fix(#1264 ): preserve portable standalone launch

fix(#1264 ): harden unattended identity bootstrap
fix(#1264 ): bootstrap fleet identity without a TTY
2026-08-16 19:01:26 -05:00 · 2026-08-16 18:33:39 -05:00 · 2026-08-16 17:37:32 -05:00
36 changed files with 1579 additions and 1592 deletions
@@ -9,19 +9,19 @@ This book is the canonical home for installation, configuration, deployment, rou
 - [Documentation atlas](../README.md) — placement rules and source-of-truth boundaries.
 - [Documentation sitemap](../SITEMAP.md) — resolvable current navigation and authority-gated migration summary.
 - [Product requirements](../PRD.md) — normative requirements, currently marked draft.
- [Operations index](operations/README.md) — current local procedures and explicitly held operational outlines.
+- [Operations index](operations/README.md) — current local procedures, unattended fleet first-start handling, and explicitly held operational outlines.
 - [Security index](security/README.md) — current SSO provider configuration.

 ## Chapter map

-| Chapter                               | Scope                                                               | Status                                                                  |
-| ------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------- |
-| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                          |
-| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                          |
-| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                          |
-| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery is current; connector lease operations are held. |
-| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                 |
-| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                          |
+| Chapter                               | Scope                                                               | Status                                                                                         |
+| ------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                                                 |
+| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                                                 |
+| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                                                 |
+| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery and fleet first start are current; connector lease operations are held. |
+| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                                        |
+| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                                                 |

 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.

@@ -5,6 +5,7 @@
 ## Current procedures

 - [Upgrade safety and recovery](upgrade-safety-and-recovery.md) — installed-CLI and local-PGlite upgrade, rollback, and framework-configuration recovery.
+- [Fleet unattended first start](fleet-unattended-first-start.md) — systemd/no-TTY identity initialization, failure handling, and isolated verification.

 ## Held procedures

@@ -0,0 +1,70 @@
+# Fleet Unattended First-Start Operations
+
+> **Status:** Current after issue #1264 lands. This runbook covers only Mosaic's first-run identity
+> gate; it does not install runtimes or credentials.
+
+## Operational contract
+
+A systemd fleet unit launches under a sanitized environment with no TTY. The generated environment
+sets `MOSAIC_AGENT_NAME`; Mosaic resolves that exact value against the canonical installed roster
+before writing identity files.
+
+If top-level identity contracts are missing, Mosaic atomically seeds them from the shipped generic
+sources:
+
+| Destination            | Source                          | New-file mode |
+| ---------------------- | ------------------------------- | ------------- |
+| `$MOSAIC_HOME/SOUL.md` | `$MOSAIC_HOME/defaults/SOUL.md` | `0600`        |
+| `$MOSAIC_HOME/USER.md` | `$MOSAIC_HOME/defaults/USER.md` | `0600`        |
+
+Creation is no-clobber and safe under concurrent seat starts. Existing regular files remain
+byte-for-byte and mode-for-mode unchanged. The runtime composer then injects the exact roster name
+and class; the generic source files grant no seat authority.
+
+## Failure handling
+
+The fleet path never falls back to an interactive wizard. It exits nonzero before runtime execution
+when:
+
+- `MOSAIC_AGENT_NAME` is not an exact roster member;
+- a defined ambient `MOSAIC_AGENT_CLASS` is blank/whitespace or disagrees with that member's
+  canonical class;
+- a missing destination has no safe regular default source;
+- a source or existing destination is a symlink (including dangling), directory, unavailable, or over the bounded size;
+- the fleet communications helper/roster cannot be validated; or
+- `USER.md` cannot be securely re-read at the point where its content is composed.
+
+Diagnostics begin with:
+
+```text
+[mosaic] ERROR: unattended fleet identity initialization failed: ...
+```
+
+Repair the exact named source, destination, roster, or helper and retry only that roster member. Do
+not delete or replace an existing personalized `SOUL.md`/`USER.md` merely to clear the check.
+
+## Verification without a live seat
+
+The source gate is:
+
+```bash
+pnpm --filter @mosaicstack/mosaic... build && \
+  pnpm --filter @mosaicstack/mosaic exec vitest run \
+    src/commands/launch-first-start.spec.ts
+```
+
+The build leg is load-bearing: `dist/` is ignored, so a direct Vitest invocation could otherwise run
+absent or stale CLI output. The gate runs the exact-source built CLI in subprocesses with piped stdin,
+temporary homes, a canonical fixture roster, fake runtime/broker executables, and no provider call. It
+covers no-TTY launch, exact identity,
+private modes, no-clobber, missing/symlink defaults, unknown members, blank/mismatched class,
+portable standalone composition/wizard preservation, and concurrent first start.
+
+Do not use this fixture as proof that a real provider credential is present or that a package has
+been deployed. Those require separate environment-specific evidence.
+
+## Related
+
+- [User workflow](../../USER-GUIDE/workflows/fleet-unattended-first-start.md)
+- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
+- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)
@@ -26,6 +26,7 @@ This book is the canonical home for architecture, package and application guides

 - [Lease-broker operations and verification](testing/lease-broker-operations.md) — safe static/test commands plus explicitly held live operations.
 - [Channel adapters](integrations/channel-adapters.md) — current shared contracts and Discord reference boundary; future adapter parity is draft.
+- [Fleet first-start identity](architecture/fleet-first-start-identity.md) — no-TTY launch boundary, roster authority, and no-clobber filesystem design.

 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.

@@ -11,6 +11,7 @@ This chapter is the canonical home for Mosaic Stack's system model, component bo
 - [`mutator-class-gate.md`](mutator-class-gate.md) — default-deny tool authorization, runtime adapters, launch choke point, and parser assurance boundary.
 - [`compaction-revocation.md`](compaction-revocation.md) — Claude/Pi observer lifecycle, runtime generations, revocation, and the bounded residual stale window.
 - [`channel-protocol.md`](channel-protocol.md) — current shared channel DTOs and Discord compatibility baseline, with unimplemented adapter work explicitly marked draft.
+- [`fleet-first-start-identity.md`](fleet-first-start-identity.md) — roster-owned identity bootstrap for concurrent no-TTY fleet launches.
 - [`decisions/mos-runtime-portability-m1.md`](decisions/mos-runtime-portability-m1.md) — current logical identity, connector lease, grant, audit, and fencing decision; connector activation remains held.

 These pages are current security-contract references and are consumed by the lease-broker acceptance suites. Their live deployment gaps remain explicitly labeled in the pages; this migration does not change runtime behavior.
@@ -0,0 +1,81 @@
+# Fleet First-Start Identity Boundary
+
+> **Status:** Implemented by issue #1264. Requirements: `FCM-REQ-12`, `AC-FCM-10`.
+
+## Problem
+
+`launchRuntime()` called `checkSoul()` before runtime execution. A missing top-level `SOUL.md`
+caused `checkSoul()` to spawn a child `mosaic wizard` with inherited stdio. Under a systemd-created
+fleet pane with no TTY, that child blocked or failed before the runtime boundary even though generic
+`defaults/SOUL.md` and `defaults/USER.md` already shipped in the same `MOSAIC_HOME`.
+
+## Chosen boundary
+
+The fix remains at `checkSoul()` and does not add flags to `yolo`, fleet commands, systemd units, or
+`start-agent-session.sh`:
+
+1. A present, nonblank, whitespace-exact `MOSAIC_AGENT_NAME` selects the fleet path.
+2. `resolveFleetIdentity()` must resolve that exact member through the existing roster/helper
+   boundary, and any defined `MOSAIC_AGENT_CLASS` (including blank/whitespace) must canonicalize to
+   the roster class, before any identity seed. Only undefined means absent.
+3. `lstatSync()` preflights every destination directory entry without following links, so a dangling
+   link is rejected before its counterpart can be published.
+4. Safe bounded snapshots are read from only the missing contracts under `defaults/`.
+5. Each snapshot is written to a random owner-private temporary file in `MOSAIC_HOME`.
+6. `linkSync()` publishes the complete file without overwriting an existing path. `EEXIST` means a
+   concurrent seat or operator won; the existing path is preserved and revalidated.
+7. Temporary files are removed, and both installed contracts are re-opened through the no-symlink
+   secure-file reader before launch continues.
+8. `composeContract()` independently re-resolves the roster, securely reads fleet `USER.md` through
+   a Linux descriptor at the point of use, and injects exact member identity and communications data.
+
+A standalone launch with no `MOSAIC_AGENT_NAME` retains the portable tolerant USER read and the
+interactive wizard. Fleet-only no-follow enforcement must not make supported standalone macOS
+composition depend on Linux `/proc` descriptor traversal.
+
+## Identity and authority
+
+The copied defaults deliberately say “Mosaic agent”; they are a generic behavioral base. They are
+not the source of a fleet seat's identity. The canonical roster controls:
+
+- exact agent/session name;
+- canonical role/class and persona;
+- peer rows and point of contact;
+- tmux socket and helper target; and
+- communications generation.
+
+An unknown/padded ambient name, mismatched class, or explicitly blank/whitespace class fails before
+any file is seeded. This avoids replacing the interactive wall with a fleet of indistinguishable or
+ambiently invented identities.
+
+## Concurrency and filesystem properties
+
+- Sources and final destinations are bounded regular files beneath `MOSAIC_HOME`; target and dangling
+  symlinks are not followed.
+- New files have mode `0600`.
+- Hard-link publication is same-filesystem, atomic, and no-clobber.
+- A temporary path is removed only when this process successfully created it.
+- All required source snapshots are validated before the first destination is published, preventing
+  a missing second default from leaving a partial seed.
+- Existing operator files are never chmodded or rewritten.
+
+## Verification
+
+`src/commands/launch-first-start.spec.ts` uses the production-kind boundary: the real built CLI in a
+no-TTY subprocess, not a direct wizard test. The package `test:vitest` gate builds Mosaic before
+Vitest, while the clean-checkout command builds its workspace dependencies first, so ignored
+`dist/cli.js` cannot be absent or stale. A fake lease launcher records whether execution reached the
+runtime boundary and captures the composed prompt.
+Positive and negative cases prove the check can both proceed and refuse. Fleet composition coverage
+replaces a previously validated `USER.md` with an external symlink and proves point-of-use refusal;
+a standalone unreadable-optional-USER case proves the portable tolerant branch remains separate.
+
+Real Pi authentication and provider task execution remain environment tests, not claims of this
+fixture.
+
+## Non-goals
+
+- Runtime installation or pane-PATH resolution (#1256/#1258).
+- The held `~/.mosaic` launch-composition layer in PR #1213.
+- Personalizing the operator's standalone identity without a wizard.
+- Changing fleet systemd or shell launcher code.
@@ -146,6 +146,29 @@ lands. M0 consists only of these normative requirements, the complete task DAG,
 documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
 are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.

+### Unattended fleet first-start amendment (#1264)
+
+`FCM-REQ-11` is reserved by #1256's concurrent runtime-preflight delivery. This amendment therefore
+uses the next non-colliding identifiers.
+
+1. `FCM-REQ-12`: A roster-owned fleet launch SHALL NOT invoke an interactive identity wizard when
+   top-level `SOUL.md` or `USER.md` is absent. It SHALL initialize only missing top-level identity
+   contracts from the shipped generic `defaults/` contracts without overwriting operator-owned
+   bytes. The canonical roster member remains the sole source of the seat's exact name and class;
+   generic defaults grant no fleet identity or authority. Missing or unsafe defaults SHALL fail
+   closed with actionable diagnostics before runtime execution. Non-fleet launches retain the
+   interactive identity flow.
+2. `AC-FCM-10`: A systemd-equivalent no-TTY test with a clean temporary Mosaic home SHALL prove a
+   named fleet seat reaches the runtime boundary without starting `mosaic wizard`, creates
+   byte-equal owner-private `SOUL.md` and `USER.md` seeds, and receives its exact roster name/class in
+   composed context. Tests SHALL also prove no-clobber behavior, concurrent/idempotent first start,
+   fail-closed invalid defaults, and preservation of the standalone interactive path.
+
+`ASSUMPTION:` `MOSAIC_AGENT_NAME` is the existing launch discriminator for roster-owned fleet
+processes. This amendment does not add a second fleet flag because generated fleet environments
+already set that value and the runtime composer independently resolves it against the canonical
+roster before execution.
+
 ---

 ## Exact Cross-Harness Fleet Communications Contract (#766)
@@ -38,11 +38,13 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Quickstart](USER-GUIDE/getting-started/quickstart.md) — installed-CLI first-use route with local PGlite safety boundaries.
 - [Web dashboard](USER-GUIDE/product/web-dashboard.md) — current routes, views, chat persistence, settings, and admin behavior.
 - [Discord conversations](USER-GUIDE/workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
+- [Fleet unattended first start](USER-GUIDE/workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap and exact roster identity.

 ## Administrator documentation

 - [Administrator operations](ADMIN-GUIDE/operations/README.md) — current local procedures and explicitly held outlines.
 - [Upgrade safety and recovery](ADMIN-GUIDE/operations/upgrade-safety-and-recovery.md) — installed-CLI/local-PGlite upgrade and framework recovery.
+- [Fleet unattended first-start operations](ADMIN-GUIDE/operations/fleet-unattended-first-start.md) — systemd identity initialization, refusal paths, and isolated verification.
 - [Mos connector lease operations](ADMIN-GUIDE/operations/mos-connector-lease-operations.md) — held/non-operative M1 outline while policy remains deny-all.
 - [Administrator security](ADMIN-GUIDE/security/README.md) — current security chapter index.
 - [SSO providers](ADMIN-GUIDE/security/sso-providers.md) — Authentik, WorkOS, and Keycloak configuration and discovery.
@@ -56,6 +58,7 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Lease-broker security](DEVELOPER-GUIDE/architecture/lease-broker-security.md) — identity, ancestry, filesystem, observer, and residual boundaries.
 - [Whole mutator-class gate](DEVELOPER-GUIDE/architecture/mutator-class-gate.md) — default-deny tool authorization and launch choke point.
 - [Compaction revocation](DEVELOPER-GUIDE/architecture/compaction-revocation.md) — lifecycle observers, generation fencing, and residual stale window.
+- [Fleet first-start identity](DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md) — roster authority and atomic no-clobber identity seeding.
 - [Architecture decisions](DEVELOPER-GUIDE/architecture/decisions/README.md) — implemented and accepted boundaries.
 - [Mos runtime portability M1](DEVELOPER-GUIDE/architecture/decisions/mos-runtime-portability-m1.md) — logical identity, connector lease, grants, audit, and fencing.
 - [Architecture RFCs](DEVELOPER-GUIDE/architecture/rfcs/README.md) — draft proposals without operational authority.
@@ -75,6 +78,7 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Archived planning](archive/planning/README.md) — historical briefs, board reviews, and work-package specifications.
 - [Archived work records](archive/work-records/README.md) — historical task scratchpads without live consumers.
 - [P8-003 performance report](reports/qa/p8-003-performance-optimization.md) — historical implementation evidence, not a current SLO.
+- [Issue #1264 unattended fleet first-start verification](reports/qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence and explicit untested bounds.
 - [Plans index](plans/README.md) — approved intent and implementation/audit plans.
 - [Documentation information-architecture design](plans/2026-08-10-docs-information-architecture-design.md) — approved documentation structure decision.
 - [Documentation catalog-audit plan](plans/2026-08-10-docs-catalog-audit.md) — evidence method and migration acceptance criteria.
@@ -11,6 +11,7 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — install Mosaic, complete setup, and launch a session.
 - [Web dashboard](product/web-dashboard.md) — current routes, navigation, chat persistence, projects/tasks views, settings, and admin behavior.
 - [Discord conversations](workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
+- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap, exact roster identity, and separate runtime prerequisites.

