fix(#1045): close credential finalization races

Co-authored-by: be-coder-08 <[email protected]>

.woodpecker/publish.yml

@@ -1,5 +1,5 @@
 # Build, publish npm packages, and push Docker images
-# Runs on main for stable publishes and on next for integration-line prereleases/images
+# Runs only on main branch push/tag
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
@@ -23,21 +23,9 @@ variables:
           - 'docs/**'
           - '**/*.md'
           - '.woodpecker/**'
-    - event: [push, manual]
-      branch: next
-  - &main_image_build_when
-    - event: tag
-    - event: [push, manual]
-      branch: main
-      path:
-        exclude:
-          - 'packages/mosaic/**'
-          - 'docs/**'
-          - '**/*.md'
-          - '.woodpecker/**'
 
 when:
-  - branch: [main, next]
+  - branch: [main]
     event: [push, manual, tag]
 
 steps:
@@ -115,84 +103,6 @@ steps:
     depends_on:
       - build
 
-  publish-next-npm:
-    image: *node_image
-    # Durable @next integration-line publish. Runs only on next; never writes
-    # the latest dist-tag and never commits the computed prerelease versions.
-    when:
-      - event: [push, manual]
-        branch: next
-    environment:
-      NPM_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_PIPELINE_NUMBER: ${CI_PIPELINE_NUMBER}
-    commands:
-      - *enable_pnpm
-      - |
-        if [ "$CI_COMMIT_BRANCH" != "next" ]; then
-          echo "[publish-next] FATAL: publish-next-npm may only run on next (got '$CI_COMMIT_BRANCH')" >&2
-          exit 1
-        fi
-        if [ -z "$CI_PIPELINE_NUMBER" ]; then
-          echo "[publish-next] FATAL: CI_PIPELINE_NUMBER is required for prerelease versioning" >&2
-          exit 1
-        fi
-        echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
-        echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
-        DIST_TAGS_JSON="$(npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json)"
-        DIST_TAGS_JSON="$DIST_TAGS_JSON" node -e 'const tags = JSON.parse(process.env.DIST_TAGS_JSON || "{}"); if (!tags || typeof tags !== "object" || !Object.hasOwn(tags, "latest")) { throw new Error("Gitea npm registry did not return a usable dist-tags object"); } console.log("[publish-next] registry dist-tags OK: latest=" + tags.latest);'
-        node <<'NODE'
-        const fs = require('node:fs');
-        const path = require('node:path');
-
-        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
-        const roots = ['apps', 'packages', 'plugins'];
-        const updated = [];
-
-        function walk(dir) {
-          if (!fs.existsSync(dir)) return;
-          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-              const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) updatePackage(packagePath);
-              walk(fullPath);
-            }
-          }
-        }
-
-        function updatePackage(packagePath) {
-          const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-          if (!manifest.name?.startsWith('@mosaicstack/') || manifest.private) return;
-          const stableMatch = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(manifest.version);
-          if (!stableMatch) {
-            throw new Error(manifest.name + " has unsupported semver version '" + manifest.version + "'");
-          }
-          const [, major, minor, patch] = stableMatch;
-          const oldVersion = manifest.version;
-          manifest.version = major + '.' + minor + '.' + (Number(patch) + 1) + '-next.' + pipelineNumber;
-          fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
-          updated.push(manifest.name + ' ' + oldVersion + ' -> ' + manifest.version);
-        }
-
-        for (const root of roots) walk(root);
-        if (updated.length === 0) throw new Error('No publishable @mosaicstack/* packages found');
-        console.log('[publish-next] computed prerelease versions for ' + updated.length + ' packages:');
-        for (const line of updated) console.log('[publish-next] ' + line);
-        NODE
-        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" --filter "!@mosaicstack/mosaic-as" publish --no-git-checks --access public --tag next
-        EXPECTED_VERSION="$(node -p "require('./packages/mosaic/package.json').version")"
-        RESOLVED_VERSION="$(npm view @mosaicstack/mosaic@next version --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/)"
-        if [ "$RESOLVED_VERSION" != "$EXPECTED_VERSION" ]; then
-          echo "[publish-next] FATAL: @mosaicstack/mosaic@next resolved '$RESOLVED_VERSION', expected '$EXPECTED_VERSION'" >&2
-          exit 1
-        fi
-        echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
-    depends_on:
-      - build
-
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
   #   image: *node_image
@@ -224,17 +134,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next gateway publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next gateway publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: gateway image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:$CI_COMMIT_TAG"
@@ -245,7 +146,7 @@ steps:
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
+    when: *image_build_when
     environment:
       REGISTRY_USER:
         from_secret: gitea_username
@@ -271,7 +172,7 @@ steps:
 
   build-web:
     image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
+    when: *image_build_when
     environment:
       REGISTRY_USER:
         from_secret: gitea_username

