feat(fleet): update-surviving persona overrides (roles.local layer, resolver, persona CLI) (H4)

Add a PRESERVE-protected persona override layer at <mosaicHome>/fleet/roles.local/
that survives `mosaic update` while baseline fleet/roles/ keeps reseeding.

- fleet-personas.ts: shared class-extraction (single source of truth, DRY with
  fleet-profiles.ts), resolvePersona (override wins, baseline fallback),
  listPersonaClasses (baseline ⊕ override union), personaStatus
  (baseline/overridden/custom), and the `fleet persona list|show|customize` CLI.
- fleet-profiles.ts: roster validation now uses the override-aware union so a
  profile can reference a user-customized or user-ADDED persona; the old
  listPersonaClasses(rolesDir) is kept as a thin delegate to the shared helper.
- install.sh: add fleet/roles.local to PRESERVE_PATHS (AC-NS-7 guarantee).
- specs: override-wins, custom-add, status classification, AC-NS-7
  update-survival simulation, and profile-validation-accepts-custom-persona.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/gateway/src/federation/client/__tests__/query-source.service.spec.ts

@@ -1,255 +0,0 @@
-import 'reflect-metadata';
-import { describe, expect, it, vi } from 'vitest';
-import type { Db } from '@mosaicstack/db';
-import type { FederationListResponse } from '@mosaicstack/types';
-import {
-  FederationClientError,
-  type FederationClientService,
-} from '../federation-client.service.js';
-import { type QuerySourceError, QuerySourceService } from '../query-source.service.js';
-
-interface TestRow {
-  id: string;
-  title: string;
-}
-
-interface PeerRow {
-  id: string;
-  commonName: string;
-  endpointUrl: string | null;
-  clientKeyPem: string | null;
-  state: 'active' | 'pending' | 'suspended' | 'revoked';
-}
-
-const LOCAL_ROWS: TestRow[] = [
-  { id: 'local-1', title: 'Local One' },
-  { id: 'local-2', title: 'Local Two' },
-];
-
-const PEER_A: PeerRow = {
-  id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-  commonName: 'peer-a',
-  endpointUrl: 'https://peer-a.example.com',
-  clientKeyPem: 'sealed-key-a',
-  state: 'active',
-};
-
-const PEER_B: PeerRow = {
-  id: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
-  commonName: 'peer-b',
-  endpointUrl: 'https://peer-b.example.com',
-  clientKeyPem: 'sealed-key-b',
-  state: 'active',
-};
-
-const PEER_LOCALHOST: PeerRow = {
-  id: 'cccccccc-cccc-cccc-cccc-cccccccccccc',
-  commonName: 'peer-localhost',
-  endpointUrl: 'https://localhost:3001',
-  clientKeyPem: 'sealed-key-c',
-  state: 'active',
-};
-
-function makeDb(activePeers: PeerRow[]): Db {
-  const orderBy = vi.fn().mockResolvedValue(activePeers);
-  const where = vi.fn().mockReturnValue({ orderBy });
-  const from = vi.fn().mockReturnValue({ where });
-  const select = vi.fn().mockReturnValue({ from });
-
-  return {
-    select,
-    insert: vi.fn(),
-    update: vi.fn(),
-    delete: vi.fn(),
-    transaction: vi.fn(),
-  } as unknown as Db;
-}
-
-function makeFederationClient(
-  list: (
-    peerId: string,
-    resource: string,
-    request: Record<string, unknown>,
-  ) => Promise<FederationListResponse<TestRow>>,
-): FederationClientService {
-  return {
-    list: list as unknown as FederationClientService['list'],
-  } as FederationClientService;
-}
-
-function makeLocalResponse(rows: TestRow[] = LOCAL_ROWS): Promise<FederationListResponse<TestRow>> {
-  return Promise.resolve({ items: rows });
-}
-
-describe('QuerySourceService', () => {
-  it('routes source="local" to the local executor and tags rows as local', async () => {
-    const list = vi.fn(async (): Promise<FederationListResponse<TestRow>> => ({ items: [] }));
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'local',
-      resource: 'tasks',
-      request: { cursor: 'ignored-for-local-test' },
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'local-2', title: 'Local Two', _source: 'local' },
-      ],
-    });
-    expect(list).not.toHaveBeenCalled();
-  });
-
-  it('routes source="federated:<host>" to the matching active peer and tags rows with peer commonName', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-1', title: 'Remote One' }],
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'federated:peer-b.example.com',
-      resource: 'tasks',
-      request: { status: 'open' },
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [{ id: 'remote-1', title: 'Remote One', _source: 'peer-b' }],
-    });
-    expect(list).toHaveBeenCalledWith(PEER_B.id, 'tasks', { status: 'open' });
-  });
-
-  it('matches federated hosts by endpoint host including non-default port', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-port', title: 'Remote Port' }],
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_LOCALHOST]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'federated:localhost:3001',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [{ id: 'remote-port', title: 'Remote Port', _source: 'peer-localhost' }],
-    });
-    expect(list).toHaveBeenCalledWith(PEER_LOCALHOST.id, 'tasks', {});
-  });
-
-  it('fans out source="all" to local plus every active outbound peer in parallel and merges tagged rows', async () => {
-    const callOrder: string[] = [];
-    const list = vi.fn(async (peerId: string): Promise<FederationListResponse<TestRow>> => {
-      callOrder.push(`remote-start:${peerId}`);
-      await Promise.resolve();
-      return {
-        items: [{ id: `remote-${peerId.slice(0, 1)}`, title: `Remote ${peerId.slice(0, 1)}` }],
-      };
-    });
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: { limit: 25 },
-      local: async () => {
-        callOrder.push('local-start');
-        await Promise.resolve();
-        return { items: [{ id: 'local-1', title: 'Local One' }] };
-      },
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote a', _source: 'peer-a' },
-        { id: 'remote-b', title: 'Remote b', _source: 'peer-b' },
-      ],
-    });
-    expect(list).toHaveBeenCalledTimes(2);
-    expect(callOrder).toEqual([
-      'local-start',
-      `remote-start:${PEER_A.id}`,
-      `remote-start:${PEER_B.id}`,
-    ]);
-  });
-
-  it('marks source="all" as partial and truncated when any subquery returns a cursor', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-a', title: 'Remote A' }],
-        nextCursor: 'remote-next',
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse([{ id: 'local-1', title: 'Local One' }]),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote A', _source: 'peer-a' },
-      ],
-      _partial: true,
-      _truncated: true,
-    });
-  });
-
-  it('returns _partial=true for source="all" when one peer fails without dropping successful sources', async () => {
-    const list = vi.fn(async (peerId: string): Promise<FederationListResponse<TestRow>> => {
-      if (peerId === PEER_B.id) {
-        throw new FederationClientError({
-          code: 'NETWORK',
-          message: 'peer unavailable',
-          peerId,
-        });
-      }
-      return { items: [{ id: 'remote-a', title: 'Remote A' }] };
-    });
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse([{ id: 'local-1', title: 'Local One' }]),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote A', _source: 'peer-a' },
-      ],
-      _partial: true,
-    });
-  });
-
-  it('throws QuerySourceError when a federated host does not match an active outbound peer', async () => {
-    const list = vi.fn(async (): Promise<FederationListResponse<TestRow>> => ({ items: [] }));
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    await expect(
-      service.list<TestRow>({
-        source: 'federated:missing.example.com',
-        resource: 'tasks',
-        request: {},
-        local: () => makeLocalResponse(),
-      }),
-    ).rejects.toMatchObject({
-      name: 'QuerySourceError',
-      code: 'PEER_NOT_FOUND',
-    } satisfies Partial<QuerySourceError>);
-  });
-});

apps/gateway/src/federation/client/index.ts

@@ -11,13 +11,3 @@ export {
   type FederationClientErrorCode,
   type FederationClientErrorOptions,
 } from './federation-client.service.js';
-export {
-  QuerySourceService,
-  QuerySourceError,
-  type QuerySource,
-  type QuerySourceErrorCode,
-  type QuerySourceErrorOptions,
-  type QuerySourceListOptions,
-  type QuerySourceListResponse,
-  type LocalListExecutor,
-} from './query-source.service.js';