 ## Chapter map

@@ -18,7 +19,7 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 | ------------------ | ------------------------------------------------------------- | ---------------------------------------------------- |
 | `getting-started/` | First-use setup, orientation, and quickstarts.                | Quickstart is current; additional pages are planned. |
 | `concepts/`        | User-facing terminology, product concepts, and mental models. | Scaffold only.                                       |
-| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord conversation workflow is current.            |
+| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord and fleet first-start workflows are current. |
 | `product/`         | Current product surfaces and visible behavior.                | Web dashboard reference is current.                  |
 | `troubleshooting/` | User-visible failures, diagnostics, and fixes.                | Scaffold only.                                       |

@@ -27,6 +28,7 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — the verified installed-CLI first-use path.
 - [Web dashboard](product/web-dashboard.md) — verified current Next.js dashboard behavior and limitations.
 - [Discord conversations](workflows/discord-conversations.md) — verified current Discord user workflow.
+- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — verified no-TTY first-start behavior and prerequisite boundaries.

 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.

@@ -0,0 +1,61 @@
+# Fleet Unattended First Start
+
+> **Status:** Current for roster-owned local fleet launches after issue #1264 lands. Runtime
+> installation and provider authentication remain separate prerequisites.
+
+A fleet seat started by systemd has no operator at its pane. On its first launch, Mosaic must not
+stop at the interactive identity wizard.
+
+## What happens on first start
+
+When `MOSAIC_AGENT_NAME` names an exact member of the installed fleet roster and top-level identity
+contracts are absent, the launcher:
+
+1. validates the exact roster member, its canonical class, and the installed fleet communications
+   helper;
+2. reads the shipped generic contracts from
+   `~/.config/mosaic/defaults/SOUL.md` and `defaults/USER.md`;
+3. creates only the missing top-level `SOUL.md` and `USER.md` as owner-private files;
+4. preserves any existing top-level identity file byte-for-byte; and
+5. launches the runtime with the roster member's exact agent/session name and role/class in composed
+   context.
+
+The generic defaults do **not** make every seat the same identity. They provide a shared behavioral
+base. The canonical roster row supplies each seat's exact name, class, peers, socket, and authority.
+
+## Operator behavior
+
+A normal standalone launch without a fleet identity retains its portable configuration path and still
+uses the interactive wizard when `SOUL.md` is absent:
+
+```bash
+mosaic pi
+```
+
+A roster-owned seat may be started without attaching to its pane:
+
+```bash
+mosaic fleet start <exact-roster-name>
+```
+
+Mosaic refuses before runtime execution if the requested member is absent, its explicitly supplied
+ambient class is blank or conflicts with the roster, a required default is missing or unsafe, or an existing identity contract
+is not a safe regular file. Repair the named component and retry the same exact roster member; do not
+copy another seat's personalized identity.
+
+## Separate prerequisites
+
+This behavior clears the Mosaic identity-wizard wall only. A clean host still needs:
+
+- the declared runtime installed on the pane PATH;
+- the fleet transport and generated unit assets; and
+- runtime/provider authentication appropriate to that seat.
+
+Those checks are separate so a successful identity bootstrap is not reported as a fully authenticated
+agent session.
+
+## Related
+
+- [Administrator runbook](../../ADMIN-GUIDE/operations/fleet-unattended-first-start.md)
+- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
+- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)
@@ -12,11 +12,13 @@ Use the canonical guide, API contract, source, and tests to determine current be
 - [Issue #756 documentation checklist](documentation/756-discord-plugin-checklist.md) — historical completion checklist for the official Discord plugin workstream.
 - [Framework consistency audit — 2026-02-17](documentation/AUDIT-2026-02-17-framework-consistency.md) — historical framework consistency and remediation snapshot.
 - [Compaction-refresh #830 checklist](compaction-refresh/830-documentation-checklist.md) — historical incomplete-at-snapshot documentation checklist.
+- [Issue #1264 documentation checklist](documentation/1264-documentation-checklist.md) — current in-repo user/admin/developer/report coverage and review gate.

 ## Code-review evidence

 - [Issue #756 independent code review](code-review/756-code-review.md) — historical exact-scope review of the official Discord plugin workstream.
 - [Gateway security-hardening code review — 2026-03-13](code-review/gateway-security-20260313.md) — historical no-blocker review snapshot.
+- [Issue #1264 independent code and security review](code-review/1264-code-review.md) — initial finding, remediation, clean re-review, and remaining formal PR-review gate.

 ## Security evidence

@@ -26,6 +28,7 @@ Use the canonical guide, API contract, source, and tests to determine current be

 - [P8-003 performance optimization report](qa/p8-003-performance-optimization.md) — historical implementation evidence; not a current SLO or production benchmark.
 - [Gateway security-hardening QA report — 2026-03-13](qa/gateway-security-20260313.md) — historical test report with its original live-smoke-test limitation.
+- [Issue #1264 unattended fleet first-start verification](qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence, baseline gates, and explicit real-provider limitation.

