feat(framework): P4 (2/2) — TS installer parity + fixtures + fail-closed init

Mirror install.sh's upgrade-safe migration in the npm/TS install path and lock it
with CI-gating fixtures:
- file-adapter.ts: FRAMEWORK_OWNED_FILES (overwrite, backup-once to
  .pre-constitution.bak) vs USER_SEEDED_FILES (seed-if-absent); CONSTITUTION.md
  added to preserve; reconcile mirrors reconcile_framework_files() in install.sh
- file-adapter.test.ts: 5 migration fixtures (overwrite framework-owned + backup,
  idempotent backup-once, preserve SOUL/credentials, preserve user-seeded TOOLS);
  updated the prior "preserve AGENTS" test that P4 intentionally inverts
- mosaic-init: fail-closed persona — --name is REQUIRED in --non-interactive mode
  (no silent agent named "Assistant"); verified exit 1 + clear error
- verify-sanitized.sh self-test: prove the identity scan actually covers
  *.yaml/*.service config formats (Claude review ticket)

Both installers now behave identically. install.sh fixture suite 14/14 green;
gate green; mosaic-init fail-closed verified.

Refs #542

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/TASKS.md

@@ -45,9 +45,3 @@ Active workstream is **W1 — Federation v1**. Workers should:
 - Status: PR open, awaiting maintainer merge ratification (fleet-governing change).
 - Cut always-injected contract AGENTS+TOOLS+RUNTIME 8,827→4,122 tok (−53%); all 12 hard gates intact.
 - Validation: deterministic gate-checklist PASS; headless A/B thin 7/9 vs monolith 5/9. Detail: scratchpads/contract-thin-core.md.
-
-## P5 — Overlay composer + cross-harness (#604) — feat/p5-overlay-composer
-
-- Status: in progress. R7 (compose-contract) + R8 (cross-harness) + R9 (composer test).
-- `composeContract({harness, mosaicHome})` pure fn + `.local` overlay deltas-by-value; `mosaic compose-contract <harness>` command; AGENTS bare-launch nudge; composer spec (per-tier anchor + Tier-3 byte-equality). Detail: scratchpads/p5-overlay-composer.md.
-- Defer to P6: CONTRIBUTING.md + compliance matrix; line-count CI ceiling; aiguide; alpha tag.

docs/fleet/PRD-fleet-suite.md

@@ -1,109 +0,0 @@
-# PRD — Mosaic Fleet Suite (init, configure, operate)
-
-> **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312` · **Phase:** 3→4 productization
-> **North star:** [docs/fleet/north-star.md](./north-star.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
-> **Lead:** Jarvis @ `w-jarvis`. **Collaborator:** coder agent @ `dragon-lin` (jwoltje@10.1.10.37:coder0-0).
-> Owner of this file: Fleet workstream lead. Does not modify MVP single-writer control-plane files.
-
-## Mission
-
-Turn the proven fleet primitives into a **user-installable, AI-free-configurable fleet product**:
-a user runs `mosaic fleet init`, answers a few questions (general / coding / research / hybrid),
-gets a recommended set of agents plus one always-on orchestrator wired for chat-ops, and can
-operate, mutate, re-create, and observe the fleet — over tmux today and Matrix tomorrow — from
-CLI/TUI and (designed-for) the webUI.
-
-**Immediate tangible goal:** the **"Mos"** orchestrator agent running on `w-jarvis`, reachable
-in **Discord channel `1517622518662434996`** (server `1112631390438166618`). Once the fleet is
-functional, we use the fleet itself to continue the work.
-
-## Requirements
-
-### A. Configure-without-AI CLI
-
-| ID  | Requirement                                                                                                   |
-| --- | ------------------------------------------------------------------------------------------------------------- |
-| R1  | `mosaic fleet` command set is functional end-to-end (init/install/start/stop/status/ps/verify + agent verbs). |
-| R2  | `mosaic fleet init` is an interactive, **AI-free** CLI wizard.                                                |
-| R3  | Init asks the **configuration type**: `general`, `coding`, `research`, `hybrid`, … (extensible).              |
-| R4  | Based on the answer, the fleet is populated with a **recommended set of agents** (a preset).                  |
-| R5  | **Exactly one main orchestrator agent** is always configured, regardless of type.                             |
-| R10 | A set of **recommended configurations (presets)** ships for easy duplication.                                 |
-| R8  | User can **re-create** the fleet when config needs change (idempotent re-init / reconfigure).                 |
-| R17 | Fleet controls are **simple and intuitive**.                                                                  |
-
-### B. Comms & orchestrator chat-ops
-
-| ID  | Requirement                                                                                                                       |
-| --- | --------------------------------------------------------------------------------------------------------------------------------- |
-| R6  | Init can wire the orchestrator to a chat connector — **Telegram / Discord / Matrix / Slack** — for command + comms.               |
-| R7  | Designed with the end-goal of **Matrix comms on a locally-controlled server**.                                                    |
-| R16 | Fleet supports **tmux AND Matrix** comms, **user-configurable** at init or any time. Not all users want Matrix.                   |
-| R19 | **"Mos" orchestrator on Discord** (`chan 1517622518662434996` / `srv 1112631390438166618`) on `w-jarvis` — the first live target. |
-
-### C. Runtime, health, lifecycle
-
-| ID  | Requirement                                                                        |
-| --- | ---------------------------------------------------------------------------------- |
-| R9  | Fleet is **mutable by the orchestrator agent** — add/remove agents per need.       |
-| R13 | Fleet **gracefully handles Pi + Claude harness updates** — keep harnesses current. |
-| R14 | The **Pi harness is customized** for proper tool usage, etc.                       |
-| R15 | **Agent heartbeat** properly configured for **Claude AND GPT/Pi** agents.          |
-
-### D. Surfaces, testing, docs
-
-| ID  | Requirement                                                                         |
-| --- | ----------------------------------------------------------------------------------- |
-| R18 | Fleet built so the **webUI can view / monitor / terminate / butt-in** on a session. |
-| R11 | Installed and **tested on both `w-jarvis` and `dragon-lin`**.                       |
-| R12 | **Documentation**: how to install, configure, and use the fleet.                    |
-
-## Architecture / approach
-
-- **Config model:** `roster.yaml` is the source of truth (already exists). Add **presets** (`general`/`coding`/`research`/`hybrid`) as shipped example rosters; `init` selects a preset, always injects the orchestrator, and writes the roster. Re-init = regenerate roster (preserve user/site overrides — mirrors install env-merge from #567).
-- **Orchestrator agent:** always present; carries the chat connector config (connector type + target IDs) so it can be commanded over chat. tmux is the substrate; the connector bridges chat ↔ the orchestrator session.
-- **Comms layers (R16):** (1) **tmux** inter-agent (`agent-send`, proven) — default, always available. (2) **chat connector** for human↔orchestrator (Discord now; Matrix the strategic target). (3) **Matrix** as the locally-controlled cross-agent bus (future). Connector is pluggable + reconfigurable.
-- **Heartbeat (R15):** runtime-agnostic launcher sidecar already covers pi/claude/codex (#584). Refine per-runtime (native HB) with the **custom Pi harness** (R14) + a Claude path.
-- **Updates (R13):** `mosaic update` (CLI) + a fleet-aware harness-update step that refreshes pi/claude/codex and re-launches agents safely (drain → update → relaunch via the durable launcher).
-- **webUI (R18):** the fleet exposes machine-readable state (`fleet ps --json` already carries tenant/host/heartbeat/managed) + control verbs (start/stop/watch/send); webUI consumes these (control plane rides federation per north star). Ensure a stable JSON contract + a terminate/attach(butt-in) path.
-
-## Phases (incremental, each shippable)
-
-| Phase                             | Deliverable                                                                                                                         | Notes                                 |
-| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
-| **F1 Presets + init wizard**      | preset rosters (general/coding/research/hybrid) + always-orchestrator + AI-free `fleet init` selecting a preset; re-init idempotent | R1–R5, R8, R10, R17                   |
-| **F2 Connector + Mos-on-Discord** | orchestrator chat-connector config (Discord first) + **Mos live on Discord `1517…`/`1112…`** on w-jarvis                            | R6, R19, partial R16                  |
-| **F3 Heartbeat + harness**        | HB confirmed for claude + pi/gpt; **custom Pi harness** (tool usage, native HB, model self-report); graceful harness updates        | R13, R14, R15                         |
-| **F4 Matrix + comms toggle**      | Matrix connector (local server) + user toggle tmux/Matrix at init/anytime                                                           | R7, R16                               |
-| **F5 Orchestrator-mutable fleet** | orchestrator can add/remove agents at runtime                                                                                       | R9                                    |
-| **F6 webUI hooks**                | stable JSON contract + terminate/attach surface for webUI view/monitor/terminate/butt-in                                            | R18                                   |
-| **F7 Test + docs**                | install+test on w-jarvis AND dragon-lin; user docs (install/configure/use)                                                          | R11, R12 (runs alongside every phase) |
-
-## Work division (proposed — confirm with dragon-lin)
-
-- **Jarvis @ w-jarvis (Lead):** F1 presets+wizard, F2 connector+Mos-on-Discord, F5 mutability, F6 webUI hooks; merge authority + dual-engine reviews; co-testing on w-jarvis.
-- **coder @ dragon-lin:** F3 custom Pi harness + harness-update flow (pi/codex-savvy); plus its in-flight constitution P4–P6 (P4 installer rework underpins `fleet init`/updates — coordinate the install path). Co-testing on dragon-lin (R11).
-- **Shared:** F4 Matrix (whoever has bandwidth); F7 testing/docs continuous.
-
-## Immediate target: Mos on Discord (F2 first slice)
-
-The discord plugin is available (`~/.claude.json`). Path: configure the **orchestrator** as a durable
-fleet session running Claude Code with the discord plugin bridged to channel `1517622518662434996`
-(server `1112631390438166618`) on w-jarvis, with the existing Discord Bridge Protocol (ack within
-~3s, reply via `mcp__discord__reply`, no `AskUserQuestion`). Heartbeat via the launcher sidecar.
-
-## Success criteria
-
-- A non-AI user can `mosaic fleet init`, pick a type, and get a working fleet + orchestrator.
-- **Mos answers in Discord `1517…`** on w-jarvis.
-- Fleet runs + is observable (`fleet ps`) on **both** w-jarvis and dragon-lin.
-- Harness updates handled gracefully; HB healthy for claude + pi/gpt agents.
-- Docs let a new operator install/configure/use the fleet.
-- Re-init + orchestrator mutation work.
-
-## Assumptions (veto-able)
-
-- `ASSUMPTION:` presets ship as example rosters under the framework (`fleet/examples/*.yaml`), selected by `init`.
-- `ASSUMPTION:` chat connectors are pluggable; Discord first (target exists), Matrix is the strategic default later.
-- `ASSUMPTION:` "Mos" = a Claude Code orchestrator session with the discord plugin (reuses the documented Discord Bridge Protocol).
-- `ASSUMPTION:` per north star, runtimes default to Codex/pi-on-Codex for workers; the orchestrator "Mos" runs Claude Code (in Claude Code, which is allowed).