apps/gateway/src/federation/client/query-source.service.ts

@@ -1,261 +0,0 @@
-/**
- * QuerySourceService — gateway query source router (FED-M3-09).
- *
- * Accepts the federation query-layer `source` selector and routes list-style
- * reads to local storage, one federated peer, or all active outbound peers.
- *
- * `source: "all"` is intentionally tolerant of per-peer failures: local data
- * and successful peer responses are returned, and the envelope is marked
- * `_partial: true`.  Local failures still reject because there is no safe local
- * fallback and the gateway's own storage is expected to be authoritative.
- */
-
-import { Inject, Injectable, Logger } from '@nestjs/common';
-import { and, eq, federationPeers, isNotNull, type Db } from '@mosaicstack/db';
-import {
-  SOURCE_LOCAL,
-  tagWithSource,
-  type FederationListResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { DB } from '../../database/database.module.js';
-import { FederationClientService } from './federation-client.service.js';
-
-export type QuerySource = 'local' | 'all' | `federated:${string}`;
-
-export type QuerySourceErrorCode = 'INVALID_SOURCE' | 'PEER_NOT_FOUND';
-
-export interface QuerySourceErrorOptions {
-  code: QuerySourceErrorCode;
-  message: string;
-  source: string;
-}
-
-export class QuerySourceError extends Error {
-  readonly code: QuerySourceErrorCode;
-  readonly source: string;
-
-  constructor(opts: QuerySourceErrorOptions) {
-    super(opts.message);
-    this.name = 'QuerySourceError';
-    this.code = opts.code;
-    this.source = opts.source;
-  }
-}
-
-export type LocalListExecutor<T extends object> = () => Promise<FederationListResponse<T> | T[]>;
-
-export interface QuerySourceListOptions<T extends object> {
-  source: QuerySource;
-  resource: string;
-  request?: Record<string, unknown>;
-  local: LocalListExecutor<T>;
-}
-
-export type QuerySourceListResponse<T extends object> = FederationListResponse<T & SourceTag>;
-
-interface OutboundPeer {
-  id: string;
-  commonName: string;
-  endpointUrl: string;
-}
-
-interface TaggedList<T extends object> {
-  items: Array<T & SourceTag>;
-  partial: boolean;
-  truncated: boolean;
-  nextCursor?: string;
-}
-
-@Injectable()
-export class QuerySourceService {
-  private readonly logger = new Logger(QuerySourceService.name);
-
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(FederationClientService) private readonly federationClient: FederationClientService,
-  ) {}
-
-  async list<T extends object>(
-    options: QuerySourceListOptions<T>,
-  ): Promise<QuerySourceListResponse<T>> {
-    const request = options.request ?? {};
-
-    if (options.source === 'local') {
-      const local = await this.runLocal(options.local);
-      return this.toResponse(this.tagList(local, SOURCE_LOCAL));
-    }
-
-    if (options.source === 'all') {
-      return this.listAll(options.resource, request, options.local);
-    }
-
-    if (options.source.startsWith('federated:')) {
-      const host = options.source.slice('federated:'.length).trim();
-      if (!host) {
-        throw new QuerySourceError({
-          code: 'INVALID_SOURCE',
-          message: 'Federated source must include a host after federated:',
-          source: options.source,
-        });
-      }
-
-      const peer = await this.findPeerByHost(host, options.source);
-      const remote = await this.federationClient.list<T>(peer.id, options.resource, request);
-      return this.toResponse(this.tagList(remote, peer.commonName));
-    }
-
-    throw new QuerySourceError({
-      code: 'INVALID_SOURCE',
-      message: `Unsupported query source: ${options.source}`,
-      source: options.source,
-    });
-  }
-
-  private async listAll<T extends object>(
-    resource: string,
-    request: Record<string, unknown>,
-    local: LocalListExecutor<T>,
-  ): Promise<QuerySourceListResponse<T>> {
-    const peers = await this.listActiveOutboundPeers();
-
-    const localPromise = this.runLocal(local).then((response) =>
-      this.tagList(response, SOURCE_LOCAL),
-    );
-    const remotePromises = peers.map(async (peer: OutboundPeer): Promise<TaggedList<T> | null> => {
-      try {
-        const response = await this.federationClient.list<T>(peer.id, resource, request);
-        return this.tagList(response, peer.commonName);
-      } catch (error: unknown) {
-        this.logger.warn(
-          `Federated query to peer ${peer.commonName} (${peer.id}) failed; returning partial all-source response: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
-        );
-        return null;
-      }
-    });
-
-    const [localResult, ...remoteResults] = await Promise.all([localPromise, ...remotePromises]);
-    const successfulRemoteResults = remoteResults.filter(
-      (result: TaggedList<T> | null): result is TaggedList<T> => result !== null,
-    );
-    const allResults = [localResult, ...successfulRemoteResults];
-    const peerFailure = successfulRemoteResults.length !== peers.length;
-
-    return this.mergeTaggedLists(allResults, peerFailure);
-  }
-
-  private async runLocal<T extends object>(
-    local: LocalListExecutor<T>,
-  ): Promise<FederationListResponse<T>> {
-    const response = await local();
-    if (Array.isArray(response)) {
-      return { items: response };
-    }
-    return response;
-  }
-
-  private tagList<T extends object>(
-    response: FederationListResponse<T>,
-    source: string,
-  ): TaggedList<T> {
-    return {
-      items: tagWithSource(response.items, source),
-      partial: response._partial === true,
-      truncated: response._truncated === true || response.nextCursor !== undefined,
-      nextCursor: response.nextCursor,
-    };
-  }
-
-  private mergeTaggedLists<T extends object>(
-    lists: Array<TaggedList<T>>,
-    peerFailure: boolean,
-  ): QuerySourceListResponse<T> {
-    const items = lists.flatMap((list: TaggedList<T>) => list.items);
-    const partial =
-      peerFailure ||
-      lists.some((list: TaggedList<T>) => list.partial || list.nextCursor !== undefined);
-    const truncated = lists.some((list: TaggedList<T>) => list.truncated);
-
-    const response: QuerySourceListResponse<T> = { items };
-    if (partial) {
-      response._partial = true;
-    }
-    if (truncated) {
-      response._truncated = true;
-    }
-    return response;
-  }
-
-  private toResponse<T extends object>(tagged: TaggedList<T>): QuerySourceListResponse<T> {
-    const response: QuerySourceListResponse<T> = {
-      items: tagged.items,
-    };
-    if (tagged.nextCursor !== undefined) {
-      response.nextCursor = tagged.nextCursor;
-    }
-    if (tagged.partial) {
-      response._partial = true;
-    }
-    if (tagged.truncated) {
-      response._truncated = true;
-    }
-    return response;
-  }
-
-  private async findPeerByHost(sourceHost: string, source: string): Promise<OutboundPeer> {
-    const host = normalizeHost(sourceHost);
-    const peers = await this.listActiveOutboundPeers();
-    const peer = peers.find((candidate: OutboundPeer) => {
-      const commonName = normalizeHost(candidate.commonName);
-      const endpointHosts = endpointHostKeys(candidate.endpointUrl).map((endpointHost: string) =>
-        normalizeHost(endpointHost),
-      );
-      return commonName === host || endpointHosts.includes(host);
-    });
-
-    if (!peer) {
-      throw new QuerySourceError({
-        code: 'PEER_NOT_FOUND',
-        message: `No active outbound federation peer matches source ${source}`,
-        source,
-      });
-    }
-
-    return peer;
-  }
-
-  private async listActiveOutboundPeers(): Promise<OutboundPeer[]> {
-    const rows = await this.db
-      .select({
-        id: federationPeers.id,
-        commonName: federationPeers.commonName,
-        endpointUrl: federationPeers.endpointUrl,
-      })
-      .from(federationPeers)
-      .where(
-        and(
-          eq(federationPeers.state, 'active'),
-          isNotNull(federationPeers.endpointUrl),
-          isNotNull(federationPeers.clientKeyPem),
-        ),
-      )
-      .orderBy(federationPeers.commonName);
-
-    return rows.filter((row): row is OutboundPeer => typeof row.endpointUrl === 'string');
-  }
-}
-
-function normalizeHost(host: string): string {
-  return host.trim().toLowerCase();
-}
-
-function endpointHostKeys(endpointUrl: string): string[] {
-  try {
-    const url = new URL(endpointUrl);
-    return Array.from(new Set([url.host, url.hostname].filter((host: string) => host.length > 0)));
-  } catch {
-    return [];
-  }
-}

apps/gateway/src/federation/federation.module.ts

@@ -5,7 +5,7 @@ import { EnrollmentController } from './enrollment.controller.js';
 import { EnrollmentService } from './enrollment.service.js';
 import { FederationController } from './federation.controller.js';
 import { GrantsService } from './grants.service.js';
-import { FederationClientService, QuerySourceService } from './client/index.js';
+import { FederationClientService } from './client/index.js';
 import { FederationAuthGuard } from './server/index.js';
 
 @Module({
@@ -16,7 +16,6 @@ import { FederationAuthGuard } from './server/index.js';
     EnrollmentService,
     GrantsService,
     FederationClientService,
-    QuerySourceService,
     FederationAuthGuard,
   ],
   exports: [
@@ -24,7 +23,6 @@ import { FederationAuthGuard } from './server/index.js';
     EnrollmentService,
     GrantsService,
     FederationClientService,
-    QuerySourceService,
     FederationAuthGuard,
   ],
 })

docs/fleet/north-star.md

@@ -353,25 +353,6 @@ re-evaluate if isolation or write-volume demands it.
 - **Docs as projections:** `docs/TASKS.md` and `MISSION-MANIFEST.md` become generated exports of the DB, not hand-maintained.
 - **Sub-decision pending:** dedicated schema in existing PG instance (recommended) vs. dedicated PG instance. Revisit if isolation or write-volume demands it.
 
-## Decisions of record (2026-06-24, with Jason)
-
-- **Per-agent model switch (operator-configurable, NOT a global lock):** model selection is
-  **per-agent**, never a host-global pin. Claude sessions MUST NOT be locked to a single model in
-  `~/.claude/settings.json`; each agent chooses its model independently. The plumbing already exists —
-  roster `model_hint` → `MOSAIC_AGENT_MODEL` → `start-agent-session.sh` appends `--model <hint>` to that
-  agent's harness (claude or pi); settable today via `mosaic fleet add|edit <agent> --model <hint>`.
-  **North-star target:** surface this as a **per-agent model switch in the webUI** (with CLI/TUI parity
-  per MVP-X1) — read the roster, expose a per-agent model dropdown, write `model_hint` back, and restart
-  that one agent to apply. Unset = inherit the harness default. This **composes with** the budget
-  downgrade ladder (opus → sonnet → haiku, then Claude → Codex): the operator sets the per-agent model
-  _intent/ceiling_; budget pacing may downgrade within policy. Tracked as a Fleet `TASKS.md` entry under
-  the Phase-5 webUI surface.
-- **Orchestrator runtime (confirmed live):** the **orchestrator and enhancer run Claude Opus 4.8 in the
-  Claude Code harness**; only workers (coder/reviewer) run pi/gpt-5.5. Consistent with the 2026-06-20
-  "Claude reserved for Claude Code only" decision (the orchestrator runs _in_ Claude Code, not an
-  alternate Claude harness). Pi/gpt-5.5 as the orchestrator is permitted **only if proven** at least as
-  satisfactory; absent that proof, the orchestrator stays on Claude Opus 4.8.
-
 ## Future enhancements (north-star, post-MVP — not on the MVP track)
 
 - **Mosaic Claude Discord Plugin** — a first-party Mosaic Discord connector that properly

docs/scratchpads/FED-M3-09-query-source.md

@@ -1,67 +0,0 @@
-# FED-M3-09 — Query Source Service Scratchpad
-
-## Objective
-
-Implement `apps/gateway/src/federation/client/query-source.service.ts` for `source: "local" | "federated:<host>" | "all"` routing.
-
-## Scope
-
-- Add QuerySourceService in gateway federation client layer.
-- Unit-test local-only, single federated peer, all-source fan-out/merge, and per-peer partial failures.
-- Keep `docs/federation/TASKS.md` read-only per project agent guidance.
-
-## Constraints / assumptions
-
-- Issue: #462.
-- Branch: `feat/federation-m3-query-source` from `origin/main` (`e0e7be70`).
-- ASSUMPTION: `federated:<host>` should match active outbound peers by `commonName` first and by `endpointUrl` host/hostname as compatibility fallback; source tags use `peer.commonName` per `@mosaicstack/types` source-tag docs.
-- ASSUMPTION: QuerySourceService provides list/fan-out behavior; get/source routing can be layered later because card acceptance says merge rows.
-- ASSUMPTION: `source: "all"` cannot safely return a single continuation cursor for multiple sub-sources; any subquery cursor marks the merged response `_partial: true` + `_truncated: true` while omitting `nextCursor`.
-- Budget: no explicit hard cap from orchestrator; working cap ~8K-12K tokens for card 1 implementation + tests + PR cycle.
-- OpenBrain unavailable: credential loader failed with missing `/home/jarvis/.config/mosaic/credentials.json`; not blocking code delivery.
-
-## Plan
-
-1. Review federation client/types/db patterns.
-2. Write unit tests for source behavior.
-3. Implement QuerySourceService and export/register it in FederationModule.
-4. Run scoped tests, typecheck, lint, format.
-5. Run codex uncommitted review and remediate.
-6. Commit, queue guard, push, PR via wrapper.
-
-## Progress
-
-- 2026-06-24: Intake complete; using isolated worktree to avoid dirty orchestrator files in original checkout.
-- 2026-06-24: Added QuerySourceService, module export, barrel export, and 7 unit tests.
-- 2026-06-24: First Codex review found pagination and port-host matching issues; both remediated with tests.
-
-## Tests run
-
-- `pnpm --filter @mosaicstack/gateway test -- query-source.service.spec.ts` — PASS (7 tests).
-- `pnpm --filter @mosaicstack/gateway typecheck` — PASS.
-- `pnpm --filter @mosaicstack/gateway lint` — PASS.
-- `pnpm format:check` — PASS.
-- `pnpm typecheck` — PASS (41/41 turbo tasks).
-- `pnpm lint` — PASS (23/23 turbo tasks).
-- `pnpm test` — FAIL in pre-existing/live-DB integration suite: `apps/gateway/src/__tests__/cross-user-isolation.test.ts` cleanup hit `relation "messages" does not exist` against local PostgreSQL. Changed QuerySource unit tests passed; failure is outside FED-M3-09 surface and appears tied to local DB schema state.
-
-## Review evidence
-
-- `~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` — first pass request-changes, 2 should-fix findings (all-source cursor handling; endpoint port host matching).
-- Remediation: `_partial` + `_truncated` when any all-source subquery has `nextCursor`; endpoint match accepts URL `host` and `hostname`; added tests for both.
-- `~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` — PASS/approve, no findings.
-- `~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted` — PASS, risk level none, no findings.
-
-## Risks / blockers
-
-- Federation query layer is not yet wired; service API needs to be stable and easy to compose.
-- Must avoid hard-failing `source: all` on remote peer failures.
-
-## Acceptance evidence mapping
-
-| Acceptance criterion                                                            | Evidence                                                                          |
-| ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
-| local source returns local rows tagged `_source: local`                         | `query-source.service.spec.ts` local test; scoped test PASS                       |
-| `federated:<host>` queries selected peer and tags rows with peer source         | `query-source.service.spec.ts` commonName/endpoint-host tests; scoped test PASS   |
-| `all` fans out local + active outbound peers in parallel and merges tagged rows | `query-source.service.spec.ts` all-source call-order/merge test; scoped test PASS |
-| per-peer failure on `all` returns `_partial: true`, not throw                   | `query-source.service.spec.ts` peer failure test; scoped test PASS                |

