fix(docs): restore Tess markdown formatting gate

.woodpecker/ci.yml

@@ -7,14 +7,7 @@ variables:
   - &enable_pnpm 'corepack enable'
 
 when:
-  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
-  # push CI is restricted to protected branches (main) so a feature-branch push no
-  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
-  # CI load on the storage-constrained runner with zero loss of gating (branch
-  # protection requires no push/ci status context; main still gets full push CI).
-  - event: [pull_request, manual]
-  - event: push
-    branch: main
+  - event: [push, pull_request, manual]
 
 # Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
 # repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).

apps/gateway/package.json

@@ -31,7 +31,6 @@
     "@mariozechner/pi-ai": "^0.65.0",
     "@mariozechner/pi-coding-agent": "^0.65.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@mosaicstack/agent": "workspace:^",
     "@mosaicstack/auth": "workspace:^",
     "@mosaicstack/brain": "workspace:^",
     "@mosaicstack/config": "workspace:^",

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -1,192 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { InMemoryDurableSessionStore } from '@mosaicstack/agent';
-import {
-  createDiscordIngressEnvelope,
-  DiscordPlugin,
-  type DiscordIngressPayload,
-} from '@mosaicstack/discord-plugin';
-import { InteractionController } from '../../agent/interaction.controller.js';
-import { RuntimeProviderService } from '../../agent/runtime-provider-registry.service.js';
-import { TessDurableSessionService } from '../../agent/tess-durable-session.service.js';
-import { ChatGateway } from '../../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../../commands/command-authorization.service.js';
-
-const SERVICE_TOKEN = 'test-discord-service-token';
-const envKeys = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-] as const;
-const priorEnv = new Map<string, string | undefined>();
-
-function payload(content: string, messageId: string, correlationId: string): DiscordIngressPayload {
-  return {
-    content,
-    messageId,
-    correlationId,
-    guildId: 'guild-1',
-    channelId: 'channel-1',
-    userId: 'discord-admin-1',
-    conversationId: 'Nova:discord:channel-1',
-  };
-}
-
-function authorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  return new CommandAuthorizationService(
-    {
-      select: () => ({
-        from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-      }),
-    } as never,
-    {
-      get: async (key: string) => entries.get(key) ?? null,
-      set: async (key: string, value: string) => entries.set(key, value),
-      del: async (key: string) => Number(entries.delete(key)),
-    },
-  );
-}
-
-describe('Tess Discord/CLI durable-session integration', () => {
-  afterEach(() => {
-    for (const key of envKeys) {
-      const value = priorEnv.get(key);
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-    priorEnv.clear();
-  });
-
-  it('enrolls through the CLI surface then resolves the same durable session from Discord', async () => {
-    for (const key of envKeys) priorEnv.set(key, process.env[key]);
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-    process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-1';
-    process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-1';
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-1';
-    process.env['DISCORD_ALLOWED_USER_IDS'] = 'discord-admin-1';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        guildId: 'guild-1',
-        channelId: 'channel-1',
-        pairedUsers: {
-          'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-        },
-      },
-    ]);
-
-    const durable = new TessDurableSessionService(
-      new InMemoryDurableSessionStore() as never,
-      {} as never,
-    );
-    const enrollmentRuntime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const controller = new InteractionController(enrollmentRuntime as never, durable);
-    await controller.enroll(
-      'Nova',
-      'Nova:discord:channel-1',
-      { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      { id: 'mosaic-admin-1', tenantId: 'tenant-1' },
-      'cli-enrollment-correlation',
-    );
-
-    const authz = authorization();
-    const terminated = vi.fn().mockResolvedValue(undefined);
-    const runtime = new RuntimeProviderService(
-      {
-        require: () => ({
-          capabilities: async () => ({ supported: ['session.terminate'] }),
-          terminate: terminated,
-        }),
-      } as never,
-      { record: async () => undefined } as never,
-      {
-        consume: (approvalId, action) =>
-          authz.consumeRuntimeTerminationApproval(approvalId, action),
-      },
-    );
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authz,
-      runtime,
-      durable,
-    );
-    const client = { data: { discordService: true }, emit: vi.fn() };
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-1'],
-      allowedChannelIds: ['channel-1'],
-      allowedUserIds: ['discord-admin-1'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          guildId: 'guild-1',
-          channelId: 'channel-1',
-          pairedUsers: {
-            'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-          },
-        },
-      ],
-    });
-    const pluginInternals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    const pluginSocket = { connected: true, emit: vi.fn() };
-    pluginInternals.client = { user: { id: 'bot-1' } };
-    pluginInternals.socket = pluginSocket;
-    pluginInternals.handleDiscordMessage({
-      id: 'approve-1',
-      guildId: 'guild-1',
-      channelId: 'channel-1',
-      author: { id: 'discord-admin-1', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-1> /approve',
-      channel: { parentId: null },
-      attachments: new Map(),
-    });
-
-    expect(pluginSocket.emit).toHaveBeenCalledWith('discord:approve', expect.any(Object));
-    const approvalEnvelope = pluginSocket.emit.mock.calls[0]?.[1];
-    await gateway.handleDiscordApproval(client as never, approvalEnvelope);
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      createDiscordIngressEnvelope(
-        payload(`/stop ${approval.approvalId}`, 'stop-1', 'discord-stop-correlation'),
-        SERVICE_TOKEN,
-      ),
-    );
-
-    expect(terminated).toHaveBeenCalledWith(
-      'runtime-1',
-      approval.approvalId,
-      expect.objectContaining({ actorId: 'mosaic-admin-1' }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'discord-stop-correlation',
-      success: true,
-    });
-  });
-});

apps/gateway/src/admin/admin-health.controller.ts

@@ -20,7 +20,7 @@ export class AdminHealthController {
   async check(): Promise<HealthStatusDto> {
     const [database, cache] = await Promise.all([this.checkDatabase(), this.checkCache()]);
 
-    const sessions = this.agentService.listAllSessionsForSystem();
+    const sessions = this.agentService.listSessions();
     const providers = this.providerService.listProviders();
 
     const allOk = database.status === 'ok' && cache.status === 'ok';

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -1,142 +0,0 @@
-import { ForbiddenException } from '@nestjs/common';
-import { describe, expect, it, vi } from 'vitest';
-import { AgentService, type AgentSession } from '../agent.service.js';
-import type { ActorTenantScope } from '../../auth/session-scope.js';
-
-const CONVERSATION_ID = '22222222-2222-4222-8222-222222222222';
-const OWNER_SCOPE: ActorTenantScope = { userId: 'owner-user', tenantId: 'owner-tenant' };
-const FOREIGN_SCOPE: ActorTenantScope = { userId: 'foreign-user', tenantId: 'foreign-tenant' };
-
-type AgentServiceInternals = {
-  sessions: Map<string, AgentSession>;
-  creating: Map<string, Promise<AgentSession>>;
-};
-
-function makeService(): AgentService {
-  return new AgentService(
-    {} as never,
-    {} as never,
-    {} as never,
-    { available: false } as never,
-    {} as never,
-    {} as never,
-    {} as never,
-    null,
-    null,
-    { collect: vi.fn().mockResolvedValue(undefined) } as never,
-  );
-}
-
-function internals(service: AgentService): AgentServiceInternals {
-  return service as unknown as AgentServiceInternals;
-}
-
-function makeSession(scope: ActorTenantScope = OWNER_SCOPE): AgentSession {
-  return {
-    id: CONVERSATION_ID,
-    provider: 'test-provider',
-    modelId: 'test-model',
-    piSession: {
-      thinkingLevel: 'off',
-      getAvailableThinkingLevels: vi.fn().mockReturnValue(['off', 'low', 'high']),
-      setThinkingLevel: vi.fn(),
-      abort: vi.fn().mockResolvedValue(undefined),
-      prompt: vi.fn().mockResolvedValue(undefined),
-      dispose: vi.fn(),
-      getSessionStats: vi.fn(),
-      getContextUsage: vi.fn(),
-    } as unknown as AgentSession['piSession'],
-    listeners: new Set(),
-    unsubscribe: vi.fn(),
-    createdAt: Date.now(),
-    promptCount: 0,
-    channels: new Set(),
-    skillPromptAdditions: [],
-    sandboxDir: '/tmp/tess-session-ownership-test',
-    allowedTools: null,
-    userId: scope.userId,
-    tenantId: scope.tenantId,
-    metrics: {
-      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-      modelSwitches: 0,
-      messageCount: 0,
-      lastActivityAt: new Date('2026-07-12T00:00:00Z').toISOString(),
-    },
-  };
-}
-
-describe('AgentService owner/tenant scope enforcement', () => {
-  it('allows owner-scoped operations and rejects foreign scopes for seeded sessions', async () => {
-    const service = makeService();
-    const session = makeSession();
-    internals(service).sessions.set(CONVERSATION_ID, session);
-
-    expect(service.getSession(CONVERSATION_ID, OWNER_SCOPE)).toBe(session);
-    expect(service.getSession(CONVERSATION_ID, FOREIGN_SCOPE)).toBeUndefined();
-    expect(service.getSessionInfo(CONVERSATION_ID, FOREIGN_SCOPE)).toBeUndefined();
-    expect(service.listSessions(OWNER_SCOPE)).toHaveLength(1);
-    expect(service.listSessions(FOREIGN_SCOPE)).toEqual([]);
-
-    service.addChannel(CONVERSATION_ID, 'websocket:owner', OWNER_SCOPE);
-    expect(session.channels.has('websocket:owner')).toBe(true);
-    expect(() => service.addChannel(CONVERSATION_ID, 'websocket:foreign', FOREIGN_SCOPE)).toThrow(
-      ForbiddenException,
-    );
-    expect(() => service.removeChannel(CONVERSATION_ID, 'websocket:owner', FOREIGN_SCOPE)).toThrow(
-      ForbiddenException,
-    );
-
-    expect(() =>
-      service.updateSessionModel(CONVERSATION_ID, 'foreign-model', FOREIGN_SCOPE),
-    ).toThrow(ForbiddenException);
-    service.updateSessionModel(CONVERSATION_ID, 'owner-model', OWNER_SCOPE);
-    expect(session.modelId).toBe('owner-model');
-
-    expect(() =>
-      service.applyAgentConfig(CONVERSATION_ID, 'agent-foreign', 'Foreign Agent', FOREIGN_SCOPE),
-    ).toThrow(ForbiddenException);
-    service.applyAgentConfig(CONVERSATION_ID, 'agent-owner', 'Owner Agent', OWNER_SCOPE);
-    expect(session.agentConfigId).toBe('agent-owner');
-
-    expect(() => service.onEvent(CONVERSATION_ID, vi.fn(), FOREIGN_SCOPE)).toThrow(
-      ForbiddenException,
-    );
-    const cleanup = service.onEvent(CONVERSATION_ID, vi.fn(), OWNER_SCOPE);
-    cleanup();
-
-    await expect(
-      service.prompt(CONVERSATION_ID, 'foreign prompt', FOREIGN_SCOPE),
-    ).rejects.toBeInstanceOf(ForbiddenException);
-    await service.prompt(CONVERSATION_ID, 'owner prompt', OWNER_SCOPE);
-    expect(session.piSession.prompt).toHaveBeenCalledWith('owner prompt');
-
-    await expect(service.destroySession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
-      ForbiddenException,
-    );
-    expect(internals(service).sessions.has(CONVERSATION_ID)).toBe(true);
-
-    await service.destroySession(CONVERSATION_ID, OWNER_SCOPE);
-    expect(session.piSession.dispose).toHaveBeenCalled();
-    expect(internals(service).sessions.has(CONVERSATION_ID)).toBe(false);
-  });
-
-  it('checks owner/tenant scope before returning an in-flight session creation', async () => {
-    const service = makeService();
-    const session = makeSession();
-    internals(service).creating.set(CONVERSATION_ID, Promise.resolve(session));
-
-    await expect(
-      service.createSession(CONVERSATION_ID, {
-        userId: FOREIGN_SCOPE.userId,
-        tenantId: FOREIGN_SCOPE.tenantId,
-      }),
-    ).rejects.toBeInstanceOf(ForbiddenException);
-
-    await expect(
-      service.createSession(CONVERSATION_ID, {
-        userId: OWNER_SCOPE.userId,
-        tenantId: OWNER_SCOPE.tenantId,
-      }),
-    ).resolves.toBe(session);
-  });
-});

apps/gateway/src/agent/__tests__/runtime-provider-registry.service.test.ts

@@ -1,370 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import type { ActorTenantScope } from '../../auth/session-scope.js';
-import {
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-  type RuntimeAuditEvent,
-  type RuntimeAuditSink,
-  type RuntimeApprovalVerifier,
-} from '../runtime-provider-registry.service.js';
-
-process.env['MOSAIC_AGENT_NAME'] ??= 'test-runtime-agent';
-
-const OWNER_SCOPE: ActorTenantScope = { userId: 'owner-1', tenantId: 'tenant-1' };
-const CONTEXT = {
-  actorScope: OWNER_SCOPE,
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-class RecordingRuntimeProvider implements AgentRuntimeProvider {
-  readonly id = 'fleet';
-  readonly receivedScopes: RuntimeScope[] = [];
-  readonly sentMessages: RuntimeMessage[] = [];
-  terminateCalls = 0;
-  throwAfterSend = false;
-  throwAuthorization = false;
-
-  constructor(private readonly supported: RuntimeCapability[]) {}
-
-  async capabilities(scope: RuntimeScope): Promise<RuntimeCapabilitySet> {
-    this.receivedScopes.push(scope);
-    return { supported: this.supported };
-  }
-
-  async health(scope: RuntimeScope): Promise<RuntimeHealth> {
-    this.receivedScopes.push(scope);
-    return { status: 'healthy', checkedAt: '2026-07-12T00:00:00.000Z' };
-  }
-
-  async listSessions(scope: RuntimeScope): Promise<RuntimeSession[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async getSessionTree(scope: RuntimeScope): Promise<RuntimeSessionTree[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async *streamSession(
-    _sessionId: string,
-    _cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    this.receivedScopes.push(scope);
-    return;
-  }
-
-  async sendMessage(
-    _sessionId: string,
-    message: RuntimeMessage,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.sentMessages.push(message);
-    if (this.throwAuthorization) {
-      throw Object.assign(new Error('provider authorization denied'), { code: 'forbidden' });
-    }
-    if (this.throwAfterSend) {
-      throw new Error('provider acknowledgement failed');
-    }
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    this.receivedScopes.push(scope);
-    return {
-      attachmentId: 'attachment-1',
-      sessionId,
-      mode,
-      expiresAt: '2026-07-12T00:00:00.000Z',
-    };
-  }
-
-  async detach(_attachmentId: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-  }
-
-  async terminate(_sessionId: string, _approvalRef: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.terminateCalls += 1;
-  }
-}
-
-class RecordingAuditSink implements RuntimeAuditSink {
-  readonly events: RuntimeAuditEvent[] = [];
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    this.events.push(event);
-  }
-}
-
-class DenyingApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(): Promise<boolean> {
-    return false;
-  }
-}
-
-class AcceptingApprovalVerifier implements RuntimeApprovalVerifier {
-  consumedAction: Parameters<RuntimeApprovalVerifier['consume']>[1] | undefined;
-
-  async consume(
-    _approvalRef: string,
-    action: Parameters<RuntimeApprovalVerifier['consume']>[1],
-  ): Promise<boolean> {
-    this.consumedAction = action;
-    return true;
-  }
-}
-
-function makeService(
-  provider: RecordingRuntimeProvider,
-  audit: RuntimeAuditSink = new RecordingAuditSink(),
-  approval: RuntimeApprovalVerifier = new DenyingApprovalVerifier(),
-): RuntimeProviderService {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(provider);
-  return new RuntimeProviderService(registry, audit, approval);
-}
-
-describe('RuntimeProviderService security boundary', (): void => {
-  it('derives and freezes only the authenticated actor scope while preserving correlation metadata', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await service.sendMessage(
-      'fleet',
-      'session-1',
-      { content: 'hello', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    const providerScope = provider.receivedScopes[0];
-    expect(providerScope).toEqual({
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-    });
-    expect(Object.isFrozen(providerScope)).toBe(true);
-    expect(audit.events).toContainEqual(
-      expect.objectContaining({
-        providerId: 'fleet',
-        operation: 'session.send',
-        outcome: 'succeeded',
-        actorId: OWNER_SCOPE.userId,
-        tenantId: OWNER_SCOPE.tenantId,
-        channelId: CONTEXT.channelId,
-        correlationId: CONTEXT.correlationId,
-        resourceId: 'session-1',
-        durationMs: expect.any(Number),
-      }),
-    );
-    expect(JSON.stringify(audit.events)).not.toContain('hello');
-    expect(JSON.stringify(audit.events)).not.toContain('key-1');
-  });
-
-  it('does not block a provider operation when an unsafe resource ID is redacted in durable audit', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let persisted: unknown;
-    const durableAudit = new RuntimeProviderAuditService({
-      logs: {
-        ingest: async (entry: unknown): Promise<unknown> => {
-          persisted = entry;
-          return entry;
-        },
-      },
-    } as never);
-    const service = makeService(provider, durableAudit);
-
-    await service.sendMessage(
-      'fleet',
-      'session/credential-canary=secret-value',
-      { content: 'safe message', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(JSON.stringify(persisted)).not.toContain('secret-value');
-  });
-
-  it('fails closed before a provider side effect when a capability is missing', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider([]);
-    const service = makeService(provider);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/capability denied/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('requires a consumed exact-action approval before termination', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new DenyingApprovalVerifier();
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit, approval);
-
-    await expect(
-      service.terminate('fleet', 'session-1', 'forged-approval', CONTEXT),
-    ).rejects.toThrow(/approval denied/);
-    expect(provider.terminateCalls).toBe(0);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('binds an accepted termination approval to provider, session, immutable scope, and correlation', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new AcceptingApprovalVerifier();
-    const service = makeService(provider, new RecordingAuditSink(), approval);
-
-    await service.terminate('fleet', 'session-1', 'approval-1', CONTEXT);
-
-    expect(approval.consumedAction).toEqual({
-      providerId: 'fleet',
-      sessionId: 'session-1',
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-      agentName: process.env['MOSAIC_AGENT_NAME'],
-    });
-    expect(provider.terminateCalls).toBe(1);
-  });
-
-  it('fails closed before invoking a provider when audit persistence rejects the request', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const unavailableAudit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        throw new Error('audit unavailable');
-      },
-    };
-    const service = makeService(provider, unavailableAudit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/audit unavailable/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('records a provider error after invocation as failed rather than denied', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAfterSend = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider acknowledgement failed/);
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(audit.events.map((event: RuntimeAuditEvent): string => event.outcome)).toEqual([
-      'requested',
-      'failed',
-    ]);
-    expect(audit.events.at(-1)).toMatchObject({
-      errorCode: 'provider_error',
-      durationMs: expect.any(Number),
-    });
-  });
-
-  it('records a provider authorization rejection as denied rather than provider failure', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAuthorization = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider authorization denied/);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('persists only metadata-only runtime audit fields', async (): Promise<void> => {
-    let persisted: unknown;
-    const ingest = async (entry: unknown): Promise<unknown> => {
-      persisted = entry;
-      return entry;
-    };
-    const service = new RuntimeProviderAuditService({ logs: { ingest } } as never);
-
-    await service.record({
-      providerId: 'fleet',
-      operation: 'session.send',
-      outcome: 'succeeded',
-      actorId: 'owner-1',
-      tenantId: 'tenant-1',
-      channelId: 'cli',
-      correlationId: 'correlation-1',
-      resourceId: 'session-1',
-      durationMs: 12,
-    });
-
-    expect(persisted).toMatchObject({
-      content: 'runtime.provider.audit',
-      metadata: expect.objectContaining({ correlationId: 'correlation-1', durationMs: 12 }),
-    });
-    expect(JSON.stringify(persisted)).not.toContain('approval');
-  });
-
-  it('does not misreport a completed provider side effect when completion auditing fails', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let auditCalls = 0;
-    const audit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        auditCalls += 1;
-        if (auditCalls === 2) {
-          throw new Error('completion audit unavailable');
-        }
-      },
-    };
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).resolves.toBeUndefined();
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(auditCalls).toBe(2);
-  });
-});

apps/gateway/src/agent/__tests__/session-ownership.test.ts

@@ -1,262 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { ForbiddenException, NotFoundException } from '@nestjs/common';
-import { describe, expect, it, vi } from 'vitest';
-
-vi.mock('../agent.service.js', () => ({ AgentService: class AgentService {} }));
-vi.mock('../../commands/command-executor.service.js', () => ({
-  CommandExecutorService: class CommandExecutorService {},
-}));
-vi.mock('../routing/routing-engine.service.js', () => ({
-  RoutingEngineService: class RoutingEngineService {},
-}));
-
-import { SessionsController } from '../sessions.controller.js';
-import { ChatController } from '../../chat/chat.controller.js';
-import { ChatGateway } from '../../chat/chat.gateway.js';
-import type { AgentSession } from '../agent.service.js';
-import type { SessionInfoDto } from '../session.dto.js';
-
-const USER_A = { id: 'user-a', tenantId: 'tenant-a' };
-const USER_B = { id: 'user-b', tenantId: 'tenant-b' };
-const CONVERSATION_ID = '11111111-1111-4111-8111-111111111111';
-
-function makeSessionInfo(overrides?: Partial<SessionInfoDto>): SessionInfoDto {
-  return {
-    id: CONVERSATION_ID,
-    provider: 'test-provider',
-    modelId: 'test-model',
-    createdAt: new Date('2026-07-12T00:00:00Z').toISOString(),
-    promptCount: 0,
-    channels: [],
-    durationMs: 0,
-    metrics: {
-      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-      modelSwitches: 0,
-      messageCount: 0,
-      lastActivityAt: new Date('2026-07-12T00:00:00Z').toISOString(),
-    },
-    ...overrides,
-  };
-}
-
-function makeAgentSession(owner = USER_A): AgentSession {
-  return {
-    id: CONVERSATION_ID,
-    provider: 'test-provider',
-    modelId: 'test-model',
-    piSession: {
-      thinkingLevel: 'off',
-      getAvailableThinkingLevels: vi.fn().mockReturnValue(['off', 'low', 'high']),
-      setThinkingLevel: vi.fn(),
-      abort: vi.fn().mockResolvedValue(undefined),
-      prompt: vi.fn().mockResolvedValue(undefined),
-      dispose: vi.fn(),
-      getSessionStats: vi.fn(),
-      getContextUsage: vi.fn(),
-    } as unknown as AgentSession['piSession'],
-    listeners: new Set(),
-    unsubscribe: vi.fn(),
-    createdAt: Date.now(),
-    promptCount: 0,
-    channels: new Set(),
-    skillPromptAdditions: [],
-    sandboxDir: '/tmp',
-    allowedTools: null,
-    userId: owner.id,
-    tenantId: owner.tenantId,
-    metrics: {
-      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-      modelSwitches: 0,
-      messageCount: 0,
-      lastActivityAt: new Date('2026-07-12T00:00:00Z').toISOString(),
-    },
-  };
-}
-
-function makeScopedAgentService() {
-  const foreign = makeAgentSession(USER_A);
-  return {
-    listSessions: vi.fn((scope?: { userId: string; tenantId?: string }) =>
-      scope?.userId === USER_B.id ? [] : [makeSessionInfo({ id: foreign.id })],
-    ),
-    getSessionInfo: vi.fn((_id: string, scope?: { userId: string; tenantId?: string }) =>
-      scope?.userId === USER_B.id ? undefined : makeSessionInfo({ id: foreign.id }),
-    ),
-    destroySession: vi.fn(),
-    getSession: vi.fn((_id: string, scope?: { userId: string; tenantId?: string }) =>
-      scope?.userId === USER_B.id ? undefined : foreign,
-    ),
-    createSession: vi.fn().mockRejectedValue(new ForbiddenException('Session scope mismatch')),
-    onEvent: vi.fn(() => vi.fn()),
-    addChannel: vi.fn(),
-    removeChannel: vi.fn(),
-    recordMessage: vi.fn(),
-    prompt: vi.fn().mockResolvedValue(undefined),
-  };
-}
-
-describe('TESS-M1-SEC-002 AgentService ownership boundary', () => {
-  it('requires explicit owner+tenant scope on protected session operations', () => {
-    const source = readFileSync(resolve('src/agent/agent.service.ts'), 'utf8');
-
-    expect(source).toContain('getSession(sessionId: string, scope: ActorTenantScope)');
-    expect(source).toContain('listSessions(scope: ActorTenantScope)');
-    expect(source).toContain('getSessionInfo(sessionId: string, scope: ActorTenantScope)');
-    expect(source).toContain(
-      'addChannel(sessionId: string, channel: string, scope: ActorTenantScope)',
-    );
-    expect(source).toContain(
-      'removeChannel(sessionId: string, channel: string, scope: ActorTenantScope)',
-    );
-    expect(source).toContain(
-      'async prompt(sessionId: string, message: string, scope: ActorTenantScope)',
-    );
-    expect(source).toContain('scope: ActorTenantScope,');
-    expect(source).toContain('async destroySession(sessionId: string, scope: ActorTenantScope)');
-    expect(source).not.toContain('scope?: ActorTenantScope');
-  });
-});
-
-describe('TESS-M1-SEC-002 REST session ownership and tenant binding', () => {
-  it('lists only sessions owned by the authenticated owner+tenant scope', () => {
-    const agentService = makeScopedAgentService();
-    const controller = new SessionsController(agentService as never);
-
-    expect(controller.list(USER_B)).toEqual({ sessions: [], total: 0 });
-    expect(agentService.listSessions).toHaveBeenCalledWith({
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-  });
-
-  it('does not reveal another owner/tenant session by guessed id', () => {
-    const agentService = makeScopedAgentService();
-    const controller = new SessionsController(agentService as never);
-
-    expect(() => controller.findOne(CONVERSATION_ID, USER_B)).toThrow(NotFoundException);
-    expect(agentService.getSessionInfo).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-  });
-
-  it('does not terminate another owner/tenant session by guessed id', async () => {
-    const agentService = makeScopedAgentService();
-    const controller = new SessionsController(agentService as never);
-
-    await expect(controller.destroy(CONVERSATION_ID, USER_B)).rejects.toBeInstanceOf(
-      NotFoundException,
-    );
-    expect(agentService.destroySession).not.toHaveBeenCalled();
-  });
-});
-
-describe('TESS-M1-SEC-002 REST chat send ownership and tenant binding', () => {
-  it('does not send a prompt into another owner/tenant session by guessed conversationId', async () => {
-    const agentService = makeScopedAgentService();
-    const controller = new ChatController(agentService as never);
-
-    await expect(
-      controller.chat({ conversationId: CONVERSATION_ID, content: 'take over' }, USER_B),
-    ).rejects.toMatchObject({ status: 404 });
-
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(agentService.prompt).not.toHaveBeenCalled();
-  });
-});
-
-describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding', () => {
-  function makeGateway(agentService = makeScopedAgentService()) {
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue(undefined),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        findMessages: vi.fn().mockResolvedValue([]),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const commandRegistry = { getManifest: vi.fn().mockReturnValue([]) };
-    const commandExecutor = { execute: vi.fn() };
-    const routingEngine = {
-      resolve: vi.fn().mockResolvedValue({ provider: 'test', model: 'test-model' }),
-    };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      commandRegistry as never,
-      commandExecutor as never,
-      routingEngine as never,
-    );
-    return { gateway, agentService };
-  }
-
-  function makeSocket() {
-    return {
-      id: 'socket-b',
-      connected: true,
-      data: { user: USER_B, session: { id: 'auth-session-b', userId: USER_B.id } },
-      emit: vi.fn(),
-      disconnect: vi.fn(),
-    };
-  }
-
-  it('does not attach or send to another owner/tenant session by guessed conversationId', async () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
-
-    await gateway.handleMessage(socket as never, {
-      conversationId: CONVERSATION_ID,
-      content: 'attach to foreign session',
-    });
-
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(agentService.onEvent).not.toHaveBeenCalled();
-    expect(agentService.addChannel).not.toHaveBeenCalled();
-    expect(agentService.prompt).not.toHaveBeenCalled();
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
-    );
-  });
-
-  it('does not mutate thinking level on another owner/tenant session', () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
-
-    gateway.handleSetThinking(socket as never, { conversationId: CONVERSATION_ID, level: 'high' });
-
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
-    );
-  });
-
-  it('does not terminate another owner/tenant session over WebSocket abort', async () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
-
-    await gateway.handleAbort(socket as never, { conversationId: CONVERSATION_ID });
-
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
-    );
-  });
-});

apps/gateway/src/agent/agent.module.ts

@@ -1,5 +1,4 @@
 import { Global, Module } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
 import { AgentService } from './agent.service.js';
 import { ProviderService } from './provider.service.js';
 import { ProviderCredentialsService } from './provider-credentials.service.js';
@@ -9,59 +8,24 @@ import { SkillLoaderService } from './skill-loader.service.js';
 import { ProvidersController } from './providers.controller.js';
 import { SessionsController } from './sessions.controller.js';
 import { AgentConfigsController } from './agent-configs.controller.js';
-import { InteractionController } from './interaction.controller.js';
 import { RoutingController } from './routing/routing.controller.js';
-import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import { TessDurableSessionService } from './tess-durable-session.service.js';
 import { CoordModule } from '../coord/coord.module.js';
 import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { SkillsModule } from '../skills/skills.module.js';
 import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
 
 @Global()
 @Module({
-  imports: [CoordModule, McpClientModule, SkillsModule, GCModule, LogModule, CommandsModule],
+  imports: [CoordModule, McpClientModule, SkillsModule, GCModule],
   providers: [
     ProviderService,
     ProviderCredentialsService,
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    TessDurableSessionRepository,
-    TessDurableSessionService,
-    {
-      provide: AGENT_RUNTIME_PROVIDER_REGISTRY,
-      useFactory: (): AgentRuntimeProviderRegistry => new AgentRuntimeProviderRegistry(),
-    },
-    RuntimeProviderAuditService,
-    {
-      provide: RUNTIME_PROVIDER_AUDIT_SINK,
-      useExisting: RuntimeProviderAuditService,
-    },
-    {
-      provide: RUNTIME_APPROVAL_VERIFIER,
-      useExisting: CommandRuntimeApprovalVerifier,
-    },
-    RuntimeProviderService,
     AgentService,
   ],
-  controllers: [
-    ProvidersController,
-    SessionsController,
-    AgentConfigsController,
-    InteractionController,
-    RoutingController,
-  ],
+  controllers: [ProvidersController, SessionsController, AgentConfigsController, RoutingController],
   exports: [
     AgentService,
     ProviderService,
@@ -69,9 +33,6 @@ import {
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    TessDurableSessionService,
-    RuntimeProviderService,
-    AGENT_RUNTIME_PROVIDER_REGISTRY,
   ],
 })
 export class AgentModule {}

apps/gateway/src/agent/agent.service.ts

@@ -1,11 +1,4 @@
-import {
-  ForbiddenException,
-  Inject,
-  Injectable,
-  Logger,
-  Optional,
-  type OnModuleDestroy,
-} from '@nestjs/common';
+import { Inject, Injectable, Logger, Optional, type OnModuleDestroy } from '@nestjs/common';
 import {
   createAgentSession,
   DefaultResourceLoader,
@@ -35,7 +28,6 @@ import type { SessionInfoDto, SessionMetrics } from './session.dto.js';
 import { SystemOverrideService } from '../preferences/system-override.service.js';
 import { PreferencesService } from '../preferences/preferences.service.js';
 import { SessionGCService } from '../gc/session-gc.service.js';
-import type { ActorTenantScope } from '../auth/session-scope.js';
 
 /** A single message from DB conversation history, used for context injection. */
 export interface ConversationHistoryMessage {
@@ -76,8 +68,6 @@ export interface AgentSessionOptions {
   agentConfigId?: string;
   /** ID of the user who owns this session. Used for preferences and system override lookups. */
   userId?: string;
-  /** Server-derived tenant scope that owns this session. Falls back to userId for solo users. */
-  tenantId?: string;
   /**
    * Prior conversation messages to inject as context when resuming a session.
    * These messages are formatted and prepended to the system prompt so the
@@ -104,8 +94,6 @@ export interface AgentSession {
   allowedTools: string[] | null;
   /** User ID that owns this session, used for preference lookups. */
   userId?: string;
-  /** Server-derived tenant scope that owns this session. Falls back to userId for solo users. */
-  tenantId?: string;
   /** Agent config ID applied to this session, if any (M5-001). */
   agentConfigId?: string;
   /** Human-readable agent name applied to this session, if any (M5-001). */
@@ -186,20 +174,12 @@ export class AgentService implements OnModuleDestroy {
       .filter((t) => t.length > 0);
   }
 
-  async createSession(sessionId: string, options: AgentSessionOptions): Promise<AgentSession> {
-    const scope = this.scopeFromOptions(options);
+  async createSession(sessionId: string, options?: AgentSessionOptions): Promise<AgentSession> {
     const existing = this.sessions.get(sessionId);
-    if (existing) {
-      this.assertSessionScope(existing, scope);
-      return existing;
-    }
+    if (existing) return existing;
 
     const inflight = this.creating.get(sessionId);
-    if (inflight) {
-      const session = await inflight;
-      this.assertSessionScope(session, scope);
-      return session;
-    }
+    if (inflight) return inflight;
 
     const promise = this.doCreateSession(sessionId, options).finally(() => {
       this.creating.delete(sessionId);
@@ -362,7 +342,6 @@ export class AgentService implements OnModuleDestroy {
       sandboxDir,
       allowedTools,
       userId: mergedOptions?.userId,
-      tenantId: this.tenantIdFor(mergedOptions?.userId, mergedOptions?.tenantId),
       agentConfigId: mergedOptions?.agentConfigId,
       agentName: resolvedAgentName,
       metrics: {
@@ -494,70 +473,38 @@ export class AgentService implements OnModuleDestroy {
     return this.providerService.getDefaultModel() ?? null;
   }
 
-  getSession(sessionId: string, scope: ActorTenantScope): AgentSession | undefined {
-    const session = this.sessions.get(sessionId);
-    if (!session || !this.sessionMatchesScope(session, scope)) return undefined;
-    return session;
+  getSession(sessionId: string): AgentSession | undefined {
+    return this.sessions.get(sessionId);
   }
 
-  listSessions(scope: ActorTenantScope): SessionInfoDto[] {
+  listSessions(): SessionInfoDto[] {
     const now = Date.now();
-    return Array.from(this.sessions.values())
-      .filter((s) => this.sessionMatchesScope(s, scope))
-      .map((s) => this.toSessionInfo(s, now));
+    return Array.from(this.sessions.values()).map((s) => ({
+      id: s.id,
+      provider: s.provider,
+      modelId: s.modelId,
+      ...(s.agentName ? { agentName: s.agentName } : {}),
+      createdAt: new Date(s.createdAt).toISOString(),
+      promptCount: s.promptCount,
+      channels: Array.from(s.channels),
+      durationMs: now - s.createdAt,
+      metrics: { ...s.metrics },
+    }));
   }
 
-  listAllSessionsForSystem(): SessionInfoDto[] {
-    const now = Date.now();
-    return Array.from(this.sessions.values()).map((s) => this.toSessionInfo(s, now));
-  }
-
-  getSessionInfo(sessionId: string, scope: ActorTenantScope): SessionInfoDto | undefined {
+  getSessionInfo(sessionId: string): SessionInfoDto | undefined {
     const s = this.sessions.get(sessionId);
-    if (!s || !this.sessionMatchesScope(s, scope)) return undefined;
-    return this.toSessionInfo(s);
-  }
-
-  private scopeFromOptions(options: AgentSessionOptions): ActorTenantScope {
-    if (!options.userId) {
-      throw new ForbiddenException('Session owner scope is required');
-    }
+    if (!s) return undefined;
     return {
-      userId: options.userId,
-      tenantId: this.tenantIdFor(options.userId, options.tenantId) ?? options.userId,
-    };
-  }
-
-  private tenantIdFor(
-    userId: string | undefined,
-    tenantId: string | undefined,
-  ): string | undefined {
-    return tenantId ?? userId;
-  }
-
-  private sessionMatchesScope(session: AgentSession, scope: ActorTenantScope): boolean {
-    return (
-      session.userId === scope.userId && (session.tenantId ?? session.userId) === scope.tenantId
-    );
-  }
-
-  private assertSessionScope(session: AgentSession, scope: ActorTenantScope): void {
-    if (!this.sessionMatchesScope(session, scope)) {
-      throw new ForbiddenException('Session does not belong to the current owner/tenant scope');
-    }
-  }
-
-  private toSessionInfo(session: AgentSession, now = Date.now()): SessionInfoDto {
-    return {
-      id: session.id,
-      provider: session.provider,
-      modelId: session.modelId,
-      ...(session.agentName ? { agentName: session.agentName } : {}),
-      createdAt: new Date(session.createdAt).toISOString(),
-      promptCount: session.promptCount,
-      channels: Array.from(session.channels),
-      durationMs: now - session.createdAt,
-      metrics: { ...session.metrics },
+      id: s.id,
+      provider: s.provider,
+      modelId: s.modelId,
+      ...(s.agentName ? { agentName: s.agentName } : {}),
+      createdAt: new Date(s.createdAt).toISOString(),
+      promptCount: s.promptCount,
+      channels: Array.from(s.channels),
+      durationMs: Date.now() - s.createdAt,
+      metrics: { ...s.metrics },
     };
   }
 
@@ -606,10 +553,9 @@ export class AgentService implements OnModuleDestroy {
    * not reconstructed — the model is used on the next createSession call for
    * the same conversationId when the session is torn down or a new one is created.
    */
-  updateSessionModel(sessionId: string, modelId: string, scope: ActorTenantScope): void {
+  updateSessionModel(sessionId: string, modelId: string): void {
     const session = this.sessions.get(sessionId);
     if (!session) return;
-    this.assertSessionScope(session, scope);
     const prev = session.modelId;
     session.modelId = modelId;
     this.recordModelSwitch(sessionId);
@@ -626,51 +572,48 @@ export class AgentService implements OnModuleDestroy {
     sessionId: string,
     agentConfigId: string,
     agentName: string,
-    scope: ActorTenantScope,
     modelId?: string,
   ): void {
     const session = this.sessions.get(sessionId);
     if (!session) return;
-    this.assertSessionScope(session, scope);
     session.agentConfigId = agentConfigId;
     session.agentName = agentName;
     if (modelId) {
-      this.updateSessionModel(sessionId, modelId, scope);
+      this.updateSessionModel(sessionId, modelId);
     }
     this.logger.log(
       `Session ${sessionId}: agent switched to "${agentName}" (${agentConfigId}) (M5-003)`,
     );
   }
 
-  addChannel(sessionId: string, channel: string, scope: ActorTenantScope): void {
+  addChannel(sessionId: string, channel: string): void {
     const session = this.sessions.get(sessionId);
-    if (!session) return;
-    this.assertSessionScope(session, scope);
-    session.channels.add(channel);
+    if (session) {
+      session.channels.add(channel);
+    }
   }
 
-  removeChannel(sessionId: string, channel: string, scope: ActorTenantScope): void {
+  removeChannel(sessionId: string, channel: string): void {
     const session = this.sessions.get(sessionId);
-    if (!session) return;
-    this.assertSessionScope(session, scope);
-    session.channels.delete(channel);
+    if (session) {
+      session.channels.delete(channel);
+    }
   }
 
-  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void> {
+  async prompt(sessionId: string, message: string): Promise<void> {
     const session = this.sessions.get(sessionId);
     if (!session) {
       throw new Error(`No agent session found: ${sessionId}`);
     }
-    this.assertSessionScope(session, scope);
     session.promptCount += 1;
 
     // Prepend session-scoped system override if present (renew TTL on each turn)
     let effectiveMessage = message;
     if (this.systemOverride) {
-      const override = await this.systemOverride.get(sessionId, scope);
+      const override = await this.systemOverride.get(sessionId);
       if (override) {
         effectiveMessage = `[System Override]\n${override}\n\n${message}`;
-        await this.systemOverride.renew(sessionId, scope);
+        await this.systemOverride.renew(sessionId);
         this.logger.debug(`Applied system override for session ${sessionId}`);
       }
     }
@@ -686,28 +629,16 @@ export class AgentService implements OnModuleDestroy {
     }
   }
 
-  onEvent(
-    sessionId: string,
-    listener: (event: AgentSessionEvent) => void,
-    scope: ActorTenantScope,
-  ): () => void {
+  onEvent(sessionId: string, listener: (event: AgentSessionEvent) => void): () => void {
     const session = this.sessions.get(sessionId);
     if (!session) {
       throw new Error(`No agent session found: ${sessionId}`);
     }
-    this.assertSessionScope(session, scope);
     session.listeners.add(listener);
     return () => session.listeners.delete(listener);
   }
 
-  async destroySession(sessionId: string, scope: ActorTenantScope): Promise<void> {
-    const session = this.sessions.get(sessionId);
-    if (!session) return;
-    this.assertSessionScope(session, scope);
-    await this.destroySessionForSystem(sessionId);
-  }
-
-  private async destroySessionForSystem(sessionId: string): Promise<void> {
+  async destroySession(sessionId: string): Promise<void> {
     const session = this.sessions.get(sessionId);
     if (!session) return;
     this.logger.log(`Destroying agent session ${sessionId}`);
@@ -736,7 +667,7 @@ export class AgentService implements OnModuleDestroy {
 
   async onModuleDestroy(): Promise<void> {
     this.logger.log('Shutting down all agent sessions');
-    const stops = Array.from(this.sessions.keys()).map((id) => this.destroySessionForSystem(id));
+    const stops = Array.from(this.sessions.keys()).map((id) => this.destroySession(id));
     const results = await Promise.allSettled(stops);
     for (const result of results) {
       if (result.status === 'rejected') {

apps/gateway/src/agent/interaction.controller.test.ts

@@ -1,233 +0,0 @@
-import { firstValueFrom } from 'rxjs';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { RuntimeApprovalDeniedError } from './runtime-provider-registry.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import { InteractionController } from './interaction.controller.js';
-
-describe('InteractionController', (): void => {
-  afterEach(() => vi.restoreAllMocks());
-
-  it('maps a denied runtime approval to Fastify HTTP 403', () => {
-    const send = vi.fn();
-    const status = vi.fn().mockReturnValue({ send });
-    const response = { status };
-    const host = { switchToHttp: () => ({ getResponse: () => response }) };
-
-    new RuntimeApprovalDeniedFilter().catch(new RuntimeApprovalDeniedError(), host as never);
-
-    expect(status).toHaveBeenCalledWith(403);
-    expect(send).toHaveBeenCalledWith({
-      statusCode: 403,
-      message: 'Runtime termination approval denied',
-    });
-  });
-
-  it('honors a differently named configured instance without a code change', async () => {
-    const prior = process.env['MOSAIC_AGENT_NAME'];
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { listSessions: vi.fn().mockResolvedValue([]) };
-    const controller = new InteractionController(runtime as never, {} as never);
-
-    await expect(
-      controller.sessions('Nova', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).resolves.toEqual([]);
-    await expect(
-      controller.sessions('Other', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).rejects.toThrow('Interaction agent is not configured');
-
-    if (prior === undefined) delete process.env['MOSAIC_AGENT_NAME'];
-    else process.env['MOSAIC_AGENT_NAME'] = prior;
-  });
-
-  it('rejects a request without the non-simple correlation header', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ listSessions: vi.fn() } as never, {} as never);
-
-    await expect(controller.sessions('Nova', 'fleet', { id: 'owner' })).rejects.toThrow(
-      'X-Correlation-Id is required',
-    );
-  });
-
-  it('enrolls a visible runtime session under the cross-surface conversation handle', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const durable = { enroll: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.enroll(
-        'Nova',
-        'conversation-1',
-        { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual({ status: 'enrolled', sessionId: 'conversation-1' });
-    expect(durable.enroll).toHaveBeenCalledWith(
-      {
-        agentName: 'Nova',
-        sessionId: 'conversation-1',
-        tenantId: 'team',
-        ownerId: 'owner',
-        providerId: 'fleet',
-        runtimeSessionId: 'runtime-1',
-      },
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('rejects an invalid attach mode before invoking a provider', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ attach: vi.fn() } as never, {} as never);
-
-    await expect(
-      controller.attach('Nova', 'durable-1', { mode: 'write' as never }, { id: 'owner' }, 'corr-1'),
-    ).rejects.toThrow('Interaction attach mode is invalid');
-  });
-
-  it('resumes a durable session by attaching and streaming its runtime events', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtimeEvent = {
-      type: 'message.delta' as const,
-      sessionId: 'runtime-1',
-      cursor: 'cursor-1',
-      occurredAt: '2026-07-13T00:00:00.000Z',
-      content: 'resumed',
-    };
-    const runtime = {
-      attach: vi.fn().mockResolvedValue({ attachmentId: 'attach-1', sessionId: 'runtime-1' }),
-      streamSession: vi.fn(async function* () {
-        yield runtimeEvent;
-      }),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.attach('Nova', 'conversation-1', { mode: 'read' }, { id: 'owner' }, 'corr-1');
-    await expect(
-      firstValueFrom(
-        controller.stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1'),
-      ),
-    ).resolves.toEqual({ data: runtimeEvent });
-
-    expect(runtime.attach).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'read',
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-    expect(runtime.streamSession).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      undefined,
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('does not create a runtime stream after the SSE subscriber disconnects during snapshot lookup', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    let resolveSnapshot!: (value: { identity: Record<string, string> }) => void;
-    const snapshot = new Promise<{ identity: Record<string, string> }>((resolve) => {
-      resolveSnapshot = resolve;
-    });
-    const runtime = { streamSession: vi.fn() };
-    const durable = { getSnapshot: vi.fn().mockReturnValue(snapshot) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    const subscription = controller
-      .stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1')
-      .subscribe();
-    subscription.unsubscribe();
-    resolveSnapshot({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    });
-    await new Promise((resolve) => setTimeout(resolve, 0));
-
-    expect(runtime.streamSession).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ['wrong actor', { getSnapshot: vi.fn().mockRejectedValue(new Error('scope mismatch')) }],
-    [
-      'session-agent mismatch',
-      {
-        getSnapshot: vi.fn().mockResolvedValue({
-          identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        }),
-      },
-    ],
-  ])('denies a CLI stop for %s', async (_reason, durable) => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toBeDefined();
-    expect(runtime.terminate).not.toHaveBeenCalled();
-  });
-
-  it('surfaces a denied runtime approval to the CLI interaction surface', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      terminate: vi.fn().mockRejectedValue(new Error('Runtime termination approval denied')),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toThrow('Runtime termination approval denied');
-  });
-
-  it('uses the durable session identity and runtime registry for an approved stop', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.stop(
-      'Nova',
-      'durable-1',
-      { approvalRef: 'approval-1' },
-      { id: 'owner' },
-      'corr-1',
-    );
-
-    expect(runtime.terminate).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'approval-1',
-      expect.objectContaining({
-        correlationId: 'corr-1',
-        actorScope: { userId: 'owner', tenantId: 'owner' },
-      }),
-    );
-  });
-});

apps/gateway/src/agent/interaction.controller.ts

@@ -1,279 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Sse,
-  Inject,
-  Param,
-  Post,
-  Query,
-  UseGuards,
-  UseFilters,
-} from '@nestjs/common';
-import type { RuntimeAttachMode, RuntimeStreamEvent } from '@mosaicstack/types';
-import { Observable } from 'rxjs';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { TessDurableSessionService } from './tess-durable-session.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Authenticated HTTP boundary for operator interaction clients. Identity is
- * selected from deployment configuration, never a client-side command name.
- */
-@Controller('api/interaction/:agentName')
-@UseGuards(AuthGuard)
-@UseFilters(RuntimeApprovalDeniedFilter)
-export class InteractionController {
-  constructor(
-    @Inject(RuntimeProviderService) private readonly runtime: RuntimeProviderService,
-    @Inject(TessDurableSessionService) private readonly durable: TessDurableSessionService,
-  ) {}
-
-  @Get('sessions')
-  async sessions(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.listSessions(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  @Get('tree')
-  async tree(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.getSessionTree(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  /**
-   * Bind an existing, authorized runtime session to the stable conversation ID.
-   * This is the lifecycle boundary where both runtime identifiers are known.
-   */
-  @Post('sessions/:sessionId/enroll')
-  async enroll(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { providerId?: string; runtimeSessionId?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const providerId = this.requiredProvider(body.providerId ?? '');
-    const runtimeSessionId = body.runtimeSessionId?.trim();
-    if (!runtimeSessionId) throw new ForbiddenException('Runtime session identity is required');
-    const context = this.context(user, correlationId);
-    const sessions = await this.runtime.listSessions(providerId, context);
-    if (!sessions.some((session): boolean => session.id === runtimeSessionId)) {
-      throw new ForbiddenException('Runtime session is not visible to this actor');
-    }
-    await this.durable.enroll(
-      {
-        agentName,
-        sessionId,
-        tenantId: context.actorScope.tenantId,
-        ownerId: context.actorScope.userId,
-        providerId,
-        runtimeSessionId,
-      },
-      context,
-    );
-    return { status: 'enrolled', sessionId };
-  }
-
-  @Post('sessions/:sessionId/attach')
-  async attach(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { mode?: RuntimeAttachMode } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const mode = body.mode ?? 'read';
-    if (mode !== 'read' && mode !== 'control') {
-      throw new ForbiddenException('Interaction attach mode is invalid');
-    }
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    return this.runtime.attach(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      mode,
-      context,
-    );
-  }
-
-  @Sse('sessions/:sessionId/stream')
-  stream(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Query('cursor') cursor: string | undefined,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Observable<{ data: RuntimeStreamEvent }> {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    return new Observable((subscriber) => {
-      let iterator: AsyncIterator<RuntimeStreamEvent> | undefined;
-      let cancelled = false;
-      void (async (): Promise<void> => {
-        try {
-          const snapshot = await this.durable.getSnapshot(sessionId, context);
-          if (cancelled || subscriber.closed) return;
-          this.assertSessionAgent(snapshot.identity.agentName, agentName);
-          iterator = this.runtime
-            .streamSession(
-              snapshot.identity.providerId,
-              snapshot.identity.runtimeSessionId,
-              cursor?.trim() || undefined,
-              context,
-            )
-            [Symbol.asyncIterator]();
-          if (cancelled || subscriber.closed) {
-            await iterator.return?.();
-            return;
-          }
-          while (!cancelled && !subscriber.closed) {
-            const next = await iterator.next();
-            if (next.done || cancelled || subscriber.closed) break;
-            subscriber.next({ data: next.value });
-          }
-          if (!subscriber.closed) subscriber.complete();
-        } catch (error: unknown) {
-          if (!subscriber.closed) subscriber.error(error);
-        }
-      })();
-      return (): void => {
-        cancelled = true;
-        void iterator?.return?.();
-      };
-    });
-  }
-
-  @Post('sessions/:sessionId/send')
-  async send(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { content?: string; idempotencyKey?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.content?.trim() || !body.idempotencyKey?.trim()) {
-      throw new ForbiddenException('Content and idempotency key are required');
-    }
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    const input = {
-      sessionId,
-      content: body.content,
-      idempotencyKey: body.idempotencyKey,
-      correlationId: context.correlationId,
-      context,
-    };
-    await this.durable.queueProviderSend(input);
-    await this.durable.dispatchProviderOutbox(sessionId, input);
-    return { status: 'queued', sessionId };
-  }
-
-  @Post('sessions/:sessionId/stop')
-  async stop(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { approvalRef?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.approvalRef?.trim())
-      throw new ForbiddenException('Exact-action approval is required');
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.runtime.terminate(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      body.approvalRef,
-      context,
-    );
-    return { status: 'stopped', sessionId };
-  }
-
-  @Post('sessions/:sessionId/recover')
-  async recover(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.durable.recoverProviderSession(sessionId, {
-      sessionId,
-      content: '',
-      idempotencyKey: `recovery:${context.correlationId}`,
-      correlationId: context.correlationId,
-      context,
-    });
-    return { status: 'recovered', sessionId };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    // This non-simple request header is mandatory for mutations. Browser
-    // cross-origin requests cannot set it without a CORS preflight, and the
-    // gateway's allowlist rejects untrusted origins before the handler runs.
-    if (!requestCorrelationId) {
-      throw new ForbiddenException('X-Correlation-Id is required');
-    }
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-
-  private assertConfiguredAgent(agentName: string): void {
-    const configured = process.env['MOSAIC_AGENT_NAME']?.trim();
-    if (!configured || configured !== agentName) {
-      throw new ForbiddenException('Interaction agent is not configured for this request');
-    }
-  }
-
-  private assertSessionAgent(sessionAgentName: string, agentName: string): void {
-    if (sessionAgentName !== agentName)
-      throw new ForbiddenException('Interaction session identity mismatch');
-  }
-
-  private requiredProvider(providerId: string): string {
-    if (!providerId?.trim()) throw new ForbiddenException('Runtime provider is required');
-    return providerId;
-  }
-}

apps/gateway/src/agent/provider.service.ts

@@ -107,7 +107,8 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
    * Interval is configurable via PROVIDER_HEALTH_INTERVAL env (seconds, default 60).
    */
   private startHealthCheckScheduler(): void {
-    const intervalSecs = this.effectiveHealthCheckIntervalSecs();
+    const intervalSecs =
+      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS;
     const intervalMs = intervalSecs * 1000;
 