README.md

@@ -30,16 +30,6 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |
 
-### Install lanes
-
-| Lane                     | Command                               | Use when                                              | Source                                                                  |
-| ------------------------ | ------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main` |
-| Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Build-from-source at `next`                                             |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                  |
-
-`--next` is shorthand for the prerelease integration lane: it enables source-build mode and uses `next` unless an explicit `--ref` or `MOSAIC_REF` is provided.
-
 After install, the wizard runs automatically or you can invoke it manually:
 
 ```bash
@@ -371,9 +361,7 @@ The CLI also performs a background update check on every invocation (cached for
 bash tools/install.sh --check           # Version check only
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --next            # Prerelease lane: source build from next
-bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
-bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
+bash tools/install.sh --ref v1.0        # Install from a specific git ref
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```

apps/gateway/src/__tests__/integration/federation-m3-list.integration.test.ts

@@ -1,519 +0,0 @@
-/**
- * Federation M3 single-gateway integration tests (FED-M3-10).
- *
- * Covers MILESTONES.md M3 acceptance:
- *  - #6: malformed certificate OIDs fail with 401; valid cert + revoked grant fails with 403.
- *  - #7: max_rows_per_query caps list results.
- *
- * Strategy:
- *  - Real PostgreSQL via @mosaicstack/db.
- *  - Mocked TLS context/Fastify request shim for FederationAuthGuard.
- *  - Direct controller calls using the real POST /api/federation/v1/list/:resource contract.
- *
- * Run:
- *   FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- \
- *     src/__tests__/integration/federation-m3-list.integration.test.ts
- */
-
-import 'reflect-metadata';
-import * as crypto from 'node:crypto';
-import type { ExecutionContext } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import {
-  and,
-  createDb,
-  eq,
-  federationGrants,
-  federationPeers,
-  inArray,
-  missionTasks,
-  missions,
-  projects,
-  tasks,
-  teamMembers,
-  teams,
-  type Db,
-  type DbHandle,
-  users,
-} from '@mosaicstack/db';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { DB } from '../../database/database.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { FederationAuthGuard } from '../../federation/server/federation-auth.guard.js';
-import { FederationScopeService } from '../../federation/server/scope.service.js';
-import { FederationListQueryService } from '../../federation/server/verbs/list-query.service.js';
-import { ListController } from '../../federation/server/verbs/list.controller.js';
-import {
-  makeMosaicIssuedCert,
-  makeSelfSignedCert,
-} from '../../federation/__tests__/helpers/test-cert.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const PG_URL = process.env['DATABASE_URL'] ?? 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const RUN_ID = `fed-m3-10-${crypto.randomUUID()}`;
-const CERT_SERIAL_HEX = crypto.randomUUID().replace(/-/g, '').toUpperCase();
-
-interface TestIds {
-  readonly subjectUserId: string;
-  readonly otherUserId: string;
-  readonly peerId: string;
-  readonly revokedPeerId: string;
-  readonly activeGrantId: string;
-  readonly revokedGrantId: string;
-  readonly subjectProjectId: string;
-  readonly subjectMissionId: string;
-  readonly otherProjectId: string;
-  readonly teamId: string;
-  readonly unauthorizedTeamId: string;
-  readonly teamProjectId: string;
-  readonly taskIds: readonly string[];
-  readonly excludedTaskIds: readonly string[];
-  readonly subjectNoteId: string;
-  readonly otherUserNoteId: string;
-}
-
-function pemToDer(pem: string): Buffer {
-  return Buffer.from(
-    pem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, ''),
-    'base64',
-  );
-}
-
-function makeFederationRequest(certPem: string): FastifyRequest {
-  return {
-    raw: {
-      socket: {
-        getPeerCertificate: () => ({
-          raw: pemToDer(certPem),
-          serialNumber: CERT_SERIAL_HEX,
-        }),
-      },
-    },
-  } as unknown as FastifyRequest;
-}
-
-function makeGuardContext(request: FastifyRequest): {
-  readonly context: ExecutionContext;
-  readonly sent: { statusCode?: number; payload?: unknown };
-} {
-  const sent: { statusCode?: number; payload?: unknown } = {};
-  const reply = {
-    status: (statusCode: number) => {
-      sent.statusCode = statusCode;
-      return {
-        header: () => ({
-          send: (payload: unknown) => {
-            sent.payload = payload;
-          },
-        }),
-      };
-    },
-  } as unknown as FastifyReply;
-
-  const context = {
-    switchToHttp: () => ({
-      getRequest: () => request,
-      getResponse: () => reply,
-    }),
-  } as unknown as ExecutionContext;
-
-  return { context, sent };
-}
-
-async function insertUser(db: Db, id: string, label: string): Promise<void> {
-  await db.insert(users).values({
-    id,
-    name: `${RUN_ID}-${label}`,
-    email: `${RUN_ID}-${label}@federation-test.invalid`,
-    emailVerified: false,
-  });
-}
-
-async function seedFixtures(db: Db): Promise<TestIds> {
-  const subjectUserId = `${RUN_ID}-subject`;
-  const otherUserId = `${RUN_ID}-other`;
-  const peerId = crypto.randomUUID();
-  const revokedPeerId = crypto.randomUUID();
-  const activeGrantId = crypto.randomUUID();
-  const revokedGrantId = crypto.randomUUID();
-  const subjectProjectId = crypto.randomUUID();
-  const subjectMissionId = crypto.randomUUID();
-  const otherProjectId = crypto.randomUUID();
-  const teamId = crypto.randomUUID();
-  const unauthorizedTeamId = crypto.randomUUID();
-  const teamProjectId = crypto.randomUUID();
-  const taskIds = [crypto.randomUUID(), crypto.randomUUID(), crypto.randomUUID()] as const;
-  const excludedTaskIds = [crypto.randomUUID(), crypto.randomUUID()] as const;
-  const subjectNoteId = crypto.randomUUID();
-  const otherUserNoteId = crypto.randomUUID();
-
-  await insertUser(db, subjectUserId, 'subject');
-  await insertUser(db, otherUserId, 'other');
-
-  await db.insert(teams).values([
-    {
-      id: teamId,
-      name: `${RUN_ID} allowed team`,
-      slug: `${RUN_ID}-allowed-team`,
-      ownerId: subjectUserId,
-      managerId: subjectUserId,
-    },
-    {
-      id: unauthorizedTeamId,
-      name: `${RUN_ID} unauthorized team`,
-      slug: `${RUN_ID}-unauthorized-team`,
-      ownerId: otherUserId,
-      managerId: otherUserId,
-    },
-  ]);
-
-  await db.insert(teamMembers).values([
-    { teamId, userId: subjectUserId, role: 'member' },
-    { teamId: unauthorizedTeamId, userId: subjectUserId, role: 'member' },
-  ]);
-
-  await db.insert(projects).values([
-    {
-      id: subjectProjectId,
-      name: `${RUN_ID} subject personal project`,
-      ownerType: 'user',
-      ownerId: subjectUserId,
-    },
-    {
-      id: otherProjectId,
-      name: `${RUN_ID} other personal project`,
-      ownerType: 'user',
-      ownerId: otherUserId,
-    },
-    {
-      id: teamProjectId,
-      name: `${RUN_ID} unauthorized team project`,
-      ownerType: 'team',
-      teamId: unauthorizedTeamId,
-    },
-  ]);
-
-  await db.insert(missions).values({
-    id: subjectMissionId,
-    name: `${RUN_ID} subject mission`,
-    projectId: subjectProjectId,
-    userId: subjectUserId,
-  });
-
-  await db.insert(tasks).values([
-    {
-      id: taskIds[0],
-      title: `${RUN_ID} visible task 1`,
-      missionId: subjectMissionId,
-      createdAt: new Date('2026-06-25T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:00:00.000Z'),
-    },
-    {
-      id: taskIds[1],
-      title: `${RUN_ID} visible task 2`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T02:00:00.000Z'),
-    },
-    {
-      id: taskIds[2],
-      title: `${RUN_ID} visible task 3`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T01:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[0],
-      title: `${RUN_ID} other user task`,
-      projectId: otherProjectId,
-      createdAt: new Date('2026-06-25T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[1],
-      title: `${RUN_ID} unauthorized team task`,
-      projectId: teamProjectId,
-      createdAt: new Date('2026-06-25T05:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T05:00:00.000Z'),
-    },
-  ]);
-
-  await db.insert(missionTasks).values([
-    {
-      id: subjectNoteId,
-      missionId: subjectMissionId,
-      userId: subjectUserId,
-      notes: `${RUN_ID} subject visible note`,
-      createdAt: new Date('2026-06-25T03:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:30:00.000Z'),
-    },
-    {
-      id: otherUserNoteId,
-      missionId: subjectMissionId,
-      userId: otherUserId,
-      notes: `${RUN_ID} other user note on subject mission`,
-      createdAt: new Date('2026-06-25T04:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:30:00.000Z'),
-    },
-  ]);
-
-  await db.insert(federationPeers).values([
-    {
-      id: peerId,
-      commonName: `${RUN_ID}-active-peer`,
-      displayName: `${RUN_ID} Active Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: CERT_SERIAL_HEX,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-    {
-      id: revokedPeerId,
-      commonName: `${RUN_ID}-revoked-peer`,
-      displayName: `${RUN_ID} Revoked Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `${CERT_SERIAL_HEX}${RUN_ID.replace(/-/g, '').slice(0, 8).toUpperCase()}`,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-  ]);
-
-  await db.insert(federationGrants).values([
-    {
-      id: activeGrantId,
-      peerId,
-      subjectUserId,
-      status: 'active',
-      scope: {
-        resources: ['tasks', 'notes'],
-        excluded_resources: [],
-        filters: {
-          tasks: { include_personal: true, include_teams: [] },
-          notes: { include_personal: true, include_teams: [] },
-        },
-        max_rows_per_query: 2,
-      },
-    },
-    {
-      id: revokedGrantId,
-      peerId,
-      subjectUserId,
-      status: 'revoked',
-      revokedAt: new Date(),
-      revokedReason: `${RUN_ID} revoked grant fixture`,
-      scope: {
-        resources: ['tasks'],
-        excluded_resources: [],
-        max_rows_per_query: 2,
-      },
-    },
-  ]);
-
-  return {
-    subjectUserId,
-    otherUserId,
-    peerId,
-    revokedPeerId,
-    activeGrantId,
-    revokedGrantId,
-    subjectProjectId,
-    subjectMissionId,
-    otherProjectId,
-    teamId,
-    unauthorizedTeamId,
-    teamProjectId,
-    taskIds,
-    excludedTaskIds,
-    subjectNoteId,
-    otherUserNoteId,
-  };
-}
-
-async function cleanupFixtures(db: Db, ids: TestIds | undefined): Promise<void> {
-  if (!ids) {
-    return;
-  }
-
-  await db
-    .delete(missionTasks)
-    .where(inArray(missionTasks.id, [ids.subjectNoteId, ids.otherUserNoteId]))
-    .catch(() => {});
-  await db
-    .delete(tasks)
-    .where(inArray(tasks.id, [...ids.taskIds, ...ids.excludedTaskIds]))
-    .catch(() => {});
-  await db
-    .delete(missions)
-    .where(eq(missions.id, ids.subjectMissionId))
-    .catch(() => {});
-  await db
-    .delete(projects)
-    .where(inArray(projects.id, [ids.subjectProjectId, ids.otherProjectId, ids.teamProjectId]))
-    .catch(() => {});
-  await db
-    .delete(teamMembers)
-    .where(
-      and(
-        eq(teamMembers.userId, ids.subjectUserId),
-        inArray(teamMembers.teamId, [ids.teamId, ids.unauthorizedTeamId]),
-      ),
-    )
-    .catch(() => {});
-  await db
-    .delete(teams)
-    .where(inArray(teams.id, [ids.teamId, ids.unauthorizedTeamId]))
-    .catch(() => {});
-  await db
-    .delete(federationGrants)
-    .where(inArray(federationGrants.id, [ids.activeGrantId, ids.revokedGrantId]))
-    .catch(() => {});
-  await db
-    .delete(federationPeers)
-    .where(inArray(federationPeers.id, [ids.peerId, ids.revokedPeerId]))
-    .catch(() => {});
-  await db
-    .delete(users)
-    .where(inArray(users.id, [ids.subjectUserId, ids.otherUserId]))
-    .catch(() => {});
-}
-
-describe.skipIf(!run)('federation M3 list verb — single-gateway integration', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let moduleRef: TestingModule;
-  let guard: FederationAuthGuard;
-  let listController: ListController;
-  let ids: TestIds | undefined;
-
-  beforeAll(async () => {
-    handle = createDb(PG_URL);
-    db = handle.db;
-    ids = await seedFixtures(db);
-
-    moduleRef = await Test.createTestingModule({
-      controllers: [ListController],
-      providers: [
-        { provide: DB, useValue: db },
-        GrantsService,
-        FederationAuthGuard,
-        FederationScopeService,
-        FederationListQueryService,
-      ],
-    }).compile();
-
-    guard = moduleRef.get(FederationAuthGuard);
-    listController = moduleRef.get(ListController);
-  }, 30_000);
-
-  afterAll(async () => {
-    await moduleRef?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await cleanupFixtures(db, ids).catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await handle?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-  });
-
-  it('#6 — rejects a client cert with malformed/missing Mosaic OIDs with 401', async () => {
-    const malformedOidCert = await makeSelfSignedCert();
-    const request = makeFederationRequest(malformedOidCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(401);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'unauthorized',
-        message: expect.stringContaining('missing required OID'),
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#6 — rejects a valid client cert when its grant is revoked with 403', async () => {
-    expect(ids).toBeDefined();
-    const revokedCert = await makeMosaicIssuedCert({
-      grantId: ids!.revokedGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(revokedCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(403);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'forbidden',
-        message: 'Federation access denied',
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#7 — enforces max_rows_per_query on POST /api/federation/v1/list/:resource', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('tasks', request, { limit: 100 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(response.items).toHaveLength(2);
-    expect(response._truncated).toBe(true);
-    expect(response.nextCursor).toEqual(expect.any(String));
-    expect(returnedIds).toEqual([ids!.taskIds[0], ids!.taskIds[1]]);
-    expect(returnedIds).not.toContain(ids!.taskIds[2]);
-    for (const excludedId of ids!.excludedTaskIds) {
-      expect(returnedIds).not.toContain(excludedId);
-    }
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('excludes another user mission task notes on the same authorized mission', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('notes', request, { limit: 10 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(returnedIds).toEqual([ids!.subjectNoteId]);
-    expect(returnedIds).not.toContain(ids!.otherUserNoteId);
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('fails closed for unsupported list resources', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    await expect(listController.list('widgets', request, {})).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is not supported',
-        },
-      },
-      status: 403,
-    });
-  });
-});

apps/gateway/src/admin/admin-health.controller.ts

@@ -1,11 +1,9 @@
-import { Controller, Get, Inject, Optional, UseGuards } from '@nestjs/common';
+import { Controller, Get, Inject, UseGuards } from '@nestjs/common';
 import { sql, type Db } from '@mosaicstack/db';
 import { createQueue } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { DB } from '../database/database.module.js';
 import { AgentService } from '../agent/agent.service.js';
 import { ProviderService } from '../agent/provider.service.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { AdminGuard } from './admin.guard.js';
 import type { HealthStatusDto, ServiceStatusDto } from './admin.dto.js';
 
@@ -16,9 +14,6 @@ export class AdminHealthController {
     @Inject(DB) private readonly db: Db,
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(ProviderService) private readonly providerService: ProviderService,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
   ) {}
 
   @Get()
@@ -60,14 +55,6 @@ export class AdminHealthController {
   }
 
   private async checkCache(): Promise<ServiceStatusDto> {
-    // On Local tier there is no Redis. The cache is intentionally absent, which
-    // is a healthy state for this tier — report 'ok' rather than opening a new
-    // ioredis connection on every admin health check (which would spam
-    // ECONNREFUSED and create/destroy a connection per request). latencyMs 0
-    // signals "no cache backend to measure" for this tier.
-    if (this.mosaicConfig?.queue?.type === 'local') {
-      return { status: 'ok', latencyMs: 0 };
-    }
     const start = Date.now();
     const handle = createQueue();
     try {

apps/gateway/src/app.module.spec.ts

@@ -1,624 +0,0 @@
-import 'reflect-metadata';
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
-import * as nodeOs from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import * as nodeUrl from 'node:url';
-import { MODULE_METADATA } from '@nestjs/common/constants.js';
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-
-interface ComposedModuleGraph {
-  imports: readonly unknown[];
-  federationModule: unknown;
-  bootLogLines: readonly string[];
-  mosaicConfig: MosaicConfig;
-  resolvedConfigPath: string;
-}
-
-type StorageTier = 'local' | 'standalone' | 'federated';
-
-interface ModuleGraphFixture {
-  tempRoot: string;
-  anchor: string;
-  homePath: string;
-  cwdPath: string;
-  monorepoRootEnvPath: string;
-  gatewayLocalEnvPath: string;
-  daemonEnvPath: string;
-  monorepoRootConfigPath: string;
-  gatewayLocalConfigPath: string;
-}
-
-interface ModuleGraphFixtureOptions {
-  rootEnvMode?: 'present' | 'absent';
-  rootTier?: StorageTier;
-  rootEnvContents?: string;
-  redactionMarker?: string;
-  gatewayLocalTier?: StorageTier;
-  gatewayLocalEnvContents?: string;
-  daemonEnvContents?: string;
-  inheritedTier?: StorageTier;
-  expectedProcessTier?: string;
-  setup?: (fixture: ModuleGraphFixture) => Promise<void>;
-}
-
-// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
-const MODULE_IMPORT_TIMEOUT_MS = 120_000;
-const MONOREPO_ROOT_DOTENV_LABEL = 'monorepo-root .env';
-const DAEMON_DOTENV_LABEL = 'daemon .env';
-
-function configJson(tier: StorageTier): string {
-  if (tier === 'local') {
-    return JSON.stringify({
-      tier,
-      storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
-      queue: { type: 'local', dataDir: '.mosaic/queue' },
-      memory: { type: 'keyword' },
-    });
-  }
-
-  return JSON.stringify({
-    tier,
-    storage: { type: 'postgres', url: 'postgresql://fixture.invalid/mosaic' },
-    queue: { type: 'bullmq' },
-    memory: { type: tier === 'federated' ? 'pgvector' : 'keyword' },
-  });
-}
-
-function snapshotProcessEnv(): Record<string, string | undefined> {
-  return { ...process.env };
-}
-
-function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
-  for (const key of Object.keys(process.env)) {
-    if (!(key in snapshot)) {
-      delete process.env[key];
-    }
-  }
-
-  for (const [key, value] of Object.entries(snapshot)) {
-    if (value === undefined) {
-      delete process.env[key];
-      continue;
-    }
-
-    process.env[key] = value;
-  }
-}
-
-function expectPathUnderTempRoot(path: string, tempRoot: string): void {
-  const relativePath = relative(tempRoot, path);
-  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
-    true,
-  );
-}
-
-async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
-  expectPathUnderTempRoot(path, tempRoot);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, contents, 'utf8');
-}
-
-interface ConfigModuleProvider {
-  provide: string;
-  useFactory: () => MosaicConfig;
-}
-
-function isConfigModuleProvider(value: unknown): value is ConfigModuleProvider {
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-
-  if (!('provide' in value) || typeof value.provide !== 'string') {
-    return false;
-  }
-
-  return 'useFactory' in value && typeof value.useFactory === 'function';
-}
-
-function singleBootLogLine(bootLogLines: readonly string[]): string {
-  expect(bootLogLines).toHaveLength(1);
-  const [bootLogLine] = bootLogLines;
-  if (bootLogLine === undefined) {
-    throw new Error('Expected a single boot log line');
-  }
-
-  return bootLogLine;
-}
-
-function expectBootLogLine(
-  bootLogLines: readonly string[],
-  tier: StorageTier,
-  source: string,
-): void {
-  const bootLogLine = singleBootLogLine(bootLogLines);
-
-  expect(bootLogLine).toContain(`storage tier=${tier}`);
-  expect(bootLogLine).toContain(`source=${source}`);
-}
-
-async function loadModuleGraphFromDotenv(
-  options: ModuleGraphFixtureOptions,
-): Promise<ComposedModuleGraph> {
-  const originalEnv = snapshotProcessEnv();
-  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-module-'));
-  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
-
-  try {
-    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
-    const homePath = join(tempRoot, 'home');
-    const cwdPath = join(tempRoot, 'ambient', 'parent', 'cwd');
-    const fixture: ModuleGraphFixture = {
-      tempRoot,
-      anchor,
-      homePath,
-      cwdPath,
-      monorepoRootEnvPath: resolve(anchor, '../../..', '.env'),
-      gatewayLocalEnvPath: resolve(anchor, '..', '.env'),
-      daemonEnvPath: join(homePath, '.config', 'mosaic', 'gateway', '.env'),
-      monorepoRootConfigPath: resolve(anchor, '../../..', 'mosaic.config.json'),
-      gatewayLocalConfigPath: resolve(anchor, '..', 'mosaic.config.json'),
-    };
-    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
-
-    for (const path of Object.values(fixture)) {
-      expectPathUnderTempRoot(path, tempRoot);
-    }
-
-    await mkdir(anchor, { recursive: true });
-    await mkdir(cwdPath, { recursive: true });
-
-    if ((options.rootEnvMode ?? 'present') === 'absent') {
-      if (
-        options.rootEnvContents !== undefined ||
-        options.rootTier !== undefined ||
-        options.redactionMarker !== undefined
-      ) {
-        throw new Error('Expected no root env fixture values when rootEnvMode is absent');
-      }
-    } else {
-      if (options.rootEnvContents === undefined && options.rootTier === undefined) {
-        throw new Error('Expected rootTier or rootEnvContents');
-      }
-
-      const rootFixture = options.rootEnvContents ?? `MOSAIC_STORAGE_TIER=${options.rootTier}\n`;
-      const rootFixtureWithMarker = options.redactionMarker
-        ? `${rootFixture}BETTER_AUTH_SECRET=${options.redactionMarker}\n`
-        : rootFixture;
-      await writeFixture(fixture.monorepoRootEnvPath, rootFixtureWithMarker, tempRoot);
-    }
-
-    if (options.daemonEnvContents !== undefined) {
-      await writeFixture(fixture.daemonEnvPath, options.daemonEnvContents, tempRoot);
-    }
-
-    if (options.gatewayLocalEnvContents !== undefined) {
-      await writeFixture(fixture.gatewayLocalEnvPath, options.gatewayLocalEnvContents, tempRoot);
-    } else if (options.gatewayLocalTier !== undefined) {
-      await writeFixture(
-        fixture.gatewayLocalEnvPath,
-        `MOSAIC_STORAGE_TIER=${options.gatewayLocalTier}\n`,
-        tempRoot,
-      );
-    }
-
-    process.env['HOME'] = homePath;
-    delete process.env['MOSAIC_STORAGE_TIER'];
-    delete process.env['DATABASE_URL'];
-    delete process.env['VALKEY_URL'];
-    delete process.env['MOSAIC_GATEWAY_HOME'];
-
-    await options.setup?.(fixture);
-
-    if (options.inheritedTier !== undefined) {
-      process.env['MOSAIC_STORAGE_TIER'] = options.inheritedTier;
-    }
-
-    vi.resetModules();
-    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
-    vi.doMock('node:url', () => ({
-      ...nodeUrl,
-      fileURLToPath: (url: string | URL): string => {
-        const actualPath = nodeUrl.fileURLToPath(url);
-        if (
-          actualPath.endsWith('/apps/gateway/src/env.ts') ||
-          actualPath.endsWith('/apps/gateway/src/env.js')
-        ) {
-          return join(anchor, 'env.ts');
-        }
-        return actualPath;
-      },
-    }));
-    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
-
-    if (options.inheritedTier === undefined) {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBeUndefined();
-    } else {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBe(options.inheritedTier);
-    }
-
-    const envModule = await import('./env.js');
-    expect(process.env['MOSAIC_STORAGE_TIER']).toBe(
-      options.expectedProcessTier ?? options.rootTier,
-    );
-
-    const { AppModule } = await import('./app.module.js');
-    const { FederationModule } = await import('./federation/federation.module.js');
-    const imports: unknown = Reflect.getMetadata(MODULE_METADATA.IMPORTS, AppModule);
-
-    if (!Array.isArray(imports)) {
-      throw new Error('AppModule imports metadata is not an array');
-    }
-
-    const { ConfigModule, MOSAIC_CONFIG } = await import('./config/config.module.js');
-    const providers: unknown = Reflect.getMetadata(MODULE_METADATA.PROVIDERS, ConfigModule);
-
-    if (!Array.isArray(providers)) {
-      throw new Error('ConfigModule providers metadata is not an array');
-    }
-
-    const configProvider = providers
-      .filter(isConfigModuleProvider)
-      .find((provider: ConfigModuleProvider): boolean => provider.provide === MOSAIC_CONFIG);
-
-    if (!configProvider) {
-      throw new Error('MOSAIC_CONFIG provider factory not found');
-    }
-
-    return {
-      imports,
-      federationModule: FederationModule,
-      bootLogLines: consoleInfoSpy.mock.calls.map((args: readonly unknown[]): string =>
-        args.map((value: unknown): string => String(value)).join(' '),
-      ),
-      mosaicConfig: configProvider.useFactory(),
-      resolvedConfigPath: envModule.resolveGatewayConfigPath(),
-    };
-  } finally {
-    cwdSpy?.mockRestore();
-    vi.doUnmock('node:url');
-    vi.doUnmock('node:os');
-    vi.resetModules();
-    consoleInfoSpy?.mockRestore();
-    restoreProcessEnv(originalEnv);
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-}
-
-describe('AppModule federation gating', (): void => {
-  it('loads dotenv before tracing and AppModule evaluation', async (): Promise<void> => {
-    const mainSource = await readFile(new URL('./main.ts', import.meta.url), 'utf8');
-    const envImportIndex = mainSource.indexOf("import './env.js';");
-    const tracingImportIndex = mainSource.indexOf("import './tracing.js';");
-    const appModuleImportIndex = mainSource.indexOf("import { AppModule } from './app.module.js';");
-
-    expect(envImportIndex).toBeGreaterThan(-1);
-    expect(envImportIndex).toBeLessThan(tracingImportIndex);
-    expect(envImportIndex).toBeLessThan(appModuleImportIndex);
-  });
-
-  it(
-    'ignores ambient cwd/.env and cwd/../.env files',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-          await writeFixture(
-            resolve(fixture.cwdPath, '..', '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/../../mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            resolve(fixture.cwdPath, '../..', 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'anchored gateway-local config wins monorepo-root config and registers FederationModule',
-    async (): Promise<void> => {
-      let gatewayLocalConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          gatewayLocalConfigPath = fixture.gatewayLocalConfigPath;
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(gatewayLocalConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'resolves the daemon-installed GATEWAY_HOME/mosaic.config.json ahead of gateway-local and monorepo-root configs',
-    async (): Promise<void> => {
-      let daemonConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          const externalGatewayHome = join(fixture.tempRoot, 'external-gateway-home');
-          daemonConfigPath = join(externalGatewayHome, 'mosaic.config.json');
-          await writeFixture(daemonConfigPath, configJson('federated'), fixture.tempRoot);
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('standalone'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-          process.env['MOSAIC_GATEWAY_HOME'] = externalGatewayHome;
-          process.env['DATABASE_URL'] = 'postgresql://fixture.invalid/mosaic';
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(daemonConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs mosaic.config.json when anchored config and env tiers are both federated',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs standalone from a monorepo-root .env DATABASE_URL fallback',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'DATABASE_URL=fixture-database-url\n',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes an invalid monorepo-root dotenv tier to the default',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'MOSAIC_STORAGE_TIER=invalid\n',
-        expectedProcessTier: 'invalid',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', 'default');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes DATABASE_URL fallback to daemon .env ahead of inherited local tier',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        daemonEnvContents: 'DATABASE_URL=fixture-database-url\n',
-        inheritedTier: 'local',
-        expectedProcessTier: 'local',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'daemon .env wins over monorepo-root and gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=standalone\n',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'inherits process.env.MOSAIC_STORAGE_TIER over daemon, monorepo-root, and gateway-local dotenv values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=federated\n',
-        inheritedTier: 'standalone',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', 'process environment');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'gateway-local .env configures the tier and source when the monorepo-root .env is absent',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        gatewayLocalTier: 'federated',
-        expectedProcessTier: 'federated',
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'gateway-local .env');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'monorepo-root .env wins over gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'standalone',
-        gatewayLocalTier: 'federated',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it.each(['local', 'standalone'] as const)(
-    'does not register FederationModule for the %s tier',
-    async (tier): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({ rootTier: tier });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, tier, MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'registers FederationModule when federated tier is supplied by the anchored monorepo root .env',
-    async (): Promise<void> => {
-      const redactionMarker = 'redaction-fixture-marker';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        redactionMarker,
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', MONOREPO_ROOT_DOTENV_LABEL);
-      expect(singleBootLogLine(graph.bootLogLines)).not.toContain(redactionMarker);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider ignores an ambient cwd/mosaic.config.json config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            JSON.stringify({
-              tier: 'federated',
-              storage: {
-                type: 'postgres',
-                url: 'postgresql://ambient-attacker.invalid/mosaic',
-                enableVector: true,
-              },
-              queue: { type: 'bullmq' },
-              memory: { type: 'pgvector' },
-            }),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('local');
-      expect(graph.mosaicConfig.storage).not.toEqual(
-        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider resolves from the anchored monorepo-root mosaic.config.json',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.mosaicConfig.storage).toEqual(
-        expect.objectContaining({ url: 'postgresql://fixture.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-});

apps/gateway/src/app.module.ts

@@ -26,16 +26,6 @@ import { WorkspaceModule } from './workspace/workspace.module.js';
 import { QueueModule } from './queue/queue.module.js';
 import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
-import { loadConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from './env.js';
-
-// Federation (step-ca client, enrollment, federation verbs) is only wired for
-// tier 'federated' — CaService hard-requires STEP_CA_* at construction, which
-// must not gate standalone/local boots (docker-compose.federated.yml: the
-// federation profile "must not start in non-federated dev"). The gateway
-// entrypoint loads env.ts before evaluating this module so dotenv-backed tier
-// configuration is visible here.
-const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'federated';
 
 @Module({
   imports: [
@@ -63,7 +53,7 @@ const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'feder
     QueueModule,
     ReloadModule,
     WorkspaceModule,
-    ...(federationEnabled ? [FederationModule] : []),
+    FederationModule,
   ],
   controllers: [HealthController],
   providers: [

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -72,13 +72,13 @@ const mockChatGateway = {
   broadcastSessionInfo: vi.fn(),
 };
 
-function buildService(redis: typeof mockRedis | null = mockRedis): CommandExecutorService {
+function buildService(): CommandExecutorService {
   return new CommandExecutorService(
     mockRegistry as never,
     mockAgentService as never,
     mockSystemOverride as never,
     mockSessionGC as never,
-    redis as never,
+    mockRedis as never,
     mockBrain as never,
     null,
     mockChatGateway as never,
@@ -131,22 +131,6 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(ttl).toBe(300);
   });
 
-  it('/provider login remains available without Redis on the local tier', async () => {
-    const localService = buildService(null);
-    const payload: SlashCommandPayload = {
-      command: 'provider',
-      args: 'login anthropic',
-      conversationId,
-    };
-
-    const result = await localService.execute(payload, userScope);
-
-    expect(result.success).toBe(true);
-    expect(result.message).not.toContain('token=');
-    expect(result.data).toEqual({ provider: 'anthropic' });
-    expect(mockRedis.set).not.toHaveBeenCalled();
-  });
-
   // /provider with no args — returns usage
   it('/provider with no args returns usage message', async () => {
     const payload: SlashCommandPayload = { command: 'provider', conversationId };

apps/gateway/src/commands/command-executor.service.ts

@@ -23,10 +23,7 @@ export class CommandExecutorService {
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(SystemOverrideService) private readonly systemOverride: SystemOverrideService,
     @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
-    // On Local tier COMMANDS_REDIS is null — provider login caching is skipped.
-    @Optional()
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(COMMANDS_REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(BRAIN) private readonly brain: Brain,
     @Optional()
     @Inject(forwardRef(() => ReloadService))
@@ -446,16 +443,14 @@ export class CommandExecutorService {
           byte.toString(16).padStart(2, '0'),
         ).join('');
         const key = `mosaic:auth:poll:${tokenHash}`;
-        if (this.redis) {
-          // Persist only a short-lived token digest. The raw token is delivered only by
-          // the authenticated dashboard flow, never in chat output or command metadata.
-          await this.redis.set(
-            key,
-            JSON.stringify({ status: 'pending', provider: providerName, userId }),
-            'EX',
-            300,
-          );
-        }
+        // Persist only a short-lived token digest. The raw token is delivered only by
+        // the authenticated dashboard flow, never in chat output or command metadata.
+        await this.redis.set(
+          key,
+          JSON.stringify({ status: 'pending', provider: providerName, userId }),
+          'EX',
+          300,
+        );
         return {
           command: 'provider',
           success: true,

apps/gateway/src/commands/commands.module.ts

@@ -1,7 +1,5 @@
-import { forwardRef, Inject, Module, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { forwardRef, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
@@ -18,17 +16,13 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
   providers: [
     {
       provide: COMMANDS_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection.
-        // CommandExecutorService falls back to no-cache for /provider login on local.
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: COMMANDS_REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
@@ -44,13 +38,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
   ],
 })
 export class CommandsModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(COMMANDS_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/config/config.module.ts

@@ -1,6 +1,5 @@
 import { Global, Module } from '@nestjs/common';
 import { loadConfig, type MosaicConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from '../env.js';
 
 export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
 
@@ -9,7 +8,7 @@ export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
   providers: [
     {
       provide: MOSAIC_CONFIG,
-      useFactory: (): MosaicConfig => loadConfig(resolveGatewayConfigPath()),
+      useFactory: (): MosaicConfig => loadConfig(),
     },
   ],
   exports: [MOSAIC_CONFIG],

apps/gateway/src/env.ts

@@ -1,133 +0,0 @@
-import { config } from 'dotenv';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { detectFromEnv, loadConfig } from '@mosaicstack/config';
-
-type TierSource =
-  | 'process environment'
-  | 'daemon .env'
-  | 'monorepo-root .env'
-  | 'gateway-local .env'
-  | 'default';
-
-type BootSource = TierSource | 'mosaic.config.json';
-
-export interface GatewayDotenvPaths {
-  daemonEnv: string;
-  monorepoRootEnv: string;
-  gatewayLocalEnv: string;
-}
-
-const here = dirname(fileURLToPath(import.meta.url));
-
-export function resolveGatewayDotenvPaths(
-  anchor: string = here,
-  homeBase: string = homedir(),
-): GatewayDotenvPaths {
-  return {
-    daemonEnv: join(homeBase, '.config', 'mosaic', 'gateway', '.env'),
-    monorepoRootEnv: resolve(anchor, '../../..', '.env'),
-    gatewayLocalEnv: resolve(anchor, '..', '.env'),
-  };
-}
-
-export function resolveGatewayConfigPath(anchor: string = here): string {
-  // GATEWAY_HOME is daemon-created 0700; its env override adds no authority because env can set MOSAIC_STORAGE_TIER.
-  const gatewayHome = resolve(
-    process.env['MOSAIC_GATEWAY_HOME'] ?? join(homedir(), '.config', 'mosaic', 'gateway'),
-  );
-  const daemonConfig = join(gatewayHome, 'mosaic.config.json');
-  const gatewayLocalConfig = resolve(anchor, '..', 'mosaic.config.json');
-  const monorepoRootConfig = resolve(anchor, '../../..', 'mosaic.config.json');
-
-  if (existsSync(daemonConfig)) {
-    return daemonConfig;
-  }
-  if (existsSync(gatewayLocalConfig)) {
-    return gatewayLocalConfig;
-  }
-  if (existsSync(monorepoRootConfig)) {
-    return monorepoRootConfig;
-  }
-
-  return monorepoRootConfig;
-}
-
-export function loadGatewayEnv(anchor: string = here, homeBase: string = homedir()): void {
-  const { daemonEnv, monorepoRootEnv, gatewayLocalEnv } = resolveGatewayDotenvPaths(
-    anchor,
-    homeBase,
-  );
-  const inheritedTier = process.env['MOSAIC_STORAGE_TIER'];
-  let tierSource: TierSource = inheritedTier === undefined ? 'default' : 'process environment';
-  const inheritedDatabaseUrl = process.env['DATABASE_URL'];
-  let databaseUrlSource: TierSource =
-    inheritedDatabaseUrl === undefined ? 'default' : 'process environment';
-
-  function loadAnchoredDotenv(
-    path: string,
-    sourceLabel: Exclude<TierSource, 'process environment' | 'default'>,
-  ): void {
-    if (!existsSync(path)) {
-      return;
-    }
-
-    const beforeTier = process.env['MOSAIC_STORAGE_TIER'];
-    const beforeDatabaseUrl = process.env['DATABASE_URL'];
-    config({ path, quiet: true });
-
-    if (
-      beforeTier === undefined &&
-      process.env['MOSAIC_STORAGE_TIER'] !== undefined &&
-      tierSource === 'default'
-    ) {
-      tierSource = sourceLabel;
-    }
-
-    if (
-      beforeDatabaseUrl === undefined &&
-      process.env['DATABASE_URL'] !== undefined &&
-      databaseUrlSource === 'default'
-    ) {
-      databaseUrlSource = sourceLabel;
-    }
-  }
-
-  // Load .env from daemon config dir (global install / daemon mode) first.
-  // It takes precedence over file-based local-dev configuration.
-  loadAnchoredDotenv(daemonEnv, 'daemon .env');
-
-  // Load .env from the anchored monorepo root, then fill any remaining values
-  // from apps/gateway/.env when present.
-  loadAnchoredDotenv(monorepoRootEnv, 'monorepo-root .env');
-  loadAnchoredDotenv(gatewayLocalEnv, 'gateway-local .env');
-
-  const envOnlyTier = detectFromEnv().tier;
-  const configPath = resolveGatewayConfigPath(anchor);
-  const anchoredConfigExists = existsSync(configPath);
-  const resolvedTier = loadConfig(configPath).tier;
-  const configuredTier = process.env['MOSAIC_STORAGE_TIER'];
-  const databaseUrlDeterminesTier = envOnlyTier === 'standalone' && configuredTier !== 'standalone';
-  const recognizedTierDeterminesTier =
-    (configuredTier === 'federated' ||
-      configuredTier === 'standalone' ||
-      configuredTier === 'local') &&
-    configuredTier === envOnlyTier;
-
-  let source: BootSource;
-  if (anchoredConfigExists) {
-    source = 'mosaic.config.json';
-  } else if (databaseUrlDeterminesTier && databaseUrlSource !== 'default') {
-    source = databaseUrlSource;
-  } else if (recognizedTierDeterminesTier && tierSource !== 'default') {
-    source = tierSource;
-  } else {
-    source = 'default';
-  }
-
-  console.info(`[gateway env] storage tier=${resolvedTier} source=${source}`);
-}
-
-loadGatewayEnv();

apps/gateway/src/federation/federation.module.ts

@@ -5,8 +5,6 @@ import { EnrollmentController } from './enrollment.controller.js';
 import { EnrollmentService } from './enrollment.service.js';
 import { FederationController } from './federation.controller.js';
 import { CapabilitiesController } from './server/verbs/capabilities.controller.js';
-import { GetController } from './server/verbs/get.controller.js';
-import { FederationGetQueryService } from './server/verbs/get-query.service.js';
 import { GrantsService } from './grants.service.js';
 import { FederationClientService, QuerySourceService } from './client/index.js';
 import { FederationAuthGuard, FederationScopeService } from './server/index.js';
@@ -14,13 +12,7 @@ import { ListController } from './server/verbs/list.controller.js';
 import { FederationListQueryService } from './server/verbs/list-query.service.js';
 
 @Module({
-  controllers: [
-    EnrollmentController,
-    FederationController,
-    CapabilitiesController,
-    ListController,
-    GetController,
-  ],
+  controllers: [EnrollmentController, FederationController, CapabilitiesController, ListController],
   providers: [
     AdminGuard,
     CaService,
@@ -31,7 +23,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
   exports: [
     CaService,
@@ -42,7 +33,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
 })
 export class FederationModule {}

apps/gateway/src/federation/server/verbs/__tests__/get-query.service.spec.ts

@@ -1,348 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-  createPgliteDb,
-  missionTasks,
-  missions,
-  projects,
-  runPgliteMigrations,
-  teams,
-  users,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { FederationScopeQueryFilter } from '../../scope.service.js';
-import { FederationGetQueryService } from '../get-query.service.js';
-
-const CREDENTIAL_FILTER: FederationScopeQueryFilter = {
-  resource: 'credentials',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: [],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-const SUBJECT_USER_ID = 'fed-m3-06-subject';
-const OTHER_USER_ID = 'fed-m3-06-other';
-const TEAM_ID = '06000000-0000-4000-8000-000000000001';
-const UNAUTHORIZED_TEAM_ID = '06000000-0000-4000-8000-000000000002';
-const PERSONAL_PROJECT_ID = '06000000-0000-4000-8000-000000000101';
-const TEAM_PROJECT_ID = '06000000-0000-4000-8000-000000000102';
-const UNAUTHORIZED_PROJECT_ID = '06000000-0000-4000-8000-000000000103';
-const PERSONAL_MISSION_ID = '06000000-0000-4000-8000-000000000201';
-const TEAM_MISSION_ID = '06000000-0000-4000-8000-000000000202';
-const UNAUTHORIZED_MISSION_ID = '06000000-0000-4000-8000-000000000203';
-const SUBJECT_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000301';
-const OTHER_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000302';
-const SUBJECT_PERSONAL_NOTE_ID = '06000000-0000-4000-8000-000000000303';
-const SUBJECT_UNAUTHORIZED_NOTE_ID = '06000000-0000-4000-8000-000000000304';
-
-let dbHandle: DbHandle | undefined;
-
-function makeService() {
-  return new FederationGetQueryService({} as Db);
-}
-
-function makeDbService() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-  return new FederationGetQueryService(dbHandle.db);
-}
-
-async function seedNotesFixture() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-
-  await dbHandle.db.insert(users).values([
-    {
-      id: SUBJECT_USER_ID,
-      name: 'Federation Subject',
-      email: `${SUBJECT_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-    {
-      id: OTHER_USER_ID,
-      name: 'Federation Other',
-      email: `${OTHER_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-  ]);
-
-  await dbHandle.db.insert(teams).values([
-    {
-      id: TEAM_ID,
-      name: 'FED-M3-06 Team',
-      slug: 'fed-m3-06-team',
-      ownerId: SUBJECT_USER_ID,
-      managerId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_TEAM_ID,
-      name: 'FED-M3-06 Unauthorized Team',
-      slug: 'fed-m3-06-unauthorized-team',
-      ownerId: OTHER_USER_ID,
-      managerId: OTHER_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(projects).values([
-    {
-      id: PERSONAL_PROJECT_ID,
-      name: 'FED-M3-06 Personal Project',
-      ownerId: SUBJECT_USER_ID,
-      ownerType: 'user',
-    },
-    {
-      id: TEAM_PROJECT_ID,
-      name: 'FED-M3-06 Team Project',
-      teamId: TEAM_ID,
-      ownerType: 'team',
-    },
-    {
-      id: UNAUTHORIZED_PROJECT_ID,
-      name: 'FED-M3-06 Unauthorized Project',
-      teamId: UNAUTHORIZED_TEAM_ID,
-      ownerType: 'team',
-    },
-  ]);
-
-  await dbHandle.db.insert(missions).values([
-    {
-      id: PERSONAL_MISSION_ID,
-      name: 'FED-M3-06 Personal Mission',
-      projectId: PERSONAL_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: TEAM_MISSION_ID,
-      name: 'FED-M3-06 Team Mission',
-      projectId: TEAM_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_MISSION_ID,
-      name: 'FED-M3-06 Unauthorized Mission',
-      projectId: UNAUTHORIZED_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(missionTasks).values([
-    {
-      id: SUBJECT_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on team mission',
-      createdAt: new Date('2026-06-24T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T03:00:00.000Z'),
-    },
-    {
-      id: OTHER_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: OTHER_USER_ID,
-      notes: 'other user note on team mission',
-      createdAt: new Date('2026-06-24T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T02:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_PERSONAL_NOTE_ID,
-      missionId: PERSONAL_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on personal mission',
-      createdAt: new Date('2026-06-24T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T01:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      missionId: UNAUTHORIZED_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note outside grant-visible missions',
-      createdAt: new Date('2026-06-24T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T04:00:00.000Z'),
-    },
-  ]);
-}
-
-describe('FederationGetQueryService', () => {
-  beforeAll(async () => {
-    dbHandle = createPgliteDb(`memory://fed-m3-06-get-${Date.now()}`);
-    await runPgliteMigrations(dbHandle);
-    await seedNotesFixture();
-  });
-
-  afterAll(async () => {
-    await dbHandle?.close();
-    dbHandle = undefined;
-  });
-
-  it('denies sensitive resources in native RBAC for M3 get reads', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'credentials',
-      }),
-    ).resolves.toMatchObject({
-      allowed: false,
-      reason: 'credentials federation get access is not implemented in M3',
-    });
-  });
-
-  it('allows personal memory reads without requiring team lookup', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'memory',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-  });
-
-  it('uses subject team membership as the native RBAC upper bound for task and note reads', async () => {
-    const service = makeService();
-    const listSubjectTeamIds = vi.fn().mockResolvedValue(['team-1', 'team-2']);
-    (
-      service as unknown as {
-        listSubjectTeamIds: (subjectUserId: string) => Promise<string[]>;
-      }
-    ).listSubjectTeamIds = listSubjectTeamIds;
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'tasks',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-    });
-    expect(listSubjectTeamIds).toHaveBeenCalledWith('user-1');
-  });
-
-  it('does not query storage for sensitive get resources even if scope allowed them', async () => {
-    const service = makeService();
-
-    await expect(service.get({ filter: CREDENTIAL_FILTER, id: 'cred-1' })).resolves.toEqual({
-      status: 'denied',
-      reason: 'credentials federation get is not implemented',
-    });
-  });
-
-  it('fails closed for unsupported resources instead of returning undefined', async () => {
-    const service = makeService();
-
-    await expect(
-      service.get({
-        filter: {
-          ...CREDENTIAL_FILTER,
-          resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-        },
-        id: 'row-1',
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Unsupported federation get resource: unknown-resource',
-    });
-  });
-
-  it('does not leak another user mission task note through team-scoped get reads', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: OTHER_TEAM_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('does not return subject notes from missions outside the grant-visible project set', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: true,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('returns a subject note only when subject ownership and authorized mission intersect', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_TEAM_NOTE_ID,
-      }),
-    ).resolves.toMatchObject({
-      status: 'found',
-      item: {
-        id: SUBJECT_TEAM_NOTE_ID,
-        missionId: TEAM_MISSION_ID,
-        content: 'subject note on team mission',
-      },
-    });
-  });
-
-  it('does not return subject personal notes when includePersonal is false', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_PERSONAL_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-});

apps/gateway/src/federation/server/verbs/__tests__/get.controller.spec.ts

@@ -1,207 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import type {
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from '../../scope.service.js';
-import { GetController } from '../get.controller.js';
-import type { FederationGetQueryResult } from '../get-query.service.js';
-
-const FEDERATION_CONTEXT = {
-  grantId: 'grant-1',
-  peerId: 'peer-1',
-  subjectUserId: 'user-1',
-  scope: { resources: ['tasks'], max_rows_per_query: 25 },
-};
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: ['team-1'],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-function makeRequest(): FastifyRequest {
-  return { federationContext: FEDERATION_CONTEXT } as unknown as FastifyRequest;
-}
-
-function allowedScope(
-  filter: FederationScopeQueryFilter = TASK_FILTER,
-): FederationScopeEvaluationResult {
-  return { allowed: true, filter };
-}
-
-function makeController(opts?: {
-  scopeResult?: FederationScopeEvaluationResult;
-  queryResult?: FederationGetQueryResult;
-}) {
-  const scope = {
-    evaluateAccess: vi.fn().mockResolvedValue(opts?.scopeResult ?? allowedScope()),
-  };
-  const query = {
-    evaluateReadAccess: vi.fn(),
-    get: vi.fn().mockResolvedValue(
-      opts?.queryResult ?? {
-        status: 'found',
-        item: {
-          id: 'task-1',
-          title: 'Federated task',
-          createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        },
-      },
-    ),
-  };
-
-  return {
-    controller: new GetController(scope as never, query as never),
-    scope,
-    query,
-  };
-}
-
-describe('GetController', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('declares POST /api/federation/v1/get/:resource/:id protected only by FederationAuthGuard', () => {
-    expect(Reflect.getMetadata('path', GetController)).toBe('api/federation/v1/get');
-    expect(Reflect.getMetadata('path', GetController.prototype.get)).toBe(':resource/:id');
-    expect(Reflect.getMetadata('method', GetController.prototype.get)).toBe(RequestMethod.POST);
-    expect(Reflect.getMetadata('__guards__', GetController)).toEqual([FederationAuthGuard]);
-  });
-
-  it('runs AuthGuard context through ScopeService and returns one local-source tagged row', async () => {
-    const { controller, scope, query } = makeController();
-
-    const response = await controller.get('tasks', 'task-1', makeRequest());
-
-    expect(scope.evaluateAccess).toHaveBeenCalledWith({
-      context: FEDERATION_CONTEXT,
-      resource: 'tasks',
-      requestedLimit: 1,
-      nativeRbac: query,
-    });
-    expect(query.get).toHaveBeenCalledWith({ filter: TASK_FILTER, id: 'task-1' });
-    expect(response).toEqual({
-      item: {
-        id: 'task-1',
-        title: 'Federated task',
-        createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        _source: 'local',
-      },
-    });
-  });
-
-  it('returns a federation error envelope when auth guard context is missing', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(
-      controller.get('tasks', 'task-1', {} as unknown as FastifyRequest),
-    ).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'unauthorized',
-          message: 'Federation context missing',
-        },
-      },
-      status: 401,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns a federation error envelope when scope evaluation denies access', async () => {
-    const { controller, query } = makeController({
-      scopeResult: {
-        allowed: false,
-        deny: {
-          code: 'resource_excluded',
-          stage: 'resource_exclusion',
-          statusCode: 403,
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-          grantId: 'grant-1',
-          peerId: 'peer-1',
-          subjectUserId: 'user-1',
-          resource: 'credentials',
-        },
-      },
-    });
-
-    await expect(controller.get('credentials', 'cred-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-        },
-      },
-      status: 403,
-    });
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns 404 when the scoped query layer cannot find the resource id', async () => {
-    const { controller } = makeController({ queryResult: { status: 'not_found' } });
-
-    await expect(controller.get('tasks', 'missing-task', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'not_found' } },
-      status: 404,
-    });
-  });
-
-  it('returns 403 when the resource exists outside the RBAC/scope intersection', async () => {
-    const { controller } = makeController({
-      queryResult: { status: 'denied', reason: 'Task is outside the federated scope' },
-    });
-
-    await expect(controller.get('tasks', 'task-2', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Task is outside the federated scope',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('fails closed when the query layer denies an unsupported resource', async () => {
-    const unsupportedFilter: FederationScopeQueryFilter = {
-      ...TASK_FILTER,
-      resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-    };
-    const { controller } = makeController({
-      scopeResult: allowedScope(unsupportedFilter),
-      queryResult: {
-        status: 'denied',
-        reason: 'Unsupported federation get resource: unknown-resource',
-      },
-    });
-
-    await expect(controller.get('unknown-resource', 'row-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Unsupported federation get resource: unknown-resource',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('rejects empty ids before evaluating scope', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(controller.get('tasks', '   ', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/federation/server/verbs/get-query.service.ts

@@ -1,311 +0,0 @@
-/**
- * Federation get query layer (FED-M3-06).
- *
- * Read-only DB adapter used by GetController after FederationAuthGuard and
- * FederationScopeService have established the subject user, allowed resource,
- * native-RBAC intersection, and row cap. Audit writes are intentionally
- * deferred to M4.
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  eq,
-  inArray,
-  insights,
-  or,
-  missionTasks,
-  missions,
-  preferences,
-  projects,
-  tasks,
-  teamMembers,
-  type Db,
-} from '@mosaicstack/db';
-import { DB } from '../../../database/database.module.js';
-import type {
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeQueryFilter,
-} from '../scope.service.js';
-
-export interface FederationGetQueryRequest {
-  readonly filter: FederationScopeQueryFilter;
-  readonly id: string;
-}
-
-export interface FederationGetQueryFoundResult<T extends object = Record<string, unknown>> {
-  readonly status: 'found';
-  readonly item: T;
-}
-
-export interface FederationGetQueryNotFoundResult {
-  readonly status: 'not_found';
-}
-
-export interface FederationGetQueryDeniedResult {
-  readonly status: 'denied';
-  readonly reason: string;
-}
-
-export type FederationGetQueryResult<T extends object = Record<string, unknown>> =
-  | FederationGetQueryFoundResult<T>
-  | FederationGetQueryNotFoundResult
-  | FederationGetQueryDeniedResult;
-
-type RowObject = Record<string, unknown>;
-
-function firstRow<T>(rows: T[]): T | undefined {
-  return rows[0];
-}
-
-function rowBelongsToAccessibleProjectOrMission(
-  row: { projectId?: string | null; missionId?: string | null },
-  projectIds: readonly string[],
-  missionIds: readonly string[],
-): boolean {
-  return (
-    (typeof row.projectId === 'string' && projectIds.includes(row.projectId)) ||
-    (typeof row.missionId === 'string' && missionIds.includes(row.missionId))
-  );
-}
-
-@Injectable()
-export class FederationGetQueryService implements FederationNativeRbacEvaluator {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async evaluateReadAccess(
-    request: FederationNativeRbacRequest,
-  ): Promise<FederationNativeRbacResult> {
-    if (request.resource === 'credentials' || request.resource === 'api_keys') {
-      return {
-        allowed: false,
-        reason: `${request.resource} federation get access is not implemented in M3`,
-        details: { resource: request.resource },
-      };
-    }
-
-    if (request.resource === 'memory') {
-      return { allowed: true, access: { includePersonal: true, teamIds: [] } };
-    }
-
-    const teamIds = await this.listSubjectTeamIds(request.subjectUserId);
-    return { allowed: true, access: { includePersonal: true, teamIds } };
-  }
-
-  async get<T extends RowObject = RowObject>(
-    request: FederationGetQueryRequest,
-  ): Promise<FederationGetQueryResult<T>> {
-    return this.getByResource(request.filter, request.id) as Promise<FederationGetQueryResult<T>>;
-  }
-
-  private async getByResource(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    switch (filter.resource) {
-      case 'tasks':
-        return this.getTask(filter, id);
-      case 'notes':
-        return this.getNote(filter, id);
-      case 'memory':
-        return this.getMemory(filter, id);
-      case 'credentials':
-      case 'api_keys':
-        return { status: 'denied', reason: `${filter.resource} federation get is not implemented` };
-      default:
-        return {
-          status: 'denied',
-          reason: `Unsupported federation get resource: ${String(filter.resource)}`,
-        };
-    }
-  }
-
-  private async listSubjectTeamIds(subjectUserId: string): Promise<string[]> {
-    const rows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, subjectUserId));
-
-    return rows.map((row) => row.teamId);
-  }
-
-  private async listAccessibleProjectIds(filter: FederationScopeQueryFilter): Promise<string[]> {
-    const clauses = [];
-    if (filter.includePersonal) {
-      clauses.push(and(eq(projects.ownerType, 'user'), eq(projects.ownerId, filter.subjectUserId)));
-    }
-    if (filter.teamIds.length > 0) {
-      // Project team ownership follows TeamsService.canAccessProject: team-owned
-      // rows are authorized through projects.teamId, while ownerId remains the
-      // user who created/bootstrapped the project.
-      clauses.push(
-        and(eq(projects.ownerType, 'team'), inArray(projects.teamId, [...filter.teamIds])),
-      );
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: projects.id })
-      .from(projects)
-      .where(clauses.length === 1 ? clauses[0] : or(...clauses));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listMissionIds(projectIds: readonly string[]): Promise<string[]> {
-    if (projectIds.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: missions.id })
-      .from(missions)
-      .where(inArray(missions.projectId, [...projectIds]));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async getTask(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: tasks.id,
-          title: tasks.title,
-          description: tasks.description,
-          status: tasks.status,
-          priority: tasks.priority,
-          projectId: tasks.projectId,
-          missionId: tasks.missionId,
-          assignee: tasks.assignee,
-          tags: tasks.tags,
-          dueDate: tasks.dueDate,
-          metadata: tasks.metadata,
-          createdAt: tasks.createdAt,
-          updatedAt: tasks.updatedAt,
-        })
-        .from(tasks)
-        .where(eq(tasks.id, id))
-        .limit(1),
-    );
-
-    if (!row) {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-    if (!rowBelongsToAccessibleProjectOrMission(row, projectIds, missionIds)) {
-      return { status: 'denied', reason: 'Task is outside the federated scope' };
-    }
-
-    return { status: 'found', item: row as RowObject };
-  }
-
-  private async getNote(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: missionTasks.id,
-          missionId: missionTasks.missionId,
-          taskId: missionTasks.taskId,
-          userId: missionTasks.userId,
-          status: missionTasks.status,
-          content: missionTasks.notes,
-          createdAt: missionTasks.createdAt,
-          updatedAt: missionTasks.updatedAt,
-        })
-        .from(missionTasks)
-        .where(eq(missionTasks.id, id))
-        .limit(1),
-    );
-
-    if (!row || row.content === null || row.content === '') {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-
-    // mission_tasks rows are user-scoped even when the mission belongs to a team.
-    // Scope-visible missions must intersect with subject ownership; team scope
-    // narrows mission IDs but never widens note reads to another user's rows.
-    if (row.userId !== filter.subjectUserId || !missionIds.includes(row.missionId)) {
-      return { status: 'denied', reason: 'Note is outside the federated scope' };
-    }
-
-    const item = { ...row } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-
-  private async getMemory(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const [insightRow, preferenceRow] = await Promise.all([
-      this.db
-        .select({
-          id: insights.id,
-          userId: insights.userId,
-          kind: insights.source,
-          content: insights.content,
-          category: insights.category,
-          relevanceScore: insights.relevanceScore,
-          metadata: insights.metadata,
-          createdAt: insights.createdAt,
-          updatedAt: insights.updatedAt,
-        })
-        .from(insights)
-        .where(eq(insights.id, id))
-        .limit(1)
-        .then(firstRow),
-      this.db
-        .select({
-          id: preferences.id,
-          userId: preferences.userId,
-          kind: preferences.category,
-          key: preferences.key,
-          value: preferences.value,
-          source: preferences.source,
-          mutable: preferences.mutable,
-          createdAt: preferences.createdAt,
-          updatedAt: preferences.updatedAt,
-        })
-        .from(preferences)
-        .where(eq(preferences.id, id))
-        .limit(1)
-        .then(firstRow),
-    ]);
-
-    const candidates = [insightRow, preferenceRow].filter(
-      (row): row is NonNullable<typeof row> => row !== undefined,
-    );
-    if (candidates.length === 0) {
-      return { status: 'not_found' };
-    }
-
-    if (!filter.includePersonal) {
-      return { status: 'denied', reason: 'Memory personal rows are outside the federated scope' };
-    }
-
-    const accessible = candidates.find((row) => row.userId === filter.subjectUserId);
-    if (!accessible) {
-      return { status: 'denied', reason: 'Memory row belongs to another subject user' };
-    }
-
-    const item = { ...accessible } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-}

apps/gateway/src/federation/server/verbs/get.controller.ts

@@ -1,100 +0,0 @@
-/**
- * Federation get verb (FED-M3-06).
- *
- * POST /api/federation/v1/get/:resource/:id
- *
- * Pipeline: FederationAuthGuard attaches the active grant context, then
- * FederationScopeService enforces grant scope + native RBAC intersection, then
- * the read-only query layer fetches one local row and tags it with `_source`.
- * Read audit-log writes are deferred to M4; this controller does not persist
- * request or response bodies.
- */
-
-import { Controller, HttpException, Inject, Param, Post, Req, UseGuards } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FederationInvalidRequestError,
-  FederationNotFoundError,
-  FederationScopeViolationError,
-  FederationUnauthorizedError,
-  SOURCE_LOCAL,
-  type FederationGetResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-import { FederationScopeService } from '../scope.service.js';
-import { FederationGetQueryService } from './get-query.service.js';
-
-type FederatedRow = Record<string, unknown> & SourceTag;
-
-function scopeDenyToHttpException(deny: {
-  readonly statusCode: 400 | 403;
-  readonly message: string;
-}): HttpException {
-  const ErrorClass =
-    deny.statusCode === 400 ? FederationInvalidRequestError : FederationScopeViolationError;
-  return new HttpException(new ErrorClass(deny.message, deny).toEnvelope(), deny.statusCode);
-}
-
-@Controller('api/federation/v1/get')
-@UseGuards(FederationAuthGuard)
-export class GetController {
-  constructor(
-    @Inject(FederationScopeService) private readonly scope: FederationScopeService,
-    @Inject(FederationGetQueryService) private readonly query: FederationGetQueryService,
-  ) {}
-
-  @Post(':resource/:id')
-  async get(
-    @Param('resource') resource: string,
-    @Param('id') id: string,
-    @Req() request: FastifyRequest,
-  ): Promise<FederationGetResponse<FederatedRow>> {
-    if (!request.federationContext) {
-      throw new HttpException(
-        new FederationUnauthorizedError('Federation context missing').toEnvelope(),
-        401,
-      );
-    }
-    if (id.trim().length === 0) {
-      throw new HttpException(
-        new FederationInvalidRequestError('Federation get id must not be empty').toEnvelope(),
-        400,
-      );
-    }
-
-    const scopeResult = await this.scope.evaluateAccess({
-      context: request.federationContext,
-      resource,
-      requestedLimit: 1,
-      nativeRbac: this.query,
-    });
-
-    if (!scopeResult.allowed) {
-      throw scopeDenyToHttpException(scopeResult.deny);
-    }
-
-    const result = await this.query.get({ filter: scopeResult.filter, id });
-    if (result.status === 'not_found') {
-      throw new HttpException(
-        new FederationNotFoundError('Requested federation resource was not found').toEnvelope(),
-        404,
-      );
-    }
-    if (result.status === 'denied') {
-      throw new HttpException(
-        new FederationScopeViolationError(result.reason, {
-          resource,
-          id,
-          grantId: request.federationContext.grantId,
-          peerId: request.federationContext.peerId,
-          subjectUserId: request.federationContext.subjectUserId,
-        }).toEnvelope(),
-        403,
-      );
-    }
-
-    return { item: { ...result.item, _source: SOURCE_LOCAL } };
-  }
-}

apps/gateway/src/gc/gc.module.ts

@@ -1,7 +1,5 @@
-import { Module, type OnApplicationShutdown, Inject, Optional } from '@nestjs/common';
+import { Module, type OnApplicationShutdown, Inject } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { SessionGCService } from './session-gc.service.js';
 import { REDIS } from './gc.tokens.js';
 
@@ -11,17 +9,13 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   providers: [
     {
       provide: GC_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection entirely.
-        // The Valkey GC sweep is a no-op on Local (no session keys stored there).
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [GC_QUEUE_HANDLE],
     },
     SessionGCService,
@@ -29,13 +23,9 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   exports: [SessionGCService],
 })
 export class GCModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(GC_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(GC_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -119,19 +119,6 @@ describe('SessionGCService', () => {
     ).resolves.toEqual({ allowed: true });
   });
 
-  it('collect() skips Valkey but still demotes only the requested session on local tier', async () => {
-    const localService = new SessionGCService(null, mockLogService as unknown as LogService);
-
-    const result = await localService.collect('local-session');
-
-    expect(result.sessionId).toBe('local-session');
-    expect(result.cleaned.valkeyKeys).toBeUndefined();
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
-      'local-session',
-      expect.any(Date),
-    );
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -21,10 +21,7 @@ function escapeRedisGlobLiteral(value: string): string {
 @Injectable()
 export class SessionGCService {
   constructor(
-    // Local tier has no Redis; lifecycle cleanup still demotes this session's logs.
-    @Optional()
-    @Inject(REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
@@ -32,10 +29,8 @@ export class SessionGCService {
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
    * duration, which can cause latency spikes under production key volumes.
-   * Returns an empty population on the Local tier where Redis is disabled.
    */
   private async scanKeys(pattern: string): Promise<string[]> {
-    if (!this.redis) return [];
     const collected: string[] = [];
     let cursor = '0';
     do {
@@ -52,14 +47,12 @@ export class SessionGCService {
   async collect(sessionId: string): Promise<GCResult> {
     const result: GCResult = { sessionId, cleaned: {} };
 
-    // 1. Valkey: delete all session-scoped keys (skipped on Local tier).
-    if (this.redis) {
-      const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
-      const valkeyKeys = await this.scanKeys(pattern);
-      if (valkeyKeys.length > 0) {
-        await this.redis.del(...valkeyKeys);
-        result.cleaned.valkeyKeys = valkeyKeys.length;
-      }
+    // 1. Valkey: delete all session-scoped keys
+    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
+    const valkeyKeys = await this.scanKeys(pattern);
+    if (valkeyKeys.length > 0) {
+      await this.redis.del(...valkeyKeys);
+      result.cleaned.valkeyKeys = valkeyKeys.length;
     }
 
     // 2. PG: demote hot-tier agent logs for this session only.

apps/gateway/src/log/cron.service.ts

@@ -18,7 +18,7 @@ import type { MosaicJobData } from '../queue/queue.service.js';
 @Injectable()
 export class CronService implements OnModuleInit, OnModuleDestroy {
   private readonly logger = new Logger(CronService.name);
-  private readonly registeredWorkers: Array<Worker<MosaicJobData>> = [];
+  private readonly registeredWorkers: Worker<MosaicJobData>[] = [];
 
   constructor(
     @Inject(SummarizationService) private readonly summarization: SummarizationService,
@@ -26,12 +26,6 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
   ) {}
 
   async onModuleInit(): Promise<void> {
-    // Local tier deliberately has no BullMQ consumers or repeatable jobs.
-    if (!this.queueService.isEnabled()) {
-      this.logger.log('CronService: BullMQ disabled on local tier — no jobs will be scheduled');
-      return;
-    }
-
     const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
     const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
 
@@ -45,7 +39,7 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     const summarizationWorker = this.queueService.registerWorker(QUEUE_SUMMARIZATION, async () => {
       await this.summarization.runSummarization();
     });
-    if (summarizationWorker) this.registeredWorkers.push(summarizationWorker);
+    this.registeredWorkers.push(summarizationWorker);
 
     // M6-005: Tier management repeatable job
     await this.queueService.addRepeatableJob(
@@ -57,7 +51,7 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     const tierWorker = this.queueService.registerWorker(QUEUE_TIER_MANAGEMENT, async () => {
       await this.summarization.runTierManagement();
     });
-    if (tierWorker) this.registeredWorkers.push(tierWorker);
+    this.registeredWorkers.push(tierWorker);
 
     // Retire any repeatable global GC schedule created by older deployments.
     // Session cleanup is now triggered only by an authorized session lifecycle operation.

apps/gateway/src/main.spec.ts

@@ -1,164 +0,0 @@
-import 'reflect-metadata';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import * as nodeOs from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import * as nodeUrl from 'node:url';
-import type { MosaicConfig } from '@mosaicstack/config';
-import type * as MosaicStorage from '@mosaicstack/storage';
-import { describe, expect, it, vi, type MockInstance } from 'vitest';
-
-// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
-const MODULE_IMPORT_TIMEOUT_MS = 120_000;
-
-function snapshotProcessEnv(): Record<string, string | undefined> {
-  return { ...process.env };
-}
-
-function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
-  for (const key of Object.keys(process.env)) {
-    if (!(key in snapshot)) {
-      delete process.env[key];
-    }
-  }
-
-  for (const [key, value] of Object.entries(snapshot)) {
-    if (value === undefined) {
-      delete process.env[key];
-      continue;
-    }
-
-    process.env[key] = value;
-  }
-}
-
-function expectPathUnderTempRoot(path: string, tempRoot: string): void {
-  const relativePath = relative(tempRoot, path);
-  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
-    true,
-  );
-}
-
-async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
-  expectPathUnderTempRoot(path, tempRoot);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, contents, 'utf8');
-}
-
-interface BootstrapPreflightResult {
-  capturedConfig: MosaicConfig | undefined;
-}
-
-async function runBootstrapPreflight(
-  anchoredConfigContents: string,
-  ambientConfigContents: string,
-): Promise<BootstrapPreflightResult> {
-  const originalEnv = snapshotProcessEnv();
-  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-main-preflight-'));
-  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let exitSpy: MockInstance<typeof process.exit> | undefined;
-  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let capturedConfig: MosaicConfig | undefined;
-
-  try {
-    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
-    const homePath = join(tempRoot, 'home');
-    const cwdPath = join(tempRoot, 'ambient', 'cwd');
-    const monorepoRootConfigPath = resolve(anchor, '../../..', 'mosaic.config.json');
-
-    await mkdir(anchor, { recursive: true });
-    await mkdir(cwdPath, { recursive: true });
-
-    await writeFixture(monorepoRootConfigPath, anchoredConfigContents, tempRoot);
-    await writeFixture(join(cwdPath, 'mosaic.config.json'), ambientConfigContents, tempRoot);
-
-    process.env['HOME'] = homePath;
-    process.env['BETTER_AUTH_SECRET'] = 'fixture-secret';
-    delete process.env['MOSAIC_STORAGE_TIER'];
-    delete process.env['DATABASE_URL'];
-    delete process.env['VALKEY_URL'];
-
-    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
-    const exitMock = vi.fn<typeof process.exit>();
-    exitSpy = vi.spyOn(process, 'exit').mockImplementation(exitMock);
-
-    vi.resetModules();
-    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
-    vi.doMock('node:url', () => ({
-      ...nodeUrl,
-      fileURLToPath: (url: string | URL): string => {
-        const actualPath = nodeUrl.fileURLToPath(url);
-        if (
-          actualPath.endsWith('/apps/gateway/src/env.ts') ||
-          actualPath.endsWith('/apps/gateway/src/env.js')
-        ) {
-          return join(anchor, 'env.ts');
-        }
-        return actualPath;
-      },
-    }));
-    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
-    vi.doMock('./tracing.js', () => ({}));
-
-    const preflightSentinel = new Error('preflight-capture-sentinel');
-    vi.doMock('@mosaicstack/storage', async () => {
-      const actual = await vi.importActual<typeof MosaicStorage>('@mosaicstack/storage');
-      return {
-        ...actual,
-        detectAndAssertTier: vi.fn((config: MosaicConfig): Promise<void> => {
-          capturedConfig = config;
-          throw preflightSentinel;
-        }),
-      };
-    });
-
-    await import('./main.js');
-    await vi.waitFor((): void => {
-      expect(exitSpy).toHaveBeenCalled();
-    });
-
-    return { capturedConfig };
-  } finally {
-    cwdSpy?.mockRestore();
-    exitSpy?.mockRestore();
-    consoleInfoSpy?.mockRestore();
-    vi.doUnmock('@mosaicstack/storage');
-    vi.doUnmock('./tracing.js');
-    vi.doUnmock('node:url');
-    vi.doUnmock('node:os');
-    vi.resetModules();
-    restoreProcessEnv(originalEnv);
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-}
-
-describe('main bootstrap preflight config anchoring', (): void => {
-  it(
-    'passes the anchored monorepo-root config to detectAndAssertTier, not an ambient cwd config',
-    async (): Promise<void> => {
-      const anchoredConfig = JSON.stringify({
-        tier: 'local',
-        storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
-        queue: { type: 'local', dataDir: '.mosaic/queue' },
-        memory: { type: 'keyword' },
-      });
-      const ambientConfig = JSON.stringify({
-        tier: 'federated',
-        storage: {
-          type: 'postgres',
-          url: 'postgresql://ambient-attacker.invalid/mosaic',
-          enableVector: true,
-        },
-        queue: { type: 'bullmq' },
-        memory: { type: 'pgvector' },
-      });
-
-      const { capturedConfig } = await runBootstrapPreflight(anchoredConfig, ambientConfig);
-
-      expect(capturedConfig?.tier).toBe('local');
-      expect(capturedConfig?.storage).not.toEqual(
-        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-});

apps/gateway/src/main.ts

@@ -1,5 +1,18 @@
 #!/usr/bin/env node
-import './env.js';
+import { config } from 'dotenv';
+import { existsSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+
+// Load .env from daemon config dir (global install / daemon mode).
+// Loaded first so monorepo .env can override for local dev.
+const daemonEnv = join(homedir(), '.config', 'mosaic', 'gateway', '.env');
+if (existsSync(daemonEnv)) config({ path: daemonEnv });
+
+// Load .env from monorepo root (cwd is apps/gateway when run via pnpm filter)
+config({ path: resolve(process.cwd(), '../../.env') });
+config(); // Also load apps/gateway/.env if present (overrides)
+
 import './tracing.js';
 import 'reflect-metadata';
 import { NestFactory } from '@nestjs/core';
@@ -13,7 +26,6 @@ import { mountAuthHandler } from './auth/auth.controller.js';
 import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
 import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';
-import { resolveGatewayConfigPath } from './env.js';
 
 async function bootstrap(): Promise<void> {
   const logger = new Logger('Bootstrap');
@@ -25,7 +37,7 @@ async function bootstrap(): Promise<void> {
   // Pre-flight: assert all external services required by the configured tier
   // are reachable. Runs before NestFactory.create() so failures are visible
   // immediately with actionable remediation hints.
-  const mosaicConfig = loadConfig(resolveGatewayConfigPath());
+  const mosaicConfig = loadConfig();
   try {
     await detectAndAssertTier(mosaicConfig);
   } catch (err) {

apps/gateway/src/preferences/system-override.service.spec.ts

@@ -1,23 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { SystemOverrideService } from './system-override.service.js';
-
-const localConfig = { queue: { type: 'local' } } as MosaicConfig;
-
-describe('SystemOverrideService local tier', () => {
-  it('keeps ephemeral overrides isolated by tenant and user scope', async () => {
-    const service = new SystemOverrideService(localConfig);
-    const firstScope = { tenantId: 'tenant-a', userId: 'user-a' };
-    const secondScope = { tenantId: 'tenant-b', userId: 'user-b' };
-
-    await service.set('shared-session', 'first override', firstScope);
-    await service.set('shared-session', 'second override', secondScope);
-
-    await expect(service.get('shared-session', firstScope)).resolves.toBe('first override');
-    await expect(service.get('shared-session', secondScope)).resolves.toBe('second override');
-
-    await service.clear('shared-session', firstScope);
-    await expect(service.get('shared-session', firstScope)).resolves.toBeNull();
-    await expect(service.get('shared-session', secondScope)).resolves.toBe('second override');
-  });
-});

apps/gateway/src/preferences/system-override.service.ts

@@ -1,8 +1,6 @@
-import { Inject, Injectable, Logger, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import type { ActorTenantScope } from '../auth/session-scope.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 
 const scopedSessionId = (sessionId: string, scope: ActorTenantScope) =>
   `${scope.tenantId}:${scope.userId}:${sessionId}`;
@@ -17,45 +15,16 @@ interface OverrideFragment {
   addedAt: number;
 }
 
-interface LocalOverrideEntry {
-  condensed: string;
-  fragments: OverrideFragment[];
-}
-
 @Injectable()
-export class SystemOverrideService implements OnApplicationShutdown {
+export class SystemOverrideService {
   private readonly logger = new Logger(SystemOverrideService.name);
-  private readonly handle: QueueHandle | null;
-  /** Local-tier fallback, keyed by the same tenant/user/session scope as Redis. */
-  private readonly localStore = new Map<string, LocalOverrideEntry>();
+  private readonly handle: QueueHandle;
 
-  constructor(
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
-  ) {
-    this.handle = this.mosaicConfig?.queue?.type === 'local' ? null : createQueue();
-  }
-
-  async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+  constructor() {
+    this.handle = createQueue();
   }
 
   async set(sessionId: string, override: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) {
-      const key = scopedSessionId(sessionId, scope);
-      const entry = this.localStore.get(key) ?? { condensed: '', fragments: [] };
-      entry.fragments.push({ text: override, addedAt: Date.now() });
-      entry.condensed = await this.condenseOverrides(
-        entry.fragments.map((fragment) => fragment.text),
-      );
-      this.localStore.set(key, entry);
-      this.logger.debug(
-        `Set system override for session ${sessionId} (local, ${entry.fragments.length} fragment(s))`,
-      );
-      return;
-    }
-
     // Load existing fragments
     const existing = await this.handle.redis.get(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope));
     const fragments: OverrideFragment[] = existing
@@ -85,14 +54,10 @@ export class SystemOverrideService implements OnApplicationShutdown {
   }
 
   async get(sessionId: string, scope: ActorTenantScope): Promise<string | null> {
-    if (!this.handle) {
-      return this.localStore.get(scopedSessionId(sessionId, scope))?.condensed ?? null;
-    }
     return this.handle.redis.get(SESSION_SYSTEM_KEY(sessionId, scope));
   }
 
   async renew(sessionId: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) return;
     const pipeline = this.handle.redis.pipeline();
     pipeline.expire(SESSION_SYSTEM_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
     pipeline.expire(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
@@ -100,11 +65,6 @@ export class SystemOverrideService implements OnApplicationShutdown {
   }
 
   async clear(sessionId: string, scope: ActorTenantScope): Promise<void> {
-    if (!this.handle) {
-      this.localStore.delete(scopedSessionId(sessionId, scope));
-      this.logger.debug(`Cleared system override for session ${sessionId} (local)`);
-      return;
-    }
     await this.handle.redis.del(
       SESSION_SYSTEM_KEY(sessionId, scope),
       SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope),

apps/gateway/src/queue/queue.service.spec.ts

@@ -1,36 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { QueueService } from './queue.service.js';
-
-const localConfig = {
-  queue: { type: 'local' },
-} as MosaicConfig;
-
-describe('QueueService local tier', () => {
-  it('disables BullMQ and treats queue operations as local no-ops', async () => {
-    const service = new QueueService(null, localConfig);
-
-    expect(service.isEnabled()).toBe(false);
-    expect(service.getQueue('mosaic-test')).toBeNull();
-    expect(service.registerWorker('mosaic-test', vi.fn())).toBeNull();
-
-    await expect(
-      service.addRepeatableJob('mosaic-test', 'local-noop', {}, '* * * * *'),
-    ).resolves.toBeUndefined();
-    await expect(service.removeRepeatableJobs('mosaic-test', 'local-noop')).resolves.toBe(0);
-    await expect(service.getHealthStatus()).resolves.toEqual({ queues: {}, healthy: true });
-    await expect(service.listJobs()).resolves.toEqual([]);
-    await expect(service.retryJob('mosaic-test__1')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.pauseQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.resumeQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-  });
-});

apps/gateway/src/queue/queue.service.ts

@@ -8,9 +8,7 @@ import {
 } from '@nestjs/common';
 import { Queue, Worker, type Job, type ConnectionOptions } from 'bullmq';
 import type { LogService } from '@mosaicstack/log';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { LOG_SERVICE } from '../log/log.tokens.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import type { JobDto, JobStatus } from './queue-admin.dto.js';
 
 // ---------------------------------------------------------------------------
@@ -110,42 +108,21 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   private readonly connection: ConnectionOptions;
   private readonly queues = new Map<string, Queue<MosaicJobData>>();
   private readonly workers = new Map<string, Worker<MosaicJobData>>();
-  /** False on Local tier — BullMQ/Redis operations become no-ops. */
-  private readonly enabled: boolean;
 
   constructor(
     @Optional()
     @Inject(LOG_SERVICE)
     private readonly logService: LogService | null,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
   ) {
-    this.enabled = this.mosaicConfig?.queue?.type !== 'local';
-    this.connection = this.enabled
-      ? getConnection()
-      : ({ host: '127.0.0.1', port: 6380 } as ConnectionOptions);
-  }
-
-  /** Returns true when BullMQ/Redis is active (Standalone and Federated tiers). */
-  isEnabled(): boolean {
-    return this.enabled;
+    this.connection = getConnection();
   }
 
   onModuleInit(): void {
-    if (this.enabled) {
-      this.logger.log('QueueService initialised (BullMQ)');
-    } else {
-      this.logger.log(
-        'QueueService: BullMQ disabled for local tier — no Redis connections will be opened',
-      );
-    }
+    this.logger.log('QueueService initialised (BullMQ)');
   }
 
   async onModuleDestroy(): Promise<void> {
-    if (this.enabled) {
-      await this.closeAll();
-    }
+    await this.closeAll();
   }
 
   // -------------------------------------------------------------------------
@@ -154,10 +131,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
 
   /**
    * Get or create a BullMQ Queue for the given queue name.
-   * Returns null on Local tier where BullMQ is disabled.
    */
-  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> | null {
