feat(#707): secure Discord service ingress

.woodpecker/ci.yml

@@ -42,27 +42,6 @@ steps:
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh
 
-  # Blocking gate (#791): a framework upgrade must never write or delete an
-  # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
-  # survives a keep-mode reseed byte-identical (with rsync present AND absent —
-  # keep mode is a single cp-based path that must not depend on rsync), and that a
-  # corrupt/empty/missing manifest aborts fail-closed leaving operator files
-  # untouched (B2/B3). The rollback gate proves a mid-sync failure is rolled back
-  # from the pre-update snapshot (B1). The durable-snapshot gate (#791 PR2) proves
-  # the retained, operator-scoped pre-update backup is taken before any mutation
-  # (0700/0600, secret never logged, retention-pruned) and that the post-sync
-  # verify net restores any operator file a manifest bug lets the sync touch. The
-  # migration matrix pins the v2→v3 contract-file semantics. Pure bash, no
-  # node_modules — runs early alongside sanitization.
-  upgrade-guard:
-    image: *node_image
-    commands:
-      - apk add --no-cache bash rsync
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-manifest-guard.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
-
   typecheck:
     image: *node_image
     commands:
@@ -71,7 +50,6 @@ steps:
     depends_on:
       - install
       - sanitization
-      - upgrade-guard
 
   # lint, format, and test are independent — run in parallel after typecheck
   lint:

CLAUDE.md

@@ -26,14 +26,13 @@ pnpm test             # Vitest (all packages)
 pnpm build            # Build all packages
 
 # Database
-pnpm --filter @mosaicstack/db db:generate  # Offline migration artifact generation only
+pnpm --filter @mosaicstack/db db:push      # Push schema to PG (dev)
-# PostgreSQL execution is held until KBN-101-00/-03/-05 land. Do not invoke a runner,
+pnpm --filter @mosaicstack/db db:generate  # Generate migrations
-# init SQL, or Compose PostgreSQL service from this checkout.
+pnpm --filter @mosaicstack/db db:migrate   # Run migrations
 
-# Dev: local PGlite data-layer work needs no PostgreSQL. Optional local queue service only:
+# Dev
-docker compose up -d valkey
+docker compose up -d                  # Start PG, Valkey, OTEL, Jaeger
-# Do not start Gateway/Web or root pnpm dev as a local PGlite route: the current unguarded dotenv
+pnpm --filter @mosaicstack/gateway exec tsx src/main.ts  # Start gateway
-# loader can inherit a daemon PostgreSQL DSN. KBN-101-02 must make that state fail closed first.
 ```
 
 ## Conventions

Dockerfile.ci

@@ -22,10 +22,10 @@
 FROM node:24-alpine
 
 # Native toolchain required to compile node-gyp deps on musl, plus the
-# postgresql-client used by the test step's pg_isready readiness probe. `bash`,
+# postgresql-client used by the test step's pg_isready readiness probe. `bash`
-# `git`, and `jq` are baked here too — framework shell tests and the shipped
+# is baked here too — the sanitization step in ci.yml otherwise does a per-run
-# Codex review wrappers require them without per-run installation in ci.yml.
+# `apk add bash`.
-RUN apk add --no-cache python3 make g++ postgresql-client bash git jq
+RUN apk add --no-cache python3 make g++ postgresql-client bash
 
 # Pin pnpm to the repo's packageManager version via corepack.
 RUN corepack enable && corepack prepare pnpm@10.6.2 --activate

README.md

@@ -97,10 +97,7 @@ mosaic config path           # Print config file path
 ```bash
 mosaic doctor                # Health audit — detect drift and missing files
 mosaic sync                  # Sync skills from canonical source
-mosaic skill list            # Audit Claude skill registrations and conflicts
+mosaic update                # Check for and install CLI updates
-mosaic skill register <name> # Register one canonical skill with Claude Code
-mosaic skill unregister <name> # Remove one Mosaic-owned Claude link
-mosaic update                # Update CLI/framework and auto-register canonical skills
 mosaic wizard                # Full guided setup wizard
 mosaic bootstrap <path>      # Bootstrap a repo with Mosaic standards
 mosaic coord init            # Initialize a new orchestration mission
@@ -160,12 +157,7 @@ mosaic storage status
 mosaic storage tier
 mosaic storage export
 mosaic storage import
-# Schema migration is unavailable in this release. The current storage wrapper shells
+mosaic storage migrate
-# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
-# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
-# --run → runner --verify → readiness. Tier copy uses only the separately held secure
-# migrate-tier route.
 ```
 
 ### Telemetry
@@ -200,32 +192,29 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 git clone git@git.mosaicstack.dev:mosaicstack/stack.git
 cd stack
 
-# Install dependencies. The local tier uses in-process PGlite; leave DATABASE_URL unset.
+# Start infrastructure (Postgres, Valkey, Jaeger)
+docker compose up -d
+
+# Install dependencies
 pnpm install
 
-# Optional local queue service only. This does not start PostgreSQL.
+# Run migrations
-docker compose up -d valkey
+pnpm --filter @mosaicstack/db run db:migrate
 
-# The current Gateway/Web local process is held; see docs/guides/dev-guide.md.
+# Start all services in dev mode
-# Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
+pnpm dev
 ```
 
-### Held future procedure
+### Infrastructure
 
-The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
+Docker Compose provides:
-current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
-invoke initialization SQL, or treat the planned migrator as currently executable.
 
-**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
+| Service               | Port      | Purpose                |
-land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
+| --------------------- | --------- | ---------------------- |
-`mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
+| PostgreSQL (pgvector) | 5433      | Primary database       |
-this README—will provide the reviewed commands and secret-consumer interface.
+| Valkey                | 6380      | Task queue + caching   |
-
+| Jaeger                | 16686     | Distributed tracing UI |
-For local data-layer work, PGlite needs no PostgreSQL service. The optional Compose command above
+| OTEL Collector        | 4317/4318 | Telemetry ingestion    |
-starts only Valkey; OTEL Collector and Jaeger may likewise be started individually if needed,
-without starting PostgreSQL. A Gateway/Web local process is not currently a safe PGlite route:
-its unguarded dotenv loader may inherit a daemon PostgreSQL DSN. Do not use root `pnpm dev` or a
-Gateway start command until KBN-101-02 makes that state fail closed.
 