     // Run an initial check immediately (non-blocking)
@@ -175,28 +176,6 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
     });
   }
 
-  /**
-   * Returns the effective provider operational policy without credentials,
-   * endpoints, request content, or provider error details.
-   */
-  getEffectivePolicyStatus(): {
-    healthCheckIntervalSecs: number;
-    configuredProviders: string[];
-    availableModelCount: number;
-  } {
-    return {
-      healthCheckIntervalSecs: this.effectiveHealthCheckIntervalSecs(),
-      configuredProviders: this.adapters.map((adapter) => adapter.name),
-      availableModelCount: this.registry?.getAvailable().length ?? 0,
-    };
-  }
-
-  private effectiveHealthCheckIntervalSecs(): number {
-    return (
-      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS
-    );
-  }
-
   // ---------------------------------------------------------------------------
   // Adapter-pattern API
   // ---------------------------------------------------------------------------

apps/gateway/src/agent/providers.controller.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ProvidersController } from './providers.controller.js';
-
-describe('ProvidersController operational status', (): void => {
-  it('reports provider latency and effective policy without exposing provider error details', (): void => {
-    const providerService = {
-      getProvidersHealth: vi.fn(() => [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          error: 'credential-canary=secret-value',
-        },
-      ]),
-      getEffectivePolicyStatus: vi.fn(() => ({
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      })),
-    };
-    const controller = new ProvidersController(providerService as never, {} as never, {} as never);
-
-    const status = controller.status();
-
-    expect(status).toEqual({
-      providers: [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          errorCode: 'provider_unavailable',
-        },
-      ],
-      effectivePolicy: {
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      },
-    });
-    expect(JSON.stringify(status)).not.toContain('secret-value');
-  });
-});

apps/gateway/src/agent/providers.controller.ts

@@ -33,20 +33,7 @@ export class ProvidersController {
 
   @Get('health')
   health() {
-    return { providers: this.safeProviderHealth() };
-  }
-
-  /**
-   * Safe operational status for troubleshooting and readiness checks. Provider
-   * errors are reduced to a stable code so credentials and remote responses
-   * cannot leak through this endpoint.
-   */
-  @Get('status')
-  status() {
-    return {
-      providers: this.safeProviderHealth(),
-      effectivePolicy: this.providerService.getEffectivePolicyStatus(),
-    };
+    return { providers: this.providerService.getProvidersHealth() };
   }
 
   @Post('test')
@@ -64,13 +51,6 @@ export class ProvidersController {
     return this.routingService.rank(criteria);
   }
 
-  private safeProviderHealth() {
-    return this.providerService.getProvidersHealth().map(({ error, ...provider }) => ({
-      ...provider,
-      ...(error ? { errorCode: 'provider_unavailable' } : {}),
-    }));
-  }
-
   // ── Credential CRUD ──────────────────────────────────────────────────────
 
   /**

apps/gateway/src/agent/runtime-approval-denied.filter.ts

@@ -1,13 +0,0 @@
-import { Catch, type ArgumentsHost, type ExceptionFilter } from '@nestjs/common';
-import { RuntimeApprovalDeniedError } from './runtime-provider-registry.service.js';
-
-/** Maps a consumed/missing runtime approval to a stable HTTP authorization response. */
-@Catch(RuntimeApprovalDeniedError)
-export class RuntimeApprovalDeniedFilter implements ExceptionFilter {
-  catch(_exception: RuntimeApprovalDeniedError, host: ArgumentsHost): void {
-    const response = host.switchToHttp().getResponse<{
-      status(code: number): { send(body: { statusCode: number; message: string }): void };
-    }>();
-    response.status(403).send({ statusCode: 403, message: 'Runtime termination approval denied' });
-  }
-}

apps/gateway/src/agent/runtime-provider-registry.service.ts

@@ -1,469 +0,0 @@
-import { ForbiddenException, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import {
-  createRuntimeAuditLogEntry,
-  type LogService,
-  type RuntimeAuditErrorCode,
-} from '@mosaicstack/log';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { LOG_SERVICE } from '../log/log.tokens.js';
-
-export const AGENT_RUNTIME_PROVIDER_REGISTRY = Symbol('AGENT_RUNTIME_PROVIDER_REGISTRY');
-export const RUNTIME_PROVIDER_AUDIT_SINK = Symbol('RUNTIME_PROVIDER_AUDIT_SINK');
-export const RUNTIME_APPROVAL_VERIFIER = Symbol('RUNTIME_APPROVAL_VERIFIER');
-
-export type RuntimeProviderOperation =
-  | RuntimeCapability
-  | 'runtime.capabilities'
-  | 'runtime.health';
-export type RuntimeProviderAuditOutcome = 'requested' | 'succeeded' | 'denied' | 'failed';
-
-/** Trusted server-side context only; it intentionally excludes client-provided identity fields. */
-export interface RuntimeProviderRequestContext {
-  actorScope: ActorTenantScope;
-  channelId: string;
-  correlationId: string;
-}
-
-/** Metadata-only audit record. Message bodies, idempotency keys, and approval refs are excluded. */
-export interface RuntimeAuditEvent {
-  providerId: string;
-  operation: RuntimeProviderOperation;
-  outcome: RuntimeProviderAuditOutcome;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  resourceId?: string;
-  durationMs?: number;
-  errorCode?: RuntimeAuditErrorCode;
-}
-
-export interface RuntimeAuditSink {
-  record(event: RuntimeAuditEvent): Promise<void>;
-}
-
-/** Exact action shape that a durable approval implementation must consume once. */
-export interface RuntimeTerminationAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  agentName: string;
-}
-
-export interface RuntimeApprovalVerifier {
-  consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean>;
-}
-
-function configuredAgentName(): string {
-  const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
-  if (!agentName) throw new RuntimeApprovalDeniedError();
-  return agentName;
-}
-
-export class RuntimeApprovalDeniedError extends Error {
-  constructor() {
-    super('Runtime termination approval denied');
-  }
-}
-
-/**
- * The default denies all runtime termination until a durable, exact-action
- * approval implementation is configured. This is safer than a permissive stub.
- */
-@Injectable()
-export class DenyRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(_approvalRef: string, _action: RuntimeTerminationAction): Promise<boolean> {
-    return false;
-  }
-}
-
-/**
- * Temporary metadata-only audit sink. M1 observability can replace this token
- * with a durable audit writer without changing provider call sites.
- */
-@Injectable()
-export class RuntimeProviderAuditService implements RuntimeAuditSink {
-  private readonly logger = new Logger(RuntimeProviderAuditService.name);
-
-  constructor(@Inject(LOG_SERVICE) private readonly logService: LogService) {}
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    const entry = createRuntimeAuditLogEntry(event);
-    await this.logService.logs.ingest(entry);
-    this.logger.log(JSON.stringify({ event: entry.content, metadata: entry.metadata }));
-  }
-}
-
-@Injectable()
-export class RuntimeProviderService {
-  private readonly logger = new Logger(RuntimeProviderService.name);
-
-  constructor(
-    @Inject(AGENT_RUNTIME_PROVIDER_REGISTRY)
-    private readonly registry: AgentRuntimeProviderRegistry,
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly audit: RuntimeAuditSink,
-    @Inject(RUNTIME_APPROVAL_VERIFIER)
-    private readonly approvals: RuntimeApprovalVerifier,
-  ) {}
-
-  async capabilities(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeCapabilitySet> {
-    return this.execute(
-      providerId,
-      'runtime.capabilities',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeCapabilitySet> =>
-        provider.capabilities(scope),
-    );
-  }
-
-  async health(providerId: string, context: RuntimeProviderRequestContext): Promise<RuntimeHealth> {
-    return this.execute(
-      providerId,
-      'runtime.health',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeHealth> =>
-        provider.health(scope),
-    );
-  }
-
-  async listSessions(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSession[]> {
-    return this.execute(
-      providerId,
-      'session.list',
-      'session.list',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSession[]> =>
-        provider.listSessions(scope),
-    );
-  }
-
-  async getSessionTree(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSessionTree[]> {
-    return this.execute(
-      providerId,
-      'session.tree',
-      'session.tree',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSessionTree[]> =>
-        provider.getSessionTree(scope),
-    );
-  }
-
-  streamSession(
-    providerId: string,
-    sessionId: string,
-    cursor: string | undefined,
-    context: RuntimeProviderRequestContext,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    return this.stream(
-      providerId,
-      'session.stream',
-      'session.stream',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): AsyncIterable<RuntimeStreamEvent> =>
-        provider.streamSession(sessionId, cursor, scope),
-    );
-  }
-
-  async sendMessage(
-    providerId: string,
-    sessionId: string,
-    message: RuntimeMessage,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.send',
-      'session.send',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.sendMessage(sessionId, message, scope),
-    );
-  }
-
-  async attach(
-    providerId: string,
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeAttachHandle> {
-    return this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeAttachHandle> =>
-        provider.attach(sessionId, mode, scope),
-    );
-  }
-
-  async detach(
-    providerId: string,
-    attachmentId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      attachmentId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.detach(attachmentId, scope),
-    );
-  }
-
-  async terminate(
-    providerId: string,
-    sessionId: string,
-    approvalRef: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.terminate',
-      'session.terminate',
-      sessionId,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> => {
-        const approved = await this.approvals.consume(approvalRef, {
-          providerId,
-          sessionId,
-          actorId: scope.actorId,
-          tenantId: scope.tenantId,
-          channelId: scope.channelId,
-          correlationId: scope.correlationId,
-          agentName: configuredAgentName(),
-        });
-        if (!approved) {
-          throw new RuntimeApprovalDeniedError();
-        }
-        await provider.terminate(sessionId, approvalRef, scope);
-      },
-    );
-  }
-
-  private async execute<T>(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability | undefined,
-    resourceId: string | undefined,
-    context: RuntimeProviderRequestContext,
-    invoke: (provider: AgentRuntimeProvider, scope: RuntimeScope) => Promise<T>,
-  ): Promise<T> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      if (requiredCapability) {
-        await this.assertCapability(provider, requiredCapability, scope);
-      }
-      invocationStarted = true;
-      const result = await invoke(provider, scope);
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-      return result;
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted && !this.isAuthorizationDenied(error)) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private async *stream(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability,
-    resourceId: string,
-    context: RuntimeProviderRequestContext,
-    invoke: (
-      provider: AgentRuntimeProvider,
-      scope: RuntimeScope,
-    ) => AsyncIterable<RuntimeStreamEvent>,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      await this.assertCapability(provider, requiredCapability, scope);
-      invocationStarted = true;
-      for await (const event of invoke(provider, scope)) {
-        yield event;
-      }
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private isAuthorizationDenied(error: unknown): boolean {
-    return (
-      error instanceof RuntimeApprovalDeniedError ||
-      error instanceof ForbiddenException ||
-      (typeof error === 'object' &&
-        error !== null &&
-        'code' in error &&
-        (error as { code?: unknown }).code === 'forbidden')
-    );
-  }
-
-  private provider(providerId: string): AgentRuntimeProvider {
-    try {
-      return this.registry.require(providerId);
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : 'Runtime provider is not registered';
-      throw new NotFoundException(message);
-    }
-  }
-
-  private async assertCapability(
-    provider: AgentRuntimeProvider,
-    requiredCapability: RuntimeCapability,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    const capabilities = await provider.capabilities(scope);
-    if (!capabilities.supported.includes(requiredCapability)) {
-      throw new ForbiddenException(`Runtime provider capability denied: ${requiredCapability}`);
-    }
-  }
-
-  private deriveScope(context: RuntimeProviderRequestContext): RuntimeScope {
-    const actorId = context.actorScope.userId.trim();
-    const tenantId = context.actorScope.tenantId.trim();
-    const channelId = context.channelId.trim();
-    const correlationId = context.correlationId.trim();
-    if (!actorId || !tenantId || !channelId || !correlationId) {
-      throw new ForbiddenException(
-        'Authenticated runtime actor scope and correlation are required',
-      );
-    }
-    return Object.freeze({ actorId, tenantId, channelId, correlationId });
-  }
-
-  private async recordFailure(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(
-        providerId,
-        operation,
-        'failed',
-        scope,
-        resourceId,
-        durationMs,
-        'provider_error',
-      );
-    } catch {
-      this.logger.error(
-        `Runtime provider failure audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async recordCompletion(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(providerId, operation, 'succeeded', scope, resourceId, durationMs);
-    } catch {
-      this.logger.error(
-        `Runtime provider completion audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async record(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    outcome: RuntimeProviderAuditOutcome,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs?: number,
-    errorCode?: RuntimeAuditErrorCode,
-  ): Promise<void> {
-    await this.audit.record({
-      providerId,
-      operation,
-      outcome,
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      channelId: scope.channelId,
-      correlationId: scope.correlationId,
-      ...(resourceId ? { resourceId } : {}),
-      ...(durationMs !== undefined ? { durationMs } : {}),
-      ...(errorCode ? { errorCode } : {}),
-    });
-  }
-}

apps/gateway/src/agent/sessions.controller.ts

@@ -10,8 +10,6 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
 import { AgentService } from './agent.service.js';
 
 @Controller('api/sessions')
@@ -20,24 +18,23 @@ export class SessionsController {
   constructor(@Inject(AgentService) private readonly agentService: AgentService) {}
 
   @Get()
-  list(@CurrentUser() user: AuthenticatedUserLike) {
-    const sessions = this.agentService.listSessions(scopeFromUser(user));
+  list() {
+    const sessions = this.agentService.listSessions();
     return { sessions, total: sessions.length };
   }
 
   @Get(':id')
-  findOne(@Param('id') id: string, @CurrentUser() user: AuthenticatedUserLike) {
-    const info = this.agentService.getSessionInfo(id, scopeFromUser(user));
+  findOne(@Param('id') id: string) {
+    const info = this.agentService.getSessionInfo(id);
     if (!info) throw new NotFoundException('Session not found');
     return info;
   }
 
   @Delete(':id')
   @HttpCode(HttpStatus.NO_CONTENT)
-  async destroy(@Param('id') id: string, @CurrentUser() user: AuthenticatedUserLike) {
-    const scope = scopeFromUser(user);
-    const info = this.agentService.getSessionInfo(id, scope);
+  async destroy(@Param('id') id: string) {
+    const info = this.agentService.getSessionInfo(id);
     if (!info) throw new NotFoundException('Session not found');
-    await this.agentService.destroySession(id, scope);
+    await this.agentService.destroySession(id);
   }
 }

apps/gateway/src/agent/tess-durable-session.dto.ts

@@ -1,10 +0,0 @@
-import type { RuntimeProviderRequestContext } from './runtime-provider-registry.service.js';
-
-/** Server-side request for a replay-safe provider message. */
-export interface TessProviderOutboxDto {
-  sessionId: string;
-  idempotencyKey: string;
-  correlationId: string;
-  content: string;
-  context: RuntimeProviderRequestContext;
-}

apps/gateway/src/agent/tess-durable-session.repository.test.ts

@@ -1,418 +0,0 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { eq, sql, interactionCheckpoints, interactionInbox } from '@mosaicstack/db';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createPgliteDb, runPgliteMigrations, type DbHandle } from '@mosaicstack/db';
-import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import { TessDurableSessionService } from './tess-durable-session.service.js';
-
-const IDENTITY: DurableSessionIdentity = {
-  agentName: 'Nova',
-  sessionId: 'tess-pglite-session',
-  tenantId: 'tenant-pglite',
-  ownerId: 'tess-owner',
-  providerId: 'fleet',
-  runtimeSessionId: 'nova',
-};
-
-describe('TessDurableSessionRepository', () => {
-  let dataDir: string | undefined;
-  let handle: DbHandle;
-  let previousAuthSecret: string | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    previousAuthSecret = process.env['BETTER_AUTH_SECRET'];
-    process.env['BETTER_AUTH_SECRET'] = 'tess-durable-state-test-sealing-key';
-    dataDir = mkdtempSync(join(tmpdir(), 'tess-durable-state-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    await seedOwner(handle);
-  }, 30_000);
-
-  beforeEach(async (): Promise<void> => {
-    await handle.db.execute(sql`DELETE FROM interaction_handoffs`);
-    await handle.db.execute(sql`DELETE FROM interaction_checkpoints`);
-    await handle.db.execute(sql`DELETE FROM interaction_inbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_outbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_sessions`);
-  });
-
-  afterAll(async (): Promise<void> => {
-    await handle.close();
-    if (dataDir) rmSync(dataDir, { recursive: true, force: true });
-    if (previousAuthSecret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-    else process.env['BETTER_AUTH_SECRET'] = previousAuthSecret;
-  });
-
-  it('survives a full PGlite close/reopen mid-session without duplicate inbox or outbox side effects', async () => {
-    const beforeRestart = new DurableSessionCoordinator(
-      new TessDurableSessionRepository(handle.db),
-    );
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      content: 'resume after a kill',
-    });
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'one response only',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-before-kill',
-      cursor: 'cursor-before-kill',
-      summary: 'restart-safe state',
-      compactionEpoch: 1,
-    });
-    await beforeRestart.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-before-kill',
-      destination: 'mos',
-      correlationId: 'correlation-before-kill',
-      checkpointId: 'checkpoint-before-kill',
-      status: 'pending',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-after-handoff',
-      cursor: 'cursor-after-handoff',
-      summary: 'newer state cannot strand the portable handoff',
-      compactionEpoch: 2,
-    });
-
-    await handle.close();
-    handle = createPgliteDb(dataDir!);
-
-    const afterRestart = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    const recovered = await afterRestart.recover(IDENTITY.sessionId);
-    const resumedHandoff = await afterRestart.resumeHandoff('handoff-before-kill');
-    const handled: string[] = [];
-    const effects: string[] = [];
-
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-
-    expect(recovered.identity).toEqual(IDENTITY);
-    expect(recovered.checkpoint).toMatchObject({ checkpointId: 'checkpoint-after-handoff' });
-    expect(recovered.handoffs).toMatchObject([{ handoffId: 'handoff-before-kill' }]);
-    expect(resumedHandoff.checkpoint).toMatchObject({ checkpointId: 'checkpoint-before-kill' });
-    expect(handled).toEqual(['inbox-before-kill']);
-    expect(effects).toEqual(['outbox-before-kill']);
-  }, 30_000);
-
-  it('redacts sensitive durable payloads before persistence', async () => {
-    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-inbox',
-      correlationId: 'correlation-redaction',
-      content: 'api_key=super-secret-canary',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-outbox',
-      correlationId: 'correlation-redaction',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'email operator@example.test api_key=super-secret-canary',
-    });
-    await coordinator.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'redacted-checkpoint',
-      cursor: 'bearer super-secret-canary',
-      summary: 'email operator@example.test',
-      compactionEpoch: 0,
-    });
-
-    const snapshot = await coordinator.snapshot(IDENTITY.sessionId);
-    const [persisted] = await handle.db
-      .select({ content: interactionInbox.content })
-      .from(interactionInbox)
-      .where(eq(interactionInbox.idempotencyKey, 'redacted-inbox'));
-
-    expect(JSON.stringify(snapshot)).not.toContain('super-secret-canary');
-    expect(JSON.stringify(snapshot)).not.toContain('operator@example.test');
-    expect(persisted?.content).not.toContain('super-secret-canary');
-    expect(persisted?.content).not.toContain('[REDACTED]');
-  }, 30_000);
-
-  it('fails closed when the configured idempotency secret is unavailable', async () => {
-    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const secret = process.env['BETTER_AUTH_SECRET'];
-    delete process.env['BETTER_AUTH_SECRET'];
-    try {
-      await expect(
-        coordinator.receive({
-          sessionId: IDENTITY.sessionId,
-          idempotencyKey: 'requires-idempotency-secret',
-          correlationId: 'correlation-secret',
-          content: 'sensitive payload',
-        }),
-      ).rejects.toThrow(/required for durable idempotency digests/);
-    } finally {
-      if (secret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-      else process.env['BETTER_AUTH_SECRET'] = secret;
-    }
-  }, 30_000);
-
-  it('uses keyed pre-redaction digests to reject distinct sensitive checkpoint payloads', async () => {
-    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-secret-conflict',
-      cursor: 'api_key=secret-one',
-      summary: 'bearer secret-one',
-      compactionEpoch: 1,
-    };
-    await coordinator.checkpoint(input);
-
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        cursor: 'api_key=secret-two',
-        summary: 'bearer secret-two',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-
-    const [persisted] = await handle.db
-      .select({
-        digest: interactionCheckpoints.contentDigest,
-        cursor: interactionCheckpoints.cursor,
-      })
-      .from(interactionCheckpoints)
-      .where(eq(interactionCheckpoints.checkpointId, input.checkpointId));
-    expect(persisted?.cursor).not.toContain('secret-one');
-    expect(persisted?.digest).not.toBe(
-      createHash('sha256')
-        .update(JSON.stringify([input.cursor, input.summary]))
-        .digest('hex'),
-    );
-
-    await coordinator.checkpoint({
-      ...input,
-      checkpointId: 'checkpoint-delimiter-conflict',
-      cursor: 'a\u0000b',
-      summary: 'c',
-    });
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        checkpointId: 'checkpoint-delimiter-conflict',
-        cursor: 'a',
-        summary: 'b\u0000c',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-  }, 30_000);
-
-  it('rejects distinct sensitive inbox and outbox payloads under reused idempotency keys', async () => {
-    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const inbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-secret-conflict',
-      correlationId: 'correlation-inbox-secret',
-      content: 'api_key=secret-one',
-    };
-    const outbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-secret-conflict',
-      correlationId: 'correlation-outbox-secret',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'api_key=secret-one',
-    };
-    await coordinator.receive(inbox);
-    await coordinator.enqueueOutbox(outbox);
-
-    await expect(coordinator.receive({ ...inbox, content: 'api_key=secret-two' })).rejects.toThrow(
-      /idempotency conflict/,
-    );
-    await expect(
-      coordinator.enqueueOutbox({ ...outbox, content: 'api_key=secret-two' }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('rejects database inbox and outbox idempotency-key conflicts', async () => {
-    const coordinator = new DurableSessionCoordinator(new TessDurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-conflict',
-      correlationId: 'correlation-inbox',
-      content: 'original inbox',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-conflict',
-      correlationId: 'correlation-outbox',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'original outbox',
-    });
-
-    await expect(
-      coordinator.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'inbox-conflict',
-        correlationId: 'forged-correlation',
-        content: 'original inbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-    await expect(
-      coordinator.enqueueOutbox({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'outbox-conflict',
-        correlationId: 'correlation-outbox',
-        channelId: 'forged-channel',
-        kind: 'provider.send',
-        content: 'original outbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('does not requeue a live outbox claim during a normal scoped dispatch', async () => {
-    const repository = new TessDurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new TessDurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'live-effect',
-      correlationId: 'correlation-live',
-      content: 'must not duplicate',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-live',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    expect(await repository.claimOutbox(IDENTITY.sessionId)).toMatchObject({
-      status: 'processing',
-    });
-
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, input);
-    await expect(
-      service.recoverProviderSession(IDENTITY.sessionId, {
-        ...input,
-        context: {
-          ...input.context,
-          actorScope: { userId: 'intruder', tenantId: 'tenant-pglite' },
-        },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'live-effect', status: 'processing' }],
-    });
-  }, 30_000);
-
-  it('rejects an outbox correlation mismatch before claiming the pending effect', async () => {
-    const repository = new TessDurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new TessDurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'mismatch-effect',
-      correlationId: 'correlation-expected',
-      content: 'must remain pending',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-expected',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    await expect(
-      service.dispatchProviderOutbox(IDENTITY.sessionId, {
-        ...input,
-        correlationId: 'correlation-forged',
-        context: { ...input.context, correlationId: 'correlation-forged' },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'mismatch-effect', status: 'pending' }],
-    });
-  }, 30_000);
-
-  it('dispatches only the outbox record bound to the supplied correlation and channel', async () => {
-    const repository = new TessDurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new TessDurableSessionService(repository, runtimeProviders as never);
-    const first = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'scoped-effect-one',
-      correlationId: 'correlation-one',
-      content: 'first result',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-one',
-      },
-    };
-    const second = {
-      ...first,
-      idempotencyKey: 'scoped-effect-two',
-      correlationId: 'correlation-two',
-      content: 'second result',
-      context: { ...first.context, correlationId: 'correlation-two' },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(first);
-    await service.queueProviderSend(second);
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, first);
-
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledTimes(1);
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledWith(
-      IDENTITY.providerId,
-      IDENTITY.runtimeSessionId,
-      { content: 'first result', idempotencyKey: 'scoped-effect-one' },
-      first.context,
-    );
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [
-        { idempotencyKey: 'scoped-effect-one', status: 'delivered' },
-        { idempotencyKey: 'scoped-effect-two', status: 'pending' },
-      ],
-    });
-  }, 30_000);
-});
-
-async function seedOwner(handle: DbHandle): Promise<void> {
-  await handle.db.execute(sql`
-    INSERT INTO users (id, name, email, email_verified, created_at, updated_at)
-    VALUES ('tess-owner', 'Tess Owner', 'tess-owner@example.test', false, now(), now())
-  `);
-}

apps/gateway/src/agent/tess-durable-session.repository.ts

@@ -1,530 +0,0 @@
-import { createHash, createHmac } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  asc,
-  desc,
-  eq,
-  interactionCheckpoints,
-  interactionHandoffs,
-  interactionInbox,
-  interactionOutbox,
-  interactionSessions,
-  type Db,
-} from '@mosaicstack/db';
-import { seal, unseal } from '@mosaicstack/auth';
-import { redactSensitiveContent } from '@mosaicstack/log';
-import type {
-  DurableCheckpoint,
-  DurableCheckpointInput,
-  DurableEnqueueResult,
-  DurableHandoff,
-  DurableHandoffInput,
-  DurableInboxEntry,
-  DurableInboxInput,
-  DurableInboxStatus,
-  DurableOutboxEntry,
-  DurableOutboxInput,
-  DurableOutboxStatus,
-  DurableSessionIdentity,
-  DurableSessionSnapshot,
-  DurableSessionStore,
-} from '@mosaicstack/agent';
-import { DB } from '../database/database.module.js';
-
-@Injectable()
-export class TessDurableSessionRepository implements DurableSessionStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async create(identity: DurableSessionIdentity): Promise<void> {
-    await this.db
-      .insert(interactionSessions)
-      .values({
-        id: identity.sessionId,
-        agentName: identity.agentName,
-        tenantId: identity.tenantId,
-        ownerId: identity.ownerId,
-        providerId: identity.providerId,
-        runtimeSessionId: identity.runtimeSessionId,
-      })
-      .onConflictDoNothing();
-
-    const existing = await this.session(identity.sessionId);
-    if (!existing || !sameEnrollmentScope(existing, identity)) {
-      throw new Error(`Durable Tess session identity conflict: ${identity.sessionId}`);
-    }
-    // A recovered/re-enrolled runtime can receive a new provider session ID;
-    // the conversation handle and owner scope remain immutable.
-    if (
-      existing.providerId !== identity.providerId ||
-      existing.runtimeSessionId !== identity.runtimeSessionId
-    ) {
-      await this.db
-        .update(interactionSessions)
-        .set({ providerId: identity.providerId, runtimeSessionId: identity.runtimeSessionId })
-        .where(eq(interactionSessions.id, identity.sessionId));
-    }
-  }
-
-  async snapshot(sessionId: string): Promise<DurableSessionSnapshot | null> {
-    const identity = await this.session(sessionId);
-    if (!identity) return null;
-
-    const [inbox, outbox, checkpoints, handoffs] = await Promise.all([
-      this.db
-        .select()
-        .from(interactionInbox)
-        .where(eq(interactionInbox.sessionId, sessionId))
-        .orderBy(asc(interactionInbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionOutbox)
-        .where(eq(interactionOutbox.sessionId, sessionId))
-        .orderBy(asc(interactionOutbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionCheckpoints)
-        .where(eq(interactionCheckpoints.sessionId, sessionId))
-        .orderBy(
-          desc(interactionCheckpoints.compactionEpoch),
-          desc(interactionCheckpoints.createdAt),
-        )
-        .limit(1),
-      this.db
-        .select()
-        .from(interactionHandoffs)
-        .where(eq(interactionHandoffs.sessionId, sessionId))
-        .orderBy(asc(interactionHandoffs.createdAt)),
-    ]);
-
-    const checkpoint = checkpoints[0];
-    return {
-      identity,
-      inbox: inbox.map(toInbox),
-      outbox: outbox.map(toOutbox),
-      ...(checkpoint ? { checkpoint: toCheckpoint(checkpoint) } : {}),
-      handoffs: handoffs.map(toHandoff),
-    };
-  }
-
-  async enqueueInbox(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableInboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionInbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionInbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionInbox)
-      .where(
-        and(
-          eq(interactionInbox.sessionId, input.sessionId),
-          eq(interactionInbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0]) throw new Error(`Durable Tess inbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toInbox(existing[0]);
-    if (
-      !sameInbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable Tess inbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimInbox(sessionId: string): Promise<DurableInboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionInbox)
-        .where(
-          and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionInbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionInbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionInbox.id, entry.id), eq(interactionInbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toInbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async completeInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'processed', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async enqueueOutbox(
-    input: DurableOutboxInput,
-  ): Promise<DurableEnqueueResult<DurableOutboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableOutboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionOutbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionOutbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionOutbox)
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, input.sessionId),
-          eq(interactionOutbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0])
-      throw new Error(`Durable Tess outbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toOutbox(existing[0]);
-    if (
-      !sameOutbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable Tess outbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimOutbox(sessionId: string): Promise<DurableOutboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionOutbox)
-        .where(
-          and(eq(interactionOutbox.sessionId, sessionId), eq(interactionOutbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionOutbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionOutbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionOutbox.id, entry.id), eq(interactionOutbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toOutbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async claimOutboxByKey(
-    sessionId: string,
-    idempotencyKey: string,
-  ): Promise<DurableOutboxEntry | null> {
-    const claimed = await this.db
-      .update(interactionOutbox)
-      .set({ status: 'processing', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'pending'),
-        ),
-      )
-      .returning();
-    return claimed[0] ? toOutbox(claimed[0]) : null;
-  }
-
-  async completeOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'delivered', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async checkpoint(input: DurableCheckpointInput): Promise<void> {
-    // Compute identity before redaction.  The persisted digest is keyed so a database
-    // reader cannot use it as an offline oracle for sensitive cursor/summary values.
-    const digest = contentDigest(JSON.stringify([input.cursor, input.summary]));
-    const checkpoint: DurableCheckpointInput = {
-      ...input,
-      cursor: redactSensitiveContent(input.cursor).content,
-      summary: redactSensitiveContent(input.summary).content,
-    };
-    const inserted = await this.db
-      .insert(interactionCheckpoints)
-      .values({
-        ...checkpoint,
-        contentDigest: digest,
-        cursor: seal(checkpoint.cursor),
-        summary: seal(checkpoint.summary),
-      })
-      .onConflictDoNothing()
-      .returning({ checkpointId: interactionCheckpoints.checkpointId });
-    if (inserted[0]) return;
-
-    const existing = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, input.sessionId),
-          eq(interactionCheckpoints.checkpointId, input.checkpointId),
-        ),
-      )
-      .limit(1);
-    if (
-      !existing[0] ||
-      !sameCheckpoint(toCheckpoint(existing[0]), checkpoint) ||
-      !matchesCheckpointDigest(existing[0].contentDigest, digest)
-    ) {
-      throw new Error(`Durable Tess checkpoint identity conflict: ${input.checkpointId}`);
-    }
-  }
-
-  async findCheckpoint(sessionId: string, checkpointId: string): Promise<DurableCheckpoint | null> {
-    const checkpoints = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, sessionId),
-          eq(interactionCheckpoints.checkpointId, checkpointId),
-        ),
-      )
-      .limit(1);
-    const checkpoint = checkpoints[0];
-    return checkpoint ? toCheckpoint(checkpoint) : null;
-  }
-
-  async handoff(input: DurableHandoffInput): Promise<void> {
-    const checkpoint = await this.findCheckpoint(input.sessionId, input.checkpointId);
-    if (!checkpoint) {
-      throw new Error(`Durable Tess handoff checkpoint is unavailable: ${input.checkpointId}`);
-    }
-    const inserted = await this.db
-      .insert(interactionHandoffs)
-      .values({ ...input })
-      .onConflictDoNothing()
-      .returning({ handoffId: interactionHandoffs.handoffId });
-    if (inserted[0]) return;
-
-    const existing = await this.findHandoff(input.handoffId);
-    if (!existing || !sameHandoff(existing, input)) {
-      throw new Error(`Durable Tess handoff identity conflict: ${input.handoffId}`);
-    }
-  }
-
-  async findHandoff(handoffId: string): Promise<DurableHandoff | null> {
-    const handoffs = await this.db
-      .select()
-      .from(interactionHandoffs)
-      .where(eq(interactionHandoffs.handoffId, handoffId))
-      .limit(1);
-    const handoff = handoffs[0];
-    return handoff ? toHandoff(handoff) : null;
-  }
-
-  async requeueInFlight(sessionId: string): Promise<void> {
-    // Inbox handlers are process-local work. A provider outbox claim may have
-    // reached an external target before a crash, so it is deliberately not
-    // replayed by generic recovery.
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'processing')),
-      );
-  }
-
-  private async session(sessionId: string): Promise<DurableSessionIdentity | null> {
-    const sessions = await this.db
-      .select()
-      .from(interactionSessions)
-      .where(eq(interactionSessions.id, sessionId))
-      .limit(1);
-    const session = sessions[0];
-    return session
-      ? {
-          agentName: session.agentName,
-          sessionId: session.id,
-          tenantId: session.tenantId,
-          ownerId: session.ownerId,
-          providerId: session.providerId,
-          runtimeSessionId: session.runtimeSessionId,
-        }
-      : null;
-  }
-}
-
-function contentDigest(content: string): string {
-  const secret = process.env['BETTER_AUTH_SECRET'];
-  if (!secret) {
-    throw new Error('BETTER_AUTH_SECRET is required for durable idempotency digests');
-  }
-  return `hmac:v1:${createHmac('sha256', secret).update(content).digest('hex')}`;
-}
-
-function matchesContentDigest(stored: string, content: string): boolean {
-  return (
-    stored === contentDigest(content) ||
-    stored === createHash('sha256').update(content).digest('hex')
-  );
-}
-
-function matchesCheckpointDigest(stored: string, digest: string): boolean {
-  // Legacy rows predate any pre-redaction identity and cannot safely prove equality.
-  // Reject rather than let redaction collapse distinct sensitive checkpoint payloads.
-  return stored === digest;
-}
-
-function sameEnrollmentScope(left: DurableSessionIdentity, right: DurableSessionIdentity): boolean {
-  return (
-    left.agentName === right.agentName &&
-    left.sessionId === right.sessionId &&
-    left.tenantId === right.tenantId &&
-    left.ownerId === right.ownerId
-  );
-}
-
-function sameInbox(left: DurableInboxEntry, right: DurableInboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.content === right.content
-  );
-}
-
-function sameOutbox(left: DurableOutboxEntry, right: DurableOutboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.channelId === right.channelId &&
-    left.kind === right.kind &&
-    left.content === right.content
-  );
-}
-
-function sameCheckpoint(left: DurableCheckpoint, right: DurableCheckpointInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.checkpointId === right.checkpointId &&
-    left.compactionEpoch === right.compactionEpoch
-  );
-}
-
-function sameHandoff(left: DurableHandoff, right: DurableHandoffInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.handoffId === right.handoffId &&
-    left.destination === right.destination &&
-    left.correlationId === right.correlationId &&
-    left.checkpointId === right.checkpointId &&
-    left.status === right.status
-  );
-}
-
-function toInbox(row: typeof interactionInbox.$inferSelect): DurableInboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toOutbox(row: typeof interactionOutbox.$inferSelect): DurableOutboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    channelId: row.channelId,
-    kind: row.kind,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toCheckpoint(row: typeof interactionCheckpoints.$inferSelect): DurableCheckpoint {
-  return {
-    sessionId: row.sessionId,
-    checkpointId: row.checkpointId,
-    cursor: unseal(row.cursor),
-    summary: unseal(row.summary),
-    compactionEpoch: row.compactionEpoch,
-  };
-}
-
-function toHandoff(row: typeof interactionHandoffs.$inferSelect): DurableHandoff {
-  return {
-    sessionId: row.sessionId,
-    handoffId: row.handoffId,
-    destination: row.destination,
-    correlationId: row.correlationId,
-    checkpointId: row.checkpointId,
-    status: row.status,
-  };
-}

apps/gateway/src/agent/tess-durable-session.service.ts

@@ -1,123 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import type { TessProviderOutboxDto } from './tess-durable-session.dto.js';
-import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Scoped gateway boundary for the canonical Tess state machine. It deliberately
- * uses composition: raw state methods cannot be injected into channel, CLI, or
- * MCP adapters without a server-derived actor/tenant/correlation context.
- */
-@Injectable()
-export class TessDurableSessionService {
-  private readonly coordinator: DurableSessionCoordinator;
-
-  constructor(
-    @Inject(TessDurableSessionRepository) repository: TessDurableSessionRepository,
-    @Inject(RuntimeProviderService) private readonly runtimeProviders: RuntimeProviderService,
-  ) {
-    this.coordinator = new DurableSessionCoordinator(repository);
-  }
-
-  /** Enroll a verified runtime session under the stable cross-surface conversation handle. */
-  async enroll(
-    identity: DurableSessionIdentity,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    if (
-      identity.ownerId !== context.actorScope.userId ||
-      identity.tenantId !== context.actorScope.tenantId
-    ) {
-      throw new ForbiddenException('Durable Tess enrollment scope mismatch');
-    }
-    await this.coordinator.create(identity);
-  }
-
-  async queueProviderSend(input: TessProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(input.sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.enqueueOutbox({
-      sessionId: input.sessionId,
-      idempotencyKey: input.idempotencyKey,
-      correlationId: input.correlationId,
-      channelId: input.context.channelId,
-      kind: 'provider.send',
-      content: input.content,
-    });
-  }
-
-  async dispatchProviderOutbox(sessionId: string, input: TessProviderOutboxDto): Promise<void> {
-    if (sessionId !== input.sessionId) {
-      throw new ForbiddenException('Durable Tess outbox session mismatch');
-    }
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    const pendingEntry = snapshot.outbox.find(
-      (entry): boolean => entry.idempotencyKey === input.idempotencyKey,
-    );
-    if (!pendingEntry) return;
-    // Validate immutable routing before claiming. A caller with a mismatched
-    // correlation/channel must not strand a pending external side effect.
-    this.assertOutboxScope(pendingEntry, input);
-    await this.coordinator.dispatchOutboxEntry(
-      sessionId,
-      input.idempotencyKey,
-      async (entry): Promise<void> => {
-        this.assertOutboxScope(entry, input);
-        await this.runtimeProviders.sendMessage(
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-          { content: entry.content, idempotencyKey: entry.idempotencyKey },
-          input.context,
-        );
-      },
-    );
-  }
-
-  /** Read durable identity/state only after deriving and checking the server-side actor scope. */
-  async getSnapshot(sessionId: string, context: RuntimeProviderRequestContext) {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, {
-      sessionId,
-      content: '',
-      idempotencyKey: 'read-only',
-      correlationId: context.correlationId,
-      context,
-    });
-    return snapshot;
-  }
-
-  /** Startup/recovery-only path; normal queue/dispatch methods never requeue live work. */
-  async recoverProviderSession(sessionId: string, input: TessProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.recover(sessionId);
-  }
-
-  private assertOutboxScope(
-    entry: { kind: string; correlationId: string; channelId: string },
-    input: TessProviderOutboxDto,
-  ): void {
-    if (
-      entry.kind !== 'provider.send' ||
-      entry.correlationId !== input.correlationId ||
-      entry.channelId !== input.context.channelId
-    ) {
-      throw new ForbiddenException('Durable Tess outbox scope or correlation mismatch');
-    }
-  }
-
-  private assertScope(ownerId: string, tenantId: string, input: TessProviderOutboxDto): void {
-    if (
-      input.context.actorScope.userId !== ownerId ||
-      input.context.actorScope.tenantId !== tenantId ||
-      input.context.correlationId !== input.correlationId
-    ) {
-      throw new ForbiddenException('Durable Tess session scope or correlation mismatch');
-    }
-  }
-}

apps/gateway/src/auth/session-scope.ts

@@ -1,24 +0,0 @@
-export interface AuthenticatedUserLike {
-  id: string;
-  tenantId?: string | null;
-  teamId?: string | null;
-  organizationId?: string | null;
-  orgId?: string | null;
-}
-
-export interface ActorTenantScope {
-  userId: string;
-  tenantId: string;
-}
-
-/**
- * Build the immutable server-derived scope used for Tess session operations.
- * Current Mosaic auth is user-scoped; future org/team claims can populate one
- * of the tenant fields without allowing clients to choose another tenant.
- */
-export function scopeFromUser(user: AuthenticatedUserLike): ActorTenantScope {
-  return {
-    userId: user.id,
-    tenantId: user.tenantId ?? user.teamId ?? user.organizationId ?? user.orgId ?? user.id,
-  };
-}

apps/gateway/src/chat/__tests__/chat-security.test.ts

@@ -12,8 +12,7 @@ describe('Chat controller source hardening', () => {
     const source = readFileSync(resolve('src/chat/chat.controller.ts'), 'utf8');
 
     expect(source).toContain('@UseGuards(AuthGuard)');
-    expect(source).toContain('@CurrentUser() user: AuthenticatedUserLike');
-    expect(source).toContain('const scope = scopeFromUser(user);');
+    expect(source).toContain('@CurrentUser() user: { id: string }');
   });
 });
 

apps/gateway/src/chat/chat.controller.ts

@@ -3,10 +3,8 @@ import {
   Post,
   Body,
   Logger,
-  ForbiddenException,
   HttpException,
   HttpStatus,
-  NotFoundException,
   Inject,
   UseGuards,
 } from '@nestjs/common';
@@ -15,7 +13,6 @@ import { Throttle } from '@nestjs/throttler';
 import { AgentService } from '../agent/agent.service.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
 import { v4 as uuid } from 'uuid';
 import { ChatRequestDto } from './chat.dto.js';
 
