docs(fleet): PRD for the Fleet Suite (init/configure/operate + Mos-on-Discord)

Mission PRD for productizing mosaic fleet: AI-free init wizard with config-type
presets (general/coding/research/hybrid), always-on orchestrator with chat
connector (Discord now, Matrix strategic), runtime-agnostic HB, custom Pi
harness, graceful harness updates, webUI hooks, dual-host testing. Immediate
target: Mos orchestrator live on Discord on w-jarvis.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RMoEx7hfdFGjUiCHuN1RRi

docs/fleet/PRD-fleet-suite.md

@@ -0,0 +1,105 @@
+# PRD — Mosaic Fleet Suite (init, configure, operate)
+
+> **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312` · **Phase:** 3→4 productization
+> **North star:** [docs/fleet/north-star.md](./north-star.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
+> **Lead:** Jarvis @ `w-jarvis`. **Collaborator:** coder agent @ `dragon-lin` (jwoltje@10.1.10.37:coder0-0).
+> Owner of this file: Fleet workstream lead. Does not modify MVP single-writer control-plane files.
+
+## Mission
+
+Turn the proven fleet primitives into a **user-installable, AI-free-configurable fleet product**:
+a user runs `mosaic fleet init`, answers a few questions (general / coding / research / hybrid),
+gets a recommended set of agents plus one always-on orchestrator wired for chat-ops, and can
+operate, mutate, re-create, and observe the fleet — over tmux today and Matrix tomorrow — from
+CLI/TUI and (designed-for) the webUI.
+
+**Immediate tangible goal:** the **"Mos"** orchestrator agent running on `w-jarvis`, reachable
+in **Discord channel `1517622518662434996`** (server `1112631390438166618`). Once the fleet is
+functional, we use the fleet itself to continue the work.
+
+## Requirements
+
+### A. Configure-without-AI CLI
+| ID | Requirement |
+|---|---|
+| R1 | `mosaic fleet` command set is functional end-to-end (init/install/start/stop/status/ps/verify + agent verbs). |
+| R2 | `mosaic fleet init` is an interactive, **AI-free** CLI wizard. |
+| R3 | Init asks the **configuration type**: `general`, `coding`, `research`, `hybrid`, … (extensible). |
+| R4 | Based on the answer, the fleet is populated with a **recommended set of agents** (a preset). |
+| R5 | **Exactly one main orchestrator agent** is always configured, regardless of type. |
+| R10 | A set of **recommended configurations (presets)** ships for easy duplication. |
+| R8 | User can **re-create** the fleet when config needs change (idempotent re-init / reconfigure). |
+| R17 | Fleet controls are **simple and intuitive**. |
+
+### B. Comms & orchestrator chat-ops
+| ID | Requirement |
+|---|---|
+| R6 | Init can wire the orchestrator to a chat connector — **Telegram / Discord / Matrix / Slack** — for command + comms. |
+| R7 | Designed with the end-goal of **Matrix comms on a locally-controlled server**. |
+| R16 | Fleet supports **tmux AND Matrix** comms, **user-configurable** at init or any time. Not all users want Matrix. |
+| R19 | **"Mos" orchestrator on Discord** (`chan 1517622518662434996` / `srv 1112631390438166618`) on `w-jarvis` — the first live target. |
+
+### C. Runtime, health, lifecycle
+| ID | Requirement |
+|---|---|
+| R9 | Fleet is **mutable by the orchestrator agent** — add/remove agents per need. |
+| R13 | Fleet **gracefully handles Pi + Claude harness updates** — keep harnesses current. |
+| R14 | The **Pi harness is customized** for proper tool usage, etc. |
+| R15 | **Agent heartbeat** properly configured for **Claude AND GPT/Pi** agents. |
+
+### D. Surfaces, testing, docs
+| ID | Requirement |
+|---|---|
+| R18 | Fleet built so the **webUI can view / monitor / terminate / butt-in** on a session. |
+| R11 | Installed and **tested on both `w-jarvis` and `dragon-lin`**. |
+| R12 | **Documentation**: how to install, configure, and use the fleet. |
+
+## Architecture / approach
+
+- **Config model:** `roster.yaml` is the source of truth (already exists). Add **presets** (`general`/`coding`/`research`/`hybrid`) as shipped example rosters; `init` selects a preset, always injects the orchestrator, and writes the roster. Re-init = regenerate roster (preserve user/site overrides — mirrors install env-merge from #567).