 ### Quality Gates
 
@@ -242,7 +231,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
+- Database migration against a fresh Postgres
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.
@@ -352,8 +341,6 @@ bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
-
 ## Contributing
 
 ```bash

apps/gateway/package.json

@@ -31,7 +31,6 @@
     "@mariozechner/pi-ai": "^0.65.0",
     "@mariozechner/pi-coding-agent": "^0.65.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@mosaicstack/agent": "workspace:^",
     "@mosaicstack/auth": "workspace:^",
     "@mosaicstack/brain": "workspace:^",
     "@mosaicstack/config": "workspace:^",

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -1,194 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { InMemoryDurableSessionStore } from '@mosaicstack/agent';
-import {
-  createDiscordIngressEnvelope,
-  DiscordPlugin,
-  type DiscordIngressPayload,
-} from '@mosaicstack/discord-plugin';
-import { InteractionController } from '../../agent/interaction.controller.js';
-import { RuntimeProviderService } from '../../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../../agent/durable-session.service.js';
-import { ChatGateway } from '../../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../../commands/command-authorization.service.js';
-
-const SERVICE_TOKEN = 'test-discord-service-token';
-const envKeys = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-] as const;
-const priorEnv = new Map<string, string | undefined>();
-
-function payload(content: string, messageId: string, correlationId: string): DiscordIngressPayload {
-  return {
-    content,
-    messageId,
-    correlationId,
-    guildId: 'guild-1',
-    channelId: 'channel-1',
-    userId: 'discord-admin-1',
-    conversationId: 'Nova:discord:channel-1',
-  };
-}
-
-function authorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  return new CommandAuthorizationService(
-    {
-      select: () => ({
-        from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-      }),
-    } as never,
-    {
-      get: async (key: string) => entries.get(key) ?? null,
-      set: async (key: string, value: string) => entries.set(key, value),
-      del: async (key: string) => Number(entries.delete(key)),
-    },
-  );
-}
-
-describe('interaction Discord/CLI durable-session integration', () => {
-  afterEach(() => {
-    for (const key of envKeys) {
-      const value = priorEnv.get(key);
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-    priorEnv.clear();
-  });
-
-  it('enrolls through the CLI surface then resolves the same durable session from Discord', async () => {
-    for (const key of envKeys) priorEnv.set(key, process.env[key]);
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-    process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-1';
-    process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-1';
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-1';
-    process.env['DISCORD_ALLOWED_USER_IDS'] = 'discord-admin-1';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
-        guildId: 'guild-1',
-        channelId: 'channel-1',
-        pairedUsers: {
-          'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-        },
-      },
-    ]);
-
-    const durable = new DurableSessionService(
-      new InMemoryDurableSessionStore() as never,
-      {} as never,
-    );
-    const enrollmentRuntime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const controller = new InteractionController(enrollmentRuntime as never, durable);
-    await controller.enroll(
-      'Nova',
-      'Nova:discord:channel-1',
-      { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      { id: 'mosaic-admin-1', tenantId: 'tenant-1' },
-      'cli-enrollment-correlation',
-    );
-
-    const authz = authorization();
-    const terminated = vi.fn().mockResolvedValue(undefined);
-    const runtime = new RuntimeProviderService(
-      {
-        require: () => ({
-          capabilities: async () => ({ supported: ['session.terminate'] }),
-          terminate: terminated,
-        }),
-      } as never,
-      { record: async () => undefined } as never,
-      {
-        consume: (approvalId, action) =>
-          authz.consumeRuntimeTerminationApproval(approvalId, action),
-      },
-    );
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authz,
-      runtime,
-      durable,
-    );
-    const client = { data: { discordService: true }, emit: vi.fn() };
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-1'],
-      allowedChannelIds: ['channel-1'],
-      allowedUserIds: ['discord-admin-1'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-1',
-          channelId: 'channel-1',
-          pairedUsers: {
-            'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-          },
-        },
-      ],
-    });
-    const pluginInternals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    const pluginSocket = { connected: true, emit: vi.fn() };
-    pluginInternals.client = { user: { id: 'bot-1' } };
-    pluginInternals.socket = pluginSocket;
-    pluginInternals.handleDiscordMessage({
-      id: 'approve-1',
-      guildId: 'guild-1',
-      channelId: 'channel-1',
-      author: { id: 'discord-admin-1', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-1> /approve',
-      channel: { parentId: null },
-      attachments: new Map(),
-    });
-
-    expect(pluginSocket.emit).toHaveBeenCalledWith('discord:approve', expect.any(Object));
-    const approvalEnvelope = pluginSocket.emit.mock.calls[0]?.[1];
-    await gateway.handleDiscordApproval(client as never, approvalEnvelope);
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      createDiscordIngressEnvelope(
-        payload(`/stop ${approval.approvalId}`, 'stop-1', 'discord-stop-correlation'),
-        SERVICE_TOKEN,
-      ),
-    );
-
-    expect(terminated).toHaveBeenCalledWith(
-      'runtime-1',
-      approval.approvalId,
-      expect.objectContaining({ actorId: 'mosaic-admin-1' }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'discord-stop-correlation',
-      success: true,
-    });
-  });
-});

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -12,24 +12,18 @@ type AgentServiceInternals = {
   creating: Map<string, Promise<AgentSession>>;
 };
 
-function makeService(operatorMemory: unknown = null): AgentService {
+function makeService(): AgentService {
   return new AgentService(
-    {
+    {} as never,
-      getDefaultModel: vi.fn(() => null),
-      getRegistry: vi.fn(() => ({})),
-      findModel: vi.fn(),
-      listAvailableModels: vi.fn(() => []),
-    } as never,
     {} as never,
     {} as never,
     { available: false } as never,
     {} as never,
-    { getToolDefinitions: vi.fn(() => []) } as never,
+    {} as never,
-    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
+    {} as never,
     null,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
-    operatorMemory as never,
   );
 }
 
@@ -115,18 +109,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     await service.prompt(CONVERSATION_ID, 'owner prompt', OWNER_SCOPE);
     expect(session.piSession.prompt).toHaveBeenCalledWith('owner prompt');
-    await service.prompt(CONVERSATION_ID, '', OWNER_SCOPE, [
-      {
-        id: 'attachment-001',
-        name: 'diagram.png',
-        url: 'https://cdn.example.test/diagram.png',
-        mimeType: 'image/png',
-      },
-    ]);
-    expect(session.piSession.prompt).toHaveBeenLastCalledWith(
-      '\n\n[Untrusted channel attachments]\n' +
-        '{"id":"attachment-001","name":"diagram.png","mimeType":"image/png","url":"https://cdn.example.test/diagram.png"}',
-    );
 
     await expect(service.destroySession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
       ForbiddenException,
@@ -138,37 +120,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     expect(internals(service).sessions.has(CONVERSATION_ID)).toBe(false);
   });
 
-  it('derives the operator-memory scope on the createSession production path', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox').mockReturnValue([]);
-
-    // Session construction reaches the real scope derivation before the intentionally incomplete
-    // Pi test double rejects later in createAgentSession.
-    await service.createSession(CONVERSATION_ID, OWNER_SCOPE).catch(() => undefined);
-
-    expect(buildTools).toHaveBeenCalledWith(expect.any(String), OWNER_SCOPE.userId, {
-      tenantId: OWNER_SCOPE.tenantId,
-      ownerId: OWNER_SCOPE.userId,
-      sessionId: CONVERSATION_ID,
-    });
-  });
-
-  it('denies a foreign actor before it can obtain another session operator-memory scope', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    internals(service).sessions.set(CONVERSATION_ID, makeSession());
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox');
-
-    await expect(service.createSession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
-      ForbiddenException,
-    );
-
-    expect(buildTools).not.toHaveBeenCalled();
-    expect(plugin.capture).not.toHaveBeenCalled();
-    expect(plugin.search).not.toHaveBeenCalled();
-  });
-
   it('checks owner/tenant scope before returning an in-flight session creation', async () => {
     const service = makeService();
     const session = makeSession();

apps/gateway/src/agent/__tests__/runtime-provider-registry.service.test.ts

@@ -1,370 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import type { ActorTenantScope } from '../../auth/session-scope.js';
-import {
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-  type RuntimeAuditEvent,
-  type RuntimeAuditSink,
-  type RuntimeApprovalVerifier,
-} from '../runtime-provider-registry.service.js';
-
-process.env['MOSAIC_AGENT_NAME'] ??= 'test-runtime-agent';
-
-const OWNER_SCOPE: ActorTenantScope = { userId: 'owner-1', tenantId: 'tenant-1' };
-const CONTEXT = {
-  actorScope: OWNER_SCOPE,
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-class RecordingRuntimeProvider implements AgentRuntimeProvider {
-  readonly id = 'fleet';
-  readonly receivedScopes: RuntimeScope[] = [];
-  readonly sentMessages: RuntimeMessage[] = [];
-  terminateCalls = 0;
-  throwAfterSend = false;
-  throwAuthorization = false;
-
-  constructor(private readonly supported: RuntimeCapability[]) {}
-
-  async capabilities(scope: RuntimeScope): Promise<RuntimeCapabilitySet> {
-    this.receivedScopes.push(scope);
-    return { supported: this.supported };
-  }
-
-  async health(scope: RuntimeScope): Promise<RuntimeHealth> {
-    this.receivedScopes.push(scope);
-    return { status: 'healthy', checkedAt: '2026-07-12T00:00:00.000Z' };
-  }
-
-  async listSessions(scope: RuntimeScope): Promise<RuntimeSession[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async getSessionTree(scope: RuntimeScope): Promise<RuntimeSessionTree[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async *streamSession(
-    _sessionId: string,
-    _cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    this.receivedScopes.push(scope);
-    return;
-  }
-
-  async sendMessage(
-    _sessionId: string,
-    message: RuntimeMessage,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.sentMessages.push(message);
-    if (this.throwAuthorization) {
-      throw Object.assign(new Error('provider authorization denied'), { code: 'forbidden' });
-    }
-    if (this.throwAfterSend) {
-      throw new Error('provider acknowledgement failed');
-    }
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    this.receivedScopes.push(scope);
-    return {
-      attachmentId: 'attachment-1',
-      sessionId,
-      mode,
-      expiresAt: '2026-07-12T00:00:00.000Z',
-    };
-  }
-
-  async detach(_attachmentId: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-  }
-
-  async terminate(_sessionId: string, _approvalRef: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.terminateCalls += 1;
-  }
-}
-
-class RecordingAuditSink implements RuntimeAuditSink {
-  readonly events: RuntimeAuditEvent[] = [];
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    this.events.push(event);
-  }
-}
-
-class DenyingApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(): Promise<boolean> {
-    return false;
-  }
-}
-
-class AcceptingApprovalVerifier implements RuntimeApprovalVerifier {
-  consumedAction: Parameters<RuntimeApprovalVerifier['consume']>[1] | undefined;
-
-  async consume(
-    _approvalRef: string,
-    action: Parameters<RuntimeApprovalVerifier['consume']>[1],
-  ): Promise<boolean> {
-    this.consumedAction = action;
-    return true;
-  }
-}
-
-function makeService(
-  provider: RecordingRuntimeProvider,
-  audit: RuntimeAuditSink = new RecordingAuditSink(),
-  approval: RuntimeApprovalVerifier = new DenyingApprovalVerifier(),
-): RuntimeProviderService {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(provider);
-  return new RuntimeProviderService(registry, audit, approval);
-}
-
-describe('RuntimeProviderService security boundary', (): void => {
-  it('derives and freezes only the authenticated actor scope while preserving correlation metadata', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await service.sendMessage(
-      'fleet',
-      'session-1',
-      { content: 'hello', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    const providerScope = provider.receivedScopes[0];
-    expect(providerScope).toEqual({
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-    });
-    expect(Object.isFrozen(providerScope)).toBe(true);
-    expect(audit.events).toContainEqual(
-      expect.objectContaining({
-        providerId: 'fleet',
-        operation: 'session.send',
-        outcome: 'succeeded',
-        actorId: OWNER_SCOPE.userId,
-        tenantId: OWNER_SCOPE.tenantId,
-        channelId: CONTEXT.channelId,
-        correlationId: CONTEXT.correlationId,
-        resourceId: 'session-1',
-        durationMs: expect.any(Number),
-      }),
-    );
-    expect(JSON.stringify(audit.events)).not.toContain('hello');
-    expect(JSON.stringify(audit.events)).not.toContain('key-1');
-  });
-
-  it('does not block a provider operation when an unsafe resource ID is redacted in durable audit', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let persisted: unknown;
-    const durableAudit = new RuntimeProviderAuditService({
-      logs: {
-        ingest: async (entry: unknown): Promise<unknown> => {
-          persisted = entry;
-          return entry;
-        },
-      },
-    } as never);
-    const service = makeService(provider, durableAudit);
-
-    await service.sendMessage(
-      'fleet',
-      'session/credential-canary=secret-value',
-      { content: 'safe message', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(JSON.stringify(persisted)).not.toContain('secret-value');
-  });
-
-  it('fails closed before a provider side effect when a capability is missing', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider([]);
-    const service = makeService(provider);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/capability denied/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('requires a consumed exact-action approval before termination', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new DenyingApprovalVerifier();
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit, approval);
-
-    await expect(
-      service.terminate('fleet', 'session-1', 'forged-approval', CONTEXT),
-    ).rejects.toThrow(/approval denied/);
-    expect(provider.terminateCalls).toBe(0);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('binds an accepted termination approval to provider, session, immutable scope, and correlation', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new AcceptingApprovalVerifier();
-    const service = makeService(provider, new RecordingAuditSink(), approval);
-
-    await service.terminate('fleet', 'session-1', 'approval-1', CONTEXT);
-
-    expect(approval.consumedAction).toEqual({
-      providerId: 'fleet',
-      sessionId: 'session-1',
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-      agentName: process.env['MOSAIC_AGENT_NAME'],
-    });
-    expect(provider.terminateCalls).toBe(1);
-  });
-
-  it('fails closed before invoking a provider when audit persistence rejects the request', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const unavailableAudit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        throw new Error('audit unavailable');
-      },
-    };
-    const service = makeService(provider, unavailableAudit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/audit unavailable/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('records a provider error after invocation as failed rather than denied', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAfterSend = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider acknowledgement failed/);
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(audit.events.map((event: RuntimeAuditEvent): string => event.outcome)).toEqual([
-      'requested',
-      'failed',
-    ]);
-    expect(audit.events.at(-1)).toMatchObject({
-      errorCode: 'provider_error',
-      durationMs: expect.any(Number),
-    });
-  });
-
-  it('records a provider authorization rejection as denied rather than provider failure', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAuthorization = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider authorization denied/);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('persists only metadata-only runtime audit fields', async (): Promise<void> => {
-    let persisted: unknown;
-    const ingest = async (entry: unknown): Promise<unknown> => {
-      persisted = entry;
-      return entry;
-    };
-    const service = new RuntimeProviderAuditService({ logs: { ingest } } as never);
-
-    await service.record({
-      providerId: 'fleet',
-      operation: 'session.send',
-      outcome: 'succeeded',
-      actorId: 'owner-1',
-      tenantId: 'tenant-1',
-      channelId: 'cli',
-      correlationId: 'correlation-1',
-      resourceId: 'session-1',
-      durationMs: 12,
-    });
-
-    expect(persisted).toMatchObject({
-      content: 'runtime.provider.audit',
-      metadata: expect.objectContaining({ correlationId: 'correlation-1', durationMs: 12 }),
-    });
-    expect(JSON.stringify(persisted)).not.toContain('approval');
-  });
-
-  it('does not misreport a completed provider side effect when completion auditing fails', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let auditCalls = 0;
-    const audit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        auditCalls += 1;
-        if (auditCalls === 2) {
-          throw new Error('completion audit unavailable');
-        }
-      },
-    };
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).resolves.toBeUndefined();
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(auditCalls).toBe(2);
-  });
-});

apps/gateway/src/agent/agent.module.ts

@@ -1,5 +1,4 @@
 import { Global, Module } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry, HermesRuntimeProvider } from '@mosaicstack/agent';
 import { AgentService } from './agent.service.js';
 import { ProviderService } from './provider.service.js';
 import { ProviderCredentialsService } from './provider-credentials.service.js';
@@ -9,79 +8,24 @@ import { SkillLoaderService } from './skill-loader.service.js';
 import { ProvidersController } from './providers.controller.js';
 import { SessionsController } from './sessions.controller.js';
 import { AgentConfigsController } from './agent-configs.controller.js';
-import { InteractionController } from './interaction.controller.js';
 import { RoutingController } from './routing/routing.controller.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
 import { CoordModule } from '../coord/coord.module.js';
 import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { SkillsModule } from '../skills/skills.module.js';
 import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  DenyConnectorLeasePolicy,
-} from './connector-lease.service.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
-
-export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegistry {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(new HermesRuntimeProvider(new GatewayHermesRuntimeTransport()));
-  return registry;
-}
 
 @Global()
 @Module({
-  imports: [CoordModule, McpClientModule, SkillsModule, GCModule, LogModule, CommandsModule],
+  imports: [CoordModule, McpClientModule, SkillsModule, GCModule],
   providers: [
     ProviderService,
     ProviderCredentialsService,
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionRepository,
-    DurableSessionService,
-    ConnectorLeaseRepository,
-    DenyConnectorLeasePolicy,
-    {
-      provide: CONNECTOR_LEASE_POLICY,
-      useExisting: DenyConnectorLeasePolicy,
-    },
-    ConnectorLeaseService,
-    {
-      provide: AGENT_RUNTIME_PROVIDER_REGISTRY,
-      useFactory: createGatewayRuntimeProviderRegistry,
-    },
-    RuntimeProviderAuditService,
-    {
-      provide: RUNTIME_PROVIDER_AUDIT_SINK,
-      useExisting: RuntimeProviderAuditService,
-    },
-    {
-      provide: RUNTIME_APPROVAL_VERIFIER,
-      useExisting: CommandRuntimeApprovalVerifier,
-    },
-    RuntimeProviderService,
     AgentService,
   ],
-  controllers: [
+  controllers: [ProvidersController, SessionsController, AgentConfigsController, RoutingController],
-    ProvidersController,
-    SessionsController,
-    AgentConfigsController,
-    InteractionController,
-    RoutingController,
-  ],
   exports: [
     AgentService,
     ProviderService,
@@ -89,10 +33,6 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionService,
-    RuntimeProviderService,
-    ConnectorLeaseService,
-    AGENT_RUNTIME_PROVIDER_REGISTRY,
   ],
 })
 export class AgentModule {}

apps/gateway/src/agent/agent.service.ts

@@ -15,11 +15,9 @@ import {
   type ToolDefinition,
 } from '@mariozechner/pi-coding-agent';
 import type { Brain } from '@mosaicstack/brain';
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
+import type { Memory } from '@mosaicstack/memory';
-import type { Memory, OperatorMemoryPlugin } from '@mosaicstack/memory';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
-import { OPERATOR_MEMORY_PLUGIN } from '../memory/memory.module.js';
 import { EmbeddingService } from '../memory/embedding.service.js';
 import { CoordService } from '../coord/coord.service.js';
 import { ProviderService } from './provider.service.js';
@@ -44,8 +42,6 @@ export interface ConversationHistoryMessage {
   role: 'user' | 'assistant' | 'system';
   content: string;
   createdAt: Date;
-  /** Validated, URI-referenced channel attachments preserved on session resume. */
-  attachments?: readonly ChannelAttachmentDto[];
 }
 
 export interface AgentSessionOptions {
@@ -139,9 +135,6 @@ export class AgentService implements OnModuleDestroy {
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
     @Inject(SessionGCService) private readonly gc: SessionGCService,
-    @Optional()
-    @Inject(OPERATOR_MEMORY_PLUGIN)
-    private readonly operatorMemory: OperatorMemoryPlugin | null = null,
   ) {}
 
   /**
@@ -153,7 +146,6 @@ export class AgentService implements OnModuleDestroy {
   private buildToolsForSandbox(
     sandboxDir: string,
     sessionUserId: string | undefined,
-    sessionScope?: { tenantId: string; ownerId: string; sessionId: string },
   ): ToolDefinition[] {
     return [
       ...createBrainTools(this.brain),
@@ -162,9 +154,6 @@ export class AgentService implements OnModuleDestroy {
         this.memory,
         this.embeddingService.available ? this.embeddingService : null,
         sessionUserId,
-        this.operatorMemory && sessionScope
-          ? { plugin: this.operatorMemory, scope: sessionScope }
-          : undefined,
       ),
       ...createFileTools(sandboxDir),
       ...createGitTools(sandboxDir),
@@ -239,7 +228,6 @@ export class AgentService implements OnModuleDestroy {
           isAdmin: options.isAdmin,
           agentConfigId: options.agentConfigId,
           userId: options.userId,
-          tenantId: options.tenantId,
           conversationHistory: options.conversationHistory,
         };
         this.logger.log(
@@ -279,15 +267,7 @@ export class AgentService implements OnModuleDestroy {
     }
 
     // Build per-session tools scoped to the sandbox directory and authenticated user
-    const sessionUserId = mergedOptions?.userId;
+    const sandboxTools = this.buildToolsForSandbox(sandboxDir, mergedOptions?.userId);
-    const sessionTenantId = this.tenantIdFor(sessionUserId, mergedOptions?.tenantId);
-    const sandboxTools = this.buildToolsForSandbox(
-      sandboxDir,
-      sessionUserId,
-      sessionUserId && sessionTenantId
-        ? { tenantId: sessionTenantId, ownerId: sessionUserId, sessionId }
-        : undefined,
-    );
 
     // Combine static tools with dynamically discovered MCP client tools and skill tools
     const mcpTools = this.mcpClientService.getToolDefinitions();
@@ -382,7 +362,7 @@ export class AgentService implements OnModuleDestroy {
       sandboxDir,
       allowedTools,
       userId: mergedOptions?.userId,
-      tenantId: sessionTenantId,
+      tenantId: this.tenantIdFor(mergedOptions?.userId, mergedOptions?.tenantId),
       agentConfigId: mergedOptions?.agentConfigId,
       agentName: resolvedAgentName,
       metrics: {
@@ -431,7 +411,7 @@ export class AgentService implements OnModuleDestroy {
     const formatMessage = (msg: ConversationHistoryMessage): string => {
       const roleLabel =
         msg.role === 'user' ? 'User' : msg.role === 'assistant' ? 'Assistant' : 'System';
-      return `**${roleLabel}:** ${msg.content}${this.attachmentContext(msg.attachments ?? [])}`;
+      return `**${roleLabel}:** ${msg.content}`;
     };
 
     const formatted = history.map((msg) => formatMessage(msg));
@@ -490,21 +470,6 @@ export class AgentService implements OnModuleDestroy {
     return result;
   }
 
-  private attachmentContext(attachments: readonly ChannelAttachmentDto[]): string {
-    if (attachments.length === 0) return '';
-    return `\n\n[Untrusted channel attachments]\n${attachments
-      .map((attachment: ChannelAttachmentDto): string =>
-        JSON.stringify({
-          id: attachment.id,
-          name: attachment.name,
-          mimeType: attachment.mimeType,
-          url: attachment.url,
-          ...(attachment.sizeBytes !== undefined ? { sizeBytes: attachment.sizeBytes } : {}),
-        }),
-      )
-      .join('\n')}`;
-  }
-
   private resolveModel(options?: AgentSessionOptions) {
     if (!options?.provider && !options?.modelId) {
       return this.providerService.getDefaultModel() ?? null;
@@ -691,19 +656,7 @@ export class AgentService implements OnModuleDestroy {
     session.channels.delete(channel);
   }
 
-  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void>;
+  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void> {
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] | undefined,
-  ): Promise<void>;
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] = [],
-  ): Promise<void> {
     const session = this.sessions.get(sessionId);
     if (!session) {
       throw new Error(`No agent session found: ${sessionId}`);
@@ -711,16 +664,12 @@ export class AgentService implements OnModuleDestroy {
     this.assertSessionScope(session, scope);
     session.promptCount += 1;
 
-    // Channel attachments are untrusted URI references. Preserve exact,
-    // authenticated metadata for the agent without treating it as authority.
-    const attachmentContext = this.attachmentContext(attachments);
-
     // Prepend session-scoped system override if present (renew TTL on each turn)
-    let effectiveMessage = `${message}${attachmentContext}`;
+    let effectiveMessage = message;
     if (this.systemOverride) {
       const override = await this.systemOverride.get(sessionId, scope);
       if (override) {
-        effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
+        effectiveMessage = `[System Override]\n${override}\n\n${message}`;
         await this.systemOverride.renew(sessionId, scope);
         this.logger.debug(`Applied system override for session ${sessionId}`);
       }

apps/gateway/src/agent/connector-lease.integration.test.ts

@@ -1,341 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Test, type TestingModule } from '@nestjs/testing';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { ConnectorExecutionContext, FencedConnectorAdapter } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  type ConnectorLeasePolicy,
-  type ConnectorLeasePolicySubject,
-} from './connector-lease.service.js';
-
-const authorize = vi.fn().mockResolvedValue(true);
-const policy: ConnectorLeasePolicy = { authorize };
-const context = {
-  actorScope: { userId: 'operator-a', tenantId: 'tenant-a' },
-  correlationId: 'correlation-acquire',
-};
-
-describe('gateway connector lease fencing integration', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let moduleRef: TestingModule;
-  let service: ConnectorLeaseService;
-  let repository: ConnectorLeaseRepository;
-
-  beforeAll(async (): Promise<void> => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-07-14T17:00:00.000Z'));
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    moduleRef = await Test.createTestingModule({
-      providers: [
-        ConnectorLeaseRepository,
-        ConnectorLeaseService,
-        { provide: DB, useValue: handle.db },
-        { provide: CONNECTOR_LEASE_POLICY, useValue: policy },
-      ],
-    }).compile();
-    service = moduleRef.get(ConnectorLeaseService);
-    repository = moduleRef.get(ConnectorLeaseRepository);
-  });
-
-  afterAll(async (): Promise<void> => {
-    vi.useRealTimers();
-    await moduleRef.close();
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('derives tenant authority at the gateway and validates a grant before side effects', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'Mos',
-        bindingId: 'operator-chat',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      context,
-    );
-    const grant = await service.issueGrant(
-      { lease, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-grant' },
-    );
-    const execute = vi.fn(async (_message: string, leaseContext: ConnectorExecutionContext) => {
-      return leaseContext.leaseEpoch;
-    });
-    const adapter: FencedConnectorAdapter<string, string> = { execute };
-
-    await expect(service.executeGrant(grant, 'runtime.send', 'hello', adapter)).resolves.toBe('1');
-    expect(execute).toHaveBeenCalledOnce();
-    expect(authorize).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        requestedScopes: ['runtime.send'],
-        requestedTtlMs: 30_000,
-      }),
-    );
-    expect(execute.mock.calls[0]?.[1]).toMatchObject({
-      identity: { tenantId: 'tenant-a', logicalAgentId: 'mos' },
-      bindingId: 'operator-chat',
-      connectorId: 'pi-worker-a',
-    });
-  });
-
-  it('normalizes lease-derived policy subjects before authorization', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-policy-setup' },
-    );
-    const aliasedLease = {
-      ...lease,
-      identity: { ...lease.identity, logicalAgentId: ' MOS ' },
-      bindingId: ' Operator-Chat-Policy ',
-      connectorId: ' PI-Worker-A ',
-      scopes: [' Runtime.Send '],
-      leaseEpoch: `00${lease.leaseEpoch}`,
-    };
-
-    await service.heartbeat(aliasedLease, 30_000, {
-      ...context,
-      correlationId: 'correlation-policy-heartbeat',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.heartbeat',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.issueGrant(
-      { lease: aliasedLease, scopes: [' Runtime.Send '], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-policy-grant' },
-    );
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.release(aliasedLease, {
-      ...context,
-      correlationId: 'correlation-policy-release',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.release',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-  });
-
-  it('denies stale, forged, expired, cross-tenant, and cross-binding grants before effects', async (): Promise<void> => {
-    const bindingId = 'operator-chat-denials';
-    const current = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-denial-setup' },
-    );
-    const stale = await service.issueGrant(
-      { lease: current, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-stale' },
-    );
-    await service.takeover(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-b',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-        expectedEpoch: current.leaseEpoch,
-      },
-      { ...context, correlationId: 'correlation-takeover' },
-    );
-    const adapter = { execute: vi.fn().mockResolvedValue(undefined) };
-
-    await expect(service.executeGrant(stale, 'runtime.send', undefined, adapter)).rejects.toThrow();
-
-    const active = await service.current('mos', bindingId, context);
-    if (!active) throw new Error('active lease fixture is unavailable');
-    const grant = await service.issueGrant(
-      { lease: active, scopes: ['runtime.send'], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-active' },
-    );
-    await expect(
-      service.executeGrant({ ...grant }, 'runtime.send', undefined, adapter),
-    ).rejects.toThrow();
-    await expect(
-      service.executeGrant(
-        { ...grant, bindingId: 'other-binding' },
-        'runtime.send',
-        undefined,
-        adapter,
-      ),
-    ).rejects.toThrow();
-    await expect(
-      service.issueGrant(
-        { lease: active, scopes: ['runtime.send'], ttlMs: 30_000 },
-        {
-          actorScope: { userId: 'operator-b', tenantId: 'tenant-b' },
-          correlationId: 'correlation-cross-tenant',
-        },
-      ),
-    ).rejects.toThrow();
-    const crossTenantAudit = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-cross-tenant'));
-    expect(crossTenantAudit).toHaveLength(1);
-    expect(crossTenantAudit[0]).toMatchObject({
-      tenantId: 'tenant-b',
-      logicalAgentId: 'untrusted',
-      bindingId: 'untrusted',
-      connectorId: 'untrusted',
-      reason: 'policy_denied',
-    });
-
-    vi.setSystemTime(new Date('2026-07-14T17:00:02.000Z'));
-    await expect(service.executeGrant(grant, 'runtime.send', undefined, adapter)).rejects.toThrow();
-    expect(adapter.execute).not.toHaveBeenCalled();
-  });
-
-  it('rejects submitted lifecycle scopes that differ from durable authority before policy or mutation', async (): Promise<void> => {
-    authorize.mockResolvedValue(true);
-    const heartbeatLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-heartbeat-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-heartbeat-scope-setup' },
-    );
-    const releaseLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-release-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-release-scope-setup' },
-    );
-    const forgedHeartbeat = { ...heartbeatLease, scopes: ['tool.execute'] };
-    const forgedRelease = { ...releaseLease, scopes: ['tool.execute'] };
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'tool.execute';
-    });
-    authorize.mockClear();
-
-    await expect(
-      service.heartbeat(forgedHeartbeat, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    await expect(
-      service.release(forgedRelease, {
-        ...context,
-        correlationId: 'correlation-release-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    expect(authorize).not.toHaveBeenCalled();
-
-    const currentHeartbeat = await repository.findCurrent({
-      identity: heartbeatLease.identity,
-      bindingId: heartbeatLease.bindingId,
-    });
-    const currentRelease = await repository.findCurrent({
-      identity: releaseLease.identity,
-      bindingId: releaseLease.bindingId,
-    });
-    expect(currentHeartbeat).toMatchObject({
-      leaseId: heartbeatLease.leaseId,
-      scopes: ['runtime.send'],
-      heartbeatAt: heartbeatLease.heartbeatAt,
-      expiresAt: heartbeatLease.expiresAt,
-    });
-    expect(currentRelease).toMatchObject({
-      leaseId: releaseLease.leaseId,
-      scopes: ['runtime.send'],
-    });
-    expect(currentRelease?.releasedAt).toBeUndefined();
-
-    const forgedAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-heartbeat-scope-forgery'));
-    expect(forgedAudits).toHaveLength(1);
-    expect(forgedAudits[0]).toMatchObject({
-      bindingId: heartbeatLease.bindingId,
-      connectorId: heartbeatLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-    const forgedReleaseAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-release-scope-forgery'));
-    expect(forgedReleaseAudits).toHaveLength(1);
-    expect(forgedReleaseAudits[0]).toMatchObject({
-      bindingId: releaseLease.bindingId,
-      connectorId: releaseLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'runtime.send';
-    });
-    await expect(
-      service.heartbeat(heartbeatLease, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-canonical',
-      }),
-    ).resolves.toMatchObject({ scopes: ['runtime.send'] });
-    await expect(
-      service.release(releaseLease, {
-        ...context,
-        correlationId: 'correlation-release-scope-canonical',
-      }),
-    ).resolves.toBeUndefined();
-  });
-});

apps/gateway/src/agent/connector-lease.postgres.integration.test.ts

@@ -1,76 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createDb,
-  eq,
-  logicalAgentConnectorLeases,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const hasPostgres = Boolean(process.env['DATABASE_URL']);
-const tenantId = `lease-test-${randomUUID()}`;
-const identity = { tenantId, logicalAgentId: 'mos' } as const;
-
-describe.skipIf(!hasPostgres)('ConnectorLeaseRepository real PostgreSQL integration', (): void => {
-  let handle: DbHandle;
-
-  beforeAll((): void => {
-    handle = createDb(process.env['DATABASE_URL']);
-  });
-
-  afterAll(async (): Promise<void> => {
-    if (!handle) return;
-    await handle.db
-      .delete(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, tenantId));
-    await handle.db
-      .delete(logicalAgentConnectorLeases)
-      .where(eq(logicalAgentConnectorLeases.tenantId, tenantId));
-    await handle.close();
-  });
-
-  it('preserves the exclusive CAS fence across a real pool close/reopen', async (): Promise<void> => {
-    const command = {
-      identity,
-      bindingId: 'operator-chat',
-      scopes: ['runtime.send'],
-      ttlMs: 60_000,
-    } as const;
-    const firstCoordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const contenders = await Promise.allSettled([
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-a',
-        correlationId: 'postgres-acquire-a',
-      }),
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-b',
-        correlationId: 'postgres-acquire-b',
-      }),
-    ]);
-    const acquired = contenders.find((result) => result.status === 'fulfilled');
-    if (!acquired || acquired.status !== 'fulfilled') throw new Error('no lease contender won');
-    expect(contenders.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-
-    await handle.close();
-    handle = createDb(process.env['DATABASE_URL']);
-    const reopened = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const persisted = await reopened.current({ identity, bindingId: 'operator-chat' });
-    expect(persisted).toMatchObject({
-      leaseId: acquired.value.leaseId,
-      leaseEpoch: '1',
-    });
-
-    const takeover = await reopened.takeover({
-      ...command,
-      connectorId: 'connector-c',
-      correlationId: 'postgres-takeover',
-      expectedEpoch: acquired.value.leaseEpoch,
-    });
-    expect(takeover).toMatchObject({ connectorId: 'connector-c', leaseEpoch: '2' });
-  });
-});

apps/gateway/src/agent/connector-lease.repository.test.ts

@@ -1,149 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator, ConnectorLeaseError } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const identity = { tenantId: 'tenant-a', logicalAgentId: 'mos' } as const;
-
-function acquireCommand(connectorId: string, correlationId: string) {
-  return {
-    identity,
-    bindingId: 'operator-chat',
-    connectorId,
-    scopes: ['runtime.send', 'tool.execute'],
-    ttlMs: 60_000,
-    correlationId,
-  };
-}
-
-describe('ConnectorLeaseRepository PostgreSQL semantics', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let now: Date;
-  let coordinator: ConnectorLeaseCoordinator;
-
-  beforeEach(async (): Promise<void> => {
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    now = new Date('2026-07-14T17:00:00.000Z');
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-  });
-
-  afterEach(async (): Promise<void> => {
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('allows only one concurrent contender to acquire a binding', async (): Promise<void> => {
-    const outcomes = await Promise.allSettled([
-      coordinator.acquire(acquireCommand('connector-a', 'correlation-a')),
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-b')),
-    ]);
-
-    expect(outcomes.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    const rejected = outcomes.find((result) => result.status === 'rejected');
-    expect(rejected).toMatchObject({
-      reason: { code: 'lease_held' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('uses compare-and-swap takeover and increments the fencing epoch monotonically', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    const results = await Promise.allSettled([
-      coordinator.takeover({
-        ...acquireCommand('connector-b', 'correlation-b'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-      coordinator.takeover({
-        ...acquireCommand('connector-c', 'correlation-c'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-    ]);
-    const winner = results.find((result) => result.status === 'fulfilled');
-
-    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    expect(winner?.status === 'fulfilled' ? winner.value.leaseEpoch : null).toBe('2');
-    expect(results.find((result) => result.status === 'rejected')).toMatchObject({
-      reason: { code: 'cas_mismatch' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('heartbeats and releases only the current connector epoch', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    now = new Date('2026-07-14T17:00:30.000Z');
-    const renewed = await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 120_000,
-      correlationId: 'correlation-renew',
-    });
-    expect(renewed.expiresAt).toBe('2026-07-14T17:02:30.000Z');
-
-    await coordinator.release({ lease: renewed, correlationId: 'correlation-release' });
-    await expect(
-      coordinator.heartbeat({
-        lease: renewed,
-        ttlMs: 120_000,
-        correlationId: 'correlation-stale',
-      }),
-    ).rejects.toMatchObject({ code: 'lease_released' } satisfies Partial<ConnectorLeaseError>);
-  });
-
-  it('survives close/reopen and requires CAS takeover to recover an expired lease', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await handle.close();
-
-    now = new Date('2026-07-14T17:02:00.000Z');
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-plain-acquire')),
-    ).rejects.toMatchObject({ code: 'takeover_required' } satisfies Partial<ConnectorLeaseError>);
-    const recovered = await coordinator.takeover({
-      ...acquireCommand('connector-b', 'correlation-takeover'),
-      expectedEpoch: acquired.leaseEpoch,
-    });
-    expect(recovered).toMatchObject({ connectorId: 'connector-b', leaseEpoch: '2' });
-  });
-
-  it('writes credential-safe lifecycle and rejection audit records', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 60_000,
-      correlationId: 'correlation-renew',
-    });
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-reject')),
-    ).rejects.toBeInstanceOf(ConnectorLeaseError);
-
-    const rows = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, identity.tenantId));
-    expect(rows.map((row) => row.event)).toEqual(
-      expect.arrayContaining(['acquire', 'renew', 'reject']),
-    );
-    const serialized = JSON.stringify(rows, (_key: string, value: unknown): unknown =>
-      typeof value === 'bigint' ? value.toString(10) : value,
-    );
-    expect(serialized).not.toContain('tool.execute');
-    expect(serialized).not.toContain('runtime.send');
-    expect(serialized).not.toMatch(/token|secret|credential/i);
-  });
-});

apps/gateway/src/agent/connector-lease.repository.ts

@@ -1,354 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  connectorLeaseAuditLog,
-  eq,
-  gt,
-  isNull,
-  logicalAgentConnectorLeases,
-  sql,
-  type Db,
-} from '@mosaicstack/db';
-import { ConnectorLeaseError } from '@mosaicstack/agent';
-import type {
-  ConnectorLease,
-  ConnectorLeaseAcquireMutation,
-  ConnectorLeaseAuditEvent,
-  ConnectorLeaseHeartbeatMutation,
-  ConnectorLeaseRejectReason,
-  ConnectorLeaseReleaseMutation,
-  ConnectorLeaseStore,
-  ConnectorLeaseTakeoverMutation,
-  LogicalAgentBinding,
-} from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-
-interface SuccessfulMutation {
-  readonly ok: true;
-  readonly lease: ConnectorLease;
-}
-
-interface FailedMutation {
-  readonly ok: false;
-  readonly reason: ConnectorLeaseRejectReason;
-}
-
-type MutationResult = SuccessfulMutation | FailedMutation;
-
-@Injectable()
-export class ConnectorLeaseRepository implements ConnectorLeaseStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async acquire(input: ConnectorLeaseAcquireMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const inserted = await tx
-          .insert(logicalAgentConnectorLeases)
-          .values({
-            leaseId: input.leaseId,
-            tenantId: input.identity.tenantId,
-            logicalAgentId: input.identity.logicalAgentId,
-            bindingId: input.bindingId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: 1n,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .onConflictDoNothing()
-          .returning();
-        const row = inserted[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'acquire'));
-          return { ok: true, lease };
-        }
-
-        const current = await findRow(tx, input);
-        if (current && current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const reason: ConnectorLeaseRejectReason =
-          current && (current.releasedAt || current.expiresAt <= new Date(input.now))
-            ? 'takeover_required'
-            : 'lease_held';
-        await insertAudit(tx, rejectionAudit(input, current ? toLease(current) : null, reason));
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async takeover(input: ConnectorLeaseTakeoverMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const current = await findRow(tx, input);
-        if (!current || current.leaseEpoch.toString(10) !== input.expectedEpoch) {
-          await insertAudit(
-            tx,
-            rejectionAudit(input, current ? toLease(current) : null, 'cas_mismatch'),
-          );
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        if (current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            leaseId: input.leaseId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: sql`${logicalAgentConnectorLeases.leaseEpoch} + 1`,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            releasedAt: null,
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input),
-              eq(logicalAgentConnectorLeases.leaseId, current.leaseId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.expectedEpoch)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (!row) {
-          await insertAudit(tx, rejectionAudit(input, toLease(current), 'cas_mismatch'));
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        const lease = toLease(row);
-        await insertAudit(tx, lifecycleAudit(input, lease, 'takeover'));
-        return { ok: true, lease };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async heartbeat(input: ConnectorLeaseHeartbeatMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'renew'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async release(input: ConnectorLeaseReleaseMutation): Promise<void> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            releasedAt: new Date(input.now),
-            expiresAt: new Date(input.now),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'release'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    unwrap(result);
-  }
-
-  async findCurrent(binding: LogicalAgentBinding): Promise<ConnectorLease | null> {
-    const row = await findRow(this.db, binding);
-    return row ? toLease(row) : null;
-  }
-
-  async recordAudit(event: ConnectorLeaseAuditEvent): Promise<void> {
-    await insertAudit(this.db, event);
-  }
-}
-
-function unwrap(result: MutationResult): ConnectorLease {
-  if (!result.ok) throw new ConnectorLeaseError(result.reason, safeErrorMessage(result.reason));
-  return result.lease;
-}
-
-function safeErrorMessage(reason: ConnectorLeaseRejectReason): string {
-  return `Connector lease mutation denied: ${reason}`;
-}
-
-function bindingPredicate(binding: LogicalAgentBinding) {
-  return and(
-    eq(logicalAgentConnectorLeases.tenantId, binding.identity.tenantId),
-    eq(logicalAgentConnectorLeases.logicalAgentId, binding.identity.logicalAgentId),
-    eq(logicalAgentConnectorLeases.bindingId, binding.bindingId),
-  );
-}
-
-async function findRow(
-  db: Pick<Db, 'select'>,
-  binding: LogicalAgentBinding,
-): Promise<typeof logicalAgentConnectorLeases.$inferSelect | null> {
-  const rows = await db
-    .select()
-    .from(logicalAgentConnectorLeases)
-    .where(bindingPredicate(binding))
-    .limit(1);
-  return rows[0] ?? null;
-}
-
-function toLease(row: typeof logicalAgentConnectorLeases.$inferSelect): ConnectorLease {
-  return Object.freeze({
-    identity: Object.freeze({ tenantId: row.tenantId, logicalAgentId: row.logicalAgentId }),
-    bindingId: row.bindingId,
-    leaseId: row.leaseId,
-    connectorId: row.connectorId,
-    scopes: Object.freeze([...row.scopes]),
-    leaseEpoch: row.leaseEpoch.toString(10),
-    acquiredAt: row.acquiredAt.toISOString(),
-    heartbeatAt: row.heartbeatAt.toISOString(),
-    expiresAt: row.expiresAt.toISOString(),
-    ...(row.releasedAt ? { releasedAt: row.releasedAt.toISOString() } : {}),
-  });
-}
-
-function classifyAuthorityFailure(
-  current: ConnectorLease | null,
-  claimed: ConnectorLease,
-  now: string,
-): ConnectorLeaseRejectReason {
-  if (!current) return 'lease_missing';
-  if (current.releasedAt) return 'lease_released';
-  if (new Date(current.expiresAt) <= new Date(now)) return 'lease_expired';
-  if (current.leaseEpoch !== claimed.leaseEpoch) return 'stale_epoch';
-  return 'connector_mismatch';
-}
-
-function lifecycleAudit(
-  input: { readonly correlationId: string; readonly now: string },
-  lease: ConnectorLease,
-  event: Exclude<ConnectorLeaseAuditEvent['event'], 'reject'>,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: lease.identity,
-    bindingId: lease.bindingId,
-    connectorId: lease.connectorId,
-    leaseId: lease.leaseId,
-    leaseEpoch: lease.leaseEpoch,
-    event,
-    outcome: 'succeeded',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-  };
-}
-
-function rejectionAudit(
-  input: {
-    readonly identity: ConnectorLease['identity'];
-    readonly bindingId: string;
-    readonly connectorId: string;
-    readonly correlationId: string;
-    readonly now: string;
-  },
-  current: ConnectorLease | null,
-  reason: ConnectorLeaseRejectReason,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: input.identity,
-    bindingId: input.bindingId,
-    connectorId: input.connectorId,
-    event: 'reject',
-    outcome: 'denied',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-    ...(current ? { leaseId: current.leaseId, leaseEpoch: current.leaseEpoch } : {}),
-    reason,
-  };
-}
-
-async function insertAudit(db: Pick<Db, 'insert'>, event: ConnectorLeaseAuditEvent): Promise<void> {
-  await db.insert(connectorLeaseAuditLog).values({
-    tenantId: event.identity.tenantId,
-    logicalAgentId: event.identity.logicalAgentId,
-    bindingId: event.bindingId,
-    connectorId: event.connectorId,
-    ...(event.leaseId ? { leaseId: event.leaseId } : {}),
-    ...(event.leaseEpoch ? { leaseEpoch: BigInt(event.leaseEpoch) } : {}),
-    event: event.event,
-    outcome: event.outcome,
-    ...(event.reason ? { reason: event.reason } : {}),
-    correlationId: event.correlationId,
-    occurredAt: new Date(event.occurredAt),
-  });
-}

apps/gateway/src/agent/connector-lease.service.ts

@@ -1,285 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { ConnectorLeaseCoordinator, normalizeConnectorLease } from '@mosaicstack/agent';
-import {
-  normalizeConnectorId,
-  normalizeConnectorScopes,
-  normalizeCorrelationId,
-  normalizeLogicalAgentIdentity,
-  normalizeLogicalBindingId,
-  type AcquireConnectorLeaseInput,
-  type ConnectorExecutionGrant,
-  type ConnectorLease,
-  type ConnectorLeaseAuditEvent,
-  type FencedConnectorAdapter,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-export const CONNECTOR_LEASE_POLICY = Symbol('CONNECTOR_LEASE_POLICY');
-
-export type ConnectorLeasePolicyAction =
-  | 'lease.acquire'
-  | 'lease.takeover'
-  | 'lease.heartbeat'
-  | 'lease.release'
-  | 'lease.read'
-  | 'grant.issue';
-
-export interface ConnectorLeaseRequestContext {
-  readonly actorScope: ActorTenantScope;
-  readonly correlationId: string;
-}
-
-export interface GatewayConnectorLeaseRequest {
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface GatewayConnectorLeaseTakeoverRequest extends GatewayConnectorLeaseRequest {
-  readonly expectedEpoch: string;
-}
-
-export interface GatewayConnectorGrantRequest {
-  readonly lease: ConnectorLease;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface ConnectorLeasePolicySubject {
-  readonly action: ConnectorLeasePolicyAction;
-  readonly actorId: string;
-  readonly tenantId: string;
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly requestedScopes: readonly string[];
-  readonly requestedTtlMs: number | null;
-}
-
-export interface ConnectorLeasePolicy {
-  authorize(subject: ConnectorLeasePolicySubject): Promise<boolean>;
-}
-
-/** M1 has no concrete cutover policy: unconfigured production use fails closed. */
-@Injectable()
-export class DenyConnectorLeasePolicy implements ConnectorLeasePolicy {
-  async authorize(_subject: ConnectorLeasePolicySubject): Promise<boolean> {
-    return false;
-  }
-}
-
-/** Gateway-owned policy surface for durable connector authority and fenced effects. */
-@Injectable()
-export class ConnectorLeaseService {
-  private readonly coordinator: ConnectorLeaseCoordinator;
-
-  constructor(
-    @Inject(ConnectorLeaseRepository) private readonly repository: ConnectorLeaseRepository,
-    @Inject(CONNECTOR_LEASE_POLICY) private readonly policy: ConnectorLeasePolicy,
-  ) {
-    this.coordinator = new ConnectorLeaseCoordinator(repository);
-  }
-
-  async acquire(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.acquire', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.acquire({ ...command, correlationId: this.correlation(context) });
-  }
-
-  async takeover(
-    request: GatewayConnectorLeaseTakeoverRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.takeover', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.takeover({
-      ...command,
-      expectedEpoch: request.expectedEpoch,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async heartbeat(
-    lease: ConnectorLease,
-    ttlMs: number,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.heartbeat', durableLease, context, durableLease.scopes, ttlMs);
-    return this.coordinator.heartbeat({
-      lease: durableLease,
-      ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async release(lease: ConnectorLease, context: ConnectorLeaseRequestContext): Promise<void> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.release', durableLease, context, durableLease.scopes, null);
-    await this.coordinator.release({
-      lease: durableLease,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async current(
-    logicalAgentId: string,
-    bindingId: string,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease | null> {
-    const binding = {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(bindingId),
-      connectorId: 'gateway',
-    };
-    await this.assertPolicy('lease.read', binding, context, [], null);
-    return this.coordinator.current(binding);
-  }
-
-  async issueGrant(
-    request: GatewayConnectorGrantRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorExecutionGrant> {
-    const lease = normalizeConnectorLease(request.lease);
-    await this.assertTenant(lease, context);
-    const scopes = normalizeConnectorScopes(request.scopes);
-    await this.assertPolicy('grant.issue', lease, context, scopes, request.ttlMs);
-    return this.coordinator.issueGrant({
-      lease,
-      scopes,
-      ttlMs: request.ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async executeGrant<TInput, TOutput>(
-    grant: ConnectorExecutionGrant,
-    requiredScope: string,
-    input: TInput,
-    adapter: FencedConnectorAdapter<TInput, TOutput>,
-  ): Promise<TOutput> {
-    return this.coordinator.executeGrant(grant, requiredScope, input, adapter);
-  }
-
-  private command(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Omit<AcquireConnectorLeaseInput, 'correlationId'> {
-    return {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId: request.logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(request.bindingId),
-      connectorId: normalizeConnectorId(request.connectorId),
-      scopes: normalizeConnectorScopes(request.scopes),
-      ttlMs: request.ttlMs,
-    };
-  }
-
-  private async assertTenant(
-    lease: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    if (lease.identity.tenantId !== context.actorScope.tenantId) {
-      await this.recordPolicyDenial(
-        {
-          identity: {
-            tenantId: context.actorScope.tenantId,
-            logicalAgentId: 'untrusted',
-          },
-          bindingId: 'untrusted',
-          connectorId: 'untrusted',
-        },
-        context,
-      );
-      throw new ForbiddenException('Connector authority tenant scope denied');
-    }
-  }
-
-  private async durableLifecycleLease(
-    submittedLease: ConnectorLease,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    await this.assertTenant(submittedLease, context);
-    const durableLease = await this.coordinator.current(submittedLease);
-    if (!durableLease || !hasSameLifecycleAuthority(submittedLease, durableLease)) {
-      await this.recordPolicyDenial(durableLease ?? submittedLease, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-    return durableLease;
-  }
-
-  private async assertPolicy(
-    action: ConnectorLeasePolicyAction,
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-    requestedScopes: readonly string[],
-    requestedTtlMs: number | null,
-  ): Promise<void> {
-    const allowed = await this.policy.authorize({
-      action,
-      actorId: context.actorScope.userId,
-      tenantId: subject.identity.tenantId,
-      logicalAgentId: subject.identity.logicalAgentId,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      requestedScopes: Object.freeze([...requestedScopes]),
-      requestedTtlMs,
-    });
-    if (!allowed) {
-      await this.recordPolicyDenial(subject, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-  }
-
-  private async recordPolicyDenial(
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    const event: ConnectorLeaseAuditEvent = {
-      identity: subject.identity,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-      correlationId: this.correlation(context),
-      occurredAt: new Date().toISOString(),
-    };
-    await this.repository.recordAudit(event);
-  }
-
-  private correlation(context: ConnectorLeaseRequestContext): string {
-    return normalizeCorrelationId(context.correlationId);
-  }
-}
-
-function hasSameLifecycleAuthority(
-  submittedLease: ConnectorLease,
-  durableLease: ConnectorLease,
-): boolean {
-  return (
-    submittedLease.identity.tenantId === durableLease.identity.tenantId &&
-    submittedLease.identity.logicalAgentId === durableLease.identity.logicalAgentId &&
-    submittedLease.bindingId === durableLease.bindingId &&
-    submittedLease.leaseId === durableLease.leaseId &&
-    submittedLease.connectorId === durableLease.connectorId &&
-    submittedLease.leaseEpoch === durableLease.leaseEpoch &&
-    submittedLease.scopes.length === durableLease.scopes.length &&
-    submittedLease.scopes.every((scope: string, index: number): boolean => {
-      return scope === durableLease.scopes[index];
-    })
-  );
-}

apps/gateway/src/agent/durable-session.dto.ts

@@ -1,10 +0,0 @@
-import type { RuntimeProviderRequestContext } from './runtime-provider-registry.service.js';
-
-/** Server-side request for a replay-safe provider message. */
-export interface ProviderOutboxDto {
-  sessionId: string;
-  idempotencyKey: string;
-  correlationId: string;
-  content: string;
-  context: RuntimeProviderRequestContext;
-}

apps/gateway/src/agent/durable-session.repository.test.ts

@@ -1,416 +0,0 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { eq, sql, interactionCheckpoints, interactionInbox } from '@mosaicstack/db';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createPgliteDb, runPgliteMigrations, type DbHandle } from '@mosaicstack/db';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
-
-const IDENTITY: DurableSessionIdentity = {
-  agentName: 'Nova',
-  sessionId: 'tess-pglite-session',
-  tenantId: 'tenant-pglite',
-  ownerId: 'tess-owner',
-  providerId: 'fleet',
-  runtimeSessionId: 'nova',
-};
-
-describe('DurableSessionRepository', () => {
-  let dataDir: string | undefined;
-  let handle: DbHandle;
-  let previousAuthSecret: string | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    previousAuthSecret = process.env['BETTER_AUTH_SECRET'];
-    process.env['BETTER_AUTH_SECRET'] = 'tess-durable-state-test-sealing-key';
-    dataDir = mkdtempSync(join(tmpdir(), 'tess-durable-state-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    await seedOwner(handle);
-  }, 30_000);
-
-  beforeEach(async (): Promise<void> => {
-    await handle.db.execute(sql`DELETE FROM interaction_handoffs`);
-    await handle.db.execute(sql`DELETE FROM interaction_checkpoints`);
-    await handle.db.execute(sql`DELETE FROM interaction_inbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_outbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_sessions`);
-  });
-
-  afterAll(async (): Promise<void> => {
-    await handle.close();
-    if (dataDir) rmSync(dataDir, { recursive: true, force: true });
-    if (previousAuthSecret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-    else process.env['BETTER_AUTH_SECRET'] = previousAuthSecret;
-  });
-
-  it('survives a full PGlite close/reopen mid-session without duplicate inbox or outbox side effects', async () => {
-    const beforeRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      content: 'resume after a kill',
-    });
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'one response only',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-before-kill',
-      cursor: 'cursor-before-kill',
-      summary: 'restart-safe state',
-      compactionEpoch: 1,
-    });
-    await beforeRestart.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-before-kill',
-      destination: 'mos',
-      correlationId: 'correlation-before-kill',
-      checkpointId: 'checkpoint-before-kill',
-      status: 'pending',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-after-handoff',
-      cursor: 'cursor-after-handoff',
-      summary: 'newer state cannot strand the portable handoff',
-      compactionEpoch: 2,
-    });
-
-    await handle.close();
-    handle = createPgliteDb(dataDir!);
-
-    const afterRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    const recovered = await afterRestart.recover(IDENTITY.sessionId);
-    const resumedHandoff = await afterRestart.resumeHandoff('handoff-before-kill');
-    const handled: string[] = [];
-    const effects: string[] = [];
-
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-
-    expect(recovered.identity).toEqual(IDENTITY);
-    expect(recovered.checkpoint).toMatchObject({ checkpointId: 'checkpoint-after-handoff' });
-    expect(recovered.handoffs).toMatchObject([{ handoffId: 'handoff-before-kill' }]);
-    expect(resumedHandoff.checkpoint).toMatchObject({ checkpointId: 'checkpoint-before-kill' });
-    expect(handled).toEqual(['inbox-before-kill']);
-    expect(effects).toEqual(['outbox-before-kill']);
-  }, 30_000);
-
-  it('redacts sensitive durable payloads before persistence', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-inbox',
-      correlationId: 'correlation-redaction',
-      content: 'api_key=super-secret-canary',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-outbox',
-      correlationId: 'correlation-redaction',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'email operator@example.test api_key=super-secret-canary',
-    });
-    await coordinator.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'redacted-checkpoint',
-      cursor: 'bearer super-secret-canary',
-      summary: 'email operator@example.test',
-      compactionEpoch: 0,
-    });
-
-    const snapshot = await coordinator.snapshot(IDENTITY.sessionId);
-    const [persisted] = await handle.db
-      .select({ content: interactionInbox.content })
-      .from(interactionInbox)
-      .where(eq(interactionInbox.idempotencyKey, 'redacted-inbox'));
-
-    expect(JSON.stringify(snapshot)).not.toContain('super-secret-canary');
-    expect(JSON.stringify(snapshot)).not.toContain('operator@example.test');
-    expect(persisted?.content).not.toContain('super-secret-canary');
-    expect(persisted?.content).not.toContain('[REDACTED]');
-  }, 30_000);
-
-  it('fails closed when the configured idempotency secret is unavailable', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const secret = process.env['BETTER_AUTH_SECRET'];
-    delete process.env['BETTER_AUTH_SECRET'];
-    try {
-      await expect(
-        coordinator.receive({
-          sessionId: IDENTITY.sessionId,
-          idempotencyKey: 'requires-idempotency-secret',
-          correlationId: 'correlation-secret',
-          content: 'sensitive payload',
-        }),
-      ).rejects.toThrow(/required for durable idempotency digests/);
-    } finally {
-      if (secret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-      else process.env['BETTER_AUTH_SECRET'] = secret;
-    }
-  }, 30_000);
-
-  it('uses keyed pre-redaction digests to reject distinct sensitive checkpoint payloads', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-secret-conflict',
-      cursor: 'api_key=secret-one',
-      summary: 'bearer secret-one',
-      compactionEpoch: 1,
-    };
-    await coordinator.checkpoint(input);
-
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        cursor: 'api_key=secret-two',
-        summary: 'bearer secret-two',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-
-    const [persisted] = await handle.db
-      .select({
-        digest: interactionCheckpoints.contentDigest,
-        cursor: interactionCheckpoints.cursor,
-      })
-      .from(interactionCheckpoints)
-      .where(eq(interactionCheckpoints.checkpointId, input.checkpointId));
-    expect(persisted?.cursor).not.toContain('secret-one');
-    expect(persisted?.digest).not.toBe(
-      createHash('sha256')
-        .update(JSON.stringify([input.cursor, input.summary]))
-        .digest('hex'),
-    );
-
-    await coordinator.checkpoint({
-      ...input,
-      checkpointId: 'checkpoint-delimiter-conflict',
-      cursor: 'a\u0000b',
-      summary: 'c',
-    });
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        checkpointId: 'checkpoint-delimiter-conflict',
-        cursor: 'a',
-        summary: 'b\u0000c',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-  }, 30_000);
-
-  it('rejects distinct sensitive inbox and outbox payloads under reused idempotency keys', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const inbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-secret-conflict',
-      correlationId: 'correlation-inbox-secret',
-      content: 'api_key=secret-one',
-    };
-    const outbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-secret-conflict',
-      correlationId: 'correlation-outbox-secret',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'api_key=secret-one',
-    };
-    await coordinator.receive(inbox);
-    await coordinator.enqueueOutbox(outbox);
-
-    await expect(coordinator.receive({ ...inbox, content: 'api_key=secret-two' })).rejects.toThrow(
-      /idempotency conflict/,
-    );
-    await expect(
-      coordinator.enqueueOutbox({ ...outbox, content: 'api_key=secret-two' }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('rejects database inbox and outbox idempotency-key conflicts', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-conflict',
-      correlationId: 'correlation-inbox',
-      content: 'original inbox',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-conflict',
-      correlationId: 'correlation-outbox',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'original outbox',
-    });
-
-    await expect(
-      coordinator.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'inbox-conflict',
-        correlationId: 'forged-correlation',
-        content: 'original inbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-    await expect(
-      coordinator.enqueueOutbox({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'outbox-conflict',
-        correlationId: 'correlation-outbox',
-        channelId: 'forged-channel',
-        kind: 'provider.send',
-        content: 'original outbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('does not requeue a live outbox claim during a normal scoped dispatch', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'live-effect',
-      correlationId: 'correlation-live',
-      content: 'must not duplicate',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-live',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    expect(await repository.claimOutbox(IDENTITY.sessionId)).toMatchObject({
-      status: 'processing',
-    });
-
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, input);
-    await expect(
-      service.recoverProviderSession(IDENTITY.sessionId, {
-        ...input,
-        context: {
-          ...input.context,
-          actorScope: { userId: 'intruder', tenantId: 'tenant-pglite' },
-        },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'live-effect', status: 'processing' }],
-    });
-  }, 30_000);
-
-  it('rejects an outbox correlation mismatch before claiming the pending effect', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'mismatch-effect',
-      correlationId: 'correlation-expected',
-      content: 'must remain pending',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-expected',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    await expect(
-      service.dispatchProviderOutbox(IDENTITY.sessionId, {
-        ...input,
-        correlationId: 'correlation-forged',
-        context: { ...input.context, correlationId: 'correlation-forged' },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'mismatch-effect', status: 'pending' }],
-    });
-  }, 30_000);
-
-  it('dispatches only the outbox record bound to the supplied correlation and channel', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const first = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'scoped-effect-one',
-      correlationId: 'correlation-one',
-      content: 'first result',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-one',
-      },
-    };
-    const second = {
-      ...first,
-      idempotencyKey: 'scoped-effect-two',
-      correlationId: 'correlation-two',
-      content: 'second result',
-      context: { ...first.context, correlationId: 'correlation-two' },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(first);
-    await service.queueProviderSend(second);
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, first);
-
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledTimes(1);
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledWith(
-      IDENTITY.providerId,
-      IDENTITY.runtimeSessionId,
-      { content: 'first result', idempotencyKey: 'scoped-effect-one' },
-      first.context,
-    );
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [
-        { idempotencyKey: 'scoped-effect-one', status: 'delivered' },
-        { idempotencyKey: 'scoped-effect-two', status: 'pending' },
-      ],
-    });
-  }, 30_000);
-});
-
-async function seedOwner(handle: DbHandle): Promise<void> {
-  await handle.db.execute(sql`
-    INSERT INTO users (id, name, email, email_verified, created_at, updated_at)
-    VALUES ('tess-owner', 'Tess Owner', 'tess-owner@example.test', false, now(), now())
-  `);
-}

apps/gateway/src/agent/durable-session.repository.ts

@@ -1,529 +0,0 @@
-import { createHash, createHmac } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  asc,
-  desc,
-  eq,
-  interactionCheckpoints,
-  interactionHandoffs,
-  interactionInbox,
-  interactionOutbox,
-  interactionSessions,
-  type Db,
-} from '@mosaicstack/db';
-import { seal, unseal } from '@mosaicstack/auth';
-import { redactSensitiveContent } from '@mosaicstack/log';
-import type {
-  DurableCheckpoint,
-  DurableCheckpointInput,
-  DurableEnqueueResult,
-  DurableHandoff,
-  DurableHandoffInput,
-  DurableInboxEntry,
-  DurableInboxInput,
-  DurableInboxStatus,
-  DurableOutboxEntry,
-  DurableOutboxInput,
-  DurableOutboxStatus,
-  DurableSessionIdentity,
-  DurableSessionSnapshot,
-  DurableSessionStore,
-} from '@mosaicstack/agent';
-import { DB } from '../database/database.module.js';
-
-@Injectable()
-export class DurableSessionRepository implements DurableSessionStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async create(identity: DurableSessionIdentity): Promise<void> {
-    await this.db
-      .insert(interactionSessions)
-      .values({
-        id: identity.sessionId,
-        agentName: identity.agentName,
-        tenantId: identity.tenantId,
-        ownerId: identity.ownerId,
-        providerId: identity.providerId,
-        runtimeSessionId: identity.runtimeSessionId,
-      })
-      .onConflictDoNothing();
-
-    const existing = await this.session(identity.sessionId);
-    if (!existing || !sameEnrollmentScope(existing, identity)) {
-      throw new Error(`Durable session identity conflict: ${identity.sessionId}`);
-    }
-    // A recovered/re-enrolled runtime can receive a new provider session ID;
-    // the conversation handle and owner scope remain immutable.
-    if (
-      existing.providerId !== identity.providerId ||
-      existing.runtimeSessionId !== identity.runtimeSessionId
-    ) {
-      await this.db
-        .update(interactionSessions)
-        .set({ providerId: identity.providerId, runtimeSessionId: identity.runtimeSessionId })
-        .where(eq(interactionSessions.id, identity.sessionId));
-    }
-  }
-
-  async snapshot(sessionId: string): Promise<DurableSessionSnapshot | null> {
-    const identity = await this.session(sessionId);
-    if (!identity) return null;
-
-    const [inbox, outbox, checkpoints, handoffs] = await Promise.all([
-      this.db
-        .select()
-        .from(interactionInbox)
-        .where(eq(interactionInbox.sessionId, sessionId))
-        .orderBy(asc(interactionInbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionOutbox)
-        .where(eq(interactionOutbox.sessionId, sessionId))
-        .orderBy(asc(interactionOutbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionCheckpoints)
-        .where(eq(interactionCheckpoints.sessionId, sessionId))
-        .orderBy(
-          desc(interactionCheckpoints.compactionEpoch),
-          desc(interactionCheckpoints.createdAt),
-        )
-        .limit(1),
-      this.db
-        .select()
-        .from(interactionHandoffs)
-        .where(eq(interactionHandoffs.sessionId, sessionId))
-        .orderBy(asc(interactionHandoffs.createdAt)),
-    ]);
-
-    const checkpoint = checkpoints[0];
-    return {
-      identity,
-      inbox: inbox.map(toInbox),
-      outbox: outbox.map(toOutbox),
-      ...(checkpoint ? { checkpoint: toCheckpoint(checkpoint) } : {}),
-      handoffs: handoffs.map(toHandoff),
-    };
-  }
-
-  async enqueueInbox(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableInboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionInbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionInbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionInbox)
-      .where(
-        and(
-          eq(interactionInbox.sessionId, input.sessionId),
-          eq(interactionInbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0]) throw new Error(`Durable inbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toInbox(existing[0]);
-    if (
-      !sameInbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable inbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimInbox(sessionId: string): Promise<DurableInboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionInbox)
-        .where(
-          and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionInbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionInbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionInbox.id, entry.id), eq(interactionInbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toInbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async completeInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'processed', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async enqueueOutbox(
-    input: DurableOutboxInput,
-  ): Promise<DurableEnqueueResult<DurableOutboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableOutboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionOutbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionOutbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionOutbox)
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, input.sessionId),
-          eq(interactionOutbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0]) throw new Error(`Durable outbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toOutbox(existing[0]);
-    if (
-      !sameOutbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable outbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimOutbox(sessionId: string): Promise<DurableOutboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionOutbox)
-        .where(
-          and(eq(interactionOutbox.sessionId, sessionId), eq(interactionOutbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionOutbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionOutbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionOutbox.id, entry.id), eq(interactionOutbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toOutbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async claimOutboxByKey(
-    sessionId: string,
-    idempotencyKey: string,
-  ): Promise<DurableOutboxEntry | null> {
-    const claimed = await this.db
-      .update(interactionOutbox)
-      .set({ status: 'processing', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'pending'),
-        ),
-      )
-      .returning();
-    return claimed[0] ? toOutbox(claimed[0]) : null;
-  }
-
-  async completeOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'delivered', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async checkpoint(input: DurableCheckpointInput): Promise<void> {
-    // Compute identity before redaction.  The persisted digest is keyed so a database
-    // reader cannot use it as an offline oracle for sensitive cursor/summary values.
-    const digest = contentDigest(JSON.stringify([input.cursor, input.summary]));
-    const checkpoint: DurableCheckpointInput = {
-      ...input,
-      cursor: redactSensitiveContent(input.cursor).content,
-      summary: redactSensitiveContent(input.summary).content,
-    };
-    const inserted = await this.db
-      .insert(interactionCheckpoints)
-      .values({
-        ...checkpoint,
-        contentDigest: digest,
-        cursor: seal(checkpoint.cursor),
-        summary: seal(checkpoint.summary),
-      })
-      .onConflictDoNothing()
-      .returning({ checkpointId: interactionCheckpoints.checkpointId });
-    if (inserted[0]) return;
-
-    const existing = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, input.sessionId),
-          eq(interactionCheckpoints.checkpointId, input.checkpointId),
-        ),
-      )
-      .limit(1);
-    if (
-      !existing[0] ||
-      !sameCheckpoint(toCheckpoint(existing[0]), checkpoint) ||
-      !matchesCheckpointDigest(existing[0].contentDigest, digest)
-    ) {
-      throw new Error(`Durable checkpoint identity conflict: ${input.checkpointId}`);
-    }
-  }
-
-  async findCheckpoint(sessionId: string, checkpointId: string): Promise<DurableCheckpoint | null> {
-    const checkpoints = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, sessionId),
-          eq(interactionCheckpoints.checkpointId, checkpointId),
-        ),
-      )
-      .limit(1);
-    const checkpoint = checkpoints[0];
-    return checkpoint ? toCheckpoint(checkpoint) : null;
-  }
-
-  async handoff(input: DurableHandoffInput): Promise<void> {
-    const checkpoint = await this.findCheckpoint(input.sessionId, input.checkpointId);
-    if (!checkpoint) {
-      throw new Error(`Durable handoff checkpoint is unavailable: ${input.checkpointId}`);
-    }
-    const inserted = await this.db
-      .insert(interactionHandoffs)
-      .values({ ...input })
-      .onConflictDoNothing()
-      .returning({ handoffId: interactionHandoffs.handoffId });
-    if (inserted[0]) return;
-
-    const existing = await this.findHandoff(input.handoffId);
-    if (!existing || !sameHandoff(existing, input)) {
-      throw new Error(`Durable handoff identity conflict: ${input.handoffId}`);
-    }
-  }
-
-  async findHandoff(handoffId: string): Promise<DurableHandoff | null> {
-    const handoffs = await this.db
-      .select()
-      .from(interactionHandoffs)
-      .where(eq(interactionHandoffs.handoffId, handoffId))
-      .limit(1);
-    const handoff = handoffs[0];
-    return handoff ? toHandoff(handoff) : null;
-  }
-
-  async requeueInFlight(sessionId: string): Promise<void> {
-    // Inbox handlers are process-local work. A provider outbox claim may have
-    // reached an external target before a crash, so it is deliberately not
-    // replayed by generic recovery.
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'processing')),
-      );
-  }
-
-  private async session(sessionId: string): Promise<DurableSessionIdentity | null> {
-    const sessions = await this.db
-      .select()
-      .from(interactionSessions)
-      .where(eq(interactionSessions.id, sessionId))
-      .limit(1);
-    const session = sessions[0];
-    return session
-      ? {
-          agentName: session.agentName,
-          sessionId: session.id,
-          tenantId: session.tenantId,
-          ownerId: session.ownerId,
-          providerId: session.providerId,
-          runtimeSessionId: session.runtimeSessionId,
-        }
-      : null;
-  }
-}
-
-function contentDigest(content: string): string {
-  const secret = process.env['BETTER_AUTH_SECRET'];
-  if (!secret) {
-    throw new Error('BETTER_AUTH_SECRET is required for durable idempotency digests');
-  }
-  return `hmac:v1:${createHmac('sha256', secret).update(content).digest('hex')}`;
-}
-
-function matchesContentDigest(stored: string, content: string): boolean {
-  return (
-    stored === contentDigest(content) ||
-    stored === createHash('sha256').update(content).digest('hex')
-  );
-}
-
-function matchesCheckpointDigest(stored: string, digest: string): boolean {
-  // Legacy rows predate any pre-redaction identity and cannot safely prove equality.
-  // Reject rather than let redaction collapse distinct sensitive checkpoint payloads.
-  return stored === digest;
-}
-
-function sameEnrollmentScope(left: DurableSessionIdentity, right: DurableSessionIdentity): boolean {
-  return (
-    left.agentName === right.agentName &&
-    left.sessionId === right.sessionId &&
-    left.tenantId === right.tenantId &&
-    left.ownerId === right.ownerId
-  );
-}
-
-function sameInbox(left: DurableInboxEntry, right: DurableInboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.content === right.content
-  );
-}
-
-function sameOutbox(left: DurableOutboxEntry, right: DurableOutboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.channelId === right.channelId &&
-    left.kind === right.kind &&
-    left.content === right.content
-  );
-}
-
-function sameCheckpoint(left: DurableCheckpoint, right: DurableCheckpointInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.checkpointId === right.checkpointId &&
-    left.compactionEpoch === right.compactionEpoch
-  );
-}
-
-function sameHandoff(left: DurableHandoff, right: DurableHandoffInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.handoffId === right.handoffId &&
-    left.destination === right.destination &&
-    left.correlationId === right.correlationId &&
-    left.checkpointId === right.checkpointId &&
-    left.status === right.status
-  );
-}
-
-function toInbox(row: typeof interactionInbox.$inferSelect): DurableInboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toOutbox(row: typeof interactionOutbox.$inferSelect): DurableOutboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    channelId: row.channelId,
-    kind: row.kind,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toCheckpoint(row: typeof interactionCheckpoints.$inferSelect): DurableCheckpoint {
-  return {
-    sessionId: row.sessionId,
-    checkpointId: row.checkpointId,
-    cursor: unseal(row.cursor),
-    summary: unseal(row.summary),
-    compactionEpoch: row.compactionEpoch,
-  };
-}
-
-function toHandoff(row: typeof interactionHandoffs.$inferSelect): DurableHandoff {
-  return {
-    sessionId: row.sessionId,
-    handoffId: row.handoffId,
-    destination: row.destination,
-    correlationId: row.correlationId,
-    checkpointId: row.checkpointId,
-    status: row.status,
-  };
-}

apps/gateway/src/agent/durable-session.service.ts

@@ -1,123 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import type { ProviderOutboxDto } from './durable-session.dto.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Scoped gateway boundary for the canonical durable session state machine. It deliberately
- * uses composition: raw state methods cannot be injected into channel, CLI, or
- * MCP adapters without a server-derived actor/tenant/correlation context.
- */
-@Injectable()
-export class DurableSessionService {
-  private readonly coordinator: DurableSessionCoordinator;
-
-  constructor(
-    @Inject(DurableSessionRepository) repository: DurableSessionRepository,
-    @Inject(RuntimeProviderService) private readonly runtimeProviders: RuntimeProviderService,
-  ) {
-    this.coordinator = new DurableSessionCoordinator(repository);
-  }
-
-  /** Enroll a verified runtime session under the stable cross-surface conversation handle. */
-  async enroll(
-    identity: DurableSessionIdentity,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    if (
-      identity.ownerId !== context.actorScope.userId ||
-      identity.tenantId !== context.actorScope.tenantId
-    ) {
-      throw new ForbiddenException('Durable session enrollment scope mismatch');
-    }
-    await this.coordinator.create(identity);
-  }
-
-  async queueProviderSend(input: ProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(input.sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.enqueueOutbox({
-      sessionId: input.sessionId,
-      idempotencyKey: input.idempotencyKey,
-      correlationId: input.correlationId,
-      channelId: input.context.channelId,
-      kind: 'provider.send',
-      content: input.content,
-    });
-  }
-
-  async dispatchProviderOutbox(sessionId: string, input: ProviderOutboxDto): Promise<void> {
-    if (sessionId !== input.sessionId) {
-      throw new ForbiddenException('Durable outbox session mismatch');
-    }
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    const pendingEntry = snapshot.outbox.find(
-      (entry): boolean => entry.idempotencyKey === input.idempotencyKey,
-    );
-    if (!pendingEntry) return;
-    // Validate immutable routing before claiming. A caller with a mismatched
-    // correlation/channel must not strand a pending external side effect.
-    this.assertOutboxScope(pendingEntry, input);
-    await this.coordinator.dispatchOutboxEntry(
-      sessionId,
-      input.idempotencyKey,
-      async (entry): Promise<void> => {
-        this.assertOutboxScope(entry, input);
-        await this.runtimeProviders.sendMessage(
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-          { content: entry.content, idempotencyKey: entry.idempotencyKey },
-          input.context,
-        );
-      },
-    );
-  }
-
-  /** Read durable identity/state only after deriving and checking the server-side actor scope. */
-  async getSnapshot(sessionId: string, context: RuntimeProviderRequestContext) {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, {
-      sessionId,
-      content: '',
-      idempotencyKey: 'read-only',
-      correlationId: context.correlationId,
-      context,
-    });
-    return snapshot;
-  }
-
-  /** Startup/recovery-only path; normal queue/dispatch methods never requeue live work. */
-  async recoverProviderSession(sessionId: string, input: ProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.recover(sessionId);
-  }
-
-  private assertOutboxScope(
-    entry: { kind: string; correlationId: string; channelId: string },
-    input: ProviderOutboxDto,
-  ): void {
-    if (
-      entry.kind !== 'provider.send' ||
-      entry.correlationId !== input.correlationId ||
-      entry.channelId !== input.context.channelId
-    ) {
-      throw new ForbiddenException('Durable outbox scope or correlation mismatch');
-    }
-  }
-
-  private assertScope(ownerId: string, tenantId: string, input: ProviderOutboxDto): void {
-    if (
-      input.context.actorScope.userId !== ownerId ||
-      input.context.actorScope.tenantId !== tenantId ||
-      input.context.correlationId !== input.correlationId
-    ) {
-      throw new ForbiddenException('Durable session scope or correlation mismatch');
-    }
-  }
-}

apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts

@@ -1,176 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { HermesRuntimeProvider } from '@mosaicstack/agent';
-import { AgentModule } from './agent.module.js';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { BRAIN } from '../brain/brain.tokens.js';
-import { DB } from '../database/database.module.js';
-import { CoordModule } from '../coord/coord.module.js';
-import { McpClientModule } from '../mcp-client/mcp-client.module.js';
-import { SkillsModule } from '../skills/skills.module.js';
-import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-} from './runtime-provider-registry.service.js';
-import { DurableSessionService } from './durable-session.service.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { AgentService } from './agent.service.js';
-import { ProviderService } from './provider.service.js';
-import { ProviderCredentialsService } from './provider-credentials.service.js';
-import { RoutingService } from './routing.service.js';
-import { RoutingEngineService } from './routing/routing-engine.service.js';
-import { SkillLoaderService } from './skill-loader.service.js';
-
-const authenticatedUser = { id: 'operator-1', tenantId: 'tenant-1' };
-
-@Module({})
-class EmptyAgentDependencyModule {}
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: authenticatedUser, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-    { provide: BRAIN, useValue: {} },
-    { provide: DB, useValue: {} },
-  ],
-  exports: [AUTH, AuthGuard, BRAIN, DB],
-})
-class AuthenticatedRequestModule {}
-
-/**
- * This is deliberately an HTTP test rather than a controller unit test: it
- * exercises AgentModule's actual provider factory, Nest DI, and AuthGuard.
- */
-describe('Hermes runtime provider reachability', (): void => {
-  let app: NestFastifyApplication | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule, AgentModule],
-    })
-      .overrideModule(CoordModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(McpClientModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(SkillsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(GCModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(LogModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(CommandsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideProvider(RuntimeProviderAuditService)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_PROVIDER_AUDIT_SINK)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_APPROVAL_VERIFIER)
-      .useValue({ consume: vi.fn().mockResolvedValue(false) })
-      .overrideProvider(DurableSessionService)
-      .useValue({})
-      .overrideProvider(DurableSessionRepository)
-      .useValue({})
-      .overrideProvider(AgentService)
-      .useValue({})
-      .overrideProvider(ProviderService)
-      .useValue({})
-      .overrideProvider(ProviderCredentialsService)
-      .useValue({})
-      .overrideProvider(RoutingService)
-      .useValue({})
-      .overrideProvider(RoutingEngineService)
-      .useValue({})
-      .overrideProvider(SkillLoaderService)
-      .useValue({})
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  afterAll(async (): Promise<void> => {
-    await app?.close();
-  });
-
-  it('returns gateway denial responses from the actual guarded interaction routes', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-
-    const attachDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/attach',
-      headers: { 'x-correlation-id': 'correlation-1' },
-      payload: { mode: 'read' },
-    });
-    expect(attachDenied.statusCode).toBe(401);
-
-    const sendDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/send',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(sendDenied.statusCode).toBe(403);
-    expect(sendDenied.json()).toMatchObject({
-      message: 'Content and idempotency key are required',
-    });
-
-    const stopDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/stop',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(stopDenied.statusCode).toBe(403);
-    expect(stopDenied.json()).toMatchObject({ message: 'Exact-action approval is required' });
-  });
-
-  it('requires authentication and reaches the Hermes provider registered by AgentModule', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-    const registry = app.get(AGENT_RUNTIME_PROVIDER_REGISTRY);
-    expect(registry.get('runtime.hermes')).toBeInstanceOf(HermesRuntimeProvider);
-
-    const denied = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { 'x-correlation-id': 'correlation-1' },
-    });
-    expect(denied.statusCode).toBe(401);
-
-    const response = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-    });
-    expect(response.statusCode).toBe(200);
-    expect(response.json()).toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-
-const scope = {
-  actorId: 'owner-1',
-  tenantId: 'tenant-1',
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-describe('GatewayHermesRuntimeTransport', () => {
-  it('preserves a configured path prefix and authenticates the concrete runtime request', async () => {
-    const fetchFn = vi
-      .fn()
-      .mockResolvedValue(new Response(JSON.stringify(['session.list']), { status: 200 }));
-    const transport = new GatewayHermesRuntimeTransport(
-      'https://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).resolves.toEqual(['session.list']);
-
-    expect(fetchFn).toHaveBeenCalledWith(
-      new URL('https://runtime.example.test/hermes/capabilities'),
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          authorization: 'Bearer test-service-token',
-          'x-mosaic-channel-id': 'cli',
-        }),
-      }),
-    );
-  });
-
-  it('rejects non-loopback HTTP runtime endpoints before sending identity headers', async () => {
-    const fetchFn = vi.fn();
-    const transport = new GatewayHermesRuntimeTransport(
-      'http://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).rejects.toThrow('requires HTTPS');
-    expect(fetchFn).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.ts

@@ -1,121 +0,0 @@
-import type { HermesLegacySession, HermesRuntimeTransport } from '@mosaicstack/agent';
-import type {
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-
-/** Concrete HTTP transport for a configured legacy Hermes runtime endpoint. */
-export class GatewayHermesRuntimeTransport implements HermesRuntimeTransport {
-  constructor(
-    private readonly baseUrl = process.env['MOSAIC_HERMES_RUNTIME_URL']?.trim(),
-    private readonly serviceToken = process.env['MOSAIC_HERMES_RUNTIME_TOKEN']?.trim(),
-    private readonly fetchFn: typeof fetch = fetch,
-  ) {}
-
-  async capabilities(scope: RuntimeScope): Promise<string[]> {
-    return this.request<string[]>('/capabilities', scope);
-  }
-
-  async health(scope: RuntimeScope): Promise<{ status: string; detail?: string }> {
-    return this.request<{ status: string; detail?: string }>('/health', scope);
-  }
-
-  async sessions(scope: RuntimeScope): Promise<HermesLegacySession[]> {
-    return this.request<HermesLegacySession[]>('/sessions', scope);
-  }
-
-  async *stream(
-    sessionId: string,
-    cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const params = new URLSearchParams(cursor ? { cursor } : {});
-    const events = await this.request<RuntimeStreamEvent[]>(
-      `/sessions/${encodeURIComponent(sessionId)}/stream?${params.toString()}`,
-      scope,
-    );
-    yield* events;
-  }
-
-  async send(sessionId: string, message: RuntimeMessage, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/messages`, scope, {
-      method: 'POST',
-      body: message,
-    });
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    return this.request<RuntimeAttachHandle>(
-      `/sessions/${encodeURIComponent(sessionId)}/attach`,
-      scope,
-      {
-        method: 'POST',
-        body: { mode },
-      },
-    );
-  }
-
-  async detach(attachmentId: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/attachments/${encodeURIComponent(attachmentId)}`, scope, {
-      method: 'DELETE',
-    });
-  }
-
-  async terminate(sessionId: string, approvalRef: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/terminate`, scope, {
-      method: 'POST',
-      body: { approvalRef },
-    });
-  }
-
-  private async request<T>(
-    path: string,
-    scope: RuntimeScope,
-    init: { method?: string; body?: unknown } = {},
-  ): Promise<T> {
-    if (!this.baseUrl || !this.serviceToken) {
-      throw new Error(
-        'MOSAIC_HERMES_RUNTIME_URL and MOSAIC_HERMES_RUNTIME_TOKEN must configure Hermes transport',
-      );
-    }
-    const endpoint = new URL(this.baseUrl);
-    if (endpoint.protocol !== 'https:' && !isLoopbackHttp(endpoint)) {
-      throw new Error('Hermes runtime transport requires HTTPS outside loopback');
-    }
-    const response = await this.fetchFn(
-      new URL(path.replace(/^\//, ''), `${endpoint.toString().replace(/\/$/, '')}/`),
-      {
-        method: init.method ?? 'GET',
-        headers: {
-          accept: 'application/json',
-          authorization: `Bearer ${this.serviceToken}`,
-          'x-mosaic-actor-id': scope.actorId,
-          'x-mosaic-tenant-id': scope.tenantId,
-          'x-mosaic-channel-id': scope.channelId,
-          'x-correlation-id': scope.correlationId,
-          ...(init.body ? { 'content-type': 'application/json' } : {}),
-        },
-        ...(init.body ? { body: JSON.stringify(init.body) } : {}),
-      },
-    );
-    if (!response.ok) throw new Error(`Hermes runtime request failed: ${response.status}`);
-    if (response.status === 204) return undefined as T;
-    return (await response.json()) as T;
-  }
-}
-
-function isLoopbackHttp(endpoint: URL): boolean {
-  return (
-    endpoint.protocol === 'http:' &&
-    (endpoint.hostname === 'localhost' ||
-      endpoint.hostname === '127.0.0.1' ||
-      endpoint.hostname === '::1')
-  );
-}

apps/gateway/src/agent/interaction.controller.test.ts

@@ -1,263 +0,0 @@
-import { createGatewayRuntimeProviderRegistry } from './agent.module.js';
-import { firstValueFrom } from 'rxjs';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import {
-  RuntimeApprovalDeniedError,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import { InteractionController } from './interaction.controller.js';
-
-describe('InteractionController', (): void => {
-  afterEach(() => vi.restoreAllMocks());
-
-  it('maps a denied runtime approval to Fastify HTTP 403', () => {
-    const send = vi.fn();
-    const status = vi.fn().mockReturnValue({ send });
-    const response = { status };
-    const host = { switchToHttp: () => ({ getResponse: () => response }) };
-
-    new RuntimeApprovalDeniedFilter().catch(new RuntimeApprovalDeniedError(), host as never);
-
-    expect(status).toHaveBeenCalledWith(403);
-    expect(send).toHaveBeenCalledWith({
-      statusCode: 403,
-      message: 'Runtime termination approval denied',
-    });
-  });
-
-  it('honors a differently named configured instance without a code change', async () => {
-    const prior = process.env['MOSAIC_AGENT_NAME'];
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { listSessions: vi.fn().mockResolvedValue([]) };
-    const controller = new InteractionController(runtime as never, {} as never);
-
-    await expect(
-      controller.sessions('Nova', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).resolves.toEqual([]);
-    await expect(
-      controller.sessions('Other', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).rejects.toThrow('Interaction agent is not configured');
-
-    if (prior === undefined) delete process.env['MOSAIC_AGENT_NAME'];
-    else process.env['MOSAIC_AGENT_NAME'] = prior;
-  });
-
-  it('reaches the registered Hermes provider through the authenticated transitional matrix route', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const registry = createGatewayRuntimeProviderRegistry();
-    const runtime = new RuntimeProviderService(
-      registry,
-      { record: vi.fn().mockResolvedValue(undefined) },
-      { consume: vi.fn().mockResolvedValue(false) },
-    );
-    const controller = new InteractionController(runtime, {} as never);
-
-    await expect(
-      controller.transitionalCapabilities(
-        'Nova',
-        'runtime.hermes',
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-
-  it('rejects a request without the non-simple correlation header', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ listSessions: vi.fn() } as never, {} as never);
-
-    await expect(controller.sessions('Nova', 'fleet', { id: 'owner' })).rejects.toThrow(
-      'X-Correlation-Id is required',
-    );
-  });
-
-  it('enrolls a visible runtime session under the cross-surface conversation handle', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const durable = { enroll: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.enroll(
-        'Nova',
-        'conversation-1',
-        { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual({ status: 'enrolled', sessionId: 'conversation-1' });
-    expect(durable.enroll).toHaveBeenCalledWith(
-      {
-        agentName: 'Nova',
-        sessionId: 'conversation-1',
-        tenantId: 'team',
-        ownerId: 'owner',
-        providerId: 'fleet',
-        runtimeSessionId: 'runtime-1',
-      },
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('rejects an invalid attach mode before invoking a provider', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ attach: vi.fn() } as never, {} as never);
-
-    await expect(
-      controller.attach('Nova', 'durable-1', { mode: 'write' as never }, { id: 'owner' }, 'corr-1'),
-    ).rejects.toThrow('Interaction attach mode is invalid');
-  });
-
-  it('resumes a durable session by attaching and streaming its runtime events', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtimeEvent = {
-      type: 'message.delta' as const,
-      sessionId: 'runtime-1',
-      cursor: 'cursor-1',
-      occurredAt: '2026-07-13T00:00:00.000Z',
-      content: 'resumed',
-    };
-    const runtime = {
-      attach: vi.fn().mockResolvedValue({ attachmentId: 'attach-1', sessionId: 'runtime-1' }),
-      streamSession: vi.fn(async function* () {
-        yield runtimeEvent;
-      }),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.attach('Nova', 'conversation-1', { mode: 'read' }, { id: 'owner' }, 'corr-1');
-    await expect(
-      firstValueFrom(
-        controller.stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1'),
-      ),
-    ).resolves.toEqual({ data: runtimeEvent });
-
-    expect(runtime.attach).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'read',
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-    expect(runtime.streamSession).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      undefined,
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('does not create a runtime stream after the SSE subscriber disconnects during snapshot lookup', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    let resolveSnapshot!: (value: { identity: Record<string, string> }) => void;
-    const snapshot = new Promise<{ identity: Record<string, string> }>((resolve) => {
-      resolveSnapshot = resolve;
-    });
-    const runtime = { streamSession: vi.fn() };
-    const durable = { getSnapshot: vi.fn().mockReturnValue(snapshot) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    const subscription = controller
-      .stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1')
-      .subscribe();
-    subscription.unsubscribe();
-    resolveSnapshot({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    });
-    await new Promise((resolve) => setTimeout(resolve, 0));
-
-    expect(runtime.streamSession).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ['wrong actor', { getSnapshot: vi.fn().mockRejectedValue(new Error('scope mismatch')) }],
-    [
-      'session-agent mismatch',
-      {
-        getSnapshot: vi.fn().mockResolvedValue({
-          identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        }),
-      },
-    ],
-  ])('denies a CLI stop for %s', async (_reason, durable) => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toBeDefined();
-    expect(runtime.terminate).not.toHaveBeenCalled();
-  });
-
-  it('surfaces a denied runtime approval to the CLI interaction surface', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      terminate: vi.fn().mockRejectedValue(new Error('Runtime termination approval denied')),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toThrow('Runtime termination approval denied');
-  });
-
-  it('uses the durable session identity and runtime registry for an approved stop', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.stop(
-      'Nova',
-      'durable-1',
-      { approvalRef: 'approval-1' },
-      { id: 'owner' },
-      'corr-1',
-    );
-
-    expect(runtime.terminate).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'approval-1',
-      expect.objectContaining({
-        correlationId: 'corr-1',
-        actorScope: { userId: 'owner', tenantId: 'owner' },
-      }),
-    );
-  });
-});

apps/gateway/src/agent/interaction.controller.ts

@@ -1,293 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Sse,
-  Inject,
-  Param,
-  Post,
-  Query,
-  UseGuards,
-  UseFilters,
-} from '@nestjs/common';
-import type { RuntimeAttachMode, RuntimeStreamEvent } from '@mosaicstack/types';
-import { Observable } from 'rxjs';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { DurableSessionService } from './durable-session.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Authenticated HTTP boundary for operator interaction clients. Identity is
- * selected from deployment configuration, never a client-side command name.
- */
-@Controller('api/interaction/:agentName')
-@UseGuards(AuthGuard)
-@UseFilters(RuntimeApprovalDeniedFilter)
-export class InteractionController {
-  constructor(
-    @Inject(RuntimeProviderService) private readonly runtime: RuntimeProviderService,
-    @Inject(DurableSessionService) private readonly durable: DurableSessionService,
-  ) {}
-
-  @Get('sessions')
-  async sessions(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.listSessions(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  @Get('transitional-capabilities')
-  async transitionalCapabilities(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.transitionalCapabilityMatrix(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  @Get('tree')
-  async tree(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.getSessionTree(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  /**
-   * Bind an existing, authorized runtime session to the stable conversation ID.
-   * This is the lifecycle boundary where both runtime identifiers are known.
-   */
-  @Post('sessions/:sessionId/enroll')