packages/db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosaicstack/db",
-  "version": "0.0.4",
+  "version": "0.0.3",
   "repository": {
     "type": "git",
     "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",

packages/mosaic/framework/fleet/profiles/software-delivery.yaml

@@ -27,49 +27,45 @@ id: software-delivery
 title: Software Delivery
 description: >-
   The engineering fleet that turns ratified objectives into shipped, reviewed,
-  merged code. The lead (orchestrator) runs the supervisor loop and dispatches
-  ready work; it hands goal-decomposition to the planner, which plans phased FRs
-  into a depends_on DAG, decomposition splits them into one-PR-each cards, coders
-  execute to green CI, and review / security-review / site-tester / merge-gate
-  guard the merge. This mirrors today's coding fleet.
-# NOTE: the lead seat is the dedicated "orchestrator" — the always-on coordinator
-# that runs the supervisor tick, dispatches ready work, and routes PRs to the
-# merge-gate while holding only lean coordination state. The planner is now a
-# distinct seat (heavy goal-decomposition context) that reports to the
-# orchestrator. The two-agent floor is orchestrator + enhancer.
-lead: orchestrator
+  merged code. The lead (planner — the orchestrator seat) plans phased FRs into a
+  depends_on DAG, decomposition splits them into one-PR-each cards, coders execute
+  to green CI, and review / security-review / site-tester / merge-gate guard the
+  merge. This mirrors today's coding fleet.
+# NOTE: the canonical lead seat is the "orchestrator". In the persona library the
+# orchestrator IS the `planner` class (see roles/planner.md: "the planner role IS
+# the existing orchestrator class") — so the lead/floor reference `planner`, the
+# only class that actually resolves to a role contract.
+lead: planner
 floor:
-  - orchestrator
+  - planner
   - enhancer
 roster:
-  - class: orchestrator
   - class: board
-    reports_to: orchestrator
+    reports_to: planner
   - class: planner
-    reports_to: orchestrator
   - class: decomposition
     reports_to: planner
   - class: code
     reports_to: decomposition
     multiplicity: 2
   - class: review
-    reports_to: orchestrator
+    reports_to: planner
   - class: security-review
     reports_to: review
   - class: site-tester
     reports_to: review
   - class: documentation
-    reports_to: orchestrator
+    reports_to: planner
   - class: merge-gate
-    reports_to: orchestrator
+    reports_to: planner
   - class: rebase
     reports_to: merge-gate
   - class: operator
-    reports_to: orchestrator
+    reports_to: planner
   - class: session-review
-    reports_to: orchestrator
+    reports_to: planner
   - class: enhancer
-    reports_to: orchestrator
+    reports_to: planner
 notes: >-
-  Two-agent floor (orchestrator + enhancer) is always staffed; every other seat is
-  added on demand.
+  Two-agent floor (orchestrator/planner + enhancer) is always staffed; every other
+  seat is added on demand.

packages/mosaic/framework/fleet/roles/LIBRARY.md

@@ -19,7 +19,6 @@ their intro so tooling can group them.
 
 | Persona         | Purpose                                                                        |
 | --------------- | ------------------------------------------------------------------------------ |
-| orchestrator    | Always-on coordinator — runs the supervisor loop, dispatches ready work        |
 | board           | Multi-lens deliberation panel; owns the mission's direction, not its execution |
 | planner         | Turns ratified objectives into a phased FR plan wired into a `depends_on` DAG  |
 | decomposition   | Splits FRs into one-PR-each cards wired with `depends_on` edges                |

packages/mosaic/framework/fleet/roles/orchestrator.md

@@ -1,46 +0,0 @@
-# Orchestrator — fleet role definition
-
-The **orchestrator** is one half of the fleet's two-agent floor: every fleet runs,
-at minimum, an **orchestrator** and an **enhancer**. The orchestrator is the
-fleet's **always-on coordinator and dispatcher** (`class: orchestrator`,
-`persistent_persona: true`) — it owns fleet _movement_, not the work itself.
-
-It is a **core, always-on** agent, not an ephemeral per-lane worker.
-
-## Mandate
-
-1. **Run the supervisor tick** — perform the readiness scan each loop and keep the
-   two-agent floor (orchestrator + enhancer) healthy, restoring it the moment it
-   drops below the floor.
-2. **Dispatch ready work** — pick up cards whose `depends_on` edges are satisfied
-   and assign them via the backlog/claim, so no idle agent sits while ready work
-   exists.
-3. **Delegate decomposition, don't do it** — hand goal-decomposition work to the
-   **planner**, which it coordinates; the orchestrator tracks the resulting plan
-   but does not author the DAG itself.
-4. **Route PRs to the merge-gate** — push reviewed, ready-to-land PRs at the
-   **merge-gate** (the only merge path); it never approves or merges itself.
-5. **Interface with the operator/user** — be the fleet's coordination surface,
-   relaying status and accepting direction, while holding only coordination state.
-6. **Keep the loop turning** — re-dispatch on completion or failure so the fleet
-   keeps moving rather than stalling.
-
-## Boundaries
-
-- **Does NOT decompose goals into the DAG/cards** — that is the **planner**'s lane,
-  which the orchestrator dispatches to.
-- **Does NOT write product/source code** (coders), **review** (review), or
-  **approve merges itself** (merge-gate).
-- **Does NOT carry deep per-task context** — it delegates and tracks, keeping its
-  own context lean so the coordination loop stays fast.
-
-The orchestrator moves work; it never holds the heavy planning or execution
-context that the seats it dispatches to carry.
-
-## Persona
-
-A lean, decisive coordinator. It thinks in readiness and throughput, dispatches the
-next ready card the instant a dependency clears, and never lets an idle agent sit
-while ready work exists — keeping its own context minimal so the loop never slows.
-
-> Doctrine: `docs/fleet/north-star.md` (two-agent floor + role library).

packages/mosaic/framework/fleet/roles/planner.md

@@ -3,11 +3,11 @@
 The **planner** turns ratified objectives into an executable **plan** — phased
 functional requirements (FRs) wired into a `depends_on` DAG.
 
-> **Reports to the orchestrator.** The planner is the goal-decomposition seat that
-> the **orchestrator** dispatches planning work to; it carries the heavy
-> goal-decomposition context, while the orchestrator holds only the lean
-> coordination state. The two-agent floor is **orchestrator + enhancer** — the
-> planner is added on demand, not part of the floor.
+> **Alias:** the planner role IS the existing **orchestrator** class. The
+> orchestrator _plays_ planner; this file documents the planning contract, it does
+> **not** introduce a competing class. The two-agent floor (orchestrator +
+> enhancer) is preserved — do not split planner into a separate persistent agent
+> that would break it.
 
 It is a **front-office** role.
 
@@ -19,8 +19,8 @@ It is a **front-office** role.
    between FRs so downstream decomposition can parallelize safely.
 3. **Emit a plan, not tasks** — the planner's output is the phased FR/DAG
    document. Splitting FRs into one-PR-each cards is the **decomposition** role's job.
-4. **Re-plan on failure** — when execution diverges, the planner re-sequences the
-   DAG rather than letting agents improvise.
+4. **Re-plan on failure** — when execution diverges, the planner (orchestrator)
+   re-sequences the DAG rather than letting agents improvise.
 
 ## Boundaries
 
@@ -35,7 +35,6 @@ merge path.
 ## Persona
 
 The architect of the mission's shape. It thinks in phases and dependencies, hands
-a clean DAG to decomposition, and reports its plan back to the orchestrator that
-dispatched it.
+a clean DAG to decomposition, and keeps the orchestrator/enhancer floor intact.
 
 > Doctrine: `docs/fleet/north-star.md` (two-agent floor + role library).

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -114,21 +114,10 @@ MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 # safe single bash token regardless of the name's characters.
 AGENT_NAME_Q=$(printf '%q' "$AGENT_NAME")
 
-# MOSAIC_AGENT_CLASS must ALSO be exported INTO the pane, for the same reason as
-# MOSAIC_AGENT_NAME above: the pane inherits the tmux SERVER environment (not this
-# script's env, and not the systemd unit's EnvironmentFile), so the per-agent class
-# written to agents/<name>.env would otherwise be invisible in-pane. The launcher
-# composes the persona contract from process.env.MOSAIC_AGENT_CLASS at launch
-# (compose-contract -> readPersonaContractBlock); without this export it sees an
-# undefined class and silently injects NO persona contract. %q-quote it so it is a
-# safe single bash token; an empty/unset class %q-quotes to '' and is a harmless
-# no-op downstream (readPersonaContractBlock returns '' for an empty class).
-AGENT_CLASS_Q=$(printf '%q' "${MOSAIC_AGENT_CLASS:-}")
-
 if [ -n "$MOSAIC_RUNTIME_BIN_PREFIX" ]; then
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
 else
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export MOSAIC_AGENT_CLASS=${AGENT_CLASS_Q}; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; exec ${MOSAIC_AGENT_COMMAND}"
 fi
 
 mkdir -p "$MOSAIC_AGENT_WORKDIR"

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -104,7 +104,6 @@ PATH="$FAKE_BIN:$PATH" \
 MOSAIC_TMUX_SOCKET="$SOCKET3" \
 MOSAIC_AGENT_WORKDIR="$WORKDIR3" \
 MOSAIC_AGENT_RUNTIME="pi" \
-MOSAIC_AGENT_CLASS="code" \
 MOSAIC_RUNTIME_BIN="$FAKE_RUNTIME_BIN" \
 MOSAIC_AGENT_COMMAND="mosaic yolo pi --model openai-codex/gpt-5.5:high" \
 MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR3" \
@@ -128,18 +127,6 @@ echo "$all_args" | grep -qF "exec " || fail "pane command does not use exec"
 echo "$all_args" | grep -qF "mosaic yolo pi --model openai-codex/gpt-5.5:high" || \
   fail "pane command does not forward MOSAIC_AGENT_COMMAND with flags intact"
 