+- **Orchestrator agent:** always present; carries the chat connector config (connector type + target IDs) so it can be commanded over chat. tmux is the substrate; the connector bridges chat ↔ the orchestrator session.
+- **Comms layers (R16):** (1) **tmux** inter-agent (`agent-send`, proven) — default, always available. (2) **chat connector** for human↔orchestrator (Discord now; Matrix the strategic target). (3) **Matrix** as the locally-controlled cross-agent bus (future). Connector is pluggable + reconfigurable.
+- **Heartbeat (R15):** runtime-agnostic launcher sidecar already covers pi/claude/codex (#584). Refine per-runtime (native HB) with the **custom Pi harness** (R14) + a Claude path.
+- **Updates (R13):** `mosaic update` (CLI) + a fleet-aware harness-update step that refreshes pi/claude/codex and re-launches agents safely (drain → update → relaunch via the durable launcher).
+- **webUI (R18):** the fleet exposes machine-readable state (`fleet ps --json` already carries tenant/host/heartbeat/managed) + control verbs (start/stop/watch/send); webUI consumes these (control plane rides federation per north star). Ensure a stable JSON contract + a terminate/attach(butt-in) path.
+
+## Phases (incremental, each shippable)
+
+| Phase | Deliverable | Notes |
+|---|---|---|
+| **F1 Presets + init wizard** | preset rosters (general/coding/research/hybrid) + always-orchestrator + AI-free `fleet init` selecting a preset; re-init idempotent | R1–R5, R8, R10, R17 |
+| **F2 Connector + Mos-on-Discord** | orchestrator chat-connector config (Discord first) + **Mos live on Discord `1517…`/`1112…`** on w-jarvis | R6, R19, partial R16 |
+| **F3 Heartbeat + harness** | HB confirmed for claude + pi/gpt; **custom Pi harness** (tool usage, native HB, model self-report); graceful harness updates | R13, R14, R15 |
+| **F4 Matrix + comms toggle** | Matrix connector (local server) + user toggle tmux/Matrix at init/anytime | R7, R16 |
+| **F5 Orchestrator-mutable fleet** | orchestrator can add/remove agents at runtime | R9 |
+| **F6 webUI hooks** | stable JSON contract + terminate/attach surface for webUI view/monitor/terminate/butt-in | R18 |
+| **F7 Test + docs** | install+test on w-jarvis AND dragon-lin; user docs (install/configure/use) | R11, R12 (runs alongside every phase) |
+
+## Work division (proposed — confirm with dragon-lin)
+
+- **Jarvis @ w-jarvis (Lead):** F1 presets+wizard, F2 connector+Mos-on-Discord, F5 mutability, F6 webUI hooks; merge authority + dual-engine reviews; co-testing on w-jarvis.
+- **coder @ dragon-lin:** F3 custom Pi harness + harness-update flow (pi/codex-savvy); plus its in-flight constitution P4–P6 (P4 installer rework underpins `fleet init`/updates — coordinate the install path). Co-testing on dragon-lin (R11).
+- **Shared:** F4 Matrix (whoever has bandwidth); F7 testing/docs continuous.
+
+## Immediate target: Mos on Discord (F2 first slice)
+
+The discord plugin is available (`~/.claude.json`). Path: configure the **orchestrator** as a durable
+fleet session running Claude Code with the discord plugin bridged to channel `1517622518662434996`
+(server `1112631390438166618`) on w-jarvis, with the existing Discord Bridge Protocol (ack within
+~3s, reply via `mcp__discord__reply`, no `AskUserQuestion`). Heartbeat via the launcher sidecar.
+
+## Success criteria
+
+- A non-AI user can `mosaic fleet init`, pick a type, and get a working fleet + orchestrator.
+- **Mos answers in Discord `1517…`** on w-jarvis.
+- Fleet runs + is observable (`fleet ps`) on **both** w-jarvis and dragon-lin.
+- Harness updates handled gracefully; HB healthy for claude + pi/gpt agents.
+- Docs let a new operator install/configure/use the fleet.
+- Re-init + orchestrator mutation work.
+
+## Assumptions (veto-able)
+
+- `ASSUMPTION:` presets ship as example rosters under the framework (`fleet/examples/*.yaml`), selected by `init`.
+- `ASSUMPTION:` chat connectors are pluggable; Discord first (target exists), Matrix is the strategic default later.
+- `ASSUMPTION:` "Mos" = a Claude Code orchestrator session with the discord plugin (reuses the documented Discord Bridge Protocol).
+- `ASSUMPTION:` per north star, runtimes default to Codex/pi-on-Codex for workers; the orchestrator "Mos" runs Claude Code (in Claude Code, which is allowed).