 ## Native Kanban/SOT evidence

@@ -0,0 +1,97 @@
+# Issue #1264 Code and Security Review
+
+> Branch: `fix/1264-fleet-unattended-first-start` | Base:
+> `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
+
+## Initial automated review
+
+Codex reviewed the pre-PR uncommitted delta with:
+
+```bash
+~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
+  -o /tmp/1264-codex-code-review.json
+```
+
+Result: `request-changes`, confidence `0.93`, 20 files, one should-fix. `checkSoul()` trimmed
+`MOSAIC_AGENT_NAME` for pre-seed resolution while composition used the original value, so a padded
+name could seed files before later refusal.
+
+Remediation rejected blank/leading/trailing-whitespace values before roster lookup or writes and
+added three built-CLI no-side-effect regressions. Automated re-review approved that delta with no
+findings (confidence `0.86`). Initial security review reported risk `none` (confidence `0.91`).
+
+## Formal exact-head review
+
+Daphne reviewed PR #1268 at exact head `43fa0477877e0d0f110da8d11c3033b40ddeb191` and filed Gitea
+review ID 168 as `REQUEST_CHANGES`. The review was source/PR-only; the canary remained untouched.
+
+Blocking groups:
+
+1. class mismatch was validated after first-start mutation;
+2. secure `USER.md` validation was discarded before ordinary path-following composition;
+3. `existsSync()` treated a dangling destination symlink as missing, allowing counterpart partial
+   publication; and
+4. the built-CLI/evidence chain allowed stale ignored `dist/`, cited an unshipped canary object, and
+   carried conflicting test totals/pane wording.
+
+The diagnostic's defaults-only repair advice was also inaccurate for roster/class/destination
+failures.
+
+## Formal-review remediation
+
+All four blocking groups received regressions before production changes. The RED run produced four
+failures while 1,568 existing tests passed. Remediation then:
+
+- validates canonical name and class before seeding;
+- preflights destination directory entries with `lstatSync()` so target and dangling symlinks fail
+  before publication;
+- securely reads `USER.md` through an `O_NOFOLLOW` descriptor at composition time;
+- adds a Mosaic build before package Vitest and a dependency build in the clean-checkout command;
+- replaces defaults-only advice with neutral named-component repair guidance; and
+- reconciles shipping canary provenance, pane chronology, commands, and totals.
+
+Remediation code review:
+
+```bash
+~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
+  -o /tmp/1264-remediation-code-review.json
+```
+
+Result: `approve`, confidence `0.88`, 6 files, no findings. Summary: the fail-closed destination
+checks, class-validation order, secure composition, and build-before-Vitest path are coherent.
+
+Remediation security review:
+
+```bash
+~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted \
+  -o /tmp/1264-remediation-security-review.json
+```
+
+Result: risk `none`, confidence `0.93`, 9 files, no critical/high/medium/low findings. The sandbox
+could not run Vitest because Vite attempted to create a temporary config artifact on its read-only
+mount (`EROFS`); executor-owned focused and full results are recorded in the QA report.
+
+## Second exact-head review
+
+Daphne reviewed exact head `9dc90be7e13b1cd609f6df97d43d890ef5392ca0` and filed Gitea review
+ID 169 as `REQUEST_CHANGES`. Review 169 confirmed all review-168 closures, then found:
+
+1. the new point-of-use reader was Linux-only but had been applied to every standalone USER read,
+   breaking supported non-fleet macOS composition; and
+2. explicit blank/whitespace `MOSAIC_AGENT_CLASS` was treated as absent and could seed before
+   runtime, while only undefined should mean absent.
+
+Red-first remediation preserves legacy `readOptional()` for standalone composition, keeps descriptor
+no-follow consumption fleet-only, moves the replacement-symlink case under a valid fleet identity,
+and rejects defined blank/whitespace classes before seeding. Three blank-class CLI cases and one
+tolerant standalone composition case failed before the source change and pass after it.
+
+Review-169 remediation code review approved at confidence `0.90` (4 files, no findings). Security
+review reported risk `none` at confidence `0.90` (4 files, no findings). The review sandbox retained
+its known Vite `EROFS` limitation; executor-owned tests are in the QA report.
+
+## Remaining review gate
+
+Daphne must re-review the next exact pushed head. This report cannot record that future verdict
+without changing the reviewed head, so the authoritative terminal verdict belongs to PR #1268's
+Gitea review record. Fred and goals are excluded as reviewers.
@@ -0,0 +1,32 @@
+# #1264 Documentation Completion Checklist
+
+## Required artifacts
+
+- [x] `docs/PRD.md` updated with `FCM-REQ-12` and `AC-FCM-10`.
+- [x] User workflow documents unattended fleet first start and separate prerequisites.
+- [x] Administrator operations page documents source/destination ownership, failure handling, and an
+      exact-source build-before-Vitest verification gate.
+- [x] Developer architecture page documents control flow, identity authority, concurrency, and non-goals.
+- [x] `docs/SITEMAP.md` and book indexes updated.
+- [x] QA evidence is under `docs/reports/qa/`; working notes are under `docs/scratchpads/`.
+- [x] Framework defaults README reflects fleet-versus-standalone behavior.
+
+## API coverage
+
+- [x] No HTTP/API endpoint or DTO changed; OpenAPI and endpoint indexes are not applicable.
+
+## Structural standards
+
+- [x] User, administrator, developer, report, and sitemap indexes link the new pages.
+- [x] No noncanonical file was added at the `docs/` root.
+- [x] Canonical documentation remains in-repo; no external publication was requested or performed.
+
+## Review gate
+
+- [x] Initial padded-name finding remediated and automated re-review approved.
+- [x] Daphne formal review ID 168 completed on exact first head `43fa0477` and requested changes.
+- [x] Four review-168 groups reproduced red and remediated; automated reviews are clean.
+- [x] Daphne review ID 169 completed on exact head `9dc90be7` and confirmed review-168 closures.
+- [x] Review-169 standalone-portability and blank-class blockers reproduced red and remediated;
+      automated reviews are clean.
+- [ ] Daphne exact-second-remediation-head re-review completed after push (Fred/goals excluded).
@@ -0,0 +1,220 @@
+# #1264 Unattended Fleet First-Start Verification
+
+> Status: **IN PROGRESS — review-169 remediation complete locally; push/re-review pending** |
+> Executor: goals | Date: 2026-08-16 | Target: isolated local fixtures only
+
+## Objective
+
+Verify that a named fleet seat launched through a systemd-equivalent, no-TTY environment on a clean
+host reaches its runtime boundary without an interactive Mosaic identity wizard. Preserve standalone
+wizard behavior and canonical-roster ownership of exact seat identity.
+
+## Source evidence accepted for local verification
+
+Daphne's canary Run-7 report is reachable from jarvis-brain `origin/main` at
+`8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`,
+`docs/reports/2026-08-16_sbx-canary-greenfield-e2e.md`. The earlier local object
+`6c0b6fc70ae6a179a1b7ff9dedfc54e9adccd19a` is not reachable from an origin ref and is not used as
+shipping provenance. Run 7 measured:
+
+```text
+systemd -> start-agent-session.sh -> mosaic yolo pi (PID 3726)
+                                  -> child mosaic wizard (PID 3762)
+```
+
+The pane was preserved when Run 7 was captured. Formal review ID 168 records that an authorized
+rollback occurred later. This task never accessed or altered the canary VM, pane, snapshot, or
+rollback state. Product behavior is independently tested here with temporary roots and fake runtime
+executables.
+
+## Controls
+
+- Original base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`.
+- PR: #1268, first pushed head `43fa0477877e0d0f110da8d11c3033b40ddeb191`.
+- `DATABASE_URL` remains unset for local tests.
+- No runtime/provider credential or token value, VM, installed Mosaic tree, unit, timer, PATH profile,
+  or live tmux session is read or mutated. Standard Gitea/Woodpecker wrappers authenticate metadata
+  reads/writes without exposing credential values.
+- Tiny's runtime-preflight and `start-agent-session.sh` PATH work remain out of scope.
+- Held PR #1213 is not a dependency.
+
+## Requirements-to-evidence map
+
+| Acceptance criterion                                                   | Method                                                          | Evidence                      |
+| ---------------------------------------------------------------------- | --------------------------------------------------------------- | ----------------------------- |
+| No-TTY fleet first start avoids wizard and reaches runtime             | Exact-source built CLI with piped stdin                         | CLI GREEN                     |
+| Missing top-level identity files are initialized from shipped defaults | Exact-byte and `0600` assertions                                | CLI + filesystem GREEN        |
+| Exact seat identity remains roster-owned                               | Captured argv; mismatched/blank class no-side-effect refusals   | CLI GREEN                     |
+| Existing operator identity is never overwritten                        | Custom bytes/mode with defaults removed                         | CLI + filesystem GREEN        |
+| Concurrent/repeated first start is safe                                | Four parallel CLIs plus repeated launch                         | CLI GREEN                     |
+| Missing/unsafe defaults and destinations fail before partial mutation  | Missing, target/dangling symlink, oversized, invalid-root cases | Filesystem/CLI GREEN          |
+| Validated `USER.md` cannot be replaced by an external symlink          | Seed, replace, compose at point of use                          | Composition GREEN             |
+| Standalone launch retains wizard                                       | Same built CLI without fleet identity                           | CLI GREEN                     |
+| Built-CLI evidence cannot use stale ignored `dist/`                    | Build-with-dependencies gate before Vitest                      | Package script + command gate |
+
+## Initial RED
+
+Production source remained unchanged after adding the first reproducer. The CLI was built from
+`origin/next@476db12` before the test.
+
+```bash
+env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic exec vitest run \
+  src/commands/launch-first-start.spec.ts
+```
+
+Exit `1`; one file and one test failed. Output included:
+
+```text
+[mosaic] SOUL.md not found. Running setup wizard...
+◆  What would you like to do?
+[mosaic] Setup failed. Run: mosaic wizard
+AssertionError: expected 1 to be +0
+```
+
+The fake runtime-boundary capture was not created. Complete stdout/stderr was retained at
+`/tmp/1264-red.out` during that work session.
+
+## Formal-review remediation RED
+
+Daphne's exact-head review ID 168 requested changes at `43fa0477`. Before changing production code,
+new regressions were run against an exact-source build. Four tests failed while the existing 1,568
+passed:
+
+1. valid roster name plus mismatched ambient class seeded both files before refusal;
+2. dangling `SOUL.md` allowed `USER.md` to be published before refusal;
+3. dangling `USER.md` allowed `SOUL.md` to be published before refusal; and
+4. replacing a securely validated `USER.md` with an external symlink was followed by composition.
+
+This establishes that all four review-168 findings were observable on the pushed implementation.
+
+Daphne's review ID 169 then found two more exact-head failures at `9dc90be7`. Before production
+changes, four new assertions failed:
+
+1. standalone composition routed an unreadable optional `USER.md` through the Linux-only descriptor
+   reader instead of the legacy portable tolerant path; and
+2. explicit `MOSAIC_AGENT_CLASS` values `""`, `" "`, and tab were treated as absent, seeded both
+   identity files, and reached runtime.
+
+The replacement-symlink case was also moved under a valid roster identity so it tests the fleet-only
+security boundary rather than standalone behavior.
+
+## Final GREEN
+
+The production-kind command builds Mosaic and all workspace dependencies before invoking Vitest,
+because `dist/` is ignored and may otherwise be absent or stale:
+
+```bash
+env -u DATABASE_URL sh -c '
+  pnpm --filter @mosaicstack/mosaic... build &&
+  pnpm --filter @mosaicstack/mosaic exec vitest run \
+    src/commands/fleet-first-start-identity.spec.ts \
+    src/commands/launch-first-start.spec.ts \
+    src/commands/launch.spec.ts \
+    src/commands/compose-contract.spec.ts \
+    src/config/file-adapter.test.ts \
+    src/cli-smoke.spec.ts
+'
+```
+
+Exit `0`: `6/6` files, `128/128` tests.
+
+- 15 real-CLI/no-TTY tests cover exact roster name/class, byte-equal `0600` seeds, no-clobber,
+  partial seed, missing/symlink defaults, unknown/padded/blank name, mismatched or explicitly blank
+  class, standalone wizard preservation, and four concurrent starts.
+- 12 direct filesystem tests cover complete publication, existing operators, idempotence, source
+  prevalidation, target and dangling destination links, invalid roots, oversized input, and
+  unexpected link errors.
+- Composition coverage deterministically replaces a valid fleet seat's validated `USER.md` with an
+  external symlink and requires refusal at point of use. A separate standalone case proves tolerant
+  optional composition remains outside the Linux-only fleet reader.
+
+Full package gate (which rebuilds Mosaic itself after the clean-checkout dependency build):
+
+```bash
+env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic run test:vitest
+```
+
+Exit `0`: `88/88` files, `1,577/1,577` tests.
+
+Focused helper + point-of-use coverage:
+
+```text
+2 files, 53/53 tests
+Statements 97.84% | Branches 91.66% | Functions 100% | Lines 97.84%
+Exit 0
+```
+
+Final repository gates after remediation:
+
+```text
+pnpm preflight    exit 0
+pnpm typecheck    45/45 tasks, exit 0
+pnpm lint         25/25 tasks, exit 0
+pnpm build        25/25 tasks, exit 0
+pnpm format:check exit 0
+git diff --check  exit 0
+```
+
+Pre-PR targeted shell runs on the unchanged shell surfaces also passed:
+
+```text
+bash framework/tools/fleet/test-start-agent-session.sh                 exit 0 locally
+bash framework/tools/quality/scripts/test-install-migration.sh         21 passed, 0 failed
+bash framework/tools/_scripts/test-mosaic-init-rce.sh                   PASS
+```
+
+The aggregate local `test:framework-shell` run stopped at `invariant_r_unittest.py`: installed
+operator-global Pi is `0.84.2`, while the invariant is measured for `0.84.1`. Later aggregate stages
+remain unmeasured except the targeted suites above. Root `pnpm test` remains locally **UNTESTED**
+because this checkout prohibits the PostgreSQL-dependent gateway isolation path.
+
+## Review and security evidence
+
+- Initial Codex review found padded-name mutation-before-refusal; it was fixed with three
+  no-side-effect regressions.
+- Codex review of the formal-review remediation: `approve`, confidence `0.88`, 6 files, no findings.
+- Codex security review of the remediation: risk `none`, confidence `0.93`, 9 files, no findings.
+  Its sandbox could not execute Vitest because Vite attempted a write on a read-only mount; the
+  executor-owned results above are the test evidence.
+- Daphne formal review ID 168 at exact head `43fa0477`: `REQUEST_CHANGES`, four blocking groups; all
+  closed by review 169.
+- Daphne formal review ID 169 at exact head `9dc90be7`: `REQUEST_CHANGES`, two blocking groups
+  (standalone portability and explicit blank class). Both now have red-first regressions and local
+  green remediation.
+- Codex review of review-169 remediation: `approve`, confidence `0.90`, 4 files, no findings.
+- Codex security review of review-169 remediation: risk `none`, confidence `0.90`, 4 files, no
+  findings. Exact-new-head Daphne re-review is pending until that head is pushed.
+
+## CI evidence and external blocker
+
+Pipeline 2445 ran against exact first head `43fa0477`:
+
+- install, sanitization, upgrade guard, typecheck, lint, and format passed;
+- Mosaic Vitest passed `88/88`, `1,568/1,568`; and
+- the test step emitted exactly one `FAIL:` line:
+
+```text
+FAIL: host provides 'pi' in the system path; missing-binary cases are not measurable here
+```
+
+That line comes from the inherited `test-start-agent-session.sh` CI-fit guard, not #1264. Fred filed
+the correction as PR #1270. Its pipeline 2448 is terminal green and proves the four formerly masked
+suites execute, but #1270 is not merged, so `next` still carries the failing chain. A new #1268
+pipeline 2449 at `9dc90be7` reproduced the same single inherited `FAIL:` after Mosaic passed
+`1,573/1,573`. A new pipeline is pending the review-169 remediation push. Terminal-green #1268 CI is
+not claimed.
+
+PR #1268's envelope was read back as `user.login=mos-dt-0`; its commit is explicitly authored and
+committed by `goals <[email protected]>`. No goals Gitea login exists on this host, and no
+other principal was borrowed. The cross-wrapper principal defect is tracked in #1272.
+
+## Explicitly untested
+
+- Canary VM remediation/restart: **UNTESTED and prohibited**.
+- Real Pi authentication/provider prompt and task execution: **UNTESTED**.
+- PR #1213 composition layer: **UNTESTED and not required**.
+- Deployment/published npm behavior: **UNTESTED until merge/release**.
+- Local PostgreSQL execution/migration: **UNTESTED and prohibited**.
+
+The local gate proves Mosaic crosses its identity boundary and reaches a fake lease-runtime boundary;
+it does not claim provider readiness, deployment, or a currently running canary seat.
@@ -0,0 +1,104 @@
+# #1264 — Unattended fleet first start
+
+## Tracking
+
+- Issue: `mosaicstack/stack#1264`
+- PR: `mosaicstack/stack#1268`
+- Branch: `fix/1264-fleet-unattended-first-start`
+- Base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
+- First pushed head: `43fa0477877e0d0f110da8d11c3033b40ddeb191`
+- Current remediation worktree: `/var/home/jason.woltje/agent-work/1264-review2-remediation`
+- Coordinator: Fred; reviewer must be neither Fred nor this implementation seat.
+- `docs/TASKS.md` is orchestrator-owned and is not modified by this worker.
+
+The original `/var/home/jason.woltje/agent-work/1264-unattended-first-start` and first remediation
+worktrees were removed without force after each pushed head and clean state were verified. The
+Fred-authorized plain-Git worktree exception was reused for exact-head review remediation because
+`/src` remains unavailable.
+
+## Objective
+
+A roster-owned fleet seat launched from systemd on a clean host must cross Mosaic's first-run identity
+gate without a human or TTY, while retaining exact name/class from the canonical roster and
+preserving the standalone interactive wizard.
+
+## Intake and boundaries
+
+- Shipping canary provenance is jarvis-brain `origin/main` commit
+  `8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`. The earlier local `6c0b6fc...` object is not used.
+- The Run-7 pane was preserved when evidence was captured; formal review records a later authorized
+  rollback. This task never accessed or altered the canary.
+- Tiny's concurrent runtime-preflight, `start-agent-session.sh`, and #1258 PATH seam remain untouched.
+- Held PR #1213 is not a dependency.
+- No runtime/provider credential values or provider calls, installed-host changes, PostgreSQL, unit,
+  timer, or profile mutation. Tests use temporary roots and fake executables only; Gitea/Woodpecker
+  metadata operations use standard wrappers without exposing credentials.
+
+## Requirements and design
+
+- PRD IDs: `FCM-REQ-12`, `AC-FCM-10`; `FCM-REQ-11` is reserved by #1256.
+- A present fleet name must be nonblank, whitespace-exact, and resolve through the canonical roster.
+- Any defined ambient class, including blank/whitespace, must canonicalize to the roster class before
+  mutation; only undefined means absent.
+- Preflight all destination directory entries with no-follow existence semantics so dangling links
+  fail before counterpart publication.
+- Seed only missing top-level files from bounded regular defaults with owner-private, atomic,
+  no-clobber hard links.
+- Generic defaults are behavior, not identity or authority.
+- Securely consume fleet `USER.md` through a Linux descriptor at composition time.
+- Standalone composition retains the portable tolerant USER read and missing identity retains the
+  wizard.
+
+## Progress
+
+- [x] Issue, canary report, Tiny collision state, and PRD read/amended.
+- [x] Initial production-kind RED captured with a real built CLI and no TTY.
+- [x] Implementation, tests, user/admin/developer docs, QA, and indexes delivered.
+- [x] Initial automated review finding (padded name before write) remediated.
+- [x] Commit `43fa0477` pushed; PR #1268 opened against `next`; original worktree removed cleanly.
+- [x] Daphne formal review ID 168 completed on exact first head: `REQUEST_CHANGES` with four groups.
+- [x] All four review-168 groups reproduced red before remediation and passed at `9dc90be7`.
+- [x] Daphne review ID 169 completed on `9dc90be7`: review-168 closures confirmed; two new blockers.
+- [x] Review-169 portability and blank-class blockers reproduced red and now pass locally.
+- [x] Review-169 Codex review approved; security review risk `none`.
+- [ ] Commit/push second remediation with explicit goals author/committer; verify remote object/content.
+- [ ] Daphne exact-new-head re-review.
+- [ ] Terminal #1268 CI. Pipeline 2445's only `FAIL:` was the inherited Pi-PATH CI-fit guard; PR
+  #1270's pipeline 2448 is green, but #1270 is not merged.
+- [ ] Remove the clean remediation worktree after push.
+
+## Test evidence
+
+### Initial RED
+
+The built `origin/next` CLI entered `mosaic wizard`, rendered `What would you like to do?`, exited 1,
+and never created the fake runtime-boundary capture.
+
+### Formal-review RED
+
+Against exact first-head production code, four new tests failed while 1,568 existing tests passed:
+class mismatch mutated before refusal; each dangling destination left its counterpart; and a
+replacement `USER.md` symlink was consumed by composition. Review-169 RED then proved standalone
+composition hit the Linux-only reader and three explicit blank/whitespace class cases seeded and
+launched.
+
+### Final local GREEN
+
+- Exact-source focused gate: `6/6` files, `128/128` tests.
+- Full exact-source Mosaic Vitest: `88/88` files, `1,577/1,577` tests.
+- Helper + point-of-use coverage: `53/53`; 97.84% statements/lines, 91.66% branches, 100% functions.
+- Root preflight passed; typecheck `45/45`, lint `25/25`, build `25/25`.
+- Initial targeted shell gates passed: start-agent-session, install migration `21/21`, init-RCE.
+- Local aggregate framework shell stops at operator-global Pi `0.84.2` versus measured `0.84.1`.
+- Local root `pnpm test` remains unrun because the checkout prohibits its PostgreSQL-dependent path.
+
+The full evidence and command boundaries are in
+`docs/reports/qa/2026-08-16-1264-unattended-first-start.md`.
+
+## Review / delivery notes
+
+- Review-168 remediation Codex review: approve `0.88`; security risk `none` `0.93`.
+- Review-169 remediation Codex review: approve `0.90`; security risk `none` `0.90`.
+- PR envelope reads `mos-dt-0`; the commit reads goals/goals. No goals Gitea principal exists on this
+  host, so no other principal will be borrowed. Tracked in #1272.
+- PR #1270 is pushed, not merged. Do not represent `next` or #1268 CI as green until measured.
@@ -7,6 +7,10 @@
 - [DOCS-IA-001 — information architecture](DOCS-IA-001.md) — completed structure-design and documentation-contract record.
 - [DOCS-IA-002 — catalog audit and migration](DOCS-IA-002-catalog-audit.md) — active coordinator progress, autonomous lane state, verification evidence, and authority blockers.

+## Active implementation records
+
+- [Issue #1264 — unattended fleet first start](1264-unattended-first-start.md) — plan, RED/GREEN evidence, collision boundaries, and PR lifecycle state.
+
 Completed scratchpads may remain here when they provide useful delivery provenance. Their conclusions must be reflected in the owning canonical page before the scratchpad is treated as complete.

