test(gateway): size the enrollment clamp tolerance to CI jitter, not to a fast machine

Closes #1090. `clamps ttlSeconds to 900` asserted a wall-clock delta against a fixed 100 ms budget: expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100); That budget covers everything between `Date.now()` and the service computing `expiresAt`. On a loaded CI agent — this step runs alongside a Postgres service container and several other workspaces — it came back at 900_106 and failed by 6 ms (#1090, observed on pipeline 2258). The property under test is CLAMPING: a 9999s request must come back as 900s. The gap between clamped and unclamped is 9_099_000 ms, so the tolerance only has to exceed scheduler jitter to stay discriminating: clamped ~900_000 ms <= 905_000 ✓ < 1_000_000 ✓ unclamped ~9_999_000 ms <= 905_000 ✗ < 1_000_000 ✗ A 5s allowance consumes 0.055% of that margin, and an unclamped implementation still misses by three orders of magnitude. Also pins the clamp explicitly with `toBeLessThan(1_000_000)`, so the property is asserted independently of any timing allowance — widening the jitter budget later cannot silently weaken it. NOT DONE: I could not execute vitest here (no node_modules; a full install is minutes). The discrimination argument above is arithmetic, not an executed red/green. A reviewer should run the suite, and if it is cheap, confirm that removing the clamp in the service still fails this test.
feat(tools/git): explain tea's misleading user does not exist error (stale token, not a missing account) (#1086 )
2026-08-07 00:18:50 -05:00 · 2026-08-07 05:07:40 +00:00 · 2026-08-07 04:26:36 +00:00
12 changed files with 173 additions and 598 deletions
@@ -245,9 +245,21 @@ describe('EnrollmentService.createToken', () => {
    const after = Date.now();

    const expiresMs = new Date(result.expiresAt).getTime();
-    // Should be at most 900s from now
-    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100);
+
+    // The property under test is CLAMPING: a 9999s request must come back as 900s.
+    // The gap between clamped and unclamped is 9_099_000 ms, so the tolerance below
+    // only has to exceed CI scheduling jitter — it does not need to be tight to keep
+    // the assertion discriminating. A 5s allowance consumes 0.05% of that margin and
+    // an unclamped result still misses by three orders of magnitude.
+    //
+    // It was 100ms and failed on a loaded agent at 900_106 — 6ms over (#1090). A
+    // wall-clock budget sized to a fast machine is a flake, not a tighter test.
+    const CI_JITTER_MS = 5_000;
+    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + CI_JITTER_MS);
    expect(expiresMs - after).toBeGreaterThanOrEqual(0);
+    // Explicitly pin the clamp itself, independent of any timing allowance:
+    // unclamped (9999s) would exceed this by ~9_099_000 ms.
+    expect(expiresMs - before).toBeLessThan(1_000_000);
  });
 });

@@ -153,24 +153,7 @@ if [[ $link_only -eq 1 ]]; then
  exit 0
 fi

-# Skills are linked into the MOSAIC-OWNED harness homes, never a base install.
-# Paths mirror the config-dir env vars the launcher injects (HARNESS_HOME_ENV in
-# commands/launch.js):
-#   claude   CLAUDE_CONFIG_DIR      -> <home>/skills
-#   pi       PI_CODING_AGENT_DIR    -> <home>/skills   (replaces ~/.pi/agent)
-#   codex    CODEX_HOME             -> <home>/skills
-#   opencode XDG_CONFIG_HOME        -> <home>/opencode/skills  (XDG adds a level)
 link_targets=(
-  "$MOSAIC_HOME/.claude/skills"
-  "$MOSAIC_HOME/.codex/skills"
-  "$MOSAIC_HOME/.opencode/opencode/skills"
-  "$MOSAIC_HOME/.pi/skills"
-)
-
-# Pre-isolation installs planted the same symlink farm directly in the operator's
-# base installs. Those are now orphaned: the launcher no longer reads them, but
-# they persist and make a "clean" base install look mosaic-managed.
-legacy_link_targets=(
  "$HOME/.claude/skills"
  "$HOME/.codex/skills"
  "$HOME/.config/opencode/skills"
@@ -262,72 +245,13 @@ prune_stale_links_in_target() {
    # -m resolves lexical dangling targets too. If resolution fails, ownership
    # is unproven and the link must be preserved.
    resolved="$(readlink -m "$link_path" 2>/dev/null || true)"
-    # $canonical_real must be length-checked BEFORE use as a prefix: if it were
-    # ever empty, "$resolved" == "$canonical_real/"* collapses to == "/"* and
-    # matches every absolute path. Combined with the is_mosaic_skill_name skip
-    # above, that inverts the function precisely — it would delete exactly the
-    # FOREIGN symlinks and keep the mosaic ones. (#1087, reported by mos-claude.)
-    if [[ -n "$resolved" && -n "$canonical_real" && "$resolved" == "$canonical_real/"* ]]; then
+    if [[ -n "$resolved" && "$resolved" == "$canonical_real/"* ]]; then
      rm -f "$link_path"
      echo "[mosaic-skills] Removed stale retired skill link: $link_path"
    fi
  done < <(find "$target_dir" -mindepth 1 -maxdepth 1 -type l -print0)
 }