packages/mosaic/framework/install.sh

@@ -19,23 +19,13 @@ SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET_DIR="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 INSTALL_MODE="${MOSAIC_INSTALL_MODE:-prompt}"
 
-# Files/dirs protected from rsync --delete during sync. NOTE: framework-owned
+# Files/dirs preserved across upgrades (never overwritten).
-# entries (CONSTITUTION/AGENTS/STANDARDS) ARE re-applied afterward by
-# reconcile_framework_files (overwrite + backup-once); the rest stay user-owned.
 # User-created content in these paths survives rsync --delete.
-PRESERVE_PATHS=("CONSTITUTION.md" "AGENTS.md" "SOUL.md" "USER.md" "TOOLS.md" "STANDARDS.md" "memory" "sources" "credentials")
+PRESERVE_PATHS=("AGENTS.md" "SOUL.md" "USER.md" "TOOLS.md" "STANDARDS.md" "memory" "sources" "credentials")
-
-# Framework-owned contract files: re-copied from defaults/ on every upgrade (the
-# user must not edit them; a divergent copy is backed up once before overwrite).
-# USER_SEEDED files are written once on first install, then owned by the user.
-# Both lists are APPEND-FRIENDLY — add a new shipped framework file here and to the
-# matching list in packages/mosaic/src/config/file-adapter.ts.
-FRAMEWORK_OWNED=("CONSTITUTION.md" "AGENTS.md" "STANDARDS.md")
-USER_SEEDED=("TOOLS.md")
 
 # Current framework schema version — bump this when the layout changes.
 # The migration system uses this to run upgrade steps.
-FRAMEWORK_VERSION=3
+FRAMEWORK_VERSION=2
 
 # ─── colours ──────────────────────────────────────────────────────────────────
 if [[ -t 1 ]]; then
@@ -50,47 +40,6 @@ warn() { echo -e "  ${YELLOW}⚠${RESET} $1" >&2; }
 fail() { echo -e "  ${RED}✗${RESET} $1" >&2; }
 step() { echo -e "\n${BOLD}$1${RESET}"; }
 
-# ─── snapshot / restore (crash safety for upgrades) ──────────────────────────
-SNAPSHOT_DIR=""
-make_snapshot() {
-  is_existing_install || return 0
-  SNAPSHOT_DIR="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-snapshot-XXXXXX")"
-  cp -a "$TARGET_DIR/." "$SNAPSHOT_DIR/" 2>/dev/null || true
-}
-restore_snapshot() {
-  [[ -n "$SNAPSHOT_DIR" && -d "$SNAPSHOT_DIR" ]] || return 0
-  fail "Install interrupted/failed — restoring previous state from snapshot"
-  rm -rf "$TARGET_DIR"; mkdir -p "$TARGET_DIR"
-  cp -a "$SNAPSHOT_DIR/." "$TARGET_DIR/" 2>/dev/null || true
-}
-cleanup_snapshot() { [[ -n "$SNAPSHOT_DIR" && -d "$SNAPSHOT_DIR" ]] && rm -rf "$SNAPSHOT_DIR"; SNAPSHOT_DIR=""; }
-
-# Reconcile contract files after sync: framework-owned overwrite (backup-once),
-# user-seeded seed-if-absent.
-reconcile_framework_files() {
-  local defaults="$TARGET_DIR/defaults" f
-  [[ -d "$defaults" ]] || return 0
-  for f in "${FRAMEWORK_OWNED[@]}"; do
-    [[ -f "$defaults/$f" ]] || continue
-    # Already current — skip to avoid mtime churn.
-    if [[ -f "$TARGET_DIR/$f" ]] && cmp -s "$TARGET_DIR/$f" "$defaults/$f"; then
-      continue
-    fi
-    if [[ -f "$TARGET_DIR/$f" && ! -f "$TARGET_DIR/${f}.pre-constitution.bak" ]]; then
-      cp "$TARGET_DIR/$f" "$TARGET_DIR/${f}.pre-constitution.bak"
-      warn "$f is now framework-owned and was updated; your previous copy is saved as ${f}.pre-constitution.bak — re-apply intended changes as a .local overlay or policy/ file (see CONSTITUTION.md / constitution/LAYER-MODEL.md)."
-    fi
-    cp "$defaults/$f" "$TARGET_DIR/$f"
-  done
-  for f in "${USER_SEEDED[@]}"; do
-    [[ -f "$defaults/$f" ]] || continue
-    if [[ ! -f "$TARGET_DIR/$f" ]]; then
-      cp "$defaults/$f" "$TARGET_DIR/$f"
-      ok "Seeded $f from defaults"
-    fi
-  done
-}
-
 # ─── helpers ──────────────────────────────────────────────────────────────────
 