@@ -35,23 +32,16 @@ export class ChatController {
   @Throttle({ default: { limit: 10, ttl: 60_000 } })
   async chat(
     @Body() body: ChatRequestDto,
-    @CurrentUser() user: AuthenticatedUserLike,
+    @CurrentUser() user: { id: string },
   ): Promise<ChatResponse> {
     const conversationId = body.conversationId ?? uuid();
-    const scope = scopeFromUser(user);
 
     try {
-      let agentSession = this.agentService.getSession(conversationId, scope);
+      let agentSession = this.agentService.getSession(conversationId);
       if (!agentSession) {
-        agentSession = await this.agentService.createSession(conversationId, {
-          userId: scope.userId,
-          tenantId: scope.tenantId,
-        });
+        agentSession = await this.agentService.createSession(conversationId);
       }
     } catch (err) {
-      if (err instanceof ForbiddenException) {
-        throw new NotFoundException('Session not found');
-      }
       this.logger.error(
         `Session creation failed for conversation=${conversationId}`,
         err instanceof Error ? err.stack : String(err),
@@ -70,27 +60,20 @@ export class ChatController {
         reject(new Error('Agent response timed out'));
       }, 120_000);
 
-      const cleanup = this.agentService.onEvent(
-        conversationId,
-        (event: AgentSessionEvent) => {
-          if (
-            event.type === 'message_update' &&
-            event.assistantMessageEvent.type === 'text_delta'
-          ) {
-            responseText += event.assistantMessageEvent.delta;
-          }
-          if (event.type === 'agent_end') {
-            clearTimeout(timer);
-            cleanup();
-            resolve();
-          }
-        },
-        scope,
-      );
+      const cleanup = this.agentService.onEvent(conversationId, (event: AgentSessionEvent) => {
+        if (event.type === 'message_update' && event.assistantMessageEvent.type === 'text_delta') {
+          responseText += event.assistantMessageEvent.delta;
+        }
+        if (event.type === 'agent_end') {
+          clearTimeout(timer);
+          cleanup();
+          resolve();
+        }
+      });
     });
 
     try {
-      await this.agentService.prompt(conversationId, body.content, scope);
+      await this.agentService.prompt(conversationId, body.content);
       await done;
     } catch (err) {
       if (err instanceof HttpException) throw err;

apps/gateway/src/chat/chat.gateway-auth.ts

@@ -1,4 +1,3 @@
-import { timingSafeEqual } from 'node:crypto';
 import type { IncomingHttpHeaders } from 'node:http';
 import { fromNodeHeaders } from 'better-auth/node';
 
@@ -13,19 +12,6 @@ export interface SessionAuth {
   };
 }
 
-export function validateDiscordServiceToken(
-  candidate: unknown,
-  expected: string | undefined,
-): boolean {
-  if (typeof candidate !== 'string' || !expected) return false;
-  const candidateBuffer = Buffer.from(candidate);
-  const expectedBuffer = Buffer.from(expected);
-  return (
-    candidateBuffer.length === expectedBuffer.length &&
-    timingSafeEqual(candidateBuffer, expectedBuffer)
-  );
-}
-
 export async function validateSocketSession(
   headers: IncomingHttpHeaders,
   auth: SessionAuth,

apps/gateway/src/chat/chat.gateway-command-approval.spec.ts

@@ -1,74 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { ChatGateway } from './chat.gateway.js';
-
-const payload: SlashCommandPayload = {
-  command: 'gc',
-  conversationId: 'conversation-1',
-  approvalId: 'approval-1',
-};
-
-function buildGateway(commandExecutor: {
-  execute: ReturnType<typeof vi.fn>;
-  createApproval: ReturnType<typeof vi.fn>;
-}): ChatGateway {
-  return new ChatGateway(
-    {} as never,
-    {} as never,
-    {} as never,
-    {} as never,
-    commandExecutor as never,
-    {} as never,
-  );
-}
-
-describe('ChatGateway command approval ingress', () => {
-  it('passes the client approval ID through to command execution while deriving the actor server-side', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn().mockResolvedValue({ ...payload, success: true }),
-      createApproval: vi.fn(),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandExecute(client as never, payload);
-
-    expect(commandExecutor.execute).toHaveBeenCalledWith(payload, {
-      userId: 'admin-1',
-      tenantId: 'admin-1',
-    });
-    expect(client.emit).toHaveBeenCalledWith(
-      'command:result',
-      expect.objectContaining({ success: true }),
-    );
-  });
-
-  it('issues a durable approval only for the authenticated actor', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn(),
-      createApproval: vi.fn().mockResolvedValue({
-        approvalId: 'approval-1',
-        expiresAt: '2026-07-12T00:05:00.000Z',
-      }),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandApproval(client as never, {
-      command: 'gc',
-      conversationId: 'conversation-1',
-    });
-
-    expect(commandExecutor.createApproval).toHaveBeenCalledWith(
-      { command: 'gc', conversationId: 'conversation-1' },
-      { userId: 'admin-1', tenantId: 'admin-1' },
-    );
-    expect(client.emit).toHaveBeenCalledWith('command:approval', {
-      command: 'gc',
-      conversationId: 'conversation-1',
-      success: true,
-      approvalId: 'approval-1',
-      expiresAt: '2026-07-12T00:05:00.000Z',
-    });
-  });
-});

apps/gateway/src/chat/chat.gateway-redaction.spec.ts

@@ -1,170 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ChatGateway } from './chat.gateway.js';
-
-const CONVERSATION_ID = 'conversation-1';
-const CANARY = 'sk_canary12345678';
-
-type GatewayInternals = {
-  clientSessions: Map<string, unknown>;
-  relayEvent(client: unknown, conversationId: string, event: unknown): void;
-};
-
-function buildGateway() {
-  const brain = {
-    conversations: {
-      addMessage: vi.fn().mockResolvedValue(undefined),
-    },
-  };
-  const agentService = {
-    getSession: vi.fn().mockReturnValue(undefined),
-  };
-  const gateway = new ChatGateway(
-    agentService as never,
-    {} as never,
-    brain as never,
-    {} as never,
-    {} as never,
-    {} as never,
-  );
-
-  return { gateway: gateway as unknown as GatewayInternals, brain };
-}
-
-describe('ChatGateway redaction boundary', (): void => {
-  it('redacts a secret split across assistant deltas before egress and persistence', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const session = {
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    };
-    gateway.clientSessions.set(client.id, session);
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'sk_canary' },
-    });
-
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('sk_canary');
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '12345678 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(session.assistantText).toBe(`${CANARY} `);
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain(CANARY);
-  });
-
-  it('retains a split secret label until its value can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'token ' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '=canaryvalue123 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canaryvalue123');
-  });
-
-  it('holds a streamed private key until it can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '-----BEGIN PRIVATE KEY-----\ncanary' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '\n-----END PRIVATE KEY-----' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET]',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canary');
-  });
-
-  it('drops an oversized unterminated stream fragment rather than retaining it', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'x'.repeat(8_193) },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_STREAM_OVERFLOW]',
-    });
-  });
-
-  it('persists only redacted assistant content with classifications', (): void => {
-    const { gateway, brain } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    gateway.clientSessions.set(client.id, {
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: CANARY,
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-
-    gateway.relayEvent(client, CONVERSATION_ID, { type: 'agent_end' });
-
-    expect(brain.conversations.addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        content: '[REDACTED_SECRET]',
-        metadata: expect.objectContaining({ classifications: ['secret'] }),
-      }),
-      'user-1',
-    );
-    expect(JSON.stringify(brain.conversations.addMessage.mock.calls)).not.toContain(CANARY);
-  });
-});

apps/gateway/src/chat/chat.gateway.ts

@@ -1,5 +1,4 @@
-import { createHash } from 'node:crypto';
-import { Inject, Logger, Optional } from '@nestjs/common';
+import { Inject, Logger } from '@nestjs/common';
 import {
   WebSocketGateway,
   WebSocketServer,
@@ -12,47 +11,24 @@ import {
 } from '@nestjs/websockets';
 import { Server, Socket } from 'socket.io';
 import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
-import {
-  verifyDiscordIngressEnvelope,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
-  type DiscordIngressEnvelope,
-  type DiscordIngressPayload,
-} from '@mosaicstack/discord-plugin';
 import type { Auth } from '@mosaicstack/auth';
 import type { Brain } from '@mosaicstack/brain';
-import { redactSensitiveContent } from '@mosaicstack/log';
 import type {
   SetThinkingPayload,
-  SlashCommandApprovalResultPayload,
   SlashCommandPayload,
   SystemReloadPayload,
   RoutingDecisionInfo,
   AbortPayload,
 } from '@mosaicstack/types';
 import { AgentService, type ConversationHistoryMessage } from '../agent/agent.service.js';
-import {
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderService,
-  type RuntimeAuditSink,
-} from '../agent/runtime-provider-registry.service.js';
-import { TessDurableSessionService } from '../agent/tess-durable-session.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
-import {
-  scopeFromUser,
-  type ActorTenantScope,
-  type AuthenticatedUserLike,
-} from '../auth/session-scope.js';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { CommandRegistryService } from '../commands/command-registry.service.js';
 import { CommandExecutorService } from '../commands/command-executor.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { RoutingEngineService } from '../agent/routing/routing-engine.service.js';
 import { v4 as uuid } from 'uuid';
 import { ChatSocketMessageDto } from './chat.dto.js';
-import { validateDiscordServiceToken, validateSocketSession } from './chat.gateway-auth.js';
-import { DiscordReplayProtector } from '../plugin/discord-replay-protector.js';
+import { validateSocketSession } from './chat.gateway-auth.js';
 
 /** Per-client state tracking streaming accumulation for persistence. */
 interface ClientSession {
@@ -64,8 +40,6 @@ interface ClientSession {
   toolCalls: Array<{ toolCallId: string; toolName: string; args: unknown; isError: boolean }>;
   /** Tool calls in-flight (started but not ended yet). */
   pendingToolCalls: Map<string, { toolName: string; args: unknown }>;
-  /** Server-derived owner/tenant scope for this socket's conversation attachment. */
-  scope: ActorTenantScope;
   /** Last routing decision made for this session (M4-008) */
   lastRoutingDecision?: RoutingDecisionInfo;
 }
@@ -75,38 +49,6 @@ interface ClientSession {
  * Keyed by conversationId, value is the model name to use.
  */
 const modelOverrides = new Map<string, string>();
-const MAX_REDACTION_BUFFER_LENGTH = 8_192;
-
-function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelope {
-  if (typeof value !== 'object' || value === null) return false;
-  const envelope = value as { payload?: unknown; signature?: unknown };
-  if (
-    typeof envelope.signature !== 'string' ||
-    typeof envelope.payload !== 'object' ||
-    envelope.payload === null
-  ) {
-    return false;
-  }
-  const payload = envelope.payload as Record<string, unknown>;
-  return [
-    payload['correlationId'],
-    payload['messageId'],
-    payload['guildId'],
-    payload['channelId'],
-    payload['userId'],
-    payload['conversationId'],
-    payload['content'],
-  ].every((field: unknown): boolean => typeof field === 'string');
-}
-
-function isChatSocketMessage(value: unknown): value is ChatSocketMessageDto {
-  if (typeof value !== 'object' || value === null) return false;
-  const payload = value as { content?: unknown; conversationId?: unknown };
-  return (
-    typeof payload.content === 'string' &&
-    (payload.conversationId === undefined || typeof payload.conversationId === 'string')
-  );
-}
 
 @WebSocketGateway({
   cors: {
@@ -120,11 +62,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   private readonly logger = new Logger(ChatGateway.name);
   private readonly clientSessions = new Map<string, ClientSession>();
-  /** Raw stream fragments are kept in memory only until they are safe to redact and emit. */
-  private readonly textEgressBuffers = new Map<string, string>();
-  private readonly thinkingEgressBuffers = new Map<string, string>();
-  private readonly overflowedEgress = new Set<string>();
-  private readonly discordReplayProtector = new DiscordReplayProtector();
 
   constructor(
     @Inject(AgentService) private readonly agentService: AgentService,
@@ -133,18 +70,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @Inject(CommandRegistryService) private readonly commandRegistry: CommandRegistryService,
     @Inject(CommandExecutorService) private readonly commandExecutor: CommandExecutorService,
     @Inject(RoutingEngineService) private readonly routingEngine: RoutingEngineService,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly commandAuthorization: CommandAuthorizationService | null = null,
-    @Optional()
-    @Inject(RuntimeProviderService)
-    private readonly runtimeRegistry: RuntimeProviderService | null = null,
-    @Optional()
-    @Inject(TessDurableSessionService)
-    private readonly durableSessions: TessDurableSessionService | null = null,
-    @Optional()
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly runtimeAudit: RuntimeAuditSink | null = null,
   ) {}
 
   afterInit(): void {
@@ -152,13 +77,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
   }
 
   async handleConnection(client: Socket): Promise<void> {
-    const serviceToken = client.handshake.auth['discordServiceToken'];
-    if (validateDiscordServiceToken(serviceToken, process.env['DISCORD_SERVICE_TOKEN'])) {
-      client.data.discordService = true;
-      this.logger.log(`Authenticated Discord service connected: ${client.id}`);
-      return;
-    }
-
     const session = await validateSocketSession(client.handshake.headers, this.auth);
     if (!session) {
       this.logger.warn(`Rejected unauthenticated WebSocket client: ${client.id}`);
@@ -169,6 +87,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     client.data.user = session.user;
     client.data.session = session.session;
     this.logger.log(`Client connected: ${client.id}`);
+
+    // Broadcast command manifest to the newly connected client
     client.emit('commands:manifest', { manifest: this.commandRegistry.getManifest() });
   }
 
@@ -177,84 +97,25 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     const session = this.clientSessions.get(client.id);
     if (session) {
       session.cleanup();
-      this.agentService.removeChannel(
-        session.conversationId,
-        `websocket:${client.id}`,
-        session.scope,
-      );
+      this.agentService.removeChannel(session.conversationId, `websocket:${client.id}`);
       this.clientSessions.delete(client.id);
     }
-    this.textEgressBuffers.delete(client.id);
-    this.thinkingEgressBuffers.delete(client.id);
-    this.overflowedEgress.delete(this.egressKey(client, 'agent:text'));
-    this.overflowedEgress.delete(this.egressKey(client, 'agent:thinking'));
-  }
-
-  private getClientScope(client: Socket): ActorTenantScope | null {
-    const user = client.data.user as AuthenticatedUserLike | undefined;
-    if (!user?.id) return null;
-    return scopeFromUser(user);
-  }
-
-  private modelOverrideKey(conversationId: string, scope: ActorTenantScope): string {
-    return `${scope.tenantId}:${scope.userId}:${conversationId}`;
-  }
-
-  private scopesEqual(a: ActorTenantScope, b: ActorTenantScope): boolean {
-    return a.userId === b.userId && a.tenantId === b.tenantId;
   }
 
   @SubscribeMessage('message')
   async handleMessage(
     @ConnectedSocket() client: Socket,
-    @MessageBody() rawData: unknown,
+    @MessageBody() data: ChatSocketMessageDto,
   ): Promise<void> {
-    let discordIngress: DiscordIngressPayload | null = null;
-    let data: ChatSocketMessageDto;
-    if (client.data.discordService) {
-      if (!isDiscordIngressEnvelope(rawData)) {
-        this.logger.warn(`Rejected malformed Discord ingress from ${client.id}`);
-        return;
-      }
-      discordIngress = this.resolveDiscordIngress(client, rawData);
-      if (!discordIngress) return;
-      data = { conversationId: discordIngress.conversationId, content: discordIngress.content };
-    } else {
-      if (!isChatSocketMessage(rawData)) {
-        this.logger.warn(`Rejected malformed chat message from ${client.id}`);
-        return;
-      }
-      data = rawData;
-    }
     const conversationId = data.conversationId ?? uuid();
-    const discordServiceUserId = process.env['DISCORD_SERVICE_USER_ID'];
-    if (discordIngress && !discordServiceUserId) {
-      this.logger.warn(
-        `Rejected Discord ingress without configured service owner from ${client.id}`,
-      );
-      return;
-    }
-    const scope = discordIngress
-      ? {
-          userId: discordServiceUserId!,
-          tenantId: process.env['DISCORD_SERVICE_TENANT_ID'] ?? discordServiceUserId!,
-        }
-      : this.getClientScope(client);
-    if (!scope) {
-      client.emit('error', { conversationId, error: 'Authenticated user scope is required.' });
-      return;
-    }
-    const userId = scope.userId;
-    const correlationId = discordIngress?.correlationId;
+    const userId = (client.data.user as { id: string } | undefined)?.id;
 
-    this.logger.log(
-      `Message from ${client.id} in conversation ${conversationId}${correlationId ? ` correlation=${correlationId}` : ''}`,
-    );
+    this.logger.log(`Message from ${client.id} in conversation ${conversationId}`);
 
     // Ensure agent session exists for this conversation
     let sessionRoutingDecision: RoutingDecisionInfo | undefined;
     try {
-      let agentSession = this.agentService.getSession(conversationId, scope);
+      let agentSession = this.agentService.getSession(conversationId);
       if (!agentSession) {
         // When resuming an existing conversation, load prior messages to inject as context (M1-004)
         const conversationHistory = await this.loadConversationHistory(conversationId, userId);
@@ -274,7 +135,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         let resolvedProvider = data.provider;
         let resolvedModelId = data.modelId;
 
-        const modelOverride = modelOverrides.get(this.modelOverrideKey(conversationId, scope));
+        const modelOverride = modelOverrides.get(conversationId);
         if (modelOverride) {
           // /model override bypasses routing engine (M4-007)
           resolvedModelId = modelOverride;
@@ -311,7 +172,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           modelId: resolvedModelId,
           agentConfigId: data.agentId,
           userId,
-          tenantId: scope.tenantId,
           conversationHistory: conversationHistory.length > 0 ? conversationHistory : undefined,
         });
 
@@ -350,17 +210,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           {
             conversationId,
             role: 'user',
-            content: redactSensitiveContent(data.content).content,
+            content: data.content,
             metadata: {
               timestamp: new Date().toISOString(),
-              ...(correlationId
-                ? {
-                    correlationId,
-                    discordMessageId: discordIngress?.messageId,
-                    discordUserId: discordIngress?.userId,
-                  }
-                : {}),
-              classifications: redactSensitiveContent(data.content).classifications,
             },
           },
           userId,
@@ -380,13 +232,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
 
     // Subscribe to agent events and relay to client
-    const cleanup = this.agentService.onEvent(
-      conversationId,
-      (event: AgentSessionEvent) => {
-        this.relayEvent(client, conversationId, event);
-      },
-      scope,
-    );
+    const cleanup = this.agentService.onEvent(conversationId, (event: AgentSessionEvent) => {
+      this.relayEvent(client, conversationId, event);
+    });
 
     // Preserve routing decision from the existing client session if we didn't get a new one
     const prevClientSession = this.clientSessions.get(client.id);
@@ -398,17 +246,16 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       assistantText: '',
       toolCalls: [],
       pendingToolCalls: new Map(),
-      scope,
       lastRoutingDecision: routingDecisionToStore,
     });
 
     // Track channel connection
-    this.agentService.addChannel(conversationId, `websocket:${client.id}`, scope);
+    this.agentService.addChannel(conversationId, `websocket:${client.id}`);
 
     // Send session info so the client knows the model/provider (M4-008: include routing decision)
     // Include agentName when a named agent config is active (M5-001)
     {
-      const agentSession = this.agentService.getSession(conversationId, scope);
+      const agentSession = this.agentService.getSession(conversationId);
       if (agentSession) {
         const piSession = agentSession.piSession;
         client.emit('session:info', {
@@ -424,21 +271,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
 
     // Send acknowledgment
-    client.emit('message:ack', {
-      conversationId,
-      messageId: uuid(),
-      ...(correlationId
-        ? {
-            correlationId,
-            discordMessageId: discordIngress?.messageId,
-            discordUserId: discordIngress?.userId,
-          }
-        : {}),
-    });
+    client.emit('message:ack', { conversationId, messageId: uuid() });
 
     // Dispatch to agent
     try {
-      await this.agentService.prompt(conversationId, data.content, scope);
+      await this.agentService.prompt(conversationId, data.content);
     } catch (err) {
       this.logger.error(
         `Agent prompt failed for client=${client.id}, conversation=${conversationId}`,
@@ -456,16 +293,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @ConnectedSocket() client: Socket,
     @MessageBody() data: SetThinkingPayload,
   ): void {
-    const scope = this.getClientScope(client);
-    if (!scope) {
-      client.emit('error', {
-        conversationId: data.conversationId,
-        error: 'Authenticated user scope is required.',
-      });
-      return;
-    }
-
-    const session = this.agentService.getSession(data.conversationId, scope);
+    const session = this.agentService.getSession(data.conversationId);
     if (!session) {
       client.emit('error', {
         conversationId: data.conversationId,
@@ -506,13 +334,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     const conversationId = data.conversationId;
     this.logger.log(`Abort requested by ${client.id} for conversation ${conversationId}`);
 
-    const scope = this.getClientScope(client);
-    if (!scope) {
-      client.emit('error', { conversationId, error: 'Authenticated user scope is required.' });
-      return;
-    }
-
-    const session = this.agentService.getSession(conversationId, scope);
+    const session = this.agentService.getSession(conversationId);
     if (!session) {
       client.emit('error', {
         conversationId,
@@ -541,45 +363,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @ConnectedSocket() client: Socket,
     @MessageBody() payload: SlashCommandPayload,
   ): Promise<void> {
-    const scope = this.getClientScope(client);
-    if (!scope) {
-      client.emit('command:result', {
-        command: payload.command,
-        conversationId: payload.conversationId,
-        success: false,
-        message: 'Authenticated user scope is required.',
-      });
-      return;
-    }
-
-    const result = await this.commandExecutor.execute(payload, scope);
+    const userId = (client.data.user as { id: string } | undefined)?.id ?? 'unknown';
+    const result = await this.commandExecutor.execute(payload, userId);
     client.emit('command:result', result);
   }
 
-  @SubscribeMessage('command:approve')
-  async handleCommandApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() payload: SlashCommandPayload,
-  ): Promise<void> {
-    const scope = this.getClientScope(client);
-    const approval = scope ? await this.commandExecutor.createApproval(payload, scope) : null;
-    const result: SlashCommandApprovalResultPayload = approval
-      ? {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: true,
-          approvalId: approval.approvalId,
-          expiresAt: approval.expiresAt,
-        }
-      : {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: false,
-          message: 'Not authorized to approve this command.',
-        };
-    client.emit('command:approval', result);
-  }
-
   broadcastReload(payload: SystemReloadPayload): void {
     this.server.emit('system:reload', payload);
     this.logger.log('Broadcasted system:reload to all connected clients');
@@ -592,23 +380,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
    * M5-005: Emits session:info to clients subscribed to this conversation when a model is set.
    * M5-007: Records a model switch in session metrics.
    */
-  setModelOverride(
-    conversationId: string,
-    modelName: string | null,
-    scope: ActorTenantScope,
-  ): void {
-    const key = this.modelOverrideKey(conversationId, scope);
+  setModelOverride(conversationId: string, modelName: string | null): void {
     if (modelName) {
-      modelOverrides.set(key, modelName);
+      modelOverrides.set(conversationId, modelName);
       this.logger.log(`Model override set: conversation=${conversationId} model="${modelName}"`);
 
       // M5-002: Update the live session's modelId so session:info reflects the new model immediately
-      this.agentService.updateSessionModel(conversationId, modelName, scope);
+      this.agentService.updateSessionModel(conversationId, modelName);
 
       // M5-005: Broadcast session:info to all clients subscribed to this conversation
-      this.broadcastSessionInfo(conversationId, scope);
+      this.broadcastSessionInfo(conversationId);
     } else {
-      modelOverrides.delete(key);
+      modelOverrides.delete(conversationId);
       this.logger.log(`Model override cleared: conversation=${conversationId}`);
     }
   }
@@ -616,8 +399,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
   /**
    * Return the active model override for a conversation, or undefined if none.
    */
-  getModelOverride(conversationId: string, scope: ActorTenantScope): string | undefined {
-    return modelOverrides.get(this.modelOverrideKey(conversationId, scope));
+  getModelOverride(conversationId: string): string | undefined {
+    return modelOverrides.get(conversationId);
   }
 
   /**
@@ -626,10 +409,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
    */
   broadcastSessionInfo(
     conversationId: string,
-    scope: ActorTenantScope,
     extra?: { agentName?: string; routingDecision?: RoutingDecisionInfo },
   ): void {
-    const agentSession = this.agentService.getSession(conversationId, scope);
+    const agentSession = this.agentService.getSession(conversationId);
     if (!agentSession) return;
 
     const piSession = agentSession.piSession;
@@ -646,7 +428,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
     // Emit to all clients currently subscribed to this conversation
     for (const [clientId, session] of this.clientSessions) {
-      if (session.conversationId === conversationId && this.scopesEqual(session.scope, scope)) {
+      if (session.conversationId === conversationId) {
         const socket = this.server.sockets.sockets.get(clientId);
         if (socket?.connected) {
           socket.emit('session:info', payload);
@@ -660,233 +442,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
    * Creates it if absent — safe to call concurrently since a duplicate insert
    * would fail on the PK constraint and be caught here.
    */
-  @SubscribeMessage('discord:approve')
-  async handleDiscordApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'approve');
-    const isApprovalCommand = /^\/approve\s*$/i.test(ingress?.content ?? '');
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (
-      !ingress ||
-      !isApprovalCommand ||
-      !tenantId ||
-      !this.commandAuthorization ||
-      !this.durableSessions
-    )
-      return;
-    const binding = resolveDiscordInteractionBinding(
-      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-      ingress.guildId,
-      ingress.channelId,
-      ingress.userId,
-      'approve',
-    );
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
-    if (!actorId || !agentName || binding.instanceId !== agentName) {
-      this.logger.warn(
-        `Rejected Discord approval without a matching runtime agent from ${client.id}`,
-      );
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    let snapshot;
-    try {
-      snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      });
-    } catch {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    if (snapshot.identity.agentName !== agentName) {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    const approval = await this.commandAuthorization.createRuntimeTerminationApproval({
-      providerId: snapshot.identity.providerId,
-      sessionId: snapshot.identity.runtimeSessionId,
-      actorId,
-      tenantId,
-      channelId: ingress.channelId,
-      correlationId: this.discordRuntimeActionCorrelation(
-        binding.instanceId,
-        ingress,
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-      ),
-      agentName,
-    });
-    if (!approval) {
-      await this.runtimeAudit?.record({
-        providerId: snapshot.identity.providerId,
-        operation: 'session.terminate',
-        outcome: 'denied',
-        actorId,
-        tenantId,
-        channelId: ingress.channelId,
-        correlationId: this.discordRuntimeActionCorrelation(
-          binding.instanceId,
-          ingress,
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-        ),
-        resourceId: snapshot.identity.runtimeSessionId,
-        errorCode: 'policy_denied',
-      });
-    }
-    client.emit('discord:approval', {
-      correlationId: ingress.correlationId,
-      success: approval !== null,
-      approvalId: approval?.approvalId,
-      expiresAt: approval?.expiresAt,
-    });
-  }
-
-  @SubscribeMessage('discord:stop')
-  async handleDiscordStop(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'stop');
-    const approvalRef = /^\/stop\s+([^\s]+)$/i.exec(ingress?.content ?? '')?.[1];
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (!ingress || !approvalRef || !tenantId || !this.runtimeRegistry || !this.durableSessions)
-      return;
-    const binding = resolveDiscordInteractionBinding(
-      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-      ingress.guildId,
-      ingress.channelId,
-      ingress.userId,
-      'stop',
-    );
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    if (!actorId) return;
-
-    try {
-      const context = {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      };
-      const snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, context);
-      if (snapshot.identity.agentName !== binding.instanceId) throw new Error('agent mismatch');
-      // RuntimeProviderService consumes the durable approval exactly once using the
-      // provisioned approving-admin identity, never the Discord service account.
-      await this.runtimeRegistry.terminate(
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-        approvalRef,
-        {
-          ...context,
-          correlationId: this.discordRuntimeActionCorrelation(
-            binding.instanceId,
-            ingress,
-            snapshot.identity.providerId,
-            snapshot.identity.runtimeSessionId,
-          ),
-        },
-      );
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: true });
-    } catch {
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: false });
-    }
-  }
-
-  /**
-   * Correlates the immutable termination target rather than either Discord message.
-   * Approval and stop are distinct ingress events, but must consume the same seven-field action.
-   */
-  private discordRuntimeActionCorrelation(
-    instanceId: string,
-    ingress: DiscordIngressPayload,
-    providerId: string,
-    sessionId: string,
-  ): string {
-    const target = [
-      instanceId,
-      ingress.guildId,
-      ingress.channelId,
-      ingress.conversationId,
-      providerId,
-      sessionId,
-    ];
-    return `discord-action:v1:${createHash('sha256').update(JSON.stringify(target)).digest('hex')}`;
-  }
-
-  private resolveDiscordIngress(
-    client: Socket,
-    envelope: DiscordIngressEnvelope,
-    operation: 'send' | 'approve' | 'stop' = 'send',
-  ): DiscordIngressPayload | null {
-    const payload = verifyDiscordIngressEnvelope(
-      envelope,
-      process.env['DISCORD_SERVICE_TOKEN'] ?? '',
-      {
-        guildIds: this.readDiscordAllowlist('DISCORD_ALLOWED_GUILD_IDS'),
-        channelIds: this.readDiscordAllowlist('DISCORD_ALLOWED_CHANNEL_IDS'),
-        userIds: this.readDiscordAllowlist('DISCORD_ALLOWED_USER_IDS'),
-      },
-    );
-    if (!payload) {
-      this.logger.warn(`Rejected invalid Discord ingress envelope from ${client.id}`);
-      return null;
-    }
-    try {
-      const binding = resolveDiscordInteractionBinding(
-        parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-        payload.guildId,
-        payload.channelId,
-        payload.userId,
-        operation,
-      );
-      if (!binding) {
-        this.logger.warn(`Rejected unpaired Discord ingress from ${client.id}`);
-        return null;
-      }
-    } catch {
-      this.logger.warn(
-        `Rejected Discord ingress without valid binding configuration from ${client.id}`,
-      );
-      return null;
-    }
-    if (!this.discordReplayProtector.claim(payload.messageId)) {
-      this.logger.warn(
-        `Rejected replayed Discord message=${payload.messageId} correlation=${payload.correlationId}`,
-      );
-      return null;
-    }
-    return payload;
-  }
-
-  private readDiscordAllowlist(name: string): string[] {
-    return (process.env[name] ?? '')
-      .split(',')
-      .map((id: string): string => id.trim())
-      .filter((id: string): boolean => id.length > 0);
-  }
-
   private async ensureConversation(conversationId: string, userId: string): Promise<void> {
     try {
       const existing = await this.brain.conversations.findById(conversationId, userId);
@@ -972,127 +527,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
   }
 
-  private appendAndFlushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    delta: string,
-  ): void {
-    const key = this.egressKey(client, eventName);
-    if (this.overflowedEgress.has(key)) return;
-
-    const buffered = `${buffers.get(client.id) ?? ''}${delta}`;
-    if (buffered.length > MAX_REDACTION_BUFFER_LENGTH) {
-      buffers.delete(client.id);
-      this.overflowedEgress.add(key);
-      client.emit(eventName, { conversationId, text: '[REDACTED_STREAM_OVERFLOW]' });
-      return;
-    }
-
-    buffers.set(client.id, buffered);
-    this.flushRedactedEgress(client, conversationId, eventName, buffers, false);
-  }
-
-  /**
-   * Holds any suffix that could become a secret, email, or phone number after a
-   * later stream chunk. This avoids relying on downstream redaction after data
-   * has already reached the socket.
-   */
-  private flushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    final: boolean,
-  ): void {
-    const key = this.egressKey(client, eventName);
-    if (this.overflowedEgress.has(key)) {
-      if (final) this.overflowedEgress.delete(key);
-      return;
-    }
-
-    const buffered = buffers.get(client.id) ?? '';
-    const releaseLength = final ? buffered.length : this.safeRedactionPrefixLength(buffered);
-    const released = buffered.slice(0, releaseLength);
-    const pending = buffered.slice(releaseLength);
-
-    if (pending) {
-      buffers.set(client.id, pending);
-    } else {
-      buffers.delete(client.id);
-    }
-
-    if (released) {
-      client.emit(eventName, {
-        conversationId,
-        text: redactSensitiveContent(released).content,
-      });
-    }
-  }
-
-  private safeRedactionPrefixLength(content: string): number {
-    let retainedFrom = content.length;
-
-    // Retain the current token because it may become a split secret or email.
-    const token = /(?:^|\s)(\S*)$/.exec(content);
-    if (token) {
-      const matched = token[0] ?? '';
-      const trailingToken = token[1] ?? '';
-      retainedFrom = token.index + matched.length - trailingToken.length;
-    }
-
-    // The secret classifier accepts whitespace around ':' and '=', so preserve
-    // a pending label until its value and delimiter are both complete.
-    const pendingSecretLabel =
-      /(?:^|[^A-Za-z0-9_])((?:api[_-]?key|token|password|secret|bearer|authorization)\s*)$/i.exec(
-        content,
-      );
-    if (pendingSecretLabel) {
-      const label = pendingSecretLabel[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        pendingSecretLabel.index + pendingSecretLabel[0].length - label.length,
-      );
-    }
-
-    const secretLabel = /(?:api[_-]?key|token|password|secret|authorization)\s*[:=]\s*$/i.exec(
-      content,
-    );
-    if (secretLabel) {
-      retainedFrom = Math.min(retainedFrom, secretLabel.index);
-    }
-
-    // Phone numbers can contain whitespace and punctuation; preserve the full
-    // trailing numeric candidate until a non-phone character establishes a boundary.
-    const phone = /(?:^|[^A-Za-z0-9_])(\+?\d[\d(). -]*)$/.exec(content);
-    if (phone) {
-      const matched = phone[0] ?? '';
-      const trailingPhoneCandidate = phone[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        phone.index + matched.length - trailingPhoneCandidate.length,
-      );
-    }
-
-    const privateKeyStart = content.lastIndexOf('-----BEGIN');
-    if (privateKeyStart >= 0) {
-      const privateKey = content.slice(privateKeyStart);
-      if (/-----END(?: [A-Z]+)* KEY-----/.test(privateKey)) {
-        // Release the complete block in one pass so the full-block classifier can redact it.
-        retainedFrom = content.length;
-      } else {
-        retainedFrom = Math.min(retainedFrom, privateKeyStart);
-      }
-    }
-
-    return retainedFrom;
-  }
-
-  private egressKey(client: Socket, eventName: 'agent:text' | 'agent:thinking'): string {
-    return `${client.id}:${eventName}`;
-  }
-
   private relayEvent(client: Socket, conversationId: string, event: AgentSessionEvent): void {
     if (!client.connected) {
       this.logger.warn(
@@ -1110,20 +544,13 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           cs.toolCalls = [];
           cs.pendingToolCalls.clear();
         }
-        this.textEgressBuffers.set(client.id, '');
-        this.thinkingEgressBuffers.set(client.id, '');
-        this.overflowedEgress.delete(this.egressKey(client, 'agent:text'));
-        this.overflowedEgress.delete(this.egressKey(client, 'agent:thinking'));
         client.emit('agent:start', { conversationId });
         break;
       }
 
       case 'agent_end': {
         // Gather usage stats from the Pi session
-        const activeClientSession = this.clientSessions.get(client.id);
-        const agentSession = activeClientSession
-          ? this.agentService.getSession(conversationId, activeClientSession.scope)
-          : undefined;
+        const agentSession = this.agentService.getSession(conversationId);
         const piSession = agentSession?.piSession;
         const stats = piSession?.getSessionStats();
         const contextUsage = piSession?.getContextUsage();
@@ -1142,20 +569,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
             }
           : undefined;
 
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:text',
-          this.textEgressBuffers,
-          true,
-        );
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:thinking',
-          this.thinkingEgressBuffers,
-          true,
-        );
         client.emit('agent:end', {
           conversationId,
           usage: usagePayload,
@@ -1198,11 +611,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
               {
                 conversationId,
                 role: 'assistant',
-                content: redactSensitiveContent(cs.assistantText).content,
-                metadata: {
-                  ...metadata,
-                  classifications: redactSensitiveContent(cs.assistantText).classifications,
-                },
+                content: cs.assistantText,
+                metadata,
               },
               userId,
             )
@@ -1224,26 +634,20 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       case 'message_update': {
         const assistantEvent = event.assistantMessageEvent;
         if (assistantEvent.type === 'text_delta') {
-          // Keep raw stream material in memory only; persist and emit only redacted text.
+          // Accumulate assistant text for persistence
           const cs = this.clientSessions.get(client.id);
           if (cs) {
             cs.assistantText += assistantEvent.delta;
           }
-          this.appendAndFlushRedactedEgress(
-            client,
+          client.emit('agent:text', {
             conversationId,
-            'agent:text',
-            this.textEgressBuffers,
-            assistantEvent.delta,
-          );
+            text: assistantEvent.delta,
+          });
         } else if (assistantEvent.type === 'thinking_delta') {
-          this.appendAndFlushRedactedEgress(
-            client,
+          client.emit('agent:thinking', {
             conversationId,
-            'agent:thinking',
-            this.thinkingEgressBuffers,
-            assistantEvent.delta,
-          );
+            text: assistantEvent.delta,
+          });
         }
         break;
       }

apps/gateway/src/commands/command-authorization.service.spec.ts

@@ -1,116 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-const adminCommand: CommandDef = {
-  name: 'gc',
-  description: 'GC',
-  aliases: [],
-  scope: 'admin',
-  execution: 'socket',
-  available: true,
-};
-const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-function createService(
-  role: string,
-  entries: Map<string, string> = new Map<string, string>(),
-): CommandAuthorizationService {
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('CommandAuthorizationService', () => {
-  it('consumes one exact actor-bound approval once', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(true);
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('rejects an approval when the structured action is mutated', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    const mutated = { ...payload, conversationId: 'other-conversation' };
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, mutated, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('denies an admin command to a member before approval is considered', async (): Promise<void> => {
-    const service = createService('member');
-    const approval = await service.createApproval(adminCommand, payload, 'member-1');
-    expect(approval).toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'member-1', 'forged-approval-id')).allowed,
-    ).toBe(false);
-  });
-
-  it('denies a malformed durable approval expiry instead of treating it as unexpired', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-malformed-expiry',
-      agentName: 'Nova',
-    };
-    const service = createService('admin', entries);
-    const approval = await service.createRuntimeTerminationApproval(action);
-    expect(approval).not.toBeNull();
-    const key = `agent:Nova:command-approval:${approval!.approvalId}`;
-    const stored = entries.get(key);
-    expect(stored).toBeDefined();
-    entries.set(key, JSON.stringify({ ...JSON.parse(stored!), expiresAt: 'not-a-date' }));
-
-    expect(await service.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-
-  it('persists and consumes one exact runtime termination approval across a service restart', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-1',
-      agentName: 'Nova',
-    };
-    const beforeRestart = createService('admin', entries);
-    const approval = await beforeRestart.createRuntimeTerminationApproval(action);
-
-    const afterRestart = createService('admin', entries);
-    expect(
-      await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, {
-        ...action,
-        sessionId: 'forged-session',
-      }),
-    ).toBe(false);
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      true,
-    );
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-});

apps/gateway/src/commands/command-authorization.service.ts

@@ -1,268 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import { eq, users as usersTable, type Db } from '@mosaicstack/db';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { COMMANDS_REDIS } from './commands.tokens.js';
-
-export type CommandRole = 'admin' | 'member' | 'viewer';
-
-export interface CommandApproval {
-  approvalId: string;
-  actionDigest: string;
-  actorId: string;
-  command: string;
-  expiresAt: string;
-}
-
-/** Exact immutable binding for a privileged runtime termination. */
-export interface RuntimeTerminationApprovalAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  /** Provisioned roster identity; isolates approvals between interaction agents. */
-  agentName: string;
-}
-
-export interface RuntimeTerminationApproval extends RuntimeTerminationApprovalAction {
-  approvalId: string;
-  actionDigest: string;
-  expiresAt: string;
-}
-
-export interface CommandAuthorizationResult {
-  allowed: boolean;
-  reason?: string;
-}
-
-@Injectable()
-export class CommandAuthorizationService {
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: {
-      get(key: string): Promise<string | null>;
-      set(key: string, value: string, ...args: string[]): Promise<unknown>;
-      del(key: string): Promise<number>;
-    },
-  ) {}
-
-  async authorize(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-    approvalId?: string,
-  ): Promise<CommandAuthorizationResult> {
-    const role = await this.resolveRole(actorId);
-    if (!role || !this.hasScope(role, command.scope)) {
-      return { allowed: false, reason: 'not authorized for this command scope' };
-    }
-    if (command.scope !== 'admin') return { allowed: true };
-    if (!approvalId) return { allowed: false, reason: 'durable approval is required' };
-    const actionDigest = this.actionDigest(command.name, payload);
-    const approved = await this.consumeApproval(approvalId, actorId, actionDigest);
-    return approved
-      ? { allowed: true }
-      : {
-          allowed: false,
-          reason: 'approval is invalid, expired, replayed, or does not match this action',
-        };
-  }
-
-  async createApproval(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-  ): Promise<CommandApproval | null> {
-    const role = await this.resolveRole(actorId);
-    if (!role || command.scope !== 'admin' || !this.hasScope(role, command.scope)) return null;
-
-    const approvalId = randomUUID();
-    const expiresAt = new Date(Date.now() + 5 * 60_000).toISOString();
-    const approval: CommandApproval = {
-      approvalId,
-      actionDigest: this.actionDigest(command.name, payload),
-      actorId,
-      command: command.name,
-      expiresAt,
-    };
-    await this.redis.set(this.key(approvalId), JSON.stringify(approval), 'EX', '300');
-    return approval;
-  }
-
-  /**
-   * Uses the same `interaction:command-approval:*` store and one-time deletion rule as
-   * command approvals. This deliberately avoids a parallel approval database.
-   */
-  async createRuntimeTerminationApproval(
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<RuntimeTerminationApproval | null> {
-    if (!this.hasRuntimeTerminationAction(action)) return null;
-    const role = await this.resolveRole(action.actorId);
-    if (role !== 'admin') return null;
-
-    const approval: RuntimeTerminationApproval = {
-      approvalId: randomUUID(),
-      actionDigest: this.runtimeActionDigest(action),
-      ...action,
-      expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(),
-    };
-    await this.redis.set(
-      this.runtimeKey(action.agentName, approval.approvalId),
-      JSON.stringify(approval),
-      'EX',
-      '300',
-    );
-    return approval;
-  }
-
-  async consumeRuntimeTerminationApproval(
-    approvalId: string,
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<boolean> {
-    const encoded = await this.redis.get(this.runtimeKey(action.agentName, approvalId));
-    if (!encoded) return false;
-    let approval: unknown;
-    try {
-      approval = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isRuntimeTerminationApproval(approval) ||
-      approval.actionDigest !== this.runtimeActionDigest(action) ||
-      approval.actorId !== action.actorId ||
-      approval.tenantId !== action.tenantId ||
-      !this.isUnexpired(approval.expiresAt)
-    ) {
-      return false;
-    }
-    if ((await this.resolveRole(approval.actorId)) !== 'admin') return false;
-    return (await this.redis.del(this.runtimeKey(action.agentName, approvalId))) === 1;
-  }
-
-  private async resolveRole(actorId: string): Promise<CommandRole | null> {
-    const [user] = await this.db
-      .select({ role: usersTable.role })
-      .from(usersTable)
-      .where(eq(usersTable.id, actorId))
-      .limit(1);
-    const role = user?.role;
-    return role === 'admin' || role === 'member' || role === 'viewer' ? role : null;
-  }
-
-  private hasScope(role: CommandRole, scope: CommandDef['scope']): boolean {
-    if (role === 'admin') return true;
-    return role === 'member' && (scope === 'core' || scope === 'agent');
-  }
-
-  private async consumeApproval(
-    approvalId: string,
-    actorId: string,
-    actionDigest: string,
-  ): Promise<boolean> {
-    const key = this.key(approvalId);
-    const encoded = await this.redis.get(key);
-    if (!encoded) return false;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isCommandApproval(parsed) ||
-      parsed.actorId !== actorId ||
-      parsed.actionDigest !== actionDigest ||
-      !this.isUnexpired(parsed.expiresAt)
-    )
-      return false;
-    return (await this.redis.del(key)) === 1;
-  }
-
-  private actionDigest(command: string, payload: SlashCommandPayload): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          command,
-          args: payload.args?.trim() ?? '',
-          conversationId: payload.conversationId,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private hasRuntimeTerminationAction(action: RuntimeTerminationApprovalAction): boolean {
-    return [
-      action.providerId,
-      action.sessionId,
-      action.actorId,
-      action.tenantId,
-      action.channelId,
-      action.correlationId,
-      action.agentName,
-    ].every((value: string): boolean => value.trim().length > 0);
-  }
-
-  private runtimeActionDigest(action: RuntimeTerminationApprovalAction): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          providerId: action.providerId,
-          sessionId: action.sessionId,
-          actorId: action.actorId,
-          tenantId: action.tenantId,
-          channelId: action.channelId,
-          correlationId: action.correlationId,
-          agentName: action.agentName,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private isUnexpired(expiresAt: unknown): expiresAt is string {
-    if (typeof expiresAt !== 'string') return false;
-    const expiresAtMs = Date.parse(expiresAt);
-    return Number.isFinite(expiresAtMs) && expiresAtMs > Date.now();
-  }
-
-  private isCommandApproval(value: unknown): value is CommandApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'expiresAt' in value &&
-      'command' in value
-    );
-  }
-
-  private isRuntimeTerminationApproval(value: unknown): value is RuntimeTerminationApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'tenantId' in value &&
-      'providerId' in value &&
-      'sessionId' in value &&
-      'channelId' in value &&
-      'correlationId' in value &&
-      'agentName' in value &&
-      'expiresAt' in value
-    );
-  }
-
-  private key(approvalId: string): string {
-    return `interaction:command-approval:${approvalId}`;
-  }
-
-  private runtimeKey(agentName: string, approvalId: string): string {
-    return `agent:${encodeURIComponent(agentName)}:command-approval:${approvalId}`;
-  }
-}

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -89,7 +89,6 @@ function buildService(): CommandExecutorService {
 describe('CommandExecutorService — P8-012 commands', () => {
   let service: CommandExecutorService;
   const userId = 'user-123';
-  const userScope = { userId, tenantId: userId };
   const conversationId = 'conv-456';
 
   beforeEach(() => {
@@ -100,26 +99,31 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /provider login — missing provider name
   it('/provider login with no provider name returns usage error', async () => {
     const payload: SlashCommandPayload = { command: 'provider', args: 'login', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(false);
     expect(result.message).toContain('Usage: /provider login');
     expect(result.command).toBe('provider');
   });
 