-# d) MOSAIC_AGENT_NAME and the per-agent MOSAIC_AGENT_CLASS must BOTH be exported
-#    INTO the pane. The pane inherits the tmux SERVER environment (not this
-#    script's env, nor the systemd unit's EnvironmentFile), so any per-agent var
-#    the launcher needs in-pane must be re-exported in the snippet. CLASS is
-#    load-bearing: the launcher composes the persona contract from
-#    process.env.MOSAIC_AGENT_CLASS, so a missing export silently drops the
-#    persona (regression guard for the A3a pane-propagation gap).
-echo "$all_args" | grep -qF "export MOSAIC_AGENT_NAME=" || \
-  fail "pane command does not export MOSAIC_AGENT_NAME into the pane"
-echo "$all_args" | grep -qF "export MOSAIC_AGENT_CLASS=code" || \
-  fail "pane command does not export MOSAIC_AGENT_CLASS into the pane (persona would silently drop)"
-
 # ── Test 4: when no extra runtime-bin dirs exist, exec still appears ───────────
 TMUX_ARGS_FILE2=$(mktemp)
 FAKE_BIN2=$(mktemp -d)

packages/mosaic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosaicstack/mosaic",
-  "version": "0.0.48",
+  "version": "0.0.45",
   "repository": {
     "type": "git",
     "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",

packages/mosaic/src/commands/compose-contract.spec.ts

@@ -164,89 +164,4 @@ describe('composeContract — overlay composer', () => {
     expect(composeContract('pi', fixture.home)).toContain('# pi runtime contract');
     expect(composeContract('codex', fixture.home)).not.toContain('# pi runtime contract');
   });
-
-  // ── Persona contract injection (A3b) ──────────────────────────────────────
-  // composeContract reads MOSAIC_AGENT_CLASS and injects the resolved persona
-  // (override-aware). Save/restore the env so these tests don't leak state.
-  describe('persona contract (A3b)', () => {
-    let prevClass: string | undefined;
-
-    beforeEach(() => {
-      prevClass = process.env['MOSAIC_AGENT_CLASS'];
-    });
-
-    afterEach(() => {
-      if (prevClass === undefined) delete process.env['MOSAIC_AGENT_CLASS'];
-      else process.env['MOSAIC_AGENT_CLASS'] = prevClass;
-    });
-
-    const seedBaseline = (klass: string, body: string): void => {
-      mkdirSync(join(fixture.home, 'fleet', 'roles'), { recursive: true });
-      writeFileSync(join(fixture.home, 'fleet', 'roles', `${klass}.md`), body);
-    };
-    const seedOverride = (klass: string, body: string): void => {
-      mkdirSync(join(fixture.home, 'fleet', 'roles.local'), { recursive: true });
-      writeFileSync(join(fixture.home, 'fleet', 'roles.local', `${klass}.md`), body);
-    };
-
-    it('injects the baseline persona when MOSAIC_AGENT_CLASS is set and a role file exists', () => {
-      seedBaseline('coder', '# Coder\n\n(`class: coder`)\n\nBASELINE-MANDATE: ship the lane.\n');
-      process.env['MOSAIC_AGENT_CLASS'] = 'coder';
-      const out = composeContract('claude', fixture.home);
-      expect(out).toContain('# Persona Contract (coder)');
-      expect(out).toContain('BASELINE-MANDATE');
-    });
-
-    it('OVERRIDE WINS at launch: roles.local persona is injected over baseline (AC-NS-7)', () => {
-      seedBaseline('coder', '# Coder\n\n(`class: coder`)\n\nBASELINE-MANDATE.\n');
-      seedOverride('coder', '# Coder (override)\n\n(`class: coder`)\n\nOVERRIDE-MANDATE.\n');
-      process.env['MOSAIC_AGENT_CLASS'] = 'coder';
-      const out = composeContract('claude', fixture.home);
-      expect(out).toContain('# Persona Contract (coder)');
-      expect(out).toContain('OVERRIDE-MANDATE');
-      expect(out).not.toContain('BASELINE-MANDATE');
-    });
-
-    it('does NOT inject a persona when MOSAIC_AGENT_CLASS is unset', () => {
-      seedBaseline('coder', '# Coder\n\n(`class: coder`)\n\nBASELINE-MANDATE.\n');
-      delete process.env['MOSAIC_AGENT_CLASS'];
-      const out = composeContract('claude', fixture.home);
-      expect(out).not.toContain('# Persona Contract');
-    });
-
-    it('does NOT inject (no throw) when MOSAIC_AGENT_CLASS names an unknown class', () => {
-      seedBaseline('coder', '# Coder\n\n(`class: coder`)\n\nBASELINE-MANDATE.\n');
-      process.env['MOSAIC_AGENT_CLASS'] = 'nonexistent';
-      expect(() => composeContract('claude', fixture.home)).not.toThrow();
-      expect(composeContract('claude', fixture.home)).not.toContain('# Persona Contract');
-    });
-
-    it('places the persona contract BEFORE the fleet comms block (identity, then peers)', () => {
-      seedBaseline('enhancer', '# Enhancer\n\n(`class: enhancer`)\n\nIMPROVE.\n');
-      mkdirSync(join(fixture.home, 'fleet'), { recursive: true });
-      writeFileSync(
-        join(fixture.home, 'fleet', 'roster.yaml'),
-        [
-          'agents:',
-          '  - name: orchestrator',
-          '    class: orchestrator',
-          '  - name: enhancer',
-          '    class: enhancer',
-          '',
-        ].join('\n'),
-      );
-      const prevName = process.env['MOSAIC_AGENT_NAME'];
-      try {
-        process.env['MOSAIC_AGENT_CLASS'] = 'enhancer';
-        process.env['MOSAIC_AGENT_NAME'] = 'enhancer';
-        const out = composeContract('claude', fixture.home);
-        expect(out).toContain('# Persona Contract (enhancer)');
-        expect(out).toContain('# Fleet Comms');
-        expect(out.indexOf('# Persona Contract')).toBeLessThan(out.indexOf('# Fleet Comms'));
-      } finally {
-        if (prevName === undefined) delete process.env['MOSAIC_AGENT_NAME'];
-        else process.env['MOSAIC_AGENT_NAME'] = prevName;
-      }
-    });
-  });
 });

packages/mosaic/src/commands/fleet-personas.ts

@@ -25,7 +25,6 @@
  * can reference a customized or user-added persona.
  */
 
-import { readFileSync, readdirSync } from 'node:fs';
 import { readFile, readdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
@@ -89,12 +88,13 @@ export interface DirClasses {
  * classes still appear in `classes` for membership checks.
  */
 export async function extractClassesFromDir(dir: string): Promise<DirClasses> {
-  const acc: DirClasses = { classes: new Set<string>(), byClass: new Map<string, PersonaFile>() };
+  const classes = new Set<string>();
+  const byClass = new Map<string, PersonaFile>();
   let entries: string[];
   try {
     entries = await readdir(dir);
   } catch {
-    return acc;
+    return { classes, byClass };
   }
 
   for (const entry of entries) {
@@ -105,75 +105,36 @@ export async function extractClassesFromDir(dir: string): Promise<DirClasses> {
     } catch {
       continue;
     }
-    accumulateEntry(acc, dir, entry, text);
-  }
-  return acc;
-}
-
-/**
- * Synchronous twin of {@link extractClassesFromDir}. Identical extraction
- * semantics (same markers, same union of marker/filename/LIBRARY sources) on
- * sync fs, for the synchronous launch-time prompt path (composeContract) which
- * cannot await. Missing dir / unreadable files degrade gracefully.
- */
-export function extractClassesFromDirSync(dir: string): DirClasses {
-  const acc: DirClasses = { classes: new Set<string>(), byClass: new Map<string, PersonaFile>() };
-  let entries: string[];
-  try {
-    entries = readdirSync(dir);
-  } catch {
-    return acc;
-  }
-
-  for (const entry of entries) {
-    if (!entry.endsWith('.md')) continue;
-    let text: string;
-    try {
-      text = readFileSync(join(dir, entry), 'utf8');
-    } catch {
+    if (entry === 'LIBRARY.md') {
+      for (const m of text.matchAll(LIBRARY_ROW)) {
+        const name = m[1];
+        if (name && name !== 'persona') classes.add(name);
+      }
       continue;
     }
-    accumulateEntry(acc, dir, entry, text);
-  }
-  return acc;
-}
-
-/**
- * Apply the class-extraction rules for ONE role file's text into `acc`. Pure
- * over already-read content, so the async and sync directory scanners share a
- * single definition of "what classes a file contributes" (DRY — no semantic
- * drift between the launch-time and command-time paths).
- */
-function accumulateEntry(acc: DirClasses, dir: string, entry: string, text: string): void {
-  const { classes, byClass } = acc;
-  if (entry === 'LIBRARY.md') {
-    for (const m of text.matchAll(LIBRARY_ROW)) {
-      const name = m[1];
-      if (name && name !== 'persona') classes.add(name);
+    // The filename stem is itself a valid class (covers marker-less alias docs).
+    const stem = basename(entry, '.md');
+    classes.add(stem);
+    const domainMatch = DOMAIN_MARKER.exec(text);
+    const domain = domainMatch?.[1];
+    let markedClassForFile: string | undefined;
+    for (const m of text.matchAll(CLASS_MARKER)) {
+      const klass = m[1];
+      if (!klass) continue;
+      classes.add(klass);
+      // Record the FIRST marker as the file's defining class (the prose names
+      // the persona's own class up top; later mentions reference siblings).
+      if (!markedClassForFile) {
+        markedClassForFile = klass;
+        byClass.set(klass, { klass, file: join(dir, entry), ...(domain ? { domain } : {}) });
+      }
     }
-    return;
-  }
-  // The filename stem is itself a valid class (covers marker-less alias docs).
-  const stem = basename(entry, '.md');
-  classes.add(stem);
-  const domainMatch = DOMAIN_MARKER.exec(text);
-  const domain = domainMatch?.[1];
-  let markedClassForFile: string | undefined;
-  for (const m of text.matchAll(CLASS_MARKER)) {
-    const klass = m[1];
-    if (!klass) continue;
-    classes.add(klass);
-    // Record the FIRST marker as the file's defining class (the prose names
-    // the persona's own class up top; later mentions reference siblings).
-    if (!markedClassForFile) {
-      markedClassForFile = klass;
-      byClass.set(klass, { klass, file: join(dir, entry), ...(domain ? { domain } : {}) });
+    // A marker-less file still maps its stem to itself (no domain known).
+    if (!markedClassForFile && !byClass.has(stem)) {
+      byClass.set(stem, { klass: stem, file: join(dir, entry) });
     }
   }
-  // A marker-less file still maps its stem to itself (no domain known).
-  if (!markedClassForFile && !byClass.has(stem)) {
-    byClass.set(stem, { klass: stem, file: join(dir, entry) });
-  }
+  return { classes, byClass };
 }
 
 export interface PersonaDirs {
@@ -234,21 +195,6 @@ export async function resolvePersona(
     extractClassesFromDir(rolesDir),
     extractClassesFromDir(overrideDir),
   ]);
-  return resolvePersonaFrom(klass, { rolesDir, overrideDir, base, over });
-}
-
-/**
- * Resolve a single class against ALREADY-EXTRACTED layer maps. Callers that
- * resolve many classes against the same two directories (e.g. provisioning a
- * full roster) should {@link extractClassesFromDir} each dir ONCE and reuse the
- * result here, rather than paying a full directory re-scan per class. Precedence
- * is identical to {@link resolvePersona}: override layer wins, then baseline.
- */
-export async function resolvePersonaFrom(
-  klass: string,
-  layers: { rolesDir: string; overrideDir: string; base: DirClasses; over: DirClasses },
-): Promise<PersonaResolution | null> {
-  const { rolesDir, overrideDir, base, over } = layers;
 
   const fromLayer = async (
     dir: string,
@@ -283,51 +229,6 @@ export async function resolvePersonaFrom(
   );
 }
 