 ## Related
@@ -102,7 +102,7 @@ mosaic yolo pi             # Launch Pi in yolo mode
 The launcher:

 1. Verifies `~/.config/mosaic` exists
-2. Verifies `SOUL.md` exists (auto-runs `mosaic init` if missing)
+2. Resolves identity: standalone launches auto-run `mosaic init` when `SOUL.md` is missing; exact roster-owned fleet launches validate name/class, atomically seed only missing `SOUL.md`/`USER.md` from generic `defaults/`, securely consume `USER.md`, and never prompt
 3. Injects `AGENTS.md` into the runtime
 4. Forwards all arguments to the runtime CLI

@@ -39,20 +39,3 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
-
-# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
-# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
-# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
-# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
-# real system path, so on a host that installs those binaries the missing-binary
-# cases cannot be measured at all. The suite's own guard (line 103) says so and
-# fails rather than reporting a pass it cannot back. That guard is correct.
-# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
-# dropped this exclusion, and the CI image provides `pi` in the system path, so
-# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
-# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
-# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
-# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
-# Because test:framework-shell is one && chain and this sat at position 44 of 48,
-# the four suites after it had not run at all since the merge.
-packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271
@@ -24,8 +24,9 @@
    "build": "tsc",
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test": "pnpm run test:vitest && pnpm run test:framework-shell",
+    "test:vitest": "pnpm run build && vitest run --passWithNoTests",
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -15,6 +15,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { FileConfigAdapter } from '../config/file-adapter.js';
+import { seedFleetIdentityDefaults } from './fleet-first-start-identity.js';
 import { composeContract } from './launch.js';

 /**
@@ -319,6 +320,7 @@ describe('composeContract — overlay composer', () => {
        ].join('\n'),
      );
      process.env['MOSAIC_AGENT_NAME'] = 'exact-self';
+      expect(seedFleetIdentityDefaults(installedHome)).toEqual(['SOUL.md', 'USER.md']);

      const composed = composeContract('pi', installedHome);
      expect(composed).toContain(sourceTools);
@@ -332,6 +334,49 @@ describe('composeContract — overlay composer', () => {
    }
  });

+  it('refuses a fleet USER.md replacement symlink at the point of composition', () => {
+    mkdirSync(join(fixture.home, 'fleet'), { recursive: true });
+    writeFileSync(
+      join(fixture.home, 'fleet', 'roster.yaml'),
+      [
+        'version: 1',
+        'transport: tmux',
+        'agents:',
+        '  - name: exact-user-seat',
+        '    runtime: pi',
+        '    class: worker',
+        '',
+      ].join('\n'),
+    );
+    process.env['MOSAIC_AGENT_NAME'] = 'exact-user-seat';
+    process.env['MOSAIC_AGENT_CLASS'] = 'worker';
+    writeFileSync(join(fixture.home, 'defaults', 'SOUL.md'), '# Generic soul\n');
+    writeFileSync(join(fixture.home, 'defaults', 'USER.md'), '# Generic user\n');
+    expect(seedFleetIdentityDefaults(fixture.home)).toEqual(['SOUL.md']);
+
+    const userPath = join(fixture.home, 'USER.md');
+    const external = join(fixture.root, 'attacker-user.md');
+    writeFileSync(external, 'UNSAFE-REPLACEMENT-USER-CONTENT\n');
+    rmSync(userPath);
+    symlinkSync(external, userPath);
+
+    expect(() => composeContract('pi', fixture.home)).toThrow(
+      `fleet identity installed is unavailable or unsafe: ${userPath}`,
+    );
+    expect(readFileSync(external, 'utf8')).toBe('UNSAFE-REPLACEMENT-USER-CONTENT\n');
+  });
+
+  it('preserves tolerant standalone composition when optional USER.md is unreadable', () => {
+    const userPath = join(fixture.home, 'USER.md');
+    rmSync(userPath);
+    mkdirSync(userPath);
+
+    const out = composeContract('pi', fixture.home);
+
+    expect(out).toContain(AGENTS);
+    expect(out).not.toContain('# User Profile');
+  });
+
  it.each(['claude', 'codex', 'opencode', 'pi'] as const)(
    'never injects installed TOOLS.md through a target symlink for %s',
    (runtime) => {
@@ -0,0 +1,182 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  lstatSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  linkIdentityContractNoClobber,
+  seedFleetIdentityDefaults,
+} from './fleet-first-start-identity.js';
+
+const roots: string[] = [];
+const DEFAULT_SOUL = '# Generic soul\n';
+const DEFAULT_USER = '# Generic user\n';
+
+function writeFixture(path: string, content: string | Buffer, mode: number = 0o600): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeFileSync(path, content, { mode });
+  chmodSync(path, mode);
+}
+
+function createMosaicHome(): string {
+  const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-seed-'));
+  roots.push(root);
+  const mosaicHome = join(root, 'home', '.config', 'mosaic');
+  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), DEFAULT_SOUL);
+  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), DEFAULT_USER);
+  return mosaicHome;
+}
+
+function temporarySeeds(mosaicHome: string): string[] {
+  return readdirSync(mosaicHome).filter((entry) => entry.includes('.fleet-seed-'));
+}
+
+afterEach((): void => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe('linkIdentityContractNoClobber', () => {
+  it('returns false and preserves a destination that already exists', () => {
+    const mosaicHome = createMosaicHome();
+    const source = join(mosaicHome, 'source.tmp');
+    const destination = join(mosaicHome, 'destination.md');
+    writeFixture(source, 'candidate\n');
+    writeFixture(destination, 'operator\n');
+
+    expect(linkIdentityContractNoClobber(source, destination)).toBe(false);
+    expect(readFileSync(destination, 'utf8')).toBe('operator\n');
+  });
+
+  it('does not misclassify an unexpected link failure as a concurrent winner', () => {
+    const mosaicHome = createMosaicHome();
+    const missingSource = join(mosaicHome, 'missing.tmp');
+
+    expect(() =>
+      linkIdentityContractNoClobber(missingSource, join(mosaicHome, 'destination.md')),
+    ).toThrow();
+  });
+});
+
+describe('seedFleetIdentityDefaults', () => {
+  it('publishes complete owner-private default snapshots', () => {
+    const mosaicHome = createMosaicHome();
+
+    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
+
+    for (const [entry, expected] of [
+      ['SOUL.md', DEFAULT_SOUL],
+      ['USER.md', DEFAULT_USER],
+    ] as const) {
+      const path = join(mosaicHome, entry);
+      expect(readFileSync(path, 'utf8')).toBe(expected);
+      expect(statSync(path).mode & 0o777).toBe(0o600);
+    }
+    expect(temporarySeeds(mosaicHome)).toEqual([]);
+  });
+
+  it('preserves an existing regular contract byte-for-byte and mode-for-mode', () => {
+    const mosaicHome = createMosaicHome();
+    const customSoul = '# Operator-owned soul\n';
+    writeFixture(join(mosaicHome, 'SOUL.md'), customSoul, 0o640);
+
+    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['USER.md']);
+    expect(readFileSync(join(mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
+    expect(statSync(join(mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
+  });
+
+  it('is idempotent after both installed contracts exist', () => {
+    const mosaicHome = createMosaicHome();
+
+    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
+    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual([]);
+    expect(temporarySeeds(mosaicHome)).toEqual([]);
+  });
+
+  it('validates every required source before publishing any destination', () => {
+    const mosaicHome = createMosaicHome();
+    const missing = join(mosaicHome, 'defaults', 'USER.md');
+    rmSync(missing);
+
+    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+      `fleet identity default is unavailable or unsafe: ${missing}`,
+    );
+    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
+    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
+  });
+
+  it('fails closed when the configured Mosaic home is not a directory', () => {
+    const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-invalid-home-'));
+    roots.push(root);
+    const mosaicHome = join(root, 'mosaic-home');
+    writeFixture(mosaicHome, 'not a directory\n');
+
+    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+      `fleet identity installed is unavailable or unsafe: ${join(mosaicHome, 'SOUL.md')}`,
+    );
+  });
+
+  it('refuses a symlinked default instead of following it', () => {
+    const mosaicHome = createMosaicHome();
+    const source = join(mosaicHome, 'defaults', 'SOUL.md');
+    rmSync(source);
+    symlinkSync(join(mosaicHome, 'defaults', 'USER.md'), source);
+
+    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+      `fleet identity default is unavailable or unsafe: ${source}`,
+    );
+    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
+  });
+
+  it('refuses an existing symlinked destination without replacing it', () => {
+    const mosaicHome = createMosaicHome();
+    const destination = join(mosaicHome, 'SOUL.md');
+    symlinkSync(join(mosaicHome, 'defaults', 'SOUL.md'), destination);
+
+    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+      `fleet identity installed is unavailable or unsafe: ${destination}`,
+    );
+    expect(lstatSync(destination).isSymbolicLink()).toBe(true);
+    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
+  });
+
+  it.each(['SOUL.md', 'USER.md'] as const)(
+    'rejects a dangling %s destination before publishing its counterpart',
+    (entry) => {
+      const mosaicHome = createMosaicHome();
+      const destination = join(mosaicHome, entry);
+      const counterpart = join(mosaicHome, entry === 'SOUL.md' ? 'USER.md' : 'SOUL.md');
+      symlinkSync(join(mosaicHome, 'missing-identity-target'), destination);
+
+      expect(existsSync(destination)).toBe(false);
+      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
+      expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+        `fleet identity installed is unavailable or unsafe: ${destination}`,
+      );
+      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
+      expect(existsSync(counterpart)).toBe(false);
+    },
+  );
+
+  it('rejects an oversized source before publishing a partial identity', () => {
+    const mosaicHome = createMosaicHome();
+    const source = join(mosaicHome, 'defaults', 'USER.md');
+    writeFixture(source, Buffer.alloc(256 * 1024 + 1, 0x61));
+
+    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
+      `fleet identity default is unavailable or unsafe: ${source}`,
+    );
+    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
+    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
+  });
+});
@@ -0,0 +1,120 @@
+import { randomBytes } from 'node:crypto';
+import { linkSync, lstatSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readRegularFileSecure } from '../fleet/secure-file.js';
+
+const MAX_IDENTITY_CONTRACT_BYTES = 256 * 1024;
+export const FLEET_IDENTITY_DEFAULTS = ['SOUL.md', 'USER.md'] as const;
+
+function isFilesystemError(error: unknown, code: string): boolean {
+  return error instanceof Error && 'code' in error && error.code === code;
+}
+
+/** @internal Publish a complete temporary file without replacing any path. */
+export function linkIdentityContractNoClobber(source: string, destination: string): boolean {
+  try {
+    linkSync(source, destination);
+    return true;
+  } catch (error: unknown) {
+    if (isFilesystemError(error, 'EEXIST')) return false;
+    throw error;
+  }
+}
+
+function unsafeIdentityError(kind: 'default' | 'installed', path: string, error: unknown): Error {
+  const reason = error instanceof Error ? error.message : String(error);
+  return new Error(`fleet identity ${kind} is unavailable or unsafe: ${path} (${reason})`);
+}
+
+function readIdentityContract(
+  mosaicHome: string,
+  path: string,
+  kind: 'default' | 'installed',
+): Buffer {
+  try {
+    return readRegularFileSecure(path, {
+      root: mosaicHome,
+      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
+    }).content;
+  } catch (error: unknown) {
+    throw unsafeIdentityError(kind, path, error);
+  }
+}
+
+function installedEntryExists(path: string): boolean {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error: unknown) {
+    if (isFilesystemError(error, 'ENOENT')) return false;
+    throw unsafeIdentityError('installed', path, error);
+  }
+}
+
+/** Secure fleet point-of-use read for a top-level identity contract. */
+export function readInstalledIdentityContractAtPointOfUse(
+  mosaicHome: string,
+  entry: (typeof FLEET_IDENTITY_DEFAULTS)[number],
+): Buffer {
+  const configuredPath = join(mosaicHome, entry);
+  try {
+    // Preserve the launcher's established support for a symlinked Mosaic home,
+    // while pinning this read to the resolved directory. O_NOFOLLOW still
+    // rejects replacement of the identity file itself (or any child ancestor).
+    const canonicalHome = realpathSync(mosaicHome);
+    return readRegularFileSecure(join(canonicalHome, entry), {
+      root: canonicalHome,
+      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
+    }).content;
+  } catch (error: unknown) {
+    throw unsafeIdentityError('installed', configuredPath, error);
+  }
+}
+
+/**
+ * Seed the generic identity base required by unattended fleet launches.
+ *
+ * Exact seat identity remains roster-owned and is injected later by the
+ * runtime composer. Each destination appears atomically through a hard link to
+ * a complete owner-private temporary file; a concurrent first seat may win the
+ * link without allowing either process to overwrite operator content.
+ */
+export function seedFleetIdentityDefaults(mosaicHome: string): string[] {
+  const snapshots = new Map<(typeof FLEET_IDENTITY_DEFAULTS)[number], Buffer>();
+
+  for (const entry of FLEET_IDENTITY_DEFAULTS) {
+    const destination = join(mosaicHome, entry);
+    if (installedEntryExists(destination)) {
+      readIdentityContract(mosaicHome, destination, 'installed');
+      continue;
+    }
+    const source = join(mosaicHome, 'defaults', entry);
+    snapshots.set(entry, readIdentityContract(mosaicHome, source, 'default'));
+  }
+
+  const seeded: string[] = [];
+  for (const [entry, content] of snapshots) {
+    const destination = join(mosaicHome, entry);
+    const temporary = join(
+      mosaicHome,
+      `.${entry}.fleet-seed-${process.pid.toString()}-${randomBytes(6).toString('hex')}`,
+    );
+    let temporaryCreated = false;
+    try {
+      writeFileSync(temporary, content, { flag: 'wx', mode: 0o600 });
+      temporaryCreated = true;
+      if (linkIdentityContractNoClobber(temporary, destination)) {
+        seeded.push(entry);
+      } else {
+        readIdentityContract(mosaicHome, destination, 'installed');
+      }
+    } finally {
+      if (temporaryCreated) rmSync(temporary, { force: true });
+    }
+  }
+
+  for (const entry of FLEET_IDENTITY_DEFAULTS) {
+    readIdentityContract(mosaicHome, join(mosaicHome, entry), 'installed');
+  }
+  return seeded;
+}
@@ -0,0 +1,393 @@
+import { spawn, spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, describe, expect, it } from 'vitest';
+
+const CLI_PATH = fileURLToPath(new URL('../../dist/cli.js', import.meta.url));
+const DEFAULT_SOUL_PATH = fileURLToPath(
+  new URL('../../framework/defaults/SOUL.md', import.meta.url),
+);
+const DEFAULT_USER_PATH = fileURLToPath(
+  new URL('../../framework/defaults/USER.md', import.meta.url),
+);
+
+interface GreenfieldFixture {
+  readonly root: string;
+  readonly home: string;
+  readonly mosaicHome: string;
+  readonly binDir: string;
+  readonly capturePath: string;
+}
+
+interface AsyncLaunchResult {
+  readonly status: number | null;
+  readonly signal: NodeJS.Signals | null;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+const fixtures: string[] = [];
+
+function writeFixture(path: string, content: string, mode: number = 0o600): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeFileSync(path, content, { encoding: 'utf8', mode });
+  chmodSync(path, mode);
+}
+
+function createGreenfieldFixture(): GreenfieldFixture {
+  const root = mkdtempSync(join(tmpdir(), 'mosaic-first-start-'));
+  fixtures.push(root);
+  const home = join(root, 'home');
+  const mosaicHome = join(home, '.config', 'mosaic');
+  const binDir = join(root, 'bin');
+  const capturePath = join(root, 'runtime-boundary.json');
+
+  mkdirSync(binDir, { recursive: true, mode: 0o700 });
+  writeFixture(join(mosaicHome, 'AGENTS.md'), '# Agent dispatcher\n');
+  writeFixture(join(mosaicHome, 'runtime', 'pi', 'RUNTIME.md'), '# Pi runtime\n');
+  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
+  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), readFileSync(DEFAULT_USER_PATH, 'utf8'));
+  writeFixture(
+    join(mosaicHome, 'fleet', 'roster.yaml'),
+    `version: 1
+transport: tmux
+tmux:
+  socket_name: mosaic-fleet
+  holder_session: _holder
+defaults:
+  working_directory: ~
+runtimes:
+  pi:
+    reset_command: /new
+agents:
+  - name: unattended-seat
+    runtime: pi
+    class: worker
+`,
+  );
+  writeFixture(
+    join(mosaicHome, 'tools', 'tmux', 'agent-send.sh'),
+    '#!/usr/bin/env bash\nexit 0\n',
+    0o755,
+  );
+  writeFixture(
+    join(mosaicHome, 'tools', 'lease-broker', 'launch-runtime.py'),
+    `#!/usr/bin/env python3
+import json
+import os
+import pathlib
+import sys
+pathlib.Path(os.environ["MOSAIC_TEST_RUNTIME_CAPTURE"]).write_text(
+    json.dumps({"argv": sys.argv[1:]}), encoding="utf-8"
+)
+`,
+    0o755,
+  );
+  // checkRuntime() must find Pi, while the fake broker boundary prevents this
+  // executable from running or making a provider call.
+  writeFixture(join(binDir, 'pi'), '#!/usr/bin/env bash\nexit 97\n', 0o755);
+
+  return { root, home, mosaicHome, binDir, capturePath };
+}
+
+function launchEnvironment(
+  fixture: GreenfieldFixture,
+  capturePath: string,
+  fleet: boolean = true,
+  agentName: string = 'unattended-seat',
+  agentClass: string = 'worker',
+): NodeJS.ProcessEnv {
+  return {
+    HOME: fixture.home,
+    MOSAIC_HOME: fixture.mosaicHome,
+    ...(fleet
+      ? {
+          MOSAIC_AGENT_NAME: agentName,
+          MOSAIC_AGENT_CLASS: agentClass,
+        }
+      : {}),
+    MOSAIC_TEST_RUNTIME_CAPTURE: capturePath,
+    PATH: `${fixture.binDir}:/usr/bin:/bin`,
+  };
+}
+
+function launchSync(
+  fixture: GreenfieldFixture,
+  options: {
+    readonly capturePath?: string;
+    readonly fleet?: boolean;
+    readonly agentName?: string;
+    readonly agentClass?: string;
+  } = {},
+): SpawnSyncReturns<string> {
+  const capturePath = options.capturePath ?? fixture.capturePath;
+  return spawnSync(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
+    cwd: fixture.root,
+    encoding: 'utf8',
+    input: '',
+    timeout: 10_000,
+    env: launchEnvironment(
+      fixture,
+      capturePath,
+      options.fleet ?? true,
+      options.agentName ?? 'unattended-seat',
+      options.agentClass ?? 'worker',
+    ),
+  });
+}
+
+function launchAsync(fixture: GreenfieldFixture, capturePath: string): Promise<AsyncLaunchResult> {
+  return new Promise<AsyncLaunchResult>((resolve, reject): void => {
+    const child = spawn(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
+      cwd: fixture.root,
+      env: launchEnvironment(fixture, capturePath),
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string): void => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk: string): void => {
+      stderr += chunk;
+    });
+    child.on('error', reject);
+    child.on('close', (status: number | null, signal: NodeJS.Signals | null): void => {
+      resolve({ status, signal, stdout, stderr });
+    });
+    child.stdin.end();
+  });
+}
+
+function outputOf(result: { readonly stdout: string; readonly stderr: string }): string {
+  return `${result.stdout}${result.stderr}`;
+}
+
+function assertPrivateDefaultSeeds(fixture: GreenfieldFixture): void {
+  const soul = join(fixture.mosaicHome, 'SOUL.md');
+  const user = join(fixture.mosaicHome, 'USER.md');
+  expect(readFileSync(soul, 'utf8')).toBe(readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
+  expect(readFileSync(user, 'utf8')).toBe(readFileSync(DEFAULT_USER_PATH, 'utf8'));
+  expect(statSync(soul).mode & 0o777).toBe(0o600);
+  expect(statSync(user).mode & 0o777).toBe(0o600);
+}
+
+function capturedArguments(path: string): string[] {
+  const capture = JSON.parse(readFileSync(path, 'utf8')) as { argv: string[] };
+  return capture.argv;
+}
+
+afterEach((): void => {
+  for (const root of fixtures.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+describe('fleet unattended first start (#1264)', () => {
+  it('reaches the runtime boundary without a TTY or identity wizard on a clean install', () => {
+    const fixture = createGreenfieldFixture();
+    const result = launchSync(fixture);
+    const output = outputOf(result);
+
+    expect(result.error, output).toBeUndefined();
+    expect(result.status, output).toBe(0);
+    expect(output).toContain('Initialized unattended fleet identity defaults: SOUL.md, USER.md');
+    expect(output).not.toContain('Running setup wizard');
+    expect(output).not.toContain('What would you like to do?');
+    expect(existsSync(fixture.capturePath), output).toBe(true);
+    assertPrivateDefaultSeeds(fixture);
+
+    const argv = capturedArguments(fixture.capturePath);
+    expect(argv).toContain('--runtime');
+    expect(argv.join('\n')).toContain('Agent/session: `unattended-seat`');
+    expect(argv.join('\n')).toContain('Role/class: `worker`');
+  });
+
+  it('preserves existing operator identity bytes without requiring defaults', () => {
+    const fixture = createGreenfieldFixture();
+    const customSoul = '# Operator soul\nNever replace this.\n';
+    const customUser = '# Operator user\nNever replace this either.\n';
+    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
+    writeFixture(join(fixture.mosaicHome, 'USER.md'), customUser, 0o600);
+    rmSync(join(fixture.mosaicHome, 'defaults'), { recursive: true, force: true });
+
+    const first = launchSync(fixture);
+    const secondCapture = join(fixture.root, 'runtime-boundary-second.json');
+    const second = launchSync(fixture, { capturePath: secondCapture });
+
+    expect(first.status, outputOf(first)).toBe(0);
+    expect(second.status, outputOf(second)).toBe(0);
+    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
+    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(customUser);
+    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
+    expect(existsSync(fixture.capturePath)).toBe(true);
+    expect(existsSync(secondCapture)).toBe(true);
+  });
+
+  it('seeds only the missing identity contract and leaves a custom SOUL byte-exact', () => {
+    const fixture = createGreenfieldFixture();
+    const customSoul = '# Exact custom soul bytes\n';
+    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
+
+    const result = launchSync(fixture);
+
+    expect(result.status, outputOf(result)).toBe(0);
+    expect(outputOf(result)).toContain('Initialized unattended fleet identity defaults: USER.md');
+    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
+    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
+    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(
+      readFileSync(DEFAULT_USER_PATH, 'utf8'),
+    );
+  });
+
+  it('fails closed without a wizard or partial seed when a required default is missing', () => {
+    const fixture = createGreenfieldFixture();
+    const missingDefault = join(fixture.mosaicHome, 'defaults', 'USER.md');
+    rmSync(missingDefault);
+
+    const result = launchSync(fixture);
+    const output = outputOf(result);
+
+    expect(result.status, output).toBe(1);
+    expect(output).toContain('unattended fleet identity initialization failed');
+    expect(output).toContain(missingDefault);
+    expect(output).not.toContain('Running setup wizard');
+    expect(output).not.toContain('What would you like to do?');
+    expect(existsSync(fixture.capturePath)).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
+  });
+
+  it('rejects a symlinked identity default without following it or prompting', () => {
+    const fixture = createGreenfieldFixture();
+    const soulDefault = join(fixture.mosaicHome, 'defaults', 'SOUL.md');
+    rmSync(soulDefault);
+    symlinkSync(DEFAULT_SOUL_PATH, soulDefault);
+
+    const result = launchSync(fixture);
+    const output = outputOf(result);
+
+    expect(result.status, output).toBe(1);
+    expect(output).toContain(`fleet identity default is unavailable or unsafe: ${soulDefault}`);
+    expect(output).not.toContain('Running setup wizard');
+    expect(existsSync(fixture.capturePath)).toBe(false);
+  });
+
+  it('refuses an unknown ambient fleet name before seeding or prompting', () => {
+    const fixture = createGreenfieldFixture();
+
+    const result = launchSync(fixture, { agentName: 'not-in-the-roster' });
+    const output = outputOf(result);
+
+    expect(result.status, output).toBe(1);
+    expect(output).toContain('canonical fleet identity is unavailable');
+    expect(output).toContain('Agent "not-in-the-roster" is not in the fleet roster');
+    expect(output).not.toContain('Running setup wizard');
+    expect(existsSync(fixture.capturePath)).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
+  });
+
+  it('refuses a mismatched ambient fleet class before seeding or prompting', () => {
+    const fixture = createGreenfieldFixture();
+
+    const result = launchSync(fixture, { agentClass: 'reviewer' });
+    const output = outputOf(result);
+
+    expect(result.status, output).toBe(1);
+    expect(output).toContain('Refusing split identity authority');
+    expect(output).not.toContain('Running setup wizard');
+    expect(existsSync(fixture.capturePath)).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
+  });
+
+  it.each(['', ' ', '\t'])(
+    'refuses explicit blank ambient fleet class %j before seeding',
+    (agentClass: string) => {
+      const fixture = createGreenfieldFixture();
+
+      const result = launchSync(fixture, { agentClass });
+      const output = outputOf(result);
+
+      expect(result.status, output).toBe(1);
+      expect(output).toContain('Refusing split identity authority');
+      expect(output).not.toContain('Running setup wizard');
+      expect(existsSync(fixture.capturePath)).toBe(false);
+      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
+    },
+  );
+
+  it.each([' unattended-seat', 'unattended-seat ', ''])(
+    'refuses non-exact ambient fleet name %j before seeding',
+    (agentName: string) => {
+      const fixture = createGreenfieldFixture();
+
+      const result = launchSync(fixture, { agentName });
+      const output = outputOf(result);
+
+      expect(result.status, output).toBe(1);
+      expect(output).toContain(
+        'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
+      );
+      expect(output).not.toContain('Running setup wizard');
+      expect(existsSync(fixture.capturePath)).toBe(false);
+      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
+    },
+  );
+
+  it('keeps the interactive wizard path for a standalone launch', () => {
+    const fixture = createGreenfieldFixture();
+
+    const result = launchSync(fixture, { fleet: false });
+    const output = outputOf(result);
+
+    expect(result.status, output).toBe(1);
+    expect(output).toContain('[mosaic] SOUL.md not found. Running setup wizard...');
+    expect(output).toContain('What would you like to do?');
+    expect(output).toContain('[mosaic] Setup failed. Run: mosaic wizard');
+    expect(existsSync(fixture.capturePath)).toBe(false);
+    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
+  });
+
+  it('allows concurrent no-TTY seats to initialize the same defaults without clobber or residue', async () => {
+    const fixture = createGreenfieldFixture();
+    const captures = Array.from({ length: 4 }, (_, index) =>
+      join(fixture.root, `runtime-boundary-${index.toString()}.json`),
+    );
+
+    const results = await Promise.all(
+      captures.map(
+        async (capturePath): Promise<AsyncLaunchResult> => launchAsync(fixture, capturePath),
+      ),
+    );
+
+    for (const result of results) {
+      expect(result.status, outputOf(result)).toBe(0);
+      expect(result.signal, outputOf(result)).toBeNull();
+      expect(outputOf(result)).not.toContain('Running setup wizard');
+    }
+    assertPrivateDefaultSeeds(fixture);
+    expect(captures.every((capturePath) => existsSync(capturePath))).toBe(true);
+    expect(
+      readdirSync(fixture.mosaicHome).filter((entry) => entry.includes('.fleet-seed-')),
+    ).toEqual([]);
+  });
+});
@@ -30,6 +30,10 @@ import { readRegularFileSecure } from '../fleet/secure-file.js';
 import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 import { canonicalizeRoleClass } from './fleet-personas.js';
 import { launchClaudex, type ClaudexHarnessAdapter } from './claudex.js';
+import {
+  readInstalledIdentityContractAtPointOfUse,
+  seedFleetIdentityDefaults,
+} from './fleet-first-start-identity.js';
 import { runLeaseEnforcementDoctorCheck } from './lease-doctor-check.js';

