fix(macp): fail-closed typed gate states — no placeholder/empty-command passes (#1275 )

RI-N2 / SDLC-D-035. Every GateResult now carries a typed status discriminator (passed|failed|simulated|waiting|capability_failure); passed:true remains true only for really-executed, really-green gates. - ci-pipeline without a CI provider → capability_failure (MACP_NO_CI_PIPELINE), never the placeholder pass - empty-command gate → capability_failure (MACP_NO_COMMAND / MACP_NO_REVIEWER), and runGates no longer silently skips it - manual gate type waits (MACP_AUTHORITY_REQUIRED) — neither pass nor fail - explicit simulation only (simulate option / --simulate): typed simulated results can never make the aggregate passed (RunGatesResult.state) - CLI stubs (tasks list, submit, events tail) exit nonzero with typed MACP_NOT_IMPLEMENTED; macp gate is now wired to runGates with --simulate - legacy __tests__/gate-runner.test.ts consolidated into src/gate-runner.spec.ts (root eslint project service does not cover packages/macp/__tests__)
2026-08-17 16:40:16 -05:00
20 changed files with 1018 additions and 1854 deletions
@@ -1,253 +0,0 @@
-import { mkdirSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { randomUUID } from 'node:crypto';
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { normalizeGate, countAIFindings, runGate, runGates } from '../src/gate-runner.js';
-
-function makeTmpDir(): string {
-  const dir = join(tmpdir(), `macp-gate-${randomUUID()}`);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-describe('normalizeGate', () => {
-  it('normalizes a string to mechanical gate', () => {
-    expect(normalizeGate('echo test')).toEqual({
-      command: 'echo test',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('normalizes an object gate with defaults', () => {
-    expect(normalizeGate({ command: 'lint' })).toEqual({
-      command: 'lint',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('preserves explicit type and fail_on', () => {
-    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
-      command: 'review',
-      type: 'ai-review',
-      fail_on: 'any',
-    });
-  });
-
-  it('handles non-string/non-object input', () => {
-    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-  });
-});
-
-describe('countAIFindings', () => {
-  it('returns zeros for non-object', () => {
-    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
-  });
-
-  it('counts from stats block', () => {
-    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
-  });
-
-  it('counts from findings array when stats has no blockers', () => {
-    const output = {
-      stats: { blockers: 0 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
-  });
-
-  it('uses stats blockers over findings array when stats has blockers', () => {
-    const output = {
-      stats: { blockers: 5 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
-    };
-    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
-    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
-  });
-
-  it('counts findings length as total when stats has zero total', () => {
-    const output = {
-      findings: [{ severity: 'warning' }, { severity: 'info' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
-  });
-});
-
-describe('runGate', () => {
-  let tmp: string;
-  let logPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = join(tmp, 'gate.log');
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('passes mechanical gate on exit 0', () => {
-    const result = runGate('echo hello', tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.exit_code).toBe(0);
-    expect(result.type).toBe('mechanical');
-    expect(result.output).toContain('hello');
-  });
-
-  it('fails mechanical gate on non-zero exit', () => {
-    const result = runGate('exit 1', tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.exit_code).toBe(1);
-  });
-
-  it('ci-pipeline always passes', () => {
-    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.type).toBe('ci-pipeline');
-    expect(result.output).toBe('CI pipeline gate placeholder');
-  });
-
-  it('empty command passes', () => {
-    const result = runGate({ command: '' }, tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-  });
-
-  it('ai-review gate parses JSON output', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.blockers).toBe(0);
-    expect(result.findings).toBe(1);
-  });
-
-  it('ai-review gate fails on blockers', () => {
-    const json = JSON.stringify({ stats: { blockers: 2 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.blockers).toBe(2);
-  });
-
-  it('ai-review gate with fail_on=any fails on any findings', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate(
-      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
-      tmp,
-      logPath,
-      30,
-    );
-    expect(result.passed).toBe(false);
-    expect(result.fail_on).toBe('any');
-  });
-
-  it('ai-review gate fails on invalid JSON output', () => {
-    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.parse_error).toBeDefined();
-  });
-
-  it('writes to log file', () => {
-    runGate('echo logged', tmp, logPath, 30);
-    const log = readFileSync(logPath, 'utf-8');
-    expect(log).toContain('COMMAND: echo logged');
-    expect(log).toContain('logged');
-    expect(log).toContain('EXIT:');
-  });
-});
-
-describe('runGates', () => {
-  let tmp: string;
-  let logPath: string;
-  let eventsPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = join(tmp, 'gates.log');
-    eventsPath = join(tmp, 'events.ndjson');
-  });
-
-  afterEach(() => {
-    rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('runs multiple gates and returns results', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo one', 'echo two'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-1',
-    );
-    expect(allPassed).toBe(true);
-    expect(gateResults).toHaveLength(2);
-  });
-
-  it('reports failure when any gate fails', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo ok', 'exit 1'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-2',
-    );
-    expect(allPassed).toBe(false);
-    expect(gateResults[0]!.passed).toBe(true);
-    expect(gateResults[1]!.passed).toBe(false);
-  });
-
-  it('emits events for each gate', () => {
-    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
-    const events = readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    expect(events).toHaveLength(2); // started + passed
-    expect(events[0].event_type).toBe('rail.check.started');
-    expect(events[1].event_type).toBe('rail.check.passed');
-  });
-
-  it('skips gates with empty command (non ci-pipeline)', () => {
-    const { gateResults } = runGates(
-      [{ command: '', type: 'mechanical' }, 'echo real'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-4',
-    );
-    expect(gateResults).toHaveLength(1);
-  });
-
-  it('does not skip ci-pipeline even with empty command', () => {
-    const { gateResults } = runGates(
-      [{ command: '', type: 'ci-pipeline' }],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-5',
-    );
-    expect(gateResults).toHaveLength(1);
-    expect(gateResults[0]!.passed).toBe(true);
-  });
-
-  it('emits failed event with correct message', () => {
-    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
-    const events = readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    const failEvent = events.find(
-      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
-    );
-    expect(failEvent).toBeDefined();
-    expect(failEvent.message).toContain('Gate failed (');
-  });
-});
@@ -1,5 +1,8 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach, beforeEach, vi } from 'vitest';
 import { Command } from 'commander';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { registerMacpCommand } from './cli.js';

