chore(orchestrator): fix pre-existing #868 README prettier drift

packages/mosaic/framework/tools/orchestrator/README.md fails
`pnpm format:check` on origin/main as-is (confirmed against the
unmodified origin/main blob directly, unrelated to this branch's
Patch-3 change). The repo-wide mandatory pre-push hook
(`pnpm typecheck && pnpm lint && pnpm format:check`) blocks any push
based on current main until this is fixed.

Whitespace/table-alignment only via `prettier --write` -- no content
change. Kept as its own commit so blame stays clean and this no-ops
cleanly whenever #868's own fix lands on main first.

packages/mosaic/framework/systemd/user/mosaic-lease-broker.service

@@ -1,22 +0,0 @@
-[Unit]
-Description=Mosaic lease broker daemon (framework tools/lease-broker/daemon.py)
-Documentation=https://git.mosaicstack.dev/mosaicstack/stack
-After=default.target
-
-[Service]
-Type=simple
-# The broker socket lives under the runtime directory so it disappears with
-# the user session instead of surviving as stale state across logins.
-# daemon.py's secure_parent() fails closed unless this directory is exactly
-# 0700, so RuntimeDirectoryMode is not cosmetic.
-RuntimeDirectory=mosaic-lease
-RuntimeDirectoryMode=0700
-# Remove loader and noninteractive-shell controls before ExecStart loads env,
-# matching the tmux fleet units in this same directory.
-UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
-ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin XDG_RUNTIME_DIR=%t /bin/bash --noprofile --norc %h/.config/mosaic/tools/lease-broker/start-lease-broker.sh
-Restart=on-failure
-RestartSec=1
-
-[Install]
-WantedBy=default.target

packages/mosaic/framework/tools/git/ci-queue-wait.ps1

@@ -185,6 +185,16 @@ switch ($platform) {
             $headSha = ($branchPayload.commit.id | Out-String).Trim()
         }
         catch {
+            # A not-yet-pushed feature branch has no in-flight pipeline, so the
+            # pre-push queue guard must treat 404 as "queue clear", not crash.
+            $statusCode = $null
+            if ($_.Exception.Response) {
+                $statusCode = [int]$_.Exception.Response.StatusCode
+            }
+            if ($statusCode -eq 404) {
+                Write-Host "[ci-queue-wait] branch $Branch not yet on remote — no in-flight pipeline; queue clear."
+                exit 0
+            }
             Write-Error "Could not resolve $Branch head SHA from Gitea API."
             exit 1
         }

packages/mosaic/framework/tools/git/ci-queue-wait.sh

@@ -137,7 +137,21 @@ gitea_get_branch_head_sha() {
     local branch="$3"
     local token="$4"
     local url="https://${host}/api/v1/repos/${repo}/branches/${branch}"
-    curl -fsSL -H "User-Agent: curl/8" -H "Authorization: token ${token}" "$url" | python3 -c '
+    # Capture HTTP status so an absent branch (404) is distinguished from an API
+    # error. A not-yet-pushed feature branch has no in-flight pipeline, so the
+    # pre-push queue guard must treat 404 as "queue clear", not crash.
+    local resp code body
+    resp=$(curl -sS -H "User-Agent: curl/8" -H "Authorization: token ${token}" -w $'\n%{http_code}' "$url")
+    code="${resp##*$'\n'}"
+    body="${resp%$'\n'*}"
+    if [[ "$code" == "404" ]]; then
+        echo "__BRANCH_ABSENT__"
+        return 0
+    fi
+    if [[ "$code" != "200" ]]; then
+        return 1
+    fi
+    printf '%s' "$body" | python3 -c '
 import json, sys
 data = json.load(sys.stdin)
 commit = data.get("commit") or {}
@@ -219,6 +233,10 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
         exit 1
     }
     HEAD_SHA=$(gitea_get_branch_head_sha "$HOST" "$OWNER/$REPO" "$BRANCH" "$TOKEN")
+    if [[ "$HEAD_SHA" == "__BRANCH_ABSENT__" ]]; then
+        echo "[ci-queue-wait] branch ${BRANCH} not yet on remote — no in-flight pipeline; queue clear."