docs/scratchpads/p5-overlay-composer.md

@@ -1,43 +0,0 @@
-# P5 — Overlay composer + cross-harness (compose-contract)
-
-- **Issue:** #604 · **Branch:** `feat/p5-overlay-composer` · **Lineage:** #542 → constitution alpha
-- **Requirements:** R7 (compose-contract) + R8 (cross-harness) + R9 (composer test)
-- **Design of record:** `docs/design/framework-constitution/{DESIGN.md §3.2, PRD.md §4}` (on `feat/framework-constitution-alpha`)
-
-## Locked design (sequential-thinking)
-
-Current `launch.ts` assembly (`buildComposedPrompt`) injects by value: mission + PRD + hard-gate +
-CONSTITUTION + AGENTS + USER + TOOLS + runtime. It does **not** inject SOUL or STANDARDS (those are
-read-on-demand per the gutted AGENTS dispatcher), and has no `.local` overlay support.
-
-**Decision (ASSUMPTION — recorded for the PR):** overlays are injected as **deltas by value** under
-labeled sections; base files keep their existing residency.
-
-- `USER.local.md` → appended directly under the `# User Profile` block (USER is injected).
-- `SOUL.local.md` + `STANDARDS.local.md` → a trailing `# Operator Overlays` section (their bases are
-  load-on-demand, so only the small delta is injected — not the full base prose).
-- **Why:** honors DESIGN §3.2 ("model gets one pre-merged blob, no read-merge ritual") while preserving
-  the P3 byte-budget tiering (don't re-inject large SOUL/STANDARDS prose). Precedence order kept: base
-  layers first, operator overlays at recency.
-- Base-only is automatic when a `.local` file is absent (`readOptional`).
-
-## Plan
-
-| #   | Task                                                                                                   | File                                    |
-| --- | ------------------------------------------------------------------------------------------------------ | --------------------------------------- |
-| 1   | Extract `composeContract({harness, mosaicHome})` pure fn; `buildComposedPrompt` delegates              | `src/commands/launch.ts`                |
-| 2   | Overlay logic (USER.local under profile; SOUL/STANDARDS.local in `# Operator Overlays`)                | `src/commands/launch.ts`                |
-| 3   | `mosaic compose-contract <harness>` command → prints blob to stdout                                    | `src/commands/launch.ts`                |
-| 4   | Bare-launch overlay nudge in self-load fallback                                                        | `framework/defaults/AGENTS.md`          |
-| 5   | `compose-contract.spec.ts`: per-tier anchor, Tier-3 byte-equality, overlay present/absent, per-harness | `src/commands/compose-contract.spec.ts` |
-
-## Deferred to P6
-
-CONTRIBUTING.md + harness×gate compliance matrix; resident line-count CI ceiling; `aiguide` reconcile;
-alpha tag `mosaic-vX.Y.Z-alpha`.
-
-## Status
-
-- [x] Phase scaffold (branch, issue #604, scratchpad, TASKS)
-- [ ] Implementation (tasks 1–5)
-- [ ] prettier + vitest green; PR via wrapper → Lead (rides 0.0.39; 0.0.38 mid-cut)

packages/mosaic/framework/defaults/AGENTS.md

@@ -9,10 +9,7 @@ overwritten on upgrade. (Layer model: `constitution/LAYER-MODEL.md`.)
 1. Your context already includes `CONSTITUTION.md` + `USER.md` + the TOOLS index + the runtime
    contract (injected by `mosaic` launch) — do not re-read those. **If you were launched bare**
    (a harness started without `mosaic`, so the law is NOT in your context), read
-   `~/.config/mosaic/CONSTITUTION.md` now, before your first action. A bare launch also gets
-   **base contracts only** — operator overlays (`*.local.md`) are composed by the launcher, so if
-   `SOUL.local.md`/`USER.local.md`/`STANDARDS.local.md` exist, relaunch via `mosaic <harness>` (or run
-   `mosaic doctor`) to pick them up.
+   `~/.config/mosaic/CONSTITUTION.md` now, before your first action.
 2. Read `SOUL.md` (agent persona — small, once).
 3. Read project-local `AGENTS.md` / `CLAUDE.md` if present (these may only make behavior stricter).
 4. Read guides ONLY as triggered by the table below — pull role-relevant depth on demand, not up front.

packages/mosaic/framework/fleet/examples/coding.yaml

@@ -1,32 +0,0 @@
-version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-factory
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  claude:
-    reset_command: /clear
-  pi:
-    reset_command: /new
-agents:
-  - name: orchestrator
-    runtime: claude
-    class: orchestrator
-    persistent_persona: true
-  - name: coder0
-    runtime: pi
-    class: implementer
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: coder1
-    runtime: pi
-    class: implementer
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: reviewer
-    runtime: pi
-    class: reviewer
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true

packages/mosaic/framework/fleet/examples/general.yaml

@@ -1,22 +0,0 @@
-version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-factory
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  claude:
-    reset_command: /clear
-  pi:
-    reset_command: /new
-agents:
-  - name: orchestrator
-    runtime: claude
-    class: orchestrator
-    persistent_persona: true
-  - name: generalist
-    runtime: pi
-    class: worker
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true

packages/mosaic/framework/fleet/examples/hybrid.yaml

@@ -1,32 +0,0 @@
-version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-factory
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  claude:
-    reset_command: /clear
-  pi:
-    reset_command: /new
-agents:
-  - name: orchestrator
-    runtime: claude
-    class: orchestrator
-    persistent_persona: true
-  - name: coder0
-    runtime: pi
-    class: implementer
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: researcher0
-    runtime: pi
-    class: researcher
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: reviewer
-    runtime: pi
-    class: reviewer
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true

packages/mosaic/framework/fleet/examples/research.yaml

@@ -1,32 +0,0 @@
-version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-factory
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  claude:
-    reset_command: /clear
-  pi:
-    reset_command: /new
-agents:
-  - name: orchestrator
-    runtime: claude
-    class: orchestrator
-    persistent_persona: true
-  - name: researcher0
-    runtime: pi
-    class: researcher
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: researcher1
-    runtime: pi
-    class: researcher
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true
-  - name: analyst
-    runtime: pi
-    class: analyst
-    model_hint: openai-codex/gpt-5.5:high
-    reset_between_tasks: true

packages/mosaic/framework/install.sh

@@ -19,9 +19,7 @@ SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET_DIR="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 INSTALL_MODE="${MOSAIC_INSTALL_MODE:-prompt}"
 
-# Files/dirs protected from rsync --delete during sync. NOTE: framework-owned
-# entries (CONSTITUTION/AGENTS/STANDARDS) ARE re-applied afterward by
-# reconcile_framework_files (overwrite + backup-once); the rest stay user-owned.
+# Files/dirs preserved across upgrades (never overwritten).
 # User-created content in these paths survives rsync --delete.
 PRESERVE_PATHS=("CONSTITUTION.md" "AGENTS.md" "SOUL.md" "USER.md" "TOOLS.md" "STANDARDS.md" "memory" "sources" "credentials")
 
@@ -72,13 +70,11 @@ reconcile_framework_files() {
   [[ -d "$defaults" ]] || return 0
   for f in "${FRAMEWORK_OWNED[@]}"; do
     [[ -f "$defaults/$f" ]] || continue
-    # Already current — skip to avoid mtime churn.
-    if [[ -f "$TARGET_DIR/$f" ]] && cmp -s "$TARGET_DIR/$f" "$defaults/$f"; then
-      continue
-    fi
-    if [[ -f "$TARGET_DIR/$f" && ! -f "$TARGET_DIR/${f}.pre-constitution.bak" ]]; then
-      cp "$TARGET_DIR/$f" "$TARGET_DIR/${f}.pre-constitution.bak"
-      warn "$f is now framework-owned and was updated; your previous copy is saved as ${f}.pre-constitution.bak — re-apply intended changes as a .local overlay or policy/ file (see CONSTITUTION.md / constitution/LAYER-MODEL.md)."
+    if [[ -f "$TARGET_DIR/$f" ]] && ! cmp -s "$TARGET_DIR/$f" "$defaults/$f"; then
+      if [[ ! -f "$TARGET_DIR/${f}.pre-constitution.bak" ]]; then
+        cp "$TARGET_DIR/$f" "$TARGET_DIR/${f}.pre-constitution.bak"
+        warn "$f is now framework-owned and was updated; your previous copy is saved as ${f}.pre-constitution.bak — re-apply intended changes as a .local overlay or policy/ file (see CONSTITUTION.md / constitution/LAYER-MODEL.md)."
+      fi
     fi
     cp "$defaults/$f" "$TARGET_DIR/$f"
   done
@@ -285,9 +281,9 @@ sync_framework
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"
 
-# Reconcile contract files from defaults/ into the framework root: framework-owned
-# files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
-# copy is backed up once); user-seeded files (TOOLS) are written on first install only.
+# Seed defaults — copy framework contract files from defaults/ to framework
+# root if not already present. These ship with sensible defaults but must
+# never be overwritten once the user has customized them.
 #
 # This list must match the framework-contract whitelist in
 # packages/mosaic/src/config/file-adapter.ts (FileConfigAdapter.syncFramework).

packages/mosaic/framework/runtime/pi/mosaic-extension.ts

@@ -9,16 +9,8 @@
  *   4. Memory routing — remind agent to use ~/.config/mosaic/memory/
  */
 
-import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
-import { Type } from 'typebox';
-import {
-  existsSync,
-  readFileSync,
-  writeFileSync,
-  unlinkSync,
-  mkdirSync,
-  renameSync,
-} from 'node:fs';
+import type { ExtensionAPI } from '@mariozechner/pi-coding-agent';
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync, spawnSync } from 'node:child_process';
@@ -33,57 +25,6 @@ const MOSAIC_HOME = process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mo
 // Helpers
 // ---------------------------------------------------------------------------
 
-// ---------------------------------------------------------------------------
-// Native heartbeat (fleet R14/R15)
-// ---------------------------------------------------------------------------
-// When this agent runs under the Mosaic fleet (MOSAIC_AGENT_NAME set), the
-// extension writes its OWN heartbeat in the same .hb contract `fleet ps` reads
-// (ts/pid/status[/model]) and touches a `.hb.native` precedence marker so the
-// shell sidecar defers. Native HB knows the real turn state (busy/ok), so it is
-// more accurate than the pane-PID-only sidecar fallback.
-const HB_AGENT_NAME = process.env['MOSAIC_AGENT_NAME'] ?? '';
-const HB_RUN_DIR = process.env['MOSAIC_HEARTBEAT_RUN_DIR'] ?? join(MOSAIC_HOME, 'fleet', 'run');
-const HB_INTERVAL_MS = (() => {
-  const s = Number.parseInt(process.env['MOSAIC_HEARTBEAT_INTERVAL'] ?? '', 10);
-  return Number.isFinite(s) && s > 0 ? s * 1000 : 15_000;
-})();
-
-function nativeHbEnabled(): boolean {
-  return HB_AGENT_NAME.length > 0;
-}
-
-function readModelId(ctx: ExtensionContext): string | null {
-  const m = ctx.model as unknown as { id?: string; name?: string } | undefined;
-  return m?.id ?? m?.name ?? null;
-}
-
-function writeNativeHeartbeat(status: 'ok' | 'busy', model: string | null): void {
-  if (!nativeHbEnabled()) return;
-  try {
-    mkdirSync(HB_RUN_DIR, { recursive: true });
-    const hb = join(HB_RUN_DIR, `${HB_AGENT_NAME}.hb`);
-    const lines = [`ts=${nowIso()}`, `pid=${process.pid}`, `status=${status}`];
-    if (model) lines.push(`model=${model}`);
-    const tmp = `${hb}.tmp.${process.pid}`;
-    writeFileSync(tmp, lines.join('\n') + '\n');
-    renameSync(tmp, hb); // atomic replace — fleet ps never reads a partial file
-    // Precedence marker: tells the shell sidecar that native HB is authoritative.
-    writeFileSync(join(HB_RUN_DIR, `${HB_AGENT_NAME}.hb.native`), nowIso() + '\n');
-  } catch {
-    // Best-effort: never let heartbeat I/O disrupt the Pi session.
-  }
-}
-
-function clearNativeMarker(): void {
-  if (!nativeHbEnabled()) return;
-  try {
-    const m = join(HB_RUN_DIR, `${HB_AGENT_NAME}.hb.native`);
-    if (existsSync(m)) unlinkSync(m); // native stopping — let the sidecar take over
-  } catch {
-    /* ignore */
-  }
-}
-
 function safeRead(filePath: string): string | null {
   try {
     return readFileSync(filePath, 'utf-8');
@@ -246,9 +187,6 @@ function buildMissionSummary(cwd: string, mission: ActiveMission): string {
 
 export default function register(pi: ExtensionAPI) {
   let sessionCwd = process.cwd();
-  let hbStatus: 'ok' | 'busy' = 'ok';
-  let hbModel: string | null = null;
-  let hbTimer: ReturnType<typeof setInterval> | null = null;
 
