORY_NAMESPACE']?.trim();
-        if (!instanceId || !namespace) return null;
-        return createOperatorMemoryPlugin({
-          adapter,
-          instanceId,
-          namespace,
-          redact: (content) => redactSensitiveContent(content).content,
-        });
-      },
-      inject: [MEMORY_ADAPTER],
-    },
     EmbeddingService,
   ],
   controllers: [MemoryController],
-  exports: [MEMORY, MEMORY_ADAPTER, OPERATOR_MEMORY_PLUGIN, EmbeddingService],
+  exports: [MEMORY, MEMORY_ADAPTER, EmbeddingService],
 })
 export class MemoryModule {}

apps/gateway/src/plugin/discord-ingress.security.spec.ts

@@ -24,7 +24,6 @@ const ENV_KEYS = [
   'DISCORD_ALLOWED_CHANNEL_IDS',
   'DISCORD_ALLOWED_USER_IDS',
   'MOSAIC_AGENT_NAME',
-  'MOSAIC_AGENT_CONFIG_ID',
 ] as const;
 const savedEnv = new Map<string, string | undefined>();
 
@@ -34,14 +33,12 @@ function configureDiscordEnv(role: 'admin' | 'member' = 'admin'): void {
   process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
   process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-discord';
   process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-  process.env['MOSAIC_AGENT_CONFIG_ID'] = 'agent-config-nova';
   process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-001';
   process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
   process.env['DISCORD_ALLOWED_USER_IDS'] = 'user-001';
   process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
     {
       instanceId: 'Nova',
-      agentConfigId: 'agent-config-nova',
       guildId: 'guild-001',
       channelId: 'channel-001',
       pairedUsers: {
@@ -144,7 +141,7 @@ function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordI
     guildId: 'guild-001',
     channelId: 'channel-001',
     userId: 'user-001',
-    conversationId: 'Nova:discord:channel-001',
+    conversationId: 'discord-channel-001',
     content: 'hello Tess',
     ...overrides,
   };
@@ -156,7 +153,6 @@ describe('Discord ingress security', () => {
       JSON.stringify([
         {
           instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
           guildId: 'guild-001',
           channelId: 'channel-001',
           pairedUsers: { 'user-001': 'admin' },
@@ -174,7 +170,6 @@ describe('Discord ingress security', () => {
       [
         {
           instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
           guildId: 'guild-001',
           channelId: 'channel-001',
           pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
@@ -312,12 +307,27 @@ describe('Discord ingress security', () => {
     );
   });
 
-  it('rejects approval when the durable session targets a different logical agent', async () => {
+  it.each([
-    configureDiscordEnv();
+    [
-    const { gateway, client, durable } = discordGateway('admin');
+      'binding',
+      () => {
+        process.env['MOSAIC_AGENT_NAME'] = 'Other';
+      },
+    ],
+    [
+      'durable session',
+      (durable: { getSnapshot: ReturnType<typeof vi.fn> }) => {
         durable.getSnapshot.mockResolvedValueOnce({
           identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
         });
+      },
+    ],
+  ])(
+    'rejects approval when the %s targets a different runtime agent',
+    async (_source, configure) => {
+      configureDiscordEnv();
+      const { gateway, client, durable } = discordGateway('admin');
+      configure(durable);
 
       await gateway.handleDiscordApproval(
         client as never,
@@ -330,28 +340,8 @@ describe('Discord ingress security', () => {
         approvalId: undefined,
         expiresAt: undefined,
       });
-  });
+    },
-
-  it('rejects privileged envelopes with a forged current conversation route', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'forged-approval-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
   );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'forged-stop-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('discord:approval', expect.anything());
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
 
   it('rejects unpaired and non-admin Discord users for approval and stop', async () => {
     configureDiscordEnv();
@@ -408,267 +398,6 @@ describe('Discord ingress security', () => {
     ]);
   });
 
-  it.each([
-    'https://user:[email protected]/diagram.png',
-    'https://cdn.example.test/diagram.png?token=secret',
-    'https://cdn.example.test/diagram.png?X-Amz-Signature=secret',
-    'https://cdn.example.test/diagram.png?auth=secret',
-    'https://cdn.example.test/diagram.png?hm=secret',
-  ])('rejects credential-bearing attachment URLs before gateway dispatch', async (url) => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', `credential-url-${url.length}`, {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [
-          { id: 'attachment-credential', name: 'diagram.png', url, contentType: 'image/png' },
-        ],
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it("selects each binding's trusted logical-agent config when creating Discord sessions", async () => {
-    configureDiscordEnv();
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001,channel-002';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
-        guildId: 'guild-001',
-        channelId: 'channel-001',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-      {
-        instanceId: 'Orion',
-        agentConfigId: 'agent-config-orion',
-        guildId: 'guild-001',
-        channelId: 'channel-002',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-    ]);
-    const session = {
-      provider: 'configured-provider',
-      modelId: 'configured-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const createSession = vi.fn().mockResolvedValue(session);
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(undefined),
-      createSession,
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt: vi.fn().mockResolvedValue(undefined),
-    };
-    const brain = {
-      agents: {
-        findById: vi.fn((id: string) =>
-          Promise.resolve({
-            id,
-            name: id === 'agent-config-orion' ? 'Orion' : 'Nova',
-          }),
-        ),
-      },
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        findMessages: vi.fn().mockResolvedValue([]),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const routingEngine = { resolve: vi.fn() };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      routingEngine as never,
-    );
-    const client = {
-      id: 'discord-client-new-session',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start configured session', 'configured-session-001', {
-        conversationId: 'Nova:discord:channel-001',
-      }),
-    );
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start second configured session', 'configured-session-002', {
-        channelId: 'channel-002',
-        conversationId: 'Orion:discord:channel-002',
-      }),
-    );
-
-    expect(createSession).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      expect.objectContaining({
-        agentConfigId: 'agent-config-nova',
-        userId: 'discord-service',
-        tenantId: 'tenant-discord',
-      }),
-    );
-    expect(createSession).toHaveBeenCalledWith(
-      'Orion:discord:channel-002',
-      expect.objectContaining({ agentConfigId: 'agent-config-orion' }),
-    );
-    expect(routingEngine.resolve).not.toHaveBeenCalled();
-  });
-
-  it('retains validated persisted attachments in resumed conversation history', async () => {
-    const attachment = {
-      id: 'attachment-history',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      mimeType: 'image/png',
-      sizeBytes: 4_096,
-    };
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {
-        conversations: {
-          findMessages: vi.fn().mockResolvedValue([
-            {
-              role: 'user',
-              content: '',
-              createdAt: new Date('2026-07-14T12:00:00.000Z'),
-              metadata: { channelAttachments: [attachment] },
-            },
-          ]),
-        },
-      } as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    ) as unknown as {
-      loadConversationHistory(
-        conversationId: string,
-        userId: string,
-      ): Promise<Array<{ attachments?: readonly (typeof attachment)[] }>>;
-    };
-
-    await expect(
-      gateway.loadConversationHistory('Nova:discord:channel-001', 'discord-service'),
-    ).resolves.toEqual([expect.objectContaining({ attachments: [attachment] })]);
-  });
-
-  it('rejects malformed signed attachment payloads before gateway dispatch', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    const malformedPayload: Record<string, unknown> = {
-      ...createPayload({
-        messageId: 'malformed-attachments-001',
-        conversationId: 'Nova:discord:channel-001',
-      }),
-      attachments: { id: 'not-an-array' },
-    };
-    const envelope = createDiscordIngressEnvelope(
-      malformedPayload as unknown as DiscordIngressPayload,
-      SERVICE_TOKEN,
-    );
-
-    await gateway.handleMessage(client as never, envelope);
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it('preserves authenticated attachment metadata through persistence and agent dispatch', async () => {
-    configureDiscordEnv();
-    const prompt = vi.fn().mockResolvedValue(undefined);
-    const addMessage = vi.fn().mockResolvedValue(undefined);
-    const session = {
-      provider: 'test-provider',
-      modelId: 'test-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(session),
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt,
-    };
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage,
-      },
-    };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    );
-    const client = {
-      id: 'discord-client-001',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-    const attachment = {
-      id: 'attachment-001',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      contentType: 'image/png',
-      sizeBytes: 4_096,
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', 'attachment-message-001', {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [attachment],
-      }),
-    );
-
-    const expectedAttachment = {
-      id: attachment.id,
-      name: attachment.name,
-      url: attachment.url,
-      mimeType: attachment.contentType,
-      sizeBytes: attachment.sizeBytes,
-    };
-    expect(prompt).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      '',
-      { userId: 'discord-service', tenantId: 'tenant-discord' },
-      [expectedAttachment],
-    );
-    expect(addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        conversationId: 'Nova:discord:channel-001',
-        metadata: expect.objectContaining({ channelAttachments: [expectedAttachment] }),
-      }),
-      'discord-service',
-    );
-  });
-
   it('accepts a thread message through its allowed bound parent channel', () => {
     const emitted = vi.fn();
     const plugin = new DiscordPlugin({
@@ -681,7 +410,6 @@ describe('Discord ingress security', () => {
       interactionBindings: [
         {
           instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
           guildId: 'guild-001',
           channelId: 'channel-001',
           pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },

apps/gateway/src/plugin/plugin.module.ts

@@ -61,16 +61,6 @@ function requiredDiscordAllowlist(name: string): string[] {
   return value;
 }
 