-    if (!this.enabled) return null;
+  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> {
     let queue = this.queues.get(name) as Queue<T> | undefined;
     if (!queue) {
       queue = new Queue<T>(name, { connection: this.connection });
@@ -169,7 +144,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * Add a BullMQ repeatable job (cron-style).
    * Uses `jobId` as a deterministic key so duplicate registrations are idempotent.
-   * No-op on Local tier.
    */
   async addRepeatableJob<T extends MosaicJobData>(
     queueName: string,
@@ -177,13 +151,7 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
     data: T,
     cronExpression: string,
   ): Promise<void> {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping repeatable job "${jobName}" on "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return;
-    }
-    const queue = this.getQueue<T>(queueName)!;
+    const queue = this.getQueue<T>(queueName);
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     await (queue as Queue<any>).add(jobName, data, {
       repeat: { pattern: cronExpression },
@@ -199,14 +167,7 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * safe retirement of previously registered system-wide jobs.
    */
   async removeRepeatableJobs(queueName: string, jobName: string): Promise<number> {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping repeatable-job removal for "${jobName}" on "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return 0;
-    }
     const queue = this.getQueue(queueName);
-    if (!queue) return 0;
     const jobs = await queue.getRepeatableJobs();
     const matchingJobs = jobs.filter((job) => job.name === jobName);
     await Promise.all(matchingJobs.map((job) => queue.removeRepeatableByKey(job.key)));
@@ -221,18 +182,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * Register a Worker for the given queue name with error handling and
    * exponential backoff.
-   * Returns null on Local tier where BullMQ is disabled.
    */
-  registerWorker<T extends MosaicJobData>(
-    queueName: string,
-    handler: JobHandler<T>,
-  ): Worker<T> | null {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping worker registration for "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return null;
-    }
+  registerWorker<T extends MosaicJobData>(queueName: string, handler: JobHandler<T>): Worker<T> {
     const worker = new Worker<T>(
       queueName,
       async (job) => {
@@ -289,12 +240,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
 
   /**
    * Return queue health statistics for all managed queues.
-   * Returns an empty healthy result on Local tier.
    */
   async getHealthStatus(): Promise<QueueHealthStatus> {
-    if (!this.enabled) {
-      return { queues: {}, healthy: true };
-    }
     const queues: QueueHealthStatus['queues'] = {};
     let healthy = true;
 
@@ -325,10 +272,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   /**
    * List jobs across all managed queues, optionally filtered by status.
    * BullMQ jobs are fetched by state type from each queue.
-   * Returns empty array on Local tier.
    */
   async listJobs(status?: JobStatus): Promise<JobDto[]> {
-    if (!this.enabled) return [];
     const jobs: JobDto[] = [];
     const states: JobStatus[] = status
       ? [status]
@@ -355,10 +300,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Retry a specific failed job by its BullMQ job ID (format: "queueName:id").
    * The caller passes "<queueName>__<jobId>" as the composite ID because BullMQ
    * job IDs are not globally unique — they are scoped to their queue.
-   * Returns an error on Local tier.
    */
   async retryJob(compositeId: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const sep = compositeId.lastIndexOf('__');
     if (sep === -1) {
       return { ok: false, message: 'Invalid job id format. Expected "<queue>__<jobId>".' };
@@ -390,7 +333,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Pause a queue by name.
    */
   async pauseQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const queue = this.queues.get(name);
     if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
     await queue.pause();
@@ -402,7 +344,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    * Resume a paused queue by name.
    */
   async resumeQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
     const queue = this.queues.get(name);
     if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
     await queue.resume();

apps/gateway/src/workspace/workspace.controller.spec.ts

@@ -1,104 +0,0 @@
-import 'reflect-metadata';
-import {
-  type CanActivate,
-  type ExecutionContext,
-  type INestApplication,
-  ValidationPipe,
-} from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { Test } from '@nestjs/testing';
-import request from 'supertest';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { ProjectBootstrapService } from './project-bootstrap.service.js';
-import { WorkspaceController } from './workspace.controller.js';
-
-const bootstrapMock = vi.fn(() =>
-  Promise.resolve({
-    projectId: 'project-1',
-    workspacePath: '/opt/mosaic/.workspaces/users/user-1/project-1',
-  }),
-);
-
-const authGuard: CanActivate = {
-  canActivate(context: ExecutionContext): boolean {
-    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
-    requestContext.user = { id: 'user-1' };
-    return true;
-  },
-};
-
-describe('POST /api/workspaces repoUrl validation', () => {
-  let app: INestApplication;
-
-  beforeAll(async () => {
-    const moduleRef = await Test.createTestingModule({
-      controllers: [WorkspaceController],
-      providers: [
-        {
-          provide: ProjectBootstrapService,
-          useValue: { bootstrap: bootstrapMock },
-        },
-      ],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue(authGuard)
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    app.useGlobalPipes(
-      new ValidationPipe({
-        whitelist: true,
-        forbidNonWhitelisted: true,
-        transform: true,
-      }),
-    );
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  beforeEach(() => {
-    bootstrapMock.mockClear();
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it.each([
-    ['a leading-dash value', '--upload-pack=sh -c id'],
-    ['an ext remote helper', 'ext::sh -c id'],
-    ['a file URL', 'file:///tmp/repository'],
-    ['an unparseable value', 'not a url'],
-    ['an SSH shorthand', '[email protected]:acme/repository.git'],
-    ['a scheme without //', 'https:example.com/acme/repository.git'],
-    ['a hostless git URL', 'git:///tmp/repository'],
-  ])('returns 400 for %s', async (_description, repoUrl) => {
-    const response = await request(app.getHttpServer())
-      .post('/api/workspaces')
-      .send({ name: 'Example', repoUrl })
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(400);
-    expect(bootstrapMock).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ['a plain HTTPS repository URL', 'https://example.com/acme/repository.git'],
-    ['a git protocol repository URL', 'git://example.com/acme/repository.git'],
-  ])('accepts %s', async (_description, repoUrl) => {
-    const response = await request(app.getHttpServer())
-      .post('/api/workspaces')
-      .send({ name: 'Example', repoUrl })
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(201);
-    expect(bootstrapMock).toHaveBeenCalledWith({
-      name: 'Example',
-      description: undefined,
-      userId: 'user-1',
-      teamId: undefined,
-      repoUrl,
-    });
-  });
-});

apps/gateway/src/workspace/workspace.controller.ts

@@ -1,11 +1,7 @@
 import { Body, Controller, Post, UseGuards } from '@nestjs/common';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
-import {
-  ProjectBootstrapService,
-  type BootstrapProjectResult,
-} from './project-bootstrap.service.js';
-import { CreateWorkspaceDto } from './workspace.dto.js';
+import { ProjectBootstrapService } from './project-bootstrap.service.js';
 
 @Controller('api/workspaces')
 @UseGuards(AuthGuard)
@@ -15,14 +11,20 @@ export class WorkspaceController {
   @Post()
   async create(
     @CurrentUser() user: { id: string },
-    @Body() dto: CreateWorkspaceDto,
-  ): Promise<BootstrapProjectResult> {
+    @Body()
+    body: {
+      name: string;
+      description?: string;
+      teamId?: string;
+      repoUrl?: string;
+    },
+  ) {
     return this.bootstrap.bootstrap({
-      name: dto.name,
-      description: dto.description,
+      name: body.name,
+      description: body.description,
       userId: user.id,
-      teamId: dto.teamId,
-      repoUrl: dto.repoUrl,
+      teamId: body.teamId,
+      repoUrl: body.repoUrl,
     });
   }
 }

apps/gateway/src/workspace/workspace.dto.ts

@@ -1,33 +0,0 @@
-import { IsOptional, IsString, IsUrl, Matches, MaxLength } from 'class-validator';
-
-export class CreateWorkspaceDto {
-  @IsString()
-  @MaxLength(255)
-  name!: string;
-
-  @IsOptional()
-  @IsString()
-  @MaxLength(10_000)
-  description?: string;
-
-  @IsOptional()
-  @IsString()
-  teamId?: string;
-
-  @IsOptional()
-  @IsString()
-  @Matches(/^(?:https|git):\/\//i, {
-    message: 'repoUrl must be a valid https:// or git:// URL',
-  })
-  @IsUrl(
-    {
-      protocols: ['https', 'git'],
-      require_host: true,
-      require_protocol: true,
-      require_tld: false,
-      require_valid_protocol: true,
-    },
-    { message: 'repoUrl must be a valid https:// or git:// URL' },
-  )
-  repoUrl?: string;
-}

apps/gateway/src/workspace/workspace.service.spec.ts

@@ -1,33 +1,11 @@
-import { BadRequestException } from '@nestjs/common';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { describe, it, expect, beforeEach } from 'vitest';
 import { WorkspaceService } from './workspace.service.js';
-
-type ExecFileMock = (
-  command: string,
-  args: readonly string[],
-  options: { cwd: string },
-  callback: (error: Error | null, stdout: string, stderr: string) => void,
-) => void;
-
-const { execFileMock } = vi.hoisted(() => ({
-  execFileMock: vi.fn<ExecFileMock>(),
-}));
-
-vi.mock('node:child_process', () => ({
-  execFile: execFileMock,
-}));
+import path from 'node:path';
 
 describe('WorkspaceService', () => {
   let service: WorkspaceService;
 
   beforeEach(() => {
-    execFileMock.mockReset();
-    execFileMock.mockImplementation((_command, _args, _options, callback) => {
-      callback(null, '', '');
-    });
     service = new WorkspaceService();
   });
 
@@ -98,69 +76,4 @@ describe('WorkspaceService', () => {
       }
     });
   });
-
-  describe('create', () => {
-    const project = {
-      id: 'project-1',
-      ownerType: 'user',
-      userId: 'user-1',
-      teamId: null,
-    } as const;
-
-    let originalRoot: string | undefined;
-    let temporaryRoot: string;
-
-    beforeEach(async () => {
-      originalRoot = process.env['MOSAIC_ROOT'];
-      temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'mosaic-workspace-'));
-      process.env['MOSAIC_ROOT'] = temporaryRoot;
-      service = new WorkspaceService();
-    });
-
-    afterEach(async () => {
-      if (originalRoot === undefined) {
-        delete process.env['MOSAIC_ROOT'];
-      } else {
-        process.env['MOSAIC_ROOT'] = originalRoot;
-      }
-      await fs.rm(temporaryRoot, { recursive: true, force: true });
-    });
-
-    it.each([
-      ['a leading-dash URL', '--upload-pack=sh -c id'],
-      ['an ext remote helper', 'ext::sh -c id'],
-      ['a file URL', 'file:///tmp/repository'],
-      ['an unparseable value', 'not a url'],
-      ['an SSH shorthand', '[email protected]:acme/repository.git'],
-      ['a scheme without //', 'https:example.com/acme/repository.git'],
-      ['a hostless git URL', 'git:///tmp/repository'],
-    ])('rejects %s before invoking git', async (_description, repoUrl) => {
-      await expect(service.create(project, repoUrl)).rejects.toBeInstanceOf(BadRequestException);
-      expect(execFileMock).not.toHaveBeenCalled();
-    });
-
-    it.each([
-      ['an HTTPS URL', 'https://example.com/acme/repository.git'],
-      ['a git protocol URL', 'git://example.com/acme/repository.git'],
-    ])('accepts %s and invokes hardened git clone arguments', async (_description, repoUrl) => {
-      const workspacePath = await service.create(project, repoUrl);
-
-      expect(execFileMock).toHaveBeenCalledOnce();
-      expect(execFileMock).toHaveBeenCalledWith(
-        'git',
-        [
-          '-c',
-          'protocol.ext.allow=never',
-          '-c',
-          'protocol.file.allow=never',
-          'clone',
-          '--',
-          repoUrl,
-          '.',
-        ],
-        { cwd: workspacePath },
-        expect.any(Function),
-      );
-    });
-  });
 });

apps/gateway/src/workspace/workspace.service.ts

@@ -1,30 +1,10 @@
-import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
-const allowedRepositoryProtocols = new Set(['https:', 'git:']);
-const repositoryUrlPrefixPattern = /^(?:https|git):\/\//i;
-const repositoryUrlError = 'repoUrl must be a valid https:// or git:// URL';
-
-function assertAllowedRepositoryUrl(repoUrl: string): void {
-  if (repoUrl.startsWith('-') || !repositoryUrlPrefixPattern.test(repoUrl)) {
-    throw new BadRequestException(repositoryUrlError);
-  }
-
-  let parsedUrl: URL;
-  try {
-    parsedUrl = new URL(repoUrl);
-  } catch {
-    throw new BadRequestException(repositoryUrlError);
-  }
-
-  if (!allowedRepositoryProtocols.has(parsedUrl.protocol) || parsedUrl.hostname.length === 0) {
-    throw new BadRequestException(repositoryUrlError);
-  }
-}
 
 export interface WorkspaceProject {
   id: string;
@@ -59,32 +39,14 @@ export class WorkspaceService {
    * If repoUrl is provided, clone instead of init.
    */
   async create(project: WorkspaceProject, repoUrl?: string): Promise<string> {
-    if (repoUrl !== undefined) {
-      assertAllowedRepositoryUrl(repoUrl);
-    }
-
     const workspacePath = this.resolvePath(project);
 
     // Create directory
     await fs.mkdir(workspacePath, { recursive: true });
 
-    if (repoUrl !== undefined) {
-      // Clone existing repo. Defense in depth keeps dangerous local helpers
-      // disabled and terminates option parsing before positional arguments.
-      await execFileAsync(
-        'git',
-        [
-          '-c',
-          'protocol.ext.allow=never',
-          '-c',
-          'protocol.file.allow=never',
-          'clone',
-          '--',
-          repoUrl,
-          '.',
-        ],
-        { cwd: workspacePath },
-      );
+    if (repoUrl) {
+      // Clone existing repo
+      await execFileAsync('git', ['clone', repoUrl, '.'], { cwd: workspacePath });
       this.logger.log(`Cloned ${repoUrl} into workspace ${workspacePath}`);
     } else {
       // Init new git repo

apps/web/index.html

@@ -1,30 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Mosaic</title>
-    <meta name="description" content="Mosaic Stack Dashboard" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Outfit:wght@300;400;500;600;700&family=Fira+Code:wght@400;500&display=swap"
-    />
-    <script>
-      // set data-theme before first paint so the stored theme never flashes
-      (function () {
-        try {
-          var theme = window.localStorage.getItem('mosaic-theme') || 'dark';
-          document.documentElement.setAttribute('data-theme', theme === 'light' ? 'light' : 'dark');
-        } catch (error) {
-          document.documentElement.setAttribute('data-theme', 'dark');
-        }
-      })();
-    </script>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>

apps/web/package.json

@@ -4,9 +4,7 @@
   "private": true,
   "scripts": {
     "build": "node ../../scripts/build-web.mjs",
-    "build:vite": "vite build",
     "dev": "next dev",
-    "dev:vite": "vite",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",
@@ -21,7 +19,6 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.18.2",
     "socket.io-client": "^4.8.0",
     "tailwind-merge": "^3.5.0"
   },
@@ -31,11 +28,9 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "@vitejs/plugin-react": "^6.0.5",
     "jsdom": "^29.0.0",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.8.0",
-    "vite": "^8.2.1",
-    "vitest": "^3.2.7"
+    "vitest": "^2.0.0"
   }
 }

apps/web/src/app/auth/provider/[provider]/page.tsx

@@ -3,56 +3,41 @@
 import Link from 'next/link';
 import { useEffect, useState } from 'react';
 import { useParams, useSearchParams } from 'next/navigation';
-import { api } from '@/lib/api';
-import { resolveAuthCallbackURL } from '@/lib/auth-redirect';
 import { signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
+import { getSsoProvider } from '@/lib/sso-providers';
 
 export default function AuthProviderRedirectPage(): React.ReactElement {
   const params = useParams<{ provider: string }>();
   const searchParams = useSearchParams();
   const providerId = typeof params.provider === 'string' ? params.provider : '';
-  const requestedCallbackURL = searchParams.get('callbackURL');
-  const [providerName, setProviderName] = useState<string | null>(null);
+  const provider = getSsoProvider(providerId);
+  const callbackURL = searchParams.get('callbackURL') ?? '/chat';
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
+    const currentProvider = provider;
+
+    if (!currentProvider) {
+      setError('Unknown SSO provider.');
+      return;
+    }
+
+    if (!currentProvider.enabled) {
+      setError(`${currentProvider.buttonLabel} is not enabled in this deployment.`);
+      return;
+    }
+
+    const activeProvider = currentProvider;
     let cancelled = false;
 
     async function redirectToProvider(): Promise<void> {
-      try {
-        const callbackURL = resolveAuthCallbackURL(requestedCallbackURL, window.location.origin);
-        const providers = await api<SsoProviderDiscovery[]>('/api/sso/providers');
-        if (cancelled) return;
+      const result = await signIn.oauth2({
+        providerId: activeProvider.id,
+        callbackURL,
+      });
 
-        const provider = providers.find((candidate) => candidate.id === providerId);
-        if (!provider) {
-          setError('Unknown SSO provider.');
-          return;
-        }
-
-        setProviderName(provider.name);
-        if (!provider.configured) {
-          setError(`${provider.name} is not enabled in this deployment.`);
-          return;
-        }
-        if (provider.loginMode !== 'oidc') {
-          setError(`${provider.name} is not available for OIDC sign in.`);
-          return;
-        }
-
-        const result = await signIn.oauth2({
-          providerId: provider.id,
-          callbackURL,
-        });
-
-        if (!cancelled && result?.error) {
-          setError(result.error.message ?? `${provider.name} sign in failed.`);
-        }
-      } catch (caught: unknown) {
-        if (!cancelled) {
-          setError(caught instanceof Error ? caught.message : 'Unable to start single sign-on.');
-        }
+      if (!cancelled && result?.error) {
+        setError(result.error.message ?? `${activeProvider.buttonLabel} sign in failed.`);
       }
     }
 
@@ -61,22 +46,19 @@ export default function AuthProviderRedirectPage(): React.ReactElement {
     return () => {
       cancelled = true;
     };
-  }, [providerId, requestedCallbackURL]);
+  }, [callbackURL, provider]);
 
   return (
     <div className="mx-auto flex min-h-[50vh] max-w-md flex-col justify-center">
       <h1 className="text-2xl font-semibold text-text-primary">Single sign-on</h1>
       <p className="mt-2 text-sm text-text-secondary">
-        {providerName
-          ? `Redirecting you to ${providerName}...`
+        {provider
+          ? `Redirecting you to ${provider.buttonLabel.replace('Continue with ', '')}...`
           : 'Preparing your sign-in request...'}
       </p>
 
       {error ? (
-        <div
-          role="alert"
-          className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
+        <div className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error">
           <p>{error}</p>
           <Link
             href="/login"

apps/web/src/lib/api.spec.ts

@@ -1,57 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { api } from './api';
-
-describe('api', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  it('fetches the supplied relative path with credentials and a JSON body', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ ok: true }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(
-      api<{ ok: boolean }>('/api/projects', {
-        method: 'POST',
-        body: { name: 'Mosaic' },
-      }),
-    ).resolves.toEqual({ ok: true });
-
-    expect(fetchMock).toHaveBeenCalledOnce();
-    expect(fetchMock).toHaveBeenCalledWith(
-      '/api/projects',
-      expect.objectContaining({
-        method: 'POST',
-        credentials: 'include',
-        body: JSON.stringify({ name: 'Mosaic' }),
-        headers: expect.objectContaining({
-          Accept: 'application/json',
-          'Content-Type': 'application/json',
-        }),
-      }),
-    );
-  });
-
-  it('throws the gateway JSON error with its statusCode', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ statusCode: 403, message: 'Forbidden' }), {
-        status: 403,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    await expect(api('/api/admin/users')).rejects.toMatchObject({
-      name: 'Error',
-      message: 'Forbidden',
-      statusCode: 403,
-    });
-  });
-});

apps/web/src/lib/api.ts

@@ -1,3 +1,5 @@
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+
 export interface ApiRequestInit extends Omit<RequestInit, 'body'> {
   body?: unknown;
 }
@@ -23,7 +25,7 @@ export async function api<T>(path: string, init?: ApiRequestInit): Promise<T> {
     headers['Content-Type'] = 'application/json';
   }
 
-  const res = await fetch(path, {
+  const res = await fetch(`${GATEWAY_URL}${path}`, {
     credentials: 'include',
     ...rest,
     headers,

apps/web/src/lib/auth-client.spec.ts

@@ -1,29 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-describe('auth client origin contract', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.resetModules();
-  });
-
-  it('uses the same-origin BetterAuth mount at /api/auth', async () => {
-    const fetchMock = vi.fn<typeof fetch>();
-    fetchMock.mockResolvedValue(
-      new Response(JSON.stringify({ session: null, user: null }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    );
-    vi.stubGlobal('fetch', fetchMock);
-
-    const { authClient } = await import('./auth-client');
-    await authClient.getSession();
-
-    expect(fetchMock).toHaveBeenCalledOnce();
-    const firstCall = fetchMock.mock.calls.at(0);
-    expect(firstCall).toBeDefined();
-    const requestURL = new URL(String(firstCall?.[0]), window.location.origin);
-    expect(requestURL.origin).toBe(window.location.origin);
-    expect(requestURL.pathname).toBe('/api/auth/get-session');
-  });
-});

apps/web/src/lib/auth-client.ts

@@ -1,9 +1,8 @@
 import { createAuthClient } from 'better-auth/react';
 import { adminClient, genericOAuthClient } from 'better-auth/client/plugins';
 
-// The gateway and BetterAuth client both use /api/auth. Omitting baseURL keeps
-// every browser request on the current origin in development and production.
 export const authClient = createAuthClient({
+  baseURL: process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242',
   plugins: [adminClient(), genericOAuthClient()],
 });
 

apps/web/src/lib/auth-redirect.spec.ts

@@ -1,30 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { resolveAuthCallbackURL } from './auth-redirect';
-
-const CURRENT_ORIGIN = 'https://mosaic.example';
-
-describe('resolveAuthCallbackURL', () => {
-  it('preserves a canonical same-origin path with search and hash', () => {
-    expect(resolveAuthCallbackURL('/projects?view=active#current', CURRENT_ORIGIN)).toBe(
-      '/projects?view=active#current',
-    );
-  });
-
-  it.each([
-    null,
-    'chat',
-    '//evil.example',
-    '/..//evil.com',
-    '/..//evil.com/x',
-    '/./..//evil.com',
-    '/../..//evil.com',
-    '/foo/..//evil.com',
-    '/\\evil.example',
-    '/\n//evil.example',
-    '/\r//evil.example',
-    '/\t//evil.example',
-    'https://evil.example/phish',
-  ])('falls back to chat for an unsafe callback target %#', (candidate) => {
-    expect(resolveAuthCallbackURL(candidate, CURRENT_ORIGIN)).toBe('/chat');
-  });
-});

apps/web/src/lib/auth-redirect.ts

@@ -1,23 +0,0 @@
-const DEFAULT_AUTH_CALLBACK_URL = '/chat';
-
-/**
- * Return a canonical same-origin path for post-auth navigation.
- *
- * Parsing before comparing origins rejects protocol-relative URLs, backslash
- * variants, and control characters that the WHATWG parser normalizes away.
- */
-export function resolveAuthCallbackURL(candidate: string | null, currentOrigin: string): string {
-  if (!candidate?.startsWith('/')) return DEFAULT_AUTH_CALLBACK_URL;
-
-  try {
-    const expectedOrigin = new URL(currentOrigin).origin;
-    const resolved = new URL(candidate, expectedOrigin);
-    if (resolved.origin !== expectedOrigin || resolved.pathname.startsWith('//')) {
-      return DEFAULT_AUTH_CALLBACK_URL;
-    }
-
-    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
-  } catch {
-    return DEFAULT_AUTH_CALLBACK_URL;
-  }
-}

apps/web/src/lib/socket.spec.ts

@@ -1,52 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const { ioMock } = vi.hoisted(() => ({
-  ioMock: vi.fn(),
-}));
-
-vi.mock('socket.io-client', () => ({
-  io: ioMock,
-}));
-
-import { destroySocket, getSocket } from './socket';
-
-describe('chat socket', () => {
-  let disconnectHandler: (() => void) | undefined;
-
-  beforeEach(() => {
-    disconnectHandler = undefined;
-    ioMock.mockReset();
-
-    const mockSocket = {
-      on: vi.fn((event: string, handler: () => void) => {
-        if (event === 'disconnect') disconnectHandler = handler;
-        return mockSocket;
-      }),
-      offAny: vi.fn(() => mockSocket),
-      disconnect: vi.fn(() => mockSocket),
-    };
-
-    ioMock.mockReturnValue(mockSocket);
-  });
-
-  afterEach(() => {
-    destroySocket();
-  });
-
-  it('creates one same-origin /chat namespace socket until it disconnects', () => {
-    const first = getSocket();
-    const second = getSocket();
-
-    expect(first).toBe(second);
-    expect(ioMock).toHaveBeenCalledOnce();
-    expect(ioMock).toHaveBeenCalledWith('/chat', {
-      withCredentials: true,
-      autoConnect: false,
-      transports: ['websocket', 'polling'],
-    });
-
-    disconnectHandler?.();
-    getSocket();
-    expect(ioMock).toHaveBeenCalledTimes(2);
-  });
-});

apps/web/src/lib/socket.ts

@@ -1,10 +1,12 @@
 import { io, type Socket } from 'socket.io-client';
 
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+
 let socket: Socket | null = null;
 
 export function getSocket(): Socket {
   if (!socket) {
-    socket = io('/chat', {
+    socket = io(`${GATEWAY_URL}/chat`, {
       withCredentials: true,
       autoConnect: false,
       transports: ['websocket', 'polling'],

apps/web/src/lib/sso-providers.test.ts

@@ -0,0 +1,48 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { getEnabledSsoProviders, getSsoProvider } from './sso-providers';
+
+describe('sso-providers', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('returns the enabled providers in login button order', () => {
+    vi.stubEnv('NEXT_PUBLIC_WORKOS_ENABLED', 'true');
+    vi.stubEnv('NEXT_PUBLIC_KEYCLOAK_ENABLED', 'true');
+
+    expect(getEnabledSsoProviders()).toEqual([
+      {
+        id: 'workos',
+        buttonLabel: 'Continue with WorkOS',
+        description: 'Enterprise SSO via WorkOS',
+        enabled: true,
+        href: '/auth/provider/workos',
+      },
+      {
+        id: 'keycloak',
+        buttonLabel: 'Continue with Keycloak',
+        description: 'Enterprise SSO via Keycloak',
+        enabled: true,
+        href: '/auth/provider/keycloak',
+      },
+    ]);
+  });
+
+  it('marks disabled providers without exposing them in the enabled list', () => {
+    vi.stubEnv('NEXT_PUBLIC_WORKOS_ENABLED', 'true');
+    vi.stubEnv('NEXT_PUBLIC_KEYCLOAK_ENABLED', 'false');
+
+    expect(getEnabledSsoProviders().map((provider) => provider.id)).toEqual(['workos']);
+    expect(getSsoProvider('keycloak')).toEqual({
+      id: 'keycloak',
+      buttonLabel: 'Continue with Keycloak',
+      description: 'Enterprise SSO via Keycloak',
+      enabled: false,
+      href: '/auth/provider/keycloak',
+    });
+  });
+
+  it('returns null for unknown providers', () => {
+    expect(getSsoProvider('authentik')).toBeNull();
+  });
+});

apps/web/src/lib/sso-providers.ts

@@ -0,0 +1,53 @@
+export type SsoProviderId = 'workos' | 'keycloak';
+
+export interface SsoProvider {
+  id: SsoProviderId;
+  buttonLabel: string;
+  description: string;
+  enabled: boolean;
+  href: string;
+}
+
+const PROVIDER_METADATA: Record<SsoProviderId, Omit<SsoProvider, 'enabled' | 'href'>> = {
+  workos: {
+    id: 'workos',
+    buttonLabel: 'Continue with WorkOS',
+    description: 'Enterprise SSO via WorkOS',
+  },
+  keycloak: {
+    id: 'keycloak',
+    buttonLabel: 'Continue with Keycloak',
+    description: 'Enterprise SSO via Keycloak',
+  },
+};
+
+export function getEnabledSsoProviders(): SsoProvider[] {
+  return (Object.keys(PROVIDER_METADATA) as SsoProviderId[])
+    .map((providerId) => getSsoProvider(providerId))
+    .filter((provider): provider is SsoProvider => provider?.enabled === true);
+}
+
+export function getSsoProvider(providerId: string): SsoProvider | null {
+  if (!isSsoProviderId(providerId)) {
+    return null;
+  }
+
+  return {
+    ...PROVIDER_METADATA[providerId],
+    enabled: isSsoProviderEnabled(providerId),
+    href: `/auth/provider/${providerId}`,
+  };
+}
+
+function isSsoProviderId(value: string): value is SsoProviderId {
+  return value === 'workos' || value === 'keycloak';
+}
+
+function isSsoProviderEnabled(providerId: SsoProviderId): boolean {
+  switch (providerId) {
+    case 'workos':
+      return process.env['NEXT_PUBLIC_WORKOS_ENABLED'] === 'true';
+    case 'keycloak':
+      return process.env['NEXT_PUBLIC_KEYCLOAK_ENABLED'] === 'true';
+  }
+}

apps/web/src/main.tsx

@@ -1,19 +0,0 @@
-import { StrictMode } from 'react';
-import { createRoot } from 'react-dom/client';
-import { RouterProvider } from 'react-router-dom';
-import { ThemeProvider } from '@/providers/theme-provider';
-import { createAppRouter } from '@/routes';
-import '@/app/globals.css';
-
-const container = document.getElementById('root');
-if (!container) {
-  throw new Error('missing #root element');
-}
-
-createRoot(container).render(
-  <StrictMode>
-    <ThemeProvider>
-      <RouterProvider router={createAppRouter()} />
-    </ThemeProvider>
-  </StrictMode>,
-);

apps/web/src/routes.tsx

@@ -1,49 +0,0 @@
-import type { ReactElement } from 'react';
-import { createBrowserRouter, Navigate, Outlet, type RouteObject } from 'react-router-dom';
-import { LoginPage } from '@/spa/pages/login';
-import { RegisterPage } from '@/spa/pages/register';
-import { SsoCallbackPage } from '@/spa/pages/sso-callback';
-import { AuthGuard, GuestGuard } from '@/spa/guards';
-import { Placeholder } from '@/spa/placeholder';
-
-function GuestLayout(): ReactElement {
-  return (
-    <div className="flex min-h-screen items-center justify-center bg-surface-bg px-4 py-8">
-      <div className="w-full max-w-md rounded-xl border border-surface-border bg-surface-card p-8 shadow-lg">
-        <Outlet />
-      </div>
-    </div>
-  );
-}
-
-export const routes: RouteObject[] = [
-  {
-    element: <GuestGuard />,
-    children: [
-      {
-        element: <GuestLayout />,
-        children: [
-          { path: '/login', element: <LoginPage /> },
-          { path: '/register', element: <RegisterPage /> },
-          { path: '/auth/provider/:provider', element: <SsoCallbackPage /> },
-        ],
-      },
-    ],
-  },
-  {
-    element: <AuthGuard />,
-    children: [
-      { path: '/', element: <Navigate to="/chat" replace /> },
-      { path: '/chat', element: <Placeholder title="Chat" /> },
-      { path: '/projects', element: <Placeholder title="Projects" /> },
-      { path: '/projects/:id', element: <Placeholder title="Project" /> },
-      { path: '/tasks', element: <Placeholder title="Tasks" /> },
-      { path: '/settings', element: <Placeholder title="Settings" /> },
-      { path: '/admin', element: <Placeholder title="Admin" /> },
-    ],
-  },
-];
-
-export function createAppRouter(): ReturnType<typeof createBrowserRouter> {
-  return createBrowserRouter(routes);
-}

apps/web/src/spa/guards.spec.tsx

@@ -1,135 +0,0 @@
-import { act } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
-import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
-
-const { useSessionMock } = vi.hoisted(() => ({
-  useSessionMock: vi.fn(),
-}));
-
-vi.mock('@/lib/auth-client', () => ({
-  useSession: useSessionMock,
-}));
-
-import { AuthGuard, GuestGuard } from './guards';
-
-interface RenderedRouter {
-  container: HTMLDivElement;
-  router: ReturnType<typeof createMemoryRouter>;
-}
-
-const mountedRoots: Root[] = [];
-
-beforeAll(() => {
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
-    configurable: true,
-    value: true,
-  });
-});
-
-afterAll(() => {
-  Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-});
-
-async function renderRouter(
-  routeObjects: RouteObject[],
-  initialEntry: string,
-): Promise<RenderedRouter> {
-  const container = document.createElement('div');
-  document.body.append(container);
-  const router = createMemoryRouter(routeObjects, { initialEntries: [initialEntry] });
-  const root = createRoot(container);
-  mountedRoots.push(root);
-
-  await act(async () => {
-    root.render(<RouterProvider router={router} />);
-  });
-
-  return { container, router };
-}
-
-afterEach(async () => {
-  for (const root of mountedRoots.splice(0)) {
-    await act(async () => {
-      root.unmount();
-    });
-  }
-  document.body.replaceChildren();
-  useSessionMock.mockReset();
-});
-
-const guestRoutes: RouteObject[] = [
-  {
-    path: '/login',
-    element: <GuestGuard />,
-    children: [{ index: true, element: <p>Guest page</p> }],
-  },
-  { path: '/chat', element: <p>Chat page</p> },
-];
-
-const authenticatedRoutes: RouteObject[] = [
-  {
-    path: '/chat',
-    element: <AuthGuard />,
-    children: [{ index: true, element: <p>Private page</p> }],
-  },
-  { path: '/login', element: <p>Login page</p> },
-];
-
-describe('GuestGuard', () => {
-  it('renders the guest outlet while session lookup is pending', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: true });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Guest page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('renders the guest outlet when no session exists', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: false });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Guest page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('redirects an authenticated session to chat', async () => {
-    useSessionMock.mockReturnValue({ data: { user: { id: 'user-1' } }, isPending: false });
-
-    const view = await renderRouter(guestRoutes, '/login');
-
-    expect(view.container.textContent).toContain('Chat page');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-});
-
-describe('AuthGuard', () => {
-  it('renders the existing loading treatment while session lookup is pending', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: true });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Loading...');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-
-  it('redirects an unauthenticated visitor to login', async () => {
-    useSessionMock.mockReturnValue({ data: null, isPending: false });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Login page');
-    expect(view.router.state.location.pathname).toBe('/login');
-  });
-
-  it('renders the authenticated outlet when a session exists', async () => {
-    useSessionMock.mockReturnValue({ data: { user: { id: 'user-1' } }, isPending: false });
-
-    const view = await renderRouter(authenticatedRoutes, '/chat');
-
-    expect(view.container.textContent).toContain('Private page');
-    expect(view.router.state.location.pathname).toBe('/chat');
-  });
-});

apps/web/src/spa/guards.tsx

@@ -1,23 +0,0 @@
-import type { ReactElement } from 'react';
-import { Navigate, Outlet } from 'react-router-dom';
-import { useSession } from '@/lib/auth-client';
-
-export function GuestGuard(): ReactElement {
-  const { data: session } = useSession();
-
-  return session ? <Navigate to="/chat" replace /> : <Outlet />;
-}
-
-export function AuthGuard(): ReactElement {
-  const { data: session, isPending } = useSession();
-
-  if (isPending) {
-    return (
-      <div className="flex min-h-screen items-center justify-center">
-        <div className="text-sm text-text-muted">Loading...</div>
-      </div>
-    );
-  }
-
-  return session ? <Outlet /> : <Navigate to="/login" replace />;
-}

apps/web/src/spa/pages/login.tsx

@@ -1,152 +0,0 @@
-import { useEffect, useState, type FormEvent, type ReactElement } from 'react';
-import { Link, useNavigate } from 'react-router-dom';
-import { SsoProviderButtons } from '@/components/auth/sso-provider-buttons';
-import { api } from '@/lib/api';
-import { authClient, signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
-
-export function LoginPage(): ReactElement {
-  const navigate = useNavigate();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-  const [ssoProviders, setSsoProviders] = useState<SsoProviderDiscovery[]>([]);
-  const [ssoLoadingProviderId, setSsoLoadingProviderId] = useState<
-    SsoProviderDiscovery['id'] | null
-  >(null);
-
-  useEffect(() => {
-    let active = true;
-
-    void api<SsoProviderDiscovery[]>('/api/sso/providers').then(
-      (providers) => {
-        if (active) setSsoProviders(providers.filter((provider) => provider.configured));
-      },
-      () => {
-        if (active) setSsoProviders([]);
-      },
-    );
-
-    return () => {
-      active = false;
-    };
-  }, []);
-
-  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
-    event.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(event.currentTarget);
-    const email = String(form.get('email') ?? '');
-    const password = String(form.get('password') ?? '');
-
-    try {
-      const result = await signIn.email({ email, password });
-
-      if (result.error) {
-        setError(result.error.message ?? 'Sign in failed');
-        return;
-      }
-
-      navigate('/chat', { replace: true });
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : 'Sign in failed');
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  async function handleSsoSignIn(providerId: SsoProviderDiscovery['id']): Promise<void> {
-    setError(null);
-    setSsoLoadingProviderId(providerId);
-
-    try {
-      const result = await authClient.signIn.oauth2({
-        providerId,
-        callbackURL: '/chat',
-        newUserCallbackURL: '/chat',
-      });
-
-      if (result.error) {
-        setError(result.error.message ?? `Sign in with ${providerId} failed`);
-        setSsoLoadingProviderId(null);
-      }
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : `Sign in with ${providerId} failed`);
-      setSsoLoadingProviderId(null);
-    }
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Sign in</h1>
-      <p className="mt-1 text-sm text-text-secondary">Sign in to your Mosaic account</p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      ) : null}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="current-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Signing in...' : 'Sign in'}
-        </button>
-      </form>
-
-      <SsoProviderButtons
-        providers={ssoProviders}
-        loadingProviderId={ssoLoadingProviderId}
-        onOidcSignIn={(providerId) => {
-          void handleSsoSignIn(providerId);
-        }}
-      />
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Don&apos;t have an account?{' '}
-        <Link to="/register" className="text-blue-400 hover:text-blue-300">
-          Sign up
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/spa/pages/register.tsx

@@ -1,116 +0,0 @@
-import { useState, type FormEvent, type ReactElement } from 'react';
-import { Link, useNavigate } from 'react-router-dom';
-import { signUp } from '@/lib/auth-client';
-
-export function RegisterPage(): ReactElement {
-  const navigate = useNavigate();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-
-  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
-    event.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(event.currentTarget);
-    const name = String(form.get('name') ?? '');
-    const email = String(form.get('email') ?? '');
-    const password = String(form.get('password') ?? '');
-
-    try {
-      const result = await signUp.email({ name, email, password });
-
-      if (result.error) {
-        setError(result.error.message ?? 'Registration failed');
-        return;
-      }
-
-      navigate('/chat', { replace: true });
-    } catch (caught: unknown) {
-      setError(caught instanceof Error ? caught.message : 'Registration failed');
-    } finally {
-      setLoading(false);
-    }
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Create account</h1>
-      <p className="mt-1 text-sm text-text-secondary">Get started with Mosaic</p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      ) : null}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="name" className="block text-sm font-medium text-text-secondary">
-            Name
-          </label>
-          <input
-            id="name"
-            name="name"
-            type="text"
-            autoComplete="name"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="Your name"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="new-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Creating account...' : 'Create account'}
-        </button>
-      </form>
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Already have an account?{' '}
-        <Link to="/login" className="text-blue-400 hover:text-blue-300">
-          Sign in
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/spa/pages/sso-callback.spec.tsx

@@ -1,90 +0,0 @@
-import { act } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-import { createMemoryRouter, RouterProvider } from 'react-router-dom';
-import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-
-const { apiMock, oauth2Mock } = vi.hoisted(() => ({
-  apiMock: vi.fn(),
-  oauth2Mock: vi.fn(),
-}));
-
-vi.mock('@/lib/api', () => ({
-  api: apiMock,
-}));
-
-vi.mock('@/lib/auth-client', () => ({
-  signIn: { oauth2: oauth2Mock },
-}));
-
-import { SsoCallbackPage } from './sso-callback';
-
-const mountedRoots: Root[] = [];
-
-beforeAll(() => {
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
-    configurable: true,
-    value: true,
-  });
-});
-
-beforeEach(() => {
-  apiMock.mockResolvedValue([
-    {
-      id: 'authentik',
-      name: 'Authentik',
-      protocols: ['oidc'],
-      configured: true,
-      loginMode: 'oidc',
-      callbackPath: '/api/auth/oauth2/callback/authentik',
-      teamSync: { enabled: false, claim: null },
-      samlFallback: { configured: false, loginUrl: null },
-      warnings: [],
-    },
-  ]);
-  oauth2Mock.mockResolvedValue({ data: null, error: null });
-});
-
-afterEach(async () => {
-  for (const root of mountedRoots.splice(0)) {
-    await act(async () => {
-      root.unmount();
-    });
-  }
-  document.body.replaceChildren();
-  apiMock.mockReset();
-  oauth2Mock.mockReset();
-});
-
-afterAll(() => {
-  Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
-});
-
-describe('SsoCallbackPage', () => {
-  it('rejects a control-character callback that normalizes to an external origin', async () => {
-    const router = createMemoryRouter(
-      [
-        {
-          path: '/auth/provider/:provider',
-          element: <SsoCallbackPage />,
-        },
-      ],
-      {
-        initialEntries: ['/auth/provider/authentik?callbackURL=%2F%0A%2F%2Fevil.example'],
-      },
-    );
-    const container = document.createElement('div');
-    document.body.append(container);
-    const root = createRoot(container);
-    mountedRoots.push(root);
-
-    await act(async () => {
-      root.render(<RouterProvider router={router} />);
-      await new Promise((resolve) => setTimeout(resolve, 0));
-    });
-
-    expect(oauth2Mock).toHaveBeenCalledWith({
-      providerId: 'authentik',
-      callbackURL: '/chat',
-    });
-  });
-});

apps/web/src/spa/pages/sso-callback.tsx

@@ -1,91 +0,0 @@
-import { useEffect, useState, type ReactElement } from 'react';
-import { Link, useParams, useSearchParams } from 'react-router-dom';
-import { api } from '@/lib/api';
-import { resolveAuthCallbackURL } from '@/lib/auth-redirect';
-import { signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
-
-export function SsoCallbackPage(): ReactElement {
-  const { provider: providerId = '' } = useParams<'provider'>();
-  const [searchParams] = useSearchParams();
-  const requestedCallbackURL = searchParams.get('callbackURL');
-  const [providerName, setProviderName] = useState<string | null>(null);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    let cancelled = false;
-
-    async function redirectToProvider(): Promise<void> {
-      try {
-        const callbackURL = resolveAuthCallbackURL(requestedCallbackURL, window.location.origin);
-        const providers = await api<SsoProviderDiscovery[]>('/api/sso/providers');
-        if (cancelled) return;
-
-        const provider = providers.find((candidate) => candidate.id === providerId);
-        if (!provider) {
-          setError('Unknown SSO provider.');
-          return;
-        }
-
-        setProviderName(provider.name);
-        if (!provider.configured) {
-          setError(`${provider.name} is not enabled in this deployment.`);
-          return;
-        }
-        if (provider.loginMode !== 'oidc') {
-          setError(`${provider.name} is not available for OIDC sign in.`);
-          return;
-        }
-
-        const result = await signIn.oauth2({
-          providerId: provider.id,
-          callbackURL,
-        });
-
-        if (!cancelled && result?.error) {
-          setError(result.error.message ?? `${provider.name} sign in failed.`);
-        }
-      } catch (caught: unknown) {
-        if (!cancelled) {
-          setError(caught instanceof Error ? caught.message : 'Unable to start single sign-on.');
-        }
-      }
-    }
-
-    void redirectToProvider();
-
-    return () => {
-      cancelled = true;
-    };
-  }, [providerId, requestedCallbackURL]);
-
-  return (
-    <div className="mx-auto flex min-h-[50vh] max-w-md flex-col justify-center">
-      <h1 className="text-2xl font-semibold text-text-primary">Single sign-on</h1>
-      <p className="mt-2 text-sm text-text-secondary">
-        {providerName
-          ? `Redirecting you to ${providerName}...`
-          : 'Preparing your sign-in request...'}
-      </p>
-
-      {error ? (
-        <div
-          role="alert"
-          className="mt-6 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          <p>{error}</p>
-          <Link
-            to="/login"
-            className="mt-3 inline-block font-medium text-blue-400 hover:text-blue-300"
-          >
-            Return to login
-          </Link>
-        </div>
-      ) : (
-        <div className="mt-6 rounded-lg border border-surface-border bg-surface-elevated px-4 py-3 text-sm text-text-secondary">
-          If the redirect does not start automatically, return to the login page and try again.
-        </div>
-      )}
-    </div>
-  );
-}

apps/web/src/spa/placeholder.tsx

@@ -1,9 +0,0 @@
-import type { ReactElement } from 'react';
-
-export function Placeholder({ title }: { title: string }): ReactElement {
-  return (
-    <main className="flex min-h-screen items-center justify-center">
-      <h1 className="text-xl font-medium">{title}</h1>
-    </main>
-  );
-}

apps/web/src/spa/routes.spec.tsx

@@ -1,58 +0,0 @@
-import { isValidElement } from 'react';
-import { describe, expect, it } from 'vitest';
-import type { RouteObject } from 'react-router-dom';
-import { routes } from '@/routes';
-import { Placeholder } from '@/spa/placeholder';
-
-function collectPaths(routeObjects: RouteObject[]): string[] {
-  return routeObjects.flatMap((route) => [
-    ...(route.path ? [route.path] : []),
-    ...(route.children ? collectPaths(route.children) : []),
-  ]);
-}
-
-function findRoute(routeObjects: RouteObject[], path: string): RouteObject | undefined {
-  for (const route of routeObjects) {
-    if (route.path === path) return route;
-    const nested = route.children ? findRoute(route.children, path) : undefined;
-    if (nested) return nested;
-  }
-  return undefined;
-}
-
-describe('SPA route table', () => {
-  it('covers every v1 parity route from the Phase P RFC', () => {
-    expect(collectPaths(routes).sort()).toEqual(
-      [
-        '/',
-        '/admin',
-        '/auth/provider/:provider',
-        '/chat',
-        '/login',
-        '/projects',
-        '/projects/:id',
-        '/register',
-        '/settings',
-        '/tasks',
-      ].sort(),
-    );
-  });
-
-  it('separates guest and authenticated route groups', () => {
-    const guestPaths = collectPaths(routes.at(0)?.children ?? []);
-    const authPaths = collectPaths(routes.at(1)?.children ?? []);
-    expect(guestPaths).toContain('/login');
-    expect(guestPaths).not.toContain('/chat');
-    expect(authPaths).toContain('/chat');
-  });
-
-  it.each(['/login', '/register', '/auth/provider/:provider'])(
-    'renders a real guest page instead of the P1 placeholder at %s',
-    (path) => {
-      const element = findRoute(routes, path)?.element;
-      expect(isValidElement(element)).toBe(true);
-      if (!isValidElement(element)) throw new Error(`Missing route element for ${path}`);
-      expect(element.type).not.toBe(Placeholder);
-    },
-  );
-});

apps/web/src/test/setup.spec.ts

@@ -1,14 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-describe('Vitest abort-controller realm', () => {
-  it('provides a global signal accepted by Node native Request', () => {
-    const controller = new AbortController();
-    const request = new Request('https://mosaic.invalid/navigation', {
-      signal: controller.signal,
-    });
-
-    expect(request.signal).toBeInstanceOf(AbortSignal);
-    controller.abort();
-    expect(request.signal.aborted).toBe(true);
-  });
-});

apps/web/src/test/setup.ts

@@ -1,23 +0,0 @@
-import { transferableAbortController } from 'node:util';
-
-// jsdom installs realm-local abort constructors while Node's undici Request
-// remains native. React Router passes a global AbortSignal to Request, so both
-// constructors must come from Node's native realm during tests.
-const nativeController = transferableAbortController();
-const nativeAbortController = nativeController.constructor;
-const nativeAbortSignal = nativeController.signal.constructor;
-
-for (const target of [globalThis, window]) {
-  Object.defineProperties(target, {
-    AbortController: {
-      configurable: true,
-      writable: true,
-      value: nativeAbortController,
-    },
-    AbortSignal: {
-      configurable: true,
-      writable: true,
-      value: nativeAbortSignal,
-    },
-  });
-}

apps/web/vite.config.ts

@@ -1,24 +0,0 @@
-import { fileURLToPath } from 'node:url';
-import react from '@vitejs/plugin-react';
-import { defineConfig } from 'vite';
-
-// The proxy exists only in dev; in production the SPA is same-origin with the gateway
-// (served by it under Candidate A, or behind one FQDN under Candidate B) and every
-// request uses a relative path, so no origin may ever be configured here or in src/.
-const gatewayTarget = 'http://localhost:14242';
-
-export default defineConfig({
-  plugins: [react()],
-  resolve: {
-    alias: {
-      '@': fileURLToPath(new URL('./src', import.meta.url)),
-    },
-  },
-  server: {
-    port: 3100,
-    proxy: {
-      '/api': gatewayTarget,
-      '/socket.io': { target: gatewayTarget, ws: true },
-    },
-  },
-});

apps/web/vitest.config.ts

@@ -1,21 +1,9 @@
-import { fileURLToPath } from 'node:url';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
-  resolve: {
-    alias: {
-      '@': fileURLToPath(new URL('./src', import.meta.url)),
-    },
-  },
-  // tsconfig uses "jsx": "preserve" for Next; tests need esbuild to compile it
-  esbuild: {
-    jsx: 'automatic',
-  },
   test: {
     globals: true,
     environment: 'jsdom',
-    setupFiles: ['./src/test/setup.ts'],
-    isolate: true,
     exclude: ['e2e/**', 'node_modules/**'],
   },
 });

docker/gateway.Dockerfile

@@ -10,8 +10,6 @@ COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/gateway/package.json ./apps/gateway/
 COPY packages/ ./packages/
 COPY plugins/ ./plugins/
-# the root prepare script runs scripts/install-hooks.mjs on install
-COPY scripts/ ./scripts/
 RUN pnpm install --frozen-lockfile
 COPY . .
 # Build gateway and all of its workspace dependencies via turbo dependency graph
@@ -23,22 +21,11 @@ RUN pnpm --filter @mosaicstack/gateway --prod deploy --legacy /deploy
 FROM base AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# WorkspaceService shells out to git at runtime and roots workspaces at
-# $MOSAIC_ROOT/.workspaces (apps/gateway/src/workspace/workspace.service.ts);
-# mount a volume over /opt/mosaic to persist workspaces across container restarts.
-# Intentionally unpinned: Alpine's signed repository is the trust anchor; pinning
-# git was declined so routine base-image security updates remain maintainable.
-RUN apk add --no-cache git \
-  && mkdir -p /opt/mosaic/.workspaces \
-  && chown -R node:node /opt/mosaic /app
-ENV MOSAIC_ROOT=/opt/mosaic
 # Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
-COPY --chown=node:node --from=builder /deploy/node_modules ./node_modules
-COPY --chown=node:node --from=builder /deploy/package.json ./package.json
+COPY --from=builder /deploy/node_modules ./node_modules
+COPY --from=builder /deploy/package.json ./package.json
 # dist is declared in package.json "files" so pnpm deploy copies it into /deploy;
 # copy from builder explicitly as belt-and-suspenders
-COPY --chown=node:node --from=builder /app/apps/gateway/dist ./dist
-# gateway defaults to port 14242 (apps/gateway/src/main.ts)
-EXPOSE 14242
-USER node
+COPY --from=builder /app/apps/gateway/dist ./dist
+EXPOSE 4000
 CMD ["node", "dist/main.js"]

docker/web.Dockerfile

@@ -8,11 +8,9 @@ WORKDIR /app
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/web/package.json ./apps/web/
 COPY packages/ ./packages/
-# the root prepare script runs scripts/install-hooks.mjs on install
-COPY scripts/ ./scripts/
 RUN pnpm install --frozen-lockfile
 COPY . .
-RUN pnpm --filter @mosaicstack/web build
+RUN pnpm --filter @mosaic/web build
 
 FROM base AS runner
 WORKDIR /app

docs/PRD.md

@@ -437,6 +437,59 @@ Canonical checkpoint/handoff payloads, exactly-once connector receipts, concrete
 
 ---
 
+## Governed fleet credential lifecycle (`mosaic cred`, #1045)
+
+### Problem and objective
+
+Fleet credentials are issued, wired, resolved, granted, validated, rotated, and revoked through unrelated scripts and manual provider actions. The split has produced silent fallback to a human/shared principal, missing runtime identity, cross-estate login resolution, incomplete permission checks, and non-auditable grants. The objective is one mechanical, durable, systemic `mosaic cred` path that decides both what a fleet seat may do and which provider identity it acts as.
+
+### Scope
+
+Phase 1 governs the existing per-identity Gitea token store and Tea login registration. VaultWarden is explicitly out for the agent tier and is not a backend option in this workstream. Certificate-backed identity and short-lived broker-issued credentials remain later phases behind the same caller contract.
+
+### Normative requirements
+
+1. `CRED-REQ-01`: The CLI SHALL expose `provision`, `wire`, `grant`, `get`, `validate`, `whoami`, `list`, `rotate`, `revoke`, and `audit`. Grant and validate SHALL conform to [`docs/credentials/GRANT-VALIDATE-CONTRACT.md`](./credentials/GRANT-VALIDATE-CONTRACT.md).
+2. `CRED-REQ-02`: Every provider operation SHALL carry an explicit identity, estate, and host. Estate-to-host mapping SHALL come from strict non-secret configuration. Missing, ambiguous, inferred, or mismatched values SHALL refuse before credential resolution. Machine location SHALL grant no estate authority.
+3. `CRED-REQ-03`: Token capability and Tea login identity are inseparable. Provisioning SHALL create/register both or neither. At mint time, delegated Basic authority SHALL read its provider principal back, the minted token object SHALL read back exact scopes, and both the token binding and exact host-bound Tea record SHALL contain that same minted credential. Rollback SHALL read provider, token-store, and Tea state back and may report complete only when the pre-operation state is established exactly; failed or unverified cleanup is `indeterminate`/`rollback-incomplete`. Provision, rotate, and revoke SHALL serialize the complete provider/token-store/Tea transaction between cooperating `mosaic cred` processes under one fixed estate/host/identity advisory lock that caller-selected state roots cannot bypass. That same-UID-replaceable filesystem lock and the file-store generation preconditions provide optimistic concurrency only for cooperating `mosaic cred` mutators; neither is an authorization boundary nor atomic CAS against a hostile same-UID filesystem writer. Provider authority is the authorization boundary. Hostile same-UID direct filesystem mutation is explicitly out of scope for this phase and deferred. Runtime `/user` identity remeasurement is required only when the seat token already carries `read:user`; least-privilege tokens SHALL NOT be widened to service the instrument. A wrong-host or absent Tea login SHALL never fall back to a host default.
+4. `CRED-REQ-04`: Under fleet context, unset or unresolvable identity SHALL fail closed identically in the git credential helper and API resolver. Interactive shared credentials remain available only through an explicit non-fleet/shared selection; absence SHALL never select them.
+5. `CRED-REQ-05`: Token scope, repository permission, and organization/team role are independent layers. Provision, grant, and validate SHALL report each separately from provider evidence. No layer substitutes for another, and a permission widening at one layer SHALL not be described as least privilege because another layer is narrow.
+6. `CRED-REQ-06`: Gitea token creation SHALL use an explicit delegated provisioning step because this provider requires Basic Auth. Password-equivalent provisioning material SHALL enter only through a protected control-plane runtime credential channel, never caller bearer storage, argv, ordinary environment, logs, or output.
+7. `CRED-REQ-07`: Permission grants SHALL be accepted only after provider read-back of the named direct collaborator permission or, for team grants, organization membership, team membership, team-repository attachment, and subject effective permission.
+8. `CRED-REQ-08`: `validate --repo` SHALL compute a side-effect-free write differential by result. One immutable credential resolution SHALL bind the declared subject's provider identity read-back, repository permission, and authenticated Git receive-pack advertisement. A distinct provider-confirmed read-only principal and an unauthenticated caller SHALL both be refused receive-pack in the same evaluation. Principal/handle disagreement SHALL be indeterminate, never refusal or success. The check SHALL create no ref or artifact and SHALL state that it does not prove a particular update will pass branch protection, hooks, races, or content policy.
+9. `CRED-REQ-09`: All provider HTTP calls SHALL share one transport implementation for URL/host binding, TLS, User-Agent, content-type, JSON-shape validation, redaction, and bounded responses. A 2xx status alone SHALL never establish identity, scope, permission, grant, or revocation.
+10. `CRED-REQ-10`: Operations SHALL return stable machine outcomes `ok`, `refused`, `error`, or `indeterminate`. Policy refusal, local operational failure, and incomplete/inconsistent evidence SHALL remain distinguishable. `provider-unavailable`, `identity-not-measured`, `identity-not-visible`, `identity-not-found`, and `credential-rejected` SHALL remain distinct diagnoses. Validation SHALL report capability from an in-scope probe separately from identity measurement. `/user` 401 is `credential-rejected`/refused; `/user` 403/404 plus successful in-scope capability is `identity-not-measured`, never a dead credential. A returned login mismatch is a binding refusal. No implemented operation may emit `identity-not-found`; that diagnosis requires a separately approved visibility-authorized inventory capability. Security callers SHALL fail closed on every outcome except `ok` without relabelling indeterminate evidence as a denial.
+11. `CRED-REQ-11`: No command SHALL print a token, password, authorization header, fingerprint, partial secret, or secret-bearing provider body, including error paths. Secrets SHALL not appear in process argv. Phase-1 file storage SHALL remain private, symlink-safe, regular-file-only, test-overridable, and compatible with existing managed token consumers.
+12. `CRED-REQ-12`: Every issue, provision, grant, rotate, revoke, and credential access SHALL be journaled with actor, subject, estate, host, repo/scope, operation, time, and non-secret provider evidence. The durable journal SHALL be opened and fsynced before the first mutation, append each mutation/read-back, and seal only after acceptance. Credential access SHALL durably record issuance start immediately before protected-fd disclosure; any partial write or post-write audit failure SHALL remain visibly `indeterminate` with mutation `unknown` or `applied`, never be relabelled as a pre-disclosure destination error. A journal seal SHALL remain staged and recovery-visible until its final rename and directory durability succeed; a final seal-commit fault SHALL revert to open classification and cannot leave an acceptance-bearing sealed-success object. Journal/audit write failure SHALL be fatal; an unsealed journal means incomplete/indeterminate work.
+13. `CRED-REQ-13`: `wire` SHALL be idempotent and SHALL update the exact roster-derived `<identity>.env.generated` fleet projection so both identity axes survive restart. It SHALL authenticate the same explicit seat through a protected delegated credential channel and provider identity read-back before mutation, refuse actor/identity/path/roster disagreements, and never authorize from the shared Unix account. It SHALL not write linked-worktree git configuration or silently infer identity from pane/session names.
+14. `CRED-REQ-14`: Rotate SHALL verify the new credential/provider identity before retiring the old credential. Revoke SHALL read back provider revocation/denial and preserve an auditable recovery record. A local file deletion or successful HTTP status is not revocation evidence.
+15. `CRED-REQ-15`: Before the #1044 fail-closed resolver change is eligible to land, `mosaic cred validate` SHALL resolve every live HOMELAB mosaic-lane seat from `git.mosaicstack.dev` by provider read-back. Any unresolved seat HOLDS the fail-closed change; the implementation may not widen or restore shared fallback.
+16. `CRED-REQ-16`: Provider claims SHALL record the estate, instance, endpoint, asserted content type, and decision-relevant object fields. Append-only provider status history SHALL be reduced to latest-per-context where current state is required.
+
+### Acceptance criteria
+
+1. `AC-CRED-01`: Red-first tests prove unset identity, missing token, wrong estate, wrong host, wrong Tea login, and out-of-estate identity produce the same structured refusal class/reason on git and API resolution, with no shared credential read and no provider mutation.
+2. `AC-CRED-02`: Provisioning against a provider fixture proves Basic Auth is required, bearer-only token minting is refused, both identity axes are established together or every completed provider/token-store/Tea change is compensated and read back to the exact pre-operation state, and exact token scopes are read back from the provider token object. Injected Tea cleanup failure returns `indeterminate`/`rollback-incomplete` and cannot claim mutation `none`; no cross-system atomic commit is claimed. A second cooperating same-identity transaction is refused across caller-selected state roots. A code-level security-model assertion pins that advisory flock as cooperative serialization, provider authority as the authorization boundary, generation preconditions as optimistic protection for cooperating mutators rather than atomic CAS, and hostile same-UID filesystem mutation as explicitly deferred.
+3. `AC-CRED-03`: Direct and team grant tests read all applicable permission layers back from provider objects. Deliberately divergent token scope and repo grant cases cannot return `ok`; organization/team membership and team-repository attachment are additionally acceptance-bearing for team grants. A direct collaborator grant reports organization membership but does not require it, because direct collaborator permission and organization membership are intentionally independent provider layers.
+4. `AC-CRED-04`: Validate proves provider identity and the write differential on the intended repository through one credential handle. The subject is accepted, a separately resolved provider-confirmed read-only principal is refused, and an unauthenticated caller is refused in the same invocation. A shared/wrong-principal fallback, independent subject lookups, invalid read-only control, evidence disagreement, unexpected content type/shape, or provider outage returns `indeterminate`, never success or policy refusal. Runtime exact scope is reported independently as `not-measured` when the current seat credential is not authorized to read its provider token object; NOT-MEASURED is neither pass nor failure and does not erase confirmed repository capability. Exact scope is acceptance-bearing at provision/rotate time, where delegated mint authority can read the token object.
+5. `AC-CRED-05`: Audit/journal fault injection before and after each mutation proves write failure is fatal, open journals remain visible/recoverable, and no operation can claim success without a sealed journal and provider read-back. Protected credential output fault injection covers partial write, post-write append, and seal failure and preserves possibly-issued/applied truth in both DTO and durable journal.
+6. `AC-CRED-06`: Adversarial output/argv tests seed distinct secret values through success, refusal, provider-error, parser-error, rollback, rotate, and revoke paths and find zero secret/partial/fingerprint occurrences in stdout, stderr, logs, audit, and child argv.
+7. `AC-CRED-07`: Storage tests reject symlinked roots/files, non-regular files, permissive modes, traversal, stale generations from cooperating concurrent mutators, and production-store leakage into fixture tests. They do not claim atomic exclusion against hostile same-UID direct filesystem mutation. Existing canonical per-seat token consumers continue through the governed adapter.
+8. `AC-CRED-08`: `wire` repeated twice is byte-idempotent, produces both required identity-axis values in the exact roster-derived generated environment, survives a fresh fleet projection/restart path, and leaves shared linked-worktree git config untouched. An unauthenticated caller, a caller authenticated as another seat, a caller-selected filename, or a file whose roster identity differs is refused before mutation.
+9. `AC-CRED-09`: Rotate validates new identity/capabilities before retiring old material; injected failure leaves the previously valid credential usable and the journal open. Revoke is accepted only when provider read-back proves the credential no longer authenticates/authorizes.
+10. `AC-CRED-10`: Every live HOMELAB mosaic-lane seat resolves from `git.mosaicstack.dev` before the #1044 fallback closes. The evidence names the complete seat population, provider endpoint/content type, and unresolved count; non-zero unresolved count blocks landing.
+11. `AC-CRED-11`: Baseline typecheck/lint/format/tests, focused auth/permission abuse cases, independent code review, independent security review, and terminal-green HOMELAB Woodpecker CI pass on the exact reviewed head.
+12. `AC-CRED-12`: Interim delivery to `next` is reported only as **believed-fixed, pending validation AND pending promotion to `main`**. Issues stay open until #1037 promotes the work and constitutional completion is independently verified.
+
+### Constraints and dependencies
+
+- C1 install-state-machine work merges first. This lane then re-takes base/head-bound measurements without redesigning or reworking code.
+- MB-BRAIN-01 (#1051) consumes the grant/validate contract and may proceed against the published interface before implementation merge.
+- The branch-model compatibility question for `next` remains escalated. No `done` claim, issue closure, or self-initiated promotion is permitted at the `next` checkpoint.
+- `ASSUMPTION:` Phase-1 Gitea support is the only provider implementation in this slice; provider-neutral types preserve later adapters without pretending unimplemented providers are supported.
+
+---
+
 ## Architecture
 
 ### High-Level System Diagram

docs/credentials/GRANT-VALIDATE-CONTRACT.md

@@ -0,0 +1,204 @@
+# `mosaic cred grant` / `validate` caller contract v1.5
+
+**Status:** early binding contract for MC-CRED-01 and MB-BRAIN-01. v1.3's anonymous absence classifier was withdrawn as unsound for private users. v1.4 adopted subject-credential validation without admin visibility. v1.5 separates in-scope capability from identity measurement so correctly least-privileged tokens are not widened to service the instrument. This contract may evolve before implementation merge; incompatible changes require an explicit change notice.
+
+## Security model
+
+- Every call carries both `--estate` and `--host`. The configured estate-to-host mapping must match exactly. Host inference, host-adjacent fallback, and cross-estate resolution are forbidden.
+- `<identity>` is always explicit. The CLI never substitutes a pane, roster, login, Unix user, or other plausible ambient identity.
+- The identity token and the host-bound Tea login are one provisioning unit. Minting authority reads the principal back when the invariant is created and records that binding with the token registration. Runtime validation re-measures identity only when the token already holds `read:user`; it never widens scopes to make the instrument green.
+- Grant authority is broker/delegated-provisioner material. It is never supplied as a CLI value, environment value, or bearer token readable by the requesting agent. The broker obtains it from its protected runtime credential channel.
+- Commands never print token, password, authorization header, fingerprint, partial secret, or secret-bearing error text. Structured evidence contains provider object fields and endpoint metadata only.
+- Every operation opens and fsyncs a durable journal before the first mutation. Journal/audit write failure is fatal. A grant is successful only after provider read-back and a sealed journal.
+
+## Commands
+
+```text
+mosaic cred grant <identity> \
+  --estate <estate> \
+  --host <host> \
+  --repo <owner/repo> \
+  --permission <read|write|admin> \
+  [--via <collaborator|team>] \
+  [--team <team>] \
+  [--read-only-control <identity>] \
+  [--json]
+
+mosaic cred validate <identity> \
+  --estate <estate> \
+  --host <host> \
+  [--repo <owner/repo>] \
+  [--require <read|write|admin>] \
+  [--read-only-control <identity>] \
+  [--json]
+```
+
+Rules:
+
+- `--via collaborator` is the default. It grants a direct repository permission and still reports the organization-membership layer.
+- `--via team` requires `--team`; `--team` with collaborator mode is invalid.
+- `validate --repo` reports two independent axes: capability from an in-scope repository probe, and identity binding from `/user` only when authorized. Capability may be `confirmed` while identity is `not-measured`; NOT-MEASURED is neither pass nor failure.
+- Write validation requires a distinct known-read-only control identity, supplied explicitly or configured in the declared estate. The control identity and its read-only permission are read back from the provider on every invocation; the configured name alone is not evidence.
+- `grant` invokes the same validation after mutation. HTTP 2xx and process exit status are never acceptance evidence.
+
+## Machine result
+
+`--json` writes exactly one non-secret JSON object to stdout. Human diagnostics go to stderr. Callers must decide from `outcome`, never by parsing prose.
+
+```json
+{
+  "schemaVersion": 1,
+  "operation": "grant",
+  "outcome": "ok",
+  "exitCode": 0,
+  "retryable": false,
+  "subject": {
+    "identity": "seat-name",
+    "estate": "estate-name",
+    "host": "git.example.invalid",
+    "repo": "owner/repo"
+  },
+  "mutation": "applied",
+  "reason": {
+    "code": "grant-verified",
+    "message": "Grant matched all provider read-backs."
+  },
+  "evidence": {
+    "providerIdentity": {
+      "login": "seat-name",
+      "endpoint": "GET /api/v1/user",
+      "contentType": "application/json"
+    },
+    "tokenCapabilities": {
+      "state": "not-measured",
+      "scopes": [],
+      "source": "runtime-not-authorized"
+    },
+    "repositoryPermission": {
+      "requested": "write",
+      "effective": "write",
+      "endpoint": "GET /api/v1/repos/owner/repo",
+      "contentType": "application/json"
+    },
+    "organizationMembership": {
+      "state": "present"
+    },
+    "teamMembership": {
+      "state": "not-applicable"
+    },
+    "writeDifferential": {
+      "state": "can-write",
+      "credentialBinding": "same-resolution",
+      "transportPrincipal": "seat-name",
+      "authenticatedReceivePack": "advertised",
+      "readOnlyControl": {
+        "identity": "read-only-control",
+        "providerPermission": "read",
+        "receivePack": "refused"
+      },
+      "unauthenticatedReceivePack": "refused",
+      "artifactCreated": false,
+      "proves": "One immutable credential resolution authenticated both the subject identity read-back and write transport; a provider-confirmed read-only principal and an unauthenticated caller were both refused.",
+      "doesNotProve": "A particular ref update will pass branch protection, hooks, races, or content policy."
+    }
+  },
+  "audit": {
+    "journalId": "opaque-id",
+    "state": "sealed"
+  }
+}
+```
+
+Fields may be `null` only when their enclosing evidence state explains why. Missing decision-relevant fields make the result `indeterminate`, never `ok`.
+
+## Terminal classes
+
+| Outcome         | Exit | Meaning                                                                                                                                                                                                                                                                                                                                                          | Mutation guarantee                                                              | Caller action                                                                               |
+| --------------- | ---: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `ok`            |  `0` | Requested property was established from provider objects and all required layers agree.                                                                                                                                                                                                                                                                          | `validate`: `none`; `grant`: `applied` and read back.                           | Continue.                                                                                   |
+| `refused`       | `10` | A complete, authoritative policy/access decision denied the request. Examples: estate-host mismatch, missing explicit identity, provider identity mismatch, explicit permission denial, or cross-estate subject.                                                                                                                                                 | `none`; refusal occurs before mutation.                                         | Treat as a stable denial. Do not retry without changing authority/configuration.            |
+| `error`         | `20` | The command contract or local control failed before an access verdict. Examples: invalid arguments, malformed estate registry, insecure credential path, journal cannot be opened/fsynced, or internal invariant failure.                                                                                                                                        | `none` unless `mutation` explicitly says `unknown`; `unknown` is never success. | Repair the tool/configuration. Do not reinterpret as access denial.                         |
+| `indeterminate` | `30` | The requested security property could not be evaluated completely or evidence disagreed. Examples: provider unavailable, wrong content type/shape, permission and receive-pack disagreement, missing post-grant read-back, or unknown mutation acknowledgement. Runtime scope `not-measured` remains a separately reported axis and is neither pass nor failure. | `none`, `applied`, or `unknown`, stated explicitly. Never infer.                | Fail closed at the calling gate. Investigate/re-evaluate; do not label the subject refused. |
+
+Parsing/usage errors emitted by Commander remain exit `2` and do not produce a broker verdict. Callers should treat them as integration defects, not access decisions.
+
+## Refusal object
+
+A refusal is intentionally recognizable without prose:
+
+```json
+{
+  "schemaVersion": 1,
+  "operation": "validate",
+  "outcome": "refused",
+  "exitCode": 10,
+  "retryable": false,
+  "subject": {
+    "identity": "external-seat",
+    "estate": "homelab",
+    "host": "git.example.invalid",
+    "repo": "owner/repo"
+  },
+  "mutation": "none",
+  "reason": {
+    "code": "no-token-for-identity",
+    "message": "The explicit identity has no credential in the declared estate."
+  },
+  "evidence": {
+    "providerIdentity": null,
+    "tokenCapabilities": {
+      "state": "not-measured",
+      "scopes": [],
+      "source": "runtime-not-authorized"
+    },
+    "repositoryPermission": null,
+    "organizationMembership": null,
+    "teamMembership": null,
+    "writeDifferential": null
+  },
+  "audit": {
+    "journalId": "opaque-id",
+    "state": "sealed"
+  }
+}
+```
+
+The git credential helper and API resolver must map the same subject/estate/host failure to the same `reason.code` and terminal class. MB-BRAIN-01 may assert this parity. A caller does not need to know which resolver path was used.
+
+## Required reason codes
+
+Stable v1 codes:
+
+- refusal: `identity-required`, `estate-required`, `estate-host-mismatch`, `cross-estate-resolution`, `no-token-for-identity`, `tea-login-missing`, `tea-login-host-mismatch`, `provider-identity-mismatch`, `credential-rejected`, `permission-denied`, `organization-membership-required`, `team-membership-required`
+- error: `invalid-input`, `estate-registry-invalid`, `insecure-credential-source`, `journal-unavailable`, `internal-invariant`
+- indeterminate: `provider-unavailable`, `identity-not-visible`, `identity-not-measured`, `identity-not-found`, `unexpected-content-type`, `unexpected-provider-shape`, `scope-not-evaluable`, `permission-evidence-disagrees`, `transport-principal-mismatch`, `read-only-control-invalid`, `readback-missing`, `mutation-state-unknown`, `concurrent-mutation`, `mutation-lock-unavailable`, `mutation-lock-release-failed`, `team-scope-changed-during-grant`, `wire-audit-incomplete`
+
+`provider-unavailable` means no usable provider answer was available. `identity-not-measured` means `/user` was scope-forbidden while an in-scope repository probe confirmed the credential capability; it is `indeterminate` only for the identity axis and must not be represented as a dead credential. `identity-not-visible` and `identity-not-found` are reserved for the unimplemented external inventory capability. `credential-rejected` means the provider rejected the credential itself (Gitea 401), which is a stable `refused` outcome. A 403 on `/user` is not credential rejection when an in-scope probe succeeds.
+
+No anonymous or visibility-unprivileged 404 is admissible evidence of absence. `identity-not-found` requires, in the same invocation: (1) the visibility credential's own `/user` object read back as the configured authority with provider-admin visibility; (2) target lookup performed with that same authority; (3) a known-present PRIVATE control returning JSON 200 with matching login and `visibility=private`; and (4) a generated absent negative control returning JSON 404 under that same authority. Missing authority or any non-discriminating control yields `identity-not-visible`, never absence. A public positive control cannot certify private subjects.
+
+No currently implemented operation may emit `identity-not-found`: the required governed inventory capability was deliberately declined and runtime validation must not acquire standing admin visibility. For `validate`, `/user` 401 means `credential-rejected`; `/user` 403/404 triggers the in-scope capability probe and, when that succeeds, identity is `identity-not-measured`; JSON 200 with a mismatched login is a binding refusal. A future inventory operation must meet every precondition above and receive an explicit privilege decision before making `identity-not-found` reachable.
+
+Unknown future reason codes must still carry one of the four stable `outcome` values.
+
+## Side-effect-free write differential
+
+For Gitea v1, `validate --repo` resolves the subject credential exactly once into an immutable in-memory credential handle. The provider `/user` read-back, authenticated repository object, and Git smart-HTTP `git-receive-pack` advertisement all consume that same handle; callers may not perform independent lookups for those steps. The command also probes a separately resolved, provider-confirmed read-only control principal and repeats the request unauthenticated.
+
+`can-write` requires all of the following:
+
+1. provider `/user` login obtained with the subject credential handle equals `<identity>`;
+2. authenticated repository object obtained with that same handle reports write-capable permission;
+3. receive-pack obtained with that same handle returns the exact advertisement content type and protocol preamble;
+4. the transport evidence records the same declared principal as the identity read-back; any handle/principal seam disagreement is `transport-principal-mismatch` and therefore `indeterminate`, never refused;
+5. a distinct known-read-only credential resolves to its declared control identity, its provider repository object reports no write permission, and receive-pack is refused;
+6. the unauthenticated control is refused and does not return a receive-pack advertisement;
+7. estate, host, and repository in every request equal the declared subject.
+
+The read-only control varies the mechanism under accusation: principal selection. The unauthenticated arm remains as a separate control proving authentication is required; it cannot establish which principal authenticated the subject probe. A missing, write-capable, identity-mismatched, or otherwise invalid read-only control makes the result `indeterminate`.
+
+No ref is updated and no repository artifact is created. This proves that the declared subject credential—not merely some authenticated credential—can enter the write transport for that repository, while a provider-confirmed read-only principal and an unauthenticated caller cannot. It does not prove any specific branch update would survive branch protection, hooks, concurrent changes, or content policy.
+
+## Grant read-back
+
+A collaborator grant is accepted only when the provider returns the named collaborator permission and the subject credential independently reads the repository with matching effective permission. A team grant uses a same-UID-replaceable advisory lock to serialize cooperating `mosaic cred` mutations per provider team; this is optimistic coordination, not an authorization boundary or atomic CAS against direct filesystem mutation. Provider authority remains the authorization boundary. While holding that cooperative lock, the grant enumerates the team's complete repository attachment set both before and after mutation. It refuses before mutation when the team is already attached outside the one explicitly requested repository (`team-scope-exceeds-request`). If the post-mutation set is not exactly the requested repository, it returns `indeterminate` (`team-scope-changed-during-grant`) and compensates only state proven absent before the locked invocation: a newly introduced subject membership and/or requested repository attachment. Both compensations require provider absence read-back and are journaled; this is explicit all-or-verified-compensation behavior, not a cross-system atomic commit, and the operation never reports success from the stale pre-check. The grant then requires provider read-back of organization membership, team membership, team repository attachment, and effective subject permission. Token capability, repository permission, and organization/team role are reported as separate layers; no layer substitutes for another.

docs/design/prerelease-next-dist-tag-pipeline.md

@@ -1,63 +0,0 @@
-# npm `@next` prerelease lane
-
-Status: **IMPLEMENTED**
-
-## Current behavior
-
-`tools/install.sh --next` provides the prerelease integration lane for the permanent `next` branch.
-
-The lane is fast-by-default:
-
-1. Install framework files from the `next` source archive.
-2. Resolve the Gitea npm registry `next` dist-tag for the globally installed packages:
-
-   ```bash
-   npm view @mosaicstack/gateway@next version
-   npm view @mosaicstack/mosaic@next version
-   ```
-
-3. Require both resolved versions to share the same `next.<pipeline>` suffix, then install the exact resolved versions.
-4. If either `@next` package is missing, unreachable, mismatched, or fails to install, fall back to the source-build path at `next`.
-
-`--next` never hard-fails solely because the prerelease npm dist-tag is unavailable.
-
-## Published packages
-
-The `next` publish pipeline publishes non-private `@mosaicstack/*` packages to the Mosaic Gitea npm registry:
-
-```text
-https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
-```
-
-Observed `next` dist-tags after enabling the pipeline:
-
-```text
-@mosaicstack/mosaic@next  -> 0.0.49-next.1633
-@mosaicstack/gateway@next -> 0.0.7-next.1633
-```
-
-The gateway also publishes a Docker image as `gateway:sha-<short>` on `next` merges. The installer fast path uses the npm gateway package when available; the Docker image is for deployed gateway/runtime harness flows.
-
-## Explicit source lanes
-
-Source builds remain available and are still the authority for explicit ref validation:
-
-- `--dev` always builds from source.
-- `--ref <ref>` / `MOSAIC_REF=<ref>` wins over `--next` and uses the source path for that exact ref.
-
-## Pipeline shape
-
-1. Trigger on `next` merges.
-2. Compute the next prerelease version from the upcoming stable version plus the Woodpecker pipeline number (`<target-stable>-next.<CI_PIPELINE_NUMBER>`).
-3. Build and publish non-private packages in CI.
-4. Publish to the Mosaic Gitea npm registry with dist-tag `next`.
-5. Keep `latest` untouched; only main/release promotion can update `latest`.
-6. Publish gateway Docker images from `next` as `gateway:sha-<short>` only.
-
-## Guardrails
-
-- `@next` is mutable prerelease convenience, not a deployment pin.
-- Stable installs continue to use `@latest`.
-- Contributor validation remains available through `--dev --ref <branch>`.
-- Pipeline output traces every prerelease package back to the source commit on `next`.
-- The installer falls back to source rather than hard-failing on prerelease registry issues.

docs/guides/dev-guide.md

@@ -195,17 +195,6 @@ pnpm format:check && pnpm typecheck && pnpm lint
 
 A pre-push hook enforces this mechanically.
 
-### CI Publish Channels
-
-Woodpecker `.woodpecker/publish.yml` keeps stable and integration-line artifacts separate:
-
-| Source                            | npm packages                                                                                                  | Gateway image                                                                            |
-| --------------------------------- | ------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
-| `main` push/manual or release tag | committed package versions published to Gitea npm without changing the dist-tag workflow                      | `gateway:sha-<short>` plus `gateway:latest` on `main`, and the release tag on tag events |
-| `next` push/manual                | CI-computed prereleases, `<target-stable>-next.<CI_PIPELINE_NUMBER>`, published with `npm publish --tag next` | `gateway:sha-<short>` only                                                               |
-
-`next` never publishes npm `latest` or Docker `latest`. The next npm publish step verifies that `@mosaicstack/mosaic@next` resolves to the computed prerelease before the pipeline can pass.
-
 ---
 
 ## Adding New Agent Tools

docs/guides/user-guide.md

@@ -175,18 +175,8 @@ Or use the direct URL:
 bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
 ```
 