 is_existing_install() {
@@ -164,14 +113,11 @@ sync_framework() {
   fi
 
   if command -v rsync >/dev/null 2>&1; then
-    local rsync_args=(-a --delete --exclude ".git" --exclude ".framework-version" --exclude "*.pre-constitution.bak")
+    local rsync_args=(-a --delete --exclude ".git" --exclude ".framework-version")
 
     if [[ "$INSTALL_MODE" == "keep" ]]; then
-      # Anchor to the transfer root (leading /) so we preserve the TOP-LEVEL
-      # ~/.config/mosaic/<file> without also excluding defaults/<file> from sync
-      # (reconcile_framework_files needs the freshly-synced defaults/ copies).
       for path in "${PRESERVE_PATHS[@]}"; do
-        rsync_args+=(--exclude "/$path")
+        rsync_args+=(--exclude "$path")
       done
     fi
 
@@ -191,7 +137,7 @@ sync_framework() {
     done
   fi
 
-  find "$TARGET_DIR" -mindepth 1 -maxdepth 1 ! -name ".git" ! -name ".framework-version" ! -name "*.pre-constitution.bak" -exec rm -rf {} +
+  find "$TARGET_DIR" -mindepth 1 -maxdepth 1 ! -name ".git" ! -name ".framework-version" -exec rm -rf {} +
   cp -R "$SOURCE_DIR"/. "$TARGET_DIR"/
   rm -rf "$TARGET_DIR/.git"
 
@@ -249,15 +195,10 @@ run_migrations() {
     fi
   fi
 
-  # ── Migration: v2 → v3 (Constitution split) ───────────────────────────────
+  # ── Future migrations go here ──────────────────────────────────────────────
-  # CONSTITUTION.md / AGENTS.md / STANDARDS.md become framework-owned (overwritten
+  # if [[ "$from_version" -lt 3 ]]; then
-  # on upgrade). reconcile_framework_files() has already run before this point: it
+  #   ...
-  # backed up any user-edited copy to <file>.pre-constitution.bak and installed the
+  # fi
-  # new framework version. Nothing further to do here — the advisory was emitted at
-  # reconcile time. (STANDARDS.local.md composition lands with the overlay composer.)
-  if [[ "$from_version" -lt 3 ]]; then
-    ok "Migrated to the Constitution layout (framework-owned CONSTITUTION/AGENTS/STANDARDS)"
-  fi
 }
 
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -275,25 +216,29 @@ else
   ok "Install mode: overwrite"
 fi
 
-# Snapshot before any destructive file operation; restore on interrupt/failure.
-make_snapshot
-trap 'restore_snapshot' ERR INT TERM
-
 sync_framework
 
 # Ensure persistent directories exist
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"
 
-# Reconcile contract files from defaults/ into the framework root: framework-owned
+# Seed defaults — copy framework contract files from defaults/ to framework
-# files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
+# root if not already present. These ship with sensible defaults but must
-# copy is backed up once); user-seeded files (TOOLS) are written on first install only.
+# never be overwritten once the user has customized them.
 #
 # This list must match the framework-contract whitelist in
 # packages/mosaic/src/config/file-adapter.ts (FileConfigAdapter.syncFramework).
 # SOUL.md and USER.md are intentionally NOT seeded here — they are generated
 # by `mosaic init` from templates with user-supplied values.
-reconcile_framework_files
+DEFAULTS_DIR="$TARGET_DIR/defaults"
+if [[ -d "$DEFAULTS_DIR" ]]; then
+  for default_file in CONSTITUTION.md AGENTS.md STANDARDS.md TOOLS.md; do
+    if [[ -f "$DEFAULTS_DIR/$default_file" ]] && [[ ! -f "$TARGET_DIR/$default_file" ]]; then
+      cp "$DEFAULTS_DIR/$default_file" "$TARGET_DIR/$default_file"
+      ok "Seeded $default_file from defaults"
+    fi
+  done
+fi
 