-  async enroll(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { providerId?: string; runtimeSessionId?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const providerId = this.requiredProvider(body.providerId ?? '');
-    const runtimeSessionId = body.runtimeSessionId?.trim();
-    if (!runtimeSessionId) throw new ForbiddenException('Runtime session identity is required');
-    const context = this.context(user, correlationId);
-    const sessions = await this.runtime.listSessions(providerId, context);
-    if (!sessions.some((session): boolean => session.id === runtimeSessionId)) {
-      throw new ForbiddenException('Runtime session is not visible to this actor');
-    }
-    await this.durable.enroll(
-      {
-        agentName,
-        sessionId,
-        tenantId: context.actorScope.tenantId,
-        ownerId: context.actorScope.userId,
-        providerId,
-        runtimeSessionId,
-      },
-      context,
-    );
-    return { status: 'enrolled', sessionId };
-  }
-
-  @Post('sessions/:sessionId/attach')
-  async attach(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { mode?: RuntimeAttachMode } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const mode = body.mode ?? 'read';
-    if (mode !== 'read' && mode !== 'control') {
-      throw new ForbiddenException('Interaction attach mode is invalid');
-    }
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    return this.runtime.attach(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      mode,
-      context,
-    );
-  }
-
-  @Sse('sessions/:sessionId/stream')
-  stream(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Query('cursor') cursor: string | undefined,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Observable<{ data: RuntimeStreamEvent }> {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    return new Observable((subscriber) => {
-      let iterator: AsyncIterator<RuntimeStreamEvent> | undefined;
-      let cancelled = false;
-      void (async (): Promise<void> => {
-        try {
-          const snapshot = await this.durable.getSnapshot(sessionId, context);
-          if (cancelled || subscriber.closed) return;
-          this.assertSessionAgent(snapshot.identity.agentName, agentName);
-          iterator = this.runtime
-            .streamSession(
-              snapshot.identity.providerId,
-              snapshot.identity.runtimeSessionId,
-              cursor?.trim() || undefined,
-              context,
-            )
-            [Symbol.asyncIterator]();
-          if (cancelled || subscriber.closed) {
-            await iterator.return?.();
-            return;
-          }
-          while (!cancelled && !subscriber.closed) {
-            const next = await iterator.next();
-            if (next.done || cancelled || subscriber.closed) break;
-            subscriber.next({ data: next.value });
-          }
-          if (!subscriber.closed) subscriber.complete();
-        } catch (error: unknown) {
-          if (!subscriber.closed) subscriber.error(error);
-        }
-      })();
-      return (): void => {
-        cancelled = true;
-        void iterator?.return?.();
-      };
-    });
-  }
-
-  @Post('sessions/:sessionId/send')
-  async send(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { content?: string; idempotencyKey?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.content?.trim() || !body.idempotencyKey?.trim()) {
-      throw new ForbiddenException('Content and idempotency key are required');
-    }
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    const input = {
-      sessionId,
-      content: body.content,
-      idempotencyKey: body.idempotencyKey,
-      correlationId: context.correlationId,
-      context,
-    };
-    await this.durable.queueProviderSend(input);
-    await this.durable.dispatchProviderOutbox(sessionId, input);
-    return { status: 'queued', sessionId };
-  }
-
-  @Post('sessions/:sessionId/stop')
-  async stop(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { approvalRef?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.approvalRef?.trim())
-      throw new ForbiddenException('Exact-action approval is required');
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.runtime.terminate(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      body.approvalRef,
-      context,
-    );
-    return { status: 'stopped', sessionId };
-  }
-
-  @Post('sessions/:sessionId/recover')
-  async recover(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.durable.recoverProviderSession(sessionId, {
-      sessionId,
-      content: '',
-      idempotencyKey: `recovery:${context.correlationId}`,
-      correlationId: context.correlationId,
-      context,
-    });
-    return { status: 'recovered', sessionId };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    // This non-simple request header is mandatory for mutations. Browser
-    // cross-origin requests cannot set it without a CORS preflight, and the
-    // gateway's allowlist rejects untrusted origins before the handler runs.
-    if (!requestCorrelationId) {
-      throw new ForbiddenException('X-Correlation-Id is required');
-    }
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-
-  private assertConfiguredAgent(agentName: string): void {
-    const configured = process.env['MOSAIC_AGENT_NAME']?.trim();
-    if (!configured || configured !== agentName) {
-      throw new ForbiddenException('Interaction agent is not configured for this request');
-    }
-  }
-
-  private assertSessionAgent(sessionAgentName: string, agentName: string): void {
-    if (sessionAgentName !== agentName)
-      throw new ForbiddenException('Interaction session identity mismatch');
-  }
-
-  private requiredProvider(providerId: string): string {
-    if (!providerId?.trim()) throw new ForbiddenException('Runtime provider is required');
-    return providerId;
-  }
-}

apps/gateway/src/agent/provider.service.ts

@@ -107,7 +107,8 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
    * Interval is configurable via PROVIDER_HEALTH_INTERVAL env (seconds, default 60).
    */
   private startHealthCheckScheduler(): void {
-    const intervalSecs = this.effectiveHealthCheckIntervalSecs();
+    const intervalSecs =
+      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS;
     const intervalMs = intervalSecs * 1000;
 
     // Run an initial check immediately (non-blocking)
@@ -175,28 +176,6 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
     });
   }
 
-  /**
-   * Returns the effective provider operational policy without credentials,
-   * endpoints, request content, or provider error details.
-   */
-  getEffectivePolicyStatus(): {
-    healthCheckIntervalSecs: number;
-    configuredProviders: string[];
-    availableModelCount: number;
-  } {
-    return {
-      healthCheckIntervalSecs: this.effectiveHealthCheckIntervalSecs(),
-      configuredProviders: this.adapters.map((adapter) => adapter.name),
-      availableModelCount: this.registry?.getAvailable().length ?? 0,
-    };
-  }
-
-  private effectiveHealthCheckIntervalSecs(): number {
-    return (
-      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS
-    );
-  }
-
   // ---------------------------------------------------------------------------
   // Adapter-pattern API
   // ---------------------------------------------------------------------------

apps/gateway/src/agent/providers.controller.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ProvidersController } from './providers.controller.js';
-
-describe('ProvidersController operational status', (): void => {
-  it('reports provider latency and effective policy without exposing provider error details', (): void => {
-    const providerService = {
-      getProvidersHealth: vi.fn(() => [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          error: 'credential-canary=secret-value',
-        },
-      ]),
-      getEffectivePolicyStatus: vi.fn(() => ({
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      })),
-    };
-    const controller = new ProvidersController(providerService as never, {} as never, {} as never);
-
-    const status = controller.status();
-
-    expect(status).toEqual({
-      providers: [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          errorCode: 'provider_unavailable',
-        },
-      ],
-      effectivePolicy: {
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      },
-    });
-    expect(JSON.stringify(status)).not.toContain('secret-value');
-  });
-});

apps/gateway/src/agent/providers.controller.ts

@@ -33,20 +33,7 @@ export class ProvidersController {
 
   @Get('health')
   health() {
-    return { providers: this.safeProviderHealth() };
+    return { providers: this.providerService.getProvidersHealth() };
-  }
-
-  /**
-   * Safe operational status for troubleshooting and readiness checks. Provider
-   * errors are reduced to a stable code so credentials and remote responses
-   * cannot leak through this endpoint.
-   */
-  @Get('status')
-  status() {
-    return {
-      providers: this.safeProviderHealth(),
-      effectivePolicy: this.providerService.getEffectivePolicyStatus(),
-    };
   }
 
   @Post('test')
@@ -64,13 +51,6 @@ export class ProvidersController {
     return this.routingService.rank(criteria);
   }
 
-  private safeProviderHealth() {
-    return this.providerService.getProvidersHealth().map(({ error, ...provider }) => ({
-      ...provider,
-      ...(error ? { errorCode: 'provider_unavailable' } : {}),
-    }));
-  }
-
   // ── Credential CRUD ──────────────────────────────────────────────────────
 
   /**

apps/gateway/src/agent/runtime-approval-denied.filter.ts

@@ -1,13 +0,0 @@
-import { Catch, type ArgumentsHost, type ExceptionFilter } from '@nestjs/common';
-import { RuntimeApprovalDeniedError } from './runtime-provider-registry.service.js';
-
-/** Maps a consumed/missing runtime approval to a stable HTTP authorization response. */
-@Catch(RuntimeApprovalDeniedError)
-export class RuntimeApprovalDeniedFilter implements ExceptionFilter {
-  catch(_exception: RuntimeApprovalDeniedError, host: ArgumentsHost): void {
-    const response = host.switchToHttp().getResponse<{
-      status(code: number): { send(body: { statusCode: number; message: string }): void };
-    }>();
-    response.status(403).send({ statusCode: 403, message: 'Runtime termination approval denied' });
-  }
-}

apps/gateway/src/agent/runtime-provider-registry.service.ts

@@ -1,500 +0,0 @@
-import { ForbiddenException, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import {
-  createRuntimeAuditLogEntry,
-  type LogService,
-  type RuntimeAuditErrorCode,
-} from '@mosaicstack/log';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-  TransitionalCapabilityInventoryEntry,
-  TransitionalCapabilityInventoryProvider,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { LOG_SERVICE } from '../log/log.tokens.js';
-
-export const AGENT_RUNTIME_PROVIDER_REGISTRY = Symbol('AGENT_RUNTIME_PROVIDER_REGISTRY');
-export const RUNTIME_PROVIDER_AUDIT_SINK = Symbol('RUNTIME_PROVIDER_AUDIT_SINK');
-export const RUNTIME_APPROVAL_VERIFIER = Symbol('RUNTIME_APPROVAL_VERIFIER');
-
-export type RuntimeProviderOperation =
-  | RuntimeCapability
-  | 'runtime.capabilities'
-  | 'runtime.health'
-  | 'runtime.transitional-capabilities';
-export type RuntimeProviderAuditOutcome = 'requested' | 'succeeded' | 'denied' | 'failed';
-
-/** Trusted server-side context only; it intentionally excludes client-provided identity fields. */
-export interface RuntimeProviderRequestContext {
-  actorScope: ActorTenantScope;
-  channelId: string;
-  correlationId: string;
-}
-
-/** Metadata-only audit record. Message bodies, idempotency keys, and approval refs are excluded. */
-export interface RuntimeAuditEvent {
-  providerId: string;
-  operation: RuntimeProviderOperation;
-  outcome: RuntimeProviderAuditOutcome;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  resourceId?: string;
-  durationMs?: number;
-  errorCode?: RuntimeAuditErrorCode;
-}
-
-export interface RuntimeAuditSink {
-  record(event: RuntimeAuditEvent): Promise<void>;
-}
-
-/** Exact action shape that a durable approval implementation must consume once. */
-export interface RuntimeTerminationAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  agentName: string;
-}
-
-export interface RuntimeApprovalVerifier {
-  consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean>;
-}
-
-function isTransitionalInventoryProvider(
-  provider: AgentRuntimeProvider,
-): provider is AgentRuntimeProvider & TransitionalCapabilityInventoryProvider {
-  return (
-    typeof (provider as Partial<TransitionalCapabilityInventoryProvider>)
-      .transitionalCapabilityMatrix === 'function'
-  );
-}
-
-function configuredAgentName(): string {
-  const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
-  if (!agentName) throw new RuntimeApprovalDeniedError();
-  return agentName;
-}
-
-export class RuntimeApprovalDeniedError extends Error {
-  constructor() {
-    super('Runtime termination approval denied');
-  }
-}
-
-/**
- * The default denies all runtime termination until a durable, exact-action
- * approval implementation is configured. This is safer than a permissive stub.
- */
-@Injectable()
-export class DenyRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(_approvalRef: string, _action: RuntimeTerminationAction): Promise<boolean> {
-    return false;
-  }
-}
-
-/**
- * Temporary metadata-only audit sink. M1 observability can replace this token
- * with a durable audit writer without changing provider call sites.
- */
-@Injectable()
-export class RuntimeProviderAuditService implements RuntimeAuditSink {
-  private readonly logger = new Logger(RuntimeProviderAuditService.name);
-
-  constructor(@Inject(LOG_SERVICE) private readonly logService: LogService) {}
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    const entry = createRuntimeAuditLogEntry(event);
-    await this.logService.logs.ingest(entry);
-    this.logger.log(JSON.stringify({ event: entry.content, metadata: entry.metadata }));
-  }
-}
-
-@Injectable()
-export class RuntimeProviderService {
-  private readonly logger = new Logger(RuntimeProviderService.name);
-
-  constructor(
-    @Inject(AGENT_RUNTIME_PROVIDER_REGISTRY)
-    private readonly registry: AgentRuntimeProviderRegistry,
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly audit: RuntimeAuditSink,
-    @Inject(RUNTIME_APPROVAL_VERIFIER)
-    private readonly approvals: RuntimeApprovalVerifier,
-  ) {}
-
-  async capabilities(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeCapabilitySet> {
-    return this.execute(
-      providerId,
-      'runtime.capabilities',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeCapabilitySet> =>
-        provider.capabilities(scope),
-    );
-  }
-
-  async health(providerId: string, context: RuntimeProviderRequestContext): Promise<RuntimeHealth> {
-    return this.execute(
-      providerId,
-      'runtime.health',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeHealth> =>
-        provider.health(scope),
-    );
-  }
-
-  async transitionalCapabilityMatrix(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<TransitionalCapabilityInventoryEntry[]> {
-    return this.execute(
-      providerId,
-      'runtime.transitional-capabilities',
-      undefined,
-      undefined,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope) => {
-        if (!isTransitionalInventoryProvider(provider)) {
-          throw new NotFoundException('Runtime provider has no transitional capability inventory');
-        }
-        return provider.transitionalCapabilityMatrix(scope);
-      },
-    );
-  }
-
-  async listSessions(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSession[]> {
-    return this.execute(
-      providerId,
-      'session.list',
-      'session.list',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSession[]> =>
-        provider.listSessions(scope),
-    );
-  }
-
-  async getSessionTree(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSessionTree[]> {
-    return this.execute(
-      providerId,
-      'session.tree',
-      'session.tree',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSessionTree[]> =>
-        provider.getSessionTree(scope),
-    );
-  }
-
-  streamSession(
-    providerId: string,
-    sessionId: string,
-    cursor: string | undefined,
-    context: RuntimeProviderRequestContext,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    return this.stream(
-      providerId,
-      'session.stream',
-      'session.stream',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): AsyncIterable<RuntimeStreamEvent> =>
-        provider.streamSession(sessionId, cursor, scope),
-    );
-  }
-
-  async sendMessage(
-    providerId: string,
-    sessionId: string,
-    message: RuntimeMessage,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.send',
-      'session.send',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.sendMessage(sessionId, message, scope),
-    );
-  }
-
-  async attach(
-    providerId: string,
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeAttachHandle> {
-    return this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeAttachHandle> =>
-        provider.attach(sessionId, mode, scope),
-    );
-  }
-
-  async detach(
-    providerId: string,
-    attachmentId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      attachmentId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.detach(attachmentId, scope),
-    );
-  }
-
-  async terminate(
-    providerId: string,
-    sessionId: string,
-    approvalRef: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.terminate',
-      'session.terminate',
-      sessionId,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> => {
-        const approved = await this.approvals.consume(approvalRef, {
-          providerId,
-          sessionId,
-          actorId: scope.actorId,
-          tenantId: scope.tenantId,
-          channelId: scope.channelId,
-          correlationId: scope.correlationId,
-          agentName: configuredAgentName(),
-        });
-        if (!approved) {
-          throw new RuntimeApprovalDeniedError();
-        }
-        await provider.terminate(sessionId, approvalRef, scope);
-      },
-    );
-  }
-
-  private async execute<T>(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability | undefined,
-    resourceId: string | undefined,
-    context: RuntimeProviderRequestContext,
-    invoke: (provider: AgentRuntimeProvider, scope: RuntimeScope) => Promise<T>,
-  ): Promise<T> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      if (requiredCapability) {
-        await this.assertCapability(provider, requiredCapability, scope);
-      }
-      invocationStarted = true;
-      const result = await invoke(provider, scope);
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-      return result;
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted && !this.isAuthorizationDenied(error)) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private async *stream(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability,
-    resourceId: string,
-    context: RuntimeProviderRequestContext,
-    invoke: (
-      provider: AgentRuntimeProvider,
-      scope: RuntimeScope,
-    ) => AsyncIterable<RuntimeStreamEvent>,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      await this.assertCapability(provider, requiredCapability, scope);
-      invocationStarted = true;
-      for await (const event of invoke(provider, scope)) {
-        yield event;
-      }
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private isAuthorizationDenied(error: unknown): boolean {
-    return (
-      error instanceof RuntimeApprovalDeniedError ||
-      error instanceof ForbiddenException ||
-      (typeof error === 'object' &&
-        error !== null &&
-        'code' in error &&
-        (error as { code?: unknown }).code === 'forbidden')
-    );
-  }
-
-  private provider(providerId: string): AgentRuntimeProvider {
-    try {
-      return this.registry.require(providerId);
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : 'Runtime provider is not registered';
-      throw new NotFoundException(message);
-    }
-  }
-
-  private async assertCapability(
-    provider: AgentRuntimeProvider,
-    requiredCapability: RuntimeCapability,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    const capabilities = await provider.capabilities(scope);
-    if (!capabilities.supported.includes(requiredCapability)) {
-      throw new ForbiddenException(`Runtime provider capability denied: ${requiredCapability}`);
-    }
-  }
-
-  private deriveScope(context: RuntimeProviderRequestContext): RuntimeScope {
-    const actorId = context.actorScope.userId.trim();
-    const tenantId = context.actorScope.tenantId.trim();
-    const channelId = context.channelId.trim();
-    const correlationId = context.correlationId.trim();
-    if (!actorId || !tenantId || !channelId || !correlationId) {
-      throw new ForbiddenException(
-        'Authenticated runtime actor scope and correlation are required',
-      );
-    }
-    return Object.freeze({ actorId, tenantId, channelId, correlationId });
-  }
-
-  private async recordFailure(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(
-        providerId,
-        operation,
-        'failed',
-        scope,
-        resourceId,
-        durationMs,
-        'provider_error',
-      );
-    } catch {
-      this.logger.error(
-        `Runtime provider failure audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async recordCompletion(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(providerId, operation, 'succeeded', scope, resourceId, durationMs);
-    } catch {
-      this.logger.error(
-        `Runtime provider completion audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async record(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    outcome: RuntimeProviderAuditOutcome,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs?: number,
-    errorCode?: RuntimeAuditErrorCode,
-  ): Promise<void> {
-    await this.audit.record({
-      providerId,
-      operation,
-      outcome,
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      channelId: scope.channelId,
-      correlationId: scope.correlationId,
-      ...(resourceId ? { resourceId } : {}),
-      ...(durationMs !== undefined ? { durationMs } : {}),
-      ...(errorCode ? { errorCode } : {}),
-    });
-  }
-}

apps/gateway/src/agent/tools/memory-tools.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { createMemoryTools } from './memory-tools.js';
-
-describe('createMemoryTools operator retrieval binding', () => {
-  const memory = {
-    insights: { searchByEmbedding: vi.fn(), create: vi.fn() },
-    preferences: { findByUserAndCategory: vi.fn(), findByUser: vi.fn(), upsert: vi.fn() },
-  };
-  const scope = { tenantId: 'tenant-a', ownerId: 'owner-a', sessionId: 'session-a' };
-
-  it('uses the configured plugin with the server-derived scope for retrieval and capture', async () => {
-    const plugin = {
-      search: vi.fn(async () => []),
-      capture: vi.fn(async () => ({ id: 'insight-1' })),
-    };
-    const tools = createMemoryTools(memory as never, null, 'owner-a', {
-      plugin: plugin as never,
-      scope,
-    });
-
-    await tools
-      .find((tool) => tool.name === 'memory_search')!
-      .execute('call-1', { query: 'plans' }, undefined, undefined, {} as never);
-    await tools
-      .find((tool) => tool.name === 'memory_save_insight')!
-      .execute(
-        'call-2',
-        { content: 'secret', category: 'decision' },
-        undefined,
-        undefined,
-        {} as never,
-      );
-
-    expect(plugin.search).toHaveBeenCalledWith(scope, 'plans', 5);
-    expect(plugin.capture).toHaveBeenCalledWith(scope, {
-      content: 'secret',
-      source: 'agent',
-      category: 'decision',
-    });
-  });
-});

apps/gateway/src/agent/tools/memory-tools.ts

@@ -1,11 +1,7 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import type {
+import type { Memory } from '@mosaicstack/memory';
-  EmbeddingProvider,
+import type { EmbeddingProvider } from '@mosaicstack/memory';
-  Memory,
-  OperatorMemoryPlugin,
-  OperatorMemoryScope,
-} from '@mosaicstack/memory';
 
 /**
  * Create memory tools bound to the session's authenticated userId.
@@ -17,10 +13,8 @@ import type {
 export function createMemoryTools(
   memory: Memory,
   embeddingProvider: EmbeddingProvider | null,
-  /** Authenticated user ID from the session. All preference operations are scoped to this user. */
+  /** Authenticated user ID from the session. All memory operations are scoped to this user. */
   sessionUserId: string | undefined,
-  /** Optional configured retrieval plugin, bound to a server-derived session scope. */
-  operatorMemory?: { plugin: OperatorMemoryPlugin; scope: OperatorMemoryScope },
 ): ToolDefinition[] {
   /** Return an error result when no session user is bound. */
   function noUserError() {
@@ -52,14 +46,6 @@ export function createMemoryTools(
         limit?: number;
       };
 
-      if (operatorMemory) {
-        const results = await operatorMemory.plugin.search(operatorMemory.scope, query, limit ?? 5);
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(results, null, 2) }],
-          details: undefined,
-        };
-      }
-
       if (!embeddingProvider) {
         return {
           content: [
@@ -172,18 +158,6 @@ export function createMemoryTools(
       };
       type Cat = 'decision' | 'learning' | 'preference' | 'fact' | 'pattern' | 'general';
 
-      if (operatorMemory) {
-        const insight = await operatorMemory.plugin.capture(operatorMemory.scope, {
-          content,
-          source: 'agent',
-          category: category ?? 'learning',
-        });
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(insight, null, 2) }],
-          details: undefined,
-        };
-      }
-
       let embedding: number[] | null = null;
       if (embeddingProvider) {
         embedding = await embeddingProvider.embed(content);

apps/gateway/src/chat/chat.dto.ts

@@ -1,4 +1,3 @@
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
 import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
 
 export class ChatRequestDto {
@@ -33,7 +32,4 @@ export class ChatSocketMessageDto {
   @IsOptional()
   @IsUUID()
   agentId?: string;
-
-  /** Validated channel attachment references; binary content is not embedded. */
-  attachments?: readonly ChannelAttachmentDto[];
 }

apps/gateway/src/chat/chat.gateway-command-approval.spec.ts

@@ -1,74 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { ChatGateway } from './chat.gateway.js';
-
-const payload: SlashCommandPayload = {
-  command: 'gc',
-  conversationId: 'conversation-1',
-  approvalId: 'approval-1',
-};
-
-function buildGateway(commandExecutor: {
-  execute: ReturnType<typeof vi.fn>;
-  createApproval: ReturnType<typeof vi.fn>;
-}): ChatGateway {
-  return new ChatGateway(
-    {} as never,
-    {} as never,
-    {} as never,
-    {} as never,
-    commandExecutor as never,
-    {} as never,
-  );
-}
-
-describe('ChatGateway command approval ingress', () => {
-  it('passes the client approval ID through to command execution while deriving the actor server-side', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn().mockResolvedValue({ ...payload, success: true }),
-      createApproval: vi.fn(),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandExecute(client as never, payload);
-
-    expect(commandExecutor.execute).toHaveBeenCalledWith(payload, {
-      userId: 'admin-1',
-      tenantId: 'admin-1',
-    });
-    expect(client.emit).toHaveBeenCalledWith(
-      'command:result',
-      expect.objectContaining({ success: true }),
-    );
-  });
-
-  it('issues a durable approval only for the authenticated actor', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn(),
-      createApproval: vi.fn().mockResolvedValue({
-        approvalId: 'approval-1',
-        expiresAt: '2026-07-12T00:05:00.000Z',
-      }),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandApproval(client as never, {
-      command: 'gc',
-      conversationId: 'conversation-1',
-    });
-
-    expect(commandExecutor.createApproval).toHaveBeenCalledWith(
-      { command: 'gc', conversationId: 'conversation-1' },
-      { userId: 'admin-1', tenantId: 'admin-1' },
-    );
-    expect(client.emit).toHaveBeenCalledWith('command:approval', {
-      command: 'gc',
-      conversationId: 'conversation-1',
-      success: true,
-      approvalId: 'approval-1',
-      expiresAt: '2026-07-12T00:05:00.000Z',
-    });
-  });
-});

apps/gateway/src/chat/chat.gateway-redaction.spec.ts

@@ -1,221 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ChatGateway } from './chat.gateway.js';
-
-const CONVERSATION_ID = 'conversation-1';
-const CANARY = 'sk_canary12345678';
-
-function clientConversationKey(clientId: string, conversationId: string): string {
-  return `${clientId}\u0000${conversationId}`;
-}
-
-type GatewayInternals = {
-  clientSessions: Map<string, unknown>;
-  relayEvent(client: unknown, conversationId: string, event: unknown): void;
-};
-
-function buildGateway() {
-  const brain = {
-    conversations: {
-      addMessage: vi.fn().mockResolvedValue(undefined),
-    },
-  };
-  const agentService = {
-    getSession: vi.fn().mockReturnValue(undefined),
-  };
-  const gateway = new ChatGateway(
-    agentService as never,
-    {} as never,
-    brain as never,
-    {} as never,
-    {} as never,
-    {} as never,
-  );
-
-  return { gateway: gateway as unknown as GatewayInternals, brain };
-}
-
-describe('ChatGateway redaction boundary', (): void => {
-  it('redacts a secret split across assistant deltas before egress and persistence', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const session = {
-      clientId: client.id,
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), session);
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'sk_canary' },
-    });
-
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('sk_canary');
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '12345678 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(session.assistantText).toBe(`${CANARY} `);
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain(CANARY);
-  });
-
-  it('retains a split secret label until its value can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'token ' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '=canaryvalue123 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canaryvalue123');
-  });
-
-  it('holds a streamed private key until it can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '-----BEGIN PRIVATE KEY-----\ncanary' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '\n-----END PRIVATE KEY-----' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET]',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canary');
-  });
-
-  it('drops an oversized unterminated stream fragment rather than retaining it', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'x'.repeat(8_193) },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_STREAM_OVERFLOW]',
-    });
-  });
-
-  it('isolates concurrent conversation streams sharing one Discord socket', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'discord-client',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const firstConversation = 'Nova:discord:thread-1';
-    const secondConversation = 'Nova:discord:thread-2';
-    const createSession = (conversationId: string) => ({
-      clientId: client.id,
-      conversationId,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-    const firstSession = createSession(firstConversation);
-    const secondSession = createSession(secondConversation);
-    gateway.clientSessions.set(clientConversationKey(client.id, firstConversation), firstSession);
-    gateway.clientSessions.set(clientConversationKey(client.id, secondConversation), secondSession);
-
-    gateway.relayEvent(client, firstConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'first response ' },
-    });
-    gateway.relayEvent(client, secondConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'second response ' },
-    });
-
-    expect(firstSession.assistantText).toBe('first response ');
-    expect(secondSession.assistantText).toBe('second response ');
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: firstConversation,
-      text: 'first response ',
-    });
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: secondConversation,
-      text: 'second response ',
-    });
-  });
-
-  it('persists only redacted assistant content with classifications', (): void => {
-    const { gateway, brain } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), {
-      clientId: client.id,
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: CANARY,
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-
-    gateway.relayEvent(client, CONVERSATION_ID, { type: 'agent_end' });
-
-    expect(brain.conversations.addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        content: '[REDACTED_SECRET]',
-        metadata: expect.objectContaining({ classifications: ['secret'] }),
-      }),
-      'user-1',
-    );
-    expect(JSON.stringify(brain.conversations.addMessage.mock.calls)).not.toContain(CANARY);
-  });
-});

apps/gateway/src/chat/chat.gateway.ts

@@ -1,5 +1,4 @@
-import { createHash } from 'node:crypto';
+import { Inject, Logger } from '@nestjs/common';
-import { Inject, Logger, Optional } from '@nestjs/common';
 import {
   WebSocketGateway,
   WebSocketServer,
@@ -14,32 +13,19 @@ import { Server, Socket } from 'socket.io';
 import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
 import {
   verifyDiscordIngressEnvelope,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
-  type DiscordAttachment,
   type DiscordIngressEnvelope,
   type DiscordIngressPayload,
 } from '@mosaicstack/discord-plugin';
 import type { Auth } from '@mosaicstack/auth';
 import type { Brain } from '@mosaicstack/brain';
-import { redactSensitiveContent } from '@mosaicstack/log';
 import type {
   SetThinkingPayload,
-  SlashCommandApprovalResultPayload,
   SlashCommandPayload,
   SystemReloadPayload,
   RoutingDecisionInfo,
   AbortPayload,
-  ChannelAttachmentDto,
 } from '@mosaicstack/types';
 import { AgentService, type ConversationHistoryMessage } from '../agent/agent.service.js';
-import {
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderService,
-  type RuntimeAuditSink,
-} from '../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../agent/durable-session.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
 import {
   scopeFromUser,
@@ -49,7 +35,6 @@ import {
 import { BRAIN } from '../brain/brain.tokens.js';
 import { CommandRegistryService } from '../commands/command-registry.service.js';
 import { CommandExecutorService } from '../commands/command-executor.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { RoutingEngineService } from '../agent/routing/routing-engine.service.js';
 import { v4 as uuid } from 'uuid';
 import { ChatSocketMessageDto } from './chat.dto.js';
@@ -58,7 +43,6 @@ import { DiscordReplayProtector } from '../plugin/discord-replay-protector.js';
 
 /** Per-client state tracking streaming accumulation for persistence. */
 interface ClientSession {
-  clientId: string;
   conversationId: string;
   cleanup: () => void;
   /** Accumulated assistant response text for the current turn. */
@@ -78,69 +62,6 @@ interface ClientSession {
  * Keyed by conversationId, value is the model name to use.
  */
 const modelOverrides = new Map<string, string>();
-const MAX_REDACTION_BUFFER_LENGTH = 8_192;
-const MAX_CHANNEL_ATTACHMENTS = 10;
-const MAX_ATTACHMENT_METADATA_BYTES = 16_384;
-const MAX_ATTACHMENT_ID_LENGTH = 128;
-const MAX_ATTACHMENT_NAME_LENGTH = 255;
-const MAX_ATTACHMENT_URL_LENGTH = 2_048;
-const MAX_ATTACHMENT_MIME_LENGTH = 255;
-
-function isSafeAttachmentUrl(value: string): boolean {
-  if (value.length === 0 || value.length > MAX_ATTACHMENT_URL_LENGTH) return false;
-  try {
-    const url = new URL(value);
-    return (
-      url.protocol === 'https:' &&
-      !url.username &&
-      !url.password &&
-      !url.hash &&
-      url.search.length === 0
-    );
-  } catch {
-    return false;
-  }
-}
-
-function hasValidAttachmentBounds(value: {
-  id: string;
-  name: string;
-  url: string;
-  sizeBytes?: number;
-}): boolean {
-  return (
-    value.id.length > 0 &&
-    value.id.length <= MAX_ATTACHMENT_ID_LENGTH &&
-    value.name.length > 0 &&
-    value.name.length <= MAX_ATTACHMENT_NAME_LENGTH &&
-    isSafeAttachmentUrl(value.url) &&
-    (value.sizeBytes === undefined || (Number.isFinite(value.sizeBytes) && value.sizeBytes >= 0))
-  );
-}
-
-function isDiscordAttachment(value: unknown): value is DiscordAttachment {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<DiscordAttachment>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.contentType === null ||
-      (typeof attachment.contentType === 'string' &&
-        attachment.contentType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as DiscordAttachment)
-  );
-}
-
-function hasValidAttachmentArray(value: unknown, guard: (attachment: unknown) => boolean): boolean {
-  return (
-    Array.isArray(value) &&
-    value.length <= MAX_CHANNEL_ATTACHMENTS &&
-    JSON.stringify(value).length <= MAX_ATTACHMENT_METADATA_BYTES &&
-    value.every(guard)
-  );
-}
 
 function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelope {
   if (typeof value !== 'object' || value === null) return false;
@@ -153,49 +74,23 @@ function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelo
     return false;
   }
   const payload = envelope.payload as Record<string, unknown>;
-  return (
+  return [
-    [
+    payload['correlationId'],
-      payload['correlationId'],
+    payload['messageId'],
-      payload['messageId'],
+    payload['guildId'],
-      payload['guildId'],
+    payload['channelId'],
-      payload['channelId'],
+    payload['userId'],
-      payload['userId'],
+    payload['conversationId'],
-      payload['conversationId'],
+    payload['content'],
-      payload['content'],
+  ].every((field: unknown): boolean => typeof field === 'string');
-    ].every((field: unknown): boolean => typeof field === 'string') &&
-    (payload['threadId'] === undefined || typeof payload['threadId'] === 'string') &&
-    (payload['attachments'] === undefined ||
-      hasValidAttachmentArray(payload['attachments'], isDiscordAttachment))
-  );
-}
-
-function isChannelAttachment(value: unknown): value is ChannelAttachmentDto {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<ChannelAttachmentDto>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.mimeType === null ||
-      (typeof attachment.mimeType === 'string' &&
-        attachment.mimeType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as ChannelAttachmentDto)
-  );
 }
 
 function isChatSocketMessage(value: unknown): value is ChatSocketMessageDto {
   if (typeof value !== 'object' || value === null) return false;
-  const payload = value as {
+  const payload = value as { content?: unknown; conversationId?: unknown };
-    content?: unknown;
-    conversationId?: unknown;
-    attachments?: unknown;
-  };
   return (
     typeof payload.content === 'string' &&
-    (payload.conversationId === undefined || typeof payload.conversationId === 'string') &&
+    (payload.conversationId === undefined || typeof payload.conversationId === 'string')
-    (payload.attachments === undefined ||
-      hasValidAttachmentArray(payload.attachments, isChannelAttachment))
   );
 }
 
@@ -211,10 +106,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   private readonly logger = new Logger(ChatGateway.name);
   private readonly clientSessions = new Map<string, ClientSession>();
-  /** Raw stream fragments are kept in memory only until they are safe to redact and emit. */
-  private readonly textEgressBuffers = new Map<string, string>();
-  private readonly thinkingEgressBuffers = new Map<string, string>();
-  private readonly overflowedEgress = new Set<string>();
   private readonly discordReplayProtector = new DiscordReplayProtector();
 
   constructor(
@@ -224,18 +115,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @Inject(CommandRegistryService) private readonly commandRegistry: CommandRegistryService,
     @Inject(CommandExecutorService) private readonly commandExecutor: CommandExecutorService,
     @Inject(RoutingEngineService) private readonly routingEngine: RoutingEngineService,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly commandAuthorization: CommandAuthorizationService | null = null,
-    @Optional()
-    @Inject(RuntimeProviderService)
-    private readonly runtimeRegistry: RuntimeProviderService | null = null,
-    @Optional()
-    @Inject(DurableSessionService)
-    private readonly durableSessions: DurableSessionService | null = null,
-    @Optional()
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly runtimeAudit: RuntimeAuditSink | null = null,
   ) {}
 
   afterInit(): void {
@@ -265,26 +144,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   handleDisconnect(client: Socket): void {
     this.logger.log(`Client disconnected: ${client.id}`);
-    for (const [key, session] of this.clientSessions) {
+    const session = this.clientSessions.get(client.id);
-      if (session.clientId !== client.id) continue;
+    if (session) {
       session.cleanup();
       this.agentService.removeChannel(
         session.conversationId,
         `websocket:${client.id}`,
         session.scope,
       );
-      this.clientSessions.delete(key);
+      this.clientSessions.delete(client.id);
-      this.textEgressBuffers.delete(key);
-      this.thinkingEgressBuffers.delete(key);
-      this.overflowedEgress.delete(`${key}:agent:text`);
-      this.overflowedEgress.delete(`${key}:agent:thinking`);
     }
   }
 
-  private clientConversationKey(client: Pick<Socket, 'id'>, conversationId: string): string {
-    return `${client.id}\u0000${conversationId}`;
-  }
-
   private getClientScope(client: Socket): ActorTenantScope | null {
     const user = client.data.user as AuthenticatedUserLike | undefined;
     if (!user?.id) return null;
@@ -313,25 +184,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       }
       discordIngress = this.resolveDiscordIngress(client, rawData);
       if (!discordIngress) return;
-      data = {
+      data = { conversationId: discordIngress.conversationId, content: discordIngress.content };
-        conversationId: discordIngress.conversationId,
-        content: discordIngress.content,
-        ...(discordIngress.attachments
-          ? {
-              attachments: discordIngress.attachments.map(
-                (attachment): ChannelAttachmentDto => ({
-                  id: attachment.id,
-                  name: attachment.name,
-                  url: attachment.url,
-                  mimeType: attachment.contentType,
-                  ...(attachment.sizeBytes !== undefined
-                    ? { sizeBytes: attachment.sizeBytes }
-                    : {}),
-                }),
-              ),
-            }
-          : {}),
-      };
     } else {
       if (!isChatSocketMessage(rawData)) {
         this.logger.warn(`Rejected malformed chat message from ${client.id}`);
@@ -340,7 +193,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       data = rawData;
     }
     const conversationId = data.conversationId ?? uuid();
-    const clientConversationKey = this.clientConversationKey(client, conversationId);
     const discordServiceUserId = process.env['DISCORD_SERVICE_USER_ID'];
     if (discordIngress && !discordServiceUserId) {
       this.logger.warn(
@@ -395,7 +247,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           this.logger.log(
             `Using /model override "${modelOverride}" for conversation=${conversationId}`,
           );
-        } else if (!resolvedProvider && !resolvedModelId && !discordIngress) {
+        } else if (!resolvedProvider && !resolvedModelId) {
           // No explicit provider/model from client — use routing engine (M4-012)
           try {
             const routingDecision = await this.routingEngine.resolve(data.content, userId);
@@ -418,24 +270,12 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           }
         }
 
-        let resolvedAgentConfigId = data.agentId;
-        if (discordIngress) {
-          const binding = this.discordBindingFor(discordIngress, 'send');
-          const agentConfig = binding
-            ? await this.brain.agents.findById(binding.agentConfigId)
-            : undefined;
-          if (!binding || !agentConfig || agentConfig.name !== binding.instanceId) {
-            throw new Error('Configured Discord logical agent is not provisioned');
-          }
-          resolvedAgentConfigId = agentConfig.id;
-        }
-
         // M5-004: Use existingSessionId as sessionId when available (session reuse)
         const sessionIdToCreate = existingSessionId ?? conversationId;
         agentSession = await this.agentService.createSession(sessionIdToCreate, {
           provider: resolvedProvider,
           modelId: resolvedModelId,
-          agentConfigId: resolvedAgentConfigId,
+          agentConfigId: data.agentId,
           userId,
           tenantId: scope.tenantId,
           conversationHistory: conversationHistory.length > 0 ? conversationHistory : undefined,
@@ -476,7 +316,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           {
             conversationId,
             role: 'user',
-            content: redactSensitiveContent(data.content).content,
+            content: data.content,
             metadata: {
               timestamp: new Date().toISOString(),
               ...(correlationId
@@ -486,18 +326,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
                     discordUserId: discordIngress?.userId,
                   }
                 : {}),
-              ...(data.attachments && data.attachments.length > 0
-                ? {
-                    channelAttachments: data.attachments.map(
-                      (attachment): ChannelAttachmentDto => ({
-                        ...attachment,
-                        name: redactSensitiveContent(attachment.name).content,
-                        url: redactSensitiveContent(attachment.url).content,
-                      }),
-                    ),
-                  }
-                : {}),
-              classifications: redactSensitiveContent(data.content).classifications,
             },
           },
           userId,
@@ -511,7 +339,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
 
     // Always clean up previous listener to prevent leak
-    const existing = this.clientSessions.get(clientConversationKey);
+    const existing = this.clientSessions.get(client.id);
     if (existing) {
       existing.cleanup();
     }
@@ -526,11 +354,10 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     );
 
     // Preserve routing decision from the existing client session if we didn't get a new one
-    const prevClientSession = this.clientSessions.get(clientConversationKey);
+    const prevClientSession = this.clientSessions.get(client.id);
     const routingDecisionToStore = sessionRoutingDecision ?? prevClientSession?.lastRoutingDecision;
 
-    this.clientSessions.set(clientConversationKey, {
+    this.clientSessions.set(client.id, {
-      clientId: client.id,
       conversationId,
       cleanup,
       assistantText: '',
@@ -576,7 +403,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
     // Dispatch to agent
     try {
-      await this.agentService.prompt(conversationId, data.content, scope, data.attachments);
+      await this.agentService.prompt(conversationId, data.content, scope);
     } catch (err) {
       this.logger.error(
         `Agent prompt failed for client=${client.id}, conversation=${conversationId}`,
@@ -694,30 +521,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     client.emit('command:result', result);
   }
 
-  @SubscribeMessage('command:approve')
-  async handleCommandApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() payload: SlashCommandPayload,
-  ): Promise<void> {
-    const scope = this.getClientScope(client);
-    const approval = scope ? await this.commandExecutor.createApproval(payload, scope) : null;
-    const result: SlashCommandApprovalResultPayload = approval
-      ? {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: true,
-          approvalId: approval.approvalId,
-          expiresAt: approval.expiresAt,
-        }
-      : {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: false,
-          message: 'Not authorized to approve this command.',
-        };
-    client.emit('command:approval', result);
-  }
-
   broadcastReload(payload: SystemReloadPayload): void {
     this.server.emit('system:reload', payload);
     this.logger.log('Broadcasted system:reload to all connected clients');
@@ -783,9 +586,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     };
 
     // Emit to all clients currently subscribed to this conversation
-    for (const session of this.clientSessions.values()) {
+    for (const [clientId, session] of this.clientSessions) {
       if (session.conversationId === conversationId && this.scopesEqual(session.scope, scope)) {
-        const socket = this.server.sockets.sockets.get(session.clientId);
+        const socket = this.server.sockets.sockets.get(clientId);
         if (socket?.connected) {
           socket.emit('session:info', payload);
         }
@@ -798,173 +601,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
    * Creates it if absent — safe to call concurrently since a duplicate insert
    * would fail on the PK constraint and be caught here.
    */
-  @SubscribeMessage('discord:approve')
-  async handleDiscordApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'approve');
-    const isApprovalCommand = /^\/approve\s*$/i.test(ingress?.content ?? '');
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (
-      !ingress ||
-      !isApprovalCommand ||
-      !tenantId ||
-      !this.commandAuthorization ||
-      !this.durableSessions
-    )
-      return;
-    const binding = this.discordBindingFor(ingress, 'approve');
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    const agentName = binding?.instanceId;
-    if (!actorId || !agentName) {
-      this.logger.warn(
-        `Rejected Discord approval without a matching runtime agent from ${client.id}`,
-      );
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    let snapshot;
-    try {
-      snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      });
-    } catch {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    if (snapshot.identity.agentName !== agentName) {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    const approval = await this.commandAuthorization.createRuntimeTerminationApproval({
-      providerId: snapshot.identity.providerId,
-      sessionId: snapshot.identity.runtimeSessionId,
-      actorId,
-      tenantId,
-      channelId: ingress.channelId,
-      correlationId: this.discordRuntimeActionCorrelation(
-        binding.instanceId,
-        ingress,
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-      ),
-      agentName,
-    });
-    if (!approval) {
-      await this.runtimeAudit?.record({
-        providerId: snapshot.identity.providerId,
-        operation: 'session.terminate',
-        outcome: 'denied',
-        actorId,
-        tenantId,
-        channelId: ingress.channelId,
-        correlationId: this.discordRuntimeActionCorrelation(
-          binding.instanceId,
-          ingress,
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-        ),
-        resourceId: snapshot.identity.runtimeSessionId,
-        errorCode: 'policy_denied',
-      });
-    }
-    client.emit('discord:approval', {
-      correlationId: ingress.correlationId,
-      success: approval !== null,
-      approvalId: approval?.approvalId,
-      expiresAt: approval?.expiresAt,
-    });
-  }
-
-  @SubscribeMessage('discord:stop')
-  async handleDiscordStop(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'stop');
-    const approvalRef = /^\/stop\s+([^\s]+)$/i.exec(ingress?.content ?? '')?.[1];
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (!ingress || !approvalRef || !tenantId || !this.runtimeRegistry || !this.durableSessions)
-      return;
-    const binding = this.discordBindingFor(ingress, 'stop');
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    if (!actorId) return;
-
-    try {
-      const context = {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      };
-      const snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, context);
-      if (snapshot.identity.agentName !== binding.instanceId) throw new Error('agent mismatch');
-      // RuntimeProviderService consumes the durable approval exactly once using the
-      // provisioned approving-admin identity, never the Discord service account.
-      await this.runtimeRegistry.terminate(
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-        approvalRef,
-        {
-          ...context,
-          correlationId: this.discordRuntimeActionCorrelation(
-            binding.instanceId,
-            ingress,
-            snapshot.identity.providerId,
-            snapshot.identity.runtimeSessionId,
-          ),
-        },
-      );
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: true });
-    } catch {
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: false });
-    }
-  }
-
-  /**
-   * Correlates the immutable termination target rather than either Discord message.
-   * Approval and stop are distinct ingress events, but must consume the same seven-field action.
-   */
-  private discordRuntimeActionCorrelation(
-    instanceId: string,
-    ingress: DiscordIngressPayload,
-    providerId: string,
-    sessionId: string,
-  ): string {
-    const target = [
-      instanceId,
-      ingress.guildId,
-      ingress.channelId,
-      ingress.conversationId,
-      providerId,
-      sessionId,
-    ];
-    return `discord-action:v1:${createHash('sha256').update(JSON.stringify(target)).digest('hex')}`;
-  }
-
   private resolveDiscordIngress(
     client: Socket,
     envelope: DiscordIngressEnvelope,
-    operation: 'send' | 'approve' | 'stop' = 'send',
   ): DiscordIngressPayload | null {
     const payload = verifyDiscordIngressEnvelope(
       envelope,
@@ -979,25 +618,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       this.logger.warn(`Rejected invalid Discord ingress envelope from ${client.id}`);
       return null;
     }
-    try {
-      const binding = this.discordBindingFor(payload, operation);
-      if (!binding) {
-        this.logger.warn(`Rejected unpaired Discord ingress from ${client.id}`);
-        return null;
-      }
-      const expectedConversationId = `${binding.instanceId}:discord:${payload.threadId ?? payload.channelId}`;
-      if (payload.conversationId !== expectedConversationId) {
-        this.logger.warn(
-          `Rejected Discord ingress for a different logical agent from ${client.id}`,
-        );
-        return null;
-      }
-    } catch {
-      this.logger.warn(
-        `Rejected Discord ingress without valid binding configuration from ${client.id}`,
-      );
-      return null;
-    }
     if (!this.discordReplayProtector.claim(payload.messageId)) {
       this.logger.warn(
         `Rejected replayed Discord message=${payload.messageId} correlation=${payload.correlationId}`,
@@ -1007,19 +627,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     return payload;
   }
 
-  private discordBindingFor(
-    payload: DiscordIngressPayload,
-    operation: 'send' | 'approve' | 'stop',
-  ) {
-    return resolveDiscordInteractionBinding(
-      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-      payload.guildId,
-      payload.channelId,
-      payload.userId,
-      operation,
-    );
-  }
-
   private readDiscordAllowlist(name: string): string[] {
     return (process.env[name] ?? '')
       .split(',')
@@ -1098,15 +705,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       const messages = await this.brain.conversations.findMessages(conversationId, userId);
       if (messages.length === 0) return [];
 
-      return messages.map((msg) => {
+      return messages.map((msg) => ({
-        const attachments = this.persistedChannelAttachments(msg.metadata);
+        role: msg.role as 'user' | 'assistant' | 'system',
-        return {
+        content: msg.content,
-          role: msg.role as 'user' | 'assistant' | 'system',
+        createdAt: msg.createdAt,
-          content: msg.content,
+      }));
-          createdAt: msg.createdAt,
-          ...(attachments ? { attachments } : {}),
-        };
-      });
     } catch (err) {
       this.logger.error(
         `Failed to load conversation history for conversation=${conversationId}`,
@@ -1116,141 +719,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
   }
 
-  private persistedChannelAttachments(metadata: unknown): readonly ChannelAttachmentDto[] | null {
-    if (typeof metadata !== 'object' || metadata === null) return null;
-    const attachments = (metadata as { channelAttachments?: unknown }).channelAttachments;
-    return hasValidAttachmentArray(attachments, isChannelAttachment)
-      ? (attachments as readonly ChannelAttachmentDto[])
-      : null;
-  }
-
-  private appendAndFlushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    delta: string,
-  ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
-    const key = this.egressKey(client, conversationId, eventName);
-    if (this.overflowedEgress.has(key)) return;
-
-    const buffered = `${buffers.get(sessionKey) ?? ''}${delta}`;
-    if (buffered.length > MAX_REDACTION_BUFFER_LENGTH) {
-      buffers.delete(sessionKey);
-      this.overflowedEgress.add(key);
-      client.emit(eventName, { conversationId, text: '[REDACTED_STREAM_OVERFLOW]' });
-      return;
-    }
-
-    buffers.set(sessionKey, buffered);
-    this.flushRedactedEgress(client, conversationId, eventName, buffers, false);
-  }
-
-  /**
-   * Holds any suffix that could become a secret, email, or phone number after a
-   * later stream chunk. This avoids relying on downstream redaction after data
-   * has already reached the socket.
-   */
-  private flushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    final: boolean,
-  ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
-    const key = this.egressKey(client, conversationId, eventName);
-    if (this.overflowedEgress.has(key)) {
-      if (final) this.overflowedEgress.delete(key);
-      return;
-    }
-
-    const buffered = buffers.get(sessionKey) ?? '';
-    const releaseLength = final ? buffered.length : this.safeRedactionPrefixLength(buffered);
-    const released = buffered.slice(0, releaseLength);
-    const pending = buffered.slice(releaseLength);
-
-    if (pending) {
-      buffers.set(sessionKey, pending);
-    } else {
-      buffers.delete(sessionKey);
-    }
-
-    if (released) {
-      client.emit(eventName, {
-        conversationId,
-        text: redactSensitiveContent(released).content,
-      });
-    }
-  }
-
-  private safeRedactionPrefixLength(content: string): number {
-    let retainedFrom = content.length;
-
-    // Retain the current token because it may become a split secret or email.
-    const token = /(?:^|\s)(\S*)$/.exec(content);
-    if (token) {
-      const matched = token[0] ?? '';
-      const trailingToken = token[1] ?? '';
-      retainedFrom = token.index + matched.length - trailingToken.length;
-    }
-
-    // The secret classifier accepts whitespace around ':' and '=', so preserve
-    // a pending label until its value and delimiter are both complete.
-    const pendingSecretLabel =
-      /(?:^|[^A-Za-z0-9_])((?:api[_-]?key|token|password|secret|bearer|authorization)\s*)$/i.exec(
-        content,
-      );
-    if (pendingSecretLabel) {
-      const label = pendingSecretLabel[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        pendingSecretLabel.index + pendingSecretLabel[0].length - label.length,
-      );
-    }
-
-    const secretLabel = /(?:api[_-]?key|token|password|secret|authorization)\s*[:=]\s*$/i.exec(
-      content,
-    );
-    if (secretLabel) {
-      retainedFrom = Math.min(retainedFrom, secretLabel.index);
-    }
-
-    // Phone numbers can contain whitespace and punctuation; preserve the full
-    // trailing numeric candidate until a non-phone character establishes a boundary.
-    const phone = /(?:^|[^A-Za-z0-9_])(\+?\d[\d(). -]*)$/.exec(content);
-    if (phone) {
-      const matched = phone[0] ?? '';
-      const trailingPhoneCandidate = phone[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        phone.index + matched.length - trailingPhoneCandidate.length,
-      );
-    }
-
-    const privateKeyStart = content.lastIndexOf('-----BEGIN');
-    if (privateKeyStart >= 0) {
-      const privateKey = content.slice(privateKeyStart);
-      if (/-----END(?: [A-Z]+)* KEY-----/.test(privateKey)) {
-        // Release the complete block in one pass so the full-block classifier can redact it.
-        retainedFrom = content.length;
-      } else {
-        retainedFrom = Math.min(retainedFrom, privateKeyStart);
-      }
-    }
-
-    return retainedFrom;
-  }
-
-  private egressKey(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-  ): string {
-    return `${this.clientConversationKey(client, conversationId)}:${eventName}`;
-  }
-
   private relayEvent(client: Socket, conversationId: string, event: AgentSessionEvent): void {
     if (!client.connected) {
       this.logger.warn(
@@ -1259,27 +727,22 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       return;
     }
 
-    const sessionKey = this.clientConversationKey(client, conversationId);
     switch (event.type) {
       case 'agent_start': {
         // Reset accumulation buffers for the new turn
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.assistantText = '';
           cs.toolCalls = [];
           cs.pendingToolCalls.clear();
         }
-        this.textEgressBuffers.set(sessionKey, '');
-        this.thinkingEgressBuffers.set(sessionKey, '');
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:text'));
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:thinking'));
         client.emit('agent:start', { conversationId });
         break;
       }
 
       case 'agent_end': {
         // Gather usage stats from the Pi session
-        const activeClientSession = this.clientSessions.get(sessionKey);
+        const activeClientSession = this.clientSessions.get(client.id);
         const agentSession = activeClientSession
           ? this.agentService.getSession(conversationId, activeClientSession.scope)
           : undefined;
@@ -1301,20 +764,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
             }
           : undefined;
 
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:text',
-          this.textEgressBuffers,
-          true,
-        );
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:thinking',
-          this.thinkingEgressBuffers,
-          true,
-        );
         client.emit('agent:end', {
           conversationId,
           usage: usagePayload,
@@ -1332,7 +781,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         }
 
         // Persist the assistant message with metadata
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         const userId = (client.data.user as { id: string } | undefined)?.id;
         if (cs && userId && cs.assistantText.trim().length > 0) {
           const metadata: Record<string, unknown> = {
@@ -1357,11 +806,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
               {
                 conversationId,
                 role: 'assistant',
-                content: redactSensitiveContent(cs.assistantText).content,
+                content: cs.assistantText,
-                metadata: {
+                metadata,
-                  ...metadata,
-                  classifications: redactSensitiveContent(cs.assistantText).classifications,
-                },
               },
               userId,
             )
@@ -1383,33 +829,27 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       case 'message_update': {
         const assistantEvent = event.assistantMessageEvent;
         if (assistantEvent.type === 'text_delta') {
-          // Keep raw stream material in memory only; persist and emit only redacted text.
+          // Accumulate assistant text for persistence
-          const cs = this.clientSessions.get(sessionKey);
+          const cs = this.clientSessions.get(client.id);
           if (cs) {
             cs.assistantText += assistantEvent.delta;
           }
-          this.appendAndFlushRedactedEgress(
+          client.emit('agent:text', {
-            client,
             conversationId,
-            'agent:text',
+            text: assistantEvent.delta,
-            this.textEgressBuffers,
+          });
-            assistantEvent.delta,
-          );
         } else if (assistantEvent.type === 'thinking_delta') {
-          this.appendAndFlushRedactedEgress(
+          client.emit('agent:thinking', {
-            client,
             conversationId,
-            'agent:thinking',
+            text: assistantEvent.delta,
-            this.thinkingEgressBuffers,
+          });
-            assistantEvent.delta,
-          );
         }
         break;
       }
 
       case 'tool_execution_start': {
         // Track pending tool call for later recording
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.pendingToolCalls.set(event.toolCallId, {
             toolName: event.toolName,
@@ -1426,7 +866,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
       case 'tool_execution_end': {
         // Finalise tool call record
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           const pending = cs.pendingToolCalls.get(event.toolCallId);
           cs.toolCalls.push({

apps/gateway/src/commands/command-authorization.service.spec.ts

@@ -1,116 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-const adminCommand: CommandDef = {
-  name: 'gc',
-  description: 'GC',
-  aliases: [],
-  scope: 'admin',
-  execution: 'socket',
-  available: true,
-};
-const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-function createService(
-  role: string,
-  entries: Map<string, string> = new Map<string, string>(),
-): CommandAuthorizationService {
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('CommandAuthorizationService', () => {
-  it('consumes one exact actor-bound approval once', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(true);
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('rejects an approval when the structured action is mutated', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    const mutated = { ...payload, conversationId: 'other-conversation' };
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, mutated, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('denies an admin command to a member before approval is considered', async (): Promise<void> => {
-    const service = createService('member');
-    const approval = await service.createApproval(adminCommand, payload, 'member-1');
-    expect(approval).toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'member-1', 'forged-approval-id')).allowed,
-    ).toBe(false);
-  });
-
-  it('denies a malformed durable approval expiry instead of treating it as unexpired', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-malformed-expiry',
-      agentName: 'Nova',
-    };
-    const service = createService('admin', entries);
-    const approval = await service.createRuntimeTerminationApproval(action);
-    expect(approval).not.toBeNull();
-    const key = `agent:Nova:command-approval:${approval!.approvalId}`;
-    const stored = entries.get(key);
-    expect(stored).toBeDefined();
-    entries.set(key, JSON.stringify({ ...JSON.parse(stored!), expiresAt: 'not-a-date' }));
-
-    expect(await service.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-
-  it('persists and consumes one exact runtime termination approval across a service restart', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-1',
-      agentName: 'Nova',
-    };
-    const beforeRestart = createService('admin', entries);
-    const approval = await beforeRestart.createRuntimeTerminationApproval(action);
-
-    const afterRestart = createService('admin', entries);
-    expect(
-      await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, {
-        ...action,
-        sessionId: 'forged-session',
-      }),
-    ).toBe(false);
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      true,
-    );
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-});

apps/gateway/src/commands/command-authorization.service.ts

@@ -1,268 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import { eq, users as usersTable, type Db } from '@mosaicstack/db';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { COMMANDS_REDIS } from './commands.tokens.js';
-
-export type CommandRole = 'admin' | 'member' | 'viewer';
-
-export interface CommandApproval {
-  approvalId: string;
-  actionDigest: string;
-  actorId: string;
-  command: string;
-  expiresAt: string;
-}
-
-/** Exact immutable binding for a privileged runtime termination. */
-export interface RuntimeTerminationApprovalAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  /** Provisioned roster identity; isolates approvals between interaction agents. */
-  agentName: string;
-}
-
-export interface RuntimeTerminationApproval extends RuntimeTerminationApprovalAction {
-  approvalId: string;
-  actionDigest: string;
-  expiresAt: string;
-}
-
-export interface CommandAuthorizationResult {
-  allowed: boolean;
-  reason?: string;
-}
-
-@Injectable()
-export class CommandAuthorizationService {
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: {
-      get(key: string): Promise<string | null>;
-      set(key: string, value: string, ...args: string[]): Promise<unknown>;
-      del(key: string): Promise<number>;
-    },
-  ) {}
-
-  async authorize(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-    approvalId?: string,
-  ): Promise<CommandAuthorizationResult> {
-    const role = await this.resolveRole(actorId);
-    if (!role || !this.hasScope(role, command.scope)) {
-      return { allowed: false, reason: 'not authorized for this command scope' };
-    }
-    if (command.scope !== 'admin') return { allowed: true };
-    if (!approvalId) return { allowed: false, reason: 'durable approval is required' };
-    const actionDigest = this.actionDigest(command.name, payload);
-    const approved = await this.consumeApproval(approvalId, actorId, actionDigest);
-    return approved
-      ? { allowed: true }
-      : {
-          allowed: false,
-          reason: 'approval is invalid, expired, replayed, or does not match this action',
-        };
-  }
-
-  async createApproval(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-  ): Promise<CommandApproval | null> {
-    const role = await this.resolveRole(actorId);
-    if (!role || command.scope !== 'admin' || !this.hasScope(role, command.scope)) return null;
-
-    const approvalId = randomUUID();
-    const expiresAt = new Date(Date.now() + 5 * 60_000).toISOString();
-    const approval: CommandApproval = {
-      approvalId,
-      actionDigest: this.actionDigest(command.name, payload),
-      actorId,
-      command: command.name,
-      expiresAt,
-    };
-    await this.redis.set(this.key(approvalId), JSON.stringify(approval), 'EX', '300');
-    return approval;
-  }
-
-  /**
-   * Uses the same `interaction:command-approval:*` store and one-time deletion rule as
-   * command approvals. This deliberately avoids a parallel approval database.
-   */
-  async createRuntimeTerminationApproval(
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<RuntimeTerminationApproval | null> {
-    if (!this.hasRuntimeTerminationAction(action)) return null;
-    const role = await this.resolveRole(action.actorId);
-    if (role !== 'admin') return null;
-
-    const approval: RuntimeTerminationApproval = {
-      approvalId: randomUUID(),
-      actionDigest: this.runtimeActionDigest(action),
-      ...action,
-      expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(),
-    };
-    await this.redis.set(
-      this.runtimeKey(action.agentName, approval.approvalId),
-      JSON.stringify(approval),
-      'EX',
-      '300',
-    );
-    return approval;
-  }
-
-  async consumeRuntimeTerminationApproval(
-    approvalId: string,
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<boolean> {
-    const encoded = await this.redis.get(this.runtimeKey(action.agentName, approvalId));
-    if (!encoded) return false;
-    let approval: unknown;
-    try {
-      approval = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isRuntimeTerminationApproval(approval) ||
-      approval.actionDigest !== this.runtimeActionDigest(action) ||
-      approval.actorId !== action.actorId ||
-      approval.tenantId !== action.tenantId ||
-      !this.isUnexpired(approval.expiresAt)
-    ) {
-      return false;
-    }
-    if ((await this.resolveRole(approval.actorId)) !== 'admin') return false;
-    return (await this.redis.del(this.runtimeKey(action.agentName, approvalId))) === 1;
-  }
-
-  private async resolveRole(actorId: string): Promise<CommandRole | null> {
-    const [user] = await this.db
-      .select({ role: usersTable.role })
-      .from(usersTable)
-      .where(eq(usersTable.id, actorId))
-      .limit(1);
-    const role = user?.role;
-    return role === 'admin' || role === 'member' || role === 'viewer' ? role : null;
-  }
-
-  private hasScope(role: CommandRole, scope: CommandDef['scope']): boolean {
-    if (role === 'admin') return true;
-    return role === 'member' && (scope === 'core' || scope === 'agent');
-  }
-
-  private async consumeApproval(
-    approvalId: string,
-    actorId: string,
-    actionDigest: string,
-  ): Promise<boolean> {
-    const key = this.key(approvalId);
-    const encoded = await this.redis.get(key);
-    if (!encoded) return false;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isCommandApproval(parsed) ||
-      parsed.actorId !== actorId ||
-      parsed.actionDigest !== actionDigest ||
-      !this.isUnexpired(parsed.expiresAt)
-    )
-      return false;
-    return (await this.redis.del(key)) === 1;
-  }
-
-  private actionDigest(command: string, payload: SlashCommandPayload): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          command,
-          args: payload.args?.trim() ?? '',
-          conversationId: payload.conversationId,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private hasRuntimeTerminationAction(action: RuntimeTerminationApprovalAction): boolean {
-    return [
-      action.providerId,
-      action.sessionId,
-      action.actorId,
-      action.tenantId,
-      action.channelId,
-      action.correlationId,
-      action.agentName,
-    ].every((value: string): boolean => value.trim().length > 0);
-  }
-
-  private runtimeActionDigest(action: RuntimeTerminationApprovalAction): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          providerId: action.providerId,
-          sessionId: action.sessionId,
-          actorId: action.actorId,
-          tenantId: action.tenantId,
-          channelId: action.channelId,
-          correlationId: action.correlationId,
-          agentName: action.agentName,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private isUnexpired(expiresAt: unknown): expiresAt is string {
-    if (typeof expiresAt !== 'string') return false;
-    const expiresAtMs = Date.parse(expiresAt);
-    return Number.isFinite(expiresAtMs) && expiresAtMs > Date.now();
-  }
-
-  private isCommandApproval(value: unknown): value is CommandApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'expiresAt' in value &&
-      'command' in value
-    );
-  }
-
-  private isRuntimeTerminationApproval(value: unknown): value is RuntimeTerminationApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'tenantId' in value &&
-      'providerId' in value &&
-      'sessionId' in value &&
-      'channelId' in value &&
-      'correlationId' in value &&
-      'agentName' in value &&
-      'expiresAt' in value
-    );
-  }
-
-  private key(approvalId: string): string {
-    return `interaction:command-approval:${approvalId}`;
-  }
-
-  private runtimeKey(agentName: string, approvalId: string): string {
-    return `agent:${encodeURIComponent(agentName)}:command-approval:${approvalId}`;
-  }
-}

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -106,8 +106,8 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(result.command).toBe('provider');
   });
 
-  // /provider login anthropic — no bearer token or auth URL reaches chat output
+  // /provider login anthropic — success with URL containing poll token
-  it('/provider login <name> keeps its one-time token out of chat output', async () => {
+  it('/provider login <name> returns success with URL and poll token', async () => {
     const payload: SlashCommandPayload = {
       command: 'provider',
       args: 'login anthropic',
@@ -117,9 +117,14 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(result.success).toBe(true);
     expect(result.command).toBe('provider');
     expect(result.message).toContain('anthropic');
-    expect(result.message).not.toContain('http');
+    expect(result.message).toContain('http');
-    expect(result.message).not.toContain('token=');
+    // data should contain loginUrl and pollToken
-    expect(result.data).toEqual({ provider: 'anthropic' });
+    expect(result.data).toBeDefined();
+    const data = result.data as Record<string, unknown>;
+    expect(typeof data['loginUrl']).toBe('string');
+    expect(typeof data['pollToken']).toBe('string');
+    expect(data['loginUrl'] as string).toContain('anthropic');
+    expect(data['loginUrl'] as string).toContain(data['pollToken'] as string);
     // Verify Valkey was called
     expect(mockRedis.set).toHaveBeenCalledOnce();
     const [key, value, , ttl] = mockRedis.set.mock.calls[0] as [string, string, string, number];

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -1,112 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-import { CommandExecutorService } from './command-executor.service.js';
-
-const registry = {
-  getManifest: vi.fn(() => ({
-    version: 1,
-    commands: [
-      {
-        name: 'gc',
-        description: 'System-wide garbage collection',
-        aliases: [],
-        scope: 'admin' as const,
-        execution: 'socket' as const,
-        available: true,
-      },
-    ],
-    skills: [],
-  })),
-};
-
-const sessionGc = {
-  sweepOrphans: vi.fn().mockResolvedValue({ orphanedSessions: 1, totalCleaned: [], duration: 1 }),
-};
-
-const scope = (userId: string) => ({ userId, tenantId: 'tenant-1' });
-
-const authorization = {
-  authorize: vi.fn((_command: unknown, _payload: unknown, actorId: string) =>
-    Promise.resolve(
-      actorId === 'member-1'
-        ? { allowed: false, reason: 'durable approval is required' }
-        : { allowed: false, reason: 'not authorized for this command scope' },
-    ),
-  ),
-};
-
-function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
-  return new CommandExecutorService(
-    registry as never,
-    { getSession: vi.fn() } as never,
-    { clear: vi.fn(), set: vi.fn() } as never,
-    sessionGc as never,
-    { set: vi.fn() } as never,
-    { agents: {} } as never,
-    null,
-    null,
-    null,
-    authorizationService as never,
-  );
-}
-
-function createDurableAuthorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
-  const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-  beforeEach((): void => {
-    vi.clearAllMocks();
-  });
-
-  it('denies a forged admin identity and does not execute a system-wide command', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('admin-forged-by-client'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('not authorized');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('denies a privileged command without a server-bound durable approval', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('member-1'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('approval');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('executes an admin command only after a valid durable approval is issued and supplied', async (): Promise<void> => {
-    const executor = buildExecutor(createDurableAuthorization());
-
-    const adminScope = scope('admin-1');
-    const denied = await executor.execute(payload, adminScope);
-    const approval = await executor.createApproval(payload, adminScope);
-    const approved = await executor.execute(
-      { ...payload, approvalId: approval?.approvalId },
-      adminScope,
-    );
-
-    expect(denied.success).toBe(false);
-    expect(denied.message).toContain('approval');
-    expect(approval).not.toBeNull();
-    // A valid durable approval is consumed, but cannot authorize an unimplemented
-    // global retention operation. Session-scoped cleanup remains lifecycle-only.
-    expect(approved.success).toBe(false);
-    expect(approved.message).toContain('Global GC is disabled');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/commands/command-executor.service.ts

@@ -11,7 +11,6 @@ import { ReloadService } from '../reload/reload.service.js';
 import { McpClientService } from '../mcp-client/mcp-client.service.js';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
 
 @Injectable()
@@ -34,9 +33,6 @@ export class CommandExecutorService {
     @Optional()
     @Inject(McpClientService)
     private readonly mcpClient: McpClientService | null,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService | null = null,
   ) {}
 
   async execute(
@@ -56,16 +52,6 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization?.authorize(
-      def,
-      payload,
-      userId,
-      payload.approvalId,
-    );
-    if (authorization && !authorization.allowed) {
-      return { command, conversationId, success: false, message: authorization.reason };
-    }
-
     try {
       switch (command) {
         case 'model':
@@ -102,15 +88,16 @@ export class CommandExecutorService {
             success: true,
             message: 'Retry last message requested.',
           };
-        case 'gc':
+        case 'gc': {
-          // Global retention requires a separate, authorized and audited job.
+          // Admin-only: system-wide GC sweep across all sessions
-          // Session cleanup is performed only through the session lifecycle.
+          const result = await this.sessionGC.sweepOrphans();
           return {
             command: 'gc',
-            success: false,
+            success: true,
-            message: 'Global GC is disabled pending an authorized retention job.',
+            message: `GC sweep complete: ${result.orphanedSessions} orphaned sessions cleaned in ${result.duration}ms.`,
             conversationId,
           };
+        }
         case 'agent':
           return await this.handleAgent(args ?? null, conversationId, scope);
         case 'provider':
@@ -161,14 +148,6 @@ export class CommandExecutorService {
     }
   }
 
-  async createApproval(payload: SlashCommandPayload, scope: ActorTenantScope) {
-    const def = this.registry
-      .getManifest()
-      .commands.find((command) => command.name === payload.command);
-    if (!def || !this.authorization) return null;
-    return this.authorization.createApproval(def, payload, scope.userId);
-  }
-
   private async handleModel(
     args: string | null,
     conversationId: string,
@@ -435,28 +414,22 @@ export class CommandExecutorService {
           };
         }
         const pollToken = crypto.randomUUID();
-        const tokenDigest = await crypto.subtle.digest(
+        const key = `mosaic:auth:poll:${pollToken}`;
-          'SHA-256',
+        // Store pending state in Valkey (TTL 5 minutes)
-          new TextEncoder().encode(pollToken),
-        );
-        const tokenHash = Array.from(new Uint8Array(tokenDigest), (byte: number): string =>
-          byte.toString(16).padStart(2, '0'),
-        ).join('');
-        const key = `mosaic:auth:poll:${tokenHash}`;
-        // Persist only a short-lived token digest. The raw token is delivered only by
-        // the authenticated dashboard flow, never in chat output or command metadata.
         await this.redis.set(
           key,
           JSON.stringify({ status: 'pending', provider: providerName, userId }),
           'EX',
           300,
         );
+        // In production this would construct an OAuth URL
+        const loginUrl = `${process.env['MOSAIC_BASE_URL'] ?? 'http://localhost:3000'}/auth/provider/${providerName}?token=${pollToken}`;
         return {
           command: 'provider',
           success: true,
-          message: `Provider login for ${providerName} is ready. Continue in the authenticated dashboard.`,
+          message: `Open this URL to authenticate with ${providerName}:\n${loginUrl}`,
           conversationId,
-          data: { provider: providerName },
+          data: { loginUrl, pollToken, provider: providerName },
         };
       }
 

apps/gateway/src/commands/commands.integration.spec.ts

@@ -177,12 +177,14 @@ describe('CommandExecutorService — integration', () => {
     expect(result.command).toBe('nonexistent');
   });
 
-  it('/gc refuses an unaudited global sweep', async () => {
+  // /gc handler calls SessionGCService.sweepOrphans (admin-only, no userId arg)
+  it('/gc calls SessionGCService.sweepOrphans without arguments', async () => {
     const payload: SlashCommandPayload = { command: 'gc', conversationId };
     const result = await executor.execute(payload, userScope);
-    expect(mockSessionGC.sweepOrphans).not.toHaveBeenCalled();
+    expect(mockSessionGC.sweepOrphans).toHaveBeenCalledWith();
-    expect(result.success).toBe(false);
+    expect(result.success).toBe(true);
-    expect(result.message).toContain('disabled pending an authorized retention job');
+    expect(result.message).toContain('GC sweep complete');
+    expect(result.message).toContain('3 orphaned sessions');
   });
 
   // /system with args calls SystemOverrideService.set

apps/gateway/src/commands/commands.module.ts

@@ -3,10 +3,8 @@ import { createQueue, type QueueHandle } from '@mosaicstack/queue';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
-import { CommandRuntimeApprovalVerifier } from './runtime-approval-verifier.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
 
 const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
@@ -26,16 +24,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
-    CommandExecutorService,
-  ],
-  exports: [
-    CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
     CommandExecutorService,
   ],
+  exports: [CommandRegistryService, CommandExecutorService],
 })
 export class CommandsModule implements OnApplicationShutdown {
   constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}

apps/gateway/src/commands/runtime-approval-verifier.ts

@@ -1,23 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import type {
-  RuntimeApprovalVerifier,
-  RuntimeTerminationAction,
-} from '../agent/runtime-provider-registry.service.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-/**
- * Adapter from the provider registry's exact termination action to the shared,
- * Redis-backed `interaction:command-approval:*` store. It has no separate approval
- * persistence or replay semantics.
- */
-@Injectable()
-export class CommandRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  constructor(
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService,
-  ) {}
-
-  async consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean> {
-    return this.authorization.consumeRuntimeTerminationApproval(approvalRef, action);
-  }
-}

apps/gateway/src/coord/coord.module.ts

@@ -1,32 +1,10 @@
 import { Module } from '@nestjs/common';
-import { InMemoryInteractionCoordinationPort } from '@mosaicstack/coord';
 import { CoordService } from './coord.service.js';
 import { CoordController } from './coord.controller.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import {
-  COORDINATION_CONFIG,
-  COORDINATION_PORT,
-  InteractionCoordinationService,
-} from './interaction-coordination.service.js';
 
 @Module({
-  providers: [
+  providers: [CoordService],
-    CoordService,
+  controllers: [CoordController],
-    {
+  exports: [CoordService],
-      provide: COORDINATION_PORT,
-      useFactory: (): InMemoryInteractionCoordinationPort =>
-        new InMemoryInteractionCoordinationPort(),
-    },
-    {
-      provide: COORDINATION_CONFIG,
-      useFactory: () => ({
-        interactionAgentId: process.env['MOSAIC_AGENT_NAME'],
-        orchestrationAgentId: process.env['MOSAIC_ORCHESTRATOR_AGENT_NAME'],
-      }),
-    },
-    InteractionCoordinationService,
-  ],
-  controllers: [CoordController, InteractionCoordinationController],
-  exports: [CoordService, InteractionCoordinationService],
 })
 export class CoordModule {}

apps/gateway/src/coord/interaction-coordination.controller.test.ts

@@ -1,47 +0,0 @@
-const PATH_METADATA = 'path';
-import { describe, expect, it, vi } from 'vitest';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-
-const user = { id: 'operator-1', tenantId: 'tenant-a' };
-
-describe('InteractionCoordinationController', () => {
-  it('exposes the neutral canonical route and Mos compatibility alias over identical handlers', () => {
-    expect(Reflect.getMetadata(PATH_METADATA, InteractionCoordinationController)).toEqual([
-      'api/coord/interaction',
-      'api/coord/mos',
-    ]);
-    expect(InteractionCoordinationController.prototype.handoff).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.observe).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.result).toBeTypeOf('function');
-  });
-
-  it('derives actor and tenant from the authenticated user rather than handoff input', async () => {
-    const coordination = {
-      handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, 'corr-1');
-
-    expect(coordination.handoff).toHaveBeenCalledWith(
-      { idempotencyKey: 'request-1', summary: 'Implement' },
-      expect.objectContaining({
-        actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-        channelId: 'cli',
-        correlationId: 'corr-1',
-      }),
-    );
-  });
-
-  it('requires a correlation header before invoking the coordination service', async () => {
-    const coordination = { handoff: vi.fn(), observe: vi.fn(), result: vi.fn() };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await expect(
-      controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, undefined),
-    ).rejects.toThrow('X-Correlation-Id is required');
-    expect(coordination.handoff).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/coord/interaction-coordination.controller.ts

@@ -1,75 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Inject,
-  Param,
-  Post,
-  UseGuards,
-} from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type {
-  InteractionCoordinationObservationDto,
-  InteractionCoordinationResponseDto,
-  InteractionCoordinationResultDto,
-  CreateHandoffDto,
-} from './interaction-coordination.dto.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-/** Authenticated interaction-plane boundary for the handoff/observe/result-only interaction coordination contract. */
-/** `api/coord/interaction` is canonical; the Mos path remains a compatibility alias. */
-@Controller(['api/coord/interaction', 'api/coord/mos'])
-@UseGuards(AuthGuard)
-export class InteractionCoordinationController {
-  constructor(
-    @Inject(InteractionCoordinationService)
-    private readonly coordination: InteractionCoordinationService,
-  ) {}
-
-  @Post('handoff')
-  async handoff(
-    @Body() request: CreateHandoffDto,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResponseDto> {
-    return { receipt: await this.coordination.handoff(request, this.context(user, correlationId)) };
-  }
-
-  @Get(':handoffId/observe')
-  async observe(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationObservationDto> {
-    return {
-      observation: await this.coordination.observe(handoffId, this.context(user, correlationId)),
-    };
-  }
-
-  @Get(':handoffId/result')
-  async result(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResultDto> {
-    return { result: await this.coordination.result(handoffId, this.context(user, correlationId)) };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    if (!requestCorrelationId) throw new ForbiddenException('X-Correlation-Id is required');
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-}

apps/gateway/src/coord/interaction-coordination.dto.ts

@@ -1,25 +0,0 @@
-import type {
-  CoordinationObservation,
-  CoordinationResult,
-  HandoffReceipt,
-} from '@mosaicstack/coord';
-
-/** Input accepted at the gateway coordination boundary. Agent identity is not caller-controlled. */
-export interface CreateHandoffDto {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-export interface InteractionCoordinationResponseDto {
-  receipt: HandoffReceipt;
-}
-
-export interface InteractionCoordinationObservationDto {
-  observation: CoordinationObservation;
-}
-
-export interface InteractionCoordinationResultDto {
-  result: CoordinationResult;
-}

apps/gateway/src/coord/interaction-coordination.routing.e2e.test.ts

@@ -1,88 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: { id: 'operator-1', tenantId: 'tenant-1' }, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-  ],
-  exports: [AUTH, AuthGuard],
-})
-class AuthenticatedRequestModule {}
-
-describe('InteractionCoordinationController route aliases', (): void => {
-  let app: NestFastifyApplication | undefined;
-  const coordination = {
-    handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-    observe: vi.fn(async () => ({ status: 'running' })),
-    result: vi.fn(async () => ({ status: 'completed' })),
-  };
-
-  beforeAll(async (): Promise<void> => {
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule],
-      controllers: [InteractionCoordinationController],
-      providers: [{ provide: InteractionCoordinationService, useValue: coordination }],
-    }).compile();
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-  afterAll(async (): Promise<void> => app?.close());
-
-  it('routes handoff, observe, and result through the same AuthGuard-protected service for both prefixes', async (): Promise<void> => {
-    if (!app) throw new Error('test app was not initialized');
-    for (const prefix of ['/api/coord/interaction', '/api/coord/mos']) {
-      const headers = { cookie: 'session=trusted', 'x-correlation-id': `corr-${prefix}` };
-      expect(
-        (
-          await app.inject({
-            method: 'POST',
-            url: `${prefix}/handoff`,
-            headers,
-            payload: { idempotencyKey: `key-${prefix}`, summary: 'handoff' },
-          })
-        ).statusCode,
-      ).toBe(201);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/observe`, headers }))
-          .statusCode,
-      ).toBe(200);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/result`, headers }))
-          .statusCode,
-      ).toBe(200);
-    }
-    expect(coordination.handoff).toHaveBeenCalledTimes(2);
-    expect(coordination.observe).toHaveBeenCalledTimes(2);
-    expect(coordination.result).toHaveBeenCalledTimes(2);
-    expect(
-      (
-        await app.inject({
-          method: 'POST',
-          url: '/api/coord/interaction/handoff',
-          payload: { idempotencyKey: 'denied', summary: 'x' },
-        })
-      ).statusCode,
-    ).toBe(401);
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.test.ts

@@ -1,217 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import {
-  InMemoryInteractionCoordinationPort,
-  type InteractionCoordinationPort,
-  type Handoff,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import {
-  InteractionCoordinationService,
-  type InteractionCoordinationConfig,
-  type InteractionCoordinationGatewayError,
-} from './interaction-coordination.service.js';
-
-const context: RuntimeProviderRequestContext = {
-  actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-  channelId: 'cli',
-  correlationId: 'corr-1',
-};
-
-const config: InteractionCoordinationConfig = {
-  interactionAgentId: 'Nova',
-  orchestrationAgentId: 'Conductor',
-};
-
-function service(
-  port: InteractionCoordinationPort = new InMemoryInteractionCoordinationPort(),
-  options: {
-    config?: InteractionCoordinationConfig;
-    handoffIdFactory?: () => string;
-  } = {},
-): InteractionCoordinationService {
-  return new InteractionCoordinationService(
-    port,
-    options.config ?? config,
-    options.handoffIdFactory ?? (() => 'handoff-1'),
-  );
-}
-
-describe('InteractionCoordinationService authority boundary', (): void => {
-  it('derives identity and actor/tenant scope server-side, then round-trips the native adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const coordination = service(adapter);
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).resolves.toEqual({
-      handoffId: 'handoff-1',
-      targetAgentId: 'Conductor',
-      status: 'queued',
-      correlationId: 'corr-1',
-    });
-
-    adapter.recordActivity('handoff-1', 'running', 'Orchestrator accepted the request');
-    adapter.recordResult('handoff-1', 'completed', 'Merged by orchestrator');
-
-    const followUpContext = { ...context, correlationId: 'corr-2' };
-    await expect(coordination.observe('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-    });
-    await expect(coordination.result('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-      summary: 'Merged by orchestrator',
-    });
-  });
-
-  it('fails closed without calling a port when the interaction requester is unconfigured', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: '', orchestrationAgentId: 'Conductor' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({
-      code: 'unconfigured_requester',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('rejects self-delegation configuration before delivering work', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: 'Nova', orchestrationAgentId: 'Nova' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toThrow('Interaction and orchestration identities must differ');
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('denies cross-tenant observe and result before calling the adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const observe = vi.spyOn(adapter, 'observe');
-    const result = vi.spyOn(adapter, 'result');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    const otherTenant = {
-      ...context,
-      actorScope: { ...context.actorScope, tenantId: 'tenant-b' },
-    };
-    await expect(coordination.observe('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(coordination.result('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(observe).not.toHaveBeenCalled();
-    expect(result).not.toHaveBeenCalled();
-  });
-
-  it('scopes idempotency by actor and joins concurrent retries without duplicate delivery', async (): Promise<void> => {
-    let handoffSequence = 0;
-    let release: (() => void) | undefined;
-    const delivered = new Promise<void>((resolve: () => void): void => {
-      release = resolve;
-    });
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => {
-        await delivered;
-        return {
-          handoffId: handoff.handoffId,
-          targetAgentId: handoff.targetAgentId,
-          status: 'queued' as const,
-          correlationId: handoff.scope.correlationId,
-        };
-      }),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const coordination = service(adapter, {
-      handoffIdFactory: (): string => `handoff-${++handoffSequence}`,
-    });
-    const request = { idempotencyKey: 'request-1', summary: 'Implement the requested feature' };
-
-    const first = coordination.handoff(request, context);
-    const retry = coordination.handoff(request, context);
-    expect(adapter.handoff).toHaveBeenCalledTimes(1);
-    release?.();
-    await expect(Promise.all([first, retry])).resolves.toEqual([
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-    ]);
-
-    await expect(
-      coordination.handoff(request, {
-        ...context,
-        actorScope: { ...context.actorScope, userId: 'operator-2' },
-      }),
-    ).resolves.toMatchObject({ handoffId: 'handoff-2' });
-    expect(adapter.handoff).toHaveBeenCalledTimes(2);
-  });
-
-  it('rejects idempotency-key payload drift and malformed handoff input before delivery', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-1', summary: 'Different work' }, context),
-    ).rejects.toMatchObject({
-      code: 'handoff_conflict',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-2', summary: '' }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-3', summary: 'x'.repeat(2_049) }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).toHaveBeenCalledTimes(1);
-  });
-
-  it('fails closed when the port reports a target that drifts from configuration', async (): Promise<void> => {
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => ({
-        handoffId: handoff.handoffId,
-        targetAgentId: 'Unexpected',
-        status: 'accepted' as const,
-        correlationId: handoff.scope.correlationId,
-      })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-
-    await expect(
-      service(adapter).handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({ code: 'target_drift' });
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.ts

@@ -1,303 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  InteractionCoordinationClient,
-  type CoordinationObservation,
-  type CoordinationResult,
-  type CoordinationScope,
-  type InteractionCoordinationIdentity,
-  type InteractionCoordinationPort,
-  type HandoffReceipt,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type { CreateHandoffDto } from './interaction-coordination.dto.js';
-
-export const COORDINATION_PORT = Symbol('COORDINATION_PORT');
-export const COORDINATION_CONFIG = Symbol('COORDINATION_CONFIG');
-
-const HANDOFF_TRACKING_TTL_MS = 60 * 60 * 1_000;
-const MAX_TRACKED_HANDOFFS = 1_000;
-const MAX_IDEMPOTENCY_KEY_LENGTH = 128;
-const MAX_SUMMARY_LENGTH = 2_048;
-const MAX_CONTEXT_LENGTH = 8_192;
-const MAX_MISSION_ID_LENGTH = 128;
-
-export interface InteractionCoordinationConfig {
-  interactionAgentId?: string;
-  orchestrationAgentId?: string;
-}
-
-interface HandoffOwner {
-  actorId: string;
-  tenantId: string;
-  requesterAgentId: string;
-  correlationId: string;
-  expiresAt: number;
-}
-
-interface NormalizedHandoffRequest {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-interface TrackedHandoff {
-  request: NormalizedHandoffRequest;
-  receipt: Promise<HandoffReceipt>;
-  expiresAt: number;
-}
-
-/**
- * Gateway authority boundary for the interaction agent. It derives requester,
- * actor, and tenant from trusted server configuration and authentication; no
- * channel request can name a target or gain orchestrator-owned orchestration verbs.
- */
-@Injectable()
-export class InteractionCoordinationService {
-  private readonly owners = new Map<string, HandoffOwner>();
-  private readonly handoffsByIdempotencyKey = new Map<string, TrackedHandoff>();
-
-  constructor(
-    @Inject(COORDINATION_PORT) private readonly port: InteractionCoordinationPort,
-    @Inject(COORDINATION_CONFIG) private readonly config: InteractionCoordinationConfig,
-    private readonly handoffIdFactory: () => string = (): string => crypto.randomUUID(),
-  ) {}
-
-  async handoff(
-    request: CreateHandoffDto,
-    context: RuntimeProviderRequestContext,
-  ): Promise<HandoffReceipt> {
-    this.pruneExpiredTracking();
-    const normalized = this.normalizeRequest(request);
-    const scope = this.scope(context);
-    const idempotencyKey = this.idempotencyKey(normalized.idempotencyKey, scope);
-    const existing = this.handoffsByIdempotencyKey.get(idempotencyKey);
-    if (existing !== undefined) {
-      if (!sameRequest(existing.request, normalized)) {
-        throw new InteractionCoordinationGatewayError(
-          'handoff_conflict',
-          'Handoff idempotency key is already bound to different immutable input',
-        );
-      }
-      return existing.receipt;
-    }
-
-    const pending = this.deliverHandoff(this.handoffIdFactory(), normalized, scope);
-    const tracked: TrackedHandoff = {
-      request: normalized,
-      receipt: pending,
-      expiresAt: this.expiresAt(),
-    };
-    this.handoffsByIdempotencyKey.set(idempotencyKey, tracked);
-    this.enforceTrackingLimit(this.handoffsByIdempotencyKey);
-    try {
-      return await pending;
-    } catch (error: unknown) {
-      if (this.handoffsByIdempotencyKey.get(idempotencyKey) === tracked) {
-        this.handoffsByIdempotencyKey.delete(idempotencyKey);
-      }
-      throw error;
-    }
-  }
-
-  async observe(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationObservation> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().observe(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  async result(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationResult> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().result(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  private async deliverHandoff(
-    handoffId: string,
-    request: NormalizedHandoffRequest,
-    scope: CoordinationScope,
-  ): Promise<HandoffReceipt> {
-    const receipt = await this.client((): string => handoffId).handoff(request, scope);
-    const owner: HandoffOwner = {
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      requesterAgentId: scope.requesterAgentId,
-      correlationId: scope.correlationId,
-      expiresAt: this.expiresAt(),
-    };
-    const existing = this.owners.get(receipt.handoffId);
-    if (existing !== undefined && !sameOwner(existing, owner)) {
-      throw new InteractionCoordinationGatewayError(
-        'handoff_conflict',
-        'Handoff ID is already bound to a different authenticated scope',
-      );
-    }
-    this.owners.set(receipt.handoffId, owner);
-    this.enforceTrackingLimit(this.owners);
-    return receipt;
-  }
-
-  private client(handoffIdFactory?: () => string): InteractionCoordinationClient {
-    return new InteractionCoordinationClient(this.identity(), this.port, handoffIdFactory);
-  }
-
-  private identity(): InteractionCoordinationIdentity {
-    const interactionAgentId = this.config.interactionAgentId?.trim();
-    const orchestrationAgentId = this.config.orchestrationAgentId?.trim();
-    if (!interactionAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_requester',
-        'Interaction agent identity is not configured',
-      );
-    }
-    if (!orchestrationAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_target',
-        'Orchestration agent identity is not configured',
-      );
-    }
-    return { interactionAgentId, orchestrationAgentId };
-  }
-
-  private scope(context: RuntimeProviderRequestContext): CoordinationScope {
-    const identity = this.identity();
-    return Object.freeze({
-      actorId: context.actorScope.userId,
-      tenantId: context.actorScope.tenantId,
-      correlationId: context.correlationId,
-      requesterAgentId: identity.interactionAgentId,
-    });
-  }
-
-  private normalizeRequest(request: CreateHandoffDto): NormalizedHandoffRequest {
-    if (typeof request !== 'object' || request === null) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        'Handoff request is invalid',
-      );
-    }
-    const idempotencyKey = this.requiredString(
-      request.idempotencyKey,
-      'idempotency key',
-      MAX_IDEMPOTENCY_KEY_LENGTH,
-    );
-    const summary = this.requiredString(request.summary, 'summary', MAX_SUMMARY_LENGTH);
-    const context = this.optionalString(request.context, 'context', MAX_CONTEXT_LENGTH);
-    const missionId = this.optionalString(request.missionId, 'mission ID', MAX_MISSION_ID_LENGTH);
-    return Object.freeze({
-      idempotencyKey,
-      summary,
-      ...(context === undefined ? {} : { context }),
-      ...(missionId === undefined ? {} : { missionId }),
-    });
-  }
-
-  private idempotencyKey(requestKey: string, scope: CoordinationScope): string {
-    return `${scope.tenantId}\u0000${scope.actorId}\u0000${scope.requesterAgentId}\u0000${requestKey}`;
-  }
-
-  private requiredString(value: unknown, field: string, maximumLength: number): string {
-    if (typeof value !== 'string') {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} must be a string`,
-      );
-    }
-    const normalized = value.trim();
-    if (normalized.length === 0 || normalized.length > maximumLength) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} is invalid`,
-      );
-    }
-    return normalized;
-  }
-
-  private optionalString(value: unknown, field: string, maximumLength: number): string | undefined {
-    if (value === undefined) return undefined;
-    return this.requiredString(value, field, maximumLength);
-  }
-
-  private expiresAt(): number {
-    return Date.now() + HANDOFF_TRACKING_TTL_MS;