-# Remove mosaic-owned symlinks left in a base install by a pre-isolation sync.
-#
-# Ownership is proven by RESOLUTION, not by name: only links resolving inside the
-# canonical or local skills dirs are removed. Anything else — a real directory, a
-# link elsewhere, an unresolvable link — is left untouched. This mirrors the
-# refusal in commands/skill.js ("only symlinks pointing inside the Mosaic skills
-# directory are managed") and preserves e.g. codex's own `.system` dir.
-#
-# The directory itself is kept: mosaic-doctor warns when ~/.pi/agent/skills is
-# missing, and an empty dir is the correct end state, not an absent one.
-cleanup_legacy_target() {
-  local target_dir="$1"
-  local removed=0 kept=0
-
-  [[ -d "$target_dir" ]] || return 0
-
-  while IFS= read -r -d '' link_path; do
-    local resolved owned=0
-    resolved="$(readlink -m "$link_path" 2>/dev/null || true)"
-
-    # Guard the empty-prefix trap: an unset *_real would make "$resolved" == "/"*
-    # match every absolute path and delete foreign links.
-    if [[ -n "$resolved" ]]; then
-      if [[ -n "$canonical_real" && "$resolved" == "$canonical_real/"* ]]; then
-        owned=1
-      elif [[ -n "$local_real" && "$resolved" == "$local_real/"* ]]; then
-        owned=1
-      fi
-    fi
-
-    if [[ $owned -eq 1 ]]; then
-      rm -f "$link_path"
-      removed=$((removed + 1))
-    else
-      kept=$((kept + 1))
-    fi
-  done < <(find "$target_dir" -mindepth 1 -maxdepth 1 -type l -print0)
-
-  if [[ $removed -gt 0 ]]; then
-    echo "[mosaic-skills] Legacy cleanup: removed $removed mosaic symlink(s) from $target_dir (preserved $kept foreign)"
-  fi
-}
-
-for legacy in "${legacy_link_targets[@]}"; do
-  # Skip anything that is also a current target, so isolation can never
-  # self-destruct if the two lists ever overlap.
-  skip=0
-  for target in "${link_targets[@]}"; do
-    [[ "$legacy" == "$target" ]] && skip=1
-  done
-  [[ $skip -eq 1 ]] && continue
-  cleanup_legacy_target "$legacy"
-done
-
 for target in "${link_targets[@]}"; do
  mkdir -p "$target"

@@ -5,7 +5,10 @@

 detect_platform() {
    local remote_url
-    remote_url=$(git remote get-url origin 2>/dev/null)
+    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
+    # kills the CALLER before the -z check below can run, so the error message that is
+    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
+    remote_url=$(git remote get-url origin 2>/dev/null) || true

    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -39,7 +42,10 @@ detect_platform() {

 get_repo_info() {
    local remote_url
-    remote_url=$(git remote get-url origin 2>/dev/null)
+    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
+    # kills the CALLER before the -z check below can run, so the error message that is
+    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
+    remote_url=$(git remote get-url origin 2>/dev/null) || true

    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -240,6 +246,21 @@ PY
    } >&2
 }