-The installer places the `mosaic` binary at `~/.npm-global/bin/mosaic`.
-
-Install lanes:
-
-| Lane                     | Command                               | Source                                                                                       |
-| ------------------------ | ------------------------------------- | -------------------------------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | npm `@mosaicstack/mosaic@latest` + `main`                                                    |
-| Prerelease integration   | `bash tools/install.sh --next`        | Fast npm `@mosaicstack/mosaic@next` + `@mosaicstack/gateway@next`; source fallback at `next` |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | Build-from-source at the requested ref                                                       |
-
-`--next` is fast-by-default from the Gitea npm `next` dist-tag and falls back to a source build at the permanent `next` branch if the dist-tag is missing or unreachable. Explicit `--ref` or `MOSAIC_REF` still wins and uses the source path.
-Flags for non-interactive use:
+The installer places the `mosaic` binary at `~/.npm-global/bin/mosaic`. Flags for
+non-interactive use:
 
 ```bash
 --yes               # Accept all defaults

docs/scratchpads/1019-zero-timeout-harness.md

@@ -0,0 +1,71 @@
+# #1019 — Zero-timeout queue-guard harness race
+
+- **Issue:** #1019 (parent status remains `believed-fixed, pending jarvis validation`; do not close)
+- **Branch:** `fix/1019-ci-queue-timeout-harness`
+- **Owner:** `be-coder-08`
+- **Base:** `origin/main` at `5916aeefd6ed12bcac086c6834c7f6c4ae38e1bc`
+- **Charter:** `/home/hermes/agent-work/tl-mosaic/CHARTER-1019-HARNESS-FIX.md`
+
+## Objective
+
+Make `test-ci-queue-wait-tristate.sh` deterministic without changing any asserted outcome. Remove the indiscriminate zero-timeout race, require every status-classification case to prove the provider was observed, and prove the harness-controlled virtual clock is active.
+
+## Scope
+
+- In scope: `packages/mosaic/framework/tools/git/test-ci-queue-wait-tristate.sh` only, plus this evidence scratchpad.
+- Out of scope: guard parsers, D2/D3 behavior, installer/reseed staleness, PR #1060, and issue closure.
+
+## Acceptance criteria
+
+1. RED deterministically reproduces deadline pre-emption before the provider call.
+2. Every case that intends status classification positively proves provider observation.
+3. Pending observes `pending` before deterministic virtual-time expiration.
+4. The virtual clock has a positive interception control; a broken-clock mutant makes the suite red.
+5. The exact CI-base image passes the final harness repeatedly with zero failures.
+6. Baseline gates, independent code/security review, exact-head CI, and coordinator-authorized squash merge pass.
+
+## Plan
+
+1. Add deterministic RED instrumentation for the known merge/provider-unreachable pre-emption.
+2. Replace global `-t 0` with a nonzero timeout interpreted under an event-driven virtual clock; stub sleep without wall waiting.
+3. Add provider-observation and virtual-clock positive controls without changing outcome assertions.
+4. Run focused shell checks, repeat in exact CI-base image, baseline gates, and independent reviews.
+5. Commit with both identity layers, queue-guard plus direct Woodpecker terminal-state verification, push, self-post PR, verify poster/head/CI, obtain coordinator merge authorization, then squash merge without closing #1019.
+
+## Budget
+
+- No explicit token cap supplied. Keep scope to one harness file and one scratchpad; stop/report at the charter's 60% context gate.
+
+## Evidence
+
+- RED, deterministic pre-provider expiry: `evidence/1019-harness-fix/red-pre-provider-expiry.log` — rc 1; merge/provider-unreachable got rc 124 instead of 75, omitted CANNOT_ASSERT, did not observe the status provider, and wrote no additional audit record (four named failures).
+- GREEN host focused harness: `evidence/1019-harness-fix/green-host.log` — rc 0, all outcome classes passed.
+- Load-bearing clock negative control: a temporary same-directory mutant replaced the virtual `date` body with `/bin/date`; `evidence/1019-harness-fix/red-clock-not-intercepted.log` — rc 1 with named `virtual clock interception did not run` failures. The mutant file was removed after the run.
+- Exact CI-base repeat: `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`, repository mounted read-only, harness work under container `/tmp`; `evidence/1019-harness-fix/ci-image-repeat/summary.log` — **100 pass / 0 fail / 100 total**.
+- Synchronization design: provider-status observation creates the event marker; virtual time is 1000 before the event and 1002 afterward. Pending alone reaches the stubbed no-op sleep and a post-observation deadline check. `-t 1` is uniquely load-bearing because removing it restores the 900-second default deadline at virtual time 1900, which 1002 does not cross. The numeric timeout is subject semantics under virtual time, not a wall-clock synchronization duration.
+
+## Review remediation — semantic timeout vs. liveness bound
+
+Security review found that virtual time remained at 1000 forever before provider observation and stubbed sleep never waited. A regression looping before the status endpoint—or blocking in the first provider call—therefore could prevent `run_guard` from returning, so the post-return provider assertion could never fire.
+
+**General rule:** A timeout usually serves two purposes: semantics and liveness. Removing wall time from semantic synchronization can silently remove the only independent hang bound. Preserve deterministic virtual time for subject semantics, but provide a separately implemented real-clock liveness watchdog and prove that watchdog fires.
+
+Remediation:
+
+- Every guard subject invocation is launched by absolute `/usr/bin/python3` in a new session. Python's internal monotonic `wait(timeout=...)` provides real-clock liveness independently of PATH; expiry kills the entire isolated process group, so neither PATH-front shims nor a blocked provider descendant can retain the capture pipe.
+- Watchdog expiry returns distinct harness rc 90 plus `FAIL HANG watchdog`, separate from subject timeout rc 124.
+- A first attempt using absolute `/usr/bin/timeout -s KILL` passed on GNU coreutils but failed in the exact Alpine CI-base image: BusyBox killed the immediate wrapper while the guard/provider descendants survived and retained the command-substitution pipe. The process-group kill is therefore required behavior, not portability polish.
+- A committed positive control hangs the branch-provider stub before the status endpoint. It must terminate through the watchdog, emit the hang-specific diagnostic, return rc 90, and prove the status provider was never reached.
+- RED before remediation: a temporary ordinary-success mutant hung before provider observation; only an external control could kill the suite (rc 137), and there was no internal hang-specific diagnostic (`red-watchdog-absent.log`).
+- The watchdog mutant/control is load-bearing: removing the internal watchdog leaves the control unable to produce its required rc 90 and diagnostic.
+
+Post-review evidence:
+
+- Host focused harness with process-group watchdog: rc 0 (`green-watchdog-process-group-host.log`).
+- Exact Alpine CI-base focused harness with process-group watchdog: rc 0 (`green-watchdog-ci-image.log`).
+- Hanging ordinary-success mutant: suite rc 1; success returned rc 90, emitted `FAIL HANG watchdog`, and loudly reported that provider/clock observation did not occur (`red-watchdog-fires.log`).
+- Removed-`-t 1` mutant: suite rc 1; pending was terminated by the watchdog instead of producing `ASSERTED_NOT_READY`, proving the explicit timeout is load-bearing (`red-timeout-argument-removed.log`).
+
+## 60% context hold
+
+Stopped before baseline/review/commit as required by the charter. Remaining: inspect final diff, shell/static/baseline gates, independent code/security review, remediation if any, identity-bound commit/trailer verification, mandatory queue guard plus direct terminal Woodpecker `mosaic` enumeration, push, self-posted PR/provider poster read-back, exact-head terminal-green CI, coordinator merge authorization, squash merge, main CI verification, and leave #1019 unclosed as `believed-fixed, pending jarvis validation`.

docs/scratchpads/1045-mosaic-cred.md

@@ -0,0 +1,110 @@
+# MC-CRED-01 / stack #1045 scratchpad
+
+Last updated: 2026-08-05
+
+## Successor remediation (`be-coder-07`, PR #1059 review id 89)
+
+Objective: close the four exact-head `rev-974` blockers without weakening any assertion, repair canonical-image test portability, and refresh the narrowed cooperative-concurrency claims and PR metadata. The provider-fetched starting head is `12958610cbafaa54a3db95327a7c3453d9111669` at merge-base `85d2108e4ed15c744ad3b87a5b629e7b2d39405a`.
+
+Plan:
+
+1. Preserve the journal-lock release assertion while replacing Alpine-invalid `/usr/bin/true` with canonical `/bin/true`.
+2. Replace cross-system atomicity claims with exact all-or-verified-compensation semantics; retain atomic wording only for explicitly scoped single-file rename/replacement primitives and qualify team locking as cooperative advisory serialization.
+3. Add red-first controls for complete journal writes under one-byte progress, rejection of zero/invalid progress, Tea generation equivalence under recursive key reorder, and durable indeterminate classification when team-lock release cannot be verified.
+4. Implement bounded journal write-all, recursive canonical generation serialization, and release-before-seal team-lock cleanup classification; then run focused and baseline gates plus code/security advisories.
+5. Commit with explicit `be-coder-07` identity, rebase rather than merge onto current `origin/main`, prove stable patch identity, run the required queue/direct-CI guards, and make one force-with-lease push pinned to the measured starting head.
+
+Budget: hard context ceiling is 60%. Reuse predecessor evidence and avoid re-deriving unrelated 41-file history. Non-blocking secret zeroization is included only after all blockers are green. Stop and write a seam/report before the ceiling.
+
+## Objective
+
+Deliver the governed `mosaic cred` identity boundary for issue, scope, validation, rotation, and revocation across explicitly declared estates. The trunk-only ruling superseded the original `next` checkpoint: the branch is rebased onto `origin/main` and its PR target is `main`. Linked issues remain **believed-fixed, pending jarvis validation** after merge.
+
+## Requirements sources
+
+- Charter: `/home/hermes/agent-work/tl-mosaic/CHARTER-MC-CRED-01-be-coder-06.md`
+- Stack issues: #1045, #1043, #1044, #1047, #1049, #1013, #1007; promotion #1037; consumer #1051
+- Remote spec: `jason.woltje/jarvis-brain` origin/main `b7687d51f4efe52e43dbcd6dc95b5554b3332957`
+- Greenfield PRD v3 addenda: INV-B durable journal, INV-C visible failure diagnostics, INV-D supported fixture
+- Binding doctrine: `/src/jarvis-brain/infra/fleet/FLEET-DOCTRINE.md`
+
+## Plan
+
+1. Publish grant/validate v1 caller contract for MB-BRAIN-01.
+2. Add repo PRD requirements and preregister acceptance tests.
+3. Implement explicit estate registry, secure current file-store adapter, durable operation journal/audit, provider transport, and terminal result types.
+4. Implement `grant` and side-effect-free `validate`; then provision/wire/get/whoami/list/rotate/revoke/audit.
+5. Make git and API resolver refusals identical and fail closed under fleet context.
+6. Reconcile live HOMELAB seats through each subject credential's own `/user`; #1044 hold is lifted, and its fail-closed change carries the pre-registered mechanism evidence (resolver refusal marker, same-run marker positive control, confirmed-lane negative arm).
+7. Run baseline/situational tests, independent code review and mandatory independent security review, CI on the exact head, then open the PR directly against `main` without closing issues or claiming Jarvis validation.
+8. C1 merges first. After any base/head move, re-derive merge-base, commit set, diff, CI, reviews, and provider measurements from the replacement SHA.
+
+## Budget
+
+No explicit token cap supplied. Working cap: keep implementation in one package plus shipped framework resolver changes and required docs/tests; avoid unrelated wrapper defect fixes and VaultWarden redesign. Escalate only if a charter requirement is technically unsatisfiable.
+
+## Decisions
+
+- VaultWarden is out for the agent tier per the charter verdict; phase 1 governs the existing per-identity file store.
+- Estate is explicit input and must match a configured host mapping; target host is never inferred from machine location.
+- Grant authority and basic-auth provisioning material are delegated control-plane credentials, never caller bearer material and never CLI argument/output.
+- `ok`, `refused`, `error`, and `indeterminate` are distinct machine outcomes. Security callers fail closed on all but `ok`, while retaining the semantic distinction.
+- Gitea write-differential resolves the subject once and binds provider identity, repository permission, and receive-pack to the same in-memory credential handle. It adds a distinct provider-confirmed read-only-principal control plus the unauthenticated control, with no ref update. The live HOMELAB negative-control subject is `tl-mosaic`, verified read-only on `mosaicstack/stack`; code and contract remain principal-agnostic.
+
+## Progress
+
+- [x] Mode/intake/core guides/skills/doctrine loaded.
+- [x] Spec repository READ confirmed under be-coder-06 from provider object.
+- [x] Target-branch conflict resolved by the trunk-only ruling; the lane was rebased from `next` onto `origin/main`.
+- [x] Canonical remote PRD v3 addenda re-read at new head.
+- [x] Required issues read via Mosaic wrapper.
+- [x] Early grant/validate contract v1 published at `docs/credentials/GRANT-VALIDATE-CONTRACT.md`.
+- [x] Contract v1.1 binds transport to the same resolved principal and adds a provider-confirmed read-only-principal control.
+- [x] Contract v1.2 distinguishes provider outage, absent identity, and rejected credential.
+- [x] Contract v1.3 positive-controlled anonymous visibility; subsequently withdrawn as unsound for private identities.
+- [x] Contract v1.4 implements ruling (b): subject credential's own `/user`, no admin/inventory authority, no implemented `identity-not-found` path.
+- [x] PRD update.
+- [x] Red-first principal-bound validate, estate-registry, file-store, provider-transport, and journal tests.
+- [x] Implementation: validate, direct/team grant, protected delegated authority, provision/wire/get/whoami/list/rotate/revoke/audit, reverse registry, and fleet fail-closed resolver paths.
+- [x] Review hardening: rotation returns visible open journals; team evidence records absent objects accurately; team scope is checked before/after under a host-qualified OS advisory lock with verified compensation; `wire` authenticates the exact seat/path/roster binding and preserves post-rename mutation semantics.
+- [x] Author advisory remediation: provisioning rollback verifies provider/token-store/Tea state and cannot suppress Tea cleanup failure; Tea put/remove always unlink secret-bearing temporary files; unrelated hosts exit before Mosaic identity grammar; `cred get` persists issuance start before disclosure, writes through a short-write-safe loop, and preserves partial/applied indeterminate semantics under write/append/seal faults; provision/rotate/revoke share a fixed cross-state-root lifecycle lock for cooperating processes only (provider authority is the authorization boundary; generation preconditions are optimistic for cooperating mutators; hostile same-UID filesystem mutation is explicitly deferred); Tea pre-state is snapshotted/restored independently; final journal seal faults revert to open classification.
+- [ ] Legacy-token estate binding is explicitly deferred: the legacy format contains no estate and the installed shell path has no distributed strict registry. Enabling refusal before registry distribution plus token-envelope migration would strand active legacy-only seats; governed envelopes already bind estate exactly.
+- [ ] Hostile same-UID direct filesystem mutation is explicitly deferred to #1065. The finding is copied verbatim there; PR #1059 links it. Phase 1 claims only optimistic generation preconditions and advisory locking for cooperating mutators, with provider authority as the authorization boundary.
+- [ ] Independent code/security approvals on the final exact head (Codex advisory iterations are not independent approval).
+- [ ] Final exact-head CI and provider evidence.
+
+## Tests and evidence
+
+Baseline after workspace build: package typecheck passed; Vitest 81/81 files and 1,514/1,514 tests passed. The package shell suite reached a pre-existing tracked #973 Bash 5.2 BASH_LINENO incompatibility and exited 97 before wake tests; this is baseline, not introduced by MC-CRED.
+
+Red-first evidence:
+- principal-bound validate module absent → focused suite red;
+- incremental v1.1 run: write-capable, identity-mismatched, and receive-pack-admitted read-only controls each returned `ok`, causing 3/13 tests to fail for the exact control defect; after the control checks, 13/13 passed;
+- read validation absent → 2 tests failed `evaluateGiteaReadValidation is not a function`; after implementation, 15/15 validate tests passed;
+- estate registry, secure file resolver, Gitea transport, and audit journal each failed first because the module did not exist, then passed focused behavior suites.
+
+Pre-remediation focused evidence: 80/80 across 11 credential/command suites; package lint, typecheck, formatting, and build were green. The advisory remediation adds thirty-five focused regression cases for rollback cleanup, Tea temporary-file cleanup, unsupported-host passthrough, and credential issuance partial-write/post-write-audit truthfulness; focused reruns are green (latest credential/command set: 109/109). Final uncommitted author advisories report code `approve` with no findings and security `none` with no findings; they remain advisory rather than independent approval. Full package Vitest reached 1,614 passing tests and three unrelated CLI-smoke failures caused solely by the installed-version update banner writing to stderr. Provider bodies are stream-bounded and requests deadline-bounded; delegated fd input is ownership/mode/size/time bounded; token and Tea stores are private and use atomic rename only for each explicitly scoped single-file replacement primitive; cross-system lifecycle completion uses verified compensation rather than an atomic-commit claim; grant mutation/read-back state is journaled.
+
+Fail-closed resolver evidence: synthetic missing-token API and git paths each emitted stable `MOSAIC_CREDENTIAL_REFUSAL` with `reason=no-token-for-identity` and `shared_path_entered=false`; all 13 live token-bearing identities bypassed the shared path without over-fire in the same run. Evidence: `/home/hermes/agent-work/be-coder-06/review-evidence/failclosed-postcondition.jsonl`; independent verification remains tl-mosaic's obligation.
+
+Live validation v1.4 (subject credential's own `/user`, no admin): population 13; CONFIRMED 8; CREDENTIAL-REJECTED 4 (`coder-mos1`, `coder-mos2`, `f10-coder`, `merge-gate`); MISMATCH 1 (`mos-admin` token authenticates as `Mos`); NOT-MEASURED 0. The four false v1.2 `identity-not-found` sealed journals remain immutable and are explicitly superseded by four sealed correction journals. Evidence: `/home/hermes/agent-work/be-coder-06/live-validation-v1.4/`.
+
+Write differential for be-coder-06 passed with the configured read-only control and unauthenticated arm. Unit evidence proves the control arm invalidates validation when write-capable, identity-mismatched, or receive-pack-admitted.
+
+## Successor review-remediation evidence
+
+- Canonical-image CI portability: `/usr/bin/true` was changed only to `/bin/true`; the second-process `flock` acquisition assertion remains `status === 0` and passes in the focused lifecycle suite.
+- Required red phase: five exact finding controls failed before implementation (journal one-byte/zero/oversized progress, recursively reordered Tea metadata, and lock-release failure). Review remediation added a sixth red control proving final-seal failure could compensate a later cooperating team mutation after lock release; a prototype-named Tea metadata control also failed before canonical object construction was hardened.
+- Focused final: 120/120 passed across all 11 credential and credential-command files.
+- Package lint and typecheck passed; dependency-aware workspace build passed 13/13 packages; repository format check and `git diff --check` passed; both git credential resolver shell regressions passed.
+- Full local package Vitest: 1,624 passed / 3 failed. The failures are the same installed-version update banner emitted to stderr by three `cli-smoke.spec.ts` cases; prior canonical pipeline #2223 ran all 22 CLI-smoke cases green. Exact-head canonical CI remains required after push.
+- First uncommitted advisories found a real post-release compensation race. Its red control observed one removal after lock release; the fix forbids compensation after successful release, and the control then passed without weakening an assertion.
+- Final uncommitted advisories: code `approve` with no findings; security risk `none` with no findings. Codex could not execute tests in its read-only sandbox (EROFS), so these verdicts rely on review only; the writable author runs above are the test evidence and independent reviewers remain required.
+
+## Risks/blockers
+
+- Hostile same-UID direct filesystem mutation is outside phase-1 and requires a transactional service, broker/distinct identity, or equivalent non-bypassable primitive; lifecycle flock and generation preconditions cover cooperating `mosaic cred` mutators only. Track the explicit security deferral linked from PR #1059.
+- The full CLI surface is broad; protect scope by sharing one provider/registry/journal core rather than per-command scripts.
+- Gitea exact token-scope read-back may require delegated Basic Auth. If a bearer-only validation path cannot obtain an exact provider token object, return `indeterminate` rather than claim a scope.
+- #1044 hold is LIFTED. The four least-privilege credentials are capability-confirmed and identity-not-measured, not dead. Fleet fail-closed paths now refuse with stable reason markers and never enter shared fallback under `MOSAIC_AGENT_NAME`; interactive callers retain explicit shared behavior. Runtime mismatch coverage remains limited to tokens holding `read:user`; future mints close identity binding at creation without widening seat scopes.
+- C1 PR #1054 remains sequencing-prior and requires its own exact-head gates. MC-CRED PR #1059 must freeze only after a new advisory review, independent review, and exact-head CI.

docs/scratchpads/462-fed-m3-06-get-verb.md

@@ -1,38 +0,0 @@
-# Scratchpad — FED-M3-06 get verb
-
-## Objective
-
-Implement `POST /api/federation/v1/get/:resource/:id` for M3 inbound federation reads.
-
-## Scope
-
-- `apps/gateway/src/federation/server/verbs/get.controller.ts`
-- `apps/gateway/src/federation/server/verbs/get-query.service.ts`
-- Unit coverage for controller pipeline + query service RBAC guardrails
-- Register controller/service in `FederationModule`
-
-## Plan
-
-1. Mirror the list verb pipeline: `FederationAuthGuard` → `FederationScopeService` → read-only query service.
-2. Return one `_source: "local"` tagged item on success.
-3. Return federation error envelopes:
-   - `404 not_found` when the resource id does not exist.
-   - `403 scope_violation` when the row exists but falls outside native RBAC/scope intersection.
-   - `400 invalid_request` for malformed ids/scope requests.
-4. Keep read audit persistence deferred to M4; no body or response persistence in M3.
-
-## Verification Evidence
-
-- Rebased onto `origin/main` at `86e106fcc9a1dfa3a18f7846bb477be128794aad` after M3-05 merged; resolved `FederationModule` by registering both list and get verb controllers/services.
-- Review-change coverage added for comment 15971:
-  - get note access now requires subject ownership AND authorized mission intersection.
-  - missing federation context returns structured `401 unauthorized` envelope.
-  - unsupported get resources fail closed with structured denial.
-  - PGlite regressions cover cross-user note exclusion and subject-note unauthorized-mission exclusion.
-- `pnpm --filter @mosaicstack/gateway test -- src/federation/server/verbs/__tests__/get.controller.spec.ts src/federation/server/verbs/__tests__/get-query.service.spec.ts` — pass (2 files / 17 tests; re-run after review changes).
-- `pnpm --filter @mosaicstack/gateway build` — pass (re-run after review changes).
-- `pnpm build` — pass (23 successful tasks before review changes).
-- `pnpm typecheck` — pass (41 successful tasks; re-run after review changes).
-- `pnpm lint` — pass (23 successful tasks; re-run after review changes).
-- `pnpm format:check` — pass (re-run after review changes).
-- `~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` — approve, 0 findings after review changes.

docs/scratchpads/B1-next-durable-publish-design.md

@@ -1,82 +0,0 @@
-# B1 / @next Durable Publish Pipeline — Design
-
-## Objective
-
-Make `next` a durable integration line that publishes the artifacts required by downstream federation boot tests without manual builds.
-
-Every merge to `next` publishes:
-
-1. **npm prerelease packages** to the Gitea npm registry with dist-tag `next`.
-2. **Gateway container image** tagged only as `gateway:sha-<short>`.
-
-The existing stable release behavior remains isolated to `main` / tags.
-
-## Registry verification
-
-Target registry: `https://git.mosaicstack.dev/api/packages/mosaicstack/npm/`.
-
-Pre-implementation checks:
-
-- `npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json` returned a dist-tags object (`latest: 0.0.48`).
-- `npm view @mosaicstack/mosaic@latest version --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/` resolved `0.0.48`.
-- `@next` currently returns 404 because no `next` dist-tag exists yet; this is expected before the first next prerelease publish.
-
-Pipeline design includes a post-publish verification that `npm view @mosaicstack/mosaic@next version` resolves to the exact CI-computed prerelease version. If Gitea fails to honor the `next` dist-tag, the pipeline fails closed.
-
-## Version scheme
-
-The prerelease version is computed at publish time only; no `package.json` version changes are committed.
-
-For each non-private `@mosaicstack/*` package:
-
-```text
-<target-stable>-next.<CI_PIPELINE_NUMBER>
-```
-
-Where:
-
-- `CI_PIPELINE_NUMBER` is Woodpecker's monotonic pipeline number.
-- `target-stable` is the package's current committed stable version with the patch component incremented.
-  - Example: `@mosaicstack/mosaic` `0.0.48` publishes as `0.0.49-next.1626`.
-  - Example: `@mosaicstack/gateway` `0.0.6` publishes as `0.0.7-next.1626`.
-
-Rationale:
-
-- npm semver sorts `0.0.49-next.1627` above `0.0.49-next.1626`.
-- The prerelease does not overtake the future stable `0.0.49`.
-- The monotonic pipeline number avoids conflicts across repeated `next` merges.
-
-## Branch and tag guardrails
-
-| Pipeline path         | Branch/event                   | Publishes                                               | Forbidden              |
-| --------------------- | ------------------------------ | ------------------------------------------------------- | ---------------------- |
-| stable npm publish    | `main` push/manual or tag      | package versions already committed in package manifests | `@next` dist-tag       |
-| next npm publish      | `next` push/manual only        | CI-computed prereleases with `--tag next`               | `latest` dist-tag      |
-| gateway image         | `main` push/manual or tag      | `sha-<short>` + `latest` on main + tag on tag events    | next prerelease npm    |
-| gateway image         | `next` push/manual only        | `sha-<short>` only                                      | `latest`               |
-| appservice/web images | `main` push/manual or tag only | existing stable image behavior                          | next image publication |
-
-The pipeline has explicit branch checks inside the publish commands as a second fail-closed layer beyond Woodpecker `when` clauses.
-
-## Implementation plan
-
-1. Widen `.woodpecker/publish.yml` top-level `when` to include `next` so the publish pipeline runs on next merges.
-2. Keep existing `publish-npm` on `main` / tags only.
-3. Add `publish-next-npm` for `next` push/manual only:
-   - configure Gitea npm auth from existing `gitea_token` secret as `NPM_TOKEN`;
-   - preflight registry dist-tag metadata;
-   - compute prerelease versions in CI by temporarily editing package manifests in the workspace;
-   - run `pnpm publish ... --tag next` against non-private `@mosaicstack/*` packages;
-   - verify `@mosaicstack/mosaic@next` resolves to the computed version.
-4. Split image `when` anchors:
-   - `image_build_when` includes `next` and is used by `build-gateway`;
-   - `main_image_build_when` keeps appservice/web on main/tags only.
-5. Keep gateway next image destinations to `sha-<short>` only; no `latest` on next.
-
-## Risk controls
-
-- Auth/registry failures are fatal.
-- No manual image build/push path is introduced.
-- No production `latest` tags are touched from `next`.
-- No `@latest` npm dist-tags are touched from `next`.
-- All changes live in CI config and docs; no runtime source behavior changes.

docs/scratchpads/B2-skills-sync-path.md

@@ -1,34 +0,0 @@
-# B2 — Fresh-install skills sync path
-
-## Problem
-
-Greenfield wizard on `next` reported:
-
-```text
-Skills sync script not found at ~/.config/mosaic/bin/mosaic-sync-skills
-Skills: install failed
-```
-
-## Diagnosis
-
-The framework install migration removed the legacy `~/.config/mosaic/bin/` directory and now installs framework helper scripts under:
-
-```text
-~/.config/mosaic/tools/_scripts/
-```
-
-`packages/mosaic/src/stages/finalize.ts` still resolved wizard helper scripts from `mosaicHome/bin`, so wizard-selected skills failed even though `mosaic-sync-skills` was present in the current framework layout.
-
-## Fix
-
-- Resolve framework helper scripts through `tools/_scripts/<name>` first.
-- Keep a legacy `bin/<name>` fallback for pre-migration installs.
-- Point missing-script warnings at the current `tools/_scripts` layout.
-- Update the finalize skills test fixture to model the fresh framework layout.
-- Update framework README examples from legacy `bin/` helper paths to `tools/_scripts/`.
-
-## Verification
-
-- Unit: `pnpm --filter @mosaicstack/mosaic test -- finalize-skills`
-- Gates: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, `pnpm build`
-- Fresh path: ran `packages/mosaic/framework/install.sh` with a temp `MOSAIC_HOME` and `MOSAIC_SYNC_ONLY=1`; verified `tools/_scripts/mosaic-sync-skills` exists, legacy `bin/mosaic-sync-skills` does not, and the script installs a selected fake `lint` skill into Mosaic + Pi runtime skill directories.

docs/scratchpads/B3-wizard-gateway-health-order.md

@@ -1,36 +0,0 @@
-# B3 — Wizard completion ordering
-
-## Problem
-
-The wizard printed the success summary / `Mosaic is ready.` during `finalizeStage`, before the gateway configuration stage had completed its daemon health check. If the gateway health gate later failed, the user could see a success claim followed by a gateway failure.
-
-## Diagnosis
-
-`finalizeStage` handled both mutation work and terminal success messaging. Wizard paths then ran `gatewayConfigStage` and `gatewayBootstrapStage` afterward:
-
-1. finalize writes config, links runtime assets, syncs skills, runs doctor;
-2. finalize prints `Installation Summary` + `Mosaic is ready.`;
-3. gateway config starts/waits for daemon health;
-4. gateway bootstrap runs.
-
-The summary needed to be deferred until after the gateway readiness gates.
-
-## Fix
-
-- `finalizeStage` now returns a `showSummary()` callback and supports `deferSummary`.
-- Wizard/quick-start paths call finalize with `deferSummary: true`.
-- `showSummary()` is called only after gateway config reports ready and bootstrap completes, or immediately when the caller explicitly skips gateway setup.
-- If gateway health/config reports not ready, the wizard returns/aborts without printing the success summary.
-- Folded in adjacent runtime install hint fix for Pi: `curl -fsSL https://pi.dev/install.sh | sh`.
-
-## Verification
-
-- Added unified-wizard coverage for summary-after-health and no-summary-on-health-failure.
-- Targeted: `pnpm --filter @mosaicstack/mosaic test -- unified-wizard finalize-skills`
-- `pnpm format:check`
-- `pnpm typecheck`
-- `pnpm lint`
-- `pnpm build`
-- `pnpm test`
-- Codex code review: approve.
-- Codex security review: one low finding on the requested Pi `curl | sh` install hint; no security finding in the wizard completion-ordering change.

docs/scratchpads/B4-wizard-step-dedup.md

@@ -1,36 +0,0 @@
-# B4 — Wizard step deduplication
-
-## Problem
-
-Greenfield wizard testing showed completed wizard steps could be executed again after the menu marked them `[done]`. In practice this made the Providers/API-key flow and Skills flow appear twice in one wizard run.
-
-There was a second related API-key duplication path: when the Providers step was completed with no key, `gatewayConfigStage` still prompted for `ANTHROPIC_API_KEY` during Finish because it only skipped the gateway API-key prompt when `providerKey` was non-empty.
-
-## Diagnosis
-
-- `runMenuLoop` labeled completed sections with `[done]`, but still dispatched the selected step again if the user selected that row.
-- Quick Start ran Providers and Skills but did not mark those sections complete in `completedSections`.
-- `runFinishPath`/`quickStartPath` defaulted `providerType` to `none` for gateway config, which made it impossible for `gatewayConfigStage` to distinguish:
-  - provider step completed and user intentionally skipped the key, vs.
-  - provider step was never run.
-
-## Fix
-
-- Added a shared menu section key helper and a completed-step guard in `runMenuLoop`.
-- Completed menu steps now log a skip message instead of re-running their stage.
-- Quick Start marks Providers and Skills complete after running them.
-- Finish/Quick Start now pass `state.providerType` as-is to gateway config instead of defaulting to `none`.
-- `gatewayConfigStage` treats `providerType: 'none'` as an explicit completed provider setup with no key and skips the second gateway API-key prompt.
-
-## Verification
-
-- Added unified wizard regression coverage asserting repeated Providers/Skills menu selections only execute each stage once.
-- Added gateway config coverage asserting `providerType: 'none'` does not prompt for a gateway API key and writes no API key env var.
-- Targeted: `pnpm --filter @mosaicstack/mosaic test -- unified-wizard gateway-config`
-- `pnpm format:check`
-- `pnpm typecheck`
-- `pnpm lint`
-- `pnpm build`
-- `pnpm test`
-- Codex code review: approve.
-- Codex security review: no findings.

docs/scratchpads/FED-M3-10-integration-tests.md

@@ -1,60 +0,0 @@
-# FED-M3-10 — Federation M3 Integration Tests
-
-## Objective
-
-Add single-gateway gateway integration tests for M3 acceptance #6 and #7.
-
-## Branch / base
-
-- Branch: `feat/federation-m3-integration`
-- Base: `origin/next` (`838701bd` after M3-06/#683 merge)
-- PR base when unblocked: `next`
-
-## Scope
-
-- Real PostgreSQL via `@mosaicstack/db`.
-- Mocked TLS context / Fastify request shim for `FederationAuthGuard`.
-- Direct controller calls using the real M3 route contract: `POST /api/federation/v1/list/:resource` with body `{ limit?, cursor? }`.
-- Gated by `FEDERATED_INTEGRATION=1`.
-- No federation harness dependency.
-
-## Fixture notes
-
-Aligned with the B2 seed design vocabulary:
-
-- `tasks` visibility uses personal `projects` + `missions` chain.
-- `notes` are `mission_tasks.notes`; the integration suite asserts subject-only note visibility on an authorized mission.
-- Seed includes a second user and unauthorized team/project tasks to prove exclusion from the max-row-cap list result.
-- Grants/peers are direct DB fixtures; cert auth still runs through `FederationAuthGuard` using real X.509 certs generated by existing test helpers.
-
-## Current implementation
-
-Added `apps/gateway/src/__tests__/integration/federation-m3-list.integration.test.ts` covering:
-
-1. M3 #6 — cert missing Mosaic OIDs returns 401 federation `unauthorized` envelope.
-2. M3 #6 — valid cert whose grant row is `revoked` returns 403 federation `forbidden` envelope.
-3. M3 #7 — active grant with `max_rows_per_query: 2` caps `list tasks`, returns `_truncated` + `nextCursor`, source-tags rows, and excludes other-user / unauthorized-team tasks.
-4. Cross-user notes invariant — subject can list their own `mission_tasks.notes` row while another user's note on the same authorized mission is excluded.
-5. Unsupported-resource invariant — `list widgets` fails closed with a federation `scope_violation` envelope.
-
-## Verification
-
-- `pnpm --filter @mosaicstack/types build` — PASS.
-- `pnpm --filter @mosaicstack/db build` — PASS.
-- `pnpm --filter @mosaicstack/storage build` — PASS.
-- `pnpm --filter @mosaicstack/brain build` — PASS.
-- `pnpm --filter @mosaicstack/queue build` — PASS.
-- `pnpm --filter @mosaicstack/config build` — PASS.
-- `pnpm --filter @mosaicstack/auth build` — PASS.
-- `pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts` — PASS skipped when `FEDERATED_INTEGRATION` unset (5 skipped).
-- `FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- src/__tests__/integration/federation-m3-list.integration.test.ts` — PASS (5 tests) after local `docker compose up -d postgres` + `pnpm --filter @mosaicstack/db db:push`.
-- `pnpm --filter @mosaicstack/gateway typecheck` — PASS.
-- `pnpm --filter @mosaicstack/gateway lint` — PASS.
-- `pnpm format:check` — PASS.
-- `~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` — PASS; approve, no findings.
-- `~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted` — PASS; risk level none, no findings.
-
-## Push / PR
-
-- #683 landed in `next`; branch rebased onto `origin/next` before push.
-- CI is serialized; run queue guard before push.

docs/scratchpads/installer-next-fast-npm-20260625.md

@@ -1,40 +0,0 @@
-# Installer `--next` fast npm lane — 2026-06-25
-
-## Scope
-
-Flip `tools/install.sh --next` from source-build-first to fast npm `@next` first, with source fallback.
-
-## Registry reality check
-
-Gitea npm registry: `https://git.mosaicstack.dev/api/packages/mosaicstack/npm/`
-
-Verified before implementation:
-
-- `@mosaicstack/mosaic@next` resolves to `0.0.49-next.1633`.
-- `@mosaicstack/gateway@next` resolves to `0.0.7-next.1633`.
-- `@mosaicstack/gateway` dist-tags include `latest: 0.0.6` and `next: 0.0.7-next.1633`.
-- `apps/gateway/package.json` is non-private and has Gitea npm `publishConfig`.
-
-Conclusion: the installer can fast-install both CLI and gateway npm packages for `--next`. The gateway Docker `gateway:sha-<short>` remains the deployment/harness artifact; the npm gateway package is valid for the installer global package path.
-
-## Behavior
-
-- `--next` with no explicit ref:
-  1. framework archive from `next`;
-  2. resolve `@mosaicstack/gateway@next` and `@mosaicstack/mosaic@next`;
-  3. require both resolved versions to share the same `next.<pipeline>` suffix;
-  4. install the exact resolved package versions;
-  5. set `MOSAIC_GATEWAY_SKIP_NPM_INSTALL=1` so wizard does not overwrite the prerelease gateway;
-  6. if either package is missing/unreachable/mismatched/fails, fall back to existing source build at `next`.
-- `--dev` remains pure source build.
-- explicit `--ref` / `MOSAIC_REF` still wins over `--next` and uses the source path for that exact ref.
-
-## Install detail
-
-The installer writes the scoped npmrc mapping (`@mosaicstack:registry=...`) and then runs npm install without overriding npm's default registry. Passing `--registry=<gitea>` to `npm install` forces public transitive dependencies (for example `@anthropic-ai/sdk`) to resolve from Gitea and breaks the fast path; the scoped npmrc mapping is the correct split-registry behavior.
-
-## Verification notes
-
-- Added `tools/install-next-lane.test.sh` with a fake npm/source harness for exact-version fast install, registry failure source fallback, explicit-ref precedence, and mismatched suffix warning.
-- Wired the installer harness into `pnpm test` via `pnpm run test:installer`.
-- Real temp-prefix fast install succeeded with `@mosaicstack/[email protected]` and `@mosaicstack/[email protected]`.

docs/scratchpads/installer-next-lane-20260624.md

@@ -1,35 +0,0 @@
-# Scratchpad — installer `--next` lane
-
-## Objective
-
-Add a prerelease installer lane for the permanent `next` integration branch.
-
-## Scope
-
-- `tools/install.sh`
-- README/install documentation
-- Follow-up design note for future npm `@next` prerelease publishing
-
-## Plan
-
-1. Add `--next` and `MOSAIC_NEXT=1` as source-build shorthand for `next`.
-2. Preserve explicit ref precedence: `MOSAIC_REF` and `--ref` win over `--next`.
-3. Update installer source display/help text.
-4. Document three lanes:
-   - stable npm `@latest`
-   - prerelease `--next`
-   - contributor `--dev --ref X`
-5. Run shell and repo gates locally, then hold before push/PR until runner serialization greenlight.
-
-## Verification
-
-- `bash -n tools/install.sh` — pass.
-- `docker run --rm -v "$PWD:/mnt" -w /mnt koalaman/shellcheck:stable tools/install.sh` — pass.
-- `bash tools/install.sh --check --framework --next` — source display shows `ref: next, --next prerelease lane`.
-- `bash tools/install.sh --check --cli --next --ref feature-x` — source display shows explicit ref wins.
-- `MOSAIC_NEXT=1 MOSAIC_REF=feature-env bash tools/install.sh --check --cli` — source display shows explicit env ref wins.
-- `pnpm install --frozen-lockfile --prefer-offline --store-dir /home/jarvis/.local/share/pnpm/store` — pass (local override for repo `.npmrc` CI store path).
-- `pnpm typecheck` — pass (41 successful tasks).
-- `pnpm lint` — pass (23 successful tasks).
-- `pnpm format:check` — pass.
-- `bash tools/e2e-install-test.sh` — attempted; current baseline fails during gateway health after stable registry install because Valkey is unavailable in the clean container. The `tools/install.sh --yes --no-auto-launch` stage itself completed before the downstream gateway verification failure.

docs/scratchpads/webui-fleet-bridge-plan.md

@@ -1,114 +0,0 @@
-# WebUI Fleet Bridge Planning Scratchpad
-
-**Mode:** Task 0 docs-only decision PR authorized; Task 1 and all executable/runtime work remain blocked.
-**Owner:** Velma
-**Opened:** 2026-08-09
-**Scope:** One enrolled Agent Host launching one native `mosaic claude` OAuth session and streaming it into `apps/web` through `apps/gateway`.
-
-## Objective
-
-Turn the approved direction in `jarvis-brain/docs/scratchpads/MOSAIC-WEBUI-FLEET-BRIDGE.md` into a test-first implementation plan while preserving Fred's harness-home/launcher contract and Scooby's greenfield safety findings.
-
-## Source reconciliation
-
-- Current `origin/main`: `b0f7d26dd9c14d91eaaefc35d6c9fd6618a0bd92`.
-- Current `origin/next`: `4df478cdd150fdf8d52ea109f02ade5d85017acd`.
-- Branches currently diverge (`main` has 11 unique commits; `next` has 13). `next` contains local-tier Redis fix #689; `main` contains later fleet/shell fixes.
-- Fred's three-root harness-home design and promotion stack are not yet fully present on either baseline.
-- Therefore neither current SHA is an acceptable implementation pin. Code may begin only from a Fred-certified reconciled SHA containing the required launcher/home contract and safe Gateway startup prerequisites.
-- The deployed `mosaic.woltje.com` v0.0.20 UI remains reference-only.
-
-## Verified seams
-
-- Current browser chat uses an in-process Pi SDK session.
-- `AgentRuntimeProvider` supports list/tree/stream/send/attach/detach/terminate, but not create/start.
-- `InteractionController` enrolls an already-existing runtime session; it cannot launch one.
-- Hermes is the only runtime provider registered in Gateway.
-- Tmux streaming is explicitly unsupported and remains out of scope.
-- `mosaic claude` is the authoritative launcher and accepts Claude's machine-facing stream-json flags.
-- Installed discovery version: Claude Code 2.1.226. Target Distrobox version must be independently pinned and certified.
-
-## Non-negotiable dependencies
-
-1. Fred approves the machine-facing launcher/seat-home contract before code.
-2. No WebUI/Gateway direct read of lease broker state, daemon socket, or state files (F-V3).
-3. No provider OAuth token leaves the Agent Host.
-4. No local Gateway/Web startup around the KBN/database hold.
-5. Greenfield work runs in a Debian Distrobox with an isolated home.
-6. The initial plan PR targets `next`; Fred binds D1–D15 on its exact head before issue/PRD/tracker completion or implementation work.
-
-## Reproducible evidence
-
-Run from a clean Stack clone:
-
-```bash
-git fetch origin main next
-git rev-parse origin/main origin/next
-git rev-list --left-right --count origin/main...origin/next
-rg -n "interface AgentRuntimeProvider|createSession|streamEvents|terminate" \
-  packages/types/src/agent packages/agent/src apps/gateway/src/agent
-rg -n "AgentService\.prompt|interaction_sessions|createRuntimeTerminationApproval" \
-  apps/gateway/src packages/db/src/schema.ts
-```
-
-Primary inspected source seams:
-
-- `packages/types/src/agent/agent-runtime-provider.ts`
-- `packages/agent/src/{runtime-provider-registry,hermes-runtime-provider,matrix-native-runtime-provider,tmux-fleet-runtime-provider}.ts`
-- `apps/gateway/src/agent/{runtime-provider-registry.service,interaction.controller,durable-session.repository,durable-session.service}.ts`
-- `apps/gateway/src/chat/chat.gateway.ts`
-- `packages/mosaic/src/commands/{launch,interaction}.ts`
-- `packages/mosaic/src/fleet/generated-env-boundary.ts`
-- `packages/db/src/schema.ts`
-- `apps/web/src/app/(dashboard)/chat/page.tsx`
-
-Planning-only investigation transcripts are local and intentionally uncommitted:
-
-- `/tmp/velma-plan-stack-surface.txt`
-- `/tmp/velma-plan-structure.txt`
-- `/tmp/velma-plan-scooby.txt`
-- `/tmp/velma-plan-runtime-contract.txt`
-
-## Source findings that constrain the design
-
-- `interaction_sessions.id` is the stable primary key; there are no create/policy/enrollment/state columns.
-- `interaction_outbox` has a unique `(session_id, idempotency_key)` index and only `pending | processing | delivered`.
-- Baseline `DurableSessionRepository.create()` can replace provider/runtime identity for the same owner; M1 must remove that implicit mutation.
-- Baseline termination approval is Redis-backed and currently consumes separately from PostgreSQL; M1 therefore needs durable authorization acceptance before destructive token deletion/dispatch.
-- Existing interaction HTTP base is `/api/interaction/:agentName`; the plan extends it rather than inventing a second route family.
-- Baseline `launch.ts`/lease launcher still use ambient lookup/literal interpreters. Section 4.1 is non-binding consumer input to Fred's W-F design; W-F's final resolved-launch contract must exist in the certified base before Velma can certify it.
-- Root `pnpm test` is not KBN-safe: it includes PGlite migration and framework-shell/lease-broker suites.
-
-## Independent draft review
-
-Seven adversarial review rounds found and drove explicit fixes for:
-
-- a candidate resolved-seat consumer descriptor and threat model, now explicitly non-binding input to Fred's W-F-owned launcher design;
-- one active launch per stable conversation, exact pending/failed encodings, durable pre-dispatch reservation, CAS activation, and crash lookup without a migration;
-- generation-bound enrollment, command/event revalidation, `SIGHUP` config epochs, and stale-epoch rejection;
-- Redis/PostgreSQL exact-stop crash safety via non-destructive verify, durable authorization acceptance, atomic claim/`GETDEL`, and same-operation status reconciliation;
-- sequence gaps/reorder limits, deterministic UUIDv5 completion, and Gateway restart fail-closed behavior;
-- shared streaming redaction before host ring/transport and again before Gateway persistence/browser;
-- D2/D12-selected path-free provenance and a separate safe browser DTO—never raw or hashed path strings;
-- exact F-V3 boundary: bridge has no broker API, while Fred's sealed launcher may enforce broker policy internally;
-- migration-free focused tests in Tasks 1–8, with live OAuth, repository transaction, Gateway/Web, and Playwright restricted to the Fred/Scooby-certified Task 9 path;
-- candidate private/public commitment and artifact-binding mechanisms that W-F may accept, simplify, replace, or defer;
-- JCS event-digest recomputation and equal/different duplicate handling in both accepted and future-buffer states;
-- a safe browser presentation DTO for host/workspace/seat/persona labels, readiness, and connection state;
-- explicit `OnApplicationBootstrap` create/stop recovery enumeration with no auto-launch;
-- all POSIX/Windows/UNC/file/tilde path classes in the streaming redactor and definitive failed-stop response semantics;
-- the full 14-column canonical task schema, fake-only Task 5 repository tests, migration-free certified Task 9 DB test, server-owned operation correlations/routes, and exact merged-SHA smoke;
-- per-commit independent review, queue guards, exact-head PR review, squash merge, exact merged-next SHA/CI wait, worktree-bound smoke, issue-state readback, and reviewed tracker-closure PR with its own merged-next CI;
-- a private DB URL loader captured/exported per session without recording or echoing the credential;
-- an attached Task 9 implementation branch, provider-filtered exact issue-state readback, and machine-verified smoke JSON binding source/worktree/deployed SHA;
-- a capped, duplicate-key-rejecting, exact-key/type smoke schema so report extensions or JSON boolean/float coercion cannot smuggle data or fake child-count evidence.
-
-The plan remains deliberately **decision-PR-ready, not implementation-ready**. Fred authorized only Task 0's initial two-document PR on `next`. He must still return every Section 2 value, replace all `[FRED-GATE]` entries, certify storage/startup, and provide the W-F-dependent `IMPLEMENTATION_BASE_SHA` before Task 0 closes or Task 1 starts.
-
-## Current status
-
-- Gitea principal verified as `velma`; helper and API wrapper resolution are fail-closed and correct.
-- Fred authorized the initial Task 0 docs-only PR in `comms/20260809T094952Z__from-fred__ec0e85.md` and confirmed its `next` lane/W-F descriptor corrections in `comms/20260809T095437Z__from-fred__4ee79d.md`.
-- Provisional decisions: D1/D8/D9/D10/D13/D14 approved; D4 tool labels exactly `{Read, Grep, Glob}`; D5/D12 provisional; D11 remains a single-operator seam; D2/D3/D6/D7 and `IMPLEMENTATION_BASE_SHA` are `BLOCKED-ON-W-F`.
-- Awaiting exact plan-PR-head review and Fred's complete D1–D15 binding contract.
-- No source code, database, deployment, or live runtime changes made.

docs/scratchpads/webui-p2-data-auth.md

@@ -1,172 +0,0 @@
-# WebUI Phase P — P2 Data + Auth Scratchpad
-
-**Task ID:** WEBUI-P2
-**Tracking ref:** stacked on PR #1143 (`feat/webui-p1-vite-skeleton`); no separate issue specified in the author brief
-**Branch:** `feat/webui-p2-data-auth`
-**Started:** 2026-08-09
-**Role:** P2 author worker (must not modify `docs/TASKS.md`)
-
-## Original tasking
-
-> Read `/home/jwoltje/briefs/P2-brief.md` and execute it fully in `/home/jwoltje/src/stack-p1` on branch `feat/webui-p2-data-auth`. Run every listed verification gate, commit locally only, and do not push.
-
-Container path mapping:
-
-- Brief: `/home/jwoltje/distrobox-homes/mosaic-dev/briefs/P2-brief.md`
-- Repo: `/home/jwoltje/distrobox-homes/mosaic-dev/src/stack-p1`
-
-## Objective
-
-Make the P1 Vite SPA authenticate against the Mosaic Gateway by same-origin relative paths, replace guest-route placeholders with real login/register/SSO callback pages, and enforce guest/authenticated route guards without modifying the parallel Next app tree except for unavoidable shared-library import fixes.
-
-## Scope and invariants
-
-- All SPA HTTP and Socket.IO access remains origin-relative (`/api/...`, `/api/auth/...`, `/chat`).
-- No `NEXT_PUBLIC_*`, `VITE_*` origin setting, or hard-coded `http://localhost:14242` under `apps/web/src/`.
-- Verify the Gateway BetterAuth mount path from source before choosing auth-client configuration.
-- Delete the legacy static SSO-provider discovery module and test; runtime `/api/sso/providers` is canonical.
-- Preserve the Next build while adding React Router guest pages and session guards.
-- Never push; stage named files only; do not touch the modified `.mosaic/orchestrator/session.lock`.
-
-## Plan
-
-1. Inspect P1 SPA structure, shared libraries, legacy Next auth pages/components, Gateway auth mount, and current test setup.
-2. Add/adjust tests first for relative API behavior, auth-client origin configuration, relative Socket.IO singleton behavior, and all guard session states; run focused tests and capture expected RED failures.
-3. Implement shared-library relative networking and remove the legacy SSO-provider module/imports.
-4. Port login, register, and provider callback pages to React Router and wire routes.
-5. Implement session-aware guest/auth guards and satisfy focused tests.
-6. Run focused tests, all brief verification gates, invariant searches, and an independent code/security review; remediate and re-run affected gates.
-7. Update this scratchpad with evidence, stage named files only, and commit locally.
-
-## Testing strategy
-
-- TDD is required because this increment changes authentication/session behavior.
-- Primary situational evidence: jsdom router guard state tests plus guest-page/auth-flow contract tests already present or added as needed.
-- Baseline gates: web tests, Vite build, Next build, typecheck, lint, and root format check exactly as listed in the brief.
-- Browser automation is not required by the brief for P2; if used, it will be headless only.
-
-## Budget
-
-No explicit user token cap was provided. Working soft cap: **30K tokens**, derived from a multi-file auth/frontend increment with tests, dual builds, review, and remediation. Keep implementation within the brief; no unrelated refactors or dependencies.
-
-## Progress / evidence
-
-- [x] Loaded mission protocol, active MVP manifest/scratchpad, top-level tasks, PRD, relevant frontend/auth/testing/type/review guides, and matching skills.
-- [x] Resolved host paths to the Distrobox-mapped repo and brief.
-- [x] Confirmed branch `feat/webui-p2-data-auth`, stacked at P1 commit `068d0f9b`.
-- [x] Source and Gateway mount inspection complete.
-- [x] RED tests observed.
-- [x] Implementation complete.
-- [x] Independent review complete and findings remediated.
-- [x] Verification gates complete.
-- [x] Local implementation commit created: `46d68e1f`.
-
-### Source decisions
-
-- Gateway source mounts BetterAuth at `/api/auth/` in `apps/gateway/src/auth/auth.controller.ts`; `packages/auth/src/auth.ts` configures `basePath: '/api/auth'`.
-- BetterAuth 1.5.5 defaults its browser client to `/api/auth` when `baseURL` is omitted. `src/lib/auth-client.ts` therefore omits `baseURL`, preserving same-origin behavior without encoding any gateway origin.
-- The only `src/app/` edit is the transitional Next provider redirect page. Deleting `src/lib/sso-providers.ts` required that mechanical consumer migration; it now uses the same runtime `/api/sso/providers` discovery and callback sanitizer as the SPA.
-- GuestGuard pending behavior intentionally follows the approved brief: if no session object exists (including pending), render `<Outlet />`; only a present session redirects to `/chat`. AuthGuard alone renders the specified pending treatment.
-
-### TDD evidence
-
-- Initial focused run: 9 expected failures, proving absolute API/auth/socket origins, P1 guest placeholders, and missing guard redirects/loading behavior.
-- After implementation: focused contract suite 15/15 passed.
-- Security remediation RED: `%2F%0A%2F%2Fevil.example` reached `signIn.oauth2` as an external-normalizing callback target before the fix.
-- Security remediation GREEN: shared `resolveAuthCallbackURL` unit suite 9/9 plus SPA callback regression 1/1 passed; both SPA and Next consumers use the shared helper.
-
-### Independent review
-
-- Primary Codex wrappers could not run because `jq` is absent; direct Codex fallback then failed authentication with HTTP 401. No review result was claimed from those attempts.
-- Independent Claude Sonnet code review found no implementation-scope blocker, one pending-state UX suggestion, and one pre-existing `api.ts` type-assertion suggestion. The pending-state suggestion was rejected because it contradicts the brief's explicit GuestGuard contract; the API cleanup is outside P2's preserve-contract scope.
-- Independent Claude Sonnet security review found a high-severity control-character open redirect in the callback prefix check shared by the newly ported SPA logic and transitional Next consumer.
-- Remediation centralized WHATWG URL parsing plus exact current-origin comparison in `src/lib/auth-redirect.ts`, returns only path/search/hash, and added the RED-first regression above.
-- Fresh code re-review: `approve`, 0 blockers, 0 should-fix findings.
-- Fresh security re-review: `low`, 0 critical/high/medium/low findings.
-
-### Documentation checklist disposition
-
-- `docs/PRD.md` exists and P2 aligns to FR-8 / AC-7 authentication requirements.
-- No Gateway endpoint, DTO, permission, or API schema changed; existing `/api/auth/*` and `/api/sso/providers` contracts are consumed unchanged, so OpenAPI/API-index updates are not applicable.
-- Route paths were already present in the P1 route table; P2 replaces placeholders without changing site-map navigation, so `docs/SITEMAP.md` is unchanged.
-- User/admin auth behavior is parity with the still-live Next implementation, not a new workflow. Implementation decisions, failure behavior, testing, and migration compatibility are documented here; no publishing action is in scope.
-- Documentation remains in-repo; no generated publishing output was created.
-
-### Final verification evidence
-
-Run fresh after remediation from the locations required by the brief:
-
-- `apps/web: pnpm test` — PASS: `Test Files 9 passed (9)`; `Tests 27 passed (27)`.
-- `apps/web: pnpm build:vite` — PASS: `✓ 113 modules transformed`; `✓ built in 565ms`.
-- `apps/web: pnpm build` — PASS: `✓ Compiled successfully in 4.6s`; 10/10 static pages generated; dynamic provider/project routes retained.
-- `apps/web: pnpm typecheck` — PASS: `tsc --noEmit` exited 0.
-- `apps/web: pnpm lint` — PASS: `eslint src` exited 0.
-- Root `pnpm format:check` — PASS: `All matched files use Prettier code style!`.
-- Invariant scan — PASS: no `NEXT_PUBLIC_*`, `VITE_*`, `GATEWAY_URL`, `http://localhost:14242`, or `sso-providers` references under `apps/web/src`.
-- `git diff --check` — PASS.
-- All six required gates above were repeated successfully after implementation commit `46d68e1f`, proving the exact committed source tree.
-
-## Risks / blockers
-
-- `.mosaic/orchestrator/session.lock` is modified by the active harness and must remain unstaged.
-- P2 changes shared `src/lib/` modules consumed by both Vite and Next, so the Next build is a required compatibility gate.
-
-## Remediation 1 — independent Node 26 verification failure
-
-**Correction received:** 2026-08-09
-
-The orchestrator rejected the P2 verification claim after an independent run under Node 26.4.0 produced 2 failed redirect tests and 2 unhandled errors. React Router passed jsdom's realm-local `AbortSignal` to Node 26's native undici `Request`, which rejects non-native signals. Production guard behavior is correct and must not change.
-
-### Remediation constraints
-
-- Preserve both redirect assertions and all `guards.tsx` behavior; no skips, weakening, or test deletion.
-- Add the smallest Vitest environment repair so global `AbortController` / `AbortSignal` are constructors accepted by native undici `Request`.
-- Run all six required gates, commit named files locally without pushing, leave `.mosaic/orchestrator/session.lock` untouched, then run `apps/web: pnpm test` as the final worktree action.
-- Completion requires zero failed tests, zero test errors, and zero unhandled rejections.
-
-### Remediation plan
-
-1. Reproduce under Node 26.4.0 if an ephemeral matching runtime is available.
-2. Add a Vitest `setupFiles` module deriving Node-native abort constructors from `node:util` and register it in `apps/web/vitest.config.ts`.
-3. Add a direct regression assertion that a global controller's signal is accepted by native `Request`, while retaining the existing redirect behavior tests unchanged.
-4. Run focused Node 22 and Node 26 tests, independent review, all required gates, and local commit(s).
-5. After every edit/commit/status check is complete, run `pnpm test` from `apps/web` as the last command.
-
-### Remediation implementation and evidence
-
-- Reproduced under ephemeral Node `v26.4.0`: `Test Files 1 failed (1)`, `Tests 2 failed | 4 passed (6)`, `Errors 2 errors`, with the exact undici `AbortSignal` realm rejection from the remediation brief.
-- Added `apps/web/src/test/setup.ts`, registered through `vitest.config.ts#setupFiles`. It derives Node-native abort constructors from the built-in `node:util.transferableAbortController()` and aligns both `globalThis` and jsdom `window`; it does not replace `Request`, `Response`, or `fetch`.
-- Explicitly pinned Vitest `isolate: true` so the test-only global constructors cannot leak between test-file environments.
-- Added `src/test/setup.spec.ts`, which proves a global controller signal is accepted by Node's native `Request` and that abort propagation remains functional.
-- Existing `guards.spec.tsx` and production `guards.tsx` remain unchanged.
-- Focused Node 26.4.0 remediation run: `Test Files 2 passed (2)` and `Tests 7 passed (7)`, with zero errors/unhandled rejections.
-- Preliminary full Node 26.4.0 run: `Test Files 9 passed (9)` and `Tests 27 passed (27)`, with zero errors/unhandled rejections before the direct setup regression was added.
-- No dependency was added; `node:util` is a Node built-in.
-
-### Remediation independent review
-
-- First code review: approve, 0 blockers, 0 should-fix; suggested a direct Request regression and version-neutral comment.
-- First security/integrity review: low risk; suggested pinning test isolation explicitly.
-- All suggestions were applied.
-- Fresh code re-review: approve, 0 blockers, 0 should-fix, no findings.
-- Fresh security/integrity re-review: low risk, 0 findings.
-
-### Remediation pre-commit gate evidence
-
-- Node 26.4.0 `pnpm test`: `Test Files 10 passed (10)`; `Tests 28 passed (28)`; zero errors and zero unhandled rejections.
-- `pnpm typecheck`: `tsc --noEmit` exited 0.
-- `pnpm build:vite`: `✓ 113 modules transformed`; `✓ built in 960ms`.
-- `pnpm build` (Next): `✓ Compiled successfully in 4.8s`; static pages generated 10/10.
-- `pnpm lint`: `eslint src` exited 0.
-- Root `pnpm format:check`: `All matched files use Prettier code style!`.
-- Final post-commit non-test gates and final-action Node 26 `pnpm test` remain required before reporting completion.
-
-### Remediation committed verification
-
-- Implementation commit: `e16c08aa` (`test(web): align jsdom abort signals with Node`).
-- Post-commit `pnpm typecheck`: `tsc --noEmit` exited 0.
-- Post-commit `pnpm build:vite`: `✓ 113 modules transformed`; `✓ built in 323ms`.
-- Post-commit `pnpm build` (Next): `✓ Compiled successfully in 4.6s`; static pages generated 10/10.
-- Post-commit `pnpm lint`: `eslint src` exited 0.
-- Post-commit root `pnpm format:check`: `All matched files use Prettier code style!`.
-- Final Node 26 `pnpm test` will be the last worktree action and its verbatim output will be reported to the orchestrator.

docs/webui/PHASE-P-STRUCTURE.md

@@ -1,115 +0,0 @@
-# WebUI Phase P — File / Folder Structure & Migration Map
-
-> **Status:** living document — first pass. Structure and increment status are verified against
-> `next` as of merge `8c27024d`. Details (per-surface component inventories, exact route tables,
-> test matrices) are still being fleshed out; extend the stub sections below rather than rewriting
-> the verified structure.
-
-## 1. What Phase P is
-
-Phase P migrates the Mosaic **web UI** (`apps/web`) from the legacy **Next.js App Router** app to a
-**Vite + React Router single-page app (SPA)** that the **Gateway serves same-origin** on
-`:14242`. The RFC splits the work into **six increments (P1–P6)**; the P1 PR title records this as
-"increment 1/6".
-
-The migration is deliberately **incremental and non-destructive**: the new SPA is built up
-*beside* the existing Next app, sharing one `apps/web/src/lib` networking/auth layer, until the
-final cutover (P5) removes the Next tree. At every point in between, **both app trees exist in the
-same package** — this is intentional, not drift.
-
-## 2. Current tree on `next` (dual-app, transitional)
-
-```
-apps/web/
-├── next.config.ts                 # legacy Next.js config          (removed at P5)
-├── vite.config.ts                 # SPA build + DEV proxy config    (canonical from P5)
-├── package.json                   # dev/build default to NEXT today; :vite variants opt in
-└── src/
-    ├── main.tsx                   # ── SPA entry (Vite)
-    ├── routes.tsx                 # ── SPA React Router route table
-    ├── spa/                       # ── NEW SPA surfaces
-    │   ├── guards.tsx             #    guest / authenticated route guards
-    │   ├── pages/                 #    login, register, sso-callback (P2); chat + error boundary (P3)
-    │   └── chat/                  #    P3 typed chat: use-chat-connection, commands-panel,
-    │                              #    session-panel, message-transcript, tool-call-list, composer
-    │
-    ├── lib/                       # ── SHARED by BOTH trees (origin-relative networking + auth)
-    │   ├── api.ts                 #    fetch wrapper — relative /api/...
-    │   ├── socket.ts              #    Socket.IO singleton — relative /chat
-    │   ├── auth-client.ts         #    BetterAuth client — relative /api/auth/...
-    │   ├── auth-redirect.ts       #    post-auth redirect resolution (protocol-relative rejected)
-    │   ├── chat-contract.ts       #    P3 typed chat wire contract (runtime-guarded)
-    │   ├── sso.ts · types.ts · cn.ts
-    │
-    ├── app/                       # ══ LEGACY Next.js App Router (removed at P5)
-    │   ├── (auth)/{login,register}/
-    │   ├── (dashboard)/{admin,chat,projects,projects/[id],settings,tasks}/
-    │   ├── auth/provider/[provider]/
-    │   └── layout.tsx · page.tsx · globals.css
-    │
-    ├── components/                # ══ LEGACY Next component library (auth, chat, layout,
-    │                              #    projects, settings, tasks, ui) — ported into spa/ across P3/P4
-    └── providers/                 # ══ theme-provider (legacy; SPA equivalent under providers)
-```
-
-Legend: `──` new SPA (keep), `══` legacy Next (removed at P5), shared `lib/` in the middle.
-
-## 3. Networking / serving model (why it's same-origin)
-
-- The SPA speaks **origin-relative paths only**: `/api/...`, `/api/auth/...`, `/chat`. No
-  `NEXT_PUBLIC_*` / `VITE_*` origin var, no hard-coded `http://localhost:14242` under
-  `apps/web/src`.
-- **Dev:** `vite.config.ts` runs a dev-only proxy that forwards those paths to the Gateway (so the
-  SPA on its dev port and the Gateway on `:14242` behave as one origin).
-- **Prod (target):** the SPA is **same-origin with the Gateway** — the Gateway serves the built
-  static bundle and the API/WS on `:14242`, so no proxy and no CORS. *(The Gateway does not serve
-  the web `dist` yet — adding that is the core of P5; see §5.)*
-
-## 4. Build scripts (`apps/web/package.json`)
-
-| Script | Today | Notes |
-|---|---|---|
-| `dev` | `next dev` | legacy dev server |
-| `dev:vite` | `vite` | SPA dev server (+ dev proxy) |
-| `build` | `node ../../scripts/build-web.mjs` | currently a **Next** build |
-| `build:vite` | `vite build` | SPA production build → `dist/` |
-| `lint` / `typecheck` / `test` | `eslint src` / `tsc --noEmit` / `vitest run` | tree-agnostic |
-
-At **P5** the `:vite` variants become the defaults (`dev`→vite, `build`→vite build) and the Next
-build path is retired.
-
-## 5. Increment map (P1–P6)
-
-| # | Increment | Branch | Status |
-|---|---|---|---|
-| **P1** | Vite + React Router skeleton beside Next (entry, router, guards, vitest) | `feat/webui-p1-vite-skeleton` | ✅ merged — PR **#1143** |
-| **P2** | SPA data layer + same-origin auth (login/register/SSO pages, guards, relative api/socket/auth-client) | `feat/webui-p2-data-auth` | ✅ merged — PR **#1144** |
-| **P3** | Typed SPA **chat** (`spa/chat/*`, `chat-contract.ts`, chat page + error boundary) | `feat/webui-p3-chat` | 🚧 in progress (unmerged) |
-| **P4** | Port **projects / tasks / settings / admin** dashboard surfaces into the SPA | _tbd_ | ⏳ not started |
-| **P5** | **Cutover**: Gateway serves the Vite `dist` on `:14242`; flip `dev`/`build` to vite; **remove** the legacy Next `app/` tree + `next.config.ts` | _tbd_ | ⏳ not started |
-| **P6** | CI / images (trails): build the SPA in CI, ship images | _tbd_ | ⏳ trails |
-
-Each increment follows the same delivery pipeline: brief traceable to the RFC → author →
-**independent** integrator verification (build+test+typecheck+lint) → **independent** code + security
-review (author ≠ reviewer) → author remediates → branch + PR to `next` → **independent** merge-gate
-merges. Author self-reports are not trusted; every gate is re-derived independently.
-
-## 6. Known dependency / blocker
-
-- **Issue #1145 — Gateway `dist` boot is broken** (DI failure on a defaulted constructor param);
-  the Gateway currently runs **dev-mode only**. This is a **hard precondition for P5**: the Gateway
-  cannot serve the SPA `dist` on `:14242` until `dist` boot works. P3/P4 remain on the dev-proxy
-  topology meanwhile.
-
-## 7. Not part of Phase P (disambiguation)
-
-`docs/plans/2026-08-09-webui-fleet-claude-bridge.md` and
-`docs/scratchpads/webui-fleet-bridge-plan.md` describe a **separate** WebUI ↔ fleet/Claude bridge
-effort. They are **not** the Phase P SPA migration and should not be conflated with the increments
-above.
-
-## 8. Where the detail lives (extend these)
-
-- Per-increment working notes: `docs/scratchpads/webui-p*-*.md` (e.g. `webui-p2-data-auth.md`).
-- _Stub — to flesh out:_ per-surface component inventory (which `components/*` port to which
-  `spa/*`), the full SPA route table, the P5 cutover checklist, and the P6 CI/image plan.

package.json

@@ -10,8 +10,7 @@
     "clean:generated": "node scripts/clean-generated.mjs",
     "typecheck": "pnpm preflight && turbo run typecheck",
     "test:checkout": "node --test scripts/*.test.mjs",
-    "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
-    "test:installer": "bash tools/install-next-lane.test.sh",
+    "test": "pnpm test:checkout && turbo run test",
     "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,md}\"",
     "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,md}\"",
     "prepare": "node scripts/install-hooks.mjs"

packages/mosaic/__tests__/integration/unified-wizard.test.ts

@@ -11,37 +11,9 @@ import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { HeadlessPrompter } from '../../src/prompter/headless-prompter.js';
 import { createConfigService } from '../../src/config/config-service.js';
-import type { SelectOption } from '../../src/prompter/interface.js';
-import type { MenuSection, WizardState } from '../../src/types.js';
 
 const gatewayConfigMock = vi.fn();
 const gatewayBootstrapMock = vi.fn();
-const providerSetupMock = vi.fn();
-const skillsSelectMock = vi.fn();
-
-class SequencedMenuPrompter extends HeadlessPrompter {
-  constructor(
-    answers: Record<string, string | boolean | string[]>,
-    private readonly menuChoices: string[],
-  ) {
-    super(answers);
-  }
-
-  override async select<T>(opts: {
-    message: string;
-    options: SelectOption<T>[];
-    initialValue?: T;
-  }): Promise<T> {
-    if (opts.message === 'What would you like to configure?') {
-      const next = this.menuChoices.shift();
-      if (!next) throw new Error('No queued menu choice left');
-      const match = opts.options.find((o) => String(o.value) === next);
-      if (!match) throw new Error(`Queued menu choice not available: ${next}`);
-      return match.value;
-    }
-    return super.select(opts);
-  }
-}
 
 vi.mock('../../src/stages/gateway-config.js', () => ({
   gatewayConfigStage: (...args: unknown[]) => gatewayConfigMock(...args),
@@ -51,14 +23,6 @@ vi.mock('../../src/stages/gateway-bootstrap.js', () => ({
   gatewayBootstrapStage: (...args: unknown[]) => gatewayBootstrapMock(...args),
 }));
 
-vi.mock('../../src/stages/provider-setup.js', () => ({
-  providerSetupStage: (...args: unknown[]) => providerSetupMock(...args),
-}));
-
-vi.mock('../../src/stages/skills-select.js', () => ({
-  skillsSelectStage: (...args: unknown[]) => skillsSelectMock(...args),
-}));
-
 // Import AFTER the mocks so runWizard picks up the mocked stage modules.
 import { runWizard } from '../../src/wizard.js';
 
@@ -80,16 +44,6 @@ describe('Unified wizard (runWizard with default skipGateway)', () => {
     }
     gatewayConfigMock.mockReset();
     gatewayBootstrapMock.mockReset();
-    providerSetupMock.mockReset();
-    skillsSelectMock.mockReset();
-    providerSetupMock.mockImplementation(async (_p: HeadlessPrompter, state: WizardState) => {
-      state.providerType = 'none';
-      state.completedSections?.add('providers' satisfies MenuSection);
-    });
-    skillsSelectMock.mockImplementation(async (_p: HeadlessPrompter, state: WizardState) => {
-      state.selectedSkills = [];
-      state.completedSections?.add('skills' satisfies MenuSection);
-    });
     // Pretend we're on an interactive TTY so the wizard's headless-abort
     // branch does not call `process.exit(1)` during these tests.
     Object.defineProperty(process.stdin, 'isTTY', { value: true, configurable: true });
@@ -144,12 +98,8 @@ describe('Unified wizard (runWizard with default skipGateway)', () => {
     expect(bootstrapCall[2]).toMatchObject({ host: 'localhost', port: 14242 });
   });
 
-  it('prints the success summary only after gateway health succeeds', async () => {
-    gatewayConfigMock.mockImplementation(async (p: HeadlessPrompter) => {
-      p.log('Gateway is healthy.');
-      return { ready: true, host: 'localhost', port: 14242 };
-    });
-    gatewayBootstrapMock.mockResolvedValue({ completed: true });
+  it('does not invoke bootstrap when config stage reports not ready', async () => {
+    gatewayConfigMock.mockResolvedValue({ ready: false });
 
     const prompter = new HeadlessPrompter({
       'Installation mode': 'quick',
@@ -168,43 +118,6 @@ describe('Unified wizard (runWizard with default skipGateway)', () => {
       skipGatewayNpmInstall: true,
     });
 
-    const logs = prompter.getLogs();
-    const healthIndex = logs.findIndex((line) => line.includes('Gateway is healthy.'));
-    const summaryIndex = logs.findIndex((line) => line.includes('Installation Summary'));
-    const readyIndex = logs.findIndex((line) => line.includes('Mosaic is ready.'));
-
-    expect(healthIndex).toBeGreaterThanOrEqual(0);
-    expect(summaryIndex).toBeGreaterThan(healthIndex);
-    expect(readyIndex).toBeGreaterThan(summaryIndex);
-  });
-
-  it('does not claim success when gateway health reports not ready', async () => {
-    gatewayConfigMock.mockImplementation(async (p: HeadlessPrompter) => {
-      p.warn('Gateway did not become healthy within 30 seconds.');
-      return { ready: false };
-    });
-
-    const prompter = new HeadlessPrompter({
-      'Installation mode': 'quick',
-      'What name should agents use?': 'TestBot',
-      'Communication style': 'direct',
-      'Your name': 'Tester',
-      'Your pronouns': 'They/Them',
-      'Your timezone': 'UTC',
-    });
-
-    await runWizard({
-      mosaicHome: tmpDir,
-      sourceDir: tmpDir,
-      prompter,
-      configService: createConfigService(tmpDir, tmpDir),
-      skipGatewayNpmInstall: true,
-    });
-
-    const logs = prompter.getLogs();
-    expect(logs.some((line) => line.includes('Gateway did not become healthy'))).toBe(true);
-    expect(logs.some((line) => line.includes('Installation Summary'))).toBe(false);
-    expect(logs.some((line) => line.includes('Mosaic is ready.'))).toBe(false);
     expect(gatewayConfigMock).toHaveBeenCalledTimes(1);
     expect(gatewayBootstrapMock).not.toHaveBeenCalled();
   });
@@ -230,34 +143,4 @@ describe('Unified wizard (runWizard with default skipGateway)', () => {
     expect(gatewayConfigMock).not.toHaveBeenCalled();
     expect(gatewayBootstrapMock).not.toHaveBeenCalled();
   });
-
-  it('does not re-run completed provider or skills menu steps', async () => {
-    const prompter = new SequencedMenuPrompter(
-      {
-        'What name should agents use?': 'TestBot',
-        'Communication style': 'direct',
-        'Your name': 'Tester',
-        'Your pronouns': 'They/Them',
-        'Your timezone': 'UTC',
-      },
-      ['providers', 'providers', 'skills', 'skills', 'finish'],
-    );
-
-    await runWizard({
-      mosaicHome: tmpDir,
-      sourceDir: tmpDir,
-      prompter,
-      configService: createConfigService(tmpDir, tmpDir),
-      skipGateway: true,
-    });
-
-    expect(providerSetupMock).toHaveBeenCalledTimes(1);
-    expect(skillsSelectMock).toHaveBeenCalledTimes(1);
-    expect(prompter.getLogs()).toEqual(
-      expect.arrayContaining([
-        expect.stringContaining('Providers [done] is already complete; skipping.'),
-        expect.stringContaining('Skills [done] is already complete; skipping.'),
-      ]),
-    );
-  });
 });

packages/mosaic/framework/defaults/README.md

@@ -43,16 +43,6 @@ The installer:
 - Runs a health audit
 - Detects existing installs and preserves local files (SOUL.md, USER.md, etc.)
 
-### Install lanes
-
-| Lane                     | Command                               | Use when                                       | Source                                                                                       |
-| ------------------------ | ------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | You want the released framework and CLI        | npm `@mosaicstack/mosaic@latest` + `main`                                                    |
-| Prerelease integration   | `bash tools/install.sh --next`        | You want the permanent `next` integration lane | Fast npm `@mosaicstack/mosaic@next` + `@mosaicstack/gateway@next`; source fallback at `next` |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are validating a branch before release     | Build-from-source at the requested git ref                                                   |
-
-`--next` is fast-by-default from the Gitea npm `next` dist-tag and falls back to a source build at the permanent `next` branch if the dist-tag is missing or unreachable. Explicit `--ref` or `MOSAIC_REF` wins and uses the source path.
-
 ## First Run
 
 After install, open a new terminal (or `source ~/.bashrc`) and run:
@@ -118,8 +108,8 @@ You can still launch runtimes directly (`claude`, `codex`, etc.) — thin runtim
 ├── TOOLS.md               ← Machine-level tool reference (generated by mosaic init)
 ├── STANDARDS.md           ← Machine-wide standards
 ├── guides/                ← Operational guides (E2E delivery, PRD, docs, etc.)
+├── bin/                   ← CLI tools (mosaic launcher, mosaic-init, mosaic-doctor, etc.)
 ├── tools/                 ← Tool suites: git, orchestrator, prdy, quality, etc.
-│   └── _scripts/          ← Framework helper scripts (sync skills, doctor, runtime links)
 ├── runtime/               ← Runtime adapters + runtime-specific references
 │   ├── claude/            ← CLAUDE.md, RUNTIME.md, settings.json, hooks
 │   ├── codex/             ← instructions.md, RUNTIME.md
@@ -184,9 +174,7 @@ The installer preserves local `SOUL.md`, `USER.md`, `TOOLS.md`, and `memory/` by
 bash tools/install.sh --check       # Version check only
 bash tools/install.sh --framework   # Framework only (skip npm CLI)
 bash tools/install.sh --cli         # npm CLI only (skip framework)
-bash tools/install.sh --next        # Prerelease lane: npm @next, source fallback
-bash tools/install.sh --dev         # Contributor lane: source build at --ref/main
-bash tools/install.sh --ref v1.0    # Install from a specific git ref (--ref wins over --next)
+bash tools/install.sh --ref v1.0    # Install from a specific git ref
 ```
 