-/**
- * Synchronous twin of {@link resolvePersona} — same override-wins precedence
- * (roles.local/ beats roles/, by marker first then filename stem), returning
- * null if neither layer defines the class. Exists for the synchronous launch
- * prompt path (composeContract → readPersonaContractBlock) which cannot await.
- * Keeping it here, beside the async resolver, keeps the resolution semantics in
- * one module so the launch-time and command-time resolutions never diverge.
- */
-export function resolvePersonaSync(
-  klass: string,
-  opts: PersonaDirs = {},
-): PersonaResolution | null {
-  const { rolesDir, overrideDir } = resolveDirs(opts);
-  const base = extractClassesFromDirSync(rolesDir);
-  const over = extractClassesFromDirSync(overrideDir);
-
-  const fromLayer = (
-    dir: string,
-    extracted: DirClasses,
-    layer: PersonaLayer,
-  ): PersonaResolution | null => {
-    // Prefer the marker-defined file; fall back to the filename stem.
-    const pf = extracted.byClass.get(klass);
-    if (!pf) {
-      if (!extracted.classes.has(klass)) return null;
-      const byName = join(dir, `${klass}.md`);
-      try {
-        const content = readFileSync(byName, 'utf8');
-        const dm = DOMAIN_MARKER.exec(content);
-        return { klass, layer, file: byName, content, ...(dm?.[1] ? { domain: dm[1] } : {}) };
-      } catch {
-        return null;
-      }
-    }
-    try {
-      const content = readFileSync(pf.file, 'utf8');
-      return { klass, layer, file: pf.file, content, ...(pf.domain ? { domain: pf.domain } : {}) };
-    } catch {
-      return null;
-    }
-  };
-
-  return fromLayer(overrideDir, over, 'override') ?? fromLayer(rolesDir, base, 'baseline');
-}
-
 export interface PersonaStatusEntry {
   klass: string;
   status: PersonaStatus;

packages/mosaic/src/commands/fleet-profiles.spec.ts

@@ -46,12 +46,10 @@ describe('listPersonaClasses (real role library)', () => {
 
   it('covers marker-less engineering personas via filename + LIBRARY index', async () => {
     const classes = await listPersonaClasses(rolesDir);
-    // planner/decomposition have a role file but no inline marker — they resolve
-    // from the filename + LIBRARY.md row.
+    // planner/decomposition have a role file but no inline marker (planner aliases
+    // the orchestrator class) — they resolve from the filename + LIBRARY.md row.
     expect(classes.has('planner')).toBe(true);
     expect(classes.has('decomposition')).toBe(true);
-    // The dedicated orchestrator persona resolves (inline marker + filename + row).
-    expect(classes.has('orchestrator')).toBe(true);
   });
 
   it('returns an empty set for a missing roles dir (graceful)', async () => {
@@ -77,17 +75,11 @@ describe('baseline profiles (real library)', () => {
 
   it('software-delivery has the expected lead, floor, and roster shape', async () => {
     const profile = await loadProfile('software-delivery', realLib);
-    expect(profile.lead).toBe('orchestrator');
-    expect(profile.floor).toEqual(['orchestrator', 'enhancer']);
+    expect(profile.lead).toBe('planner');
+    expect(profile.floor).toEqual(['planner', 'enhancer']);
     const code = profile.roster.find((r) => r.class === 'code');
     expect(code?.multiplicity).toBe(2);
     expect(code?.reportsTo).toBe('decomposition');
-    // The dedicated orchestrator is the lead seat (no reports_to); the planner is
-    // now a distinct seat that reports to it.
-    const orchestrator = profile.roster.find((r) => r.class === 'orchestrator');
-    expect(orchestrator?.reportsTo).toBeUndefined();
-    const planner = profile.roster.find((r) => r.class === 'planner');
-    expect(planner?.reportsTo).toBe('orchestrator');
   });
 
   it('loadProfile throws on an unknown id', async () => {

packages/mosaic/src/commands/fleet-provision.spec.ts

@@ -1,270 +0,0 @@
-import { access, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { loadFleetRoster } from './fleet.js';
-import { generateRoster, runProvision } from './fleet-provision.js';
-import { loadProfile } from './fleet-profiles.js';
-
-// These are INTEGRATION tests: each exercises real filesystem I/O — scanning the
-// committed framework/fleet persona library, rendering YAML, writing to a temp
-// mosaicHome, and round-tripping through the real roster parser. On a heavily
-// contended CI runner (the whole monorepo's suites run in parallel) that genuine
-// I/O can exceed vitest's 5s default even though it completes in ~400ms locally.
-// Give the legitimately I/O-bound work generous headroom so CI is deterministic.
-vi.setConfig({ testTimeout: 30_000 });
-
-// The real, committed library: packages/mosaic/src/commands -> framework/fleet.
-const frameworkFleet = resolve(
-  dirname(fileURLToPath(import.meta.url)),
-  '..',
-  '..',
-  'framework',
-  'fleet',
-);
-const rolesDir = join(frameworkFleet, 'roles');
-const profilesDir = join(frameworkFleet, 'profiles');
-
-/** A fresh temp mosaicHome whose fleet/ dir is empty (for write-path tests). */
-async function freshMosaicHome(): Promise<string> {
-  const home = await mkdtemp(join(tmpdir(), 'mosaic-provision-'));
-  await mkdir(join(home, 'fleet'), { recursive: true });
-  return home;
-}
-
-async function fileExists(path: string): Promise<boolean> {
-  try {
-    await access(path, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe('provision software-delivery (floor, default)', () => {
-  it('materializes only the floor seats with correct flags + valid scaffold', async () => {
-    const profile = await loadProfile('software-delivery', { profilesDir, rolesDir });
-    const { seats, yaml } = await generateRoster(profile, { profilesDir, rolesDir });
-
-    // Floor is orchestrator + enhancer.
-    expect(seats.map((s) => s.name).sort()).toEqual(['enhancer', 'orchestrator']);
-    const orch = seats.find((s) => s.name === 'orchestrator');
-    const enh = seats.find((s) => s.name === 'enhancer');
-    // RULE 2: floor + lead get persistent_persona.
-    expect(orch?.persistentPersona).toBe(true);
-    expect(enh?.persistentPersona).toBe(true);
-    // RULE 3: floor/lead do NOT reset between tasks.
-    expect(orch?.resetBetweenTasks).toBeUndefined();
-    expect(enh?.resetBetweenTasks).toBeUndefined();
-    // RULE 4: default runtime claude.
-    expect(orch?.runtime).toBe('claude');
-
-    // Scaffold round-trips through the real parser.
-    expect(yaml).toContain('version: 1');
-    expect(yaml).toContain('transport: tmux');
-    expect(yaml).toContain('socket_name: mosaic-fleet');
-  });
-});
-
-describe('provision --full', () => {
-  it('expands the entire roster, including multiplicity, deterministically', async () => {
-    const profile = await loadProfile('software-delivery', { profilesDir, rolesDir });
-    const { seats } = await generateRoster(profile, { full: true, profilesDir, rolesDir });
-
-    const names = seats.map((s) => s.name);
-    // code multiplicity 2 -> code0/code1 (RULE 1).
-    expect(names).toContain('code0');
-    expect(names).toContain('code1');
-    expect(names).not.toContain('code');
-    // Singleton seats keep the bare class name.
-    expect(names).toContain('planner');
-    expect(names).toContain('merge-gate');
-
-    // Deterministic ordering: profile roster order, multiplicity expanded inline.
-    const codeIdx0 = names.indexOf('code0');
-    expect(names[codeIdx0 + 1]).toBe('code1');
-
-    // RULE 3: a non-floor, non-lead execution seat resets between tasks.
-    const code0 = seats.find((s) => s.name === 'code0');
-    expect(code0?.resetBetweenTasks).toBe(true);
-    expect(code0?.persistentPersona).toBeUndefined();
-
-    // Seat count == sum of multiplicities.
-    const expected = profile.roster.reduce((n, e) => n + e.multiplicity, 0);
-    expect(seats.length).toBe(expected);
-  });
-});
-
-describe('generated roster round-trips through the real parser', () => {
-  it('feeds generated YAML back through loadFleetRoster (key correctness proof)', async () => {
-    const home = await freshMosaicHome();
-    try {
-      const result = await runProvision('software-delivery', {
-        mosaicHome: home,
-        profilesDir,
-        rolesDir,
-        full: true,
-        write: true,
-      });
-      expect(result.wrote).toBe(join(home, 'fleet', 'roster.yaml'));
-
-      const parsed = await loadFleetRoster(result.wrote!);
-      // It parses with no error and carries every seat.
-      const profile = await loadProfile('software-delivery', { profilesDir, rolesDir });
-      const expected = profile.roster.reduce((n, e) => n + e.multiplicity, 0);
-      expect(parsed.agents.length).toBe(expected);
-      // Classes survive the round-trip.
-      expect(parsed.agents.some((a) => a.className === 'orchestrator')).toBe(true);
-      expect(parsed.agents.filter((a) => a.className === 'code').length).toBe(2);
-      // reports_to must NOT have been emitted (parser rejects unknown keys).
-      expect(result.yaml).not.toContain('reports_to');
-    } finally {
-      await rm(home, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('override-aware persona validation', () => {
-  let dir: string;
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), 'mosaic-provision-ov-'));
-  });
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  it('resolves a user-added (roles.local-only) persona without a false unresolved error', async () => {
-    const overrideDir = join(dir, 'roles.local');
-    const customProfilesDir = join(dir, 'profiles');
-    await mkdir(overrideDir, { recursive: true });
-    await mkdir(customProfilesDir, { recursive: true });
-    // A brand-new class that exists ONLY in roles.local.
-    await writeFile(
-      join(overrideDir, 'widget-maker.md'),
-      '# widget-maker\n\nThe widget-maker persona (`class: widget-maker`).\n',
-    );
-    await writeFile(
-      join(customProfilesDir, 'custom.yaml'),
-      [
-        'id: custom',
-        'title: Custom',
-        'description: a custom system',
-        'lead: widget-maker',
-        'floor: [widget-maker]',
-        'roster:',
-        '  - class: widget-maker',
-        '',
-      ].join('\n'),
-    );
-
-    const result = await runProvision('custom', {
-      mosaicHome: dir,
-      profilesDir: customProfilesDir,
-      // Point baseline rolesDir at a missing dir so resolution depends on override.
-      rolesDir: join(dir, 'no-baseline'),
-      overrideDir,
-    });
-    expect(result.yaml).toContain('class: widget-maker');
-    // It resolved from the override layer.
-    // (generateRoster records personaLayer; the seat is present.)
-    expect(result.summary).toContain('persona=override');
-  });
-
-  it('FAILS with a clear message when a profile references a bogus class', async () => {
-    const customProfilesDir = join(dir, 'profiles');
-    await mkdir(customProfilesDir, { recursive: true });
-    await writeFile(
-      join(customProfilesDir, 'bogus.yaml'),
-      [
-        'id: bogus',
-        'title: Bogus',
-        'description: bad system',
-        'lead: orchestrator',
-        'floor: [orchestrator]',
-        'roster:',
-        '  - class: orchestrator',
-        '  - class: not-a-real-persona-xyz',
-        '    reports_to: orchestrator',
-        '',
-      ].join('\n'),
-    );
-    await expect(
-      runProvision('bogus', {
-        mosaicHome: dir,
-        profilesDir: customProfilesDir,
-        rolesDir,
-        overrideDir: join(dir, 'roles.local'),
-      }),
-    ).rejects.toThrow(/not-a-real-persona-xyz|not a known persona class/);
-  });
-});
-
-describe('--write protection', () => {
-  it('refuses to clobber an existing roster.yaml without --force', async () => {
-    const home = await freshMosaicHome();
-    try {
-      const rosterPath = join(home, 'fleet', 'roster.yaml');
-      await writeFile(rosterPath, 'version: 1\n# operator customizations\n');
-      await expect(
-        runProvision('software-delivery', { mosaicHome: home, profilesDir, rolesDir, write: true }),
-      ).rejects.toThrow(/Refusing to overwrite/);
-      // The original file is untouched.
-      const { readFile } = await import('node:fs/promises');
-      expect(await readFile(rosterPath, 'utf8')).toContain('operator customizations');
-    } finally {
-      await rm(home, { recursive: true, force: true });
-    }
-  });
-
-  it('--write --force overwrites an existing roster', async () => {
-    const home = await freshMosaicHome();
-    try {
-      const rosterPath = join(home, 'fleet', 'roster.yaml');
-      await writeFile(rosterPath, 'version: 1\n# old\n');
-      const result = await runProvision('software-delivery', {
-        mosaicHome: home,
-        profilesDir,
-        rolesDir,
-        write: true,
-        force: true,
-      });
-      expect(result.wrote).toBe(rosterPath);
-      const parsed = await loadFleetRoster(rosterPath);
-      expect(parsed.agents.length).toBeGreaterThan(0);
-    } finally {
-      await rm(home, { recursive: true, force: true });
-    }
-  });
-
-  it('--write to a fresh mosaicHome creates the roster file', async () => {
-    const home = await freshMosaicHome();
-    try {
-      const result = await runProvision('software-delivery', {
-        mosaicHome: home,
-        profilesDir,
-        rolesDir,
-        write: true,
-      });
-      expect(await fileExists(result.wrote!)).toBe(true);
-    } finally {
-      await rm(home, { recursive: true, force: true });
-    }
-  });
-
-  it('dry run (no --write) writes nothing', async () => {
-    const home = await freshMosaicHome();
-    try {
-      const result = await runProvision('software-delivery', {
-        mosaicHome: home,
-        profilesDir,
-        rolesDir,
-      });
-      expect(result.wrote).toBeUndefined();
-      expect(await fileExists(join(home, 'fleet', 'roster.yaml'))).toBe(false);
-    } finally {
-      await rm(home, { recursive: true, force: true });
-    }
-  });
-});