+# Explain tea's most misleading failure. `user does not exist [uid: 0, name: ]` reads
+# as a missing account; it almost always means a REVOKED OR STALE TOKEN. `tea login`
+# keeps its OWN COPY of the token, so rotating the credential store does not update it.
+# Diagnostic only -- stderr, no control flow, no exit.
+explain_tea_user_does_not_exist() {
+    cat >&2 <<'MSG'
+NOTE: `user does not exist [uid: 0, name: ]` from tea usually means a REVOKED OR STALE TOKEN,
+      not a missing account. A `tea login` stores its OWN COPY of the token; rotating the
+      credential store does NOT update it.
+      CHECK: the login's cached copy (`tea login list` -- read the FULL table, never `| head`),
+             then re-register that login against the current token.
+      DO NOT probe capability with a mutating request; a POST is the action, not a check.
+MSG
+}
+
 get_gitea_login_for_host() {
    local host="${1:-}"
    local login
@@ -156,6 +156,7 @@ case "$PLATFORM" in
                exit 0
            fi
            echo "Warning: tea issue create failed, trying Gitea API fallback..." >&2
+            { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
        fi
        gitea_issue_create_api
        ;;
@@ -71,6 +71,7 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
            exit 0
        fi
        echo "Warning: tea issue view failed, trying Gitea API fallback..." >&2
+        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
    fi
    gitea_issue_view_api
 else
@@ -219,6 +219,7 @@ case "$PLATFORM" in
            exit 0
        fi
        echo "Warning: tea pr create failed, trying Gitea API fallback..." >&2
+        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
        gitea_pr_create_api
        ;;
    *)
@@ -0,0 +1,58 @@
+#!/bin/bash
+# Regression: detect_platform / get_repo_info must FAIL LOUDLY outside a git repo,
+# not kill the caller silently.
+#
+# Both functions already contained the right error path:
+#     if [[ -z "$remote_url" ]]; then echo "error: not a git repository..." >&2; return 1; fi
+# but under `set -e` -- which every wrapper in this directory uses -- the preceding
+# assignment `remote_url=$(git remote get-url origin 2>/dev/null)` returns git's 128
+# outside a repo and terminates the CALLER first. The message was unreachable.
+#
+# Observed cost: pr-review.sh invoked from a non-repo cwd exits 128 with NO stdout and
+# NO stderr, even when -r/--repo and -H/--host are supplied -- the flags documented as
+# "skips git-remote inference". Two reviewer seats hit this and correctly reported
+# `blocked` with no diagnostic to report.
+#
+# The control that matters is the LOUD one: asserting "rc != 0" passes on the broken
+# build too, because 128 is also non-zero. The test must assert the MESSAGE.
+set -uo pipefail
+fail=0
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+run_outside() { # $1=function name -> "rc:sawmessage"
+    local fn="$1" out rc
+    out=$( cd "$TMP" && bash -c "set -e; source '$HERE/detect-platform.sh'; $fn" 2>&1 ); rc=$?
+    printf '%s:%s' "$rc" "$(grep -qi 'not a git repository' <<<"$out" && echo yes || echo no)"
+}
+check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
+
+# $TMP must not be inside a git repo. Do not SKIP on failure: be-coder-07 showed the
+# original SKIP exited 0, so pointing TMPDIR beneath a git worktree made this test PASS
+# against unchanged main. A skip that exits 0 is indistinguishable from a pass.
+# GIT_CEILING_DIRECTORIES stops git walking above $TMP, making the condition hold
+# regardless of where TMPDIR lives, rather than merely detecting when it does not.
+# GIT_CEILING_DIRECTORIES is matched against the PHYSICAL path -- a symlinked TMPDIR
+# (/tmp is commonly one) makes the logical path never match, and the ceiling silently
+# does nothing. Resolve it before exporting.
+TMP="$(cd "$TMP" && pwd -P)"
+export GIT_CEILING_DIRECTORIES="$TMP"
+if ( cd "$TMP" && git rev-parse --git-dir >/dev/null 2>&1 ); then
+    echo "  FAIL  scratch dir is inside a git repo even with GIT_CEILING_DIRECTORIES set;"
+    echo "        the outside-a-repo precondition cannot be established -- refusing to report a result"
+    exit 1
+fi
+
+echo "== outside a git repo: rc=1 AND the diagnostic is emitted =="
+check "detect_platform" "$(run_outside detect_platform)" "1:yes"
+check "get_repo_info"   "$(run_outside get_repo_info)"   "1:yes"
+
+echo "== inside a git repo the functions still work =="
+git init -q "$TMP/repo" 2>/dev/null
+git -C "$TMP/repo" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git 2>/dev/null
+out=$( cd "$TMP/repo" && bash -c "set -e; source '$HERE/detect-platform.sh'; detect_platform" 2>&1 ); rc=$?
+if [ "$rc" -eq 0 ] && grep -qi 'gitea' <<<"$out"; then echo "  PASS  detect_platform in-repo (rc=0, $out)"
+else echo "  FAIL  detect_platform in-repo: rc=$rc out=$out"; fail=1; fi
+
+[ "$fail" -eq 0 ] && echo "OK  detect-platform fails loudly outside a repo" || echo "FAILED"
+exit "$fail"
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Regression: the tea-failure diagnostic must be STATUS-NEUTRAL.
+#
+# Found by be-coder-08 reviewing PR #1086. At all three call sites the diagnostic is emitted
+# immediately BEFORE the Gitea API fallback. Written as the last command of an && list:
+#     declare -F explain_... >/dev/null && explain_...
+# under `set -e` a FAILING diagnostic exits and the fallback never runs -- a diagnostic that
+# suppresses the recovery path it exists to explain. It misbehaves ONLY when the helper is
+# PRESENT, so the helper-absent path (pre-#1086 behaviour) keeps working and reads as a
+# passing control.
+#
+# TWO DEFECTS IN THE FIRST VERSION OF THIS TEST, both found by be-coder-08:
+#   1. `out=$( ... ) 2>"$errto"` applies the redirection to the ASSIGNMENT, not to the
+#      command substitution, so the probe's stderr was never actually pointed at /dev/full
+#      and the /dev/full rows proved nothing. Verified: `out=$(echo x >&2) 2>/dev/full`
+#      leaks to the terminal and returns 0; the redirect must be INSIDE the substitution.
+#   2. `eval "$CONSTRUCT"` changes `set -e` semantics for a bare && list, so the probe did
+#      not exercise the construct as the shipped file executes it. It now writes the line
+#      into a real script and runs it -- same parse, same set -e rules, no eval.
+# The construct is still LIFTED FROM THE SHIPPED FILE: retyping the fixed form makes the
+# probe pass on a build whose real call sites still carry the bare && form.
+set -uo pipefail
+fail=0
+GIT_DIR_UNDER_TEST="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+probe() { # $1=present|absent  $2=stderr target  $3=source file  -> "rc:fallback"
+    local helper="$1" errto="$2" src="$3" construct script out rc
+    construct=$(grep -m1 'explain_tea_user_does_not_exist' "$GIT_DIR_UNDER_TEST/$src" | sed 's/^[[:space:]]*//')
+    [ -n "$construct" ] || { printf 'no-construct:no'; return; }
+    script="$TMP/probe.sh"
+    {
+        echo '#!/bin/bash'
+        echo 'set -e'
+        echo 'explain_tea_user_does_not_exist() { echo "diagnostic" >&2; }'
+        [ "$helper" = absent ] && echo 'unset -f explain_tea_user_does_not_exist'
+        echo "$construct"                # the shipped line, parsed by a real shell
+        echo 'echo FALLBACK_REACHED'
+    } > "$script"
+    # redirect INSIDE the substitution so the subshell's stderr really is $errto
+    out=$( bash "$script" 2>"$errto" ); rc=$?
+    printf '%s:%s' "$rc" "$(grep -q FALLBACK_REACHED <<<"$out" && echo yes || echo no)"
+}
+
+check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
+
+echo "== diagnostic must not alter exit status or skip the fallback =="
+# /dev/full makes every stderr write fail -- the real-world shape is a closed or full fd.
+for src in pr-create.sh issue-view.sh issue-create.sh; do
+    check "$src stderr OK      / helper present" "$(probe present /dev/null "$src")" "0:yes"
+    check "$src stderr OK      / helper absent " "$(probe absent  /dev/null "$src")" "0:yes"
+    check "$src stderr FAILING / helper present" "$(probe present /dev/full "$src")" "0:yes"
+    check "$src stderr FAILING / helper absent " "$(probe absent  /dev/full "$src")" "0:yes"
+done
+
+echo "== all three call sites use the status-neutral form =="
+for f in pr-create.sh issue-view.sh issue-create.sh; do
+    p="$GIT_DIR_UNDER_TEST/$f"
+    grep -q '{ declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true' "$p" \
+        && echo "  PASS  $f guarded" || { echo "  FAIL  $f: diagnostic is not status-neutral"; fail=1; }
+done
+
+[ "$fail" -eq 0 ] && echo "OK  diagnostic is status-neutral" || echo "FAILED"
+exit "$fail"
@@ -8,9 +8,7 @@ import json
 import os
 import socket
 import sys
-import time
 from collections.abc import Callable, Mapping, Sequence
-from datetime import datetime, timezone
 from pathlib import Path
 from typing import Final