-function optionalPositiveInteger(name: string): number | undefined {
-  const raw = process.env[name];
-  if (raw === undefined) return undefined;
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value <= 0) {
-    throw new Error(`${name} must be a positive integer when configured`);
-  }
-  return value;
-}
-
 function createPluginRegistry(): IChannelPlugin[] {
   const plugins: IChannelPlugin[] = [];
   const discordToken = process.env['DISCORD_BOT_TOKEN'];
@@ -92,10 +82,6 @@ function createPluginRegistry(): IChannelPlugin[] {
           guildId: discordGuildId,
           gatewayUrl: discordGatewayUrl,
           serviceToken: discordServiceToken,
-          messageRateLimitPerMinute: optionalPositiveInteger(
-            'DISCORD_MESSAGE_RATE_LIMIT_PER_MINUTE',
-          ),
-          threadRateLimitPerMinute: optionalPositiveInteger('DISCORD_THREAD_RATE_LIMIT_PER_MINUTE'),
           allowedGuildIds: requiredDiscordAllowlist('DISCORD_ALLOWED_GUILD_IDS'),
           allowedChannelIds: requiredDiscordAllowlist('DISCORD_ALLOWED_CHANNEL_IDS'),
           allowedUserIds: requiredDiscordAllowlist('DISCORD_ALLOWED_USER_IDS'),

apps/gateway/src/preferences/system-override.service.spec.ts

@@ -1,23 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { SystemOverrideService } from './system-override.service.js';
-
-const localConfig = { queue: { type: 'local' } } as MosaicConfig;
-
-describe('SystemOverrideService local tier', () => {
-  it('keeps ephemeral overrides isolated by tenant and user scope', async () => {
-    const service = new SystemOverrideService(localConfig);
-    const firstScope = { tenantId: 'tenant-a', userId: 'user-a' };
-    const secondScope = { tenantId: 'tenant-b', userId: 'user-b' };
-
-    await service.set('shared-session', 'first override', firstScope);
-    await service.set('shared-session', 'second override', secondScope);
-
-    await expect(service.get('shared-session', firstScope)).resolves.toBe('first override');
-    await expect(service.get('shared-session', secondScope)).resolves.toBe('second override');
-
-    await service.clear('shared-session', firstScope);
-    await expect(service.get('shared-session', firstScope)).resolves.toBeNull();
-    await expect(service.get('shared-session', secondScope)).resolves.toBe('second override');
-  });
-});

apps/gateway/src/preferences/system-override.service.ts

@@ -1,8 +1,6 @@
-import { Inject, Injectable, Logger, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import type { ActorTenantScope } from '../auth/session-scope.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 
 const scopedSessionId = (sessionId: string, scope: ActorTenantScope) =>
   `${scope.tenantId}:${scope.userId}:${sessionId}`;
@@ -17,45 +15,16 @@ interface OverrideFragment {
   addedAt: number;
 }
 
-interface LocalOverrideEntry {
-  condensed: string;
-  fragments: OverrideFragment[];
-}
-
 @Injectable()
-export class SystemOverrideService implements OnApplicationShutdown {
+export class SystemOverrideService {
   private readonly logger = new Logger(SystemOverrideService.name);
-  private readonly handle: QueueHandle | null;
+  private readonly handle: QueueHandle;
-  /** Local-tier fallback, keyed by the same tenant/user/session scope as Redis. */
-  private readonly localStore = new Map<string, LocalOverrideEntry>();
 
-  constructor(
+  constructor() {
-    @Optional()
+    this.handle = createQueue();
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
-  ) {
-    this.handle = this.mosaicConfig?.queue?.type === 'local' ? null : createQueue();
-  }
-
-  async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
   }
 
   async set(sessionId: string, override: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) {
-      const key = scopedSessionId(sessionId, scope);
-      const entry = this.localStore.get(key) ?? { condensed: '', fragments: [] };
-      entry.fragments.push({ text: override, addedAt: Date.now() });
-      entry.condensed = await this.condenseOverrides(
-        entry.fragments.map((fragment) => fragment.text),
-      );
-      this.localStore.set(key, entry);
-      this.logger.debug(
-        `Set system override for session ${sessionId} (local, ${entry.fragments.length} fragment(s))`,
-      );
-      return;
-    }
-
     // Load existing fragments
     const existing = await this.handle.redis.get(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope));
     const fragments: OverrideFragment[] = existing
@@ -85,14 +54,10 @@ export class SystemOverrideService implements OnApplicationShutdown {
   }
 
   async get(sessionId: string, scope: ActorTenantScope): Promise<string | null> {
-    if (!this.handle) {
-      return this.localStore.get(scopedSessionId(sessionId, scope))?.condensed ?? null;
-    }
     return this.handle.redis.get(SESSION_SYSTEM_KEY(sessionId, scope));
   }
 
   async renew(sessionId: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) return;
     const pipeline = this.handle.redis.pipeline();
     pipeline.expire(SESSION_SYSTEM_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
     pipeline.expire(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
@@ -100,11 +65,6 @@ export class SystemOverrideService implements OnApplicationShutdown {
   }
 
   async clear(sessionId: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) {
-      this.localStore.delete(scopedSessionId(sessionId, scope));
-      this.logger.debug(`Cleared system override for session ${sessionId} (local)`);
-      return;
-    }
     await this.handle.redis.del(
       SESSION_SYSTEM_KEY(sessionId, scope),
       SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope),

apps/gateway/src/queue/queue.service.spec.ts

@@ -1,36 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { QueueService } from './queue.service.js';
-
-const localConfig = {
-  queue: { type: 'local' },
-} as MosaicConfig;
-
-describe('QueueService local tier', () => {
-  it('disables BullMQ and treats queue operations as local no-ops', async () => {
-    const service = new QueueService(null, localConfig);
-
-    expect(service.isEnabled()).toBe(false);
-    expect(service.getQueue('mosaic-test')).toBeNull();
-    expect(service.registerWorker('mosaic-test', vi.fn())).toBeNull();
-
-    await expect(
-      service.addRepeatableJob('mosaic-test', 'local-noop', {}, '* * * * *'),
-    ).resolves.toBeUndefined();
-    await expect(service.removeRepeatableJobs('mosaic-test', 'local-noop')).resolves.toBe(0);
-    await expect(service.getHealthStatus()).resolves.toEqual({ queues: {}, healthy: true });
-    await expect(service.listJobs()).resolves.toEqual([]);
-    await expect(service.retryJob('mosaic-test__1')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.pauseQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.resumeQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-  });
-});

apps/gateway/src/queue/queue.service.ts

@@ -8,9 +8,7 @@ import {
 } from '@nestjs/common';
 import { Queue, Worker, type Job, type ConnectionOptions } from 'bullmq';
 import type { LogService } from '@mosaicstack/log';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { LOG_SERVICE } from '../log/log.tokens.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import type { JobDto, JobStatus } from './queue-admin.dto.js';
 
 // ---------------------------------------------------------------------------
@@ -110,43 +108,22 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   private readonly connection: ConnectionOptions;
   private readonly queues = new Map<string, Queue<MosaicJobData>>();
   private readonly workers = new Map<string, Worker<MosaicJobData>>();
-  /** False on Local tier — BullMQ/Redis operations become no-ops. */
-  private readonly enabled: boolean;
 
   constructor(
     @Optional()
     @Inject(LOG_SERVICE)
     private readonly logService: LogService | null,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
   ) {
-    this.enabled = this.mosaicConfig?.queue?.type !== 'local';
+    this.connection = getConnection();
-    this.connection = this.enabled
-      ? getConnection()
-      : ({ host: '127.0.0.1', port: 6380 } as ConnectionOptions);
-  }
-
-  /** Returns true when BullMQ/Redis is active (Standalone and Federated tiers). */
-  isEnabled(): boolean {
-    return this.enabled;
   }
 
   onModuleInit(): void {
-    if (this.enabled) {
     this.logger.log('QueueService initialised (BullMQ)');
-    } else {
-      this.logger.log(
-        'QueueService: BullMQ disabled for local tier — no Redis connections will be opened',
-      );
-    }
   }
 
   async onModuleDestroy(): Promise<void> {
-    if (this.enabled) {
     await this.closeAll();
   }
-  }
 