 const MOSAIC_HOME = process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
@@ -230,8 +234,55 @@ function checkRuntime(cmd: string): void {
  }
 }

+function assertAmbientFleetClassMatches(canonicalName: string, canonicalClass: string): void {
+  const configuredClass = process.env['MOSAIC_AGENT_CLASS'];
+  if (configuredClass === undefined) return;
+
+  const ambientClass = canonicalizeRoleClass(configuredClass).canonicalClass;
+  if (ambientClass !== canonicalClass) {
+    throw new Error(
+      `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalName}" resolves to "${canonicalClass}". Refusing split identity authority.`,
+    );
+  }
+}
+
 function checkSoul(): void {
  const soulPath = join(MOSAIC_HOME, 'SOUL.md');
+  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
+  if (fleetAgentName !== undefined) {
+    try {
+      if (fleetAgentName.length === 0 || fleetAgentName !== fleetAgentName.trim()) {
+        throw new Error(
+          'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
+        );
+      }
+      const fleetIdentity = resolveFleetIdentity(MOSAIC_HOME, fleetAgentName);
+      if (!fleetIdentity.ok || !fleetIdentity.identity) {
+        throw new Error(
+          `canonical fleet identity is unavailable: ${fleetIdentity.error ?? 'exact roster member was not resolved'}`,
+        );
+      }
+      assertAmbientFleetClassMatches(
+        fleetIdentity.identity.member.name,
+        fleetIdentity.identity.member.className,
+      );
+      const seeded = seedFleetIdentityDefaults(MOSAIC_HOME);
+      if (seeded.length > 0) {
+        console.log(
+          `[mosaic] Initialized unattended fleet identity defaults: ${seeded.join(', ')}. Exact seat identity remains roster-owned.`,
+        );
+      }
+      return;
+    } catch (error: unknown) {
+      const reason = error instanceof Error ? error.message : String(error);
+      console.error(`[mosaic] ERROR: unattended fleet identity initialization failed: ${reason}`);
+      console.error(
+        '[mosaic] Repair the named fleet roster, launch identity, installed contract, or shipped default, then retry.',
+      );
+      process.exit(1);
+    }
+  }
+
  if (!existsSync(soulPath)) {
    console.log('[mosaic] SOUL.md not found. Running setup wizard...');