@@ -55,48 +53,6 @@ def broker_request(socket_path: Path, request: dict[str, object]) -> dict[str, o
    return value


-def _self_starttime() -> str | None:
-    """Field 22 of our own /proc stat — the anchor starttime the broker records.
-
-    Read past the comm field's parens, since a process name may contain them.
-    """
-    try:
-        raw = Path(f"/proc/{os.getpid()}/stat").read_text()
-        return raw.rsplit(")", 1)[1].split()[19]
-    except (OSError, IndexError, ValueError):
-        return None
-
-
-def _append_launch_record(environ: Mapping[str, str], record: dict[str, object]) -> None:
-    """Append one NDJSON event to the #797 Runtime Session Ledger.
-
-    `fleet/run/sessions/` is operator-classified in framework-manifest.txt and is
-    already covered by test-upgrade-manifest-guard.sh, so an upgrade can neither
-    overwrite nor prune it. Files 0600 under a 0700 dir, matching what that guard
-    asserts.
-
-    Never raises: a launch must not be denied over bookkeeping. But it also never
-    fails silently — a missing record is exactly the kind of gap that made the
-    2026-08-06 MUTATOR_UNVERIFIED investigation cost a day.
-    """
-    try:
-        mosaic_home = environ.get("MOSAIC_HOME") or str(Path.home() / ".config" / "mosaic")
-        directory = Path(mosaic_home) / "fleet" / "run" / "sessions"
-        directory.mkdir(parents=True, exist_ok=True)
-        os.chmod(directory, 0o700)
-        framed = {
-            "seq": time.time_ns() // 1_000_000,
-            "ts": datetime.now(timezone.utc).isoformat(),
-            **record,
-        }
-        path = directory / "events.ndjson"
-        descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
-        with os.fdopen(descriptor, "w") as handle:
-            handle.write(json.dumps(framed, separators=(",", ":")) + "\n")
-    except (OSError, ValueError, TypeError) as error:
-        print(f"[mosaic] WARNING: launch record not written: {error}", file=sys.stderr)
-
-
 def main(
    argv: Sequence[str] | None = None,
    *,
@@ -138,9 +94,8 @@ def main(
    # silent pass and never folded into the generic registration-failure
    # branch.
    try:
-        activation_capability = probe_activation_capability(source_environment)
        assert_activation_capability_matches(
-            activation_capability,
+            probe_activation_capability(source_environment),
            expected_activation_capability,
        )
    except VersionCouplingError as version_error:
@@ -173,32 +128,6 @@ def main(
        print("Mosaic lease broker registration failed; runtime launch denied.", file=sys.stderr)
        return 1