 describe('registerMacpCommand', () => {
@@ -75,3 +78,162 @@ describe('registerMacpCommand', () => {
    expect(topLevel).toContain('events');
  });
 });
+
+/**
+ * RI-N2 fail-closed CLI behavior: an unimplemented capability is a failure,
+ * never a success. Every stub exits nonzero with a typed message, and the
+ * implemented `macp gate` mirrors the typed gate-runner states.
+ */
+describe('registerMacpCommand fail-closed (RI-N2)', () => {
+  let tmpDir: string;
+
+  function buildProgram(): Command {
+    const program = new Command();
+    program.exitOverride();
+    program.configureOutput({ writeErr: () => {} });
+    registerMacpCommand(program);
+    return program;
+  }
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'macp-cli-failclosed-'));
+    process.exitCode = 0;
+  });
+
+  afterEach(() => {
+    process.exitCode = 0;
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it('macp tasks list exits nonzero (unimplemented capability)', async () => {
+    const program = buildProgram();
+    await program.parseAsync(['macp', 'tasks', 'list'], { from: 'user' });
+    expect(process.exitCode).not.toBe(0);
+  });
+
+  it('macp submit exits nonzero with a typed MACP_NOT_IMPLEMENTED message', async () => {
+    const program = buildProgram();
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      await program.parseAsync(['macp', 'submit', 'spec.json'], { from: 'user' });
+      expect(process.exitCode).not.toBe(0);
+      const errText = errSpy.mock.calls.map((c) => String(c[0])).join('\n');
+      expect(errText).toContain('MACP_NOT_IMPLEMENTED');
+    } finally {
+      errSpy.mockRestore();
+    }
+  });
+
+  it('macp events tail exits nonzero (unimplemented capability)', async () => {
+    const program = buildProgram();
+    await program.parseAsync(['macp', 'events', 'tail'], { from: 'user' });
+    expect(process.exitCode).not.toBe(0);
+  });
+
+  it('macp gate runs a green inline command and exits 0', async () => {
+    const program = buildProgram();
+    await program.parseAsync(
+      [
+        'macp',
+        'gate',
+        'exit 0',
+        '--cwd',
+        tmpDir,
+        '--log',
+        path.join(tmpDir, 'g.log'),
+        '--timeout',
+        '10',
+      ],
+      { from: 'user' },
+    );
+    expect(process.exitCode).toBe(0);
+  });
+
+  it('macp gate exits nonzero on a failing command', async () => {
+    const program = buildProgram();
+    await program.parseAsync(
+      [
+        'macp',
+        'gate',
+        'exit 9',
+        '--cwd',
+        tmpDir,
+        '--log',
+        path.join(tmpDir, 'g.log'),
+        '--timeout',
+        '10',
+      ],
+      { from: 'user' },
+    );
+    expect(process.exitCode).not.toBe(0);
+  });
+
+  it('macp gate with an unimplemented ci-pipeline capability exits nonzero', async () => {
+    const program = buildProgram();
+    const specPath = path.join(tmpDir, 'gates.json');
+    fs.writeFileSync(specPath, JSON.stringify([{ type: 'ci-pipeline' }]));
+    await program.parseAsync(
+      [
+        'macp',
+        'gate',
+        specPath,
+        '--cwd',
+        tmpDir,
+        '--log',
+        path.join(tmpDir, 'g.log'),
+        '--timeout',
+        '10',
+      ],
+      { from: 'user' },
+    );
+    expect(process.exitCode).not.toBe(0);
+  });
+
+  it('macp gate --simulate completes (exit 0) but reports simulated results', async () => {
+    const program = buildProgram();
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    try {
+      await program.parseAsync(
+        [
+          'macp',
+          'gate',
+          'exit 0',
+          '--simulate',
+          '--cwd',
+          tmpDir,
+          '--log',
+          path.join(tmpDir, 'g.log'),
+          '--timeout',
+          '10',
+        ],
+        { from: 'user' },
+      );
+      // completes only because the caller explicitly asked to simulate
+      expect(process.exitCode).toBe(0);
+      const outText = logSpy.mock.calls.map((c) => String(c[0])).join('\n');
+      expect(outText).toContain('simulated');
+      expect(outText).toContain('SIMULATED');
+    } finally {
+      logSpy.mockRestore();
+    }
+  });
+
+  it('macp gate with an empty spec exits nonzero with a typed error', async () => {
+    const program = buildProgram();
+    await program.parseAsync(
+      [
+        'macp',
+        'gate',
+        '   ',
+        '--cwd',
+        tmpDir,
+        '--log',
+        path.join(tmpDir, 'g.log'),
+        '--timeout',
+        '10',
+      ],
+      { from: 'user' },
+    );
+    expect(process.exitCode).not.toBe(0);
+  });
+});
@@ -1,5 +1,73 @@
+import { existsSync, readFileSync } from 'node:fs';
+
 import type { Command } from 'commander';