@@ -532,26 +583,27 @@ For required push/merge/issue-close/release actions, execute without routine con
  parts.push(readFileSync(join(mosaicHome, 'AGENTS.md'), 'utf-8'));

  // USER.md (+ USER.local.md operator overlay, appended directly under the
-  // profile its base owns).
-  const user = readOptional(join(mosaicHome, 'USER.md'));
+  // profile its base owns). Fleet first start is Linux/systemd-owned and uses
+  // the no-follow reader at point of use. Standalone launches retain the
+  // portable tolerant path used on macOS and other supported hosts.
+  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
+  const user =
+    fleetAgentName === undefined
+      ? readOptional(join(mosaicHome, 'USER.md'))
+      : readInstalledIdentityContractAtPointOfUse(mosaicHome, 'USER.md').toString('utf8');
  if (user) parts.push('\n\n# User Profile\n\n' + user);
  const userLocal = readOptional(join(mosaicHome, 'USER.local.md'));
  if (userLocal.trim()) {
    parts.push('\n\n## Operator Overlay (USER.local.md)\n\n' + userLocal);
  }

-  const fleetIdentity = resolveFleetIdentity(mosaicHome, process.env['MOSAIC_AGENT_NAME']);
+  const fleetIdentity = resolveFleetIdentity(mosaicHome, fleetAgentName);
  if (!fleetIdentity.ok) {
    throw new Error(`Fleet communications contract unavailable: ${fleetIdentity.error}`);
  }
  const canonicalMember = fleetIdentity.identity?.member;
-  if (canonicalMember && process.env['MOSAIC_AGENT_CLASS']?.trim()) {
-    const ambientClass = canonicalizeRoleClass(process.env['MOSAIC_AGENT_CLASS']).canonicalClass;
-    if (ambientClass !== canonicalMember.className) {
-      throw new Error(
-        `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalMember.name}" resolves to "${canonicalMember.className}". Refusing split identity authority.`,
-      );
-    }
+  if (canonicalMember) {
+    assertAmbientFleetClassMatches(canonicalMember.name, canonicalMember.className);
  }

  // TOOLS.md
@@ -1,149 +0,0 @@
-import { mkdtemp, readFile, readdir } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { parse as parseYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerMissionCommand } from './mission.js';
-import { PrdService } from '@mosaicstack/prdy';
-import type { MissionInfo } from '../tui/gateway-api.js';
-
-// ── Mocks: the gateway is not available in adapter tests ──────────────────────
-
-// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
-// be initialized there too.
-const MISSION = vi.hoisted(
-  (): MissionInfo => ({
-    id: 'mission-plan-1',
-    name: 'Plan Mission Alpha',
-    description: null,
-    status: 'planning',
-    projectId: null,
-    userId: null,
-    phase: null,
-    milestones: null,
-    config: null,
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-03-04T05:06:07.000Z',
-  }),
-);
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
-  fetchMission: vi.fn(),
-  createMission: vi.fn(),
-  updateMission: vi.fn(),
-  fetchMissionTasks: vi.fn().mockResolvedValue([]),
-  createMissionTask: vi.fn(),
-  updateMissionTask: vi.fn(),
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerMissionCommand(program);
-  return program;
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
-  process.chdir(projectDir);
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-  consoleStub.push(logSpy);
-});
-
-afterEach(() => {
-  // Restore only the per-test spies; module factory mocks keep their
-  // implementations across tests.
-  for (const stub of consoleStub) stub.mockRestore();
-  consoleStub = [];
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic mission --plan (thin adapter over PrdService)', () => {
-  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // PRD landed in the same store `mosaic prdy` uses.
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    // Fresh service instance (new-process equivalent) reads the linkage back.
-    const service = new PrdService({ projectPath: projectDir });
-    const docs = await service.list();
-    expect(docs).toHaveLength(1);
-
-    const prd = docs[0]!;
-    expect(prd.title).toBe('Plan Mission Alpha');
-    expect(prd.version).toBe(1);
-
-    const links = await service.listMissionLinks(prd.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: MISSION.id,
-      missionVersion: MISSION.updatedAt, // mission version marker
-      prdVersion: 1,
-    });
-
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
-  });
-
-  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
-    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
-
-    expect(persisted.missions).toHaveLength(1);
-    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
-  });
-
-  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
-    // Mission path.
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // prdy path (service, non-interactive entry).
-    const service = new PrdService({ projectPath: projectDir });
-    const direct = await service.create({ name: 'Directly Created' });
-
-    const all = await service.list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
-    expect(all).toHaveLength(2);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toContain(`${direct.id}.yaml`);
-
-    // Both are v1 in the same store with distinct stable ids.
-    for (const doc of all) {
-      expect(doc.version).toBe(1);
-      expect(files).toContain(`${doc.id}.yaml`);
-    }
-  });
-});
@@ -256,41 +256,14 @@ async function planMission(
  console.log(`Planning mission: ${mission.name}\n`);

  try {
-    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
-    // PrdService — no second writer path. The mission's updatedAt serves as
-    // its version marker (the gateway exposes no numeric mission version).
-    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-    const service = new PrdService({ projectPath: process.cwd() });
-
-    if (process.stdout.isTTY) {
-      const created = await runPrdWizard({
-        name: mission.name,
-        projectPath: process.cwd(),
-        interactive: true,
-      });
-      const linked = await service.linkMission({
-        prdId: created.id,
-        missionId: mission.id,
-        missionVersion: mission.updatedAt,
-        requirementIds: [],
-      });
-      console.log(
-        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
-      );
-      return;
-    }
-
-    const doc = await service.planForMission({
+    const { runPrdWizard } = await import('@mosaicstack/prdy');
+    await runPrdWizard({
      name: mission.name,
-      missionId: mission.id,
-      missionVersion: mission.updatedAt,
-      requirementIds: [],
+      projectPath: process.cwd(),
+      interactive: true,
    });
-    console.log(
-      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
-    );
  } catch (err) {
-    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
    process.exit(1);
  }
 }
@@ -1,204 +0,0 @@
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { stringify as stringifyYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerPrdyCommand } from './prdy.js';
-import { PrdService } from '@mosaicstack/prdy';
-
-// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
-//    outside the tmp project dir) ──────────────────────────────────────────────
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-class ProcessExitError extends Error {
-  constructor(readonly code: number) {
-    super(`process.exit(${code})`);
-  }
-}
-
-function stubProcessExit() {
-  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new ProcessExitError(code ?? 0);
-  }) as never);
-}
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let errorSpy: ReturnType<typeof vi.spyOn>;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let exitStub: ReturnType<typeof stubProcessExit>;
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerPrdyCommand(program);
-  return program;
-}
-
-function runPrdy(args: string[]): Promise<unknown> {
-  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
-}
-
-function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
-  return {
-    id: 'cmd-import-prd',
-    title: 'Command Import PRD',
-    status: 'approved', // must be forced to draft: validity is not approval
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
-  process.chdir(projectDir);
-  exitStub = stubProcessExit();
-  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-});
-
-afterEach(() => {
-  // Restore only the per-test spies: module factory mocks must keep their
-  // implementations for the next test.
-  exitStub.mockRestore();
-  errorSpy.mockRestore();
-  logSpy.mockRestore();
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic prdy (thin adapter over PrdService)', () => {
-  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
-    await runPrdy(['--init', 'Adapter Created']);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.title).toBe('Adapter Created');
-    expect(docs[0]?.version).toBe(1);
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
-  });
-
-  it('--import <file> creates a valid import through the service', async () => {
-    const filePath = path.join(projectDir, 'incoming.yaml');
-    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
-
-    await runPrdy(['--import', filePath]);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.id).toBe('cmd-import-prd');
-    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
-  });
-
-  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
-    const filePath = path.join(projectDir, 'broken.yaml');
-    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    // Typed refusal surfaced to the user, nothing created.
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
-    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Conflict Target' });
-    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
-    const beforeBytes = await readFile(storeFile, 'utf8');
-
-    const filePath = path.join(projectDir, 'divergent.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Divergent Command Import',
-        }),
-      ),
-      'utf8',
-    );
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
-
-    // Original authority document is byte-identical on disk.
-    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
-  });
-
-  it('--import --accept-successor persists the successor version explicitly', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Successor Target' });
-
-    const filePath = path.join(projectDir, 'divergent2.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Accepted Via CLI',
-        }),
-      ),
-      'utf8',
-    );
-
-    await runPrdy(['--import', filePath, '--accept-successor']);
-
-    const doc = await service.get(existing.id);
-    expect(doc.version).toBe(2);
-    expect(doc.title).toBe('Accepted Via CLI');
-    expect(doc.status).toBe('draft');
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
-  });
-
-  it('--export writes a labeled generated view and never touches authority', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const created = await service.create({ name: 'Export Via CLI' });
-    const before = await service.get(created.id);
-
-    await runPrdy(['--export', created.id]);
-
-    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
-    const md = await readFile(mdPath, 'utf8');
-    expect(md).toContain('generated view — do not edit');
-    expect(md).toContain(`prd-id: ${created.id}`);
-    expect(md).toContain('prd-version: 1');
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining(`Generated view written: ${mdPath}`),
-    );
-
-    // Authority unchanged by the export.
-    expect(await service.get(created.id)).toEqual(before);
-  });
-});
@@ -2,10 +2,6 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';

-/**
- * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
- * All reads/writes go through the service; there is no local writer path.
- */
 export function registerPrdyCommand(program: Command) {
  const cmd = program
    .command('prdy')
@@ -13,18 +9,12 @@ export function registerPrdyCommand(program: Command) {
    .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
    .option('--init [name]', 'Create a new PRD')
    .option('--update [name]', 'Update an existing PRD')
-    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
-    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
-    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
    .option('--project <idOrName>', 'Scope to project')
    .action(
      async (opts: {
        gateway: string;
        init?: string | boolean;
        update?: string | boolean;
-        import?: string;
-        acceptSuccessor?: boolean;
-        export?: string | boolean;
        project?: string;
      }) => {
        // Detect project context when --project flag is provided
@@ -41,69 +31,20 @@ export function registerPrdyCommand(program: Command) {
          }
        }

-        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-        const service = new PrdService({ projectPath: process.cwd() });
-
        try {
-          if (opts.import !== undefined) {
-            const input = { filePath: opts.import };
-
-            if (opts.acceptSuccessor) {
-              const successor = await service.acceptSuccessor(input);
-              console.log(
-                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
-              );
-              return;
-            }
-
-            const result = await service.importDocument(input);
-            console.log(
-              result.kind === 'created'
-                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
-                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
-            );
-            return;
-          }
-
-          if (opts.export !== undefined) {
-            const id =
-              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
-            const result = await service.exportMarkdown({ id });
-            console.log(
-              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
-            );
-            return;
-          }
-
+          const { runPrdWizard } = await import('@mosaicstack/prdy');
          const name =
            typeof opts.init === 'string'
              ? opts.init
              : typeof opts.update === 'string'
                ? opts.update
                : 'untitled';
-
-          if (process.stdout.isTTY) {
-            await runPrdWizard({
-              name,
-              projectPath: process.cwd(),
-              interactive: true,
-            });
-            return;
-          }
-
-          // Non-interactive fallback routes through the service directly.
-          const doc = await service.create({ name });
-          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
+          await runPrdWizard({
+            name,
+            projectPath: process.cwd(),
+            interactive: true,
+          });
        } catch (err) {
-          if (err instanceof Error && err.name === 'PrdImportConflictError') {
-            const conflict = err as { proposal?: { version?: number } };
-            console.error(`${err.message}`);
-            console.error(
-              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
-            );
-            process.exit(1);
-          }
-
          console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
          process.exit(1);
        }
@@ -1,6 +1,6 @@
 import { Command } from 'commander';

-import { PrdService } from './service.js';
+import { createPrd, listPrds, loadPrd } from './prd.js';
 import { runPrdWizard } from './wizard.js';

 interface InitCommandOptions {
@@ -18,22 +18,6 @@ interface ShowCommandOptions {
  readonly id?: string;
 }

-interface ImportCommandOptions {
-  readonly project: string;
-  readonly file: string;
-  readonly acceptSuccessor?: boolean;
-}
-
-interface ExportCommandOptions {
-  readonly project: string;
-  readonly id?: string;
-  readonly out?: string;
-}
-
-function serviceFor(project: string): PrdService {
-  return new PrdService({ projectPath: project });
-}
-
 export function buildPrdyCli(): Command {
  const program = new Command();
  program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -54,9 +38,11 @@ export function buildPrdyCli(): Command {
            template: options.template,
            interactive: true,
          })
-        : await serviceFor(options.project).create({
+        : await createPrd({
            name: options.name,
+            projectPath: options.project,
            template: options.template,
+            interactive: false,
          });

      console.log(
@@ -66,7 +52,6 @@ export function buildPrdyCli(): Command {
            id: doc.id,
            title: doc.title,
            status: doc.status,
-            version: doc.version,
            projectPath: doc.projectPath,
          },
          null,
@@ -80,7 +65,7 @@ export function buildPrdyCli(): Command {
    .description('List PRD documents for a project')
    .requiredOption('--project <path>', 'Project path')
    .action(async (options: ListCommandOptions) => {
-      const docs = await serviceFor(options.project).list();
+      const docs = await listPrds(options.project);
      console.log(JSON.stringify(docs, null, 2));
    });

@@ -90,65 +75,20 @@ export function buildPrdyCli(): Command {
    .requiredOption('--project <path>', 'Project path')
    .option('--id <id>', 'PRD document id')
    .action(async (options: ShowCommandOptions) => {
-      const doc = await serviceFor(options.project).get(options.id);
-      console.log(JSON.stringify(doc, null, 2));
-    });
+      if (options.id !== undefined) {
+        const docs = await listPrds(options.project);
+        const match = docs.find((doc) => doc.id === options.id);

-  prdy
-    .command('import')
-    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
-    .requiredOption('--project <path>', 'Project path')
-    .requiredOption('--file <file>', 'Path to YAML PRD document')
-    .option('--accept-successor', 'Accept a conflicted import as the next version')
-    .action(async (options: ImportCommandOptions) => {
-      const service = serviceFor(options.project);
-      const input = { filePath: options.file };
+        if (match === undefined) {
+          throw new Error(`PRD id not found: ${options.id}`);
+        }

-      if (options.acceptSuccessor) {
-        const successor = await service.acceptSuccessor(input);
-        console.log(
-          JSON.stringify(
-            {
-              ok: true,
-              outcome: 'successor-accepted',
-              id: successor.id,
-              version: successor.version,
-            },
-            null,
-            2,
-          ),
-        );
+        console.log(JSON.stringify(match, null, 2));
        return;
      }

