fix(tools/git): pr-review.sh _belongs case-insensitive repo-slug compare

#866 hardened the comment-persistence read-back into a full-path _belongs()
check that pins scheme+host+port origin plus the full path, to block
look-alike-host and same-host decoy-prefix attacks. That check compared the
path case-sensitively: EXPECTED_REPO_SLUG is taken verbatim from
GITEA_API_BASE and can be mixed-case (e.g. "USC/uconnect"), while Gitea
canonicalizes the returned pull_request_url's owner/repo segment to
lowercase. A successful 201 write on a mixed-case-slug repo therefore
false-negatived ("did not land on a pull request") even though the comment
genuinely landed — fail-closed on a real success, not a false success, but
broken for legitimate mixed-case-slug repos.

Lowercase both sides of the path comparison inside _belongs (path and
expected_path) while leaving the origin tuple comparison, _origin_and_path's
scheme+host lowercasing, and the full (non-suffix) path match untouched — the
look-alike-host and decoy-prefix protections from #866 are unchanged; only
the repo-slug segment's case sensitivity is relaxed, which is safe because
Gitea repo slugs are case-insensitive and the remainder of the path is
numeric.

Adds a red-first regression case (comment-mixed-case-slug) modeling a
mixed-case EXPECTED_REPO_SLUG against a Gitea-canonicalized lowercase
pull_request_url, which fails against pre-fix code and passes after.

Closes #875

packages/mosaic/framework/install.sh

@@ -639,10 +639,6 @@ reconcile_framework_files
 # Ensure tool scripts are executable
 find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} + 2>/dev/null || true
 find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} + 2>/dev/null || true
-# git-credential-mosaic (per-agent Gitea identity helper) ships without a .sh
-# suffix — git resolves credential helpers by exact name/path, not extension —
-# so the *.sh glob above does not cover it; chmod it explicitly.
-[[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] && chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic" 2>/dev/null || true
 
 ok "Framework synced to $TARGET_DIR"
 

packages/mosaic/framework/tools/git/README.md

@@ -33,64 +33,3 @@ The Gitea API token is **never passed on a curl command line.** An `Authorizatio
 Both `pr-review.sh` and `issue-comment.sh` accept an optional `--login <name>` flag that overrides the automatically detected Gitea login for that single invocation. The override selects **which credential the REST write, the `/user` identity lookup, and the read-back all use** — its token is resolved from the tea config for that login name (`get_gitea_token_for_login`), falling back to the repo host's credential when no login is named. The resolved login is **host- and port-bound**: the login's configured URL host **and effective port** (the scheme's default port — 80 for `http`, 443 for `https` — applies when a port is omitted, symmetrically on both sides) must match the repo remote's, so a login name shared across hosts (or an override configured for a different Gitea, including one on a different port of the same host) can never send one host's credential to another — a host or port mismatch fails closed rather than leaking a cross-host token. Resolving the acting identity and the read-back from the _same_ login that performs the write is essential: a write performed under an overridden login must be verified against that login's identity, not the host default's. Callers who need a different login than the host default should pass `--login <reviewer-login>`.
 
 As a durable successor to this mechanism, consider giving each reviewer/approver slot its own dedicated Gitea login credential, so that author≠reviewer holds at the credential level rather than relying on wrapper-level `--login` bookkeeping. This is a recommendation for future hardening, not something implemented by this flag.
-
-## Per-agent Gitea identity (Gate-16 author≠reviewer)
-
-By default, git push/fetch (via `git-credential-mosaic`) and the API wrappers above (via
-`detect-platform.sh`'s `get_gitea_token`) all authenticate as the single shared Gitea
-account/token configured through `tools/_lib/credentials.sh`. That means every agent in a
-fleet commits, pushes, and opens PRs under one identity — with no cryptographic
-separation between an author and a reviewer.
-
-Both `git-credential-mosaic` and `get_gitea_token()` resolve an optional **per-agent
-identity** before falling back to the shared account:
-
-1. `MOSAIC_GIT_IDENTITY` environment variable, or
-2. `git config --get mosaic.gitIdentity` (set per-worktree; persists on disk across
-   non-persistent shells — `git config mosaic.gitIdentity <agent-id>`), or
-3. (git-credential-mosaic only) the username git itself supplies for the credential
-   request.
-
-If the resolved identity has a token file at
-`~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<agent-id>.token`, that
-identity + token is used. **Nothing configured → nothing changes**: with no per-slot
-token file present, both tools fall through to the existing shared-account path
-unchanged, so this feature is a no-op on any host that hasn't provisioned per-slot
-tokens.
-
-### Enabling it for a clone
-
-The framework installer syncs `git-credential-mosaic` to
-`~/.config/mosaic/tools/git/git-credential-mosaic` (executable) on every install/update,
-but does **not** register it as git's credential helper automatically. Registration is a
-one-time, explicit step:
-
-```bash
-# Per-repo (recommended — scopes the helper to this clone only):
-git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
-
-# Per-worktree identity pin (Gate-16 separation):
-git config mosaic.gitIdentity <agent-id>
-```
-
-This is deliberately **not** auto-registered on install/update: `credential.helper` is
-global, order-sensitive git config (`~/.gitconfig`) that can already hold an
-operator-chosen credential manager (keychain, `store`, `manager-core`, …) for
-repositories unrelated to Mosaic. Silently inserting an entry on every framework
-install/upgrade risks reordering or shadowing that operator-owned surface across the
-whole host — the same operator-owned config the installer's manifest system is
-otherwise careful never to touch. Because identity is already resolved per-worktree
-(`mosaic.gitIdentity`), the correct granularity for registering the helper is per-clone
-too, so a documented manual step is the right shape here, not a global auto-write.
-
-### PowerShell parity
-
-`detect-platform.ps1`'s Gitea wrappers authenticate through `tea` CLI logins
-(`Get-GiteaLoginForHost`), not a raw-token `get_gitea_token`-equivalent function — there
-is nothing to prepend the identity-resolution block to on the PowerShell side. A native
-PowerShell git-credential helper is also unnecessary: `git-credential-mosaic` is invoked
-by git's credential-helper protocol (stdin/stdout), which works identically under Git for
-Windows' bundled `bash`/`sh` when configured via `credential.helper`, without a `.ps1`
-counterpart. A `tea`-login-based per-agent identity for the PowerShell wrappers is a
-separate, larger design (mapping identities to `tea login` profiles) and is out of scope
-here.