-  // /provider login anthropic — no bearer token or auth URL reaches chat output
-  it('/provider login <name> keeps its one-time token out of chat output', async () => {
+  // /provider login anthropic — success with URL containing poll token
+  it('/provider login <name> returns success with URL and poll token', async () => {
     const payload: SlashCommandPayload = {
       command: 'provider',
       args: 'login anthropic',
       conversationId,
     };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('provider');
     expect(result.message).toContain('anthropic');
-    expect(result.message).not.toContain('http');
-    expect(result.message).not.toContain('token=');
-    expect(result.data).toEqual({ provider: 'anthropic' });
+    expect(result.message).toContain('http');
+    // data should contain loginUrl and pollToken
+    expect(result.data).toBeDefined();
+    const data = result.data as Record<string, unknown>;
+    expect(typeof data['loginUrl']).toBe('string');
+    expect(typeof data['pollToken']).toBe('string');
+    expect(data['loginUrl'] as string).toContain('anthropic');
+    expect(data['loginUrl'] as string).toContain(data['pollToken'] as string);
     // Verify Valkey was called
     expect(mockRedis.set).toHaveBeenCalledOnce();
     const [key, value, , ttl] = mockRedis.set.mock.calls[0] as [string, string, string, number];
@@ -134,7 +138,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /provider with no args — returns usage
   it('/provider with no args returns usage message', async () => {
     const payload: SlashCommandPayload = { command: 'provider', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('Usage: /provider');
   });
@@ -142,7 +146,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /provider list
   it('/provider list returns success', async () => {
     const payload: SlashCommandPayload = { command: 'provider', args: 'list', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('provider');
   });
@@ -150,7 +154,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /provider logout with no name — usage error
   it('/provider logout with no name returns error', async () => {
     const payload: SlashCommandPayload = { command: 'provider', args: 'logout', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(false);
     expect(result.message).toContain('Usage: /provider logout');
   });
@@ -162,7 +166,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
       args: 'unknown',
       conversationId,
     };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(false);
     expect(result.message).toContain('Unknown subcommand');
   });
@@ -170,7 +174,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /mission status
   it('/mission status returns stub message', async () => {
     const payload: SlashCommandPayload = { command: 'mission', args: 'status', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('mission');
     expect(result.message).toContain('Mission status');
@@ -179,7 +183,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /mission with no args
   it('/mission with no args returns status stub', async () => {
     const payload: SlashCommandPayload = { command: 'mission', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('Mission status');
   });
@@ -191,7 +195,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
       args: 'set my-mission-123',
       conversationId,
     };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('my-mission-123');
   });
@@ -199,7 +203,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /agent list
   it('/agent list returns stub message', async () => {
     const payload: SlashCommandPayload = { command: 'agent', args: 'list', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('agent');
     expect(result.message).toContain('agent');
@@ -208,7 +212,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /agent with no args
   it('/agent with no args returns usage', async () => {
     const payload: SlashCommandPayload = { command: 'agent', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('Usage: /agent');
   });
@@ -220,7 +224,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
       args: 'my-agent-id',
       conversationId,
     };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('my-agent-id');
   });
@@ -228,7 +232,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /prdy
   it('/prdy returns PRD wizard message', async () => {
     const payload: SlashCommandPayload = { command: 'prdy', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('prdy');
     expect(result.message).toContain('mosaic prdy');
@@ -237,7 +241,7 @@ describe('CommandExecutorService — P8-012 commands', () => {
   // /tools
   it('/tools returns tools stub message', async () => {
     const payload: SlashCommandPayload = { command: 'tools', conversationId };
-    const result = await service.execute(payload, userScope);
+    const result = await service.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('tools');
     expect(result.message).toContain('tools');

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -1,112 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-import { CommandExecutorService } from './command-executor.service.js';
-
-const registry = {
-  getManifest: vi.fn(() => ({
-    version: 1,
-    commands: [
-      {
-        name: 'gc',
-        description: 'System-wide garbage collection',
-        aliases: [],
-        scope: 'admin' as const,
-        execution: 'socket' as const,
-        available: true,
-      },
-    ],
-    skills: [],
-  })),
-};
-
-const sessionGc = {
-  sweepOrphans: vi.fn().mockResolvedValue({ orphanedSessions: 1, totalCleaned: [], duration: 1 }),
-};
-
-const scope = (userId: string) => ({ userId, tenantId: 'tenant-1' });
-
-const authorization = {
-  authorize: vi.fn((_command: unknown, _payload: unknown, actorId: string) =>
-    Promise.resolve(
-      actorId === 'member-1'
-        ? { allowed: false, reason: 'durable approval is required' }
-        : { allowed: false, reason: 'not authorized for this command scope' },
-    ),
-  ),
-};
-
-function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
-  return new CommandExecutorService(
-    registry as never,
-    { getSession: vi.fn() } as never,
-    { clear: vi.fn(), set: vi.fn() } as never,
-    sessionGc as never,
-    { set: vi.fn() } as never,
-    { agents: {} } as never,
-    null,
-    null,
-    null,
-    authorizationService as never,
-  );
-}
-
-function createDurableAuthorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
-  const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-  beforeEach((): void => {
-    vi.clearAllMocks();
-  });
-
-  it('denies a forged admin identity and does not execute a system-wide command', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('admin-forged-by-client'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('not authorized');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('denies a privileged command without a server-bound durable approval', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('member-1'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('approval');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('executes an admin command only after a valid durable approval is issued and supplied', async (): Promise<void> => {
-    const executor = buildExecutor(createDurableAuthorization());
-
-    const adminScope = scope('admin-1');
-    const denied = await executor.execute(payload, adminScope);
-    const approval = await executor.createApproval(payload, adminScope);
-    const approved = await executor.execute(
-      { ...payload, approvalId: approval?.approvalId },
-      adminScope,
-    );
-
-    expect(denied.success).toBe(false);
-    expect(denied.message).toContain('approval');
-    expect(approval).not.toBeNull();
-    // A valid durable approval is consumed, but cannot authorize an unimplemented
-    // global retention operation. Session-scoped cleanup remains lifecycle-only.
-    expect(approved.success).toBe(false);
-    expect(approved.message).toContain('Global GC is disabled');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/commands/command-executor.service.ts

@@ -3,7 +3,6 @@ import type { QueueHandle } from '@mosaicstack/queue';
 import type { Brain } from '@mosaicstack/brain';
 import type { SlashCommandPayload, SlashCommandResultPayload } from '@mosaicstack/types';
 import { AgentService } from '../agent/agent.service.js';
-import type { ActorTenantScope } from '../auth/session-scope.js';
 import { ChatGateway } from '../chat/chat.gateway.js';
 import { SessionGCService } from '../gc/session-gc.service.js';
 import { SystemOverrideService } from '../preferences/system-override.service.js';
@@ -11,7 +10,6 @@ import { ReloadService } from '../reload/reload.service.js';
 import { McpClientService } from '../mcp-client/mcp-client.service.js';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
 
 @Injectable()
@@ -34,17 +32,10 @@ export class CommandExecutorService {
     @Optional()
     @Inject(McpClientService)
     private readonly mcpClient: McpClientService | null,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService | null = null,
   ) {}
 
-  async execute(
-    payload: SlashCommandPayload,
-    scope: ActorTenantScope,
-  ): Promise<SlashCommandResultPayload> {
+  async execute(payload: SlashCommandPayload, userId: string): Promise<SlashCommandResultPayload> {
     const { command, args, conversationId } = payload;
-    const userId = scope.userId;
 
     const def = this.registry.getManifest().commands.find((c) => c.name === command);
     if (!def) {
@@ -56,24 +47,14 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization?.authorize(
-      def,
-      payload,
-      userId,
-      payload.approvalId,
-    );
-    if (authorization && !authorization.allowed) {
-      return { command, conversationId, success: false, message: authorization.reason };
-    }
-
     try {
       switch (command) {
         case 'model':
-          return await this.handleModel(args ?? null, conversationId, scope);
+          return await this.handleModel(args ?? null, conversationId);
         case 'thinking':
           return await this.handleThinking(args ?? null, conversationId);
         case 'system':
-          return await this.handleSystem(args ?? null, conversationId, scope);
+          return await this.handleSystem(args ?? null, conversationId);
         case 'new':
           return {
             command,
@@ -102,17 +83,18 @@ export class CommandExecutorService {
             success: true,
             message: 'Retry last message requested.',
           };
-        case 'gc':
-          // Global retention requires a separate, authorized and audited job.
-          // Session cleanup is performed only through the session lifecycle.
+        case 'gc': {
+          // Admin-only: system-wide GC sweep across all sessions
+          const result = await this.sessionGC.sweepOrphans();
           return {
             command: 'gc',
-            success: false,
-            message: 'Global GC is disabled pending an authorized retention job.',
+            success: true,
+            message: `GC sweep complete: ${result.orphanedSessions} orphaned sessions cleaned in ${result.duration}ms.`,
             conversationId,
           };
+        }
         case 'agent':
-          return await this.handleAgent(args ?? null, conversationId, scope);
+          return await this.handleAgent(args ?? null, conversationId, userId);
         case 'provider':
           return await this.handleProvider(args ?? null, userId, conversationId);
         case 'mission':
@@ -161,22 +143,13 @@ export class CommandExecutorService {
     }
   }
 
-  async createApproval(payload: SlashCommandPayload, scope: ActorTenantScope) {
-    const def = this.registry
-      .getManifest()
-      .commands.find((command) => command.name === payload.command);
-    if (!def || !this.authorization) return null;
-    return this.authorization.createApproval(def, payload, scope.userId);
-  }
-
   private async handleModel(
     args: string | null,
     conversationId: string,
-    scope: ActorTenantScope,
   ): Promise<SlashCommandResultPayload> {
     if (!args || args.trim().length === 0) {
       // Show current override or usage hint
-      const currentOverride = this.chatGateway?.getModelOverride(conversationId, scope);
+      const currentOverride = this.chatGateway?.getModelOverride(conversationId);
       if (currentOverride) {
         return {
           command: 'model',
@@ -198,7 +171,7 @@ export class CommandExecutorService {
 
     // /model clear removes the override and re-enables automatic routing
     if (modelName === 'clear') {
-      this.chatGateway?.setModelOverride(conversationId, null, scope);
+      this.chatGateway?.setModelOverride(conversationId, null);
       return {
         command: 'model',
         conversationId,
@@ -208,9 +181,9 @@ export class CommandExecutorService {
     }
 
     // Set the sticky per-session override (M4-007)
-    this.chatGateway?.setModelOverride(conversationId, modelName, scope);
+    this.chatGateway?.setModelOverride(conversationId, modelName);
 
-    const session = this.agentService.getSession(conversationId, scope);
+    const session = this.agentService.getSession(conversationId);
     if (!session) {
       return {
         command: 'model',
@@ -251,11 +224,10 @@ export class CommandExecutorService {
   private async handleSystem(
     args: string | null,
     conversationId: string,
-    scope: ActorTenantScope,
   ): Promise<SlashCommandResultPayload> {
     if (!args || args.trim().length === 0) {
       // Clear the override when called with no args
-      await this.systemOverride.clear(conversationId, scope);
+      await this.systemOverride.clear(conversationId);
       return {
         command: 'system',
         conversationId,
@@ -264,7 +236,7 @@ export class CommandExecutorService {
       };
     }
 
-    await this.systemOverride.set(conversationId, args.trim(), scope);
+    await this.systemOverride.set(conversationId, args.trim());
     return {
       command: 'system',
       conversationId,
@@ -276,9 +248,8 @@ export class CommandExecutorService {
   private async handleAgent(
     args: string | null,
     conversationId: string,
-    scope: ActorTenantScope,
+    userId: string,
   ): Promise<SlashCommandResultPayload> {
-    const userId = scope.userId;
     if (!args) {
       return {
         command: 'agent',
@@ -367,14 +338,11 @@ export class CommandExecutorService {
         conversationId,
         agentConfig.id,
         agentConfig.name,
-        scope,
         agentConfig.model ?? undefined,
       );
 
       // Broadcast updated session:info so TUI TopBar reflects new agent/model
-      this.chatGateway?.broadcastSessionInfo(conversationId, scope, {
-        agentName: agentConfig.name,
-      });
+      this.chatGateway?.broadcastSessionInfo(conversationId, { agentName: agentConfig.name });
 
       this.logger.log(
         `Agent switched to "${agentConfig.name}" (${agentConfig.id}) for conversation ${conversationId} (M5-003)`,
@@ -435,28 +403,22 @@ export class CommandExecutorService {
           };
         }
         const pollToken = crypto.randomUUID();
-        const tokenDigest = await crypto.subtle.digest(
-          'SHA-256',
-          new TextEncoder().encode(pollToken),
-        );
-        const tokenHash = Array.from(new Uint8Array(tokenDigest), (byte: number): string =>
-          byte.toString(16).padStart(2, '0'),
-        ).join('');
-        const key = `mosaic:auth:poll:${tokenHash}`;
-        // Persist only a short-lived token digest. The raw token is delivered only by
-        // the authenticated dashboard flow, never in chat output or command metadata.
+        const key = `mosaic:auth:poll:${pollToken}`;
+        // Store pending state in Valkey (TTL 5 minutes)
         await this.redis.set(
           key,
           JSON.stringify({ status: 'pending', provider: providerName, userId }),
           'EX',
           300,
         );
+        // In production this would construct an OAuth URL
+        const loginUrl = `${process.env['MOSAIC_BASE_URL'] ?? 'http://localhost:3000'}/auth/provider/${providerName}?token=${pollToken}`;
         return {
           command: 'provider',
           success: true,
-          message: `Provider login for ${providerName} is ready. Continue in the authenticated dashboard.`,
+          message: `Open this URL to authenticate with ${providerName}:\n${loginUrl}`,
           conversationId,
-          data: { provider: providerName },
+          data: { loginUrl, pollToken, provider: providerName },
         };
       }
 

apps/gateway/src/commands/commands.integration.spec.ts

@@ -159,7 +159,6 @@ describe('CommandExecutorService — integration', () => {
   let registry: CommandRegistryService;
   let executor: CommandExecutorService;
   const userId = 'user-integ-001';
-  const userScope = { userId, tenantId: userId };
   const conversationId = 'conv-integ-001';
 
   beforeEach(() => {
@@ -171,26 +170,28 @@ describe('CommandExecutorService — integration', () => {
   // Unknown command returns error
   it('unknown command returns success:false with descriptive message', async () => {
     const payload: SlashCommandPayload = { command: 'nonexistent', conversationId };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(false);
     expect(result.message).toContain('nonexistent');
     expect(result.command).toBe('nonexistent');
   });
 
-  it('/gc refuses an unaudited global sweep', async () => {
+  // /gc handler calls SessionGCService.sweepOrphans (admin-only, no userId arg)
+  it('/gc calls SessionGCService.sweepOrphans without arguments', async () => {
     const payload: SlashCommandPayload = { command: 'gc', conversationId };
-    const result = await executor.execute(payload, userScope);
-    expect(mockSessionGC.sweepOrphans).not.toHaveBeenCalled();
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('disabled pending an authorized retention job');
+    const result = await executor.execute(payload, userId);
+    expect(mockSessionGC.sweepOrphans).toHaveBeenCalledWith();
+    expect(result.success).toBe(true);
+    expect(result.message).toContain('GC sweep complete');
+    expect(result.message).toContain('3 orphaned sessions');
   });
 
   // /system with args calls SystemOverrideService.set
   it('/system with text calls SystemOverrideService.set', async () => {
     const override = 'You are a helpful assistant.';
     const payload: SlashCommandPayload = { command: 'system', args: override, conversationId };
-    const result = await executor.execute(payload, userScope);
-    expect(mockSystemOverride.set).toHaveBeenCalledWith(conversationId, override, userScope);
+    const result = await executor.execute(payload, userId);
+    expect(mockSystemOverride.set).toHaveBeenCalledWith(conversationId, override);
     expect(result.success).toBe(true);
     expect(result.message).toContain('override set');
   });
@@ -198,8 +199,8 @@ describe('CommandExecutorService — integration', () => {
   // /system with no args clears the override
   it('/system with no args calls SystemOverrideService.clear', async () => {
     const payload: SlashCommandPayload = { command: 'system', conversationId };
-    const result = await executor.execute(payload, userScope);
-    expect(mockSystemOverride.clear).toHaveBeenCalledWith(conversationId, userScope);
+    const result = await executor.execute(payload, userId);
+    expect(mockSystemOverride.clear).toHaveBeenCalledWith(conversationId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('cleared');
   });
@@ -211,7 +212,7 @@ describe('CommandExecutorService — integration', () => {
       args: 'claude-3-opus',
       conversationId,
     };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('model');
     expect(result.message).toContain('claude-3-opus');
@@ -220,7 +221,7 @@ describe('CommandExecutorService — integration', () => {
   // /thinking with valid level returns success
   it('/thinking with valid level returns success', async () => {
     const payload: SlashCommandPayload = { command: 'thinking', args: 'high', conversationId };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('high');
   });
@@ -228,7 +229,7 @@ describe('CommandExecutorService — integration', () => {
   // /thinking with invalid level returns usage message
   it('/thinking with invalid level returns usage message', async () => {
     const payload: SlashCommandPayload = { command: 'thinking', args: 'invalid', conversationId };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.message).toContain('Usage:');
   });
@@ -236,7 +237,7 @@ describe('CommandExecutorService — integration', () => {
   // /new command returns success
   it('/new returns success', async () => {
     const payload: SlashCommandPayload = { command: 'new', conversationId };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(true);
     expect(result.command).toBe('new');
   });
@@ -244,7 +245,7 @@ describe('CommandExecutorService — integration', () => {
   // /reload without reloadService returns failure
   it('/reload without ReloadService returns failure', async () => {
     const payload: SlashCommandPayload = { command: 'reload', conversationId };
-    const result = await executor.execute(payload, userScope);
+    const result = await executor.execute(payload, userId);
     expect(result.success).toBe(false);
     expect(result.message).toContain('ReloadService');
   });
@@ -254,7 +255,7 @@ describe('CommandExecutorService — integration', () => {
   for (const cmd of stubCommands) {
     it(`/${cmd} returns success (stub)`, async () => {
       const payload: SlashCommandPayload = { command: cmd, conversationId };
-      const result = await executor.execute(payload, userScope);
+      const result = await executor.execute(payload, userId);
       expect(result.success).toBe(true);
       expect(result.command).toBe(cmd);
     });

apps/gateway/src/commands/commands.module.ts

@@ -3,10 +3,8 @@ import { createQueue, type QueueHandle } from '@mosaicstack/queue';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
-import { CommandRuntimeApprovalVerifier } from './runtime-approval-verifier.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
 
 const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
@@ -26,16 +24,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
-    CommandExecutorService,
-  ],
-  exports: [
-    CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
     CommandExecutorService,
   ],
+  exports: [CommandRegistryService, CommandExecutorService],
 })
 export class CommandsModule implements OnApplicationShutdown {
   constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}

apps/gateway/src/commands/runtime-approval-verifier.ts

@@ -1,23 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import type {
-  RuntimeApprovalVerifier,
-  RuntimeTerminationAction,
-} from '../agent/runtime-provider-registry.service.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-/**
- * Adapter from the provider registry's exact termination action to the shared,
- * Redis-backed `interaction:command-approval:*` store. It has no separate approval
- * persistence or replay semantics.
- */
-@Injectable()
-export class CommandRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  constructor(
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService,
-  ) {}
-
-  async consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean> {
-    return this.authorization.consumeRuntimeTerminationApproval(approvalRef, action);
-  }
-}

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -3,7 +3,6 @@ import { Logger } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { SessionGCService } from './session-gc.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 
 type MockRedis = {
   scan: ReturnType<typeof vi.fn>;
@@ -13,12 +12,7 @@ type MockRedis = {
 describe('SessionGCService', () => {
   let service: SessionGCService;
   let mockRedis: MockRedis;
-  let mockLogService: {
-    logs: {
-      promoteSessionToWarm: ReturnType<typeof vi.fn>;
-      promoteToWarm: ReturnType<typeof vi.fn>;
-    };
-  };
+  let mockLogService: { logs: { promoteToWarm: ReturnType<typeof vi.fn> } };
 
   /**
    * Helper: build a scan mock that returns all provided keys in a single
@@ -36,7 +30,6 @@ describe('SessionGCService', () => {
 
     mockLogService = {
       logs: {
-        promoteSessionToWarm: vi.fn().mockResolvedValue(0),
         promoteToWarm: vi.fn().mockResolvedValue(0),
       },
     };
@@ -66,76 +59,54 @@ describe('SessionGCService', () => {
     expect(result.cleaned.valkeyKeys).toBeUndefined();
   });
 
-  it('escapes glob metacharacters in a session identifier', async () => {
-    await service.collect('abc*?[tenant]\\escape');
-
-    expect(mockRedis.scan).toHaveBeenCalledWith(
-      '0',
-      'MATCH',
-      'mosaic:session:abc\\*\\?\\[tenant\\]\\\\escape:*',
-      'COUNT',
-      100,
-    );
-  });
-
-  it('preserves a valid durable approval after session GC', async () => {
-    const entries = new Map<string, string>();
-    const redis = {
-      scan: vi.fn().mockResolvedValue(['0', ['mosaic:session:owned:state']]),
-      get: vi.fn(async (key: string) => entries.get(key) ?? null),
-      set: vi.fn(async (key: string, value: string) => entries.set(key, value)),
-      del: vi.fn(async (...keys: string[]) => {
-        let deleted = 0;
-        for (const key of keys) deleted += Number(entries.delete(key));
-        return deleted;
-      }),
-    };
-    const authorization = new CommandAuthorizationService(
-      {
-        select: () => ({
-          from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-        }),
-      } as never,
-      redis,
-    );
-    const command = {
-      name: 'gc',
-      description: 'System-wide garbage collection',
-      aliases: [],
-      scope: 'admin',
-      execution: 'socket',
-      available: true,
-    } as never;
-    const payload = { command: 'gc', conversationId: 'owned' };
-    const approval = await authorization.createApproval(command, payload, 'admin-1');
-    const approvalKey = `interaction:command-approval:${approval!.approvalId}`;
-    const gc = new SessionGCService(redis as never, mockLogService as unknown as LogService);
-
-    await gc.collect('owned');
-
-    expect(entries.has(approvalKey)).toBe(true);
-    await expect(
-      authorization.authorize(command, payload, 'admin-1', approval!.approvalId),
-    ).resolves.toEqual({ allowed: true });
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');
   });
 
-  it('collect() demotes logs only for the requested session', async () => {
-    await service.collect('owned-session');
-
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
-      'owned-session',
-      expect.any(Date),
-    );
-    expect(mockLogService.logs.promoteToWarm).not.toHaveBeenCalled();
+  it('fullCollect() deletes all session keys', async () => {
+    mockRedis.scan = makeScanMock(['mosaic:session:abc:system', 'mosaic:session:xyz:foo']);
+    const result = await service.fullCollect();
+    expect(mockRedis.del).toHaveBeenCalled();
+    expect(result.valkeyKeys).toBe(2);
   });
 
-  it('does not expose automatic global GC entry points', () => {
-    expect('fullCollect' in service).toBe(false);
-    expect('sweepOrphans' in service).toBe(false);
+  it('fullCollect() with no keys returns 0 valkeyKeys', async () => {
+    mockRedis.scan = makeScanMock([]);
+    const result = await service.fullCollect();
+    expect(result.valkeyKeys).toBe(0);
+    expect(mockRedis.del).not.toHaveBeenCalled();
+  });
+
+  it('fullCollect() returns duration', async () => {
+    const result = await service.fullCollect();
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() extracts unique session IDs and collects them', async () => {
+    // First scan call returns the global session list; subsequent calls return
+    // per-session keys during collect().
+    mockRedis.scan = vi
+      .fn()
+      .mockResolvedValueOnce([
+        '0',
+        ['mosaic:session:abc:system', 'mosaic:session:abc:messages', 'mosaic:session:xyz:system'],
+      ])
+      // collect('abc') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:abc:system', 'mosaic:session:abc:messages']])
+      // collect('xyz') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:xyz:system']]);
+    mockRedis.del.mockResolvedValue(1);
+
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBeGreaterThanOrEqual(0);
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() returns empty when no session keys', async () => {
+    mockRedis.scan = makeScanMock([]);
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBe(0);
+    expect(result.totalCleaned).toHaveLength(0);
   });
 });

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -13,18 +13,49 @@ export interface GCResult {
   };
 }
 
-/** Escape Redis glob metacharacters so a session identifier is always literal. */
-function escapeRedisGlobLiteral(value: string): string {
-  return value.replace(/[\\*?\[\]]/g, '\\$&');
+export interface GCSweepResult {
+  orphanedSessions: number;
+  totalCleaned: GCResult[];
+  duration: number;
+}
+
+export interface FullGCResult {
+  valkeyKeys: number;
+  logsDemoted: number;
+  jobsPurged: number;
+  tempFilesRemoved: number;
+  duration: number;
 }
 
 @Injectable()
-export class SessionGCService {
+export class SessionGCService implements OnModuleInit {
+  private readonly logger = new Logger(SessionGCService.name);
+
   constructor(
     @Inject(REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
+  onModuleInit(): void {
+    // Fire-and-forget: run full GC asynchronously so it does not block the
+    // NestJS bootstrap chain.  Cold-start GC typically takes 100–500 ms
+    // depending on Valkey key count; deferring it removes that latency from
+    // the TTFB of the first HTTP request.
+    this.fullCollect()
+      .then((result) => {
+        this.logger.log(
+          `Full GC complete: ${result.valkeyKeys} Valkey keys, ` +
+            `${result.logsDemoted} logs demoted, ` +
+            `${result.jobsPurged} jobs purged, ` +
+            `${result.tempFilesRemoved} temp dirs removed ` +
+            `(${result.duration}ms)`,
+        );
+      })
+      .catch((err: unknown) => {
+        this.logger.error('Cold-start GC failed', err instanceof Error ? err.stack : String(err));
+      });
+  }
+
   /**
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
@@ -48,20 +79,86 @@ export class SessionGCService {
     const result: GCResult = { sessionId, cleaned: {} };
 
     // 1. Valkey: delete all session-scoped keys
-    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
+    const pattern = `mosaic:session:${sessionId}:*`;
     const valkeyKeys = await this.scanKeys(pattern);
     if (valkeyKeys.length > 0) {
       await this.redis.del(...valkeyKeys);
       result.cleaned.valkeyKeys = valkeyKeys.length;
     }
 
-    // 2. PG: demote hot-tier agent logs for this session only.
-    const cutoff = new Date();
-    const logsDemoted = await this.logService.logs.promoteSessionToWarm(sessionId, cutoff);
+    // 2. PG: demote hot-tier agent_logs for this session to warm
+    const cutoff = new Date(); // demote all hot logs for this session
+    const logsDemoted = await this.logService.logs.promoteToWarm(cutoff);
     if (logsDemoted > 0) {
       result.cleaned.logsDemoted = logsDemoted;
     }
 
     return result;
   }
+
+  /**
+   * Sweep GC — find orphaned artifacts from dead sessions.
+   * System-wide operation: only call from admin-authorized paths or internal
+   * scheduled jobs.  Individual session cleanup is handled by collect().
+   */
+  async sweepOrphans(): Promise<GCSweepResult> {
+    const start = Date.now();
+    const cleaned: GCResult[] = [];
+
+    // 1. Find all session-scoped Valkey keys (non-blocking SCAN)
+    const allSessionKeys = await this.scanKeys('mosaic:session:*');
+
+    // Extract unique session IDs from keys
+    const sessionIds = new Set<string>();
+    for (const key of allSessionKeys) {
+      const match = key.match(/^mosaic:session:([^:]+):/);
+      if (match) sessionIds.add(match[1]!);
+    }
+
+    // 2. For each session ID, collect stale keys
+    for (const sessionId of sessionIds) {
+      const gcResult = await this.collect(sessionId);
+      if (Object.keys(gcResult.cleaned).length > 0) {
+        cleaned.push(gcResult);
+      }
+    }
+
+    return {
+      orphanedSessions: cleaned.length,
+      totalCleaned: cleaned,
+      duration: Date.now() - start,
+    };
+  }
+
+  /**
+   * Full GC — aggressive collection for cold start.
+   * Assumes no sessions survived the restart.
+   */
+  async fullCollect(): Promise<FullGCResult> {
+    const start = Date.now();
+
+    // 1. Valkey: delete ALL session-scoped keys (non-blocking SCAN)
+    const sessionKeys = await this.scanKeys('mosaic:session:*');
+    if (sessionKeys.length > 0) {
+      await this.redis.del(...sessionKeys);
+    }
+
+    // 2. NOTE: channel keys are NOT collected on cold start
+    //    (discord/telegram plugins may reconnect and resume)
+
+    // 3. PG: demote stale hot-tier logs older than 24h to warm
+    const hotCutoff = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const logsDemoted = await this.logService.logs.promoteToWarm(hotCutoff);
+
+    // 4. No summarization job purge API available yet
+    const jobsPurged = 0;
+
+    return {
+      valkeyKeys: sessionKeys.length,
+      logsDemoted,
+      jobsPurged,
+      tempFilesRemoved: 0,
+      duration: Date.now() - start,
+    };
+  }
 }

apps/gateway/src/health/health.controller.test.ts

@@ -1,12 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { HealthController } from './health.controller.js';
-
-describe('HealthController', (): void => {
-  it('exposes liveness and readiness without configuration details', (): void => {
-    const controller = new HealthController();
-
-    expect(controller.check()).toEqual({ status: 'ok' });
-    expect(controller.ready()).toEqual({ status: 'ready' });
-    expect(JSON.stringify(controller.ready())).not.toContain('credential');
-  });
-});

apps/gateway/src/health/health.controller.ts

@@ -6,10 +6,4 @@ export class HealthController {
   check(): { status: string } {
     return { status: 'ok' };
   }
-
-  /** Readiness intentionally exposes no configuration, provider, or credential details. */
-  @Get('ready')
-  ready(): { status: string } {
-    return { status: 'ready' };
-  }
 }

apps/gateway/src/log/cron.service.ts

@@ -6,10 +6,11 @@ import {
   type OnModuleDestroy,
 } from '@nestjs/common';
 import { SummarizationService } from './summarization.service.js';
+import { SessionGCService } from '../gc/session-gc.service.js';
 import {
   QueueService,
-  QUEUE_GC,
   QUEUE_SUMMARIZATION,
+  QUEUE_GC,
   QUEUE_TIER_MANAGEMENT,
 } from '../queue/queue.service.js';
 import type { Worker } from 'bullmq';
@@ -22,12 +23,14 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
 
   constructor(
     @Inject(SummarizationService) private readonly summarization: SummarizationService,
+    @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
     @Inject(QueueService) private readonly queueService: QueueService,
   ) {}
 
   async onModuleInit(): Promise<void> {
     const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
     const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
+    const gcSchedule = process.env['SESSION_GC_CRON'] ?? '0 4 * * *'; // daily at 4am
 
     // M6-003: Summarization repeatable job
     await this.queueService.addRepeatableJob(
@@ -53,12 +56,15 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     });
     this.registeredWorkers.push(tierWorker);
 
-    // Retire any repeatable global GC schedule created by older deployments.
-    // Session cleanup is now triggered only by an authorized session lifecycle operation.
-    await this.queueService.removeRepeatableJobs(QUEUE_GC, 'session-gc');
+    // M6-004: GC repeatable job
+    await this.queueService.addRepeatableJob(QUEUE_GC, 'session-gc', {}, gcSchedule);
+    const gcWorker = this.queueService.registerWorker(QUEUE_GC, async () => {
+      await this.sessionGC.sweepOrphans();
+    });
+    this.registeredWorkers.push(gcWorker);
 
     this.logger.log(
-      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}"`,
+      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}", gc="${gcSchedule}"`,
     );
   }
 

apps/gateway/src/mcp/mcp.controller.ts

@@ -3,11 +3,7 @@ import { Logger } from '@nestjs/common';
 import { fromNodeHeaders } from 'better-auth/node';
 import type { Auth } from '@mosaicstack/auth';
 import type { NestFastifyApplication } from '@nestjs/platform-fastify';
-import {
-  createMcpActorContext,
-  deriveMcpToolScopesForUser,
-  type McpService,
-} from './mcp.service.js';
+import type { McpService } from './mcp.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
 
 /**
@@ -71,25 +67,14 @@ async function handleMcpRequest(
     return;
   }
 
-  const authUser = result.user as {
-    id: string;
-    role?: string | null;
-    tenantId?: string | null;
-    organizationId?: string | null;
-  };
-  const actor = createMcpActorContext({
-    userId: authUser.id,
-    role: authUser.role,
-    tenantId: authUser.tenantId ?? authUser.organizationId ?? undefined,
-    scopes: deriveMcpToolScopesForUser({ role: authUser.role }),
-  });
+  const userId = result.user.id;
 
   // ─── Session routing ─────────────────────────────────────────────────────
   const sessionId = req.raw.headers['mcp-session-id'];
 
   if (typeof sessionId === 'string' && sessionId.length > 0) {
     // Existing session request
-    const transport = mcpService.getSession(sessionId, actor);
+    const transport = mcpService.getSession(sessionId);
     if (!transport) {
       logger.warn(`MCP session not found: ${sessionId}`);
       reply.raw.writeHead(404, { 'Content-Type': 'application/json' });
@@ -127,10 +112,8 @@ async function handleMcpRequest(
   }
 
   // Create new session and handle this initializing request
-  const { transport } = mcpService.createSession(actor);
-  logger.log(
-    `New MCP session created for actor=${actor.userId} tenant=${actor.tenantId} correlation=${actor.correlationId}`,
-  );
+  const { transport } = mcpService.createSession(userId);
+  logger.log(`New MCP session created for user ${userId}`);
 
   await transport.handleRequest(req.raw, reply.raw, body);
 }

apps/gateway/src/mcp/mcp.service.spec.ts

@@ -1,461 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { z } from 'zod';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { Brain } from '@mosaicstack/brain';
-import type { Memory } from '@mosaicstack/memory';
-import type { EmbeddingService } from '../memory/embedding.service.js';
-import type { CoordService } from '../coord/coord.service.js';
-import {
-  assertMcpToolAuthorized,
-  createMcpActorContext,
-  deriveMcpToolScopesForUser,
-  MCP_TOOL_SCOPES,
-  McpService,
-  type McpToolName,
-} from './mcp.service.js';
-
-type ToolResult = { content: Array<{ type: 'text'; text: string }> };
-type ToolHandler = (params: Record<string, unknown>) => Promise<ToolResult>;
-
-interface CapturedTool {
-  inputSchema: z.ZodType;
-  handler: ToolHandler;
-}
-
-function makeCapturingServer(): { server: McpServer; tools: Map<string, CapturedTool> } {
-  const tools = new Map<string, CapturedTool>();
-  const server = {
-    registerTool(name: string, config: { inputSchema: z.ZodType }, handler: ToolHandler): void {
-      tools.set(name, { inputSchema: config.inputSchema, handler });
-    },
-  };
-  return { server: server as unknown as McpServer, tools };
-}
-
-function makeService(opts?: {
-  projects?: Array<Record<string, unknown> & { id: string; ownerId?: string | null }>;
-  missions?: Array<
-    Record<string, unknown> & { id: string; projectId?: string | null; userId?: string | null }
-  >;
-  tasks?: Array<
-    Record<string, unknown> & {
-      id: string;
-      projectId?: string | null;
-      missionId?: string | null;
-      status?: string;
-    }
-  >;
-}) {
-  const projects = opts?.projects ?? [];
-  const missions = opts?.missions ?? [];
-  const tasks = opts?.tasks ?? [];
-  const brain = {
-    projects: {
-      findAll: vi.fn(async () => projects),
-      findById: vi.fn(async (id: string) => projects.find((project) => project.id === id) ?? null),
-    },
-    tasks: {
-      findAll: vi.fn(async () => tasks),
-      findById: vi.fn(async (id: string) => tasks.find((task) => task.id === id) ?? null),
-      findByProject: vi.fn(async (projectId: string) =>
-        tasks.filter((task) => task.projectId === projectId),
-      ),
-      findByMission: vi.fn(async (missionId: string) =>
-        tasks.filter((task) => task.missionId === missionId),
-      ),
-      findByStatus: vi.fn(async (status: string) => tasks.filter((task) => task.status === status)),
-      create: vi.fn(async (task: Record<string, unknown>) => ({ id: 'task-1', ...task })),
-      update: vi.fn(async (id: string, updates: Record<string, unknown>) => ({ id, ...updates })),
-    },
-    missions: {
-      findAll: vi.fn(async () => missions),
-      findById: vi.fn(async (id: string) => missions.find((mission) => mission.id === id) ?? null),
-      findByProject: vi.fn(async (projectId: string) =>
-        missions.filter((mission) => mission.projectId === projectId),
-      ),
-    },
-    conversations: {
-      findAll: vi.fn(async (userId: string) => [{ id: 'conversation-1', userId }]),
-    },
-  } as unknown as Brain;
-
-  const memory = {
-    insights: {
-      searchByEmbedding: vi.fn(async (userId: string) => [{ id: 'insight-1', userId }]),
-      create: vi.fn(async (insight: Record<string, unknown>) => ({ id: 'insight-2', ...insight })),
-    },
-    preferences: {
-      findByUser: vi.fn(async (userId: string) => [{ key: 'theme', userId }]),
-      findByUserAndCategory: vi.fn(async (userId: string, category: string) => [
-        { key: 'theme', userId, category },
-      ]),
-      upsert: vi.fn(async (preference: Record<string, unknown>) => ({
-        id: 'pref-1',
-        ...preference,
-      })),
-    },
-  } as unknown as Memory;
-
-  const embeddings = {
-    available: true,
-    embed: vi.fn(async () => [0.1, 0.2, 0.3]),
-  } as unknown as EmbeddingService;
-
-  const coord = {
-    getMissionStatus: vi.fn(async () => null),
-    listTasks: vi.fn(async () => []),
-    getTaskStatus: vi.fn(async () => null),
-  } as unknown as CoordService;
-
-  return {
-    service: new McpService(brain, memory, embeddings, coord),
-    brain: brain as unknown as {
-      conversations: { findAll: ReturnType<typeof vi.fn> };
-      tasks: {
-        create: ReturnType<typeof vi.fn>;
-        update: ReturnType<typeof vi.fn>;
-      };
-    },
-    memory: memory as unknown as {
-      insights: { searchByEmbedding: ReturnType<typeof vi.fn> };
-    },
-    coord: coord as unknown as {
-      listTasks: ReturnType<typeof vi.fn>;
-    },
-  };
-}
-
-function getTool(tools: Map<string, CapturedTool>, name: McpToolName): CapturedTool {
-  const tool = tools.get(name);
-  if (!tool) throw new Error(`Missing captured tool ${name}`);
-  return tool;
-}
-
-function makeMemberActor(userId = 'authenticated-user') {
-  return createMcpActorContext({
-    userId,
-    role: 'member',
-    scopes: deriveMcpToolScopesForUser({ role: 'member' }),
-  });
-}
-
-function makeAdminActor(userId = 'admin-user', tenantId?: string) {
-  return createMcpActorContext({
-    userId,
-    tenantId,
-    role: 'admin',
-    scopes: deriveMcpToolScopesForUser({ role: 'admin' }),
-  });
-}
-
-function makePlatformAdminActor(userId = 'platform-admin-user') {
-  return createMcpActorContext({
-    userId,
-    role: 'platform-admin',
-    scopes: deriveMcpToolScopesForUser({ role: 'platform-admin' }),
-  });
-}
-
-describe('MCP actor identity and tool scope enforcement', () => {
-  it('derives immutable actor, tenant, channel, correlation, and explicit tool scopes server-side', () => {
-    const actor = createMcpActorContext({
-      userId: ' user-authenticated ',
-      role: 'member',
-      scopes: deriveMcpToolScopesForUser({ role: 'member' }),
-    });
-
-    expect(actor.userId).toBe('user-authenticated');
-    expect(actor.tenantId).toBe('user:user-authenticated');
-    expect(actor.role).toBe('member');
-    expect(actor.channel).toBe('mcp');
-    expect(actor.correlationId).toMatch(/[0-9a-f-]{36}/i);
-    expect(actor.scopes.has(MCP_TOOL_SCOPES.memory_search)).toBe(true);
-    expect(actor.scopes.has(MCP_TOOL_SCOPES.coord_list_tasks)).toBe(false);
-    expect(
-      deriveMcpToolScopesForUser({ role: 'admin' }).has(MCP_TOOL_SCOPES.coord_list_tasks),
-    ).toBe(false);
-    expect(
-      deriveMcpToolScopesForUser({ role: 'platform-admin' }).has(MCP_TOOL_SCOPES.coord_list_tasks),
-    ).toBe(true);
-  });
-
-  it('fails closed when scopes are not supplied by the authenticated context policy', () => {
-    const actor = createMcpActorContext({ userId: 'user-authenticated' });
-
-    expect(actor.scopes.size).toBe(0);
-    expect(() => assertMcpToolAuthorized(actor, 'memory_search', { query: 'notes' })).toThrow(
-      'MCP tool scope denied: memory:insight:read',
-    );
-  });
-
-  it('fails closed when a tool caller supplies actor or tenant identity fields', () => {
-    const actor = createMcpActorContext({ userId: 'user-authenticated' });
-
-    expect(() =>
-      assertMcpToolAuthorized(actor, 'memory_search', {
-        userId: 'victim-user',
-        query: 'private data',
-      }),
-    ).toThrow('MCP caller-controlled identity field is forbidden: userId');
-
-    expect(() =>
-      assertMcpToolAuthorized(actor, 'coord_list_tasks', {
-        tenantId: 'victim-tenant',
-        projectPath: '/tmp/project',
-      }),
-    ).toThrow('MCP caller-controlled identity field is forbidden: tenantId');
-
-    expect(() =>
-      assertMcpToolAuthorized(actor, 'brain_create_task', {
-        title: 'forged org',
-        organizationId: 'victim-org',
-      }),
-    ).toThrow('MCP caller-controlled identity field is forbidden: organizationId');
-
-    expect(() =>
-      assertMcpToolAuthorized(actor, 'brain_update_task', {
-        title: 'forged team',
-        teamId: 'victim-team',
-      }),
-    ).toThrow('MCP caller-controlled identity field is forbidden: teamId');
-  });
-
-  it('fails closed when the server-derived actor lacks the required per-tool scope', () => {
-    const actor = createMcpActorContext({ userId: 'user-authenticated', scopes: [] });
-
-    expect(() => assertMcpToolAuthorized(actor, 'memory_search', { query: 'notes' })).toThrow(
-      'MCP tool scope denied: memory:insight:read',
-    );
-  });
-
-  it('removes caller-controlled userId from memory schemas and never queries victim memory', async () => {
-    const { service, memory } = makeService();
-    const { server, tools } = makeCapturingServer();
-    const actor = makeMemberActor('authenticated-user');
-
-    service.registerTools(server, actor);
-    const tool = getTool(tools, 'memory_search');
-
-    expect(tool.inputSchema.safeParse({ userId: 'victim-user', query: 'anything' }).success).toBe(
-      false,
-    );
-    await expect(tool.handler({ userId: 'victim-user', query: 'anything' })).rejects.toThrow(
-      'MCP caller-controlled identity field is forbidden: userId',
-    );
-    expect(memory.insights.searchByEmbedding).not.toHaveBeenCalled();
-
-    await tool.handler({ query: 'only my notes' });
-    expect(memory.insights.searchByEmbedding).toHaveBeenCalledWith(
-      'authenticated-user',
-      [0.1, 0.2, 0.3],
-      5,
-    );
-  });
-
-  it('binds conversation listing to the authenticated actor instead of a caller-supplied userId', async () => {
-    const { service, brain } = makeService();
-    const { server, tools } = makeCapturingServer();
-    const actor = makeMemberActor('authenticated-user');
-
-    service.registerTools(server, actor);
-    const tool = getTool(tools, 'brain_list_conversations');
-
-    expect(tool.inputSchema.safeParse({ userId: 'victim-user' }).success).toBe(false);
-    await expect(tool.handler({ userId: 'victim-user' })).rejects.toThrow(
-      'MCP caller-controlled identity field is forbidden: userId',
-    );
-    expect(brain.conversations.findAll).not.toHaveBeenCalled();
-
-    await tool.handler({});
-    expect(brain.conversations.findAll).toHaveBeenCalledWith('authenticated-user');
-  });
-
-  it('scopes brain project, mission, and task reads to the authenticated actor', async () => {
-    const { service } = makeService({
-      projects: [
-        { id: 'project-owned', ownerId: 'authenticated-user', name: 'owned' },
-        { id: 'project-victim', ownerId: 'victim-user', name: 'victim' },
-      ],
-      missions: [
-        { id: 'mission-owned', projectId: 'project-owned' },
-        { id: 'mission-victim', userId: 'victim-user', projectId: 'project-victim' },
-      ],
-      tasks: [
-        { id: 'task-owned-project', projectId: 'project-owned', status: 'not-started' },
-        { id: 'task-owned-mission', missionId: 'mission-owned', status: 'not-started' },
-        { id: 'task-victim-project', projectId: 'project-victim', status: 'not-started' },
-        { id: 'task-unowned', status: 'not-started' },
-      ],
-    });
-    const { server, tools } = makeCapturingServer();
-    const actor = makeMemberActor('authenticated-user');
-
-    service.registerTools(server, actor);
-
-    const projects = JSON.parse(
-      (await getTool(tools, 'brain_list_projects').handler({})).content[0]!.text,
-    );
-    expect(projects.map((project: { id: string }) => project.id)).toEqual(['project-owned']);
-
-    const missions = JSON.parse(
-      (await getTool(tools, 'brain_list_missions').handler({})).content[0]!.text,
-    );
-    expect(missions.map((mission: { id: string }) => mission.id)).toEqual(['mission-owned']);
-
-    const tasks = JSON.parse(
-      (await getTool(tools, 'brain_list_tasks').handler({})).content[0]!.text,
-    );
-    expect(tasks.map((task: { id: string }) => task.id)).toEqual([
-      'task-owned-project',
-      'task-owned-mission',
-    ]);
-  });
-
-  it('enforces tenant boundaries for tenant-admin brain project, mission, and task reads', async () => {
-    const { service } = makeService({
-      projects: [
-        {
-          id: 'project-tenant-a',
-          ownerId: 'other-user-a',
-          teamId: 'tenant-a',
-          name: 'same tenant',
-        },
-        {
-          id: 'project-tenant-b',
-          ownerId: 'other-user-b',
-          teamId: 'tenant-b',
-          name: 'other tenant',
-        },
-      ],
-      missions: [
-        { id: 'mission-tenant-a', tenantId: 'tenant-a', projectId: 'project-tenant-a' },
-        { id: 'mission-tenant-b', tenantId: 'tenant-b', projectId: 'project-tenant-b' },
-      ],
-      tasks: [
-        { id: 'task-tenant-a', projectId: 'project-tenant-a', status: 'not-started' },
-        { id: 'task-tenant-b', projectId: 'project-tenant-b', status: 'not-started' },
-      ],
-    });
-    const { server, tools } = makeCapturingServer();
-    const actor = makeAdminActor('tenant-admin-user', 'tenant-a');
-
-    service.registerTools(server, actor);
-
-    const projects = JSON.parse(
-      (await getTool(tools, 'brain_list_projects').handler({})).content[0]!.text,
-    );
-    expect(projects.map((project: { id: string }) => project.id)).toEqual(['project-tenant-a']);
-
-    const missions = JSON.parse(
-      (await getTool(tools, 'brain_list_missions').handler({})).content[0]!.text,
-    );
-    expect(missions.map((mission: { id: string }) => mission.id)).toEqual(['mission-tenant-a']);
-
-    const tasks = JSON.parse(
-      (await getTool(tools, 'brain_list_tasks').handler({})).content[0]!.text,
-    );
-    expect(tasks.map((task: { id: string }) => task.id)).toEqual(['task-tenant-a']);
-  });
-
-  it('denies tenant-admin task writes outside the authenticated tenant', async () => {
-    const { service, brain } = makeService({
-      projects: [
-        { id: 'project-tenant-a', ownerId: 'other-user-a', teamId: 'tenant-a' },
-        { id: 'project-tenant-b', ownerId: 'other-user-b', teamId: 'tenant-b' },
-      ],
-      missions: [
-        { id: 'mission-tenant-a', tenantId: 'tenant-a', projectId: 'project-tenant-a' },
-        { id: 'mission-tenant-b', tenantId: 'tenant-b', projectId: 'project-tenant-b' },
-      ],
-      tasks: [
-        { id: 'task-tenant-a', projectId: 'project-tenant-a', status: 'not-started' },
-        { id: 'task-tenant-b', projectId: 'project-tenant-b', status: 'not-started' },
-      ],
-    });
-    const { server, tools } = makeCapturingServer();
-    const actor = makeAdminActor('tenant-admin-user', 'tenant-a');
-
-    service.registerTools(server, actor);
-
-    await expect(
-      getTool(tools, 'brain_create_task').handler({
-        title: 'unscoped tenant write',
-      }),
-    ).rejects.toThrow('MCP task scope denied');
-    expect(brain.tasks.create).not.toHaveBeenCalled();
-
-    await expect(
-      getTool(tools, 'brain_create_task').handler({
-        title: 'cross-tenant write',
-        projectId: 'project-tenant-b',
-      }),
-    ).rejects.toThrow('MCP task project scope denied');
-    expect(brain.tasks.create).not.toHaveBeenCalled();
-
-    await expect(
-      getTool(tools, 'brain_update_task').handler({
-        id: 'task-tenant-a',
-        projectId: 'project-tenant-b',
-      }),
-    ).rejects.toThrow('MCP task project scope denied');
-    expect(brain.tasks.update).not.toHaveBeenCalled();
-
-    const updateResult = await getTool(tools, 'brain_update_task').handler({
-      id: 'task-tenant-b',
-      title: 'cross-tenant update',
-    });
-    expect(updateResult.content[0]!.text).toBe('Task not found: task-tenant-b');
-    expect(brain.tasks.update).not.toHaveBeenCalled();
-
-    await getTool(tools, 'brain_create_task').handler({
-      title: 'same-tenant write',
-      projectId: 'project-tenant-a',
-    });
-    expect(brain.tasks.create).toHaveBeenCalledWith(
-      expect.objectContaining({ projectId: 'project-tenant-a', title: 'same-tenant write' }),
-    );
-  });
-
-  it('keeps admin-only coordination tools on server-derived paths', async () => {
-    const { service, coord } = makeService();
-    const { server, tools } = makeCapturingServer();
-    const member = makeMemberActor('authenticated-user');
-    const tenantAdmin = makeAdminActor('admin-user');
-    const platformAdmin = makePlatformAdminActor('platform-admin-user');
-
-    service.registerTools(server, member);
-    const memberTool = getTool(tools, 'coord_list_tasks');
-    expect(memberTool.inputSchema.safeParse({ projectPath: '/tmp/victim' }).success).toBe(false);
-    await expect(memberTool.handler({})).rejects.toThrow('MCP tool scope denied: coord:read');
-
-    tools.clear();
-    service.registerTools(server, tenantAdmin);
-    const tenantAdminTool = getTool(tools, 'coord_list_tasks');
-    await expect(tenantAdminTool.handler({})).rejects.toThrow('MCP tool scope denied: coord:read');
-
-    tools.clear();
-    service.registerTools(server, platformAdmin);
-    const platformAdminTool = getTool(tools, 'coord_list_tasks');
-    await platformAdminTool.handler({ projectPath: '/tmp/victim' });
-    expect(coord.listTasks).toHaveBeenCalledWith(process.cwd());
-  });
-
-  it('does not attach a guessed or stale-scope MCP session to another authenticated context', async () => {
-    const { service } = makeService();
-    const owner = makeMemberActor('owner-user');
-    const attacker = makeMemberActor('attacker-user');
-    const admin = makeAdminActor('admin-user');
-    const downgradedAdmin = makeMemberActor('admin-user');
-
-    const { sessionId, transport } = service.createSession(owner);
-    const staleSession = service.createSession(admin);
-
-    expect(service.getSession(sessionId, owner)).toBe(transport);
-    expect(service.getSession(sessionId, attacker)).toBeNull();
-    expect(service.getSession(sessionId, owner)).toBe(transport);
-    expect(service.getSession(staleSession.sessionId, downgradedAdmin)).toBeNull();
-    expect(service.getSession(staleSession.sessionId, admin)).toBe(staleSession.transport);
-
-    await service.onModuleDestroy();
-  });
-});

apps/gateway/src/mcp/mcp.service.ts

@@ -10,216 +10,11 @@ import { MEMORY } from '../memory/memory.tokens.js';
 import { EmbeddingService } from '../memory/embedding.service.js';
 import { CoordService } from '../coord/coord.service.js';
 