-  }
-
-  private pruneExpiredTracking(): void {
-    const now = Date.now();
-    for (const [key, tracked] of this.handoffsByIdempotencyKey) {
-      if (tracked.expiresAt <= now) this.handoffsByIdempotencyKey.delete(key);
-    }
-    for (const [key, owner] of this.owners) {
-      if (owner.expiresAt <= now) this.owners.delete(key);
-    }
-  }
-
-  private enforceTrackingLimit<T>(entries: Map<string, T>): void {
-    while (entries.size > MAX_TRACKED_HANDOFFS) {
-      const oldest = entries.keys().next().value;
-      if (typeof oldest !== 'string') return;
-      entries.delete(oldest);
-    }
-  }
-
-  private ownerFor(handoffId: string, scope: CoordinationScope): HandoffOwner {
-    const owner = this.owners.get(handoffId);
-    if (owner === undefined) {
-      throw new InteractionCoordinationGatewayError('not_found', 'Handoff was not found');
-    }
-    if (
-      owner.tenantId !== scope.tenantId ||
-      owner.actorId !== scope.actorId ||
-      owner.requesterAgentId !== scope.requesterAgentId
-    ) {
-      throw new InteractionCoordinationGatewayError(
-        'cross_tenant_forbidden',
-        'Handoff is outside the authenticated scope',
-      );
-    }
-    return owner;
-  }
-}
-
-export type InteractionCoordinationGatewayErrorCode =
-  | 'cross_tenant_forbidden'
-  | 'handoff_conflict'
-  | 'invalid_request'
-  | 'not_found'
-  | 'unconfigured_requester'
-  | 'unconfigured_target';
-
-function sameOwner(left: HandoffOwner, right: HandoffOwner): boolean {
-  return (
-    left.actorId === right.actorId &&
-    left.tenantId === right.tenantId &&
-    left.requesterAgentId === right.requesterAgentId
-  );
-}
-
-function sameRequest(left: NormalizedHandoffRequest, right: NormalizedHandoffRequest): boolean {
-  return (
-    left.idempotencyKey === right.idempotencyKey &&
-    left.summary === right.summary &&
-    left.context === right.context &&
-    left.missionId === right.missionId
-  );
-}
-
-export class InteractionCoordinationGatewayError extends Error {
-  constructor(
-    readonly code: InteractionCoordinationGatewayErrorCode,
-    message: string,
-  ) {
-    super(message);
-    this.name = InteractionCoordinationGatewayError.name;
-  }
-}

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -3,7 +3,6 @@ import { Logger } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { SessionGCService } from './session-gc.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 
 type MockRedis = {
   scan: ReturnType<typeof vi.fn>;
@@ -13,12 +12,7 @@ type MockRedis = {
 describe('SessionGCService', () => {
   let service: SessionGCService;
   let mockRedis: MockRedis;
-  let mockLogService: {
+  let mockLogService: { logs: { promoteToWarm: ReturnType<typeof vi.fn> } };
-    logs: {
-      promoteSessionToWarm: ReturnType<typeof vi.fn>;
-      promoteToWarm: ReturnType<typeof vi.fn>;
-    };
-  };
 
   /**
    * Helper: build a scan mock that returns all provided keys in a single
@@ -36,7 +30,6 @@ describe('SessionGCService', () => {
 
     mockLogService = {
       logs: {
-        promoteSessionToWarm: vi.fn().mockResolvedValue(0),
         promoteToWarm: vi.fn().mockResolvedValue(0),
       },
     };
@@ -66,76 +59,54 @@ describe('SessionGCService', () => {
     expect(result.cleaned.valkeyKeys).toBeUndefined();
   });
 
-  it('escapes glob metacharacters in a session identifier', async () => {
-    await service.collect('abc*?[tenant]\\escape');
-
-    expect(mockRedis.scan).toHaveBeenCalledWith(
-      '0',
-      'MATCH',
-      'mosaic:session:abc\\*\\?\\[tenant\\]\\\\escape:*',
-      'COUNT',
-      100,
-    );
-  });
-
-  it('preserves a valid durable approval after session GC', async () => {
-    const entries = new Map<string, string>();
-    const redis = {
-      scan: vi.fn().mockResolvedValue(['0', ['mosaic:session:owned:state']]),
-      get: vi.fn(async (key: string) => entries.get(key) ?? null),
-      set: vi.fn(async (key: string, value: string) => entries.set(key, value)),
-      del: vi.fn(async (...keys: string[]) => {
-        let deleted = 0;
-        for (const key of keys) deleted += Number(entries.delete(key));
-        return deleted;
-      }),
-    };
-    const authorization = new CommandAuthorizationService(
-      {
-        select: () => ({
-          from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-        }),
-      } as never,
-      redis,
-    );
-    const command = {
-      name: 'gc',
-      description: 'System-wide garbage collection',
-      aliases: [],
-      scope: 'admin',
-      execution: 'socket',
-      available: true,
-    } as never;
-    const payload = { command: 'gc', conversationId: 'owned' };
-    const approval = await authorization.createApproval(command, payload, 'admin-1');
-    const approvalKey = `interaction:command-approval:${approval!.approvalId}`;
-    const gc = new SessionGCService(redis as never, mockLogService as unknown as LogService);
-
-    await gc.collect('owned');
-
-    expect(entries.has(approvalKey)).toBe(true);
-    await expect(
-      authorization.authorize(command, payload, 'admin-1', approval!.approvalId),
-    ).resolves.toEqual({ allowed: true });
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');
   });
 
-  it('collect() demotes logs only for the requested session', async () => {
+  it('fullCollect() deletes all session keys', async () => {
-    await service.collect('owned-session');
+    mockRedis.scan = makeScanMock(['mosaic:session:abc:system', 'mosaic:session:xyz:foo']);
-
+    const result = await service.fullCollect();
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
+    expect(mockRedis.del).toHaveBeenCalled();
-      'owned-session',
+    expect(result.valkeyKeys).toBe(2);
-      expect.any(Date),
-    );
-    expect(mockLogService.logs.promoteToWarm).not.toHaveBeenCalled();
   });
 
-  it('does not expose automatic global GC entry points', () => {
+  it('fullCollect() with no keys returns 0 valkeyKeys', async () => {
-    expect('fullCollect' in service).toBe(false);
+    mockRedis.scan = makeScanMock([]);
-    expect('sweepOrphans' in service).toBe(false);
+    const result = await service.fullCollect();
+    expect(result.valkeyKeys).toBe(0);
+    expect(mockRedis.del).not.toHaveBeenCalled();
+  });
+
+  it('fullCollect() returns duration', async () => {
+    const result = await service.fullCollect();
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() extracts unique session IDs and collects them', async () => {
+    // First scan call returns the global session list; subsequent calls return
+    // per-session keys during collect().
+    mockRedis.scan = vi
+      .fn()
+      .mockResolvedValueOnce([
+        '0',
+        ['mosaic:session:abc:system', 'mosaic:session:abc:messages', 'mosaic:session:xyz:system'],
+      ])
+      // collect('abc') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:abc:system', 'mosaic:session:abc:messages']])
+      // collect('xyz') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:xyz:system']]);
+    mockRedis.del.mockResolvedValue(1);
+
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBeGreaterThanOrEqual(0);
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() returns empty when no session keys', async () => {
+    mockRedis.scan = makeScanMock([]);
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBe(0);
+    expect(result.totalCleaned).toHaveLength(0);
   });
 });

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -13,18 +13,49 @@ export interface GCResult {
   };
 }
 
-/** Escape Redis glob metacharacters so a session identifier is always literal. */
+export interface GCSweepResult {
-function escapeRedisGlobLiteral(value: string): string {
+  orphanedSessions: number;
-  return value.replace(/[\\*?\[\]]/g, '\\$&');
+  totalCleaned: GCResult[];
+  duration: number;
+}
+
+export interface FullGCResult {
+  valkeyKeys: number;
+  logsDemoted: number;
+  jobsPurged: number;
+  tempFilesRemoved: number;
+  duration: number;
 }
 
 @Injectable()
-export class SessionGCService {
+export class SessionGCService implements OnModuleInit {
+  private readonly logger = new Logger(SessionGCService.name);
+
   constructor(
     @Inject(REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
+  onModuleInit(): void {
+    // Fire-and-forget: run full GC asynchronously so it does not block the
+    // NestJS bootstrap chain.  Cold-start GC typically takes 100–500 ms
+    // depending on Valkey key count; deferring it removes that latency from
+    // the TTFB of the first HTTP request.
+    this.fullCollect()
+      .then((result) => {
+        this.logger.log(
+          `Full GC complete: ${result.valkeyKeys} Valkey keys, ` +
+            `${result.logsDemoted} logs demoted, ` +
+            `${result.jobsPurged} jobs purged, ` +
+            `${result.tempFilesRemoved} temp dirs removed ` +
+            `(${result.duration}ms)`,
+        );
+      })
+      .catch((err: unknown) => {
+        this.logger.error('Cold-start GC failed', err instanceof Error ? err.stack : String(err));
+      });
+  }
+
   /**
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
@@ -48,20 +79,86 @@ export class SessionGCService {
     const result: GCResult = { sessionId, cleaned: {} };
 
     // 1. Valkey: delete all session-scoped keys
-    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
+    const pattern = `mosaic:session:${sessionId}:*`;
     const valkeyKeys = await this.scanKeys(pattern);
     if (valkeyKeys.length > 0) {
       await this.redis.del(...valkeyKeys);
       result.cleaned.valkeyKeys = valkeyKeys.length;
     }
 
-    // 2. PG: demote hot-tier agent logs for this session only.
+    // 2. PG: demote hot-tier agent_logs for this session to warm
-    const cutoff = new Date();
+    const cutoff = new Date(); // demote all hot logs for this session
-    const logsDemoted = await this.logService.logs.promoteSessionToWarm(sessionId, cutoff);
+    const logsDemoted = await this.logService.logs.promoteToWarm(cutoff);
     if (logsDemoted > 0) {
       result.cleaned.logsDemoted = logsDemoted;
     }
 
     return result;
   }
+
+  /**
+   * Sweep GC — find orphaned artifacts from dead sessions.
+   * System-wide operation: only call from admin-authorized paths or internal
+   * scheduled jobs.  Individual session cleanup is handled by collect().
+   */
+  async sweepOrphans(): Promise<GCSweepResult> {
+    const start = Date.now();
+    const cleaned: GCResult[] = [];
+
+    // 1. Find all session-scoped Valkey keys (non-blocking SCAN)
+    const allSessionKeys = await this.scanKeys('mosaic:session:*');
+
+    // Extract unique session IDs from keys
+    const sessionIds = new Set<string>();
+    for (const key of allSessionKeys) {
+      const match = key.match(/^mosaic:session:([^:]+):/);
+      if (match) sessionIds.add(match[1]!);
+    }
+
+    // 2. For each session ID, collect stale keys
+    for (const sessionId of sessionIds) {
+      const gcResult = await this.collect(sessionId);
+      if (Object.keys(gcResult.cleaned).length > 0) {
+        cleaned.push(gcResult);
+      }
+    }
+
+    return {
+      orphanedSessions: cleaned.length,
+      totalCleaned: cleaned,
+      duration: Date.now() - start,
+    };
+  }
+
+  /**
+   * Full GC — aggressive collection for cold start.
+   * Assumes no sessions survived the restart.
+   */
+  async fullCollect(): Promise<FullGCResult> {
+    const start = Date.now();
+
+    // 1. Valkey: delete ALL session-scoped keys (non-blocking SCAN)
+    const sessionKeys = await this.scanKeys('mosaic:session:*');
+    if (sessionKeys.length > 0) {
+      await this.redis.del(...sessionKeys);
+    }
+
+    // 2. NOTE: channel keys are NOT collected on cold start
+    //    (discord/telegram plugins may reconnect and resume)
+
+    // 3. PG: demote stale hot-tier logs older than 24h to warm
+    const hotCutoff = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const logsDemoted = await this.logService.logs.promoteToWarm(hotCutoff);
+
+    // 4. No summarization job purge API available yet
+    const jobsPurged = 0;
+
+    return {
+      valkeyKeys: sessionKeys.length,
+      logsDemoted,
+      jobsPurged,
+      tempFilesRemoved: 0,
+      duration: Date.now() - start,
+    };
+  }
 }

apps/gateway/src/health/health.controller.test.ts

@@ -1,12 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { HealthController } from './health.controller.js';
-
-describe('HealthController', (): void => {
-  it('exposes liveness and readiness without configuration details', (): void => {
-    const controller = new HealthController();
-
-    expect(controller.check()).toEqual({ status: 'ok' });
-    expect(controller.ready()).toEqual({ status: 'ready' });
-    expect(JSON.stringify(controller.ready())).not.toContain('credential');
-  });
-});

apps/gateway/src/health/health.controller.ts

@@ -6,10 +6,4 @@ export class HealthController {
   check(): { status: string } {
     return { status: 'ok' };
   }
-
-  /** Readiness intentionally exposes no configuration, provider, or credential details. */
-  @Get('ready')
-  ready(): { status: string } {
-    return { status: 'ready' };
-  }
 }

apps/gateway/src/log/cron.service.ts

@@ -6,10 +6,11 @@ import {
   type OnModuleDestroy,
 } from '@nestjs/common';
 import { SummarizationService } from './summarization.service.js';
+import { SessionGCService } from '../gc/session-gc.service.js';
 import {
   QueueService,
-  QUEUE_GC,
   QUEUE_SUMMARIZATION,
+  QUEUE_GC,
   QUEUE_TIER_MANAGEMENT,
 } from '../queue/queue.service.js';
 import type { Worker } from 'bullmq';
@@ -22,12 +23,14 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
 
   constructor(
     @Inject(SummarizationService) private readonly summarization: SummarizationService,
+    @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
     @Inject(QueueService) private readonly queueService: QueueService,
   ) {}
 
   async onModuleInit(): Promise<void> {
     const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
     const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
+    const gcSchedule = process.env['SESSION_GC_CRON'] ?? '0 4 * * *'; // daily at 4am
 
     // M6-003: Summarization repeatable job
     await this.queueService.addRepeatableJob(
@@ -53,12 +56,15 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     });
     this.registeredWorkers.push(tierWorker);
 
-    // Retire any repeatable global GC schedule created by older deployments.
+    // M6-004: GC repeatable job
-    // Session cleanup is now triggered only by an authorized session lifecycle operation.
+    await this.queueService.addRepeatableJob(QUEUE_GC, 'session-gc', {}, gcSchedule);
-    await this.queueService.removeRepeatableJobs(QUEUE_GC, 'session-gc');
+    const gcWorker = this.queueService.registerWorker(QUEUE_GC, async () => {
+      await this.sessionGC.sweepOrphans();
+    });
+    this.registeredWorkers.push(gcWorker);
 
     this.logger.log(
-      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}"`,
+      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}", gc="${gcSchedule}"`,
     );
   }
 

apps/gateway/src/memory/memory.module.ts

@@ -3,10 +3,8 @@ import {
   createMemory,
   type Memory,
   createMemoryAdapter,
-  createOperatorMemoryPlugin,
   type MemoryAdapter,
   type MemoryConfig,
-  type OperatorMemoryPlugin,
 } from '@mosaicstack/memory';
 import type { Db } from '@mosaicstack/db';
 import type { StorageAdapter } from '@mosaicstack/storage';
@@ -16,9 +14,6 @@ import { DB, STORAGE_ADAPTER } from '../database/database.module.js';
 import { MEMORY } from './memory.tokens.js';
 import { MemoryController } from './memory.controller.js';
 import { EmbeddingService } from './embedding.service.js';
-import { redactSensitiveContent } from '@mosaicstack/log';
-
-export const OPERATOR_MEMORY_PLUGIN = 'OPERATOR_MEMORY_PLUGIN';
 
 export const MEMORY_ADAPTER = 'MEMORY_ADAPTER';
 
@@ -43,24 +38,9 @@ function buildMemoryConfig(config: MosaicConfig, storageAdapter: StorageAdapter)
         createMemoryAdapter(buildMemoryConfig(config, storageAdapter)),
       inject: [MOSAIC_CONFIG, STORAGE_ADAPTER],
     },
-    {
-      provide: OPERATOR_MEMORY_PLUGIN,
-      useFactory: (adapter: MemoryAdapter): OperatorMemoryPlugin | null => {
-        const instanceId = process.env['MOSAIC_OPERATOR_MEMORY_INSTANCE_ID']?.trim();
-        const namespace = process.env['MOSAIC_OPERATOR_MEMORY_NAMESPACE']?.trim();
-        if (!instanceId || !namespace) return null;
-        return createOperatorMemoryPlugin({
-          adapter,
-          instanceId,
-          namespace,
-          redact: (content) => redactSensitiveContent(content).content,
-        });
-      },
-      inject: [MEMORY_ADAPTER],
-    },
     EmbeddingService,
   ],
   controllers: [MemoryController],
-  exports: [MEMORY, MEMORY_ADAPTER, OPERATOR_MEMORY_PLUGIN, EmbeddingService],
+  exports: [MEMORY, MEMORY_ADAPTER, EmbeddingService],
 })
 export class MemoryModule {}

apps/gateway/src/plugin/discord-ingress.security.spec.ts

@@ -1,141 +1,13 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import {
   createDiscordIngressEnvelope,
   verifyDiscordIngressEnvelope,
-  DiscordPlugin,
   type DiscordIngressPayload,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
 } from '@mosaicstack/discord-plugin';
-import { RuntimeProviderService } from '../agent/runtime-provider-registry.service.js';
-import { ChatGateway } from '../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { validateDiscordServiceToken } from '../chat/chat.gateway-auth.js';
 import { DiscordReplayProtector } from './discord-replay-protector.js';
 
 const SERVICE_TOKEN = 'test-service-token';
-const ENV_KEYS = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_USER_ID',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-  'MOSAIC_AGENT_CONFIG_ID',
-] as const;
-const savedEnv = new Map<string, string | undefined>();
-
-function configureDiscordEnv(role: 'admin' | 'member' = 'admin'): void {
-  for (const key of ENV_KEYS) savedEnv.set(key, process.env[key]);
-  process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-  process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
-  process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-discord';
-  process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-  process.env['MOSAIC_AGENT_CONFIG_ID'] = 'agent-config-nova';
-  process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-001';
-  process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
-  process.env['DISCORD_ALLOWED_USER_IDS'] = 'user-001';
-  process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-    {
-      instanceId: 'Nova',
-      agentConfigId: 'agent-config-nova',
-      guildId: 'guild-001',
-      channelId: 'channel-001',
-      pairedUsers: {
-        'user-001': {
-          role: role === 'admin' ? 'admin' : 'operator',
-          mosaicUserId: 'mosaic-admin-001',
-        },
-      },
-    },
-  ]);
-}
-
-afterEach((): void => {
-  for (const key of ENV_KEYS) {
-    const value = savedEnv.get(key);
-    if (value === undefined) delete process.env[key];
-    else process.env[key] = value;
-  }
-  savedEnv.clear();
-});
-
-function commandAuthorization(role: 'admin' | 'member'): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => entries.set(key, value),
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-function discordGateway(role: 'admin' | 'member'): {
-  gateway: ChatGateway;
-  client: { data: { discordService: boolean }; emit: ReturnType<typeof vi.fn> };
-  consumedActions: Array<{ actorId: string; correlationId: string }>;
-  durable: { getSnapshot: ReturnType<typeof vi.fn> };
-  audit: { record: ReturnType<typeof vi.fn> };
-} {
-  const authorization = commandAuthorization(role);
-  const consumedActions: Array<{ actorId: string; correlationId: string }> = [];
-  const durable = {
-    getSnapshot: vi.fn().mockResolvedValue({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    }),
-  };
-  const audit = { record: vi.fn().mockResolvedValue(undefined) };
-  const runtimeRegistry = new RuntimeProviderService(
-    {
-      require: () => ({
-        capabilities: async () => ({ supported: ['session.terminate'] }),
-        terminate: async () => undefined,
-      }),
-    } as never,
-    { record: async () => undefined } as never,
-    {
-      consume: async (approvalId, action) => {
-        consumedActions.push({ actorId: action.actorId, correlationId: action.correlationId });
-        return authorization.consumeRuntimeTerminationApproval(approvalId, action);
-      },
-    },
-  );
-  return {
-    gateway: new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authorization,
-      runtimeRegistry,
-      durable as never,
-      audit as never,
-    ),
-    client: { data: { discordService: true }, emit: vi.fn() },
-    consumedActions,
-    durable,
-    audit,
-  };
-}
-
-function ingressEnvelope(
-  content: string,
-  messageId: string,
-  overrides: Partial<DiscordIngressPayload> = {},
-): ReturnType<typeof createDiscordIngressEnvelope> {
-  return createDiscordIngressEnvelope(
-    createPayload({ content, messageId, ...overrides }),
-    SERVICE_TOKEN,
-  );
-}
 
 function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordIngressPayload {
   return {
@@ -144,51 +16,13 @@ function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordI
     guildId: 'guild-001',
     channelId: 'channel-001',
     userId: 'user-001',
-    conversationId: 'Nova:discord:channel-001',
+    conversationId: 'discord-channel-001',
     content: 'hello Tess',
     ...overrides,
   };
 }
 
 describe('Discord ingress security', () => {
-  it('keeps legacy role-only bindings valid while withholding privileged actor identity', () => {
-    const [binding] = parseDiscordInteractionBindings(
-      JSON.stringify([
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': 'admin' },
-        },
-      ]),
-    );
-    expect(
-      resolveDiscordInteractionBinding([binding!], 'guild-001', 'channel-001', 'user-001', 'send'),
-    ).toEqual(binding);
-    expect(resolveDiscordInteractionActorId(binding!, 'user-001')).toBeNull();
-  });
-
-  it('binds a differently named configured interaction instance without code changes', () => {
-    const binding = resolveDiscordInteractionBinding(
-      [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-      'guild-001',
-      'channel-001',
-      'user-001',
-      'send',
-    );
-
-    expect(binding?.instanceId).toBe('Nova');
-  });
-
   it('accepts only the configured Discord service identity', () => {
     expect(validateDiscordServiceToken(SERVICE_TOKEN, SERVICE_TOKEN)).toBe(true);
     expect(validateDiscordServiceToken('wrong-service-token', SERVICE_TOKEN)).toBe(false);
@@ -252,464 +86,4 @@ describe('Discord ingress security', () => {
     expect(replayProtector.claim('discord-message-003')).toBe(true);
     expect(replayProtector.size).toBe(2);
   });
-
-  it('consumes the exact target once when approval and stop are separate Discord messages', async () => {
-    configureDiscordEnv();
-    const { gateway, client, consumedActions } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'approve-message', {
-        correlationId: 'approval-ingress-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'stop-message', {
-        correlationId: 'stop-ingress-correlation',
-      }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'stop-ingress-correlation',
-      success: true,
-    });
-    expect(consumedActions).toEqual([
-      {
-        actorId: 'mosaic-admin-001',
-        correlationId: expect.stringMatching(/^discord-action:v1:/),
-      },
-    ]);
-  });
-
-  it('audits a Discord mint-side authorization denial', async () => {
-    configureDiscordEnv();
-    const { gateway, client, audit } = discordGateway('member');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'denied-approve'),
-    );
-
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-    expect(audit.record).toHaveBeenCalledWith(
-      expect.objectContaining({
-        outcome: 'denied',
-        operation: 'session.terminate',
-        errorCode: 'policy_denied',
-      }),
-    );
-  });
-
-  it('rejects approval when the durable session targets a different logical agent', async () => {
-    configureDiscordEnv();
-    const { gateway, client, durable } = discordGateway('admin');
-    durable.getSnapshot.mockResolvedValueOnce({
-      identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    });
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'mismatched-agent-approve'),
-    );
-
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-  });
-
-  it('rejects privileged envelopes with a forged current conversation route', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'forged-approval-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
-    );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'forged-stop-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('discord:approval', expect.anything());
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
-
-  it('rejects unpaired and non-admin Discord users for approval and stop', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('member');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'member-approve'),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([]);
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'unpaired-stop'),
-    );
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
-
-  it('rejects replaying a Discord-created termination approval', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'replay-approve', {
-        correlationId: 'replay-approval-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-    };
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-one', {
-        correlationId: 'replay-stop-correlation-one',
-      }),
-    );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-two', {
-        correlationId: 'replay-stop-correlation-two',
-      }),
-    );
-    const stopResults = client.emit.mock.calls.filter(([event]) => event === 'discord:stop');
-    expect(stopResults.map(([, result]) => (result as { success: boolean }).success)).toEqual([
-      true,
-      false,
-    ]);
-  });
-
-  it.each([
-    'https://user:password@cdn.example.test/diagram.png',
-    'https://cdn.example.test/diagram.png?token=secret',
-    'https://cdn.example.test/diagram.png?X-Amz-Signature=secret',
-    'https://cdn.example.test/diagram.png?auth=secret',
-    'https://cdn.example.test/diagram.png?hm=secret',
-  ])('rejects credential-bearing attachment URLs before gateway dispatch', async (url) => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', `credential-url-${url.length}`, {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [
-          { id: 'attachment-credential', name: 'diagram.png', url, contentType: 'image/png' },
-        ],
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it("selects each binding's trusted logical-agent config when creating Discord sessions", async () => {
-    configureDiscordEnv();
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001,channel-002';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
-        guildId: 'guild-001',
-        channelId: 'channel-001',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-      {
-        instanceId: 'Orion',
-        agentConfigId: 'agent-config-orion',
-        guildId: 'guild-001',
-        channelId: 'channel-002',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-    ]);
-    const session = {
-      provider: 'configured-provider',
-      modelId: 'configured-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const createSession = vi.fn().mockResolvedValue(session);
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(undefined),
-      createSession,
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt: vi.fn().mockResolvedValue(undefined),
-    };
-    const brain = {
-      agents: {
-        findById: vi.fn((id: string) =>
-          Promise.resolve({
-            id,
-            name: id === 'agent-config-orion' ? 'Orion' : 'Nova',
-          }),
-        ),
-      },
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        findMessages: vi.fn().mockResolvedValue([]),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const routingEngine = { resolve: vi.fn() };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      routingEngine as never,
-    );
-    const client = {
-      id: 'discord-client-new-session',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start configured session', 'configured-session-001', {
-        conversationId: 'Nova:discord:channel-001',
-      }),
-    );
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start second configured session', 'configured-session-002', {
-        channelId: 'channel-002',
-        conversationId: 'Orion:discord:channel-002',
-      }),
-    );
-
-    expect(createSession).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      expect.objectContaining({
-        agentConfigId: 'agent-config-nova',
-        userId: 'discord-service',
-        tenantId: 'tenant-discord',
-      }),
-    );
-    expect(createSession).toHaveBeenCalledWith(
-      'Orion:discord:channel-002',
-      expect.objectContaining({ agentConfigId: 'agent-config-orion' }),
-    );
-    expect(routingEngine.resolve).not.toHaveBeenCalled();
-  });
-
-  it('retains validated persisted attachments in resumed conversation history', async () => {
-    const attachment = {
-      id: 'attachment-history',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      mimeType: 'image/png',
-      sizeBytes: 4_096,
-    };
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {
-        conversations: {
-          findMessages: vi.fn().mockResolvedValue([
-            {
-              role: 'user',
-              content: '',
-              createdAt: new Date('2026-07-14T12:00:00.000Z'),
-              metadata: { channelAttachments: [attachment] },
-            },
-          ]),
-        },
-      } as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    ) as unknown as {
-      loadConversationHistory(
-        conversationId: string,
-        userId: string,
-      ): Promise<Array<{ attachments?: readonly (typeof attachment)[] }>>;
-    };
-
-    await expect(
-      gateway.loadConversationHistory('Nova:discord:channel-001', 'discord-service'),
-    ).resolves.toEqual([expect.objectContaining({ attachments: [attachment] })]);
-  });
-
-  it('rejects malformed signed attachment payloads before gateway dispatch', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    const malformedPayload: Record<string, unknown> = {
-      ...createPayload({
-        messageId: 'malformed-attachments-001',
-        conversationId: 'Nova:discord:channel-001',
-      }),
-      attachments: { id: 'not-an-array' },
-    };
-    const envelope = createDiscordIngressEnvelope(
-      malformedPayload as unknown as DiscordIngressPayload,
-      SERVICE_TOKEN,
-    );
-
-    await gateway.handleMessage(client as never, envelope);
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it('preserves authenticated attachment metadata through persistence and agent dispatch', async () => {
-    configureDiscordEnv();
-    const prompt = vi.fn().mockResolvedValue(undefined);
-    const addMessage = vi.fn().mockResolvedValue(undefined);
-    const session = {
-      provider: 'test-provider',
-      modelId: 'test-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(session),
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt,
-    };
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage,
-      },
-    };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    );
-    const client = {
-      id: 'discord-client-001',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-    const attachment = {
-      id: 'attachment-001',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      contentType: 'image/png',
-      sizeBytes: 4_096,
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', 'attachment-message-001', {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [attachment],
-      }),
-    );
-
-    const expectedAttachment = {
-      id: attachment.id,
-      name: attachment.name,
-      url: attachment.url,
-      mimeType: attachment.contentType,
-      sizeBytes: attachment.sizeBytes,
-    };
-    expect(prompt).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      '',
-      { userId: 'discord-service', tenantId: 'tenant-discord' },
-      [expectedAttachment],
-    );
-    expect(addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        conversationId: 'Nova:discord:channel-001',
-        metadata: expect.objectContaining({ channelAttachments: [expectedAttachment] }),
-      }),
-      'discord-service',
-    );
-  });
-
-  it('accepts a thread message through its allowed bound parent channel', () => {
-    const emitted = vi.fn();
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-001'],
-      allowedChannelIds: ['channel-001'],
-      allowedUserIds: ['user-001'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-    });
-    const internals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    internals.client = { user: { id: 'bot-001' } };
-    internals.socket = { connected: true, emit: emitted };
-    internals.handleDiscordMessage({
-      id: 'thread-message',
-      guildId: 'guild-001',
-      channelId: 'thread-001',
-      author: { id: 'user-001', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-001> hello from thread',
-      channel: { parentId: 'channel-001' },
-      attachments: new Map(),
-    });
-
-    const [, envelope] = emitted.mock.calls[0] as [
-      string,
-      ReturnType<typeof createDiscordIngressEnvelope>,
-    ];
-    expect(verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN)?.channelId).toBe('channel-001');
-  });
 });

apps/gateway/src/plugin/plugin.module.ts

@@ -6,7 +6,7 @@ import {
   type OnModuleDestroy,
   type OnModuleInit,
 } from '@nestjs/common';
-import { DiscordPlugin, parseDiscordInteractionBindings } from '@mosaicstack/discord-plugin';
+import { DiscordPlugin } from '@mosaicstack/discord-plugin';
 import { TelegramPlugin } from '@mosaicstack/telegram-plugin';
 import { PluginService } from './plugin.service.js';
 import type { IChannelPlugin } from './plugin.interface.js';
@@ -61,16 +61,6 @@ function requiredDiscordAllowlist(name: string): string[] {
   return value;
 }
 
-function optionalPositiveInteger(name: string): number | undefined {
-  const raw = process.env[name];
-  if (raw === undefined) return undefined;
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value <= 0) {
-    throw new Error(`${name} must be a positive integer when configured`);
-  }
-  return value;
-}
-
 function createPluginRegistry(): IChannelPlugin[] {
   const plugins: IChannelPlugin[] = [];
   const discordToken = process.env['DISCORD_BOT_TOKEN'];
@@ -92,16 +82,9 @@ function createPluginRegistry(): IChannelPlugin[] {
           guildId: discordGuildId,
           gatewayUrl: discordGatewayUrl,
           serviceToken: discordServiceToken,
-          messageRateLimitPerMinute: optionalPositiveInteger(
-            'DISCORD_MESSAGE_RATE_LIMIT_PER_MINUTE',
-          ),
-          threadRateLimitPerMinute: optionalPositiveInteger('DISCORD_THREAD_RATE_LIMIT_PER_MINUTE'),
           allowedGuildIds: requiredDiscordAllowlist('DISCORD_ALLOWED_GUILD_IDS'),
           allowedChannelIds: requiredDiscordAllowlist('DISCORD_ALLOWED_CHANNEL_IDS'),
           allowedUserIds: requiredDiscordAllowlist('DISCORD_ALLOWED_USER_IDS'),
-          interactionBindings: parseDiscordInteractionBindings(
-            process.env['DISCORD_INTERACTION_BINDINGS'],
-          ),
         }),
       ),
     );

apps/gateway/src/queue/queue.service.ts

@@ -162,23 +162,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
     );
   }
 
-  /**
-   * Remove every existing repeatable schedule for a job name. This supports
-   * safe retirement of previously registered system-wide jobs.
-   */
-  async removeRepeatableJobs(queueName: string, jobName: string): Promise<number> {
-    const queue = this.getQueue(queueName);
-    const jobs = await queue.getRepeatableJobs();
-    const matchingJobs = jobs.filter((job) => job.name === jobName);
-    await Promise.all(matchingJobs.map((job) => queue.removeRepeatableByKey(job.key)));
-    if (matchingJobs.length > 0) {
-      this.logger.log(
-        `Removed ${matchingJobs.length} repeatable "${jobName}" job(s) from "${queueName}"`,
-      );
-    }
-    return matchingJobs.length;
-  }
-
   /**
    * Register a Worker for the given queue name with error handling and
    * exponential backoff.

docs/MISSION-MANIFEST.md

@@ -10,9 +10,9 @@
 **Statement:** Ship a self-hosted, multi-user AI agent platform that consolidates the user's disparate jarvis-brain usage across home and USC workstations into a single coherent system reachable via three first-class surfaces — webUI, TUI, and CLI — with federation as the data-layer mechanism that makes cross-host agent sessions work in real time without copying user data across the boundary.
 **Phase:** Execution (workstream W1 in planning-complete state)
 **Current Workstream:** W1 — Federation v1
-**Progress:** 0 / 3 declared workstreams complete (more workstreams will be declared as scope is refined)
+**Progress:** 0 / 1 declared workstreams complete (more workstreams will be declared as scope is refined)
 **Status:** active (continuous since 2026-03-13)
-**Last Updated:** 2026-07-14 (W3 Native Kanban/SOT canon independently approved under issue #751)
+**Last Updated:** 2026-04-19 (manifest authored at the rollup level; install-ux-v2 archived; W1 federation planning landed via PR #468)
 **Source PRD:** [docs/PRD.md](./PRD.md) — Mosaic Stack v0.1.0
 **Scratchpad:** [docs/scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md) (active since 2026-03-13; 14 prior sessions of phase-based execution)
 
@@ -67,12 +67,11 @@ The MVP is complete when ALL declared workstreams are complete AND every cross-c
 
 ## Workstreams
 
-| #   | ID   | Name                                        | Status            | Manifest                                                                              | Notes                                                    |
+| #   | ID   | Name                                        | Status            | Manifest                                                                | Notes                                               |
-| --- | ---- | ------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------- |
+| --- | ---- | ------------------------------------------- | ----------------- | ----------------------------------------------------------------------- | --------------------------------------------------- |
-| W1  | FED  | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md)               | 7 milestones, ~175K tokens, issues #460–#466 filed       |
+| W1  | FED  | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md) | 7 milestones, ~175K tokens, issues #460–#466 filed  |
-| W2  | TESS | Tess interaction agent                      | planning-complete | [docs/tess/MISSION-MANIFEST.md](./tess/MISSION-MANIFEST.md)                           | 5 milestones; issue #706; M1 issue #707 ready            |
+| W2  | TESS | Tess interaction agent                      | planning-complete | [docs/tess/MISSION-MANIFEST.md](./tess/MISSION-MANIFEST.md)             | 5 milestones; issue #706; M1 issue #707 ready       |
-| W3  | KBN  | Native Kanban and canonical task SOT        | planning-complete | [docs/native-kanban-sot/MISSION-MANIFEST.md](./native-kanban-sot/MISSION-MANIFEST.md) | P0–P3; issue #751; implementation held until canon merge |
+| W3+ | TBD  | (additional workstreams declared as scoped) | —                 | —                                                                       | Scope creep is expected and explicitly accommodated |
-| W4+ | TBD  | (additional workstreams declared as scoped) | —                 | —                                                                                     | Scope creep is expected and explicitly accommodated      |
 
 ### Likely Additional Workstreams (Not Yet Declared)
 

docs/PERFORMANCE.md

@@ -149,9 +149,15 @@ for any `<Image>` components added in the future.
 
 ---
 
-## Held future procedure
+## How to Apply
 
-This report is non-operative evidence, not a current runbook. Until **KBN-101-00, KBN-101-03, and KBN-101-05** land, do not execute a PostgreSQL runner from this checkout. The approved future procedure is exactly: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Deployment will supply the reviewed runner, migration-only credentials, and TLS material; Gateway startup only verifies readiness.
+```bash
+# Run the DB migration (requires a live DB)
+pnpm --filter @mosaicstack/db exec drizzle-kit migrate
+
+# Or, in Docker/Swarm — migrations run automatically on gateway startup
+# via runMigrations() in packages/db/src/migrate.ts
+```
 
 ---
 

docs/PRD.md

@@ -79,151 +79,6 @@ Jarvis (v0.2.0) is a self-hosted AI assistant with a Python FastAPI backend and
 
 ---
 
-## Fleet Declarative Configuration Management Workstream (FCM, #758)
-
-### Problem and objective
-
-The local Mosaic fleet has a roster, generated agent environment files, user-systemd units, tmux
-sessions, heartbeat files, examples, profiles, and separate gateway-backed agent records. These
-planes have drifted and are not one safe operator lifecycle. The objective is one **local fleet
-roster** as the desired-state SSOT, with generated environment, systemd, tmux, and heartbeat
-artifacts as rebuildable projections; it does not merge the local fleet control plane with the
-gateway-backed agent catalog.
-
-### Normative requirements
-
-| ID           | Requirement                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `FCM-REQ-01` | The roster SHALL be the sole writable desired-state source for local fleet membership, launch policy, and persisted lifecycle target. Generated environment files, systemd enablement, tmux sessions, and heartbeat state SHALL be non-authoritative projections.                                                                                                                                                                                                         |
-| `FCM-REQ-02` | The implementation SHALL provide one executable structural contract for YAML/JSON input and one shared semantic validator. Roster load, profile validation, provision, migration, and apply SHALL reuse the existing baseline-plus-`roles.local` profile/persona resolver; a parallel role resolver is forbidden.                                                                                                                                                         |
-| `FCM-REQ-03` | The local fleet CLI SHALL expose documented programmatic validate, show, plan, apply/reconcile, create, inspect, update, delete, start, stop, restart, status, verify, and doctor operations with stable JSON and exit-code behavior. Existing `fleet add/remove` compatibility aliases may remain during the stated deprecation window.                                                                                                                                  |
-| `FCM-REQ-04` | A fresh create SHALL persist `enabled:true` and `desired_state:stopped` unless an explicit persisted start is requested. The model SHALL distinguish enabled state, persisted desired state, and observed state. Migration, apply, reboot, and rollback SHALL not start an agent that was observed stopped before cutover.                                                                                                                                                |
-| `FCM-REQ-05` | The launch chain SHALL consume deterministic, digest-stamped generated input only. Optional local overrides SHALL be parsed as strict data, may not shadow authoritative generated keys, and may not contain arbitrary commands, credential values, channels, or unknown `MOSAIC_AGENT_*` keys. Forbidden legacy keys, including `MOSAIC_AGENT_COMMAND`, SHALL be privately quarantined before launch and reported only by key name and content hash.                     |
-| `FCM-REQ-06` | Mutations and apply SHALL validate before mutation, use an expected generation/lock, write projections atomically, produce a deterministic plan, and emit recovery information on partial failure. Reconciliation SHALL act only on local, enabled, roster-owned projections and SHALL not kill unmanaged tmux sessions by fuzzy name.                                                                                                                                    |
-| `FCM-REQ-07` | Canonical required classes are `code`, `review`, `validator`, `orchestrator`, `team-leader`, `enhancer`, and `interaction`. `validator` issues an independent final certificate but has no merge authority; `merge-gate` remains sole approve-to-land/merge authority. Team-leader capacity is bounded by an orchestrator-issued lease, and interaction is request/status only. Tess and Ultron are configurable instance/display names, not required machine identities. |
-| `FCM-REQ-08` | v1 migration SHALL be field-complete, reversible, and explicit about aliases, unresolved classes, lifecycle inference, generated-file regeneration, local override quarantine, schema-only remote/connector fields, and rollback. Every shipped example, profile, and service preset SHALL be migrated and executable, retained as an explicitly versioned v1 fixture, or retired with a replacement and deprecation note.                                                |
-| `FCM-REQ-09` | M1–M5 SHALL remain local tmux/systemd control-plane work. Remote/SSH reconciliation, connector mutation, secret references, arbitrary command/channel overrides, gateway/API convergence, and UI configuration storage are excluded and require a separate PRD/threat model.                                                                                                                                                                                              |
-| `FCM-REQ-10` | Documentation and examples are delivery gates. The M0 checklist at [docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) and the baseline disposition inventory at [docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md) SHALL be maintained as acceptance evidence.                                                                                                  |
-
-### Acceptance criteria
-
-1. `AC-FCM-01`: A valid local v2 roster can be parsed from YAML or JSON, validated structurally and semantically through the shared resolver, and rendered canonically; invalid fields, duplicate names, unresolved classes, unsupported runtime/model combinations, socket ambiguity, and incompatible options fail closed.
-2. `AC-FCM-02`: `plan` reports deterministic desired-versus-observed differences for roster, generated environment, systemd enablement, tmux/session, heartbeat, installed-asset revision, and provable orphans without mutation; `apply --check` reports drift without mutation.
-3. `AC-FCM-03`: Local create/update/delete is generation-guarded, atomic, idempotent, and safe by default; it permits supported runtime/model/harness/effort/workdir/role changes without direct editing of generated environment files and does not start a newly created agent unless explicitly persisted.
-4. `AC-FCM-04`: The generated-env/local-override launch chain rejects generated-key shadowing, arbitrary command override, unknown keys, shell evaluation, and sensitive-value diagnostics before any agent starts; known-safe legacy input is regenerated or strictly relocated, and forbidden input is quarantined.
-5. `AC-FCM-05`: Local lifecycle reconciliation implements the persisted/transient start-stop rules, exact default/named tmux socket targeting, systemd/tmux status, stale generated state, unmanaged-session reporting, and rollback without surprise restarts or fuzzy destructive targeting.
-6. `AC-FCM-06`: A v1 roster migration previews field-by-field disposition, preserves observed stopped/running state, inventories rather than reconciles remote/schema-only entries, supports a canary and rollback, and classifies every shipped example, profile, and service preset according to the M0 inventory.
-7. `AC-FCM-07`: Required role authority is validated: validator certificate is consumed but does not merge, merge-gate is the sole merge authority, team-leader leases do not change roster/credentials/authority, and interaction/Tess cannot claim orchestration or merge powers.
-8. `AC-FCM-08`: Documentation, examples, migration, troubleshooting, operational recovery, package/update asset drift, schema/example/profile validation, independent code/security review, validator certificate, and terminal-green CI are complete before #758 closes.
-
-### M0 implementation gate
-
-No source, schema, role, example, profile, systemd, or live-fleet change is authorized before M0
-lands. M0 consists only of these normative requirements, the complete task DAG, the scoped
-documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
-are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
-
----
-
-## Exact Cross-Harness Fleet Communications Contract (#766)
-
-### Problem and objective
-
-Fleet runtime contracts currently combine exact peer rows with generic operational metavariables and
-independently parsed roster data. Non-Claude harnesses can mistake those metavariables for values to
-infer, producing incorrect host, session, socket, or helper targets. The objective is one
-roster-resolved communications contract that every supported harness receives unchanged.
-
-### Normative requirements
-
-1. `FCOM-REQ-01`: Fleet commands and runtime composition SHALL use one shared v1 roster structural
-   resolver. A second lenient communications parser is forbidden.
-2. `FCOM-REQ-02`: The composed contract SHALL render the local roster member's authoritative host,
-   exact agent/session name, resolved tmux socket, exact helper path, and deterministic communications
-   generation.
-3. `FCOM-REQ-03`: Every known peer SHALL have one exact executable command. Same-host commands SHALL
-   omit `-H`; cross-host commands SHALL use only that peer's explicit roster `ssh` target; the one
-   supported fleet-wide named socket SHALL use `-L` with its exact value. A per-agent socket declaration
-   must equal that fleet-wide value; unsupported independent sockets and missing cross-host SSH data SHALL
-   fail closed.
-4. `FCOM-REQ-04`: Operational fleet examples SHALL not contain unresolved host, session, socket, or
-   helper-path metavariables. Agents SHALL select an exact rendered peer row and SHALL NOT infer,
-   substitute, or fuzzy-match targeting values.
-5. `FCOM-REQ-05`: An unknown local member or requested peer SHALL fail closed with exact-name discovery
-   guidance. Runtime composition SHALL not silently omit a requested fleet member's communications
-   contract.
-6. `FCOM-REQ-06`: Claude Code, Codex, OpenCode, and Pi SHALL receive equivalent authoritative
-   communications data through the common runtime composer.
-7. `FCOM-REQ-07`: Tests SHALL prove the contract from framework-source `TOOLS.md`, through a fresh
-   installed `TOOLS.md`, to final runtime composition and helper executability. User-owned installed
-   `TOOLS.md` content SHALL remain preserved.
-8. `FCOM-REQ-08`: Stale installed or active composed context SHALL be reported with deterministic
-   generation/repair/relaunch guidance. Currency requires the expected source and installed contract
-   marker/version plus bounded byte equality. The supported current-version repair SHALL run independently
-   of package updates, preserve divergent `TOOLS.md` bytes in a digest-qualified no-clobber backup, restore
-   a regular executable helper without following symlinks, and be idempotent. Detection and reporting SHALL
-   NOT rewrite active context, restart a session, or mutate a live fleet.
-9. `FCOM-REQ-09`: The shared resolver SHALL preserve and strictly validate every schema-supported v1
-   connector kind (`tmux`, `discord`, and `matrix`) from YAML and JSON. Every accepted snake/camel alias
-   pair SHALL reject differing dual declarations and accept identical declarations. JSON roster fallback
-   SHALL occur only when `roster.yaml` is absent; all other YAML access failures SHALL fail closed.
-10. `FCOM-REQ-10`: The communications generation SHALL cover the complete canonical rendered semantic
-    contract, including identity, role/class, resolved host/socket/helper, peer metadata, and exact commands.
-    Installed helpers SHALL be validated with no-follow filesystem inspection as regular executable files.
-    Keep-mode reseed and relaunch discovery SHALL preserve and support both YAML and JSON rosters.
-
-### Acceptance criteria
-
-1. `AC-FCOM-01`: Contract fixtures contain no unresolved operational targeting metavariables; local
-   identity contains exact host/session/socket/helper values.
-2. `AC-FCOM-02`: Same-host, cross-host, named-socket, literal-default-socket, and missing-SSH tests prove
-   exact targeting and fail-closed behavior.
-3. `AC-FCOM-03`: Unknown identities and peers report known exact names plus an exact self-scoped
-   discovery command; no fuzzy session selection is emitted.
-4. `AC-FCOM-04`: Four-harness tests prove byte-equal authoritative communications sections.
-5. `AC-FCOM-05`: Source, fresh-install, preserved-custom-install, stale-installed, composed-generation,
-   helper executable, agent-send socket isolation, and exact-target tests pass.
-6. `AC-FCOM-06`: Documentation defines non-mutating stale-context detection and operator-authorized,
-   exact-agent relaunch; no implementation path performs automatic session mutation.
-7. `AC-FCOM-07`: YAML and JSON fixtures cover every connector kind; all snake/camel aliases cover
-   identical acceptance and conflicting rejection; non-`ENOENT` YAML failures do not fall back.
-8. `AC-FCOM-08`: Missing, directory, symlink, and non-executable installed helpers fail closed. Explicit
-   current-version repair proves partial-deletion recovery, digest-qualified backup collision safety,
-   symlink-target safety, and repeated-run idempotence.
-9. `AC-FCOM-09`: Markerless-equal and wrong-version source/installed contracts are stale, and a rendered
-   role/class change produces a different communications generation.
-
----
-
-## KBN-101 Database Runtime/Migration Role Split (#771)
-
-### Problem and objective
-
-PostgreSQL Gateway/storage currently uses one `DATABASE_URL` for runtime queries and migrations. That makes the deployed application identity an owner and prevents certification that KBN immutable event, artifact, checkpoint, and evidence relations reject runtime `UPDATE`/`DELETE`. KBN-101 freezes a least-privilege runtime/migration split before KBN-100 schema work.
-
-### Normative requirements
-
-1. `K101-REQ-01`: `DATABASE_URL` SHALL be the non-owner PostgreSQL runtime connection and `DATABASE_MIGRATION_URL` SHALL be the migration-only owner/migrator connection. They are required respectively for runtime and the dedicated `mosaic-db-migrator --run|--verify` phase in `standalone`/`federated`; local PGlite is the explicit exception. The published `@mosaicstack/db` bin maps exactly `mosaic-db-migrator` to `./dist/cli.js`, its image entrypoint is exactly `mosaic-db-migrator`, accepts no URL/SQL/schema/role argv, and returns stable sanitized exits. Every current/future PostgreSQL DDL entrypoint SHALL route to that runner or be denied, and SHALL reject `DATABASE_URL`-only execution before connection/DDL. Data migration may connect only after the runner prepares and verifies the PostgreSQL target, through dedicated non-DDL `mosaic_data_importer` and exactly `--target-url-file /run/secrets/mosaic-migrate-target-url`, its fixed paired authenticated provider-version file `/run/secrets/mosaic-migrate-target-version`, plus `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`. KBN-101-05 obtains URL key `url` and version only from the same successful Vault KV-v2 response at `secret-{env}/mosaic-stack/database/importer` (`data.metadata.version`), renders them as one immutable generation into separate consumer copies, and never infers a provider version from DSN bytes. The trusted runner verifies TLS/identity/manifest, reads its fixed importer URL/version copies only for binding through safe no-follow fd checks, and signs a credential-free JCS/Ed25519 attestation using its runner-only fixed root-owned private-key file; no signing key reaches importer/runtime. The artifact binds secret version and SHA-256 of exact high-entropy credential-file bytes, canonical TLS host/port/database, CA/SPKI, PostgreSQL system identifier/database OID, importer role, manifest/schema fingerprints, producer invocation/build/image digest, issued/expires/nonce, and correlation. Before target connection the importer validates URL/version/attestation/public-key files, signature/key/expiry/replay/authenticated provider version/digest/generation/bindings and the importer-only CA at exact `DATABASE_TLS_CA_CERT_PATH`; after verified TLS and before DML it validates server/database/role/CA/schema identity, with same-fd/in-memory-byte TOCTOU protection, rotation/revocation, a privileged producer-only-to-importer-only artifact handoff controller that verifies/copies/fsyncs/atomically renames/seals before importer start, consumer isolation/no logging-oracle, and sanitized errors. Raw `--target-url`, `DATABASE_URL` fallback, runtime-owner use, missing/unsafe/substituted files, stale/replayed/tampered/wrong-key attestation, wrong binding, and DDL attempt fail before target connection/DDL; post-connect mismatch closes with zero DML/DDL. A reviewed finite classifier inventories executable current source/scripts/package bins, operator docs, deploy manifests, and exact normative contracts by path; active secure records pin both options/files, producer/key/bindings/tests, while normative contracts cannot mask instructions. Unknown active commands, duplicate-owner, ownerless, missing-path, and historical/status-only masking hits fail. `db:push` is forbidden outside an explicitly disposable local developer database and cannot accept a production-like URL.
-2. `K101-REQ-02`: Gateway runtime/replicas SHALL not execute migrations or DDL. The runner SHALL hold one `max:1` session and fixed two-int advisory namespace `1297044289` (`MOSA`), `1262636593` (`KBN1`) across preflight, reconciliation, migration, verification, and release. It SHALL compare the versioned canonical manifest v1 tuple (journal logical index/tag plus exact SQL-byte SHA-256) to the complete observed ledger mapping; count/set-only, timestamps, and physical insertion order are non-normative and insufficient.
-3. `K101-REQ-03`: PostgreSQL SHALL separate non-login platform database owner, non-login schema owner, dedicated `NOLOGIN SUPERUSER` `mosaic_extension_owner`, login migrator, dedicated login non-DDL data importer, non-login runtime capability, and login runtime roles. For PostgreSQL 17 + pgvector 0.8.2, `vector` is untrusted (`trusted` is absent and `relocatable=true`): only an externally controlled audited platform-bootstrap superuser session may `SET ROLE mosaic_extension_owner` for CREATE/UPDATE/SET SCHEMA, then `RESET ROLE`; the role has `rolcanlogin=false`, `rolsuper=true`, zero members, no runtime credential/Vault secret, and is never provided to app containers. It owns `mosaic_extensions`, fresh `vector`, and owner-bearing extension members, while `mosaic_schema_owner` receives only `USAGE` for type resolution and never ownership/`CREATE`/`ALTER`/`DROP`/member-change/default-privilege authority there. Superuser cannot be constrained by `GRANT`/`REVOKE`; this is identity/non-login/no-membership/external-control/audit isolation, not a false least-privilege claim. Extension operations require control-plane change, independent review, backup/rollback, maintenance window, and audit evidence. Managed targets that cannot establish this exact role are ineligible until an independently approved versioned provider-owned extension-owner profile exists; app/migrator ownership is never silently retained. Existing approved-owner extension relocation validates exact `pg_namespace.nspowner`, `pg_extension.extowner`, member ownership/schema/version, while legacy runtime-owned extension fails closed to a controlled shadow-database migration—never unsupported ownership alteration, catalog mutation, ownership adoption, or `DROP CASCADE`. Runtime, migrator, schema owner, importer, and all service roles must fail `SET ROLE`, catalog/direct `ALTER`/`UPDATE`/`DROP`/membership-change denial, role ownership, superuser/role-creation/schema-creation/TEMPORARY, unsafe membership, untrusted search path, missing grants, unauthenticated TLS, and immutable privilege drift checks. Application schema is fixed `mosaic` with exact `pg_catalog,mosaic` session path; historical public migrations remain byte-immutable legacy bootstrap only, every future Drizzle application declaration targets `mosaic`, and `vector` is explicitly qualified from non-writable `mosaic_extensions`. No config-derived SQL identifier is permitted.
-4. `K101-REQ-04`: `mosaicstack/stack` KBN-101-00 SHALL exclusively own `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, `infra/pg-bootstrap/README.md`, and bootstrap tests; KBN-101-05 SHALL exclusively own `tools/db/render-postgres-secrets.ts`, its tests, and current Compose/Portainer/two-gateway deployment declarations, consuming the versioned bootstrap interface without overlap. Environment IaC/Vault is named input and Mosaic deployment control plane/Jason is activation authority. Distinct runtime/migrator/importer URL, importer authenticated provider-version, DB-client CA, Gateway leaf, and PostgreSQL server key/certificate materials are provisioned before a production-like database starts. Importer and migrator have separate immutable URL/version copies at fixed `10002:10002`/`10003:10003` identities; runtime/unrelated containers receive neither importer material, attestation private key, or importer artifact. Runtime, migrator, and importer require their mounted CA plus `sslmode=verify-full`. Exact UID/GID/mode/rendering, service-DNS SANs, Vault/compose/Swarm consumer isolation, two-gateway pair ordering, server activation, pre-enforcement legacy-client drain and `hostssl` zero-plaintext-session proof, fresh/existing transition, CA-overlap rotation, TLS-only rollback, and standalone/federated/Swarm/two-gateway positive/negative TLS evidence are required. No application-generated production certificate or plaintext bootstrap exception is permitted.
-5. `K101-REQ-05`: KBN immutable relations SHALL permit the real runtime role INSERT/SELECT only and deny UPDATE/DELETE; parent retention remains RESTRICT/no-cascade. Role/password/Vault creation is external platform control, never application migration/source.
-6. `K101-REQ-06`: N-1 single-URL compatibility, rollout/rollback, Vault ownership/rotation/redaction, CI, installer, compose/Portainer, observability, and deployment handoffs SHALL be separately bounded one-card/one-PR work. Prepared slices remain inactive while current owner-runtime deployments stay N-1; Mosaic control plane/Jason alone authorizes one final atomic activation or rollback, with no force-on-red/bypass. KBN-101 planning itself SHALL not mutate production.
-7. `K101-REQ-07`: KBN-100 SHALL begin only after the KBN-101 foundation role/schema-boundary certificate; it SHALL rebase on that main head, restore generated Drizzle declaration/snapshot/journal consistency, and bound procedural immutable-table grant/trigger/backfill additions to its schema slice. KBN-101 real deployed-role immutable-operation certification SHALL complete after KBN-100 creates those relations and before KBN-105.
-
-### Acceptance criteria
-
-1. `AC-K101-01`: DTO/command-matrix tests prove required modes, PGlite exception, `mosaic-db-migrator --help|--run|--verify`/stable exits/argv refusal, public-import negative, every finite classified DDL/static-bypass inventory path and both harness pairs reject `DATABASE_URL`-only before connection/DDL, no migration-to-runtime fallback, and `db:push` refusal outside an allowlisted disposable DB. Before inventory, ownership, or status masking, the semantic fixture fails README's exact former commented code-fence generic-wrapper form and the user guide's exact former executable generic-wrapper form; source-consistency proves current `packages/storage/src/cli.ts` directly `execSync`s `pnpm --filter @mosaicstack/db db:migrate` and no `mosaic-db-migrator` bin exists, so runner-delegation documentation fails. The active `docs/guides/migrate-tier.md` route is inventoried to KBN-101-07 and proves runner-produced `--target-url-file /run/secrets/mosaic-migrate-target-url`, fixed paired provider-version file, and `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing/private-key isolation; Vault KV-v2 same-response version provenance, separate immutable generation mounts, importer CA, JCS/Ed25519 signature/key rotation/revocation, atomic artifact, expiry/replay, safe-fd secret-version/digest, canonical TLS/CA/server/database/role/manifest/schema bindings, dedicated non-DDL importer, consumer isolation/no log-oracle, and exact no-connection versus zero-DML rejection for missing/wrong/stale/replayed/tampered/wrong-key/substituted/generation-mismatched inputs. The full current non-normative docs inventory—including user guide, federation historical task/MILESTONES status, and non-operative SETUP—has an exact safe disposition. Scanner semantic checks reject automatic first-boot/startup extension/schema/migration wording, Compose-up-before-runner, init-script authority, production `.env`/monorepo auto-load/`EnvironmentFile=`/credential-export-or-argv/restart-as-secret-activation routes, and every unqualified operator-document `mosaic-db-migrator --run|--verify` hit regardless of named/normative/status classification. The exact former README/dev/deployment Compose-first sequences, former SETUP wording, exact former MILESTONES wording `pgvector extension installed + verified on startup`, former architecture-plan/PERFORMANCE/backlog runner routes, and any unqualified runner fixture fail before inventory masking. Only one `Held future procedure` Markdown section—bounded through the next equal-or-higher heading—may contain the explicit non-operative/no-current-command-authority form that names KBN-101-00/-03/-05 and preserves external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness; every runner hit outside that section fails. The README assertion for the checked-in direct CI `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` passes only as active legacy N-1, uncertified, non-authorizing-as-an-operator-route status against an isolated disposable CI database pending KBN-101-06 removal—not as an ordinary operator or approved DDL-authority route. Only local PGlite data-layer work or non-PostgreSQL Compose is current (Gateway/Web local startup is held pending daemon/inherited/project-DSN rejection).
-2. `AC-K101-02`: Fixed namespace lock contention/crash/readiness/non-interference and exact manifest-v1 reconciliation tests prove no replica race/runtime auto-migration and fail closed on every missing/unknown/duplicate/ambiguous/corrupt/stale ledger state.
-3. `AC-K101-03`: Actual PostgreSQL 17 + pgvector 0.8.2 control-file, catalog, Drizzle-generation, vector-query/operator, fresh/approved-owner/legacy-shadow/partial/resume/rollback/N-1, and real deployed-role tests prove `trusted` absent/untrusted plus relocatability, external-superuser `SET ROLE` create/update/`RESET ROLE` audit, exact `rolcanlogin=false`/`rolsuper=true`/zero-membership/no-runtime-secret state, platform/schema/extension-owner/migrator/importer/runtime separation, `pg_extension.extowner` plus owner-bearing extension-member/schema/version assertions, and runtime/migrator/schema-owner/importer/all-service-role `SET ROLE`/ALTER/DROP/member-update denial. They also prove `pg_catalog,mosaic` per-session pool safety, `mosaic_extensions` qualification, identifier injection denial, ownership/membership/ledger-read/TEMP/default grants, and unsafe privilege denial.
-4. `AC-K101-04`: Disposable standalone, federated/Swarm, and two-gateway verified-TLS positives plus for both pairs missing CA/wrong CA/wrong SAN/sslmode downgrade, server/Gateway key mode, UID/GID, secret-consumer isolation, and legacy-drain/`hostssl` negatives prove server bootstrap, ordering, and readiness; PGlite is expressly excluded from this PostgreSQL evidence.
-5. `AC-K101-05`: Real runtime-role evidence proves INSERT/SELECT succeeds and UPDATE/DELETE fails for every frozen immutable KBN relation.
-6. `AC-K101-06`: N-1/atomic activation/rollback, Vault/CA-overlap rotation/redaction, health/operator behavior, CI/deployment handoff, independent exact-head security review, and terminal-green CI evidence the foundation before KBN-100; after KBN-100, the real deployed-role immutable-operation certificate and Ultron approval release KBN-105.
-
-**Normative implementation contract:** [`docs/native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md`](./native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md). `ASSUMPTION:` existing `standalone` and `federated` are all PostgreSQL production-like modes; any new PostgreSQL tier inherits these requirements until an explicit versioned amendment.
-
----
-
 ## Tess Interaction Agent Workstream (TESS)
 
 ### Problem and Objective
@@ -320,100 +175,6 @@ Delivery uses five gated milestones: runtime contracts/security; Pi service/stat
 
 ---
 
-## Official Channel Plugin Workstream (#756)
-
-### Problem and Objective
-
-The Discord plugin currently couples Discord event handling, gateway bridging, and reply routing in one implementation and activates only on mentions. Mosaic needs an official channel adapter that behaves the same no matter whether the bound logical agent currently runs through Claude, Codex, Pi, OpenCode, or a future harness. The Discord connection and conversation address must remain stable while the gateway changes the runtime provider behind that logical session.
-
-The objective is to make Discord the first implementation of a transport-neutral official channel contract, with explicit authorization and deterministic channel/thread routing that future Matrix, Slack, and other adapters can share.
-
-### Scope
-
-#### In Scope
-
-1. `CHN-001`: Transport-neutral channel adapter, route, message, attachment, authorization-principal, response-target, and health contracts in `@mosaicstack/types`, including trusted per-binding logical-agent configuration selection.
-2. `CHN-002`: Stable channel conversation addresses based on logical agent plus channel/thread identity; harness, model, and runtime-provider IDs are forbidden from channel session keys.
-3. `DSC-001`: An authorized untagged message in a configured agent-bound channel routes to the agent and receives its response in that channel.
-4. `DSC-002`: A bot mention in a configured parent channel creates a Discord thread, or reuses the thread already attached to that same native message; the mentioned turn and subsequent thread turns route and respond in that thread.
-5. `DSC-003`: A message already inside an authorized thread inherits authorization from its configured parent and never attempts a nested thread.
-6. `DSC-004`: Guild, parent channel, user, pairing, and role authorization remains default-deny before thread creation or gateway dispatch.
-7. `DSC-005`: Discord service authentication, HMAC envelope integrity, replay protection, attachments, approvals, response chunking, and correlation behavior remain intact.
-8. `DSC-006`: The Discord adapter exposes lifecycle and health behavior through the shared channel contract without importing a harness SDK.
-
-#### Out of Scope
-
-1. The logical-agent lease, fencing epoch, execution grant, checkpoint, or cross-harness takeover implementation tracked by #754/#755.
-2. Dynamic Discord authorization administration in the web UI.
-3. Multi-guild tenant isolation, DMs, slash commands, voice, reactions, or production bot deployment.
-4. Implementing Matrix or Slack adapters in this slice.
-
-### Non-Functional Requirements
-
-1. **Security:** no thread or dispatch side effect occurs until guild, parent channel, user, pairing, role, and bounded per-user/channel rate checks pass; attachment metadata is shape- and size-bounded; credentials never enter source, messages, session keys, or logs.
-2. **Portability:** channel contracts and stable conversation IDs contain no Claude, Codex, Pi, OpenCode, model, process, or provider-specific field; each configuration-owned binding selects its trusted logical agent without changing the channel identity.
-3. **Reliability:** repeated messages for one channel/thread resolve the same conversation handle; reconnecting the adapter does not require a harness-specific rebinding.
-4. **Maintainability:** Discord-specific API translation stays in the Discord package; gateway and future adapters depend on transport-neutral contracts.
-5. **Observability:** thread creation or routing failure is reported without message content or credential material.
-
-### Acceptance Criteria
-
-1. `AC-CHN-01`: Contract and behavior tests prove the plugin route contains only logical agent plus channel/thread identity and produces the same stable conversation handle regardless of underlying harness selection.
-2. `AC-CHN-02`: A mentioned authorized parent-channel message creates a thread (or reuses its already-attached thread), dispatches to the thread conversation, and targets the response to that thread.
-3. `AC-CHN-03`: An untagged authorized parent-channel message dispatches to the parent conversation and targets the response to the parent channel.
-4. `AC-CHN-04`: Untagged follow-ups inside an authorized thread dispatch and respond in that same thread without creating a nested thread.
-5. `AC-CHN-05`: Unauthorized guilds, channels, users, unpaired users, insufficient roles, and rate-limited senders produce no thread and no gateway dispatch.
-6. `AC-CHN-06`: Shared channel contracts are exported from `@mosaicstack/types`, Discord implements the lifecycle/health seam, and no harness SDK is imported by the plugin.
-7. `AC-CHN-07`: Focused routing/auth tests, package tests, typecheck, lint, formatting, coverage, independent code/security review, and terminal-green CI pass.
-
-### Constraints, Risks, and Assumptions
-
-- Dependency: Mosaic gateway remains the policy, durable-session, audit, and runtime-provider boundary.
-- Constraint: This work must not modify orchestrator-to-Pi migration or #754/#755 lease/fencing files.
-- Risk: accepting untagged messages could create noisy or unintended agent input. Mitigation: only explicitly configured channels and paired, role-authorized users are accepted, with bounded per-user/channel message and thread rates.
-- Risk: Discord thread creation can fail because of channel permissions, archived state, or API rate limits. Mitigation: fail without dispatching a turn whose response destination cannot be honored, and emit sanitized diagnostics.
-- `ASSUMPTION:` Configured channels are dedicated agent interaction surfaces, so authorized untagged human messages are intentional agent input.
-- `ASSUMPTION:` Mention in a parent channel selects a public thread; messages already in a thread remain there because Discord has no nested threads.
-- `ASSUMPTION:` One Discord bot may serve multiple configuration-owned logical-agent bindings.
-- `ASSUMPTION:` Static allowlists and paired-user roles are the authorization administration surface for this slice.
-
-### Testing and Delivery Intent
-
-Use TDD for remote-ingress routing and permission boundaries. Required evidence includes parent-channel mention, untagged parent message, existing-thread follow-up, existing-thread mention, thread reuse, unauthorized side-effect denial, stable harness-neutral conversation identity, adapter health, and regression coverage for signed envelopes and approvals. Deliver through issue #756, a reviewed squash PR to `main`, terminal-green CI, and issue closure.
-
----
-
-## Mos Runtime Portability Workstream (MOS-PORT)
-
-### Problem and Objective
-
-Mos is currently identified partly by a harness-native session and communication process. Replacement/rebinding exists, but no gateway-enforced logical identity or fencing prevents a stale harness from continuing to reply or execute effects after takeover.
-
-The objective is to make Mos a server-derived logical Mosaic identity whose authority can move safely among runtime connectors. The gateway owns identity, lease, policy, and audit; harnesses remain replaceable adapters.
-
-### M1 Requirements
-
-1. `MOS-PORT-ID-001`: Define a normalized logical-agent identity independent of Claude Code, Pi, Codex, tmux, Matrix, and provider-native session IDs.
-2. `MOS-PORT-LEASE-001`: Persist one exclusive connector lease per tenant/logical-agent/binding with CAS acquisition, monotonic fencing epoch, TTL, heartbeat, explicit release, and takeover.
-3. `MOS-PORT-FENCE-001`: Bind every connector dispatch/execution grant to the current server-derived tenant, logical identity, binding, connector, scopes, expiry, and lease epoch.
-4. `MOS-PORT-FENCE-002`: Reject and audit stale, expired, forged, cross-tenant, cross-binding, and unauthorized grants before connector, channel, provider, or tool side effects.
-5. `MOS-PORT-OBS-001`: Emit credential-safe correlation/audit events for lease acquire, renew, takeover, reject, release, and expiry.
-6. `MOS-PORT-ARCH-001`: Runtime/provider adapters consume normalized lease context without adding harness-native schemas to Mosaic core.
-
-### M1 Acceptance Criteria
-
-1. `AC-MOS-PORT-01`: Two contenders for one binding cannot simultaneously hold current authority under concurrency.
-2. `AC-MOS-PORT-02`: Successful takeover increments the fencing epoch and every operation from the old epoch fails closed before side effects.
-3. `AC-MOS-PORT-03`: Gateway/database restart preserves lease and epoch state; expired leases can be recovered only through the authorized takeover path.
-4. `AC-MOS-PORT-04`: Cross-tenant, cross-agent, cross-binding, forged, and expired lease/grant cases are denied and audited.
-5. `AC-MOS-PORT-05`: Unit, migration, repository close/reopen, concurrency, abuse, gateway integration, independent security review, CI, and documentation gates pass.
-
-### Deferred to Later #754 Milestones
-
-Canonical checkpoint/handoff payloads, exactly-once connector receipts, concrete Claude/Pi/Codex adapters, channel cutover, and full cross-harness failover/rollback E2E are explicitly out of M1 scope.
-
----
-
 ## Architecture
 
 ### High-Level System Diagram
@@ -768,8 +529,7 @@ Discord remote control channel. Architecture inspired by OpenClaw (https://githu
 - Single-guild binding only (v0.1.0) — prevents data leaks between servers
 - Receives Discord messages, dispatches through gateway routing
 - Streams agent responses back to Discord (chunked for 2000-char limit)
-- Routes authorized untagged messages in-channel; mentions create threads (or reuse the same message's attached thread) for multi-turn topics
+- Supports mention-based activation, thread management for multi-turn
-- Uses stable logical-agent/channel conversation addresses independent of the active harness/provider
 - Bot pairing and permission management (Discord user → Mosaic user mapping)
 - DM support for private conversations
 
@@ -942,12 +702,10 @@ Telegram remote control channel.
 
 ### FR-9: Remote Control — Discord
 
-- Discord bot that connects to the gateway through a transport-neutral channel adapter contract
+- Discord bot that connects to the gateway
-- Authorized messages in configured agent-bound channels work without a mention and respond in-channel
+- Mention-based activation in channels
-- Mentions in parent channels create threads, or reuse a thread already attached to that same native message, for multi-turn conversations
-- Messages already in a thread remain there without requiring repeated mentions
-- Stable logical-agent/channel conversation identity survives underlying harness/provider changes
 - DM support for private conversations
+- Thread creation for multi-turn conversations
 - Chunked message delivery (Discord 2000-char limit)
 - Bot configuration via web dashboard
 - Permission management (which Discord users/roles can interact)
@@ -1131,13 +889,10 @@ Telegram remote control channel.
 
 ### AC-3: Discord Remote Control
 
-- [ ] Discord bot connects through the harness-neutral channel contract
+- [ ] Discord bot connects and responds to mentions
-- [ ] Authorized untagged channel messages route through the gateway and respond in-channel
+- [ ] Messages route through gateway to agent pool
-- [ ] Mentioned parent-channel messages create a thread (or reuse their already-attached thread) and respond there
-- [ ] Existing-thread follow-ups stay in the thread without repeated mentions
-- [ ] Channel/session identity remains stable while the underlying harness/provider changes
 - [ ] Responses stream back to Discord (chunked)
-- [ ] Unauthorized guilds, channels, users, pairings, and roles create no thread and dispatch no message
+- [ ] Thread creation for multi-turn conversations
 
 ### AC-4: Gateway Orchestration
 
@@ -1181,10 +936,10 @@ Telegram remote control channel.
 
 ### AC-10: Deployment
 
-- [ ] PGlite data-layer work uses no PostgreSQL; optional Compose services are selected individually and do not start PostgreSQL; Gateway/Web local start remains held until KBN-101-02 rejects daemon/inherited/project DSNs before connection or DDL
+- [ ] `docker compose up` starts full stack from clean state
-- [ ] PostgreSQL/federated activation is unavailable until KBN-101-00/-03/-05 deliver external bootstrap, TLS/roles, runner `--run`, runner `--verify`, and Gateway/Compose readiness in that order
+- [ ] `mosaic` CLI installable and functional on bare metal
-- [ ] `mosaic` CLI installable and functional on bare metal after the reviewed KBN-101-05 secret-renderer/process-exec or `LoadCredential` interface exists
+- [ ] Database migrations run automatically on first start
-- [ ] Local-only configuration documentation is distinct from production generation-pinned Vault-rendered consumer material
+- [ ] `.env.example` documents all required configuration
 
 ### AC-11: @mosaicstack/\* Packages
 
@@ -1336,7 +1091,7 @@ All work is **alpha** (< 0.1.0) until Jason approves 0.1.0 beta release.
 
 6. ASSUMPTION: **Log summarization uses Haiku-tier LLM by default, configurable.** Haiku is well-suited for summarization (compression, not generation — source material is in context). Guardrails: structured output via Zod schema (force extraction of decisions/tools/outcomes/errors as discrete fields), chunked per-session processing (no bulk conflation), extraction-focused prompts. Raw logs stay in hot tier (7 days) as safety net. Users can override the summarization model via routing engine config if they want higher fidelity. Rationale: Haiku is 10-20x cheaper than Sonnet; log summarization runs on schedule against large volumes where cost matters.
 
-7. ASSUMPTION: **Discord plugin starts minimal and single-guild only** — explicitly configured agent-bound channels accept authorized untagged messages in-channel, while mentions create threads or reuse a thread already attached to that same native message; responses are chunked. Single guild binding prevents data leaks between servers. DM support, voice, components, slash commands, and multi-guild operation are post-beta. Rationale: Ship the requested core interaction model while preserving default-deny data isolation.
+7. ASSUMPTION: **Discord plugin starts minimal and single-guild only** — DM support, mention-based channel activation, thread management, chunked responses. Single guild binding to prevent data leaks between servers. Advanced features (voice, components, slash commands, multi-guild) are post-beta. Rationale: Proven pattern from OpenClaw; ship core interaction first; data isolation is non-negotiable.
 
 8. ASSUMPTION: **Telegram plugin is lower priority than Discord** and may ship as v0.0.7 or later if Discord takes longer than expected. Rationale: Jason indicated Discord as the high-priority remote channel.
 

docs/SITEMAP.md

@@ -1,75 +0,0 @@
-# Documentation Sitemap
-
-## CLI and skill management
-
-- [Skill registration user guide](guides/user-guide.md#claude-code-skill-registration) — register, unregister, list statuses, automatic install/update reconciliation, and Claude reload behavior.
-- [Skill bridge developer guide](guides/dev-guide.md#claude-code-skill-bridge) — path-validation, ownership, clobber-protection, install/update wiring, tests, and Pi/Codex scope notes.
-
-## Fleet configuration management
-
-- [Generated environment boundary](fleet/reference/generated-env-boundary.md) — roster-derived launch projection, strict local data, legacy quarantine, and downstream interface evidence.
-- [Roster v2 structural contract](fleet/reference/roster-v2-fields.md) — local-tmux schema v2 parsing and structural validation.
-- [Role classes and authority](fleet/reference/role-classes.md) — canonical role resolver and protected authority boundaries.
-- [Executable asset dispositions](fleet/migration/example-profile-disposition.md) — shipped v1 fixture/profile/service validation posture.
-
-## Official channel plugins
-
-- [Channel protocol architecture](architecture/channel-protocol.md) — shared lifecycle, message, stable-route, authorization, and response-target contracts.
-- [Discord administrator configuration](guides/admin-guide.md#discord-ingress-security) — secrets, allowlists, bindings, role policy, and thread permissions.
-- [Discord user workflow](tess/USER-GUIDE.md#discord-conversations) — in-channel messages, mention-created threads, and runtime-transparent continuity.
-- [Channel plugin authoring](tess/PLUGIN-GUIDE.md#official-channel-adapter-contract) — requirements for future Matrix, Slack, and other official adapters.
-- [Discord package guide](../plugins/discord/README.md) — package behavior, configuration shape, and development commands.
-
-## Native Kanban and canonical task SOT
-
-- [Canonical requirements](requirements/native-kanban-sot.md) — ratified P0–P3 requirements and acceptance criteria.
-- [Workstream index](native-kanban-sot/INDEX.md) — artifact map, lane partition, and delivery order.
-- [Mission manifest](native-kanban-sot/MISSION-MANIFEST.md) — scope, authority, invariants, and gate model.
-- [Task decomposition](native-kanban-sot/TASKS.md) — dependency-ordered implementation slices and ownership boundaries.
-- [KBN-101 database role split](native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md) — rc.16 direct-Drizzle storage-wrapper hold: legacy N-1/uncertified/non-operative pending -02/-03/-06/-08; exact README/user-guide wrapper forms fail before masking and source-consistency rejects runner-delegation copy; held bootstrap → TLS/roles → run → verify → readiness; plus prior attestation, pgvector owner, classifier, TLS, activation, and certification prerequisite.
-- [Federated tier data migration](guides/migrate-tier.md) — active KBN-101-07 operator route: runner-produced target attestation, dedicated non-DDL importer, and paired credential-/attestation-file references only.
-- [Frozen shared contract](native-kanban-sot/SHARED-CONTRACT.md) — schema, API, Coordinator, health, recovery, and migration contracts.
-- [KBN-101 exact-head security review](reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) — retained prior REQUEST CHANGES evidence for `da742ca`; rc.16 awaits independent exact-head re-review after closing the current generic storage-wrapper authority HIGH finding.
-- [Initial independent review](reports/native-kanban-sot/canon-initial-review-no-go.md) — KCR-001–016 findings that blocked the first draft.
-- [Final independent re-review](reports/native-kanban-sot/canon-final-rereview-go.md) — closure evidence and GO verdict.
-- [Ultron final gate](reports/native-kanban-sot/ultron-final-go.md) — final requirements, authority, schema, migration, recovery, and evidence review.
-
-## Tess interaction agent
-
-### Operator guides
-
-- [User guide](tess/USER-GUIDE.md) — authorized session, attach, send, stop, and handoff workflows.
-- [Admin guide](tess/ADMIN-GUIDE.md) — deployment configuration, policy, and approval controls.
-- [Developer guide](tess/DEVELOPER-GUIDE.md) — provider contracts, scope boundaries, and test workflow.
-- [Plugin guide](tess/PLUGIN-GUIDE.md) — adapter, redaction, and identity-as-data requirements.
-- [Operations guide](tess/OPERATIONS-GUIDE.md) — readiness, recovery, and incident-safe procedures.
-
-### Architecture and security
-
-- [Architecture](tess/ARCHITECTURE.md)
-- [Threat model](tess/THREAT-MODEL.md)
-- [Mos coordination boundary](tess/MOS-COORDINATION.md)
-- [Hermes runtime adapter design](tess/hermes-runtime-adapter-design.md)
-- [Operator plugin sketch](tess/M4-003-OPERATOR-PLUGIN-SKETCH.md)
-
-### API contract
-
-- [Tess OpenAPI contract](openapi-tess.yaml)
-
-### Migration and qualification
-
-- [Migration inventory](tess/M5-MIGRATION-INVENTORY.md)
-- [Cutover procedure](tess/M5-MIGRATION-CUTOVER.md)
-- [Rollback procedure](tess/M5-MIGRATION-ROLLBACK.md)
-- [Retention and deprecation evidence](tess/M5-MIGRATION-RETENTION-DEPRECATION.md)
-- [Verification matrix](tess/VERIFICATION-MATRIX.md)
-- [Documentation checklist](tess/M5-003-DOCUMENTATION-CHECKLIST.md)
-- [Independent Option 2 runtime-portability qualification (2026-07-14)](tess/qualification/2026-07-14-option2-runtime-portability.md)
-
-## Runtime-neutral Mos portability
-
-- [Optional AI egress gateway ADR](architecture/ADR-MOS-EGRESS-GATEWAYS.md) — placement and gates for LiteLLM, Bifrost, and purpose-built translation proxies.
-- [Runtime-neutral Mos identity and failover mission](https://git.mosaicstack.dev/mosaicstack/stack/issues/754)
-- [Logical identity and connector lease/fencing implementation](https://git.mosaicstack.dev/mosaicstack/stack/issues/755)
-- [M1 logical identity and fencing architecture](architecture/mos-runtime-portability-m1.md)
-- [M1 connector lease operations](guides/mos-connector-lease-operations.md)

docs/TASKS.md

@@ -14,12 +14,10 @@
 
 ## Workstream Rollup
 
-| id  | status            | workstream                     | progress         | tasks file                                                      | notes                                                                             |
+| id  | status            | workstream             | progress         | tasks file                                        | notes                                                           |
-| --- | ----------------- | ------------------------------ | ---------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------- |
+| --- | ----------------- | ---------------------- | ---------------- | ------------------------------------------------- | --------------------------------------------------------------- |
-| W1  | planning-complete | Federation v1 (FED)            | 0 / 7 milestones | [docs/federation/TASKS.md](./federation/TASKS.md)               | M1 task breakdown populated; M2–M7 deferred to mission planning                   |
+| W1  | planning-complete | Federation v1 (FED)    | 0 / 7 milestones | [docs/federation/TASKS.md](./federation/TASKS.md) | M1 task breakdown populated; M2–M7 deferred to mission planning |
-| W2  | planning-complete | Tess interaction agent         | 0 / 5 milestones | [docs/tess/TASKS.md](./tess/TASKS.md)                           | Issue #706; independent planning gate PASS; M1 issue #707 ready                   |
+| W2  | planning-complete | Tess interaction agent | 0 / 5 milestones | [docs/tess/TASKS.md](./tess/TASKS.md)             | Issue #706; independent planning gate PASS; M1 issue #707 ready |
-| W3  | planning-complete | Native Kanban/SOT              | 0 / 4 phases     | [docs/native-kanban-sot/TASKS.md](./native-kanban-sot/TASKS.md) | Issue #751; canon independently approved; implementation held until canon merges  |
-| W4  | planning-complete | Fleet configuration management | 0 / 12 cards     | This file (§ Fleet configuration management #758)               | Issue #758; M0 docs gate defines the implementation DAG before any fleet mutation |
 
 ## Cross-Cutting Tracking
 
@@ -43,30 +41,6 @@ Active workstream is **W1 — Federation v1**. Workers should:
 2. Read [docs/federation/TASKS.md](./federation/TASKS.md) for the next pending task
 3. Follow per-task agent + tier guidance from the workstream manifest
 
-## Fleet configuration management (#758) — M0–M5 implementation DAG
-
-> **PRD:** [Fleet declarative configuration management](./PRD.md#fleet-declarative-configuration-management-workstream-fcm-758) · **M0 acceptance:** [docs IA checklist](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) · **baseline dispositions:** [legacy example/profile inventory](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md)
->
-> Every row below is one independently reviewable card and **one PR**. `depends_on` is a
-> hard DAG edge; no card may silently absorb another card's scope. All source cards require
-> the repository quality gates, independent code and security review, terminal-green CI, and
-> the applicable acceptance evidence before merge. Issue #758 remains open until M5 closes.
-
-| id         | status      | description                                                                                                                                                            | issue | agent         | repo              | branch                                  | depends_on                                     | estimate | notes                                                                                                            |
-| ---------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------------- | ----------------- | --------------------------------------- | ---------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------- |
-| FCM-M0-001 | done        | Publish normative PRD requirements/acceptance criteria, this M0–M5 DAG, docs-IA checklist, and legacy example/profile disposition inventory; no implementation changes | #758  | sonnet        | mosaicstack/stack | `docs/758-fleet-config-management`      | —                                              | 18K      | Merged via #760 (`c32d85a`); parent #758 intentionally remains open through M5                                   |
-| FCM-M1-001 | done        | Implement narrow local-tmux v2 roster structural contract/compiler with YAML/JSON canonicalization and schema/parser parity tests                                      | #758  | coder0        | mosaicstack/stack | `feat/758-roster-v2-compiler`           | FCM-M0-001                                     | 30K      | #764 squash `aa5b43b`; exact-head RoR and PR/main terminal-green CI; no lifecycle or live mutation               |
-| FCM-M1-002 | done        | Reuse existing profile/persona/provision resolver for roster semantics; add canonical class/authority validation and approved aliases                                  | #758  | native-sonnet | mosaicstack/stack | `feat/758-shared-role-resolution`       | FCM-M0-001                                     | 25K      | #768 squash `a5e8e55`; shared resolver and canonical authority/alias validation delivered                        |
-| FCM-M1-003 | done        | Convert the M0 legacy inventory into executable example/profile/service-preset validation and explicit v1-version/retirement checks                                    | #758  | codex         | mosaicstack/stack | `test/758-example-profile-dispositions` | FCM-M1-001, FCM-M1-002                         | 20K      | #770 squash `e9c4aa3`; shipped artifact disposition validation delivered                                         |
-| FCM-M2-001 | done        | Migrate generic launch chain to deterministic `.env.generated` plus strict data-only `.env.local`; quarantine forbidden legacy keys                                    | #758  | codex         | mosaicstack/stack | `feat/758-generated-env-boundary`       | FCM-M1-001, FCM-M1-002                         | 30K      | #772 squash `191efae`; generated/local boundary and private quarantine delivered                                 |
-| FCM-M2-002 | done        | Add generation-guarded local fleet agent create/get/update/delete mutations with plan/dry-run, atomic roster writes, and recovery output                               | #758  | codex         | mosaicstack/stack | `feat/758-fleet-agent-crud`             | FCM-M1-001, FCM-M2-001                         | 30K      | #773 squash `bc5e736`; generation-guarded atomic CRUD and recovery contracts delivered                           |
-| FCM-M3-001 | done        | Implement local roster-owned reconcile/apply plus lifecycle/status/verify/doctor contracts and stable JSON/exit codes                                                  | #758  | codex         | mosaicstack/stack | `feat/758-local-reconciler`             | FCM-M2-001, FCM-M2-002                         | 35K      | #785 squash `4990905`; exact roster-owned systemd/tmux reconcile and lifecycle contracts delivered               |
-| FCM-M3-002 | in-progress | Add isolated systemd/tmux lifecycle, drift, socket, unmanaged-session, crash, and rollback acceptance coverage                                                         | #758  | sonnet        | mosaicstack/stack | `test/758-reconciler-lifecycle-gates`   | FCM-M3-001                                     | 25K      | Canonical v2 named-socket + legacy-v1 default-server boundaries; fake adapters/temp fixtures only                |
-| FCM-M4-001 | not-started | Implement field-complete v1-to-v2 inventory/preview/migrator with alias, lifecycle, env-quarantine, and remote/connector disposition evidence                          | #758  | codex         | mosaicstack/stack | `feat/758-v1-v2-migrator`               | FCM-M1-003, FCM-M3-001                         | 35K      | Preview first; no unreviewed lifecycle inference                                                                 |
-| FCM-M4-002 | not-started | Add reversible canary migration, rollback, stale-projection/orphan classification, and current-host 9-managed/3-unmanaged fixture coverage                             | #758  | sonnet        | mosaicstack/stack | `test/758-migration-rollback-gates`     | FCM-M4-001, FCM-M3-002                         | 25K      | Never starts a previously stopped agent or kills an unproven unmanaged session                                   |
-| FCM-M5-001 | not-started | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | Must close every checklist item or record an approved deferral                                                   |
-| FCM-M5-002 | not-started | Package/update asset-drift checks, rolling local canary, independent validation certificate, and release evidence                                                      | #758  | sonnet        | mosaicstack/stack | `feat/758-fleet-config-release-gate`    | FCM-M3-002, FCM-M4-002, FCM-M5-001             | 30K      | Final #758 gate: quality, independent code/security review, validator certificate, merge-gate approval, green CI |
-
 ## Thin-core prompt diet (#528) — feat/contract-thin-core
 
 - Status: PR open, awaiting maintainer merge ratification (fleet-governing change).

docs/architecture/ADR-MOS-EGRESS-GATEWAYS.md

@@ -1,151 +0,0 @@
-# ADR: Optional AI egress gateways for runtime-neutral Mos
-
-**Status:** Proposed for controlled prototypes; not approved as Mosaic core
-
-**Date:** 2026-07-14
-
-**Issues:** #754, #755
-
-**Decision owner:** Mosaic Gateway / provider-adapter architecture
-
-## Context
-
-The emergency Mos continuity path kept Claude Code as the harness and translated Anthropic Messages traffic to Codex OAuth through a small localhost proxy. That preserved the existing Claude Discord plugin and transcript, but exposed two architectural facts:
-
-1. Harness identity, channel entitlement, provider credentials, and inference transport are separate concerns.
-2. A generic AI gateway can improve provider routing, budgets, and observability, but must not become Mosaic's identity, authorization, tenant, or orchestration boundary.
-
-The Tess qualification report also found that current provider rebinding is not identity-continuous failover. Mosaic still needs a logical agent identity, durable connector lease/fencing, canonical handoff/checkpoint, exactly-once receipts, concrete harness adapters, and cross-harness rollback E2E.
-
-## Decision
-
-Mosaic MAY support LiteLLM, Bifrost, the purpose-built Claude/Codex proxy, or future gateways as optional egress implementations behind `IProviderAdapter` / `AgentRuntimeProvider`.
-
-Mosaic Gateway remains authoritative for:
-
-- authenticated actor and tenant identity;
-- logical agent identity and connector binding;
-- authorization, approval, and policy;
-- lease epoch and stale-holder fencing;
-- audit correlation and redaction;
-- canonical handoff/checkpoint state;
-- idempotency and side-effect receipts.
-
-An egress gateway MUST NOT:
-
-- receive channel ingress directly;
-- authorize tools or connector ownership;
-- define Mosaic tenant or agent identity;
-- persist raw Mosaic handoffs or channel credentials;
-- bypass adapter capability negotiation;
-- silently fail over when policy, lease, or provider health is uncertain.
-
-Allowed topology:
-
-```text
-Discord / Matrix / CLI / web
-        ↓
-Mosaic Gateway: identity, authz, lease/fence, approvals, audit
-        ↓
-IProviderAdapter / AgentRuntimeProvider
-        ↓
-optional egress gateway
-        ↓
-upstream provider or subscription-backed OAuth session
-```
-
-## Candidate assessment
-
-### Purpose-built `raine/claude-code-proxy`
-
-**Disposition:** Approved only for the verified emergency localhost bridge.
-
-Strengths:
-
-- explicit Codex device OAuth flow;
-- small operational surface;
-- Anthropic Messages translation suitable for Claude Code;
-- model and reasoning-effort enforcement;
-- straightforward loopback systemd supervision and rollback.
-
-Constraints:
-
-- not a Mosaic multi-tenant control plane;
-- Claude built-in channels still depend on Claude subscription entitlement and feature lookup;
-- model aliases can obscure the upstream model unless proxy policy/logs are treated as evidence;
-- no replacement for connector leasing, canonical handoff, or exactly-once effects.
-
-### LiteLLM
-
-**Disposition:** Candidate for a formal adapter-only prototype and terms/security review.
-
-Current documentation states that ChatGPT subscription access is available through an OAuth device-code flow. LiteLLM also provides broad provider routing, virtual keys, budgets, observability, and OpenAI/Anthropic-compatible surfaces.
-
-Required prototype gates:
-
-- verify the exact ChatGPT subscription OAuth flow and supported models against current provider terms;
-- document token location, encryption, revocation, refresh, scope, and incident response;
-- prove tenant isolation and prevent virtual keys from becoming Mosaic principals;
-- verify streaming, tool calls, reasoning controls, cancellation, and idempotency metadata;
-- fail closed instead of selecting an unhealthy provider merely to return a result;
-- demonstrate that Mosaic audit correlation survives gateway retries/failover;
-- keep channel ingress and connector credentials outside LiteLLM.
-
-Source references:
-
-- [LiteLLM ChatGPT subscription provider](https://docs.litellm.ai/docs/providers/chatgpt)
-- [LiteLLM providers](https://docs.litellm.ai/docs/providers)
-
-### Bifrost
-
-**Disposition:** Candidate for governance/routing research; subscription OAuth compatibility unverified.
-
-Useful concepts include virtual keys, budgets, rate limits, weighted load balancing, and automatic provider failover. Those features may inform Mosaic egress policy, but Bifrost virtual keys are downstream credentials—not Mosaic actors or tenants.
-
-Required prototype gates:
-
-- verify Codex/ChatGPT subscription OAuth rather than assuming API-key compatibility;
-- map budgets and virtual keys to server-derived Mosaic tenants without duplicating authority;
-- prove failover does not violate connector lease, approval, or exactly-once semantics;
-- ensure request/response logs are redacted before persistence;
-- disable or constrain automatic failover when policy or side-effect state is ambiguous.
-
-Source references:
-
-- [Bifrost overview](https://docs.getbifrost.ai/overview)
-- [Bifrost repository](https://github.com/maximhq/bifrost)
-
-### `teremterem/claude-code-gpt-5-codex`
-
-**Disposition:** Not selected as the emergency implementation; useful as a historical LiteLLM recipe.
-
-The reviewed repository uses `OPENAI_API_KEY`, tells previously authenticated Claude users to log out, and documents a Claude Web Search schema incompatibility. Logging Claude out conflicts with the channel-entitlement requirement observed in the live Mos cutover. The repository therefore does not, as provided, satisfy subscription-OAuth plus built-in-channel continuity.
-
-Source references:
-
-- [Repository](https://github.com/teremterem/claude-code-gpt-5-codex)
-- [Environment template](https://github.com/teremterem/claude-code-gpt-5-codex/blob/main/.env.template)
-
-## Security consequences
-
-- Subscription OAuth grants are high-value credentials and require the same lifecycle controls as service credentials.
-- Downstream virtual keys reduce provider-key exposure but do not establish user, tenant, or agent authority.
-- Automatic retry/failover can duplicate tool or external side effects unless Mosaic owns operation IDs and receipts.
-- Gateway telemetry can contain prompts, tool schemas, and model output; redaction and retention policy must apply before persistence.
-- A localhost unauthenticated translation endpoint must remain loopback-only and process-isolated.
-
-## Acceptance before production use
-
-1. Threat model and provider-terms review approved.
-2. Credential lifecycle and revocation drill documented and exercised.
-3. Adapter contract tests pass for streaming, tools, cancellation, reasoning policy, errors, and audit correlation.
-4. Tenant-bound authorization remains entirely in Mosaic Gateway.
-5. Failure injection proves no duplicate side effects across retries or provider failover.
-6. Rollback to the prior provider path is exercised.
-7. Independent code and security reviews approve the exact deployed revision.
-
-## Follow-up
-
-- #754 owns cross-harness logical identity, checkpoint, receipt, adapter, and failover work.
-- #755 / PR #757 implements the first logical identity and connector lease/fencing boundary.
-- A later issue should prototype LiteLLM and Bifrost behind the provider adapter after #755 is merged and independently qualified.

docs/architecture/channel-protocol.md

@@ -1,9 +1,9 @@
 # Channel Protocol Architecture
 
-**Status:** Official adapter baseline implemented by #756; extended registry/multiplexing remains iterative
+**Status:** Draft
 **Authors:** Mosaic Core Team
-**Last Updated:** 2026-07-14
+**Last Updated:** 2026-03-22
-**Covers:** M7-001 (OfficialChannelAdapter interface), M7-002 (ChannelMessageDto protocol), M7-003 (Matrix integration design), M7-004 (conversation multiplexing), M7-005 (remote auth bridging), M7-006 (agent-to-agent communication via Matrix), M7-007 (multi-user isolation in Matrix)
+**Covers:** M7-001 (IChannelAdapter interface), M7-002 (ChannelMessage protocol), M7-003 (Matrix integration design), M7-004 (conversation multiplexing), M7-005 (remote auth bridging), M7-006 (agent-to-agent communication via Matrix), M7-007 (multi-user isolation in Matrix)
 
 ---
 
@@ -11,80 +11,93 @@
 
 The channel protocol defines a unified abstraction layer between Mosaic's core messaging infrastructure and the external communication channels it supports (Matrix, Discord, Telegram, TUI, WebUI, and future channels).
 
-The implemented baseline is exported from `@mosaicstack/types` and consists of four contract groups:
+The protocol consists of two main contracts:
 
-1. `OfficialChannelAdapter` — transport lifecycle and connection health.
+1. `IChannelAdapter` — the interface each channel driver must implement.
-2. `ChannelMessageDto` / `ChannelAttachmentDto` — canonical transport data.
+2. `ChannelMessage` — the canonical message format that flows through the system.
-3. `ChannelConversationRouteDto` — stable logical-agent conversation and authorization address.
-4. `ChannelResponseTargetDto` — channel/thread destination for replies.
 
-All channel-specific translation logic lives inside the adapter implementation. Runtime selection does not: gateway durable-session and provider services may rebind the logical session from Claude to Codex, Pi, OpenCode, or another harness without reconnecting the channel adapter.
+All channel-specific translation logic lives inside the adapter implementation. The rest of Mosaic works exclusively with `ChannelMessage` objects.
 
 ---
 
-## M7-001: OfficialChannelAdapter Interface
+## M7-001: IChannelAdapter Interface
 