+        exit 0
+    fi
     if [[ -z "$HEAD_SHA" ]]; then
         echo "Error: Could not resolve ${BRANCH} head SHA." >&2
         exit 1

packages/mosaic/framework/tools/git/test-ci-queue-wait-branch-absent.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Regression harness for ci-queue-wait.sh's 404-branch-absent handling.
+#
+# gitea_get_branch_head_sha() resolves a branch's head SHA before the
+# pre-push queue guard runs. A branch that has never been pushed doesn't
+# exist on the remote yet, so Gitea's branches/<branch> endpoint 404s.
+# Before the fix, `curl -fsSL` failed on the 404, its empty stdout was piped
+# into `python3 -c 'json.load(sys.stdin)'`, and the resulting
+# JSONDecodeError crashed the guard -- blocking every new feature branch's
+# first push. The fix must treat 404 as "no in-flight pipeline" (queue
+# clear) while still failing closed on a genuine API error.
+#
+# Covers:
+#   (a) 404 branch-absent          -> exit 0, "queue clear" message.
+#   (b) 200 existing branch + a terminal CI state -> unchanged behavior.
+#   (c) genuine API error (500)    -> still fail-closed (nonzero exit).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/ci-queue-wait-branch-absent}"
+REPO_DIR="$WORK_DIR/repo"
+STUB_DIR="$WORK_DIR/stubs"
+
+rm -rf "$WORK_DIR"
+mkdir -p "$REPO_DIR" "$STUB_DIR"
+
+git -C "$REPO_DIR" init -q
+git -C "$REPO_DIR" remote add origin https://git.example.test/acme/widgets.git
+
+# Minimal curl stub. Selects a canned response by inspecting which Gitea
+# endpoint is being hit (branches/<branch> vs commits/<sha>/status) and
+# whether -w '%{http_code}' was requested. Only the patched branch-lookup
+# call passes -w; the unpatched call and the (unchanged) status call both
+# use plain `curl -fsSL` semantics -- exit nonzero and print nothing on a
+# non-2xx response. This lets the same stub exercise both the pre-fix and
+# post-fix branch-lookup code paths faithfully.
+cat > "$STUB_DIR/curl" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+
+has_w=0
+url=""
+for arg in "$@"; do
+    case "$arg" in
+        -w) has_w=1 ;;
+        http://*|https://*) url="$arg" ;;
+    esac
+done
+
+case "$url" in
+    */branches/*) mode="${MOSAIC_STUB_BRANCH_MODE:?MOSAIC_STUB_BRANCH_MODE not set}" ;;
+    */status)     mode="${MOSAIC_STUB_STATUS_MODE:-terminal-success}" ;;
+    *)
+        echo "curl stub: unrecognized URL: $url" >&2
+        exit 2
+        ;;
+esac
+
+case "$mode" in
+    404)  code=404; body="" ;;
+    200)  code=200; body='{"commit":{"id":"deadbeefcafef00d0123456789abcdef01234567"}}' ;;
+    500)  code=500; body='{"message":"internal server error"}' ;;
+    no-status)         code=200; body='{}' ;;
+    terminal-success)  code=200; body='{"state":"success"}' ;;
+    *)
+        echo "curl stub: unknown mode=$mode" >&2
+        exit 2
+        ;;
+esac
+
+if [[ "$has_w" == 1 ]]; then
+    printf '%s\n%s' "$body" "$code"
+    exit 0
+fi
+
+# Unpatched branch-lookup call / status-endpoint call: real curl -fsSL
+# exits nonzero and emits nothing on stdout for a non-2xx response.