-      const result = await service.importDocument(input);
-      console.log(
-        JSON.stringify(
-          {
-            ok: true,
-            outcome: result.kind,
-            id: result.document.id,
-            version: result.document.version,
-            status: result.document.status,
-          },
-          null,
-          2,
-        ),
-      );
-    });
-
-  prdy
-    .command('export')
-    .description('Render a PRD to a labeled generated-view Markdown file')
-    .requiredOption('--project <path>', 'Project path')
-    .option('--id <id>', 'PRD document id')
-    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
-    .action(async (options: ExportCommandOptions) => {
-      const result = await serviceFor(options.project).exportMarkdown({
-        id: options.id,
-        outPath: options.out,
-      });
-      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
+      const doc = await loadPrd(options.project);
+      console.log(JSON.stringify(doc, null, 2));
    });

  return program;
@@ -1,35 +1,12 @@
-// PrdService is the single authority surface for PRD documents. The raw store
-// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
-// goes through the service so there is no second writer path.
-export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
+export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
-export {
-  PrdService,
-  PRD_GENERATED_VIEW_LABEL,
-  PrdError,
-  PrdNotFoundError,
-  PrdUpdateError,
-  PrdImportInvalidError,
-  PrdImportConflictError,
-} from './service.js';
 export type {
  PrdStatus,
  PrdTemplate,
  PrdTemplateSection,
  PrdSection,
-  PrdMissionLinkage,
  PrdDocument,
  CreatePrdOptions,
-  PrdServiceOptions,
-  PrdCreateInput,
-  PrdSectionPatch,
-  PrdUpdateInput,
-  PrdLinkMissionInput,
-  PrdPlanForMissionInput,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
 } from './types.js';
@@ -17,49 +17,17 @@ const prdSectionSchema = z.object({
  fields: z.record(z.string(), z.string()),
 });

-const prdMissionLinkageSchema = z.object({
-  missionId: z.string().min(1),
-  missionVersion: z.string().min(1),
-  prdVersion: z.number().int().min(1),
-  requirementIds: z.array(z.string()),
-  linkedAt: z.string().datetime(),
-});
-
 const prdDocumentSchema = z.object({
  id: z.string().min(1),
  title: z.string().min(1),
  status: z.enum(['draft', 'review', 'approved', 'archived']),
  projectPath: z.string().min(1),
  template: z.string().min(1),
-  // Defaults keep documents written by older prdy versions loadable.
-  version: z.number().int().min(1).default(1),
  sections: z.array(prdSectionSchema),
-  missions: z.array(prdMissionLinkageSchema).default([]),
  createdAt: z.string().datetime(),
  updatedAt: z.string().datetime(),
 });

-/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
-function coerceTimestamps(value: unknown): unknown {
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  if (Array.isArray(value)) {
-    return value.map(coerceTimestamps);
-  }
-  if (typeof value === 'object' && value !== null) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
-    );
-  }
-  return value;
-}
-
-/** Validate an unknown value as a PRD document (throws zod errors on failure). */
-export function parsePrdDocument(value: unknown): PrdDocument {
-  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
-}
-
 function expandHome(projectPath: string): string {
  if (!projectPath.startsWith('~')) {
    return projectPath;
@@ -106,8 +74,6 @@ function prdDirectory(projectPath: string): string {
  return path.join(projectPath, PRD_DIRECTORY);
 }

-export { prdDirectory };
-
 function prdFilePath(projectPath: string, id: string): string {
  return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -147,13 +113,11 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
    status: 'draft',
    projectPath: resolvedProjectPath,
    template: template.id,
-    version: 1,
    sections: template.sections.map((section) => ({
      id: section.id,
      title: section.title,
      fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
    })),
-    missions: [],
    createdAt: now,
    updatedAt: now,
  };
@@ -226,7 +190,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
      throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
    }

-    const document = parsePrdDocument(parsed);
+    const document = prdDocumentSchema.parse(parsed);
    documents.push(document);
  }

@@ -1,433 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-import { beforeEach, describe, expect, it } from 'vitest';
-
-import {
-  PRD_GENERATED_VIEW_LABEL,
-  PrdImportConflictError,
-  PrdImportInvalidError,
-  PrdNotFoundError,
-  PrdService,
-  PrdUpdateError,
-} from './index.js';
-import type { PrdDocument } from './index.js';
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-let projectDir: string;
-
-async function makeProject(): Promise<string> {
-  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
-}
-
-function service(): PrdService {
-  return new PrdService({ projectPath: projectDir });
-}
-
-function storeDir(): string {
-  return path.join(projectDir, 'docs', 'prdy');
-}
-
-/** Handcraft a full, schema-valid PRD document for import scenarios. */
-function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
-  return {
-    id: 'imported-prd-20260101-000000',
-    title: 'Imported PRD',
-    status: 'draft',
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
-      {
-        id: 'scope-non-goals',
-        title: 'Scope / Non-Goals',
-        fields: { inScope: '', outOfScope: '' },
-      },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-async function writeImportFile(doc: PrdDocument): Promise<string> {
-  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
-  await writeFile(filePath, yaml.dump(doc), 'utf8');
-  return filePath;
-}
-
-beforeEach(async () => {
-  projectDir = await makeProject();
-});
-
-// ── Single authority store (AC: prdy path and mission path resolve to the
-//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
-
-describe('PrdService single authority store', () => {
-  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
-    const direct = await service().create({ name: 'Direct PRD' });
-    const viaMission = await service().planForMission({
-      name: 'Mission PRD',
-      missionId: 'mission-1',
-      missionVersion: '2026-01-01T00:00:00.000Z',
-    });
-
-    const files = await readdir(storeDir());
-    expect(files).toContain(`${direct.id}.yaml`);
-    expect(files).toContain(`${viaMission.id}.yaml`);
-
-    // A fresh service instance (new process equivalent) resolves both.
-    const all = await service().list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
-
-    // Stable versions: creation is v1; linkage writes do not bump content version.
-    expect((await service().get(direct.id)).version).toBe(1);
-    expect((await service().get(viaMission.id)).version).toBe(1);
-  });
-
-  it('round-trips documents through the store with identity intact', async () => {
-    const created = await service().create({ name: 'Round Trip', template: 'feature' });
-    const fresh = await service().get(created.id);
-
-    expect(fresh).toEqual(created);
-    expect(fresh.id).toBe(created.id);
-    expect(fresh.template).toBe('feature');
-    expect(fresh.status).toBe('draft');
-  });
-
-  it('throws a typed error for unknown ids and empty stores', async () => {
-    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
-    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── Mission linkage persistence (AC: linkage survives restart via fresh
-//    service instances) ────────────────────────────────────────────────────────
-
-describe('PrdService mission linkage', () => {
-  it('persists linkage and reads it back from a fresh service instance', async () => {
-    const created = await service().planForMission({
-      name: 'Linked PRD',
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Fresh instance — nothing in memory from the creating call.
-    const links = await service().listMissionLinks(created.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      prdVersion: 1,
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Linkage is carried in the YAML authority file itself.
-    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    const persisted = yaml.load(raw) as PrdDocument;
-    expect(persisted.missions[0]?.missionId).toBe('mission-42');
-    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
-  });
-
-  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
-    const created = await service().planForMission({
-      name: 'Relink PRD',
-      missionId: 'mission-7',
-      missionVersion: 'v1',
-    });
-
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
-    });
-
-    const relinked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'mission-7',
-      missionVersion: 'v2',
-      requirementIds: ['NFR-1'],
-    });
-
-    expect(relinked.missions).toHaveLength(1);
-    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
-  });
-
-  it('does not bump the content version when writing linkage', async () => {
-    const created = await service().create({ name: 'Stable Version' });
-    const linked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'm',
-      missionVersion: 'v1',
-    });
-    expect(linked.version).toBe(1);
-  });
-});
-
-// ── Update semantics ──────────────────────────────────────────────────────────
-
-describe('PrdService update', () => {
-  it('applies section patches and bumps the content version', async () => {
-    const created = await service().create({ name: 'Updatable' });
-    const updated = await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
-    });
-
-    expect(updated.version).toBe(2);
-    expect(updated.sections[0]?.fields).toMatchObject({
-      context: 'Some context',
-      objective: 'Goal',
-    });
-    expect((await service().get(created.id)).version).toBe(2);
-  });
-
-  it('refuses unknown section ids with a typed error', async () => {
-    const created = await service().create({ name: 'Strict' });
-    await expect(
-      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
-    ).rejects.toBeInstanceOf(PrdUpdateError);
-  });
-});
-
-// ── Markdown export is a labeled generated view, never authority ──────────────
-
-describe('PrdService exportMarkdown', () => {
-  it('writes a generated view carrying the label and source identity', async () => {
-    const created = await service().create({ name: 'Exported PRD' });
-    const result = await service().exportMarkdown({ id: created.id });
-
-    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
-    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
-    expect(result.content).toContain(`prd-id: ${created.id}`);
-    expect(result.content).toContain('prd-version: 1');
-    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
-  });
-
-  it('reflects the current version after updates', async () => {
-    const created = await service().create({ name: 'Versioned Export' });
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
-    });
-    const result = await service().exportMarkdown({ id: created.id });
-    expect(result.content).toContain('prd-version: 2');
-  });
-
-  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
-    const created = await service().create({ name: 'Guarded PRD' });
-    const before = structuredClone(await service().get(created.id));
-
-    const result = await service().exportMarkdown({ id: created.id });
-    await writeFile(
-      result.filePath,
-      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
-      'utf8',
-    );
-
-    const after = await service().get(created.id);
-    expect(after).toEqual(before);
-    expect(after.version).toBe(1);
-    expect(after.title).toBe(before.title);
-  });
-
-  it('never parses Markdown files that sit in the store directory', async () => {
-    const created = await service().create({ name: 'Decoy Guard' });
-
-    // A decoy .md file with invalid YAML must be invisible to the store.
-    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
-    // And a decoy .yaml-named Markdown body must not silently validate either.
-    await service().exportMarkdown({ id: created.id });
-
-    const listed = await service().list();
-    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
-    await expect(service().get(created.id)).resolves.toBeTruthy();
-  });
-});
-
-// ── Import: validated, conflict-aware, never silently merging ─────────────────
-
-describe('PrdService importDocument', () => {
-  it('creates a valid import through the service, as draft — validity is not approval', async () => {
-    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
-
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('created');
-    expect(result.document.id).toBe('imported-prd-20260101-000000');
-    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
-    expect(result.document.version).toBe(1);
-
-    const persisted = await service().get('imported-prd-20260101-000000');
-    expect(persisted.status).toBe('draft');
-
-    const files = await readdir(storeDir());
-    expect(files).toContain('imported-prd-20260101-000000.yaml');
-  });
-
-  it('reports identical content as a no-op without writing', async () => {
-    const created = await service().create({ name: 'Existing PRD' });
-    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-
-    const filePath = await writeImportFile(importFixture({ ...created }));
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('identical');
-    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    expect(after).toBe(before);
-  });
-
-  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
-    const existing = await service().create({ name: 'Authority PRD' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-      requirementIds: ['FR-0'],
-    });
-    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Divergent Title',
-      sections: [
-        {
-          id: 'introduction',
-          title: 'Introduction',
-          fields: { context: 'changed', objective: '' },
-        },
-      ],
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const attempt = service().importDocument({ filePath });
-    let caught: unknown;
-    try {
-      await attempt;
-    } catch (error) {
-      caught = error;
-    }
-    expect(caught).toBeInstanceOf(PrdImportConflictError);
-
-    const error = caught as PrdImportConflictError;
-    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
-    expect(error.existing.id).toBe(existing.id);
-    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
-    expect(error.proposal.status).toBe('draft');
-
-    // Original authority content untouched on disk.
-    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-    expect(afterBytes).toBe(beforeBytes);
-  });
-
-  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
-    const existing = await service().create({ name: 'Successor Base' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-    });
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Accepted Successor Title',
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const successor = await service().acceptSuccessor({ filePath });
-    expect(successor.id).toBe(existing.id);
-    expect(successor.version).toBe(existing.version + 1);
-    expect(successor.title).toBe('Accepted Successor Title');
-    expect(successor.status).toBe('draft');
-    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
-
-    // Persisted for a fresh reader.
-    const fresh = await service().get(existing.id);
-    expect(fresh.version).toBe(2);
-    expect(fresh.title).toBe('Accepted Successor Title');
-  });
-
-  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
-    const cases: Array<{ name: string; body: string }> = [
-      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
-      {
-        name: 'bad-status.yaml',
-        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
-      },
-      {
-        name: 'bad-version.yaml',
-        body: yaml.dump(importFixture({ version: 0 })),
-      },
-      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
-    ];
-
-    for (const fixture of cases) {
-      const filePath = path.join(projectDir, fixture.name);
-      await writeFile(filePath, fixture.body, 'utf8');
-
-      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
-        PrdImportInvalidError,
-      );
-    }
-
-    // Nothing was created: the authority store does not even exist yet.
-    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
-    const filePath = await writeImportFile(importFixture());
-    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── No second writer: no code path reads exported Markdown back into authority ─
-
-describe('no-second-writer invariant (source-level)', () => {
-  // Resolve the package source dir whether vitest runs from the package root
-  // (turbo/pnpm test) or from the worktree root.
-  function resolveSrcDir(): string {
-    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
-    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
-  }
-
-  const srcDir = resolveSrcDir();
-  const sourceFiles = [
-    'cli.ts',
-    'index.ts',
-    'prd.ts',
-    'service.ts',
-    'templates.ts',
-    'types.ts',
-    'wizard.ts',
-  ];
-
-  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
-    for (const file of sourceFiles) {
-      const text = await readFile(path.join(srcDir, file), 'utf8');
-      const readLines = text
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
-
-      for (const line of readLines) {
-        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
-      }
-    }
-  });
-
-  it('the mosaic prdy/mission adapters never read a .md file', async () => {
-    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
-    for (const file of ['prdy.ts', 'mission.ts']) {
-      const text = await readFile(path.join(adapterDir, file), 'utf8');
-      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
-        false,
-      );
-    }
-  });
-});
@@ -1,379 +0,0 @@
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-
-import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
-import type {
-  PrdCreateInput,
-  PrdDocument,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
-  PrdLinkMissionInput,
-  PrdMissionLinkage,
-  PrdPlanForMissionInput,
-  PrdServiceOptions,
-  PrdUpdateInput,
-} from './types.js';
-
-/**
- * PrdService is the SINGLE authority surface for PRD documents.
- *
- * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
- * through this service; the YAML store under `docs/prdy/` is the authority and
- * exported Markdown is a generated view that no code path reads back.
- */
-
-// ── Typed errors ───────────────────────────────────────────────────────────────
-
-export class PrdError extends Error {
-  constructor(
-    message: string,
-    readonly code: string,
-  ) {
-    super(message);
-    this.name = 'PrdError';
-  }
-}
-
-export class PrdNotFoundError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_NOT_FOUND');
-    this.name = 'PrdNotFoundError';
-  }
-}
-
-export class PrdUpdateError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_UPDATE_INVALID');
-    this.name = 'PrdUpdateError';
-  }
-}
-
-/** Structural refusal: the import payload failed schema validation. Nothing is written. */
-export class PrdImportInvalidError extends PrdError {
-  constructor(
-    message: string,
-    readonly issues?: string,
-  ) {
-    super(message, 'PRD_IMPORT_INVALID');
-    this.name = 'PrdImportInvalidError';
-  }
-}
-
-/**
- * Conflict refusal: an existing PRD shares the imported id but the content
- * diverges. Carries a PROPOSED successor (existing version + 1) that is only
- * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
- * never overwrites and never merges.
- */
-export class PrdImportConflictError extends PrdError {
-  constructor(
-    message: string,
-    readonly existing: PrdDocument,
-    readonly proposal: PrdDocument,
-  ) {
-    super(message, 'PRD_IMPORT_CONFLICT');
-    this.name = 'PrdImportConflictError';
-  }
-}
-
-// ── Service ────────────────────────────────────────────────────────────────────
-
-/** The generated-view label carried by every Markdown export. */
-export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
-
-export class PrdService {
-  private readonly projectPath: string;
-
-  constructor(options: PrdServiceOptions) {
-    this.projectPath = options.projectPath;
-  }
-
-  /** Create a new PRD (version 1, draft) in the authority store. */
-  async create(input: PrdCreateInput): Promise<PrdDocument> {
-    return createPrd({
-      name: input.name,
-      projectPath: this.projectPath,
-      template: input.template,
-      interactive: false,
-    });
-  }
-
-  /** Read a PRD by id, or the most recently updated one. */
-  async get(id?: string): Promise<PrdDocument> {
-    const documents = await listPrds(this.projectPath);
-
-    if (id === undefined) {
-      const latest = documents[0];
-      if (latest === undefined) {
-        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
-      }
-      return latest;
-    }
-
-    const match = documents.find((doc) => doc.id === id);
-    if (match === undefined) {
-      throw new PrdNotFoundError(`PRD id not found: ${id}`);
-    }
-    return match;
-  }
-
-  /** List all PRDs in the authority store (most recently updated first). */
-  async list(): Promise<PrdDocument[]> {
-    return listPrds(this.projectPath);
-  }
-
-  /**
-   * Apply section field patches and bump the content version.
-   * Linkage entries are preserved; linkage writes do NOT bump the version.
-   */
-  async update(input: PrdUpdateInput): Promise<PrdDocument> {
-    const doc = await this.get(input.id);
-
-    for (const patch of input.sections) {
-      const section = doc.sections.find((candidate) => candidate.id === patch.id);
-      if (section === undefined) {
-        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
-      }
-      for (const [field, value] of Object.entries(patch.fields)) {
-        if (!(field in section.fields)) {
-          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
-        }
-        section.fields[field] = value;
-      }
-    }
-
-    doc.version += 1;
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  /**
-   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
-   * Persisted in the YAML authority, so it survives restarts.
-   */
-  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const doc = await this.get(input.prdId);
-    return this.applyLinkage(doc, input);
-  }
-
-  /** Read back the mission linkages recorded on a PRD. */
-  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
-    const doc = await this.get(prdId);
-    return doc.missions;
-  }
-
-  /**
-   * Mission planning path: create a PRD for a mission AND persist the
-   * mission↔PRD linkage in a single authority write.
-   */
-  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
-    const doc = await this.create({ name: input.name, template: input.template });
-    return this.applyLinkage(doc, {
-      prdId: doc.id,
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      requirementIds: input.requirementIds,
-    });
-  }
-
-  /**
-   * Render the PRD to a Markdown GENERATED VIEW.
-   *
-   * The output carries source identity (PRD id + version + generated-view
-   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
-   * the authority store only loads `.yaml`/`.yml` files, and no code path in
-   * this package parses the exported Markdown.
-   */
-  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
-    const doc = await this.get(input?.id);
-    const content = renderMarkdown(doc);
-    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
-
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, content, 'utf8');
-    return { filePath, content };
-  }
-
-  /**
-   * Import a YAML PRD document.
-   *
-   * Structural validation (zod) happens BEFORE anything is proposed or
-   * written. A structurally-valid import is persisted as `draft` — validity is
-   * NOT approval. If an existing PRD shares the id with divergent content, a
-   * typed {@link PrdImportConflictError} is thrown carrying a proposed
-   * successor; the original authority document is left byte-identical on disk.
-   */
-  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      const document = this.buildImportedDocument(incoming);
-      await savePrd(document);
-      return { kind: 'created', document };
-    }
-
-    if (canonicalCore(existing) === canonicalCore(incoming)) {
-      return { kind: 'identical', document: existing };
-    }
-
-    throw new PrdImportConflictError(
-      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
-        `Proposed successor: version ${existing.version + 1} (draft). ` +
-        `Accept explicitly with acceptSuccessor().`,
-      existing,
-      this.buildSuccessor(existing, incoming),
-    );
-  }
-
-  /**
-   * Explicitly accept a conflicted import as a successor version of the
-   * existing PRD. Re-validates the source file before writing; the successor
-   * is persisted with status `draft` (acceptance of the import is not approval
-   * of the PRD) and the existing mission linkages are carried forward.
-   */
-  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      throw new PrdNotFoundError(
-        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
-      );
-    }
-
-    const successor = this.buildSuccessor(existing, incoming);
-    await savePrd(successor);
-    return successor;
-  }
-
-  // ── internals ──────────────────────────────────────────────────────────────
-
-  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const entry: PrdMissionLinkage = {
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      prdVersion: doc.version,
-      requirementIds: input.requirementIds ?? [],
-      linkedAt: new Date().toISOString(),
-    };
-
-    // One entry per mission: refresh in place if the mission is already linked.
-    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
-    if (index === -1) {
-      doc.missions.push(entry);
-    } else {
-      doc.missions[index] = entry;
-    }
-
-    // Linkage is mission-side metadata, not a content revision: bump the
-    // timestamp only so ids/versions stay stable for consumers.
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  private async readImportFile(filePath: string): Promise<PrdDocument> {
-    let raw: string;
-    try {
-      raw = await fs.readFile(filePath, 'utf8');
-    } catch (error) {
-      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
-    }
-
-    let parsed: unknown;
-    try {
-      parsed = yaml.load(raw);
-    } catch (error) {
-      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
-    }
-
-    try {
-      return parsePrdDocument(parsed);
-    } catch (error) {
-      throw new PrdImportInvalidError(
-        `Import file failed PRD schema validation: ${filePath}`,
-        error instanceof Error ? error.message : String(error),
-      );
-    }
-  }
-
-  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
-    const now = new Date().toISOString();
-    return {
-      ...incoming,
-      // The import lands in THIS project's authority store.
-      projectPath: this.projectPath,
-      // A structurally-valid import is not thereby approved.
-      status: 'draft',
-      version: 1,
-      missions: [],
-      createdAt: now,
-      updatedAt: now,
-    };
-  }
-
-  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
-    return {
-      ...incoming,
-      id: existing.id,
-      projectPath: existing.projectPath,
-      status: 'draft',
-      version: existing.version + 1,
-      missions: existing.missions,
-      createdAt: existing.createdAt,
-      updatedAt: new Date().toISOString(),
-    };
-  }
-}
-
-// ── Markdown rendering (generated view) ───────────────────────────────────────
-
-function canonicalCore(doc: PrdDocument): string {
-  return JSON.stringify([doc.title, doc.template, doc.sections]);
-}
-
-function renderMarkdown(doc: PrdDocument): string {
-  const lines: string[] = [
-    '<!--',
-    `${PRD_GENERATED_VIEW_LABEL}`,
-    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
-    `prd-id: ${doc.id}`,
-    `prd-version: ${doc.version}`,
-    `generated-at: ${new Date().toISOString()}`,
-    '-->',
-    '',
-    `# ${doc.title}`,
-    '',
-    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
-    '',
-  ];
-
-  if (doc.missions.length > 0) {
-    lines.push('## Mission Linkage', '');
-    for (const mission of doc.missions) {
-      const requirements =
-        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
-      lines.push(
-        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
-          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
-      );
-    }
-    lines.push('');
-  }
-
-  for (const section of doc.sections) {
-    lines.push(`## ${section.title}`, '');
-    for (const [field, value] of Object.entries(section.fields)) {
-      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
-    }
-  }
-
-  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
-  return lines.join('\n');
-}
@@ -19,31 +19,13 @@ export interface PrdSection {
  fields: Record<string, string>;
 }