 # Ensure tool scripts are executable
 find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} + 2>/dev/null || true
@@ -304,18 +249,6 @@ ok "Framework synced to $TARGET_DIR"
 # Run migrations before post-install (migrations may remove old bin/ etc.)
 run_migrations
 
-# File-system phase complete and consistent — clear the restore trap.
-trap - ERR INT TERM
-cleanup_snapshot
-
-# Testability / minimal-install hook: stop after the file-system phase, before any
-# environment-touching post-install steps (runtime linking, MCP setup, skills, doctor).
-if [[ "${MOSAIC_SYNC_ONLY:-0}" == "1" ]]; then
-  write_framework_version
-  ok "Sync-only mode: file phase complete"
-  exit 0
-fi
-
 step "Post-install tasks"
 
 SCRIPTS="$TARGET_DIR/tools/_scripts"

packages/mosaic/framework/tools/_scripts/mosaic-init

@@ -274,13 +274,6 @@ detect_existing_config
 echo "[mosaic-init] Generating SOUL.md — agent identity contract"
 echo ""
 
-# Fail-closed persona: in non-interactive mode the agent NAME must be supplied
-# explicitly (--name) — never silently ship an agent named "Assistant".
-if [[ $NON_INTERACTIVE -eq 1 && -z "$AGENT_NAME" ]]; then
-  echo "[mosaic-init] ERROR: --name (agent name) is required in non-interactive mode." >&2
-  exit 1
-fi
-
 prompt_if_empty AGENT_NAME "What name should agents use" "Assistant"
 prompt_if_empty ROLE_DESCRIPTION "Agent role description" "execution partner and visibility engine"
 

packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-# test-install-migration.sh — fixture matrix for the v2→v3 (Constitution) upgrade
-# migration in install.sh. Runs the installer against throwaway MOSAIC_HOME dirs
-# with MOSAIC_SYNC_ONLY=1 (file phase only — no environment-touching post-install)
-# and asserts the framework-owned-overwrite + user-preserve + backup semantics.
-#
-# Mirrors the TS fixture suite in packages/mosaic/src/config/file-adapter.test.ts;
-# both installers MUST behave identically.
-#
-# Usage:  bash test-install-migration.sh
-set -uo pipefail
-
-FW="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"   # packages/mosaic/framework
-INSTALL="$FW/install.sh"
-DEFA="$FW/defaults"
-
-pass=0; fail=0
-chk() { if eval "$2"; then echo "  ✓ $1"; pass=$((pass + 1)); else echo "  ✗ $1"; fail=$((fail + 1)); fi; }
-run() { MOSAIC_HOME="$1" MOSAIC_INSTALL_MODE="$2" MOSAIC_SYNC_ONLY=1 bash "$INSTALL" >/dev/null 2>&1; }
-
-echo "install.sh v2→v3 migration fixture matrix:"
-
-# F1 — fresh install
-T1=$(mktemp -d); run "$T1" overwrite
-chk "F1 fresh: CONSTITUTION/AGENTS/STANDARDS/TOOLS seeded" \
-  "[ -f '$T1/CONSTITUTION.md' ] && [ -f '$T1/AGENTS.md' ] && [ -f '$T1/STANDARDS.md' ] && [ -f '$T1/TOOLS.md' ]"
-chk "F1 fresh: AGENTS == shipped default" "cmp -s '$T1/AGENTS.md' '$DEFA/AGENTS.md'"
-chk "F1 fresh: framework-version stamped 3" "[ \"\$(cat '$T1/.framework-version' 2>/dev/null)\" = 3 ]"
-
-# F2 — legacy install with a user-edited AGENTS.md (the sanctioned pre-constitution customization)
-T2=$(mktemp -d); mkdir -p "$T2/credentials"
-printf '# user-edited AGENTS pre-constitution\n' > "$T2/AGENTS.md"
-printf '# my persona\n' > "$T2/SOUL.md"
-printf 'token\n' > "$T2/credentials/c.json"
-echo 2 > "$T2/.framework-version"
-run "$T2" keep
-chk "F2 legacy-edited: AGENTS overwritten to framework version" "cmp -s '$T2/AGENTS.md' '$DEFA/AGENTS.md'"
-chk "F2 legacy-edited: prior AGENTS saved to .pre-constitution.bak" \
-  "grep -q 'user-edited AGENTS pre-constitution' '$T2/AGENTS.md.pre-constitution.bak'"
-chk "F2 legacy-edited: SOUL.md preserved" "grep -q 'my persona' '$T2/SOUL.md'"
-chk "F2 legacy-edited: credentials preserved" "grep -q token '$T2/credentials/c.json'"
-chk "F2 legacy-edited: CONSTITUTION.md installed" "[ -f '$T2/CONSTITUTION.md' ]"
-run "$T2" keep
-chk "F2 idempotent: .pre-constitution.bak preserved across a 2nd upgrade" \
-  "grep -q 'user-edited AGENTS pre-constitution' '$T2/AGENTS.md.pre-constitution.bak'"
-
-# F3 — user-tuned STANDARDS.md
-T3=$(mktemp -d); printf '# tuned standards\n' > "$T3/STANDARDS.md"; printf '# persona\n' > "$T3/SOUL.md"; echo 2 > "$T3/.framework-version"
-run "$T3" keep
-chk "F3 tuned-standard: STANDARDS overwritten" "cmp -s '$T3/STANDARDS.md' '$DEFA/STANDARDS.md'"
-chk "F3 tuned-standard: tuned copy backed up" "grep -q 'tuned standards' '$T3/STANDARDS.md.pre-constitution.bak'"
-
-# F4 — unattended / no TTY (stdin closed): must complete without hanging, default to keep
-T4=$(mktemp -d); printf '# persona\n' > "$T4/SOUL.md"; printf '# old\n' > "$T4/AGENTS.md"; echo 2 > "$T4/.framework-version"
-MOSAIC_HOME="$T4" MOSAIC_SYNC_ONLY=1 bash "$INSTALL" </dev/null >/dev/null 2>&1
-chk "F4 no-TTY: completed, AGENTS updated" "cmp -s '$T4/AGENTS.md' '$DEFA/AGENTS.md'"
-
-# F5 — failure path must not corrupt existing data (invalid mode rejected before any file op)
-T5=$(mktemp -d); mkdir -p "$T5/credentials"; printf '# orig\n' > "$T5/SOUL.md"; printf 'keepme\n' > "$T5/credentials/c.json"; echo 2 > "$T5/.framework-version"
-MOSAIC_HOME="$T5" MOSAIC_INSTALL_MODE=bogus MOSAIC_SYNC_ONLY=1 bash "$INSTALL" >/dev/null 2>&1; rc=$?
-chk "F5 failure: invalid mode rejected (nonzero exit)" "[ $rc -ne 0 ]"
-chk "F5 failure: SOUL + credentials intact" "grep -q orig '$T5/SOUL.md' && grep -q keepme '$T5/credentials/c.json'"
-
-rm -rf "$T1" "$T2" "$T3" "$T4" "$T5"
-echo
-echo "RESULT: $pass passed, $fail failed"
-[ "$fail" -eq 0 ]

packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh

@@ -53,15 +53,9 @@ _selftest() {
   local tmp; tmp="$(mktemp -d)" || return 1
   printf 'contact jason.woltje at jarvis-brain (PDA-friendly)\n' > "$tmp/planted.md"
   printf 'X="${VAR:-$HOME/src/whatever/x.json}"\n' > "$tmp/planted.sh"
-  printf 'name: jason-woltje\n' > "$tmp/planted.yaml"
-  printf '[Service]\nUser=jarvis\n' > "$tmp/planted.service"
   local rc=0
   grep -qIEi "$DENYLIST" "$tmp/planted.md" || { echo "✗ SELF-TEST: identity denylist regex broken" >&2; rc=1; }
   grep -qIE  "$STRUCTURAL_SH" "$tmp/planted.sh" || { echo "✗ SELF-TEST: structural regex broken" >&2; rc=1; }
-  # Prove the identity scan covers the config formats it claims to (yaml/service/etc).
-  local n_ext
-  n_ext=$(find "$tmp" -type f \( -name '*.yaml' -o -name '*.service' \) -print0 | xargs -0 -r grep -lIEi "$DENYLIST" 2>/dev/null | wc -l)
-  [[ "$n_ext" -eq 2 ]] || { echo "✗ SELF-TEST: identity scan does not cover .yaml/.service extensions" >&2; rc=1; }
   rm -rf "$tmp"; return $rc
 }
 _selftest || exit 2