+if [[ "$code" != "200" ]]; then
+    exit 22
+fi
+printf '%s' "$body"
+SH
+chmod +x "$STUB_DIR/curl"
+
+run_ci_queue_wait() {
+    local branch="$1"
+    (
+        cd "$REPO_DIR"
+        export PATH="$STUB_DIR:$PATH"
+        export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json"
+        export GITEA_TOKEN="stub-token"
+        export GITEA_URL="https://git.example.test"
+        "$SCRIPT_DIR/ci-queue-wait.sh" -B "$branch" --purpose push -t 5 -i 1
+    )
+}
+
+fail=0
+
+# (a) 404 branch-absent -> queue clear, exit 0.
+set +e
+out_a=$(MOSAIC_STUB_BRANCH_MODE=404 run_ci_queue_wait "feat/not-pushed-yet" 2>&1)
+status_a=$?
+set -e
+if [[ "$status_a" -ne 0 ]]; then
+    echo "FAIL(a): expected exit 0 for 404 branch-absent, got $status_a" >&2
+    echo "$out_a" >&2
+    fail=1
+elif [[ "$out_a" != *"queue clear"* ]]; then
+    echo "FAIL(a): expected a queue-clear message, got:" >&2
+    echo "$out_a" >&2
+    fail=1
+fi
+
+# (b) 200 existing branch + terminal CI state -> unchanged behavior, exit 0.
+set +e
+out_b=$(MOSAIC_STUB_BRANCH_MODE=200 MOSAIC_STUB_STATUS_MODE=terminal-success run_ci_queue_wait "main" 2>&1)
+status_b=$?
+set -e
+if [[ "$status_b" -ne 0 ]]; then
+    echo "FAIL(b): expected exit 0 for existing branch with terminal status, got $status_b" >&2
+    echo "$out_b" >&2
+    fail=1
+elif [[ "$out_b" != *"sha=deadbeefcafef00d0123456789abcdef01234567"* ]]; then
+    echo "FAIL(b): expected the resolved HEAD SHA to be logged, got:" >&2
+    echo "$out_b" >&2
+    fail=1
+elif [[ "$out_b" == *"queue clear"* ]]; then
+    echo "FAIL(b): an existing branch must not take the branch-absent path" >&2
+    echo "$out_b" >&2
+    fail=1
+fi
+
+# (c) genuine API error (500) -> still fail-closed, exit nonzero.
+set +e
+out_c=$(MOSAIC_STUB_BRANCH_MODE=500 run_ci_queue_wait "feat/some-branch" 2>&1)
+status_c=$?
+set -e
+if [[ "$status_c" -eq 0 ]]; then
+    echo "FAIL(c): expected a nonzero exit for a genuine 500 API error, got 0" >&2
+    echo "$out_c" >&2
+    fail=1
+elif [[ "$out_c" == *"queue clear"* ]]; then
+    echo "FAIL(c): a genuine API error must not be reported as queue-clear" >&2
+    echo "$out_c" >&2
+    fail=1
+fi
+
+if [[ "$fail" -eq 0 ]]; then
+    echo "ci-queue-wait branch-absent regression passed (3/3 cases)"
+fi
+
+exit "$fail"

packages/mosaic/framework/tools/lease-broker/start-lease-broker.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# Supervisor entry point for the Mosaic lease broker daemon (issue #869, C3).
-#
-# Resolves the broker socket path with the SAME precedence as
-# `defaultLeaseBrokerSocket` in `packages/mosaic/src/commands/launch.ts`, so a
-# gated runtime launched through that client always finds the socket this
-# supervisor creates:
-#   1. an explicit MOSAIC_LEASE_BROKER_SOCKET
-#   2. "$XDG_RUNTIME_DIR/mosaic-lease/broker.sock"
-#   3. "/run/user/<uid>/mosaic-lease/broker.sock"
-#
-# The state file is colocated next to the socket (same directory,
-# "state.json"), mirroring how the broker already colocates its per-session
-# generation files beside the socket.
-#
-# This script never installs, enables, or starts the systemd unit that calls
-# it; it is only ever invoked BY that unit (or by a human/test harness that
-# passes its own HOME/XDG_RUNTIME_DIR).