-    # Immutable launch record, half two. `mosaic` wrote `session.launch` with the
-    # config/provenance it knows; only this process knows the broker session id
-    # and the activation capability it just asserted. os.execvpe preserves the
-    # PID, so this PID is BOTH the anchor pid and the join key back to that
-    # record. Never fatal — bookkeeping must not deny a launch — but never
-    # silent either.
-    _append_launch_record(
-        source_environment,
-        {
-            "kind": "lease.register",
-            # Joins back to `mosaic`'s session.launch record. NOT pid: execRuntime()
-            # spawns rather than execs, so this process is a CHILD of mosaic with a
-            # different pid. This pid IS the broker anchor pid (os.execvpe below
-            # preserves it), which is a separate and still-useful fact.
-            "launch_id": source_environment.get("MOSAIC_LAUNCH_ID"),
-            "pid": os.getpid(),
-            "runtime": arguments.runtime,
-            "session_id": session_id,
-            "runtime_generation": generation,
-            "generation_file": str(generation_file),
-            "anchor_starttime": _self_starttime(),
-            "activation_capability": activation_capability,
-            "command": Path(command[0]).name,
-        },
-    )
-
    environment = dict(source_environment)
    environment["MOSAIC_LEASE_SESSION_ID"] = session_id
    environment["MOSAIC_RUNTIME_GENERATION"] = str(generation)
@@ -1,269 +0,0 @@
-#!/usr/bin/env python3
-"""Lease promotion client — the half the enforcement toolkit never shipped.
-
-The enforcement half (``daemon.py`` + ``mutator-gate.py``) ships and denies. The
-promotion half has no production caller anywhere in the package: as of 0.0.48,
-0.0.49 and 0.0.50-next.2207, ``begin_verification`` / ``observe_receipt`` /
-``promote_lease`` are invoked only by ``broker-test-client.ts``, the acceptance
-spec, unit tests, and two probes under ``docs/``. Consequence: **no lease on any
-host can reach VERIFIED**, so every mutator is denied ``MUTATOR_UNVERIFIED`` by a
-gate nothing can satisfy.
-
-THE PROTOCOL (``daemon.py:578-754``)
------------------------------------
-  1. ``begin_verification`` — broker revokes, mints a challenge, and returns the
-     exact ``receipt`` text the MODEL must emit
-  2. *the model emits that text verbatim as its ENTIRE latest message*
-  3. the runtime adapter ships that message to the daemon-owned observer socket
-  4. ``observe_receipt``  -> ``PENDING_PROMOTION``
-  5. ``promote_lease``    -> ``VERIFIED``
-
-THIS MODULE IMPLEMENTS 1, 4 AND 5 — NEVER 2
-------------------------------------------
-Step 2 is the security property, not a formality. ``is_verbatim_receipt`` uses
-``hmac.compare_digest`` against the exact minted string — explicitly "not a
-transcript substring" (``receipt_challenge.py``). Promotion therefore requires a
-live model that received the challenge in its context and echoed it exactly.
-
-``receipt-observer-client.py`` will post ANY string as the latest assistant
-message. A promotion client that posted its own receipt would satisfy the broker
-while proving nothing — a gate-disabler indistinguishable from a working fix
-unless someone looks for it. **This module never posts a receipt.** Emitting it
-belongs to the runtime adapter, where a real model turn happens.
-
-The construction binds the exact normative source bytes, so a VERIFIED lease
-means "this agent is running THIS law", not merely "this session id is known".
-``h_source`` / ``h_payload`` are derived by the framework's own
-``normative_fragments.build_payload`` rather than reimplemented: the broker
-derives them the same way and any divergence yields ``PAYLOAD_BINDING_MISMATCH``.
-There must be exactly one implementation.
-
-Usage
-----
-    lease_promote.py --begin                 # prints the receipt the MODEL must emit
-    lease_promote.py --complete <challenge>  # after the adapter observed it
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import json
-import os
-import socket
-import sys
-from pathlib import Path
-from typing import Final
-
-# Isolated (`python -I`) adapter invocations must still import co-located
-# framework modules; never depend on the caller's PYTHONPATH.
-_MODULE_DIRECTORY = str(Path(__file__).resolve().parent)
-if _MODULE_DIRECTORY not in sys.path:
-    sys.path.insert(0, _MODULE_DIRECTORY)
-
-from normative_fragments import NormativeFragment, build_payload  # noqa: E402
-
-MAX_FRAME: Final = 64 * 1024
-BROKER_TIMEOUT_SECONDS: Final = 3.0
-SCHEMA_VERSION: Final = 1
-MANIFEST_VERSION: Final = 1
-GENERATOR_VERSION: Final = "mosaic/lease_promote@1"
-DEFAULT_TTL_SECONDS: Final = 300
-
-# Normative sources whose exact bytes bind the lease. Sources absent on a given
-# deployment are simply not part of the binding — never fabricated.
-FRAGMENT_SOURCES: Final = (
-    "CONSTITUTION.md",
-    "AGENTS.md",
-    "SOUL.md",
-    "USER.md",
-    "STANDARDS.md",
-    "TOOLS.md",
-)
-
-
-def mosaic_home() -> Path:
-    return Path(os.environ.get("MOSAIC_HOME") or Path.home() / ".config" / "mosaic")
-
-
-def broker_socket() -> Path:
-    value = os.environ.get("MOSAIC_LEASE_BROKER_SOCKET")
-    if value:
-        return Path(value)
-    runtime_dir = os.environ.get("XDG_RUNTIME_DIR")
-    if runtime_dir:
-        return Path(runtime_dir) / "mosaic-lease" / "broker.sock"
-    return Path(f"/run/user/{os.getuid()}/mosaic-lease/broker.sock")
-
-
-def session_identity() -> tuple[str, int, str]:
-    """Session id, CURRENT generation, runtime.
-
-    The generation file wins over the env var, matching ``lease_generation.py``.
-    Sending a generation HIGHER than the broker's would revoke this session's own
-    authority (``daemon.py:342-344``), so this never guesses.
-    """
-    session_id = os.environ["MOSAIC_LEASE_SESSION_ID"]
-    runtime = os.environ["MOSAIC_LEASE_RUNTIME"]
-    state_file = os.environ.get("MOSAIC_LEASE_GENERATION_FILE")
-    if state_file:
-        try:
-            return session_id, int(Path(state_file).read_text().strip()), runtime
-        except (OSError, ValueError):
-            pass