packages/mosaic/src/config/file-adapter.test.ts

@@ -99,8 +99,11 @@ describe('FileConfigAdapter.syncFramework — defaults seeding', () => {
     );
   });
 
-  it('overwrites framework-owned files (backup-once) but preserves user-seeded files', async () => {
+  it('preserves existing contract files — never overwrites user customization', async () => {
-    // Plant a root-level AGENTS.md in sourceDir so syncDirectory's preserve is exercised.
+    // Also plant a root-level AGENTS.md in sourceDir so that `syncDirectory`
+    // itself (not just the seed loop) has something to try to overwrite.
+    // Without this, the test would silently pass even if preserve semantics
+    // were broken in syncDirectory.
     writeFileSync(join(fixture.sourceDir, 'AGENTS.md'), '# shipped AGENTS from source root\n');
 
     writeFileSync(join(fixture.mosaicHome, 'TOOLS.md'), '# user-customized TOOLS\n');
@@ -109,50 +112,18 @@ describe('FileConfigAdapter.syncFramework — defaults seeding', () => {
     const adapter = new FileConfigAdapter(fixture.mosaicHome, fixture.sourceDir);
     await adapter.syncFramework('keep');
 
-    // User-seeded TOOLS.md is preserved.
     expect(readFileSync(join(fixture.mosaicHome, 'TOOLS.md'), 'utf-8')).toBe(
       '# user-customized TOOLS\n',
     );
-    // Framework-owned AGENTS.md is overwritten from defaults/ ...
+    expect(readFileSync(join(fixture.mosaicHome, 'AGENTS.md'), 'utf-8')).toBe(
-    expect(readFileSync(join(fixture.mosaicHome, 'AGENTS.md'), 'utf-8')).toBe('# AGENTS default\n');
-    // ... and the user's prior copy is backed up exactly once.
-    expect(readFileSync(join(fixture.mosaicHome, 'AGENTS.md.pre-constitution.bak'), 'utf-8')).toBe(
       '# user-customized AGENTS\n',
     );
-    // Framework-owned STANDARDS.md (absent) gets installed.
+    // And the missing contract file still gets seeded.
     expect(readFileSync(join(fixture.mosaicHome, 'STANDARDS.md'), 'utf-8')).toContain(
       '# STANDARDS default',
     );
   });
 
-  it('backs up a divergent framework-owned file only once (idempotent across re-sync)', async () => {
-    writeFileSync(join(fixture.mosaicHome, 'AGENTS.md'), '# user-customized AGENTS\n');
-    const adapter = new FileConfigAdapter(fixture.mosaicHome, fixture.sourceDir);
-
-    await adapter.syncFramework('keep'); // 1st: backup created, AGENTS overwritten
-    await adapter.syncFramework('keep'); // 2nd: AGENTS already == default, no new backup
-
-    expect(readFileSync(join(fixture.mosaicHome, 'AGENTS.md.pre-constitution.bak'), 'utf-8')).toBe(
-      '# user-customized AGENTS\n',
-    );
-  });
-
-  it('preserves SOUL.md and credentials through a framework-owned overwrite', async () => {
-    writeFileSync(join(fixture.mosaicHome, 'SOUL.md'), '# my persona\n');
-    writeFileSync(join(fixture.mosaicHome, 'AGENTS.md'), '# user-customized AGENTS\n');
-    mkdirSync(join(fixture.mosaicHome, 'credentials'), { recursive: true });
-    writeFileSync(join(fixture.mosaicHome, 'credentials', 'c.json'), 'token\n');
-
-    const adapter = new FileConfigAdapter(fixture.mosaicHome, fixture.sourceDir);
-    await adapter.syncFramework('keep');
-
-    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf-8')).toBe('# my persona\n');
-    expect(readFileSync(join(fixture.mosaicHome, 'credentials', 'c.json'), 'utf-8')).toBe(
-      'token\n',
-    );
-    expect(readFileSync(join(fixture.mosaicHome, 'AGENTS.md'), 'utf-8')).toBe('# AGENTS default\n');
-  });
-
   it('is a no-op for seeding when defaults/ dir does not exist', async () => {
     rmSync(fixture.defaultsDir, { recursive: true });
 