+import { runGates } from './gate-runner.js';
+import { MACPCapabilityError, type MacpErrorCode } from './errors.js';
+
+/**
+ * Load gates from a spec: an existing file (JSON gates array, a JSON object
+ * with `quality_gates`, a JSON gate object, or one command per line) or an
+ * inline command string. Fails closed with a typed capability error when the
+ * spec contains no executable gate definition.
+ */
+function loadGateSpec(spec: string): unknown[] {
+  if (existsSync(spec)) {
+    const raw = readFileSync(spec, 'utf-8');
+    try {
+      const parsed = JSON.parse(raw) as unknown;
+      if (Array.isArray(parsed)) {
+        if (parsed.length === 0) {
+          throw new MACPCapabilityError(
+            'MACP_NO_COMMAND',
+            'gate-spec',
+            `gate spec file '${spec}' contains an empty gates array`,
+          );
+        }
+        return parsed;
+      }
+      if (typeof parsed === 'object' && parsed !== null) {
+        const obj = parsed as Record<string, unknown>;
+        if (Array.isArray(obj['quality_gates'])) {
+          return obj['quality_gates'];
+        }
+        return [parsed];
+      }
+      throw new MACPCapabilityError(
+        'MACP_NO_COMMAND',
+        'gate-spec',
+        `gate spec file '${spec}' parsed to ${typeof parsed} — expected a gates array, a task with quality_gates, or a gate object`,
+      );
+    } catch (exc) {
+      if (exc instanceof MACPCapabilityError) throw exc;
+      // Not JSON — treat each non-empty line as a command gate.
+      const lines = raw
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+      if (lines.length > 0) return lines;
+      throw new MACPCapabilityError(
+        'MACP_NO_COMMAND',
+        'gate-spec',
+        `gate spec file '${spec}' contains no gates`,
+      );
+    }
+  }
+  if (spec.trim().length > 0) return [spec];
+  throw new MACPCapabilityError('MACP_NO_COMMAND', 'gate-spec', 'gate spec is empty');
+}
+
+/** Print a typed not-implemented failure and exit nonzero (RI-N2 fail-closed). */
+function notImplemented(subcommand: string, capability: string, hint: string): void {
+  const err = new MACPCapabilityError(
+    'MACP_NOT_IMPLEMENTED',
+    capability,
+    `${subcommand} is not implemented in @mosaicstack/macp yet (${capability} capability absent) — ${hint}`,
+  );
+  console.error(`[macp] ${subcommand}: ${err.message} [${err.code}]`);
+  process.exitCode = 1;
+}
+
 /**
 * Register macp subcommands on an existing Commander program.
 * This avoids cross-package Commander version mismatches by using the
@@ -24,15 +92,14 @@ export function registerMacpCommand(parent: Command): void {
      'Filter by task type (coding|deploy|research|review|documentation|infrastructure)',
    )
    .action((opts: { status?: string; type?: string }) => {
-      // not yet wired — task persistence layer is not present in @mosaicstack/macp
-      console.log('[macp] tasks list: not yet wired — use macp package programmatically');
+      // unimplemented capability — a failure, never a success (RI-N2)
      if (opts.status) {
        console.log(`  status filter: ${opts.status}`);
      }
      if (opts.type) {
        console.log(`  type filter: ${opts.type}`);
      }
-      process.exitCode = 0;
+      notImplemented('tasks list', 'task-persistence', 'use the macp package programmatically');
    });