-    return session_id, int(os.environ["MOSAIC_RUNTIME_GENERATION"]), runtime
-
-
-def build_construction(runtime: str) -> tuple[dict[str, object], object]:
-    """Assemble the wire construction and derive its hashes with the sole builder."""
-    sources = list(FRAGMENT_SOURCES) + [f"runtime/{runtime}/RUNTIME.md"]
-    wire_fragments: list[dict[str, str]] = []
-    objects: list[NormativeFragment] = []
-
-    for source_id in sources:
-        try:
-            content = (mosaic_home() / source_id).read_bytes()
-        except OSError:
-            continue
-        import hashlib
-
-        digest = hashlib.sha256(content).hexdigest()
-        wire_fragments.append(
-            {
-                "source_id": source_id,
-                "content_base64": base64.b64encode(content).decode("ascii"),
-                "expected_sha256": digest,
-            }
-        )
-        objects.append(NormativeFragment(source_id, content, digest))
-
-    if not wire_fragments:
-        raise RuntimeError("no normative sources found — refusing to build an empty binding")
-
-    result = build_payload(
-        manifest_version=MANIFEST_VERSION,
-        generator_version=GENERATOR_VERSION,
-        fragments=objects,
-    )
-    if result.injectionDecision != "ACCEPTED" or not result.promotion:
-        raise RuntimeError(f"construction refused locally: {result.source_reason}")
-
-    return (
-        {
-            "manifest_version": MANIFEST_VERSION,
-            "generator_version": GENERATOR_VERSION,
-            "fragments": wire_fragments,
-        },
-        result,
-    )
-
-
-def broker_request(payload: dict[str, object]) -> dict[str, object]:
-    raw = (json.dumps(payload, separators=(",", ":")) + "\n").encode()
-    if len(raw) > MAX_FRAME:
-        raise ValueError(
-            f"request too large ({len(raw)} bytes); broker frame cap is {MAX_FRAME}"
-        )
-    response = bytearray()
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
-        connection.settimeout(BROKER_TIMEOUT_SECONDS)
-        connection.connect(str(broker_socket()))
-        connection.sendall(raw)
-        connection.shutdown(socket.SHUT_WR)
-        while len(response) <= MAX_FRAME:
-            chunk = connection.recv(4096)
-            if not chunk:
-                break
-            response.extend(chunk)
-    if len(response) > MAX_FRAME or not response.endswith(b"\n"):
-        raise ValueError("invalid broker reply")
-    value = json.loads(response)
-    if not isinstance(value, dict):
-        raise ValueError("invalid broker reply")
-    return value
-
-
-def begin(
-    ttl_seconds: int = DEFAULT_TTL_SECONDS,
-    compaction_epoch: int = 0,
-    request_epoch: int = 0,
-) -> dict[str, object]:
-    """Step 1. Returns the broker reply, including the exact ``receipt`` text."""
-    session_id, generation, runtime = session_identity()
-    construction, derived = build_construction(runtime)
-    return broker_request(
-        {
-            "action": "begin_verification",
-            "session_id": session_id,
-            "runtime_generation": generation,
-            "runtime": runtime,
-            "ttl_seconds": ttl_seconds,
-            "binding": {
-                "compaction_epoch": compaction_epoch,
-                "request_epoch": request_epoch,
-                "h_source": derived.h_source,
-                "h_payload": derived.h_payload,
-                "schema_version": SCHEMA_VERSION,
-            },
-            "construction": construction,
-        }
-    )
-
-
-def complete(challenge: str) -> dict[str, object]:
-    """Steps 4-5. Assumes the model already emitted the receipt and the adapter
-    shipped it to the observer socket."""
-    session_id, generation, _ = session_identity()
-    observed = broker_request(
-        {
-            "action": "observe_receipt",
-            "session_id": session_id,
-            "runtime_generation": generation,
-            "receipt_challenge": challenge,
-        }
-    )
-    if observed.get("ok") is not True or observed.get("state") != "PENDING_PROMOTION":
-        return {"stage": "observe_receipt", **observed}
-    promoted = broker_request(
-        {
-            "action": "promote_lease",
-            "session_id": session_id,
-            "runtime_generation": generation,
-            "receipt_challenge": challenge,
-        }
-    )
-    return {"stage": "promote_lease", **promoted}
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(description="Mosaic lease promotion client.")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument(
-        "--begin",
-        action="store_true",
-        help="mint a challenge; prints the receipt the MODEL must emit verbatim",
-    )
-    group.add_argument(
-        "--complete",
-        metavar="CHALLENGE",
-        help="observe the emitted receipt and promote the lease",
-    )
-    parser.add_argument("--ttl-seconds", type=int, default=DEFAULT_TTL_SECONDS)
-    arguments = parser.parse_args(argv)
-
-    try:
-        if arguments.begin:
-            print(json.dumps(begin(ttl_seconds=arguments.ttl_seconds), indent=2))
-        else:
-            print(json.dumps(complete(arguments.complete), indent=2))
-    except KeyError as exc:
-        print(f"missing lease environment: {exc}; not a lease-gated session", file=sys.stderr)
-        return 2
-    except (OSError, ValueError, RuntimeError, json.JSONDecodeError) as exc:
-        print(f"{type(exc).__name__}: {exc}", file=sys.stderr)
-        return 2
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-explain-diagnostic-status-neutral.sh && bash framework/tools/git/test-detect-platform-outside-repo.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -14,11 +14,9 @@ import {
  readdirSync,
  realpathSync,
  rmSync,
-  appendFileSync,
 } from 'node:fs';
-import { createHash, randomBytes } from 'node:crypto';
 import { createRequire } from 'node:module';
-import { homedir, hostname } from 'node:os';
+import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import type { Command } from 'commander';
 import {
@@ -44,163 +42,6 @@ const RUNTIME_LABELS: Record<RuntimeName, string> = {
  pi: 'Pi',
 };