-export const MCP_CALLER_IDENTITY_FIELDS = [
-  'actorId',
-  'actor',
-  'authenticatedUserId',
-  'channel',
-  'organizationId',
-  'ownerId',
-  'sessionUserId',
-  'teamId',
-  'tenant',
-  'tenantId',
-  'user',
-  'userId',
-] as const;
-
-type McpCallerIdentityField = (typeof MCP_CALLER_IDENTITY_FIELDS)[number];
-
-export const MCP_TOOL_SCOPES = {
-  brain_list_projects: 'brain:project:read',
-  brain_get_project: 'brain:project:read',
-  brain_list_tasks: 'brain:task:read',
-  brain_create_task: 'brain:task:write',
-  brain_update_task: 'brain:task:write',
-  brain_list_missions: 'brain:mission:read',
-  brain_list_conversations: 'brain:conversation:read',
-  memory_search: 'memory:insight:read',
-  memory_get_preferences: 'memory:preference:read',
-  memory_save_preference: 'memory:preference:write',
-  memory_save_insight: 'memory:insight:write',
-  coord_mission_status: 'coord:read',
-  coord_list_tasks: 'coord:read',
-  coord_task_detail: 'coord:read',
-} as const;
-
-export type McpToolName = keyof typeof MCP_TOOL_SCOPES;
-export type McpToolScope = (typeof MCP_TOOL_SCOPES)[McpToolName];
-
-export interface McpActorContext {
-  userId: string;
-  tenantId: string;
-  role: string;
-  channel: 'mcp';
-  correlationId: string;
-  scopes: ReadonlySet<McpToolScope>;
-}
-
 interface SessionEntry {
   server: McpServer;
   transport: StreamableHTTPServerTransport;
   createdAt: Date;
-  actor: McpActorContext;
-}
-
-const GLOBAL_ADMIN_MCP_SCOPES = new Set<McpToolScope>(Object.values(MCP_TOOL_SCOPES));
-const TENANT_ADMIN_MCP_SCOPES = new Set<McpToolScope>([
-  MCP_TOOL_SCOPES.brain_list_projects,
-  MCP_TOOL_SCOPES.brain_get_project,
-  MCP_TOOL_SCOPES.brain_list_tasks,
-  MCP_TOOL_SCOPES.brain_create_task,
-  MCP_TOOL_SCOPES.brain_update_task,
-  MCP_TOOL_SCOPES.brain_list_missions,
-  MCP_TOOL_SCOPES.brain_list_conversations,
-  MCP_TOOL_SCOPES.memory_search,
-  MCP_TOOL_SCOPES.memory_get_preferences,
-  MCP_TOOL_SCOPES.memory_save_preference,
-  MCP_TOOL_SCOPES.memory_save_insight,
-]);
-const MEMBER_MCP_SCOPES = new Set<McpToolScope>([
-  MCP_TOOL_SCOPES.brain_list_projects,
-  MCP_TOOL_SCOPES.brain_get_project,
-  MCP_TOOL_SCOPES.brain_list_tasks,
-  MCP_TOOL_SCOPES.brain_list_missions,
-  MCP_TOOL_SCOPES.brain_list_conversations,
-  MCP_TOOL_SCOPES.memory_search,
-  MCP_TOOL_SCOPES.memory_get_preferences,
-  MCP_TOOL_SCOPES.memory_save_preference,
-  MCP_TOOL_SCOPES.memory_save_insight,
-]);
-
-export function deriveMcpToolScopesForUser(input: {
-  role?: string | null;
-}): ReadonlySet<McpToolScope> {
-  if (input.role === 'platform-admin' || input.role === 'super-admin') {
-    return new Set(GLOBAL_ADMIN_MCP_SCOPES);
-  }
-  if (input.role === 'admin') {
-    return new Set(TENANT_ADMIN_MCP_SCOPES);
-  }
-  return new Set(MEMBER_MCP_SCOPES);
-}
-
-export function createMcpActorContext(input: {
   userId: string;
-  tenantId?: string;
-  role?: string | null;
-  scopes?: Iterable<McpToolScope>;
-  correlationId?: string;
-}): McpActorContext {
-  const userId = input.userId.trim();
-  if (userId.length === 0) {
-    throw new Error('MCP authenticated user is required');
-  }
-
-  return {
-    userId,
-    tenantId: input.tenantId?.trim() || `user:${userId}`,
-    role: input.role ?? 'member',
-    channel: 'mcp',
-    correlationId: input.correlationId ?? randomUUID(),
-    scopes: new Set(input.scopes ?? []),
-  };
-}
-
-export function assertNoCallerControlledIdentity(params: unknown): void {
-  if (params === null || typeof params !== 'object') return;
-
-  const keys = new Set(Object.keys(params));
-  const forbidden = MCP_CALLER_IDENTITY_FIELDS.find((field: McpCallerIdentityField) =>
-    keys.has(field),
-  );
-  if (forbidden) {
-    throw new Error(`MCP caller-controlled identity field is forbidden: ${forbidden}`);
-  }
-}
-
-export function assertMcpToolAuthorized(
-  actor: McpActorContext,
-  toolName: McpToolName,
-  params: unknown,
-): void {
-  assertNoCallerControlledIdentity(params);
-  const requiredScope = MCP_TOOL_SCOPES[toolName];
-  if (!actor.scopes.has(requiredScope)) {
-    throw new Error(`MCP tool scope denied: ${requiredScope}`);
-  }
-}
-
-function strictObject<T extends z.ZodRawShape>(shape: T): z.ZodObject<T> {
-  return z.object(shape).strict();
-}
-
-type TenantScopedLike = {
-  tenantId?: string | null;
-  organizationId?: string | null;
-  teamId?: string | null;
-};
-type ProjectLike = TenantScopedLike & { id: string; ownerId?: string | null };
-type MissionLike = TenantScopedLike & {
-  id: string;
-  projectId?: string | null;
-  userId?: string | null;
-};
-type TaskLike = TenantScopedLike & {
-  projectId?: string | null;
-  missionId?: string | null;
-  userId?: string | null;
-};
-
-function isGlobalAdminActor(actor: McpActorContext): boolean {
-  return actor.role === 'platform-admin' || actor.role === 'super-admin';
-}
-
-function isTenantAdminActor(actor: McpActorContext): boolean {
-  return actor.role === 'admin';
-}
-
-function matchesTenant(actor: McpActorContext, record: TenantScopedLike): boolean {
-  return (
-    record.tenantId === actor.tenantId ||
-    record.organizationId === actor.tenantId ||
-    record.teamId === actor.tenantId
-  );
-}
-
-function filterProjectsForActor<T extends ProjectLike>(actor: McpActorContext, projects: T[]): T[] {
-  if (isGlobalAdminActor(actor)) return projects;
-  return projects.filter(
-    (project) =>
-      project.ownerId === actor.userId ||
-      (isTenantAdminActor(actor) && matchesTenant(actor, project)),
-  );
-}
-
-function filterMissionsByDirectActorScope<T extends MissionLike>(
-  actor: McpActorContext,
-  missions: T[],
-): T[] {
-  if (isGlobalAdminActor(actor)) return missions;
-  return missions.filter(
-    (mission) =>
-      mission.userId === actor.userId ||
-      (isTenantAdminActor(actor) && matchesTenant(actor, mission)),
-  );
-}
-
-function scopesEqual(left: ReadonlySet<McpToolScope>, right: ReadonlySet<McpToolScope>): boolean {
-  if (left.size !== right.size) return false;
-  for (const scope of left) {
-    if (!right.has(scope)) return false;
-  }
-  return true;
-}
-
-function sameActorAuthorization(stored: McpActorContext, current: McpActorContext): boolean {
-  return (
-    stored.userId === current.userId &&
-    stored.tenantId === current.tenantId &&
-    stored.role === current.role &&
-    scopesEqual(stored.scopes, current.scopes)
-  );
 }
 
 @Injectable()
@@ -238,18 +33,13 @@ export class McpService implements OnModuleDestroy {
    * Creates a new MCP session with its own server + transport pair.
    * Returns the transport for use by the controller.
    */
-  createSession(actor: McpActorContext): {
-    sessionId: string;
-    transport: StreamableHTTPServerTransport;
-  } {
+  createSession(userId: string): { sessionId: string; transport: StreamableHTTPServerTransport } {
     const sessionId = randomUUID();
 
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: () => sessionId,
       onsessioninitialized: (id) => {
-        this.logger.log(
-          `MCP session initialized: ${id} for actor=${actor.userId} tenant=${actor.tenantId} correlation=${actor.correlationId}`,
-        );
+        this.logger.log(`MCP session initialized: ${id} for user ${userId}`);
       },
     });
 
@@ -258,7 +48,7 @@ export class McpService implements OnModuleDestroy {
       { capabilities: { tools: {} } },
     );
 
-    this.registerTools(server, actor);
+    this.registerTools(server, userId);
 
     transport.onclose = () => {
       this.logger.log(`MCP session closed: ${sessionId}`);
@@ -271,126 +61,31 @@ export class McpService implements OnModuleDestroy {
       );
     });
 
-    this.sessions.set(sessionId, { server, transport, createdAt: new Date(), actor });
+    this.sessions.set(sessionId, { server, transport, createdAt: new Date(), userId });
     return { sessionId, transport };
   }
 
   /**
-   * Returns the transport for an existing session only when it belongs to the
-   * currently authenticated MCP actor. Guessed or cross-tenant session IDs grant
-   * no authority.
+   * Returns the transport for an existing session, or null if not found.
    */
-  getSession(sessionId: string, actor: McpActorContext): StreamableHTTPServerTransport | null {
-    const entry = this.sessions.get(sessionId);
-    if (!entry) return null;
-    if (!sameActorAuthorization(entry.actor, actor)) {
-      this.logger.warn(
-        `MCP session actor or scope mismatch: session=${sessionId} actor=${actor.userId} tenant=${actor.tenantId} role=${actor.role}`,
-      );
-      return null;
-    }
-    return entry.transport;
-  }
-
-  private async isProjectAuthorized(actor: McpActorContext, projectId: string): Promise<boolean> {
-    if (isGlobalAdminActor(actor)) return true;
-    const project = (await this.brain.projects.findById(projectId)) as ProjectLike | undefined;
-    return project ? filterProjectsForActor(actor, [project]).length === 1 : false;
-  }
-
-  private async filterMissionsForActor<T extends MissionLike>(
-    actor: McpActorContext,
-    missions: T[],
-  ): Promise<T[]> {
-    if (isGlobalAdminActor(actor)) return missions;
-
-    const projects = (await this.brain.projects.findAll()) as ProjectLike[];
-    const projectIds = new Set(
-      filterProjectsForActor(actor, projects).map((project) => project.id),
-    );
-
-    return missions.filter(
-      (mission) =>
-        filterMissionsByDirectActorScope(actor, [mission]).length === 1 ||
-        (typeof mission.projectId === 'string' && projectIds.has(mission.projectId)),
-    );
-  }
-
-  private async isMissionAuthorized(actor: McpActorContext, missionId: string): Promise<boolean> {
-    if (isGlobalAdminActor(actor)) return true;
-    const mission = (await this.brain.missions.findById(missionId)) as MissionLike | undefined;
-    if (!mission) return false;
-    return (await this.filterMissionsForActor(actor, [mission])).length === 1;
-  }
-
-  private async assertTaskReferencesAuthorized(
-    actor: McpActorContext,
-    refs: { projectId?: string | null; missionId?: string | null },
-  ): Promise<void> {
-    if (refs.projectId && !(await this.isProjectAuthorized(actor, refs.projectId))) {
-      throw new Error('MCP task project scope denied');
-    }
-    if (refs.missionId && !(await this.isMissionAuthorized(actor, refs.missionId))) {
-      throw new Error('MCP task mission scope denied');
-    }
-  }
-
-  private async assertTaskCreateScopeAuthorized(
-    actor: McpActorContext,
-    refs: { projectId?: string | null; missionId?: string | null },
-  ): Promise<void> {
-    if (!isGlobalAdminActor(actor) && !refs.projectId && !refs.missionId) {
-      throw new Error('MCP task scope denied');
-    }
-    await this.assertTaskReferencesAuthorized(actor, refs);
-  }
-
-  private async filterTasksForActor<T extends TaskLike>(
-    actor: McpActorContext,
-    tasks: T[],
-  ): Promise<T[]> {
-    if (isGlobalAdminActor(actor)) return tasks;
-
-    const [projects, missions] = await Promise.all([
-      this.brain.projects.findAll(),
-      this.brain.missions.findAll(),
-    ]);
-    const projectIds = new Set(
-      filterProjectsForActor(actor, projects as ProjectLike[]).map((project) => project.id),
-    );
-    const missionIds = new Set(
-      (await this.filterMissionsForActor(actor, missions as MissionLike[])).map(
-        (mission) => mission.id,
-      ),
-    );
-
-    return tasks.filter(
-      (task) =>
-        task.userId === actor.userId ||
-        (isTenantAdminActor(actor) && matchesTenant(actor, task)) ||
-        (typeof task.projectId === 'string' && projectIds.has(task.projectId)) ||
-        (typeof task.missionId === 'string' && missionIds.has(task.missionId)),
-    );
+  getSession(sessionId: string): StreamableHTTPServerTransport | null {
+    return this.sessions.get(sessionId)?.transport ?? null;
   }
 
   /**
    * Registers all platform tools on the given McpServer instance.
    */
-  registerTools(server: McpServer, actor: McpActorContext): void {
+  private registerTools(server: McpServer, _userId: string): void {
     // ─── Brain: Project tools ────────────────────────────────────────────
 
     server.registerTool(
       'brain_list_projects',
       {
         description: 'List all projects in the brain.',
-        inputSchema: strictObject({}),
+        inputSchema: z.object({}),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'brain_list_projects', params);
-        const projects = filterProjectsForActor(
-          actor,
-          (await this.brain.projects.findAll()) as ProjectLike[],
-        );
+      async () => {
+        const projects = await this.brain.projects.findAll();
         return {
           content: [{ type: 'text' as const, text: JSON.stringify(projects, null, 2) }],
         };
@@ -401,21 +96,17 @@ export class McpService implements OnModuleDestroy {
       'brain_get_project',
       {
         description: 'Get a project by ID.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           id: z.string().describe('Project ID (UUID)'),
         }),
       },
-      async ({ id, ...params }) => {
-        assertMcpToolAuthorized(actor, 'brain_get_project', params);
-        const project = (await this.brain.projects.findById(id)) as ProjectLike | undefined;
-        const authorizedProject = project ? filterProjectsForActor(actor, [project])[0] : undefined;
+      async ({ id }) => {
+        const project = await this.brain.projects.findById(id);
         return {
           content: [
             {
               type: 'text' as const,
-              text: authorizedProject
-                ? JSON.stringify(authorizedProject, null, 2)
-                : `Project not found: ${id}`,
+              text: project ? JSON.stringify(project, null, 2) : `Project not found: ${id}`,
             },
           ],
         };
@@ -428,23 +119,20 @@ export class McpService implements OnModuleDestroy {
       'brain_list_tasks',
       {
         description: 'List tasks, optionally filtered by project, mission, or status.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           projectId: z.string().optional().describe('Filter by project ID'),
           missionId: z.string().optional().describe('Filter by mission ID'),
           status: z.string().optional().describe('Filter by status'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'brain_list_tasks', params);
-        const { projectId, missionId, status } = params;
+      async ({ projectId, missionId, status }) => {
         type TaskStatus = 'not-started' | 'in-progress' | 'blocked' | 'done' | 'cancelled';
         let tasks;
         if (projectId) tasks = await this.brain.tasks.findByProject(projectId);
         else if (missionId) tasks = await this.brain.tasks.findByMission(missionId);
         else if (status) tasks = await this.brain.tasks.findByStatus(status as TaskStatus);
         else tasks = await this.brain.tasks.findAll();
-        const scopedTasks = await this.filterTasksForActor(actor, tasks as TaskLike[]);
-        return { content: [{ type: 'text' as const, text: JSON.stringify(scopedTasks, null, 2) }] };
+        return { content: [{ type: 'text' as const, text: JSON.stringify(tasks, null, 2) }] };
       },
     );
 
@@ -452,7 +140,7 @@ export class McpService implements OnModuleDestroy {
       'brain_create_task',
       {
         description: 'Create a new task in the brain.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           title: z.string().describe('Task title'),
           description: z.string().optional().describe('Task description'),
           projectId: z.string().optional().describe('Project ID'),
@@ -461,8 +149,6 @@ export class McpService implements OnModuleDestroy {
         }),
       },
       async (params) => {
-        assertMcpToolAuthorized(actor, 'brain_create_task', params);
-        await this.assertTaskCreateScopeAuthorized(actor, params);
         type Priority = 'low' | 'medium' | 'high' | 'critical';
         const task = await this.brain.tasks.create({
           ...params,
@@ -476,7 +162,7 @@ export class McpService implements OnModuleDestroy {
       'brain_update_task',
       {
         description: 'Update an existing task.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           id: z.string().describe('Task ID'),
           title: z.string().optional(),
           description: z.string().optional(),
@@ -485,17 +171,9 @@ export class McpService implements OnModuleDestroy {
             .optional()
             .describe('not-started, in-progress, blocked, done, cancelled'),
           priority: z.string().optional(),
-          projectId: z.string().optional().describe('Project ID'),
-          missionId: z.string().optional().describe('Mission ID'),
         }),
       },
       async ({ id, ...updates }) => {
-        assertMcpToolAuthorized(actor, 'brain_update_task', updates);
-        const existing = (await this.brain.tasks.findById(id)) as TaskLike | undefined;
-        if (!existing || (await this.filterTasksForActor(actor, [existing])).length === 0) {
-          return { content: [{ type: 'text' as const, text: `Task not found: ${id}` }] };
-        }
-        await this.assertTaskReferencesAuthorized(actor, updates);
         type TaskStatus = 'not-started' | 'in-progress' | 'blocked' | 'done' | 'cancelled';
         type Priority = 'low' | 'medium' | 'high' | 'critical';
         const task = await this.brain.tasks.update(id, {
@@ -520,19 +198,14 @@ export class McpService implements OnModuleDestroy {
       'brain_list_missions',
       {
         description: 'List all missions, optionally filtered by project.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           projectId: z.string().optional().describe('Filter by project ID'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'brain_list_missions', params);
-        const { projectId } = params;
-        const missions = await this.filterMissionsForActor(
-          actor,
-          (projectId
-            ? await this.brain.missions.findByProject(projectId)
-            : await this.brain.missions.findAll()) as MissionLike[],
-        );
+      async ({ projectId }) => {
+        const missions = projectId
+          ? await this.brain.missions.findByProject(projectId)
+          : await this.brain.missions.findAll();
         return { content: [{ type: 'text' as const, text: JSON.stringify(missions, null, 2) }] };
       },
     );
@@ -540,12 +213,13 @@ export class McpService implements OnModuleDestroy {
     server.registerTool(
       'brain_list_conversations',
       {
-        description: 'List conversations for the authenticated MCP actor.',
-        inputSchema: strictObject({}),
+        description: 'List conversations for a user.',
+        inputSchema: z.object({
+          userId: z.string().describe('User ID'),
+        }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'brain_list_conversations', params);
-        const conversations = await this.brain.conversations.findAll(actor.userId);
+      async ({ userId }) => {
+        const conversations = await this.brain.conversations.findAll(userId);
         return {
           content: [{ type: 'text' as const, text: JSON.stringify(conversations, null, 2) }],
         };
@@ -558,15 +232,14 @@ export class McpService implements OnModuleDestroy {
       'memory_search',
       {
         description:
-          'Search stored insights and knowledge for the authenticated MCP actor using natural language.',
-        inputSchema: strictObject({
+          'Search across stored insights and knowledge using natural language. Returns semantically similar results.',
+        inputSchema: z.object({
+          userId: z.string().describe('User ID to search memory for'),
           query: z.string().describe('Natural language search query'),
           limit: z.number().optional().describe('Max results (default 5)'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'memory_search', params);
-        const { query, limit } = params;
+      async ({ userId, query, limit }) => {
         if (!this.embeddings.available) {
           return {
             content: [
@@ -578,11 +251,7 @@ export class McpService implements OnModuleDestroy {
           };
         }
         const embedding = await this.embeddings.embed(query);
-        const results = await this.memory.insights.searchByEmbedding(
-          actor.userId,
-          embedding,
-          limit ?? 5,
-        );
+        const results = await this.memory.insights.searchByEmbedding(userId, embedding, limit ?? 5);
         return { content: [{ type: 'text' as const, text: JSON.stringify(results, null, 2) }] };
       },
     );
@@ -590,21 +259,20 @@ export class McpService implements OnModuleDestroy {
     server.registerTool(
       'memory_get_preferences',
       {
-        description: 'Retrieve stored preferences for the authenticated MCP actor.',
-        inputSchema: strictObject({
+        description: 'Retrieve stored preferences for a user.',
+        inputSchema: z.object({
+          userId: z.string().describe('User ID'),
           category: z
             .string()
             .optional()
             .describe('Filter by category: communication, coding, workflow, appearance, general'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'memory_get_preferences', params);
-        const { category } = params;
+      async ({ userId, category }) => {
         type Cat = 'communication' | 'coding' | 'workflow' | 'appearance' | 'general';
         const prefs = category
-          ? await this.memory.preferences.findByUserAndCategory(actor.userId, category as Cat)
-          : await this.memory.preferences.findByUser(actor.userId);
+          ? await this.memory.preferences.findByUserAndCategory(userId, category as Cat)
+          : await this.memory.preferences.findByUser(userId);
         return { content: [{ type: 'text' as const, text: JSON.stringify(prefs, null, 2) }] };
       },
     );
@@ -613,8 +281,9 @@ export class McpService implements OnModuleDestroy {
       'memory_save_preference',
       {
         description:
-          'Store a learned preference for the authenticated MCP actor (e.g., "prefers tables over paragraphs").',
-        inputSchema: strictObject({
+          'Store a learned user preference (e.g., "prefers tables over paragraphs", "timezone: America/Chicago").',
+        inputSchema: z.object({
+          userId: z.string().describe('User ID'),
           key: z.string().describe('Preference key'),
           value: z.string().describe('Preference value (JSON string)'),
           category: z
@@ -623,9 +292,7 @@ export class McpService implements OnModuleDestroy {
             .describe('Category: communication, coding, workflow, appearance, general'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'memory_save_preference', params);
-        const { key, value, category } = params;
+      async ({ userId, key, value, category }) => {
         type Cat = 'communication' | 'coding' | 'workflow' | 'appearance' | 'general';
         let parsedValue: unknown;
         try {
@@ -634,7 +301,7 @@ export class McpService implements OnModuleDestroy {
           parsedValue = value;
         }
         const pref = await this.memory.preferences.upsert({
-          userId: actor.userId,
+          userId,
           key,
           value: parsedValue,
           category: (category as Cat) ?? 'general',
@@ -648,8 +315,9 @@ export class McpService implements OnModuleDestroy {
       'memory_save_insight',
       {
         description:
-          'Store a learned insight, decision, or knowledge for the authenticated MCP actor.',
-        inputSchema: strictObject({
+          'Store a learned insight, decision, or knowledge extracted from the current interaction.',
+        inputSchema: z.object({
+          userId: z.string().describe('User ID'),
           content: z.string().describe('The insight or knowledge to store'),
           category: z
             .string()
@@ -657,13 +325,11 @@ export class McpService implements OnModuleDestroy {
             .describe('Category: decision, learning, preference, fact, pattern, general'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'memory_save_insight', params);
-        const { content, category } = params;
+      async ({ userId, content, category }) => {
         type Cat = 'decision' | 'learning' | 'preference' | 'fact' | 'pattern' | 'general';
         const embedding = this.embeddings.available ? await this.embeddings.embed(content) : null;
         const insight = await this.memory.insights.create({
-          userId: actor.userId,
+          userId,
           content,
           embedding,
           source: 'agent',
@@ -680,11 +346,16 @@ export class McpService implements OnModuleDestroy {
       {
         description:
           'Get the current orchestration mission status including milestones, tasks, and active session.',
-        inputSchema: strictObject({}),
+        inputSchema: z.object({
+          projectPath: z
+            .string()
+            .optional()
+            .describe('Project path. Defaults to gateway working directory.'),
+        }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'coord_mission_status', params);
-        const status = await this.coordService.getMissionStatus(process.cwd());
+      async ({ projectPath }) => {
+        const resolvedPath = projectPath ?? process.cwd();
+        const status = await this.coordService.getMissionStatus(resolvedPath);
         return {
           content: [
             {
@@ -700,11 +371,16 @@ export class McpService implements OnModuleDestroy {
       'coord_list_tasks',
       {
         description: 'List all tasks from the orchestration TASKS.md file.',
-        inputSchema: strictObject({}),
+        inputSchema: z.object({
+          projectPath: z
+            .string()
+            .optional()
+            .describe('Project path. Defaults to gateway working directory.'),
+        }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'coord_list_tasks', params);
-        const tasks = await this.coordService.listTasks(process.cwd());
+      async ({ projectPath }) => {
+        const resolvedPath = projectPath ?? process.cwd();
+        const tasks = await this.coordService.listTasks(resolvedPath);
         return { content: [{ type: 'text' as const, text: JSON.stringify(tasks, null, 2) }] };
       },
     );
@@ -713,14 +389,17 @@ export class McpService implements OnModuleDestroy {
       'coord_task_detail',
       {
         description: 'Get detailed status for a specific orchestration task.',
-        inputSchema: strictObject({
+        inputSchema: z.object({
           taskId: z.string().describe('Task ID (e.g. P2-005)'),
+          projectPath: z
+            .string()
+            .optional()
+            .describe('Project path. Defaults to gateway working directory.'),
         }),
       },
-      async (params) => {
-        assertMcpToolAuthorized(actor, 'coord_task_detail', params);
-        const { taskId } = params;
-        const detail = await this.coordService.getTaskStatus(process.cwd(), taskId);
+      async ({ taskId, projectPath }) => {
+        const resolvedPath = projectPath ?? process.cwd();
+        const detail = await this.coordService.getTaskStatus(resolvedPath, taskId);
         return {
           content: [
             {

apps/gateway/src/plugin/discord-ingress.security.spec.ts

@@ -1,443 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import {
-  createDiscordIngressEnvelope,
-  verifyDiscordIngressEnvelope,
-  DiscordPlugin,
-  type DiscordIngressPayload,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
-} from '@mosaicstack/discord-plugin';
-import { RuntimeProviderService } from '../agent/runtime-provider-registry.service.js';
-import { ChatGateway } from '../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
-import { validateDiscordServiceToken } from '../chat/chat.gateway-auth.js';
-import { DiscordReplayProtector } from './discord-replay-protector.js';
-
-const SERVICE_TOKEN = 'test-service-token';
-const ENV_KEYS = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_USER_ID',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-] as const;
-const savedEnv = new Map<string, string | undefined>();
-
-function configureDiscordEnv(role: 'admin' | 'member' = 'admin'): void {
-  for (const key of ENV_KEYS) savedEnv.set(key, process.env[key]);
-  process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-  process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
-  process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-discord';
-  process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-  process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-001';
-  process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
-  process.env['DISCORD_ALLOWED_USER_IDS'] = 'user-001';
-  process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-    {
-      instanceId: 'Nova',
-      guildId: 'guild-001',
-      channelId: 'channel-001',
-      pairedUsers: {
-        'user-001': {
-          role: role === 'admin' ? 'admin' : 'operator',
-          mosaicUserId: 'mosaic-admin-001',
-        },
-      },
-    },
-  ]);
-}
-
-afterEach((): void => {
-  for (const key of ENV_KEYS) {
-    const value = savedEnv.get(key);
-    if (value === undefined) delete process.env[key];
-    else process.env[key] = value;
-  }
-  savedEnv.clear();
-});
-
-function commandAuthorization(role: 'admin' | 'member'): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => entries.set(key, value),
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-function discordGateway(role: 'admin' | 'member'): {
-  gateway: ChatGateway;
-  client: { data: { discordService: boolean }; emit: ReturnType<typeof vi.fn> };
-  consumedActions: Array<{ actorId: string; correlationId: string }>;
-  durable: { getSnapshot: ReturnType<typeof vi.fn> };
-  audit: { record: ReturnType<typeof vi.fn> };
-} {
-  const authorization = commandAuthorization(role);
-  const consumedActions: Array<{ actorId: string; correlationId: string }> = [];
-  const durable = {
-    getSnapshot: vi.fn().mockResolvedValue({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    }),
-  };
-  const audit = { record: vi.fn().mockResolvedValue(undefined) };
-  const runtimeRegistry = new RuntimeProviderService(
-    {
-      require: () => ({
-        capabilities: async () => ({ supported: ['session.terminate'] }),
-        terminate: async () => undefined,
-      }),
-    } as never,
-    { record: async () => undefined } as never,
-    {
-      consume: async (approvalId, action) => {
-        consumedActions.push({ actorId: action.actorId, correlationId: action.correlationId });
-        return authorization.consumeRuntimeTerminationApproval(approvalId, action);
-      },
-    },
-  );
-  return {
-    gateway: new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authorization,
-      runtimeRegistry,
-      durable as never,
-      audit as never,
-    ),
-    client: { data: { discordService: true }, emit: vi.fn() },
-    consumedActions,
-    durable,
-    audit,
-  };
-}
-
-function ingressEnvelope(
-  content: string,
-  messageId: string,
-  overrides: Partial<DiscordIngressPayload> = {},
-): ReturnType<typeof createDiscordIngressEnvelope> {
-  return createDiscordIngressEnvelope(
-    createPayload({ content, messageId, ...overrides }),
-    SERVICE_TOKEN,
-  );
-}
-
-function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordIngressPayload {
-  return {
-    correlationId: 'correlation-001',
-    messageId: 'discord-message-001',
-    guildId: 'guild-001',
-    channelId: 'channel-001',
-    userId: 'user-001',
-    conversationId: 'discord-channel-001',
-    content: 'hello Tess',
-    ...overrides,
-  };
-}
-
-describe('Discord ingress security', () => {
-  it('keeps legacy role-only bindings valid while withholding privileged actor identity', () => {
-    const [binding] = parseDiscordInteractionBindings(
-      JSON.stringify([
-        {
-          instanceId: 'Nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': 'admin' },
-        },
-      ]),
-    );
-    expect(
-      resolveDiscordInteractionBinding([binding!], 'guild-001', 'channel-001', 'user-001', 'send'),
-    ).toEqual(binding);
-    expect(resolveDiscordInteractionActorId(binding!, 'user-001')).toBeNull();
-  });
-
-  it('binds a differently named configured interaction instance without code changes', () => {
-    const binding = resolveDiscordInteractionBinding(
-      [
-        {
-          instanceId: 'Nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-      'guild-001',
-      'channel-001',
-      'user-001',
-      'send',
-    );
-
-    expect(binding?.instanceId).toBe('Nova');
-  });
-
-  it('accepts only the configured Discord service identity', () => {
-    expect(validateDiscordServiceToken(SERVICE_TOKEN, SERVICE_TOKEN)).toBe(true);
-    expect(validateDiscordServiceToken('wrong-service-token', SERVICE_TOKEN)).toBe(false);
-    expect(validateDiscordServiceToken(undefined, SERVICE_TOKEN)).toBe(false);
-  });
-
-  it('rejects unauthenticated or tampered service envelopes', () => {
-    const envelope = createDiscordIngressEnvelope(createPayload(), SERVICE_TOKEN);
-
-    expect(verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN)).toEqual(createPayload());
-    expect(verifyDiscordIngressEnvelope(envelope, 'wrong-service-token')).toBeNull();
-    expect(
-      verifyDiscordIngressEnvelope(
-        { ...envelope, payload: { ...envelope.payload, content: 'forged command' } },
-        SERVICE_TOKEN,
-      ),
-    ).toBeNull();
-  });
-
-  it.each([
-    ['guild', { guildId: 'unlisted-guild' }],
-    ['channel', { channelId: 'unlisted-channel' }],
-    ['user', { userId: 'unlisted-user' }],
-  ])(
-    'rejects an unallowlisted Discord %s',
-    (_kind: string, overrides: Partial<DiscordIngressPayload>) => {
-      const envelope = createDiscordIngressEnvelope(createPayload(overrides), SERVICE_TOKEN);
-
-      expect(
-        verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN, {
-          guildIds: ['guild-001'],
-          channelIds: ['channel-001'],
-          userIds: ['user-001'],
-        }),
-      ).toBeNull();
-    },
-  );
-
-  it('retains Discord message and correlation IDs after authenticated allowlisted validation', () => {
-    const payload = createPayload({
-      correlationId: 'correlation-trace-123',
-      messageId: 'discord-snowflake-987',
-    });
-    const envelope = createDiscordIngressEnvelope(payload, SERVICE_TOKEN);
-
-    expect(
-      verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN, {
-        guildIds: ['guild-001'],
-        channelIds: ['channel-001'],
-        userIds: ['user-001'],
-      }),
-    ).toEqual(payload);
-  });
-
-  it('rejects a replayed Discord message ID while retaining bounded replay state', () => {
-    const replayProtector = new DiscordReplayProtector(60_000, 2);
-
-    expect(replayProtector.claim('discord-message-001')).toBe(true);
-    expect(replayProtector.claim('discord-message-001')).toBe(false);
-    expect(replayProtector.claim('discord-message-002')).toBe(true);
-    expect(replayProtector.claim('discord-message-003')).toBe(true);
-    expect(replayProtector.size).toBe(2);
-  });
-
-  it('consumes the exact target once when approval and stop are separate Discord messages', async () => {
-    configureDiscordEnv();
-    const { gateway, client, consumedActions } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'approve-message', {
-        correlationId: 'approval-ingress-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'stop-message', {
-        correlationId: 'stop-ingress-correlation',
-      }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'stop-ingress-correlation',
-      success: true,
-    });
-    expect(consumedActions).toEqual([
-      {
-        actorId: 'mosaic-admin-001',
-        correlationId: expect.stringMatching(/^discord-action:v1:/),
-      },
-    ]);
-  });
-
-  it('audits a Discord mint-side authorization denial', async () => {
-    configureDiscordEnv();
-    const { gateway, client, audit } = discordGateway('member');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'denied-approve'),
-    );
-
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-    expect(audit.record).toHaveBeenCalledWith(
-      expect.objectContaining({
-        outcome: 'denied',
-        operation: 'session.terminate',
-        errorCode: 'policy_denied',
-      }),
-    );
-  });
-
-  it.each([
-    [
-      'binding',
-      () => {
-        process.env['MOSAIC_AGENT_NAME'] = 'Other';
-      },
-    ],
-    [
-      'durable session',
-      (durable: { getSnapshot: ReturnType<typeof vi.fn> }) => {
-        durable.getSnapshot.mockResolvedValueOnce({
-          identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        });
-      },
-    ],
-  ])(
-    'rejects approval when the %s targets a different runtime agent',
-    async (_source, configure) => {
-      configureDiscordEnv();
-      const { gateway, client, durable } = discordGateway('admin');
-      configure(durable);
-
-      await gateway.handleDiscordApproval(
-        client as never,
-        ingressEnvelope('/approve', 'mismatched-agent-approve'),
-      );
-
-      expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-        correlationId: 'correlation-001',
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-    },
-  );
-
-  it('rejects unpaired and non-admin Discord users for approval and stop', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('member');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'member-approve'),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([]);
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'unpaired-stop'),
-    );
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
-
-  it('rejects replaying a Discord-created termination approval', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'replay-approve', {
-        correlationId: 'replay-approval-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-    };
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-one', {
-        correlationId: 'replay-stop-correlation-one',
-      }),
-    );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-two', {
-        correlationId: 'replay-stop-correlation-two',
-      }),
-    );
-    const stopResults = client.emit.mock.calls.filter(([event]) => event === 'discord:stop');
-    expect(stopResults.map(([, result]) => (result as { success: boolean }).success)).toEqual([
-      true,
-      false,
-    ]);
-  });
-
-  it('accepts a thread message through its allowed bound parent channel', () => {
-    const emitted = vi.fn();
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-001'],
-      allowedChannelIds: ['channel-001'],
-      allowedUserIds: ['user-001'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-    });
-    const internals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    internals.client = { user: { id: 'bot-001' } };
-    internals.socket = { connected: true, emit: emitted };
-    internals.handleDiscordMessage({
-      id: 'thread-message',
-      guildId: 'guild-001',
-      channelId: 'thread-001',
-      author: { id: 'user-001', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-001> hello from thread',
-      channel: { parentId: 'channel-001' },
-      attachments: new Map(),
-    });
-
-    const [, envelope] = emitted.mock.calls[0] as [
-      string,
-      ReturnType<typeof createDiscordIngressEnvelope>,
-    ];
-    expect(verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN)?.channelId).toBe('channel-001');
-  });
-});

apps/gateway/src/plugin/discord-replay-protector.ts

@@ -1,40 +0,0 @@
-/**
- * Bounded replay cache for Discord's globally unique native message IDs.
- * Durable ingress idempotency is added with Tess's canonical inbox/outbox work.
- */
-export class DiscordReplayProtector {
-  private readonly claimedAt = new Map<string, number>();
-
-  constructor(
-    private readonly ttlMs = 15 * 60 * 1000,
-    private readonly maxEntries = 10_000,
-  ) {}
-
-  get size(): number {
-    return this.claimedAt.size;
-  }
-
-  /** Claims an ID exactly once within its bounded retention window. */
-  claim(messageId: string, now = Date.now()): boolean {
-    this.prune(now);
-    if (this.claimedAt.has(messageId)) return false;
-
-    this.claimedAt.set(messageId, now);
-    this.evictOverflow();
-    return true;
-  }
-
-  private prune(now: number): void {
-    for (const [messageId, claimedAt] of this.claimedAt) {
-      if (now - claimedAt >= this.ttlMs) this.claimedAt.delete(messageId);
-    }
-  }
-
-  private evictOverflow(): void {
-    while (this.claimedAt.size > this.maxEntries) {
-      const oldestMessageId = this.claimedAt.keys().next().value;
-      if (oldestMessageId === undefined) return;
-      this.claimedAt.delete(oldestMessageId);
-    }
-  }
-}

apps/gateway/src/plugin/plugin.module.ts

@@ -6,7 +6,7 @@ import {
   type OnModuleDestroy,
   type OnModuleInit,
 } from '@nestjs/common';
-import { DiscordPlugin, parseDiscordInteractionBindings } from '@mosaicstack/discord-plugin';
+import { DiscordPlugin } from '@mosaicstack/discord-plugin';
 import { TelegramPlugin } from '@mosaicstack/telegram-plugin';
 import { PluginService } from './plugin.service.js';
 import type { IChannelPlugin } from './plugin.interface.js';
@@ -50,44 +50,19 @@ class TelegramChannelPluginAdapter implements IChannelPlugin {
 
 const DEFAULT_GATEWAY_URL = 'http://localhost:14242';
 
-function requiredDiscordAllowlist(name: string): string[] {
-  const value = process.env[name]
-    ?.split(',')
-    .map((id: string): string => id.trim())
-    .filter((id: string): boolean => id.length > 0);
-  if (!value || value.length === 0) {
-    throw new Error(`${name} is required when DISCORD_BOT_TOKEN is configured`);
-  }
-  return value;
-}
-
 function createPluginRegistry(): IChannelPlugin[] {
   const plugins: IChannelPlugin[] = [];
   const discordToken = process.env['DISCORD_BOT_TOKEN'];
   const discordGuildId = process.env['DISCORD_GUILD_ID'];
   const discordGatewayUrl = process.env['DISCORD_GATEWAY_URL'] ?? DEFAULT_GATEWAY_URL;
-  const discordServiceToken = process.env['DISCORD_SERVICE_TOKEN'];
-  const discordServiceUserId = process.env['DISCORD_SERVICE_USER_ID'];
 
   if (discordToken) {
-    if (!discordServiceToken || !discordServiceUserId) {
-      throw new Error(
-        'DISCORD_SERVICE_TOKEN and DISCORD_SERVICE_USER_ID are required when DISCORD_BOT_TOKEN is configured',
-      );
-    }
     plugins.push(
       new DiscordChannelPluginAdapter(
         new DiscordPlugin({
           token: discordToken,
           guildId: discordGuildId,
           gatewayUrl: discordGatewayUrl,
-          serviceToken: discordServiceToken,
-          allowedGuildIds: requiredDiscordAllowlist('DISCORD_ALLOWED_GUILD_IDS'),
-          allowedChannelIds: requiredDiscordAllowlist('DISCORD_ALLOWED_CHANNEL_IDS'),
-          allowedUserIds: requiredDiscordAllowlist('DISCORD_ALLOWED_USER_IDS'),
-          interactionBindings: parseDiscordInteractionBindings(
-            process.env['DISCORD_INTERACTION_BINDINGS'],
-          ),
         }),
       ),
     );

apps/gateway/src/preferences/system-override.service.ts

@@ -1,13 +1,9 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { ActorTenantScope } from '../auth/session-scope.js';
 
-const scopedSessionId = (sessionId: string, scope: ActorTenantScope) =>
-  `${scope.tenantId}:${scope.userId}:${sessionId}`;
-const SESSION_SYSTEM_KEY = (sessionId: string, scope: ActorTenantScope) =>
-  `mosaic:session:${scopedSessionId(sessionId, scope)}:system`;
-const SESSION_SYSTEM_FRAGMENTS_KEY = (sessionId: string, scope: ActorTenantScope) =>
-  `mosaic:session:${scopedSessionId(sessionId, scope)}:system:fragments`;
+const SESSION_SYSTEM_KEY = (sessionId: string) => `mosaic:session:${sessionId}:system`;
+const SESSION_SYSTEM_FRAGMENTS_KEY = (sessionId: string) =>
+  `mosaic:session:${sessionId}:system:fragments`;
 const SYSTEM_OVERRIDE_TTL_SECONDS = 604800; // 7 days
 
 interface OverrideFragment {
@@ -24,9 +20,9 @@ export class SystemOverrideService {
     this.handle = createQueue();
   }
 
-  async set(sessionId: string, override: string, scope: ActorTenantScope): Promise<void> {
+  async set(sessionId: string, override: string): Promise<void> {
     // Load existing fragments
-    const existing = await this.handle.redis.get(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope));
+    const existing = await this.handle.redis.get(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId));
     const fragments: OverrideFragment[] = existing
       ? (JSON.parse(existing) as OverrideFragment[])
       : [];
@@ -41,11 +37,11 @@ export class SystemOverrideService {
     // Store both: fragments array and condensed result
     const pipeline = this.handle.redis.pipeline();
     pipeline.setex(
-      SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope),
+      SESSION_SYSTEM_FRAGMENTS_KEY(sessionId),
       SYSTEM_OVERRIDE_TTL_SECONDS,
       JSON.stringify(fragments),
     );
-    pipeline.setex(SESSION_SYSTEM_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS, condensed);
+    pipeline.setex(SESSION_SYSTEM_KEY(sessionId), SYSTEM_OVERRIDE_TTL_SECONDS, condensed);
     await pipeline.exec();
 
     this.logger.debug(
@@ -53,21 +49,21 @@ export class SystemOverrideService {
     );
   }
 
-  async get(sessionId: string, scope: ActorTenantScope): Promise<string | null> {
-    return this.handle.redis.get(SESSION_SYSTEM_KEY(sessionId, scope));
+  async get(sessionId: string): Promise<string | null> {
+    return this.handle.redis.get(SESSION_SYSTEM_KEY(sessionId));
   }
 
-  async renew(sessionId: string, scope: ActorTenantScope): Promise<void> {
+  async renew(sessionId: string): Promise<void> {
     const pipeline = this.handle.redis.pipeline();
-    pipeline.expire(SESSION_SYSTEM_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
-    pipeline.expire(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope), SYSTEM_OVERRIDE_TTL_SECONDS);
+    pipeline.expire(SESSION_SYSTEM_KEY(sessionId), SYSTEM_OVERRIDE_TTL_SECONDS);
+    pipeline.expire(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId), SYSTEM_OVERRIDE_TTL_SECONDS);
     await pipeline.exec();
   }
 
-  async clear(sessionId: string, scope: ActorTenantScope): Promise<void> {
+  async clear(sessionId: string): Promise<void> {
     await this.handle.redis.del(
-      SESSION_SYSTEM_KEY(sessionId, scope),
-      SESSION_SYSTEM_FRAGMENTS_KEY(sessionId, scope),
+      SESSION_SYSTEM_KEY(sessionId),
+      SESSION_SYSTEM_FRAGMENTS_KEY(sessionId),
     );
     this.logger.debug(`Cleared system override for session ${sessionId}`);
   }

apps/gateway/src/queue/queue.service.ts

@@ -162,23 +162,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
     );
   }
 
-  /**
-   * Remove every existing repeatable schedule for a job name. This supports
-   * safe retirement of previously registered system-wide jobs.
-   */
-  async removeRepeatableJobs(queueName: string, jobName: string): Promise<number> {
-    const queue = this.getQueue(queueName);
-    const jobs = await queue.getRepeatableJobs();
-    const matchingJobs = jobs.filter((job) => job.name === jobName);
-    await Promise.all(matchingJobs.map((job) => queue.removeRepeatableByKey(job.key)));
-    if (matchingJobs.length > 0) {
-      this.logger.log(
-        `Removed ${matchingJobs.length} repeatable "${jobName}" job(s) from "${queueName}"`,
-      );
-    }
-    return matchingJobs.length;
-  }
-
   /**
    * Register a Worker for the given queue name with error handling and
    * exponential backoff.

docs/architecture/channel-protocol.md

@@ -232,10 +232,6 @@ The following sections document how each supported channel maps its native messa
 
 **Outbound:** Adapter calls Discord REST `POST /channels/{id}/messages`. Markdown content is sent as-is (Discord renders it). For `contentType = "code"` the adapter wraps in triple-backtick fences with the `metadata.language` tag.
 