 ```typescript
-interface OfficialChannelAdapter {
+interface IChannelAdapter {
-  /** Stable, lowercase adapter identifier such as "discord" or "matrix". */
+  /**
+   * Stable, lowercase identifier for this channel (e.g. "matrix", "discord").
+   * Used as a namespace key in registry lookups and log metadata.
+   */
   readonly name: string;
-  /** Establish both native-channel and gateway connections. */
+
-  start(): Promise<void>;
+  /**
-  /** Gracefully close connections and release resources. */
+   * Establish a connection to the external channel backend.
-  stop(): Promise<void>;
+   * Called once at application startup. Must be idempotent (safe to call
-  /** Best-effort health; ordinary disconnection is a result, not an exception. */
+   * when already connected).
-  health(): Promise<{
+   */
-    status: 'connected' | 'degraded' | 'disconnected';
+  connect(): Promise<void>;
-    detail?: string;
+
-  }>;
+  /**
+   * Gracefully disconnect from the channel backend.
+   * Must flush in-flight sends and release resources before resolving.
+   */
+  disconnect(): Promise<void>;
+
+  /**
+   * Return the current health of the adapter connection.
+   * Used by the admin health endpoint and alerting.
+   *
+   * - "connected"    — fully operational
+   * - "degraded"     — partial connectivity (e.g. read-only, rate-limited)
+   * - "disconnected" — no connection to channel backend
+   */
+  health(): Promise<{ status: 'connected' | 'degraded' | 'disconnected' }>;
+
+  /**
+   * Register an inbound message handler.
+   * The adapter calls `handler` for every message received from the channel.
+   * Multiple calls replace the previous handler (last-write-wins).
+   * The handler is async; the adapter must not deliver new messages until
+   * the previous handler promise resolves (back-pressure).
+   */
+  onMessage(handler: (msg: ChannelMessage) => Promise<void>): void;
+
+  /**
+   * Send a ChannelMessage to the given channel/room/conversation.
+   * `channelId` is the channel-native identifier (e.g. Matrix room ID,
+   * Discord channel snowflake, Telegram chat ID).
+   */
+  sendMessage(channelId: string, msg: ChannelMessage): Promise<void>;
+
+  /**
+   * Map a channel-native user identifier to the Mosaic internal userId.
+   * Returns null when no matching Mosaic account exists for the given
+   * channelUserId (anonymous or unlinked user).
+   */
+  mapIdentity(channelUserId: string): Promise<string | null>;
 }
 ```
 
-The small lifecycle seam lets the gateway host official plugins uniformly without moving native message translation into gateway core. Message ingress remains adapter-owned; gateway policy, durable session routing, auditing, and runtime/provider selection remain gateway-owned.
-
-### Stable conversation route
-
-```typescript
-interface ChannelConversationRouteDto {
-  bindingId: string;
-  logicalAgentId: string;
-  conversationId: string;
-  channelName: string;
-  authorizationChannelId: string;
-  responseTarget: { channelId: string; threadId?: string };
-}
-```
-
-Harness, provider, model, process, and native runtime-session identifiers are forbidden from this route. Runtime adapters consume the gateway's durable logical-session binding; channel adapters consume only the stable route and response target.
-
-### Typed ingress and egress ports
-
-`ChannelIngressPort` is the transport-neutral direct-integration seam for official adapters. The current deployed Discord adapter preserves its existing HMAC-signed Socket.IO compatibility ingress so gateway-side service authentication, replay protection, approval handling, and correlation semantics remain unchanged; it normalizes the same `ChannelIngressDto` before signing. The adapter uses a supplied `ChannelIngressPort` directly when a future gateway registration provides one. New adapters must use the shared ports rather than adding channel branches to gateway core.
-
-`ChannelBindingDto` contains the configuration-owned workspace/channel→logical-agent mapping and paired external principals; credentials are absent. After native allowlist, pairing, and role checks pass, an adapter submits `ChannelIngressDto` to `ChannelIngressPort.receive()`. It includes the normalized message, `ChannelAuthorizedPrincipalDto`, operation, correlation ID, native message ID, and stable route. Unauthorized input never reaches the port.
-
-Gateway policy and runtime routing produce `ChannelEgressDto`, which `ChannelEgressPort.send()` delivers to the route's response target. Discord's existing HMAC envelope is its authenticated wire encoding of this boundary; future Matrix/Slack adapters use their native authenticated transports while preserving the same actor/operation/correlation semantics.
-
 ### Adapter Registration
 
-Adapters are registered with the gateway plugin host at startup. The host calls `start()`/`stop()` and may monitor `health()` on a configurable interval. A richer dynamic `ChannelRegistry` remains a compatible future extension of this lifecycle contract.
+Adapters are registered with the `ChannelRegistry` service at startup. The registry calls `connect()` on each adapter and monitors `health()` on a configurable interval (default: 30 s).
 