  // ─── submit ──────────────────────────────────────────────────────────────
@@ -41,12 +108,11 @@ export function registerMacpCommand(parent: Command): void {
    .command('submit <path>')
    .description('Submit a task from a JSON/YAML spec file')
    .action((specPath: string) => {
-      // not yet wired — task submission requires a running MACP server
-      console.log('[macp] submit: not yet wired — use macp package programmatically');
+      // unimplemented capability — a failure, never a success (RI-N2)
      console.log(`  spec path: ${specPath}`);
      console.log('  task id:   (unavailable — no MACP server connected)');
      console.log('  status:    (unavailable — no MACP server connected)');
-      process.exitCode = 0;
+      notImplemented('submit', 'macp-server', 'use the macp package programmatically');
    });

  // ─── gate ────────────────────────────────────────────────────────────────
@@ -58,16 +124,58 @@ export function registerMacpCommand(parent: Command): void {
    .option('--cwd <path>', 'Working directory for gate execution', process.cwd())
    .option('--log <path>', 'Path to write gate log output', '/tmp/macp-gate.log')
    .option('--timeout <seconds>', 'Gate timeout in seconds', '60')
-    .action((spec: string, opts: { failOn: string; cwd: string; log: string; timeout: string }) => {
-      // not yet wired — gate execution requires a task context and event sink
-      console.log('[macp] gate: not yet wired — use macp package programmatically');
-      console.log(`  spec:     ${spec}`);
-      console.log(`  fail-on:  ${opts.failOn}`);
-      console.log(`  cwd:      ${opts.cwd}`);
-      console.log(`  log:      ${opts.log}`);
-      console.log(`  timeout:  ${opts.timeout}s`);
-      process.exitCode = 0;
-    });
+    .option(
+      '--simulate',
+      'Simulate gates instead of executing them; results are typed simulated and never satisfy a check',
+    )
+    .action(
+      (
+        spec: string,
+        opts: { failOn: string; cwd: string; log: string; timeout: string; simulate?: boolean },
+      ) => {
+        let gates: unknown[];
+        try {
+          gates = loadGateSpec(spec);
+        } catch (exc) {
+          if (exc instanceof MACPCapabilityError) {
+            console.error(`[macp] gate: ${exc.message} [${exc.code}]`);
+          } else {
+            console.error(`[macp] gate: ${String(exc)}`);
+          }
+          process.exitCode = 1;
+          return;
+        }
+
+        const timeoutSec = Number.parseInt(opts.timeout, 10) || 60;
+        const eventsPath = `${opts.log}.events.ndjson`;
+        const { state, gateResults } = runGates(
+          gates,
+          opts.cwd,
+          opts.log,
+          timeoutSec,
+          eventsPath,
+          'macp-cli-gate',
+          {
+            simulate: opts.simulate,
+          },
+        );
+
+        for (const r of gateResults) {
+          const label = r.command || r.type;
+          const reason = r.reason ? ` — ${r.reason}` : '';
+          console.log(`[macp] gate ${r.status}: ${label}${reason}`);
+        }
+        if (opts.simulate) {
+          console.log(
+            '[macp] SIMULATED run — every result is typed simulated and can never satisfy a gate, dependency, or release check',
+          );
+        }
+
+        // Simulated runs may complete (exit 0) only because the caller
+        // explicitly passed --simulate; the typed state stays 'simulated'.
+        process.exitCode = state === 'passed' || state === 'simulated' ? 0 : 1;
+      },
+    );