packages/mosaic/src/commands/fleet-provision.ts

@@ -1,406 +0,0 @@
-/**
- * `mosaic fleet provision --profile <id>` — turn a declared SYSTEM TYPE (a
- * profile) into a concrete fleet roster (North Star H3).
- *
- * A profile (fleet/profiles/<id>.yaml) is a DECLARATIVE mapping from a system
- * type to a persona roster + org topology (H2). This command MATERIALIZES that
- * declaration into the concrete `roster.yaml` shape the live fleet consumes — the
- * same shape `fleet.ts` parses (version/transport/tmux/defaults/runtimes/agents).
- *
- * DRY-RUN-FIRST + REVIEWABLE: with no --write it prints the roster it WOULD
- * generate plus a topology summary and writes nothing. --write persists it, and
- * REFUSES to clobber an existing roster.yaml without --force (protects operator
- * customizations).
- *
- * DRY: profile parsing/validation is reused wholesale from fleet-profiles.ts
- * (loadProfile/validateProfile) and persona resolution from fleet-personas.ts
- * (resolvePersona, override-aware). This module owns ONLY the profile→roster
- * generation policy, documented inline below so each default is reviewable.
- */
-
-import { access, mkdir, writeFile } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import type { Command } from 'commander';
-import YAML from 'yaml';
-import {
-  loadProfile,
-  validateProfile,
-  type FleetProfile,
-  type ProfileRosterEntry,
-  defaultProfilesDir,
-  defaultRolesDir,
-  listPersonaClassesWithOverrides,
-} from './fleet-profiles.js';
-import {
-  defaultOverrideDir,
-  extractClassesFromDir,
-  resolvePersonaFrom,
-  type PersonaLayer,
-} from './fleet-personas.js';
-
-function defaultMosaicHome(): string {
-  return process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
-}
-
-// ---------------------------------------------------------------------------
-// GENERATION RULES — each default below is intentionally simple and documented
-// so a reviewer can ratify or override the policy. See the PR body for the open
-// runtime-per-class question (RULE 4).
-// ---------------------------------------------------------------------------
-
-/**
- * RULE 4 — Runtime assignment policy (THE one open design question).
- *
- * Default: EVERY seat → `runtime: claude`. Claude runs every persona, so it is
- * the safe universal default and guarantees a structurally-valid, launchable
- * roster regardless of how the policy ultimately lands. We deliberately do NOT
- * hardcode pi / gpt-5.5 per class here. The live roster today runs coders on
- * pi + openai-codex/gpt-5.5:high — whether provisioning should encode a
- * class→runtime/model map (and WHERE: the profile schema vs a separate
- * runtime-policy file) is flagged in the PR body for ratification.
- *
- * Centralized so changing the policy is a ONE-edit change. If a future profile
- * entry (or persona) declares a runtime/model preference, honor it here; until
- * then everything defaults to claude.
- */
-export const DEFAULT_RUNTIME = 'claude';
-
-/** Result of applying the runtime policy to one seat. */
-interface RuntimeChoice {
-  runtime: string;
-  modelHint?: string;
-}
-
-/**
- * The single centralized runtime-policy function. Today it returns the universal
- * `claude` default for every seat. To encode a class→runtime/model map later,
- * edit ONLY this function (and/or extend the profile schema and read it here).
- */
-export function resolveSeatRuntime(
-  _klass: string,
-  _isFloor: boolean,
-  _isLead: boolean,
-): RuntimeChoice {
-  return { runtime: DEFAULT_RUNTIME };
-}
-
-/** One generated seat, fully resolved for emission + topology display. */
-export interface GeneratedSeat {
-  name: string;
-  className: string;
-  runtime: string;
-  modelHint?: string;
-  persistentPersona?: boolean;
-  resetBetweenTasks?: boolean;
-  /** Topology edge from the profile (NOT emitted to roster.yaml — see RULE 6). */
-  reportsTo?: string;
-  /** Which persona layer the class resolved from (baseline/override). */
-  personaLayer: PersonaLayer;
-}
-
-export interface GenerateRosterResult {
-  seats: GeneratedSeat[];
-  /** The roster.yaml text (parser-valid, drop-in). */
-  yaml: string;
-}
-
-export interface ProvisionOptions {
-  /** Materialize the entire profile roster (multiplicity expanded). */
-  full?: boolean;
-  mosaicHome?: string;
-  /** Test overrides — mirror fleet-profiles LoadProfilesOptions. */
-  profilesDir?: string;
-  rolesDir?: string;
-  overrideDir?: string;
-}
-
-function resolveDirs(opts: ProvisionOptions): {
-  mosaicHome: string;
-  profilesDir: string;
-  rolesDir: string;
-  overrideDir: string;
-} {
-  const mosaicHome = opts.mosaicHome ?? defaultMosaicHome();
-  return {
-    mosaicHome,
-    profilesDir: opts.profilesDir ?? defaultProfilesDir(mosaicHome),
-    rolesDir: opts.rolesDir ?? defaultRolesDir(mosaicHome),
-    overrideDir: opts.overrideDir ?? defaultOverrideDir(mosaicHome),
-  };
-}
-
-/**
- * RULE 1 — Seat naming. multiplicity 1 → name = class (e.g. `planner`).
- * multiplicity N>1 → `<class>0`,`<class>1`,… (e.g. `code` ×2 → code0/code1).
- * Names are deterministic, following profile roster order.
- */
-function seatNames(entry: ProfileRosterEntry): string[] {
-  if (entry.multiplicity <= 1) return [entry.class];
-  return Array.from({ length: entry.multiplicity }, (_, i) => `${entry.class}${i}`);
-}
-
-/**
- * Generate the concrete seats + roster.yaml for a validated profile.
- *
- * Seat selection:
- *   --full  → the ENTIRE profile roster, multiplicity expanded.
- *   default → ONLY the `floor` classes (the always-staffed minimum), matching
- *             the profile note "two-agent floor always staffed; every other seat
- *             added on demand."
- *
- * Per-seat flags:
- *   RULE 2 persistent_persona: true for floor classes AND the lead; else omitted.
- *   RULE 3 reset_between_tasks: true for non-floor, non-lead execution seats;
- *           floor/lead omit it (mirrors today's coders resetting while the
- *           orchestrator/enhancer do not).
- *   RULE 4 runtime: via resolveSeatRuntime (defaults claude).
- *   RULE 6 reports_to: tracked on the seat for the topology summary but NOT
- *           emitted to roster.yaml — the fleet.ts parser rejects unknown agent
- *           keys, so writing reports_to would break round-trip. Confirmed against
- *           normalizeAgent's allow-list in fleet.ts.
- *
- * Persona resolution: every emitted class is resolved override-aware via
- * resolvePersona so we can (a) record the layer for the summary and (b) refuse
- * to emit a roster that references a nonexistent persona.
- */
-export async function generateRoster(
-  profile: FleetProfile,
-  opts: ProvisionOptions,
-): Promise<GenerateRosterResult> {
-  const { rolesDir, overrideDir } = resolveDirs(opts);
-  const floor = new Set(profile.floor);
-  const lead = profile.lead;
-
-  const selected: ProfileRosterEntry[] = opts.full
-    ? profile.roster
-    : profile.roster.filter((e) => floor.has(e.class));
-
-  // Scan the persona directories ONCE, then resolve every roster entry against
-  // the in-memory maps. resolvePersona() would otherwise re-scan both dirs per
-  // entry — O(entries × files) redundant reads that push --full provisioning
-  // past the test timeout on slow/contended filesystems.
-  const [base, over] = await Promise.all([
-    extractClassesFromDir(rolesDir),
-    extractClassesFromDir(overrideDir),
-  ]);
-
-  const seats: GeneratedSeat[] = [];
-  for (const entry of selected) {
-    const isFloor = floor.has(entry.class);
-    const isLead = entry.class === lead;
-
-    const resolved = await resolvePersonaFrom(entry.class, { rolesDir, overrideDir, base, over });
-    if (!resolved) {
-      // Defensive: validateProfile already guards this, but a class can resolve
-      // for membership yet have no readable file. Fail loudly rather than emit a
-      // roster pointing at a persona we cannot load.
-      throw new Error(
-        `Cannot provision: roster class "${entry.class}" does not resolve to a readable persona.`,
-      );
-    }
-
-    const runtimeChoice = resolveSeatRuntime(entry.class, isFloor, isLead);
-    for (const name of seatNames(entry)) {
-      const seat: GeneratedSeat = {
-        name,
-        className: entry.class,
-        runtime: runtimeChoice.runtime,
-        personaLayer: resolved.layer,
-      };
-      if (runtimeChoice.modelHint) seat.modelHint = runtimeChoice.modelHint;
-      if (isFloor || isLead) seat.persistentPersona = true;
-      if (!isFloor && !isLead) seat.resetBetweenTasks = true;
-      if (entry.reportsTo) seat.reportsTo = entry.reportsTo;
-      seats.push(seat);
-    }
-  }
-
-  if (seats.length === 0) {
-    throw new Error(
-      `Profile "${profile.id}" produced no seats. ` +