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -505,28 +505,6 @@ get_gitea_token() {
     script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
     local cred_loader="$script_dir/../_lib/credentials.sh"
 
-    # 0. Per-agent identity (Gate-16 author≠reviewer). If MOSAIC_GIT_IDENTITY, or the
-    #    per-worktree `git config mosaic.gitIdentity`, resolves to an agent that has a
-    #    stored per-slot token for this host, act AS that agent so API tooling
-    #    (pr-create, issue-create, …) authors under the right identity — matching the
-    #    git credential helper. Backward-compatible: nothing resolvable → shared logic below.
-    local _ident="${MOSAIC_GIT_IDENTITY:-}"
-    [[ -z "$_ident" ]] && _ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
-    if [[ -n "$_ident" ]]; then
-        local _idpfx=""
-        case "$host" in
-            git.uscllc.com)      _idpfx=gitea-usc ;;
-            git.mosaicstack.dev) _idpfx=gitea-mosaicstack ;;
-        esac
-        if [[ -n "$_idpfx" ]]; then
-            local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
-            if [[ -r "$_idtok" ]]; then
-                cat "$_idtok"
-                return 0
-            fi
-        fi
-    fi
-
     # 1. Mosaic credential loader (host → service mapping, run in subshell to avoid polluting env)
     if [[ -f "$cred_loader" ]]; then
         local token

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -1,69 +0,0 @@
-#!/bin/bash
-# git-credential-mosaic — git credential helper — resolves Gitea tokens from
-# the Mosaic credential store at runtime so remote URLs never embed secrets.
-#
-# Install (one-time, per clone or globally):
-#   git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
-#   # or, fleet-wide: git config --global credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
-#
-# Per-agent Gate-16 identity (author != reviewer separation):
-#   git config mosaic.gitIdentity <agent-id>   # per-worktree, persists on disk
-#   # or: export MOSAIC_GIT_IDENTITY=<agent-id>
-#
-# Resolution priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity
-# (per-worktree, survives across non-persistent shells) > git-supplied username
-# (credential.username / URL). When the resolved identity has a matching
-# per-agent token file, use it instead of the shared account. Backward
-# compatible: nothing resolvable -> shared token (unchanged behavior).
-[ "$1" = "get" ] || exit 0
-host=""; username_in=""
-while IFS= read -r line; do
-  [ -z "$line" ] && break
-  case "$line" in
-    host=*)     host=${line#host=};;
-    username=*) username_in=${line#username=};;
-  esac
-done
-# Per-agent identity resolution (Gate-16 author≠reviewer separation).
-# Priority: MOSAIC_GIT_IDENTITY env  >  git config mosaic.gitIdentity (per-worktree,
-# survives across non-persistent shells)  >  git-supplied username (credential.username
-# / URL). When the resolved identity has a matching per-agent token, use it instead of
-# the shared account. Backward-compatible: nothing resolvable → shared token.
-ident="$MOSAIC_GIT_IDENTITY"
-[ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
-[ -z "$ident" ] && ident="$username_in"
-if [ -n "$ident" ]; then
-  case "$host" in
-    git.uscllc.com)      idpfx=gitea-usc;;
-    git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
-    *) idpfx="";;
-  esac
-  if [ -n "$idpfx" ]; then
-    idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
-    if [ -r "$idtok" ]; then
-      echo "username=${ident}"
-      echo "password=$(cat "$idtok")"
-      exit 0
-    fi
-  fi
-fi
-case "$host" in
-  git.uscllc.com)      svc=gitea-usc;;
-  git.mosaicstack.dev) svc=gitea-mosaicstack;;
-  *) exit 0;;
-esac
-# Script-relative (not $HOME-absolute) so this resolves correctly regardless
-# of where the framework installer places tools/ under $HOME — mirrors
-# detect-platform.sh's own cred_loader resolution in this same directory.
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../_lib/credentials.sh
-source "$script_dir/../_lib/credentials.sh"
-load_credentials "$svc" >/dev/null 2>&1 || exit 0
-# GITEA_USER is not populated by load_credentials (it only exports
-# GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
-# git-over-HTTP auth authenticates from the token itself (the password field),
-# not from the username string, so any non-empty placeholder works here — this
-# is deliberately NOT a real account name (framework files must stay
-# operator-agnostic; see tools/quality/scripts/verify-sanitized.sh).
-echo "username=${GITEA_USER:-git}"
-echo "password=$GITEA_TOKEN"