 ```
 ChannelRegistry
-  └── register(adapter: OfficialChannelAdapter): void
+  └── register(adapter: IChannelAdapter): void
-  └── getAdapter(name: string): OfficialChannelAdapter | null
+  └── getAdapter(name: string): IChannelAdapter | null
-  └── listAdapters(): OfficialChannelAdapter[]
+  └── listAdapters(): IChannelAdapter[]
   └── healthAll(): Promise<Record<string, AdapterHealth>>
 ```
 
 ---
 
-## M7-002: ChannelMessageDto Protocol
+## M7-002: ChannelMessage Protocol
 
 ### Canonical Message Format
 
 ```typescript
-interface ChannelMessageDto {
+interface ChannelMessage {
   /**
    * Globally unique message ID.
    * Format: UUID v4. Generated by the adapter when receiving, or by Mosaic
@@ -97,7 +110,6 @@ interface ChannelMessageDto {
    * The adapter populates this from the inbound message.
    * For outbound messages, the caller supplies the target channel.
    */
-  channelName: string;
   channelId: string;
 
   /**
@@ -107,7 +119,7 @@ interface ChannelMessageDto {
   senderId: string;
 
   /** Sender classification. */
-  senderKind: 'user' | 'agent' | 'system';
+  senderType: 'user' | 'agent' | 'system';
 
   /**
    * Textual content of the message.
@@ -124,7 +136,7 @@ interface ChannelMessageDto {
    * - "image"    — binary image; content is empty, see attachments
    * - "file"     — binary file; content is empty, see attachments
    */
-  contentKind: 'text' | 'markdown' | 'code' | 'image' | 'file';
+  contentType: 'text' | 'markdown' | 'code' | 'image' | 'file';
 
   /**
    * Arbitrary key-value metadata for channel-specific extension fields.
@@ -132,7 +144,7 @@ interface ChannelMessageDto {
    * Adapters should store channel-native IDs here so round-trip correlation
    * is possible without altering the canonical fields.
    */
-  metadata: Readonly<Record<string, ChannelMetadataValue>>;
+  metadata: Record<string, unknown>;
 
   /**
    * Optional thread or reply-chain identifier.
@@ -151,21 +163,18 @@ interface ChannelMessageDto {
    * Binary or URI-referenced attachments.
    * Each attachment carries its MIME type and a URL or base64 payload.
    */
-  attachments?: readonly ChannelAttachmentDto[];
+  attachments?: ChannelAttachment[];
 
-  /** ISO-8601 wall-clock timestamp when the message was sent/received. */
+  /** Wall-clock timestamp when the message was sent/received. */
-  timestamp: string;
+  timestamp: Date;
 }
 
-interface ChannelAttachmentDto {
+interface ChannelAttachment {
-  /** Channel-native attachment identifier. */
+  /** Filename or identifier. */
-  id: string;
-
-  /** Filename or display name. */
   name: string;
 
-  /** MIME type when supplied by the channel. */
+  /** MIME type (e.g. "image/png", "application/pdf"). */
-  mimeType: string | null;
+  mimeType: string;
 
   /**
    * URL pointing to the attachment, OR a `data:` URI with base64 payload.
@@ -183,23 +192,23 @@ interface ChannelAttachmentDto {
 
 ## Channel Translation Reference
 
-The following sections document how each supported channel maps its native message format to and from `ChannelMessageDto`.
+The following sections document how each supported channel maps its native message format to and from `ChannelMessage`.
 
 ### Matrix
 
-| ChannelMessageDto field | Matrix equivalent                                                                                                                 |
+| ChannelMessage field | Matrix equivalent                                                                                                                 |
-| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Matrix event ID (`$...`)                                                            |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Matrix event ID (`$...`)                                                            |
-| `channelId`             | Matrix room ID (`!roomid:homeserver`)                                                                                             |
+| `channelId`          | Matrix room ID (`!roomid:homeserver`)                                                                                             |
-| `senderId`              | Matrix user ID (`@user:homeserver`)                                                                                               |
+| `senderId`           | Matrix user ID (`@user:homeserver`)                                                                                               |
-| `senderKind`            | Always `"user"` for inbound; `"agent"` or `"system"` for outbound                                                                 |
+| `senderType`         | Always `"user"` for inbound; `"agent"` or `"system"` for outbound                                                                 |
-| `content`               | `event.content.body`                                                                                                              |
+| `content`            | `event.content.body`                                                                                                              |
-| `contentKind`           | `"markdown"` if `msgtype = m.text` and body contains markdown; `"text"` otherwise; `"image"` for `m.image`; `"file"` for `m.file` |
+| `contentType`        | `"markdown"` if `msgtype = m.text` and body contains markdown; `"text"` otherwise; `"image"` for `m.image`; `"file"` for `m.file` |
-| `threadId`              | `event.content['m.relates_to']['event_id']` when `rel_type = m.thread`                                                            |
+| `threadId`           | `event.content['m.relates_to']['event_id']` when `rel_type = m.thread`                                                            |
-| `replyToId`             | Mosaic ID looked up from `event.content['m.relates_to']['m.in_reply_to']['event_id']`                                             |
+| `replyToId`          | Mosaic ID looked up from `event.content['m.relates_to']['m.in_reply_to']['event_id']`                                             |
-| `attachments`           | Populated from `url` in `m.image` / `m.file` events                                                                               |
+| `attachments`        | Populated from `url` in `m.image` / `m.file` events                                                                               |
-| `timestamp`             | `new Date(event.origin_server_ts)`                                                                                                |
+| `timestamp`          | `new Date(event.origin_server_ts)`                                                                                                |
-| `metadata`              | `{ channelMessageId, roomId, eventType, unsigned }`                                                                               |
+| `metadata`           | `{ channelMessageId, roomId, eventType, unsigned }`                                                                               |
 
 **Outbound:** Adapter sends `m.room.message` with `msgtype = m.text` (or `m.notice` for system messages). Markdown content is sent with `format = org.matrix.custom.html` and a rendered HTML body.
 
@@ -207,34 +216,21 @@ The following sections document how each supported channel maps its native messa
 
 ### Discord
 
-| ChannelMessageDto field | Discord equivalent                                                      |
+| ChannelMessage field | Discord equivalent                                                      |
-| ----------------------- | ----------------------------------------------------------------------- |
+| -------------------- | ----------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Discord message snowflake |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Discord message snowflake |
-| `channelId`             | Discord channel ID (snowflake string)                                   |
+| `channelId`          | Discord channel ID (snowflake string)                                   |
-| `senderId`              | Discord user ID (snowflake)                                             |
+| `senderId`           | Discord user ID (snowflake)                                             |
-| `senderKind`            | `"user"` for human members; `"agent"` for bot messages                  |
+| `senderType`         | `"user"` for human members; `"agent"` for bot messages                  |
-| `content`               | `message.content`                                                       |
+| `content`            | `message.content`                                                       |
-| `contentKind`           | `"markdown"` (Discord uses a markdown-like syntax natively)             |
+| `contentType`        | `"markdown"` (Discord uses a markdown-like syntax natively)             |
-| `threadId`              | `message.thread.id` when the message is inside a thread channel         |
+| `threadId`           | `message.thread.id` when the message is inside a thread channel         |
-| `replyToId`             | Mosaic ID looked up from `message.referenced_message.id`                |
+| `replyToId`          | Mosaic ID looked up from `message.referenced_message.id`                |
-| `attachments`           | `message.attachments` mapped to `ChannelAttachmentDto`                  |
+| `attachments`        | `message.attachments` mapped to `ChannelAttachment`                     |
-| `timestamp`             | `new Date(message.timestamp)`                                           |
+| `timestamp`          | `new Date(message.timestamp)`                                           |
-| `metadata`              | `{ channelMessageId, guildId, channelType, mentions, embeds }`          |
+| `metadata`           | `{ channelMessageId, guildId, channelType, mentions, embeds }`          |
 
-**Outbound:** Adapter calls Discord REST `POST /channels/{id}/messages`. Markdown content is sent as-is (Discord renders it). For `contentKind = "code"` the adapter wraps in triple-backtick fences with the `metadata.language` tag.
+**Outbound:** Adapter calls Discord REST `POST /channels/{id}/messages`. Markdown content is sent as-is (Discord renders it). For `contentType = "code"` the adapter wraps in triple-backtick fences with the `metadata.language` tag.
-
-### Discord routing and thread policy
-
-A configured Discord binding maps `(guildId, parentChannelId)` to a stable logical agent and a trusted gateway agent-config ID. Gateway verifies that configuration's name matches the binding logical agent before session creation. The stable conversation handle is derived from logical agent plus response channel/thread and never includes the active harness, provider, model, process, or agent-config ID.
-
-| Inbound location/trigger                   | Conversation and response target                                |
-| ------------------------------------------ | --------------------------------------------------------------- |
-| Authorized untagged parent-channel message | Parent channel; response is sent in-channel                     |
-| Authorized bot mention in parent channel   | Thread already attached to that message, or a new public thread |
-| Authorized message already in a thread     | Existing thread; no repeated mention and no nested thread       |
-| `/approve` or `/stop <approval>`           | Current parent/thread durable session; no new topic is created  |
-
-Authorization order is fixed: guild allowlist → parent-channel allowlist → user allowlist → configured binding/pairing → operation role → per-user/channel message and thread rate limits → thread creation/dispatch. A normal Discord channel's category parent is never treated as the thread authorization parent. If requested thread creation fails, dispatch does not occur because the adapter cannot honor the response target.
 
 ### Discord service ingress security
 
@@ -244,21 +240,21 @@ The Discord adapter is an authenticated gateway service, not an anonymous Socket
 
 ### Telegram
 
-| ChannelMessageDto field | Telegram equivalent                                                                                           |
+| ChannelMessage field | Telegram equivalent                                                                                           |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------- |
+| -------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Telegram `message_id` (integer)                                 |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Telegram `message_id` (integer)                                 |
-| `channelId`             | Telegram `chat_id` (integer as string)                                                                        |
+| `channelId`          | Telegram `chat_id` (integer as string)                                                                        |
-| `senderId`              | Telegram `from.id` (integer as string)                                                                        |
+| `senderId`           | Telegram `from.id` (integer as string)                                                                        |
-| `senderKind`            | `"user"` for human senders; `"agent"` for bot-originated messages                                             |
+| `senderType`         | `"user"` for human senders; `"agent"` for bot-originated messages                                             |
-| `content`               | `message.text` or `message.caption`                                                                           |
+| `content`            | `message.text` or `message.caption`                                                                           |
-| `contentKind`           | `"text"` for plain; `"markdown"` if `parse_mode = MarkdownV2`; `"image"` for `photo`; `"file"` for `document` |
+| `contentType`        | `"text"` for plain; `"markdown"` if `parse_mode = MarkdownV2`; `"image"` for `photo`; `"file"` for `document` |
-| `threadId`              | `message.message_thread_id` (for supergroup topics)                                                           |
+| `threadId`           | `message.message_thread_id` (for supergroup topics)                                                           |
-| `replyToId`             | Mosaic ID looked up from `message.reply_to_message.message_id`                                                |
+| `replyToId`          | Mosaic ID looked up from `message.reply_to_message.message_id`                                                |
-| `attachments`           | `photo`, `document`, `video` fields mapped to `ChannelAttachmentDto`                                          |
+| `attachments`        | `photo`, `document`, `video` fields mapped to `ChannelAttachment`                                             |
-| `timestamp`             | `new Date(message.date * 1000)`                                                                               |
+| `timestamp`          | `new Date(message.date * 1000)`                                                                               |
-| `metadata`              | `{ channelMessageId, chatType, fromUsername, forwardFrom }`                                                   |
+| `metadata`           | `{ channelMessageId, chatType, fromUsername, forwardFrom }`                                                   |
 
-**Outbound:** Adapter calls Telegram Bot API `sendMessage` with `parse_mode = MarkdownV2` for markdown content. For `contentKind = "image"` or `"file"` it uses `sendPhoto` / `sendDocument`.
+**Outbound:** Adapter calls Telegram Bot API `sendMessage` with `parse_mode = MarkdownV2` for markdown content. For `contentType = "image"` or `"file"` it uses `sendPhoto` / `sendDocument`.
 
 ---
 
@@ -266,19 +262,19 @@ The Discord adapter is an authenticated gateway service, not an anonymous Socket
 
 The TUI adapter bridges Mosaic's terminal interface (`packages/cli`) to the channel protocol so that TUI sessions can be treated as a first-class channel.
 
-| ChannelMessageDto field | TUI equivalent                                                     |
+| ChannelMessage field | TUI equivalent                                                     |
-| ----------------------- | ------------------------------------------------------------------ |
+| -------------------- | ------------------------------------------------------------------ |
-| `id`                    | Generated UUID (TUI has no native message IDs)                     |
+| `id`                 | Generated UUID (TUI has no native message IDs)                     |
-| `channelId`             | `"tui:<conversationId>"` — the active conversation ID              |
+| `channelId`          | `"tui:<conversationId>"` — the active conversation ID              |
-| `senderId`              | Authenticated Mosaic `userId`                                      |
+| `senderId`           | Authenticated Mosaic `userId`                                      |
-| `senderKind`            | `"user"` for human input; `"agent"` for agent replies              |
+| `senderType`         | `"user"` for human input; `"agent"` for agent replies              |
-| `content`               | Raw text from stdin / agent output                                 |
+| `content`            | Raw text from stdin / agent output                                 |
-| `contentKind`           | `"text"` for input; `"markdown"` for agent responses               |
+| `contentType`        | `"text"` for input; `"markdown"` for agent responses               |
-| `threadId`              | Not used (TUI sessions are linear)                                 |
+| `threadId`           | Not used (TUI sessions are linear)                                 |
-| `replyToId`             | Not used                                                           |
+| `replyToId`          | Not used                                                           |
-| `attachments`           | File paths dragged/pasted into the TUI; resolved to `file://` URLs |
+| `attachments`        | File paths dragged/pasted into the TUI; resolved to `file://` URLs |
-| `timestamp`             | `new Date()` at the moment of send                                 |
+| `timestamp`          | `new Date()` at the moment of send                                 |
-| `metadata`              | `{ conversationId, sessionId, ttyWidth, colorSupport }`            |
+| `metadata`           | `{ conversationId, sessionId, ttyWidth, colorSupport }`            |
 
 **Outbound:** The adapter writes rendered content to stdout. Markdown is rendered via a terminal markdown renderer (e.g. `marked-terminal`). Code blocks are syntax-highlighted when `metadata.colorSupport = true`.
 
@@ -288,19 +284,19 @@ The TUI adapter bridges Mosaic's terminal interface (`packages/cli`) to the chan
 
 The WebUI adapter connects the Next.js frontend (`apps/web`) to the channel protocol over the existing Socket.IO gateway (`apps/gateway`).
 
-| ChannelMessageDto field | WebUI equivalent                                             |
+| ChannelMessage field | WebUI equivalent                                             |
-| ----------------------- | ------------------------------------------------------------ |
+| -------------------- | ------------------------------------------------------------ |
-| `id`                    | Generated UUID; echoed back in the WebSocket event           |
+| `id`                 | Generated UUID; echoed back in the WebSocket event           |
-| `channelId`             | `"webui:<conversationId>"`                                   |
+| `channelId`          | `"webui:<conversationId>"`                                   |
-| `senderId`              | Authenticated Mosaic `userId`                                |
+| `senderId`           | Authenticated Mosaic `userId`                                |
-| `senderKind`            | `"user"` for browser input; `"agent"` for agent responses    |
+| `senderType`         | `"user"` for browser input; `"agent"` for agent responses    |
-| `content`               | Message text from the input field                            |
+| `content`            | Message text from the input field                            |
-| `contentKind`           | `"text"` or `"markdown"`                                     |
+| `contentType`        | `"text"` or `"markdown"`                                     |
-| `threadId`              | Not used (conversation model handles threading)              |
+| `threadId`           | Not used (conversation model handles threading)              |
-| `replyToId`             | Message ID the user replied to (UI reply affordance)         |
+| `replyToId`          | Message ID the user replied to (UI reply affordance)         |
-| `attachments`           | Files uploaded via the file picker; stored to object storage |
+| `attachments`        | Files uploaded via the file picker; stored to object storage |
-| `timestamp`             | `new Date()` at send, or server timestamp from event         |
+| `timestamp`          | `new Date()` at send, or server timestamp from event         |
-| `metadata`              | `{ conversationId, sessionId, clientTimezone, userAgent }`   |
+| `metadata`           | `{ conversationId, sessionId, clientTimezone, userAgent }`   |
 
 **Outbound:** Adapter emits a `chat:message` Socket.IO event. The WebUI React component receives it and appends to the conversation list. Markdown content is rendered client-side via the existing markdown renderer component.
 
@@ -308,7 +304,7 @@ The WebUI adapter connects the Next.js frontend (`apps/web`) to the channel prot
 
 ## Identity Mapping
 
-Gateway identity-linking policy resolves a channel-native user identifier to a Mosaic `userId` and produces `ChannelAuthorizedPrincipalDto`. Adapters provide native identity evidence but cannot self-authorize Mosaic scope. Discord currently uses configuration-owned paired users; database-backed linking remains the canonical direction for dynamic Matrix/Slack identity.
+`mapIdentity(channelUserId)` resolves a channel-native user identifier to a Mosaic `userId`. This is required to attribute inbound messages to authenticated Mosaic accounts.
 
 The implementation must query a `channel_identities` table (or equivalent) keyed on `(channel_name, channel_user_id)`. When no mapping exists the method returns `null` and the message is treated as anonymous (no Mosaic session context).
 
@@ -327,8 +323,8 @@ Identity linking flows (OAuth dance, deep-link verification token, etc.) are out
 
 ## Error Handling Conventions
 
-- `start()` must establish the native channel transport or throw a structured connection error. An adapter hosted inside the gateway must not wait for a loopback connection to that same not-yet-listening process; it starts the native transport, lets Socket.IO reconnect, and reports `degraded` until both links are ready.
+- `connect()` must throw a structured error (subclass of `ChannelConnectError`) if the initial connection cannot be established within a reasonable timeout (default: 10 s).
-- `ChannelEgressPort.send()` implementations must throw a typed terminal error for revoked auth, an invalid route, or a missing channel. Only transient rate/network/server failures are retried with bounded exponential backoff; Discord retries reuse a stable enforced nonce to prevent duplicate chunks, while permanent 4xx failures are not retried.
+- `sendMessage()` must throw `ChannelSendError` on terminal failures (auth revoked, channel not found). Transient failures (rate limit, network blip) should be retried internally with exponential backoff before throwing.
 - `health()` must never throw — it returns `{ status: 'disconnected' }` on error.
 - Adapters must emit structured logs with `{ channel: adapter.name, event, ... }` metadata for observability.
 
@@ -336,7 +332,7 @@ Identity linking flows (OAuth dance, deep-link verification token, etc.) are out
 
 ## Versioning
 
-The `ChannelMessageDto` protocol follows semantic versioning. Non-breaking field additions (new optional fields) are minor version bumps. Breaking changes (type changes, required field additions) require a major version bump and a migration guide.
+The `ChannelMessage` protocol follows semantic versioning. Non-breaking field additions (new optional fields) are minor version bumps. Breaking changes (type changes, required field additions) require a major version bump and a migration guide.
 
 Current version: **1.0.0**
 
@@ -477,7 +473,7 @@ A single Mosaic conversation can be accessed simultaneously from multiple surfac
 ### Real-Time Sync Flow
 
 1. A message arrives on any surface (TUI keystroke, browser send, Matrix event).
-2. The surface's adapter normalizes the message to `ChannelMessageDto` and delivers it to `ConversationService`.
+2. The surface's adapter normalizes the message to `ChannelMessage` and delivers it to `ConversationService`.
 3. `ConversationService` persists the message to PostgreSQL, assigns a canonical `id`, and publishes a `message:new` event to the Valkey pub/sub channel keyed by `conversationId`.
 4. All active surfaces subscribed to that `conversationId` receive the fanout event and push it to their respective clients:
    - TUI adapter: writes rendered output to the connected terminal session.
@@ -565,7 +561,7 @@ Matrix sessions for linked users are persistent and long-lived. Unlike TUI sessi
 - Their `channel_identities` row exists (link not revoked).
 - They remain members of the relevant Matrix rooms.
 
-Revoking a Matrix link (`DELETE /auth/channel-link/matrix/<matrixUserId>`) removes the `channel_identities` row and causes gateway principal resolution to deny the identity. The appservice optionally kicks the Matrix user from all Mosaic-managed rooms as part of the revocation flow (configurable, default: off).
+Revoking a Matrix link (`DELETE /auth/channel-link/matrix/<matrixUserId>`) removes the `channel_identities` row and causes `mapIdentity()` to return `null`. The appservice optionally kicks the Matrix user from all Mosaic-managed rooms as part of the revocation flow (configurable, default: off).
 