-/**
- * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
- *
- * `missionVersion` is the mission-side revision marker available to the CLI
- * (the gateway exposes `updatedAt` for missions — there is no numeric mission
- * version yet). `prdVersion` snapshots the PRD content version at link time.
- */
-export interface PrdMissionLinkage {
-  missionId: string;
-  missionVersion: string;
-  prdVersion: number;
-  requirementIds: string[];
-  linkedAt: string;
-}
-
 export interface PrdDocument {
  id: string;
  title: string;
  status: PrdStatus;
  projectPath: string;
  template: string;
-  /** Content revision counter. Bumped by updates and accepted imports. */
-  version: number;
  sections: PrdSection[];
-  missions: PrdMissionLinkage[];
  createdAt: string;
  updatedAt: string;
 }
@@ -54,60 +36,3 @@ export interface CreatePrdOptions {
  template?: string;
  interactive?: boolean;
 }
-
-// ── PrdService surface (single authority entry point) ─────────────────────────
-
-export interface PrdServiceOptions {
-  projectPath: string;
-}
-
-export interface PrdCreateInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdSectionPatch {
-  id: string;
-  fields: Record<string, string>;
-}
-
-export interface PrdUpdateInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  sections: PrdSectionPatch[];
-}
-
-export interface PrdLinkMissionInput {
-  /** Defaults to the most recently updated PRD. */
-  prdId?: string;
-  missionId: string;
-  missionVersion: string;
-  requirementIds?: string[];
-}
-
-export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdExportInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  /** Override the generated-view output path. */
-  outPath?: string;
-}
-
-export interface PrdExportResult {
-  filePath: string;
-  content: string;
-}
-
-/** Discriminated result of a non-conflicting import. */
-export type PrdImportResult =
-  | { kind: 'created'; document: PrdDocument }
-  | { kind: 'identical'; document: PrdDocument };
-
-export interface PrdImportInput {
-  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
-  filePath: string;
-}
@@ -2,8 +2,8 @@ import path from 'node:path';

 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';

-import { PrdService } from './service.js';
-import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';
+import { createPrd, savePrd } from './prd.js';
+import type { CreatePrdOptions, PrdDocument } from './types.js';

 interface WizardAnswers {
  goals: string;
@@ -11,41 +11,20 @@ interface WizardAnswers {
  milestones: string;
 }

-/**
- * Translate wizard answers into section patches using the same keyword
- * matching the wizard always used (first section whose id contains the
- * keyword, then first field whose name contains it, else first field).
- */
-function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
-  const bySection = new Map<string, PrdSectionPatch>();
+function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
+  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));

-  const add = (keyword: string, value: string): void => {
-    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
-    if (section === undefined) {
-      return;
-    }
+  if (section === undefined) {
+    return;
+  }

-    const fieldName =
-      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
-      Object.keys(section.fields)[0];
+  const fieldName =
+    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
+    Object.keys(section.fields)[0];

-    if (fieldName === undefined || section.fields[fieldName] === value) {
-      return;
-    }
-
-    const existing = bySection.get(section.id);
-    if (existing === undefined) {
-      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
-    } else {
-      existing.fields[fieldName] = value;
-    }
-  };
-
-  add('goal', answers.goals);
-  add('constraint', answers.constraints);
-  add('milestone', answers.milestones);
-
-  return [...bySection.values()];
+  if (fieldName !== undefined) {
+    section.fields[fieldName] = value;
+  }
 }

 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -84,10 +63,15 @@ async function promptTemplate(template?: string): Promise<string> {
  return choice;
 }

-/**
- * Interactive PRD wizard. All writes go through PrdService — the wizard is a
- * prompt layer, never a second writer path.
- */
+function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
+  updateSectionField(doc, 'goal', answers.goals);
+  updateSectionField(doc, 'constraint', answers.constraints);
+  updateSectionField(doc, 'milestone', answers.milestones);
+
+  doc.updatedAt = new Date().toISOString();
+  return doc;
+}
+
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
  intro('Mosaic PRD wizard');

@@ -98,15 +82,20 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
  const constraints = await promptText('Key constraints');
  const milestones = await promptText('Planned milestones');

-  const service = new PrdService({ projectPath: options.projectPath });
-  const doc = await service.create({
+  const doc = await createPrd({
+    ...options,
    name,
    template,
+    interactive: true,
  });

-  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
-  const updated =
-    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;
+  const updated = applyWizardAnswers(doc, {
+    goals,
+    constraints,
+    milestones,
+  });
+
+  await savePrd(updated);

  outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);

@@ -1,37 +0,0 @@
-# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
-
- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
-  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
-  Markdown export is a labeled generated view (never read back); import is
-  validated/conflict-aware with typed refusals.
- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
-  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
-  root build rc=0.
- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
-  typed errors (3) wizard/cli route through service (4) mosaic adapters
-  (5) contract specs both packages (6) gates (7) sabotage control (8) report
-  to /var/tmp/ri-050/ri-4-001-report.md.
- Decisions:
-  - Linkage lives ON the PRD document (`missions` array) — one authority file,
-    survives restart, no sidecar sync problems.
-  - `version` = content revision of sections/status (bumped by update/import
-    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
-    for the card's "stable ids/versions" contract.
-  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
-    numeric version field).
-  - Import reads YAML documents only — never the exported Markdown (keeps the
-    "no code path reads exported Markdown" invariant).
-  - Import of an existing id with identical core content → `identical` no-op;
-    divergent → typed `PrdImportConflictError` carrying proposed successor
-    (existing.version + 1, status draft, linkages preserved). Original bytes
-    untouched until explicit `acceptSuccessor`.
-  - `requirementIds` default `[]` at the mission command (no requirement
-    selection UI yet) — service accepts ids when a caller has them.
- Progress log:
-  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
-  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
-  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
-  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
-  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
-  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
-  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete
Author	SHA1	Message	Date
goals	3af594590a	fix(#1264 ): preserve portable standalone launch ci/woodpecker/pr/ci Pipeline failed Details	2026-08-16 19:01:26 -05:00
goals	9dc90be7e1	fix(#1264 ): harden unattended identity bootstrap ci/woodpecker/pr/ci Pipeline failed Details	2026-08-16 18:33:39 -05:00
goals	43fa047787	fix(#1264 ): bootstrap fleet identity without a TTY ci/woodpecker/pr/ci Pipeline failed Details	2026-08-16 17:37:32 -05:00