   // ── Session Start ─────────────────────────────────────────────────────
   pi.on('session_start', async (_event, ctx) => {
@@ -269,39 +207,10 @@ export default function register(pi: ExtensionAPI) {
     } else {
       ctx.ui.notify('Mosaic framework loaded', 'info');
     }
-
-    // Native heartbeat: write immediately, then on an interval. Idle = 'ok';
-    // turn_start/turn_end flip the status so `fleet ps` reflects real activity.
-    if (nativeHbEnabled()) {
-      hbModel = readModelId(ctx);
-      writeNativeHeartbeat('ok', hbModel);
-      hbTimer = setInterval(() => writeNativeHeartbeat(hbStatus, hbModel), HB_INTERVAL_MS);
-      if (typeof hbTimer.unref === 'function') hbTimer.unref();
-    }
   });
 
-  // ── Turn lifecycle → accurate busy/ok heartbeat ───────────────────────
-  pi.on('turn_start', async (_event, ctx) => {
-    hbStatus = 'busy';
-    hbModel = readModelId(ctx) ?? hbModel;
-    writeNativeHeartbeat('busy', hbModel);
-  });
-  pi.on('turn_end', async (_event, ctx) => {
-    hbStatus = 'ok';
-    hbModel = readModelId(ctx) ?? hbModel;
-    writeNativeHeartbeat('ok', hbModel);
-  });
-
-  // ── Session Shutdown ──────────────────────────────────────────────────
-  // (The pi API event is 'session_shutdown'; the prior 'session_end' handler
-  // never fired — fixed here so repo hooks + lock cleanup actually run.)
-  pi.on('session_shutdown', async (_event, _ctx) => {
-    if (hbTimer) {
-      clearInterval(hbTimer);
-      hbTimer = null;
-    }
-    clearNativeMarker();
-
+  // ── Session End ───────────────────────────────────────────────────────
+  pi.on('session_end', async (_event, _ctx) => {
     // Run repo session-end hook
     runRepoHook(sessionCwd, 'session-end');
 
@@ -343,32 +252,4 @@ export default function register(pi: ExtensionAPI) {
       }
     },
   });
-
-  // ── Register mosaic_mission_status tool (model-callable) ──────────────
-  // R14 "proper tool usage": give the agent a first-class tool to load its
-  // active Mosaic mission, milestone progress, task counts, and latest
-  // scratchpad — so it self-orients on in-flight work before planning,
-  // instead of shelling out or guessing. Mirrors the /mosaic-status command
-  // but returns the summary as tool output the LLM can read.
-  pi.registerTool({
-    name: 'mosaic_mission_status',
-    label: 'Mosaic Mission Status',
-    description:
-      'Return the active Mosaic mission, milestone progress, task counts, and latest scratchpad for the current project. Returns a note when no mission is active.',
-    promptSnippet: 'Read the active Mosaic mission + task state for the current project',
-    promptGuidelines: [
-      'Use mosaic_mission_status at the start of a session or task to load the active mission, milestone progress, and open tasks before planning work.',
-    ],
-    parameters: Type.Object({}),
-    async execute(_toolCallId, _params, _signal, _onUpdate, _ctx) {
-      const mission = detectMission(sessionCwd);
-      const text = mission
-        ? buildMissionSummary(sessionCwd, mission)
-        : 'No active Mosaic mission in this project.';
-      return {
-        content: [{ type: 'text', text }],
-        details: mission ? { ...mission } : { active: false },
-      };
-    },
-  });
 }

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -6,8 +6,6 @@ MOSAIC_TMUX_SOCKET=${MOSAIC_TMUX_SOCKET:-mosaic-factory}
 MOSAIC_AGENT_RUNTIME=${MOSAIC_AGENT_RUNTIME:-pi}
 MOSAIC_AGENT_WORKDIR=${MOSAIC_AGENT_WORKDIR:-$HOME}
 MOSAIC_AGENT_COMMAND=${MOSAIC_AGENT_COMMAND:-}
-MOSAIC_HEARTBEAT_RUN_DIR=${MOSAIC_HEARTBEAT_RUN_DIR:-${MOSAIC_HOME:-$HOME/.config/mosaic}/fleet/run}
-MOSAIC_HEARTBEAT_INTERVAL=${MOSAIC_HEARTBEAT_INTERVAL:-15}
 
 if [ -z "$AGENT_NAME" ]; then
   echo "ERROR: agent name argument or MOSAIC_AGENT_NAME is required" >&2
@@ -90,70 +88,13 @@ MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 #
 # We build the snippet as a double-quoted here-string embedded in a printf call
 # to avoid nested quoting problems.
-#
-# MOSAIC_AGENT_NAME must also be exported INTO the pane: panes inherit the tmux
-# server environment (not this script's, and not the systemd unit's), so the
-# name would otherwise be empty in-pane and the runtime's native heartbeat
-# (which gates on MOSAIC_AGENT_NAME) would never fire. %q-quote it so it is a
-# safe single bash token regardless of the name's characters.
-AGENT_NAME_Q=$(printf '%q' "$AGENT_NAME")
 
 if [ -n "$MOSAIC_RUNTIME_BIN_PREFIX" ]; then
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="export PATH=\"${MOSAIC_RUNTIME_BIN_PREFIX}:\${PATH}\"; exec ${MOSAIC_AGENT_COMMAND}"
 else
-  PANE_SHELL_SNIPPET="export MOSAIC_AGENT_NAME=${AGENT_NAME_Q}; exec ${MOSAIC_AGENT_COMMAND}"
+  PANE_SHELL_SNIPPET="exec ${MOSAIC_AGENT_COMMAND}"
 fi
 
 mkdir -p "$MOSAIC_AGENT_WORKDIR"
-
-# ── Launch the tmux session (no exec — we continue to wire the heartbeat) ────
-tmux -L "$MOSAIC_TMUX_SOCKET" new-session -d -s "$AGENT_NAME" -c "$MOSAIC_AGENT_WORKDIR" \
+exec tmux -L "$MOSAIC_TMUX_SOCKET" new-session -d -s "$AGENT_NAME" -c "$MOSAIC_AGENT_WORKDIR" \
   bash -c "$PANE_SHELL_SNIPPET"
-
-# ── Resolve the pane PID (retry briefly to let the session initialise) ────────
-PANE_PID=""
-for _retry in 1 2 3 4 5; do
-  PANE_PID=$(tmux -L "$MOSAIC_TMUX_SOCKET" list-panes \
-    -t "=${AGENT_NAME}:0.0" -F '#{pane_pid}' 2>/dev/null || true)
-  [ -n "$PANE_PID" ] && break
-  sleep 0.2
-done
-
-# ── Spawn the heartbeat sidecar (detached, best-effort) ──────────────────────
-# The sidecar writes ~/.config/mosaic/fleet/run/<AGENT>.hb atomically while the
-# pane process is alive, then exits so the file goes stale (fleet ps shows stale
-# then PANE=dead).  It is runtime-agnostic: it only cares about the pane PID.
-_start_heartbeat_sidecar() {
-  local agent="$1"
-  local pane_pid="$2"
-  local run_dir="$3"
-  local interval="$4"
-  local hb_file="${run_dir}/${agent}.hb"
-
-  mkdir -p "$run_dir"
-
-  # Write the sidecar as a self-contained bash one-liner so it carries no
-  # references to any variables from this script's environment.
-  local sidecar_script
-  sidecar_script=$(printf \
-    'hb=%q; pid=%q; iv=%q; mkdir -p "$(dirname "$hb")"; while kill -0 "$pid" 2>/dev/null; do nat="$hb.native"; if [ -f "$nat" ] && [ "$(( $(date +%%s) - $(stat -c %%Y "$nat" 2>/dev/null || echo 0) ))" -lt "$(( iv * 2 ))" ]; then sleep "$iv"; continue; fi; tmp="$hb.tmp.$$"; printf "ts=%%s\npid=%%s\nstatus=ok\n" "$(date +%%Y-%%m-%%dT%%H:%%M:%%S%%z)" "$pid" > "$tmp" && mv "$tmp" "$hb"; sleep "$iv"; done' \
-    "$hb_file" "$pane_pid" "$interval")
-
-  # setsid + disown ensures the sidecar survives this script exiting.
-  # stderr/stdout go to /dev/null; failures are non-fatal.
-  if command -v setsid >/dev/null 2>&1; then
-    setsid bash -c "$sidecar_script" </dev/null >/dev/null 2>&1 &
-  else
-    bash -c "$sidecar_script" </dev/null >/dev/null 2>&1 &
-  fi
-  disown $! 2>/dev/null || true
-}
-
-if [ -n "$PANE_PID" ]; then
-  # Guard: do not let sidecar startup failures abort the launcher (set -e).
-  _start_heartbeat_sidecar "$AGENT_NAME" "$PANE_PID" \
-    "$MOSAIC_HEARTBEAT_RUN_DIR" "$MOSAIC_HEARTBEAT_INTERVAL" || \
-    echo "WARNING: heartbeat sidecar could not be started for $AGENT_NAME" >&2
-else
-  echo "WARNING: could not resolve pane PID for $AGENT_NAME — heartbeat sidecar not started" >&2
-fi

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -32,15 +32,8 @@ MOSAIC_AGENT_COMMAND='bash --noprofile --norc -i' \
   "$START" "$AGENT"
 
 tmux -L "$SOCKET" has-session -t "=$AGENT:0.0" || fail "agent session was not created"
-# Retry: pane_current_path briefly reflects the tmux server's cwd until the pane
-# process establishes its own cwd (the -c start dir). Poll until it settles.
-actual_dir=""
-for _ in $(seq 1 30); do
-  actual_dir=$(tmux -L "$SOCKET" display-message -p -t "=$AGENT:0.0" '#{pane_current_path}')
-  [ "$actual_dir" = "$WORKDIR" ] && break
-  sleep 0.1
-done
-[ "$actual_dir" = "$WORKDIR" ] || fail "agent workdir mismatch: $actual_dir (expected $WORKDIR)"
+actual_dir=$(tmux -L "$SOCKET" display-message -p -t "=$AGENT:0.0" '#{pane_current_path}')
+[ "$actual_dir" = "$WORKDIR" ] || fail "agent workdir mismatch: $actual_dir"
 