 The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
@@ -196,11 +184,10 @@ The installer rejects unrecognized flags or positional arguments before making c
 The installer syncs skills from `mosaic/agent-skills` into `~/.config/mosaic/skills/`. Install, wizard finalization, and `mosaic update` automatically reconcile every canonical skill into Claude Code's `~/.claude/skills/` directory.
 
 ```bash
-mosaic sync                                                   # Full canonical catalog sync
-~/.config/mosaic/tools/_scripts/mosaic-sync-skills --link-only # Re-link only
-mosaic skill list                                              # Show registered, missing, dangling, and foreign entries
-mosaic skill register <name>                                   # Register or repair one canonical Claude link
-mosaic skill unregister <name>                                 # Remove one Mosaic-owned Claude link
+mosaic sync                         # Full canonical catalog sync
+mosaic skill list                   # Show registered, missing, dangling, and foreign entries
+mosaic skill register <name>        # Register or repair one canonical Claude link
+mosaic skill unregister <name>      # Remove one Mosaic-owned Claude link
 ```
 
 Skill names are direct children using `[A-Za-z0-9][A-Za-z0-9._-]*`, not paths. Registration rejects traversal/control characters and never replaces foreign files, directories, or symlinks; unregister removes only links that point inside the canonical Mosaic skill root. After registering during a running Claude Code session, use `/reload-skills` or start a new session.
@@ -210,8 +197,8 @@ M1 lifecycle management targets Claude Code. Pi can discover the canonical Mosai
 ## Health Audit
 
 ```bash
-mosaic doctor                                           # Standard audit
-~/.config/mosaic/tools/_scripts/mosaic-doctor --fail-on-warn      # Strict mode
+mosaic doctor                                          # Standard audit
+~/.config/mosaic/bin/mosaic-doctor --fail-on-warn      # Strict mode
 ```
 