packages/mosaic/src/config/file-adapter.ts

@@ -13,17 +13,12 @@ import { join } from 'node:path';
  * This list must match the explicit seed loop in
  * packages/mosaic/framework/install.sh.
  */
-// Framework-owned contract files: re-copied from defaults/ on every upgrade (a
+export const DEFAULT_SEED_FILES = [
-// divergent existing copy is backed up once to <file>.pre-constitution.bak first).
+  'CONSTITUTION.md',
-// MUST match FRAMEWORK_OWNED in packages/mosaic/framework/install.sh (append-friendly).
+  'AGENTS.md',
-export const FRAMEWORK_OWNED_FILES = ['CONSTITUTION.md', 'AGENTS.md', 'STANDARDS.md'] as const;
+  'STANDARDS.md',
-
+  'TOOLS.md',
-// User-seeded contract files: written once on first install, then owned by the user.
+] as const;
-// MUST match USER_SEEDED in packages/mosaic/framework/install.sh.
-export const USER_SEEDED_FILES = ['TOOLS.md'] as const;
-
-// Union, retained for callers/tests that assert the full seed set on a fresh install.
-export const DEFAULT_SEED_FILES = [...FRAMEWORK_OWNED_FILES, ...USER_SEEDED_FILES] as const;
 import type { ConfigService, ConfigSection, ResolvedConfig } from './config-service.js';
 import type { SoulConfig, UserConfig, ToolsConfig, InstallAction } from '../types.js';
 import { soulSchema, userSchema, toolsSchema } from './schemas.js';
@@ -164,7 +159,6 @@ export class FileConfigAdapter implements ConfigService {
     const preservePaths =
       action === 'keep' || action === 'reconfigure'
         ? [
-            'CONSTITUTION.md',
             'AGENTS.md',
             'SOUL.md',
             'USER.md',
@@ -181,10 +175,10 @@ export class FileConfigAdapter implements ConfigService {
       excludeGit: true,
     });
 
-    // Reconcile framework-contract files from framework/defaults/ into the mosaic
+    // Copy framework-contract files (AGENTS.md, STANDARDS.md, TOOLS.md)
-    // home root: framework-owned files (CONSTITUTION/AGENTS/STANDARDS) are overwritten
+    // from framework/defaults/ into the mosaic home root if they don't
-    // every upgrade (backup-once); user-seeded files (TOOLS) are written on first
+    // exist yet. These are written on first install only and are never
-    // install only. Mirrors reconcile_framework_files() in install.sh.
+    // overwritten afterwards — the user may have customized them.
     //
     // SOUL.md and USER.md are deliberately NOT seeded here. They are
     // generated from templates by the soul/user wizard stages with
@@ -192,22 +186,7 @@ export class FileConfigAdapter implements ConfigService {
     // identity flow and leak placeholder content into the mosaic home.
     const defaultsDir = join(this.sourceDir, 'defaults');
     if (existsSync(defaultsDir)) {
-      // Framework-owned: overwrite from defaults/ every sync; back up a divergent
+      for (const entry of DEFAULT_SEED_FILES) {
-      // existing copy ONCE to <file>.pre-constitution.bak before the first overwrite.
-      for (const entry of FRAMEWORK_OWNED_FILES) {
-        const src = join(defaultsDir, entry);
-        const dest = join(this.mosaicHome, entry);
-        if (!existsSync(src) || !statSync(src).isFile()) continue;
-        // Already current — skip to avoid mtime churn.
-        if (existsSync(dest) && readFileSync(src).equals(readFileSync(dest))) continue;
-        const bak = `${dest}.pre-constitution.bak`;
-        if (existsSync(dest) && !existsSync(bak)) {
-          copyFileSync(dest, bak);
-        }
-        copyFileSync(src, dest);
-      }
-      // User-seeded: write only if absent.
-      for (const entry of USER_SEEDED_FILES) {
         const src = join(defaultsDir, entry);
         const dest = join(this.mosaicHome, entry);
         if (existsSync(dest)) continue;