-set -euo pipefail
-
-SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
-
-if [ -n "${MOSAIC_LEASE_BROKER_SOCKET:-}" ]; then
-  SOCKET="$MOSAIC_LEASE_BROKER_SOCKET"
-else
-  RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
-  SOCKET="$RUNTIME_DIR/mosaic-lease/broker.sock"
-fi
-STATE="$(dirname -- "$SOCKET")/state.json"
-
-exec python3 "$SCRIPT_DIR/daemon.py" --socket "$SOCKET" --state "$STATE"

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/lease-broker/broker-supervisor.spec.ts

@@ -1,237 +0,0 @@
-import { createServer, type Server } from 'node:net';
-import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { afterEach, describe, expect, it } from 'vitest';
-
-import {
-  applyBrokerSupervisor,
-  checkBrokerSupervisorHealth,
-  isBrokerSupervisorHealthy,
-  resolveBrokerSupervisorPaths,
-  resolveLeaseBrokerSocketPath,
-  type BrokerSupervisorPaths,
-} from './broker-supervisor.js';
-
-const REAL_FRAMEWORK_ROOT = new URL('../../framework/', import.meta.url).pathname;
-
-const cleanupDirs: string[] = [];
-const cleanupServers: Server[] = [];
-
-async function tempDir(prefix: string): Promise<string> {
-  const dir = await mkdtemp(join(tmpdir(), prefix));
-  cleanupDirs.push(dir);
-  return dir;
-}
-
-afterEach(async () => {
-  for (const server of cleanupServers.splice(0)) {
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-  }
-  for (const dir of cleanupDirs.splice(0)) {
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-describe('resolveLeaseBrokerSocketPath', () => {
-  it('honors an explicit MOSAIC_LEASE_BROKER_SOCKET override', () => {
-    expect(resolveLeaseBrokerSocketPath({ MOSAIC_LEASE_BROKER_SOCKET: '/tmp/explicit.sock' })).toBe(
-      '/tmp/explicit.sock',
-    );
-  });
-
-  it('falls back to $XDG_RUNTIME_DIR/mosaic-lease/broker.sock', () => {
-    expect(resolveLeaseBrokerSocketPath({ XDG_RUNTIME_DIR: '/run/user/1000' })).toBe(
-      join('/run/user/1000', 'mosaic-lease', 'broker.sock'),
-    );
-  });
-
-  it('falls back to /run/user/<uid>/mosaic-lease/broker.sock as a last resort', () => {
-    expect(resolveLeaseBrokerSocketPath({}, 4242)).toBe(
-      join('/run/user', '4242', 'mosaic-lease', 'broker.sock'),
-    );
-  });
-
-  it('prefers the explicit override over XDG_RUNTIME_DIR', () => {
-    expect(
-      resolveLeaseBrokerSocketPath({
-        MOSAIC_LEASE_BROKER_SOCKET: '/explicit.sock',
-        XDG_RUNTIME_DIR: '/run/user/1000',
-      }),
-    ).toBe('/explicit.sock');
-  });
-});
-
-describe('resolveBrokerSupervisorPaths', () => {
-  it('colocates the state file next to the resolved socket', () => {
-    const paths = resolveBrokerSupervisorPaths({
-      mosaicHome: '/home/x/.config/mosaic',
-      frameworkRoot: '/repo/framework',
-      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
-    });
-    expect(paths.socketPath).toBe(join('/run/user/1000', 'mosaic-lease', 'broker.sock'));
-    expect(paths.statePath).toBe(join('/run/user/1000', 'mosaic-lease', 'state.json'));
-  });
-
-  it('targets the systemd --user dir under the given home, not mosaicHome', () => {
-    const paths = resolveBrokerSupervisorPaths({
-      mosaicHome: '/somewhere-else/.config/mosaic',
-      frameworkRoot: '/repo/framework',
-      homeDir: '/home/canary',
-      env: {},
-      uid: 0,
-    });
-    expect(paths.systemdUserDir).toBe(join('/home/canary', '.config', 'systemd', 'user'));
-    expect(paths.unitTargetPath).toBe(
-      join('/home/canary', '.config', 'systemd', 'user', 'mosaic-lease-broker.service'),
-    );
-  });
-
-  it('is a pure function: identical options resolve to identical paths', () => {