   // -------------------------------------------------------------------------
   // Queue helpers
@@ -154,10 +131,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
 
   /**
    * Get or create a BullMQ Queue for the given queue name.
-   * Returns null on Local tier where BullMQ is disabled.
    */
-  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> | null {
+  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> {
-    if (!this.enabled) return null;
     let queue = this.queues.get(name) as Queue<T> | undefined;
     if (!queue) {
       queue = new Queue<T>(name, { connection: this.connection });
@@ -169,7 +144,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * Add a BullMQ repeatable job (cron-style).
    * Uses `jobId` as a deterministic key so duplicate registrations are idempotent.
-   * No-op on Local tier.
    */
   async addRepeatableJob<T extends MosaicJobData>(
     queueName: string,
@@ -177,13 +151,7 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
     data: T,
     cronExpression: string,
   ): Promise<void> {
-    if (!this.enabled) {
+    const queue = this.getQueue<T>(queueName);
-      this.logger.debug(
-        `Skipping repeatable job "${jobName}" on "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return;
-    }
-    const queue = this.getQueue<T>(queueName)!;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     await (queue as Queue<any>).add(jobName, data, {
       repeat: { pattern: cronExpression },
@@ -199,14 +167,7 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * safe retirement of previously registered system-wide jobs.
    */
   async removeRepeatableJobs(queueName: string, jobName: string): Promise<number> {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping repeatable-job removal for "${jobName}" on "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return 0;
-    }
     const queue = this.getQueue(queueName);
-    if (!queue) return 0;
     const jobs = await queue.getRepeatableJobs();
     const matchingJobs = jobs.filter((job) => job.name === jobName);
     await Promise.all(matchingJobs.map((job) => queue.removeRepeatableByKey(job.key)));
@@ -221,18 +182,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * Register a Worker for the given queue name with error handling and
    * exponential backoff.
-   * Returns null on Local tier where BullMQ is disabled.
    */
-  registerWorker<T extends MosaicJobData>(
+  registerWorker<T extends MosaicJobData>(queueName: string, handler: JobHandler<T>): Worker<T> {
-    queueName: string,
-    handler: JobHandler<T>,
-  ): Worker<T> | null {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping worker registration for "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return null;
-    }
     const worker = new Worker<T>(
       queueName,
       async (job) => {
@@ -289,12 +240,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
 
   /**
    * Return queue health statistics for all managed queues.
-   * Returns an empty healthy result on Local tier.
    */
   async getHealthStatus(): Promise<QueueHealthStatus> {
-    if (!this.enabled) {
-      return { queues: {}, healthy: true };
-    }
     const queues: QueueHealthStatus['queues'] = {};
     let healthy = true;
 
@@ -325,10 +272,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * List jobs across all managed queues, optionally filtered by status.
    * BullMQ jobs are fetched by state type from each queue.
-   * Returns empty array on Local tier.
    */
   async listJobs(status?: JobStatus): Promise<JobDto[]> {
-    if (!this.enabled) return [];
     const jobs: JobDto[] = [];
     const states: JobStatus[] = status
       ? [status]
@@ -355,10 +300,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Retry a specific failed job by its BullMQ job ID (format: "queueName:id").
    * The caller passes "<queueName>__<jobId>" as the composite ID because BullMQ
    * job IDs are not globally unique — they are scoped to their queue.
-   * Returns an error on Local tier.
    */
   async retryJob(compositeId: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const sep = compositeId.lastIndexOf('__');
     if (sep === -1) {
       return { ok: false, message: 'Invalid job id format. Expected "<queue>__<jobId>".' };
@@ -390,7 +333,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Pause a queue by name.
    */
   async pauseQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const queue = this.queues.get(name);
     if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
     await queue.pause();
@@ -402,7 +344,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Resume a paused queue by name.
    */
   async resumeQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const queue = this.queues.get(name);
     if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
     await queue.resume();

apps/gateway/src/workspace/workspace.controller.spec.ts

@@ -1,104 +0,0 @@
-import 'reflect-metadata';
-import {
-  type CanActivate,
-  type ExecutionContext,
-  type INestApplication,
-  ValidationPipe,
-} from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { Test } from '@nestjs/testing';
-import request from 'supertest';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { ProjectBootstrapService } from './project-bootstrap.service.js';
-import { WorkspaceController } from './workspace.controller.js';
-
-const bootstrapMock = vi.fn(() =>
-  Promise.resolve({
-    projectId: 'project-1',
-    workspacePath: '/opt/mosaic/.workspaces/users/user-1/project-1',
-  }),
-);
-
-const authGuard: CanActivate = {
-  canActivate(context: ExecutionContext): boolean {
-    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
-    requestContext.user = { id: 'user-1' };
-    return true;
-  },
-};
-
-describe('POST /api/workspaces repoUrl validation', () => {
-  let app: INestApplication;
-
-  beforeAll(async () => {
-    const moduleRef = await Test.createTestingModule({
-      controllers: [WorkspaceController],
-      providers: [
-        {
-          provide: ProjectBootstrapService,
-          useValue: { bootstrap: bootstrapMock },
-        },
-      ],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue(authGuard)
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    app.useGlobalPipes(
-      new ValidationPipe({
-        whitelist: true,
-        forbidNonWhitelisted: true,
-        transform: true,
-      }),
-    );
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  beforeEach(() => {
-    bootstrapMock.mockClear();
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it.each([
-    ['a leading-dash value', '--upload-pack=sh -c id'],
-    ['an ext remote helper', 'ext::sh -c id'],
-    ['a file URL', 'file:///tmp/repository'],
-    ['an unparseable value', 'not a url'],
-    ['an SSH shorthand', '[email protected]:acme/repository.git'],
-    ['a scheme without //', 'https:example.com/acme/repository.git'],
-    ['a hostless git URL', 'git:///tmp/repository'],
-  ])('returns 400 for %s', async (_description, repoUrl) => {
-    const response = await request(app.getHttpServer())
-      .post('/api/workspaces')
-      .send({ name: 'Example', repoUrl })
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(400);
-    expect(bootstrapMock).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ['a plain HTTPS repository URL', 'https://example.com/acme/repository.git'],
-    ['a git protocol repository URL', 'git://example.com/acme/repository.git'],
-  ])('accepts %s', async (_description, repoUrl) => {
-    const response = await request(app.getHttpServer())
-      .post('/api/workspaces')
-      .send({ name: 'Example', repoUrl })
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(201);
-    expect(bootstrapMock).toHaveBeenCalledWith({
-      name: 'Example',
-      description: undefined,
-      userId: 'user-1',
-      teamId: undefined,
-      repoUrl,
-    });
-  });
-});

apps/gateway/src/workspace/workspace.controller.ts

@@ -1,11 +1,7 @@
 import { Body, Controller, Post, UseGuards } from '@nestjs/common';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
-import {
+import { ProjectBootstrapService } from './project-bootstrap.service.js';
-  ProjectBootstrapService,
-  type BootstrapProjectResult,
-} from './project-bootstrap.service.js';
-import { CreateWorkspaceDto } from './workspace.dto.js';
 
 @Controller('api/workspaces')
 @UseGuards(AuthGuard)
@@ -15,14 +11,20 @@ export class WorkspaceController {
   @Post()
   async create(
     @CurrentUser() user: { id: string },
-    @Body() dto: CreateWorkspaceDto,
+    @Body()
-  ): Promise<BootstrapProjectResult> {
+    body: {
+      name: string;
+      description?: string;
+      teamId?: string;
+      repoUrl?: string;
+    },
+  ) {
     return this.bootstrap.bootstrap({
-      name: dto.name,
+      name: body.name,
-      description: dto.description,
+      description: body.description,
       userId: user.id,
-      teamId: dto.teamId,
+      teamId: body.teamId,
-      repoUrl: dto.repoUrl,
+      repoUrl: body.repoUrl,
     });
   }
 }

apps/gateway/src/workspace/workspace.dto.ts

@@ -1,33 +0,0 @@
-import { IsOptional, IsString, IsUrl, Matches, MaxLength } from 'class-validator';
-
-export class CreateWorkspaceDto {
-  @IsString()
-  @MaxLength(255)
-  name!: string;
-
-  @IsOptional()
-  @IsString()
-  @MaxLength(10_000)
-  description?: string;
-
-  @IsOptional()
-  @IsString()
-  teamId?: string;
-
-  @IsOptional()
-  @IsString()
-  @Matches(/^(?:https|git):\/\//i, {
-    message: 'repoUrl must be a valid https:// or git:// URL',
-  })
-  @IsUrl(
-    {
-      protocols: ['https', 'git'],
-      require_host: true,
-      require_protocol: true,
-      require_tld: false,
-      require_valid_protocol: true,
-    },
-    { message: 'repoUrl must be a valid https:// or git:// URL' },
-  )
-  repoUrl?: string;
-}

apps/gateway/src/workspace/workspace.service.spec.ts

@@ -1,33 +1,11 @@
-import { BadRequestException } from '@nestjs/common';
+import { describe, it, expect, beforeEach } from 'vitest';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { WorkspaceService } from './workspace.service.js';
-
+import path from 'node:path';
-type ExecFileMock = (
-  command: string,
-  args: readonly string[],
-  options: { cwd: string },
-  callback: (error: Error | null, stdout: string, stderr: string) => void,
-) => void;
-
-const { execFileMock } = vi.hoisted(() => ({
-  execFileMock: vi.fn<ExecFileMock>(),
-}));
-
-vi.mock('node:child_process', () => ({
-  execFile: execFileMock,
-}));
 
 describe('WorkspaceService', () => {
   let service: WorkspaceService;
 
   beforeEach(() => {
-    execFileMock.mockReset();
-    execFileMock.mockImplementation((_command, _args, _options, callback) => {
-      callback(null, '', '');
-    });
     service = new WorkspaceService();
   });
 