packages/mosaic/framework/tools/git/test-git-credential-mosaic.sh

@@ -1,161 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for `git-credential-mosaic` — per-agent Gitea identity
-# resolution (Gate-16 author≠reviewer separation).
-#
-# Covers:
-#   1. Identity resolution priority: MOSAIC_GIT_IDENTITY env > git config
-#      mosaic.gitIdentity (per-worktree) > git-supplied username.
-#   2. Correct per-slot token file path chosen per host
-#      (gitea-usc-<id>.token vs gitea-mosaicstack-<id>.token).
-#   3. Per-slot token present -> emits that identity + token.
-#   4. Per-slot token absent -> falls back to the shared account
-#      (backward-compat / no-op for hosts without per-slot tokens).
-#   5. Unknown/unrelated host -> exits 0 with no output (passthrough).
-#
-# Uses stubbed token files under a fake HOME + a real (throwaway) git repo.
-# NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/git-credential-mosaic}"
-FAKE_HOME="$WORK_DIR/home"
-REPO_DIR="$WORK_DIR/repo"
-# Mirror the real deployed layout (~/.config/mosaic/tools/{git,_lib}/) under the
-# fake HOME: git-credential-mosaic resolves its credentials.sh sibling via a
-# script-relative path (BASH_SOURCE), so the copy must live next to a stubbed
-# _lib/credentials.sh, not the real one, to keep this test hermetic.
-HELPER="$FAKE_HOME/.config/mosaic/tools/git/git-credential-mosaic"
-
-rm -rf "$WORK_DIR"
-mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" \
-         "$FAKE_HOME/.config/mosaic/tools/git" \
-         "$FAKE_HOME/.config/mosaic/tools/_lib" \
-         "$REPO_DIR"
-
-cp "$SCRIPT_DIR/git-credential-mosaic" "$HELPER"
-chmod +x "$HELPER"
-
-git -C "$REPO_DIR" init -q
-git -C "$REPO_DIR" config user.email "test@example.invalid"
-git -C "$REPO_DIR" config user.name "Test"
-
-# Fake shared-account credential loader — stands in for
-# tools/_lib/credentials.sh's load_credentials(), scoped to this test only.
-cat > "$FAKE_HOME/.config/mosaic/tools/_lib/credentials.sh" <<'SH'
-load_credentials() {
-  case "$1" in
-    gitea-mosaicstack) GITEA_URL="https://git.mosaicstack.dev"; GITEA_TOKEN="shared-mosaicstack-token"; export GITEA_URL GITEA_TOKEN; return 0 ;;
-    gitea-usc)         GITEA_URL="https://git.uscllc.com"; GITEA_TOKEN="shared-usc-token"; export GITEA_URL GITEA_TOKEN; return 0 ;;
-    *) return 1 ;;
-  esac
-}
-SH
-
-fail=0
-assert_eq() {
-  local desc="$1" expected="$2" actual="$3"
-  if [[ "$expected" != "$actual" ]]; then
-    echo "FAIL: $desc — expected '$expected', got '$actual'" >&2
-    fail=1
-  fi
-}
-
-# Feed "host=<h>\nusername=<u>\n\n" on stdin (mirrors git's credential protocol)
-# and run the helper with the fake HOME, inside REPO_DIR (so `git config
-# mosaic.gitIdentity` resolves per-worktree), plus any extra env passed in $@.
-run_helper() {
-  local host="$1" username_in="$2"; shift 2
-  (
-    cd "$REPO_DIR"
-    env -i HOME="$FAKE_HOME" PATH="$PATH" "$@" bash "$HELPER" get <<EOF
-host=$host
-username=$username_in
-
-EOF
-  )
-}
-
-# ---------------------------------------------------------------------------
-# 1. No identity resolvable anywhere, no per-slot token -> shared fallback
-#    (backward-compat: unchanged behavior when nothing is configured).
-# ---------------------------------------------------------------------------
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
-out=$(run_helper "git.mosaicstack.dev" "")
-assert_eq "shared fallback: username" "username=git" "$(echo "$out" | grep '^username=')"
-assert_eq "shared fallback: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 2. git-supplied username resolves to an identity WITH a per-slot token ->
-#    that identity + token wins over the shared account.
-# ---------------------------------------------------------------------------
-echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
-out=$(run_helper "git.mosaicstack.dev" "agentA")
-assert_eq "username-resolved identity: username" "username=agentA" "$(echo "$out" | grep '^username=')"
-assert_eq "username-resolved identity: password" "password=agentA-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 3. git config mosaic.gitIdentity (per-worktree) beats git-supplied username.
-# ---------------------------------------------------------------------------
-echo -n "agentB-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentB.token"
-git -C "$REPO_DIR" config mosaic.gitIdentity agentB
-out=$(run_helper "git.mosaicstack.dev" "agentA")
-assert_eq "git-config beats username: username" "username=agentB" "$(echo "$out" | grep '^username=')"
-assert_eq "git-config beats username: password" "password=agentB-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 4. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
-# ---------------------------------------------------------------------------
-echo -n "agentC-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentC.token"
-out=$(run_helper "git.mosaicstack.dev" "agentA" MOSAIC_GIT_IDENTITY=agentC)
-assert_eq "env beats git-config: username" "username=agentC" "$(echo "$out" | grep '^username=')"
-assert_eq "env beats git-config: password" "password=agentC-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity
-
-# ---------------------------------------------------------------------------
-# 5. Identity resolves, but no matching per-slot token file -> falls back to
-#    the shared account (per-agent identity is opt-in, not a hard requirement).
-# ---------------------------------------------------------------------------
-out=$(run_helper "git.mosaicstack.dev" "no-such-agent")
-assert_eq "no per-slot token: username" "username=git" "$(echo "$out" | grep '^username=')"
-assert_eq "no per-slot token: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 6. Correct per-slot token PATH is chosen per host: same agent id, different
-#    host prefix (gitea-usc- vs gitea-mosaicstack-).
-# ---------------------------------------------------------------------------
-echo -n "agentD-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentD.token"
-out=$(run_helper "git.uscllc.com" "agentD")
-assert_eq "host-scoped token path (usc): username" "username=agentD" "$(echo "$out" | grep '^username=')"
-assert_eq "host-scoped token path (usc): password" "password=agentD-usc-token" "$(echo "$out" | grep '^password=')"
-# agentD has NO mosaicstack token -> must fall back to shared mosaicstack, not
-# leak the usc token across hosts.
-out=$(run_helper "git.mosaicstack.dev" "agentD")
-assert_eq "host-scoped token path (cross-host must not leak): username" "username=git" "$(echo "$out" | grep '^username=')"
-assert_eq "host-scoped token path (cross-host must not leak): password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 7. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
-#    remotes, e.g. github.com via a different credential helper).
-# ---------------------------------------------------------------------------
-out=$(run_helper "github.com" "agentA")
-assert_eq "unknown host: no output" "" "$out"
-
-# ---------------------------------------------------------------------------
-# 8. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
-#    protocol: this helper only implements get).
-# ---------------------------------------------------------------------------
-store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" bash "$HELPER" store <<EOF
-host=git.mosaicstack.dev
-username=agentA
-password=whatever
-
-EOF
-)
-assert_eq "store verb: no output" "" "$store_out"
-
-if [[ "$fail" -eq 0 ]]; then
-  echo "git-credential-mosaic identity resolution regression passed"
-fi
-
-exit "$fail"