-    const options = {
-      mosaicHome: '/h/.config/mosaic',
-      frameworkRoot: '/repo/framework',
-      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
-    };
-    expect(resolveBrokerSupervisorPaths(options)).toEqual(resolveBrokerSupervisorPaths(options));
-  });
-});
-
-describe('applyBrokerSupervisor', () => {
-  async function fakePaths(): Promise<BrokerSupervisorPaths> {
-    const home = await tempDir('mosaic-broker-supervisor-home-');
-    const mosaicHome = join(home, '.config', 'mosaic');
-    const runtimeDir = await tempDir('mosaic-broker-supervisor-runtime-');
-    return resolveBrokerSupervisorPaths({
-      mosaicHome,
-      frameworkRoot: REAL_FRAMEWORK_ROOT,
-      homeDir: home,
-      env: { XDG_RUNTIME_DIR: runtimeDir },
-    });
-  }
-
-  it('renders a unit that references the installed wrapper script and hardens the runtime dir', async () => {
-    const paths = await fakePaths();
-    const unitSource = await readFile(paths.unitSourcePath, 'utf8');
-    expect(unitSource).toContain('ExecStart=');
-    expect(unitSource).toContain('%h/.config/mosaic/tools/lease-broker/start-lease-broker.sh');
-    expect(unitSource).toContain('RuntimeDirectory=mosaic-lease');
-    expect(unitSource).toContain('RuntimeDirectoryMode=0700');
-    expect(unitSource).toContain('Restart=on-failure');
-    expect(unitSource).toContain('WantedBy=default.target');
-    // No ambient environment file preload, matching the other fleet units'
-    // strict-parsing convention.
-    expect(unitSource).not.toMatch(/^Environment(File)?=/m);
-  });
-
-  it('materializes the unit, wrapper script, and daemon sources on first apply', async () => {
-    const paths = await fakePaths();
-
-    const result = await applyBrokerSupervisor(paths);
-
-    expect(result.installedFiles).toContain(paths.unitTargetPath);
-    expect(result.installedFiles).toContain(paths.wrapperTargetPath);
-    for (const target of paths.daemonTargetPaths) {
-      expect(result.installedFiles).toContain(target);
-    }
-
-    const unitTargetContent = await readFile(paths.unitTargetPath, 'utf8');
-    const unitSourceContent = await readFile(paths.unitSourcePath, 'utf8');
-    expect(unitTargetContent).toBe(unitSourceContent);
-
-    const wrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
-    expect(wrapperMode).toBe(0o755);
-
-    for (const target of paths.daemonTargetPaths) {
-      await expect(stat(target)).resolves.toBeDefined();
-    }
-  });
-
-  it('is idempotent: applying twice reproduces identical files with no error', async () => {
-    const paths = await fakePaths();
-
-    await applyBrokerSupervisor(paths);
-    const firstUnit = await readFile(paths.unitTargetPath, 'utf8');
-    const firstWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
-    const firstWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
-
-    await expect(applyBrokerSupervisor(paths)).resolves.toBeDefined();
-
-    const secondUnit = await readFile(paths.unitTargetPath, 'utf8');
-    const secondWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
-    const secondWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
-
-    expect(secondUnit).toBe(firstUnit);
-    expect(secondWrapper).toBe(firstWrapper);
-    expect(secondWrapperMode).toBe(firstWrapperMode);
-  });
-
-  it('never touches the real host: only writes under the supplied temp dirs', async () => {
-    const paths = await fakePaths();
-    await applyBrokerSupervisor(paths);
-    expect(paths.systemdUserDir.startsWith(tmpdir())).toBe(true);
-    expect(paths.mosaicHome.startsWith(tmpdir())).toBe(true);
-  });
-});
-