 # ── Test 2: idempotency (duplicate start prints 'already running') ─────────────
 MOSAIC_TMUX_SOCKET="$SOCKET" \
@@ -57,10 +50,6 @@ grep -qF 'already running' /tmp/mosaic-start-agent-idempotent.out || fail "dupli
 #   - Intercepts 'new-session' calls and records its arguments to a file.
 #   - For 'has-session' calls, exits 1 (session does not exist) so the script
 #     proceeds to launch instead of printing "already running".
-#   - For 'list-panes' calls, returns empty so PANE_PID stays unset and the
-#     heartbeat sidecar is NOT spawned (heartbeat is not the focus of this test;
-#     test 6 and 7 cover that path).  This prevents any real-filesystem side
-#     effects or leaked background processes.
 #   - For all other subcommands, exits 0.
 #
 # Assertions:
@@ -71,8 +60,7 @@ grep -qF 'already running' /tmp/mosaic-start-agent-idempotent.out || fail "dupli
 FAKE_BIN=$(mktemp -d)
 FAKE_RUNTIME_BIN=$(mktemp -d)
 TMUX_ARGS_FILE=$(mktemp)
-HB_RUN_DIR3=$(mktemp -d)
-CLEANUP_DIRS+=("$FAKE_BIN" "$FAKE_RUNTIME_BIN" "$HB_RUN_DIR3")
+CLEANUP_DIRS+=("$FAKE_BIN" "$FAKE_RUNTIME_BIN")
 
 # Write the fake tmux shim (uses only positional args, no sourced vars).
 cat > "$FAKE_BIN/tmux" <<SHIM
@@ -86,11 +74,6 @@ if [ "\$subcmd" = "new-session" ]; then
   printf '%s\n' "\$@" > "$TMUX_ARGS_FILE"
   exit 0
 fi
-if [ "\$subcmd" = "list-panes" ]; then
-  # Return empty: no sidecar spawned (heartbeat is not the focus of this test).
-  echo ""
-  exit 0
-fi
 exit 0
 SHIM
 chmod +x "$FAKE_BIN/tmux"
@@ -106,7 +89,6 @@ MOSAIC_AGENT_WORKDIR="$WORKDIR3" \
 MOSAIC_AGENT_RUNTIME="pi" \
 MOSAIC_RUNTIME_BIN="$FAKE_RUNTIME_BIN" \
 MOSAIC_AGENT_COMMAND="mosaic yolo pi --model openai-codex/gpt-5.5:high" \
-MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR3" \
   "$START" "$AGENT3"
 
 all_args=$(cat "$TMUX_ARGS_FILE" 2>/dev/null || true)
@@ -130,8 +112,7 @@ echo "$all_args" | grep -qF "mosaic yolo pi --model openai-codex/gpt-5.5:high" |
 # ── Test 4: when no extra runtime-bin dirs exist, exec still appears ───────────
 TMUX_ARGS_FILE2=$(mktemp)
 FAKE_BIN2=$(mktemp -d)
-HB_RUN_DIR4=$(mktemp -d)
-CLEANUP_DIRS+=("$FAKE_BIN2" "$HB_RUN_DIR4")
+CLEANUP_DIRS+=("$FAKE_BIN2")
 
 cat > "$FAKE_BIN2/tmux" <<SHIM2
 #!/usr/bin/env bash
@@ -141,11 +122,6 @@ if [ "\$subcmd" = "new-session" ]; then
   printf '%s\n' "\$@" > "$TMUX_ARGS_FILE2"
   exit 0
 fi
-if [ "\$subcmd" = "list-panes" ]; then
-  # Return empty: no sidecar spawned (heartbeat is not the focus of this test).
-  echo ""
-  exit 0
-fi
 exit 0
 SHIM2
 chmod +x "$FAKE_BIN2/tmux"
@@ -163,7 +139,6 @@ MOSAIC_AGENT_WORKDIR="$WORKDIR4" \
 MOSAIC_AGENT_RUNTIME="pi" \
 MOSAIC_RUNTIME_BIN="/nonexistent-dir-$$" \
 MOSAIC_AGENT_COMMAND="mosaic yolo pi" \
-MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR4" \
   "$START" "$AGENT4"
 
 all_args4=$(cat "$TMUX_ARGS_FILE2" 2>/dev/null || true)
@@ -186,8 +161,7 @@ echo "$all_args4" | grep -qF "mosaic yolo pi" || fail "pane command does not inc
 TMUX_ARGS_FILE5=$(mktemp)
 FAKE_BIN5=$(mktemp -d)
 FAKE_RUNTIME_BIN5=$(mktemp -d)  # this dir IS on the launcher's PATH below
-HB_RUN_DIR5=$(mktemp -d)
-CLEANUP_DIRS+=("$FAKE_BIN5" "$FAKE_RUNTIME_BIN5" "$HB_RUN_DIR5")
+CLEANUP_DIRS+=("$FAKE_BIN5" "$FAKE_RUNTIME_BIN5")
 
 cat > "$FAKE_BIN5/tmux" <<SHIM5
 #!/usr/bin/env bash
@@ -197,11 +171,6 @@ if [ "\$subcmd" = "new-session" ]; then
   printf '%s\n' "\$@" > "$TMUX_ARGS_FILE5"
   exit 0
 fi
-if [ "\$subcmd" = "list-panes" ]; then
-  # Return empty: no sidecar spawned (heartbeat is not the focus of this test).
-  echo ""
-  exit 0
-fi
 exit 0
 SHIM5
 chmod +x "$FAKE_BIN5/tmux"
@@ -221,7 +190,6 @@ MOSAIC_AGENT_WORKDIR="$WORKDIR5" \
 MOSAIC_AGENT_RUNTIME="pi" \
 MOSAIC_RUNTIME_BIN="$FAKE_RUNTIME_BIN5" \
 MOSAIC_AGENT_COMMAND="mosaic yolo pi" \
-MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR5" \
   "$START" "$AGENT5"
 
 all_args5=$(cat "$TMUX_ARGS_FILE5" 2>/dev/null || true)
@@ -237,123 +205,4 @@ echo "$all_args5" | grep -qF "export PATH=" || \
 echo "$all_args5" | grep -qF "$FAKE_RUNTIME_BIN5" || \
   fail "test5: candidate dir (already on launcher PATH) was NOT baked into pane PATH — regression"
 
-# ── Test 6: heartbeat sidecar — pane PID resolved + .hb file written ──────────
-#
-# Uses a real tmux session (same socket as test 1 which already has $AGENT) so
-# list-panes returns a real pane PID.  We override MOSAIC_HEARTBEAT_RUN_DIR to
-# a temp dir and set a 1-second interval, then wait up to 3 s for the .hb file
-# to appear and check its content.
-
-HB_RUN_DIR=$(mktemp -d)
-CLEANUP_DIRS+=("$HB_RUN_DIR")
-
-# Re-use the session+agent created in Test 1 (still alive on $SOCKET / $AGENT).
-# We need to invoke the script for a NEW agent on the same socket to exercise
-# the heartbeat path with a real pane PID.
-AGENT6="agent6-$RANDOM"
-MOSAIC_TMUX_SOCKET="$SOCKET" \
-MOSAIC_AGENT_WORKDIR="$WORKDIR" \
-MOSAIC_AGENT_COMMAND='bash --noprofile --norc -i' \
-MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR" \
-MOSAIC_HEARTBEAT_INTERVAL="1" \
-  "$START" "$AGENT6"
-
-HB_FILE="$HB_RUN_DIR/${AGENT6}.hb"
-
-# Wait up to 5 seconds for the heartbeat file to appear.
-_waited=0
-until [ -f "$HB_FILE" ] || [ "$_waited" -ge 5 ]; do
-  sleep 0.5
-  _waited=$((_waited + 1))
-done
-
-[ -f "$HB_FILE" ] || fail "test6: heartbeat file not written at $HB_FILE within 5s"
-
-hb_content=$(cat "$HB_FILE")
-echo "--- test 6: heartbeat file content ---"
-echo "$hb_content"
-echo "--- end test 6 ---"
-
-# Verify required fields are present.
-echo "$hb_content" | grep -qE '^ts=[0-9]{4}-[0-9]{2}-[0-9]{2}T' || \
-  fail "test6: heartbeat ts field missing or malformed"
-echo "$hb_content" | grep -qE '^pid=[0-9]+' || \
-  fail "test6: heartbeat pid field missing or malformed"
-echo "$hb_content" | grep -qF 'status=ok' || \
-  fail "test6: heartbeat status=ok missing"
-
-# ── Test 7: heartbeat sidecar — targets correct .hb path per agent name ────────
-#
-# Uses the fake-tmux shim approach (like tests 3-5) to capture the sidecar
-# invocation without needing a real session.  A fake setsid shim records its
-# arguments so we can assert the sidecar script targets the expected .hb path
-# and uses the configured interval.
-
-FAKE_BIN7=$(mktemp -d)
-FAKE_RUNTIME_BIN7=$(mktemp -d)
-SETSID_ARGS_FILE=$(mktemp)
-HB_RUN_DIR7=$(mktemp -d)
-CLEANUP_DIRS+=("$FAKE_BIN7" "$FAKE_RUNTIME_BIN7" "$HB_RUN_DIR7")
-
-AGENT7="my-fleet-agent-$RANDOM"
-INTERVAL7="42"
-
-# Fake tmux: has-session → not found; new-session → ok; list-panes → known PID.
-cat > "$FAKE_BIN7/tmux" <<SHIM7
-#!/usr/bin/env bash
-subcmd="\$3"
-if [ "\$subcmd" = "has-session" ]; then exit 1; fi
-if [ "\$subcmd" = "new-session" ]; then exit 0; fi
-if [ "\$subcmd" = "list-panes" ]; then echo "88888"; exit 0; fi
-exit 0
-SHIM7
-chmod +x "$FAKE_BIN7/tmux"
-
-# Fake setsid: capture the bash -c <script> argument for inspection, then
-# background an actual bash subshell so disown succeeds in the caller.
-cat > "$FAKE_BIN7/setsid" <<'SETSID_SHIM'
-#!/usr/bin/env bash
-# argv: setsid bash -c <sidecar_script>
-# Record the full argument list to the capture file, then exit cleanly.
-printf '%s\0' "$@" > __SETSID_ARGS_FILE__
-exit 0
-SETSID_SHIM
-# Patch the placeholder with the real capture-file path (avoids heredoc expansion issues).
-sed -i "s|__SETSID_ARGS_FILE__|${SETSID_ARGS_FILE}|g" "$FAKE_BIN7/setsid"
-chmod +x "$FAKE_BIN7/setsid"
-
-SOCKET7="mosaic-agent-test7-$RANDOM-$$"
-WORKDIR7=$(mktemp -d)
-CLEANUP_DIRS+=("$WORKDIR7")
-
-PATH="$FAKE_BIN7:$PATH" \
-MOSAIC_TMUX_SOCKET="$SOCKET7" \
-MOSAIC_AGENT_WORKDIR="$WORKDIR7" \
-MOSAIC_AGENT_RUNTIME="pi" \
-MOSAIC_RUNTIME_BIN="$FAKE_RUNTIME_BIN7" \
-MOSAIC_AGENT_COMMAND="mosaic yolo pi" \
-MOSAIC_HEARTBEAT_RUN_DIR="$HB_RUN_DIR7" \
-MOSAIC_HEARTBEAT_INTERVAL="$INTERVAL7" \
-  "$START" "$AGENT7"
-
-# Give the background setsid shim a moment to finish writing the capture file.
-sleep 0.5
-
-setsid_args=$(cat "$SETSID_ARGS_FILE" 2>/dev/null | tr '\0' '\n' || true)
-rm -f "$SETSID_ARGS_FILE"
-rm -rf "$WORKDIR7"
-
-echo "--- test 7: captured setsid args ---"
-echo "$setsid_args"
-echo "--- end test 7 ---"
-
-# The sidecar script (bash -c <script>) must reference the correct .hb path.
-expected_hb="${HB_RUN_DIR7}/${AGENT7}.hb"
-echo "$setsid_args" | grep -qF "$expected_hb" || \
-  fail "test7: sidecar script does not reference correct .hb path ($expected_hb)"
-
-# The sidecar script must use the configured interval.
-echo "$setsid_args" | grep -qF "$INTERVAL7" || \
-  fail "test7: sidecar script does not reference configured interval ($INTERVAL7)"
-
 echo "ok - start-agent-session"