packages/mosaic/framework/tools/git/test-gitea-token-identity.sh

@@ -1,122 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for detect-platform.sh's get_gitea_token() per-agent
-# identity resolution (Gate-16 author≠reviewer separation) — the API-tooling
-# counterpart to git-credential-mosaic, so pr-create.sh/issue-create.sh/etc.
-# open records under the resolved agent identity, not the shared account.
-#
-# Covers:
-#   1. Identity resolution priority: MOSAIC_GIT_IDENTITY env > git config
-#      mosaic.gitIdentity (per-worktree).
-#   2. Correct per-slot token file path chosen per host
-#      (gitea-usc-<id>.token vs gitea-mosaicstack-<id>.token).
-#   3. Per-slot token present -> that token is returned (agent-authored calls).
-#   4. Per-slot token absent -> falls back to the shared credential-loader
-#      token (backward-compat / no-op for hosts without per-slot tokens).
-#   5. Unrelated host with no shared credentials configured -> failure
-#      (unchanged, existing behavior).
-#
-# Uses a stubbed credentials.json + stubbed per-slot token files under a fake
-# HOME. NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/gitea-token-identity}"
-FAKE_HOME="$WORK_DIR/home"
-REPO_DIR="$WORK_DIR/repo"
-CREDENTIALS_FILE="$FAKE_HOME/.config/mosaic/credentials.json"
-
-rm -rf "$WORK_DIR"
-mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" "$REPO_DIR"
-
-git -C "$REPO_DIR" init -q
-git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
-
-cat > "$CREDENTIALS_FILE" <<'JSON'
-{
-  "gitea": {
-    "mosaicstack": {
-      "url": "https://git.mosaicstack.dev",
-      "token": "shared-mosaicstack-token"
-    },
-    "usc": {
-      "url": "https://git.uscllc.com",
-      "token": "shared-usc-token"
-    }
-  }
-}
-JSON
-
-fail=0
-assert_eq() {
-  local desc="$1" expected="$2" actual="$3"
-  if [[ "$expected" != "$actual" ]]; then
-    echo "FAIL: $desc — expected '$expected', got '$actual'" >&2
-    fail=1
-  fi
-}
-
-# Runs get_gitea_token for $1=host inside REPO_DIR (per-worktree git config
-# resolves there) with a fake HOME + the stub credentials.json, plus any
-# extra env passed in $@.
-call_get_gitea_token() {
-  local host="$1"; shift
-  (
-    cd "$REPO_DIR"
-    # shellcheck disable=SC2016 # deliberately deferred: $DETECT_PLATFORM_SH is
-    # expanded by the INNER bash -c (via the exported env var below), not here.
-    env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
-      DETECT_PLATFORM_SH="$SCRIPT_DIR/detect-platform.sh" "$@" \
-      bash -c 'source "$DETECT_PLATFORM_SH"; get_gitea_token "$1"' _ "$host"
-  )
-}
-
-# ---------------------------------------------------------------------------
-# 1. No identity resolvable -> shared credential-loader token (unchanged).
-# ---------------------------------------------------------------------------
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
-out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "shared fallback (no identity)" "shared-mosaicstack-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 2. git config mosaic.gitIdentity resolves to an agent WITH a per-slot
-#    token -> that token wins over the shared account.
-# ---------------------------------------------------------------------------
-echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
-git -C "$REPO_DIR" config mosaic.gitIdentity agentA
-out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "git-config identity token" "agentA-mosaicstack-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 3. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
-# ---------------------------------------------------------------------------
-echo -n "agentB-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentB.token"
-out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=agentB)
-assert_eq "env beats git-config identity token" "agentB-mosaicstack-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 4. Identity resolves but has no per-slot token for THIS host -> falls back
-#    to the shared token (per-agent identity is opt-in per host).
-# ---------------------------------------------------------------------------
-git -C "$REPO_DIR" config mosaic.gitIdentity no-such-agent
-out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "no per-slot token falls back to shared" "shared-mosaicstack-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 5. Correct per-slot token PATH per host: same agent id, only a usc token
-#    exists -> usc host returns it, mosaicstack host must NOT leak it and
-#    instead falls back to the shared mosaicstack token.
-# ---------------------------------------------------------------------------
-echo -n "agentD-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentD.token"
-git -C "$REPO_DIR" config mosaic.gitIdentity agentD
-out=$(call_get_gitea_token "git.uscllc.com")
-assert_eq "host-scoped token path (usc)" "agentD-usc-token" "$out"
-out=$(call_get_gitea_token "git.mosaicstack.dev")
-assert_eq "host-scoped token path (no cross-host leak)" "shared-mosaicstack-token" "$out"
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity
-
-if [[ "$fail" -eq 0 ]]; then
-  echo "get_gitea_token identity resolution regression passed"
-fi
-
-exit "$fail"