-describe('checkBrokerSupervisorHealth / isBrokerSupervisorHealthy', () => {
-  async function fakeHealthPaths(): Promise<
-    Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>
-  > {
-    const runtimeDir = await tempDir('mosaic-broker-supervisor-health-');
-    await mkdir(join(runtimeDir, 'systemd-user'), { recursive: true });
-    return {
-      unitTargetPath: join(runtimeDir, 'systemd-user', 'mosaic-lease-broker.service'),
-      socketPath: join(runtimeDir, 'broker.sock'),
-    };
-  }
-
-  it('reports unhealthy when neither the unit nor the socket exist', async () => {
-    const paths = await fakeHealthPaths();
-
-    const health = await checkBrokerSupervisorHealth(paths);
-
-    expect(health).toEqual({ unitInstalled: false, socketPresent: false, healthy: false });
-    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
-  });
-
-  it('reports unhealthy when the unit is installed but no socket is listening', async () => {
-    const paths = await fakeHealthPaths();
-    await writeFile(paths.unitTargetPath, '[Unit]\n');
-
-    const health = await checkBrokerSupervisorHealth(paths);
-
-    expect(health.unitInstalled).toBe(true);
-    expect(health.socketPresent).toBe(false);
-    expect(health.healthy).toBe(false);
-  });
-
-  it('reports healthy=true once a real Unix socket exists at the resolved path, and false again once removed', async () => {
-    const paths = await fakeHealthPaths();
-
-    const server = createServer();
-    cleanupServers.push(server);
-    await new Promise<void>((resolve, reject) => {
-      server.once('error', reject);
-      server.listen(paths.socketPath, resolve);
-    });
-
-    expect(await isBrokerSupervisorHealthy(paths)).toBe(true);
-    const health = await checkBrokerSupervisorHealth(paths);
-    expect(health.socketPresent).toBe(true);
-    expect(health.healthy).toBe(true);
-
-    await new Promise<void>((resolve) => server.close(() => resolve()));
-    await rm(paths.socketPath, { force: true });
-
-    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
-  });
-
-  it('does not confuse a stale regular file at the socket path with a live socket', async () => {
-    const paths = await fakeHealthPaths();
-    await writeFile(paths.socketPath, 'not actually a socket');
-
-    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
-  });
-});

packages/mosaic/src/lease-broker/broker-supervisor.ts

@@ -1,223 +0,0 @@
-/**
- * Activation-side supervisor for the Mosaic lease broker (issue #869, Point-1
- * C3). #828 shipped fail-closed enforcement hooks (`mutator-gate.py`,
- * `receipt-observer-client.py`) with nothing that guaranteed `daemon.py` was
- * running or that its socket existed before a gated runtime started. This
- * module:
- *
- *  - resolves the broker socket/state paths and the on-disk locations of the
- *    supervisor artifacts, deterministically and consistently with
- *    `defaultLeaseBrokerSocket` in `../commands/launch.ts`;
- *  - idempotently applies (materializes) a systemd `--user` unit plus the
- *    wrapper script and daemon sources it execs, mirroring the tmux fleet
- *    unit convention in `framework/systemd/user/`;
- *  - exposes a health predicate other cards (e.g. the C1 activation probe)
- *    can call to learn whether a broker supervisor is present and healthy.
- *
- * `applyBrokerSupervisor` only writes files under the paths it is given. It
- * never runs `systemctl`, never starts `daemon.py`, and never touches a real
- * host's `~/.config` unless the caller explicitly resolves paths there.
- * Enabling/starting the unit is a separate, later, out-of-scope step.