 ## MCP Registration
@@ -222,8 +209,8 @@ sequential-thinking MCP is required for Mosaic Stack. The installer registers it
 To verify or re-register manually:
 
 ```bash
-~/.config/mosaic/tools/_scripts/mosaic-ensure-sequential-thinking
-~/.config/mosaic/tools/_scripts/mosaic-ensure-sequential-thinking --check
+~/.config/mosaic/bin/mosaic-ensure-sequential-thinking
+~/.config/mosaic/bin/mosaic-ensure-sequential-thinking --check
 ```
 
 ### Claude Code MCP Registration

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -499,8 +499,17 @@ get_gitea_url_for_host() {
 
 # Resolve a Gitea API token for the given host.
 # Priority: Mosaic credential loader → GITEA_TOKEN env → ~/.git-credentials
+_trace_credential_resolution() {
+    [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]] || return 0
+    local reason="$1" identity="$2" host="$3" source="$4"
+    local shared_path_entered=false
+    [[ "$_resolution_path" == shared ]] && shared_path_entered=true
+    printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
+        "$reason" "$identity" "$host" "$_resolution_path" "$shared_path_entered" "$source" >&2
+}
+
 get_gitea_token() {
-    local host="$1"
+    local host="$1" _resolution_path=unresolved
     local script_dir
     script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
     local cred_loader="$script_dir/../_lib/credentials.sh"
@@ -516,6 +525,16 @@ get_gitea_token() {
         _ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
         _ident_src="git config mosaic.gitIdentity"
     fi
+    if [[ -n "$_ident" && ! "$_ident" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*$ ]]; then
+        printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=invalid-identity identity=<invalid> host=%s shared_path_entered=false source=%s\n' \
+            "$host" "$_ident_src" >&2
+        return 1
+    fi
+    if [[ -n "${MOSAIC_AGENT_NAME:-}" && -n "$_ident" && "$_ident" != "$MOSAIC_AGENT_NAME" ]]; then
+        printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=provider-identity-mismatch identity=%s fleet_identity=%s host=%s shared_path_entered=false source=%s\n' \
+            "$_ident" "$MOSAIC_AGENT_NAME" "$host" "$_ident_src" >&2
+        return 1
+    fi
     if [[ -n "$_ident" ]]; then
         local _idpfx=""
         case "$host" in
@@ -524,8 +543,23 @@ get_gitea_token() {
         esac
         if [[ -n "$_idpfx" ]]; then
             local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
-            if [[ -r "$_idtok" ]]; then
-                cat "$_idtok"
+            local _idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.credential.json"
+            if [[ -e "$_idcred" || -L "$_idcred" ]]; then
+                local _resolved_token
+                _resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \
+                    "$HOME/.config/mosaic/secrets/gitea-tokens" "$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1
+                _resolution_path=identity
+                _trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
+                printf '%s\n' "$_resolved_token"
+                return 0
+            fi
+            if [[ -e "$_idtok" || -L "$_idtok" ]]; then
+                local _resolved_token
+                _resolved_token=$(python3 "$script_dir/resolve-legacy-token.py" \
+                    "$HOME/.config/mosaic/secrets/gitea-tokens" "$_idtok") || return 1
+                _resolution_path=identity
+                _trace_credential_resolution credential-resolved "$_ident" "$host" "$_ident_src"
+                printf '%s\n' "$_resolved_token"
                 return 0
             fi
             # FAIL LOUD: an explicit git identity was requested for a recognized Gitea host,
@@ -534,12 +568,21 @@ get_gitea_token() {
             # would post PRs/issues/reviews under the WRONG agent (e.g. rev2's review attributed
             # to coder3), corrupting Gate-16 author≠reviewer separation. Hard-stop instead so the
             # caller aborts loudly rather than acting as the wrong identity.
-            echo "Error: git identity '$_ident' requested (via $_ident_src) for host '$host', but no per-slot token at $_idtok." >&2
-            echo "       Refusing to borrow another slot's token. Provision the per-slot token, or unset the identity to use shared credentials." >&2
+            printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=no-token-for-identity identity=%s host=%s shared_path_entered=false source=%s path=%s\n' \
+                "$_ident" "$host" "$_ident_src" "$_idtok" >&2
             return 1
         fi
     fi
 
+    # Fleet automation never borrows a shared human/default credential. An
+    # explicit interactive caller may still reach the shared paths below, but
+    # a fleet process must name an identity and resolve that identity exactly.
+    if [[ -n "${MOSAIC_AGENT_NAME:-}" ]]; then
+        printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=identity-required identity=<unset> host=%s shared_path_entered=false source=MOSAIC_AGENT_NAME\n' \
+            "$host" >&2
+        return 1
+    fi
+
     # 1. Mosaic credential loader (host → service mapping, run in subshell to avoid polluting env)
     if [[ -f "$cred_loader" ]]; then
         local token
@@ -571,6 +614,8 @@ get_gitea_token() {
             echo "${GITEA_TOKEN:-}"
         )
         if [[ -n "$token" ]]; then
+            _resolution_path=shared
+            _trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
             echo "$token"
             return 0
         fi
@@ -579,6 +624,8 @@ get_gitea_token() {
     # 2. GITEA_TOKEN env var (only when GITEA_URL, if present, matches the remote host)
     if [[ -n "${GITEA_TOKEN:-}" ]]; then
         if [[ -z "${GITEA_URL:-}" ]] || gitea_url_matches_host "$GITEA_URL" "$host"; then
+            _resolution_path=shared
+            _trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" environment
             echo "$GITEA_TOKEN"
             return 0
         fi
@@ -590,6 +637,8 @@ get_gitea_token() {
         local token
         token=$(grep -F "$host" "$creds" 2>/dev/null | sed -n 's#https\?://[^@]*:\([^@/]*\)@.*#\1#p' | head -n 1)
         if [[ -n "$token" ]]; then
+            _resolution_path=shared
+            _trace_credential_resolution shared-credential-resolved '<interactive-shared>' "$host" git-credentials
             echo "$token"
             return 0
         fi

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -24,29 +24,79 @@ while IFS= read -r line; do
     username=*) username_in=${line#username=};;
   esac
 done
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+trace_resolution() {
+  [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ] || return 0
+  reason="$1" trace_identity="$2" trace_host="$3" source="$4"
+  shared_path_entered=false
+  [ "$resolution_path" = shared ] && shared_path_entered=true
+  printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
+    "$reason" "$trace_identity" "$trace_host" "$resolution_path" "$shared_path_entered" "$source" >&2
+}
+resolution_path=unresolved
 # Per-agent identity resolution (Gate-16 author≠reviewer separation).
 # Priority: MOSAIC_GIT_IDENTITY env  >  git config mosaic.gitIdentity (per-worktree,
 # survives across non-persistent shells)  >  git-supplied username (credential.username
 # / URL). When the resolved identity has a matching per-agent token, use it instead of
 # the shared account. Backward-compatible: nothing resolvable → shared token.
+case "$host" in
+  git.uscllc.com) idpfx=gitea-usc;;
+  git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+  *) exit 0;;
+esac
 ident="$MOSAIC_GIT_IDENTITY"
 [ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
 [ -z "$ident" ] && ident="$username_in"
+if [[ -n "$ident" && ! "$ident" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*$ ]]; then
+  echo "quit=true"
+  printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=invalid-identity identity=<invalid> host=%s shared_path_entered=false source=git-credential-mosaic\n' "$host" >&2
+  exit 1
+fi
+if [ -n "$idpfx" ] && [ -n "${MOSAIC_AGENT_NAME:-}" ] && [ -n "$ident" ] && [ "$ident" != "$MOSAIC_AGENT_NAME" ]; then
+  echo "quit=true"
+  printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=provider-identity-mismatch identity=%s fleet_identity=%s host=%s shared_path_entered=false source=git-credential-mosaic\n' \
+    "$ident" "$MOSAIC_AGENT_NAME" "$host" >&2
+  exit 1
+fi
 if [ -n "$ident" ]; then
-  case "$host" in
-    git.uscllc.com)      idpfx=gitea-usc;;
-    git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
-    *) idpfx="";;
-  esac
   if [ -n "$idpfx" ]; then
     idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
-    if [ -r "$idtok" ]; then
+    idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.credential.json"
+    if [ -e "$idcred" ] || [ -L "$idcred" ]; then
+      token=$(python3 "$script_dir/resolve-credential-envelope.py" \
+        "$HOME/.config/mosaic/secrets/gitea-tokens" "$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1
+      resolution_path=identity
+      trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic
       echo "username=${ident}"
-      echo "password=$(cat "$idtok")"
+      echo "password=${token}"
       exit 0
     fi
+    if [ -e "$idtok" ] || [ -L "$idtok" ]; then
+      token=$(python3 "$script_dir/resolve-legacy-token.py" \
+        "$HOME/.config/mosaic/secrets/gitea-tokens" "$idtok") || exit 1
+      resolution_path=identity
+      trace_resolution credential-resolved "$ident" "$host" git-credential-mosaic
+      echo "username=${ident}"
+      echo "password=${token}"
+      exit 0
+    fi
+    if [ -n "${MOSAIC_AGENT_NAME:-}" ]; then
+      echo "quit=true"
+      printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=no-token-for-identity identity=%s host=%s shared_path_entered=false source=git-credential-mosaic path=%s\n' \
+        "$ident" "$host" "$idtok" >&2
+      exit 1
+    fi
   fi
 fi
+if [ -n "${MOSAIC_AGENT_NAME:-}" ] && [ -z "$ident" ]; then
+  case "$host" in
+    git.uscllc.com|git.mosaicstack.dev)
+      echo "quit=true"
+      printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=identity-required identity=<unset> host=%s shared_path_entered=false source=git-credential-mosaic\n' "$host" >&2
+      exit 1
+      ;;
+  esac
+fi
 case "$host" in
   git.uscllc.com)      svc=gitea-usc;;
   git.mosaicstack.dev) svc=gitea-mosaicstack;;
@@ -55,10 +105,11 @@ esac
 # Script-relative (not $HOME-absolute) so this resolves correctly regardless
 # of where the framework installer places tools/ under $HOME — mirrors
 # detect-platform.sh's own cred_loader resolution in this same directory.
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../_lib/credentials.sh
 source "$script_dir/../_lib/credentials.sh"
 load_credentials "$svc" >/dev/null 2>&1 || exit 0
+resolution_path=shared
+trace_resolution shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
 # GITEA_USER is not populated by load_credentials (it only exports
 # GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
 # git-over-HTTP auth authenticates from the token itself (the password field),

packages/mosaic/framework/tools/git/resolve-credential-envelope.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""Fail-closed reader for one governed Mosaic credential envelope."""
+
+import hashlib
+import json
+import os
+import stat
+import sys
+
+MAX_BYTES = 64 * 1024
+EXPECTED_KEYS = {
+    "schemaVersion",
+    "identity",
+    "estate",
+    "host",
+    "providerLogin",
+    "tokenName",
+    "scopes",
+    "createdAt",
+    "tokenDigest",
+    "token",
+}
+
+
+def refuse(message: str) -> None:
+    print(f"credential envelope refused: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+if len(sys.argv) != 6:
+    refuse("expected governed root, path, identity, estate, and host")
+root, path, identity, estate, host = sys.argv[1:]
+if os.path.abspath(os.path.dirname(path)) != os.path.abspath(root):
+    refuse("credential is not a direct child of the governed root")
+if not estate:
+    refuse("explicit estate is required")
+parent = os.path.dirname(path)
+try:
+    parent_stat = os.stat(parent, follow_symlinks=False)
+except OSError:
+    refuse("credential directory unavailable")
+if not stat.S_ISDIR(parent_stat.st_mode) or stat.S_ISLNK(parent_stat.st_mode):
+    refuse("credential directory is not a real directory")
+if parent_stat.st_uid != os.getuid() or parent_stat.st_mode & 0o022:
+    refuse("credential directory owner or mode is unsafe")
+try:
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_CLOEXEC)
+except OSError:
+    refuse("credential file unavailable or symbolic")
+try:
+    file_stat = os.fstat(fd)
+    if not stat.S_ISREG(file_stat.st_mode):
+        refuse("credential is not a regular file")
+    if file_stat.st_uid != os.getuid() or file_stat.st_mode & 0o077:
+        refuse("credential owner or mode is unsafe")
+    content = os.read(fd, MAX_BYTES + 1)
+    if len(content) > MAX_BYTES:
+        refuse("credential exceeds size limit")
+finally:
+    os.close(fd)
+try:
+    value = json.loads(content)
+except (UnicodeDecodeError, json.JSONDecodeError):
+    refuse("credential is not valid JSON")
+if not isinstance(value, dict) or set(value) != EXPECTED_KEYS:
+    refuse("credential schema is not exact")
+if (
+    value.get("schemaVersion") != 1
+    or value.get("identity") != identity
+    or value.get("estate") != estate
+    or value.get("host") != host
+    or value.get("providerLogin") != identity
+):
+    refuse("credential binding does not match requested identity, estate, host, and principal")
+token = value.get("token")
+if not isinstance(token, str) or not token or any(ch.isspace() for ch in token):
+    refuse("credential token is invalid")
+if value.get("tokenDigest") != hashlib.sha256(token.encode()).hexdigest():
+    refuse("credential digest does not match token")
+sys.stdout.write(token + "\n")

packages/mosaic/framework/tools/git/resolve-legacy-token.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Fail-closed reader for one legacy per-seat token file."""
+
+import os
+import stat
+import sys
+
+MAX_BYTES = 16 * 1024
+
+
+def refuse(message: str) -> None:
+    print(f"legacy credential refused: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+if len(sys.argv) != 3:
+    refuse("expected governed root and token path")
+root, path = sys.argv[1:]
+if os.path.abspath(os.path.dirname(path)) != os.path.abspath(root):
+    refuse("credential is not a direct child of the governed root")
+parent = os.path.dirname(path)
+try:
+    parent_stat = os.stat(parent, follow_symlinks=False)
+except OSError:
+    refuse("credential directory unavailable")
+if not stat.S_ISDIR(parent_stat.st_mode) or stat.S_ISLNK(parent_stat.st_mode):
+    refuse("credential directory is not a real directory")
+if parent_stat.st_uid != os.getuid() or parent_stat.st_mode & 0o022:
+    refuse("credential directory owner or mode is unsafe")
+try:
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_CLOEXEC)
+except OSError:
+    refuse("credential file unavailable or symbolic")
+try:
+    file_stat = os.fstat(fd)
+    if not stat.S_ISREG(file_stat.st_mode):
+        refuse("credential is not a regular file")
+    if file_stat.st_uid != os.getuid() or file_stat.st_mode & 0o077:
+        refuse("credential owner or mode is unsafe")
+    content = os.read(fd, MAX_BYTES + 1)
+    if len(content) > MAX_BYTES:
+        refuse("credential exceeds size limit")
+finally:
+    os.close(fd)
+try:
+    token = content.decode("utf-8").strip()
+except UnicodeDecodeError:
+    refuse("credential is not UTF-8")
+if not token or any(ch.isspace() for ch in token):
+    refuse("credential token is invalid")
+sys.stdout.write(token + "\n")

packages/mosaic/framework/tools/git/test-ci-queue-wait-tristate.sh

@@ -9,10 +9,51 @@ WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-tristate}
 REPO_DIR="$WORK_DIR/repo"
 STUB_DIR="$WORK_DIR/stubs"
 AUDIT_LOG="$WORK_DIR/audit/ci-queue-wait.jsonl"
+STATUS_OBSERVED="$WORK_DIR/status-observed"
+CLOCK_LOG="$WORK_DIR/clock.log"
+WATCHDOG_PYTHON="/usr/bin/python3"
+WATCHDOG_SCRIPT="$WORK_DIR/real-clock-watchdog.py"
+WATCHDOG_TIMEOUT_SEC=5
+WATCHDOG_EXIT=90
 FEATURE_BRANCH="fix/rm-03-fixture"
 
+if [[ ! -x "$WATCHDOG_PYTHON" ]]; then
+    echo "FAIL setup: required real-clock watchdog runtime is unavailable at $WATCHDOG_PYTHON" >&2
+    exit 1
+fi
+
 rm -rf "$WORK_DIR"
 mkdir -p "$REPO_DIR" "$STUB_DIR"
+cat > "$WATCHDOG_SCRIPT" <<'PY'
+import os
+import signal
+import subprocess
+import sys
+
+if len(sys.argv) < 3:
+    raise SystemExit(2)
+
+timeout_seconds = float(sys.argv[1])
+process = subprocess.Popen(sys.argv[2:], start_new_session=True)
+try:
+    return_code = process.wait(timeout=timeout_seconds)
+except subprocess.TimeoutExpired:
+    try:
+        os.killpg(process.pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    process.wait()
+    print(
+        f"FAIL HANG watchdog: subject exceeded {timeout_seconds:g}s "
+        "before completing its intended path",
+        file=sys.stderr,
+    )
+    raise SystemExit(90)
+
+if return_code < 0:
+    raise SystemExit(128 - return_code)
+raise SystemExit(return_code)
+PY
 git -C "$REPO_DIR" init -q
 git -C "$REPO_DIR" checkout -q -b "$FEATURE_BRANCH"
 git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
@@ -33,6 +74,9 @@ printf '%s\n' "$url" >> "${MOSAIC_STUB_URL_LOG:?}"
 
 case "$url" in
     */branches/*)
+        if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "hang-before-provider" ]]; then
+            while :; do :; done
+        fi
         if [[ "${MOSAIC_STUB_BRANCH_MODE:-ok}" == "unreachable" ]]; then
             exit 7
         fi
@@ -44,6 +88,7 @@ case "$url" in
         fi
         ;;
     */status)
+        : > "${MOSAIC_STUB_STATUS_OBSERVED:?}"
         case "${MOSAIC_STUB_STATUS_MODE:?}" in
             success)   printf '%s' '{"state":"success","statuses":[{"status":"success"}]}' ;;
             pending)   printf '%s' '{"state":"pending","statuses":[{"status":"pending","context":"ci/test"}]}' ;;
@@ -63,7 +108,31 @@ case "$url" in
     *) echo "unexpected curl URL: $url" >&2; exit 2 ;;
 esac
 SH
-chmod +x "$STUB_DIR/curl"
+
+cat > "$STUB_DIR/date" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 1 || "$1" != "+%s" ]]; then
+    echo "unexpected date invocation: $*" >&2
+    exit 2
+fi
+
+if [[ -e "${MOSAIC_STUB_STATUS_OBSERVED:?}" ]]; then
+    printf 'date-phase=after-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+    printf '1002\n'
+else
+    printf 'date-phase=before-status\n' >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+    printf '1000\n'
+fi
+SH
+
+cat > "$STUB_DIR/sleep" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'sleep-after-status=%s\n' "$*" >> "${MOSAIC_STUB_CLOCK_LOG:?}"
+SH
+chmod +x "$STUB_DIR/curl" "$STUB_DIR/date" "$STUB_DIR/sleep"
 
 run_guard() {
     local status_mode="$1"
@@ -83,13 +152,46 @@ run_guard() {
             export GITEA_URL=https://git.example.test
             export MOSAIC_STUB_STATUS_MODE="$status_mode"
         fi
+        rm -f "$STATUS_OBSERVED" "$CLOCK_LOG"
         export MOSAIC_STUB_URL_LOG="$WORK_DIR/urls.log"
+        export MOSAIC_STUB_STATUS_OBSERVED="$STATUS_OBSERVED"
+        export MOSAIC_STUB_CLOCK_LOG="$CLOCK_LOG"
         export MOSAIC_CI_QUEUE_AUDIT_LOG="$audit_log"
-        "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 0 -i 0 "$@"
+        # Provider observation is the synchronization event. The one-second
+        # timeout is subject semantics under virtual time, never a wall wait.
+        # The absolute Python runtime uses an internal monotonic wait and kills
+        # the subject's isolated process group. Neither operation can resolve
+        # to the virtual date/sleep stubs at the front of PATH.
+        local subject_rc
+        if "$WATCHDOG_PYTHON" "$WATCHDOG_SCRIPT" "$WATCHDOG_TIMEOUT_SEC" \
+            "$SCRIPT_DIR/ci-queue-wait.sh" --purpose "${MOSAIC_TEST_PURPOSE:-push}" -t 1 -i 1 "$@"; then
+            subject_rc=0
+        else
+            subject_rc=$?
+        fi
+        return "$subject_rc"
     )
 }
 
 failures=0
+assert_provider_observed() {
+    local name="$1" require_expiration="${2:-0}"
+    if [[ ! -e "$STATUS_OBSERVED" ]]; then
+        echo "FAIL $name: status provider was not observed" >&2
+        failures=$((failures + 1))
+    fi
+    if [[ ! -s "$CLOCK_LOG" ]] || ! grep -q '^date-phase=before-status$' "$CLOCK_LOG"; then
+        echo "FAIL $name: virtual clock interception did not run before provider observation" >&2
+        failures=$((failures + 1))
+    fi
+    if [[ "$require_expiration" -eq 1 ]]; then
+        if ! grep -q '^sleep-after-status=' "$CLOCK_LOG" || ! grep -q '^date-phase=after-status$' "$CLOCK_LOG"; then
+            echo "FAIL $name: pending path did not expire after provider observation" >&2
+            failures=$((failures + 1))
+        fi
+    fi
+}
+
 run_assertion() {
     local name="$1" expected_rc="$2" status_mode="$3" required_text="$4"
     local output rc
@@ -124,6 +226,13 @@ run_assertion() {
         printf '%s\n' "$output" >&2
         failures=$((failures + 1))
     fi
+    if [[ "$status_mode" != "credential-unresolvable" ]]; then
+        if [[ "$status_mode" == "pending" ]]; then
+            assert_provider_observed "$name" 1
+        else
+            assert_provider_observed "$name"
+        fi
+    fi
 }
 
 set -e
@@ -140,6 +249,27 @@ run_assertion large-payload not126 large-success 'state=terminal-success'
 run_assertion credential-unresolvable zero credential-unresolvable 'CANNOT_ASSERT'
 run_assertion provider-unreachable zero unreachable 'CANNOT_ASSERT'
 