packages/mosaic/framework/tools/lease-broker/activation_version_gate.py

@@ -1,180 +0,0 @@
-#!/usr/bin/env python3
-"""Enforcement-side version-coupling gate (issue #869, Point-1 card C4).
-
-Root cause this exists to guard against (#828 version skew, restated from
-the C1 activation probe in ``lease-activation-probe.ts``): the lease
-broker's ENFORCEMENT half (this toolkit — ``launch-runtime.py``,
-``mutator-gate.py``, ``revoke-lease.py``) and its ACTIVATION half
-(``execLeaseGatedRuntime()`` in ``launch.ts``, which chains the gated
-runtime through ``launch-runtime.py`` and injects ``MOSAIC_LEASE_*``) ship
-on different channels — an npm package and a framework/CLI reseed. C1 gave
-the activation half a versioned, machine-checkable identity
-(``LEASE_ACTIVATION_CAPABILITY``, printed by the CLI's hidden
-``mosaic __lease-capability`` subcommand). That identity is inert on its
-own: nothing yet asserted that ENFORCEMENT actually requires the version
-ACTIVATION advertises. This module is that assertion, owned by the
-enforcement side.
-
-``EXPECTED_ACTIVATION_CAPABILITY`` below is this toolkit's own contract
-declaration — bump it only when this toolkit's launch/gate seam starts
-requiring a different activation contract (new env vars it depends on,
-changed chaining behavior, etc.), independent of any package semver, for
-the same reason C1's constant is: #828 happened precisely because a
-version number that should have moved did not.
-
-This module never talks to a real broker or a real installed CLI in its
-own tests — both the probe's command resolution and its ``run`` transport
-are injectable so tests can drive every branch with fakes/stubs (see
-``version_coupling_unittest.py``).
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shlex
-import shutil
-import subprocess
-from collections.abc import Callable, Mapping
-from typing import Final, TypedDict
-
-
-class ActivationCapability(TypedDict):
-    name: str
-    version: int
-
-
-# ENFORCEMENT-side expected activation contract. OWNED by this toolkit (the
-# enforcement half). Mirrors — but is deliberately a SEPARATE constant from
-# — `LEASE_ACTIVATION_CAPABILITY` in
-# `packages/mosaic/src/commands/lease-activation-probe.ts` (the activation
-# half's own declaration of what it implements). The two are compared at
-# runtime by `assert_activation_capability_matches()`; drift between them is
-# exactly the version-skew failure mode #828/#869 exist to catch, and must
-# FAIL LOUD, never a silent pass and never a dead (always-true) gate.
-EXPECTED_ACTIVATION_CAPABILITY: Final[ActivationCapability] = {
-    "name": "lease-runtime-activation",
-    "version": 1,
-}
-
-# Matches `LEASE_CAPABILITY_PROBE_COMMAND` in lease-activation-probe.ts —
-# the hidden CLI subcommand that prints the activation half's advertised
-# capability as compact JSON.
-LEASE_CAPABILITY_PROBE_COMMAND: Final = "__lease-capability"
-
-PROBE_TIMEOUT_SECONDS: Final = 2.0
-
-# Override hook: a full shell-style command line (parsed with `shlex.split`)
-# to run INSTEAD of resolving `mosaic` on PATH and appending the probe
-# subcommand. Real deployments should never need this — `mosaic` is on PATH
-# whenever a runtime was launched via `mosaic <cmd>` in the first place, the
-# only real caller of this seam. It exists for integration tests that spawn
-# `launch-runtime.py` directly (never through the real CLI) to supply a
-# fake/stub CLI probe, matching the existing convention of those tests
-# supplying a fake broker and a fake runtime binary rather than depending on
-# host state.
-MOSAIC_COMMAND_OVERRIDE_VAR: Final = "MOSAIC_LEASE_VERSION_PROBE_COMMAND"
-
-
-class VersionCouplingError(Exception):
-    """Raised when the activation capability is absent, unreadable, or does
-    not match what enforcement expects. Callers MUST fail loud on this
-    (non-zero exit, clear actionable stderr) — never swallow it into a
-    silent pass, and never let its absence be treated as compatible."""
-
-
-def _resolve_probe_command(environ: Mapping[str, str]) -> list[str] | None:
-    override = environ.get(MOSAIC_COMMAND_OVERRIDE_VAR)
-    if override:
-        parsed = shlex.split(override)
-        return parsed or None
-    resolved = shutil.which("mosaic")
-    if resolved is None:
-        return None
-    return [resolved, LEASE_CAPABILITY_PROBE_COMMAND]
-
-
-def default_probe_activation_capability(
-    environ: Mapping[str, str] | None = None,
-    *,
-    run: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,
-) -> ActivationCapability | None:
-    """Real capability lookup: resolves and executes the CLI's hidden
-    ``__lease-capability`` probe subcommand out-of-process (the same
-    mechanism `defaultCapabilityProbe()` in lease-activation-probe.ts uses
-    from the activation side) and parses its JSON stdout. Any failure to
-    resolve a command, spawn it, have it exit zero, or produce a well-shaped
-    ``{name, version}`` JSON object is treated as NO capability (``None``)
-    — fail-closed, never a fabricated/guessed capability.
-    """
-    source_environment = os.environ if environ is None else environ
-    command = _resolve_probe_command(source_environment)
-    if command is None:
-        return None
-    try:
-        completed = run(
-            command,
-            capture_output=True,
-            text=True,
-            timeout=PROBE_TIMEOUT_SECONDS,
-            check=False,
-        )
-    except (OSError, subprocess.TimeoutExpired, ValueError):
-        return None
-    if completed.returncode != 0:
-        return None
-    try:
-        parsed = json.loads(completed.stdout)
-    except json.JSONDecodeError:
-        return None
-    if (
-        not isinstance(parsed, dict)
-        or not isinstance(parsed.get("name"), str)
-        or not isinstance(parsed.get("version"), int)
-        or isinstance(parsed.get("version"), bool)
-    ):
-        return None
-    return {"name": parsed["name"], "version": parsed["version"]}
-
-
-def format_mismatch_message(
-    activation: ActivationCapability | None,
-    expected: ActivationCapability,
-) -> str:
-    """Actionable, non-silent remediation message for either failure shape:
-    absent/unreadable capability, or a present-but-incompatible one."""
-    if activation is None:
-        return (
-            "Mosaic lease activation capability unreadable: enforcement "
-            f"expects '{expected['name']}' v{expected['version']} but the "
-            f"CLI's `mosaic {LEASE_CAPABILITY_PROBE_COMMAND}` probe produced "
-            "no usable result (mosaic not on PATH, non-zero exit, or "
-            "malformed output) — framework/CLI version skew; upgrade both "
-            "as one unit; see #869."
-        )
-    if activation["name"] != expected["name"]:
-        return (
-            f"activation capability name '{activation['name']}' != "
-            f"enforcement expects '{expected['name']}' — framework/CLI "
-            "version skew; upgrade both as one unit; see #869"
-        )
-    return (
-        f"activation capability v{activation['version']} != enforcement "
-        f"expects v{expected['version']} — framework/CLI version skew; "
-        "upgrade both as one unit; see #869"
-    )
-
-
-def assert_activation_capability_matches(
-    activation: ActivationCapability | None,
-    expected: ActivationCapability = EXPECTED_ACTIVATION_CAPABILITY,
-) -> None:
-    """Raise `VersionCouplingError` unless `activation` is present AND its
-    `name`/`version` exactly match `expected`. Absence is treated the same
-    as a mismatch — never a silent pass."""
-    if (
-        activation is None
-        or activation.get("name") != expected["name"]
-        or activation.get("version") != expected["version"]
-    ):
-        raise VersionCouplingError(format_mismatch_message(activation, expected))

packages/mosaic/framework/tools/lease-broker/launch-runtime.py

@@ -12,24 +12,11 @@ from collections.abc import Callable, Mapping, Sequence
 from pathlib import Path
 from typing import Final
 
-from activation_version_gate import (
-    EXPECTED_ACTIVATION_CAPABILITY,
-    ActivationCapability,
-    VersionCouplingError,
-    assert_activation_capability_matches,
-    default_probe_activation_capability,
-)
 from lease_generation import initialize_runtime_generation
 
 MAX_FRAME: Final = 64 * 1024
 BROKER_TIMEOUT_SECONDS: Final = 1.5
 CLAUDE_DANGEROUS_FLAG: Final = "--dangerously-skip-permissions"
-# Distinct, non-overlapping exit code for the C4 version-coupling gate (see
-# `activation_version_gate.py`) — deliberately different from the `1`
-# (broker registration failed closed) and `64` (usage error) codes already
-# owned by this script, so a version-skew denial is unambiguous in caller
-# logs/tests and is never confused with a broker-availability failure.
-EXIT_VERSION_SKEW: Final = 65
 
 
 def broker_request(socket_path: Path, request: dict[str, object]) -> dict[str, object]:
@@ -60,10 +47,6 @@ def main(
     request: Callable[[Path, dict[str, object]], dict[str, object]] = broker_request,
     execute: Callable[[str, list[str], dict[str, str]], object] = os.execvpe,
     initialize_generation: Callable[[Path, int], None] = initialize_runtime_generation,
-    probe_activation_capability: Callable[
-        [Mapping[str, str]], ActivationCapability | None
-    ] = default_probe_activation_capability,
-    expected_activation_capability: ActivationCapability = EXPECTED_ACTIVATION_CAPABILITY,
 ) -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--runtime", required=True, choices=("claude", "pi"))
@@ -83,25 +66,6 @@ def main(
         command = [command[0], CLAUDE_DANGEROUS_FLAG, *command[1:]]
 
     source_environment = os.environ if environ is None else environ
-
-    # C4 version-coupling gate (#869 Point-1): before this ENFORCEMENT half
-    # chains into anything, assert that the ACTIVATION contract it is about
-    # to rely on (MOSAIC_LEASE_* injection, broker chaining) matches what
-    # this enforcement build expects. This is a build/deploy-defect check,
-    # not a broker-availability question, so it runs before — and
-    # independently of — broker registration below, and it FAILS LOUD: a
-    # clear stderr message plus a dedicated non-zero exit code, never a
-    # silent pass and never folded into the generic registration-failure
-    # branch.
-    try:
-        assert_activation_capability_matches(
-            probe_activation_capability(source_environment),
-            expected_activation_capability,
-        )
-    except VersionCouplingError as version_error:
-        print(str(version_error), file=sys.stderr)
-        return EXIT_VERSION_SKEW
-
     try:
         socket_path = Path(source_environment["MOSAIC_LEASE_BROKER_SOCKET"])
         generation = int(source_environment.get("MOSAIC_RUNTIME_GENERATION", "1"))