-// ─── Harness home isolation ──────────────────────────────────────────────────
-// Mosaic-launched runtimes read config from a dedicated home under the mosaic
-// tree — never the operator's base install. A bare `claude` / `pi` therefore
-// keeps its own config AND its own auth, and stays a working break-glass no
-// matter what mosaic does to its own tree.
-//
-// These paths are manifest-UNKNOWN, which resolves to operator ownership
-// (framework-manifest.txt rule 3, #791), so a keep-mode `mosaic update` can
-// neither overwrite nor prune them. Overwrite-mode install still would.
-//
-// opencode has no dedicated config-dir variable and follows XDG, so isolating it
-// sets XDG_CONFIG_HOME for that process tree. That is blunter than the other
-// three: it also relocates XDG lookups for anything opencode spawns.
-const HARNESS_HOME_ENV: Record<RuntimeName, string> = {
-  claude: 'CLAUDE_CONFIG_DIR',
-  pi: 'PI_CODING_AGENT_DIR',
-  codex: 'CODEX_HOME',
-  opencode: 'XDG_CONFIG_HOME',
-};
-
-/** Dedicated mosaic-owned home for a runtime: ~/.config/mosaic/.<runtime> */
-function harnessHome(runtime: RuntimeName): string {
-  return join(MOSAIC_HOME, `.${runtime}`);
-}
-
-/**
- * Env overlay pointing a runtime at its mosaic-owned home. The directory is
- * created on demand so a first launch does not fail on a missing path.
- */
-function harnessEnv(runtime: RuntimeName): Record<string, string> {
-  const key = HARNESS_HOME_ENV[runtime];
-  if (!key) return {};
-  const home = harnessHome(runtime);
-  mkdirSync(home, { recursive: true });
-  return { [key]: home };
-}
-
-// ─── Launch record (immutable provenance) ────────────────────────────────────
-// MANDATORY and MECHANICAL: every launch appends one record of what the agent
-// actually launched with, written before exec. No model involvement, no opt-out.
-//
-// WHY LAUNCH-TIME AND NOT INSPECT-LATER: pi rewrites its own argv to a bare
-// `pi`, so /proc/<pid>/cmdline DESTROYS the launch evidence. That has already
-// produced a confident wrong diagnosis ("this agent bypassed the launcher"),
-// disproved only by the parent process's argv and only because the parent had
-// not yet exited. A record written before exec is the only place this survives.
-//
-// Lands in fleet/run/sessions/ — the #797 Runtime Session Ledger path, already
-// operator-classified in framework-manifest.txt and already covered by
-// test-upgrade-manifest-guard.sh, so an upgrade can neither overwrite nor prune
-// it.
-//
-// CORRELATION is by an explicit MOSAIC_LAUNCH_ID, never by pid: execRuntime()
-// uses spawnSync, so the runtime is a CHILD with a different pid.
-// launch-runtime.py appends the matching `lease.register` event.
-//
-// NEVER records a credential value: env is captured as PRESENT NAMES ONLY, and
-// oversized argv values (the composed system prompt) become a digest + length.
-const LAUNCH_LEDGER_DIR = join(MOSAIC_HOME, 'fleet', 'run', 'sessions');
-
-const CLI_VERSION: string | null = (() => {
-  try {
-    // Resolved RELATIVELY: the package `exports` map does not expose
-    // package.json, so '@mosaicstack/mosaic/package.json' throws
-    // ERR_PACKAGE_PATH_NOT_EXPORTED. Same relative depth from src/ and dist/.
-    return (createRequire(import.meta.url)('../../package.json') as { version: string }).version;
-  } catch {
-    return null;
-  }
-})();
-
-interface NormativeFragmentDigest {
-  source_id: string;
-  sha256: string | null;
-  bytes: number | null;
-  missing?: boolean;
-}
-
-function sha256Of(value: string | Buffer): string {
-  return createHash('sha256').update(value).digest('hex');
-}
-
-/**
- * Hash the normative sources injected into the agent. This is "what the agent
- * IS" — and it is the same fragment set the lease broker hashes for promotion,
- * so an unexpected digest here is a mechanically detectable red flag rather than
- * a matter of judgement.
- */
-function normativeFragmentDigests(runtime: RuntimeName): NormativeFragmentDigest[] {
-  const candidates: Array<[string, string]> = [
-    ['CONSTITUTION.md', join(MOSAIC_HOME, 'CONSTITUTION.md')],
-    ['AGENTS.md', join(MOSAIC_HOME, 'AGENTS.md')],
-    ['SOUL.md', join(MOSAIC_HOME, 'SOUL.md')],
-    ['USER.md', join(MOSAIC_HOME, 'USER.md')],
-    ['STANDARDS.md', join(MOSAIC_HOME, 'STANDARDS.md')],
-    ['TOOLS.md', join(MOSAIC_HOME, 'TOOLS.md')],
-    [`runtime/${runtime}/RUNTIME.md`, join(MOSAIC_HOME, 'runtime', runtime, 'RUNTIME.md')],
-  ];
-  return candidates.map(([sourceId, path]) => {
-    try {
-      const bytes = readFileSync(path);
-      return { source_id: sourceId, sha256: sha256Of(bytes), bytes: bytes.length };
-    } catch {
-      return { source_id: sourceId, sha256: null, bytes: null, missing: true };
-    }
-  });
-}
-
-/** argv with oversized values replaced by a digest, so the record stays small
- * and never inlines injected content verbatim. */
-function redactArgv(argv: string[]): string[] {
-  return argv.map((a) =>
-    typeof a === 'string' && a.length > 256
-      ? `<redacted sha256:${sha256Of(a).slice(0, 16)} bytes:${a.length}>`
-      : a,
-  );
-}
-
-function recordLaunch(runtime: RuntimeName, cliArgs: string[], yolo: boolean): void {
-  try {
-    mkdirSync(LAUNCH_LEDGER_DIR, { recursive: true, mode: 0o700 });
-    // Correlation id for the lease.register half. Set into process.env so it
-    // propagates through every `...process.env` / `...baseEnv` spread below.
-    const launchId = `${Date.now().toString(36)}-${randomBytes(6).toString('hex')}`;
-    process.env['MOSAIC_LAUNCH_ID'] = launchId;
-    const record = {
-      seq: Date.now(),
-      kind: 'session.launch',
-      launch_id: launchId,
-      ts: new Date().toISOString(),
-      host: hostname(),
-      pid: process.pid,
-      runtime,
-      mode: yolo ? 'yolo' : 'normal',
-      cwd: process.cwd(),
-      cli_version: CLI_VERSION,
-      config_home: harnessHome(runtime),
-      config_home_isolated: true,
-      config_home_env: HARNESS_HOME_ENV[runtime] ?? null,
-      argv: redactArgv(cliArgs),
-      normative_fragments: normativeFragmentDigests(runtime),
-      // names only — values are never recorded
-      mosaic_env_present: Object.keys(process.env)
-        .filter((k) => k.startsWith('MOSAIC_'))
-        .sort(),
-    };
-    appendFileSync(join(LAUNCH_LEDGER_DIR, 'events.ndjson'), `${JSON.stringify(record)}\n`, {
-      mode: 0o600,
-    });
-  } catch (err) {
-    // Never block a launch on bookkeeping — but never fail silently either.
-    console.error(
-      `[mosaic] WARNING: launch record not written: ${err instanceof Error ? err.message : String(err)}`,
-    );
-  }
-}
-
 // ─── Pre-flight checks ──────────────────────────────────────────────────────