+# Positive liveness control: a subject mutant hangs before the branch lookup
+# can reach the status provider. Only the independent real-clock watchdog may
+# terminate it, and its failure must be distinct from subject timeout rc=124.
+set +e
+watchdog_output=$(MOSAIC_STUB_BRANCH_MODE=hang-before-provider run_guard success "$AUDIT_LOG" 2>&1)
+watchdog_rc=$?
+set -e
+if [[ "$watchdog_rc" -ne "$WATCHDOG_EXIT" ]]; then
+    echo "FAIL watchdog-control: expected hang-specific rc=$WATCHDOG_EXIT, got rc=$watchdog_rc" >&2
+    failures=$((failures + 1))
+fi
+if [[ "$watchdog_output" != *"FAIL HANG watchdog:"* ]]; then
+    echo "FAIL watchdog-control: expected distinct hang-specific diagnostic" >&2
+    printf '%s\n' "$watchdog_output" >&2
+    failures=$((failures + 1))
+fi
+if [[ -e "$STATUS_OBSERVED" ]]; then
+    echo "FAIL watchdog-control: hanging mutant unexpectedly reached the status provider" >&2
+    failures=$((failures + 1))
+fi
+
 if [[ ! -s "$AUDIT_LOG" ]] || ! grep -q '"outcome":"CANNOT_ASSERT"' "$AUDIT_LOG"; then
     echo "FAIL provider-unreachable-audit: expected durable CANNOT_ASSERT JSONL record" >&2
     failures=$((failures + 1))
@@ -160,6 +290,7 @@ if [[ "$merge_unreachable_output" != *"CANNOT_ASSERT"* ]]; then
     echo "FAIL merge-provider-unreachable: expected loud CANNOT_ASSERT diagnostic" >&2
     failures=$((failures + 1))
 fi
+assert_provider_observed merge-provider-unreachable
 merge_audit_lines_after=$(wc -l < "$AUDIT_LOG")
 if [[ "$merge_audit_lines_after" -le "$merge_audit_lines_before" ]]; then
     echo "FAIL merge-provider-unreachable: expected an additional audit record" >&2
@@ -223,6 +354,7 @@ if [[ "$audit_failure_output" != *"audit"* ]]; then
     echo "FAIL audit-unavailable: expected loud audit failure diagnostic" >&2
     failures=$((failures + 1))
 fi
+assert_provider_observed audit-unavailable
 
 if [[ "$failures" -ne 0 ]]; then
     echo "ci-queue-wait tri-state regression failed ($failures assertions)" >&2

packages/mosaic/framework/tools/git/test-git-credential-mosaic.sh

@@ -16,6 +16,7 @@
 # NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
 
 set -euo pipefail
+umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/git-credential-mosaic}"
@@ -34,6 +35,8 @@ mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" \
          "$REPO_DIR"
 
 cp "$SCRIPT_DIR/git-credential-mosaic" "$HELPER"
+cp "$SCRIPT_DIR/resolve-credential-envelope.py" "$FAKE_HOME/.config/mosaic/tools/git/resolve-credential-envelope.py"
+cp "$SCRIPT_DIR/resolve-legacy-token.py" "$FAKE_HOME/.config/mosaic/tools/git/resolve-legacy-token.py"
 chmod +x "$HELPER"
 
 git -C "$REPO_DIR" init -q
@@ -84,6 +87,22 @@ git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
 out=$(run_helper "git.mosaicstack.dev" "")
 assert_eq "shared fallback: username" "username=git" "$(echo "$out" | grep '^username=')"
 assert_eq "shared fallback: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+out=$(run_helper "git.mosaicstack.dev" "" MOSAIC_CREDENTIAL_TRACE=1 2>"$WORK_DIR/shared-trace.stderr")
+err=$(cat "$WORK_DIR/shared-trace.stderr")
+if [[ "$err" != *"resolution_path=shared"* || "$err" != *"shared_path_entered=true"* ]]; then
+  echo "FAIL: shared credential materialization did not emit its computed path" >&2
+  fail=1
+fi
+
+set +e
+out=$(run_helper "git.mosaicstack.dev" "" MOSAIC_AGENT_NAME=synthetic-seat 2>"$WORK_DIR/fleet-unset.stderr")
+rc=$?
+set -e
+err=$(cat "$WORK_DIR/fleet-unset.stderr")
+if [[ "$rc" -eq 0 || "$out" != *"quit=true"* || "$err" != *"reason=identity-required"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: fleet unset identity did not stop at the resolver marker" >&2
+  fail=1
+fi
 
 # ---------------------------------------------------------------------------
 # 2. git-supplied username resolves to an identity WITH a per-slot token ->
@@ -93,6 +112,21 @@ echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-to
 out=$(run_helper "git.mosaicstack.dev" "agentA")
 assert_eq "username-resolved identity: username" "username=agentA" "$(echo "$out" | grep '^username=')"
 assert_eq "username-resolved identity: password" "password=agentA-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+out=$(run_helper "git.mosaicstack.dev" "agentA" MOSAIC_AGENT_NAME=agentA MOSAIC_CREDENTIAL_TRACE=1 2>"$WORK_DIR/identity-trace.stderr")
+err=$(cat "$WORK_DIR/identity-trace.stderr")
+if [[ "$err" != *"resolution_path=identity"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: identity credential did not emit its computed path" >&2
+  fail=1
+fi
+set +e
+out=$(run_helper "git.mosaicstack.dev" "agentA" MOSAIC_AGENT_NAME=agentB 2>"$WORK_DIR/fleet-mismatch.stderr")
+rc=$?
+set -e
+err=$(cat "$WORK_DIR/fleet-mismatch.stderr")
+if [[ "$rc" -eq 0 || "$out" != *"quit=true"* || "$err" != *"reason=provider-identity-mismatch"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: fleet identity override was not refused before token resolution" >&2
+  fail=1
+fi
 
 # ---------------------------------------------------------------------------
 # 3. git config mosaic.gitIdentity (per-worktree) beats git-supplied username.
@@ -120,6 +154,16 @@ out=$(run_helper "git.mosaicstack.dev" "no-such-agent")
 assert_eq "no per-slot token: username" "username=git" "$(echo "$out" | grep '^username=')"
 assert_eq "no per-slot token: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
 
+set +e
+out=$(run_helper "git.mosaicstack.dev" "no-such-agent" MOSAIC_AGENT_NAME=no-such-agent 2>"$WORK_DIR/fleet-missing.stderr")
+rc=$?
+set -e
+err=$(cat "$WORK_DIR/fleet-missing.stderr")
+if [[ "$rc" -eq 0 || "$out" != *"quit=true"* || "$err" != *"reason=no-token-for-identity"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: fleet missing token did not stop at the resolver marker" >&2
+  fail=1
+fi
+
 # ---------------------------------------------------------------------------
 # 6. Correct per-slot token PATH is chosen per host: same agent id, different
 #    host prefix (gitea-usc- vs gitea-mosaicstack-).
@@ -135,14 +179,47 @@ assert_eq "host-scoped token path (cross-host must not leak): username" "usernam
 assert_eq "host-scoped token path (cross-host must not leak): password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
 
 # ---------------------------------------------------------------------------
-# 7. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
+# 7. Governed envelopes use the same binding, owner, mode, and digest checks.
+# ---------------------------------------------------------------------------
+envelope="$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentE.credential.json"
+python3 - "$envelope" <<'PY'
+import hashlib, json, sys
+secret = "agentE-envelope-token"
+json.dump({
+  "schemaVersion": 1, "identity": "agentE", "estate": "homelab",
+  "host": "git.mosaicstack.dev", "providerLogin": "agentE",
+  "tokenName": "mosaic-agentE-1", "scopes": ["write:repository"],
+  "createdAt": "2026-08-05T00:00:00.000Z",
+  "tokenDigest": hashlib.sha256(secret.encode()).hexdigest(), "token": secret,
+}, open(sys.argv[1], "w", encoding="utf-8"))
+PY
+chmod 600 "$envelope"
+out=$(run_helper "git.mosaicstack.dev" "agentE" MOSAIC_AGENT_NAME=agentE MOSAIC_CREDENTIAL_ESTATE=homelab)
+assert_eq "governed envelope: password" "password=agentE-envelope-token" "$(echo "$out" | grep '^password=')"
+echo -n "must-not-fallback-legacy" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentE.token"
+chmod 640 "$envelope"
+set +e
+out=$(run_helper "git.mosaicstack.dev" "agentE" MOSAIC_AGENT_NAME=agentE MOSAIC_CREDENTIAL_ESTATE=homelab 2>"$WORK_DIR/envelope-mode.stderr")
+rc=$?
+set -e
+if [[ "$rc" -eq 0 || "$out" == *"password="* ]]; then
+  echo "FAIL: permissive envelope was consumed" >&2
+  fail=1
+fi
+
+# ---------------------------------------------------------------------------
+# 8. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
 #    remotes, e.g. github.com via a different credential helper).
 # ---------------------------------------------------------------------------
 out=$(run_helper "github.com" "agentA")
 assert_eq "unknown host: no output" "" "$out"
+out=$(run_helper "github.com" "[email protected]")
+assert_eq "unknown host with non-Mosaic username: no output" "" "$out"
+out=$(run_helper "github.com" "github-user" MOSAIC_AGENT_NAME=agentA)
+assert_eq "unknown host in fleet context: no output" "" "$out"
 
 # ---------------------------------------------------------------------------
-# 8. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
+# 9. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
 #    protocol: this helper only implements get).
 # ---------------------------------------------------------------------------
 store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" bash "$HELPER" store <<EOF

packages/mosaic/framework/tools/git/test-gitea-token-identity.sh

@@ -28,6 +28,7 @@
 # HOME. NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
 
 set -euo pipefail
+umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/gitea-token-identity}"
@@ -85,7 +86,23 @@ call_get_gitea_token() {
 # ---------------------------------------------------------------------------
 git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
 out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "shared fallback (no identity)" "shared-mosaicstack-token" "$out"
+assert_eq "interactive shared fallback (no identity)" "shared-mosaicstack-token" "$out"
+
+# Fleet context with no explicit identity refuses before the shared path. This
+# is the marker-emission positive control for the fail-closed mechanism.
+set +e
+out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_AGENT_NAME=synthetic-seat 2>"$WORK_DIR/stderr-fleet-unset.tmp")
+rc=$?
+set -e
+err=$(cat "$WORK_DIR/stderr-fleet-unset.tmp")
+if [[ "$rc" -eq 0 || -n "$out" ]]; then
+  echo "FAIL: fleet unset identity must refuse with empty stdout" >&2
+  fail=1
+fi
+if [[ "$err" != *"MOSAIC_CREDENTIAL_REFUSAL"* || "$err" != *"reason=identity-required"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: fleet unset identity did not emit the stable resolver refusal marker: $err" >&2
+  fail=1
+fi
 
 # ---------------------------------------------------------------------------
 # 2. git config mosaic.gitIdentity resolves to an agent WITH a per-slot
@@ -93,8 +110,17 @@ assert_eq "shared fallback (no identity)" "shared-mosaicstack-token" "$out"
 # ---------------------------------------------------------------------------
 echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
 git -C "$REPO_DIR" config mosaic.gitIdentity agentA
-out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "git-config identity token" "agentA-mosaicstack-token" "$out"
+out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_AGENT_NAME=agentA)
+assert_eq "confirmed fleet identity bypasses shared path" "agentA-mosaicstack-token" "$out"
+set +e
+out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_AGENT_NAME=agentA MOSAIC_GIT_IDENTITY=agentB 2>"$WORK_DIR/fleet-mismatch.stderr")
+rc=$?
+set -e
+err=$(cat "$WORK_DIR/fleet-mismatch.stderr")
+if [[ "$rc" -eq 0 || -n "$out" || "$err" != *"reason=provider-identity-mismatch"* || "$err" != *"shared_path_entered=false"* ]]; then
+  echo "FAIL: fleet identity override was not refused before token resolution" >&2
+  fail=1
+fi
 
 # ---------------------------------------------------------------------------
 # 3. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
@@ -143,13 +169,17 @@ assert_failloud() {
     echo "$stderr" >&2
     fail=1
   fi
+  if [[ "$stderr" != *"MOSAIC_CREDENTIAL_REFUSAL"* || "$stderr" != *"reason=no-token-for-identity"* || "$stderr" != *"shared_path_entered=false"* ]]; then
+    echo "FAIL: $desc — stable resolver refusal marker missing: $stderr" >&2
+    fail=1
+  fi
   if [[ "$stderr" != *"$expected_tok_path"* ]]; then
     echo "FAIL: $desc — stderr does not name the expected per-slot token path '$expected_tok_path':" >&2
     echo "$stderr" >&2
     fail=1
   fi
-  if [[ "$stderr" == *"shared"*"token"* ]]; then
-    echo "FAIL: $desc — stderr unexpectedly mentions a shared token value:" >&2
+  if [[ "$stderr" == *"shared-mosaicstack-token"* || "$stderr" == *"shared-usc-token"* ]]; then
+    echo "FAIL: $desc — stderr unexpectedly contains a shared credential value:" >&2
     echo "$stderr" >&2
     fail=1
   fi

packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh

@@ -39,11 +39,12 @@ ORIG_PATH="$PATH"
 # loop — which would make the control a false negative. A root dotfile is
 # operator-owned (unknown→operator), so the sync loop skips it. Clean up on exit.
 STRIPPED="$FW/.install-rollback-control.tmp.sh"
+SIGNALED="$FW/.install-signal-control.tmp.sh"
 NOEXIT="$FW/.install-noexit-control.tmp.sh"
 D1CTRL="$FW/.install-d1guard-control.tmp.sh"
 D2CTRL="$FW/.install-d2guard-control.tmp.sh"
-rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
-trap 'rm -f "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT
+rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+trap 'rm -f "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"' EXIT
 
 pass=0; fail=0
 chk() { if eval "$2"; then echo "  ✓ $1"; pass=$((pass + 1)); else echo "  ✗ $1"; fail=$((fail + 1)); fi; }
@@ -180,41 +181,86 @@ chk "[control] without -E the mid-sync corruption survives (no rollback)" \
 # ── Part C: an INT/TERM interrupt must terminate, not resume (blocker-A) ──────
 # A bash signal trap that merely returns lets the script continue past the
 # interrupt — restoring the snapshot, then resuming the sync and reporting
-# success. We inject a SIGTERM mid-sync with a cp that SUCCEEDS (so set -e never
-# fires and ONLY the signal path governs), and assert the shipped installer
-# restores AND exits without reporting success. The control strips `exit 1` from
-# the trap and shows the buggy resume-to-success.
-make_term_shim() {
-  local dir="$1"
-  cat > "$dir/cp" <<SHIM
-#!/usr/bin/env bash
-dest="\${@: -1}"
-case "\$dest" in
-  */$POISON_REL)
-    kill -TERM "\$PPID" 2>/dev/null   # signal install.sh; the copy still succeeds
-    exec env PATH="$ORIG_PATH" cp "\$@" ;;
-esac
-exec env PATH="$ORIG_PATH" cp "\$@"
-SHIM
-  chmod +x "$dir/cp"
+# success. The earlier test used a child cp shim to signal its parent, making
+# child completion race Bash's interrupted wait. Concurrency is not part of the
+# guarded property: sync_framework_keep() runs in the installer's own Bash
+# process, and `kill` is a builtin. Generate two installer fixtures that signal
+# themselves at the same known mid-sync point. Their TERM handlers emit the same
+# observable before diverging, so missing signal delivery fails BOTH arms rather
+# than manufacturing a pass. The only semantic difference between fixtures is
+# the explicit `exit 1` whose load-bearing behavior this control proves.
+TERM_MARKER='[test-control] TERM handler entered'
+HANDLER_WITH_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot; exit 1' TERM  # TEST-TERM-HANDLER"
+HANDLER_WITHOUT_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot' TERM  # TEST-TERM-HANDLER"
+
+make_signal_installer() {
+  local output="$1" handler="$2"
+  local target_trap="trap 'restore_snapshot; exit 1' ERR INT TERM"
+  local target_cp='    cp "$abs" "$dst/$rel"'
+  local inject_open="    if [[ \"\$rel\" == \"$POISON_REL\" ]]; then"
+  local inject_kill='      kill -TERM "$$"  # TEST-TERM-INJECTION'
+  local inject_close='    fi'
+
+  if ! awk \
+    -v target_trap="$target_trap" -v target_cp="$target_cp" \
+    -v handler="$handler" -v inject_open="$inject_open" \
+    -v inject_kill="$inject_kill" -v inject_close="$inject_close" '
+      $0 == target_cp {
+        print inject_open
+        print inject_kill
+        print inject_close
+        injection_sites++
+      }
+      { print }
+      $0 == target_trap {
+        print handler
+        handler_sites++
+      }
+      END {
+        if (handler_sites != 1 || injection_sites != 1) exit 42
+      }
+    ' "$INSTALL" > "$output"; then
+    rm -f "$output"
+    fail "Could not construct the self-TERM control installer at the exact trap/copy sites"
+    exit 1
+  fi
+  chmod +x "$output"
 }
 
-# Run one keep-mode upgrade with the SIGTERM shim. Echoes "<exit>\t<out>\t<home>".
+make_signal_installer "$SIGNALED" "$HANDLER_WITH_EXIT"
+make_signal_installer "$NOEXIT" "$HANDLER_WITHOUT_EXIT"
+signal_fixture_ready() {
+  local fixture="$1" expected_handler="$2"
+  [[ "$(grep -cF '# TEST-TERM-INJECTION' "$fixture")" -eq 1 ]] \
+    && [[ "$(grep -cF '# TEST-TERM-HANDLER' "$fixture")" -eq 1 ]] \
+    && grep -Fqx "$expected_handler" "$fixture"
+}
+signaled_fixture_ready() { signal_fixture_ready "$SIGNALED" "$HANDLER_WITH_EXIT"; }
+noexit_fixture_ready() { signal_fixture_ready "$NOEXIT" "$HANDLER_WITHOUT_EXIT"; }
+chk "[signal] shipped fixture has exactly one self-TERM injection and marked handler" \
+  "signaled_fixture_ready"
+chk "[control] no-exit fixture has exactly one self-TERM injection and marked handler" \
+  "noexit_fixture_ready"
+chk "[control] removing the explicit TERM exit changes the fixture" \
+  "! cmp -s '$SIGNALED' '$NOEXIT'"
+
+# Run one keep-mode upgrade whose own shell delivers SIGTERM synchronously at
+# the selected copy. Echoes "<exit>\t<out>\t<home>".
 run_signal_upgrade() {
-  local installer="$1" H OUT SHIM rc
-  H=$(mktemp -d); OUT=$(mktemp); SHIM=$(mktemp -d)
+  local installer="$1" H OUT rc
+  H=$(mktemp -d); OUT=$(mktemp)
   seed_home "$H"
-  make_term_shim "$SHIM"
   set +e
-  PATH="$SHIM:$ORIG_PATH" \
+  PATH="$ORIG_PATH" \
     MOSAIC_HOME="$H" MOSAIC_INSTALL_MODE=keep MOSAIC_SYNC_ONLY=1 bash "$installer" >"$OUT" 2>&1
   rc=$?
   set -e 2>/dev/null || true
-  rm -rf "$SHIM"
   printf '%s\t%s\t%s\n' "$rc" "$OUT" "$H"
 }
 
-IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$INSTALL")
+IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$SIGNALED")
+chk "[signal] TERM handler observable fires exactly once" \
+  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTC')\" -eq 1 ]"
 chk "[signal] SIGTERM mid-sync aborts non-zero (trap exits, does not resume)" \
   "[ '$rcC' -ne 0 ]"
 chk "[signal] restore_snapshot fires on the interrupt" \
@@ -222,13 +268,13 @@ chk "[signal] restore_snapshot fires on the interrupt" \
 chk "[signal] does NOT resume to report sync success after the interrupt" \
   "! grep -q 'file phase complete' '$OUTC'"
 
-# Control: strip `exit 1` from the signal trap → the handler returns, the script
-# resumes past the interrupt and wrongly reports success. In $FW so SOURCE_DIR resolves.
-sed "s/trap 'restore_snapshot; exit 1' ERR INT TERM/trap 'restore_snapshot' ERR INT TERM/" \
-  "$INSTALL" > "$NOEXIT"
-chk "[control] the exit-strip actually changed the installer" \
-  "! cmp -s '$INSTALL' '$NOEXIT'"
-IFS=$'\t' read -r _rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
+IFS=$'\t' read -r rcD OUTD HD < <(run_signal_upgrade "$NOEXIT")
+chk "[control] TERM handler observable fires exactly once" \
+  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTD')\" -eq 1 ]"
+chk "[control] without 'exit 1' the handler restores before returning" \
+  "grep -q 'restoring previous state from snapshot' '$OUTD'"
+chk "[control] without 'exit 1' the installer exits zero after resuming" \
+  "[ '$rcD' -eq 0 ]"
 chk "[control] without 'exit 1' the trap resumes and reports sync success (the bug)" \
   "grep -q 'file phase complete' '$OUTD'"
 
@@ -309,10 +355,10 @@ chk "[control] without the D2 recovery line the operator gets no snapshot pointe
 # Reap any snapshot the reset-fail runs left in /tmp (reset failed → never cleaned).
 grep -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTH" 2>/dev/null | head -1 | while read -r s; do rm -rf "$s"; done
 
-# Cleanup ($STRIPPED / $NOEXIT / $D1CTRL / $D2CTRL are also removed by the EXIT trap).
+# Cleanup (generated installer controls are also removed by the EXIT trap).
 for d in "$HA" "$REFA" "$HB" "$REFB" "$HC" "$HD" "$HE" "$REFE" "$HF" "$REFF" "$HG" "$HH"; do rm -rf "$d"; done
 rm -f "$OUTA" "$OUTB" "$OUTC" "$OUTD" "$OUTE" "$OUTF" "$OUTG" "$OUTH" \
-  "$STRIPPED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
+  "$STRIPPED" "$SIGNALED" "$NOEXIT" "$D1CTRL" "$D2CTRL"
 
 echo
 echo "RESULT: $pass passed, $fail failed"

packages/mosaic/src/cli.ts

@@ -14,6 +14,7 @@ import { registerTelemetryCommand } from './commands/telemetry.js';
 import { registerAgentCommand } from './commands/agent.js';
 import { registerInteractionCommand } from './commands/interaction.js';
 import { registerConfigCommand } from './commands/config.js';
+import { registerCredentialCommand } from './commands/cred.js';
 import { registerFleetCommand } from './commands/fleet.js';
 import { registerMissionCommand } from './commands/mission.js';
 import { registerUninstallCommand } from './commands/uninstall.js';
@@ -371,6 +372,10 @@ registerInteractionCommand(program);
 
 registerFleetCommand(program);
 
+// ─── credential governance ─────────────────────────────────────────────
+
+registerCredentialCommand(program);
+
 // ─── config ────────────────────────────────────────────────────────────
 
 registerConfigCommand(program);

packages/mosaic/src/commands/cred.spec.ts

@@ -0,0 +1,795 @@
+import {
+  chmod,
+  mkdtemp,
+  mkdir,
+  open,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  symlink,
+  unlink,
+  writeFile,
+} from 'node:fs/promises';
+import { writeSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  CredentialAuditJournal,
+  CredentialJournalError,
+  listCredentialJournals,
+} from '../credentials/audit-journal.js';
+import { parseCredentialEstateRegistry } from '../credentials/estate-registry.js';
+import { FileCredentialStore } from '../credentials/file-credential-store.js';
+import { credentialLifecycleLocksDirectory } from '../credentials/lifecycle.js';
+import { TeaLoginStore } from '../credentials/tea-login-store.js';
+import { executeCredentialGet, executeCredentialRotate, executeCredentialWire } from './cred.js';
+
+let cleanup: string | undefined;
+afterEach(async (): Promise<void> => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+  if (cleanup !== undefined) await rm(cleanup, { recursive: true, force: true });
+  cleanup = undefined;
+});
+
+async function fixture(): Promise<{
+  readonly mosaicHome: string;
+  readonly registryPath: string;
+  readonly tokenDirectory: string;
+  readonly stateRoot: string;
+}> {
+  cleanup = await mkdtemp(join(tmpdir(), 'mosaic-cred-command-'));
+  await chmod(cleanup, 0o700);
+  const mosaicHome = join(cleanup, 'mosaic');
+  const credentialDirectory = join(mosaicHome, 'cred');
+  await mkdir(credentialDirectory, { recursive: true, mode: 0o700 });
+  const registryPath = join(credentialDirectory, 'estates.json');
+  await writeFile(
+    registryPath,
+    JSON.stringify({
+      version: 1,
+      estates: [
+        {
+          name: 'homelab',
+          hosts: [
+            {
+              host: 'git.example.invalid',
+              provider: 'gitea',
+              apiBaseUrl: 'https://git.example.invalid',
+              tokenPrefix: 'gitea-example',
+            },
+          ],
+        },
+      ],
+    }),
+    { mode: 0o600 },
+  );
+  return {
+    mosaicHome,
+    registryPath,
+    tokenDirectory: join(mosaicHome, 'secrets', 'gitea-tokens'),
+    stateRoot: join(cleanup, 'state'),
+  };
+}
+
+describe('credential lifecycle command controls', (): void => {
+  it('returns the visible open rotation journal when protected authority resolution fails', async (): Promise<void> => {
+    const paths = await fixture();
+    const registry = parseCredentialEstateRegistry(await readFile(paths.registryPath, 'utf8'));
+    await mkdir(join(paths.mosaicHome, 'secrets'), { mode: 0o700 });
+    const store = new FileCredentialStore(paths.tokenDirectory, registry);
+    await store.put(
+      {
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        providerLogin: 'seat-name',
+        tokenName: 'old-generation',
+        scopes: ['write:repository'],
+        createdAt: '2026-08-05T00:00:00.000Z',
+      },
+      new TextEncoder().encode('old-token-canary'),
+    );
+
+    const result = await executeCredentialRotate('seat-name', {
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      actor: 'seat-name',
+      authorityFd: '999',
+      tokenName: 'new-generation',
+      mosaicHome: paths.mosaicHome,
+      registry: paths.registryPath,
+      tokenDir: paths.tokenDirectory,
+      stateDir: paths.stateRoot,
+    });
+
+    expect(result.outcome).toBe('error');
+    expect(result.mutation).toBe('none');
+    expect(result.audit.state).toBe('open');
+    expect(result.audit.journalId).not.toBeNull();
+    await expect(listCredentialJournals(paths.stateRoot)).resolves.toContainEqual(
+      expect.objectContaining({ id: result.audit.journalId, state: 'open' }),
+    );
+  });
+
+  it.each(['partialWrite', 'shortWrite', 'recordMutation', 'seal'] as const)(
+    'handles %s without overstating credential disclosure',
+    async (method): Promise<void> => {
+      const paths = await fixture();
+      const registry = parseCredentialEstateRegistry(await readFile(paths.registryPath, 'utf8'));
+      await mkdir(join(paths.mosaicHome, 'secrets'), { mode: 0o700 });
+      const store = new FileCredentialStore(paths.tokenDirectory, registry);
+      await store.put(
+        {
+          identity: 'seat-name',
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          providerLogin: 'seat-name',
+          tokenName: 'active-generation',
+          scopes: ['write:repository'],
+          createdAt: '2026-08-05T00:00:00.000Z',
+        },
+        new TextEncoder().encode('seat-token-canary'),
+      );
+      const authorityPath = join(cleanup!, 'authority.json');
+      const outputPath = join(cleanup!, 'credential.out');
+      await writeFile(
+        authorityPath,
+        JSON.stringify({
+          identity: 'seat-name',
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          secret: 'seat-token-canary',
+        }),
+        { mode: 0o600 },
+      );
+      vi.stubGlobal(
+        'fetch',
+        async (): Promise<Response> =>
+          new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          }),
+      );
+      if (method === 'recordMutation') {
+        const original = CredentialAuditJournal.prototype.recordMutation;
+        vi.spyOn(CredentialAuditJournal.prototype, 'recordMutation').mockImplementation(
+          async function (this: CredentialAuditJournal, decision): Promise<void> {
+            if (decision === 'credential-issued') {
+              throw new CredentialJournalError('journal-unavailable', 'injected append failure');
+            }
+            await original.call(this, decision);
+          },
+        );
+      } else if (method === 'seal') {
+        const original = CredentialAuditJournal.prototype.seal;
+        vi.spyOn(CredentialAuditJournal.prototype, 'seal').mockImplementation(async function (
+          this: CredentialAuditJournal,
+          outcome,
+          reason,
+        ): Promise<string> {
+          if (outcome === 'ok') {
+            throw new CredentialJournalError('journal-unavailable', 'injected seal failure');
+          }
+          return original.call(this, outcome, reason);
+        });
+      }
+      let writes = 0;
+      const authority = await open(authorityPath, 'r');
+      const output = await open(outputPath, 'w+', 0o600);
+      try {
+        const result = await executeCredentialGet('seat-name', {
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          actor: 'seat-name',
+          authorityFd: authority.fd.toString(),
+          outputFd: output.fd.toString(),
+          mosaicHome: paths.mosaicHome,
+          registry: paths.registryPath,
+          tokenDir: paths.tokenDirectory,
+          stateDir: paths.stateRoot,
+          credentialWrite:
+            method === 'partialWrite'
+              ? (fd, data): number => {
+                  writes += 1;
+                  if (writes === 2) throw new Error('injected partial write failure');
+                  return writeSync(fd, data);
+                }
+              : method === 'shortWrite'
+                ? (fd, data): number =>
+                    writeSync(fd, data.subarray(0, Math.max(1, Math.floor(data.byteLength / 2))))
+                : undefined,
+        });
+        if (method === 'shortWrite') {
+          expect(result).toMatchObject({
+            outcome: 'ok',
+            mutation: 'none',
+            reason: { code: 'get-verified' },
+          });
+        } else {
+          expect(result).toMatchObject({
+            outcome: 'indeterminate',
+            mutation: method === 'partialWrite' ? 'unknown' : 'applied',
+            reason: { code: 'credential-issuance-indeterminate' },
+          });
+        }
+        const emitted = await readFile(outputPath, 'utf8');
+        if (method === 'partialWrite') {
+          expect(emitted).toContain('username=seat-name');
+          expect(emitted).not.toContain('seat-token-canary');
+        } else {
+          expect(emitted).toContain('password=seat-token-canary');
+        }
+      } finally {
+        await output.close();
+        await authority.close();
+      }
+    },
+  );
+
+  it.each(['absent', 'divergent'] as const)(
+    'restores an independently %s Tea pre-state after rotation journal failure',
+    async (teaState): Promise<void> => {
+      const paths = await fixture();
+      const registry = parseCredentialEstateRegistry(await readFile(paths.registryPath, 'utf8'));
+      await mkdir(join(paths.mosaicHome, 'secrets'), { mode: 0o700 });
+      const store = new FileCredentialStore(paths.tokenDirectory, registry);
+      await store.put(
+        {
+          identity: 'seat-name',
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          providerLogin: 'seat-name',
+          tokenName: 'old-generation',
+          scopes: ['write:repository'],
+          createdAt: '2026-08-05T00:00:00.000Z',
+        },
+        new TextEncoder().encode('old-token'),
+      );
+      const teaConfig = join(cleanup!, 'tea', 'config.yml');
+      const teaStore = new TeaLoginStore(teaConfig);
+      if (teaState === 'divergent') {
+        await teaStore.put(
+          'seat-name',
+          'git.example.invalid',
+          new TextEncoder().encode('divergent-tea-token'),
+        );
+      }
+      const authorityPath = join(cleanup!, 'authority.json');
+      await writeFile(
+        authorityPath,
+        JSON.stringify({
+          identity: 'seat-name',
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          secret: 'authority-canary',
+        }),
+        { mode: 0o600 },
+      );
+      let replacementRevoked = false;
+      vi.stubGlobal('fetch', async (input: string | URL | Request, init?: RequestInit) => {
+        const url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url);
+        const method = init?.method ?? 'GET';
+        if (url.pathname === '/api/v1/user') {
+          return new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          });
+        }
+        if (url.pathname.endsWith('/tokens') && method === 'POST') {
+          return new Response(
+            JSON.stringify({
+              name: 'new-generation',
+              sha1: 'replacement-token',
+              scopes: ['write:repository'],
+            }),
+            { status: 201, headers: { 'content-type': 'application/json' } },
+          );
+        }
+        if (url.pathname.endsWith('/tokens') && method === 'GET') {
+          return new Response(
+            JSON.stringify(
+              replacementRevoked ? [] : [{ name: 'new-generation', scopes: ['write:repository'] }],
+            ),
+            { status: 200, headers: { 'content-type': 'application/json' } },
+          );
+        }
+        if (url.pathname.endsWith('/tokens/new-generation') && method === 'DELETE') {
+          replacementRevoked = true;
+          return new Response(null, { status: 204 });
+        }
+        throw new Error(`unexpected provider request: ${method} ${url.pathname}`);
+      });
+      let mintRecords = 0;
+      const recordMutation = CredentialAuditJournal.prototype.recordMutation;
+      vi.spyOn(CredentialAuditJournal.prototype, 'recordMutation').mockImplementation(
+        async function (this: CredentialAuditJournal, decision): Promise<void> {
+          if (decision === 'token-mint-applied') {
+            mintRecords += 1;
+            if (mintRecords === 2) {
+              throw new CredentialJournalError('journal-unavailable', 'injected rotation failure');
+            }
+          }
+          await recordMutation.call(this, decision);
+        },
+      );
+      const authority = await open(authorityPath, 'r');
+      try {
+        const result = await executeCredentialRotate('seat-name', {
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          actor: 'seat-name',
+          authorityFd: authority.fd.toString(),
+          tokenName: 'new-generation',
+          mosaicHome: paths.mosaicHome,
+          registry: paths.registryPath,
+          tokenDir: paths.tokenDirectory,
+          stateDir: paths.stateRoot,
+          teaConfig,
+        });
+        expect(result).toMatchObject({ outcome: 'error', mutation: 'none' });
+        if (teaState === 'absent') {
+          expect(teaStore.snapshot('seat-name', 'git.example.invalid')).toBeUndefined();
+        } else {
+          expect(
+            teaStore.matchesSecret(
+              'seat-name',
+              'git.example.invalid',
+              new TextEncoder().encode('divergent-tea-token'),
+            ),
+          ).toBe(true);
+        }
+      } finally {
+        await authority.close();
+      }
+    },
+  );
+
+  it('preserves an open nested provision journal in the rotate result', async (): Promise<void> => {
+    const paths = await fixture();
+    const registry = parseCredentialEstateRegistry(await readFile(paths.registryPath, 'utf8'));
+    await mkdir(paths.tokenDirectory, { recursive: true, mode: 0o700 });
+    const store = new FileCredentialStore(paths.tokenDirectory, registry);
+    await store.put(
+      {
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        providerLogin: 'seat-name',
+        tokenName: 'old-generation',
+        scopes: ['write:repository'],
+        createdAt: '2026-08-05T00:00:00.000Z',
+      },
+      new TextEncoder().encode('old-token'),
+    );
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    const snapshot = TeaLoginStore.prototype.snapshot;
+    let snapshotCalls = 0;
+    vi.spyOn(TeaLoginStore.prototype, 'snapshot').mockImplementation(function (
+      this: TeaLoginStore,
+      identity,
+      host,
+    ) {
+      snapshotCalls += 1;
+      if (snapshotCalls === 2) throw new Error('injected nested snapshot failure');
+      return snapshot.call(this, identity, host);
+    });
+    const seal = CredentialAuditJournal.prototype.seal;
+    vi.spyOn(CredentialAuditJournal.prototype, 'seal').mockImplementation(async function (
+      this: CredentialAuditJournal,
+      outcome,
+      reasonCode,
+    ): Promise<string> {
+      if (reasonCode === 'credential-snapshot-unavailable') {
+        throw new CredentialJournalError('journal-unavailable', 'injected nested seal failure');
+      }
+      return seal.call(this, outcome, reasonCode);
+    });
+    const authority = await open(authorityPath, 'r');
+    try {
+      const result = await executeCredentialRotate('seat-name', {
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        actor: 'seat-name',
+        authorityFd: authority.fd.toString(),
+        tokenName: 'new-generation',
+        mosaicHome: paths.mosaicHome,
+        registry: paths.registryPath,
+        tokenDir: paths.tokenDirectory,
+        stateDir: paths.stateRoot,
+        teaConfig: join(cleanup!, 'tea', 'config.yml'),
+      });
+      expect(result).toMatchObject({
+        operation: 'rotate',
+        outcome: 'error',
+        mutation: 'none',
+        audit: { state: 'open' },
+      });
+    } finally {
+      await authority.close();
+    }
+  });
+
+  it('preserves the journal failure diagnosis when rotate lock failure cannot be sealed', async (): Promise<void> => {
+    const paths = await fixture();
+    const registry = parseCredentialEstateRegistry(await readFile(paths.registryPath, 'utf8'));
+    await mkdir(paths.tokenDirectory, { recursive: true, mode: 0o700 });
+    const store = new FileCredentialStore(paths.tokenDirectory, registry);
+    await store.put(
+      {
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        providerLogin: 'seat-name',
+        tokenName: 'old-generation',
+        scopes: ['write:repository'],
+        createdAt: '2026-08-05T00:00:00.000Z',
+      },
+      new TextEncoder().encode('old-token'),
+    );
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    const locksDirectory = credentialLifecycleLocksDirectory();
+    await mkdir(locksDirectory, { recursive: true, mode: 0o700 });
+    const lockPath = join(locksDirectory, 'homelab--git.example.invalid--seat-name.lock');
+    await unlink(lockPath).catch((): void => undefined);
+    await symlink('/dev/null', lockPath);
+    vi.spyOn(CredentialAuditJournal.prototype, 'seal').mockRejectedValue(
+      new CredentialJournalError('journal-recovery-required', 'injected final seal failure'),
+    );
+    const authority = await open(authorityPath, 'r');
+    try {
+      const result = await executeCredentialRotate('seat-name', {
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        actor: 'seat-name',
+        authorityFd: authority.fd.toString(),
+        tokenName: 'new-generation',
+        mosaicHome: paths.mosaicHome,
+        registry: paths.registryPath,
+        tokenDir: paths.tokenDirectory,
+        stateDir: paths.stateRoot,
+        teaConfig: join(cleanup!, 'tea', 'config.yml'),
+      });
+      expect(result).toMatchObject({
+        operation: 'rotate',
+        outcome: 'error',
+        mutation: 'none',
+        reason: { code: 'journal-recovery-required' },
+        audit: { state: 'open' },
+      });
+    } finally {
+      await authority.close();
+      await unlink(lockPath).catch((): void => undefined);
+    }
+  });
+
+  it('refuses an unauthenticated actor before rewriting another seat environment', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'seat-name.env.generated');
+    const before = 'MOSAIC_AGENT_NAME=seat-name\nMOSAIC_AGENT_CLASS=coder\n';
+    await writeFile(seatEnvironment, before, { mode: 0o600 });
+
+    const result = await executeCredentialWire('seat-name', {
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      actor: 'intruder-seat',
+      seatEnv: seatEnvironment,
+      mosaicHome: paths.mosaicHome,
+      registry: paths.registryPath,
+      tokenDir: paths.tokenDirectory,
+      stateDir: paths.stateRoot,
+    });
+
+    expect(result.outcome).toBe('refused');
+    expect(result.mutation).toBe('none');
+    await expect(readFile(seatEnvironment, 'utf8')).resolves.toBe(before);
+  });
+
+  it('authenticates the exact seat and rewrites its roster-derived projection idempotently', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'seat-name.env.generated');
+    await writeFile(seatEnvironment, 'MOSAIC_AGENT_NAME=seat-name\nMOSAIC_AGENT_CLASS=coder\n', {
+      mode: 0o600,
+    });
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    vi.stubGlobal(
+      'fetch',
+      async (): Promise<Response> =>
+        new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    );
+
+    const invoke = async () => {
+      const authority = await open(authorityPath, 'r');
+      try {
+        return await executeCredentialWire('seat-name', {
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          actor: 'seat-name',
+          authorityFd: authority.fd.toString(),
+          seatEnv: seatEnvironment,
+          mosaicHome: paths.mosaicHome,
+          registry: paths.registryPath,
+          tokenDir: paths.tokenDirectory,
+          stateDir: paths.stateRoot,
+        });
+      } finally {
+        await authority.close();
+      }
+    };
+
+    const first = await invoke();
+    const afterFirst = await readFile(seatEnvironment, 'utf8');
+    const second = await invoke();
+    const afterSecond = await readFile(seatEnvironment, 'utf8');
+
+    expect(first.outcome).toBe('ok');
+    expect(second.outcome).toBe('ok');
+    expect(afterSecond).toBe(afterFirst);
+    expect(afterSecond).toContain('MOSAIC_GIT_IDENTITY=seat-name\n');
+    expect(afterSecond).toContain('MOSAIC_CREDENTIAL_ESTATE=homelab\n');
+    expect(afterSecond).toContain('GITEA_LOGIN=seat-name--git.example.invalid\n');
+  });
+
+  it.each(['recordMutation', 'seal'] as const)(
+    'reports an applied wire as indeterminate when audit %s fails after rename',
+    async (method): Promise<void> => {
+      const paths = await fixture();
+      const agents = join(paths.mosaicHome, 'fleet', 'agents');
+      await mkdir(agents, { recursive: true, mode: 0o700 });
+      const seatEnvironment = join(agents, 'seat-name.env.generated');
+      await writeFile(seatEnvironment, 'MOSAIC_AGENT_NAME=seat-name\n', { mode: 0o600 });
+      const authorityPath = join(cleanup!, 'authority.json');
+      await writeFile(
+        authorityPath,
+        JSON.stringify({
+          identity: 'seat-name',
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          secret: 'authority-canary',
+        }),
+        { mode: 0o600 },
+      );
+      vi.stubGlobal(
+        'fetch',
+        async (): Promise<Response> =>
+          new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          }),
+      );
+      vi.spyOn(CredentialAuditJournal.prototype, method).mockRejectedValueOnce(
+        new CredentialJournalError('journal-unavailable', 'injected audit failure'),
+      );
+      const authority = await open(authorityPath, 'r');
+      try {
+        const result = await executeCredentialWire('seat-name', {
+          estate: 'homelab',
+          host: 'git.example.invalid',
+          actor: 'seat-name',
+          authorityFd: authority.fd.toString(),
+          seatEnv: seatEnvironment,
+          mosaicHome: paths.mosaicHome,
+          registry: paths.registryPath,
+          tokenDir: paths.tokenDirectory,
+          stateDir: paths.stateRoot,
+        });
+        expect(result.outcome).toBe('indeterminate');
+        expect(result.mutation).toBe('applied');
+        expect(await readFile(seatEnvironment, 'utf8')).toContain('MOSAIC_GIT_IDENTITY=seat-name');
+      } finally {
+        await authority.close();
+      }
+    },
+  );
+
+  it('refuses to overwrite a roster projection replaced after validation', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'seat-name.env.generated');
+    await writeFile(seatEnvironment, 'MOSAIC_AGENT_NAME=seat-name\n', { mode: 0o600 });
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    vi.stubGlobal(
+      'fetch',
+      async (): Promise<Response> =>
+        new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    );
+    const authority = await open(authorityPath, 'r');
+    try {
+      const result = await executeCredentialWire('seat-name', {
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        actor: 'seat-name',
+        authorityFd: authority.fd.toString(),
+        seatEnv: seatEnvironment,
+        mosaicHome: paths.mosaicHome,
+        registry: paths.registryPath,
+        tokenDir: paths.tokenDirectory,
+        stateDir: paths.stateRoot,
+        wireBeforeRename: async (): Promise<void> => {
+          const replacement = join(agents, 'replacement');
+          await writeFile(replacement, 'MOSAIC_AGENT_NAME=seat-name\nNEW=value\n', { mode: 0o600 });
+          await rename(replacement, seatEnvironment);
+        },
+      });
+      expect(result.outcome).toBe('error');
+      expect(result.mutation).toBe('none');
+      expect(await readFile(seatEnvironment, 'utf8')).toBe(
+        'MOSAIC_AGENT_NAME=seat-name\nNEW=value\n',
+      );
+    } finally {
+      await authority.close();
+    }
+  });
+
+  it('reports directory-sync failure after rename as applied and indeterminate', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'seat-name.env.generated');
+    await writeFile(seatEnvironment, 'MOSAIC_AGENT_NAME=seat-name\n', { mode: 0o600 });
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    vi.stubGlobal(
+      'fetch',
+      async (): Promise<Response> =>
+        new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+    );
+    const authority = await open(authorityPath, 'r');
+    try {
+      const result = await executeCredentialWire('seat-name', {
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        actor: 'seat-name',
+        authorityFd: authority.fd.toString(),
+        seatEnv: seatEnvironment,
+        mosaicHome: paths.mosaicHome,
+        registry: paths.registryPath,
+        tokenDir: paths.tokenDirectory,
+        stateDir: paths.stateRoot,
+        wireDirectorySync: async (): Promise<void> => {
+          throw new Error('injected directory sync failure');
+        },
+      });
+      expect(result.outcome).toBe('indeterminate');
+      expect(result.mutation).toBe('applied');
+      expect(await readFile(seatEnvironment, 'utf8')).toContain('MOSAIC_GIT_IDENTITY=seat-name');
+    } finally {
+      await authority.close();
+    }
+  });
+
+  it('removes a temporary projection when directory revalidation fails before rename', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'seat-name.env.generated');
+    await writeFile(seatEnvironment, 'MOSAIC_AGENT_NAME=seat-name\n', { mode: 0o600 });
+    const authorityPath = join(cleanup!, 'authority.json');
+    await writeFile(
+      authorityPath,
+      JSON.stringify({
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        secret: 'authority-canary',
+      }),
+      { mode: 0o600 },
+    );
+    vi.stubGlobal('fetch', async (): Promise<Response> => {
+      await chmod(agents, 0o777);
+      return new Response(JSON.stringify({ id: 7, login: 'seat-name' }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    });
+    const authority = await open(authorityPath, 'r');
+    try {
+      const result = await executeCredentialWire('seat-name', {
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        actor: 'seat-name',
+        authorityFd: authority.fd.toString(),
+        seatEnv: seatEnvironment,
+        mosaicHome: paths.mosaicHome,
+        registry: paths.registryPath,
+        tokenDir: paths.tokenDirectory,
+        stateDir: paths.stateRoot,
+      });
+      expect(result.outcome).toBe('error');
+      expect(await readdir(agents)).toEqual(['seat-name.env.generated']);
+    } finally {
+      await authority.close();
+      await chmod(agents, 0o700);
+    }
+  });
+
+  it('refuses a caller-selected seat filename that is not bound to the requested identity', async (): Promise<void> => {
+    const paths = await fixture();
+    const agents = join(paths.mosaicHome, 'fleet', 'agents');
+    await mkdir(agents, { recursive: true, mode: 0o700 });
+    const seatEnvironment = join(agents, 'other-seat.env.generated');
+    const before = 'MOSAIC_AGENT_NAME=other-seat\nMOSAIC_AGENT_CLASS=coder\n';
+    await writeFile(seatEnvironment, before, { mode: 0o600 });
+
+    const result = await executeCredentialWire('seat-name', {
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      actor: 'seat-name',
+      authorityFd: '999',
+      seatEnv: seatEnvironment,
+      mosaicHome: paths.mosaicHome,
+      registry: paths.registryPath,
+      tokenDir: paths.tokenDirectory,
+      stateDir: paths.stateRoot,
+    });
+
+    expect(result.outcome).toBe('refused');
+    expect(result.reason.code).toBe('credential-binding-mismatch');
+    await expect(readFile(seatEnvironment, 'utf8')).resolves.toBe(before);
+  });
+});