-### Discord service ingress security
-
-The Discord adapter is an authenticated gateway service, not an anonymous Socket.IO client. It presents `DISCORD_SERVICE_TOKEN` during its `/chat` connection and signs each inbound envelope using HMAC-SHA-256. The envelope contains the Discord native message ID and a generated correlation ID. Gateway verifies the service credential, signature, and configured guild/channel/user allowlists before agent dispatch, then rejects duplicate native message IDs inside its bounded replay window. All three allowlists are default-deny and required when the Discord plugin is enabled. The service credential is injected at runtime and is never logged or included in protocol payloads.
-
 ---
 
 ### Telegram

docs/guides/admin-guide.md

@@ -293,28 +293,13 @@ Each OIDC provider requires its client ID, client secret, and issuer URL togethe
 
 ### Plugins
 
-| Variable                      | Description                                                                                                                               |
-| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `DISCORD_BOT_TOKEN`           | Discord bot token (enables Discord plugin)                                                                                                |
-| `DISCORD_SERVICE_TOKEN`       | Required high-entropy service credential used to authenticate and sign Discord ingress; inject through the approved secret mechanism only |
-| `DISCORD_SERVICE_USER_ID`     | Required Mosaic service-principal user ID that owns persisted Discord conversations; the original Discord user ID remains audit metadata  |
-| `DISCORD_GUILD_ID`            | Discord guild/server ID                                                                                                                   |
-| `DISCORD_GATEWAY_URL`         | Gateway URL for Discord plugin to call (default: `http://localhost:14242`)                                                                |
-| `DISCORD_ALLOWED_GUILD_IDS`   | Required comma-separated Discord guild snowflake allowlist; default-deny                                                                  |
-| `DISCORD_ALLOWED_CHANNEL_IDS` | Required comma-separated Discord channel snowflake allowlist; default-deny                                                                |
-| `DISCORD_ALLOWED_USER_IDS`    | Required comma-separated Discord user snowflake allowlist; default-deny                                                                   |
-| `TELEGRAM_BOT_TOKEN`          | Telegram bot token (enables Telegram plugin)                                                                                              |
-| `TELEGRAM_GATEWAY_URL`        | Gateway URL for Telegram plugin to call                                                                                                   |
-
-### Discord ingress security
-
-When `DISCORD_BOT_TOKEN` is configured, `DISCORD_SERVICE_TOKEN`, `DISCORD_SERVICE_USER_ID`, and all three Discord allowlists are required. Gateway startup fails rather than enabling a broad or unauthenticated remote-control surface. The service user ID identifies a provisioned Mosaic service principal for persistence; the original Discord user ID is retained in ingress audit metadata. The service token is a secret supplied by the approved runtime secret mechanism and is never committed or logged.
-
-Inbound Discord messages must originate from an allowed guild, channel, and user, mention the bot, and carry a signed envelope containing the native Discord message ID and a generated correlation ID. The gateway validates the service identity, envelope signature, and allowlists again before dispatching. Replayed Discord message IDs are rejected during the bounded ingress replay window. Durable inbox/idempotency retention is introduced with Tess durable state.
-
-### Session retention and garbage collection
-
-Session cleanup is scoped to one session identifier and only removes that session's Valkey keys and demotes that session's hot logs. Gateway startup and scheduled jobs do not perform global session cleanup; startup removes legacy repeatable `session-gc` schedules created by older deployments. The `/gc` command is intentionally disabled until a distinct global-retention job supplies explicit authorization and audit evidence. This prevents one tenant or session's cleanup from changing another's retained data.
+| Variable               | Description                                                                |
+| ---------------------- | -------------------------------------------------------------------------- |
+| `DISCORD_BOT_TOKEN`    | Discord bot token (enables Discord plugin)                                 |
+| `DISCORD_GUILD_ID`     | Discord guild/server ID                                                    |
+| `DISCORD_GATEWAY_URL`  | Gateway URL for Discord plugin to call (default: `http://localhost:14242`) |
+| `TELEGRAM_BOT_TOKEN`   | Telegram bot token (enables Telegram plugin)                               |
+| `TELEGRAM_GATEWAY_URL` | Gateway URL for Telegram plugin to call                                    |
 
 ### Observability
 

docs/scratchpads/703-wrapper-interactive-auth.md

@@ -1,49 +0,0 @@
-# #703 Git Wrapper Interactive and Auth Resilience
-
-## Objective
-
-Restore the deployed Git wrapper contract: issue-create supports interactive invocation and Gitea mutation behavior tolerates a stale Tea authenticated user by validating current identity and using the existing host-scoped API fallback.
-
-## Scope
-
-- `packages/mosaic/framework/tools/git/issue-create.sh`
-- `packages/mosaic/framework/tools/git/detect-platform.sh`
-- Git wrapper regression harnesses
-- This scratchpad
-
-## Requirements / acceptance evidence
-
-1. `issue-create -i` and `--interactive` prompt for missing issue fields without exposing credentials.
-2. Explicit command-line fields retain precedence and do not trigger prompt input.
-3. Gitea wrapper resolves the current user dynamically from the target host and does not rely on the saved Tea user identity.
-4. A Tea `GetUserByName` failure falls back to authenticated API creation.
-5. Existing body-safety, login-resolution, issue-create, and pr-create paths remain green.
-6. Source framework is re-seeded to deployed `~/.config/mosaic`, then deployed wrappers are verified end to end.
-
-## Plan
-
-1. Add failing shell regression harness for interactive input and stale Tea user fallback.
-2. Implement minimal helper and parser changes.
-3. Run wrapper harnesses, syntax checks, and repository baseline checks.
-4. Re-seed deployed framework and run live wrapper verification.
-5. Commit, queue guard, push, open PR, and stop for independent review.
-
-## Progress
-
-- Issue #703 filed before code; issue comment records #536 root cause and stale-login trigger.
-- Deployed wrapper `issue-create.sh -i` reproduced: `Unknown option: -i` (exit 1).
-- Live Tea mutation did not reproduce `GetUserByName` on this host because the current mosaicstack Tea login is valid. The test harness models the reported stale authenticated-user condition.
-- Implemented `-i` / `--interactive` prompt collection and a dynamic Tea `/user` validation. A stale Tea identity now selects the existing host-scoped Gitea API fallback before mutation for both issue and PR creation.
-- Re-seeded the framework with `MOSAIC_INSTALL_MODE=keep MOSAIC_SYNC_ONLY=1 bash packages/mosaic/framework/install.sh`. Installed and source wrapper SHA-256 values matched.
-- Live deployed verification: interactive issue-create opened then closed #704; installed dynamic identity resolved `jason.woltje`.
-
-## Verification
-
-- PASS: `packages/mosaic/framework/tools/git/test-issue-create-interactive-auth.sh`
-- PASS: `packages/mosaic/framework/tools/git/test-issue-create-body-safety.sh`
-- PASS: `packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh`
-- PASS: `packages/mosaic/framework/tools/git/test-pr-metadata-gitea.sh`
-- PASS: `packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh`
-- PASS: `bash packages/mosaic/framework/tools/git/test-lane-brief-pr-linkage.sh`
-- PASS: `bash -n packages/mosaic/framework/tools/git/*.sh`
-- PASS: Prettier check for this scratchpad

docs/scratchpads/tess-20260712.md

@@ -56,11 +56,3 @@
 **Final focused review:** PASS. Deterministic audit validated all task repository roots with zero missing paths; no planning placeholders remained; security prerequisites still gate Tess exposure; observability traceability is explicit.
 
 **Current gate:** planning PR must merge to `main` with terminal-green CI before any source-code worker starts.
-
-## 2026-07-13 — M3 cross-surface delivery
-
-**Branch:** `feat/tess-m3-integration` from `main` at `84d884b9`.
-
-**Delivered:** Stable Discord `conversationId` enrollment after a visible provider/runtime session is known; idempotent provider-session rebinding that preserves agent/tenant/owner scope; Discord approval/stop target resolution through the durable snapshot; SSE runtime streaming after CLI attach; denial/audit parity including provider authorization denials and HTTP 403 approval-denial mapping.
-
-**Evidence:** Gateway targeted suite: 37 tests passed; Mosaic CLI interaction test passed; agent durable-session test passed; gateway and CLI typechecks passed; changed-file format and whitespace checks passed. Codex security review found no confident vulnerability. Code review identified a Fastify exception-response mismatch and two UX/acknowledgement issues; all were corrected before the final validation run.

docs/scratchpads/tess-m1-002-provider-registry.md

@@ -1,38 +0,0 @@
-# TESS-M1-002 — Provider Registry
-
-- **Issue:** #707
-- **Branch:** `feat/tess-provider-registry`
-- **Objective:** Build the runtime provider registry/service boundary that derives immutable actor/tenant/channel/correlation scope server-side, fail-closes unsupported and destructive runtime operations, binds termination approval to the exact structured action, and emits correlation-safe audit events.
-
-## Plan
-
-1. Add a provider-agnostic registry in `@mosaicstack/agent` over the merged `AgentRuntimeProvider` contract.
-2. Write abuse-case tests before implementation for duplicate/unknown providers, immutable server-derived scope, capability denial, approval mismatch/absence, and audit failure.
-3. Implement the Gateway service that converts only authenticated `ActorTenantScope` plus trusted ingress metadata into a frozen `RuntimeScope`, gates capabilities and terminate approval, and records metadata-only audits.
-4. Register the service in `AgentModule`, then run focused, baseline, cold-cache, and independent-review gates.
-
-## Security Invariants
-
-- Caller-supplied actor/tenant identity never reaches runtime providers.
-- Provider capability absence and approval/audit failure deny before side effects.
-- Termination approval is verified against provider, session, actor, tenant, channel, and correlation context.
-- Audit events retain correlation and authority metadata but never message content or approval material.
-
-## Progress
-
-- 2026-07-12: Created fresh worktree from `origin/main` at `119f64e6`; source and Tess planning/security documentation reviewed.
-- 2026-07-12: Security TDD added registry and gateway abuse tests before implementation.
-- 2026-07-12: Implemented `AgentRuntimeProviderRegistry` and gateway `RuntimeProviderService`; registered both in `AgentModule` and documented the internal boundary.
-- 2026-07-12: Independent review found two audit correctness issues. Remediated completion-audit failure handling and provider execution failures: pre-invocation denials are audited as `denied`; post-invocation errors as `failed`; completion audit failure does not misreport a completed effect as retryable.
-- 2026-07-12: Final independent security review: no findings. Final code review had one false positive: `@mosaicstack/types` is already declared in `packages/agent/package.json`.
-
-## Tests
-
-- TDD red: `pnpm --filter @mosaicstack/gateway test -- runtime-provider-registry.service.test.ts` failed before both audit remediations, as expected.
-- Focused: package registry 2 tests and gateway security boundary 7 tests pass.
-- Cold-cache: removed this worktree's `node_modules`, then `pnpm install --offline --frozen-lockfile --store-dir /home/jarvis/.local/share/pnpm/store` passed.
-- Cold-cache baseline: `TURBO_FORCE=true pnpm typecheck` — 42/42 tasks passed; `TURBO_FORCE=true pnpm lint` — 23/23 tasks passed; `TURBO_FORCE=true pnpm format:check` passed; `TURBO_FORCE=true pnpm test` — 42/42 tasks passed (gateway 548 tests passed, 11 intentionally skipped).
-
-## Risks / Blockers
-
-- The canonical durable approval implementation is currently command-specific. This card introduces a fail-closed runtime approval verifier boundary so a runtime provider cannot terminate until its exact-action verifier is wired; later provider implementations cannot bypass it.

docs/scratchpads/tess-m1-003-fleet-provider.md

@@ -1,75 +0,0 @@
-# TESS-M1-003 — Fleet/tmux Runtime Provider
-
-- **Task:** `TESS-M1-003`
-- **Issue:** `#707`
-- **Branch:** `feat/tess-fleet-provider`
-- **PR target:** `main`
-- **Budget:** 30K estimate from `docs/tess/TASKS.md`; work remains scoped to `packages/mosaic`, `packages/agent`, and Tess architecture/scratchpad documentation.
-
-## Objective
-
-Implement `TESS-FLT-001` as a tmux/fleet `AgentRuntimeProvider` on the M1 registry contract. Operations must use roster-bound, exact tmux targets; fail closed on missing or mismatched peer identity; allow read-only attach only; use exact-target message delivery and termination; and expose no arbitrary shell, socket, or fuzzy session targeting.
-
-## Requirements and Security Invariants
-
-- `TESS-FLT-001`: fleet roster/status/heartbeat inspection, message delivery, session hierarchy, safe attach, controlled termination/recovery.
-- `TESS-ARP-001` / `TESS-TRN-001`: conform to the runtime provider contract and advertise only implemented capabilities.
-- TM-10: exact target/socket binding and peer identity verification; wrong socket, target, or identity must refuse delivery/attach.
-- Gateway supplies immutable actor/tenant/channel/correlation scope and consumes durable termination approvals before provider invocation.
-- `control` attach is denied. A provider attach is a scoped read-only logical handle; it never opens a server-side interactive terminal or exposes a raw tmux target.
-- M2 will make durable attachment/session state available. This M1 provider does not claim durable attachment handles or durable message idempotency.
-
-## Plan
-
-1. Add security TDD cases first for fuzzy/unrostered targets, incorrect socket/identity, control attach, attachment scope replay, and termination exact targeting.
-2. Add Mosaic fleet primitives for exact target validation and identity probing from the roster/socket.
-3. Implement and export the fleet/tmux provider in `@mosaicstack/agent`, using only those primitives and a command-runner seam.
-4. Update Tess architecture docs and this evidence log.
-5. Run focused tests, independent code/security reviews, cold-cache forced gates, then create a PR with `Refs #707`.
-
-## Branch/Base Note
-
-The orchestrator corrected the initial brief: `feat/tess-interaction-agent` is a stale planning branch. This branch was correctly created from `origin/main` at `e92186d7` (including M1-002) and will open a clean PR to `main` with `Refs #707`.
-
-## Progress
-
-- [x] Read PRD, Tess architecture, threat model, runtime contract, registry, fleet command primitives, task record, and issue #707.
-- [x] Created clean worktree from `origin/main` at `e92186d7`.
-- [x] Security TDD tests written before implementation; initially failed because the transport/provider modules did not exist.
-- [x] Fleet transport and capability-limited provider implemented; read/list/attach and direct Tess write/control default to deny pending scope-aware authority adapters.
-- [x] Focused typecheck, lint, formatting, and abuse tests passed (transport: 7; provider: 14).
-- [x] Cold-cache forced workspace gates passed after reinstall; final workspace gates also passed.
-- [x] Independent Codex code and security reviews passed with no findings.
-
-## Verification Evidence
-
-- `pnpm --filter @mosaicstack/mosaic typecheck` — pass.
-- `pnpm --filter @mosaicstack/agent typecheck` — pass.
-- `pnpm --filter @mosaicstack/mosaic lint` — pass.
-- `pnpm --filter @mosaicstack/agent lint` — pass.
-- `pnpm --filter @mosaicstack/mosaic test -- src/fleet/tmux-runtime-transport.test.ts` — 7 passed.
-- `pnpm --filter @mosaicstack/agent test -- src/tmux-fleet-runtime-provider.test.ts` — 14 passed.
-- The worktree dependency install must use `--store-dir /home/jarvis/.local/share/pnpm/store` because machine pnpm config points to an unreadable root-owned store. This is a local tool configuration issue, not an application workaround.
-
-## Documentation Checklist
-
-- [x] Canonical PRD and Tess architecture are current for this internal provider; no HTTP/API endpoint changed.
-- [x] `docs/tess/ARCHITECTURE.md` documents the internal fleet target/identity, read-only attach, and Mos authority boundary.
-- [x] No user/admin/API sitemap updates are applicable because no user-facing or HTTP API surface was introduced.
-
-## Acceptance Criteria to Evidence
-
-| Acceptance criterion | Evidence target |
-| --- | --- |
-| Only roster-bound exact targets are operated | Provider abuse tests prove unknown/prefix targets yield typed denial and runner is untouched. |
-| Socket and peer runtime identity are exact | Provider abuse tests prove wrong socket/no pane/runtime drift deny before send/attach/terminate. |
-| Message sends are capability-safe and exact | Tests assert the maintained sender receives only the configured socket and exact roster session. |
-| Fleet reads cannot cross an authority boundary | Tests prove list and read attach default-deny without a scope-aware read authority; per-target authority filtering is enforced. |
-| Attach cannot grant control or replay across scope | Tests deny `control`; attachment handles are random, scoped, short-lived, single-use for detach, and pruned after expiry. |
-| Termination is exact and caller cannot select arbitrary target | Tests assert roster/identity validation precedes exact `tmux kill-session -t =<agent>`. Gateway tests from M1-002 cover approval consumption. |
-| Documentation describes the boundary | `docs/tess/ARCHITECTURE.md` documents fleet capability, scope, and non-goals. |
-
-## Risks / Decisions
-
-- Runtime process identity can only be verified from the declared fleet roster and exact tmux pane command in M1. The tmux server itself is a trusted local transport boundary; stronger authenticated peer attestations are deferred to the Matrix/native provider.
-- The current roster schema does not encode per-agent tenant/owner. Scope-aware read/write authority adapters remain the integration point for gateway/Mos ownership policy; provider scope is bound to logical attachment handles to prevent replay.

docs/scratchpads/tess-m1-obs-001.md

@@ -1,9 +0,0 @@
-# TESS-M1-OBS-001 Scratchpad
-
-- Branch: `feat/tess-observability-terra` (the requested name is checked out by an abandoned worktree; orchestrator approved this clean branch).
-- Base: `origin/main` at `e92186d7`.
-- Scope: correlation propagation; metadata-only structured runtime/provider/tool audit; health/readiness; safe effective-policy status.
-- Security invariant: audit and status data use an allowlist; no message bodies, credentials, approval references, tool arguments, or tool output.
-- TDD: `packages/log/src/runtime-audit.test.ts` and `apps/gateway/src/health/health.controller.test.ts` failed before implementation and now pass.
-- Verification: full `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, and `pnpm test` passed after implementation (2026-07-12).
-- Review: corrected audit sanitizer findings by hashing every resource ID. Durable audit persistence remains fail-closed by design: the pre-existing M1 provider-boundary suite requires it to prevent an unaudited side effect.

docs/scratchpads/tess-m1-sec-001.md

@@ -1,27 +0,0 @@
-# TESS-M1-SEC-001 — Command authorization and exact-action approval
-
-- Issue/milestone: #707 / M1
-- Branch: `fix/tess-command-authz`
-- Requirement: `TESS-SEC-002`, with approval binding controls from `TESS-SEC-007`
-- Scope: `apps/gateway` only, plus required in-repo security/developer documentation.
-
-## Plan
-
-1. Locate the gateway command executor, command metadata, authorization context, and existing test conventions.
-2. Write abuse/authz tests before production changes. Expected red cases: non-admin blocked from admin/system command; forged caller scope cannot authorize; privileged/destructive action requires durable exact-action approval; expired/replayed/mutated approvals deny.
-3. Implement server-derived role/scope enforcement and durable approval validation/consumption with audit results.
-4. Run focused security tests, then repository baseline gates: typecheck, lint, format-check, test.
-5. Run independent security/code review, commit, queue-guard, push, and open the PR to `main` through the stated Gitea API fallback. Stop after PR creation.
-
-## Assumptions
-
-- The existing gateway persistence interface is the available durable approval boundary. If no persistence abstraction exists, a minimal injectable repository interface will be introduced rather than an in-memory approval implementation, because TESS-SEC-002/007 require durable enforcement.
-- “Exact action” is a canonical digest over structured command identity and normalized arguments; role/scope checks always use authenticated server context, not client-declared claims.
-
-## TDD evidence
-
-- Pending: abuse/authz test written and observed red before implementation.
-
-## Verification evidence
-
-- Pending.

docs/scratchpads/tess-m1-sec-004-discord-ingress.md

@@ -1,35 +0,0 @@
-# Scratchpad — TESS-M1-SEC-004 Discord ingress
-
-- **Task / issue:** TESS-M1-SEC-004 / #707
-- **Branch:** `fix/tess-discord-ingress` from `origin/main` at `59e49cfd`
-- **Objective:** Authenticate the Discord plugin service at gateway ingress; enforce explicit guild/channel/user allowlists; attach Discord message and generated correlation IDs; reject replayed native message IDs.
-- **Scope:** `plugins/discord`, `apps/gateway`, and existing Discord admin/developer protocol docs.
-- **Budget:** Task estimate 28K; no explicit hard cap supplied.
-- **Assumptions:** The Discord plugin and gateway share an injected high-entropy `DISCORD_SERVICE_TOKEN`; a configured Discord plugin fails closed without it. Allowlist configuration is comma-separated Discord snowflakes. Discord native message ID is the replay key, with bounded in-memory retention pending the M2 durable inbox/idempotency work.
-
-## Plan
-
-1. Add failing tests covering ingress service authentication/signing, unlisted guild/channel/user rejection, correlation propagation, and replay rejection.
-2. Implement the signed Discord ingress envelope and allowlist validation in the plugin.
-3. Authenticate and validate the envelope at the gateway boundary, then enforce bounded replay protection before agent dispatch.
-4. Document the service-token and allowlist operations; run focused and baseline gates; obtain independent review.
-
-## Progress
-
-- 2026-07-12: Intake complete; PRD TESS-SEC-005, architecture, and threat model reviewed.
-- Added service-token Socket.IO authentication, HMAC-signed Discord envelopes, default-deny guild/channel/user allowlists, correlated message metadata, bounded replay rejection, and fail-fast configuration checks.
-- Code and security reviews completed. Code review findings on service persistence ownership, package-boundary tests, disconnected ingress observability, and chat payload validation were remediated; final independent code review approved.
-
-## Risks / blockers
-
-- Existing `main` has known unrelated Prettier debt; only changed files will be held format-clean. Durable replay persistence is intentionally out of scope for this M1 prerequisite and belongs to TESS-M2 durable inbox/idempotency work.
-
-## Verification evidence
-
-- Focused ingress suite: `pnpm --filter @mosaicstack/gateway test -- discord-ingress.security.spec.ts` — 7 passed.
-- Gateway suite: `pnpm --filter @mosaicstack/gateway test` — 513 passed, 11 skipped.
-- Plugin suite: `pnpm --filter @mosaicstack/discord-plugin test` — no tests, passed by configured `--passWithNoTests`.
-- `pnpm typecheck` — passed.
-- `pnpm lint` — passed.
-- `pnpm format:check` — fails only on the known pre-existing Tess documentation debt listed in the task dispatch; changed files pass targeted Prettier verification.
-- Codex security review — no findings; final Codex code review — approved.

docs/scratchpads/tess-m1-sec-006-session-gc-scope.md

@@ -1,22 +0,0 @@
-# Scratchpad — TESS-M1-SEC-006 Session GC scope
-
-- **Task / issue:** TESS-M1-SEC-006 / #707
-- **Branch:** `fix/tess-session-gc-scope` from `origin/main` at `59e49cfd`
-- **Objective:** Make session cleanup session-scoped and prevent automatic global retention/GC without an authorized, auditable operation.
-- **Scope:** `apps/gateway`, `packages/log`, admin/developer operations documentation.
-- **Budget:** Task estimate 18K; no explicit hard cap supplied.
-- **Assumption:** No authorized global retention service exists today. Existing full/sweep GC must therefore be disabled from startup and cron paths, while single-session cleanup remains available.
-
-## Plan
-
-1. Add failing isolation tests proving single-session cleanup only demotes its own logs and automatic startup/scheduled GC cannot globally delete session data.
-2. Add session-scoped log repository retention and make `collect(sessionId)` use it.
-3. Remove automatic full/sweep GC invocation; preserve any future global operation behind an explicit authorization/audit seam.
-4. Document the operational boundary, run gates, review, and commit without push.
-
-## Verification evidence
-
-- Isolation TDD: `pnpm --filter @mosaicstack/gateway test -- session-gc.service.spec.ts commands.integration.spec.ts command-executor-p8012.spec.ts` — 61 passed.
-- `pnpm typecheck` — passed.
-- `pnpm lint` — passed.
-- `pnpm format:check` remains red only on the known pre-existing Tess documentation debt; changed files are Prettier-clean.

docs/scratchpads/tess-m2-001-pi-service.md

@@ -1,40 +0,0 @@
-# TESS-M2-001 — Pi Interaction Service
-
-## Scope
-
-- Add a generic rostered/systemd Pi operator-interaction service in
-  `packages/mosaic/framework`.
-- Pin the service to `openai/gpt-5.6-sol`, high reasoning, and the
-  `operator-interaction` tool policy.
-- Keep identity as provisioning data; the product name appears only in the
-  committed example roster.
-
-## Security and Configuration Invariants
-
-1. The chosen display/roster name is supplied as data and must exactly match the
-   generic systemd instance.
-2. The service fails before launch if runtime, model, reasoning, or tool policy
-   differs from the pinned policy.
-3. Effective-policy output includes only name, runtime, model, reasoning, and
-   tool policy; it does not inspect or output credential variables.
-4. The default example is replaceable without a source change; the TDD suite
-   provisions `Nova` from the same profile.
-
-## Evidence
-
-- `src/fleet/tess-service-profile.test.ts` proves a `Nova` provisioning path,
-  roster parser/env serialization, effective-policy output, fail-fast drift
-  rejection, and absence of the product name from generic source/profile.
-- `test-fleet-units.sh` validates the generic interaction systemd unit requires
-  per-agent config and invokes fail-fast startup validation.
-- `test-start-agent-session.sh` proves the tool-policy value is exported into
-  the Pi pane; `compose-contract.spec.ts` proves it becomes an explicit
-  runtime contract block.
-- Fresh-worktree dependency install plus root `pnpm typecheck`, `pnpm lint`,
-  `pnpm format:check`, and `pnpm test` passed; package/full fleet suites passed.
-- Independent Codex code and security reviews passed with no remaining findings.
-
-## Delivery Notes
-
-- Branch starts from fresh `origin/main` at `86a50138`.
-- PR targets `main` and references issue `#708`.

docs/scratchpads/tess-m2-002-durable-state.md

@@ -1,63 +0,0 @@
-# TESS-M2-002 — Durable Tess State
-
-- **Issue:** #708
-- **Task:** `TESS-M2-002` / `TESS-STA-001`, `TESS-SEC-007..008`
-- **Branch:** `feat/tess-durable-state`
-- **Base:** fresh `origin/main` at `e3b5113be21e51d015fa1ae54572929b2a4acd9f`
-- **Budget assumption:** 38K task estimate; no explicit cap. Use focused TDD plus workspace validation.
-
-## Objective
-
-Persist a Tess session's immutable identity, inbox/outbox idempotency state, checkpoints,
-handoffs, and approval bindings so a new service instance can recover it after a process
-restart or context compaction without replaying a completed message or applied side effect.
-
-## Plan
-
-1. Write recovery/idempotency tests first in `packages/agent/src/tess-durable-session.test.ts`.
-2. Add transport-neutral durable-state contracts/state machine in `packages/agent`.
-3. Add canonical PostgreSQL schema/migration and a gateway Drizzle repository adapter.
-4. Wire gateway service/module and reuse `tess:command-approval:*` durable approval semantics
-   for exact, actor/tenant/action-bound approval consumption.
-5. Test PGlite restart recovery with separate service instances sharing the same durable DB.
-6. Document the recovery/compaction operation and update Tess architecture evidence.
-7. Run focused, cold-cache, workspace, migration, review, commit, push, and open PR to `main`.
-
-## Required Evidence
-
-| Requirement | Primary evidence |
-| --- | --- |
-| Restart recovery | Test creates a second coordinator over unchanged durable store after simulated process death. |
-| No duplicate side effects | Duplicate ingress and post-restart dispatch assert one handler/effect invocation. |
-| Compaction survival | Checkpoint/handoff/reconstructed state preserve the same session identity and pending records. |
-| Durable approvals | Existing `tess:command-approval` record is consumed only once and survives a new authorization service instance. |
-| Handoff | Stored handoff is portable and reconstructed without live process state. |
-
-## Progress
-
-- Intake complete: PRD AC-TESS-06, threat TM-07/TM-08, and verification matrix reviewed.
-- Affected surfaces: `packages/agent`, `apps/gateway`, `packages/db`; auth/authorization and DB migration tests required.
-- TDD is required (security authorization and critical state mutation).
-
-## Risks
-
-- An external provider action cannot be atomically committed with the database. The outbox
-  gives the receiver a stable idempotency key; generic recovery never replays an ambiguous
-  `processing` effect, and completed effects are never redispatched.
-- PostgreSQL is canonical; PGlite is the local/restart test implementation.
-
-## Verification
-
-- TDD red: `pnpm --filter @mosaicstack/agent test src/tess-durable-session.test.ts`
-  initially failed because the durable-state module did not exist.
-- Focused green: 7 agent state-machine tests; 6 PGlite repository tests (including
-  close/reopen recovery and encrypted-at-rest redaction); 5 durable-approval tests; DB migration tests.
-- Full cold-cache green: `pnpm turbo run typecheck lint test --force` completed
-  88 tasks with zero cache hits; `pnpm format:check` and `git diff --check` passed.
-- Fresh worktree dependency install passed with
-  `pnpm install --frozen-lockfile --store-dir /home/jarvis/.local/share/pnpm/store`.
-  The default pnpm store path was inaccessible to this harness, so the explicit
-  user-owned store path was required.
-- Codex review identified plaintext durable payload risk; resolved by AES-256-GCM sealing
-  after redaction, with an at-rest ciphertext assertion in the PGlite suite.
-- Pending final clean review, commit, and PR.

docs/tess/ARCHITECTURE.md

@@ -37,12 +37,6 @@ Required operations:
 
 Every call receives an immutable, server-derived actor/tenant/channel scope and correlation ID. Caller-supplied actor IDs are forbidden. Unsupported capabilities fail closed with typed errors.
 
-### M1 Registry Boundary
-
-`@mosaicstack/agent` owns the explicit `AgentRuntimeProviderRegistry`; duplicate provider IDs are rejected rather than replaced. Gateway owns `RuntimeProviderService`, which creates a frozen `RuntimeScope` from authenticated `ActorTenantScope` and trusted ingress channel/correlation metadata before every provider call. The service checks the declared provider capability before invoking a side effect and records metadata-only audit events (`providerId`, operation, outcome, actor/tenant/channel, correlation, and resource ID). It never records message bodies, idempotency keys, or approval references.
-
-Termination is fail-closed: a runtime approval verifier consumes a one-time, exact action binding for the provider, session, actor, tenant, channel, and correlation ID before `terminate` reaches a provider. The verifier reuses the Redis-backed `interaction:command-approval:*` store and its expiry/delete-on-consume semantics; it has no parallel approval store. This internal service introduces no HTTP endpoint; later Discord, CLI, MCP, and provider adapters consume the same gateway boundary.
-
 ## Authority Model
 
 | Intent                                                                      | Owner                   | Tess behavior                                                          |
@@ -56,30 +50,7 @@ Termination is fail-closed: a runtime approval verifier consumes a one-time, exa
 
 A Tess session has stable `sessionId`, `tenantId`, `ownerId`, provider/runtime identity, ingress bindings, cursor, checkpoint, inbox/outbox, and idempotency records. Discord and CLI bind to the same authorized session. Ownership is verified server-side on every list/read/attach/send/terminate operation.
 
-Valkey holds the existing short-lived, one-time command-approval records; PostgreSQL is canonical for durable session bindings, checkpoints, inbox/outbox, and idempotency. Pi session files are replay sources, not cross-agent truth.
-
-### M2 Durable Recovery
-
-`@mosaicstack/agent` owns a transport-neutral state machine and `apps/gateway` provides its
-PostgreSQL adapter. `interaction_sessions` holds immutable identity; inbox/outbox records use a
-per-session unique idempotency key and transition `pending → processing → processed|delivered`.
-Checkpoints are immutable history scoped by session and checkpoint ID: the latest checkpoint
-supports compaction recovery, while a handoff always resolves the exact checkpoint it references.
-Recovery requeues only interrupted inbox work; an ambiguous `processing` outbox record is preserved
-until separately authorized reconciliation can establish its external delivery state.
-
-Provider sends travel through the existing `RuntimeProviderService` with the persisted outbox
-idempotency key. A normal dispatch claims exactly one outbox record and verifies its stored
-correlation and channel against the server-derived request scope; it never requeues or drains
-another live record. Inbox/outbox payloads and checkpoint cursor/summary pass through the existing
-secret/PII redactor and AES-256-GCM sealing before persistence; decryption occurs only in the
-scoped gateway repository path, and runtime audit remains metadata-only.
-
-An external effect cannot share a database transaction. If a process dies after an effect begins
-but before its terminal outbox transition, automatic recovery does not replay that ambiguous claim.
-It remains `processing` until separately authorized reconciliation can establish delivery state;
-completed effects are never redispatched. Operators can therefore restart the gateway/Pi service,
-reconstruct the session, and resume pending inbox work without relying on process-local state.
+Valkey may hold ephemeral coordination state; PostgreSQL is canonical for durable session bindings, approvals, audit, checkpoints, inbox/outbox, and idempotency. Pi session files are replay sources, not cross-agent truth.
 
 ## Transport Strategy
 
@@ -87,12 +58,6 @@ reconstruct the session, and resume pending inbox work without relying on proces
 - **Forward:** Matrix/native Mosaic provider using authenticated identity, idempotent transaction IDs, replay cursors, and the same contract suite.
 - Discord/CLI never call tmux or Matrix directly.
 
-### Fleet/tmux Provider Boundary
-
-`TmuxFleetRuntimeProvider` supports only rostered fleet peers. Its transport resolves the configured roster socket itself and verifies the exact `=<agent>:0.0` pane and declared runtime command before every attach, message, or termination operation. Prefixes, unrostered session IDs, unavailable sockets, dead panes, and runtime identity mismatches fail closed; callers cannot supply a socket or raw tmux target.
-
-The provider advertises list, tree, read-only attach, send, and terminate. List/tree/health and read attach all default-deny until a scope-aware read authority permits the operation and exact peer. Attach produces a short-lived handle bound to the immutable actor, tenant, channel, and correlation scope; it never opens a server-side terminal and rejects `control` mode. Fleet stream support is intentionally absent. Tess has no direct write/control authority: send and terminate default-deny until a Mos authority adapter explicitly allows the exact session and immutable scope. The gateway registry remains the audit boundary for every requested, denied, and successful provider operation, and still consumes the exact-action termination approval before the provider is invoked.
-
 ## Plugin Families
 
 1. Channel: Discord now; other channels later.
@@ -104,5 +69,3 @@ The provider advertises list, tree, read-only attach, send, and terminate. List/
 ## Deployment
 
 Tess runs as a rostered, systemd-supervised Pi agent using GPT-5.6 Sol and high reasoning. Secrets are supplied through approved runtime secret mechanisms. Startup fails when required model, gateway identity, Discord binding, or durable-state dependencies are missing. Health reports effective model/reasoning/tool policy without credential material.
-
-The interaction-service identity is provisioning data, not a source identifier: the roster and per-agent environment carry the chosen display/roster name into a generic systemd instance. The service rejects a name mismatch or any drift from its pinned Pi/GPT-5.6 Sol/high/operator-interaction effective policy before launch. Its policy printer exposes only those resolved safe fields.

docs/tess/TASKS.md

@@ -3,24 +3,22 @@
 > Mission: `tess-20260712` · Issue: #706 · PRD requirements: `TESS-*`
 > Orchestrator is sole writer. Workers must not modify this file.
 > `repo` contains one or more comma-separated repository-relative roots; every listed root must exist before dispatch.
-> **BASE CONVENTION (Mos-locked 2026-07-12):** EVERY M1 dispatch targets `base=main` and branches from fresh `origin/main`. Do NOT base on `feat/tess-interaction-agent` — that is the STALE planning branch (merged via #712); basing on it yields `mergeable=False` + intervening-commit noise (cf. #723/SEC-005 re-base). Every dispatch brief must state base=main + branch-from-origin/main.
 
 | id | status | description | issue | agent | repo | branch | depends_on | estimate | notes |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | TESS-PLAN-001 | done | Finalize PRD, architecture, authority boundary, threat model, migration inventory, and verification matrix | #706 | sonnet | docs, packages/types, apps/gateway | feat/tess-interaction-agent | — | 22K | Independent gate PASS after two remediation rounds; completion effective when planning PR merges |
-| TESS-M1-SEC-001 | done | Enforce command scopes/roles and durable exact-action approval for privileged/destructive commands | #707 | codex | apps/gateway | fix/tess-command-authz | TESS-PLAN-001 | 25K | TESS-SEC-002; diskhygiene-terra; PR #718 head e3d98d73 MERGED (ROR 16829) |
-| TESS-M1-SEC-002 | done | Enforce owner/tenant binding on session list/read/attach/send/terminate across REST and WS | #707 | codex | apps/gateway | fix/tess-session-ownership | TESS-PLAN-001 | 30K | TESS-SEC-003; coder0; PR #715 head 43ffbe7b MERGED (ROR 16808) |
-| TESS-M1-SEC-003 | done | Bind MCP actor/tenant to authenticated context and add per-tool scopes | #707 | codex | apps/gateway | fix/tess-mcp-identity | TESS-PLAN-001 | 22K | TESS-SEC-004; coder1; PR #717 head 9ab776f9 MERGED (ROR 16819) |
-| TESS-M1-SEC-004 | done | Add authenticated Discord service ingress, allowlists, correlation and replay protection | #707 | codex | plugins/discord, apps/gateway | fix/tess-discord-ingress | TESS-PLAN-001 | 28K | TESS-SEC-005; coder4; PR #716 head 55ae77b6 MERGED (ROR 16830) |
-| TESS-M1-SEC-005 | done | Redact/classify secret and PII before persistence/egress; harden provider login flow | #707 | codex | apps/gateway, packages/log | fix/tess-redaction | TESS-PLAN-001 | 28K | TESS-SEC-006; coder1 (Mos-routed from blocked wrapfix-terra); mis-based #723 CLOSED superseded. MERGED to main: PR #725 head 726f7ab7 (ROR 16880). Verified chat persistence + egress redaction hooks; canary tests split-secret/private-key/overflow/persistence classification; provider login no auth URL/raw token in chat output |
-| TESS-M1-SEC-006 | done | Scope session GC/retention or separate authorized global retention job | #707 | codex | apps/gateway, packages/log | fix/tess-session-gc-scope | TESS-PLAN-001 | 18K | TESS-SEC-009; coder4; PR #720 base=main. MERGED to main: head 37be090e (ROR 16861). Both blockers fixed: glob metachar sessionIds escaped+regression; durable approval survives GC pass (create→GC→key remains→authz succeeds); /gc disabled, per-session log demotion, no fullCollect/sweepOrphans entry, legacy repeatable GC schedule removed |
-| TESS-M1-001 | done | Define AgentRuntimeProvider, capabilities, session tree, normalized stream events/errors, attach semantics | #707 | codex | packages/types, packages/agent | feat/tess-runtime-contract | TESS-PLAN-001 | 25K | TESS-ARP-001, TESS-TRN-001; wrapfix-terra; PR #719 head 5c42e67f MERGED (ROR 16813) |
-| TESS-M1-002 | done | Implement provider registry/service with immutable actor scope, approval, audit and correlation boundaries | #707 | codex | apps/gateway, packages/agent | feat/tess-provider-registry | TESS-M1-001,TESS-M1-SEC-001,TESS-M1-SEC-002,TESS-M1-SEC-003 | 30K | TESS-SEC-001..004,007; coder0; PR #722 head c529022d MERGED (ROR 16849) |
-| TESS-M1-003 | done | Implement tmux/fleet runtime provider and safe attach/message/terminate capability policy | #707 | codex | packages/mosaic, packages/agent | feat/tess-fleet-provider | TESS-M1-002 | 30K | TESS-FLT-001; coder0; PR #724 base=main. MERGED to main: head 355d814f (ROR 16868). HARD BOUNDARY verified: writes/control default-deny before tmux probing unless write authority permits; final exact-target authz after roster/socket/runtime verification; exact target/prefix/runtime-drift tests; read-only attach with immutable scope handles; empty-msg/default-deny/unverified-target tests; no credential material |
-| TESS-M1-OBS-001 | done | Implement correlation propagation, structured runtime/provider/tool audit, health/readiness and safe effective-policy status | #707 | codex | apps/gateway, packages/agent, packages/log | feat/tess-observability-terra | TESS-M1-002 | 24K | TESS-OBS-001; SOLE owner=diskhygiene-terra. MERGED to main at REBASED head: PR #726 head 53f5414 (re-ROR comment 16886, prior 16881@adfa5c06 discarded after head move), CI 1723 green. Both @mosaicstack/log barrel exports coexist (redaction + runtime-audit), metadata-only/SHA-256 audit intact, fail-closed audit-before-side-effects intact, safe status/effective-policy/readiness |
-| TESS-M1-V | done | Independent architecture/security review and complete contract/abuse-suite verification | #707 | mos-reviewer | apps/gateway, packages/agent, packages/log, plugins/discord | review/tess-m1 | TESS-M1-SEC-001,TESS-M1-SEC-002,TESS-M1-SEC-003,TESS-M1-SEC-004,TESS-M1-SEC-005,TESS-M1-SEC-006,TESS-M1-003,TESS-M1-OBS-001 | 20K | Gate M2 = PASS (Mos-owned independent non-author reviewer, 2026-07-12): all 5 priority seams verified live, 60+ tests green. M2 (#708) OPEN. Orchestrator did NOT run a competing lane (prior reviewer-lane dispatch recalled). Non-gating follow-up from this review captured as TESS-M1-FUP-001 (execute() authz-error mis-classification), scheduled to land before/with TESS-M3-001 — not now |
-| TESS-M1-FUP-001 | not-started | RuntimeProviderService.execute() records provider-thrown authorization errors as failed/provider_error instead of denied/policy_denied | #707 | — | apps/gateway, packages/agent | — | — | 6K | NON-GATING follow-up from M1-V review (2026-07-12). Provider-thrown authz errors (e.g. FleetRuntimeProviderError 'forbidden' from M1-003 write-authority) mis-classify as outcome:'failed'/'provider_error' rather than 'denied'/'policy_denied'. Low-priority. Land BEFORE/WITH TESS-M3-001 fleet-provider registry wiring (#709), NOT now |
-| TESS-M2-001 | in-progress | Add Tess roster/profile/service pinned to GPT-5.6 Sol high with fail-fast config and observable effective policy | #708 | coder0 | packages/mosaic | feat/tess-pi-service | TESS-M1-V | 22K | TESS-PI-001; explicit AC-TESS-03 test. Mos-dispatched DIRECTLY to coder0 (2026-07-12) — orchestrator tracks, does NOT dispatch a competing lane. Branch feat/tess-pi-service from fresh origin/main 86a50138; first TDD packages/mosaic/src/fleet/tess-service-profile.test.ts. NAME-AS-CONFIG INVARIANT (MISSION-MANIFEST #6, b01fdf11): agent name = config parameter (default example only), NO hardcoded key/identifier/default; profile carries name as DATA; M2 exit gate must prove a DISTINCT name provisions cleanly with ZERO code change (coder0 enforcing via a 'Nova' provisioning case). base=main, PR-open-STOP, independent non-author ROR then Mos merges. |
+| TESS-M1-SEC-001 | not-started | Enforce command scopes/roles and durable exact-action approval for privileged/destructive commands | #707 | codex | apps/gateway | fix/tess-command-authz | TESS-PLAN-001 | 25K | TESS-SEC-002; security TDD |
+| TESS-M1-SEC-002 | not-started | Enforce owner/tenant binding on session list/read/attach/send/terminate across REST and WS | #707 | codex | apps/gateway | fix/tess-session-ownership | TESS-PLAN-001 | 30K | TESS-SEC-003; security TDD |
+| TESS-M1-SEC-003 | not-started | Bind MCP actor/tenant to authenticated context and add per-tool scopes | #707 | codex | apps/gateway | fix/tess-mcp-identity | TESS-PLAN-001 | 22K | TESS-SEC-004; security TDD |
+| TESS-M1-SEC-004 | not-started | Add authenticated Discord service ingress, allowlists, correlation and replay protection | #707 | codex | plugins/discord, apps/gateway | fix/tess-discord-ingress | TESS-PLAN-001 | 28K | TESS-SEC-005; security TDD |
+| TESS-M1-SEC-005 | not-started | Redact/classify secret and PII before persistence/egress; harden provider login flow | #707 | codex | apps/gateway, packages/log | fix/tess-redaction | TESS-PLAN-001 | 28K | TESS-SEC-006; seeded canary tests |
+| TESS-M1-SEC-006 | not-started | Scope session GC/retention or separate authorized global retention job | #707 | codex | apps/gateway, packages/log | fix/tess-session-gc-scope | TESS-PLAN-001 | 18K | TESS-SEC-009; isolation TDD |
+| TESS-M1-001 | not-started | Define AgentRuntimeProvider, capabilities, session tree, normalized stream events/errors, attach semantics | #707 | codex | packages/types, packages/agent | feat/tess-runtime-contract | TESS-PLAN-001 | 25K | TESS-ARP-001, TESS-TRN-001; contract TDD |
+| TESS-M1-002 | not-started | Implement provider registry/service with immutable actor scope, approval, audit and correlation boundaries | #707 | codex | apps/gateway, packages/agent | feat/tess-provider-registry | TESS-M1-001,TESS-M1-SEC-001,TESS-M1-SEC-002,TESS-M1-SEC-003 | 30K | TESS-SEC-001..004,007; security TDD |
+| TESS-M1-003 | not-started | Implement tmux/fleet runtime provider and safe attach/message/terminate capability policy | #707 | codex | packages/mosaic, packages/agent | feat/tess-fleet-provider | TESS-M1-002 | 30K | TESS-FLT-001; exact target/identity tests |
+| TESS-M1-OBS-001 | not-started | Implement correlation propagation, structured runtime/provider/tool audit, health/readiness and safe effective-policy status | #707 | codex | apps/gateway, packages/agent, packages/log | feat/tess-observability | TESS-M1-002 | 24K | TESS-OBS-001; no credential material |
+| TESS-M1-V | not-started | Independent architecture/security review and complete contract/abuse-suite verification | #707 | sonnet | apps/gateway, packages/agent, packages/log, plugins/discord | review/tess-m1 | TESS-M1-SEC-001,TESS-M1-SEC-002,TESS-M1-SEC-003,TESS-M1-SEC-004,TESS-M1-SEC-005,TESS-M1-SEC-006,TESS-M1-003,TESS-M1-OBS-001 | 20K | Gate M2 |
+| TESS-M2-001 | not-started | Add Tess roster/profile/service pinned to GPT-5.6 Sol high with fail-fast config and observable effective policy | #708 | codex | packages/mosaic/framework | feat/tess-pi-service | TESS-M1-V | 22K | TESS-PI-001; explicit AC-TESS-03 test |
 | TESS-M2-002 | not-started | Implement durable session identity, inbox/outbox, approval, checkpoint, handoff, compaction and restart recovery | #708 | codex | apps/gateway, packages/agent, packages/db | feat/tess-durable-state | TESS-M2-001 | 38K | TESS-STA-001, TESS-SEC-007..008; recovery TDD |
 | TESS-M2-V | not-started | Clean-host Pi launch plus model/policy status and restart/compaction/duplicate-side-effect verification | #708 | sonnet | apps/gateway/src/__tests__/integration, packages/mosaic/src | review/tess-m2 | TESS-M2-002 | 18K | Gate M3; AC-TESS-03/06 |
 | TESS-M3-001 | not-started | Bind dedicated Tess Discord channel with streaming, threads, attachments, pairing/RBAC and approvals | #709 | codex | plugins/discord, apps/gateway | feat/tess-discord | TESS-M2-V,TESS-M1-SEC-004 | 35K | TESS-DSC-001 |