@@ -98,69 +76,4 @@ describe('WorkspaceService', () => {
       }
     });
   });
-
-  describe('create', () => {
-    const project = {
-      id: 'project-1',
-      ownerType: 'user',
-      userId: 'user-1',
-      teamId: null,
-    } as const;
-
-    let originalRoot: string | undefined;
-    let temporaryRoot: string;
-
-    beforeEach(async () => {
-      originalRoot = process.env['MOSAIC_ROOT'];
-      temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'mosaic-workspace-'));
-      process.env['MOSAIC_ROOT'] = temporaryRoot;
-      service = new WorkspaceService();
-    });
-
-    afterEach(async () => {
-      if (originalRoot === undefined) {
-        delete process.env['MOSAIC_ROOT'];
-      } else {
-        process.env['MOSAIC_ROOT'] = originalRoot;
-      }
-      await fs.rm(temporaryRoot, { recursive: true, force: true });
-    });
-
-    it.each([
-      ['a leading-dash URL', '--upload-pack=sh -c id'],
-      ['an ext remote helper', 'ext::sh -c id'],
-      ['a file URL', 'file:///tmp/repository'],
-      ['an unparseable value', 'not a url'],
-      ['an SSH shorthand', '[email protected]:acme/repository.git'],
-      ['a scheme without //', 'https:example.com/acme/repository.git'],
-      ['a hostless git URL', 'git:///tmp/repository'],
-    ])('rejects %s before invoking git', async (_description, repoUrl) => {
-      await expect(service.create(project, repoUrl)).rejects.toBeInstanceOf(BadRequestException);
-      expect(execFileMock).not.toHaveBeenCalled();
-    });
-
-    it.each([
-      ['an HTTPS URL', 'https://example.com/acme/repository.git'],
-      ['a git protocol URL', 'git://example.com/acme/repository.git'],
-    ])('accepts %s and invokes hardened git clone arguments', async (_description, repoUrl) => {
-      const workspacePath = await service.create(project, repoUrl);
-
-      expect(execFileMock).toHaveBeenCalledOnce();
-      expect(execFileMock).toHaveBeenCalledWith(
-        'git',
-        [
-          '-c',
-          'protocol.ext.allow=never',
-          '-c',
-          'protocol.file.allow=never',
-          'clone',
-          '--',
-          repoUrl,
-          '.',
-        ],
-        { cwd: workspacePath },
-        expect.any(Function),
-      );
-    });
-  });
 });

apps/gateway/src/workspace/workspace.service.ts

@@ -1,30 +1,10 @@
-import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
-const allowedRepositoryProtocols = new Set(['https:', 'git:']);
-const repositoryUrlPrefixPattern = /^(?:https|git):\/\//i;
-const repositoryUrlError = 'repoUrl must be a valid https:// or git:// URL';
-
-function assertAllowedRepositoryUrl(repoUrl: string): void {
-  if (repoUrl.startsWith('-') || !repositoryUrlPrefixPattern.test(repoUrl)) {
-    throw new BadRequestException(repositoryUrlError);
-  }
-
-  let parsedUrl: URL;
-  try {
-    parsedUrl = new URL(repoUrl);
-  } catch {
-    throw new BadRequestException(repositoryUrlError);
-  }
-
-  if (!allowedRepositoryProtocols.has(parsedUrl.protocol) || parsedUrl.hostname.length === 0) {
-    throw new BadRequestException(repositoryUrlError);
-  }
-}
 
 export interface WorkspaceProject {
   id: string;
@@ -59,32 +39,14 @@ export class WorkspaceService {
    * If repoUrl is provided, clone instead of init.
    */
   async create(project: WorkspaceProject, repoUrl?: string): Promise<string> {
-    if (repoUrl !== undefined) {
-      assertAllowedRepositoryUrl(repoUrl);
-    }
-
     const workspacePath = this.resolvePath(project);
 
     // Create directory
     await fs.mkdir(workspacePath, { recursive: true });
 
-    if (repoUrl !== undefined) {
+    if (repoUrl) {
-      // Clone existing repo. Defense in depth keeps dangerous local helpers
+      // Clone existing repo
-      // disabled and terminates option parsing before positional arguments.
+      await execFileAsync('git', ['clone', repoUrl, '.'], { cwd: workspacePath });
-      await execFileAsync(
-        'git',
-        [
-          '-c',
-          'protocol.ext.allow=never',
-          '-c',
-          'protocol.file.allow=never',
-          'clone',
-          '--',
-          repoUrl,
-          '.',
-        ],
-        { cwd: workspacePath },
-      );
       this.logger.log(`Cloned ${repoUrl} into workspace ${workspacePath}`);
     } else {
       // Init new git repo

apps/web/index.html

@@ -1,30 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Mosaic</title>
-    <meta name="description" content="Mosaic Stack Dashboard" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700&family=Fira+Code:wght@400;500&display=swap"
-    />
-    <script>
-      // set data-theme before first paint so the stored theme never flashes
-      (function () {
-        try {
-          var theme = window.localStorage.getItem('mosaic-theme') || 'dark';
-          document.documentElement.setAttribute('data-theme', theme === 'light' ? 'light' : 'dark');
-        } catch (error) {
-          document.documentElement.setAttribute('data-theme', 'dark');
-        }
-      })();
-    </script>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>

apps/web/package.json

@@ -3,10 +3,8 @@
   "version": "0.0.2",
   "private": true,
   "scripts": {
-    "build": "node ../../scripts/build-web.mjs",
+    "build": "next build",
-    "build:vite": "vite build",
     "dev": "next dev",
-    "dev:vite": "vite",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",
@@ -21,7 +19,6 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.18.2",
     "socket.io-client": "^4.8.0",
     "tailwind-merge": "^3.5.0"
   },
@@ -31,11 +28,9 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "@vitejs/plugin-react": "^6.0.5",
     "jsdom": "^29.0.0",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.8.0",
-    "vite": "^8.2.1",
+    "vitest": "^2.0.0"
-    "vitest": "^3.2.7"
   }
 }

apps/web/src/app/auth/provider/[provider]/page.tsx

@@ -3,56 +3,41 @@
 import Link from 'next/link';
 import { useEffect, useState } from 'react';
 import { useParams, useSearchParams } from 'next/navigation';
-import { api } from '@/lib/api';
-import { resolveAuthCallbackURL } from '@/lib/auth-redirect';
 import { signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
+import { getSsoProvider } from '@/lib/sso-providers';
 
 export default function AuthProviderRedirectPage(): React.ReactElement {
   const params = useParams<{ provider: string }>();
   const searchParams = useSearchParams();
   const providerId = typeof params.provider === 'string' ? params.provider : '';
-  const requestedCallbackURL = searchParams.get('callbackURL');
+  const provider = getSsoProvider(providerId);
-  const [providerName, setProviderName] = useState<string | null>(null);
+  const callbackURL = searchParams.get('callbackURL') ?? '/chat';
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    let cancelled = false;
+    const currentProvider = provider;
 
-    async function redirectToProvider(): Promise<void> {
+    if (!currentProvider) {
-      try {
-        const callbackURL = resolveAuthCallbackURL(requestedCallbackURL, window.location.origin);
-        const providers = await api<SsoProviderDiscovery[]>('/api/sso/providers');
-        if (cancelled) return;
-
-        const provider = providers.find((candidate) => candidate.id === providerId);
-        if (!provider) {
       setError('Unknown SSO provider.');
       return;
     }
 