packages/mosaic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosaicstack/mosaic",
-  "version": "0.0.37",
+  "version": "0.0.35",
   "repository": {
     "type": "git",
     "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",

packages/mosaic/src/commands/compose-contract.spec.ts

@@ -1,118 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { composeContract } from './launch.js';
-
-/**
- * Composer unit test (R7/R8/R9): asserts the launcher-composed runtime contract
- *
- *   - includes the per-tier anchors (CONSTITUTION / AGENTS / USER / runtime),
- *   - keeps the CONSTITUTION block byte-equal to the on-disk file (Tier-3
- *     byte-equality — the bare-launch fallback read must match what is injected),
- *   - merges `*.local.md` operator overlays as deltas-by-value, and omits them
- *     entirely when absent (base-only),
- *   - selects the correct per-harness RUNTIME.md.
- *
- * `composeContract` takes `mosaicHome` as a param, so each test runs against an
- * isolated fixture home. We also chdir to an empty temp cwd so the cwd-relative
- * mission/PRD blocks contribute nothing (deterministic output).
- */
-
-const CONSTITUTION = '# CONSTITUTION\n\nGATE-1: the non-negotiable law.\n';
-const AGENTS = '# Mosaic Agent Dispatcher\n\nLoad order + guide router.\n';
-const USER = '# operator\n\nName: Test Operator\n';
-const TOOLS = '# tools index\n';
-
-function makeHome(): { home: string; root: string } {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-compose-'));
-  const home = join(root, 'mosaic-home');
-  for (const h of ['claude', 'codex', 'opencode', 'pi']) {
-    mkdirSync(join(home, 'runtime', h), { recursive: true });
-    writeFileSync(join(home, 'runtime', h, 'RUNTIME.md'), `# ${h} runtime contract\n`);
-  }
-  writeFileSync(join(home, 'CONSTITUTION.md'), CONSTITUTION);
-  writeFileSync(join(home, 'AGENTS.md'), AGENTS);
-  writeFileSync(join(home, 'USER.md'), USER);
-  writeFileSync(join(home, 'TOOLS.md'), TOOLS);
-  return { home, root };
-}
-
-describe('composeContract — overlay composer', () => {
-  let fixture: ReturnType<typeof makeHome>;
-  let prevCwd: string;
-  let cwdDir: string;
-
-  beforeEach(() => {
-    fixture = makeHome();
-    prevCwd = process.cwd();
-    cwdDir = mkdtempSync(join(tmpdir(), 'mosaic-cwd-'));
-    process.chdir(cwdDir); // neutralize cwd-relative mission/PRD blocks
-  });
-
-  afterEach(() => {
-    process.chdir(prevCwd);
-    rmSync(fixture.root, { recursive: true, force: true });
-    rmSync(cwdDir, { recursive: true, force: true });
-  });
-
-  it('includes the per-tier anchors and the selected harness runtime', () => {
-    const out = composeContract('claude', fixture.home);
-    expect(out).toContain('GATE-1: the non-negotiable law.'); // L0
-    expect(out).toContain('Mosaic Agent Dispatcher'); // AGENTS
-    expect(out).toContain('# User Profile'); // USER header
-    expect(out).toContain('Name: Test Operator'); // USER body
-    expect(out).toContain('# Runtime-Specific Contract');
-    expect(out).toContain('# claude runtime contract');
-  });
-
-  it('keeps the CONSTITUTION block byte-equal to the on-disk file (Tier-3)', () => {
-    const out = composeContract('pi', fixture.home);
-    const onDisk = readFileSync(join(fixture.home, 'CONSTITUTION.md'), 'utf-8');
-    // The injected L0 must be a byte-equal substring of the composed blob, so a
-    // bare-launch fallback read of CONSTITUTION.md matches what was injected.
-    expect(out.includes(onDisk)).toBe(true);
-  });
-
-  it('is base-only when no *.local overlays exist', () => {
-    const out = composeContract('claude', fixture.home);
-    expect(out).not.toContain('# Operator Overlays');
-    expect(out).not.toContain('Operator Overlay (USER.local.md)');
-    expect(out).not.toContain('Persona Overlay');
-    expect(out).not.toContain('Standards Overlay');
-  });
-
-  it('merges USER.local.md directly under the operator profile', () => {
-    writeFileSync(join(fixture.home, 'USER.local.md'), 'Prefer terse status updates.\n');
-    const out = composeContract('claude', fixture.home);
-    expect(out).toContain('## Operator Overlay (USER.local.md)');
-    expect(out).toContain('Prefer terse status updates.');
-    // Overlay appears AFTER its base profile.
-    expect(out.indexOf('# User Profile')).toBeLessThan(
-      out.indexOf('## Operator Overlay (USER.local.md)'),
-    );
-  });
-
-  it('merges SOUL.local.md + STANDARDS.local.md as deltas in the Operator Overlays block', () => {
-    writeFileSync(join(fixture.home, 'SOUL.local.md'), 'Tone: dry and direct.\n');
-    writeFileSync(join(fixture.home, 'STANDARDS.local.md'), 'Require 90% coverage on auth code.\n');
-    const out = composeContract('claude', fixture.home);
-    expect(out).toContain('# Operator Overlays');
-    expect(out).toContain('## Persona Overlay (SOUL.local.md)');
-    expect(out).toContain('Tone: dry and direct.');
-    expect(out).toContain('## Standards Overlay (STANDARDS.local.md)');
-    expect(out).toContain('Require 90% coverage on auth code.');
-  });
-
-  it('ignores whitespace-only *.local overlays (no empty overlay section)', () => {
-    writeFileSync(join(fixture.home, 'SOUL.local.md'), '   \n\n');
-    const out = composeContract('claude', fixture.home);
-    expect(out).not.toContain('# Operator Overlays');
-  });
-
-  it('selects a different RUNTIME.md per harness', () => {
-    expect(composeContract('codex', fixture.home)).toContain('# codex runtime contract');
-    expect(composeContract('pi', fixture.home)).toContain('# pi runtime contract');
-    expect(composeContract('codex', fixture.home)).not.toContain('# pi runtime contract');
-  });
-});

packages/mosaic/src/commands/fleet.ts

@@ -1,10 +1,9 @@
 import { constants } from 'node:fs';
-import { access, chmod, copyFile, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { access, chmod, copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { homedir, hostname, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
-import * as readline from 'node:readline';
 import type { Command } from 'commander';
 import YAML from 'yaml';
 
@@ -42,11 +41,6 @@ export interface FleetCommandDeps {
   sleepFn?: SleepFn;
   mosaicHome?: string;
   frameworkRoot?: string;
-  /**
-   * Injectable TTY check for `fleet init` wizard. Defaults to process.stdin.isTTY.
-   * Tests stub this to simulate interactive or non-interactive environments.
-   */
-  isStdinTTY?: boolean;
 }
 
 interface RawFleetRoster {
@@ -152,16 +146,13 @@ export function resolveFleetPaths(mosaicHome = defaultMosaicHome()): FleetPaths
 }
 
 function defaultMosaicHome(): string {
-  // Honor MOSAIC_HOME so the reader matches the writer sidecar (and the launcher),
-  // even when MOSAIC_HOME is set in the shell without an explicit --mosaic-home flag.
-  return process.env.MOSAIC_HOME ?? join(homedir(), '.config', 'mosaic');
+  return join(homedir(), '.config', 'mosaic');
 }
 
 function assertDefaultMosaicHomeForSystemd(mosaicHome: string): void {
-  const literalHome = join(homedir(), '.config', 'mosaic');
-  if (resolve(mosaicHome) !== resolve(literalHome)) {
+  if (resolve(mosaicHome) !== resolve(defaultMosaicHome())) {
     throw new Error(
-      `install-systemd only supports the default Mosaic home (${literalHome}) because the user systemd units use %h/.config/mosaic paths.`,
+      `install-systemd only supports the default Mosaic home (${defaultMosaicHome()}) because the user systemd units use %h/.config/mosaic paths.`,
     );
   }
 }
@@ -219,93 +210,6 @@ export function buildFleetServiceCommand(action: FleetServiceAction, agentName?:
   return ['systemctl', '--user', action, service];
 }
 
-/**
- * Returns the systemctl --user enable command for a given unit.
- * Used by the install auto-enable step to persist units across reboots.
- */
-export function buildSystemdEnableCommand(unit: string): string[] {
-  return ['systemctl', '--user', 'enable', unit];
-}
-
-/**
- * Returns the loginctl enable-linger command for a given user.
- * Linger allows user systemd services to survive logout.
- */
-export function buildEnableLingerCommand(user: string): string[] {
-  return ['loginctl', 'enable-linger', user];
-}
-
-/**
- * Enable fleet units for boot-survival after install.
- * Non-fatal: if systemctl enable returns non-zero, a warning is printed and we continue.
- * If opts.enable === false (--no-enable flag), the whole step is skipped.
- */
-export async function enableFleetUnits(
-  runner: CommandRunner,
-  roster: FleetRoster,
-  opts: { enable?: boolean },
-): Promise<void> {
-  if (opts.enable === false) {
-    return;
-  }
-  try {
-    let succeeded = 0;
-    let failed = 0;
-
-    const holderResult = await runner(
-      ...splitCommand(buildSystemdEnableCommand('mosaic-tmux-holder.service')),
-    );
-    if (holderResult.exitCode === 0) {
-      succeeded++;
-    } else {
-      failed++;
-      process.stderr.write(
-        `Warning: could not enable mosaic-tmux-holder.service: ${holderResult.stderr || holderResult.stdout || 'non-zero exit'}\n`,
-      );
-    }
-
-    for (const agent of roster.agents) {
-      const unit = `mosaic-agent@${agent.name}.service`;
-      const result = await runner(...splitCommand(buildSystemdEnableCommand(unit)));
-      if (result.exitCode === 0) {
-        succeeded++;
-      } else {
-        failed++;
-        process.stderr.write(
-          `Warning: could not enable ${unit}: ${result.stderr || result.stdout || 'non-zero exit'}\n`,
-        );
-      }
-    }
-
-    if (succeeded > 0) {
-      console.log(`Enabled ${succeeded} unit(s) for boot-survival.`);
-    }
-    if (failed > 0) {
-      process.stderr.write(
-        `Warning: ${failed} unit(s) could not be enabled (systemctl unavailable?). Run manually if needed.\n`,
-      );
-    }
-
-    // Best-effort linger
-    let username: string;
-    try {
-      username = userInfo().username;
-    } catch {
-      username = process.env['USER'] ?? process.env['LOGNAME'] ?? 'unknown';
-    }
-    const lingerResult = await runner(...splitCommand(buildEnableLingerCommand(username)));
-    if (lingerResult.exitCode !== 0) {
-      process.stderr.write(
-        `Hint: run 'loginctl enable-linger ${username}' as root to survive logout.\n`,
-      );
-    }
-  } catch (err) {
-    process.stderr.write(
-      `Warning: auto-enable step failed unexpectedly: ${err instanceof Error ? err.message : String(err)}\n`,
-    );
-  }
-}
-
 export function buildAgentSendCommand(
   paths: FleetPaths,
   agentName: string,
@@ -371,16 +275,6 @@ export function buildAgentTailCommand(
 // ---------------------------------------------------------------------------
 
 export const HEARTBEAT_INTERVAL_MS = 15_000;
-
-/**
- * Heartbeat interval in ms, honoring MOSAIC_HEARTBEAT_INTERVAL (seconds) so the
- * `fleet ps` freshness threshold matches the writer sidecar's actual cadence
- * (start-agent-session.sh). Falls back to HEARTBEAT_INTERVAL_MS (15s).
- */
-export function heartbeatIntervalMs(): number {
-  const sec = Number.parseInt(process.env.MOSAIC_HEARTBEAT_INTERVAL ?? '', 10);
-  return Number.isFinite(sec) && sec > 0 ? sec * 1000 : HEARTBEAT_INTERVAL_MS;
-}
 export const HEARTBEAT_HEALTHY_MULTIPLIER = 3;
 
 export interface HeartbeatInfo {
@@ -390,8 +284,6 @@ export interface HeartbeatInfo {
   /** healthy | stale | unknown */
   health: 'healthy' | 'stale' | 'unknown';
   ageMs: number | null;
-  /** Model id the runtime self-reported in its heartbeat (native HB only), else null. */
-  model: string | null;
 }
 
 export interface AgentPsRow {
@@ -410,10 +302,6 @@ export interface AgentPsRow {
   driftFlag: boolean;
   /** active but UnitFileState=disabled */
   bootEnableWarning: boolean;
-  /** true = came from roster; false = found on socket but not in roster */
-  managed: boolean;
-  /** "roster" = defined in roster.yaml; "socket" = discovered via tmux list-sessions */
-  source: 'roster' | 'socket';
 }
 