packages/agent/src/index.ts

@@ -1,5 +1 @@
 export const VERSION = '0.0.0';
-
-export * from './runtime-provider-registry.js';
-export * from './tmux-fleet-runtime-provider.js';
-export * from './tess-durable-session.js';

packages/agent/src/runtime-provider-registry.test.ts

@@ -1,95 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-import { AgentRuntimeProviderRegistry } from './runtime-provider-registry.js';
-
-class TestRuntimeProvider implements AgentRuntimeProvider {
-  readonly id = 'test-runtime';
-
-  async capabilities(_scope: RuntimeScope): Promise<RuntimeCapabilitySet> {
-    return { supported: ['session.list'] };
-  }
-
-  async health(_scope: RuntimeScope): Promise<RuntimeHealth> {
-    return { status: 'healthy', checkedAt: '2026-07-12T00:00:00.000Z' };
-  }
-
-  async listSessions(_scope: RuntimeScope): Promise<RuntimeSession[]> {
-    return [];
-  }
-
-  async getSessionTree(_scope: RuntimeScope): Promise<RuntimeSessionTree[]> {
-    return [];
-  }
-
-  async *streamSession(
-    _sessionId: string,
-    _cursor: string | undefined,
-    _scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    return;
-  }
-
-  async sendMessage(
-    _sessionId: string,
-    _message: RuntimeMessage,
-    _scope: RuntimeScope,
-  ): Promise<void> {}
-
-  async attach(
-    _sessionId: string,
-    _mode: RuntimeAttachMode,
-    _scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    return {
-      attachmentId: 'attachment-1',
-      sessionId: 'session-1',
-      mode: 'read',
-      expiresAt: '2026-07-12T00:00:00.000Z',
-    };
-  }
-
-  async detach(_attachmentId: string, _scope: RuntimeScope): Promise<void> {}
-
-  async terminate(_sessionId: string, _approvalRef: string, _scope: RuntimeScope): Promise<void> {}
-}
-
-describe('AgentRuntimeProviderRegistry', (): void => {
-  it('resolves only registered runtime providers', (): void => {
-    const registry = new AgentRuntimeProviderRegistry();
-    const provider = new TestRuntimeProvider();
-
-    registry.register(provider);
-
-    expect(registry.get(provider.id)).toBe(provider);
-    expect(registry.get('unknown-runtime')).toBeUndefined();
-    expect(registry.list()).toEqual([provider]);
-  });
-
-  it('rejects duplicate and blank provider identities rather than silently replacing a runtime', (): void => {
-    const registry = new AgentRuntimeProviderRegistry();
-    const provider = new TestRuntimeProvider();
-
-    registry.register(provider);
-
-    expect((): void => {
-      registry.register(provider);
-    }).toThrow(/already registered/);
-    expect((): void => {
-      registry.require('');
-    }).toThrow(/provider ID is required/);
-    expect((): void => {
-      registry.require('unknown-runtime');
-    }).toThrow(/not registered/);
-  });
-});

packages/agent/src/runtime-provider-registry.ts

@@ -1,40 +0,0 @@
-import type { AgentRuntimeProvider } from '@mosaicstack/types';
-
-/**
- * Registry for runtime providers. Registration is explicit and replacement is
- * forbidden so a provider identity cannot be silently hijacked at runtime.
- */
-export class AgentRuntimeProviderRegistry {
-  private readonly providers = new Map<string, AgentRuntimeProvider>();
-
-  register(provider: AgentRuntimeProvider): void {
-    const providerId = provider.id.trim();
-    if (providerId.length === 0) {
-      throw new Error('Runtime provider ID is required');
-    }
-    if (this.providers.has(providerId)) {
-      throw new Error(`Runtime provider is already registered: ${providerId}`);
-    }
-    this.providers.set(providerId, provider);
-  }
-
-  get(providerId: string): AgentRuntimeProvider | undefined {
-    return this.providers.get(providerId);
-  }
-
-  require(providerId: string): AgentRuntimeProvider {
-    const normalizedProviderId = providerId.trim();
-    if (normalizedProviderId.length === 0) {
-      throw new Error('Runtime provider ID is required');
-    }
-    const provider = this.providers.get(normalizedProviderId);
-    if (!provider) {
-      throw new Error(`Runtime provider is not registered: ${normalizedProviderId}`);
-    }
-    return provider;
-  }
-
-  list(): AgentRuntimeProvider[] {
-    return Array.from(this.providers.values());
-  }
-}

packages/agent/src/tess-durable-session.test.ts

@@ -1,305 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  DurableSessionCoordinator,
-  InMemoryDurableSessionStore,
-  type DurableSessionIdentity,
-} from './tess-durable-session.js';
-
-const IDENTITY: DurableSessionIdentity = {
-  agentName: 'Nova',
-  sessionId: 'tess-session-1',
-  tenantId: 'tenant-1',
-  ownerId: 'owner-1',
-  providerId: 'fleet',
-  runtimeSessionId: 'nova',
-};
-
-describe('DurableSessionCoordinator', () => {
-  it('reconstructs an exact session identity, pending inbox/outbox, checkpoint, and handoff after a simulated process restart', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const beforeRestart = new DurableSessionCoordinator(store);
-
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'ingress-1',
-      correlationId: 'correlation-1',
-      content: 'continue the session',
-    });
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-1',
-      correlationId: 'correlation-1',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'resumable response',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-1',
-      cursor: 'cursor-42',
-      summary: 'operator asked for recovery proof',
-      compactionEpoch: 0,
-    });
-    await beforeRestart.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-1',
-      destination: 'mos',
-      correlationId: 'correlation-1',
-      checkpointId: 'checkpoint-1',
-      status: 'pending',
-    });
-
-    // Simulate an ungraceful process death: no in-memory coordinator state survives.
-    const afterRestart = new DurableSessionCoordinator(store);
-    const recovered = await afterRestart.recover(IDENTITY.sessionId);
-
-    expect(recovered.identity).toEqual(IDENTITY);
-    expect(recovered.inbox).toMatchObject([{ idempotencyKey: 'ingress-1', status: 'pending' }]);
-    expect(recovered.outbox).toMatchObject([{ idempotencyKey: 'outbox-1', status: 'pending' }]);
-    expect(recovered.checkpoint).toMatchObject({
-      checkpointId: 'checkpoint-1',
-      cursor: 'cursor-42',
-    });
-    expect(recovered.handoffs).toMatchObject([{ handoffId: 'handoff-1', status: 'pending' }]);
-  });
-
-  it('rebinds a recovered runtime while preserving the immutable conversation owner scope', async () => {
-    const coordinator = new DurableSessionCoordinator(new InMemoryDurableSessionStore());
-    await coordinator.create(IDENTITY);
-    await coordinator.create({
-      ...IDENTITY,
-      providerId: 'fleet-next',
-      runtimeSessionId: 'nova-next',
-    });
-
-    await expect(coordinator.snapshot(IDENTITY.sessionId)).resolves.toMatchObject({
-      identity: { ...IDENTITY, providerId: 'fleet-next', runtimeSessionId: 'nova-next' },
-    });
-    await expect(coordinator.create({ ...IDENTITY, ownerId: 'other-owner' })).rejects.toThrow(
-      /identity conflict/,
-    );
-  });
-
-  it('deduplicates duplicate ingress and never reprocesses an inbox record after restart or compaction', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const firstProcess = new DurableSessionCoordinator(store);
-    const handled: string[] = [];
-
-    await firstProcess.create(IDENTITY);
-    await expect(
-      firstProcess.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'ingress-duplicate',
-        correlationId: 'correlation-2',
-        content: 'only process me once',
-      }),
-    ).resolves.toMatchObject({ accepted: true });
-    await expect(
-      firstProcess.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'ingress-duplicate',
-        correlationId: 'correlation-2',
-        content: 'only process me once',
-      }),
-    ).resolves.toMatchObject({ accepted: false, status: 'pending' });
-    await expect(
-      firstProcess.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'ingress-duplicate',
-        correlationId: 'forged-correlation',
-        content: 'only process me once',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-
-    await firstProcess.drainInbox(IDENTITY.sessionId, async (entry) => {
-      handled.push(entry.idempotencyKey);
-    });
-    await firstProcess.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-after-inbox',
-      cursor: 'cursor-43',
-      summary: 'safe to compact',
-      compactionEpoch: 1,
-    });
-
-    const afterRestartAndCompaction = new DurableSessionCoordinator(store);
-    await afterRestartAndCompaction.recover(IDENTITY.sessionId);
-    await afterRestartAndCompaction.drainInbox(IDENTITY.sessionId, async (entry) => {
-      handled.push(entry.idempotencyKey);
-    });
-
-    expect(handled).toEqual(['ingress-duplicate']);
-  });
-
-  it('does not redispatch an already applied outbox side effect after replay, restart, or compaction', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const beforeRestart = new DurableSessionCoordinator(store);
-    const appliedEffects: string[] = [];
-
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'effect-1',
-      correlationId: 'correlation-3',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'send exactly once',
-    });
-    await expect(
-      beforeRestart.enqueueOutbox({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'effect-1',
-        correlationId: 'correlation-3',
-        channelId: 'cli',
-        kind: 'provider.send',
-        content: 'send exactly once',
-      }),
-    ).resolves.toMatchObject({ accepted: false, status: 'pending' });
-
-    await beforeRestart.dispatchOutbox(IDENTITY.sessionId, async (entry) => {
-      appliedEffects.push(entry.idempotencyKey);
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-after-effect',
-      cursor: 'cursor-44',
-      summary: 'effect persisted before compaction',
-      compactionEpoch: 1,
-    });
-
-    const afterRestartAndCompaction = new DurableSessionCoordinator(store);
-    await afterRestartAndCompaction.recover(IDENTITY.sessionId);
-    await afterRestartAndCompaction.dispatchOutbox(IDENTITY.sessionId, async (entry) => {
-      appliedEffects.push(entry.idempotencyKey);
-    });
-
-    expect(appliedEffects).toEqual(['effect-1']);
-  });
-
-  it('rejects outbox idempotency-key reuse when immutable effect data differs', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const coordinator = new DurableSessionCoordinator(store);
-
-    await coordinator.create(IDENTITY);
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-conflict',
-      correlationId: 'correlation-outbox',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'original effect',
-    });
-    await expect(
-      coordinator.enqueueOutbox({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'outbox-conflict',
-        correlationId: 'correlation-outbox',
-        channelId: 'forged-channel',
-        kind: 'provider.send',
-        content: 'original effect',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-  });
-
-  it('retains an ambiguous failed provider effect as processing until explicit recovery', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const beforeRestart = new DurableSessionCoordinator(store);
-
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'ambiguous-effect',
-      correlationId: 'correlation-ambiguous',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'preserve this effect claim',
-    });
-    await expect(
-      beforeRestart.dispatchOutbox(IDENTITY.sessionId, async (): Promise<void> => {
-        throw new Error('provider connection dropped after submit');
-      }),
-    ).rejects.toThrow(/connection dropped/);
-
-    const afterRestart = new DurableSessionCoordinator(store);
-    await afterRestart.recover(IDENTITY.sessionId);
-    const calls: string[] = [];
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      calls.push(entry.idempotencyKey);
-    });
-
-    expect(calls).toEqual([]);
-    expect(await afterRestart.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'ambiguous-effect', status: 'processing' }],
-    });
-  });
-
-  it('rejects a handoff-id replay with different immutable state', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const coordinator = new DurableSessionCoordinator(store);
-
-    await coordinator.create(IDENTITY);
-    await coordinator.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-conflict',
-      cursor: 'cursor-conflict',
-      summary: 'handoff conflict proof',
-      compactionEpoch: 0,
-    });
-    await coordinator.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-conflict',
-      destination: 'mos',
-      correlationId: 'correlation-conflict',
-      checkpointId: 'checkpoint-conflict',
-      status: 'pending',
-    });
-
-    await expect(
-      coordinator.handoff({
-        sessionId: IDENTITY.sessionId,
-        handoffId: 'handoff-conflict',
-        destination: 'forged-destination',
-        correlationId: 'correlation-conflict',
-        checkpointId: 'checkpoint-conflict',
-        status: 'pending',
-      }),
-    ).rejects.toThrow(/identity conflict/);
-  });
-
-  it('keeps a handoff portable and resumes it from its durable checkpoint without process-local references', async () => {
-    const store = new InMemoryDurableSessionStore();
-    const source = new DurableSessionCoordinator(store);
-
-    await source.create(IDENTITY);
-    await source.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-handoff',
-      cursor: 'cursor-45',
-      summary: 'portable state',
-      compactionEpoch: 2,
-    });
-    await source.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-portable',
-      destination: 'mos',
-      correlationId: 'correlation-4',
-      checkpointId: 'checkpoint-handoff',
-      status: 'pending',
-    });
-    await source.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-later',
-      cursor: 'cursor-46',
-      summary: 'newer compacted state must not strand the handoff',
-      compactionEpoch: 3,
-    });
-
-    const receivingProcess = new DurableSessionCoordinator(store);
-    const handoff = await receivingProcess.resumeHandoff('handoff-portable');
-
-    expect(handoff.identity).toEqual(IDENTITY);
-    expect(handoff.checkpoint).toMatchObject({ checkpointId: 'checkpoint-handoff' });
-    expect(handoff.handoff).toMatchObject({ handoffId: 'handoff-portable', destination: 'mos' });
-  });
-});

packages/agent/src/tess-durable-session.ts

@@ -1,498 +0,0 @@
-export interface DurableSessionIdentity {
-  /** Provisioned roster identity; isolates durable state between named agents. */
-  agentName: string;
-  sessionId: string;
-  tenantId: string;
-  ownerId: string;
-  providerId: string;
-  runtimeSessionId: string;
-}
-
-export type DurableInboxStatus = 'pending' | 'processing' | 'processed';
-export type DurableOutboxStatus = 'pending' | 'processing' | 'delivered';
-
-export interface DurableInboxInput {
-  sessionId: string;
-  idempotencyKey: string;
-  correlationId: string;
-  content: string;
-}
-
-export interface DurableInboxEntry extends DurableInboxInput {
-  status: DurableInboxStatus;
-}
-
-export interface DurableOutboxInput {
-  sessionId: string;
-  idempotencyKey: string;
-  correlationId: string;
-  channelId: string;
-  kind: string;
-  content: string;
-}
-
-export interface DurableOutboxEntry extends DurableOutboxInput {
-  status: DurableOutboxStatus;
-}
-
-export interface DurableCheckpointInput {
-  sessionId: string;
-  checkpointId: string;
-  cursor: string;
-  summary: string;
-  compactionEpoch: number;
-}
-
-export interface DurableCheckpoint extends DurableCheckpointInput {}
-
-export interface DurableHandoffInput {
-  sessionId: string;
-  handoffId: string;
-  destination: string;
-  correlationId: string;
-  checkpointId: string;
-  status: 'pending' | 'accepted';
-}
-
-export interface DurableHandoff extends DurableHandoffInput {}
-
-export interface DurableSessionSnapshot {
-  identity: DurableSessionIdentity;
-  inbox: DurableInboxEntry[];
-  outbox: DurableOutboxEntry[];
-  checkpoint?: DurableCheckpoint;
-  handoffs: DurableHandoff[];
-}
-
-export interface DurableHandoffRecovery {
-  identity: DurableSessionIdentity;
-  checkpoint: DurableCheckpoint;
-  handoff: DurableHandoff;
-}
-
-export interface DurableEnqueueResult<TStatus extends string> {
-  accepted: boolean;
-  status: TStatus;
-}
-
-/**
- * A durable-state port. Implementations must atomically claim and complete work
- * records. Recovery may requeue interrupted inbox work, but never an
- * externally visible outbox effect: an ambiguous provider result remains
- * claimed until a separately authorized reconciliation proves it safe.
- */
-export interface DurableSessionStore {
-  create(identity: DurableSessionIdentity): Promise<void>;
-  snapshot(sessionId: string): Promise<DurableSessionSnapshot | null>;
-  enqueueInbox(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>>;
-  claimInbox(sessionId: string): Promise<DurableInboxEntry | null>;
-  completeInbox(sessionId: string, idempotencyKey: string): Promise<void>;
-  releaseInbox(sessionId: string, idempotencyKey: string): Promise<void>;
-  enqueueOutbox(input: DurableOutboxInput): Promise<DurableEnqueueResult<DurableOutboxStatus>>;
-  claimOutbox(sessionId: string): Promise<DurableOutboxEntry | null>;
-  claimOutboxByKey(sessionId: string, idempotencyKey: string): Promise<DurableOutboxEntry | null>;
-  completeOutbox(sessionId: string, idempotencyKey: string): Promise<void>;
-  releaseOutbox(sessionId: string, idempotencyKey: string): Promise<void>;
-  checkpoint(input: DurableCheckpointInput): Promise<void>;
-  findCheckpoint(sessionId: string, checkpointId: string): Promise<DurableCheckpoint | null>;
-  handoff(input: DurableHandoffInput): Promise<void>;
-  findHandoff(handoffId: string): Promise<DurableHandoff | null>;
-  requeueInFlight(sessionId: string): Promise<void>;
-}
-
-export class DurableSessionNotFoundError extends Error {
-  constructor(sessionId: string) {
-    super(`Durable Tess session not found: ${sessionId}`);
-    this.name = 'DurableSessionNotFoundError';
-  }
-}
-
-export class DurableSessionCoordinator {
-  constructor(private readonly store: DurableSessionStore) {}
-
-  async create(identity: DurableSessionIdentity): Promise<void> {
-    this.assertIdentity(identity);
-    await this.store.create(identity);
-  }
-
-  async receive(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>> {
-    this.assertRecord(input.sessionId, input.idempotencyKey, input.correlationId, input.content);
-    return this.store.enqueueInbox(input);
-  }
-
-  async enqueueOutbox(
-    input: DurableOutboxInput,
-  ): Promise<DurableEnqueueResult<DurableOutboxStatus>> {
-    this.assertRecord(
-      input.sessionId,
-      input.idempotencyKey,
-      input.correlationId,
-      input.channelId,
-      input.content,
-    );
-    if (input.kind.trim().length === 0) throw new Error('Durable outbox kind is required');
-    return this.store.enqueueOutbox(input);
-  }
-
-  async checkpoint(input: DurableCheckpointInput): Promise<void> {
-    this.assertRecord(input.sessionId, input.checkpointId, input.cursor, input.summary);
-    if (!Number.isInteger(input.compactionEpoch) || input.compactionEpoch < 0) {
-      throw new Error('Durable checkpoint compaction epoch must be a non-negative integer');
-    }
-    await this.store.checkpoint(input);
-  }
-
-  async handoff(input: DurableHandoffInput): Promise<void> {
-    this.assertRecord(input.sessionId, input.handoffId, input.destination, input.correlationId);
-    if (input.checkpointId.trim().length === 0)
-      throw new Error('Durable handoff checkpoint is required');
-    await this.store.handoff(input);
-  }
-
-  /** Read durable state without changing claim status; safe during normal operation. */
-  async snapshot(sessionId: string): Promise<DurableSessionSnapshot> {
-    const snapshot = await this.store.snapshot(sessionId);
-    if (!snapshot) throw new DurableSessionNotFoundError(sessionId);
-    return snapshot;
-  }
-
-  /** Requeue interrupted inbox work during recovery; preserve ambiguous outbox claims. */
-  async recover(sessionId: string): Promise<DurableSessionSnapshot> {
-    await this.store.requeueInFlight(sessionId);
-    return this.snapshot(sessionId);
-  }
-
-  async drainInbox(
-    sessionId: string,
-    handler: (entry: DurableInboxEntry) => Promise<void>,
-  ): Promise<void> {
-    for (;;) {
-      const entry = await this.store.claimInbox(sessionId);
-      if (!entry) return;
-      try {
-        await handler(entry);
-      } catch (error: unknown) {
-        await this.store.releaseInbox(sessionId, entry.idempotencyKey);
-        throw error;
-      }
-      // If this write fails after the handler succeeded, leave the record
-      // processing. A recovery path can retry it with its stable idempotency key.
-      await this.store.completeInbox(sessionId, entry.idempotencyKey);
-    }
-  }
-
-  async dispatchOutbox(
-    sessionId: string,
-    dispatcher: (entry: DurableOutboxEntry) => Promise<void>,
-  ): Promise<void> {
-    for (;;) {
-      const entry = await this.store.claimOutbox(sessionId);
-      if (!entry) return;
-      // A provider failure can be ambiguous: it may occur after the receiver
-      // accepted the idempotency key. Preserve the claim for reconciliation.
-      await dispatcher(entry);
-      // Do not requeue an effect after it has been applied but before its
-      // terminal state could be persisted; recovery preserves the claim.
-      await this.store.completeOutbox(sessionId, entry.idempotencyKey);
-    }
-  }
-
-  async dispatchOutboxEntry(
-    sessionId: string,
-    idempotencyKey: string,
-    dispatcher: (entry: DurableOutboxEntry) => Promise<void>,
-  ): Promise<void> {
-    const entry = await this.store.claimOutboxByKey(sessionId, idempotencyKey);
-    if (!entry) return;
-    // A provider failure can be ambiguous, so this stays processing until
-    // separately authorized reconciliation proves it safe to resolve.
-    await dispatcher(entry);
-    await this.store.completeOutbox(sessionId, entry.idempotencyKey);
-  }
-
-  async resumeHandoff(handoffId: string): Promise<DurableHandoffRecovery> {
-    const handoff = await this.store.findHandoff(handoffId);
-    if (!handoff) throw new Error(`Durable Tess handoff not found: ${handoffId}`);
-    const snapshot = await this.snapshot(handoff.sessionId);
-    const checkpoint = await this.store.findCheckpoint(handoff.sessionId, handoff.checkpointId);
-    if (!checkpoint) {
-      throw new Error(`Durable Tess handoff checkpoint is unavailable: ${handoff.checkpointId}`);
-    }
-    return { identity: snapshot.identity, checkpoint, handoff };
-  }
-
-  private assertIdentity(identity: DurableSessionIdentity): void {
-    this.assertRecord(
-      identity.agentName,
-      identity.sessionId,
-      identity.tenantId,
-      identity.ownerId,
-      identity.providerId,
-    );
-    if (identity.runtimeSessionId.trim().length === 0) {
-      throw new Error('Durable runtime session identity is required');
-    }
-  }
-
-  private assertRecord(...values: string[]): void {
-    if (values.some((value: string): boolean => value.trim().length === 0)) {
-      throw new Error('Durable session records require non-empty fields');
-    }
-  }
-}
-
-interface InMemorySessionState {
-  identity: DurableSessionIdentity;
-  inbox: Map<string, DurableInboxEntry>;
-  outbox: Map<string, DurableOutboxEntry>;
-  checkpoints: Map<string, DurableCheckpoint>;
-  handoffs: Map<string, DurableHandoff>;
-}
-
-/** Reference store for deterministic domain tests; production uses the gateway DB adapter. */
-export class InMemoryDurableSessionStore implements DurableSessionStore {
-  private readonly sessions = new Map<string, InMemorySessionState>();
-
-  async create(identity: DurableSessionIdentity): Promise<void> {
-    const existing = this.sessions.get(identity.sessionId);
-    if (existing) {
-      if (!sameEnrollmentScope(existing.identity, identity)) {
-        throw new Error(`Durable Tess session identity conflict: ${identity.sessionId}`);
-      }
-      existing.identity.providerId = identity.providerId;
-      existing.identity.runtimeSessionId = identity.runtimeSessionId;
-      return;
-    }
-    this.sessions.set(identity.sessionId, {
-      identity: copyIdentity(identity),
-      inbox: new Map(),
-      outbox: new Map(),
-      checkpoints: new Map(),
-      handoffs: new Map(),
-    });
-  }
-
-  async snapshot(sessionId: string): Promise<DurableSessionSnapshot | null> {
-    const state = this.sessions.get(sessionId);
-    if (!state) return null;
-    const checkpoint = latestCheckpoint(state.checkpoints);
-    return {
-      identity: copyIdentity(state.identity),
-      inbox: [...state.inbox.values()].map(copyInbox),
-      outbox: [...state.outbox.values()].map(copyOutbox),
-      ...(checkpoint ? { checkpoint: copyCheckpoint(checkpoint) } : {}),
-      handoffs: [...state.handoffs.values()].map(copyHandoff),
-    };
-  }
-
-  async enqueueInbox(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>> {
-    const state = this.require(input.sessionId);
-    const existing = state.inbox.get(input.idempotencyKey);
-    if (existing) {
-      if (!sameInbox(existing, input)) {
-        throw new Error(`Durable Tess inbox idempotency conflict: ${input.idempotencyKey}`);
-      }
-      return { accepted: false, status: existing.status };
-    }
-    state.inbox.set(input.idempotencyKey, { ...input, status: 'pending' });
-    return { accepted: true, status: 'pending' };
-  }
-
-  async claimInbox(sessionId: string): Promise<DurableInboxEntry | null> {
-    const state = this.require(sessionId);
-    const entry = [...state.inbox.values()].find(
-      (candidate: DurableInboxEntry): boolean => candidate.status === 'pending',
-    );
-    if (!entry) return null;
-    entry.status = 'processing';
-    return copyInbox(entry);
-  }
-
-  async completeInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    this.requireEntry(this.require(sessionId).inbox, idempotencyKey, 'inbox').status = 'processed';
-  }
-
-  async releaseInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    this.requireEntry(this.require(sessionId).inbox, idempotencyKey, 'inbox').status = 'pending';
-  }
-
-  async enqueueOutbox(
-    input: DurableOutboxInput,
-  ): Promise<DurableEnqueueResult<DurableOutboxStatus>> {
-    const state = this.require(input.sessionId);
-    const existing = state.outbox.get(input.idempotencyKey);
-    if (existing) {
-      if (!sameOutbox(existing, input)) {
-        throw new Error(`Durable Tess outbox idempotency conflict: ${input.idempotencyKey}`);
-      }
-      return { accepted: false, status: existing.status };
-    }
-    state.outbox.set(input.idempotencyKey, { ...input, status: 'pending' });
-    return { accepted: true, status: 'pending' };
-  }
-
-  async claimOutbox(sessionId: string): Promise<DurableOutboxEntry | null> {
-    const state = this.require(sessionId);
-    const entry = [...state.outbox.values()].find(
-      (candidate: DurableOutboxEntry): boolean => candidate.status === 'pending',
-    );
-    if (!entry) return null;
-    entry.status = 'processing';
-    return copyOutbox(entry);
-  }
-
-  async claimOutboxByKey(
-    sessionId: string,
-    idempotencyKey: string,
-  ): Promise<DurableOutboxEntry | null> {
-    const entry = this.require(sessionId).outbox.get(idempotencyKey);
-    if (!entry || entry.status !== 'pending') return null;
-    entry.status = 'processing';
-    return copyOutbox(entry);
-  }
-
-  async completeOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    this.requireEntry(this.require(sessionId).outbox, idempotencyKey, 'outbox').status =
-      'delivered';
-  }
-
-  async releaseOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    this.requireEntry(this.require(sessionId).outbox, idempotencyKey, 'outbox').status = 'pending';
-  }
-
-  async checkpoint(input: DurableCheckpointInput): Promise<void> {
-    const checkpoints = this.require(input.sessionId).checkpoints;
-    const existing = checkpoints.get(input.checkpointId);
-    if (existing && !sameCheckpoint(existing, input)) {
-      throw new Error(`Durable Tess checkpoint identity conflict: ${input.checkpointId}`);
-    }
-    if (!existing) checkpoints.set(input.checkpointId, { ...input });
-  }
-
-  async findCheckpoint(sessionId: string, checkpointId: string): Promise<DurableCheckpoint | null> {
-    const checkpoint = this.require(sessionId).checkpoints.get(checkpointId);
-    return checkpoint ? copyCheckpoint(checkpoint) : null;
-  }
-
-  async handoff(input: DurableHandoffInput): Promise<void> {
-    const state = this.require(input.sessionId);
-    if (!state.checkpoints.has(input.checkpointId)) {
-      throw new Error(`Durable Tess handoff checkpoint is unavailable: ${input.checkpointId}`);
-    }
-    const existing = state.handoffs.get(input.handoffId);
-    if (existing && !sameHandoff(existing, input)) {
-      throw new Error(`Durable Tess handoff identity conflict: ${input.handoffId}`);
-    }
-    if (!existing) state.handoffs.set(input.handoffId, { ...input });
-  }
-
-  async findHandoff(handoffId: string): Promise<DurableHandoff | null> {
-    for (const state of this.sessions.values()) {
-      const handoff = state.handoffs.get(handoffId);
-      if (handoff) return copyHandoff(handoff);
-    }
-    return null;
-  }
-
-  async requeueInFlight(sessionId: string): Promise<void> {
-    const state = this.require(sessionId);
-    for (const entry of state.inbox.values()) {
-      if (entry.status === 'processing') entry.status = 'pending';
-    }
-  }
-
-  private require(sessionId: string): InMemorySessionState {
-    const state = this.sessions.get(sessionId);
-    if (!state) throw new DurableSessionNotFoundError(sessionId);
-    return state;
-  }
-
-  private requireEntry<T extends { status: string }>(
-    records: Map<string, T>,
-    idempotencyKey: string,
-    kind: string,
-  ): T {
-    const entry = records.get(idempotencyKey);
-    if (!entry) throw new Error(`Durable Tess ${kind} entry not found: ${idempotencyKey}`);
-    return entry;
-  }
-}
-
-function sameEnrollmentScope(left: DurableSessionIdentity, right: DurableSessionIdentity): boolean {
-  return (
-    left.agentName === right.agentName &&
-    left.sessionId === right.sessionId &&
-    left.tenantId === right.tenantId &&
-    left.ownerId === right.ownerId
-  );
-}
-
-function sameInbox(left: DurableInboxEntry, right: DurableInboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.content === right.content
-  );
-}
-
-function sameOutbox(left: DurableOutboxEntry, right: DurableOutboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.channelId === right.channelId &&
-    left.kind === right.kind &&
-    left.content === right.content
-  );
-}
-
-function sameCheckpoint(left: DurableCheckpoint, right: DurableCheckpointInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.checkpointId === right.checkpointId &&
-    left.cursor === right.cursor &&
-    left.summary === right.summary &&
-    left.compactionEpoch === right.compactionEpoch
-  );
-}
-
-function latestCheckpoint(
-  checkpoints: Map<string, DurableCheckpoint>,
-): DurableCheckpoint | undefined {
-  return [...checkpoints.values()].sort(
-    (left: DurableCheckpoint, right: DurableCheckpoint): number =>
-      right.compactionEpoch - left.compactionEpoch,
-  )[0];
-}
-
-function sameHandoff(left: DurableHandoff, right: DurableHandoffInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.handoffId === right.handoffId &&
-    left.destination === right.destination &&
-    left.correlationId === right.correlationId &&
-    left.checkpointId === right.checkpointId &&
-    left.status === right.status
-  );
-}
-
-function copyIdentity(identity: DurableSessionIdentity): DurableSessionIdentity {
-  return { ...identity };
-}
-
-function copyInbox(entry: DurableInboxEntry): DurableInboxEntry {
-  return { ...entry };
-}
-
-function copyOutbox(entry: DurableOutboxEntry): DurableOutboxEntry {
-  return { ...entry };
-}
-
-function copyCheckpoint(checkpoint: DurableCheckpoint): DurableCheckpoint {
-  return { ...checkpoint };
-}
-
-function copyHandoff(handoff: DurableHandoff): DurableHandoff {
-  return { ...handoff };
-}

packages/agent/src/tmux-fleet-runtime-provider.test.ts

@@ -1,261 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { RuntimeScope } from '@mosaicstack/types';
-import {
-  type FleetReadAuthority,
-  type FleetWriteAuthority,
-  TmuxFleetRuntimeProvider,
-} from './tmux-fleet-runtime-provider.js';
-import type {
-  FleetRuntimeProviderError,
-  FleetRuntimeTarget,
-  FleetRuntimeTransport,
-} from './tmux-fleet-runtime-provider.js';
-
-const scope: RuntimeScope = {
-  actorId: 'operator-1',
-  tenantId: 'tenant-a',
-  channelId: 'discord-1',
-  correlationId: 'corr-1',
-};
-
-const target: FleetRuntimeTarget = {
-  id: 'coder0',
-  runtimeId: 'codex',
-  socketName: 'tess-fleet',
-};
-
-function transport(): FleetRuntimeTransport {
-  return {
-    verifySession: vi.fn(async (): Promise<FleetRuntimeTarget> => target),
-    listSessions: vi.fn(async (): Promise<FleetRuntimeTarget[]> => [target]),
-    sendMessage: vi.fn(async (): Promise<void> => undefined),
-    terminate: vi.fn(async (): Promise<void> => undefined),
-  };
-}
-
-function readAuthority(): FleetReadAuthority {
-  return { canRead: vi.fn(async (): Promise<boolean> => true) };
-}
-
-describe('TmuxFleetRuntimeProvider security policy', (): void => {
-  it('advertises only fleet operations it can safely implement', async (): Promise<void> => {
-    const provider = new TmuxFleetRuntimeProvider({ transport: transport() });
-
-    await expect(provider.capabilities(scope)).resolves.toEqual({
-      supported: [
-        'session.list',
-        'session.tree',
-        'session.send',
-        'session.attach',
-        'session.terminate',
-      ],
-    });
-  });
-
-  it('rejects control attach without consulting the tmux transport', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet });
-
-    await expect(provider.attach('coder0', 'control', scope)).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    expect(fleet.verifySession).not.toHaveBeenCalled();
-  });
-
-  it('denies fleet listing without an exact-scope read authority decision', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet });
-
-    await expect(provider.listSessions(scope)).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    expect(fleet.listSessions).not.toHaveBeenCalled();
-  });
-
-  it('denies read attachment without an exact-scope read authority decision', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet });
-
-    await expect(provider.attach('coder0', 'read', scope)).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    expect(fleet.verifySession).not.toHaveBeenCalled();
-  });
-
-  it('creates a read-only attachment only after exact target verification', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: fleet,
-      readAuthority: readAuthority(),
-      attachmentIdFactory: (): string => 'attachment-1',
-      now: (): Date => new Date('2026-07-12T00:00:00.000Z'),
-    });
-
-    await expect(provider.attach('coder0', 'read', scope)).resolves.toEqual({
-      attachmentId: 'attachment-1',
-      sessionId: 'coder0',
-      mode: 'read',
-      expiresAt: '2026-07-12T00:05:00.000Z',
-    });
-    expect(fleet.verifySession).toHaveBeenCalledWith('coder0');
-  });
-
-  it('denies attachment-handle replay from another immutable actor scope', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: fleet,
-      readAuthority: readAuthority(),
-      attachmentIdFactory: (): string => 'attachment-1',
-      now: (): Date => new Date('2026-07-12T00:00:00.000Z'),
-    });
-    await provider.attach('coder0', 'read', scope);
-
-    await expect(
-      provider.detach('attachment-1', { ...scope, actorId: 'operator-2' }),
-    ).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-  });
-
-  it('keeps attachment scope immutable after caller-side scope mutation', async (): Promise<void> => {
-    const mutableScope = { ...scope };
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: transport(),
-      readAuthority: readAuthority(),
-      attachmentIdFactory: (): string => 'attachment-1',
-      now: (): Date => new Date('2026-07-12T00:00:00.000Z'),
-    });
-    await provider.attach('coder0', 'read', mutableScope);
-    mutableScope.actorId = 'operator-2';
-
-    await expect(provider.detach('attachment-1', scope)).resolves.toBeUndefined();
-  });
-
-  it('denies expired attachment handles and removes them', async (): Promise<void> => {
-    let now = new Date('2026-07-12T00:00:00.000Z');
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: transport(),
-      readAuthority: readAuthority(),
-      attachmentIdFactory: (): string => 'attachment-1',
-      now: (): Date => now,
-    });
-    await provider.attach('coder0', 'read', scope);
-    now = new Date('2026-07-12T00:05:00.001Z');
-
-    await expect(provider.detach('attachment-1', scope)).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    await expect(provider.detach('attachment-1', scope)).rejects.toMatchObject({
-      code: 'not_found',
-    } satisfies Partial<FleetRuntimeProviderError>);
-  });
-
-  it('prunes expired attachment handles before creating a new handle', async (): Promise<void> => {
-    let now = new Date('2026-07-12T00:00:00.000Z');
-    let attachmentSequence = 0;
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: transport(),
-      readAuthority: readAuthority(),
-      attachmentIdFactory: (): string => `attachment-${++attachmentSequence}`,
-      now: (): Date => now,
-    });
-    await provider.attach('coder0', 'read', scope);
-    now = new Date('2026-07-12T00:05:00.001Z');
-    await provider.attach('coder0', 'read', scope);
-
-    await expect(provider.detach('attachment-1', scope)).rejects.toMatchObject({
-      code: 'not_found',
-    } satisfies Partial<FleetRuntimeProviderError>);
-  });
-
-  it('rejects an empty message before consulting write authority or tmux', async (): Promise<void> => {
-    const fleet = transport();
-    const writeAuthority: FleetWriteAuthority = {
-      canWrite: vi.fn(async (): Promise<boolean> => true),
-      assertAuthorized: vi.fn(async (): Promise<void> => undefined),
-    };
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet, writeAuthority });
-
-    await expect(
-      provider.sendMessage('coder0', { content: '', idempotencyKey: 'message-1' }, scope),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    expect(writeAuthority.canWrite).not.toHaveBeenCalled();
-    expect(writeAuthority.assertAuthorized).not.toHaveBeenCalled();
-    expect(fleet.verifySession).not.toHaveBeenCalled();
-    expect(fleet.sendMessage).not.toHaveBeenCalled();
-  });
-
-  it('denies fleet writes by default before probing the tmux transport', async (): Promise<void> => {
-    const fleet = transport();
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet });
-
-    await expect(
-      provider.sendMessage('coder0', { content: 'hello', idempotencyKey: 'message-1' }, scope),
-    ).rejects.toMatchObject({ code: 'forbidden' } satisfies Partial<FleetRuntimeProviderError>);
-    await expect(provider.terminate('coder0', 'approval-1', scope)).rejects.toMatchObject({
-      code: 'forbidden',
-    } satisfies Partial<FleetRuntimeProviderError>);
-    expect(fleet.verifySession).not.toHaveBeenCalled();
-    expect(fleet.sendMessage).not.toHaveBeenCalled();
-    expect(fleet.terminate).not.toHaveBeenCalled();
-  });
-
-  it('rejects an unverified target before consulting Mos write authority', async (): Promise<void> => {
-    const fleet = transport();
-    fleet.verifySession = vi.fn(async (): Promise<FleetRuntimeTarget> => {
-      throw new Error('target identity mismatch');
-    });
-    const writeAuthority: FleetWriteAuthority = {
-      canWrite: vi.fn(async (): Promise<boolean> => true),
-      assertAuthorized: vi.fn(async (): Promise<void> => undefined),
-    };
-    const provider = new TmuxFleetRuntimeProvider({ transport: fleet, writeAuthority });
-
-    await expect(
-      provider.sendMessage('coder', { content: 'hello', idempotencyKey: 'message-1' }, scope),
-    ).rejects.toThrow('target identity mismatch');
-    expect(writeAuthority.assertAuthorized).not.toHaveBeenCalled();
-    expect(fleet.sendMessage).not.toHaveBeenCalled();
-  });
-
-  it('passes an exact session ID to the fleet transport only through authorized Mos writes', async (): Promise<void> => {
-    const fleet = transport();
-    const writeAuthority: FleetWriteAuthority = {
-      canWrite: vi.fn(async (): Promise<boolean> => true),
-      assertAuthorized: vi.fn(async (): Promise<void> => undefined),
-    };
-    const provider = new TmuxFleetRuntimeProvider({
-      transport: fleet,
-      sourceLabel: 'tess',
-      writeAuthority,
-    });
-
-    await provider.sendMessage('coder0', { content: 'hello', idempotencyKey: 'message-1' }, scope);
-    await provider.terminate('coder0', 'approval-1', scope);
-
-    expect(writeAuthority.assertAuthorized).toHaveBeenCalledWith({
-      operation: 'session.send',
-      sessionId: 'coder0',
-      scope,
-    });
-    expect(writeAuthority.assertAuthorized).toHaveBeenCalledWith({
-      operation: 'session.terminate',
-      sessionId: 'coder0',
-      scope,
-      approvalRef: 'approval-1',
-    });
-    expect(fleet.sendMessage).toHaveBeenCalledWith('coder0', 'hello', 'tess');
-    expect(fleet.terminate).toHaveBeenCalledWith('coder0');
-  });
-
-  it('fails closed when consumers ask for session streaming', async (): Promise<void> => {
-    const provider = new TmuxFleetRuntimeProvider({ transport: transport() });
-    const stream = provider.streamSession('coder0', undefined, scope)[Symbol.asyncIterator]();
-
-    await expect(stream.next()).rejects.toMatchObject({
-      code: 'capability_unsupported',
-    } satisfies Partial<FleetRuntimeProviderError>);
-  });
-});