 ---
 
@@ -737,7 +733,7 @@ room_retention_policies
   created_at       TIMESTAMP
 ```
 
-The retention policy is enforced by a background job in the gateway that calls Conduit's admin API to purge events older than the configured threshold. Purged events are removed from the Conduit store but Mosaic's PostgreSQL message store retains the canonical `ChannelMessageDto` record unless the Mosaic retention policy also covers it.
+The retention policy is enforced by a background job in the gateway that calls Conduit's admin API to purge events older than the configured threshold. Purged events are removed from the Conduit store but Mosaic's PostgreSQL message store retains the canonical `ChannelMessage` record unless the Mosaic retention policy also covers it.
 
 Default retention values:
 

docs/architecture/mos-runtime-portability-m1.md

@@ -1,49 +0,0 @@
-# Mos Runtime Portability M1 — Logical Identity and Fencing
-
-## Boundary
-
-M1 separates the logical Mosaic agent from any Claude, Pi, Codex, tmux, Matrix, or provider-native session. The normalized identity is:
-
-```text
-(tenant_id, logical_agent_id, binding_id)
-```
-
-`logical_agent_id` is a server-owned stable identifier. A connector is a replaceable holder of a lease for one binding; it is not the agent identity.
-
-## Durable lease model
-
-PostgreSQL table `logical_agent_connector_leases` has one unique row per identity/binding tuple. The current row records:
-
-- an opaque lease UUID;
-- connector ID and normalized allowed scopes;
-- a positive decimal fencing epoch stored as PostgreSQL `bigint`;
-- acquired, heartbeat, expiry, release, and update timestamps.
-
-Initial acquisition is insert-only. An existing active row causes `lease_held`. An expired or released row causes `takeover_required`; ordinary acquisition cannot recover it. Authorized takeover uses compare-and-swap against the expected epoch, rotates the lease UUID, and increments the epoch atomically. Heartbeat and release match the full identity, binding, connector, lease UUID, and epoch.
-
-The companion `connector_lease_audit_log` is append-only metadata. It stores lifecycle event, outcome/reason, identity/binding/connector, epoch, correlation ID, and timestamp. It deliberately excludes scopes, grant objects, payloads, approval references, tokens, and credentials.
-
-## Execution grants
-
-`ConnectorLeaseCoordinator` issues a short-lived internal grant only after rereading the durable current lease. Defense-in-depth caps leases at 5 minutes and grants at 30 seconds by default; constructor options may tighten these limits. A grant is bound to tenant, logical agent, binding, connector, lease UUID, scope subset, expiry, and epoch.
-
-Validation occurs immediately before adapter invocation and rereads PostgreSQL. The adapter receives only `ConnectorExecutionContext`; harness-native schemas remain behind the adapter. Validation denies:
-
-- grants not minted by the current gateway process (including cloned/forged objects);
-- expired grants or leases;
-- released leases;
-- stale epochs or replaced connector/lease UUIDs;
-- missing/cross-tenant/cross-agent/cross-binding leases;
-- scopes not authorized by both grant and current lease.
-
-A gateway restart intentionally invalidates process-local grants. The durable lease and epoch survive, and a fresh grant may be issued only after current-lease and gateway-policy validation.
-
-## Concurrency and side-effect rule
-
-The database CAS determines the sole current holder. A successful takeover makes every old-epoch validation fail. Connector adapters must consume and propagate the normalized lease epoch/context so downstream effect boundaries can also fence races that occur after gateway validation.
-
-M1 does not provide exactly-once receipts or a side-effect journal. Those remain later #754 work; callers must not infer exactly-once delivery from lease fencing.
-
-## Extension boundary
-
-`ConnectorLeaseService` is the gateway-owned policy surface. Every policy decision receives the normalized requested scopes and TTL (or explicit `null` where no TTL applies), so a concrete policy can enforce least privilege and duration limits. Its production default policy denies every lease/grant operation until a server-configured connector policy is supplied. No M1 HTTP endpoint accepts caller-controlled tenant or logical identity, and no concrete Claude/Pi/Codex adapter or channel cutover is included.

docs/compaction-refresh/GATE0-EVIDENCE.md

@@ -1,352 +0,0 @@
-# Compaction-Refresh WI-0 Gate0 Evidence Pack
-
-- **Issue:** Gitea #827
-- **Milestone:** 188 — Compaction-Refresh Mechanism
-- **Branch:** `feat/827-gate0-probe`
-- **Starting HEAD:** `d801d6c4c8a984d6a95033c49714210018d3d9a8`
-- **Host/runtime:** Linux 6.1.0-48-amd64; Mosaic 0.0.48; Pi 0.80.7; Claude Code 2.1.205
-- **Scope:** Probe fixtures and evidence only. No WI-1..WI-7 feature implementation.
-
-## Verdict — 5/6 PASS; BUILD ADMISSION: **NO**
-
-| Probe | Verdict | Short result |
-| --- | --- | --- |
-| P1 launcher topology + ancestry | **PASS** | Real Mosaic→Pi and Mosaic→Claude chains reached the registered anchor; real Claude `SessionStart` hook ancestry accepted; same-UID sibling with the minted victim ID rejected. |
-| P2 Pi last-position + nonce map | **PASS** | Real Pi proved last-or-closed; `message_end` mapped exact `toolCallId → requestNonce` before `tool_call`; provider-response hook occurred before stream consumption/content completion. |
-| P3 same-PID generation revocation | **PASS** | Same Pi PID/starttime persisted through reload/fork/new/resume while broker generations increased; reload revoked a prior `VERIFIED` generation. |
-| P4 `SO_PEERCRED` + socket posture | **PASS** | Real Unix socket peer PID/UID/starttime matched `/proc`; 0700 directory + 0600 socket demonstrated. Same-UID counterfeit replacement remains explicitly T-C without a distinct principal/authenticated response. |
-| P5 source invalidation | **PASS** | Missing, oversize, and hash-mismatched fragments each refused injection/promotion, revoked broker state, and blocked the exact emitted tool call. |
-| P6 atomic injection | **T-C GAP** | Both runtimes empirically delivered a complete single block/message, but neither installed runtime contract states an **atomic/prefix-preserving** transport guarantee. Observation is not a guarantee; A-v5-1/T27 cannot be admitted. |
-
-**Planner return item:** P6. The evidence establishes successful complete delivery in these runs, not the required invariant that the harness cannot middle-drop/replace bytes while preserving the terminal token. Per R1, such a middle-drop is not receipt-detectable. It is therefore classed **T-C**, not assumed away.
-
-## STEP 0 — Authority re-verification
-
-Command:
-
-```bash
-sha256sum \
-  ~/agent-work/reviews/compaction-refresh-BUILD-BRIEF.md \
-  ~/agent-work/reviews/compaction-refresh-SPEC-v5.md \
-  ~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md
-```
-
-Captured result:
-
-```text
-89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b  .../compaction-refresh-BUILD-BRIEF.md
-a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433  .../compaction-refresh-SPEC-v5.md
-bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67  .../compaction-refresh-SPEC-RATIFICATION.md
-```
-
-All three **MATCH**. They were read in full before probe construction. Raw artifact: [`evidence/raw/STEP0-authority-hashes.txt`](./evidence/raw/STEP0-authority-hashes.txt).
-
-## Evidence method
-
-The scripts under [`probes/`](./probes/) are isolated Gate0 instrumentation, not product implementation. They run the installed `mosaic yolo` launcher and real installed runtime binaries. Broker prototypes use Linux `SO_PEERCRED` and `/proc`; runtime adapters are temporary Claude hooks/Pi extensions. No product source under `packages/mosaic` was changed.
-
-Raw-output artifact integrity is indexed at [`evidence/RAW-SHA256SUMS.txt`](./evidence/RAW-SHA256SUMS.txt).
-
----
-
-## P1 — Launcher exec/parent topology + supported-hook ancestry (D1)
-
-**Verdict: PASS**
-
-### Commands
-
-```bash
-python3 docs/compaction-refresh/probes/p1_run.py --runtime both
-rg -n "spawnSync|execRuntime" \
-  ~/.npm-global/lib/node_modules/@mosaicstack/mosaic/dist/commands/launch.js | tail -8
-```
-
-Full outputs:
-
-- [`evidence/raw/P1-launch-ancestry.txt`](./evidence/raw/P1-launch-ancestry.txt)
-- [`evidence/raw/P1-claude-hook-events.txt`](./evidence/raw/P1-claude-hook-events.txt)
-
-### Real topology observed
-
-The installed Mosaic launcher does **not** replace itself with the runtime despite its `execRuntime` name; installed `launch.js:668` uses `spawnSync`. The Gate0 anchor first registered, then `execvpe` replaced the anchor with the real `mosaic yolo` process (PID/starttime retained). Mosaic remained the stable parent while it spawned the runtime.
-
-Pi run:
-
-```text
-anchor before exec: pid=4010843 starttime=365919858 exe=/usr/bin/python3.11
-anchor after exec:  pid=4010843 starttime=365919858 exe=/usr/bin/node
-Pi runtime:         pid=4011046 ppid=4010843 starttime=365920219 exe=/usr/bin/node
-
-ps:
-4010843 4010840 Fri Jul 17 19:35:18 2026 1001 1001 node
-4011046 4010843 Fri Jul 17 19:35:22 2026 1001 1001 pi
-```
-
-Claude supported-hook run (latest capture):
-
-```text
-hook python  pid=4011380 starttime=365920845
-  -> /bin/sh pid=4011379 starttime=365920845
-  -> claude  pid=4011285 starttime=365920748
-  -> node/mosaic anchor pid=4011129 starttime=365920380
-```
-
-The stream independently recorded the real hook firing:
-
-```json
-{"type":"system","subtype":"hook_started","hook_name":"SessionStart:startup","hook_event":"SessionStart"}
-{"type":"system","subtype":"hook_response","hook_name":"SessionStart:startup","exit_code":0,"outcome":"success","stdout":"...GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED..."}
-```
-
-### Authentication and sibling substitution
-
-The broker minted the logical ID on first peercred contact and keyed the anchor by `(pid,starttime)`. It took the hook/extension PID from `SO_PEERCRED`, walked `/proc/<pid>/stat`, and re-read every starttime before accepting.
-
-Real Pi acceptance excerpt:
-
-```json
-{"peercred":{"pid":4011046,"uid":1001,"gid":1001},"decision":"ACCEPT","reason":"ancestry-reaches-registered-anchor","starttimes_rechecked":true}
-```
-
-A separately spawned same-UID sibling was given the real minted victim ID. Its ancestry did not reach the anchor:
-
-```json
-{"attacker_uid":1001,"victim_session_id_known":true,"broker_decision":"REJECT","broker_reason":"victim-id-known-but-ancestry-mismatch"}
-```
-
-The same rejection occurred in both Pi and Claude runs. This is positive runtime evidence for D1/T15a under the supported non-daemonizing topology.
-
----
-
-## P2 — Pi last-position invariant + nonce map (D5)
-
-**Verdict: PASS**
-
-### Commands
-
-```bash
-python3 docs/compaction-refresh/probes/pi_gate0_run.py
-python3 docs/compaction-refresh/probes/p2_provider_timing_run.py
-```
-
-Full outputs:
-
-- [`evidence/raw/P2-P3-P5-P6-pi.txt`](./evidence/raw/P2-P3-P5-P6-pi.txt)
-- [`evidence/raw/P2-provider-timing.txt`](./evidence/raw/P2-provider-timing.txt)
-
-### Last-or-closed evidence
-
-Real Pi argv/load order with the probe last:
-
-```json
-{"extensions":[".../mosaic-extension.ts",".../pi_gate0_extension.ts"],"lastPosition":true,"gateState":"UNVERIFIED_READY","pid":4004545}
-```
-
-A second real Pi launch deliberately appended a later handler:
-
-```json
-{"extensions":[".../mosaic-extension.ts",".../pi_gate0_extension.ts",".../pi_later_extension.ts"],"lastPosition":false,"gateState":"CLOSED_NOT_LAST","pid":4005692}
-```
-
-Thus the invariant observed is exactly **last or closed**, not an asserted registration order.
-
-### Exact nonce → tool-call-ID map
-
-In one real GPT-5.6 Sol Pi response, sequence 5 completed the assistant tool-call message and bound its exact ID:
-
-```json
-{"seq":5,"event":"message_end","requestNonce":"e5a82358-a6c9-490b-a0de-2e1f1d9b8d79","toolCallIds":["call_bgGE...57c"],"nonceMappings":[{"toolCallId":"call_bgGE...57c","requestNonce":"e5a82358-a6c9-490b-a0de-2e1f1d9b8d79"}]}
-```
-
-The following `tool_call` was sequence 6 and carried the same ID/nonce:
-
-```json
-{"seq":6,"event":"tool_call","toolCallId":"call_bgGE...57c","mapping":{"nonce":"e5a82358-a6c9-490b-a0de-2e1f1d9b8d79","verified":true},"allowed":true}
-```
-
-The harmless tool executed at sequence 7 with that same tool-call ID. No session-global “current epoch” was borrowed.
-
-### `after_provider_response` is not assistant-content observation
-
-A deterministic localhost HTTP provider was used only to force headers/status exposure through the real Pi transport. Actual order:
-
-```json
-{"seq":4,"event":"before_provider_request"}
-{"seq":5,"event":"after_provider_response","status":200,"assistantContentAvailableAtThisHook":false,"timing":"headers/status before stream consumption"}
-{"seq":6,"event":"message_end","role":"assistant","assistantContentObserved":true}
-```
-
-```text
-headers_hook_precedes_completed_message=True
-```
-
-This positively confirms SPEC-v5’s precision correction: receipt content is observed at `message_end`; `after_provider_response` is status/headers before stream consumption.
-
----
-
-## P3 — Same-PID `runtime_generation` bump revokes prior lease (D4)
-
-**Verdict: PASS**
-
-### Command
-
-```bash
-python3 docs/compaction-refresh/probes/pi_gate0_run.py
-```
-
-Full output: [`evidence/raw/P2-P3-P5-P6-pi.txt`](./evidence/raw/P2-P3-P5-P6-pi.txt).
-
-The real Pi process identity remained:
-
-```text
-pid=4004545 starttime_ticks=365907677 uid=1001
-```
-
-Broker state around reload:
-
-```json
-{"event":"runtime_generation_bump","reason":"startup","old_generation":0,"new_generation":1,"new_lease_state":"UNVERIFIED"}
-{"event":"probe_lease_promoted","generation":1,"new_lease_state":"VERIFIED"}
-{"event":"runtime_generation_bump","phase":"shutdown","reason":"reload","old_generation":1,"new_generation":2,"prior_lease":"VERIFIED","prior_lease_revoked":true,"new_lease_state":"REVOKED"}
-{"event":"runtime_generation_bump","phase":"start","reason":"reload","old_generation":2,"new_generation":3,"new_lease_state":"UNVERIFIED"}
-```
-
-The same `(pid,starttime)` then emitted monotonic bumps for real `fork`, `new`, and `resume` replacement flows, reaching generation 12. Pi 0.80.7 emitted an additional conservative `session_start` callback in each of those replacement flows; the broker bumped again rather than reusing authority. This is an availability/idempotence consideration for implementation, not a fail-open result.
-
----
-
-## P4 — `SO_PEERCRED` + socket authenticity posture
-
-**Verdict: PASS, with the spec’s named same-UID T-C residual**
-
-### Command
-
-```bash
-python3 docs/compaction-refresh/probes/p4_peercred_probe.py
-```
-
-Full output: [`evidence/raw/P4-so-peercred.txt`](./evidence/raw/P4-so-peercred.txt).
-
-Captured real socket result:
-
-```text
-server_pid=4013762 server_uid=1001 server_gid=1001
-directory_mode=0700 socket_mode=0600
-SO_PEERCRED pid=4013768 uid=1001 gid=1001
-client_claim={"pid":4013768,"starttime_ticks":365927069,"uid":1001,...}
-proc_observed={"pid":4013768,"starttime_ticks":365927069,"uid":1001,...}
-pid_match=True
-uid_match=True
-starttime_match=True
-client_exit_status=0
-```
-
-Achievable unprivileged posture on this host is a user-owned 0700 parent plus 0600 socket. That excludes other UIDs and positively authenticates the connecting kernel PID/UID/GID. It does **not** stop another process running as `hermes` from unlinking/rebinding the socket. A claim stronger than T-C against counterfeit replacement therefore requires the ratified distinct-principal system service or authenticated broker responses. No stronger claim is made.
-
----
-
-## P5 — Source invalidation fail-closed
-
-**Verdict: PASS**
-
-### Command
-
-```bash
-python3 docs/compaction-refresh/probes/pi_gate0_run.py
-```
-
-Full output: [`evidence/raw/P2-P3-P5-P6-pi.txt`](./evidence/raw/P2-P3-P5-P6-pi.txt).
-
-Each fault was injected into the manifest/source read by the real Pi `context` hook. Each run reached an actual model-produced `toolCallId`, then the runtime gate refused it:
-
-| Fault | Runtime validation | Injection/promotion | Broker | Tool result |
-| --- | --- | --- | --- | --- |
-| Missing path | `reason=missing` | `injectionDecision=REFUSED`, `promotion=false` | `source_invalidation_revoke` | `allowed=false`, `unverified-source:missing` |
-| 65 bytes with 64-byte max | `reason=oversize` | `REFUSED`, `promotion=false` | revoked | `allowed=false`, `unverified-source:oversize` |
-| Bytes differ from pinned SHA-256 | `reason=hash-mismatch` | `REFUSED`, `promotion=false` | revoked | `allowed=false`, `unverified-source:hash-mismatch` |
-
-Missing example:
-
-```json
-{"event":"context_return","sourceValidation":{"ok":false,"reason":"missing"},"injectionDecision":"REFUSED","promotion":false,"sourceBroker":{"event":"source_invalidation_revoke","new_lease_state":"REVOKED"}}
-{"event":"tool_call","mapping":{"verified":false,"sourceReason":"missing"},"allowed":false,"reason":"unverified-source:missing"}
-```
-
-No fault case reached tool execution or promotion.
-
----
-
-## P6 — Atomic Claude `additionalContext` + Pi `context` injection (A-v5-1 / T27)
-
-**Verdict: T-C GAP — returns to planner**
-
-### Commands
-
-```bash
-python3 docs/compaction-refresh/probes/pi_gate0_run.py
-python3 docs/compaction-refresh/probes/p6_claude_run.py
-rg -n -i "atomic|prefix-preserv" <installed Pi and Claude hook docs>
-```
-
-Full outputs:
-
-- [`evidence/raw/P2-P3-P5-P6-pi.txt`](./evidence/raw/P2-P3-P5-P6-pi.txt)
-- [`evidence/raw/P6-claude-additional-context.txt`](./evidence/raw/P6-claude-additional-context.txt)
-- [`evidence/raw/P6-contract-gap.txt`](./evidence/raw/P6-contract-gap.txt)
-
-### Positive empirical observations
-
-**Pi:** The real `context` hook returned exactly one additional `AgentMessage`; the prior message prefix hash was unchanged. The real final provider payload contained exactly one occurrence in one content item, and the real model copied all bytes exactly:
-
-```json
-{"event":"context_return","inputCount":1,"outputCount":2,"injectionDecision":"ONE_ATOMIC_AGENT_MESSAGE","prefixPreservedByReturn":true,"blockLength":108,"blockSha256":"99c3...a0dd"}
-{"event":"before_provider_request","markerOccurrences":1,"markerPaths":["$.input[1].content[0].text"],"finalPayloadValid":true}
-{"event":"message_end","exactContextBlockCopied":true,"assistantTextSha256":"99c3...a0dd"}
-```
-
-**Claude:** The real `SessionStart` hook emitted one `hookSpecificOutput.additionalContext` string. Claude’s stream recorded successful hook execution, and the real model’s exact copied block matched byte length and SHA-256:
-
-```text
-block_length=116
-block_sha256=ef6377d63552af075f4f4adec00165988418c5f46a992f4dce8e678b56fd34ac
-assistant_copy_length=116
-assistant_copy_sha256=ef6377d63552af075f4f4adec00165988418c5f46a992f4dce8e678b56fd34ac
-assistant_copy_exact=True
-```
-
-### Why this is not a PASS
-
-The installed Pi documentation says only that `context` receives a deep copy and may return `{ messages }`. The installed Claude documentation says only that `additionalContext` enters/adds to context/system prompt. The exact search result was:
-
-```text
-NO MATCH: neither installed runtime document states an atomic/prefix-preserving transport guarantee.
-```
-
-One or several successful complete deliveries cannot prove the transport invariant needed by A-v5-1. In particular, a harness-side middle deletion/replacement that preserves the terminal receipt is not detectable by the receipt. That is precisely R1’s assurance boundary. Therefore:
-
-- absent or prefix-truncated terminal token: receipt-detectable;
-- middle-drop preserving the tail token: **not receipt-detectable**;
-- no documented runtime contract excludes that transform;
-- classification: **T-C contract gap**.
-
-No atomicity claim is inferred from empirical success.
-
----
-
-## Independent probe review
-
-After an initial review identified a session-global P2 correlation flaw, the probe was changed to queue request-scoped cycles from `before_provider_request` through assistant `message_end`; all runtime probes were re-run and raw checksums regenerated. The final independent review command was:
-
-```bash
-~/.config/mosaic/tools/codex/codex-code-review.sh \
-  -b d801d6c4c8a984d6a95033c49714210018d3d9a8 \
-  -o /tmp/827-gate0-rereview.json
-```
-
-Final review: **APPROVE**, confidence 0.91, 18 files reviewed, 0 blockers, 0 should-fix findings, 0 suggestions.
-
-## Final admission decision
-
-Gate0 requires every item to produce positive runtime evidence. P6 does not. **Do not admit WI-1..WI-7. Return A-v5-1/T27 to planner review.**
-
-No feature work, push, PR, merge, or issue closure was performed.

docs/compaction-refresh/evidence/RAW-SHA256SUMS.txt

@@ -1,8 +0,0 @@
-d19ed51612b52d8f5f4957321776e05157008d048b693217c03d71318dc4c763  docs/compaction-refresh/evidence/raw/P1-claude-hook-events.txt
-c2d7bc21200063a4a0e61c67ba91abaf958ee88aa686e86f3f71c2717732b413  docs/compaction-refresh/evidence/raw/P1-launch-ancestry.txt
-6efb12d908e9e20badcfda5b070aa1873409bd5a05f533f0b08bb1b4ef53d1a7  docs/compaction-refresh/evidence/raw/P2-P3-P5-P6-pi.txt
-a9df6cc9f5d45f60d7d914ad1f80b9601574b82831101b3a10eccf1b93787e94  docs/compaction-refresh/evidence/raw/P2-provider-timing.txt
-92e7aa7d69d53e58a151f9d56cfb583d90c206ecc0bc8a1b185e172c598fb177  docs/compaction-refresh/evidence/raw/P4-so-peercred.txt
-047d235c6b6553158e27378c4ace081b094e5746734f4b5db6a6dc8ef9e05ff2  docs/compaction-refresh/evidence/raw/P6-claude-additional-context.txt
-7df20b2878fc87aa4d1fc89121e494d8f4f7bf313b89e1e3147f16fdaa567cdd  docs/compaction-refresh/evidence/raw/P6-contract-gap.txt
-405bf3a06bf355d7f4f4d7b29d45a1ae70d93a690af5f7d0fc4819249e9f408f  docs/compaction-refresh/evidence/raw/STEP0-authority-hashes.txt

docs/compaction-refresh/evidence/raw/P1-claude-hook-events.txt

@@ -1,28 +0,0 @@
-$ python3 docs/compaction-refresh/probes/p1_run.py --runtime claude
-=== P1 CLAUDE REAL LAUNCH ===
-$ python3 docs/compaction-refresh/probes/p1_anchor_exec.py --socket <protected-socket> claude <runtime args>
-registered_anchor={"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933580, "ppid": 3933578, "starttime_ticks": 365788075}
-broker_minted_session_id=ebe9f9146ad1ba5b9fd757fe9517d24b
-hook_or_extension_record={"ancestry": [{"argc": 2, "argv0": "python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933983, "ppid": 3933982, "starttime_ticks": 365788568}, {"argc": 3, "argv0": "/bin/sh", "comm": "sh", "exe": "/usr/bin/dash", "pid": 3933982, "ppid": 3933751, "starttime_ticks": 365788568}, {"argc": 16, "argv0": "claude", "comm": "claude", "exe": "/home/hermes/.local/share/claude/versions/2.1.205", "pid": 3933751, "ppid": 3933580, "starttime_ticks": 365788474}, {"argc": 16, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 3933580, "ppid": 3933578, "starttime_ticks": 365788075}], "anchor": {"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933580, "ppid": 3933578, "starttime_ticks": 365788075}, "claimed_session_id": null, "decision": "ACCEPT", "event": "resolve-hook", "peercred": {"gid": 1001, "pid": 3933983, "uid": 1001}, "reason": "ancestry-reaches-registered-anchor", "resolved_session_id": "ebe9f9146ad1ba5b9fd757fe9517d24b", "starttimes_rechecked": true}
-sibling_attack_record={"ancestry": [{"argc": 6, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933581, "ppid": 3933578, "starttime_ticks": 365788080}, {"argc": 4, "argv0": "python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933578, "ppid": 3933576, "starttime_ticks": 365788059}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 3933576, "ppid": 3933575, "starttime_ticks": 365788058}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 3933575, "ppid": 3888118, "starttime_ticks": 365788058}, {"argc": 1, "argv0": "pi", "comm": "pi", "exe": "/usr/bin/node", "pid": 3888118, "ppid": 3887912, "starttime_ticks": 365707392}, {"argc": 6, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 3887912, "ppid": 3887869, "starttime_ticks": 365707050}, {"argc": 1, "argv0": "-bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 3887869, "ppid": 1244054, "starttime_ticks": 365706948}, {"argc": 10, "argv0": "tmux", "comm": "tmux: server", "exe": "/usr/bin/tmux", "pid": 1244054, "ppid": 745, "starttime_ticks": 114078803}, {"argc": 2, "argv0": "/lib/systemd/systemd", "comm": "systemd", "exe": "/usr/lib/systemd/systemd", "pid": 745, "ppid": 1, "starttime_ticks": 627}], "anchor": {"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 3933580, "ppid": 3933578, "starttime_ticks": 365788075}, "claimed_session_id": "ebe9f9146ad1ba5b9fd757fe9517d24b", "decision": "REJECT", "event": "claim-session", "peercred": {"gid": 1001, "pid": 3933581, "uid": 1001}, "reason": "victim-id-known-but-ancestry-mismatch", "resolved_session_id": null, "starttimes_rechecked": false}
-sibling_process_stdout={"attacker_pid": 3933581, "attacker_uid": 1001, "broker_decision": "REJECT", "broker_reason": "victim-id-known-but-ancestry-mismatch", "victim_session_id_known": true}
-sibling_process_exit=0
-ps_snapshot=<hook chain exited; broker /proc snapshot above is authoritative>
-launcher_stderr_excerpt:
-  {"argv": ["mosaic", "yolo", "claude", "<12 runtime args>"], "event": "anchor-exec", "note": "os.execvpe retains pid and /proc starttime", "pid": 3933580}
-runtime_stdout_excerpt:
-  
-  [mosaic] Claude Code settings audit:
-    ⚠ Missing PreToolUse hook: prevent-memory-write.sh
-    ⚠ Missing PostToolUse hook: qa-hook-stdin.sh
-    ⚠ Missing PostToolUse hook: typecheck-hook.sh
-    ⚠ Missing plugin: feature-dev
-    ⚠ Missing plugin: pr-review-toolkit
-    ⚠ Missing plugin: code-review
-runtime_hook_event_excerpt:
-    ⚠ Missing PreToolUse hook: prevent-memory-write.sh
-    ⚠ Missing PostToolUse hook: qa-hook-stdin.sh
-    ⚠ Missing PostToolUse hook: typecheck-hook.sh
-  {"type":"system","subtype":"hook_started","hook_id":"cadd5ded-a869-4b05-85fc-cfd1a4988217","hook_name":"SessionStart:startup","hook_event":"SessionStart","uuid":"b63d67bf-2247-4e1c-b16b-7ccffa73180b","session_id":"97e1224c-7c1c-42c7-9fb5-598d2cd3dfaf"}
-  {"type":"system","subtype":"hook_response","hook_id":"cadd5ded-a869-4b05-85fc-cfd1a4988217","hook_name":"SessionStart:startup","hook_event":"SessionStart","output":"{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED\"}}\n","stdout":"{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED\"}}\n","stderr":"","exit_code":0,"outcome":"success","uuid":"b2bb583d-d287-4b56-8061-09153a32adc2","session_id":"97e1224c-7c1c-42c7-9fb5-598d2cd3dfaf"}
-

docs/compaction-refresh/evidence/raw/P1-launch-ancestry.txt

@@ -1,62 +0,0 @@
-$ python3 docs/compaction-refresh/probes/p1_run.py --runtime both
-=== P1 PI REAL LAUNCH ===
-machine_assertions=PASS
-$ python3 docs/compaction-refresh/probes/p1_anchor_exec.py --socket <protected-socket> pi <runtime args>
-registered_anchor={"argc": 13, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010843, "ppid": 4010840, "starttime_ticks": 365919858}
-broker_minted_session_id=5207bd0d8251b616fe4df4c68f438830
-hook_or_extension_record={"ancestry": [{"argc": 1, "argv0": "pi", "comm": "pi", "exe": "/usr/bin/node", "pid": 4011046, "ppid": 4010843, "starttime_ticks": 365920219}, {"argc": 12, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 4010843, "ppid": 4010840, "starttime_ticks": 365919858}], "anchor": {"argc": 13, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010843, "ppid": 4010840, "starttime_ticks": 365919858}, "claimed_session_id": null, "decision": "ACCEPT", "event": "resolve-hook", "peercred": {"gid": 1001, "pid": 4011046, "uid": 1001}, "reason": "ancestry-reaches-registered-anchor", "resolved_session_id": "5207bd0d8251b616fe4df4c68f438830", "starttimes_rechecked": true}
-sibling_attack_record={"ancestry": [{"argc": 6, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010844, "ppid": 4010840, "starttime_ticks": 365919864}, {"argc": 4, "argv0": "python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010840, "ppid": 4010838, "starttime_ticks": 365919843}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 4010838, "ppid": 4010837, "starttime_ticks": 365919843}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 4010837, "ppid": 3888118, "starttime_ticks": 365919842}, {"argc": 1, "argv0": "pi", "comm": "pi", "exe": "/usr/bin/node", "pid": 3888118, "ppid": 3887912, "starttime_ticks": 365707392}, {"argc": 6, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 3887912, "ppid": 3887869, "starttime_ticks": 365707050}, {"argc": 1, "argv0": "-bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 3887869, "ppid": 1244054, "starttime_ticks": 365706948}, {"argc": 10, "argv0": "tmux", "comm": "tmux: server", "exe": "/usr/bin/tmux", "pid": 1244054, "ppid": 745, "starttime_ticks": 114078803}, {"argc": 2, "argv0": "/lib/systemd/systemd", "comm": "systemd", "exe": "/usr/lib/systemd/systemd", "pid": 745, "ppid": 1, "starttime_ticks": 627}], "anchor": {"argc": 13, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010843, "ppid": 4010840, "starttime_ticks": 365919858}, "claimed_session_id": "5207bd0d8251b616fe4df4c68f438830", "decision": "REJECT", "event": "claim-session", "peercred": {"gid": 1001, "pid": 4010844, "uid": 1001}, "reason": "victim-id-known-but-ancestry-mismatch", "resolved_session_id": null, "starttimes_rechecked": false}
-sibling_process_stdout={"attacker_pid": 4010844, "attacker_uid": 1001, "broker_decision": "REJECT", "broker_reason": "victim-id-known-but-ancestry-mismatch", "victim_session_id_known": true}
-sibling_process_exit=0
-$ ps -o pid=,ppid=,lstart=,uid=,gid=,comm= -p 4011046,4010843
-4010843 4010840 Fri Jul 17 19:35:18 2026  1001  1001 node
-4011046 4010843 Fri Jul 17 19:35:22 2026  1001  1001 pi
-launcher_stderr_excerpt:
-  {"argv": ["mosaic", "yolo", "pi", "<8 runtime args>"], "event": "anchor-exec", "note": "os.execvpe retains pid and /proc starttime", "pid": 4010843}
-runtime_stdout_excerpt:
-  [mosaic] Launching Pi in YOLO mode...
-  {"type":"extension_ui_request","id":"4cf086c7-299e-4734-9264-6ad2964f3664","method":"notify","message":"Mosaic framework loaded","notifyType":"info"}
-  {"id":"state","type":"response","command":"get_state","success":true,"data":{"model":{"id":"gpt-5.6-sol","name":"GPT-5.6 Sol","api":"openai-codex-responses","provider":"openai-codex","baseUrl":"https://chatgpt.com/backend-api","compat":{"supportsToolSearch":true},"reasoning":true,"thinkingLevelMap":{"xhigh":"xhigh","max":"max","minimal":"low"},"input":["text","image"],"cost":{"input":5,"output":30,"cacheRead":0.5,"cacheWrite":6.25,"tiers":[{"inputTokensAbove":272000,"input":10,"output":45,"cache
-runtime_hook_event_excerpt:
-
-=== P1 CLAUDE REAL LAUNCH ===
-machine_assertions=PASS
-$ python3 docs/compaction-refresh/probes/p1_anchor_exec.py --socket <protected-socket> claude <runtime args>
-registered_anchor={"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4011129, "ppid": 4010840, "starttime_ticks": 365920380}
-broker_minted_session_id=f382fa5f4b2142ef79bb76204521ff2a
-hook_or_extension_record={"ancestry": [{"argc": 2, "argv0": "python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4011380, "ppid": 4011379, "starttime_ticks": 365920845}, {"argc": 3, "argv0": "/bin/sh", "comm": "sh", "exe": "/usr/bin/dash", "pid": 4011379, "ppid": 4011285, "starttime_ticks": 365920845}, {"argc": 16, "argv0": "claude", "comm": "claude", "exe": "/home/hermes/.local/share/claude/versions/2.1.205", "pid": 4011285, "ppid": 4011129, "starttime_ticks": 365920748}, {"argc": 16, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 4011129, "ppid": 4010840, "starttime_ticks": 365920380}], "anchor": {"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4011129, "ppid": 4010840, "starttime_ticks": 365920380}, "claimed_session_id": null, "decision": "ACCEPT", "event": "resolve-hook", "peercred": {"gid": 1001, "pid": 4011380, "uid": 1001}, "reason": "ancestry-reaches-registered-anchor", "resolved_session_id": "f382fa5f4b2142ef79bb76204521ff2a", "starttimes_rechecked": true}
-sibling_attack_record={"ancestry": [{"argc": 6, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4011130, "ppid": 4010840, "starttime_ticks": 365920385}, {"argc": 4, "argv0": "python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4010840, "ppid": 4010838, "starttime_ticks": 365919843}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 4010838, "ppid": 4010837, "starttime_ticks": 365919843}, {"argc": 3, "argv0": "/bin/bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 4010837, "ppid": 3888118, "starttime_ticks": 365919842}, {"argc": 1, "argv0": "pi", "comm": "pi", "exe": "/usr/bin/node", "pid": 3888118, "ppid": 3887912, "starttime_ticks": 365707392}, {"argc": 6, "argv0": "node", "comm": "node", "exe": "/usr/bin/node", "pid": 3887912, "ppid": 3887869, "starttime_ticks": 365707050}, {"argc": 1, "argv0": "-bash", "comm": "bash", "exe": "/usr/bin/bash", "pid": 3887869, "ppid": 1244054, "starttime_ticks": 365706948}, {"argc": 10, "argv0": "tmux", "comm": "tmux: server", "exe": "/usr/bin/tmux", "pid": 1244054, "ppid": 745, "starttime_ticks": 114078803}, {"argc": 2, "argv0": "/lib/systemd/systemd", "comm": "systemd", "exe": "/usr/lib/systemd/systemd", "pid": 745, "ppid": 1, "starttime_ticks": 627}], "anchor": {"argc": 17, "argv0": "/usr/bin/python3", "comm": "python3", "exe": "/usr/bin/python3.11", "pid": 4011129, "ppid": 4010840, "starttime_ticks": 365920380}, "claimed_session_id": "f382fa5f4b2142ef79bb76204521ff2a", "decision": "REJECT", "event": "claim-session", "peercred": {"gid": 1001, "pid": 4011130, "uid": 1001}, "reason": "victim-id-known-but-ancestry-mismatch", "resolved_session_id": null, "starttimes_rechecked": false}
-sibling_process_stdout={"attacker_pid": 4011130, "attacker_uid": 1001, "broker_decision": "REJECT", "broker_reason": "victim-id-known-but-ancestry-mismatch", "victim_session_id_known": true}
-sibling_process_exit=0
-ps_snapshot=<hook chain exited; broker /proc snapshot above is authoritative>
-launcher_stderr_excerpt:
-  {"argv": ["mosaic", "yolo", "claude", "<12 runtime args>"], "event": "anchor-exec", "note": "os.execvpe retains pid and /proc starttime", "pid": 4011129}
-runtime_stdout_excerpt:
-  
-  [mosaic] Claude Code settings audit:
-    ⚠ Missing PreToolUse hook: prevent-memory-write.sh
-    ⚠ Missing PostToolUse hook: qa-hook-stdin.sh
-    ⚠ Missing PostToolUse hook: typecheck-hook.sh
-    ⚠ Missing plugin: feature-dev
-    ⚠ Missing plugin: pr-review-toolkit
-    ⚠ Missing plugin: code-review
-runtime_hook_event_excerpt:
-    ⚠ Missing PreToolUse hook: prevent-memory-write.sh
-    ⚠ Missing PostToolUse hook: qa-hook-stdin.sh
-    ⚠ Missing PostToolUse hook: typecheck-hook.sh
-  {"type":"system","subtype":"hook_started","hook_id":"2a5f7dab-a064-4610-a6b1-4ad151ddcdd9","hook_name":"SessionStart:startup","hook_event":"SessionStart","uuid":"c6e0690c-f0c9-4d60-a8fb-5f0c25ea3208","session_id":"167d104d-907a-4120-9b07-bdf4762818a9"}
-  {"type":"system","subtype":"hook_response","hook_id":"2a5f7dab-a064-4610-a6b1-4ad151ddcdd9","hook_name":"SessionStart:startup","hook_event":"SessionStart","output":"{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED\"}}\n","stdout":"{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED\"}}\n","stderr":"","exit_code":0,"outcome":"success","uuid":"167b2a5b-a45a-4e70-a72b-1f4a609bb979","session_id":"167d104d-907a-4120-9b07-bdf4762818a9"}
-
-
-$ readlink -f "$(command -v mosaic)"
-/home/hermes/.npm-global/lib/node_modules/@mosaicstack/mosaic/dist/cli.js
-
-$ rg -n "spawnSync|execRuntime" ~/.npm-global/lib/node_modules/@mosaicstack/mosaic/dist/commands/launch.js | tail -8
-63:            spawnSync(initBin, [], { stdio: 'inherit' });
-131:    const result = spawnSync(checker, ['--check', '--runtime', runtime], { stdio: 'ignore' });
-624:            execRuntime('claude', cliArgs);
-637:            execRuntime('codex', cliArgs);
-643:            execRuntime('opencode', args);
-658:            execRuntime('pi', cliArgs);
-665:function execRuntime(cmd, args) {
-668:        const result = spawnSync(cmd, args, {

docs/compaction-refresh/evidence/raw/P2-P3-P5-P6-pi.txt

@@ -1,52 +0,0 @@
-$ python3 docs/compaction-refresh/probes/pi_gate0_run.py
-machine_assertions=PASS
-runtime_versions:
-  0.80.7
-  0.0.48
-
-P2_EVENT_ORDER_AND_NONCE_MAP:
-{"assistantContentObserved": true, "assistantTextSha256": "a36f1eb364f062cad2f9f7d7e2b62ef7715d2aef79caafcfccd3a227cecf3e61", "event": "message_end", "exactContextBlockCopied": false, "inFlightDepthAfter": 0, "nonceMappings": [{"requestNonce": "e5a82358-a6c9-490b-a0de-2e1f1d9b8d79", "toolCallId": "call_bgGEFnBJOmwJPEfmzMo1eHOy|fc_0fb3d12b5404a73c016a5ac9d6f9a4819b9ddf70296c0cf57c"}], "pid": 4004545, "requestNonce": "e5a82358-a6c9-490b-a0de-2e1f1d9b8d79", "role": "assistant", "seq": 5, "starttime_ticks": 365907677, "toolCallIds": ["call_bgGEFnBJOmwJPEfmzMo1eHOy|fc_0fb3d12b5404a73c016a5ac9d6f9a4819b9ddf70296c0cf57c"]}
-{"allowed": true, "event": "tool_call", "mapping": {"nonce": "e5a82358-a6c9-490b-a0de-2e1f1d9b8d79", "sourceReason": "all-fragments-valid", "verified": true}, "pid": 4004545, "reason": "exact-tool-call-id-mapped-to-verified-request-nonce", "seq": 6, "starttime_ticks": 365907677, "toolCallId": "call_bgGEFnBJOmwJPEfmzMo1eHOy|fc_0fb3d12b5404a73c016a5ac9d6f9a4819b9ddf70296c0cf57c", "toolName": "gate0_nonce_probe"}
-{"broker": {"event": "probe_lease_promoted", "generation": 1, "new_lease_state": "VERIFIED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "starttime_ticks": 365907677}, "event": "tool_execute", "label": "p2", "pid": 4004545, "seq": 7, "starttime_ticks": 365907677, "toolCallId": "call_bgGEFnBJOmwJPEfmzMo1eHOy|fc_0fb3d12b5404a73c016a5ac9d6f9a4819b9ddf70296c0cf57c"}
-{"assistantContentObserved": true, "assistantTextSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "message_end", "exactContextBlockCopied": true, "inFlightDepthAfter": 0, "nonceMappings": [], "pid": 4004545, "requestNonce": "cca4b1e3-296a-4e4c-9805-a395c270c01f", "role": "assistant", "seq": 11, "starttime_ticks": 365907677, "toolCallIds": []}
-
-P2_LAST_OR_CLOSED:
-{"broker": {"event": "runtime_generation_bump", "new_generation": 1, "new_lease_state": "UNVERIFIED", "old_generation": 0, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "NONE", "prior_lease_revoked": true, "reason": "startup", "starttime_ticks": 365907677}, "event": "session_start", "extensions": ["/home/hermes/.config/mosaic/runtime/pi/mosaic-extension.ts", "/home/hermes/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/pi_gate0_extension.ts"], "gateState": "UNVERIFIED_READY", "lastPosition": true, "pid": 4004545, "reason": "startup", "self": "/home/hermes/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/pi_gate0_extension.ts", "seq": 1, "starttime_ticks": 365907677}
-{"broker": {"skipped": true}, "event": "session_start", "extensions": ["/home/hermes/.config/mosaic/runtime/pi/mosaic-extension.ts", "/home/hermes/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/pi_gate0_extension.ts", "/home/hermes/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/pi_later_extension.ts"], "gateState": "CLOSED_NOT_LAST", "lastPosition": false, "pid": 4005692, "reason": "startup", "self": "/home/hermes/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/pi_gate0_extension.ts", "seq": 1, "starttime_ticks": 365910545}
-
-P3_GENERATION_BROKER:
-{"event": "runtime_generation_bump", "new_generation": 1, "new_lease_state": "UNVERIFIED", "old_generation": 0, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "NONE", "prior_lease_revoked": true, "reason": "startup", "starttime_ticks": 365907677}
-{"event": "probe_lease_promoted", "generation": 1, "new_lease_state": "VERIFIED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 2, "new_lease_state": "REVOKED", "old_generation": 1, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "shutdown", "prior_lease": "VERIFIED", "prior_lease_revoked": true, "reason": "reload", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 3, "new_lease_state": "UNVERIFIED", "old_generation": 2, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "REVOKED", "prior_lease_revoked": true, "reason": "reload", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 4, "new_lease_state": "REVOKED", "old_generation": 3, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "shutdown", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "fork", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 5, "new_lease_state": "UNVERIFIED", "old_generation": 4, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "REVOKED", "prior_lease_revoked": true, "reason": "fork", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 6, "new_lease_state": "UNVERIFIED", "old_generation": 5, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "fork", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 7, "new_lease_state": "REVOKED", "old_generation": 6, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "shutdown", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "new", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 8, "new_lease_state": "UNVERIFIED", "old_generation": 7, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "REVOKED", "prior_lease_revoked": true, "reason": "new", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 9, "new_lease_state": "UNVERIFIED", "old_generation": 8, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "new", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 10, "new_lease_state": "REVOKED", "old_generation": 9, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "shutdown", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "resume", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 11, "new_lease_state": "UNVERIFIED", "old_generation": 10, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "REVOKED", "prior_lease_revoked": true, "reason": "resume", "starttime_ticks": 365907677}
-{"event": "runtime_generation_bump", "new_generation": 12, "new_lease_state": "UNVERIFIED", "old_generation": 11, "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "phase": "start", "prior_lease": "UNVERIFIED", "prior_lease_revoked": true, "reason": "resume", "starttime_ticks": 365907677}
-
-P5_SOURCE_INVALIDATION:
-{"blockLength": 108, "blockSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "context_return", "injectionDecision": "REFUSED", "inputCount": 5, "lastPosition": true, "outputCount": 5, "pid": 4004545, "prefixHashAfter": "4f339e3e45989486374b75d8a40abad22a3f3091f1099e3b4112f3afd1c60eb0", "prefixHashBefore": "4f339e3e45989486374b75d8a40abad22a3f3091f1099e3b4112f3afd1c60eb0", "prefixPreservedByReturn": true, "promotion": false, "requestNonce": "24ef5352-bcc6-4418-b65f-c2763453cc46", "seq": 12, "sourceBroker": {"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "UNVERIFIED", "promotion": false, "source_reason": "missing", "starttime_ticks": 365907677}, "sourceValidation": {"fragment": "/tmp/gate0-pi-g_3gsk34/absent-fragment.md", "ok": false, "reason": "missing"}, "starttime_ticks": 365907677}
-{"allowed": false, "event": "tool_call", "mapping": {"nonce": "24ef5352-bcc6-4418-b65f-c2763453cc46", "sourceReason": "missing", "verified": false}, "pid": 4004545, "reason": "unverified-source:missing", "seq": 15, "starttime_ticks": 365907677, "toolCallId": "call_XBwBkiv5tZx2ayuDxHKD5vSB|fc_0fb3d12b5404a73c016a5ac9dc341c819bb6ed3e00ca2cf1a5", "toolName": "gate0_nonce_probe"}
-{"blockLength": 108, "blockSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "context_return", "injectionDecision": "REFUSED", "inputCount": 9, "lastPosition": true, "outputCount": 9, "pid": 4004545, "prefixHashAfter": "1a39911018caefe8f5b5acb652cece9f92d937e7384109f5c1559266349480b7", "prefixHashBefore": "1a39911018caefe8f5b5acb652cece9f92d937e7384109f5c1559266349480b7", "prefixPreservedByReturn": true, "promotion": false, "requestNonce": "319646e8-59e2-4021-9b27-de1376b13c32", "seq": 22, "sourceBroker": {"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "REVOKED", "promotion": false, "source_reason": "oversize", "starttime_ticks": 365907677}, "sourceValidation": {"fragment": "/tmp/gate0-pi-g_3gsk34/oversize.md", "ok": false, "reason": "oversize"}, "starttime_ticks": 365907677}
-{"allowed": false, "event": "tool_call", "mapping": {"nonce": "319646e8-59e2-4021-9b27-de1376b13c32", "sourceReason": "oversize", "verified": false}, "pid": 4004545, "reason": "unverified-source:oversize", "seq": 25, "starttime_ticks": 365907677, "toolCallId": "call_P9d0wR5TSXSqZHydVHclh6Cg|fc_0fb3d12b5404a73c016a5ac9e02a28819bb39df373b7c9e23b", "toolName": "gate0_nonce_probe"}
-{"blockLength": 108, "blockSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "context_return", "injectionDecision": "REFUSED", "inputCount": 13, "lastPosition": true, "outputCount": 13, "pid": 4004545, "prefixHashAfter": "224c8777dd0cd5fcf1ae02f0fc46198548b48647dbfd044ed131533d72086f16", "prefixHashBefore": "224c8777dd0cd5fcf1ae02f0fc46198548b48647dbfd044ed131533d72086f16", "prefixPreservedByReturn": true, "promotion": false, "requestNonce": "23f3125f-6e62-4f3c-aa60-3eaed705ddc1", "seq": 32, "sourceBroker": {"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "REVOKED", "promotion": false, "source_reason": "hash-mismatch", "starttime_ticks": 365907677}, "sourceValidation": {"fragment": "/tmp/gate0-pi-g_3gsk34/mismatch.md", "ok": false, "reason": "hash-mismatch"}, "starttime_ticks": 365907677}
-{"allowed": false, "event": "tool_call", "mapping": {"nonce": "23f3125f-6e62-4f3c-aa60-3eaed705ddc1", "sourceReason": "hash-mismatch", "verified": false}, "pid": 4004545, "reason": "unverified-source:hash-mismatch", "seq": 35, "starttime_ticks": 365907677, "toolCallId": "call_QUMvqBRnzv6HNqEd37jU5NUw|fc_0fb3d12b5404a73c016a5ac9e37510819b8506879faf287aa3", "toolName": "gate0_nonce_probe"}
-{"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "UNVERIFIED", "promotion": false, "source_reason": "missing", "starttime_ticks": 365907677}
-{"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "REVOKED", "promotion": false, "source_reason": "oversize", "starttime_ticks": 365907677}
-{"event": "source_invalidation_revoke", "generation": 12, "new_lease_state": "REVOKED", "peercred": {"gid": 1001, "pid": 4004545, "uid": 1001}, "prior_lease": "REVOKED", "promotion": false, "source_reason": "hash-mismatch", "starttime_ticks": 365907677}
-
-P6_PI_CONTEXT_ATOMIC_OBSERVATION:
-{"blockLength": 108, "blockSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "context_return", "injectionDecision": "ONE_ATOMIC_AGENT_MESSAGE", "inputCount": 1, "lastPosition": true, "outputCount": 2, "pid": 4004545, "prefixHashAfter": "095a5415879b0d4006d1485dba3398fee6bf39850711ba0dc2e9cfa312e865dc", "prefixHashBefore": "095a5415879b0d4006d1485dba3398fee6bf39850711ba0dc2e9cfa312e865dc", "prefixPreservedByReturn": true, "promotion": false, "requestNonce": "e5a82358-a6c9-490b-a0de-2e1f1d9b8d79", "seq": 3, "sourceBroker": {"action": "none", "reason": "source-valid"}, "sourceValidation": {"ok": true, "reason": "all-fragments-valid"}, "starttime_ticks": 365907677}
-{"event": "before_provider_request", "finalPayloadValid": true, "inFlightDepth": 1, "markerOccurrences": 1, "markerPaths": ["$.input[1].content[0].text"], "pid": 4004545, "requestNonce": "e5a82358-a6c9-490b-a0de-2e1f1d9b8d79", "seq": 4, "starttime_ticks": 365907677}
-{"blockLength": 108, "blockSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "context_return", "injectionDecision": "ONE_ATOMIC_AGENT_MESSAGE", "inputCount": 3, "lastPosition": true, "outputCount": 4, "pid": 4004545, "prefixHashAfter": "7c40cce3664af7581b21ea007a4a44764237fce1e4f16b031e96d60df2229855", "prefixHashBefore": "7c40cce3664af7581b21ea007a4a44764237fce1e4f16b031e96d60df2229855", "prefixPreservedByReturn": true, "promotion": false, "requestNonce": "cca4b1e3-296a-4e4c-9805-a395c270c01f", "seq": 9, "sourceBroker": {"action": "none", "reason": "source-valid"}, "sourceValidation": {"ok": true, "reason": "all-fragments-valid"}, "starttime_ticks": 365907677}
-{"event": "before_provider_request", "finalPayloadValid": true, "inFlightDepth": 1, "markerOccurrences": 1, "markerPaths": ["$.input[5].content[0].text"], "pid": 4004545, "requestNonce": "cca4b1e3-296a-4e4c-9805-a395c270c01f", "seq": 10, "starttime_ticks": 365907677}
-{"assistantContentObserved": true, "assistantTextSha256": "99c3dce194b16405dfb555f126ee5ccc014fdc184d0882aee1a903cbc700a0dd", "event": "message_end", "exactContextBlockCopied": true, "inFlightDepthAfter": 0, "nonceMappings": [], "pid": 4004545, "requestNonce": "cca4b1e3-296a-4e4c-9805-a395c270c01f", "role": "assistant", "seq": 11, "starttime_ticks": 365907677, "toolCallIds": []}
-
-RPC_EVENT_COUNTS:
-{"agent_end": 4, "agent_settled": 4, "agent_start": 4, "extension_ui_request": 8, "message_end": 16, "message_start": 16, "message_update": 105, "response": 9, "tool_execution_end": 4, "tool_execution_start": 4, "turn_end": 8, "turn_start": 8}
-stderr_nonempty=False

docs/compaction-refresh/evidence/raw/P2-provider-timing.txt

@@ -1,9 +0,0 @@
-$ python3 docs/compaction-refresh/probes/p2_provider_timing_run.py
-local_http_endpoint=http://127.0.0.1:42823/v1/chat/completions
-{"event": "before_provider_request", "finalPayloadValid": true, "inFlightDepth": 1, "markerOccurrences": 1, "markerPaths": ["$.messages[2].content[0].text"], "pid": 4008778, "requestNonce": "056b82c4-36eb-420b-94cf-b2c73813ef79", "seq": 4, "starttime_ticks": 365916346}
-{"assistantContentAvailableAtThisHook": false, "event": "after_provider_response", "pid": 4008778, "requestNonce": "056b82c4-36eb-420b-94cf-b2c73813ef79", "seq": 5, "starttime_ticks": 365916346, "status": 200, "timing": "headers/status before stream consumption"}
-{"assistantContentObserved": true, "assistantTextSha256": "fb4ebaab26d63661040dc15925a99e22dc07ee2b33df5c6b2ca93a5b34f08b1d", "event": "message_end", "exactContextBlockCopied": false, "inFlightDepthAfter": 0, "nonceMappings": [], "pid": 4008778, "requestNonce": "056b82c4-36eb-420b-94cf-b2c73813ef79", "role": "assistant", "seq": 6, "starttime_ticks": 365916346, "toolCallIds": []}
-machine_assertions=PASS
-after_provider_response_seq=5
-message_end_seq=6
-headers_hook_precedes_completed_message=True

docs/compaction-refresh/evidence/raw/P4-so-peercred.txt

@@ -1,23 +0,0 @@
-$ python3 docs/compaction-refresh/probes/p4_peercred_probe.py
-machine_assertions=PASS
-server_pid=4013762 server_uid=1001 server_gid=1001
-socket_path=/tmp/gate0-p4-nl1_8ap2/broker.sock
-directory_mode=0700 socket_mode=0600
-SO_PEERCRED pid=4013768 uid=1001 gid=1001
-client_claim={"exe": "/usr/bin/python3.11", "pid": 4013768, "ppid": 4013762, "starttime_ticks": 365927069, "uid": 1001}
-proc_observed={"exe": "/usr/bin/python3.11", "pid": 4013768, "ppid": 4013762, "starttime_ticks": 365927069, "uid": 1001}
-pid_match=True
-uid_match=True
-starttime_match=True
-client_exit_status=0
-same_principal_socket=true
-posture=0700 parent + 0600 socket excludes other UIDs, but does not prevent the same UID from unlinking/rebinding; distinct-principal system service remains required for a claim stronger than T-C against same-UID counterfeit replacement
-
-$ id
-uid=1001(hermes) gid=1001(hermes) groups=1001(hermes),40(src),100(users),996(docker)
-
-$ uname -srmo
-Linux 6.1.0-48-amd64 x86_64 GNU/Linux
-
-$ getconf CLK_TCK
-100

docs/compaction-refresh/evidence/raw/P6-claude-additional-context.txt

@@ -1,21 +0,0 @@
-$ python3 docs/compaction-refresh/probes/p6_claude_run.py
-machine_assertions=PASS
-command=mosaic yolo claude --settings <isolated> --model haiku --print --output-format stream-json --verbose --include-hook-events <prompt>
-claude_version=2.1.205 (Claude Code)
-mosaic_version=0.0.48
-exit_code=0
-hook_process_log={"block_length": 116, "block_sha256": "ef6377d63552af075f4f4adec00165988418c5f46a992f4dce8e678b56fd34ac", "emission": "one hookSpecificOutput.additionalContext string field", "hook_event_name": "SessionStart", "pid": 4015703, "ppid": 4015701, "starttime_ticks": 365930489}
-hook_stream_event={"hook_event": "SessionStart", "hook_id": "557d613e-574f-4523-8bfb-8c6e51946035", "hook_name": "SessionStart:startup", "session_id": "f821d0db-1177-4237-8ff5-83b2a46996a6", "subtype": "hook_started", "type": "system", "uuid": "59449134-e2d4-43a9-9d34-b59e74622c08"}
-hook_stream_event={"exit_code": 0, "hook_event": "SessionStart", "hook_id": "557d613e-574f-4523-8bfb-8c6e51946035", "hook_name": "SessionStart:startup", "outcome": "success", "output": "{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_CLAUDE_ATOMIC_BEGIN\\nsegment-01=alpha-2d11\\nsegment-02=middle-8e22\\nsegment-03=omega-4f33\\nGATE0_CLAUDE_ATOMIC_END\"}}\n", "session_id": "f821d0db-1177-4237-8ff5-83b2a46996a6", "stderr": "", "stdout": "{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": \"GATE0_CLAUDE_ATOMIC_BEGIN\\nsegment-01=alpha-2d11\\nsegment-02=middle-8e22\\nsegment-03=omega-4f33\\nGATE0_CLAUDE_ATOMIC_END\"}}\n", "subtype": "hook_response", "type": "system", "uuid": "e05842c1-813a-41dd-93c9-768eb834f260"}
-block_length=116
-block_sha256=ef6377d63552af075f4f4adec00165988418c5f46a992f4dce8e678b56fd34ac
-stream_fields_containing_full_block=3
-stream_fields_exactly_equal_block=2
-assistant_copy_length=449
-assistant_copy_sha256=a65febbb3ad8fa4952894d94406a83a520ef712c0ecb9ab43be3212094b21ba1
-assistant_copy_exact=False
-assistant_copy="The user is asking me to return the exact GATE0_CLAUDE_ATOMIC block that was injected by SessionStart. This block was provided in the system-reminder at the beginning of the conversation:\n\n```\nGATE0_CLAUDE_ATOMIC_BEGIN\nsegment-01=alpha-2d11\nsegment-02=middle-8e22\nsegment-03=omega-4f33\nGATE0_CLAUDE_ATOMIC_END\n```\n\nThe user wants me to return ONLY this exact block, with no code fence or commentary. So I should just output it exactly as it appears."
-assistant_copy_length=116
-assistant_copy_sha256=ef6377d63552af075f4f4adec00165988418c5f46a992f4dce8e678b56fd34ac
-assistant_copy_exact=True
-assistant_copy="GATE0_CLAUDE_ATOMIC_BEGIN\nsegment-01=alpha-2d11\nsegment-02=middle-8e22\nsegment-03=omega-4f33\nGATE0_CLAUDE_ATOMIC_END"

docs/compaction-refresh/evidence/raw/P6-contract-gap.txt

@@ -1,47 +0,0 @@
-$ rg -n -i "atomic|prefix-preserv" <Pi extensions docs> <Claude hook docs>
-NO MATCH: neither installed runtime document states an atomic/prefix-preserving transport guarantee.
-
-$ rg -n -C 3 "#### context|event.messages - deep copy|return \{ messages" <Pi extensions docs>
-638-});
-639-```
-640-
-641:#### context
-642-
-643-Fired before each LLM call. Modify messages non-destructively. See [Session Format](session-format.md) for message types.
-644-
-645-```typescript
-646-pi.on("context", async (event, ctx) => {
-647:  // event.messages - deep copy, safe to modify
-648-  const filtered = event.messages.filter(m => !shouldPrune(m));
-649:  return { messages: filtered };
-650-});
-651-```
-652-
-
-$ rg -n -C 3 "additionalContext|add to the default system prompt" <Claude installed docs>
-/home/hermes/.config/mosaic/runtime/claude/RUNTIME.md-58-  tiered models via the Task `model` param).
-/home/hermes/.config/mosaic/runtime/claude/RUNTIME.md-59-
-/home/hermes/.config/mosaic/runtime/claude/RUNTIME.md-60-Note: PostToolUse hook plain stdout on exit 0 goes to the debug log, not model context — only
-/home/hermes/.config/mosaic/runtime/claude/RUNTIME.md:61:`hookSpecificOutput.additionalContext` (or exit-2 stderr) enters context.
---
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-59-expressed as
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-60-[subagents](https://docs.claude.com/en/docs/claude-code/sub-agents), not as
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-61-SessionStart hooks. Subagents change the system prompt while SessionStart hooks
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md:62:add to the default system prompt.
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-63-
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-64-## Managing changes
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/README.md-65-
---
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-1-#!/usr/bin/env bash
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-2-
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh:3:# Output the explanatory mode instructions as additionalContext
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-4-# This mimics the deprecated Explanatory output style
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-5-
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-6-cat << 'EOF'
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-7-{
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-8-  "hookSpecificOutput": {
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-9-    "hookEventName": "SessionStart",
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh:10:    "additionalContext": "You are in 'explanatory' output style mode, where you should provide educational insights about the codebase as you help with the user's task.\n\nYou should be clear and educational, providing helpful explanations while remaining focused on the task. Balance educational content with task completion. When providing insights, you may exceed typical length constraints, but remain focused and relevant.\n\n## Insights\nIn order to encourage learning, before and after writing code, always provide brief educational explanations about implementation choices using (with backticks):\n\"`★ Insight ─────────────────────────────────────`\n[2-3 key educational points]\n`─────────────────────────────────────────────────`\"\n\nThese insights should be included in the conversation, not in the codebase. You should generally focus on interesting insights that are specific to the codebase or the code you just wrote, rather than general programming concepts. Do not wait until the end to provide insights. Provide them as you write code."
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-11-  }
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-12-}
-/home/hermes/.claude/plugins/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh-13-EOF

docs/compaction-refresh/evidence/raw/STEP0-authority-hashes.txt

@@ -1,9 +0,0 @@
-$ sha256sum ~/agent-work/reviews/compaction-refresh-BUILD-BRIEF.md ~/agent-work/reviews/compaction-refresh-SPEC-v5.md ~/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md
-89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b  /home/hermes/agent-work/reviews/compaction-refresh-BUILD-BRIEF.md
-a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433  /home/hermes/agent-work/reviews/compaction-refresh-SPEC-v5.md
-bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67  /home/hermes/agent-work/reviews/compaction-refresh-SPEC-RATIFICATION.md
-
-Expected:
-89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b  BUILD-BRIEF
-a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433  SPEC-v5
-bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67  RATIFICATION

docs/compaction-refresh/probes/.gitignore

@@ -1,2 +0,0 @@
-__pycache__/
-*.pyc

docs/compaction-refresh/probes/p1_anchor_exec.py

@@ -1,51 +0,0 @@
-#!/usr/bin/env python3
-"""Register this PID as anchor, then exec the real `mosaic yolo` launcher."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import sys
-
-
-def request(socket_path: str, payload: dict[str, object]) -> dict[str, object]:
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(socket_path)
-    conn.sendall((json.dumps(payload) + "\n").encode())
-    response = json.loads(conn.makefile("r", encoding="utf-8").readline())
-    conn.close()
-    return response
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("runtime", choices=["pi", "claude"])
-    parser.add_argument("args", nargs=argparse.REMAINDER)
-    ns = parser.parse_args()
-
-    response = request(ns.socket, {"action": "register-anchor", "runtime": ns.runtime})
-    if response.get("decision") != "ACCEPT":
-        raise SystemExit("anchor registration refused")
-    os.environ["GATE0_SESSION_ID"] = str(response["session_id"])
-    argv = ["mosaic", "yolo", ns.runtime, *ns.args]
-    print(
-        json.dumps(
-            {
-                "event": "anchor-exec",
-                "pid": os.getpid(),
-                "argv": ["mosaic", "yolo", ns.runtime, f"<{len(ns.args)} runtime args>"],
-                "note": "os.execvpe retains pid and /proc starttime",
-            },
-            sort_keys=True,
-        ),
-        file=sys.stderr,
-        flush=True,
-    )
-    os.execvpe("mosaic", argv, os.environ)
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p1_broker.py

@@ -1,180 +0,0 @@
-#!/usr/bin/env python3
-"""Gate0 P1 broker prototype: peercred anchor minting and /proc ancestry checks."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import secrets
-import socket
-import stat
-import struct
-import sys
-from pathlib import Path
-from typing import Any
-
-
-def proc_node(pid: int) -> dict[str, Any]:
-    text = Path(f"/proc/{pid}/stat").read_text()
-    close = text.rfind(")")
-    comm = text[text.find("(") + 1 : close]
-    fields = text[close + 2 :].split()
-    cmdline = Path(f"/proc/{pid}/cmdline").read_bytes().split(b"\0")
-    return {
-        "pid": pid,
-        "ppid": int(fields[1]),
-        "starttime_ticks": int(fields[19]),
-        "comm": comm,
-        "exe": os.readlink(f"/proc/{pid}/exe"),
-        "argv0": cmdline[0].decode(errors="replace") if cmdline and cmdline[0] else "",
-        "argc": len([part for part in cmdline if part]),
-    }
-
-
-def ancestry(peer_pid: int, anchor: dict[str, Any] | None) -> tuple[list[dict[str, Any]], bool, str]:
-    chain: list[dict[str, Any]] = []
-    pid = peer_pid
-    seen: set[int] = set()
-    try:
-        while pid > 0 and pid not in seen:
-            seen.add(pid)
-            node = proc_node(pid)
-            chain.append(node)
-            if anchor and pid == anchor["pid"]:
-                if node["starttime_ticks"] != anchor["starttime_ticks"]:
-                    return chain, False, "anchor-starttime-mismatch"
-                break
-            pid = node["ppid"]
-        else:
-            return chain, False, "anchor-not-reached"
-
-        if not anchor or chain[-1]["pid"] != anchor["pid"]:
-            return chain, False, "anchor-not-reached"
-
-        # Re-read every node after the walk. A disappearing PID or changed
-        # starttime invalidates the complete chain (PID-reuse/race closure).
-        for original in chain:
-            again = proc_node(original["pid"])
-            if again["starttime_ticks"] != original["starttime_ticks"]:
-                return chain, False, f"starttime-race:{original['pid']}"
-        return chain, True, "ancestry-reaches-registered-anchor"
-    except (FileNotFoundError, ProcessLookupError, PermissionError) as exc:
-        return chain, False, f"proc-walk-failed:{type(exc).__name__}"
-
-
-def emit(log_file: Path, record: dict[str, Any]) -> None:
-    line = json.dumps(record, sort_keys=True)
-    with log_file.open("a", encoding="utf-8") as out:
-        out.write(line + "\n")
-    print(line, flush=True)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--log", required=True)
-    parser.add_argument("--state", required=True)
-    args = parser.parse_args()
-
-    socket_path = Path(args.socket)
-    log_file = Path(args.log)
-    state_file = Path(args.state)
-    socket_path.parent.mkdir(parents=True, exist_ok=True)
-    os.chmod(socket_path.parent, 0o700)
-    socket_path.unlink(missing_ok=True)
-    log_file.unlink(missing_ok=True)
-    state_file.unlink(missing_ok=True)
-
-    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    server.bind(str(socket_path))
-    os.chmod(socket_path, 0o600)
-    server.listen(8)
-    anchor: dict[str, Any] | None = None
-    session_id: str | None = None
-    emit(
-        log_file,
-        {
-            "event": "broker-listen",
-            "pid": os.getpid(),
-            "socket": str(socket_path),
-            "directory_mode": f"{stat.S_IMODE(socket_path.parent.stat().st_mode):04o}",
-            "socket_mode": f"{stat.S_IMODE(socket_path.stat().st_mode):04o}",
-        },
-    )
-
-    while True:
-        conn, _ = server.accept()
-        with conn:
-            raw = conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12)
-            peer_pid, peer_uid, peer_gid = struct.unpack("3i", raw)
-            request = json.loads(conn.makefile("r", encoding="utf-8").readline())
-            action = request.get("action")
-
-            if action == "register-anchor" and anchor is None:
-                anchor = proc_node(peer_pid)
-                session_id = secrets.token_hex(16)
-                state = {"session_id": session_id, "anchor": anchor}
-                state_file.write_text(json.dumps(state, sort_keys=True) + "\n")
-                record = {
-                    "event": "anchor-minted",
-                    "decision": "ACCEPT",
-                    "peercred": {"pid": peer_pid, "uid": peer_uid, "gid": peer_gid},
-                    "anchor": anchor,
-                    "session_id": session_id,
-                }
-                emit(log_file, record)
-                conn.sendall((json.dumps(record) + "\n").encode())
-                continue
-
-            if action in {"resolve-hook", "claim-session"}:
-                chain, reaches, reason = ancestry(peer_pid, anchor)
-                claimed = request.get("session_id")
-                claim_ok = action == "resolve-hook" or claimed == session_id
-                accepted = bool(anchor and session_id and reaches and claim_ok)
-                if action == "claim-session" and claimed != session_id:
-                    reason = "unknown-session-id"
-                elif action == "claim-session" and claimed == session_id and not reaches:
-                    reason = "victim-id-known-but-ancestry-mismatch"
-                record = {
-                    "event": action,
-                    "decision": "ACCEPT" if accepted else "REJECT",
-                    "reason": reason,
-                    "peercred": {"pid": peer_pid, "uid": peer_uid, "gid": peer_gid},
-                    "claimed_session_id": claimed,
-                    "resolved_session_id": session_id if accepted else None,
-                    "anchor": anchor,
-                    "ancestry": chain,
-                    "starttimes_rechecked": reaches,
-                }
-                emit(log_file, record)
-                conn.sendall((json.dumps(record) + "\n").encode())
-                continue
-
-            if action == "shutdown":
-                record = {
-                    "event": "broker-shutdown",
-                    "peercred": {"pid": peer_pid, "uid": peer_uid, "gid": peer_gid},
-                }
-                emit(log_file, record)
-                conn.sendall((json.dumps(record) + "\n").encode())
-                break
-
-            record = {
-                "event": "invalid-request",
-                "decision": "REJECT",
-                "peercred": {"pid": peer_pid, "uid": peer_uid, "gid": peer_gid},
-            }
-            emit(log_file, record)
-            conn.sendall((json.dumps(record) + "\n").encode())
-
-    server.close()
-    socket_path.unlink(missing_ok=True)
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except Exception as exc:
-        print(f"P1 broker fatal: {type(exc).__name__}: {exc}", file=sys.stderr)
-        raise

docs/compaction-refresh/probes/p1_hook_client.py

@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-"""Claude SessionStart hook client for P1 ancestry evidence."""
-
-from __future__ import annotations
-
-import json
-import os
-import socket
-import sys
-
-
-def main() -> None:
-    # Consume the real Claude hook payload without recording transcript paths or
-    # prompt content in the evidence artifact.
-    hook_input = json.load(sys.stdin)
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(os.environ["GATE0_BROKER_SOCKET"])
-    conn.sendall((json.dumps({"action": "resolve-hook"}) + "\n").encode())
-    response = json.loads(conn.makefile("r", encoding="utf-8").readline())
-    conn.close()
-    event_name = hook_input.get("hook_event_name")
-    if response.get("decision") != "ACCEPT":
-        print(f"Gate0 broker rejected {event_name} hook ancestry", file=sys.stderr)
-        raise SystemExit(2)
-    print(
-        json.dumps(
-            {
-                "hookSpecificOutput": {
-                    "hookEventName": event_name,
-                    "additionalContext": "GATE0_P1_SUPPORTED_HOOK_ANCESTRY_ACCEPTED",
-                }
-            }
-        )
-    )
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p1_pi_extension.ts

@@ -1,35 +0,0 @@
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import net from 'node:net';
-
-async function brokerRequest(payload: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const socketPath = process.env['GATE0_BROKER_SOCKET'];
-  if (!socketPath) throw new Error('GATE0_BROKER_SOCKET missing');
-  return await new Promise((resolve, reject) => {
-    const socket = net.createConnection(socketPath);
-    let buffer = '';
-    socket.setEncoding('utf8');
-    socket.on('connect', () => socket.write(`${JSON.stringify(payload)}\n`));
-    socket.on('data', (chunk) => {
-      buffer += chunk;
-      const newline = buffer.indexOf('\n');
-      if (newline < 0) return;
-      socket.end();
-      resolve(JSON.parse(buffer.slice(0, newline)) as Record<string, unknown>);
-    });
-    socket.on('error', reject);
-  });
-}
-
-export default function register(pi: ExtensionAPI) {
-  pi.on('session_start', async () => {
-    const response = await brokerRequest({ action: 'resolve-hook', runtime: 'pi-extension' });
-    if (response['decision'] !== 'ACCEPT') {
-      throw new Error(`P1 broker rejected Pi extension ancestry: ${response['reason']}`);
-    }
-  });
-
-  pi.registerCommand('gate0-p1-ready', {
-    description: 'Return only after the P1 session_start ancestry hook completed',
-    handler: async () => undefined,
-  });
-}

docs/compaction-refresh/probes/p1_run.py

@@ -1,274 +0,0 @@
-#!/usr/bin/env python3
-"""Run P1 against the real installed Mosaic→Pi and Mosaic→Claude chains."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import shutil
-import signal
-import socket
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-from typing import Any
-
-HERE = Path(__file__).resolve().parent
-
-
-def wait_for(predicate, description: str, timeout: float = 30.0) -> None:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if predicate():
-            return
-        time.sleep(0.05)
-    raise TimeoutError(f"timed out waiting for {description}")
-
-
-def read_records(path: Path) -> list[dict[str, Any]]:
-    if not path.exists():
-        return []
-    return [json.loads(line) for line in path.read_text().splitlines() if line]
-
-
-def socket_request(path: Path, payload: dict[str, object]) -> dict[str, object]:
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(str(path))
-    conn.sendall((json.dumps(payload) + "\n").encode())
-    response = json.loads(conn.makefile("r", encoding="utf-8").readline())
-    conn.close()
-    return response
-
-
-def start_broker(root: Path) -> tuple[subprocess.Popen[str], Path, Path, Path]:
-    socket_path = root / "broker.sock"
-    log_path = root / "broker.jsonl"
-    state_path = root / "state.json"
-    broker = subprocess.Popen(
-        [
-            sys.executable,
-            str(HERE / "p1_broker.py"),
-            "--socket",
-            str(socket_path),
-            "--log",
-            str(log_path),
-            "--state",
-            str(state_path),
-        ],
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-    )
-    wait_for(socket_path.exists, "broker socket")
-    return broker, socket_path, log_path, state_path
-
-
-def print_ps(record: dict[str, Any]) -> None:
-    chain = record.get("ancestry", [])
-    pids = [str(node["pid"]) for node in chain if Path(f"/proc/{node['pid']}").exists()]
-    if not pids:
-        print("ps_snapshot=<hook chain exited; broker /proc snapshot above is authoritative>")
-        return
-    command = [
-        "ps",
-        "-o",
-        "pid=,ppid=,lstart=,uid=,gid=,comm=",
-        "-p",
-        ",".join(pids),
-    ]
-    print("$ " + " ".join(command))
-    print(subprocess.check_output(command, text=True).rstrip())
-
-
-def run_runtime(runtime: str) -> None:
-    with tempfile.TemporaryDirectory(prefix=f"gate0-p1-{runtime}-") as temp:
-        root = Path(temp)
-        workspace = root / "workspace"
-        workspace.mkdir()
-        broker, socket_path, log_path, state_path = start_broker(root)
-        env = os.environ.copy()
-        env.update(
-            {
-                "GATE0_BROKER_SOCKET": str(socket_path),
-                "MOSAIC_PI_FORCE_SKILLS": "",
-                "PI_SKIP_VERSION_CHECK": "1",
-            }
-        )
-        stdout_path = root / f"{runtime}.stdout"
-        stderr_path = root / f"{runtime}.stderr"
-
-        if runtime == "pi":
-            runtime_args = [
-                "--mode",
-                "rpc",
-                "--no-session",
-                "--no-extensions",
-                "--no-context-files",
-                "--no-prompt-templates",
-                "--extension",
-                str(HERE / "p1_pi_extension.ts"),
-            ]
-        else:
-            settings = root / "claude-settings.json"
-            settings.write_text(
-                json.dumps(
-                    {
-                        "hooks": {
-                            "SessionStart": [
-                                {
-                                    "hooks": [
-                                        {
-                                            "type": "command",
-                                            "command": f'python3 "{HERE / "p1_hook_client.py"}"',
-                                            "timeout": 20,
-                                        }
-                                    ]
-                                }
-                            ]
-                        }
-                    }
-                )
-            )
-            runtime_args = [
-                "--settings",
-                str(settings),
-                "--model",
-                "haiku",
-                "--print",
-                "--output-format",
-                "stream-json",
-                "--verbose",
-                "--include-hook-events",
-                "--max-budget-usd",
-                "0.03",
-                "Reply exactly: OK",
-            ]
-
-        out = stdout_path.open("w", encoding="utf-8")
-        err = stderr_path.open("w", encoding="utf-8")
-        anchor = subprocess.Popen(
-            [
-                sys.executable,
-                str(HERE / "p1_anchor_exec.py"),
-                "--socket",
-                str(socket_path),
-                runtime,
-                *runtime_args,
-            ],
-            cwd=workspace,
-            env=env,
-            stdin=subprocess.PIPE if runtime == "pi" else subprocess.DEVNULL,
-            stdout=out,
-            stderr=err,
-            text=True,
-            start_new_session=True,
-        )
-        try:
-            wait_for(state_path.exists, "anchor registration")
-            attacker = subprocess.run(
-                [
-                    sys.executable,
-                    str(HERE / "p1_sibling_attacker.py"),
-                    "--socket",
-                    str(socket_path),
-                    "--state",
-                    str(state_path),
-                ],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if runtime == "pi":
-                assert anchor.stdin is not None
-                anchor.stdin.write('{"id":"state","type":"get_state"}\n')
-                anchor.stdin.flush()
-
-            wait_for(
-                lambda: any(r.get("event") == "resolve-hook" for r in read_records(log_path)),
-                f"{runtime} supported hook/extension broker contact",
-                timeout=60,
-            )
-            if runtime == "claude":
-                try:
-                    anchor.wait(timeout=90)
-                except subprocess.TimeoutExpired:
-                    pass
-            records = read_records(log_path)
-            state = json.loads(state_path.read_text())
-            resolve = next(r for r in records if r.get("event") == "resolve-hook")
-            reject = next(r for r in records if r.get("event") == "claim-session")
-            if resolve.get("decision") != "ACCEPT":
-                raise AssertionError(f"{runtime} hook ancestry was not accepted: {resolve}")
-            if reject.get("decision") != "REJECT":
-                raise AssertionError(f"{runtime} sibling substitution was not rejected: {reject}")
-            if attacker.returncode != 0:
-                raise AssertionError(f"{runtime} sibling probe did not observe rejection: {attacker.stderr}")
-
-            print(f"=== P1 {runtime.upper()} REAL LAUNCH ===")
-            print("machine_assertions=PASS")
-            print(
-                "$ python3 docs/compaction-refresh/probes/p1_anchor_exec.py "
-                f"--socket <protected-socket> {runtime} <runtime args>"
-            )
-            print("registered_anchor=" + json.dumps(state["anchor"], sort_keys=True))
-            print("broker_minted_session_id=" + state["session_id"])
-            print("hook_or_extension_record=" + json.dumps(resolve, sort_keys=True))
-            print("sibling_attack_record=" + json.dumps(reject, sort_keys=True))
-            print("sibling_process_stdout=" + attacker.stdout.strip())
-            print(f"sibling_process_exit={attacker.returncode}")
-            print_ps(resolve)
-            print("launcher_stderr_excerpt:")
-            for line in stderr_path.read_text(errors="replace").splitlines()[:12]:
-                print("  " + line[:500])
-            runtime_lines = stdout_path.read_text(errors="replace").splitlines()
-            print("runtime_stdout_excerpt:")
-            for line in runtime_lines[:8]:
-                print("  " + line[:500])
-            hook_lines = [
-                line
-                for line in runtime_lines
-                if "hook" in line.lower() or "GATE0_P1_SUPPORTED_HOOK" in line
-            ]
-            print("runtime_hook_event_excerpt:")
-            for line in hook_lines[:8]:
-                print("  " + line[:1000])
-            print()
-        finally:
-            if anchor.poll() is None:
-                try:
-                    os.killpg(anchor.pid, signal.SIGTERM)
-                except ProcessLookupError:
-                    pass
-                try:
-                    anchor.wait(timeout=5)
-                except subprocess.TimeoutExpired:
-                    os.killpg(anchor.pid, signal.SIGKILL)
-                    anchor.wait(timeout=5)
-            out.close()
-            err.close()
-            try:
-                socket_request(socket_path, {"action": "shutdown"})
-            except OSError:
-                pass
-            try:
-                broker.wait(timeout=5)
-            except subprocess.TimeoutExpired:
-                broker.kill()
-                broker.wait()
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--runtime", choices=["pi", "claude", "both"], default="both")
-    ns = parser.parse_args()
-    if ns.runtime in {"pi", "both"}:
-        run_runtime("pi")
-    if ns.runtime in {"claude", "both"}:
-        run_runtime("claude")
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p1_sibling_attacker.py

@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""Same-UID sibling that attempts to claim the anchor's broker-minted id."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import time
-from pathlib import Path
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--state", required=True)
-    ns = parser.parse_args()
-    state_path = Path(ns.state)
-    for _ in range(200):
-        if state_path.exists():
-            break
-        time.sleep(0.025)
-    state = json.loads(state_path.read_text())
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(ns.socket)
-    conn.sendall(
-        (
-            json.dumps(
-                {"action": "claim-session", "session_id": state["session_id"]},
-                sort_keys=True,
-            )
-            + "\n"
-        ).encode()
-    )
-    response = json.loads(conn.makefile("r", encoding="utf-8").readline())
-    conn.close()
-    print(
-        json.dumps(
-            {
-                "attacker_pid": os.getpid(),
-                "attacker_uid": os.getuid(),
-                "victim_session_id_known": True,
-                "broker_decision": response.get("decision"),
-                "broker_reason": response.get("reason"),
-            },
-            sort_keys=True,
-        )
-    )
-    raise SystemExit(0 if response.get("decision") == "REJECT" else 1)
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p2_provider_timing_run.py

@@ -1,135 +0,0 @@
-#!/usr/bin/env python3
-"""Force a real Pi HTTP provider response to prove response-hook timing."""
-
-from __future__ import annotations
-
-import json
-import os
-import tempfile
-import threading
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-
-from pi_gate0_run import PiRpc, jsonl
-
-HERE = Path(__file__).resolve().parent
-
-
-class Handler(BaseHTTPRequestHandler):
-    protocol_version = "HTTP/1.1"
-
-    def log_message(self, _format: str, *_args: object) -> None:
-        return
-
-    def do_POST(self) -> None:  # noqa: N802
-        length = int(self.headers.get("content-length", "0"))
-        self.rfile.read(length)
-        chunks = [
-            {
-                "id": "gate0-response",
-                "object": "chat.completion.chunk",
-                "created": 1,
-                "model": "gate0-model",
-                "choices": [{"index": 0, "delta": {"role": "assistant"}, "finish_reason": None}],
-            },
-            {
-                "id": "gate0-response",
-                "object": "chat.completion.chunk",
-                "created": 1,
-                "model": "gate0-model",
-                "choices": [
-                    {"index": 0, "delta": {"content": "TIMING_OK"}, "finish_reason": None}
-                ],
-            },
-            {
-                "id": "gate0-response",
-                "object": "chat.completion.chunk",
-                "created": 1,
-                "model": "gate0-model",
-                "choices": [{"index": 0, "delta": {}, "finish_reason": "stop"}],
-                "usage": {"prompt_tokens": 10, "completion_tokens": 2, "total_tokens": 12},
-            },
-        ]
-        body = "".join(f"data: {json.dumps(chunk)}\n\n" for chunk in chunks) + "data: [DONE]\n\n"
-        encoded = body.encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "text/event-stream")
-        self.send_header("Content-Length", str(len(encoded)))
-        self.send_header("X-Gate0-Response", "headers-before-stream")
-        self.end_headers()
-        self.wfile.write(encoded)
-        self.wfile.flush()
-
-
-def main() -> None:
-    server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
-    thread = threading.Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    port = server.server_address[1]
-
-    with tempfile.TemporaryDirectory(prefix="gate0-p2-timing-") as temp:
-        root = Path(temp)
-        workspace = root / "workspace"
-        workspace.mkdir()
-        log = root / "hooks.jsonl"
-        env = os.environ.copy()
-        env.update(
-            {
-                "GATE0_PI_LOG": str(log),
-                "GATE0_LOCAL_PROVIDER_URL": f"http://127.0.0.1:{port}/v1",
-                "MOSAIC_PI_FORCE_SKILLS": "",
-                "PI_SKIP_VERSION_CHECK": "1",
-            }
-        )
-        command = [
-            "mosaic",
-            "yolo",
-            "pi",
-            "--mode",
-            "rpc",
-            "--no-session",
-            "--no-extensions",
-            "--no-context-files",
-            "--no-prompt-templates",
-            "--provider",
-            "gate0-local",
-            "--model",
-            "gate0-model",
-            "--extension",
-            str(HERE / "pi_gate0_extension.ts"),
-        ]
-        pi = PiRpc(command, workspace, env)
-        try:
-            pi.prompt_and_settle("timing", "Reply with TIMING_OK")
-            records = jsonl(log)
-            selected = [
-                record
-                for record in records
-                if record["event"] in {"before_provider_request", "after_provider_response", "message_end"}
-                and (record["event"] != "message_end" or record.get("role") == "assistant")
-            ]
-            print("$ python3 docs/compaction-refresh/probes/p2_provider_timing_run.py")
-            print(f"local_http_endpoint=http://127.0.0.1:{port}/v1/chat/completions")
-            for record in selected:
-                print(json.dumps(record, sort_keys=True))
-            after = next(record for record in selected if record["event"] == "after_provider_response")
-            message = next(record for record in selected if record["event"] == "message_end")
-            if not (
-                after["seq"] < message["seq"]
-                and after["assistantContentAvailableAtThisHook"] is False
-                and message["assistantContentObserved"] is True
-            ):
-                raise AssertionError("provider response/content observation ordering failed")
-            print("machine_assertions=PASS")
-            print(f"after_provider_response_seq={after['seq']}")
-            print(f"message_end_seq={message['seq']}")
-            print(f"headers_hook_precedes_completed_message={after['seq'] < message['seq']}")
-        finally:
-            pi.close()
-
-    server.shutdown()
-    server.server_close()
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p3_d4_focused_run.py

@@ -1,849 +0,0 @@
-#!/usr/bin/env python3
-"""D4-only same-PID runtime-generation revocation harness.
-
-AUTHORING NOTE: this file is intentionally not executed until the separately
-ratified FIRE authorization.  When run later, every invocation creates its own
-/tmp fixture and launches the real Pi RPC runtime with only the D4 extension
-and ``p3_generation_broker.py``.  It does not use the broader Gate0 runner.
-"""
-
-from __future__ import annotations
-
-import argparse
-import ast
-import hashlib
-import json
-import os
-import queue
-import shutil
-import signal
-import socket
-import subprocess
-import sys
-import tempfile
-import threading
-import time
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable
-
-HERE = Path(__file__).resolve().parent
-# WI-3 remains in a reviewed worktree until the release package contains the
-# gated launcher. The probe resolves that worktree portably and never falls
-# back to the released `mosaic` binary.
-GATED_WI_ROOT_OVERRIDE = os.environ.get("GATED_WI_ROOT")
-GATED_WI_BRANCH = "refs/heads/feat/830-compaction-revoke"
-GATED_WI_HEAD = "f400830738998db105107a2a4c69c7f2a2a6fd5d"
-GATED_WI_ANCESTOR = "66b1e0a0"
-GATED_BROKER_HEAD = "23c0caca9b5d44002e6184cd7f2b6c837e8795b2"
-LEASE_BROKER_DIRECTORY = "packages/mosaic/framework/tools/lease-broker"
-BROKER_RELATIVE_PATH = "docs/compaction-refresh/probes/p3_generation_broker.py"
-GATED_LAUNCHER_SHA256 = "e950e4224e280f16979d90cabb89aa1896c5ee28bed2df957e14d018d43cda82"
-GATED_GENERATION_SHA256 = "061625402f08488eac47acd23272904e71fd1a71fd15b3bdab158632c801be4c"
-GATED_BROKER_SHA256 = "4db4fef1ac6658a8ca79ad5091cefc901d2aa26003265c3d6726c294cf895cad"
-
-
-class PiRpc:
-    """Small JSON-RPC client for an isolated real Pi process."""
-
-    def __init__(self, command: list[str], cwd: Path, env: dict[str, str]) -> None:
-        self.process = subprocess.Popen(
-            command,
-            cwd=cwd,
-            env=env,
-            stdin=subprocess.PIPE,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            text=True,
-            bufsize=1,
-            start_new_session=True,
-        )
-        self.events: queue.Queue[dict[str, Any]] = queue.Queue()
-        self.stderr_lines: list[str] = []
-        threading.Thread(target=self._read_stdout, daemon=True).start()
-        threading.Thread(target=self._read_stderr, daemon=True).start()
-
-    def _read_stdout(self) -> None:
-        if self.process.stdout is None:
-            raise RuntimeError("Pi stdout pipe is unavailable")
-        for line in self.process.stdout:
-            try:
-                self.events.put(json.loads(line))
-            except json.JSONDecodeError:
-                continue
-
-    def _read_stderr(self) -> None:
-        if self.process.stderr is None:
-            raise RuntimeError("Pi stderr pipe is unavailable")
-        for line in self.process.stderr:
-            self.stderr_lines.append(line.rstrip("\n"))
-
-    def send(self, payload: dict[str, object]) -> None:
-        if self.process.stdin is None:
-            raise RuntimeError("Pi stdin pipe is unavailable")
-        self.process.stdin.write(json.dumps(payload) + "\n")
-        self.process.stdin.flush()
-
-    def wait(
-        self,
-        predicate: Callable[[dict[str, Any]], bool],
-        description: str,
-        timeout: float = 180,
-    ) -> dict[str, Any]:
-        deadline = time.monotonic() + timeout
-        while time.monotonic() < deadline:
-            if self.process.poll() is not None and self.events.empty():
-                detail = " | ".join(self.stderr_lines[-5:])
-                raise RuntimeError(
-                    f"Pi exited {self.process.returncode} while waiting for {description}: {detail}"
-                )
-            try:
-                event = self.events.get(timeout=0.2)
-            except queue.Empty:
-                continue
-            if predicate(event):
-                return event
-        raise TimeoutError(f"timed out waiting for {description}")
-
-    def response(self, request_id: str, timeout: float = 180) -> dict[str, Any]:
-        return self.wait(
-            lambda event: event.get("type") == "response" and event.get("id") == request_id,
-            f"response {request_id}",
-            timeout,
-        )
-
-    def prompt_and_settle(self, request_id: str, message: str) -> None:
-        self.send({"id": request_id, "type": "prompt", "message": message})
-        response = self.response(request_id)
-        if not response.get("success"):
-            raise RuntimeError(f"prompt rejected: {response}")
-        self.wait(
-            lambda event: event.get("type") == "agent_settled",
-            f"agent_settled {request_id}",
-        )
-
-    def close(self) -> None:
-        if self.process.poll() is None:
-            try:
-                os.killpg(self.process.pid, signal.SIGTERM)
-            except ProcessLookupError:
-                pass
-            try:
-                self.process.wait(timeout=8)
-            except subprocess.TimeoutExpired:
-                os.killpg(self.process.pid, signal.SIGKILL)
-                self.process.wait(timeout=5)
-
-
-def wait_path(path: Path, timeout: float = 20) -> None:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if path.exists():
-            return
-        time.sleep(0.05)
-    raise TimeoutError(f"timed out waiting for {path}")
-
-
-def request(path: Path, payload: dict[str, object]) -> dict[str, Any]:
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as conn:
-        conn.connect(str(path))
-        conn.sendall((json.dumps(payload) + "\n").encode())
-        reply = conn.makefile("r", encoding="utf-8").readline()
-    return json.loads(reply)
-
-
-def jsonl(path: Path) -> list[dict[str, Any]]:
-    return [json.loads(line) for line in path.read_text().splitlines() if line]
-
-
-def write_extension(path: Path) -> None:
-    """Write the minimal Pi lifecycle bridge into the isolated fixture only."""
-
-    path.write_text(
-        """import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { Type } from 'typebox';
-import { appendFileSync, readFileSync } from 'node:fs';
-import net from 'node:net';
-
-const socketPath = process.env['D4_GENERATION_SOCKET'];
-const logPath = process.env['D4_PI_LOG'];
-
-function starttime(): number {
-  const text = readFileSync(`/proc/${process.pid}/stat`, 'utf8');
-  const close = text.lastIndexOf(')');
-  return Number(text.slice(close + 2).trim().split(/\\s+/)[19]);
-}
-
-function log(event: string, details: Record<string, unknown> = {}): void {
-  if (!logPath) return;
-  appendFileSync(logPath, `${JSON.stringify({ event, pid: process.pid, starttime_ticks: starttime(), ...details })}\\n`);
-}
-
-function broker(payload: Record<string, unknown>): Promise<Record<string, unknown>> {
-  if (!socketPath) return Promise.reject(new Error('D4_GENERATION_SOCKET is required'));
-  return new Promise((resolve, reject) => {
-    const connection = net.createConnection(socketPath);
-    let buffer = '';
-    connection.setEncoding('utf8');
-    connection.on('connect', () => connection.write(`${JSON.stringify(payload)}\\n`));
-    connection.on('data', (chunk) => {
-      buffer += chunk;
-      const newline = buffer.indexOf('\\n');
-      if (newline < 0) return;
-      connection.end();
-      resolve(JSON.parse(buffer.slice(0, newline)) as Record<string, unknown>);
-    });
-    connection.on('error', reject);
-  });
-}
-
-export default function register(pi: ExtensionAPI): void {
-  let initialStartup = true;
-
-  async function lifecycle(
-    phase: 'start' | 'shutdown',
-    reason: string,
-  ): Promise<Record<string, unknown>> {
-    if (!(phase === 'start' && reason === 'startup' && initialStartup)) {
-      const bump = await broker({ action: 'bump-generation' });
-      log('generation_state_bump', { phase, reason, bump });
-    }
-    initialStartup = false;
-    return broker({ action: 'lifecycle', phase, reason });
-  }
-
-  pi.on('session_start', async (event) => {
-    const lifecycleResult = await lifecycle('start', event.reason);
-    log('session_start', { reason: event.reason, lifecycle: lifecycleResult });
-    if (event.reason === 'reload') {
-      const generation = lifecycleResult['new_generation'];
-      if (typeof generation !== 'number') throw new Error('broker did not return new_generation');
-      const current = await broker({ action: 'authorize-probe', generation });
-      const superseded = await broker({ action: 'authorize-probe', generation: generation - 1 });
-      log('d4_generation_authorization', { generation, current, superseded });
-    }
-  });
-
-  pi.on('session_shutdown', async (event) => {
-    const lifecycleResult = await lifecycle('shutdown', event.reason);
-    log('session_shutdown', { reason: event.reason, lifecycle: lifecycleResult });
-  });
-
-  pi.registerTool({
-    name: 'd4_fixture_promote',
-    label: 'D4 Fixture Promotion',
-    description: 'Promotes only the fixture lease needed for the D4 revocation check.',
-    parameters: Type.Object({}),
-    async execute() {
-      // the promotion step is a D4 test fixture, not a P2 evidence-gathering authorization.
-      const promotion = await broker({ action: 'promote-probe' });
-      log('fixture_promotion', { promotion });
-      return { content: [{ type: 'text', text: 'D4 fixture promotion complete' }] };
-    },
-  });
-
-  pi.registerCommand('d4-reload', {
-    description: 'D4-only same-PID reload boundary.',
-    handler: async (_args, context) => {
-      await context.reload();
-    },
-  });
-}
-""",
-        encoding="utf-8",
-    )
-
-
-def repository_root() -> Path:
-    for candidate in HERE.parents:
-        if (candidate / ".git").exists():
-            return candidate
-    raise RuntimeError("D4 precondition: probe repository root is unavailable")
-
-
-def resolve_gated_wi_root() -> Path:
-    """Resolve an explicit override or the unique checked-out WI-3 branch."""
-
-    if GATED_WI_ROOT_OVERRIDE:
-        candidate = Path(GATED_WI_ROOT_OVERRIDE).expanduser()
-        candidates = [candidate]
-    else:
-        try:
-            listing = subprocess.check_output(
-                ["git", "-C", str(repository_root()), "worktree", "list", "--porcelain"],
-                text=True,
-            )
-        except (OSError, subprocess.CalledProcessError) as error:
-            raise RuntimeError("D4 precondition: cannot enumerate WI-3 worktrees") from error
-        candidates = []
-        worktree: Path | None = None
-        head: str | None = None
-        branch: str | None = None
-        for line in [*listing.splitlines(), ""]:
-            if line.startswith("worktree "):
-                worktree = Path(line.removeprefix("worktree "))
-                head = None
-                branch = None
-            elif line.startswith("HEAD "):
-                head = line.removeprefix("HEAD ")
-            elif line.startswith("branch "):
-                branch = line.removeprefix("branch ")
-            elif not line and worktree is not None:
-                if head == GATED_WI_HEAD and branch == GATED_WI_BRANCH:
-                    candidates.append(worktree)
-                worktree = None
-        if len(candidates) != 1:
-            raise RuntimeError("D4 precondition: WI-3 worktree is ambiguous or unavailable")
-
-    gated_root = candidates[0]
-    try:
-        if not gated_root.is_dir():
-            raise RuntimeError("D4 precondition: GATED_WI_ROOT is not a directory")
-        is_worktree = subprocess.check_output(
-            ["git", "-C", str(gated_root), "rev-parse", "--is-inside-work-tree"],
-            text=True,
-        ).strip()
-        head = subprocess.check_output(
-            ["git", "-C", str(gated_root), "rev-parse", "HEAD"], text=True
-        ).strip()
-    except (OSError, subprocess.CalledProcessError) as error:
-        raise RuntimeError("D4 precondition: GATED_WI_ROOT is not a git worktree") from error
-    if is_worktree != "true":
-        raise RuntimeError("D4 precondition: GATED_WI_ROOT is not a git worktree")
-    if head != GATED_WI_HEAD:
-        raise RuntimeError(f"D4 precondition: gated WI head mismatch: {head}")
-    try:
-        forward_contains = subprocess.run(
-            [
-                "git",
-                "-C",
-                str(gated_root),
-                "merge-base",
-                "--is-ancestor",
-                GATED_WI_ANCESTOR,
-                GATED_WI_HEAD,
-            ],
-            check=False,
-        ).returncode == 0
-    except OSError as error:
-        raise RuntimeError("D4 precondition: cannot verify WI-3 ancestry") from error
-    if not forward_contains:
-        raise RuntimeError("D4 precondition: gated WI lacks required ancestor")
-    return gated_root
-
-
-@dataclass(frozen=True)
-class PinnedClosure:
-    launcher: Path
-    generation: Path
-    broker: Path
-
-
-def git_object_bytes(git_root: Path, commit: str, relative_path: str) -> bytes:
-    try:
-        return subprocess.check_output(
-            ["git", "-C", str(git_root), "show", f"{commit}:{relative_path}"]
-        )
-    except (OSError, subprocess.CalledProcessError) as error:
-        raise RuntimeError(f"D4 precondition: missing pinned source {relative_path}") from error
-
-
-def closure_import_guard(member_sources: dict[str, str]) -> None:
-    """Refuse an incomplete project-code closure before materializing it."""
-
-    allowed_nonstdlib = {"lease_generation"}
-    stdlib = getattr(sys, "stdlib_module_names", frozenset())
-    for name, source in member_sources.items():
-        try:
-            tree = ast.parse(source, filename=name)
-        except SyntaxError as error:
-            raise RuntimeError(f"D4 precondition: pinned {name} does not parse") from error
-        for node in ast.walk(tree):
-            module: str | None = None
-            if isinstance(node, ast.Import):
-                for alias in node.names:
-                    module = alias.name.split(".", maxsplit=1)[0]
-                    if module not in stdlib and module not in allowed_nonstdlib:
-                        raise RuntimeError(f"D4 precondition: unpinned import {module} in {name}")
-            elif isinstance(node, ast.ImportFrom):
-                if node.level:
-                    raise RuntimeError(f"D4 precondition: relative import in {name}")
-                if node.module:
-                    module = node.module.split(".", maxsplit=1)[0]
-                    if module not in stdlib and module not in allowed_nonstdlib:
-                        raise RuntimeError(f"D4 precondition: unpinned import {module} in {name}")
-
-
-def write_pinned_file(path: Path, data: bytes) -> None:
-    descriptor = os.open(
-        path,
-        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC,
-        0o600,
-    )
-    try:
-        remaining = memoryview(data)
-        while remaining:
-            written = os.write(descriptor, remaining)
-            if written <= 0:
-                raise OSError("pinned write made no progress")
-            remaining = remaining[written:]
-    finally:
-        os.close(descriptor)
-
-
-def materialize_closure(root: Path, gated_root: Path, gate0_root: Path) -> PinnedClosure:
-    """Pin the complete project-authored runtime closure inside this fixture."""
-
-    launcher_relative = f"{LEASE_BROKER_DIRECTORY}/launch-runtime.py"
-    generation_relative = f"{LEASE_BROKER_DIRECTORY}/lease_generation.py"
-    members = (
-        (
-            "launch-runtime.py",
-            gated_root,
-            GATED_WI_HEAD,
-            launcher_relative,
-            GATED_LAUNCHER_SHA256,
-        ),
-        (
-            "lease_generation.py",
-            gated_root,
-            GATED_WI_HEAD,
-            generation_relative,
-            GATED_GENERATION_SHA256,
-        ),
-        (
-            "p3_generation_broker.py",
-            gate0_root,
-            GATED_BROKER_HEAD,
-            BROKER_RELATIVE_PATH,
-            GATED_BROKER_SHA256,
-        ),
-    )
-    member_bytes: dict[str, bytes] = {}
-    member_sources: dict[str, str] = {}
-    for name, git_root, commit, relative_path, digest in members:
-        data = git_object_bytes(git_root, commit, relative_path)
-        if hashlib.sha256(data).hexdigest() != digest:
-            raise RuntimeError(f"D4 precondition: {name} hash mismatch")
-        try:
-            member_sources[name] = data.decode("utf-8")
-        except UnicodeDecodeError as error:
-            raise RuntimeError(f"D4 precondition: pinned {name} is not UTF-8") from error
-        member_bytes[name] = data
-    closure_import_guard(member_sources)
-
-    pinned = root / "pinned"
-    pinned.mkdir(mode=0o700)
-    paths = {name: pinned / name for name, *_ in members}
-    for name, path in paths.items():
-        write_pinned_file(path, member_bytes[name])
-    return PinnedClosure(
-        launcher=paths["launch-runtime.py"],
-        generation=paths["lease_generation.py"],
-        broker=paths["p3_generation_broker.py"],
-    )
-
-
-def gated_launcher_precondition(
-    root: Path, socket_path: Path, environment: dict[str, str]
-) -> PinnedClosure:
-    """Verify and materialize the full WI-3/probe closure before execution."""
-
-    if environment.get("MOSAIC_LEASE_BROKER_SOCKET") != str(socket_path):
-        raise RuntimeError("D4 precondition: lease broker socket is not this fixture")
-    if environment.get("MOSAIC_LEASE_GENERATION_FILE"):
-        raise RuntimeError("D4 precondition: inherited generation file is forbidden")
-    fixture_path_vars = (
-        "HOME",
-        "XDG_CONFIG_HOME",
-        "XDG_CACHE_HOME",
-        "XDG_STATE_HOME",
-        "XDG_RUNTIME_DIR",
-        "TMPDIR",
-        "D4_PI_LOG",
-        "MOSAIC_AGENT_WORKDIR",
-        "MOSAIC_HEARTBEAT_RUN_DIR",
-        "MOSAIC_HOME",
-    )
-    if any(
-        not (value := environment.get(name)) or not Path(value).is_relative_to(root)
-        for name in fixture_path_vars
-    ):
-        raise RuntimeError("D4 precondition: child write path escapes fixture root")
-    if socket_path.parent != root or root.parent != Path(tempfile.gettempdir()):
-        raise RuntimeError("D4 precondition: fixture socket is outside this run's temporary root")
-
-    gated_root = resolve_gated_wi_root()
-    closure = materialize_closure(root, gated_root, repository_root())
-    launcher_source = closure.launcher.read_text(encoding="utf-8")
-    generation_source = closure.generation.read_text(encoding="utf-8")
-    # Exact hashes in materialize_closure are the trust anchor. These marker
-    # checks are belt-and-suspenders diagnostics only.
-    behavior_markers = (
-        '"action": "register_anchor"',
-        "initialize_runtime_generation(generation_file, generation)",
-        "execute(command[0], command, environment)",
-        'source_environment["MOSAIC_LEASE_BROKER_SOCKET"]',
-        'socket_path.parent / f"generation-{session_id}.state"',
-        'environment["MOSAIC_LEASE_GENERATION_FILE"]',
-    )
-    if not all(marker in launcher_source for marker in behavior_markers) or not (
-        "def read_runtime_generation" in generation_source
-        and "def bump_runtime_generation" in generation_source
-    ):
-        raise RuntimeError("D4 precondition: pinned launcher lacks file-generation markers")
-    return closure
-
-
-def reject_pinned_bytecode(pinned_directory: Path) -> None:
-    cache_directory = pinned_directory / "__pycache__"
-    if cache_directory.exists() or any(pinned_directory.rglob("*.pyc")):
-        raise RuntimeError("D4 precondition: pinned bytecode cache is forbidden")
-
-
-def launch_verified_pi(
-    launcher: Path,
-    workspace: Path,
-    sessions: Path,
-    extension: Path,
-    environment: dict[str, str],
-) -> PiRpc:
-    command = [
-        sys.executable,
-        # -s preserves sys.path[0]=pinned/ for the launcher's sibling helper.
-        "-s",
-        "-S",
-        "-B",
-        str(launcher),
-        "--runtime",
-        "pi",
-        "--",
-        "pi",
-        "--mode",
-        "rpc",
-        "--session-dir",
-        str(sessions),
-        "--no-extensions",
-        "--no-context-files",
-        "--no-prompt-templates",
-        "--model",
-        "openai-codex/gpt-5.6-sol",
-        "--thinking",
-        "medium",
-        "--extension",
-        str(extension),
-    ]
-    reject_pinned_bytecode(launcher.parent)
-    # This is deliberately the statement immediately before Popen (inside
-    # PiRpc): the fixture-pinned launcher bytes are re-hashed then executed.
-    if hashlib.sha256(launcher.read_bytes()).hexdigest() != GATED_LAUNCHER_SHA256:
-        raise RuntimeError("D4 precondition: adjacent launcher hash mismatch")
-    return PiRpc(command, workspace, environment)
-
-
-def launch_verified_broker(
-    broker_path: Path,
-    generation_path: Path,
-    socket_path: Path,
-    log_path: Path,
-    environment: dict[str, str],
-) -> subprocess.Popen[str]:
-    command = [
-        sys.executable,
-        "-I",
-        "-S",
-        "-B",
-        str(broker_path),
-        "--socket",
-        str(socket_path),
-        "--log",
-        str(log_path),
-        "--generation-module",
-        str(generation_path),
-    ]
-    reject_pinned_bytecode(broker_path.parent)
-    if hashlib.sha256(broker_path.read_bytes()).hexdigest() != GATED_BROKER_SHA256:
-        raise RuntimeError("D4 precondition: pinned broker hash mismatch")
-    # The final helper re-hash is immediately adjacent to the broker Popen.
-    if hashlib.sha256(generation_path.read_bytes()).hexdigest() != GATED_GENERATION_SHA256:
-        raise RuntimeError("D4 precondition: pinned helper hash mismatch")
-    return subprocess.Popen(
-        command,
-        env=environment,
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-    )
-
-
-def assert_d4(records: list[dict[str, Any]]) -> dict[str, object]:
-    def record_where(description: str, candidates: list[dict[str, Any]]) -> dict[str, Any]:
-        if not candidates:
-            raise AssertionError(f"missing D4 evidence record: {description}")
-        return candidates[0]
-
-    fixture_listen = record_where(
-        "fixture listen", [r for r in records if r.get("event") == "listen"]
-    )
-    fixture_root = Path(fixture_listen["socket"]).parent
-    lifecycle = [record for record in records if record.get("event") == "runtime_generation_bump"]
-    state_bumps = [record for record in records if record.get("event") == "generation_state_bumped"]
-    promotion = record_where(
-        "fixture promotion", [r for r in records if r.get("event") == "probe_lease_promoted"]
-    )
-    launcher_registration = record_where(
-        "lease anchor", [r for r in records if r.get("event") == "lease_anchor_registered"]
-    )
-    reload_revoke = record_where(
-        "reload shutdown",
-        [
-            r
-            for r in lifecycle
-            if r.get("reason") == "reload" and r.get("phase") == "shutdown"
-        ],
-    )
-    reload_start = record_where(
-        "reload start",
-        [
-            r
-            for r in lifecycle
-            if r.get("reason") == "reload" and r.get("phase") == "start"
-        ],
-    )
-    authorization = [
-        record for record in records if record.get("event") == "generation_authorization"
-    ]
-    current_generation = reload_start["new_generation"]
-    current_authorization = record_where(
-        "current-generation authorization",
-        [r for r in authorization if r.get("requested_generation") == current_generation],
-    )
-    superseded_authorization = record_where(
-        "superseded-generation authorization",
-        [r for r in authorization if r.get("requested_generation") == current_generation - 1],
-    )
-
-    identities = {
-        (record["peercred"]["pid"], record["starttime_ticks"])
-        for record in [*lifecycle, *state_bumps, promotion, launcher_registration, *authorization]
-    }
-    generations = [record["new_generation"] for record in lifecycle]
-    file_records = [*lifecycle, *state_bumps, promotion, *authorization]
-    observed_reasons = {record.get("reason") for record in lifecycle}
-    checks = {
-        "same_pid_starttime": len(identities) == 1,
-        "strictly_increasing_generation": all(
-            previous < current for previous, current in zip(generations, generations[1:])
-        ),
-        "state_file_drives_lifecycle": [record["generation"] for record in state_bumps]
-        == generations[1:],
-        "state_file_source": all(
-            record.get("generation_source") == "state-file" for record in file_records
-        ),
-        "state_file_in_fixture_root": all(
-            Path(record["generation_file"]).parent == fixture_root for record in file_records
-        )
-        and Path(launcher_registration["generation_file"]).parent == fixture_root,
-        "all_lifecycle_boundaries": {"startup", "reload", "fork", "new", "resume"}
-        <= observed_reasons,
-        "lease_anchor_fixture": launcher_registration.get("session_id_shape") == "hex-256",
-        "verified_revoked_on_reload": reload_revoke.get("prior_lease") == "VERIFIED"
-        and reload_revoke.get("prior_lease_revoked") is True,
-        "new_generation_unverified": current_authorization.get("code") == "MUTATOR_UNVERIFIED",
-        "prior_generation_stale": superseded_authorization.get("code") == "STALE_GENERATION",
-    }
-    failed = [name for name, passed in checks.items() if not passed]
-    if failed:
-        raise AssertionError(f"D4 checks failed: {', '.join(failed)}")
-    passed = all(checks.values())
-    if not passed:
-        raise AssertionError("D4 PASS derivation failed")
-
-    return {
-        "machine_assertions": "PASS" if passed else "FAIL",
-        "checks": checks,
-        "same_pid_starttime": next(iter(identities)),
-        "generations": generations,
-        "reload_revoke_verified": checks["verified_revoked_on_reload"],
-        "lease_anchor_fixture": checks["lease_anchor_fixture"],
-        "file_backed_generation": checks["state_file_drives_lifecycle"],
-        "new_generation_code": current_authorization["code"],
-        "superseded_generation_code": superseded_authorization["code"],
-    }
-
-
-def isolated_environment(
-    root: Path, index: int, workspace: Path, socket_path: Path, pi_log: Path
-) -> dict[str, str]:
-    """Build a write-confined child environment; no inherited path variable survives."""
-
-    fixture_home = root / "home"
-    fixture_config = root / "config"
-    fixture_cache = root / "cache"
-    fixture_state = root / "state"
-    fixture_runtime = root / "runtime"
-    fixture_tmp = root / "tmp"
-    fixture_heartbeat = root / "heartbeat"
-    fixture_mosaic_home = root / "mosaic-home"
-    for directory in (
-        fixture_home,
-        fixture_config,
-        fixture_cache,
-        fixture_state,
-        fixture_runtime,
-        fixture_tmp,
-        fixture_heartbeat,
-        fixture_mosaic_home,
-    ):
-        directory.mkdir(mode=0o700)
-