 /**
@@ -456,34 +344,11 @@ export function buildTmuxListPanesCommand(
   ];
 }
 
-/**
- * Returns the tmux list-sessions command to enumerate all sessions on a socket.
- * Format: `tmux -L <socket> list-sessions -F '#{session_name}'`
- * Used to discover ad-hoc sessions that are not in the roster.
- */
-export function buildTmuxListSessionsCommand(socketName = DEFAULT_SOCKET_NAME): string[] {
-  return ['tmux', '-L', socketName, 'list-sessions', '-F', '#{session_name}'];
-}
-
-/**
- * Parse the output of `tmux list-sessions -F '#{session_name}'` into an array of session names.
- * Returns an empty array on empty/blank output.
- */
-export function parseTmuxListSessions(output: string): string[] {
-  return output
-    .split('\n')
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0);
-}
-
 /**
  * Returns the heartbeat file path for an agent.
  */
 export function heartbeatPath(agentName: string, mosaicHome = defaultMosaicHome()): string {
-  // Honor MOSAIC_HEARTBEAT_RUN_DIR (the writer sidecar's override); otherwise the
-  // canonical <mosaicHome>/fleet/run. Keeps reader and writer on the same path.
-  const runDir = process.env.MOSAIC_HEARTBEAT_RUN_DIR ?? join(mosaicHome, 'fleet', 'run');
-  return join(runDir, `${agentName}.hb`);
+  return join(mosaicHome, 'fleet', 'run', `${agentName}.hb`);
 }
 
 /**
@@ -492,17 +357,15 @@ export function heartbeatPath(agentName: string, mosaicHome = defaultMosaicHome(
  *   ts=<iso8601>
  *   pid=<pid>
  *   status=<ok|busy>
- *   model=<model-id>   (optional — native runtime heartbeats self-report it)
  */
 export function parseHeartbeat(content: string | null, nowMs = Date.now()): HeartbeatInfo {
   if (content === null) {
-    return { ts: null, pid: null, status: null, health: 'unknown', ageMs: null, model: null };
+    return { ts: null, pid: null, status: null, health: 'unknown', ageMs: null };
   }
   const lines = content.split('\n');
   let ts: Date | null = null;
   let pid: number | null = null;
   let status: 'ok' | 'busy' | null = null;
-  let model: string | null = null;
   for (const line of lines) {
     const [key, ...rest] = line.split('=');
     const val = rest.join('=').trim();
@@ -514,18 +377,16 @@ export function parseHeartbeat(content: string | null, nowMs = Date.now()): Hear
       if (Number.isFinite(n)) pid = n;
     } else if (key === 'status' && (val === 'ok' || val === 'busy')) {
       status = val;
-    } else if (key === 'model' && val) {
-      model = val;
     }
   }
-  const thresholdMs = heartbeatIntervalMs() * HEARTBEAT_HEALTHY_MULTIPLIER;
+  const thresholdMs = HEARTBEAT_INTERVAL_MS * HEARTBEAT_HEALTHY_MULTIPLIER;
   let health: 'healthy' | 'stale' | 'unknown' = 'unknown';
   let ageMs: number | null = null;
   if (ts !== null) {
     ageMs = nowMs - ts.getTime();
     health = ageMs <= thresholdMs ? 'healthy' : 'stale';
   }
-  return { ts, pid, status, health, ageMs, model };
+  return { ts, pid, status, health, ageMs };
 }
 
 /**
@@ -576,41 +437,32 @@ export function parseTmuxListPanes(
   return { pid, command, dead, idleSeconds };
 }
 
-/**
- * Maps each known runtime to the set of acceptable pane commands.
- * A pane running any of these commands for the given runtime is NOT considered drifted.
- * Runtimes launched via `mosaic yolo` wrap in node, so 'node' is acceptable for most.
- * The dogfood runtime accepts python3/python (the canary-pi dogfood stub).
- */
-export const RUNTIME_ACCEPTABLE_COMMANDS: Record<string, readonly string[]> = {
-  claude: ['claude', 'node'],
-  codex: ['codex', 'node'],
-  opencode: ['opencode', 'node'],
-  pi: ['pi', 'node'],
-  dogfood: ['python3', 'python'],
-};
-
 /**
  * Determine if there is a runtime drift: roster says one runtime but the pane
  * is actually running something from a different runtime. We detect this by
- * checking if the pane command doesn't match a known acceptable command for the
+ * checking if the pane command doesn't match a known canonical command for the
  * roster's declared runtime.
  *
- * Known acceptable commands per runtime (see RUNTIME_ACCEPTABLE_COMMANDS):
- *   claude   → claude, node  (node covers mosaic yolo wrapper)
- *   codex    → codex, node
- *   opencode → opencode, node
- *   pi       → pi, node      (python3 still flags drift for canary-pi dogfood stub)
- *   dogfood  → python3, python
+ * Known canonical commands per runtime:
+ *   claude → claude
+ *   codex  → codex
+ *   opencode → opencode
+ *   pi     → pi
  *
  * If the pane is running something else (e.g., python3/dogfood-agent.py) for
  * an agent whose roster runtime is "pi", that's a drift.
  */
 export function detectDrift(rosterRuntime: string, paneCommand: string | null): boolean {
   if (!paneCommand) return false;
-  const acceptable = RUNTIME_ACCEPTABLE_COMMANDS[rosterRuntime];
-  if (!acceptable) return false;
-  return !acceptable.includes(paneCommand);
+  const knownCommands: Record<string, string[]> = {
+    claude: ['claude'],
+    codex: ['codex'],
+    opencode: ['opencode'],
+    pi: ['pi'],
+  };
+  const expected = knownCommands[rosterRuntime];
+  if (!expected) return false;
+  return !expected.includes(paneCommand);
 }
 
 /**
@@ -827,42 +679,19 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
   cmd
     .command('init')
     .description('Initialize a local fleet roster')
-    .option(
-      '--profile <name>',
-      `Roster profile: ${FLEET_PROFILES.join(', ')} (skips interactive wizard)`,
-    )
+    .option('--profile <name>', 'Roster profile: minimal or local-canary', 'minimal')
     .option('--write', 'Write the roster to Mosaic home')
     .option('--force', 'Overwrite an existing roster when used with --write')
-    .action(async (opts: { profile?: string; write?: boolean; force?: boolean }) => {
+    .action(async (opts: { profile: string; write?: boolean; force?: boolean }) => {
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-
-      let profile: FleetProfile;
-      if (opts.profile !== undefined) {
-        // Explicit --profile flag: validate and use it (non-interactive path).
-        profile = parseInitProfile(opts.profile);
-      } else {
-        // No --profile: use wizard when stdin is a TTY, else default to 'general'.
-        const isTTY = deps.isStdinTTY ?? process.stdin.isTTY ?? false;
-        if (isTTY) {
-          profile = await promptFleetProfile();
-        } else {
-          process.stderr.write(
-            'Note: stdin is not a TTY; defaulting to fleet profile "general". ' +
-              'Use --profile <name> to select a different preset.\n',
-          );
-          profile = 'general';
-        }
-      }
-
-      const source = join(frameworkRoot, 'fleet', 'examples', resolvePresetFilename(profile));
+      const profile = parseInitProfile(opts.profile);
+      const source = join(frameworkRoot, 'fleet', 'examples', `${profile}.yaml`);
       const content = await readFile(source, 'utf8');
-
       if (!opts.write) {
         console.log(content.trimEnd());
         return;
       }
-
       const destination = commandOpts.roster ?? activePaths.rosterPath;
       if (!opts.force && (await canRead(destination))) {
         throw new Error(
@@ -871,44 +700,18 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
       }
       await mkdir(dirname(destination), { recursive: true });
       await writeFile(destination, content);
-
-      // Validate: exactly one orchestrator required (R5) — friendly summary on success.
-      const written = await loadFleetRoster(destination);
-      const orchCount = countOrchestrators(written);
-      if (orchCount !== 1) {
-        process.stderr.write(
-          `Warning: fleet roster at ${destination} has ${orchCount} orchestrator agent(s) (expected exactly 1).\n`,
-        );
-        console.log(
-          `Initialized ${profile} fleet: ${written.agents.length} agent(s). Next: mosaic fleet install`,
-        );
-      } else {
-        const workerCount = written.agents.length - 1;
-        console.log(
-          `Initialized ${profile} fleet: 1 orchestrator + ${workerCount} agent(s). Next: mosaic fleet install`,
-        );
-      }
+      console.log(`Wrote fleet roster: ${destination}`);
     });
 
   cmd
     .command('install')
     .description('Install local fleet tools and user systemd units')
-    .option('--no-enable', 'Skip enabling units for boot-survival')
-    .action(async (opts: { enable?: boolean }) => {
-      await installFleet(cmd, frameworkRoot);
-      const roster = await loadRosterForCommand(cmd);
-      await enableFleetUnits(runner, roster, opts);
-    });
+    .action(async () => installFleet(cmd, frameworkRoot));
 
   cmd
     .command('install-systemd')
     .description('Install local fleet tools and user systemd units')
-    .option('--no-enable', 'Skip enabling units for boot-survival')
-    .action(async (opts: { enable?: boolean }) => {
-      await installFleet(cmd, frameworkRoot);
-      const roster = await loadRosterForCommand(cmd);
-      await enableFleetUnits(runner, roster, opts);
-    });
+    .action(async () => installFleet(cmd, frameworkRoot));
 
   for (const action of ['start', 'stop', 'restart'] as const) {
     cmd
@@ -988,9 +791,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
 
   cmd
     .command('ps')
-    .description(
-      'Show real-time status for all roster agents and unmanaged socket sessions (systemd + tmux + heartbeat)',
-    )
+    .description('Show real-time status for all roster agents (systemd + tmux + heartbeat)')
     .option('--json', 'Print JSON array')
     .action(async (opts: { json?: boolean }) => {
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
@@ -1001,9 +802,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
 
       const rows: AgentPsRow[] = [];
 