-        setProviderName(provider.name);
+    if (!currentProvider.enabled) {
-        if (!provider.configured) {
+      setError(`${currentProvider.buttonLabel} is not enabled in this deployment.`);
-          setError(`${provider.name} is not enabled in this deployment.`);
-          return;
-        }
-        if (provider.loginMode !== 'oidc') {
-          setError(`${provider.name} is not available for OIDC sign in.`);
       return;
     }
 
+    const activeProvider = currentProvider;
+    let cancelled = false;
+
+    async function redirectToProvider(): Promise<void> {
       const result = await signIn.oauth2({
-          providerId: provider.id,
+        providerId: activeProvider.id,
         callbackURL,
       });
 
       if (!cancelled && result?.error) {
-          setError(result.error.message ?? `${provider.name} sign in failed.`);
+        setError(result.error.message ?? `${activeProvider.buttonLabel} sign in failed.`);
-        }
-      } catch (caught: unknown) {
-        if (!cancelled) {
-          setError(caught instanceof Error ? caught.message : 'Unable to start single sign-on.');
-        }
       }
     }
 
@@ -61,22 +46,19 @@ export default function AuthProviderRedirectPage(): React.ReactElement {
     return () => {
       cancelled = true;
     };
-  }, [providerId, requestedCallbackURL]);
+  }, [callbackURL, provider]);
 
   return (
     <div className="mx-auto flex min-h-[50vh] max-w-md flex-col justify-center">
       <h1 className="text-2xl font-semibold text-text-primary">Single sign-on</h1>
       <p className="mt-2 text-sm text-text-secondary">
-        {providerName
+        {provider
-          ? `Redirecting you to ${providerName}...`
+          ? `Redirecting you to ${provider.buttonLabel.replace('Continue with ', '')}...`
           : 'Preparing your sign-in request...'}
       </p>
 
       {error ? (
-        <div
+        <div className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error">
-          role="alert"
-          className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
           <p>{error}</p>
           <Link
             href="/login"

apps/web/src/lib/api.spec.ts

@@ -1,57 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { api } from './api';
-
-describe('api', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it('fetches the supplied relative path with credentials and a JSON body', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ ok: true }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(
-      api<{ ok: boolean }>('/api/projects', {
-        method: 'POST',
-        body: { name: 'Mosaic' },
-      }),
-    ).resolves.toEqual({ ok: true });
-
-    expect(fetchMock).toHaveBeenCalledOnce();
-    expect(fetchMock).toHaveBeenCalledWith(
-      '/api/projects',
-      expect.objectContaining({
-        method: 'POST',
-        credentials: 'include',
-        body: JSON.stringify({ name: 'Mosaic' }),
-        headers: expect.objectContaining({
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        }),
-      }),
-    );
-  });
-
-  it('throws the gateway JSON error with its statusCode', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ statusCode: 403, message: 'Forbidden' }), {
-        status: 403,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(api('/api/admin/users')).rejects.toMatchObject({
-      name: 'Error',
-      message: 'Forbidden',
-      statusCode: 403,
-    });
-  });
-});

apps/web/src/lib/api.ts

@@ -1,3 +1,5 @@
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+
 export interface ApiRequestInit extends Omit<RequestInit, 'body'> {
   body?: unknown;
 }
@@ -23,7 +25,7 @@ export async function api<T>(path: string, init?: ApiRequestInit): Promise<T> {
     headers['Content-Type'] = 'application/json';
   }
 
-  const res = await fetch(path, {
+  const res = await fetch(`${GATEWAY_URL}${path}`, {
     credentials: 'include',
     ...rest,
     headers,

apps/web/src/lib/auth-client.spec.ts

@@ -1,29 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-describe('auth client origin contract', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.resetModules();
-  });
-
-  it('uses the same-origin BetterAuth mount at /api/auth', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ session: null, user: null }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    const { authClient } = await import('./auth-client');
-    await authClient.getSession();
-
-    expect(fetchMock).toHaveBeenCalledOnce();
-    const firstCall = fetchMock.mock.calls.at(0);
-    expect(firstCall).toBeDefined();
-    const requestURL = new URL(String(firstCall?.[0]), window.location.origin);
-    expect(requestURL.origin).toBe(window.location.origin);
-    expect(requestURL.pathname).toBe('/api/auth/get-session');
-  });
-});

apps/web/src/lib/auth-client.ts

@@ -1,9 +1,8 @@
 import { createAuthClient } from 'better-auth/react';
 import { adminClient, genericOAuthClient } from 'better-auth/client/plugins';
 
-// The gateway and BetterAuth client both use /api/auth. Omitting baseURL keeps
-// every browser request on the current origin in development and production.
 export const authClient = createAuthClient({
+  baseURL: process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242',
   plugins: [adminClient(), genericOAuthClient()],
 });
 

apps/web/src/lib/auth-redirect.spec.ts

@@ -1,30 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveAuthCallbackURL } from './auth-redirect';
-
-const CURRENT_ORIGIN = 'https://mosaic.example';
-
-describe('resolveAuthCallbackURL', () => {
-  it('preserves a canonical same-origin path with search and hash', () => {
-    expect(resolveAuthCallbackURL('/projects?view=active#current', CURRENT_ORIGIN)).toBe(
-      '/projects?view=active#current',
-    );
-  });
-
-  it.each([
-    null,
-    'chat',
-    '//evil.example',
-    '/..//evil.com',
-    '/..//evil.com/x',
-    '/./..//evil.com',
-    '/../..//evil.com',
-    '/foo/..//evil.com',
-    '/\\evil.example',
-    '/\n//evil.example',
-    '/\r//evil.example',
-    '/\t//evil.example',
-    'https://evil.example/phish',
-  ])('falls back to chat for an unsafe callback target %#', (candidate) => {
-    expect(resolveAuthCallbackURL(candidate, CURRENT_ORIGIN)).toBe('/chat');
-  });
-});

apps/web/src/lib/auth-redirect.ts

@@ -1,23 +0,0 @@
-const DEFAULT_AUTH_CALLBACK_URL = '/chat';
-
-/**
- * Return a canonical same-origin path for post-auth navigation.
- *
- * Parsing before comparing origins rejects protocol-relative URLs, backslash
- * variants, and control characters that the WHATWG parser normalizes away.
- */
-export function resolveAuthCallbackURL(candidate: string | null, currentOrigin: string): string {
-  if (!candidate?.startsWith('/')) return DEFAULT_AUTH_CALLBACK_URL;
-
-  try {
-    const expectedOrigin = new URL(currentOrigin).origin;
-    const resolved = new URL(candidate, expectedOrigin);
-    if (resolved.origin !== expectedOrigin || resolved.pathname.startsWith('//')) {
-      return DEFAULT_AUTH_CALLBACK_URL;
-    }
-
-    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
-  } catch {
-    return DEFAULT_AUTH_CALLBACK_URL;
-  }
-}

apps/web/src/lib/socket.spec.ts

@@ -1,52 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const { ioMock } = vi.hoisted(() => ({
-  ioMock: vi.fn(),
-}));
-
-vi.mock('socket.io-client', () => ({
-  io: ioMock,
-}));
-
-import { destroySocket, getSocket } from './socket';
-
-describe('chat socket', () => {
-  let disconnectHandler: (() => void) | undefined;
-
-  beforeEach(() => {
-    disconnectHandler = undefined;
-    ioMock.mockReset();
-
-    const mockSocket = {
-      on: vi.fn((event: string, handler: () => void) => {
-        if (event === 'disconnect') disconnectHandler = handler;
-        return mockSocket;
-      }),
-      offAny: vi.fn(() => mockSocket),
-      disconnect: vi.fn(() => mockSocket),
-    };
-
-    ioMock.mockReturnValue(mockSocket);
-  });
-
-  afterEach(() => {
-    destroySocket();
-  });
-
-  it('creates one same-origin /chat namespace socket until it disconnects', () => {
-    const first = getSocket();
-    const second = getSocket();
-
-    expect(first).toBe(second);
-    expect(ioMock).toHaveBeenCalledOnce();
-    expect(ioMock).toHaveBeenCalledWith('/chat', {
-      withCredentials: true,
-      autoConnect: false,
-      transports: ['websocket', 'polling'],
-    });
-
-    disconnectHandler?.();
-    getSocket();
-    expect(ioMock).toHaveBeenCalledTimes(2);
-  });
-});

apps/web/src/lib/socket.ts

@@ -1,10 +1,12 @@
 import { io, type Socket } from 'socket.io-client';
 