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/mutator-gate/mutator-gate.acceptance.spec.ts

@@ -47,22 +47,6 @@ const piLifecyclePath = join(frameworkRoot, 'runtime/pi/lease-lifecycle.ts');
 const prdyInitPath = join(frameworkRoot, 'tools/prdy/prdy-init.sh');
 const prdyUpdatePath = join(frameworkRoot, 'tools/prdy/prdy-update.sh');
 const remediationHandlerPath = join(frameworkRoot, 'tools/qa/remediation-hook-handler.sh');
-
-// C4 (#869 Point-1): launch-runtime.py now asserts, before anything else,
-// that the CLI's advertised lease-activation capability (normally read via
-// the hidden `mosaic __lease-capability` subcommand) matches what
-// enforcement expects — see framework/tools/lease-broker/
-// activation_version_gate.py. This suite drives launch-runtime.py directly
-// as a subprocess (never through the real `mosaic` CLI), so — exactly like
-// the fake broker (daemon.py) and fake `claude` binaries already used
-// below — it must supply a fake activation-capability probe rather than
-// depend on a real `mosaic` binary being on PATH. `MOSAIC_LEASE_VERSION_PROBE_COMMAND`
-// is launch-runtime.py's injection point for that fake; this literal
-// {name, version} pair must be kept in sync with
-// `EXPECTED_ACTIVATION_CAPABILITY` (activation_version_gate.py) and
-// `LEASE_ACTIVATION_CAPABILITY` (lease-activation-probe.ts) — all three
-// currently agree on v1.
-const leaseCapabilityProbeStub = `python3 -c "import json; print(json.dumps({'name': 'lease-runtime-activation', 'version': 1}))"`;
 const children: ChildProcess[] = [];
 const temporaryRoots: string[] = [];
 
@@ -200,7 +184,6 @@ raise SystemExit(0 if len(session_id) == 64 and denied else 1)
       MOSAIC_PRDY_RUNTIME: 'claude',
       MOSAIC_LEASE_BROKER_SOCKET: socket,
       MOSAIC_RUNTIME_GENERATION: '1',
-      MOSAIC_LEASE_VERSION_PROBE_COMMAND: leaseCapabilityProbeStub,
     },
   });
 }
@@ -760,7 +743,6 @@ describe('whole mutator-class lease gate', () => {
           ...process.env,
           MOSAIC_LEASE_BROKER_SOCKET: socket,
           MOSAIC_RUNTIME_GENERATION: '1',
-          MOSAIC_LEASE_VERSION_PROBE_COMMAND: leaseCapabilityProbeStub,
         },
       },
     );
@@ -779,7 +761,6 @@ describe('whole mutator-class lease gate', () => {
           ...process.env,
           MOSAIC_LEASE_BROKER_SOCKET: join(tmpdir(), 'missing-mosaic-broker.sock'),
           MOSAIC_RUNTIME_GENERATION: '1',
-          MOSAIC_LEASE_VERSION_PROBE_COMMAND: leaseCapabilityProbeStub,
         },
       },
     );
@@ -897,7 +878,6 @@ raise SystemExit(0 if len(session_id) == 64 and hook_present and observers_prese
           PATH: `${binDir}:${process.env.PATH ?? ''}`,
           MOSAIC_LEASE_BROKER_SOCKET: socket,
           MOSAIC_RUNTIME_GENERATION: '1',
-          MOSAIC_LEASE_VERSION_PROBE_COMMAND: leaseCapabilityProbeStub,
         },
         proxyGate: () =>
           Promise.resolve({

packages/mosaic/src/mutator-gate/runtime_tools_unittest.py

@@ -39,18 +39,6 @@ LAUNCHER = load_tool("lease_runtime_launcher", "launch-runtime.py")
 GATE = load_tool("lease_mutator_gate", "mutator-gate.py")
 
 
-def matching_activation_probe(*_args: object, **_kwargs: object) -> dict[str, object]:
-    """Fake activation-capability probe matching what enforcement expects
-    (C4, #869 Point-1). Injected into `LAUNCHER.main()` calls below that are
-    exercising OTHER branches (registration, exec, generation init, ...) so
-    the new version-coupling gate — which runs before those — never blocks
-    on host state (no real `mosaic` CLI on PATH in a test sandbox). The
-    version-coupling gate's OWN behavior (match/mismatch/absent) is covered
-    by its dedicated red-first tests in `version_coupling_unittest.py`."""
-
-    return dict(LAUNCHER.EXPECTED_ACTIVATION_CAPABILITY)
-
-
 class FakeSocket:
     def __init__(self, *chunks: bytes):
         self.chunks = list(chunks)
@@ -107,7 +95,6 @@ class LaunchRuntimeTest(unittest.TestCase):
             request=request,
             execute=execute,
             initialize_generation=initialize_generation,
-            probe_activation_capability=matching_activation_probe,
         )
 
         self.assertEqual(result, 0)
@@ -140,7 +127,6 @@ class LaunchRuntimeTest(unittest.TestCase):
             request=lambda *_args: {"ok": True, "session_id": "e" * 64},
             execute=lambda *args: executed.append(args),
             initialize_generation=lambda *_args: None,
-            probe_activation_capability=matching_activation_probe,
         )
         self.assertEqual(result, 0)
         self.assertEqual(
@@ -167,7 +153,6 @@ class LaunchRuntimeTest(unittest.TestCase):
             request=lambda *_args: {"ok": True, "session_id": "f" * 64},
             execute=lambda *args: executed.append(args),
             initialize_generation=lambda *_args: None,
-            probe_activation_capability=matching_activation_probe,
         )
         self.assertEqual(result, 0)
         self.assertEqual(executed[0][0:2], ("pi", ["pi", "--print", "hello"]))
@@ -203,7 +188,6 @@ class LaunchRuntimeTest(unittest.TestCase):
                     environ=environment,
                     request=lambda *_args, value=reply: value,
                     execute=lambda *args: executed.append(args),
-                    probe_activation_capability=matching_activation_probe,
                 )
                 self.assertEqual(result, 1)
                 self.assertEqual(executed, [])
@@ -219,7 +203,6 @@ class LaunchRuntimeTest(unittest.TestCase):
                     initialize_generation=lambda *_args: (_ for _ in ()).throw(
                         OSError("unsafe state")
                     ),
-                    probe_activation_capability=matching_activation_probe,
                 ),
                 1,
             )
@@ -237,7 +220,6 @@ class LaunchRuntimeTest(unittest.TestCase):
                         environ={"MOSAIC_LEASE_BROKER_SOCKET": "/x"},
                         request=request,
                         execute=lambda *_args: self.fail("must not execute"),
-                        probe_activation_capability=matching_activation_probe,
                     ),
                     1,
                 )
@@ -251,7 +233,6 @@ class LaunchRuntimeTest(unittest.TestCase):
                     request=lambda *_args: {"ok": True, "session_id": "c" * 64},
                     execute=lambda *_args: (_ for _ in ()).throw(OSError("missing")),
                     initialize_generation=lambda *_args: None,
-                    probe_activation_capability=matching_activation_probe,
                 ),
                 1,
             )