-      // Build the set of roster agent names for quick lookup when filtering socket sessions.
-      const rosterAgentNames = new Set(roster.agents.map((a) => a.name));
-
       for (const agent of roster.agents) {
         // systemd show
         const showResult = await runner(...splitCommand(buildSystemdShowCommand(agent.name)));
@@ -1044,75 +842,9 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
           heartbeat: hb,
           driftFlag,
           bootEnableWarning,
-          managed: true,
-          source: 'roster',
         });
       }
 
-      // Enumerate all live sessions on the socket to surface unmanaged (ad-hoc) sessions.
-      // If list-sessions fails (socket not up), silently skip — show roster rows only.
-      try {
-        const listSessionsResult = await runner(
-          ...splitCommand(buildTmuxListSessionsCommand(roster.tmux.socketName)),
-        );
-        if (listSessionsResult.exitCode === 0) {
-          const socketSessions = parseTmuxListSessions(listSessionsResult.stdout);
-          const holderSession = roster.tmux.holderSession;
-
-          for (const sessionName of socketSessions) {
-            // Skip roster agents (already in rows) and the holder session (infrastructure).
-            if (rosterAgentNames.has(sessionName) || sessionName === holderSession) {
-              continue;
-            }
-
-            // tmux list-panes for pane info
-            const panesResult = await runner(
-              ...splitCommand(buildTmuxListPanesCommand(sessionName, roster.tmux.socketName)),
-            );
-            const paneInfo = parseTmuxListPanes(panesResult.stdout, nowMs);
-
-            // heartbeat — try reading the .hb file using the same path convention
-            const hbFile = heartbeatPath(sessionName, activePaths.mosaicHome);
-            let hbContent: string | null = null;
-            try {
-              hbContent = await readFile(hbFile, 'utf8');
-            } catch {
-              hbContent = null;
-            }
-            const hb = parseHeartbeat(hbContent, nowMs);
-
-            // systemd — check if mosaic-agent@<name>.service exists (usually inactive for ad-hoc)
-            const showResult = await runner(...splitCommand(buildSystemdShowCommand(sessionName)));
-            const sysInfo = parseSystemdShow(showResult.stdout);
-
-            const bootEnableWarning =
-              sysInfo.ActiveState === 'active' && sysInfo.UnitFileState === 'disabled';
-
-            rows.push({
-              name: sessionName,
-              tenant_id,
-              host,
-              // runtime unknown — not in roster
-              runtime: 'unknown',
-              systemdActive: sysInfo.ActiveState,
-              systemdEnabled: sysInfo.UnitFileState,
-              paneAlive: !paneInfo.dead,
-              panePid: paneInfo.pid,
-              paneCommand: paneInfo.command,
-              idleSeconds: paneInfo.idleSeconds,
-              heartbeat: hb,
-              // No roster runtime to compare — drift is not meaningful for unmanaged sessions
-              driftFlag: false,
-              bootEnableWarning,
-              managed: false,
-              source: 'socket',
-            });
-          }
-        }
-      } catch {
-        // list-sessions failed (socket missing or permission error) — show roster rows only
-      }
-
       if (opts.json) {
         console.log(JSON.stringify(rows, null, 2));
         return;
@@ -1129,7 +861,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
         'PID'.padEnd(8),
         'IDLE'.padEnd(8),
         'HB'.padEnd(12),
-        'MODEL'.padEnd(22),
         'FLAGS',
       ].join(' ');
       console.log(header);
@@ -1144,9 +875,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
           row.heartbeat.ageMs !== null
             ? `${Math.round(row.heartbeat.ageMs / 1000)}s/${row.heartbeat.health}`
             : `unknown`;
-        const model = row.heartbeat.model ?? '-';
         const flags: string[] = [];
-        if (!row.managed) flags.push('UNMANAGED');
         if (row.driftFlag) flags.push('DRIFT');
         if (row.bootEnableWarning) flags.push('BOOT-ENABLE');
 
@@ -1161,119 +890,12 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
             pid.padEnd(8),
             idle.padEnd(8),
             hbAge.padEnd(12),
-            model.padEnd(22),
             flags.join(','),
           ].join(' '),
         );
       }
     });
 
-  cmd
-    .command('add <name>')
-    .description('Add a new agent to the fleet roster and optionally start it')
-    .requiredOption('--runtime <runtime>', `Agent runtime (${VALID_FLEET_RUNTIMES.join(', ')})`)
-    .requiredOption('--class <class>', 'Agent class (e.g. worker, orchestrator, canary)')
-    .option('--model <hint>', 'Model hint for the agent')
-    .option('--working-dir <path>', 'Working directory for the agent')
-    .option('--no-start', 'Skip starting the agent after adding')
-    .action(
-      async (
-        name: string,
-        opts: {
-          runtime: string;
-          class: string;
-          model?: string;
-          workingDir?: string;
-          start: boolean;
-        },
-      ) => {
-        if (!VALID_FLEET_RUNTIMES.includes(opts.runtime)) {
-          throw new Error(
-            `Invalid runtime "${opts.runtime}". Valid runtimes: ${VALID_FLEET_RUNTIMES.join(', ')}.`,
-          );
-        }
-        const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
-        const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-        const rosterPath = await resolveRosterPath(commandOpts.mosaicHome, commandOpts.roster);
-        const roster = await loadFleetRoster(rosterPath);
-
-        const newAgent: FleetAgent = {
-          name,
-          runtime: opts.runtime,
-          className: opts.class,
-          ...(opts.workingDir !== undefined && { workingDirectory: opts.workingDir }),
-          ...(opts.model !== undefined && { modelHint: opts.model }),
-        };
-
-        const updatedRoster = addAgentToRoster(roster, newAgent);
-        await writeFile(rosterPath, serializeRosterToYaml(updatedRoster));
-
-        const envPath = join(activePaths.agentEnvDir, `${name}.env`);
-        const existingEnv = (await canRead(envPath)) ? await readFile(envPath, 'utf8') : undefined;
-        await mkdir(activePaths.agentEnvDir, { recursive: true });
-        await writeFile(
-          envPath,
-          mergeAgentEnv(generateAgentEnv(updatedRoster, newAgent), existingEnv),
-        );
-
-        console.log(`Added ${name} (${opts.runtime}/${opts.class}) to the fleet.`);
-
-        if (opts.start !== false) {
-          await runChecked(runner, buildFleetServiceCommand('start', name));
-          console.log(`Started mosaic-agent@${name}.service.`);
-        } else {
-          console.log(`Agent queued (--no-start); run: mosaic fleet start ${name}`);
-        }
-      },
-    );
-
-  cmd
-    .command('remove <name>')
-    .description('Remove an agent from the fleet roster')
-    .option('--keep-files', 'Skip deleting env and heartbeat files')
-    .action(async (name: string, opts: { keepFiles?: boolean }) => {
-      const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
-      const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-      const rosterPath = await resolveRosterPath(commandOpts.mosaicHome, commandOpts.roster);
-      const roster = await loadFleetRoster(rosterPath);
-
-      // Guard: throws if removing leaves 0 orchestrators or agent not in roster
-      const updatedRoster = removeAgentFromRoster(roster, name);
-
-      // Stop agent (non-fatal)
-      try {
-        const stopResult = await runner(...splitCommand(buildFleetServiceCommand('stop', name)));
-        if (stopResult.exitCode !== 0) {
-          process.stderr.write(
-            `Warning: could not stop mosaic-agent@${name}.service: ${stopResult.stderr || stopResult.stdout || 'non-zero exit'}\n`,
-          );
-        }
-      } catch (err) {
-        process.stderr.write(
-          `Warning: stop command failed for ${name}: ${err instanceof Error ? err.message : String(err)}\n`,
-        );
-      }
-
-      // Write updated roster
-      await writeFile(rosterPath, serializeRosterToYaml(updatedRoster));
-
-      // Delete env and heartbeat files (best-effort, non-fatal)
-      if (!opts.keepFiles) {
-        try {
-          await unlink(join(activePaths.agentEnvDir, `${name}.env`));
-        } catch {
-          // best-effort
-        }
-        try {
-          await unlink(heartbeatPath(name, activePaths.mosaicHome));
-        } catch {
-          // best-effort
-        }
-      }
-
-      console.log(`Removed ${name} from the fleet.`);
-    });
-
   return cmd;
 }
 
@@ -1453,19 +1075,15 @@ export function registerFleetAgentCommands(
 
       await runChecked(runner, buildAgentWatchCreateViewerCommand(agent, viewerName, socketName));
 
-      let exitCode = 0;
-      try {
-        const [bin, args] = splitCommand(buildAgentWatchAttachCommand(viewerName, socketName));
-        exitCode = await iRunner(bin, args);
-      } finally {
-        // ALWAYS clean up the viewer session — even if attach threw or the process was
-        // interrupted — so stale grouped *-watch-* sessions never accumulate. Errors here
-        // are intentionally suppressed; the agent session is unaffected.
-        const killResult = await runner(
-          ...splitCommand(buildAgentWatchKillViewerCommand(viewerName, socketName)),
-        );
-        void killResult;
-      }
+      const [bin, args] = splitCommand(buildAgentWatchAttachCommand(viewerName, socketName));
+      const exitCode = await iRunner(bin, args);
+
+      // Best-effort cleanup of the viewer session regardless of how the user detached.
+      // Errors here are intentionally suppressed — the agent session is unaffected.
+      const killResult = await runner(
+        ...splitCommand(buildAgentWatchKillViewerCommand(viewerName, socketName)),
+      );
+      void killResult; // result is intentionally ignored
 
       if (exitCode !== 0) {
         process.exitCode = exitCode;
@@ -1848,195 +1466,11 @@ function splitCommand(command: string[]): [string, string[]] {
   return [bin, args];
 }
 