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+
 let socket: Socket | null = null;
 
 export function getSocket(): Socket {
   if (!socket) {
-    socket = io('/chat', {
+    socket = io(`${GATEWAY_URL}/chat`, {
       withCredentials: true,
       autoConnect: false,
       transports: ['websocket', 'polling'],

apps/web/src/lib/sso-providers.test.ts

@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { getEnabledSsoProviders, getSsoProvider } from './sso-providers';
+
+describe('sso-providers', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('returns the enabled providers in login button order', () => {
+    vi.stubEnv('NEXT_PUBLIC_WORKOS_ENABLED', 'true');
+    vi.stubEnv('NEXT_PUBLIC_KEYCLOAK_ENABLED', 'true');
+
+    expect(getEnabledSsoProviders()).toEqual([
+      {
+        id: 'workos',
+        buttonLabel: 'Continue with WorkOS',
+        description: 'Enterprise SSO via WorkOS',
+        enabled: true,
+        href: '/auth/provider/workos',
+      },
+      {
+        id: 'keycloak',
+        buttonLabel: 'Continue with Keycloak',
+        description: 'Enterprise SSO via Keycloak',
+        enabled: true,
+        href: '/auth/provider/keycloak',
+      },
+    ]);
+  });
+
+  it('marks disabled providers without exposing them in the enabled list', () => {
+    vi.stubEnv('NEXT_PUBLIC_WORKOS_ENABLED', 'true');
+    vi.stubEnv('NEXT_PUBLIC_KEYCLOAK_ENABLED', 'false');
+
+    expect(getEnabledSsoProviders().map((provider) => provider.id)).toEqual(['workos']);
+    expect(getSsoProvider('keycloak')).toEqual({
+      id: 'keycloak',
+      buttonLabel: 'Continue with Keycloak',
+      description: 'Enterprise SSO via Keycloak',
+      enabled: false,
+      href: '/auth/provider/keycloak',
+    });
+  });
+
+  it('returns null for unknown providers', () => {
+    expect(getSsoProvider('authentik')).toBeNull();
+  });
+});

apps/web/src/lib/sso-providers.ts

@@ -0,0 +1,53 @@
+export type SsoProviderId = 'workos' | 'keycloak';
+
+export interface SsoProvider {
+  id: SsoProviderId;
+  buttonLabel: string;
+  description: string;
+  enabled: boolean;
+  href: string;
+}
+
+const PROVIDER_METADATA: Record<SsoProviderId, Omit<SsoProvider, 'enabled' | 'href'>> = {
+  workos: {
+    id: 'workos',
+    buttonLabel: 'Continue with WorkOS',
+    description: 'Enterprise SSO via WorkOS',
+  },
+  keycloak: {
+    id: 'keycloak',
+    buttonLabel: 'Continue with Keycloak',
+    description: 'Enterprise SSO via Keycloak',
+  },
+};
+
+export function getEnabledSsoProviders(): SsoProvider[] {
+  return (Object.keys(PROVIDER_METADATA) as SsoProviderId[])
+    .map((providerId) => getSsoProvider(providerId))
+    .filter((provider): provider is SsoProvider => provider?.enabled === true);
+}
+
+export function getSsoProvider(providerId: string): SsoProvider | null {
+  if (!isSsoProviderId(providerId)) {
+    return null;
+  }
+
+  return {
+    ...PROVIDER_METADATA[providerId],
+    enabled: isSsoProviderEnabled(providerId),
+    href: `/auth/provider/${providerId}`,
+  };
+}
+
+function isSsoProviderId(value: string): value is SsoProviderId {
+  return value === 'workos' || value === 'keycloak';
+}
+
+function isSsoProviderEnabled(providerId: SsoProviderId): boolean {
+  switch (providerId) {
+    case 'workos':
+      return process.env['NEXT_PUBLIC_WORKOS_ENABLED'] === 'true';
+    case 'keycloak':
+      return process.env['NEXT_PUBLIC_KEYCLOAK_ENABLED'] === 'true';
+  }
+}

apps/web/src/main.tsx

@@ -1,19 +0,0 @@
-import { StrictMode } from 'react';
-import { createRoot } from 'react-dom/client';
-import { RouterProvider } from 'react-router-dom';
-import { ThemeProvider } from '@/providers/theme-provider';
-import { createAppRouter } from '@/routes';
-import '@/app/globals.css';
-
-const container = document.getElementById('root');
-if (!container) {
-  throw new Error('missing #root element');
-}
-
-createRoot(container).render(
-  <StrictMode>
-    <ThemeProvider>
-      <RouterProvider router={createAppRouter()} />
-    </ThemeProvider>
-  </StrictMode>,
-);

apps/web/src/routes.tsx

@@ -1,49 +0,0 @@
-import type { ReactElement } from 'react';
-import { createBrowserRouter, Navigate, Outlet, type RouteObject } from 'react-router-dom';
-import { LoginPage } from '@/spa/pages/login';
-import { RegisterPage } from '@/spa/pages/register';
-import { SsoCallbackPage } from '@/spa/pages/sso-callback';
-import { AuthGuard, GuestGuard } from '@/spa/guards';
-import { Placeholder } from '@/spa/placeholder';
-
-function GuestLayout(): ReactElement {
-  return (
-    <div className="flex min-h-screen items-center justify-center bg-surface-bg px-4 py-8">
-      <div className="w-full max-w-md rounded-xl border border-surface-border bg-surface-card p-8 shadow-lg">
-        <Outlet />
-      </div>
-    </div>
-  );
-}
-
-export const routes: RouteObject[] = [
-  {
-    element: <GuestGuard />,
-    children: [
-      {
-        element: <GuestLayout />,
-        children: [
-          { path: '/login', element: <LoginPage /> },
-          { path: '/register', element: <RegisterPage /> },
-          { path: '/auth/provider/:provider', element: <SsoCallbackPage /> },
-        ],
-      },
-    ],
-  },
-  {
-    element: <AuthGuard />,
-    children: [
-      { path: '/', element: <Navigate to="/chat" replace /> },
-      { path: '/chat', element: <Placeholder title="Chat" /> },
-      { path: '/projects', element: <Placeholder title="Projects" /> },
-      { path: '/projects/:id', element: <Placeholder title="Project" /> },
-      { path: '/tasks', element: <Placeholder title="Tasks" /> },
-      { path: '/settings', element: <Placeholder title="Settings" /> },
-      { path: '/admin', element: <Placeholder title="Admin" /> },
-    ],
-  },
-];
-
-export function createAppRouter(): ReturnType<typeof createBrowserRouter> {
-  return createBrowserRouter(routes);
-}

apps/web/src/spa/guards.spec.tsx

@@ -1,135 +0,0 @@
-import { act } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
-import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
-
-const { useSessionMock } = vi.hoisted(() => ({
-  useSessionMock: vi.fn(),
-}));
-
-vi.mock('@/lib/auth-client', () => ({
-  useSession: useSessionMock,
-}));
-
-import { AuthGuard, GuestGuard } from './guards';
-
-interface RenderedRouter {
-  container: HTMLDivElement;
-  router: ReturnType<typeof createMemoryRouter>;
-}
-
-const mountedRoots: Root[] = [];
-
-beforeAll(() => {
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
-    configurable: true,
-    value: true,
-  });
-});
-
-afterAll(() => {
-  Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-});
-
-async function renderRouter(
-  routeObjects: RouteObject[],
-  initialEntry: string,
-): Promise<RenderedRouter> {
-  const container = document.createElement('div');
-  document.body.append(container);
-  const router = createMemoryRouter(routeObjects, { initialEntries: [initialEntry] });
-  const root = createRoot(container);
-  mountedRoots.push(root);
-
-  await act(async () => {
-    root.render(<RouterProvider router={router} />);
-  });
-
-  return { container, router };
-}
-
-afterEach(async () => {
-  for (const root of mountedRoots.splice(0)) {
-    await act(async () => {
-      root.unmount();
-    });
-  }
-  document.body.replaceChildren();
-  useSessionMock.mockReset();
-});
-
-const guestRoutes: RouteObject[] = [
-  {
-    path: '/login',
-    element: <GuestGuard />,
-    children: [{ index: true, element: <p>Guest page</p> }],
-  },
-  { path: '/chat', element: <p>Chat page</p> },
-];
-
-const authenticatedRoutes: RouteObject[] = [
-  {
-    path: '/chat',
-    element: <AuthGuard />,
-    children: [{ index: true, element: <p>Private page</p> }],
-  },
-  { path: '/login', element: <p>Login page</p> },
-];
-
-describe('GuestGuard', () => {
-  it('renders the guest outlet while session lookup is pending', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: true });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Guest page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('renders the guest outlet when no session exists', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: false });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Guest page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('redirects an authenticated session to chat', async () => {
-    useSessionMock.mockReturnValue({ data: { user: { id: 'user-1' } }, isPending: false });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Chat page');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-});
-
-describe('AuthGuard', () => {
-  it('renders the existing loading treatment while session lookup is pending', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: true });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Loading...');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-
-  it('redirects an unauthenticated visitor to login', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: false });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Login page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('renders the authenticated outlet when a session exists', async () => {
-    useSessionMock.mockReturnValue({ data: { user: { id: 'user-1' } }, isPending: false });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Private page');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-});