  // ─── events ──────────────────────────────────────────────────────────────

@@ -79,14 +187,16 @@ export function registerMacpCommand(parent: Command): void {
    .option('--file <path>', 'Path to the MACP events NDJSON file')
    .option('--follow', 'Follow the file for new events (like tail -f)')
    .action((opts: { file?: string; follow?: boolean }) => {
-      // not yet wired — event streaming requires a live event source
-      console.log('[macp] events tail: not yet wired — use macp package programmatically');
+      // unimplemented capability — a failure, never a success (RI-N2)
      if (opts.file) {
        console.log(`  file:   ${opts.file}`);
      }
      if (opts.follow) {
        console.log('  mode:   follow');
      }
-      process.exitCode = 0;
+      notImplemented('events tail', 'event-source', 'use the macp package programmatically');
    });
 }
+
+// Re-export so CLI consumers can surface typed capability codes.
+export type { MacpErrorCode };
@@ -0,0 +1,35 @@
+/** Typed error code from the closed MACP_ERROR_CODES set. */
+export type MacpErrorCode = (typeof MACP_ERROR_CODES)[number];
+/**
+ * Typed fail-closed capability errors (RI-N2, SDLC-D-035).
+ *
+ * MACP must fail closed when a required capability (executor, reviewer,
+ * command, CI provider, human authority) is absent. These typed codes mirror
+ * the Forge failure vocabulary (FORGE_NO_*) so both packages speak the same
+ * language: an unimplemented capability is a failure, never a stub success.
+ */
+
+/** Closed set of typed MACP capability error codes. */
+export const MACP_ERROR_CODES = [
+  'MACP_NOT_IMPLEMENTED',
+  'MACP_NO_COMMAND',
+  'MACP_NO_REVIEWER',
+  'MACP_NO_CI_PIPELINE',
+  'MACP_NO_PROVIDER',
+  'MACP_AUTHORITY_REQUIRED',
+] as const;
+
+/** Raised when a required capability is missing and execution must fail closed. */
+export class MACPCapabilityError extends Error {
+  /** Typed error code from the closed MACP_ERROR_CODES set. */
+  readonly code: MacpErrorCode;
+  /** The missing capability, e.g. `ci-provider`, `task-persistence`, `command`. */
+  readonly capability: string;
+
+  constructor(code: MacpErrorCode, capability: string, message: string) {
+    super(message);
+    this.name = 'MACPCapabilityError';
+    this.code = code;
+    this.capability = capability;
+  }
+}
@@ -0,0 +1,429 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { countAIFindings, normalizeGate, runGate, runGates } from './gate-runner.js';
+
+function makeTmpDir(): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'macp-gate-'));
+}
+
+describe('normalizeGate', () => {
+  it('normalizes a string to mechanical gate', () => {
+    expect(normalizeGate('echo test')).toEqual({
+      command: 'echo test',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('normalizes an object gate with defaults', () => {
+    expect(normalizeGate({ command: 'lint' })).toEqual({
+      command: 'lint',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('preserves explicit type and fail_on', () => {
+    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
+      command: 'review',
+      type: 'ai-review',
+      fail_on: 'any',
+    });
+  });
+
+  it('handles non-string/non-object input', () => {
+    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+  });
+});
+
+describe('countAIFindings', () => {
+  it('returns zeros for non-object', () => {
+    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
+  });
+
+  it('counts from stats block', () => {
+    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
+  });
+
+  it('counts from findings array when stats has no blockers', () => {
+    const output = {
+      stats: { blockers: 0 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
+  });
+
+  it('uses stats blockers over findings array when stats has blockers', () => {
+    const output = {
+      stats: { blockers: 5 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
+    };
+    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
+    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
+  });
+
+  it('counts findings length as total when stats has zero total', () => {
+    const output = {
+      findings: [{ severity: 'warning' }, { severity: 'info' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
+  });
+});
+
+describe('runGate', () => {
+  let tmp: string;
+  let logPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = path.join(tmp, 'gate.log');
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('passes mechanical gate on exit 0', () => {
+    const result = runGate('echo hello', tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.exit_code).toBe(0);
+    expect(result.type).toBe('mechanical');
+    expect(result.output).toContain('hello');
+  });
+
+  it('fails mechanical gate on non-zero exit', () => {
+    const result = runGate('exit 1', tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.exit_code).toBe(1);
+  });
+
+  it('ci-pipeline fails closed without a CI provider (no placeholder pass)', () => {
+    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.status).toBe('capability_failure');
+    expect(result.capability_code).toBe('MACP_NO_CI_PIPELINE');
+    expect(result.type).toBe('ci-pipeline');
+    expect(result.output).not.toBe('CI pipeline gate placeholder');
+  });
+
+  it('empty command is a typed capability failure, never a pass', () => {
+    const result = runGate({ command: '' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.status).toBe('capability_failure');
+    expect(result.capability_code).toBe('MACP_NO_COMMAND');
+  });
+
+  it('ai-review gate parses JSON output', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.blockers).toBe(0);
+    expect(result.findings).toBe(1);
+  });
+
+  it('ai-review gate fails on blockers', () => {
+    const json = JSON.stringify({ stats: { blockers: 2 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.blockers).toBe(2);
+  });
+
+  it('ai-review gate with fail_on=any fails on any findings', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate(
+      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
+      tmp,
+      logPath,
+      30,
+    );
+    expect(result.passed).toBe(false);
+    expect(result.fail_on).toBe('any');
+  });
+
+  it('ai-review gate fails on invalid JSON output', () => {
+    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.parse_error).toBeDefined();
+  });
+
+  it('writes to log file', () => {
+    runGate('echo logged', tmp, logPath, 30);
+    const log = fs.readFileSync(logPath, 'utf-8');
+    expect(log).toContain('COMMAND: echo logged');
+    expect(log).toContain('logged');
+    expect(log).toContain('EXIT:');
+  });
+});
+
+describe('runGates', () => {
+  let tmp: string;
+  let logPath: string;
+  let eventsPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = path.join(tmp, 'gates.log');
+    eventsPath = path.join(tmp, 'events.ndjson');
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('runs multiple gates and returns results', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo one', 'echo two'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-1',
+    );
+    expect(allPassed).toBe(true);
+    expect(gateResults).toHaveLength(2);
+  });
+
+  it('reports failure when any gate fails', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo ok', 'exit 1'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-2',
+    );
+    expect(allPassed).toBe(false);
+    expect(gateResults[0]!.passed).toBe(true);
+    expect(gateResults[1]!.passed).toBe(false);
+  });
+
+  it('emits events for each gate', () => {
+    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
+    const events = fs
+      .readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    expect(events).toHaveLength(2); // started + passed
+    expect(events[0].event_type).toBe('rail.check.started');