 function checkMosaicHome(): void {
@@ -264,11 +105,11 @@ interface SettingsAudit {

 function auditClaudeSettings(): SettingsAudit {
  const warnings: string[] = [];
-  const settingsPath = join(harnessHome('claude'), 'settings.json');
+  const settingsPath = join(homedir(), '.claude', 'settings.json');
  const settings = readJson(settingsPath);

  if (!settings) {
-    warnings.push(`${settingsPath} not found — hooks and plugins will be missing`);
+    warnings.push('~/.claude/settings.json not found — hooks and plugins will be missing');
    return { warnings };
  }

@@ -720,9 +561,7 @@ function skillRealPath(dir: string): string {
 /** Skill roots Pi auto-discovers natively (no `--skill` needed): its global
 * skills dir and the project-local one relative to the launch cwd. */
 function piNativeSkillRoots(cwd: string = process.cwd()): string[] {
-  // PI_CODING_AGENT_DIR replaces ~/.pi/agent (not ~/.pi), so skills live at
-  // <home>/skills — there is no extra 'agent' segment under the isolated home.
-  return [join(harnessHome('pi'), 'skills'), join(cwd, '.pi', 'skills')];
+  return [join(homedir(), '.pi', 'agent', 'skills'), join(cwd, '.pi', 'skills')];
 }

 /** Enumerate skill dirs under a set of roots, deduped by real path. A directory
@@ -925,13 +764,12 @@ function launchRuntime(runtime: RuntimeName, args: string[], yolo: boolean): nev
        cliArgs.push(...args);
      }
      console.log(`[mosaic] Launching ${label}${modeStr}${missionStr}...`);
-      recordLaunch('claude', cliArgs, yolo);
      execLeaseGatedRuntime('claude', cliArgs, process.env, yolo);
      break;
    }

    case 'codex': {
-      ensureRuntimeConfig('codex', join(harnessHome('codex'), 'instructions.md'));
+      ensureRuntimeConfig('codex', join(homedir(), '.codex', 'instructions.md'));
      const cliArgs = yolo ? ['--dangerously-bypass-approvals-and-sandbox'] : [];
      if (hasMissionNoArgs) {
        cliArgs.push(missionPrompt);
@@ -939,17 +777,14 @@ function launchRuntime(runtime: RuntimeName, args: string[], yolo: boolean): nev
        cliArgs.push(...args);
      }
      console.log(`[mosaic] Launching ${label}${modeStr}${missionStr}...`);
-      recordLaunch('codex', cliArgs, yolo);
-      execRuntime('codex', cliArgs, { ...process.env, ...harnessEnv('codex') });
+      execRuntime('codex', cliArgs);
      break;
    }

    case 'opencode': {
-      // opencode follows XDG, so its config resolves to $XDG_CONFIG_HOME/opencode.
-      ensureRuntimeConfig('opencode', join(harnessHome('opencode'), 'opencode', 'AGENTS.md'));
+      ensureRuntimeConfig('opencode', join(homedir(), '.config', 'opencode', 'AGENTS.md'));
      console.log(`[mosaic] Launching ${label}${modeStr}...`);
-      recordLaunch('opencode', args, yolo);
-      execRuntime('opencode', args, { ...process.env, ...harnessEnv('opencode') });
+      execRuntime('opencode', args);
      break;
    }

@@ -964,7 +799,6 @@ function launchRuntime(runtime: RuntimeName, args: string[], yolo: boolean): nev
        cliArgs.push(...args);
      }
      console.log(`[mosaic] Launching ${label}${modeStr}${missionStr}...`);
-      recordLaunch('pi', cliArgs, yolo);
      execLeaseGatedRuntime('pi', cliArgs);
      break;
    }
@@ -1001,7 +835,6 @@ function execLeaseGatedRuntime(
    [launcher, ...dangerousArgs, '--runtime', runtime, '--', runtime, ...args],
    {
      ...baseEnv,
-      ...harnessEnv(runtime),
      MOSAIC_LEASE_BROKER_SOCKET: defaultLeaseBrokerSocket(baseEnv),
      MOSAIC_RUNTIME_GENERATION: baseEnv['MOSAIC_RUNTIME_GENERATION'] ?? '1',
    },