-        (opts.full ? 'Its roster is empty.' : 'No floor seats are defined — try --full.'),
-    );
-  }
-
-  return { seats, yaml: renderRosterYaml(seats) };
-}
-
-/**
- * RULE 5 — Standard roster scaffolding. We emit the same generic, non-personal
- * scaffold the committed example presets use (socket_name: mosaic-fleet,
- * holder_session: _holder, working_directory: ~, claude + pi runtimes) so the
- * output is a drop-in valid roster. No operator-personal data is copied.
- *
- * Built via the `yaml` lib (same serializer the parser uses) so the result
- * round-trips. reports_to is intentionally NOT included on agents (RULE 6).
- */
-function renderRosterYaml(seats: GeneratedSeat[]): string {
-  const agents = seats.map((s) => {
-    const a: Record<string, unknown> = {
-      name: s.name,
-      runtime: s.runtime,
-      class: s.className,
-    };
-    if (s.persistentPersona) a['persistent_persona'] = true;
-    if (s.modelHint) a['model_hint'] = s.modelHint;
-    if (s.resetBetweenTasks) a['reset_between_tasks'] = true;
-    return a;
-  });
-
-  const doc = {
-    version: 1,
-    transport: 'tmux',
-    tmux: { socket_name: 'mosaic-fleet', holder_session: '_holder' },
-    defaults: { working_directory: '~' },
-    runtimes: {
-      claude: { reset_command: '/clear' },
-      pi: { reset_command: '/new' },
-    },
-    agents,
-  };
-
-  return YAML.stringify(doc);
-}
-
-// ---------------------------------------------------------------------------
-// Validation — reuse fleet-profiles.validateProfile (override-aware classes) and
-// name any unresolved class clearly. Never generate a roster referencing a
-// nonexistent persona.
-// ---------------------------------------------------------------------------
-
-/**
- * Validate the profile against the override-aware persona library. Throws with a
- * clear, class-naming message if any referenced class is unresolved.
- */
-export async function validateProfileForProvision(
-  profile: FleetProfile,
-  opts: ProvisionOptions,
-): Promise<void> {
-  const { rolesDir, overrideDir } = resolveDirs(opts);
-  const validClasses = await listPersonaClassesWithOverrides(rolesDir, overrideDir);
-  const problems = validateProfile(profile, validClasses);
-  if (problems.length > 0) {
-    throw new Error(
-      `Profile "${profile.id}" is invalid; cannot provision:\n  - ${problems.join('\n  - ')}`,
-    );
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Topology summary (printed in dry-run and after write).
-// ---------------------------------------------------------------------------
-
-function formatTopologySummary(seats: GeneratedSeat[]): string {
-  const lines: string[] = [];
-  lines.push(`Topology (${seats.length} seat(s)):`);
-  for (const s of seats) {
-    const reports = s.reportsTo ? `reports_to=${s.reportsTo}` : 'reports_to=- (lead)';
-    lines.push(
-      `  - ${s.name}\tclass=${s.className}\truntime=${s.runtime}\t${reports}\tpersona=${s.personaLayer}`,
-    );
-  }
-  return lines.join('\n');
-}
-
-// ---------------------------------------------------------------------------
-// CLI wiring — mirror registerFleetProfileCommand / registerFleetPersonaCommand.
-// ---------------------------------------------------------------------------
-
-export interface ProvisionRunResult {
-  yaml: string;
-  summary: string;
-  wrote?: string;
-}
-
-/**
- * Core provision flow shared by the CLI: load + validate the profile, generate
- * the roster, optionally write it. Returns the artifacts for printing/testing.
- */
-export async function runProvision(
-  profileId: string,
-  opts: ProvisionOptions & { write?: boolean; force?: boolean },
-): Promise<ProvisionRunResult> {
-  const dirs = resolveDirs(opts);
-  const profile = await loadProfile(profileId, {
-    mosaicHome: dirs.mosaicHome,
-    profilesDir: dirs.profilesDir,
-    rolesDir: dirs.rolesDir,
-    overrideDir: dirs.overrideDir,
-  });
-  // loadProfile already validates, but re-run with our explicit error wording so
-  // an unresolved class is named clearly even if invoked directly.
-  await validateProfileForProvision(profile, opts);
-
-  const { seats, yaml } = await generateRoster(profile, opts);
-  const summary = formatTopologySummary(seats);
-
-  if (!opts.write) {
-    return { yaml, summary };
-  }
-
-  const rosterPath = join(dirs.mosaicHome, 'fleet', 'roster.yaml');
-  if (!opts.force) {
-    let exists = false;
-    try {
-      await access(rosterPath, constants.F_OK);
-      exists = true;
-    } catch {
-      exists = false;
-    }
-    if (exists) {
-      throw new Error(
-        `Refusing to overwrite existing roster: ${rosterPath}. ` +
-          `Pass --force to overwrite, or edit it by hand.`,
-      );
-    }
-  }
-  await mkdir(dirname(rosterPath), { recursive: true });
-  await writeFile(rosterPath, yaml, 'utf8');
-  return { yaml, summary, wrote: rosterPath };
-}
-
-/**
- * Register `provision` under an existing `fleet` command. `mosaicHomeFor`
- * resolves the active --mosaic-home (parent flag) at call time, exactly like the
- * profile/persona/backlog subcommands.
- */
-export function registerFleetProvisionCommand(
-  fleetCmd: Command,
-  mosaicHomeFor: () => string,
-): Command {
-  const provisionCmd = fleetCmd
-    .command('provision')
-    .description('Materialize a roster.yaml from a system-type profile (H3). DRY-RUN by default.')
-    .requiredOption('--profile <id>', 'System-type profile id to provision')
-    .option('--full', 'Materialize the entire profile roster (default: floor seats only)')
-    .option('--write', 'Write the generated roster to <mosaicHome>/fleet/roster.yaml')
-    .option('--force', 'Overwrite an existing roster.yaml (requires --write)')
-    .action(async (opts: { profile: string; full?: boolean; write?: boolean; force?: boolean }) => {
-      try {
-        const result = await runProvision(opts.profile, {
-          mosaicHome: mosaicHomeFor(),
-          full: opts.full,
-          write: opts.write,
-          force: opts.force,
-        });
-        if (result.wrote) {
-          console.log(`Wrote roster: ${result.wrote}`);
-          console.log('');
-          console.log(result.summary);
-        } else {
-          // DRY RUN: print the roster it WOULD generate + topology, write nothing.
-          console.log('# DRY RUN — no files written. Re-run with --write to persist.');
-          console.log(result.yaml.trimEnd());
-          console.log('');
-          console.log(result.summary);
-        }
-      } catch (err) {
-        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
-        process.exitCode = 1;
-      }
-    });
-
-  return provisionCmd;
-}

packages/mosaic/src/commands/fleet.spec.ts

@@ -84,7 +84,6 @@ describe('registerFleetCommand', () => {
       'install-systemd',
       'persona',
       'profile',
-      'provision',
       'ps',
       'remove',
       'restart',
@@ -247,8 +246,6 @@ describe('fleet roster parsing', () => {
     expect(generateAgentEnv(roster, getRosterAgent(roster, 'coder0'))).toBe(
       [
         'MOSAIC_AGENT_NAME=coder0',
-        // Reflects the roster's non-default `class: implementer` (A3a).
-        'MOSAIC_AGENT_CLASS=implementer',
         'MOSAIC_AGENT_RUNTIME=codex',
         'MOSAIC_AGENT_MODEL=',
         'MOSAIC_AGENT_WORKDIR=/srv/mosaic',
@@ -258,40 +255,6 @@ describe('fleet roster parsing', () => {
     );
   });
 
-  it('emits MOSAIC_AGENT_CLASS=worker for an agent that declares no class', async () => {
-    cleanup = await tempDir();
-    const rosterPath = join(cleanup, 'roster.json');
-    await writeFile(
-      rosterPath,
-      JSON.stringify({
-        version: 1,
-        transport: 'tmux',
-        agents: [{ name: 'coder0', runtime: 'codex' }],
-      }),
-    );
-    const roster = await loadFleetRoster(rosterPath);
-    expect(generateAgentEnv(roster, getRosterAgent(roster, 'coder0'))).toContain(
-      'MOSAIC_AGENT_CLASS=worker\n',
-    );
-  });
-
-  it('shell-escapes MOSAIC_AGENT_CLASS so a launcher reads it verbatim', async () => {
-    cleanup = await tempDir();
-    const rosterPath = join(cleanup, 'roster.json');
-    await writeFile(
-      rosterPath,
-      JSON.stringify({
-        version: 1,
-        transport: 'tmux',
-        agents: [{ name: 'coder0', runtime: 'codex', class: 'orchestrator' }],
-      }),
-    );
-    const roster = await loadFleetRoster(rosterPath);
-    expect(generateAgentEnv(roster, getRosterAgent(roster, 'coder0'))).toContain(
-      'MOSAIC_AGENT_CLASS=orchestrator\n',
-    );
-  });
-
   it('preserves site-owned agent EnvironmentFile overrides while refreshing roster keys', () => {
     const generated = [
       'MOSAIC_AGENT_NAME=coder0',
@@ -323,28 +286,6 @@ describe('fleet roster parsing', () => {
     );
   });
 