apps/web/src/spa/guards.tsx

@@ -1,23 +0,0 @@
-import type { ReactElement } from 'react';
-import { Navigate, Outlet } from 'react-router-dom';
-import { useSession } from '@/lib/auth-client';
-
-export function GuestGuard(): ReactElement {
-  const { data: session } = useSession();
-
-  return session ? <Navigate to="/chat" replace /> : <Outlet />;
-}
-
-export function AuthGuard(): ReactElement {
-  const { data: session, isPending } = useSession();
-
-  if (isPending) {
-    return (
-      <div className="flex min-h-screen items-center justify-center">
-        <div className="text-sm text-text-muted">Loading...</div>
-      </div>
-    );
-  }
-
-  return session ? <Outlet /> : <Navigate to="/login" replace />;
-}

apps/web/src/spa/pages/login.tsx

@@ -1,152 +0,0 @@
-import { useEffect, useState, type FormEvent, type ReactElement } from 'react';
-import { Link, useNavigate } from 'react-router-dom';
-import { SsoProviderButtons } from '@/components/auth/sso-provider-buttons';
-import { api } from '@/lib/api';
-import { authClient, signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
-
-export function LoginPage(): ReactElement {
-  const navigate = useNavigate();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-  const [ssoProviders, setSsoProviders] = useState<SsoProviderDiscovery[]>([]);
-  const [ssoLoadingProviderId, setSsoLoadingProviderId] = useState<
-    SsoProviderDiscovery['id'] | null
-  >(null);
-
-  useEffect(() => {
-    let active = true;
-
-    void api<SsoProviderDiscovery[]>('/api/sso/providers').then(
-      (providers) => {
-        if (active) setSsoProviders(providers.filter((provider) => provider.configured));
-      },
-      () => {
-        if (active) setSsoProviders([]);
-      },
-    );
-
-    return () => {
-      active = false;
-    };
-  }, []);
-
-  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
-    event.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(event.currentTarget);
-    const email = String(form.get('email') ?? '');
-    const password = String(form.get('password') ?? '');
-
-    try {
-      const result = await signIn.email({ email, password });
-
-      if (result.error) {
-        setError(result.error.message ?? 'Sign in failed');
-        return;
-      }
-
-      navigate('/chat', { replace: true });
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : 'Sign in failed');
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  async function handleSsoSignIn(providerId: SsoProviderDiscovery['id']): Promise<void> {
-    setError(null);
-    setSsoLoadingProviderId(providerId);
-
-    try {
-      const result = await authClient.signIn.oauth2({
-        providerId,
-        callbackURL: '/chat',
-        newUserCallbackURL: '/chat',
-      });
-
-      if (result.error) {
-        setError(result.error.message ?? `Sign in with ${providerId} failed`);
-        setSsoLoadingProviderId(null);
-      }
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : `Sign in with ${providerId} failed`);
-      setSsoLoadingProviderId(null);
-    }
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Sign in</h1>
-      <p className="mt-1 text-sm text-text-secondary">Sign in to your Mosaic account</p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      ) : null}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="current-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Signing in...' : 'Sign in'}
-        </button>
-      </form>
-
-      <SsoProviderButtons
-        providers={ssoProviders}
-        loadingProviderId={ssoLoadingProviderId}
-        onOidcSignIn={(providerId) => {
-          void handleSsoSignIn(providerId);
-        }}
-      />
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Don&apos;t have an account?{' '}
-        <Link to="/register" className="text-blue-400 hover:text-blue-300">
-          Sign up
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/spa/pages/register.tsx

@@ -1,116 +0,0 @@
-import { useState, type FormEvent, type ReactElement } from 'react';
-import { Link, useNavigate } from 'react-router-dom';
-import { signUp } from '@/lib/auth-client';
-
-export function RegisterPage(): ReactElement {
-  const navigate = useNavigate();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-
-  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
-    event.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(event.currentTarget);
-    const name = String(form.get('name') ?? '');
-    const email = String(form.get('email') ?? '');
-    const password = String(form.get('password') ?? '');
-
-    try {
-      const result = await signUp.email({ name, email, password });
-
-      if (result.error) {
-        setError(result.error.message ?? 'Registration failed');
-        return;
-      }
-
-      navigate('/chat', { replace: true });
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : 'Registration failed');
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Create account</h1>
-      <p className="mt-1 text-sm text-text-secondary">Get started with Mosaic</p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      ) : null}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="name" className="block text-sm font-medium text-text-secondary">
-            Name
-          </label>
-          <input
-            id="name"
-            name="name"
-            type="text"
-            autoComplete="name"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="Your name"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="new-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Creating account...' : 'Create account'}
-        </button>
-      </form>
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Already have an account?{' '}
-        <Link to="/login" className="text-blue-400 hover:text-blue-300">
-          Sign in
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/spa/pages/sso-callback.spec.tsx

@@ -1,90 +0,0 @@
-import { act } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-import { createMemoryRouter, RouterProvider } from 'react-router-dom';
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const { apiMock, oauth2Mock } = vi.hoisted(() => ({
-  apiMock: vi.fn(),
-  oauth2Mock: vi.fn(),
-}));
-
-vi.mock('@/lib/api', () => ({
-  api: apiMock,
-}));
-
-vi.mock('@/lib/auth-client', () => ({
-  signIn: { oauth2: oauth2Mock },
-}));
-
-import { SsoCallbackPage } from './sso-callback';
-
-const mountedRoots: Root[] = [];
-
-beforeAll(() => {
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
-    configurable: true,
-    value: true,
-  });
-});
-
-beforeEach(() => {
-  apiMock.mockResolvedValue([
-    {
-      id: 'authentik',
-      name: 'Authentik',
-      protocols: ['oidc'],
-      configured: true,
-      loginMode: 'oidc',
-      callbackPath: '/api/auth/oauth2/callback/authentik',
-      teamSync: { enabled: false, claim: null },
-      samlFallback: { configured: false, loginUrl: null },
-      warnings: [],
-    },
-  ]);
-  oauth2Mock.mockResolvedValue({ data: null, error: null });
-});
-
-afterEach(async () => {
-  for (const root of mountedRoots.splice(0)) {
-    await act(async () => {
-      root.unmount();
-    });
-  }
-  document.body.replaceChildren();
-  apiMock.mockReset();
-  oauth2Mock.mockReset();
-});
-
-afterAll(() => {
-  Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-});
-
-describe('SsoCallbackPage', () => {
-  it('rejects a control-character callback that normalizes to an external origin', async () => {
-    const router = createMemoryRouter(
-      [
-        {
-          path: '/auth/provider/:provider',
-          element: <SsoCallbackPage />,
-        },
-      ],
-      {
-        initialEntries: ['/auth/provider/authentik?callbackURL=%2F%0A%2F%2Fevil.example'],
-      },
-    );
-    const container = document.createElement('div');
-    document.body.append(container);
-    const root = createRoot(container);
-    mountedRoots.push(root);
-
-    await act(async () => {
-      root.render(<RouterProvider router={router} />);
-      await new Promise((resolve) => setTimeout(resolve, 0));
-    });
-
-    expect(oauth2Mock).toHaveBeenCalledWith({
-      providerId: 'authentik',
-      callbackURL: '/chat',
-    });
-  });
-});