- */
-import { chmod, copyFile, mkdir, stat } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-
-const UNIT_NAME = 'mosaic-lease-broker.service';
-const WRAPPER_SCRIPT_NAME = 'start-lease-broker.sh';
-
-/** Co-located modules `daemon.py` imports at runtime; kept alongside it. */
-const DAEMON_SOURCE_FILE_NAMES = [
-  'daemon.py',
-  'lease_generation.py',
-  'normative_fragments.py',
-  'receipt_challenge.py',
-  'receipt_observer.py',
-] as const;
-
-export interface ResolveBrokerSupervisorPathsOptions {
-  /** `~/.config/mosaic` (or an override) — where installed tool copies live. */
-  mosaicHome: string;
-  /** Root of the checked-out `framework/` directory (canonical file source). */
-  frameworkRoot: string;
-  /** Defaults to `process.env`; pass a fake for tests. */
-  env?: NodeJS.ProcessEnv;
-  /** Defaults to `os.homedir()`; pass a temp dir in tests. */
-  homeDir?: string;
-  /** Defaults to `process.getuid()` (or 0); pass a fake for tests. */
-  uid?: number;
-}
-
-export interface BrokerSupervisorPaths {
-  readonly mosaicHome: string;
-  readonly frameworkRoot: string;
-  readonly systemdUserDir: string;
-  readonly leaseBrokerToolsDir: string;
-  readonly unitSourcePath: string;
-  readonly unitTargetPath: string;
-  readonly wrapperSourcePath: string;
-  readonly wrapperTargetPath: string;
-  readonly daemonSourcePaths: readonly string[];
-  readonly daemonTargetPaths: readonly string[];
-  /**
-   * Resolved with the same precedence as `defaultLeaseBrokerSocket` in
-   * `../commands/launch.ts`: an explicit `MOSAIC_LEASE_BROKER_SOCKET`, else
-   * `$XDG_RUNTIME_DIR/mosaic-lease/broker.sock`, else
-   * `/run/user/<uid>/mosaic-lease/broker.sock`.
-   */
-  readonly socketPath: string;
-  /** Colocated next to the socket, matching the broker's own generation-file convention. */
-  readonly statePath: string;
-}
-
-/**
- * Resolve the lease broker socket path alone, with the same precedence as
- * `defaultLeaseBrokerSocket` in `../commands/launch.ts`. Exported so callers
- * (and tests) can assert the two stay in agreement without importing the CLI
- * command module.
- */
-export function resolveLeaseBrokerSocketPath(
-  env: NodeJS.ProcessEnv = process.env,
-  uid: number = typeof process.getuid === 'function' ? process.getuid() : 0,
-): string {
-  const explicit = env['MOSAIC_LEASE_BROKER_SOCKET'];
-  if (explicit) return explicit;
-  const runtimeDir = env['XDG_RUNTIME_DIR'];
-  if (runtimeDir) return join(runtimeDir, 'mosaic-lease', 'broker.sock');
-  return join('/run/user', String(uid), 'mosaic-lease', 'broker.sock');
-}
-
-/** Resolve every path the supervisor apply/health functions need, deterministically. */
-export function resolveBrokerSupervisorPaths(
-  options: ResolveBrokerSupervisorPathsOptions,
-): BrokerSupervisorPaths {
-  const { mosaicHome, frameworkRoot } = options;
-  const env = options.env ?? process.env;
-  const homeDir = options.homeDir ?? homedir();
-  const systemdUserDir = join(homeDir, '.config', 'systemd', 'user');
-  const leaseBrokerToolsDir = join(mosaicHome, 'tools', 'lease-broker');
-  const frameworkLeaseBrokerDir = join(frameworkRoot, 'tools', 'lease-broker');
-  const socketPath = resolveLeaseBrokerSocketPath(env, options.uid);
-  const statePath = join(dirname(socketPath), 'state.json');
-
-  return {
-    mosaicHome,
-    frameworkRoot,
-    systemdUserDir,
-    leaseBrokerToolsDir,
-    unitSourcePath: join(frameworkRoot, 'systemd', 'user', UNIT_NAME),
-    unitTargetPath: join(systemdUserDir, UNIT_NAME),
-    wrapperSourcePath: join(frameworkLeaseBrokerDir, WRAPPER_SCRIPT_NAME),
-    wrapperTargetPath: join(leaseBrokerToolsDir, WRAPPER_SCRIPT_NAME),
-    daemonSourcePaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(frameworkLeaseBrokerDir, name)),
-    daemonTargetPaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(leaseBrokerToolsDir, name)),
-    socketPath,
-    statePath,
-  };
-}
-
-export interface ApplyBrokerSupervisorResult {
-  readonly installedFiles: readonly string[];
-}
-
-/**
- * Idempotently materialize the supervisor unit, its wrapper script, and the
- * daemon sources it execs. Safe to call on every reseed: every write is a
- * deterministic overwrite of the same target path from the same source, so a
- * second call reproduces identical bytes/modes and never errors.