-/** All supported fleet profile names. */
-export type FleetProfile =
-  | 'general'
-  | 'coding'
-  | 'research'
-  | 'hybrid'
-  | 'minimal'
-  | 'local-canary';
-
-/** The list of all valid fleet profile names, for wizard menus and error messages. */
-export const FLEET_PROFILES: readonly FleetProfile[] = [
-  'general',
-  'coding',
-  'research',
-  'hybrid',
-  'minimal',
-  'local-canary',
-];
-
-/**
- * Maps a fleet profile name to its example YAML filename (without the path).
- * Pure function — testable without I/O.
- */
-export function resolvePresetFilename(profile: FleetProfile): string {
-  return `${profile}.yaml`;
-}
-
-/**
- * Validate and normalise a fleet profile name string.
- * Throws with a clear message on unknown values.
- */
-export function parseInitProfile(profile: string): FleetProfile {
-  if ((FLEET_PROFILES as readonly string[]).includes(profile)) {
-    return profile as FleetProfile;
+function parseInitProfile(profile: string): 'minimal' | 'local-canary' {
+  if (profile === 'minimal' || profile === 'local-canary') {
+    return profile;
   }
-  throw new Error(`Unsupported fleet profile "${profile}". Use: ${FLEET_PROFILES.join(', ')}.`);
-}
-
-/**
- * Count orchestrator agents in a parsed roster.
- * Returns the count; callers assert === 1.
- */
-export function countOrchestrators(roster: FleetRoster): number {
-  return roster.agents.filter((a) => a.className === 'orchestrator').length;
-}
-
-/** Valid runtime identifiers for fleet agents. */
-export const VALID_FLEET_RUNTIMES: readonly string[] = [
-  'pi',
-  'claude',
-  'codex',
-  'opencode',
-  'dogfood',
-];
-
-/**
- * Add a new agent to a fleet roster (immutable — returns a new FleetRoster).
- * Throws on invalid name, duplicate name.
- */
-export function addAgentToRoster(roster: FleetRoster, agent: FleetAgent): FleetRoster {
-  if (!agent.name || !/^[A-Za-z0-9_.-]+$/.test(agent.name)) {
-    throw new Error(`Invalid fleet agent name: ${agent.name || '<empty>'}`);
-  }
-  if (roster.agents.some((a) => a.name === agent.name)) {
-    throw new Error(`Agent "${agent.name}" already exists in the fleet roster.`);
-  }
-  return {
-    ...roster,
-    agents: [...roster.agents, agent],
-  };
-}
-
-/**
- * Remove an agent from a fleet roster (immutable — returns a new FleetRoster).
- * Throws if the agent is not found, or if removal would leave zero orchestrators.
- */
-export function removeAgentFromRoster(roster: FleetRoster, name: string): FleetRoster {
-  const agent = roster.agents.find((a) => a.name === name);
-  if (!agent) {
-    throw new Error(`Agent "${name}" is not in the fleet roster.`);
-  }
-  const remaining = roster.agents.filter((a) => a.name !== name);
-  const remainingOrchCount = remaining.filter((a) => a.className === 'orchestrator').length;
-  if (remainingOrchCount === 0 && agent.className === 'orchestrator') {
-    throw new Error(
-      `Cannot remove agent "${name}": it is the sole orchestrator. Add another orchestrator first (R5).`,
-    );
-  }
-  return {
-    ...roster,
-    agents: remaining,
-  };
-}
-
-/**
- * Serialize a FleetRoster to YAML text (snake_case keys).
- * The output is parseable by loadFleetRoster.
- */
-export function serializeRosterToYaml(roster: FleetRoster): string {
-  const agents = roster.agents.map((agent) => {
-    const raw: Record<string, unknown> = {
-      name: agent.name,
-      runtime: agent.runtime,
-      class: agent.className,
-    };
-    if (agent.workingDirectory !== undefined) {
-      raw['working_directory'] = agent.workingDirectory;
-    }
-    if (agent.modelHint !== undefined) {
-      raw['model_hint'] = agent.modelHint;
-    }
-    if (agent.persistentPersona !== undefined) {
-      raw['persistent_persona'] = agent.persistentPersona;
-    }
-    if (agent.resetBetweenTasks !== undefined) {
-      raw['reset_between_tasks'] = agent.resetBetweenTasks;
-    }
-    if (agent.kickstartTemplate !== undefined) {
-      raw['kickstart_template'] = agent.kickstartTemplate;
-    }
-    return raw;
-  });
-
-  const runtimes: Record<string, { reset_command: string }> = {};
-  for (const [runtime, config] of Object.entries(roster.runtimes)) {
-    runtimes[runtime] = { reset_command: config.resetCommand };
-  }
-
-  const raw: Record<string, unknown> = {
-    version: roster.version,
-    transport: roster.transport,
-    tmux: {
-      socket_name: roster.tmux.socketName,
-      holder_session: roster.tmux.holderSession,
-    },
-    defaults: {
-      working_directory: roster.defaults.workingDirectory,
-    },
-    runtimes,
-    agents,
-  };
-
-  return YAML.stringify(raw);
-}
-
-/**
- * Prompt interactively for a fleet profile via stdin readline.
- * AI-free: no LLM calls — pure readline menu.
- * Resolves with the chosen profile string, or rejects on I/O error.
- */
-function promptFleetProfile(): Promise<FleetProfile> {
-  return new Promise((resolve, reject) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const menu = [
-      '',
-      'Choose a fleet configuration type:',
-      '  1) general      — orchestrator + generalist worker',
-      '  2) coding       — orchestrator + coder0 + coder1 + reviewer',
-      '  3) research     — orchestrator + researcher0 + researcher1 + analyst',
-      '  4) hybrid       — orchestrator + coder0 + researcher0 + reviewer',
-      '  5) minimal      — single canary-pi agent (no orchestrator)',
-      '  6) local-canary — legacy canary preset with lead + coder + reviewer',
-      '',
-    ].join('\n');
-    process.stdout.write(menu);
-    rl.question('Enter number or name [1]: ', (answer) => {
-      rl.close();
-      const trimmed = answer.trim();
-      // Map numeric shortcut → name
-      const byNumber: Record<string, FleetProfile> = {
-        '1': 'general',
-        '2': 'coding',
-        '3': 'research',
-        '4': 'hybrid',
-        '5': 'minimal',
-        '6': 'local-canary',
-        '': 'general', // default on empty enter
-      };
-      if (trimmed in byNumber) {
-        resolve(byNumber[trimmed]!);
-        return;
-      }
-      try {
-        resolve(parseInitProfile(trimmed));
-      } catch (err) {
-        reject(err);
-      }
-    });
-  });
+  throw new Error(`Unsupported fleet profile "${profile}". Use: minimal, local-canary.`);
 }
 
 function writeCommandOutput(result: CommandResult): void {

packages/mosaic/src/commands/launch.ts

@@ -291,23 +291,12 @@ function buildPrdBlock(): string {
 
 // ─── Runtime prompt builder ──────────────────────────────────────────────────
 
-/**
- * Compose the full runtime contract for a harness: the resident-by-value core
- * (CONSTITUTION + AGENTS + USER + TOOLS + runtime) plus operator overlays
- * (`*.local.md` deltas), merged in precedence order so the model gets one
- * pre-merged blob (DESIGN §3.2 / R7). Overlays are injected as deltas by value;
- * base files keep their existing residency (USER injected; SOUL/STANDARDS are
- * load-on-demand, so only their small `.local` deltas are injected here).
- *
- * `mosaicHome` is parameterized for testability; production callers use the
- * module-level default.
- */
-export function composeContract(runtime: RuntimeName, mosaicHome: string = MOSAIC_HOME): string {
+function buildRuntimePrompt(runtime: RuntimeName): string {
   const runtimeContractPaths: Record<RuntimeName, string> = {
-    claude: join(mosaicHome, 'runtime', 'claude', 'RUNTIME.md'),
-    codex: join(mosaicHome, 'runtime', 'codex', 'RUNTIME.md'),
-    opencode: join(mosaicHome, 'runtime', 'opencode', 'RUNTIME.md'),
-    pi: join(mosaicHome, 'runtime', 'pi', 'RUNTIME.md'),
+    claude: join(MOSAIC_HOME, 'runtime', 'claude', 'RUNTIME.md'),
+    codex: join(MOSAIC_HOME, 'runtime', 'codex', 'RUNTIME.md'),
+    opencode: join(MOSAIC_HOME, 'runtime', 'opencode', 'RUNTIME.md'),
+    pi: join(MOSAIC_HOME, 'runtime', 'pi', 'RUNTIME.md'),
   };
 
   const runtimeFile = runtimeContractPaths[runtime];
@@ -342,55 +331,27 @@ For required push/merge/issue-close/release actions, execute without routine con
 `);
 
   // CONSTITUTION.md (L0 — the non-negotiable law; lead with it). Tolerant of
-  // pre-constitution installs that have not been re-seeded yet. Injected by
-  // value verbatim so the bare-launch fallback read is byte-equal (R8).
-  const constitution = readOptional(join(mosaicHome, 'CONSTITUTION.md'));
+  // pre-constitution installs that have not been re-seeded yet.
+  const constitution = readOptional(join(MOSAIC_HOME, 'CONSTITUTION.md'));
   if (constitution) parts.push(constitution);
 
   // AGENTS.md
-  parts.push(readFileSync(join(mosaicHome, 'AGENTS.md'), 'utf-8'));
+  parts.push(readFileSync(join(MOSAIC_HOME, 'AGENTS.md'), 'utf-8'));
 
-  // USER.md (+ USER.local.md operator overlay, appended directly under the
-  // profile its base owns).
-  const user = readOptional(join(mosaicHome, 'USER.md'));
+  // USER.md
+  const user = readOptional(join(MOSAIC_HOME, 'USER.md'));
   if (user) parts.push('\n\n# User Profile\n\n' + user);
-  const userLocal = readOptional(join(mosaicHome, 'USER.local.md'));
-  if (userLocal.trim()) {
-    parts.push('\n\n## Operator Overlay (USER.local.md)\n\n' + userLocal);
-  }
 
   // TOOLS.md
-  const tools = readOptional(join(mosaicHome, 'TOOLS.md'));
+  const tools = readOptional(join(MOSAIC_HOME, 'TOOLS.md'));
   if (tools) parts.push('\n\n# Machine Tools\n\n' + tools);
 
-  // Operator overlays whose base layers are load-on-demand (SOUL, STANDARDS):
-  // inject only the small `.local` delta by value so the customization reaches
-  // the model without re-injecting the full base prose (preserves the byte
-  // budget). Absent `.local` files → base-only, automatically (R7 §3.2).
-  const overlayBlocks: string[] = [];
-  const soulLocal = readOptional(join(mosaicHome, 'SOUL.local.md'));
-  if (soulLocal.trim()) {
-    overlayBlocks.push('## Persona Overlay (SOUL.local.md)\n\n' + soulLocal.trim());
-  }
-  const standardsLocal = readOptional(join(mosaicHome, 'STANDARDS.local.md'));
-  if (standardsLocal.trim()) {
-    overlayBlocks.push('## Standards Overlay (STANDARDS.local.md)\n\n' + standardsLocal.trim());
-  }
-  if (overlayBlocks.length > 0) {
-    parts.push('\n\n# Operator Overlays\n\n' + overlayBlocks.join('\n\n'));
-  }
-
   // Runtime-specific contract
   parts.push('\n\n# Runtime-Specific Contract\n\n' + readFileSync(runtimeFile, 'utf-8'));
 
   return parts.join('\n');
 }
 
-/** @deprecated internal alias — use composeContract. Retained for call-site clarity. */
-function buildRuntimePrompt(runtime: RuntimeName): string {
-  return composeContract(runtime);
-}
-
 // ─── Session lock ────────────────────────────────────────────────────────────
 
 function writeSessionLock(runtime: string): void {
@@ -1015,22 +976,6 @@ export function registerLaunchCommands(program: Command): void {
     launchRuntime(runtime, extraArgs, yolo);
   });
 
-  // compose-contract — emit the composed runtime contract (base + operator
-  // overlays) for a harness to stdout, without launching. For inspection,
-  // `mosaic doctor`, diffing, and the composer test (R7).
-  program
-    .command('compose-contract <harness>')
-    .description('Print the composed runtime contract (base + *.local overlays) for a harness')
-    .action((harness: string) => {
-      const valid: RuntimeName[] = ['claude', 'codex', 'opencode', 'pi'];
-      if (!valid.includes(harness as RuntimeName)) {
-        console.error(`Unknown harness '${harness}'. Expected one of: ${valid.join(', ')}.`);
-        process.exitCode = 64;
-        return;
-      }
-      process.stdout.write(composeContract(harness as RuntimeName));
-    });
-
   // Coord (mission orchestrator)
   program
     .command('coord')

packages/mosaic/src/config/file-adapter.ts

@@ -198,10 +198,8 @@ export class FileConfigAdapter implements ConfigService {
         const src = join(defaultsDir, entry);
         const dest = join(this.mosaicHome, entry);
         if (!existsSync(src) || !statSync(src).isFile()) continue;
-        // Already current — skip to avoid mtime churn.
-        if (existsSync(dest) && readFileSync(src).equals(readFileSync(dest))) continue;
         const bak = `${dest}.pre-constitution.bak`;
-        if (existsSync(dest) && !existsSync(bak)) {
+        if (existsSync(dest) && !readFileSync(src).equals(readFileSync(dest)) && !existsSync(bak)) {
           copyFileSync(dest, bak);
         }
         copyFileSync(src, dest);