packages/agent/src/tmux-fleet-runtime-provider.ts

@@ -1,368 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-const FLEET_PROVIDER_ID = 'fleet.tmux';
-const ATTACHMENT_TTL_MS = 5 * 60 * 1_000;
-
-export type FleetRuntimeProviderErrorCode =
-  | 'capability_unsupported'
-  | 'forbidden'
-  | 'invalid_request'
-  | 'not_found';
-
-/** A roster-bound target verified by the concrete fleet transport. */
-export interface FleetRuntimeTarget {
-  id: string;
-  runtimeId: string;
-  socketName: string;
-}
-
-/**
- * Narrow transport boundary implemented by the Mosaic tmux adapter. Keeping it
- * here prevents the runtime package from depending on the Mosaic CLI package.
- */
-export interface FleetRuntimeTransport {
-  verifySession(sessionId: string): Promise<FleetRuntimeTarget>;
-  listSessions(): Promise<FleetRuntimeTarget[]>;
-  sendMessage(sessionId: string, message: string, sourceLabel: string): Promise<void>;
-  terminate(sessionId: string): Promise<void>;
-}
-
-export type FleetReadOperation =
-  | 'runtime.health'
-  | 'session.list'
-  | 'session.tree'
-  | 'session.attach';
-
-export interface FleetReadAuthorization {
-  operation: FleetReadOperation;
-  scope: RuntimeScope;
-  sessionId?: string;
-}
-
-/** Authorization for fleet inspection and read-only attachments. */
-export interface FleetReadAuthority {
-  canRead(authorization: FleetReadAuthorization): Promise<boolean>;
-}
-
-export interface FleetWriteAuthorization {
-  operation: 'session.send' | 'session.terminate';
-  sessionId: string;
-  scope: RuntimeScope;
-  /** Present only for terminate; authority adapters bind it to the exact action. */
-  approvalRef?: string;
-}
-
-/**
- * Mos is the only authority that may permit Tess write/control requests to a
- * fleet peer. Gateway records the request and denial/success around provider
- * invocation; the default authority prevents direct Tess writes by design.
- */
-export interface FleetWriteAuthority {
-  /** Non-consuming preflight used before probing the fleet transport. */
-  canWrite(authorization: FleetWriteAuthorization): Promise<boolean>;
-  /** Final exact-target authorization; may consume a Mos grant. */
-  assertAuthorized(authorization: FleetWriteAuthorization): Promise<void>;
-}
-
-export interface TmuxFleetRuntimeProviderOptions {
-  transport: FleetRuntimeTransport;
-  readAuthority?: FleetReadAuthority;
-  writeAuthority?: FleetWriteAuthority;
-  sourceLabel?: string;
-  attachmentIdFactory?: () => string;
-  now?: () => Date;
-  attachmentTtlMs?: number;
-}
-
-interface FleetAttachment {
-  sessionId: string;
-  scope: RuntimeScope;
-  expiresAtMs: number;
-}
-
-/** A typed, fail-closed provider error that callers can normalize at the boundary. */
-export class FleetRuntimeProviderError extends Error {
-  constructor(
-    readonly code: FleetRuntimeProviderErrorCode,
-    message: string,
-  ) {
-    super(message);
-    this.name = FleetRuntimeProviderError.name;
-  }
-}
-
-class DenyFleetReadAuthority implements FleetReadAuthority {
-  async canRead(_authorization: FleetReadAuthorization): Promise<boolean> {
-    return false;
-  }
-}
-
-class DenyFleetWriteAuthority implements FleetWriteAuthority {
-  async canWrite(_authorization: FleetWriteAuthorization): Promise<boolean> {
-    return false;
-  }
-
-  async assertAuthorized(_authorization: FleetWriteAuthorization): Promise<void> {
-    throw new FleetRuntimeProviderError(
-      'forbidden',
-      'Fleet writes require an explicit Mos authority decision',
-    );
-  }
-}
-
-/**
- * A capability-limited provider for rostered local fleet peers. It never
- * permits raw tmux socket/target selection, interactive control attach, or
- * direct Tess writes; all side effects pass through exact transport checks.
- */
-export class TmuxFleetRuntimeProvider implements AgentRuntimeProvider {
-  readonly id = FLEET_PROVIDER_ID;
-  private readonly attachments = new Map<string, FleetAttachment>();
-  private readonly readAuthority: FleetReadAuthority;
-  private readonly writeAuthority: FleetWriteAuthority;
-  private readonly sourceLabel: string;
-  private readonly attachmentIdFactory: () => string;
-  private readonly now: () => Date;
-  private readonly attachmentTtlMs: number;
-
-  constructor(private readonly options: TmuxFleetRuntimeProviderOptions) {
-    this.readAuthority = options.readAuthority ?? new DenyFleetReadAuthority();
-    this.writeAuthority = options.writeAuthority ?? new DenyFleetWriteAuthority();
-    this.sourceLabel = options.sourceLabel ?? 'tess';
-    this.attachmentIdFactory = options.attachmentIdFactory ?? randomUUID;
-    this.now = options.now ?? (() => new Date());
-    this.attachmentTtlMs = options.attachmentTtlMs ?? ATTACHMENT_TTL_MS;
-  }
-
-  async capabilities(_scope: RuntimeScope): Promise<RuntimeCapabilitySet> {
-    return {
-      supported: [
-        'session.list',
-        'session.tree',
-        'session.send',
-        'session.attach',
-        'session.terminate',
-      ],
-    };
-  }
-
-  async health(scope: RuntimeScope): Promise<RuntimeHealth> {
-    const targets = await this.readTargets('runtime.health', scope);
-    return {
-      status: targets.length > 0 ? 'healthy' : 'down',
-      checkedAt: this.now().toISOString(),
-      detail:
-        targets.length > 0
-          ? 'Authorized rostered fleet peers are reachable'
-          : 'No authorized rostered fleet peers are reachable',
-    };
-  }
-
-  async listSessions(scope: RuntimeScope): Promise<RuntimeSession[]> {
-    const targets = await this.readTargets('session.list', scope);
-    return this.toRuntimeSessions(targets);
-  }
-
-  async getSessionTree(scope: RuntimeScope): Promise<RuntimeSessionTree[]> {
-    const targets = await this.readTargets('session.tree', scope);
-    return this.toRuntimeSessions(targets).map(
-      (session): RuntimeSessionTree => ({
-        session,
-        children: [],
-      }),
-    );
-  }
-
-  async *streamSession(
-    _sessionId: string,
-    _cursor: string | undefined,
-    _scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    throw new FleetRuntimeProviderError(
-      'capability_unsupported',
-      'Fleet session streaming is not supported by the tmux provider',
-    );
-  }
-
-  async sendMessage(
-    sessionId: string,
-    message: RuntimeMessage,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    if (message.content.length === 0) {
-      throw new FleetRuntimeProviderError('invalid_request', 'Fleet message content is required');
-    }
-    await this.assertWritePermitted('session.send', sessionId, scope);
-    const target = await this.options.transport.verifySession(sessionId);
-    await this.assertWriteAuthorized('session.send', target.id, scope);
-    await this.options.transport.sendMessage(target.id, message.content, this.sourceLabel);
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    if (mode !== 'read') {
-      throw new FleetRuntimeProviderError('forbidden', 'Fleet control attach is not permitted');
-    }
-    await this.assertReadAuthorized('session.attach', sessionId, scope);
-    const target = await this.options.transport.verifySession(sessionId);
-    await this.assertReadAuthorized('session.attach', target.id, scope);
-    const attachmentId = this.attachmentIdFactory();
-    const nowMs = this.now().getTime();
-    this.pruneExpiredAttachments(nowMs);
-    const expiresAtMs = nowMs + this.attachmentTtlMs;
-    this.attachments.set(attachmentId, {
-      sessionId: target.id,
-      scope: snapshotScope(scope),
-      expiresAtMs,
-    });
-    return {
-      attachmentId,
-      sessionId: target.id,
-      mode,
-      expiresAt: new Date(expiresAtMs).toISOString(),
-    };
-  }
-
-  async detach(attachmentId: string, scope: RuntimeScope): Promise<void> {
-    const attachment = this.attachments.get(attachmentId);
-    if (!attachment) {
-      throw new FleetRuntimeProviderError('not_found', 'Fleet attachment is not active');
-    }
-    if (this.now().getTime() >= attachment.expiresAtMs) {
-      this.attachments.delete(attachmentId);
-      throw new FleetRuntimeProviderError('forbidden', 'Fleet attachment has expired');
-    }
-    if (!sameScope(attachment.scope, scope)) {
-      throw new FleetRuntimeProviderError('forbidden', 'Fleet attachment scope does not match');
-    }
-    this.attachments.delete(attachmentId);
-  }
-
-  async terminate(sessionId: string, approvalRef: string, scope: RuntimeScope): Promise<void> {
-    if (approvalRef.trim().length === 0) {
-      throw new FleetRuntimeProviderError(
-        'invalid_request',
-        'Fleet termination approval is required',
-      );
-    }
-    await this.assertWritePermitted('session.terminate', sessionId, scope, approvalRef);
-    const target = await this.options.transport.verifySession(sessionId);
-    await this.assertWriteAuthorized('session.terminate', target.id, scope, approvalRef);
-    await this.options.transport.terminate(target.id);
-  }
-
-  private async readTargets(
-    operation: FleetReadOperation,
-    scope: RuntimeScope,
-  ): Promise<FleetRuntimeTarget[]> {
-    await this.assertReadAuthorized(operation, undefined, scope);
-    const targets = await this.options.transport.listSessions();
-    const authorization = await Promise.all(
-      targets.map(
-        async (target): Promise<boolean> =>
-          this.readAuthority.canRead({ operation, sessionId: target.id, scope }),
-      ),
-    );
-    return targets.filter((_target, index): boolean => authorization[index] === true);
-  }
-
-  private toRuntimeSessions(targets: FleetRuntimeTarget[]): RuntimeSession[] {
-    const timestamp = this.now().toISOString();
-    return targets.map(
-      (target): RuntimeSession => ({
-        id: target.id,
-        providerId: this.id,
-        runtimeId: target.runtimeId,
-        state: 'active',
-        createdAt: timestamp,
-        updatedAt: timestamp,
-      }),
-    );
-  }
-
-  private async assertReadAuthorized(
-    operation: FleetReadOperation,
-    sessionId: string | undefined,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    const allowed = await this.readAuthority.canRead({
-      operation,
-      scope,
-      ...(sessionId ? { sessionId } : {}),
-    });
-    if (!allowed) {
-      throw new FleetRuntimeProviderError('forbidden', 'Fleet read is not authorized');
-    }
-  }
-
-  private pruneExpiredAttachments(nowMs: number): void {
-    for (const [attachmentId, attachment] of this.attachments) {
-      if (attachment.expiresAtMs <= nowMs) {
-        this.attachments.delete(attachmentId);
-      }
-    }
-  }
-
-  private async assertWritePermitted(
-    operation: FleetWriteAuthorization['operation'],
-    sessionId: string,
-    scope: RuntimeScope,
-    approvalRef?: string,
-  ): Promise<void> {
-    const permitted = await this.writeAuthority.canWrite({
-      operation,
-      sessionId,
-      scope,
-      ...(approvalRef ? { approvalRef } : {}),
-    });
-    if (!permitted) {
-      throw new FleetRuntimeProviderError('forbidden', 'Fleet write is not authorized');
-    }
-  }
-
-  private async assertWriteAuthorized(
-    operation: FleetWriteAuthorization['operation'],
-    sessionId: string,
-    scope: RuntimeScope,
-    approvalRef?: string,
-  ): Promise<void> {
-    await this.writeAuthority.assertAuthorized({
-      operation,
-      sessionId,
-      scope,
-      ...(approvalRef ? { approvalRef } : {}),
-    });
-  }
-}
-
-function snapshotScope(scope: RuntimeScope): RuntimeScope {
-  return Object.freeze({
-    actorId: scope.actorId,
-    tenantId: scope.tenantId,
-    channelId: scope.channelId,
-    correlationId: scope.correlationId,
-  });
-}
-
-function sameScope(left: RuntimeScope, right: RuntimeScope): boolean {
-  return (
-    left.actorId === right.actorId &&
-    left.tenantId === right.tenantId &&
-    left.channelId === right.channelId &&
-    left.correlationId === right.correlationId
-  );
-}

packages/db/drizzle/0012_interaction_durable_state.sql

@@ -1,71 +0,0 @@
-CREATE TYPE "public"."interaction_handoff_status" AS ENUM('pending', 'accepted');--> statement-breakpoint
-CREATE TYPE "public"."interaction_inbox_status" AS ENUM('pending', 'processing', 'processed');--> statement-breakpoint
-CREATE TYPE "public"."interaction_outbox_status" AS ENUM('pending', 'processing', 'delivered');--> statement-breakpoint
-CREATE TABLE "interaction_checkpoints" (
-	"session_id" text PRIMARY KEY NOT NULL,
-	"checkpoint_id" text NOT NULL,
-	"cursor" text NOT NULL,
-	"summary" text NOT NULL,
-	"compaction_epoch" integer NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
-	CONSTRAINT "interaction_checkpoints_checkpoint_id_unique" UNIQUE("checkpoint_id")
-);
---> statement-breakpoint
-CREATE TABLE "interaction_handoffs" (
-	"handoff_id" text PRIMARY KEY NOT NULL,
-	"session_id" text NOT NULL,
-	"destination" text NOT NULL,
-	"correlation_id" text NOT NULL,
-	"checkpoint_id" text NOT NULL,
-	"status" "interaction_handoff_status" DEFAULT 'pending' NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE "interaction_inbox" (
-	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
-	"session_id" text NOT NULL,
-	"idempotency_key" text NOT NULL,
-	"correlation_id" text NOT NULL,
-	"content" text NOT NULL,
-	"content_digest" text NOT NULL,
-	"status" "interaction_inbox_status" DEFAULT 'pending' NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE "interaction_outbox" (
-	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
-	"session_id" text NOT NULL,
-	"idempotency_key" text NOT NULL,
-	"correlation_id" text NOT NULL,
-	"kind" text NOT NULL,
-	"content" text NOT NULL,
-	"content_digest" text NOT NULL,
-	"status" "interaction_outbox_status" DEFAULT 'pending' NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE "interaction_sessions" (
-	"id" text PRIMARY KEY NOT NULL,
-	"agent_name" text NOT NULL,
-	"tenant_id" text NOT NULL,
-	"owner_id" text NOT NULL,
-	"provider_id" text NOT NULL,
-	"runtime_session_id" text NOT NULL,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
-	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-ALTER TABLE "interaction_checkpoints" ADD CONSTRAINT "interaction_checkpoints_session_id_interaction_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."interaction_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "interaction_handoffs" ADD CONSTRAINT "interaction_handoffs_session_id_interaction_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."interaction_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "interaction_inbox" ADD CONSTRAINT "interaction_inbox_session_id_interaction_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."interaction_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "interaction_outbox" ADD CONSTRAINT "interaction_outbox_session_id_interaction_sessions_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."interaction_sessions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "interaction_sessions" ADD CONSTRAINT "interaction_sessions_owner_id_users_id_fk" FOREIGN KEY ("owner_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-CREATE INDEX "interaction_handoffs_session_status_idx" ON "interaction_handoffs" USING btree ("session_id","status");--> statement-breakpoint
-CREATE UNIQUE INDEX "interaction_inbox_session_idempotency_idx" ON "interaction_inbox" USING btree ("session_id","idempotency_key");--> statement-breakpoint
-CREATE INDEX "interaction_inbox_session_status_created_idx" ON "interaction_inbox" USING btree ("session_id","status","created_at");--> statement-breakpoint
-CREATE UNIQUE INDEX "interaction_outbox_session_idempotency_idx" ON "interaction_outbox" USING btree ("session_id","idempotency_key");--> statement-breakpoint
-CREATE INDEX "interaction_outbox_session_status_created_idx" ON "interaction_outbox" USING btree ("session_id","status","created_at");

packages/db/drizzle/0013_interaction_checkpoint_history.sql

@@ -1,5 +0,0 @@
-ALTER TABLE "interaction_checkpoints" DROP CONSTRAINT "interaction_checkpoints_checkpoint_id_unique";--> statement-breakpoint
-ALTER TABLE "interaction_checkpoints" DROP CONSTRAINT "interaction_checkpoints_pkey";--> statement-breakpoint
-ALTER TABLE "interaction_checkpoints" ADD COLUMN "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL;--> statement-breakpoint
-CREATE UNIQUE INDEX "interaction_checkpoints_session_idempotency_idx" ON "interaction_checkpoints" USING btree ("session_id","checkpoint_id");--> statement-breakpoint
-CREATE INDEX "interaction_checkpoints_session_epoch_idx" ON "interaction_checkpoints" USING btree ("session_id","compaction_epoch");

packages/db/drizzle/0014_interaction_outbox_channel_scope.sql

@@ -1,5 +0,0 @@
-ALTER TABLE "interaction_outbox" ADD COLUMN "channel_id" text;
---> statement-breakpoint
-UPDATE "interaction_outbox" SET "channel_id" = 'legacy:unknown' WHERE "channel_id" IS NULL;
---> statement-breakpoint
-ALTER TABLE "interaction_outbox" ALTER COLUMN "channel_id" SET NOT NULL;

packages/db/drizzle/0015_interaction_checkpoint_payload_digest.sql

@@ -1,3 +0,0 @@
-ALTER TABLE "interaction_checkpoints" ADD COLUMN "content_digest" text;--> statement-breakpoint
-UPDATE "interaction_checkpoints" SET "content_digest" = 'legacy' WHERE "content_digest" IS NULL;--> statement-breakpoint
-ALTER TABLE "interaction_checkpoints" ALTER COLUMN "content_digest" SET NOT NULL;

packages/db/drizzle/meta/_journal.json

@@ -85,34 +85,6 @@
       "when": 1782310438919,
       "tag": "0011_bitter_gateway",
       "breakpoints": true
-    },
-    {
-      "idx": 12,
-      "version": "7",
-      "when": 1783911983447,
-      "tag": "0012_interaction_durable_state",
-      "breakpoints": true
-    },
-    {
-      "idx": 13,
-      "version": "7",
-      "when": 1783913232578,
-      "tag": "0013_interaction_checkpoint_history",
-      "breakpoints": true
-    },
-    {
-      "idx": 14,
-      "version": "7",
-      "when": 1783913398006,
-      "tag": "0014_interaction_outbox_channel_scope",
-      "breakpoints": true
-    },
-    {
-      "idx": 15,
-      "version": "7",
-      "when": 1783942610000,
-      "tag": "0015_interaction_checkpoint_payload_digest",
-      "breakpoints": true
     }
   ]
 }

packages/db/src/schema.ts

@@ -487,120 +487,6 @@ export const agentLogs = pgTable(
   ],
 );
 
-// ─── Tess durable session state ─────────────────────────────────────────────
-// PostgreSQL is canonical for restart-safe Tess session recovery. The state
-// machine lives in @mosaicstack/agent; these records are its durable adapter.
-
-export const interactionInboxStatusEnum = pgEnum('interaction_inbox_status', [
-  'pending',
-  'processing',
-  'processed',
-]);
-export const interactionOutboxStatusEnum = pgEnum('interaction_outbox_status', [
-  'pending',
-  'processing',
-  'delivered',
-]);
-export const interactionHandoffStatusEnum = pgEnum('interaction_handoff_status', [
-  'pending',
-  'accepted',
-]);
-
-export const interactionSessions = pgTable('interaction_sessions', {
-  id: text('id').primaryKey(),
-  agentName: text('agent_name').notNull(),
-  tenantId: text('tenant_id').notNull(),
-  ownerId: text('owner_id')
-    .notNull()
-    .references(() => users.id, { onDelete: 'cascade' }),
-  providerId: text('provider_id').notNull(),
-  runtimeSessionId: text('runtime_session_id').notNull(),
-  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
-});
-
-export const interactionInbox = pgTable(
-  'interaction_inbox',
-  {
-    id: uuid('id').primaryKey().defaultRandom(),
-    sessionId: text('session_id')
-      .notNull()
-      .references(() => interactionSessions.id, { onDelete: 'cascade' }),
-    idempotencyKey: text('idempotency_key').notNull(),
-    correlationId: text('correlation_id').notNull(),
-    content: text('content').notNull(),
-    contentDigest: text('content_digest').notNull(),
-    status: interactionInboxStatusEnum('status').notNull().default('pending'),
-    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
-  },
-  (t) => [
-    uniqueIndex('interaction_inbox_session_idempotency_idx').on(t.sessionId, t.idempotencyKey),
-    index('interaction_inbox_session_status_created_idx').on(t.sessionId, t.status, t.createdAt),
-  ],
-);
-
-export const interactionOutbox = pgTable(
-  'interaction_outbox',
-  {
-    id: uuid('id').primaryKey().defaultRandom(),
-    sessionId: text('session_id')
-      .notNull()
-      .references(() => interactionSessions.id, { onDelete: 'cascade' }),
-    idempotencyKey: text('idempotency_key').notNull(),
-    correlationId: text('correlation_id').notNull(),
-    channelId: text('channel_id').notNull(),
-    kind: text('kind').notNull(),
-    content: text('content').notNull(),
-    contentDigest: text('content_digest').notNull(),
-    status: interactionOutboxStatusEnum('status').notNull().default('pending'),
-    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
-  },
-  (t) => [
-    uniqueIndex('interaction_outbox_session_idempotency_idx').on(t.sessionId, t.idempotencyKey),
-    index('interaction_outbox_session_status_created_idx').on(t.sessionId, t.status, t.createdAt),
-  ],
-);
-
-export const interactionCheckpoints = pgTable(
-  'interaction_checkpoints',
-  {
-    id: uuid('id').primaryKey().defaultRandom(),
-    sessionId: text('session_id')
-      .notNull()
-      .references(() => interactionSessions.id, { onDelete: 'cascade' }),
-    checkpointId: text('checkpoint_id').notNull(),
-    contentDigest: text('content_digest').notNull(),
-    cursor: text('cursor').notNull(),
-    summary: text('summary').notNull(),
-    compactionEpoch: integer('compaction_epoch').notNull(),
-    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
-  },
-  (t) => [
-    uniqueIndex('interaction_checkpoints_session_idempotency_idx').on(t.sessionId, t.checkpointId),
-    index('interaction_checkpoints_session_epoch_idx').on(t.sessionId, t.compactionEpoch),
-  ],
-);
-
-export const interactionHandoffs = pgTable(
-  'interaction_handoffs',
-  {
-    handoffId: text('handoff_id').primaryKey(),
-    sessionId: text('session_id')
-      .notNull()
-      .references(() => interactionSessions.id, { onDelete: 'cascade' }),
-    destination: text('destination').notNull(),
-    correlationId: text('correlation_id').notNull(),
-    checkpointId: text('checkpoint_id').notNull(),
-    status: interactionHandoffStatusEnum('status').notNull().default('pending'),
-    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
-  },
-  (t) => [index('interaction_handoffs_session_status_idx').on(t.sessionId, t.status)],
-);
-
 // ─── Skills ─────────────────────────────────────────────────────────────────
 
 export const skills = pgTable(

packages/log/src/agent-logs.ts

@@ -58,28 +58,9 @@ export function createAgentLogsRepo(db: Db) {
       return rows[0];
     },
 
-    /**
-     * Transition hot logs for one session to warm tier. Session retention is
-     * default-deny: no other session's logs can be changed by this operation.
-     */
-    async promoteSessionToWarm(sessionId: string, olderThan: Date): Promise<number> {
-      const result = await db
-        .update(agentLogs)
-        .set({ tier: 'warm', summarizedAt: new Date() })
-        .where(
-          and(
-            eq(agentLogs.sessionId, sessionId),
-            eq(agentLogs.tier, 'hot'),
-            lt(agentLogs.createdAt, olderThan),
-          ),
-        )
-        .returning();
-      return result.length;
-    },
-
     /**
      * Transition hot logs older than the cutoff to warm tier.
-     * Reserved for a separately authorized global retention job.
+     * Returns the number of logs transitioned.
      */
     async promoteToWarm(olderThan: Date): Promise<number> {
       const result = await db

packages/log/src/index.ts

@@ -10,15 +10,3 @@ export {
   type LogQuery,
 } from './agent-logs.js';
 export { registerLogCommand } from './cli.js';
-export {
-  redactSensitiveContent,
-  type RedactionResult,
-  type SensitiveClassification,
-} from './redaction.js';
-export {
-  createRuntimeAuditLogEntry,
-  type RuntimeAuditEvent,
-  type RuntimeAuditErrorCode,
-  type RuntimeAuditOperation,
-  type RuntimeAuditOutcome,
-} from './runtime-audit.js';

packages/log/src/redaction.spec.ts

@@ -1,25 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { redactSensitiveContent } from './redaction.js';
-
-describe('redactSensitiveContent', (): void => {
-  it('redacts seeded secret and PII canaries before persistence or egress', (): void => {
-    const result = redactSensitiveContent(
-      'email canary@example.test token=sk_CANARY12345678 phone +1 555 555 1212',
-    );
-    expect(result.content).not.toContain('canary@example.test');
-    expect(result.content).not.toContain('sk_CANARY12345678');
-    expect(result.content).not.toContain('+1 555 555 1212');
-    expect(result.classifications).toEqual(['secret', 'pii']);
-  });
-
-  it('redacts common provider credential formats', (): void => {
-    const result = redactSensitiveContent(
-      'Authorization: Bearer canary.bearer.token jwt eyJcanary.eyJpayload.eyJsignature aws AKIACANARY1234567890',
-    );
-
-    expect(result.content).not.toContain('canary.bearer.token');
-    expect(result.content).not.toContain('eyJcanary.eyJpayload.eyJsignature');
-    expect(result.content).not.toContain('AKIACANARY1234567890');
-    expect(result.classifications).toEqual(['secret']);
-  });
-});

packages/log/src/redaction.ts

@@ -1,40 +0,0 @@
-export type SensitiveClassification = 'secret' | 'pii';
-
-export interface RedactionResult {
-  content: string;
-  classifications: SensitiveClassification[];
-}
-
-const SECRET_PATTERNS: RegExp[] = [
-  /\b(?:sk|ghp|gitea)_[A-Za-z0-9_-]{8,}\b/g,
-  /\b(?:api[_-]?key|token|password|secret)\s*[:=]\s*[^\s,;]+/gi,
-  /\b(?:authorization\s*:\s*)?bearer\s+[A-Za-z0-9._~+/-]+=*/gi,
-  /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
-  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
-  /-----BEGIN(?: [A-Z]+)* KEY-----[\s\S]*?-----END(?: [A-Z]+)* KEY-----/g,
-  /https?:\/\/[^\s?#]+[^\s]*[?&](?:token|key|secret|signature|sig)=[^\s&#]+/gi,
-];
-const PII_PATTERNS: RegExp[] = [
-  /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
-  /\b\+?\d[\d(). -]{7,}\d\b/g,
-];
-
-export function redactSensitiveContent(content: string): RedactionResult {
-  let redacted = content;
-  const classifications: SensitiveClassification[] = [];
-  for (const pattern of SECRET_PATTERNS) {
-    if (pattern.test(redacted)) {
-      classifications.push('secret');
-      redacted = redacted.replace(pattern, '[REDACTED_SECRET]');
-    }
-    pattern.lastIndex = 0;
-  }
-  for (const pattern of PII_PATTERNS) {
-    if (pattern.test(redacted)) {
-      classifications.push('pii');
-      redacted = redacted.replace(pattern, '[REDACTED_PII]');
-    }
-    pattern.lastIndex = 0;
-  }
-  return { content: redacted, classifications: [...new Set(classifications)] };
-}

packages/log/src/runtime-audit.test.ts

@@ -1,52 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { createRuntimeAuditLogEntry } from './runtime-audit.js';
-
-describe('createRuntimeAuditLogEntry', (): void => {
-  it('serializes only allowlisted runtime audit metadata', (): void => {
-    const entry = createRuntimeAuditLogEntry({
-      providerId: 'fleet',
-      operation: 'session.send',
-      outcome: 'succeeded',
-      actorId: 'actor-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord',
-      correlationId: 'correlation-1',
-      resourceId: 'session-1',
-      durationMs: 12,
-    });
-
-    expect(entry).toMatchObject({
-      sessionId: 'runtime:fleet',
-      userId: 'actor-1',
-      level: 'info',
-      category: 'tool_use',
-      content: 'runtime.provider.audit',
-      metadata: {
-        providerId: 'fleet',
-        operation: 'session.send',
-        outcome: 'succeeded',
-        correlationId: 'correlation-1',
-        resourceId: expect.stringMatching(/^sha256:/),
-        durationMs: 12,
-      },
-    });
-    expect(JSON.stringify(entry)).not.toContain('approvalRef');
-  });
-
-  it('hashes every resource ID without blocking a runtime audit or persisting its raw value', (): void => {
-    const entry = createRuntimeAuditLogEntry({
-      providerId: 'fleet',
-      operation: 'session.send',
-      outcome: 'succeeded',
-      actorId: 'actor-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord',
-      correlationId: 'correlation-1',
-      resourceId: 'credential-canary:secret-value',
-      durationMs: 12,
-    });
-
-    expect(entry.metadata).toMatchObject({ resourceId: expect.stringMatching(/^sha256:/) });
-    expect(JSON.stringify(entry)).not.toContain('secret-value');
-  });
-});

packages/log/src/runtime-audit.ts

@@ -1,86 +0,0 @@
-import { createHash } from 'node:crypto';
-import type { NewAgentLog } from './agent-logs.js';
-
-export type RuntimeAuditOperation =
-  | 'session.list'
-  | 'session.tree'
-  | 'session.stream'
-  | 'session.send'
-  | 'session.attach'
-  | 'session.terminate'
-  | 'runtime.capabilities'
-  | 'runtime.health';
-
-export type RuntimeAuditOutcome = 'requested' | 'succeeded' | 'denied' | 'failed';
-export type RuntimeAuditErrorCode = 'policy_denied' | 'provider_error';
-
-/**
- * Deliberately metadata-only runtime audit record. It has no fields for message
- * content, credentials, approval references, tool arguments, or tool output.
- */
-export interface RuntimeAuditEvent {
-  providerId: string;
-  operation: RuntimeAuditOperation;
-  outcome: RuntimeAuditOutcome;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  resourceId?: string;
-  durationMs?: number;
-  errorCode?: RuntimeAuditErrorCode;
-}
-
-const SAFE_IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
-
-function safeIdentifier(value: string): string {
-  if (SAFE_IDENTIFIER.test(value)) return value;
-  return hashIdentifier(value);
-}
-
-function hashIdentifier(value: string): string {
-  return `sha256:${createHash('sha256').update(value).digest('hex')}`;
-}
-
-/**
- * Converts a typed audit event into a durable log entry using an explicit
- * allowlist. Values that could carry credentials or untrusted content are
- * rejected before persistence or structured log emission.
- */
-export function createRuntimeAuditLogEntry(event: RuntimeAuditEvent): NewAgentLog {
-  const providerId = safeIdentifier(event.providerId);
-  const actorId = safeIdentifier(event.actorId);
-  const tenantId = safeIdentifier(event.tenantId);
-  const channelId = safeIdentifier(event.channelId);
-  const correlationId = safeIdentifier(event.correlationId);
-  // Provider resource identifiers may be opaque or user-derived, so never persist them raw.
-  const resourceId = event.resourceId ? hashIdentifier(event.resourceId) : undefined;
-  const persistedUserId = SAFE_IDENTIFIER.test(event.actorId) ? event.actorId : null;
-
-  if (
-    event.durationMs !== undefined &&
-    (!Number.isInteger(event.durationMs) || event.durationMs < 0)
-  ) {
-    throw new Error('Runtime audit duration must be a non-negative integer');
-  }
-
-  return {
-    sessionId: `runtime:${providerId}`,
-    userId: persistedUserId,
-    level: event.outcome === 'failed' ? 'error' : event.outcome === 'denied' ? 'warn' : 'info',
-    category: event.operation.startsWith('session.') ? 'tool_use' : 'general',
-    content: 'runtime.provider.audit',
-    metadata: {
-      providerId,
-      operation: event.operation,
-      outcome: event.outcome,
-      actorId,
-      tenantId,
-      channelId,
-      correlationId,
-      ...(resourceId ? { resourceId } : {}),
-      ...(event.durationMs !== undefined ? { durationMs: event.durationMs } : {}),
-      ...(event.errorCode ? { errorCode: event.errorCode } : {}),
-    },
-  };
-}

packages/mosaic/framework/fleet/README.md

@@ -15,21 +15,6 @@ default tmux server.
 
 - `examples/minimal.yaml` starts one local canary slot.
 - `examples/local-canary.yaml` starts a small generic dogfood fleet.
-- `examples/operator-interaction.yaml` is an example Pi operator-interaction
-  service; replace its example agent name before provisioning.
-
-## Operator interaction service
-
-`services/operator-interaction.yaml` pins the Pi runtime, GPT-5.6 Sol model,
-high reasoning, and the `operator-interaction` tool policy. The agent identity
-is provisioning data: choose a roster name, generate its per-agent environment
-file, then start the matching generic systemd instance. The service fails before
-launch if the configured identity does not match the instance or any pinned
-policy field drifts.
-
-The installed `tools/fleet/print-interaction-effective-policy.sh` prints only
-the resolved name, runtime, model, reasoning, and tool policy. It never reads
-or prints credential variables.
 
 Initialize a roster:
 

packages/mosaic/framework/fleet/examples/operator-interaction.yaml

@@ -1,19 +0,0 @@
-# Example instance only. Replace `Tess` with the chosen provisioned identity.
-version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: ~/src
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: Tess
-    runtime: pi
-    class: operator-interaction
-    model_hint: openai/gpt-5.6-sol
-    reasoning_level: high
-    tool_policy: operator-interaction
-    persistent_persona: true

packages/mosaic/framework/fleet/roles/operator-interaction.md

@@ -1,11 +0,0 @@
-# Operator Interaction — fleet role definition
-
-The **operator-interaction** role is the authorized human interaction plane for
-Mosaic. It presents runtime and fleet state, mediates approved actions, and
-hands coding or general orchestration work to Mos.
-
-## Boundaries
-
-- It does not claim Mos-owned coding or general orchestration work.
-- It exposes only the configured, observable tool policy.
-- It does not receive or surface credentials in its effective policy.

packages/mosaic/framework/fleet/roster.schema.json

@@ -105,18 +105,6 @@
           "modelHint": {
             "type": "string"
           },
-          "reasoning_level": {
-            "type": "string"
-          },
-          "reasoningLevel": {
-            "type": "string"
-          },
-          "tool_policy": {
-            "type": "string"
-          },
-          "toolPolicy": {
-            "type": "string"
-          },
           "persistent_persona": {
             "oneOf": [{ "type": "boolean" }, { "type": "string" }]
           },

packages/mosaic/framework/fleet/services/operator-interaction.yaml

@@ -1,5 +0,0 @@
-# Generic service policy. Provisioning supplies the agent name as data.
-runtime: pi
-model: openai/gpt-5.6-sol
-reasoning: high
-tool_policy: operator-interaction

packages/mosaic/framework/systemd/user/README.md

@@ -12,8 +12,6 @@ exact-match session.
 
 - `mosaic-tmux-holder.service` — user-mode holder that owns the named tmux server.
 - `mosaic-agent@.service` — user-mode template for one reusable agent session.
-- `mosaic-interaction-agent@.service` — generic Pi operator-interaction template
-  that fails fast when its pinned runtime policy is incomplete or changed.
 - `test-fleet-units.sh` — validates unit syntax and required relationships.
 
 The agent template calls:
@@ -47,22 +45,12 @@ MOSAIC_AGENT_WORKDIR=$HOME/src/your-project
 ```bash
 mkdir -p ~/.config/systemd/user ~/.config/mosaic/tools/fleet ~/.config/mosaic/fleet/agents
 cp packages/mosaic/framework/systemd/user/mosaic-*.service ~/.config/systemd/user/
-cp packages/mosaic/framework/tools/fleet/*.sh ~/.config/mosaic/tools/fleet/
-chmod +x ~/.config/mosaic/tools/fleet/*.sh
+cp packages/mosaic/framework/tools/fleet/start-agent-session.sh ~/.config/mosaic/tools/fleet/
+chmod +x ~/.config/mosaic/tools/fleet/start-agent-session.sh
 systemctl --user daemon-reload
 systemctl --user start mosaic-tmux-holder.service
 systemctl --user start mosaic-agent@canary.service
 tmux -L mosaic-fleet ls
-
-# For an operator-interaction service, the roster/env identity selects the
-# generic unit instance; no service source is renamed for an instance.
-systemctl --user start mosaic-interaction-agent@<agent-name>.service
-MOSAIC_AGENT_NAME=<agent-name> \
-MOSAIC_AGENT_RUNTIME=pi \
-MOSAIC_AGENT_MODEL=openai/gpt-5.6-sol \
-MOSAIC_AGENT_REASONING=high \
-MOSAIC_AGENT_TOOL_POLICY=operator-interaction \
-  ~/.config/mosaic/tools/fleet/print-interaction-effective-policy.sh
 ```
 
 Do not use `tmux kill-server` without `-L mosaic-fleet`; this pattern is meant

packages/mosaic/framework/systemd/user/mosaic-interaction-agent@.service

@@ -1,17 +0,0 @@
-[Unit]
-Description=Mosaic operator interaction agent %i
-Documentation=https://git.mosaicstack.dev/mosaicstack/stack
-Requires=mosaic-tmux-holder.service
-After=mosaic-tmux-holder.service
-PartOf=mosaic-tmux-holder.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-Environment=MOSAIC_AGENT_NAME=%i
-EnvironmentFile=%h/.config/mosaic/fleet/agents/%i.env
-ExecStart=/bin/bash %h/.config/mosaic/tools/fleet/start-interaction-service.sh %i
-ExecStop=-/bin/bash -lc 'if [ -n "${MOSAIC_TMUX_SOCKET:-}" ]; then tmux -L "$MOSAIC_TMUX_SOCKET" kill-session -t "=%i"; else tmux kill-session -t "=%i"; fi'
-
-[Install]
-WantedBy=default.target

packages/mosaic/framework/systemd/user/test-fleet-units.sh

@@ -4,7 +4,6 @@ set -euo pipefail
 SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
 HOLDER="$SCRIPT_DIR/mosaic-tmux-holder.service"
 AGENT="$SCRIPT_DIR/mosaic-agent@.service"
-INTERACTION="$SCRIPT_DIR/mosaic-interaction-agent@.service"
 
 fail() {
   echo "FAIL: $*" >&2
@@ -13,7 +12,6 @@ fail() {
 
 [ -f "$HOLDER" ] || fail "missing mosaic-tmux-holder.service"
 [ -f "$AGENT" ] || fail "missing mosaic-agent@.service"
-[ -f "$INTERACTION" ] || fail "missing mosaic-interaction-agent@.service"
 
 grep -qF 'ExecStart=' "$HOLDER" || fail "holder has no ExecStart"
 grep -qF 'tmux -L' "$HOLDER" || fail "holder does not use named tmux socket"
@@ -21,12 +19,9 @@ grep -qF '_holder' "$HOLDER" || fail "holder session is not explicit"
 grep -qF 'Requires=mosaic-tmux-holder.service' "$AGENT" || fail "agent does not require holder"
 grep -qF 'start-agent-session.sh' "$AGENT" || fail "agent unit does not call start-agent-session.sh"
 grep -qF 'kill-session -t "=%i"' "$AGENT" || fail "agent stop does not exact-match its session"
-grep -qF 'Requires=mosaic-tmux-holder.service' "$INTERACTION" || fail "interaction service does not require holder"
-grep -qF 'EnvironmentFile=%h/.config/mosaic/fleet/agents/%i.env' "$INTERACTION" || fail "interaction service does not require per-agent config"
-grep -qF 'start-interaction-service.sh %i' "$INTERACTION" || fail "interaction service does not validate before startup"
 
 if command -v systemd-analyze >/dev/null 2>&1; then
-  systemd-analyze verify --user "$HOLDER" "$AGENT" "$INTERACTION" >/tmp/mosaic-fleet-systemd-verify.log 2>&1 || {
+  systemd-analyze verify --user "$HOLDER" "$AGENT" >/tmp/mosaic-fleet-systemd-verify.log 2>&1 || {
     cat /tmp/mosaic-fleet-systemd-verify.log >&2
     fail "systemd-analyze verify failed"
   }

packages/mosaic/framework/tools/fleet/print-interaction-effective-policy.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-AGENT_NAME=${MOSAIC_AGENT_NAME:-}
-RUNTIME=${MOSAIC_AGENT_RUNTIME:-}
-MODEL=${MOSAIC_AGENT_MODEL:-}
-REASONING=${MOSAIC_AGENT_REASONING:-}
-TOOL_POLICY=${MOSAIC_AGENT_TOOL_POLICY:-}
-
-[ -n "$AGENT_NAME" ] || { echo 'ERROR: MOSAIC_AGENT_NAME is required' >&2; exit 64; }
-[[ "$AGENT_NAME" =~ ^[A-Za-z0-9_.-]+$ ]] || { echo 'ERROR: invalid agent name' >&2; exit 64; }
-[ "$RUNTIME" = 'pi' ] || { echo 'ERROR: invalid runtime policy' >&2; exit 64; }
-[ "$MODEL" = 'openai/gpt-5.6-sol' ] || { echo 'ERROR: invalid model policy' >&2; exit 64; }
-[ "$REASONING" = 'high' ] || { echo 'ERROR: invalid reasoning policy' >&2; exit 64; }
-[ "$TOOL_POLICY" = 'operator-interaction' ] || { echo 'ERROR: invalid tool policy' >&2; exit 64; }
-
-printf '{"agentName":"%s","runtime":"%s","model":"%s","reasoning":"%s","toolPolicy":"%s"}\n' \
-  "$AGENT_NAME" "$RUNTIME" "$MODEL" "$REASONING" "$TOOL_POLICY"

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -8,7 +8,6 @@ AGENT_NAME=${1:-${MOSAIC_AGENT_NAME:-}}
 MOSAIC_TMUX_SOCKET=${MOSAIC_TMUX_SOCKET:-}
 MOSAIC_AGENT_RUNTIME=${MOSAIC_AGENT_RUNTIME:-pi}
 MOSAIC_AGENT_MODEL=${MOSAIC_AGENT_MODEL:-}
-MOSAIC_AGENT_REASONING=${MOSAIC_AGENT_REASONING:-}
 MOSAIC_AGENT_WORKDIR=${MOSAIC_AGENT_WORKDIR:-$HOME}
 MOSAIC_AGENT_COMMAND=${MOSAIC_AGENT_COMMAND:-}
 MOSAIC_HEARTBEAT_RUN_DIR=${MOSAIC_HEARTBEAT_RUN_DIR:-${MOSAIC_HOME:-$HOME/.config/mosaic}/fleet/run}
@@ -19,14 +18,6 @@ if [ -z "$AGENT_NAME" ]; then
   exit 64
 fi
 
-case "$MOSAIC_AGENT_REASONING" in
-  ''|low|medium|high) ;;
-  *)
-    echo "ERROR: MOSAIC_AGENT_REASONING must be low, medium, or high" >&2
-    exit 64
-    ;;
-esac
-
 if ! command -v tmux >/dev/null 2>&1; then
   echo "ERROR: tmux is required" >&2
   exit 69
@@ -50,7 +41,7 @@ fi
 if [ -z "$MOSAIC_AGENT_COMMAND" ]; then
   # Map the roster's per-agent model_hint to `--model` so workers launch on the
   # configured model (e.g. pi on openai-codex/gpt-5.5:high). Omitted when unset.
-  MOSAIC_AGENT_COMMAND="mosaic yolo $MOSAIC_AGENT_RUNTIME${MOSAIC_AGENT_MODEL:+ --model $MOSAIC_AGENT_MODEL}${MOSAIC_AGENT_REASONING:+ --thinking $MOSAIC_AGENT_REASONING}"
+  MOSAIC_AGENT_COMMAND="mosaic yolo $MOSAIC_AGENT_RUNTIME${MOSAIC_AGENT_MODEL:+ --model $MOSAIC_AGENT_MODEL}"
 fi
 
 # ── Derive a runtime-bin PATH prefix ─────────────────────────────────────────
@@ -133,12 +124,11 @@ AGENT_NAME_Q=$(printf '%q' "$AGENT_NAME")
 # safe single bash token; an empty/unset class %q-quotes to '' and is a harmless
 # no-op downstream (readPersonaContractBlock returns '' for an empty class).
 AGENT_CLASS_Q=$(printf '%q' "${MOSAIC_AGENT_CLASS:-}")
-AGENT_TOOL_POLICY_Q=$(printf '%q' "${MOSAIC_AGENT_TOOL_POLICY:-}")
 
 if [ -n "$MOSAIC_RUNTIME_BIN_PREFIX" ]; then
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; export MOSAIC_AGENT_TOOL_POLICY=${AGENT_TOOL_POLICY_Q}; export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
 else
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; export MOSAIC_AGENT_TOOL_POLICY=${AGENT_TOOL_POLICY_Q}; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; exec ${MOSAIC_AGENT_COMMAND}"
 fi
 
 mkdir -p "$MOSAIC_AGENT_WORKDIR"

packages/mosaic/framework/tools/fleet/start-interaction-service.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-AGENT_NAME=${1:-}
-
-fail() {
-  echo "ERROR: $*" >&2
-  exit 64
-}
-
-[ -n "$AGENT_NAME" ] || fail "agent name argument is required"
-[[ "$AGENT_NAME" =~ ^[A-Za-z0-9_.-]+$ ]] || fail "agent name contains unsupported characters"
-[ "${MOSAIC_AGENT_NAME:-}" = "$AGENT_NAME" ] || fail "configured agent name must exactly match the service instance"
-[ "${MOSAIC_AGENT_RUNTIME:-}" = "pi" ] || fail "operator interaction service requires runtime pi"
-[ "${MOSAIC_AGENT_MODEL:-}" = "openai/gpt-5.6-sol" ] || fail "operator interaction service requires the pinned model"
-[ "${MOSAIC_AGENT_REASONING:-}" = "high" ] || fail "operator interaction service requires high reasoning"
-[ "${MOSAIC_AGENT_TOOL_POLICY:-}" = "operator-interaction" ] || fail "operator interaction service requires the operator-interaction tool policy"
-
-exec "$(cd -- "$(dirname -- "$0")" && pwd)/start-agent-session.sh" "$AGENT_NAME"

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -105,7 +105,6 @@ MOSAIC_TMUX_SOCKET="$SOCKET3" \
 MOSAIC_AGENT_WORKDIR="$WORKDIR3" \
 MOSAIC_AGENT_RUNTIME="pi" \
 MOSAIC_AGENT_CLASS="code" \
-MOSAIC_AGENT_TOOL_POLICY="operator-interaction" \
 MOSAIC_RUNTIME_BIN="$FAKE_RUNTIME_BIN" \
 MOSAIC_AGENT_COMMAND="mosaic yolo pi --model openai-codex/gpt-5.5:high" \
 MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR3" \
@@ -140,8 +139,6 @@ echo "$all_args" | grep -qF "export MOSAIC_AGENT_NAME=" || \
   fail "pane command does not export MOSAIC_AGENT_NAME into the pane"
 echo "$all_args" | grep -qF "export MOSAIC_AGENT_CLASS=code" || \
   fail "pane command does not export MOSAIC_AGENT_CLASS into the pane (persona would silently drop)"
-echo "$all_args" | grep -qF "export MOSAIC_AGENT_TOOL_POLICY=operator-interaction" || \
-  fail "pane command does not export MOSAIC_AGENT_TOOL_POLICY into the pane"
 
 # ── Test 4: when no extra runtime-bin dirs exist, exec still appears ───────────
 TMUX_ARGS_FILE2=$(mktemp)

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -240,33 +240,6 @@ get_gitea_login_for_host() {
     return 1
 }
 
-# Validate the current authenticated Gitea user for a resolved Tea login.
-# Tea stores a user name with each login which can become stale after user rename,
-# token rotation, or server migration. Querying /user derives the identity from the
-# active credential instead of trusting that saved name. Callers fall back to the
-# host-scoped API path when this validation fails.
-get_gitea_authenticated_user() {
-    local login_name="$1" response
-
-    command -v tea >/dev/null 2>&1 || return 1
-    response=$(tea api --login "$login_name" /user 2>/dev/null) || return 1
-    TEA_AUTHENTICATED_USER_JSON="$response" python3 - <<'PY'
-import json
-import os
-
-try:
-    user = json.loads(os.environ["TEA_AUTHENTICATED_USER_JSON"])
-except (KeyError, json.JSONDecodeError):
-    raise SystemExit(1)
-
-login = user.get("login") if isinstance(user, dict) else None
-if isinstance(login, str) and login:
-    print(login)
-    raise SystemExit(0)
-raise SystemExit(1)
-PY
-}
-
 get_default_tea_login() {
     local logins_json
 

packages/mosaic/framework/tools/git/issue-create.sh

@@ -12,7 +12,6 @@ TITLE=""
 BODY=""
 LABELS=""
 MILESTONE=""
-INTERACTIVE=false
 
 # get_remote_host and get_gitea_token are provided by detect-platform.sh
 
@@ -67,13 +66,11 @@ Options:
     -b, --body BODY         Issue body/description
     -l, --labels LABELS     Comma-separated labels (e.g., "bug,feature")
     -m, --milestone NAME    Milestone name to assign
-    -i, --interactive       Prompt for missing issue fields
     -h, --help              Show this help message
 
 Examples:
     $(basename "$0") -t "Fix login bug" -l "bug,priority-high"
     $(basename "$0") -t "Add dark mode" -b "Implement theme switching" -m "0.2.0"
-    $(basename "$0") -i
 EOF
     exit "${1:-1}"
 }
@@ -97,10 +94,6 @@ while [[ $# -gt 0 ]]; do
             MILESTONE="$2"
             shift 2
             ;;
-        -i|--interactive)
-            INTERACTIVE=true
-            shift
-            ;;
         -h|--help)
             usage 0
             ;;
@@ -111,13 +104,6 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-if [[ "$INTERACTIVE" == true ]]; then
-    [[ -n "$TITLE" ]] || read -r -p "Issue title: " TITLE
-    [[ -n "$BODY" ]] || read -r -p "Issue body (optional): " BODY || true
-    [[ -n "$LABELS" ]] || read -r -p "Labels, comma-separated (optional): " LABELS || true
-    [[ -n "$MILESTONE" ]] || read -r -p "Milestone (optional): " MILESTONE || true
-fi
-
 if [[ -z "$TITLE" ]]; then
     echo "Error: Title is required (-t)" >&2
     usage
@@ -141,11 +127,6 @@ case "$PLATFORM" in
                 gitea_issue_create_api
                 exit $?
             }
-            if ! get_gitea_authenticated_user "$GITEA_LOGIN_NAME" >/dev/null; then
-                echo "Warning: Tea authenticated-user validation failed (possible stale user/login); trying Gitea API fallback..." >&2
-                gitea_issue_create_api
-                exit $?
-            fi
             REPO_ARGS=(--repo "$REPO_SLUG" --login "$GITEA_LOGIN_NAME")
             CMD=(tea issue create "${REPO_ARGS[@]}" --title "$TITLE")
             [[ -n "$BODY" ]] && CMD+=(--description "$BODY")