- *
- * Never runs `systemctl`; the caller decides separately whether/when to
- * `daemon-reload`/`enable`/`start` the installed unit.
- */
-export async function applyBrokerSupervisor(
-  paths: BrokerSupervisorPaths,
-): Promise<ApplyBrokerSupervisorResult> {
-  await mkdir(paths.leaseBrokerToolsDir, { recursive: true });
-  await mkdir(paths.systemdUserDir, { recursive: true });
-
-  const installedFiles: string[] = [];
-
-  for (let index = 0; index < paths.daemonSourcePaths.length; index += 1) {
-    const source = paths.daemonSourcePaths[index];
-    const target = paths.daemonTargetPaths[index];
-    if (source === undefined || target === undefined) continue;
-    await copyFile(source, target);
-    await chmod(target, 0o644);
-    installedFiles.push(target);
-  }
-
-  await copyFile(paths.wrapperSourcePath, paths.wrapperTargetPath);
-  await chmod(paths.wrapperTargetPath, 0o755);
-  installedFiles.push(paths.wrapperTargetPath);
-
-  await copyFile(paths.unitSourcePath, paths.unitTargetPath);
-  await chmod(paths.unitTargetPath, 0o644);
-  installedFiles.push(paths.unitTargetPath);
-
-  return { installedFiles };
-}
-
-export interface BrokerSupervisorHealth {
-  /** Whether the systemd unit file has been materialized at its target path. */
-  readonly unitInstalled: boolean;
-  /** Whether a Unix domain socket currently exists at the resolved socket path. */
-  readonly socketPresent: boolean;
-  /**
-   * The signal other cards (e.g. C1's activation probe) should treat as
-   * "a broker supervisor is present and healthy". Presence of a live socket
-   * is the authoritative signal: a gated runtime can only ever succeed by
-   * connecting to it, so this is what fail-closed callers must check.
-   */
-  readonly healthy: boolean;
-}
-
-/**
- * Report the supervisor's on-disk/health signals. Never throws for an
- * absent unit or socket — both simply report `false`; unexpected filesystem
- * errors (permission issues, etc.) still propagate.
- */
-export async function checkBrokerSupervisorHealth(
-  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
-): Promise<BrokerSupervisorHealth> {
-  const [unitInstalled, socketPresent] = await Promise.all([
-    pathExists(paths.unitTargetPath),
-    isUnixSocket(paths.socketPath),
-  ]);
-  return { unitInstalled, socketPresent, healthy: socketPresent };
-}
-
-/** Convenience boolean form of {@link checkBrokerSupervisorHealth} for simple call sites. */
-export async function isBrokerSupervisorHealthy(
-  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
-): Promise<boolean> {
-  return (await checkBrokerSupervisorHealth(paths)).healthy;
-}
-
-async function pathExists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch (error) {
-    if (isEnoent(error)) return false;
-    throw error;
-  }
-}
-
-async function isUnixSocket(path: string): Promise<boolean> {
-  try {
-    const info = await stat(path);
-    return info.isSocket();
-  } catch (error) {
-    if (isEnoent(error)) return false;
-    throw error;
-  }
-}
-
-function isEnoent(error: unknown): boolean {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    'code' in error &&
-    (error as NodeJS.ErrnoException).code === 'ENOENT'
-  );
-}