apps/web/src/spa/pages/sso-callback.tsx

@@ -1,91 +0,0 @@
-import { useEffect, useState, type ReactElement } from 'react';
-import { Link, useParams, useSearchParams } from 'react-router-dom';
-import { api } from '@/lib/api';
-import { resolveAuthCallbackURL } from '@/lib/auth-redirect';
-import { signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
-
-export function SsoCallbackPage(): ReactElement {
-  const { provider: providerId = '' } = useParams<'provider'>();
-  const [searchParams] = useSearchParams();
-  const requestedCallbackURL = searchParams.get('callbackURL');
-  const [providerName, setProviderName] = useState<string | null>(null);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    let cancelled = false;
-
-    async function redirectToProvider(): Promise<void> {
-      try {
-        const callbackURL = resolveAuthCallbackURL(requestedCallbackURL, window.location.origin);
-        const providers = await api<SsoProviderDiscovery[]>('/api/sso/providers');
-        if (cancelled) return;
-
-        const provider = providers.find((candidate) => candidate.id === providerId);
-        if (!provider) {
-          setError('Unknown SSO provider.');
-          return;
-        }
-
-        setProviderName(provider.name);
-        if (!provider.configured) {
-          setError(`${provider.name} is not enabled in this deployment.`);
-          return;
-        }
-        if (provider.loginMode !== 'oidc') {
-          setError(`${provider.name} is not available for OIDC sign in.`);
-          return;
-        }
-
-        const result = await signIn.oauth2({
-          providerId: provider.id,
-          callbackURL,
-        });
-
-        if (!cancelled && result?.error) {
-          setError(result.error.message ?? `${provider.name} sign in failed.`);
-        }
-      } catch (caught: unknown) {
-        if (!cancelled) {
-          setError(caught instanceof Error ? caught.message : 'Unable to start single sign-on.');
-        }
-      }
-    }
-
-    void redirectToProvider();
-
-    return () => {
-      cancelled = true;
-    };
-  }, [providerId, requestedCallbackURL]);
-
-  return (
-    <div className="mx-auto flex min-h-[50vh] max-w-md flex-col justify-center">
-      <h1 className="text-2xl font-semibold text-text-primary">Single sign-on</h1>
-      <p className="mt-2 text-sm text-text-secondary">
-        {providerName
-          ? `Redirecting you to ${providerName}...`
-          : 'Preparing your sign-in request...'}
-      </p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          <p>{error}</p>
-          <Link
-            to="/login"
-            className="mt-3 inline-block font-medium text-blue-400 hover:text-blue-300"
-          >
-            Return to login
-          </Link>
-        </div>
-      ) : (
-        <div className="mt-6 rounded-lg border border-surface-border bg-surface-elevated px-4 py-3 text-sm text-text-secondary">
-          If the redirect does not start automatically, return to the login page and try again.
-        </div>
-      )}
-    </div>
-  );
-}

apps/web/src/spa/placeholder.tsx

@@ -1,9 +0,0 @@
-import type { ReactElement } from 'react';
-
-export function Placeholder({ title }: { title: string }): ReactElement {
-  return (
-    <main className="flex min-h-screen items-center justify-center">
-      <h1 className="text-xl font-medium">{title}</h1>
-    </main>
-  );
-}

apps/web/src/spa/routes.spec.tsx

@@ -1,58 +0,0 @@
-import { isValidElement } from 'react';
-import { describe, expect, it } from 'vitest';
-import type { RouteObject } from 'react-router-dom';
-import { routes } from '@/routes';
-import { Placeholder } from '@/spa/placeholder';
-
-function collectPaths(routeObjects: RouteObject[]): string[] {
-  return routeObjects.flatMap((route) => [
-    ...(route.path ? [route.path] : []),
-    ...(route.children ? collectPaths(route.children) : []),
-  ]);
-}
-
-function findRoute(routeObjects: RouteObject[], path: string): RouteObject | undefined {
-  for (const route of routeObjects) {
-    if (route.path === path) return route;
-    const nested = route.children ? findRoute(route.children, path) : undefined;
-    if (nested) return nested;
-  }
-  return undefined;
-}
-
-describe('SPA route table', () => {
-  it('covers every v1 parity route from the Phase P RFC', () => {
-    expect(collectPaths(routes).sort()).toEqual(
-      [
-        '/',
-        '/admin',
-        '/auth/provider/:provider',
-        '/chat',
-        '/login',
-        '/projects',
-        '/projects/:id',
-        '/register',
-        '/settings',
-        '/tasks',
-      ].sort(),
-    );
-  });
-
-  it('separates guest and authenticated route groups', () => {
-    const guestPaths = collectPaths(routes.at(0)?.children ?? []);
-    const authPaths = collectPaths(routes.at(1)?.children ?? []);
-    expect(guestPaths).toContain('/login');
-    expect(guestPaths).not.toContain('/chat');
-    expect(authPaths).toContain('/chat');
-  });
-
-  it.each(['/login', '/register', '/auth/provider/:provider'])(
-    'renders a real guest page instead of the P1 placeholder at %s',
-    (path) => {
-      const element = findRoute(routes, path)?.element;
-      expect(isValidElement(element)).toBe(true);
-      if (!isValidElement(element)) throw new Error(`Missing route element for ${path}`);
-      expect(element.type).not.toBe(Placeholder);
-    },
-  );
-});

apps/web/src/test/setup.spec.ts

@@ -1,14 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-describe('Vitest abort-controller realm', () => {
-  it('provides a global signal accepted by Node native Request', () => {
-    const controller = new AbortController();
-    const request = new Request('https://mosaic.invalid/navigation', {
-      signal: controller.signal,
-    });
-
-    expect(request.signal).toBeInstanceOf(AbortSignal);
-    controller.abort();
-    expect(request.signal.aborted).toBe(true);
-  });
-});

apps/web/src/test/setup.ts

@@ -1,23 +0,0 @@
-import { transferableAbortController } from 'node:util';
-
-// jsdom installs realm-local abort constructors while Node's undici Request
-// remains native. React Router passes a global AbortSignal to Request, so both
-// constructors must come from Node's native realm during tests.
-const nativeController = transferableAbortController();
-const nativeAbortController = nativeController.constructor;
-const nativeAbortSignal = nativeController.signal.constructor;
-
-for (const target of [globalThis, window]) {
-  Object.defineProperties(target, {
-    AbortController: {
-      configurable: true,
-      writable: true,
-      value: nativeAbortController,
-    },
-    AbortSignal: {
-      configurable: true,
-      writable: true,
-      value: nativeAbortSignal,
-    },
-  });
-}

apps/web/vite.config.ts

@@ -1,24 +0,0 @@
-import { fileURLToPath } from 'node:url';
-import react from '@vitejs/plugin-react';
-import { defineConfig } from 'vite';
-
-// The proxy exists only in dev; in production the SPA is same-origin with the gateway
-// (served by it under Candidate A, or behind one FQDN under Candidate B) and every
-// request uses a relative path, so no origin may ever be configured here or in src/.
-const gatewayTarget = 'http://localhost:14242';
-
-export default defineConfig({
-  plugins: [react()],
-  resolve: {
-    alias: {
-      '@': fileURLToPath(new URL('./src', import.meta.url)),
-    },
-  },
-  server: {
-    port: 3100,
-    proxy: {
-      '/api': gatewayTarget,
-      '/socket.io': { target: gatewayTarget, ws: true },
-    },
-  },
-});

apps/web/vitest.config.ts

@@ -1,21 +1,9 @@
-import { fileURLToPath } from 'node:url';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
-  resolve: {
-    alias: {
-      '@': fileURLToPath(new URL('./src', import.meta.url)),
-    },
-  },
-  // tsconfig uses "jsx": "preserve" for Next; tests need esbuild to compile it
-  esbuild: {
-    jsx: 'automatic',
-  },
   test: {
     globals: true,
     environment: 'jsdom',
-    setupFiles: ['./src/test/setup.ts'],
-    isolate: true,
     exclude: ['e2e/**', 'node_modules/**'],
   },
 });

docker/gateway.Dockerfile

@@ -10,8 +10,6 @@ COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/gateway/package.json ./apps/gateway/
 COPY packages/ ./packages/
 COPY plugins/ ./plugins/
-# the root prepare script runs scripts/install-hooks.mjs on install
-COPY scripts/ ./scripts/
 RUN pnpm install --frozen-lockfile
 COPY . .
 # Build gateway and all of its workspace dependencies via turbo dependency graph
@@ -23,22 +21,11 @@ RUN pnpm --filter @mosaicstack/gateway --prod deploy --legacy /deploy
 FROM base AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# WorkspaceService shells out to git at runtime and roots workspaces at
-# $MOSAIC_ROOT/.workspaces (apps/gateway/src/workspace/workspace.service.ts);
-# mount a volume over /opt/mosaic to persist workspaces across container restarts.
-# Intentionally unpinned: Alpine's signed repository is the trust anchor; pinning
-# git was declined so routine base-image security updates remain maintainable.
-RUN apk add --no-cache git \
-  && mkdir -p /opt/mosaic/.workspaces \
-  && chown -R node:node /opt/mosaic /app
-ENV MOSAIC_ROOT=/opt/mosaic
 # Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
-COPY --chown=node:node --from=builder /deploy/node_modules ./node_modules
+COPY --from=builder /deploy/node_modules ./node_modules
-COPY --chown=node:node --from=builder /deploy/package.json ./package.json
+COPY --from=builder /deploy/package.json ./package.json
 # dist is declared in package.json "files" so pnpm deploy copies it into /deploy;
 # copy from builder explicitly as belt-and-suspenders
-COPY --chown=node:node --from=builder /app/apps/gateway/dist ./dist
+COPY --from=builder /app/apps/gateway/dist ./dist
-# gateway defaults to port 14242 (apps/gateway/src/main.ts)
+EXPOSE 4000
-EXPOSE 14242
-USER node
 CMD ["node", "dist/main.js"]