+    expect(events[1].event_type).toBe('rail.check.passed');
+  });
+
+  it('does not silently skip gates with empty command — they become capability failures', () => {
+    const { gateResults, allPassed, state } = runGates(
+      [{ command: '', type: 'mechanical' }, 'echo real'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-4',
+    );
+    expect(gateResults).toHaveLength(2);
+    expect(gateResults[0]!.status).toBe('capability_failure');
+    expect(gateResults[1]!.status).toBe('passed');
+    expect(allPassed).toBe(false);
+    expect(state).toBe('capability_failure');
+  });
+
+  it('does not skip ci-pipeline even with empty command — typed capability failure', () => {
+    const { gateResults, allPassed, state } = runGates(
+      [{ command: '', type: 'ci-pipeline' }],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-5',
+    );
+    expect(gateResults).toHaveLength(1);
+    expect(gateResults[0]!.passed).toBe(false);
+    expect(gateResults[0]!.status).toBe('capability_failure');
+    expect(allPassed).toBe(false);
+    expect(state).toBe('capability_failure');
+  });
+
+  it('emits failed event with correct message', () => {
+    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
+    const events = fs
+      .readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    const failEvent = events.find(
+      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
+    );
+    expect(failEvent).toBeDefined();
+    expect(failEvent.message).toContain('Gate failed (');
+  });
+});
+
+/**
+ * RI-N2 / SDLC-D-035 fail-closed controls for the MACP gate runner.
+ *
+ * Invariant under test: `passed: true` occurs ONLY when a gate really executed
+ * and really exited green (`status === 'passed'`). Absent capabilities,
+ * manual sign-offs, and simulated runs are typed distinctly and can never
+ * make the aggregate `passed`.
+ */
+describe('gate-runner fail-closed (RI-N2)', () => {
+  let tmpDir: string;
+  let logPath: string;
+  let eventsPath: string;
+
+  beforeEach(() => {
+    tmpDir = makeTmpDir();
+    logPath = path.join(tmpDir, 'gate.log');
+    eventsPath = path.join(tmpDir, 'events.ndjson');
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  function run(gates: unknown[], options?: { simulate?: boolean }) {
+    return runGates(gates, tmpDir, logPath, 10, eventsPath, 'spec-task', options);
+  }
+
+  // ─── positive controls ───────────────────────────────────────────────────
+
+  it('a really-executed green command gate still passes', () => {
+    const result = run([{ command: 'exit 0', type: 'mechanical' }]);
+    expect(result.gateResults[0]!.status).toBe('passed');
+    expect(result.gateResults[0]!.passed).toBe(true);
+    expect(result.allPassed).toBe(true);
+    expect(result.state).toBe('passed');
+  });
+
+  it('explicit simulate completes and types every result simulated', () => {
+    const result = run([{ command: 'exit 0', type: 'mechanical' }, 'echo hello'], {
+      simulate: true,
+    });
+    expect(result.gateResults).toHaveLength(2);
+    for (const gate of result.gateResults) {
+      expect(gate.status).toBe('simulated');
+      expect(gate.passed).toBe(false);
+    }
+    expect(result.state).toBe('simulated');
+  });
+
+  it('a really-executed red command gate fails with typed status failed', () => {
+    const result = run([{ command: 'exit 3', type: 'mechanical' }]);
+    expect(result.gateResults[0]!.status).toBe('failed');
+    expect(result.gateResults[0]!.passed).toBe(false);
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('failed');
+  });
+
+  // ─── negative controls — each asserts typed status AND aggregate not passed ──
+
+  it('an empty-command gate is a capability_failure, not skipped and not passed', () => {
+    const result = run([{ command: '', type: 'mechanical' }]);
+    // runGates must not silently skip it — it produces a typed result
+    expect(result.gateResults).toHaveLength(1);
+    const gate = result.gateResults[0]!;
+    expect(gate.status).toBe('capability_failure');
+    expect(gate.capability_code).toBe('MACP_NO_COMMAND');
+    expect(gate.passed).toBe(false);
+    // aggregate is not passed
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('capability_failure');
+    expect(result.state).not.toBe('passed');
+  });
+
+  it('a commandless ai-review gate is a typed MACP_NO_REVIEWER capability_failure', () => {
+    const result = run([{ command: '', type: 'ai-review' }]);
+    expect(result.gateResults[0]!.status).toBe('capability_failure');
+    expect(result.gateResults[0]!.capability_code).toBe('MACP_NO_REVIEWER');
+    expect(result.allPassed).toBe(false);
+    expect(result.state).not.toBe('passed');
+  });
+
+  it('a ci-pipeline gate without a provider implementation is a capability_failure, never a placeholder pass', () => {
+    const result = run([{ command: '', type: 'ci-pipeline' }]);
+    const gate = result.gateResults[0]!;
+    expect(gate.status).toBe('capability_failure');
+    expect(gate.capability_code).toBe('MACP_NO_CI_PIPELINE');
+    expect(gate.passed).toBe(false);
+    // the old false-success placeholder must be gone
+    expect(gate.output).not.toBe('CI pipeline gate placeholder');
+    expect(result.allPassed).toBe(false);
+    expect(result.state).not.toBe('passed');
+  });
+
+  it('a ci-pipeline gate fails closed even alongside an otherwise green run', () => {
+    const result = run(['exit 0', { type: 'ci-pipeline', command: 'fake-ci' }]);
+    expect(result.gateResults[1]!.status).toBe('capability_failure');
+    expect(result.gateResults[0]!.status).toBe('passed');
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('capability_failure');
+  });
+
+  it('a manual gate with no automation enters typed waiting — neither pass nor fail', () => {
+    const result = run([{ type: 'manual' }]);
+    const gate = result.gateResults[0]!;
+    expect(gate.status).toBe('waiting');
+    expect(gate.passed).toBe(false);
+    expect(gate.exit_code).toBe(0);
+    // aggregate is not passed while any gate is waiting
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('waiting');
+    expect(result.state).not.toBe('passed');
+  });
+
+  it('a simulated result can never make the aggregate passed', () => {
+    const result = run(['exit 0', 'exit 0'], { simulate: true });
+    expect(result.gateResults.every((g) => g.status === 'simulated')).toBe(true);
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('simulated');
+    expect(result.state).not.toBe('passed');
+  });
+
+  it('waiting dominates an otherwise green aggregate', () => {
+    const result = run(['exit 0', { type: 'manual' }]);
+    expect(result.allPassed).toBe(false);
+    expect(result.state).toBe('waiting');
+  });
+});
+
+describe('runGate fail-closed (RI-N2)', () => {
+  let tmpDir: string;
+  let logPath: string;
+
+  beforeEach(() => {
+    tmpDir = makeTmpDir();
+    logPath = path.join(tmpDir, 'gate.log');
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it('simulate: true returns a typed simulated result without executing', () => {
+    const result = runGate('this-command-does-not-exist-xyz', tmpDir, logPath, 10, {
+      simulate: true,
+    });
+    expect(result.status).toBe('simulated');
+    expect(result.passed).toBe(false);
+    expect(result.exit_code).toBe(0);
+  });
+
+  it('normal mode executes for real and types a green gate passed', () => {
+    const result = runGate('echo ok', tmpDir, logPath, 10);
+    expect(result.status).toBe('passed');
+    expect(result.passed).toBe(true);
+    expect(result.output).toContain('ok');
+  });
+
+  it('a bare string gate normalizes to mechanical and executes', () => {
+    const result = runGate('exit 7', tmpDir, logPath, 10);
+    expect(result.type).toBe('mechanical');
+    expect(result.status).toBe('failed');
+    expect(result.passed).toBe(false);
+  });
+});
@@ -4,7 +4,20 @@ import { dirname } from 'node:path';