packages/mosaic/src/mutator-gate/version_coupling_unittest.py

@@ -1,287 +0,0 @@
-#!/usr/bin/env python3
-"""Red-first tests for issue #869 Point-1 C4 — the enforcement/activation
-version-coupling assertion at the `launch-runtime.py` seam.
-
-Root cause under test (#828 restated): the lease broker's ENFORCEMENT half
-(this toolkit) and its ACTIVATION half (`execLeaseGatedRuntime()` in
-`launch.ts`, chained through `launch-runtime.py`) shipped on different
-channels and drifted. C1 (`lease-activation-probe.ts`) gave the activation
-half a versioned, machine-checkable identity
-(`LEASE_ACTIVATION_CAPABILITY`, printed via the hidden CLI subcommand
-`mosaic __lease-capability`). C4 (this module + `activation_version_gate.py`)
-is the assertion that actually USES that identity: enforcement must refuse
-to proceed — loudly, with an actionable remediation message, never a
-silent pass — unless the activation capability it observes exactly matches
-what enforcement expects.
-
-Every case here drives the seam with injected fakes/stubs (a fake
-`probe_activation_capability` callable at the `launch-runtime.py` level, or
-a fake `run` transport at the `activation_version_gate` level) — never a
-real broker, a real installed CLI, or a real `mosaic` binary on PATH.
-"""
-
-from __future__ import annotations
-
-import importlib.util
-import io
-import subprocess
-import sys
-import unittest
-from contextlib import redirect_stderr
-from pathlib import Path
-
-
-TOOLS_DIR = Path(__file__).parents[2] / "framework/tools/lease-broker"
-if str(TOOLS_DIR) not in sys.path:
-    sys.path.insert(0, str(TOOLS_DIR))
-
-
-def load_tool(module_name: str, filename: str):
-    spec = importlib.util.spec_from_file_location(module_name, TOOLS_DIR / filename)
-    if spec is None or spec.loader is None:
-        raise RuntimeError(f"unable to load {filename}")
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-# Loaded under distinct module names from runtime_tools_unittest.py's own
-# LAUNCHER/GATE loads — importlib.util.module_from_spec() gives each load a
-# fresh module object regardless of name collisions, but distinct names keep
-# tracebacks/debugging unambiguous when both files run in the same process.
-LAUNCHER = load_tool("lease_runtime_launcher_version_coupling", "launch-runtime.py")
-VERSION_GATE = load_tool("lease_activation_version_gate_test", "activation_version_gate.py")
-
-
-def matching_capability() -> dict[str, object]:
-    return dict(VERSION_GATE.EXPECTED_ACTIVATION_CAPABILITY)
-
-
-class AssertActivationCapabilityMatchesTest(unittest.TestCase):
-    """Unit-level coverage of `activation_version_gate.py`'s own assertion,
-    isolated from the launch-runtime.py seam it is wired into below."""
-
-    def test_matching_capability_passes_silently(self) -> None:
-        VERSION_GATE.assert_activation_capability_matches(matching_capability())
-        # No exception is the assertion; nothing further to check.
-
-    def test_absent_capability_fails_closed_not_silent_pass(self) -> None:
-        with self.assertRaises(VERSION_GATE.VersionCouplingError) as raised:
-            VERSION_GATE.assert_activation_capability_matches(None)
-        message = str(raised.exception)
-        self.assertIn("#869", message)
-        self.assertIn("upgrade", message.lower())
-
-    def test_version_mismatch_message_is_actionable(self) -> None:
-        expected = {"name": "lease-runtime-activation", "version": 1}
-        mismatched = {"name": "lease-runtime-activation", "version": 2}
-        with self.assertRaises(VERSION_GATE.VersionCouplingError) as raised:
-            VERSION_GATE.assert_activation_capability_matches(mismatched, expected)
-        message = str(raised.exception)
-        self.assertIn("v2", message)
-        self.assertIn("v1", message)
-        self.assertIn("#869", message)
-        self.assertIn("upgrade", message.lower())
-        self.assertIn("version skew", message.lower())
-
-    def test_name_mismatch_fails_loud(self) -> None:
-        expected = {"name": "lease-runtime-activation", "version": 1}
-        mismatched = {"name": "some-other-capability", "version": 1}
-        with self.assertRaises(VERSION_GATE.VersionCouplingError) as raised:
-            VERSION_GATE.assert_activation_capability_matches(mismatched, expected)
-        message = str(raised.exception)
-        self.assertIn("some-other-capability", message)
-        self.assertIn("lease-runtime-activation", message)
-        self.assertIn("#869", message)
-
-    def test_reversed_drift_newer_activation_than_enforcement_expects_also_fails(self) -> None:
-        # A build/deploy where ACTIVATION shipped ahead of ENFORCEMENT is
-        # exactly as much version skew as the reverse (#828's actual shape
-        # was enforcement ahead of activation) — the assertion must not special
-        # case direction.
-        expected = {"name": "lease-runtime-activation", "version": 1}
-        newer_activation = {"name": "lease-runtime-activation", "version": 2}
-        with self.assertRaises(VERSION_GATE.VersionCouplingError):
-            VERSION_GATE.assert_activation_capability_matches(newer_activation, expected)
-
-
-class ProbeActivationCapabilityTest(unittest.TestCase):
-    """Coverage of the probe's command resolution and fail-closed transport
-    handling — never spawns a real `mosaic` process."""
-
-    def test_returns_none_when_mosaic_is_not_resolvable_on_path(self) -> None:
-        result = VERSION_GATE.default_probe_activation_capability(
-            {"PATH": "/nonexistent-bin-dir-for-869-c4-test"}
-        )
-        self.assertIsNone(result)
-
-    def test_override_command_is_parsed_and_the_probe_subcommand_is_not_double_appended(
-        self,
-    ) -> None:
-        captured: list[list[str]] = []
-
-        class FakeCompleted:
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation", "version": 1}'
-
-        def fake_run(argv: list[str], **_kwargs: object) -> FakeCompleted:
-            captured.append(argv)
-            return FakeCompleted()
-
-        result = VERSION_GATE.default_probe_activation_capability(
-            {VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: "/fake/mosaic __lease-capability"},
-            run=fake_run,
-        )
-        self.assertEqual(result, {"name": "lease-runtime-activation", "version": 1})
-        self.assertEqual(captured, [["/fake/mosaic", "__lease-capability"]])
-
-    def test_fails_closed_on_nonzero_exit_malformed_json_and_missing_fields(self) -> None:
-        class NonZeroExit:
-            returncode = 1
-            stdout = '{"name": "lease-runtime-activation", "version": 1}'
-
-        class MalformedOutput:
-            returncode = 0
-            stdout = "not-json"
-
-        class MissingVersion:
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation"}'
-
-        class WrongShapeVersion:
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation", "version": "1"}'
-
-        class BooleanVersion:
-            # bool is a subclass of int in Python; must not be accepted as
-            # a version number.
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation", "version": true}'
-
-        for fake in (
-            NonZeroExit(),
-            MalformedOutput(),
-            MissingVersion(),
-            WrongShapeVersion(),
-            BooleanVersion(),
-        ):
-            with self.subTest(stdout=fake.stdout, returncode=fake.returncode):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: "/fake/mosaic"},
-                    run=lambda *_a, fake=fake, **_kw: fake,
-                )
-                self.assertIsNone(result)
-
-    def test_fails_closed_on_timeout_and_transport_error(self) -> None:
-        def timeout_run(*_args: object, **_kwargs: object) -> None:
-            raise subprocess.TimeoutExpired(cmd="mosaic", timeout=2.0)
-
-        def oserror_run(*_args: object, **_kwargs: object) -> None:
-            raise OSError("no such file or directory")
-
-        for run_fake in (timeout_run, oserror_run):
-            with self.subTest(run=run_fake.__name__):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: "/fake/mosaic"},
-                    run=run_fake,
-                )
-                self.assertIsNone(result)
-
-
-class LaunchRuntimeVersionCouplingSeamTest(unittest.TestCase):
-    """End-to-end (still fully faked) coverage of the seam as wired into
-    `launch-runtime.py`'s `main()` — the strongest natural enforcement point
-    per the C4 card, run before any broker registration."""
-
-    def _run(self, *, probe):
-        calls: dict[str, object] = {}
-
-        def request(_path: Path, payload: dict[str, object]) -> dict[str, object]:
-            calls["registered"] = True
-            calls["request"] = payload
-            return {"ok": True, "session_id": "a" * 64}
-
-        def execute(command: str, argv: list[str], environment: dict[str, str]) -> None:
-            calls["executed"] = (command, argv, environment)
-
-        def initialize_generation(_path: Path, _generation: int) -> None:
-            calls["generation_initialized"] = True
-
-        stderr = io.StringIO()
-        with redirect_stderr(stderr):
-            result = LAUNCHER.main(
-                ["--runtime", "claude", "--", "claude", "--print", "hello"],
-                environ={"MOSAIC_LEASE_BROKER_SOCKET": "/run/test/broker.sock"},
-                request=request,
-                execute=execute,
-                initialize_generation=initialize_generation,
-                probe_activation_capability=probe,
-            )
-        return result, stderr.getvalue(), calls
-
-    def test_matching_activation_version_passes_and_the_gate_proceeds(self) -> None:
-        result, stderr_text, calls = self._run(probe=lambda *_a, **_kw: matching_capability())
-        self.assertEqual(result, 0)
-        self.assertEqual(stderr_text, "")
-        self.assertTrue(calls.get("registered"))
-        self.assertIn("executed", calls)
-
-    def test_version_mismatch_fails_loud_denies_and_never_registers_or_execs(self) -> None:
-        expected = LAUNCHER.EXPECTED_ACTIVATION_CAPABILITY
-        mismatched = {"name": expected["name"], "version": expected["version"] + 1}
-        result, stderr_text, calls = self._run(probe=lambda *_a, **_kw: mismatched)
-
-        self.assertEqual(result, LAUNCHER.EXIT_VERSION_SKEW)
-        self.assertNotEqual(result, 0)
-        self.assertIn("#869", stderr_text)
-        self.assertIn(f"v{mismatched['version']}", stderr_text)
-        self.assertIn(f"v{expected['version']}", stderr_text)
-        self.assertIn("upgrade", stderr_text.lower())
-        # Never reaches broker registration or exec — the version gate is a
-        # hard stop, not advisory.
-        self.assertNotIn("registered", calls)
-        self.assertNotIn("executed", calls)
-
-    def test_name_mismatch_fails_loud(self) -> None:
-        expected = LAUNCHER.EXPECTED_ACTIVATION_CAPABILITY
-        mismatched = {"name": "some-other-capability", "version": expected["version"]}
-        result, stderr_text, calls = self._run(probe=lambda *_a, **_kw: mismatched)
-
-        self.assertEqual(result, LAUNCHER.EXIT_VERSION_SKEW)
-        self.assertIn("#869", stderr_text)
-        self.assertIn("some-other-capability", stderr_text)
-        self.assertNotIn("registered", calls)
-        self.assertNotIn("executed", calls)
-
-    def test_absent_activation_capability_fails_closed_not_a_silent_pass(self) -> None:
-        result, stderr_text, calls = self._run(probe=lambda *_a, **_kw: None)
-
-        self.assertEqual(result, LAUNCHER.EXIT_VERSION_SKEW)
-        self.assertNotEqual(result, 0)
-        self.assertIn("#869", stderr_text)
-        self.assertNotIn("registered", calls)
-        self.assertNotIn("executed", calls)
-
-    def test_version_gate_runs_before_and_independently_of_broker_registration(self) -> None:
-        def request_must_not_be_called(*_args: object, **_kwargs: object) -> dict[str, object]:
-            self.fail("broker must not be contacted when activation version is mismatched")
-
-        stderr = io.StringIO()
-        with redirect_stderr(stderr):
-            result = LAUNCHER.main(
-                ["--runtime", "claude", "--", "claude"],
-                environ={"MOSAIC_LEASE_BROKER_SOCKET": "/run/test/broker.sock"},
-                request=request_must_not_be_called,
-                probe_activation_capability=lambda *_a, **_kw: None,
-            )
-        self.assertEqual(result, LAUNCHER.EXIT_VERSION_SKEW)
-
-    def test_dedicated_exit_code_never_collides_with_usage_or_registration_codes(self) -> None:
-        # Distinctness guard: a version-skew denial must never be mistaken
-        # for the pre-existing usage error (64) or registration/exec
-        # fail-closed code (1) this script already owns.
-        self.assertNotIn(LAUNCHER.EXIT_VERSION_SKEW, (0, 1, 64))
-
-
-if __name__ == "__main__":
-    unittest.main()