-  it('updates (does not duplicate) MOSAIC_AGENT_CLASS on re-launch', () => {
-    const generated = [
-      'MOSAIC_AGENT_NAME=coder0',
-      'MOSAIC_AGENT_CLASS=orchestrator',
-      'MOSAIC_AGENT_RUNTIME=codex',
-      '',
-    ].join('\n');
-    const existing = [
-      'MOSAIC_AGENT_NAME=coder0',
-      'MOSAIC_AGENT_CLASS=worker',
-      'MOSAIC_AGENT_RUNTIME=codex',
-      '',
-    ].join('\n');
-
-    const merged = mergeAgentEnv(generated, existing);
-    // mergeAgentEnv keys by VAR name, so the regenerated CLASS wins and there is
-    // exactly one MOSAIC_AGENT_CLASS line (no stale worker value left behind).
-    expect(merged).toContain('MOSAIC_AGENT_CLASS=orchestrator');
-    expect(merged).not.toContain('MOSAIC_AGENT_CLASS=worker');
-    expect(merged.match(/^MOSAIC_AGENT_CLASS=/gm)).toHaveLength(1);
-  });
-
   it('rejects unknown roster fields instead of silently defaulting', async () => {
     cleanup = await tempDir();
     const rosterPath = join(cleanup, 'roster.yaml');

packages/mosaic/src/commands/fleet.ts

@@ -11,7 +11,6 @@ import { resolveCommsBlock } from '../fleet/comms-onboarding.js';
 import { registerFleetBacklogCommand } from './fleet-backlog.js';
 import { registerFleetPersonaCommand } from './fleet-personas.js';
 import { registerFleetProfileCommand } from './fleet-profiles.js';
-import { registerFleetProvisionCommand } from './fleet-provision.js';
 
 /**
  * A function that spawns a command with inherited stdio (TTY passthrough).
@@ -491,9 +490,6 @@ export function generateAgentEnv(roster: FleetRoster, agent: FleetAgent): string
   const workingDirectory = agent.workingDirectory ?? roster.defaults.workingDirectory;
   return [
     `MOSAIC_AGENT_NAME=${shellEnvValue(agent.name)}`,
-    // Per-agent class → start-agent-session.sh / launcher reads this to inject the
-    // matching persona contract for the agent's class (default `worker`).
-    `MOSAIC_AGENT_CLASS=${shellEnvValue(agent.className)}`,
     `MOSAIC_AGENT_RUNTIME=${shellEnvValue(agent.runtime)}`,
     // Per-agent model hint → start-agent-session.sh appends `--model <hint>` to
     // the `mosaic yolo` launch so workers run on the roster's model (e.g. pi on
@@ -1721,10 +1717,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
   // --mosaic-home flag.
   registerFleetPersonaCommand(cmd, () => cmd.opts<{ mosaicHome: string }>().mosaicHome);
 
-  // Provisioning (H3): materialize a concrete roster.yaml from a system-type
-  // profile. DRY-RUN by default; --write persists under the same --mosaic-home.
-  registerFleetProvisionCommand(cmd, () => cmd.opts<{ mosaicHome: string }>().mosaicHome);
-
   return cmd;
 }
 

packages/mosaic/src/commands/launch.ts

@@ -20,7 +20,6 @@ import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import type { Command } from 'commander';
 import { readFleetCommsBlock } from '../fleet/comms-onboarding.js';
-import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 
 const MOSAIC_HOME = process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
 
@@ -385,16 +384,6 @@ For required push/merge/issue-close/release actions, execute without routine con
   // Runtime-specific contract
   parts.push('\n\n# Runtime-Specific Contract\n\n' + readFileSync(runtimeFile, 'utf-8'));
 
-  // Persona contract (A3b): when this agent was spawned with a class
-  // (MOSAIC_AGENT_CLASS, exported into the pane env by A3a), inject its resolved
-  // role contract so its identity (mandate + boundaries) is resident from the
-  // first turn. Override-aware via the persona resolver: a user-customized
-  // persona in fleet/roles.local/ wins over the baseline (AC-NS-7 launch proof).
-  // Placed BEFORE fleet comms: identity first, then how-to-reach-peers. No-ops
-  // silently when the class is unset/unknown (mirrors the comms block).
-  const persona = readPersonaContractBlock(mosaicHome, process.env['MOSAIC_AGENT_CLASS']);
-  if (persona) parts.push('\n\n' + persona);
-
   // Fleet onboarding: when this is a spawned fleet agent (MOSAIC_AGENT_NAME set
   // and present in the roster), inject a comms cheat-sheet + peer roster so it
   // knows how to reach the orchestrator and its peers from its first turn.

packages/mosaic/src/fleet/persona-contract.spec.ts

@@ -1,106 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { readPersonaContractBlock } from './persona-contract.js';
-
-/**
- * Persona-contract launch injection (A3b). Asserts the override-aware resolver
- * is wired so a customized persona in roles.local/ wins at launch (AC-NS-7), and
- * that any miss (unset/empty/unknown class, missing file) no-ops silently —
- * never throws — mirroring readFleetCommsBlock's tolerant contract.
- */
-
-const BASELINE_CODER = `# Coder — fleet role definition
-
-The **coder** persona (\`class: coder\`, \`domain: engineering\`).
-
-## Mandate
-
-BASELINE-MANDATE: implement the assigned lane.
-`;
-
-const OVERRIDE_CODER = `# Coder — fleet role definition (override)
-
-The **coder** persona (\`class: coder\`).
-
-## Mandate
-
-OVERRIDE-MANDATE: implement the assigned lane, the user's way.
-`;
-
-function makeHome(): string {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-persona-'));
-  return join(root, 'mosaic-home');
-}
-
-function seedBaseline(home: string, klass: string, body: string): void {
-  const dir = join(home, 'fleet', 'roles');
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, `${klass}.md`), body);
-}
-
-function seedOverride(home: string, klass: string, body: string): void {
-  const dir = join(home, 'fleet', 'roles.local');
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, `${klass}.md`), body);
-}
-
-describe('readPersonaContractBlock — launch-time persona injection (A3b)', () => {
-  let home: string;
-
-  beforeEach(() => {
-    home = makeHome();
-  });
-
-  afterEach(() => {
-    // root is the parent of mosaic-home
-    rmSync(join(home, '..'), { recursive: true, force: true });
-  });
-
-  it('injects the baseline persona when the class has a fleet/roles/<class>.md', () => {
-    seedBaseline(home, 'coder', BASELINE_CODER);
-    const block = readPersonaContractBlock(home, 'coder');
-    expect(block).toContain('# Persona Contract (coder)');
-    expect(block).toContain('BASELINE-MANDATE');
-    expect(block).toContain('baseline `fleet/roles/` layer');
-  });
-
-  it('OVERRIDE WINS: roles.local/<class>.md content is injected over the baseline (AC-NS-7)', () => {
-    seedBaseline(home, 'coder', BASELINE_CODER);
-    seedOverride(home, 'coder', OVERRIDE_CODER);
-    const block = readPersonaContractBlock(home, 'coder');
-    expect(block).toContain('# Persona Contract (coder)');
-    expect(block).toContain('OVERRIDE-MANDATE'); // override body present
-    expect(block).not.toContain('BASELINE-MANDATE'); // baseline NOT used
-    expect(block).toContain('roles.local'); // layer note names the override layer
-  });
-
-  it('injects an override-only (user-added) persona with no baseline at all', () => {
-    seedOverride(home, 'reviewer', '# Reviewer\n\n(`class: reviewer`)\n\nCUSTOM-ROLE.\n');
-    const block = readPersonaContractBlock(home, 'reviewer');
-    expect(block).toContain('# Persona Contract (reviewer)');
-    expect(block).toContain('CUSTOM-ROLE');
-  });
-
-  it('no-ops (empty string) when the class is undefined', () => {
-    seedBaseline(home, 'coder', BASELINE_CODER);
-    expect(readPersonaContractBlock(home, undefined)).toBe('');
-  });
-
-  it('no-ops (empty string) when the class is empty/whitespace', () => {
-    seedBaseline(home, 'coder', BASELINE_CODER);
-    expect(readPersonaContractBlock(home, '')).toBe('');
-    expect(readPersonaContractBlock(home, '   ')).toBe('');
-  });
-
-  it('no-ops (empty string) for an unknown class with no role file', () => {
-    seedBaseline(home, 'coder', BASELINE_CODER);
-    expect(readPersonaContractBlock(home, 'nonexistent')).toBe('');
-  });
-
-  it('no-ops (empty string, no throw) when no roles directories exist at all', () => {
-    expect(() => readPersonaContractBlock(home, 'coder')).not.toThrow();
-    expect(readPersonaContractBlock(home, 'coder')).toBe('');
-  });
-});

packages/mosaic/src/fleet/persona-contract.ts

@@ -1,63 +0,0 @@
-/**
- * Persona-contract injection at launch (North Star A3b).
- *
- * A spawned fleet agent should boot already knowing WHO it is: its class's role
- * contract (mandate + boundaries). The companion goal A3a exports the agent's
- * resolved class into the pane env as `MOSAIC_AGENT_CLASS`; here we read that
- * class at launch (composeContract → system prompt) and inject the resolved
- * persona contract so the identity is resident from the agent's first turn.
- *
- * OVERRIDE-AWARE: resolution goes through fleet-personas' resolver, so a
- * user-customized persona in the PRESERVE-protected `fleet/roles.local/` layer
- * WINS over the baseline `fleet/roles/` of the same class. That is the
- * launch-time proof of AC-NS-7 — a customized persona actually reaches the model
- * when the agent boots, not just in `mosaic fleet persona show`.
- *
- * Tolerant by contract (mirrors readFleetCommsBlock): an empty/missing class, an
- * unknown class, or a missing role file all yield '' so the launcher no-ops
- * silently. This MUST never throw during launch.
- *
- * Standalone module (no fleet.ts import) to keep launch.ts's prompt path free of
- * the heavy fleet command module; it depends only on the lightweight persona
- * resolver.
- */
-
-import {
-  resolvePersonaSync,
-  defaultRolesDir,
-  defaultOverrideDir,
-} from '../commands/fleet-personas.js';
-
-/**
- * Resolve `klass`'s persona contract (override-aware) and render it as a
- * clearly-delimited launch block. Returns '' on any miss (falsy class, unknown
- * class, missing/unreadable file) so composeContract can push it unconditionally
- * and have it no-op silently. Never throws.
- */
-export function readPersonaContractBlock(mosaicHome: string, klass: string | undefined): string {
-  if (!klass || !klass.trim()) return '';
-  let resolved: ReturnType<typeof resolvePersonaSync>;
-  try {
-    resolved = resolvePersonaSync(klass.trim(), {
-      rolesDir: defaultRolesDir(mosaicHome),
-      overrideDir: defaultOverrideDir(mosaicHome),
-    });
-  } catch {
-    // Best-effort onboarding: a resolver hiccup must not abort the launch.
-    return '';
-  }
-  if (!resolved) return '';
-
-  const layerNote =
-    resolved.layer === 'override'
-      ? '_(resolved from the `fleet/roles.local/` override layer — wins over baseline)_'
-      : '_(resolved from the baseline `fleet/roles/` layer)_';
-
-  return `# Persona Contract (${resolved.klass})
-
-${layerNote}
-
-You are operating as the **${resolved.klass}** persona. The role contract below is your identity — its mandate and boundaries govern what you own and what you must not do for this assignment.
-
-${resolved.content.trim()}`;
-}