 import { emitEvent } from './event-emitter.js';
 import { nowISO } from './event-emitter.js';
-import type { GateResult } from './types.js';
+import type { GateResult, GateStatus, RunGatesResult } from './types.js';
+
+/** Typed reason stamped on every simulated gate result. */
+export const SIMULATED_GATE_REASON =
+  'simulated execution (explicit simulate opt-in): gate was not evaluated by a real implementation';
+
+/** Options for gate execution (RI-N2 fail-closed / explicit simulation). */
+export interface RunGateOptions {
+  /**
+   * Explicit caller opt-in to simulation. Simulated gates are NOT executed;
+   * every result is typed `simulated` and never satisfies anything.
+   */
+  simulate?: boolean;
+}

 export interface NormalizedGate {
  command: string;
@@ -103,36 +116,91 @@ export function countAIFindings(parsedOutput: unknown): { blockers: number; tota
  return { blockers, total };
 }

+function simulatedResult(gateEntry: NormalizedGate): GateResult {
+  return {
+    command: gateEntry.command,
+    exit_code: 0,
+    type: gateEntry.type,
+    output: SIMULATED_GATE_REASON,
+    timed_out: false,
+    passed: false,
+    status: 'simulated',
+    reason: SIMULATED_GATE_REASON,
+  };
+}
+
+function capabilityFailureResult(
+  gateEntry: NormalizedGate,
+  code: GateResult['capability_code'],
+  reason: string,
+): GateResult {
+  return {
+    command: gateEntry.command,
+    exit_code: 1,
+    type: gateEntry.type,
+    output: '',
+    timed_out: false,
+    passed: false,
+    status: 'capability_failure',
+    capability_code: code,
+    reason,
+  };
+}
+
+function waitingResult(gateEntry: NormalizedGate, reason: string): GateResult {
+  return {
+    command: gateEntry.command,
+    exit_code: 0,
+    type: gateEntry.type,
+    output: '',
+    timed_out: false,
+    passed: false,
+    status: 'waiting',
+    capability_code: 'MACP_AUTHORITY_REQUIRED',
+    reason,
+  };
+}
+
 export function runGate(
  gate: unknown,
  cwd: string,
  logPath: string,
  timeoutSec: number,
+  options: RunGateOptions = {},
 ): GateResult {
  const gateEntry = normalizeGate(gate);
  const gateType = gateEntry.type;
  const command = gateEntry.command;