-    # Authentication/settings are copied into fixture HOME so Pi never writes
-    # under the operator's HOME. They are not emitted or modified in place.
-    source_agent = Path.home() / ".pi" / "agent"
-    target_agent = fixture_home / ".pi" / "agent"
-    target_agent.mkdir(parents=True, mode=0o700)
-    for name in ("settings.json", "auth.json", "bin/fd"):
-        source = source_agent / name
-        target = target_agent / name
-        if source.is_file():
-            target.parent.mkdir(parents=True, mode=0o700)
-            shutil.copy2(source, target)
-
-    environment = {
-        "HOME": str(fixture_home),
-        "XDG_CONFIG_HOME": str(fixture_config),
-        "XDG_CACHE_HOME": str(fixture_cache),
-        "XDG_STATE_HOME": str(fixture_state),
-        "XDG_RUNTIME_DIR": str(fixture_runtime),
-        "TMPDIR": str(fixture_tmp),
-        "PATH": os.environ.get("PATH", ""),
-        "LANG": os.environ.get("LANG", "C.UTF-8"),
-        "TERM": os.environ.get("TERM", "dumb"),
-        "D4_GENERATION_SOCKET": str(socket_path),
-        "MOSAIC_LEASE_BROKER_SOCKET": str(socket_path),
-        "D4_PI_LOG": str(pi_log),
-        "MOSAIC_AGENT_NAME": f"d4-fixture-{index}",
-        "MOSAIC_AGENT_WORKDIR": str(workspace),
-        "MOSAIC_HEARTBEAT_RUN_DIR": str(fixture_heartbeat),
-        "MOSAIC_HOME": str(fixture_mosaic_home),
-        "MOSAIC_PI_FORCE_SKILLS": "",
-        "PI_SKIP_VERSION_CHECK": "1",
-        "PYTHONDONTWRITEBYTECODE": "1",
-        "PYTHONNOUSERSITE": "1",
-    }
-    if "PI_CODING_AGENT" in os.environ:
-        environment["PI_CODING_AGENT"] = os.environ["PI_CODING_AGENT"]
-    return environment
-
-
-def scrub_fixture_credentials(root: Path) -> None:
-    """Remove the copied Pi credential/config subtree before retaining evidence."""
-
-    copied_agent = root / "home" / ".pi" / "agent"
-    if copied_agent.exists():
-        shutil.rmtree(copied_agent)
-    if copied_agent.exists():
-        raise RuntimeError("D4 credential scrub failed")
-
-
-def run_once(index: int) -> Path:
-    root = Path(tempfile.mkdtemp(prefix=f"gate0-d4-{index}-"))
-    workspace = root / "workspace"
-    sessions = root / "sessions"
-    workspace.mkdir(mode=0o700)
-    sessions.mkdir(mode=0o700)
-    socket_path = root / "generation.sock"
-    generation_log = root / "generation.jsonl"
-    pi_log = root / "pi.jsonl"
-    extension = root / "d4_extension.ts"
-    write_extension(extension)
-    broker: subprocess.Popen[str] | None = None
-    pi: PiRpc | None = None
-
-    try:
-        environment = isolated_environment(root, index, workspace, socket_path, pi_log)
-        # Must run before the fixture broker or Pi process is launched. It proves
-        # the launcher registers before exec and can only read this fixture socket.
-        closure = gated_launcher_precondition(root, socket_path, environment)
-        broker = launch_verified_broker(
-            closure.broker, closure.generation, socket_path, generation_log, environment
-        )
-        wait_path(socket_path)
-        pi = launch_verified_pi(closure.launcher, workspace, sessions, extension, environment)
-        pi.send({"id": "state", "type": "get_state"})
-        state = pi.response("state")
-        original_session = state["data"]["sessionFile"]
-        pi.prompt_and_settle(
-            "fixture-promote",
-            "Call d4_fixture_promote exactly once, then stop.",
-        )
-        pi.send({"id": "reload", "type": "prompt", "message": "/d4-reload"})
-        reload_response = pi.response("reload")
-        if not reload_response.get("success"):
-            raise RuntimeError(f"reload failed: {reload_response}")
-        for request_id, request_payload in [
-            ("clone", {"id": "clone", "type": "clone"}),
-            ("new", {"id": "new", "type": "new_session"}),
-            (
-                "resume",
-                {"id": "resume", "type": "switch_session", "sessionPath": original_session},
-            ),
-        ]:
-            pi.send(request_payload)
-            response = pi.response(request_id)
-            if not response.get("success") or response.get("data", {}).get("cancelled"):
-                raise RuntimeError(f"{request_id} failed: {response}")
-        results = assert_d4(jsonl(generation_log))
-        verdict = results.get("machine_assertions")
-        if verdict != "PASS":
-            raise RuntimeError(f"D4 checks did not derive PASS: {verdict}")
-        (root / "machine-assertions.json").write_text(
-            json.dumps(results, sort_keys=True, indent=2) + "\n",
-            encoding="utf-8",
-        )
-        print(f"run={index} evidence_dir={root}")
-        print(f"machine_assertions={verdict}")
-        print(json.dumps(results, sort_keys=True))
-    except Exception as error:
-        (root / "machine-assertions.json").write_text(
-            json.dumps({"error": f"{type(error).__name__}: {error}"}, sort_keys=True, indent=2)
-            + "\n",
-            encoding="utf-8",
-        )
-        print(f"run={index} evidence_dir={root}")
-        print("machine_assertions=FAIL")
-        print(f"error={type(error).__name__}: {error}")
-        raise
-    finally:
-        try:
-            try:
-                if pi is not None:
-                    pi.close()
-            finally:
-                if broker is not None:
-                    try:
-                        request(socket_path, {"action": "shutdown-broker"})
-                    except OSError:
-                        pass
-                    try:
-                        broker.wait(timeout=5)
-                    except subprocess.TimeoutExpired:
-                        broker.kill()
-                        broker.wait()
-        finally:
-            scrub_fixture_credentials(root)
-    return root
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--runs", type=int, default=3, choices=(3,))
-    args = parser.parse_args()
-    roots: list[Path] = []
-    for index in range(1, args.runs + 1):
-        roots.append(run_once(index))
-    print("d4_isolation_runs=" + ",".join(str(root) for root in roots))
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p3_generation_broker.py

@@ -1,215 +0,0 @@
-#!/usr/bin/env python3
-"""P3 broker prototype: peercred-keyed runtime_generation and lease revocation."""
-
-from __future__ import annotations
-
-import argparse
-import importlib.util
-import json
-import os
-import secrets
-import socket
-import struct
-from collections.abc import Callable, Mapping
-from pathlib import Path
-from typing import Any
-
-
-def proc_starttime(pid: int) -> int:
-    text = Path(f"/proc/{pid}/stat").read_text()
-    close = text.rfind(")")
-    return int(text[close + 2 :].split()[19])
-
-
-def emit(log: Path, value: dict[str, Any]) -> None:
-    with log.open("a", encoding="utf-8") as out:
-        out.write(json.dumps(value, sort_keys=True) + "\n")
-
-
-def load_generation_functions(
-    path: Path,
-) -> tuple[Callable[[Mapping[str, str]], int], Callable[[Mapping[str, str]], int]]:
-    spec = importlib.util.spec_from_file_location("d4_lease_generation", path)
-    if spec is None or spec.loader is None:
-        raise ValueError("generation module is unavailable")
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    reader = getattr(module, "read_runtime_generation", None)
-    bumper = getattr(module, "bump_runtime_generation", None)
-    if not callable(reader) or not callable(bumper):
-        raise ValueError("generation module has no read/bump functions")
-    return reader, bumper
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--log", required=True)
-    parser.add_argument("--generation-module", required=True, type=Path)
-    ns = parser.parse_args()
-    socket_path = Path(ns.socket)
-    log_path = Path(ns.log)
-    read_runtime_generation, bump_runtime_generation = load_generation_functions(
-        ns.generation_module
-    )
-    socket_path.parent.mkdir(parents=True, exist_ok=True)
-    os.chmod(socket_path.parent, 0o700)
-    socket_path.unlink(missing_ok=True)
-    log_path.unlink(missing_ok=True)
-
-    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    server.bind(str(socket_path))
-    os.chmod(socket_path, 0o600)
-    server.listen(8)
-    generations: dict[tuple[int, int], int] = {}
-    lease_state: dict[tuple[int, int], str] = {}
-    # The gated launcher registers its own exec-preserved PID here.  This is
-    # deliberately volatile fixture state; nothing is written outside root.
-    launcher_sessions: dict[tuple[int, int], str] = {}
-    generation_files: dict[tuple[int, int], Path] = {}
-
-    def generation_environment(identity: tuple[int, int]) -> dict[str, str]:
-        state_path = generation_files.get(identity)
-        if state_path is None or state_path.parent != socket_path.parent:
-            raise ValueError("generation file is outside the fixture root")
-        return {"MOSAIC_LEASE_GENERATION_FILE": str(state_path)}
-
-    def file_generation(identity: tuple[int, int]) -> int:
-        return read_runtime_generation(generation_environment(identity))
-
-    emit(log_path, {"event": "listen", "pid": os.getpid(), "socket": str(socket_path)})
-
-    while True:
-        conn, _ = server.accept()
-        with conn:
-            raw = conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12)
-            pid, uid, gid = struct.unpack("3i", raw)
-            starttime = proc_starttime(pid)
-            request = json.loads(conn.makefile("r", encoding="utf-8").readline())
-            if request.get("action") == "shutdown-broker":
-                conn.sendall(b'{"ok":true}\n')
-                break
-            identity = (pid, starttime)
-            if request.get("action") == "register_anchor":
-                generation = request.get("runtime_generation")
-                if type(generation) is not int or generation < 0:
-                    conn.sendall(b'{"ok":false,"code":"INVALID_GENERATION"}\n')
-                    continue
-                session_id = launcher_sessions.setdefault(identity, secrets.token_hex(32))
-                generation_file = socket_path.parent / f"generation-{session_id}.state"
-                generation_files[identity] = generation_file
-                record = {
-                    "event": "lease_anchor_registered",
-                    "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                    "starttime_ticks": starttime,
-                    "runtime_generation": generation,
-                    "session_id_shape": "hex-256",
-                    "generation_file": str(generation_file),
-                }
-                emit(log_path, record)
-                reply = {
-                    "ok": True,
-                    "session_id": session_id,
-                    "peer": {"pid": pid, "uid": uid, "gid": gid, "starttime": str(starttime)},
-                }
-                conn.sendall((json.dumps(reply, sort_keys=True) + "\n").encode())
-                continue
-            # The D4 extension requests this at each post-start lifecycle
-            # boundary; the exact WI-3 helper mutates the launcher-created file.
-            if request.get("action") == "bump-generation":
-                generation = bump_runtime_generation(generation_environment(identity))
-                record = {
-                    "event": "generation_state_bumped",
-                    "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                    "starttime_ticks": starttime,
-                    "generation": generation,
-                    "generation_file": str(generation_files[identity]),
-                    "generation_source": "state-file",
-                }
-                emit(log_path, record)
-                conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
-                continue
-            if request.get("action") == "promote-probe":
-                generation = file_generation(identity)
-                lease_state[identity] = "VERIFIED"
-                record = {
-                    "event": "probe_lease_promoted",
-                    "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                    "starttime_ticks": starttime,
-                    "generation": generation,
-                    "generation_file": str(generation_files[identity]),
-                    "generation_source": "state-file",
-                    "new_lease_state": "VERIFIED",
-                }
-                emit(log_path, record)
-                conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
-                continue
-            # D4 fixture-only authorization observation.  It exposes the broker's
-            # current versus superseded generation disposition without changing it.
-            if request.get("action") == "authorize-probe":
-                generation = request.get("generation")
-                if type(generation) is not int or generation < 0:
-                    conn.sendall(b'{"ok":false,"code":"INVALID_GENERATION"}\n')
-                    continue
-                current_generation = file_generation(identity)
-                current_lease = lease_state.get(identity, "NONE")
-                if generation < current_generation:
-                    code = "STALE_GENERATION"
-                elif generation > current_generation:
-                    code = "FUTURE_GENERATION"
-                elif current_lease != "VERIFIED":
-                    code = "MUTATOR_UNVERIFIED"
-                else:
-                    code = "ALLOW"
-                record = {
-                    "event": "generation_authorization",
-                    "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                    "starttime_ticks": starttime,
-                    "requested_generation": generation,
-                    "current_generation": current_generation,
-                    "generation_file": str(generation_files[identity]),
-                    "generation_source": "state-file",
-                    "lease_state": current_lease,
-                    "ok": code == "ALLOW",
-                    "code": code,
-                }
-                emit(log_path, record)
-                conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
-                continue
-            if request.get("action") != "lifecycle":
-                conn.sendall(b'{"ok":false,"reason":"invalid-action"}\n')
-                continue
-
-            old_generation = generations.get(identity, 0)
-            old_lease = lease_state.get(identity, "NONE")
-            new_generation = file_generation(identity)
-            if new_generation <= old_generation:
-                conn.sendall(b'{"ok":false,"code":"NON_MONOTONIC_STATE_FILE"}\n')
-                continue
-            generations[identity] = new_generation
-            # Every lifecycle boundary revokes first. A start establishes a new
-            # UNVERIFIED incarnation; it never inherits prior VERIFIED state.
-            lease_state[identity] = "UNVERIFIED" if request.get("phase") == "start" else "REVOKED"
-            record = {
-                "event": "runtime_generation_bump",
-                "peercred": {"pid": pid, "uid": uid, "gid": gid},
-                "starttime_ticks": starttime,
-                "phase": request.get("phase"),
-                "reason": request.get("reason"),
-                "old_generation": old_generation,
-                "new_generation": new_generation,
-                "generation_file": str(generation_files[identity]),
-                "generation_source": "state-file",
-                "prior_lease": old_lease,
-                "prior_lease_revoked": True,
-                "new_lease_state": lease_state[identity],
-            }
-            emit(log_path, record)
-            conn.sendall((json.dumps(record, sort_keys=True) + "\n").encode())
-
-    server.close()
-    socket_path.unlink(missing_ok=True)
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p4_peercred_probe.py

@@ -1,97 +0,0 @@
-#!/usr/bin/env python3
-"""Gate0 P4: exercise Linux SO_PEERCRED and correlate it to /proc."""
-
-from __future__ import annotations
-
-import json
-import os
-import socket
-import stat
-import tempfile
-from pathlib import Path
-
-
-def proc_identity(pid: int) -> dict[str, int | str]:
-    stat_text = Path(f"/proc/{pid}/stat").read_text()
-    close = stat_text.rfind(")")
-    fields = stat_text[close + 2 :].split()
-    # fields[0] is field 3 (state); ppid is field 4 and starttime is field 22.
-    return {
-        "pid": pid,
-        "ppid": int(fields[1]),
-        "starttime_ticks": int(fields[19]),
-        "uid": int(Path(f"/proc/{pid}/status").read_text().split("Uid:", 1)[1].split()[0]),
-        "exe": os.readlink(f"/proc/{pid}/exe"),
-    }
-
-
-def main() -> None:
-    with tempfile.TemporaryDirectory(prefix="gate0-p4-") as tmp:
-        root = Path(tmp)
-        os.chmod(root, 0o700)
-        socket_path = root / "broker.sock"
-        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        server.bind(str(socket_path))
-        os.chmod(socket_path, 0o600)
-        server.listen(1)
-
-        child = os.fork()
-        if child == 0:
-            client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-            client.connect(str(socket_path))
-            identity = proc_identity(os.getpid())
-            client.sendall((json.dumps(identity, sort_keys=True) + "\n").encode())
-            # Keep /proc/<pid> alive until the server has correlated peercred.
-            if client.recv(2) != b"OK":
-                os._exit(2)
-            client.close()
-            os._exit(0)
-
-        conn, _ = server.accept()
-        raw = conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12)
-        peer_pid = int.from_bytes(raw[0:4], byteorder="little", signed=True)
-        peer_uid = int.from_bytes(raw[4:8], byteorder="little", signed=True)
-        peer_gid = int.from_bytes(raw[8:12], byteorder="little", signed=True)
-        claimed = json.loads(conn.makefile("r", encoding="utf-8").readline())
-        observed = proc_identity(peer_pid)
-        conn.sendall(b"OK")
-        _, status = os.waitpid(child, 0)
-
-        root_mode = stat.S_IMODE(root.stat().st_mode)
-        socket_mode = stat.S_IMODE(socket_path.stat().st_mode)
-        if not (
-            peer_pid == claimed["pid"] == observed["pid"]
-            and peer_uid == claimed["uid"] == observed["uid"]
-            and claimed["starttime_ticks"] == observed["starttime_ticks"]
-            and root_mode == 0o700
-            and socket_mode == 0o600
-            and os.waitstatus_to_exitcode(status) == 0
-        ):
-            raise AssertionError("SO_PEERCRED, /proc identity, or socket-mode correlation failed")
-        print("machine_assertions=PASS")
-        print(f"server_pid={os.getpid()} server_uid={os.getuid()} server_gid={os.getgid()}")
-        print(f"socket_path={socket_path}")
-        print(f"directory_mode={root_mode:04o} socket_mode={socket_mode:04o}")
-        print(f"SO_PEERCRED pid={peer_pid} uid={peer_uid} gid={peer_gid}")
-        print("client_claim=" + json.dumps(claimed, sort_keys=True))
-        print("proc_observed=" + json.dumps(observed, sort_keys=True))
-        print(f"pid_match={peer_pid == claimed['pid'] == observed['pid']}")
-        print(f"uid_match={peer_uid == claimed['uid'] == observed['uid']}")
-        print(
-            "starttime_match="
-            + str(claimed["starttime_ticks"] == observed["starttime_ticks"])
-        )
-        print(f"client_exit_status={os.waitstatus_to_exitcode(status)}")
-        print("same_principal_socket=true")
-        print(
-            "posture=0700 parent + 0600 socket excludes other UIDs, but does not prevent "
-            "the same UID from unlinking/rebinding; distinct-principal system service remains "
-            "required for a claim stronger than T-C against same-UID counterfeit replacement"
-        )
-
-        conn.close()
-        server.close()
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p6_claude_hook.py

@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""Claude SessionStart additionalContext producer for P6 observation."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import sys
-from pathlib import Path
-
-BLOCK = "\n".join(
-    [
-        "GATE0_CLAUDE_ATOMIC_BEGIN",
-        "segment-01=alpha-2d11",
-        "segment-02=middle-8e22",
-        "segment-03=omega-4f33",
-        "GATE0_CLAUDE_ATOMIC_END",
-    ]
-)
-
-
-def starttime(pid: int) -> int:
-    text = Path(f"/proc/{pid}/stat").read_text()
-    return int(text[text.rfind(")") + 2 :].split()[19])
-
-
-def main() -> None:
-    hook_input = json.load(sys.stdin)
-    log = Path(os.environ["GATE0_CLAUDE_HOOK_LOG"])
-    record = {
-        "hook_event_name": hook_input.get("hook_event_name"),
-        "pid": os.getpid(),
-        "ppid": os.getppid(),
-        "starttime_ticks": starttime(os.getpid()),
-        "block_length": len(BLOCK.encode()),
-        "block_sha256": hashlib.sha256(BLOCK.encode()).hexdigest(),
-        "emission": "one hookSpecificOutput.additionalContext string field",
-    }
-    log.write_text(json.dumps(record, sort_keys=True) + "\n")
-    print(
-        json.dumps(
-            {
-                "hookSpecificOutput": {
-                    "hookEventName": "SessionStart",
-                    "additionalContext": BLOCK,
-                }
-            }
-        )
-    )
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p6_claude_run.py

@@ -1,145 +0,0 @@
-#!/usr/bin/env python3
-"""Run real Claude 2.1.x through `mosaic yolo` for P6 observation."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-from typing import Any
-
-HERE = Path(__file__).resolve().parent
-BLOCK = "\n".join(
-    [
-        "GATE0_CLAUDE_ATOMIC_BEGIN",
-        "segment-01=alpha-2d11",
-        "segment-02=middle-8e22",
-        "segment-03=omega-4f33",
-        "GATE0_CLAUDE_ATOMIC_END",
-    ]
-)
-
-
-def strings(value: Any):
-    if isinstance(value, str):
-        yield value
-    elif isinstance(value, list):
-        for item in value:
-            yield from strings(item)
-    elif isinstance(value, dict):
-        for item in value.values():
-            yield from strings(item)
-
-
-def main() -> None:
-    with tempfile.TemporaryDirectory(prefix="gate0-p6-claude-") as temp:
-        root = Path(temp)
-        workspace = root / "workspace"
-        workspace.mkdir()
-        settings = root / "settings.json"
-        hook_log = root / "hook.jsonl"
-        settings.write_text(
-            json.dumps(
-                {
-                    "hooks": {
-                        "SessionStart": [
-                            {
-                                "hooks": [
-                                    {
-                                        "type": "command",
-                                        "command": f'python3 "{HERE / "p6_claude_hook.py"}"',
-                                        "timeout": 20,
-                                    }
-                                ]
-                            }
-                        ]
-                    }
-                }
-            )
-        )
-        env = os.environ.copy()
-        env["GATE0_CLAUDE_HOOK_LOG"] = str(hook_log)
-        command = [
-            "mosaic",
-            "yolo",
-            "claude",
-            "--settings",
-            str(settings),
-            "--model",
-            "haiku",
-            "--print",
-            "--output-format",
-            "stream-json",
-            "--verbose",
-            "--include-hook-events",
-            "--max-budget-usd",
-            "0.10",
-            "Return only the exact full GATE0_CLAUDE_ATOMIC_BEGIN through GATE0_CLAUDE_ATOMIC_END block injected by SessionStart, with no code fence or commentary.",
-        ]
-        result = subprocess.run(
-            command,
-            cwd=workspace,
-            env=env,
-            stdin=subprocess.DEVNULL,
-            text=True,
-            capture_output=True,
-            timeout=150,
-            check=False,
-        )
-        events: list[dict[str, Any]] = []
-        for line in result.stdout.splitlines():
-            try:
-                events.append(json.loads(line))
-            except json.JSONDecodeError:
-                continue
-        hook_events = [
-            event
-            for event in events
-            if event.get("type") == "system"
-            and event.get("subtype") in {"hook_started", "hook_response"}
-        ]
-        full_matches = [text for event in events for text in strings(event) if BLOCK in text]
-        exact_matches = [text for event in events for text in strings(event) if text == BLOCK]
-        assistant_texts: list[str] = []
-        for event in events:
-            if event.get("type") != "assistant":
-                continue
-            for text in strings(event.get("message", {})):
-                if "GATE0_CLAUDE_ATOMIC_BEGIN" in text:
-                    assistant_texts.append(text)
-
-        if result.returncode != 0:
-            raise AssertionError(f"Claude probe exited {result.returncode}")
-        if not any(event.get("subtype") == "hook_response" and event.get("outcome") == "success" for event in hook_events):
-            raise AssertionError("Claude SessionStart hook did not complete successfully")
-        if BLOCK not in exact_matches:
-            raise AssertionError("Claude did not return an exact full-block field")
-
-        print("$ python3 docs/compaction-refresh/probes/p6_claude_run.py")
-        print("machine_assertions=PASS")
-        print("command=mosaic yolo claude --settings <isolated> --model haiku --print --output-format stream-json --verbose --include-hook-events <prompt>")
-        print("claude_version=" + subprocess.check_output(["claude", "--version"], text=True).strip())
-        print("mosaic_version=" + subprocess.check_output(["mosaic", "--version"], text=True).strip())
-        print(f"exit_code={result.returncode}")
-        print("hook_process_log=" + hook_log.read_text().strip())
-        for event in hook_events:
-            print("hook_stream_event=" + json.dumps(event, sort_keys=True))
-        print(f"block_length={len(BLOCK.encode())}")
-        print(f"block_sha256={hashlib.sha256(BLOCK.encode()).hexdigest()}")
-        print(f"stream_fields_containing_full_block={len(full_matches)}")
-        print(f"stream_fields_exactly_equal_block={len(exact_matches)}")
-        for text in assistant_texts:
-            print(f"assistant_copy_length={len(text.encode())}")
-            print(f"assistant_copy_sha256={hashlib.sha256(text.encode()).hexdigest()}")
-            print(f"assistant_copy_exact={text == BLOCK}")
-            print("assistant_copy=" + json.dumps(text))
-        if result.stderr.strip():
-            print("stderr_excerpt=" + json.dumps(result.stderr.splitlines()[:10]))
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/pi_gate0_extension.ts

@@ -1,350 +0,0 @@
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-import { Type } from 'typebox';
-import { createHash, randomUUID } from 'node:crypto';
-import { readFileSync, appendFileSync, statSync } from 'node:fs';
-import net from 'node:net';
-import { fileURLToPath } from 'node:url';
-import { resolve } from 'node:path';
-
-const SELF = resolve(fileURLToPath(import.meta.url).split('?')[0]!);
-const LOG = process.env['GATE0_PI_LOG'];
-const CONTEXT_BLOCK =
-  process.env['GATE0_PI_CONTEXT_BLOCK'] ??
-  [
-    'GATE0_PI_ATOMIC_BEGIN',
-    'segment-01=alpha-7e31',
-    'segment-02=middle-9c42',
-    'segment-03=omega-5b83',
-    'GATE0_PI_ATOMIC_END',
-  ].join('\n');
-
-let sequence = 0;
-
-function sha(value: string | Buffer): string {
-  return createHash('sha256').update(value).digest('hex');
-}
-
-function procStarttime(): number {
-  const text = readFileSync(`/proc/${process.pid}/stat`, 'utf8');
-  const close = text.lastIndexOf(')');
-  const fields = text.slice(close + 2).trim().split(/\s+/);
-  return Number(fields[19]);
-}
-
-function log(event: string, details: Record<string, unknown> = {}): void {
-  if (!LOG) return;
-  sequence += 1;
-  appendFileSync(
-    LOG,
-    `${JSON.stringify({ seq: sequence, event, pid: process.pid, starttime_ticks: procStarttime(), ...details })}\n`,
-  );
-}
-
-function argvExtensions(): string[] {
-  const result: string[] = [];
-  for (let i = 0; i < process.argv.length; i += 1) {
-    if (process.argv[i] === '--extension' || process.argv[i] === '-e') {
-      const candidate = process.argv[i + 1];
-      if (candidate) result.push(resolve(candidate));
-    }
-  }
-  return result;
-}
-
-interface SourceValidation {
-  ok: boolean;
-  reason: string;
-  fragment?: string;
-}
-
-function validateSources(): SourceValidation {
-  const manifestPath = process.env['GATE0_SOURCE_MANIFEST'];
-  if (!manifestPath) return { ok: true, reason: 'no-manifest-probe-disabled' };
-  try {
-    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8')) as {
-      maxBytes: number;
-      fragments: Array<{ path: string; sha256: string }>;
-    };
-    for (const fragment of manifest.fragments) {
-      let fileStat;
-      try {
-        fileStat = statSync(fragment.path);
-      } catch {
-        return { ok: false, reason: 'missing', fragment: fragment.path };
-      }
-      if (!fileStat.isFile()) {
-        return { ok: false, reason: 'not-regular-file', fragment: fragment.path };
-      }
-      if (fileStat.size > manifest.maxBytes) {
-        return { ok: false, reason: 'oversize', fragment: fragment.path };
-      }
-      const bytes = readFileSync(fragment.path);
-      if (sha(bytes) !== fragment.sha256) {
-        return { ok: false, reason: 'hash-mismatch', fragment: fragment.path };
-      }
-    }
-    return { ok: true, reason: 'all-fragments-valid' };
-  } catch (error) {
-    return { ok: false, reason: `manifest-error:${error instanceof Error ? error.name : 'unknown'}` };
-  }
-}
-
-function brokerRequest(payload: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const socketPath = process.env['GATE0_GENERATION_SOCKET'];
-  if (!socketPath) return Promise.resolve({ skipped: true });
-  return new Promise((resolvePromise, reject) => {
-    const socket = net.createConnection(socketPath);
-    let buffer = '';
-    socket.setEncoding('utf8');
-    socket.on('connect', () => socket.write(`${JSON.stringify(payload)}\n`));
-    socket.on('data', (chunk) => {
-      buffer += chunk;
-      const newline = buffer.indexOf('\n');
-      if (newline < 0) return;
-      socket.end();
-      resolvePromise(JSON.parse(buffer.slice(0, newline)) as Record<string, unknown>);
-    });
-    socket.on('error', reject);
-  });
-}
-
-function markerPaths(value: unknown, path = '$'): string[] {
-  const matches: string[] = [];
-  if (typeof value === 'string') {
-    if (value.includes(CONTEXT_BLOCK)) matches.push(path);
-    return matches;
-  }
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => matches.push(...markerPaths(item, `${path}[${index}]`)));
-    return matches;
-  }
-  if (value && typeof value === 'object') {
-    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
-      matches.push(...markerPaths(item, `${path}.${key}`));
-    }
-  }
-  return matches;
-}
-
-function assistantToolIds(message: unknown): string[] {
-  if (!message || typeof message !== 'object') return [];
-  const candidate = message as { role?: string; content?: unknown };
-  if (candidate.role !== 'assistant' || !Array.isArray(candidate.content)) return [];
-  return candidate.content
-    .filter(
-      (block): block is { type: 'toolCall'; id: string } =>
-        Boolean(
-          block &&
-            typeof block === 'object' &&
-            (block as { type?: string }).type === 'toolCall' &&
-            typeof (block as { id?: unknown }).id === 'string',
-        ),
-    )
-    .map((block) => block.id);
-}
-
-function assistantText(message: unknown): string {
-  if (!message || typeof message !== 'object') return '';
-  const candidate = message as { role?: string; content?: unknown };
-  if (candidate.role !== 'assistant' || !Array.isArray(candidate.content)) return '';
-  return candidate.content
-    .filter(
-      (block): block is { type: 'text'; text: string } =>
-        Boolean(
-          block &&
-            typeof block === 'object' &&
-            (block as { type?: string }).type === 'text' &&
-            typeof (block as { text?: unknown }).text === 'string',
-        ),
-    )
-    .map((block) => block.text)
-    .join('');
-}
-
-export default function register(pi: ExtensionAPI) {
-  const localProviderUrl = process.env['GATE0_LOCAL_PROVIDER_URL'];
-  if (localProviderUrl) {
-    pi.registerProvider('gate0-local', {
-      baseUrl: localProviderUrl,
-      apiKey: 'gate0-probe-not-a-secret',
-      api: 'openai-completions',
-      models: [
-        {
-          id: 'gate0-model',
-          name: 'Gate0 deterministic local model',
-          reasoning: false,
-          input: ['text'],
-          cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-          contextWindow: 32_000,
-          maxTokens: 1_024,
-        },
-      ],
-    });
-  }
-
-  const extensions = argvExtensions();
-  const lastPosition = extensions.length > 0 && extensions.at(-1) === SELF;
-  interface RequestCycle {
-    nonce: string;
-    verified: boolean;
-    sourceReason: string;
-  }
-  let buildingCycle: RequestCycle | undefined;
-  const inFlightCycles: RequestCycle[] = [];
-  const toolNonce = new Map<string, { nonce: string; verified: boolean; sourceReason: string }>();
-
-  pi.on('session_start', async (event) => {
-    const broker = await brokerRequest({ action: 'lifecycle', phase: 'start', reason: event.reason });
-    log('session_start', {
-      reason: event.reason,
-      extensions,
-      self: SELF,
-      lastPosition,
-      gateState: lastPosition ? 'UNVERIFIED_READY' : 'CLOSED_NOT_LAST',
-      broker,
-    });
-  });
-
-  pi.on('session_shutdown', async (event) => {
-    const broker = await brokerRequest({ action: 'lifecycle', phase: 'shutdown', reason: event.reason });
-    log('session_shutdown', { reason: event.reason, broker });
-  });
-
-  pi.on('context', async (event) => {
-    const validation = validateSources();
-    buildingCycle = {
-      nonce: randomUUID(),
-      sourceReason: validation.reason,
-      verified: lastPosition && validation.ok,
-    };
-    const inputJson = JSON.stringify(event.messages);
-    const injected = {
-      role: 'custom' as const,
-      customType: 'gate0-context',
-      content: CONTEXT_BLOCK,
-      display: false,
-      timestamp: Date.now(),
-    };
-    const outputMessages = buildingCycle.verified
-      ? [...event.messages, injected]
-      : [...event.messages];
-    const outputPrefix = outputMessages.slice(0, event.messages.length);
-    const sourceBroker = validation.ok
-      ? { action: 'none', reason: 'source-valid' }
-      : await brokerRequest({ action: 'source-invalid', reason: validation.reason });
-    log('context_return', {
-      requestNonce: buildingCycle.nonce,
-      sourceValidation: validation,
-      sourceBroker,
-      lastPosition,
-      promotion: false,
-      injectionDecision: buildingCycle.verified ? 'ONE_ATOMIC_AGENT_MESSAGE' : 'REFUSED',
-      inputCount: event.messages.length,
-      outputCount: outputMessages.length,
-      prefixHashBefore: sha(inputJson),
-      prefixHashAfter: sha(JSON.stringify(outputPrefix)),
-      prefixPreservedByReturn: sha(inputJson) === sha(JSON.stringify(outputPrefix)),
-      blockLength: CONTEXT_BLOCK.length,
-      blockSha256: sha(CONTEXT_BLOCK),
-    });
-    return { messages: outputMessages };
-  });
-
-  pi.on('before_provider_request', async (event) => {
-    const paths = markerPaths(event.payload);
-    const cycle = buildingCycle;
-    buildingCycle = undefined;
-    if (cycle) inFlightCycles.push(cycle);
-    log('before_provider_request', {
-      requestNonce: cycle?.nonce,
-      inFlightDepth: inFlightCycles.length,
-      markerOccurrences: paths.length,
-      markerPaths: paths,
-      finalPayloadValid: Boolean(cycle?.verified && paths.length === 1),
-    });
-  });
-
-  pi.on('after_provider_response', async (event) => {
-    const cycle = inFlightCycles[0];
-    log('after_provider_response', {
-      requestNonce: cycle?.nonce,
-      status: event.status,
-      assistantContentAvailableAtThisHook: false,
-      timing: 'headers/status before stream consumption',
-    });
-  });
-
-  pi.on('message_end', async (event) => {
-    const role = (event.message as { role?: string }).role;
-    const ids = assistantToolIds(event.message);
-    const text = assistantText(event.message);
-    const cycle = role === 'assistant' ? inFlightCycles.shift() : undefined;
-    if (ids.length > 0 && cycle) {
-      for (const id of ids) {
-        toolNonce.set(id, {
-          nonce: cycle.nonce,
-          verified: cycle.verified,
-          sourceReason: cycle.sourceReason,
-        });
-      }
-    }
-    log('message_end', {
-      role,
-      assistantContentObserved: role === 'assistant',
-      requestNonce: cycle?.nonce,
-      inFlightDepthAfter: inFlightCycles.length,
-      toolCallIds: ids,
-      nonceMappings: ids.map((id) => ({ toolCallId: id, requestNonce: cycle?.nonce })),
-      exactContextBlockCopied: text.includes(CONTEXT_BLOCK),
-      assistantTextSha256: text ? sha(text) : null,
-    });
-  });
-
-  pi.on('tool_call', async (event) => {
-    const mapping = toolNonce.get(event.toolCallId);
-    const allowed = Boolean(lastPosition && mapping?.verified);
-    log('tool_call', {
-      toolCallId: event.toolCallId,
-      toolName: event.toolName,
-      mapping: mapping ?? null,
-      allowed,
-      reason: !lastPosition
-        ? 'closed-not-last'
-        : !mapping
-          ? 'unknown-tool-call-id'
-          : !mapping.verified
-            ? `unverified-source:${mapping.sourceReason}`
-            : 'exact-tool-call-id-mapped-to-verified-request-nonce',
-    });
-    if (!allowed) return { block: true, reason: 'Gate0 probe refused unverified tool batch' };
-  });
-
-  pi.on('agent_settled', async () => {
-    log('agent_settled', { retainedNonceMappingsBeforeClear: toolNonce.size });
-    toolNonce.clear();
-  });
-
-  pi.registerTool({
-    name: 'gate0_nonce_probe',
-    label: 'Gate0 Nonce Probe',
-    description: 'Gate0-only harmless tool used to prove toolCallId to request-nonce correlation.',
-    parameters: Type.Object({ label: Type.String() }),
-    async execute(toolCallId, params) {
-      const broker = await brokerRequest({ action: 'promote-probe' });
-      log('tool_execute', { toolCallId, label: params.label, broker });
-      return {
-        content: [{ type: 'text', text: `gate0_nonce_probe executed for ${params.label}` }],
-        details: { harmless: true },
-      };
-    },
-  });
-
-  pi.registerCommand('gate0-reload', {
-    description: 'Trigger a real same-PID Pi extension/runtime reload.',
-    handler: async (_args, ctx) => {
-      log('reload_command_before');
-      await ctx.reload();
-      return;
-    },
-  });
-}

docs/compaction-refresh/probes/pi_gate0_run.py

@@ -1,450 +0,0 @@
-#!/usr/bin/env python3
-"""Drive real Pi 0.80.x RPC for P2/P3/P5/P6 runtime evidence."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import queue
-import shutil
-import signal
-import socket
-import subprocess
-import sys
-import tempfile
-import threading
-import time
-from pathlib import Path
-from typing import Any, Callable
-
-HERE = Path(__file__).resolve().parent
-BLOCK = "\n".join(
-    [
-        "GATE0_PI_ATOMIC_BEGIN",
-        "segment-01=alpha-7e31",
-        "segment-02=middle-9c42",
-        "segment-03=omega-5b83",
-        "GATE0_PI_ATOMIC_END",
-    ]
-)
-
-
-def wait_path(path: Path, timeout: float = 20) -> None:
-    deadline = time.monotonic() + timeout
-    while time.monotonic() < deadline:
-        if path.exists():
-            return
-        time.sleep(0.05)
-    raise TimeoutError(f"timed out waiting for {path}")
-
-
-def socket_request(path: Path, payload: dict[str, object]) -> None:
-    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    conn.connect(str(path))
-    conn.sendall((json.dumps(payload) + "\n").encode())
-    conn.makefile("r", encoding="utf-8").readline()
-    conn.close()
-
-
-def jsonl(path: Path) -> list[dict[str, Any]]:
-    if not path.exists():
-        return []
-    return [json.loads(line) for line in path.read_text().splitlines() if line]
-
-
-class PiRpc:
-    def __init__(self, command: list[str], cwd: Path, env: dict[str, str]):
-        self.process = subprocess.Popen(
-            command,
-            cwd=cwd,
-            env=env,
-            stdin=subprocess.PIPE,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            text=True,
-            bufsize=1,
-            start_new_session=True,
-        )
-        self.events: queue.Queue[dict[str, Any]] = queue.Queue()
-        self.raw_lines: list[str] = []
-        self.stderr_lines: list[str] = []
-        threading.Thread(target=self._read_stdout, daemon=True).start()
-        threading.Thread(target=self._read_stderr, daemon=True).start()
-
-    def _read_stdout(self) -> None:
-        assert self.process.stdout is not None
-        for line in self.process.stdout:
-            stripped = line.rstrip("\n")
-            self.raw_lines.append(stripped)
-            try:
-                event = json.loads(stripped)
-            except json.JSONDecodeError:
-                continue
-            self.events.put(event)
-
-    def _read_stderr(self) -> None:
-        assert self.process.stderr is not None
-        for line in self.process.stderr:
-            self.stderr_lines.append(line.rstrip("\n"))
-
-    def send(self, payload: dict[str, object]) -> None:
-        assert self.process.stdin is not None
-        self.process.stdin.write(json.dumps(payload) + "\n")
-        self.process.stdin.flush()
-
-    def wait(self, predicate: Callable[[dict[str, Any]], bool], description: str, timeout: float = 180) -> dict[str, Any]:
-        deadline = time.monotonic() + timeout
-        while time.monotonic() < deadline:
-            if self.process.poll() is not None and self.events.empty():
-                raise RuntimeError(
-                    f"Pi exited {self.process.returncode} while waiting for {description}: "
-                    + " | ".join(self.stderr_lines[-5:])
-                )
-            try:
-                event = self.events.get(timeout=0.2)
-            except queue.Empty:
-                continue
-            if predicate(event):
-                return event
-        raise TimeoutError(f"timed out waiting for {description}")
-
-    def response(self, request_id: str, timeout: float = 180) -> dict[str, Any]:
-        return self.wait(
-            lambda event: event.get("type") == "response" and event.get("id") == request_id,
-            f"response {request_id}",
-            timeout,
-        )
-
-    def prompt_and_settle(self, request_id: str, message: str) -> None:
-        self.send({"id": request_id, "type": "prompt", "message": message})
-        response = self.response(request_id)
-        if not response.get("success"):
-            raise RuntimeError(f"prompt rejected: {response}")
-        self.wait(lambda event: event.get("type") == "agent_settled", f"agent_settled {request_id}")
-
-    def close(self) -> None:
-        if self.process.poll() is None:
-            try:
-                os.killpg(self.process.pid, signal.SIGTERM)
-            except ProcessLookupError:
-                pass
-            try:
-                self.process.wait(timeout=8)
-            except subprocess.TimeoutExpired:
-                os.killpg(self.process.pid, signal.SIGKILL)
-                self.process.wait(timeout=5)
-
-
-def manifest(path: Path, fragment: Path, expected_hash: str, max_bytes: int = 64) -> None:
-    path.write_text(
-        json.dumps(
-            {
-                "maxBytes": max_bytes,
-                "fragments": [{"path": str(fragment), "sha256": expected_hash}],
-            },
-            sort_keys=True,
-        )
-    )
-
-
-def run_open(root: Path) -> tuple[list[dict[str, Any]], list[dict[str, Any]], list[str], list[str]]:
-    workspace = root / "workspace"
-    workspace.mkdir()
-    session_dir = root / "sessions"
-    session_dir.mkdir()
-    pi_log = root / "pi-hooks.jsonl"
-    generation_log = root / "generation.jsonl"
-    generation_socket = root / "generation.sock"
-    source_manifest = root / "manifest.json"
-    valid_fragment = root / "fragment.md"
-    valid_fragment.write_text("NORMATIVE-FRAGMENT-v1\n")
-    expected = hashlib.sha256(valid_fragment.read_bytes()).hexdigest()
-    manifest(source_manifest, valid_fragment, expected)
-
-    broker = subprocess.Popen(
-        [
-            sys.executable,
-            str(HERE / "p3_generation_broker.py"),
-            "--socket",
-            str(generation_socket),
-            "--log",
-            str(generation_log),
-        ],
-        text=True,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-    )
-    wait_path(generation_socket)
-    env = os.environ.copy()
-    env.update(
-        {
-            "GATE0_PI_LOG": str(pi_log),
-            "GATE0_GENERATION_SOCKET": str(generation_socket),
-            "GATE0_SOURCE_MANIFEST": str(source_manifest),
-            "GATE0_PI_CONTEXT_BLOCK": BLOCK,
-            "MOSAIC_PI_FORCE_SKILLS": "",
-            "PI_SKIP_VERSION_CHECK": "1",
-        }
-    )
-    command = [
-        "mosaic",
-        "yolo",
-        "pi",
-        "--mode",
-        "rpc",
-        "--session-dir",
-        str(session_dir),
-        "--no-extensions",
-        "--no-context-files",
-        "--no-prompt-templates",
-        "--model",
-        "openai-codex/gpt-5.6-sol",
-        "--thinking",
-        "medium",
-        "--extension",
-        str(HERE / "pi_gate0_extension.ts"),
-    ]
-    pi = PiRpc(command, workspace, env)
-    try:
-        pi.send({"id": "state-0", "type": "get_state"})
-        state0 = pi.response("state-0")
-        original_session = state0["data"]["sessionFile"]
-
-        pi.prompt_and_settle(
-            "p2",
-            "Call gate0_nonce_probe exactly once with label p2. After the tool finishes, copy the exact full GATE0_PI_ATOMIC_BEGIN through GATE0_PI_ATOMIC_END block from context, with no commentary.",
-        )
-
-        # P3 immediately follows the valid P2 promotion so reload must revoke a
-        # genuinely VERIFIED prior generation, not an already-invalid source run.
-        pi.send({"id": "reload", "type": "prompt", "message": "/gate0-reload"})
-        reload_response = pi.response("reload")
-        if not reload_response.get("success"):
-            raise RuntimeError(f"reload command failed: {reload_response}")
-
-        pi.send({"id": "clone", "type": "clone"})
-        clone_response = pi.response("clone")
-        if not clone_response.get("success") or clone_response.get("data", {}).get("cancelled"):
-            raise RuntimeError(f"clone failed: {clone_response}")
-
-        pi.send({"id": "new", "type": "new_session"})
-        new_response = pi.response("new")
-        if not new_response.get("success") or new_response.get("data", {}).get("cancelled"):
-            raise RuntimeError(f"new session failed: {new_response}")
-
-        pi.send(
-            {
-                "id": "resume",
-                "type": "switch_session",
-                "sessionPath": original_session,
-            }
-        )
-        resume_response = pi.response("resume")
-        if not resume_response.get("success") or resume_response.get("data", {}).get("cancelled"):
-            raise RuntimeError(f"resume failed: {resume_response}")
-
-        # P5 missing fragment: action-time source validation must revoke/refuse.
-        manifest(source_manifest, root / "absent-fragment.md", expected)
-        pi.prompt_and_settle(
-            "p5-missing",
-            "Call gate0_nonce_probe exactly once with label p5-missing, then stop.",
-        )
-
-        # P5 oversize fragment: expected hash is correct, size limit is not.
-        oversize = root / "oversize.md"
-        oversize.write_text("X" * 65)
-        manifest(source_manifest, oversize, hashlib.sha256(oversize.read_bytes()).hexdigest(), 64)
-        pi.prompt_and_settle(
-            "p5-oversize",
-            "Call gate0_nonce_probe exactly once with label p5-oversize, then stop.",
-        )
-
-        # P5 hash mismatch: size is valid but bytes differ from expected.
-        mismatch = root / "mismatch.md"
-        mismatch.write_text("tampered\n")
-        manifest(source_manifest, mismatch, expected, 64)
-        pi.prompt_and_settle(
-            "p5-hash",
-            "Call gate0_nonce_probe exactly once with label p5-hash-mismatch, then stop.",
-        )
-
-        time.sleep(1)
-        return jsonl(pi_log), jsonl(generation_log), list(pi.raw_lines), list(pi.stderr_lines)
-    finally:
-        pi.close()
-        try:
-            socket_request(generation_socket, {"action": "shutdown-broker"})
-        except OSError:
-            pass
-        try:
-            broker.wait(timeout=5)
-        except subprocess.TimeoutExpired:
-            broker.kill()
-            broker.wait()
-
-
-def run_closed(root: Path) -> list[dict[str, Any]]:
-    workspace = root / "closed-workspace"
-    workspace.mkdir()
-    pi_log = root / "closed-hooks.jsonl"
-    env = os.environ.copy()
-    env.update(
-        {
-            "GATE0_PI_LOG": str(pi_log),
-            "MOSAIC_PI_FORCE_SKILLS": "",
-            "PI_SKIP_VERSION_CHECK": "1",
-        }
-    )
-    command = [
-        "mosaic",
-        "yolo",
-        "pi",
-        "--mode",
-        "rpc",
-        "--no-session",
-        "--no-extensions",
-        "--no-context-files",
-        "--no-prompt-templates",
-        "--extension",
-        str(HERE / "pi_gate0_extension.ts"),
-        "--extension",
-        str(HERE / "pi_later_extension.ts"),
-    ]
-    pi = PiRpc(command, workspace, env)
-    try:
-        pi.send({"id": "closed-state", "type": "get_state"})
-        pi.response("closed-state")
-        time.sleep(0.5)
-        return jsonl(pi_log)
-    finally:
-        pi.close()
-
-
-def main() -> None:
-    with tempfile.TemporaryDirectory(prefix="gate0-pi-") as temp:
-        root = Path(temp)
-        records, generations, rpc_lines, stderr_lines = run_open(root)
-        closed = run_closed(root)
-
-        p2_message = next(
-            r for r in records if r["event"] == "message_end" and r.get("nonceMappings")
-        )
-        p2_tool = next(r for r in records if r["event"] == "tool_call" and r.get("allowed"))
-        mapped = p2_message["nonceMappings"][0]
-        assert mapped["toolCallId"] == p2_tool["toolCallId"]
-        assert mapped["requestNonce"] == p2_tool["mapping"]["nonce"]
-        assert next(r for r in records if r["event"] == "session_start")["lastPosition"] is True
-        assert next(r for r in closed if r["event"] == "session_start")["gateState"] == "CLOSED_NOT_LAST"
-        reload_revoke = next(
-            r
-            for r in generations
-            if r["event"] == "runtime_generation_bump"
-            and r.get("reason") == "reload"
-            and r.get("phase") == "shutdown"
-        )
-        assert reload_revoke["prior_lease"] == "VERIFIED"
-        assert reload_revoke["prior_lease_revoked"] is True
-        for reason in {"missing", "oversize", "hash-mismatch"}:
-            assert any(
-                r["event"] == "context_return"
-                and r.get("sourceValidation", {}).get("reason") == reason
-                and r.get("injectionDecision") == "REFUSED"
-                and r.get("promotion") is False
-                for r in records
-            )
-            assert any(
-                r["event"] == "tool_call"
-                and r.get("mapping", {}).get("sourceReason") == reason
-                and r.get("allowed") is False
-                for r in records
-            )
-        assert any(
-            r["event"] == "message_end" and r.get("exactContextBlockCopied") is True
-            for r in records
-        )
-
-        print("$ python3 docs/compaction-refresh/probes/pi_gate0_run.py")
-        print("machine_assertions=PASS")
-        print("runtime_versions:")
-        print("  " + subprocess.check_output(["pi", "--version"], text=True).strip())
-        print("  " + subprocess.check_output(["mosaic", "--version"], text=True).strip())
-
-        print("\nP2_EVENT_ORDER_AND_NONCE_MAP:")
-        for record in records:
-            if record["seq"] <= 12 and record["event"] in {
-                "after_provider_response",
-                "message_end",
-                "tool_call",
-                "tool_execute",
-            } and (
-                record["event"] != "message_end"
-                or record.get("role") == "assistant"
-            ):
-                print(json.dumps(record, sort_keys=True))
-
-        print("\nP2_LAST_OR_CLOSED:")
-        print(json.dumps(next(r for r in records if r["event"] == "session_start"), sort_keys=True))
-        print(json.dumps(next(r for r in closed if r["event"] == "session_start"), sort_keys=True))
-
-        print("\nP3_GENERATION_BROKER:")
-        for record in generations:
-            if record["event"] in {"probe_lease_promoted", "runtime_generation_bump"}:
-                print(json.dumps(record, sort_keys=True))
-
-        print("\nP5_SOURCE_INVALIDATION:")
-        fault_reasons = {"missing", "oversize", "hash-mismatch"}
-        emitted_context: set[str] = set()
-        emitted_tool: set[str] = set()
-        for record in records:
-            source_reason = record.get("sourceValidation", {}).get("reason")
-            if (
-                record["event"] == "context_return"
-                and source_reason in fault_reasons
-                and source_reason not in emitted_context
-            ):
-                print(json.dumps(record, sort_keys=True))
-                emitted_context.add(source_reason)
-            mapping_reason = record.get("mapping", {}).get("sourceReason")
-            if (
-                record["event"] == "tool_call"
-                and not record.get("allowed")
-                and mapping_reason in fault_reasons
-                and mapping_reason not in emitted_tool
-            ):
-                print(json.dumps(record, sort_keys=True))
-                emitted_tool.add(mapping_reason)
-        emitted_broker: set[str] = set()
-        for record in generations:
-            reason = record.get("source_reason")
-            if record["event"] == "source_invalidation_revoke" and reason not in emitted_broker:
-                print(json.dumps(record, sort_keys=True))
-                emitted_broker.add(str(reason))
-
-        print("\nP6_PI_CONTEXT_ATOMIC_OBSERVATION:")
-        for record in records:
-            include = (
-                (record["event"] == "context_return" and record.get("injectionDecision") == "ONE_ATOMIC_AGENT_MESSAGE")
-                or (record["event"] == "before_provider_request" and record.get("finalPayloadValid"))
-                or (record["event"] == "message_end" and record.get("exactContextBlockCopied"))
-            )
-            if include and record["seq"] <= 12:
-                print(json.dumps(record, sort_keys=True))
-
-        print("\nRPC_EVENT_COUNTS:")
-        counts: dict[str, int] = {}
-        for line in rpc_lines:
-            try:
-                event = json.loads(line)
-            except json.JSONDecodeError:
-                continue
-            key = str(event.get("type"))
-            counts[key] = counts.get(key, 0) + 1
-        print(json.dumps(counts, sort_keys=True))
-        print("stderr_nonempty=" + str(bool(stderr_lines)))
-        for line in stderr_lines[:10]:
-            print("stderr: " + line[:500])
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/pi_later_extension.ts

@@ -1,8 +0,0 @@
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
-
-// Deliberately loaded after pi_gate0_extension.ts. The Gate0 extension must
-// observe its argv position and remain CLOSED rather than claiming finality.
-export default function register(pi: ExtensionAPI) {
-  pi.on('context', async (event) => ({ messages: [...event.messages] }));
-  pi.on('before_provider_request', async () => undefined);
-}

docs/compaction-refresh/reviews/GATE0-PROBE3-CLASSB-S3-REVIEW-v3.md

@@ -1,65 +0,0 @@
-# Gate0 Probe-3 (D4) Class-B — §3-Conformance Review v3
-
-**Verdict: ✅ PASS**
-
-## Pin (G1 — reviewed object, mandatory)
-
-- **Reviewed object = `ace6066762c088f4b9729860da71b4c84451a7c3`** (harness commit, branch `feat/827-gate0-probe`, `mosaicstack/stack` @ git.mosaicstack.dev).
-- **Reviewed file:** `docs/compaction-refresh/probes/p3_d4_focused_run.py`
-- **Harness sha256 (pushed provider bytes, fetched `-o FILE`, FULL-40 ref, verified before trust):**
-  `2f11c9391c0eef203f26b1206bee8bc4cd106e8c1192399c5e7b71f41a3f6b75` (17162 bytes; no not-found sentinel).
-- **§3 amendment authority read at pin:** `GATE0-PROBE3-EXEC-AMENDMENT.md` @ ref `571f239154c6793fb1a5eac0d1cd4182f286a3ac`,
-  sha256 `9ac9ff873fad41a6e15763cc89cb94d0bc4a6b0cf9b6770561d1781b03f63276` (7699 bytes). MUST-HAVE/MUST-BE-ABSENT
-  confirmed against the actual fetched §3 text, not a paraphrase.
-
-## Independence (G2)
-
-Distinct Opus §3-conformance reviewer (Gate-16 author≠reviewer). I did **not** build this harness (author =
-ms-rev-826); I am not Mos. This verdict is my own; the author did not author or edit it. Byte review only — **ran
-nothing** (no harness, no broker, no sockets/state). Reviewed across v1 (FAIL, live-broker launch path) → v2 (PASS,
-later found runtime-dead producer) → this v3 (closes the live-path review-gap).
-
-## Why v3 (the review-gap closed)
-
-v2 PASS @`839d156f` credited the static presence of `lease_anchor_registered` as isolation proof. At FIRE the
-producing path was **dead**: the harness drove the *released* `mosaic` binary, which launched Pi **ungated**, so
-`register_anchor` never ran. Static presence of an assertion ≠ its producing path executing. v3 requires the
-producing path to be **live at runtime**.
-
-## Surface-by-surface
-
-| Surface | Result | Evidence (file:line) |
-|---|---|---|
-| Pushed bytes fetched + sha-verified | ✅ | sha256==`2f11c939…`, 17162B, no sentinel |
-| (a) LIVE-PATH — drives the **gated** launcher, producer in the exec chain, NOT released `mosaic`/plain `execRuntime` | ✅ | launch = `python3 <GATED_LAUNCHER> --runtime pi -- pi …` :357-364; `GATED_LAUNCHER=…/launch-runtime.py` :32, pinned `GATED_WI_HEAD=abd2791f…` :31; `mosaic yolo`/`execRuntime` = 0 hits. `launch-runtime.py` unconditionally `register_anchor`s before `execvpe`, so the producer is in the invoked chain |
-| (b) Fail-closed precondition present + correct (gated + fixture-socket, refuses otherwise), invoked before all launches | ✅ | `gated_launcher_precondition` :229-251, called :342 **before** broker Popen :343 and Pi launch :357. Verifies (ii) `MOSAIC_LEASE_BROKER_SOCKET==fixture` :232 + fixture in tempdir :234; (i) launcher HEAD==`abd2791f` :243 + source has `register_anchor` **before** `execute(command[0]…)` and reads `MOSAIC_LEASE_BROKER_SOCKET` :246-250. Raises `RuntimeError` (no run) on any miss :233/:235/:242/:244/:250 |
-| (c) Fixture-socket isolation (no live/default broker reachable, single p3 fixture, non-destructive) | ✅ | `pop("MOSAIC_LEASE_BROKER_SOCKET")` :330 + set to fixture socket :334; harness invokes `launch-runtime.py` directly so it reads `MOSAIC_LEASE_BROKER_SOCKET`=fixture with **no** `defaultLeaseBrokerSocket`/XDG/`/run/user` fallback in the path; `register_anchor` served by the single p3 fixture; `p3_generation_broker.py` **zero diff** vs `839d156f` (in-memory volatile hex-256 session `secrets.token_hex(32)`, nothing durable outside tempdir) |
-| (d) Assertion INTACT (`lease_anchor_registered` + `session_id_shape=="hex-256"`, not softened/optional/repointed) | ✅ | :256-258 (event), :298 (`hex-256`), folded into single-PID/starttime identity set :286. Not Case C |
-| spawns ONLY p3_generation_broker.py | ✅ | broker Popen = `HERE/p3_generation_broker.py` :343-346; the pinned launcher is a register-before-exec launch wrapper, not a 2nd broker |
-| promotion = fixture-only (not P2-banked) | ✅ | `d4_fixture_promote` "not a P2 evidence-gathering authorization"; `promote-probe` in-memory; precondition target only; no P2 import |
-| D4 assertions complete | ✅ | same-PID+starttime persist (incl. launcher registration) :284-288; gen strictly increases :290-293; reload revokes genuinely-VERIFIED prior :299-300; new→`MUTATOR_UNVERIFIED` :301; prior→`STALE_GENERATION` :302; lifecycle boundaries :294-297 |
-| P5 / P6 / P2-bank / retry-launder / live-effect / mechanism-change / scope-widen ABSENT | ✅ | 0 hits: `source-invalid`/`run_open`/`atomic`/`p2_provider`/`p5`/`p6`/`pi_gate0_run`/`retry`; no real-broker path; the only mechanism change is the required launch-routing fix (release→pinned gated launcher), which narrows scope, not widens |
-| non-destructive | ✅ | per-run `tempfile.mkdtemp` fixtures; p3 in-memory + tempdir socket/log only; reads `/proc/<pid>/stat` (read-only) |
-| deterministic | ✅ | isolated tempdir per run; deterministic assertions; session-id randomness is **shape**-asserted only (`hex-256`), `setdefault` idempotent |
-| hidden exec-at-import | ✅ absent | only `if __name__ == "__main__": main()`; docstring: not executed until FIRE |
-
-## Verdict
-
-**PASS @ `ace60667`** — (a) LIVE-PATH, (b) fail-closed precondition, (c) fixture-socket isolation, and
-(d) intact assertion all hold, with zero out-of-scope surface. The v2 review-gap (runtime-dead producer via the
-released ungated `mosaic`) is structurally closed: the harness no longer invokes `mosaic` at all — it invokes the
-pinned `abd2791f` `launch-runtime.py` directly (register-before-exec), and refuses to launch unless the launcher is
-that pinned gated register-before-exec binary bound to this run's fixture socket.
-
-**Findings: none.**
-
-## Scope reminder (not a finding)
-
-Per §3/§5 of the amendment, producing this evidence **executes** the Gate0 mechanism (launches processes, creates
-socket/state artifacts, exercises revocation). This review clears the **bytes**; **FIRE remains separately gated on
-Mos's explicit post-clear GO** and is not authorized by this review.
-
----
-
-**Reviewer:** independent Opus §3-conformance reviewer (Gate-16 author≠reviewer). Byte review only; ran nothing.
-**Reviewed object (pin):** `ace6066762c088f4b9729860da71b4c84451a7c3` · harness sha256 `2f11c9391c0eef203f26b1206bee8bc4cd106e8c1192399c5e7b71f41a3f6b75`.

docs/compaction-refresh/reviews/GATE0-PROBE3-FIDELITY-S3-REVIEW-v4.md

@@ -1,95 +0,0 @@
-# Gate0 Probe-3 (D4) Observation-Fidelity — §3-Conformance Review v4
-
-**Verdict: ✅ PASS**
-
-## Pin (G1 — reviewed object, mandatory)
-
-- **Reviewed object = `484849387006ab5561798506fd6042ddbd5617de`** (harness commit, branch `feat/827-gate0-probe`, `mosaicstack/stack` @ git.mosaicstack.dev).
-- **Reviewed file:** `docs/compaction-refresh/probes/p3_d4_focused_run.py` — sha256 (pushed provider bytes, `-o FILE`, FULL-40 ref, verified before trust): `9095eab7a4ddf11bb92bb5971d49e1facad12f4692ce2081665b0af47cbe5098` (23698 bytes, no not-found sentinel). Worktree bytes at `48484938` re-hashed identical.
-- **Co-reviewed fixture broker:** `docs/compaction-refresh/probes/p3_generation_broker.py` (sha256 `fd5327d2e9a2808282cbc9c4a4ccef42d2a806482b27cc48035191b9b11607c8`).
-- **Traceability anchor (independently recomputed):** `GATED_LAUNCHER_SHA256 = e950e4224e280f16979d90cabb89aa1896c5ee28bed2df957e14d018d43cda82` equals the sha256 of `packages/mosaic/framework/tools/lease-broker/launch-runtime.py` at WI-3 #830 reviewed head `f400830738998db105107a2a4c69c7f2a2a6fd5d` (computed from two independent worktrees).
-
-## Independence (G2)
-
-Distinct Opus §3-conformance reviewer (Gate-16 author≠reviewer). I did not build this harness (author = ms-rev-826);
-I am not Mos. This verdict is my own; the author did not author or edit it. Byte review only — **ran nothing** (no
-harness, no broker, no sockets/state). Prior v3 PASS (`ace60667`, pinned `abd2791f`) is correctly **superseded**:
-pinning a pre-`66b1e0a0` ancestor made D4 an in-memory socket simulation (hollow gate). v4 requires
-mechanism-fidelity within isolation (Jason R1).
-
-## BAR1 — Traceability (evidence attests the SHIPPED WI-3 D4 mechanism)
-
-| Check | Result | Evidence |
-|---|---|---|
-| `GATED_WI_HEAD == f4008307` (not `abd2791f`) | ✅ | :33 |
-| Launcher pinned by git-HEAD **and** sha256 | ✅ | precondition :285-288 (`head != GATED_WI_HEAD` raise; `sha256(launcher) != GATED_LAUNCHER_SHA256` raise); sha256 independently == f4008307's `launch-runtime.py` |
-| Launcher bytes contain the file-backed mechanism | ✅ | precondition requires `register_anchor` :290, `initialize_runtime_generation(generation_file, generation)` :291, `generation-{session_id}.state` :294, `MOSAIC_LEASE_GENERATION_FILE` :295, `read_runtime_generation`+`bump_runtime_generation` in `lease_generation.py` :296-299; order `register < initialize < execute` :302-303 |
-
-## BAR2 — Fidelity (file-backed generation, not in-memory simulation)
-
-| # | Requirement | Result | Evidence |
-|---|---|---|---|
-| i | Extension bumps `generation-{sid}.state` via the real helper, not in-mem | ✅ | ext `lifecycle()` calls `broker({action:'bump-generation'})` at every post-start boundary (harness :200-205); broker `bump-generation` → `bump_runtime_generation(generation_environment(identity))` (broker :119-120) |
-| ii | Broker reads generation via `read_runtime_generation`, not an in-mem counter | ✅ | broker loads the pinned module (`--generation-module`, :52-54); `file_generation()` = `read_runtime_generation(...)` (:77-78); authorize-probe reads `current_generation = file_generation(identity)` (:154); lifecycle `new_generation = file_generation(identity)` (:201). The in-mem `generations` dict is only an old-value cache for the monotonic guard (:199-204), never the authorization authority |
-| iii | `assert_d4` observes the FILE-BACKED transition | ✅ | `state_file_source` = all records `generation_source=="state-file"` (harness :370-372); `state_file_drives_lifecycle` = state-bumps == lifecycle generations[1:] (:368-369); `new_generation_unverified→MUTATOR_UNVERIFIED` :382; `prior_generation_stale→STALE_GENERATION` :383; `verified_revoked_on_reload` :380-381 — not a socket-only bump |
-| iv | `.state` bound to per-run fixture temp root | ✅ | broker `generation_environment` **raises if `state_path.parent != socket_path.parent`** (:73-74); `state_file_in_fixture_root` (:373-376); precondition forbids inherited `MOSAIC_LEASE_GENERATION_FILE` (:255-256) and requires socket in `gettempdir()` (:274-275); launcher/broker agree on `socket_path.parent / generation-{sid}.state` |
-
-## BAR3 — Carry-over
-
-| # | Result | Evidence |
-|---|---|---|
-| a LIVE-PATH (gated launcher @f4008307 at runtime, not released/plain execRuntime) | ✅ | Pi launched via `python3 <GATED_LAUNCHER> --runtime pi -- pi …` :502-505; `mosaic yolo`/`execRuntime` = 0 hits; register-before-exec producer in the invoked chain (precondition order gate) |
-| b Fail-closed precondition present+correct | ✅ | `gated_launcher_precondition` :250-306, invoked :485 **before** broker/Pi; raises on socket≠fixture / gen-file-inherited / write-path-escape / head-mismatch / hash-mismatch / not-register-before-exec-file-bound |
-| c Fixture-socket isolation, single p3 broker | ✅ | one broker Popen :486-500; `MOSAIC_LEASE_BROKER_SOCKET=socket_path` (fixture); direct launcher invocation ⇒ no default/XDG/`/run/user` fallback in path |
-| d `lease_anchor_registered` INTACT | ✅ | broker emits event + `session_id_shape=="hex-256"` (:102-107); `record_where` requires it (:324-326); `lease_anchor_fixture` check (:379) — not deleted/softened/optional/repointed (not Case-C) |
-
-## BAR4 — Homelab Gate-B carry-forward findings
-
-| # | Result | Evidence |
-|---|---|---|
-| b4-1 gated launcher @f4008307, not released/plain execRuntime | ✅ | :502-505; 0 `mosaic yolo`/`execRuntime` |
-| b4-2 **affirmative no-escape** (allow-list base, not deny-list) | ✅ | `isolated_environment` builds the child env from a **literal allow-list dict** (:442-461), NOT `os.environ.copy()`; only PATH/LANG/TERM/PI_CODING_AGENT (non-write-bearing) pass through; every write-bearing var (HOME/XDG*/TMPDIR/MOSAIC_AGENT_WORKDIR/HEARTBEAT_RUN_DIR/MOSAIC_HOME/D4_PI_LOG/socket) redirected under `root`; precondition double-checks each is `is_relative_to(root)` (:257-273). No unnamed/future inherited var survives |
-| b4-3 `--runs` exactly 3, fail-closed otherwise | ✅ | `add_argument("--runs", type=int, default=3, choices=(3,))` :591 (argparse rejects any other value) |
-| b4-4 cleanup try/finally spans the whole launch | ✅ | `broker=pi=None` :479-480; `try` opens **before** precondition/broker/PiRpc :482; nested `finally` always closes pi then broker+socket even on early `wait_path`/`PiRpc` failure :571-585 |
-| b4-5 `-O`-safe integrity + derived PASS | ✅ | load-bearing checks in a `checks` dict; `if failed: raise AssertionError` :385-387 and `if not passed: raise` :388-390 (NO bare `assert` anywhere — grep-confirmed); PASS = `"PASS" if passed else "FAIL"` derived from `all(checks.values())` :393, re-derived+checked in `run_once` :550-553 |
-
-## MUST-BE-ABSENT sweep
-
-`P5` / `P6` / `P2-bank` / `retry-launder` / `mosaic yolo` / `execRuntime` / `run_open` / `atomic-observation` /
-`pi_gate0_run` = **0 hits** (both files). Extension invokes only `bump-generation` / `lifecycle` /
-`authorize-probe` / `promote-probe`. No live/prod/real-broker path (single fixture broker; allow-list env; launcher
-pinned to fixture socket). No `.state`/gen-file path outside the fixture temp root (broker `generation_environment`
-raises otherwise). §4 live effect: none. No extra broker/socket beyond the single p3. No exec-at-import (both files
-`__main__`-guarded). Mechanism change is confined to the mandated R1 observation-fidelity deepening + BAR4 hardening;
-no scope-widen of what the probe touches.
-
-## Observations (transparency — not findings)
-
-1. The fixture broker retains a **dormant `source-invalid` action** (:179-194, P5-adjacent, in-mem). It is
-   **never invoked** by the harness or its embedded extension (verified: extension actions are only
-   bump/lifecycle/authorize/promote), and `assert_d4` never observes it — so the probe does **not** exercise or bank
-   P5. Pre-existing shared-fixture code, unchanged. Surfaced so Mos may, if desired, apply a stricter
-   purge-dormant-P5-from-the-fixture standard; under the "what the probe TOUCHES/does" framing it is not a violation.
-2. Fixture `HOME` receives a **read-only copy** of the operator's `~/.pi/agent` `settings.json`/`auth.json`/`bin/fd`
-   (:430-440, `shutil.copy2` into the fixture) so real Pi can authenticate to the model provider. It reads operator
-   state; it does not write/mutate operator HOME and does not emit/log credential material. Confined to the fixture.
-
-## Verdict
-
-**PASS @ `48484938`** — BAR1 (traceability to shipped f4008307 mechanism) + BAR2 (genuine file-backed generation,
-i–iv) + BAR3 (live-path / fail-closed precondition / isolation / intact assertion) + BAR4 (b4-1..b4-5) all hold,
-with zero out-of-scope surface exercised. The v3 hollow-gate (ancestor pin, in-mem simulation) is structurally
-closed: evidence now attests the shipped WI-3 D4 file-backed generation mechanism, launcher pinned by head+sha256,
-child env write-confined by allow-list, integrity `-O`-safe with a derived PASS.
-
-**Findings: none.**
-
-## Scope reminder (not a finding)
-
-Per §3/§5 of the amendment, producing this evidence **executes** the Gate0 mechanism. This review clears the
-**bytes**; **FIRE remains separately gated on Mos's explicit post-clear GO** and is not authorized by this review.
-
----
-
-**Reviewer:** independent Opus §3-conformance reviewer (Gate-16 author≠reviewer). Byte review only; ran nothing.
-**Reviewed object (pin):** `484849387006ab5561798506fd6042ddbd5617de` · harness sha256 `9095eab7a4ddf11bb92bb5971d49e1facad12f4692ce2081665b0af47cbe5098`.

docs/compaction-refresh/reviews/GATE0-PROBE3-HYGIENE-S3-REVIEW-v5.md

@@ -1,80 +0,0 @@
-# Gate0 Probe-3 (D4) Hygiene-Delta — §3-Conformance Review v5
-
-**Verdict: ❌ FAIL** (hygiene delta (a)+(b) landed correctly and (c)+(d) hold, but homelab findings **NEW-5** and **NEW-6** are present in these bytes; both must close for PASS).
-
-## Pin (G1 — reviewed object, mandatory)
-
-- **Reviewed object = `7f975b95ad39096463a7548bd6be0dbb387cb61b`** (harness commit, branch `feat/827-gate0-probe`).
-- **Reviewed file:** `docs/compaction-refresh/probes/p3_d4_focused_run.py` — sha256 (pushed provider bytes, `-o FILE`, FULL-40 ref, verified before trust): `c3a09a342a4b367184d44472ec6fc11f8a3aabb7e90d5a72aa6b7044b1d9b91e` (24174 bytes, no not-found sentinel).
-- **Co-reviewed fixture broker:** `p3_generation_broker.py` sha256 `4db4fef1ac6658a8ca79ad5091cefc901d2aa26003265c3d6726c294cf895cad`.
-
-## Reviewer identity / lane (independence — on the record)
-
-This review is produced by a **distinct independent Opus §3-conformance / SECREV session** (Gate-16 author≠reviewer),
-**byte review only, ran nothing**, that **did not build** this harness (author = ms-rev-826) and **is not Mos**. The
-PROCESS/LANE separation (build lane ≠ review lane) holds and is attested here. Homelab's separate observation — that
-the published PASS commits and the repair commits share the `ms-lead-reviewer` **Git signer identity** — is a
-git-identity-signer question I do **not** self-resolve; per instruction it is routed to Mos. My lane attestation is
-independent of the git signer.
-
-## Hygiene delta (v4 `48484938` → v5 `7f975b95`) — items (a)+(b): CLOSED
-
-Full `diff` of both files shows the delta touches **only** these:
-
-- **(a) Creds scrubbed — CLOSED.** New `scrub_fixture_credentials(root)` (:467-475): `shutil.rmtree(root/"home"/".pi"/"agent")` then a fail-closed re-check `if copied_agent.exists(): raise` (:473-474). Invoked in the **outermost `finally`** (:598), **after** pi/broker cleanup and **before** `return root` (:600) — so it runs on the **success path too**. The scrub target exactly matches the only copy site (`target_agent = fixture_home/".pi"/"agent"`, :433). `isolated_environment` was moved inside the `try` (:485) so the scrub finally also covers a partial env-setup failure. No copied agent credential/config subtree (incl. `auth.json`) survives in any retained root. ✅
-- **(b) `source-invalid` handler REMOVED — CLOSED.** `grep source-invalid / source_invalidation_revoke == 0` across **both** files. Broker delta is solely the deletion of the old `:179-194` block. ✅
-
-## (c) Everything-else byte-stable vs `48484938` — HOLDS
-
-Diff confirms **no other hunks**. Re-swept intact: traceability `GATED_WI_HEAD=f4008307` (:33) + `GATED_LAUNCHER_SHA256=e950e4224e…` (:35); fidelity `read_runtime_generation`/`bump_runtime_generation` + `generation_source=="state-file"` + `new→MUTATOR_UNVERIFIED`/`prior→STALE_GENERATION`; `lease_anchor_registered` + `hex-256`; `-O`-safe (0 bare `assert`, PASS derived `all(checks.values())`); allow-list literal env (0 `os.environ.copy`); `--runs choices=(3,)`; fail-closed precondition; single p3 broker. Blockers 1-4 (inherited env / `--runs`≠3 / cleanup-misses-setup-failure / `-O`-strips-checks) remain closed.
-
-## (d) ABSENT sweep — 0
-
-`P5`/`P6`/`P2-bank`/`retry-launder`/`mosaic yolo`/`execRuntime`/`run_open`/`atomic`/`pi_gate0` = 0 (both files);
-extension invokes only `bump-generation`/`lifecycle`/`authorize-probe`/`promote-probe`; no exec-at-import.
-
-## Homelab carry-forward — NEW-5 / NEW-6: **PRESENT → FAIL**
-
-### 🔴 NEW-6 — GATED_WI_ROOT resolves wrong / non-portably (CONFIRMED)
-`GATED_WI_ROOT = HERE.parents[3].parent / "stack-cr-wi3-revoke"` (:32). For the harness at
-`…/agent-work/stack-cr-wi0-gate0/docs/compaction-refresh/probes/`, this computes
-**`/home/hermes/stack-cr-wi3-revoke` — which does not exist**. The actual f4008307 worktree is
-`/home/hermes/agent-work/stack-cr-wi3-revoke` = `HERE.parents[3] / "stack-cr-wi3-revoke"`. The traversal is
-**off-by-one** (`.parents[3].parent` should be `.parents[3]`), and it additionally hardcodes the worktree name — a
-non-portable relative assumption. On this host the precondition therefore fail-closes ("gated WI launcher is
-unavailable") and the probe cannot locate/execute the pinned launcher at all. **Real resolution defect** (independently
-computed by path arithmetic; harness not run). **file:line — :32.**
-*Fix:* derive `GATED_WI_ROOT` from a portable, explicit anchor (e.g. an env-provided path validated to be the
-f4008307 worktree, or `HERE.parents[3] / "stack-cr-wi3-revoke"` with existence+HEAD assertion), not `.parents[3].parent`.
-
-### 🔴 NEW-5 — launcher precondition is check-then-exec, not pinned-executed-bytes (CONFIRMED)
-The precondition hashes `launcher_bytes = GATED_LAUNCHER.read_bytes()` (:280) against `GATED_LAUNCHER_SHA256` (:287),
-but the launcher is **executed separately** via `PiRpc([sys.executable, str(GATED_LAUNCHER), …])` (:514-515), which
-opens and **re-reads the file at exec time**. There is **no fd-handoff and no exec-from-verified-copy**, so the
-verified snapshot does **not** bind the executed bytes. The window between check (:287) and exec (:514-515) spans the
-broker `Popen` + `wait_path` (≤20 s) — a genuine **check-then-exec TOCTOU / mutable-path trust**; the `git rev-parse
-HEAD` check (:285-286) is likewise on a mutable HEAD, not the executed bytes. Per the bar this is a real gap.
-**file:line — hash :280/:287 vs exec :514-515.**
-*Fix:* execute the exact verified bytes with no window — e.g. read once, verify, and exec from a fixture-private
-copy of the verified bytes (or `python3 /proc/self/fd/<verified-fd>`), so the hashed bytes == executed bytes.
-
-## Verdict
-
-**FAIL @ `7f975b95`.** The hygiene delta itself is correct — (a) creds scrub (fail-closed finally, success path,
-every retained root) and (b) `source-invalid` removal both landed cleanly, (c) everything else is byte-stable vs
-`48484938`, and (d) the absent sweep is 0. **However**, homelab's NEW-5 (check-then-exec launcher TOCTOU / not
-pinned-executed-bytes) and NEW-6 (GATED_WI_ROOT off-by-one/non-portable resolution) are **present in these bytes**;
-the addendum requires both **closed** for PASS. Not softened. Returns to author (ms-rev-826) — not to a builder
-re-review, no PASS-launder.
-
-**Findings:** NEW-6 (`p3_d4_focused_run.py:32`); NEW-5 (`p3_d4_focused_run.py:280/:287` vs `:514-515`).
-
-## Scope reminder (not a finding)
-
-Producing this evidence **executes** the Gate0 mechanism (§3/§5). This review clears **bytes** only; FIRE remains
-separately gated on Mos's explicit post-clear GO — and is moot until this FAIL is remediated.
-
----
-
-**Reviewer:** independent Opus §3-conformance/SECREV reviewer (Gate-16 author≠reviewer). Byte review only; ran nothing.
-**Reviewed object (pin):** `7f975b95ad39096463a7548bd6be0dbb387cb61b` · harness sha256 `c3a09a342a4b367184d44472ec6fc11f8a3aabb7e90d5a72aa6b7044b1d9b91e`.

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v-final.md

@@ -1,116 +0,0 @@
-# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v-final)
-
-**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
-**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
-`ms-lead-reviewer@mosaic.local` lane signer — so this record stands as a *distinct-identity*
-co-attestation, not a same-signer duplicate. See "Independence" below.
-
-**Verify class:** independent provider-byte read (guarded `git show <full-40>:path | sha256sum` from a
-read-only clone of `mosaicstack/stack`). Not a re-build, not a re-run — a byte/scope/hygiene audit of
-the exact committed objects on the provider branch.
-
-## Package under attestation
-
-| Artifact | Ref |
-|---|---|
-| Branch | `feat/827-gate0-probe` |
-| Harness commit-40 | `2d54a9dd14cb924701b2ae4ed72dae4df760c4e3` |
-| Harness `p3_d4_focused_run.py` sha256 | `15a154df55273f51301763a984485fd63813f6d1f05d2728abb9fb8b9c040b1a` (27366 B) |
-| §3-review-v6 commit-40 | `23c0caca9b5d44002e6184cd7f2b6c837e8795b2` |
-| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-NEW56-S3-REVIEW-v6.md` |
-
-sha256 re-confirmed against the checked-out object at `HEAD:docs/compaction-refresh/probes/p3_d4_focused_run.py`
-(git object id `8c68cd07…`) — matches the relayed value byte-for-byte.
-
-## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS**
-
-**Anchors.** Harness sha256 matches (27366 B). review-v6 (`23c0caca`) parent == harness commit
-`2d54a9dd`; review touches only the review `.md` (+82 lines, 1 file). Broker
-(`p3_generation_broker.py`) delta vs `48484938…` = **exactly** the 16-line `action=="source-invalid"`
-handler purge, byte-stable otherwise.
-
-**NEW-6 (GATED_WI_ROOT off-by-one) — CLOSED.** `resolve_gated_wi_root()` selects the worktree by
-`git worktree list --porcelain` enumeration, requires a UNIQUE match on `HEAD==GATED_WI_HEAD`
-(`f400830738998db105107a2a4c69c7f2a2a6fd5d`) AND `branch==refs/heads/feat/830-compaction-revoke`,
-then fail-closed re-validates (`is-inside-work-tree==true`, `rev-parse HEAD==GATED_WI_HEAD`);
-`RuntimeError` on ambiguity/mismatch. The `HERE.parents[3].parent / "stack-cr-wi3-revoke"` off-by-one
-and the hardcoded `/home/hermes/...` literal are **gone** — portable, zero hardcoded path.
-
-**NEW-5 (TOCTOU / pinned-executed-bytes) — CLOSED via approach (i), as mandated.** The `git`-object
-sha256 pin (`GATED_LAUNCHER_SHA256 = e950e422…`) is the trust anchor. Ordering/marker `.find()`
-heuristics are downgraded to explicitly diagnostic-only ("never a substitute for the pin"). In
-`launch_verified_pi()` the executed working-tree file is re-hashed against the pin **in the statement
-immediately before `Popen`** (no interleaved yield/IO), and the launcher is executed **in place at the
-pinned worktree path** — the higher-risk approach (ii) copy-to-fixture (previously at `7ff63cd5` /
-`6164dc07`) is **reverted** (the only remaining `shutil.copy2` is the legitimate credential copy, not a
-launcher copy). Residual sub-statement TOCTOU window on a local file inside a non-adversarial operator
-fixture is within this probe's threat model; the gross precondition→much-later-exec gap homelab flagged
-is closed.
-
-**Hygiene — CLOSED.** `scrub_fixture_credentials(root)` removes the entire `.pi/agent` subtree in a
-`finally` block (nested try/finally, after `pi.close()` + broker shutdown, before `return root`) and
-`RuntimeError`s if the scrub fails — credentials are removed from retained evidence; logs retained.
-
-**Invariants byte-stable (all INTACT):** assertion `lease_anchor_registered`; file-backed fidelity
-checks (`generation_source=="state-file"`, `state_file_in_fixture_root`, `MUTATOR_UNVERIFIED`,
-`STALE_GENERATION`); `-O`-safe (0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker;
-`--runs choices=(3,)`; ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0.
-
-**R1 mechanism-fidelity boundary — HELD.** D4 exercises #830's real file-backed revocation
-(`generation-{sid}.state` / `MOSAIC_LEASE_GENERATION_FILE`, from `66b1e0a0`); `.state` stays inside the
-fixture temp root; fixture-socket / child-write-escape / gettempdir isolation preconditions preserved;
-launcher exec is in place at the pinned worktree (same surface as R1, not a new production/live
-surface). **No path escapes the fixture root.** BEYOND-R1 tripwire NOT tripped.
-
-## Independence
-
-- **Substantive principal-independence** of review-v6 is satisfied by an orchestrator-dispatched,
-  builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder) — that IS the substance of
-  Gate-16.
-- The shared `ms-lead-reviewer` git signer on harness+review commits is **evidentiary, not
-  substantive**. It is resolved by (1) this Mos co-attestation committed under a **distinct** identity
-  (`mos-orchestrator`), and (2) a homelab third-principal verify under its own distinct identity —
-  i.e. three distinct-identity principals of record.
-- The shared signer is a tracked **fleet-infra tooling-gap** (durable fix = per-lane distinct signers),
-  **not a blocker**.
-
-## Scope of this record — byte-clear, NOT fire-authorization
-
-Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
-This co-attestation clears the **bytes/scope/hygiene**. FIRE remains gated on: **homelab
-third-principal verify** + **Mos transparency-to-Jason** (real-Pi consumes operator model creds inside
-the isolated fixture, scrubbed post-run, never emitted) + **Mos explicit FIRE GO**. Until then: nothing
-banked, WI-3 #830 held at `f4008307` (unmoved), C-hatch armed (if 3× isolation still no-fire /
-wrong-value / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
-
-**Mos verdict: byte-scope + mechanism + hygiene PASS. Co-attestation of record — committed.**
-
----
-
-## ⚠️ SUPERSEDED — homelab third-principal FAIL raised a stricter bar (evidence-integrity note)
-
-This co-attestation was **byte-clear on the v6 bar ONLY** and self-limited above to *"byte-clear
-ONLY, NOT fire-authorization; FIRE remains gated on homelab third-principal verify."* Homelab (the
-required third principal) subsequently returned **FAIL @2d54a9dd**, and Mos **UPHELD** it — so the v6
-byte-clear this document records is **SUPERSEDED** and does **NOT** authorize FIRE.
-
-Homelab's substantively-correct deepening (accepted as gate-**strengthening**, not softening):
-1. `launch_verified_pi` hashes the launcher then `Popen`/execve **reopens the path** → statement
-   adjacency shrinks but does not eliminate TOCTOU; hashed-snapshot ≠ executed-bytes.
-2. `lease_generation.py` helper is unpinned, loaded from the mutable worktree → HEAD + launcher-pin
-   do not bind the helper bytes.
-3. `p3_generation_broker.py` executes from the mutable worktree unhashed → reviewed broker bytes need
-   not be the evidence-producing bytes.
-
-For a fail-closed DO-178C evidence gate, **hashed==executed must hold on the FULL executed closure**
-(launcher + helper + broker), which v6 (approach (i) adjacency) does not meet. Mos therefore
-**authorized approach (ii) full-closure materialization** (SHA-pin + materialize the full closure into
-a fixture-private 0700/0600 dir or held verified fds, exec from there, launcher+broker consume the same
-pinned helper; re-hash==f4008307 pins immediately before exec, fail-closed). This rides the existing R1
-authorization + Mos adjudication authority (it deepens isolation of already-authorized touch and stays
-inside the fixture temp root → R1 owner tripwire not tripped; no fresh owner window).
-
-**Live target = v7** (materialized-closure harness, forthcoming). `2d54a9dd` / `23c0caca` / this
-co-attestation (`12914d8`) are **SUPERSEDED**. A fresh Mos co-attestation will be committed on v7
-byte-verify PASS. WI-3 #830 remains HELD at `f4008307`; nothing banked; C-hatch armed.
-

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v10.md

@@ -1,97 +0,0 @@
-# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v10 no-site startup closure)
-
-**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
-**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
-`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this
-record stands as a *distinct-identity* co-attestation. See "Independence".
-
-**Verify class:** independent provider-byte read (`git show <full-40>:path | sha256sum`) plus a
-git-diff byte-comparison of the v9→v10 delta and source inspection of the executed command lines. Not
-a re-build, not a re-run. This SUPERSEDES the v9 co-attestation `f320d075` (byte-clear on the v9
-env-iso + bytecode-pin bar), which was overtaken by homelab's 4th-round FAIL @1c34e3cb
-(site-startup-closure hole) and the resulting B9 bar.
-
-## Package under attestation
-
-| Artifact | Ref |
-|---|---|
-| Branch | `feat/827-gate0-probe` (mosaicstack/stack) |
-| Harness commit-40 | `ce5ba762051354338889959bfce2b0381f4a4e2a` |
-| Harness `p3_d4_focused_run.py` sha256 | `7e14ead89a7b2a297fcc17e7653291b3bcace1d2002a8f90a989db74f6985b6f` (32753 B) |
-| §3-review-v10 commit-40 | `ffc3b573a8258a86e3ece9ef92bac925fb5a7a5b` (parent == harness `ce5ba762`, byte-stable; adds only the review `.md`, +86; ms-secrev-828 authored) |
-| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V10-NOSITE-S3-REVIEW-v10.md` |
-
-**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants; UNCHANGED from v9):**
-
-| Member | Source (commit:path) | Pin sha256 | Size |
-|---|---|---|---|
-| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
-| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
-| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
-
-> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the
-> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`.
-
-## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v10 = v9 + B9 no-site)
-
-The v9→v10 delta is **exactly 2 insertions / 0 deletions** (git-diff byte-compared), a `+28 B`
-harness growth **fully accounted** (2 × `        "-S",\n` = 14 B each). Every prior invariant is
-byte-stable — the diff touches nothing outside the two command lists.
-
-**B9 — no-site startup closure (homelab 4th-round finding CLOSED).** Both child command lists now
-carry `-S`, which disables the `site` module entirely (no `.pth` executable lines, no
-`sitecustomize`/`usercustomize`) so no unpinned startup code runs before the exact launcher/broker or
-outside `closure_import_guard`:
-- launcher `launch_verified_pi` (`:515`): `-s` + **`-S`** + `-B`, **no `-I`** (`-I` appears exactly
-  once in the harness, `:553`, the broker only).
-- broker `launch_verified_broker` (`:554`): `-I` + **`-S`** + `-B`.
-
-Homelab's finding was **independently reproduced by Mos** and the fix **empirically verified** on host
-Py3.11.2 (throwaway, not the harness): `[-s -B]`→`no_site=0, site imported` (the v9 hole); `[-I -B]`→
-`no_site=0, site imported` (proves `-I` does **not** imply `-S`); `[-s -S -B]`→`no_site=1`, `site` not
-in `sys.modules`, **and the launcher's bare `from lease_generation import` still resolves** (`sys.path[0]`
-untouched by `-S` → no B6c regression); `[-I -S -B]`→`no_site=1`. The launcher deliberately omits `-I`
-(B6c: on 3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]` → sibling import breaks);
-its env isolation comes from the `PiRpc` `env=` allow-list, not `-I`.
-
-**All priors — byte-stable (outside the 2-line delta, re-confirmed from the v9 verify):**
-B5 conjunction (materialize-from-pin / `mkdir(0o700)`+`O_EXCL` no-writer-window / re-hash==pin
-immediately-before-exec); B6 (single pinned helper bound; `closure_import_guard` AST-reject); B6c
-(launcher no `-I`); B7 (broker `env=environment` strict allow-list `:570`); B8 (`reject_pinned_bytecode`
-fail-closed `:498-501` before each consumer `:535/:562` + `PYTHONDONTWRITEBYTECODE=1` `:729` + `-B` on
-both); fidelity asserts (`generation_source=='state-file'`, `state_file_in_fixture_root`,
-`MUTATOR_UNVERIFIED`, `STALE_GENERATION`); `lease_anchor_registered`; BAR1 `GATED_WI_HEAD==f4008307`
-(`:36`) + `merge-base --is-ancestor 66b1e0a0 f4008307` = **YES**; `--runs choices=(3,)`; `-O`-safe
-(0 bare `assert`); allow-list env (0 `os.environ.copy`); single broker (1 def + 1 call); the only
-`shutil.copy2` is the `.pi/agent` credential copy.
-
-**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp
-root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — `-S`
-deepens startup-closure isolation of an already-authorized touch; it does not widen the touched surface.
-
-## Independence
-
-Substantive principal-independence of review-v10 is satisfied by an orchestrator-dispatched,
-builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared
-`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by
-(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab
-third-principal verify under its own distinct identity = three distinct-identity principals of record.
-The prior 2-of-3 (`ms-secrev-828` v9 §3 PASS + `f320d075`) does **not** carry — all three re-verify
-this v10 SHA. Shared signer = tracked fleet-infra tooling-gap, not a blocker.
-
-## Scope of this record — byte-clear, NOT fire-authorization
-
-Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
-This clears **bytes / scope / mechanism / hygiene on the v10 (v9 + B9 no-site) bar**. FIRE remains
-gated on: **homelab third-principal re-verify** (5th round, own distinct identity) + **Mos
-transparency-to-Jason** + **Mos explicit FIRE GO**. The FIRE GO additionally carries an
-**execution-procedure constraint**: the 3× isolation dispatch must launch the runner under
-externally-enforced **`python -I -S -B p3_d4_focused_run.py`** — a self-reexec is too late, the
-harness's own `site` runs before it could re-add `-S` to itself. Until FIRE GO: nothing banked, WI-3
-#830 held at `f4008307` (unmoved), C-hatch armed (fired-rig only: no-fire / wrong-value /
-assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
-
-Prior v10-superseded set: `1c34e3cb` / `e1c9a468` / `f320d075` (and transitively the v7 chain).
-
-**Mos verdict: v10 (v9 + B9 no-site) byte-scope + mechanism + hygiene PASS. Co-attestation of
-record — committed.**

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v7.md

@@ -1,131 +0,0 @@
-# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v7 full-closure)
-
-**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
-**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
-`ms-lead-reviewer@mosaic.local` lane signer that authored both the harness and the §3 review — so this
-record stands as a *distinct-identity* co-attestation. See "Independence" below.
-
-**Verify class:** independent provider-byte read (guarded `git show <full-40>:path | sha256sum`) plus
-source-level inspection of the executed mechanism. Not a re-build, not a re-run. This SUPERSEDES the v6
-co-attestation `12914d8` (and its SUPERSEDED-note `b6bd0cd`), which was byte-clear on the v6 bar only
-and was overtaken by homelab's third-principal FAIL @2d54a9dd + the resulting stricter full-closure bar.
-
-## Package under attestation
-
-| Artifact | Ref |
-|---|---|
-| Branch | `feat/827-gate0-probe` |
-| Harness commit-40 | `f609a44953f5ae61916805fcb45ca337de00b0b0` |
-| Harness `p3_d4_focused_run.py` sha256 | `0f1bd1b39399b32f243d901230e2d840794a2144edd723a095dab716833a7a9b` (32071 B) |
-| §3-review-v7 commit-40 | `2bba933f67c821899d320a938a9473a73a136422` (adds only the review `.md`; harness parent byte-stable) |
-| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V7-FULLCLOSURE-S3-REVIEW-v7.md` |
-
-**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins):**
-
-| Member | Source (commit:path) | Pin sha256 | Size |
-|---|---|---|---|
-| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
-| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
-| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
-
-> Note: `f4008307` (the held WI-3 #830 gated head) is **not on origin** — it exists only as a local
-> `git worktree` on the build host. Mos recomputed the launcher+helper pins from that worktree
-> (`stack-cr-wi3-revoke`, HEAD == `f4008307`) rather than passing over a clone-completeness gap. The
-> broker pin was recomputed from origin `23c0caca`.
-
-## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v7 full-closure bar)
-
-Homelab's stricter bar — **hashed==executed on the FULL executed closure (launcher + helper + broker)**
-— is met. Verified at the source, not accepted on the review's assertion:
-
-**B5 conjunction (the load-bearing repair) — HELD, all three legs:**
-- **(a) materialized from pinned git-object bytes, NOT the mutable worktree.** `materialize_closure`
-  fetches each member via `git_object_bytes` (`git show {commit}:{path}`), then
-  `sha256(data) == pin` **fail-closed** (`RuntimeError` on mismatch) before use.
-- **(b) no writable window hash→consume.** `pinned/` is `mkdir(mode=0o700)`; each file is written with
-  `os.open(O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0o600)` — `O_EXCL` refuses a pre-planted file. No `chmod`,
-  no `os.rename/replace`, no `symlink`, and nothing re-opens a pinned file for write (grep = 0). The
-  pinned bytes are immutable within the fixture threat model between hash and exec.
-- **(c) re-hash == pin IMMEDIATELY before each exec, no interleaved yield.** Launcher: re-hash then
-  `return PiRpc(command,…)` whose `__init__` **first statement** is `subprocess.Popen(command,…)` —
-  zero IO/yield/reopen between. Broker + helper: both re-hashed then `subprocess.Popen` on the next
-  line. Adjacency-alone-without-materialization (the v6 defect) is **absent** — all three exec from
-  `pinned/`.
-
-**B6 — helper pinned AND bound to the SAME single copy.** The broker receives
-`--generation-module {closure.generation}` (the pinned helper); the launcher runs from `pinned/` so its
-`import lease_generation` resolves to the sibling pinned copy via `sys.path[0]`. `closure_import_guard`
-AST-parses every member and raises on any non-stdlib import other than the allowed `lease_generation`
-— proving the dependency closure is complete and no unpinned module can enter at runtime.
-
-**Closure = exactly 3 files, materialized inside the fixture root** (`root / "pinned"`). No path escapes
-the fixture temp root; no live/default broker; `.state` remains fixture-bound. **R1 owner tripwire NOT
-tripped** — this deepened isolation of an already-authorized touch, it did not widen the touched surface.
-
-**Invariants (all INTACT):** BAR1 `GATED_WI_HEAD == f4008307` and `merge-base --is-ancestor 66b1e0a0
-f4008307` = YES (file-backed `.state` revocation fidelity present); BAR2 `.state` =
-`socket_path.parent / generation-{sid}.state`, `state_file_in_fixture_root` + `generation_source ==
-"state-file"` checks present; BAR3 `lease_anchor_registered` / live-path / fixture-socket isolation
-intact. `-O`-safe (0 bare `assert`); ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`)
-= 0; single broker (1 def + 1 call site); `--runs choices=(3,)`; allow-list env (0 `os.environ.copy`);
-the only `shutil.copy2` is the legitimate `.pi/agent` credential copy (settings/auth/fd), **not** a
-launcher/helper/broker copy — the v6 copy-to-fixture concern is gone.
-
-## Independence
-
-- **Substantive principal-independence** of review-v7 is satisfied by an orchestrator-dispatched,
-  builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder) — that IS the substance of
-  Gate-16.
-- The shared `ms-lead-reviewer` git signer on both the harness (`ms-rev-826` build) and the review
-  commit is **evidentiary, not substantive**. It is resolved by (1) this Mos co-attestation under a
-  **distinct** identity (`mos-orchestrator`), and (2) a homelab third-principal verify under its own
-  distinct identity — three distinct-identity principals of record. Tracked fleet-infra tooling-gap
-  (durable fix = per-lane distinct signers), **not a blocker**.
-
-## Scope of this record — byte-clear, NOT fire-authorization
-
-Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
-This co-attestation clears the **bytes / scope / mechanism / hygiene on the v7 full-closure bar**. FIRE
-remains gated on: **homelab third-principal re-verify** (under its own distinct identity) + **Mos
-transparency-to-Jason** + **Mos explicit FIRE GO**. Until then: nothing banked, WI-3 #830 held at
-`f4008307` (unmoved), C-hatch armed (if the materialized-closure rig still no-fire / wrong-value /
-assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
-
-**Mos verdict: v7 full-closure byte-scope + mechanism + hygiene PASS. Co-attestation of record —
-committed.**
-
----
-
-## ⚠️ SUPERSEDED — homelab v7 third-principal FAIL @f609a449 raised a stricter bar (evidence-integrity note)
-
-This co-attestation was **byte-clear on the v7 full-closure bar ONLY** and self-limited above to
-*"byte-clear NOT fire-authorization; FIRE remains gated on homelab third-principal re-verify."*
-Homelab (the required third principal) subsequently returned **FAIL @f609a449** (static verify, no
-code run), and Mos **UPHELD** it after independently confirming both findings in source — so the v7
-byte-clear this document records is **SUPERSEDED** and does **NOT** authorize FIRE.
-
-Two residual isolation/binding holes WITHIN the materialized closure (both independently reproduced
-by Mos in the harness source; accepted as gate-**strengthening**, not softening):
-1. **Broker child env not isolated.** `launch_verified_broker` (`:551`) calls `Popen` with **no
-   `env=`** (only `PiRpc.__init__` `:50` passes an allow-listed `env`) → the broker child inherits
-   ambient `os.environ` (PYTHONPATH/PYTHONHOME/PYTHONPYCACHEPREFIX). `closure_import_guard` is a
-   static AST check and cannot bind the child's runtime stdlib resolution.
-2. **Executed bytecode-cache outside the pin.** No `PYTHONDONTWRITEBYTECODE`/`-I`/`-B`/`__pycache__`
-   handling anywhere. `exec_module` on the pinned helper writes derived `.pyc` the pin never covers;
-   only the `.py` is re-hashed → executed bytecode ≠ pinned-source-hash.
-
-Both break "hashed==executed on the FULL executed closure" on **fidelity** grounds even in a
-non-adversarial fixture. Mos **authorized the bounded repair** (broker `Popen` with strict
-allow-listed `env=` + `-I` + `PYTHON*` stripped; bytecode-cache suppressed via
-`PYTHONDONTWRITEBYTECODE=1`/`-B` + reject stray `__pycache__`/`.pyc` fail-closed before each
-consumer; launcher sibling-import binding to the pinned helper preserved). This **rides the existing
-(ii)-full-closure authorization + R1 + Mos adjudication** — it deepens isolation/binding of an
-already-authorized touch, stays inside the fixture temp root, no fresh Jason owner-window. It is
-**NOT a Case-C escalation** (no probe fired, no evidence produced — a static pre-fire catch, exactly
-what the review gate is for). Added review bars **B7** (broker child env-isolated) and **B8**
-(executed bytecode pinned-or-suppressed) on top of B5+B6+all priors.
-
-**Live target = v8** (env-isolated + bytecode-pinned harness, forthcoming). `f609a449` /
-`2bba933f` / this co-attestation (`e08ad03`) are **SUPERSEDED**. A fresh Mos co-attestation will be
-committed on v8 byte-verify PASS. WI-3 #830 remains HELD at `f4008307`; nothing banked; C-hatch
-armed; NO FIRE.

docs/compaction-refresh/reviews/GATE0-PROBE3-MOS-COATTEST-v9.md

@@ -1,145 +0,0 @@
-# GATE0 Probe-3 (#827) — Mos byte-scope-verify CO-ATTESTATION (v9 full-closure, env-isolated + bytecode-pinned)
-
-**Principal:** Mos (orchestrator, merge authority for the mosaic-stack governance lane).
-**Committed under a DISTINCT git identity** (`mos-orchestrator@mosaic.local`) — deliberately NOT the
-`ms-lead-reviewer@mosaic.local` lane signer that authored the harness and the §3 review — so this
-record stands as a *distinct-identity* co-attestation. See "Independence".
-
-**Verify class:** independent provider-byte read (`git show <full-40>:path | sha256sum`) plus
-source-level inspection of the executed mechanism and the v7→v9 delta. Not a re-build, not a re-run.
-This SUPERSEDES the v7 co-attestation `e08ad03` (and its SUPERSEDED note `2ae379e`), which was
-byte-clear on the v7 bar and was overtaken by homelab's third-principal FAIL @f609a449 (broker
-env-isolation + executed-bytecode-cache) and the resulting B7/B8 bar.
-
-## Package under attestation
-
-| Artifact | Ref |
-|---|---|
-| Branch | `feat/827-gate0-probe` |
-| Harness commit-40 | `1c34e3cb3172acdcd094e683e847d7c984afc96c` |
-| Harness `p3_d4_focused_run.py` sha256 | `29e5c7bfbe1911b52984bd94c79036bb1200ee82588318367b13c2b1053a0103` (32725 B) |
-| §3-review-v9 commit-40 | `e1c9a4682da2892ca5f5381012caffe1dd7b43a7` (parent == harness `1c34e3cb`, byte-stable; adds only the review `.md`; ms-secrev-828 authored) |
-| Review path | `docs/compaction-refresh/reviews/GATE0-PROBE3-V9-LAUNCHERFIX-S3-REVIEW-v9.md` |
-
-**Pinned closure (all 3 sha256 INDEPENDENTLY recomputed by Mos from git objects == pins == embedded harness constants):**
-
-| Member | Source (commit:path) | Pin sha256 | Size |
-|---|---|---|---|
-| launcher `launch-runtime.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/launch-runtime.py` | `e950e422…` | 4237 B |
-| helper `lease_generation.py` | `f4008307:packages/mosaic/framework/tools/lease-broker/lease_generation.py` | `061625402f…` | 3769 B |
-| broker `p3_generation_broker.py` | `23c0caca:docs/compaction-refresh/probes/p3_generation_broker.py` | `4db4fef1…` | — |
-
-> `f4008307` (held WI-3 #830 gated head) is **not on origin** — recomputed launcher+helper from the
-> local `stack-cr-wi3-revoke` worktree (HEAD == `f4008307`); broker from origin `23c0caca`.
-
-## Findings — VERDICT: byte-scope + mechanism + hygiene **PASS** (v9 = v7 full-closure + B7 + B8)
-
-The v7→v9 delta is **exactly 22 insertions / 2 deletions**, confined to the intended B7+B8+B6c
-surface; every prior invariant is byte-stable (outside the delta) from the v7 verify.
-
-**B7 — broker child env-ISOLATED (homelab finding 1 CLOSED).** `launch_verified_broker` (`:568`) now
-passes `env=environment` (the strict allow-list, `:570`) — the ambient-`os.environ`-inheritance hole
-is gone — AND runs the broker with `-I` (`:552`, isolated: ignores `PYTHON*`/user-site) + `-B`
-(`:553`). Both children are env-controlled: the launcher was already `env=env` at `PiRpc` (`:53`).
-
-**B8 — executed bytecode PINNED/SUPPRESSED (homelab finding 2 CLOSED).** `reject_pinned_bytecode`
-(`:498`) raises `RuntimeError` fail-closed if a `__pycache__` dir or any `*.pyc` exists in the pinned
-dir, and is called before **each** consumer (launcher `:535`, broker `:562`). Bytecode writes are
-disabled via `PYTHONDONTWRITEBYTECODE=1` (`:729`) in the allow-list env **and** `-B` on both command
-lines. No unpinned `.pyc` can be executed; only the pinned `.py` re-hash governs.
-
-**B6c — launcher sibling-import PRESERVED (v8 regression FIXED).** v8 over-applied `-I` to the
-launcher; on Py3.11+ `-I` implies `-P`, dropping the script dir from `sys.path[0]`, so the pinned
-launcher's bare `from lease_generation import` (launch-runtime.py:15) would `ModuleNotFoundError`. v9
-uses `-s` (`:514`) + `-B` (`:515`) on the launcher (NO `-I`) — neither touches `sys.path[0]`, so the
-sibling import still resolves to `pinned/lease_generation.py`. **Mos empirically re-verified on host
-Py3.11.2** (throwaway, not the harness): `-I` launcher → `ModuleNotFoundError`; `-s`+`PYTHONNOUSERSITE`
-→ import OK. The launcher's env isolation comes from the `PiRpc` `env=` allow-list, NOT `-I`, so
-dropping `-I` does **not** reopen B7. My earlier constraint-(c) assumption ("`-I` does not strip the
-script dir") was FALSIFIED for 3.11+; the author≠reviewer gate (ms-secrev-828) caught it — recorded.
-
-**B5 conjunction (load-bearing repair) — HELD, all three legs (byte-stable from v7):**
-(a) materialized from pinned git-object bytes via `materialize_closure`/`git_object_bytes`, `sha256==pin`
-fail-closed; (b) `pinned/` `mkdir(0o700)` + `O_EXCL|O_CLOEXEC` `0o600`, no writable window — now also
-`reject_pinned_bytecode` closes the `.pyc` side-channel; (c) re-hash == pin IMMEDIATELY before each
-exec, no interleaved yield: launcher re-hash (`:538`) → `return PiRpc(command,…)` whose `__init__`
-first statement is `Popen` (`:50`); broker re-hash (`:563`) + helper re-hash (`:566`) → `Popen`
-(`:568`) on the next line.
-
-**B6 — single pinned helper, complete closure.** Broker gets `--generation-module {closure.generation}`;
-launcher resolves `import lease_generation` to the sibling pinned copy via `sys.path[0]`.
-`closure_import_guard` (`:351`, called `:433`) AST-rejects any non-stdlib import other than
-`lease_generation`. Single broker: `launch_verified_broker` 1 def (`:543`) + 1 call (`:766`).
-
-**Invariants (all INTACT):** BAR1 `GATED_WI_HEAD == f4008307` (`:36`) and `merge-base --is-ancestor
-66b1e0a0 f4008307` = YES (file-backed `.state` revocation fidelity present); fidelity
-`generation_source=='state-file'` (`:639`), `state_file_in_fixture_root` (`:641`),
-`MUTATOR_UNVERIFIED` (`:650`), `STALE_GENERATION` (`:651`); `lease_anchor_registered` (`:593`);
-`-O`-safe (0 bare `assert`); `--runs choices=(3,)` (`:838`); allow-list env (0 `os.environ.copy`);
-ABSENT-sweep (`yolo`/`execRuntime`/`p3_bank`/`promote_p2`/`retry`) = 0; the only `shutil.copy2`
-(`:708`) is the `.pi/agent` credential copy, not a closure copy.
-
-**Closure = exactly 3 files, materialized inside the fixture root.** No path escapes the fixture temp
-root; no live/default broker; `.state` fixture-bound. **R1 owner tripwire NOT tripped** — B7/B8
-deepen isolation/binding of an already-authorized touch, they do not widen the touched surface.
-
-## Independence
-
-Substantive principal-independence of review-v9 is satisfied by an orchestrator-dispatched,
-builder-distinct Opus SECREV (`ms-secrev-828`, byte-only, non-builder, non-Mos). The shared
-`ms-lead-reviewer` git signer on harness+review commits is evidentiary, not substantive — resolved by
-(1) this Mos co-attestation under a **distinct** identity (`mos-orchestrator`) and (2) a homelab
-third-principal verify under its own distinct identity = three distinct-identity principals of record.
-Shared signer = tracked fleet-infra tooling-gap (durable fix = per-lane distinct signers), not a blocker.
-
-## Scope of this record — byte-clear, NOT fire-authorization
-
-Producing probe evidence **executes** the Gate0 mechanism; a byte-clear is not a fire-authorization.
-This clears **bytes / scope / mechanism / hygiene on the v9 (full-closure + B7 + B8) bar**. FIRE
-remains gated on: **homelab third-principal re-verify** (4th round, own distinct identity) + **Mos
-transparency-to-Jason** + **Mos explicit FIRE GO**. Until then: nothing banked, WI-3 #830 held at
-`f4008307` (unmoved), C-hatch armed (materialized-closure rig still no-fire / wrong-value /
-assertion-FAIL / isolation-FAIL → possible Case-C → STOP + escalate to Jason).
-
-**Mos verdict: v9 full-closure + B7 + B8 byte-scope + mechanism + hygiene PASS. Co-attestation of
-record — committed.**
-
----
-
-## ⚠️ SUPERSEDED — homelab v9 4th-round FAIL @1c34e3cb raised a stricter *startup-closure* bar
-
-This co-attestation was **byte-clear on the v9 (env-iso + bytecode-pin) bar ONLY** and self-limited
-above to *"byte-clear NOT fire-authorization; FIRE remains gated on homelab 4th-round re-verify."*
-Homelab (the required third principal) returned **FAIL @1c34e3cb** (static, nothing executed), and Mos
-**UPHELD** it after independently confirming the finding in-source AND empirically on host Py3.11.2 —
-so the v9 byte-clear this document records is **SUPERSEDED** and does **NOT** authorize FIRE.
-
-**Residual startup-closure hole (empirically reproduced by Mos; accepted as gate-STRENGTHENING):**
-neither child carries `-S`, so CPython imports the `site` module **before** the script runs. `-s`
-(launcher) suppresses only *user*-site; `-I` (broker) implies `-s -E -P` but **NOT** `-S`. Proven:
-
-    [-s  -B ]  no_site=0  site_imported=True    ← v9 launcher: site runs
-    [-I  -B ]  no_site=0  site_imported=True    ← v9 broker: -I does NOT imply -S
-    [-s -S -B] no_site=1  site_imported=False   ← v10 launcher fix (sibling import STILL resolves)
-    [-I -S -B] no_site=1  site_imported=False   ← v10 broker fix (additive)
-
-System-site executable `.pth` lines + sitecustomize/usercustomize can therefore run **unpinned startup
-code** before the exact launcher/broker and **outside** `closure_import_guard`, while every hash +
-`reject_pinned_bytecode` + import-guard still pass — defeating hashed==executed on the full *startup*
-closure (strictly wider than the module-import closure v9 cleared). A genuine fidelity hole for a
-fail-closed DO-178C evidence gate.
-
-Mos **authorized the bounded v10 repair**: add `-S` to the **launcher** (keep `-s -B`, NOT `-I`) and
-to the **broker** (keep `-I -B`) — a minimal 2-line delta; no B6c regression (launcher `-s -S -B`
-sibling import empirically intact; `-S` does not touch `sys.path[0]`). Added review bar **B9**
-(no-site startup closure). This **rides the existing (ii)-full-closure authorization + R1 + Mos
-adjudication** (deepens startup-closure isolation of an already-authorized touch, inside the fixture
-temp root, no fresh Jason owner-window) and is **NOT a Case-C escalation** (static pre-fire catch, no
-probe fired). A separate **FIRE-time** constraint is captured: the 3× isolation dispatch must launch
-the runner under externally-enforced `python -I -S -B` (a self-reexec is too late).
-
-**Live target = v10** (no-site harness, forthcoming). `1c34e3cb` / `e1c9a468` / this co-attestation
-(`f320d075`) are **SUPERSEDED**; the prior 2-of-3 (ms-secrev-828 v9 §3 PASS + `f320d075`) does NOT
-carry — all three distinct-identity principals re-verify the new v10 SHA. A fresh Mos co-attestation
-will be committed on v10 byte-verify PASS. WI-3 #830 remains HELD at `f4008307`; nothing banked;
-C-hatch armed (fired-rig only); NO FIRE.