packages/mosaic/src/credentials/audit-journal.dto.ts

@@ -0,0 +1,67 @@
+import type { FileHandle } from 'node:fs/promises';
+
+export type CredentialJournalOperation =
+  | 'provision'
+  | 'wire'
+  | 'grant'
+  | 'get'
+  | 'validate'
+  | 'rotate'
+  | 'revoke'
+  | 'whoami'
+  | 'list'
+  | 'audit';
+
+export interface CredentialJournalContextDto {
+  readonly operation: CredentialJournalOperation;
+  readonly actor: string;
+  readonly identity: string;
+  readonly estate: string;
+  readonly host: string;
+  readonly repo: string | null;
+}
+
+export interface CredentialProviderJournalEvidenceDto {
+  readonly endpoint: string;
+  readonly contentType: string;
+  readonly decision: string;
+}
+
+export interface CredentialJournalCorrectionDto {
+  readonly supersedesJournalId: string;
+  readonly correctedByJournalId: string;
+  readonly previousReason: string;
+  readonly correctedReason: string;
+  readonly previousOutcome?: 'ok' | 'refused' | 'error' | 'indeterminate';
+  readonly correctedOutcome?: 'ok' | 'refused' | 'error' | 'indeterminate';
+}
+
+export interface CredentialPopulationCorrectionDto {
+  readonly entries: readonly {
+    readonly identity: string;
+    readonly supersedesJournalIds: readonly string[];
+    readonly settledByJournalId: string;
+    readonly capability: 'confirmed';
+    readonly identityBinding: 'not-measured';
+    readonly mechanism: 'identity-scope-forbidden-in-scope-capability-confirmed';
+  }[];
+}
+
+export interface CredentialJournalRuntimeOptionsDto {
+  readonly id?: string;
+  readonly now?: () => string;
+  readonly syncDirectory?: (path: string) => Promise<void>;
+  readonly rename?: (source: string, destination: string) => Promise<void>;
+  readonly write?: (
+    handle: FileHandle,
+    data: Uint8Array,
+    offset: number,
+    length: number,
+  ) => Promise<number>;
+}
+
+export interface CredentialJournalSummaryDto {
+  readonly id: string;
+  readonly state: 'open' | 'sealed';
+  readonly path: string;
+}

packages/mosaic/src/credentials/audit-journal.spec.ts

@@ -0,0 +1,415 @@
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  open,
+  readFile,
+  rename,
+  rm,
+  symlink,
+  truncate,
+  writeFile,
+} from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { CredentialAuditJournal, listCredentialJournals } from './audit-journal.js';
+
+let cleanup: string | undefined;
+
+async function stateRoot(): Promise<string> {
+  cleanup = await mkdtemp(join(tmpdir(), 'mosaic-cred-journal-'));
+  return join(cleanup, 'state');
+}
+
+afterEach(async (): Promise<void> => {
+  if (cleanup !== undefined) await rm(cleanup, { recursive: true, force: true });
+  cleanup = undefined;
+});
+
+describe('credential durable audit journal', (): void => {
+  it('opens before mutation, appends provider evidence, and seals durably', async (): Promise<void> => {
+    const root = await stateRoot();
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'grant',
+        actor: 'provisioner',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: 'owner/repo',
+      },
+      { id: 'journal-id', now: (): string => '2026-08-05T00:00:00.000Z' },
+    );
+
+    await journal.recordIntent('provider-grant');
+    await journal.recordProviderEvidence({
+      endpoint: 'GET /api/v1/repos/owner/repo',
+      contentType: 'application/json',
+      decision: 'permission-write',
+    });
+    const sealedPath = await journal.seal('ok', 'grant-verified');
+
+    expect(sealedPath).toMatch(/journal-id\.sealed\.jsonl$/);
+    const records = (await readFile(sealedPath, 'utf8')).trim().split('\n');
+    expect(records).toHaveLength(4);
+    expect(records[0]).toContain('"phase":"opened"');
+    expect(records[1]).toContain('"phase":"intent"');
+    expect(records[2]).toContain('"phase":"provider-evidence"');
+    expect(records[3]).toContain('"phase":"sealed"');
+  });
+
+  it('writes every journal record completely when each write makes one-byte progress', async (): Promise<void> => {
+    const root = await stateRoot();
+    let writeCalls = 0;
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'grant',
+        actor: 'provisioner',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: 'owner/repo',
+      },
+      {
+        id: 'short-write',
+        now: (): string => '2026-08-05T00:00:00.000Z',
+        write: async (handle, data, offset, length): Promise<number> => {
+          writeCalls += 1;
+          const result = await handle.write(data, offset, Math.min(1, length), null);
+          return result.bytesWritten;
+        },
+      },
+    );
+
+    await journal.recordIntent('provider-grant');
+    const sealedPath = await journal.seal('ok', 'grant-verified');
+    const records = (await readFile(sealedPath, 'utf8')).trim().split('\n');
+
+    expect(writeCalls).toBeGreaterThan(3);
+    expect(records).toHaveLength(3);
+    expect(records[0]).toContain('"phase":"opened"');
+    expect(records[1]).toContain('"phase":"intent"');
+    expect(records[2]).toContain('"phase":"sealed"');
+  });
+
+  it.each([
+    ['zero', (_remaining: number): number => 0],
+    ['oversized', (remaining: number): number => remaining + 1],
+  ] as const)(
+    'rejects %s journal write progress before reporting an opened journal',
+    async (_label, progress): Promise<void> => {
+      const root = await stateRoot();
+      await expect(
+        CredentialAuditJournal.open(
+          root,
+          {
+            operation: 'grant',
+            actor: 'provisioner',
+            identity: 'seat-name',
+            estate: 'homelab',
+            host: 'git.example.invalid',
+            repo: 'owner/repo',
+          },
+          {
+            id: `invalid-progress-${_label}`,
+            write: async (_handle, _data, _offset, length): Promise<number> => progress(length),
+          },
+        ),
+      ).rejects.toThrow(/journal-unavailable/);
+    },
+  );
+
+  it('keeps a final seal non-accepting while directory durability is pending', async (): Promise<void> => {
+    const root = await stateRoot();
+    let directorySyncs = 0;
+    let signalFinalSync: (() => void) | undefined;
+    let releaseFinalSync: (() => void) | undefined;
+    const finalSyncEntered = new Promise<void>((resolve): void => {
+      signalFinalSync = resolve;
+    });
+    const finalSyncRelease = new Promise<void>((resolve): void => {
+      releaseFinalSync = resolve;
+    });
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'get',
+        actor: 'seat-name',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: null,
+      },
+      {
+        id: 'seal-pending',
+        syncDirectory: async (path): Promise<void> => {
+          directorySyncs += 1;
+          if (directorySyncs === 3) {
+            signalFinalSync?.();
+            await finalSyncRelease;
+          }
+          const handle = await open(path, 'r');
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
+        },
+      },
+    );
+
+    const sealing = journal.seal('ok', 'get-verified');
+    await finalSyncEntered;
+    await expect(listCredentialJournals(root)).resolves.toContainEqual(
+      expect.objectContaining({ id: 'seal-pending', state: 'open' }),
+    );
+    releaseFinalSync?.();
+    await sealing;
+    await expect(listCredentialJournals(root)).resolves.toContainEqual(
+      expect.objectContaining({ id: 'seal-pending', state: 'sealed' }),
+    );
+  });
+
+  it('reverts a failed final seal commit to visible open state', async (): Promise<void> => {
+    const root = await stateRoot();
+    let directorySyncs = 0;
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'get',
+        actor: 'seat-name',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: null,
+      },
+      {
+        id: 'seal-fault',
+        syncDirectory: async (path): Promise<void> => {
+          directorySyncs += 1;
+          if (directorySyncs === 3) throw new Error('injected final directory sync failure');
+          const handle = await open(path, 'r');
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
+        },
+      },
+    );
+
+    await expect(journal.seal('ok', 'get-verified')).rejects.toThrow(/journal-unavailable/);
+    const [entry] = await listCredentialJournals(root);
+    expect(entry).toMatchObject({ id: 'seal-fault', state: 'open' });
+    expect(await readFile(entry?.path ?? '', 'utf8')).not.toContain('"phase":"sealed"');
+  });
+
+  it('uses a non-accepting recovery path when the compensating rename fails', async (): Promise<void> => {
+    const root = await stateRoot();
+    let directorySyncs = 0;
+    let renames = 0;
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'get',
+        actor: 'seat-name',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: null,
+      },
+      {
+        id: 'seal-recovery-fault',
+        syncDirectory: async (path): Promise<void> => {
+          directorySyncs += 1;
+          if (directorySyncs === 3) throw new Error('injected final directory sync failure');
+          const handle = await open(path, 'r');
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
+        },
+        rename: async (source, destination): Promise<void> => {
+          renames += 1;
+          if (renames === 3) throw new Error('injected compensating rename failure');
+          await rename(source, destination);
+        },
+      },
+    );
+
+    await expect(journal.seal('ok', 'get-verified')).rejects.toThrow(/journal-recovery-required/);
+    const [entry] = await listCredentialJournals(root);
+    expect(entry).toMatchObject({ id: 'seal-recovery-fault', state: 'open' });
+    expect(entry?.path).toMatch(/\.recovery\.jsonl$/);
+    expect(await readFile(entry?.path ?? '', 'utf8')).not.toContain('"phase":"sealed"');
+  });
+
+  it.each(['symlink', 'oversized'] as const)(
+    'classifies an unsafe %s sealed-looking journal as open without consuming it',
+    async (kind): Promise<void> => {
+      const root = await stateRoot();
+      const journal = await CredentialAuditJournal.open(root, {
+        operation: 'audit',
+        actor: 'seat-name',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: null,
+      });
+      await journal.closeIncomplete();
+      const journalsDirectory = join(root, 'journals');
+      const candidate = join(journalsDirectory, `unsafe-${kind}.sealed.jsonl`);
+      if (kind === 'symlink') {
+        if (cleanup === undefined) throw new Error('test fixture root is unavailable');
+        const outside = join(cleanup, 'outside-journal');
+        await writeFile(outside, '{"phase":"sealed","outcome":"ok"}\n', { mode: 0o600 });
+        await symlink(outside, candidate);
+      } else {
+        await writeFile(candidate, '', { mode: 0o600 });
+        await truncate(candidate, 4 * 1024 * 1024 + 1);
+      }
+
+      const entry = (await listCredentialJournals(root)).find(
+        (value): boolean => value.id === `unsafe-${kind}`,
+      );
+      expect(entry).toMatchObject({ state: 'open' });
+    },
+  );
+
+  it('leaves an unsealed journal visible for recovery', async (): Promise<void> => {
+    const root = await stateRoot();
+    const journal = await CredentialAuditJournal.open(root, {
+      operation: 'rotate',
+      actor: 'provisioner',
+      identity: 'seat-name',
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      repo: null,
+    });
+
+    const journals = await listCredentialJournals(root);
+
+    expect(journals).toHaveLength(1);
+    expect(journals[0]?.state).toBe('open');
+    await journal.closeIncomplete();
+  });
+
+  it('fails fatally when the durable journal root cannot be created', async (): Promise<void> => {
+    const root = await stateRoot();
+    await writeFile(root, 'not-a-directory', { mode: 0o600 });
+
+    await expect(
+      CredentialAuditJournal.open(root, {
+        operation: 'grant',
+        actor: 'provisioner',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: 'owner/repo',
+      }),
+    ).rejects.toThrow(/journal-unavailable/);
+  });
+
+  it('rejects secret-shaped evidence instead of writing it', async (): Promise<void> => {
+    const root = await stateRoot();
+    const journal = await CredentialAuditJournal.open(root, {
+      operation: 'validate',
+      actor: 'seat-name',
+      identity: 'seat-name',
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      repo: 'owner/repo',
+    });
+
+    await expect(
+      journal.recordProviderEvidence({
+        endpoint: 'GET /api/v1/user',
+        contentType: 'application/json',
+        decision: 'seeded-secret-canary',
+      }),
+    ).rejects.toThrow(/unsafe-audit-value/);
+    const journals = await listCredentialJournals(root);
+    const source = await readFile(journals[0]?.path ?? '', 'utf8');
+    expect(source).not.toContain('seeded-secret-canary');
+    await journal.closeIncomplete();
+  });
+
+  it('refuses a group-writable journal root before opening evidence', async (): Promise<void> => {
+    const root = await stateRoot();
+    await mkdir(root, { mode: 0o700 });
+    await chmod(root, 0o770);
+    await expect(
+      CredentialAuditJournal.open(root, {
+        operation: 'grant',
+        actor: 'provisioner',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: 'owner/repo',
+      }),
+    ).rejects.toThrow(/journal-unavailable/);
+  });
+
+  it('supersedes a false sealed classification without editing the original journal', async (): Promise<void> => {
+    const root = await stateRoot();
+    const journal = await CredentialAuditJournal.open(
+      root,
+      {
+        operation: 'validate',
+        actor: 'be-coder-06',
+        identity: 'seat-name',
+        estate: 'homelab',
+        host: 'git.example.invalid',
+        repo: 'owner/repo',
+      },
+      { id: 'correction-1' },
+    );
+    await journal.recordIntent('classification-correction');
+    await journal.recordCorrection({
+      supersedesJournalId: 'old-sealed-id',
+      correctedByJournalId: 'new-validation-id',
+      previousReason: 'identity-not-found',
+      correctedReason: 'credential-rejected',
+      previousOutcome: 'indeterminate',
+      correctedOutcome: 'refused',
+    });
+    const path = await journal.seal('indeterminate', 'credential-rejected');
+    const source = await readFile(path, 'utf8');
+    expect(source).toContain('"phase":"classification-correction"');
+    expect(source).toContain('"supersedesJournalId":"old-sealed-id"');
+  });
+
+  it('records one settled population correction across a classification chain', async (): Promise<void> => {
+    const root = await stateRoot();
+    const journal = await CredentialAuditJournal.open(root, {
+      operation: 'validate',
+      actor: 'be-coder-06',
+      identity: 'fleet-reconciliation',
+      estate: 'homelab',
+      host: 'git.example.invalid',
+      repo: 'owner/repo',
+    });
+    await journal.recordIntent('classification-correction');
+    await journal.recordPopulationCorrection({
+      entries: [
+        {
+          identity: 'seat-name',
+          supersedesJournalIds: ['v1-2-id', 'v1-4-id', 'v1-4-1-id'],
+          settledByJournalId: 'v1-5-id',
+          capability: 'confirmed',
+          identityBinding: 'not-measured',
+          mechanism: 'identity-scope-forbidden-in-scope-capability-confirmed',
+        },
+      ],
+    });
+    const path = await journal.seal('ok', 'classification-corrected');
+    const source = await readFile(path, 'utf8');
+    expect(source).toContain('"phase":"population-classification-correction"');
+    expect(source).toContain('"capability":"confirmed"');
+    expect(source).toContain('"identityBinding":"not-measured"');
+  });
+});

packages/mosaic/src/credentials/audit-journal.ts

@@ -0,0 +1,467 @@
+import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { constants, lstatSync } from 'node:fs';
+import { open, readdir, rename } from 'node:fs/promises';
+import type { FileHandle } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensureManagedDirectory, readRegularFileSecure } from '../fleet/secure-file.js';
+import type {
+  CredentialJournalContextDto,
+  CredentialJournalCorrectionDto,
+  CredentialJournalRuntimeOptionsDto,
+  CredentialPopulationCorrectionDto,
+  CredentialJournalSummaryDto,
+  CredentialProviderJournalEvidenceDto,
+} from './audit-journal.dto.js';
+
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+const SAFE_ESTATE = /^[a-z0-9][a-z0-9-]*$/;
+const SAFE_HOST = /^[a-z0-9][a-z0-9.-]*$/;
+const SAFE_REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SAFE_ENDPOINT = /^(?:GET|PUT|POST|DELETE) \/[A-Za-z0-9_./{}:-]+$/;
+const SAFE_CONTENT_TYPE = /^[A-Za-z0-9!#$&^_.+/-]+(?:;[A-Za-z0-9=._+-]+)*$/;
+const MAX_JOURNAL_BYTES = 4 * 1024 * 1024;
+const SAFE_DECISIONS = new Set<string>([
+  'provider-grant',
+  'permission-none',
+  'permission-read',
+  'permission-write',
+  'permission-admin',
+  'identity-verified',
+  'inventory-authority-verified',
+  'scope-verified',
+  'grant-verified',
+  'revoke-verified',
+  'rotate-verified',
+  'validation-requested',
+  'whoami-requested',
+  'provision-requested',
+  'rotate-requested',
+  'revoke-requested',
+  'wire-requested',
+  'get-requested',
+  'validation-verified',
+  'team-member-present',
+  'team-member-absent',
+  'team-repository-present',
+  'team-repository-absent',
+  'team-repository-set-verified',
+  'organization-member-present',
+  'organization-member-absent',
+  'collaborator-grant-applied',
+  'team-member-applied',
+  'team-member-rollback-applied',
+  'team-repository-applied',
+  'team-repository-rollback-applied',
+  'transport-write-verified',
+  'token-mint-applied',
+  'token-binding-stored',
+  'tea-login-stored',
+  'tea-login-removed',
+  'provision-rollback-verified',
+  'rotate-rollback-verified',
+  'token-revoke-applied',
+  'wire-applied',
+  'credential-issuance-authorized',
+  'credential-issuance-started',
+  'credential-issuance-possibly-issued',
+  'credential-issued',
+  'classification-correction',
+]);
+
+export class CredentialJournalError extends Error {
+  constructor(
+    public readonly code: string,
+    message: string,
+  ) {
+    super(`Credential audit journal failed: code=${code} ${message}`);
+    this.name = 'CredentialJournalError';
+  }
+}
+
+function assertPrivateDirectory(path: string): void {
+  const stat = lstatSync(path);
+  if (
+    !stat.isDirectory() ||
+    stat.isSymbolicLink() ||
+    stat.uid !== process.getuid?.() ||
+    (stat.mode & 0o022) !== 0
+  ) {
+    throw new CredentialJournalError(
+      'journal-unavailable',
+      'journal directory owner or write permissions are unsafe',
+    );
+  }
+}
+
+function assertContext(context: CredentialJournalContextDto): void {
+  if (
+    !SAFE_NAME.test(context.actor) ||
+    !SAFE_NAME.test(context.identity) ||
+    !SAFE_ESTATE.test(context.estate) ||
+    !SAFE_HOST.test(context.host) ||
+    (context.repo !== null && !SAFE_REPO.test(context.repo))
+  ) {
+    throw new CredentialJournalError(
+      'unsafe-audit-value',
+      'journal context is outside the non-secret allowlist grammar',
+    );
+  }
+}
+
+function assertEvidence(evidence: CredentialProviderJournalEvidenceDto): void {
+  if (
+    !SAFE_ENDPOINT.test(evidence.endpoint) ||
+    !SAFE_CONTENT_TYPE.test(evidence.contentType) ||
+    !SAFE_DECISIONS.has(evidence.decision)
+  ) {
+    throw new CredentialJournalError(
+      'unsafe-audit-value',
+      'provider evidence is outside the non-secret allowlist',
+    );
+  }
+}
+
+async function writeJournalBytes(
+  handle: FileHandle,
+  data: Uint8Array,
+  offset: number,
+  length: number,
+): Promise<number> {
+  const result = await handle.write(data, offset, length, null);
+  return result.bytesWritten;
+}
+
+async function syncDirectory(path: string): Promise<void> {
+  const directory = await open(path, 'r');
+  try {
+    await directory.sync();
+  } finally {
+    await directory.close();
+  }
+}
+
+async function acquireJournalLock(
+  path: string,
+  mode: 'exclusive' | 'shared',
+): Promise<FileHandle | undefined> {
+  let handle: FileHandle | undefined;
+  try {
+    handle = await open(path, constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
+      throw new Error('journal lock file is unsafe');
+    }
+    const acquired = spawnSync('/usr/bin/flock', ['-n', mode === 'exclusive' ? '-x' : '-s', '3'], {
+      stdio: ['ignore', 'ignore', 'ignore', handle.fd],
+    });
+    if (acquired.error !== undefined || acquired.status !== 0) {
+      await handle.close();
+      return undefined;
+    }
+    return handle;
+  } catch {
+    await handle?.close().catch((): void => undefined);
+    return undefined;
+  }
+}
+
+export class CredentialAuditJournal {
+  private closed = false;
+
+  private constructor(
+    private readonly handle: FileHandle,
+    private readonly lockHandle: FileHandle,
+    private readonly openPath: string,
+    private readonly journalsDirectory: string,
+    private readonly id: string,
+    private readonly now: () => string,
+    private readonly syncJournalDirectory: (path: string) => Promise<void>,
+    private readonly renameJournal: (source: string, destination: string) => Promise<void>,
+    private readonly writeJournal: (
+      handle: FileHandle,
+      data: Uint8Array,
+      offset: number,
+      length: number,
+    ) => Promise<number>,
+  ) {}
+
+  static async open(
+    stateRoot: string,
+    context: CredentialJournalContextDto,
+    runtime: CredentialJournalRuntimeOptionsDto = {},
+  ): Promise<CredentialAuditJournal> {
+    assertContext(context);
+    const id = runtime.id ?? randomUUID();
+    if (!SAFE_NAME.test(id)) {
+      throw new CredentialJournalError('unsafe-audit-value', 'journal id is outside the grammar');
+    }
+    const now = runtime.now ?? ((): string => new Date().toISOString());
+    const journalsDirectory = join(stateRoot, 'journals');
+    const locksDirectory = join(stateRoot, 'journal-locks');
+    let handle: FileHandle | undefined;
+    let lockHandle: FileHandle | undefined;
+    try {
+      ensureManagedDirectory(stateRoot, journalsDirectory);
+      ensureManagedDirectory(stateRoot, locksDirectory);
+      assertPrivateDirectory(stateRoot);
+      assertPrivateDirectory(journalsDirectory);
+      assertPrivateDirectory(locksDirectory);
+      const openPath = join(journalsDirectory, `${id}.open.jsonl`);
+      const lockPath = join(locksDirectory, `${id}.lock`);
+      handle = await open(openPath, 'wx', 0o600);
+      lockHandle = await acquireJournalLock(lockPath, 'exclusive');
+      if (lockHandle === undefined) {
+        throw new CredentialJournalError(
+          'journal-unavailable',
+          'journal lock could not be acquired',
+        );
+      }
+      const syncJournalDirectory = runtime.syncDirectory ?? syncDirectory;
+      const renameJournal = runtime.rename ?? rename;
+      const journal = new CredentialAuditJournal(
+        handle,
+        lockHandle,
+        openPath,
+        journalsDirectory,
+        id,
+        now,
+        syncJournalDirectory,
+        renameJournal,
+        runtime.write ?? writeJournalBytes,
+      );
+      await journal.append({ phase: 'opened', at: now(), context });
+      await syncJournalDirectory(journalsDirectory);
+      return journal;
+    } catch (error: unknown) {
+      if (handle !== undefined) await handle.close().catch((): void => undefined);
+      if (lockHandle !== undefined) await lockHandle.close().catch((): void => undefined);
+      if (error instanceof CredentialJournalError) throw error;
+      throw new CredentialJournalError(
+        'journal-unavailable',
+        'durable journal could not be opened and fsynced',
+      );
+    }
+  }
+
+  private async append(record: object): Promise<void> {
+    if (this.closed) {
+      throw new CredentialJournalError('journal-unavailable', 'journal is already closed');
+    }
+    try {
+      const data = Buffer.from(`${JSON.stringify(record)}\n`, 'utf8');
+      let offset = 0;
+      while (offset < data.byteLength) {
+        const remaining = data.byteLength - offset;
+        const written = await this.writeJournal(this.handle, data, offset, remaining);
+        if (!Number.isSafeInteger(written) || written <= 0 || written > remaining) {
+          throw new Error('journal write made invalid progress');
+        }
+        offset += written;
+      }
+      await this.handle.sync();
+    } catch {
+      throw new CredentialJournalError(
+        'journal-unavailable',
+        'durable journal append or fsync failed',
+      );
+    }
+  }
+
+  journalId(): string {
+    return this.id;
+  }
+
+  async recordIntent(decision: string): Promise<void> {
+    if (!SAFE_DECISIONS.has(decision)) {
+      throw new CredentialJournalError(
+        'unsafe-audit-value',
+        'intent decision is outside the non-secret allowlist',
+      );
+    }
+    await this.append({ phase: 'intent', at: this.now(), decision });
+  }
+
+  async recordProviderEvidence(evidence: CredentialProviderJournalEvidenceDto): Promise<void> {
+    assertEvidence(evidence);
+    await this.append({ phase: 'provider-evidence', at: this.now(), evidence });
+  }
+
+  async recordMutation(decision: string): Promise<void> {
+    if (!SAFE_DECISIONS.has(decision)) {
+      throw new CredentialJournalError(
+        'unsafe-audit-value',
+        'mutation decision is outside the non-secret allowlist',
+      );
+    }
+    await this.append({ phase: 'mutation', at: this.now(), decision });
+  }
+
+  async recordCorrection(correction: CredentialJournalCorrectionDto): Promise<void> {
+    if (
+      !SAFE_NAME.test(correction.supersedesJournalId) ||
+      !SAFE_NAME.test(correction.correctedByJournalId) ||
+      !SAFE_NAME.test(correction.previousReason) ||
+      !SAFE_NAME.test(correction.correctedReason) ||
+      (correction.previousOutcome === undefined) !== (correction.correctedOutcome === undefined)
+    ) {
+      throw new CredentialJournalError(
+        'unsafe-audit-value',
+        'classification correction is outside the non-secret grammar',
+      );
+    }
+    await this.append({ phase: 'classification-correction', at: this.now(), correction });
+  }
+
+  async recordPopulationCorrection(correction: CredentialPopulationCorrectionDto): Promise<void> {
+    if (
+      correction.entries.length === 0 ||
+      correction.entries.some(
+        (entry): boolean =>
+          !SAFE_NAME.test(entry.identity) ||
+          !SAFE_NAME.test(entry.settledByJournalId) ||
+          entry.supersedesJournalIds.length === 0 ||
+          entry.supersedesJournalIds.some((id): boolean => !SAFE_NAME.test(id)),
+      )
+    ) {
+      throw new CredentialJournalError(
+        'unsafe-audit-value',
+        'population correction is outside the non-secret grammar',
+      );
+    }
+    await this.append({
+      phase: 'population-classification-correction',
+      at: this.now(),
+      correction,
+    });
+  }
+
+  async seal(
+    outcome: 'ok' | 'refused' | 'error' | 'indeterminate',
+    reasonCode: string,
+  ): Promise<string> {
+    if (!SAFE_NAME.test(reasonCode)) {
+      throw new CredentialJournalError(
+        'unsafe-audit-value',
+        'reason code is outside the non-secret grammar',
+      );
+    }
+    const preSealSize = (await this.handle.stat()).size;
+    const sealingPath = join(this.journalsDirectory, `${this.id}.sealing.jsonl`);
+    const sealedPath = join(this.journalsDirectory, `${this.id}.sealed.jsonl`);
+    const recoveryPath = join(this.journalsDirectory, `${this.id}.recovery.jsonl`);
+    let currentPath = this.openPath;
+    try {
+      await this.renameJournal(currentPath, sealingPath);
+      currentPath = sealingPath;
+      await this.syncJournalDirectory(this.journalsDirectory);
+      await this.append({ phase: 'sealed', at: this.now(), outcome, reasonCode });
+      await this.renameJournal(currentPath, sealedPath);
+      currentPath = sealedPath;
+      await this.syncJournalDirectory(this.journalsDirectory);
+      await this.handle.close();
+      await this.lockHandle.close();
+      this.closed = true;
+      return sealedPath;
+    } catch {
+      let recovered = true;
+      try {
+        await this.handle.truncate(preSealSize);
+        await this.handle.sync();
+      } catch {
+        recovered = false;
+      }
+      if (currentPath !== this.openPath) {
+        try {
+          await this.renameJournal(currentPath, this.openPath);
+          currentPath = this.openPath;
+        } catch {
+          recovered = false;
+          try {
+            await this.renameJournal(currentPath, recoveryPath);
+            currentPath = recoveryPath;
+          } catch {
+            // The non-success return below remains authoritative; the path is reported by audit scan.
+          }
+        }
+      }
+      try {
+        await this.syncJournalDirectory(this.journalsDirectory);
+      } catch {
+        recovered = false;
+      }
+      await this.handle.close().catch((): void => undefined);
+      await this.lockHandle.close().catch((): void => undefined);
+      this.closed = true;
+      throw new CredentialJournalError(
+        recovered ? 'journal-unavailable' : 'journal-recovery-required',
+        'sealed journal could not be committed durably',
+      );
+    }
+  }
+
+  async closeIncomplete(): Promise<void> {
+    if (this.closed) return;
+    await this.handle.close();
+    await this.lockHandle.close();
+    this.closed = true;
+  }
+}
+
+export async function listCredentialJournals(
+  stateRoot: string,
+): Promise<readonly CredentialJournalSummaryDto[]> {
+  const journalsDirectory = join(stateRoot, 'journals');
+  const locksDirectory = join(stateRoot, 'journal-locks');
+  let names: string[];
+  try {
+    assertPrivateDirectory(stateRoot);
+    assertPrivateDirectory(journalsDirectory);
+    ensureManagedDirectory(stateRoot, locksDirectory);
+    assertPrivateDirectory(locksDirectory);
+    names = await readdir(journalsDirectory);
+  } catch (error: unknown) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return [];
+    throw new CredentialJournalError('journal-unavailable', 'journal directory could not be read');
+  }
+  return Promise.all(
+    names
+      .filter((name: string): boolean => /\.(?:open|sealing|recovery|sealed)\.jsonl$/.test(name))
+      .sort()
+      .map(async (name: string): Promise<CredentialJournalSummaryDto> => {
+        const path = join(journalsDirectory, name);
+        const id = name.replace(/\.(?:open|sealing|recovery|sealed)\.jsonl$/, '');
+        let committedSeal = false;
+        let scanLock: FileHandle | undefined;
+        if (name.endsWith('.sealed.jsonl') && SAFE_NAME.test(id)) {
+          try {
+            scanLock = await acquireJournalLock(join(locksDirectory, `${id}.lock`), 'shared');
+            if (scanLock === undefined) throw new Error('journal seal is still in progress');
+            const snapshot = readRegularFileSecure(path, {
+              root: journalsDirectory,
+              maxBytes: MAX_JOURNAL_BYTES,
+            });
+            if (snapshot.uid !== process.getuid?.() || (snapshot.mode & 0o077) !== 0) {
+              throw new Error('journal owner or mode is unsafe');
+            }
+            const records = snapshot.content.toString('utf8').trim().split('\n');
+            const finalRecord: unknown = JSON.parse(records.at(-1) ?? 'null');
+            committedSeal =
+              typeof finalRecord === 'object' &&
+              finalRecord !== null &&
+              'phase' in finalRecord &&
+              finalRecord.phase === 'sealed';
+          } catch {
+            committedSeal = false;
+          } finally {
+            await scanLock?.close().catch((): void => undefined);
+          }
+        }
+        return {
+          id,
+          state: committedSeal ? 'sealed' : 'open',
+          path,
+        };
+      }),
+  );
+}

packages/mosaic/src/credentials/credential-binding.dto.ts

@@ -0,0 +1,11 @@
+export interface CredentialBindingMetadataDto {
+  readonly schemaVersion?: 1;
+  readonly identity: string;
+  readonly estate: string;
+  readonly host: string;
+  readonly providerLogin: string;
+  readonly tokenName: string;
+  readonly scopes: readonly string[];
+  readonly createdAt: string;
+  readonly tokenDigest?: string;
+}

packages/mosaic/src/credentials/credential-provider.dto.ts

@@ -0,0 +1,52 @@
+import type {
+  ProviderIdentityEvidenceDto,
+  ReceivePackEvidenceDto,
+  RepositoryPermission,
+  RepositoryPermissionEvidenceDto,
+} from './credential-result.dto.js';
+
+export interface ResolvedCredential {
+  readonly identity: string;
+  readonly estate: string;
+  readonly host: string;
+  readonly resolutionId: string;
+  readonly secret: Uint8Array;
+}
+
+export interface CredentialResolver {
+  resolve(identity: string, estate: string, host: string): Promise<ResolvedCredential | undefined>;
+}
+
+export interface GiteaCredentialProvider {
+  readIdentity(resolved: ResolvedCredential): Promise<ProviderIdentityEvidenceDto>;
+  readRepositoryPermission(
+    resolved: ResolvedCredential,
+    repo: string,
+  ): Promise<RepositoryPermissionEvidenceDto>;
+  probeReceivePack(
+    resolved: ResolvedCredential | undefined,
+    repo: string,
+  ): Promise<ReceivePackEvidenceDto>;
+}
+
+export interface CredentialEstateRegistry {
+  matches(estate: string, host: string): boolean;
+}
+
+export interface CredentialValidationDependencies {
+  readonly resolver: CredentialResolver;
+  readonly provider: GiteaCredentialProvider;
+  readonly estateRegistry: CredentialEstateRegistry;
+}
+
+export interface GiteaReadValidationRequestDto {
+  readonly identity: string;
+  readonly estate: string;
+  readonly host: string;
+  readonly repo: string;
+  readonly requiredPermission?: RepositoryPermission;
+}
+
+export interface GiteaWriteValidationRequestDto extends GiteaReadValidationRequestDto {
+  readonly readOnlyControlIdentity: string;
+}

packages/mosaic/src/credentials/credential-result.dto.ts

@@ -0,0 +1,84 @@
+export type CredentialOutcome = 'ok' | 'refused' | 'error' | 'indeterminate';
+export type CredentialMutationState = 'none' | 'not-started' | 'applied' | 'unknown';
+export type RepositoryPermission = 'none' | 'read' | 'write' | 'admin';
+export type ReceivePackState = 'advertised' | 'refused';
+
+export interface CredentialReasonDto {
+  readonly code: string;
+  readonly message: string;
+}
+
+export interface CredentialSubjectDto {
+  readonly identity: string;
+  readonly estate: string;
+  readonly host: string;
+  readonly repo: string;
+}
+
+export interface ProviderIdentityEvidenceDto {
+  readonly login: string;
+  readonly endpoint: string;
+  readonly contentType: string;
+}
+
+export interface RepositoryPermissionEvidenceDto {
+  readonly effective: RepositoryPermission;
+  readonly endpoint: string;
+  readonly contentType: string;
+}
+
+export interface ReceivePackEvidenceDto {
+  readonly state: ReceivePackState;
+  readonly principal: string | null;
+  readonly resolutionId: string | null;
+  readonly contentType: string;
+}
+
+export interface ReadOnlyControlEvidenceDto {
+  readonly identity: string;
+  readonly providerPermission: RepositoryPermission;
+  readonly receivePack: ReceivePackState;
+}
+
+export interface WriteDifferentialEvidenceDto {
+  readonly state: 'can-write';
+  readonly credentialBinding: 'same-resolution';
+  readonly transportPrincipal: string;
+  readonly authenticatedReceivePack: 'advertised';
+  readonly readOnlyControl: ReadOnlyControlEvidenceDto;
+  readonly unauthenticatedReceivePack: 'refused';
+  readonly artifactCreated: false;
+  readonly proves: string;
+  readonly doesNotProve: string;
+}
+
+export interface TokenCapabilitiesEvidenceDto {
+  readonly state: 'measured' | 'not-measured';
+  readonly scopes: readonly string[];
+  readonly source: 'provider-token-object' | 'runtime-not-authorized';
+}
+
+export interface CredentialValidationEvidenceDto {
+  readonly providerIdentity: ProviderIdentityEvidenceDto | null;
+  readonly tokenCapabilities: TokenCapabilitiesEvidenceDto;
+  readonly repositoryPermission: RepositoryPermissionEvidenceDto | null;
+  readonly writeDifferential: WriteDifferentialEvidenceDto | null;
+}
+
+export interface CredentialAuditResultDto {
+  readonly journalId: string | null;
+  readonly state: 'not-started' | 'open' | 'sealed';
+}
+
+export interface CredentialValidationResultDto {
+  readonly schemaVersion: 1;
+  readonly operation: 'validate' | 'whoami';
+  readonly outcome: CredentialOutcome;
+  readonly exitCode: 0 | 10 | 20 | 30;
+  readonly retryable: boolean;
+  readonly subject: CredentialSubjectDto;
+  readonly mutation: CredentialMutationState;
+  readonly reason: CredentialReasonDto;
+  readonly evidence: CredentialValidationEvidenceDto;
+  readonly audit: CredentialAuditResultDto;
+}

packages/mosaic/src/credentials/credential-validate-service.ts

@@ -0,0 +1,141 @@
+import { CredentialAuditJournal, CredentialJournalError } from './audit-journal.js';
+import type {
+  CredentialValidationDependencies,
+  GiteaReadValidationRequestDto,
+  GiteaWriteValidationRequestDto,
+} from './credential-provider.dto.js';
+import type {
+  CredentialValidationResultDto,
+  RepositoryPermission,
+} from './credential-result.dto.js';
+import { evaluateGiteaReadValidation, evaluateGiteaWriteValidation } from './validate.js';
+
+export interface CredentialValidationServiceOptions {
+  readonly stateRoot: string;
+  readonly actor: string;
+  readonly operation?: 'validate' | 'whoami';
+}
+
+function permissionDecision(permission: RepositoryPermission): string {
+  if (permission === 'none') return 'permission-none';
+  if (permission === 'admin') return 'permission-admin';
+  if (permission === 'write') return 'permission-write';
+  return 'permission-read';
+}
+
+async function openValidationJournal(
+  request: GiteaReadValidationRequestDto,
+  options: CredentialValidationServiceOptions,
+): Promise<CredentialAuditJournal> {
+  const journal = await CredentialAuditJournal.open(options.stateRoot, {
+    operation: options.operation ?? 'validate',
+    actor: options.actor,
+    identity: request.identity,
+    estate: request.estate,
+    host: request.host,
+    repo: request.repo,
+  });
+  await journal.recordIntent(
+    options.operation === 'whoami' ? 'whoami-requested' : 'validation-requested',
+  );
+  return journal;
+}
+
+async function recordAndSealValidation(
+  journal: CredentialAuditJournal,
+  validation: CredentialValidationResultDto,
+): Promise<CredentialValidationResultDto> {
+  if (validation.evidence.providerIdentity !== null) {
+    await journal.recordProviderEvidence({
+      endpoint: validation.evidence.providerIdentity.endpoint,
+      contentType: validation.evidence.providerIdentity.contentType,
+      decision: 'identity-verified',
+    });
+  }
+  if (validation.evidence.repositoryPermission !== null) {
+    await journal.recordProviderEvidence({
+      endpoint: validation.evidence.repositoryPermission.endpoint,
+      contentType: validation.evidence.repositoryPermission.contentType,
+      decision: permissionDecision(validation.evidence.repositoryPermission.effective),
+    });
+  }
+  await journal.seal(validation.outcome, validation.reason.code);
+  return {
+    ...validation,
+    audit: { journalId: journal.journalId(), state: 'sealed' },
+  };
+}
+
+function journalFailureResult(
+  request: GiteaReadValidationRequestDto,
+  journal: CredentialAuditJournal,
+  error: CredentialJournalError,
+  operation: 'validate' | 'whoami',
+): CredentialValidationResultDto {
+  return {
+    schemaVersion: 1,
+    operation,
+    outcome: 'error',
+    exitCode: 20,
+    retryable: false,
+    subject: {
+      identity: request.identity,
+      estate: request.estate,
+      host: request.host,
+      repo: request.repo,
+    },
+    mutation: 'none',
+    reason: {
+      code: error.code,
+      message: 'Validation audit persistence failed; inspect the durable open journal.',
+    },
+    evidence: {
+      providerIdentity: null,
+      tokenCapabilities: {
+        state: 'not-measured',
+        scopes: [],
+        source: 'runtime-not-authorized',
+      },
+      repositoryPermission: null,
+      writeDifferential: null,
+    },
+    audit: { journalId: journal.journalId(), state: 'open' },
+  };
+}
+
+export async function runCredentialReadValidation(
+  request: GiteaReadValidationRequestDto,
+  dependencies: CredentialValidationDependencies,
+  options: CredentialValidationServiceOptions,
+): Promise<CredentialValidationResultDto> {
+  const journal = await openValidationJournal(request, options);
+  try {
+    const validation = await evaluateGiteaReadValidation(request, dependencies);
+    return await recordAndSealValidation(journal, {
+      ...validation,
+      operation: options.operation ?? 'validate',
+    });
+  } catch (error: unknown) {
+    if (error instanceof CredentialJournalError) {
+      return journalFailureResult(request, journal, error, options.operation ?? 'validate');
+    }
+    throw error;
+  }
+}
+
+export async function runCredentialValidation(
+  request: GiteaWriteValidationRequestDto,
+  dependencies: CredentialValidationDependencies,
+  options: CredentialValidationServiceOptions,
+): Promise<CredentialValidationResultDto> {
+  const journal = await openValidationJournal(request, options);
+  try {
+    const validation = await evaluateGiteaWriteValidation(request, dependencies);
+    return await recordAndSealValidation(journal, validation);
+  } catch (error: unknown) {
+    if (error instanceof CredentialJournalError) {
+      return journalFailureResult(request, journal, error, 'validate');
+    }
+    throw error;
+  }
+}