+  // Explicit simulation only: never executes, typed simulated, never satisfying.
+  if (options.simulate) {
+    return simulatedResult(gateEntry);
+  }
+
+  // Fail closed: no CI provider implementation exists in @mosaicstack/macp,
+  // so a ci-pipeline gate is an absent capability — never a placeholder pass.
  if (gateType === 'ci-pipeline') {
-    return {
-      command,
-      exit_code: 0,
-      type: gateType,
-      output: 'CI pipeline gate placeholder',
-      timed_out: false,
-      passed: true,
-    };
+    return capabilityFailureResult(
+      gateEntry,
+      'MACP_NO_CI_PIPELINE',
+      `ci-pipeline gate '${gateEntry.command || gateType}' has no CI provider implementation wired — refusing placeholder pass`,
+    );
  }

  if (!command) {
-    return {
-      command: '',
-      exit_code: 0,
-      type: gateType,
-      output: '',
-      timed_out: false,
-      passed: true,
-    };
+    // A manual gate with no automation waits for human sign-off: not pass, not fail.
+    if (gateType === 'manual') {
+      return waitingResult(
+        gateEntry,
+        `manual gate has no automation — waiting for human sign-off (type: ${gateType})`,
+      );
+    }
+    // Any other commandless gate is an absent capability — never a vacuous pass.
+    return capabilityFailureResult(
+      gateEntry,
+      gateType === 'ai-review' ? 'MACP_NO_REVIEWER' : 'MACP_NO_COMMAND',
+      `gate of type '${gateType}' has no command to execute — refusing empty-command pass`,
+    );
  }

  const { exitCode, output, timedOut } = runShell(command, cwd, logPath, timeoutSec);
@@ -143,10 +211,12 @@ export function runGate(
    output,
    timed_out: timedOut,
    passed: false,
+    status: 'failed',
  };

  if (gateType !== 'ai-review') {
    result.passed = exitCode === 0;
+    result.status = result.passed ? 'passed' : 'failed';
    return result;
  }

@@ -170,6 +240,7 @@ export function runGate(
  } else {
    result.passed = exitCode === 0 && blockers === 0 && !timedOut && parseError === undefined;
  }
+  result.status = result.passed ? 'passed' : 'failed';

  result.fail_on = failOn;
  result.blockers = blockers;
@@ -191,16 +262,19 @@ export function runGates(
  timeoutSec: number,
  eventsPath: string,
  taskId: string,
-): { allPassed: boolean; gateResults: GateResult[] } {
-  let allPassed = true;
+  options: RunGateOptions = {},
+): RunGatesResult {
  const gateResults: GateResult[] = [];
+  let hasCapabilityFailure = false;
+  let hasSimulated = false;
+  let hasFailed = false;
+  let hasWaiting = false;

  for (const gate of gates) {
    const gateEntry = normalizeGate(gate);
    const gateCmd = gateEntry.command;
-    if (!gateCmd && gateEntry.type !== 'ci-pipeline') continue;
-
    const label = gateCmd || gateEntry.type;
+    // NOTE: no silent skip — every gate produces a typed result (RI-N2).
    emitEvent(
      eventsPath,
      'rail.check.started',
@@ -209,10 +283,10 @@ export function runGates(
      'quality-gate',
      `Running gate: ${label}`,
    );
-    const result = runGate(gate, cwd, logPath, timeoutSec);
+    const result = runGate(gate, cwd, logPath, timeoutSec, options);
    gateResults.push(result);

-    if (result.passed) {
+    if (result.status === 'passed') {
      emitEvent(
        eventsPath,
        'rail.check.passed',
@@ -224,7 +298,46 @@ export function runGates(
      continue;
    }

-    allPassed = false;
+    if (result.status === 'waiting') {
+      hasWaiting = true;
+      emitEvent(
+        eventsPath,
+        'rail.check.waiting',
+        taskId,
+        'gated',
+        'quality-gate',
+        `Gate waiting: ${label} — ${result.reason ?? 'manual gate awaits sign-off'}`,
+      );
+      continue;
+    }
+
+    if (result.status === 'simulated') {
+      hasSimulated = true;
+      emitEvent(
+        eventsPath,
+        'rail.check.simulated',
+        taskId,
+        'gated',
+        'quality-gate',
+        `Gate simulated (non-satisfying): ${label}`,
+      );
+      continue;
+    }
+
+    if (result.status === 'capability_failure') {
+      hasCapabilityFailure = true;
+      emitEvent(
+        eventsPath,
+        'rail.check.failed',
+        taskId,
+        'gated',
+        'quality-gate',
+        `Gate capability failure (${result.capability_code ?? 'MACP_NO_PROVIDER'}): ${label} — ${result.reason ?? 'required capability is absent'}`,
+      );
+      continue;
+    }
+
+    hasFailed = true;
    let message: string;
    if (result.timed_out) {
      message = `Gate timed out after ${timeoutSec}s: ${label}`;
@@ -236,5 +349,15 @@ export function runGates(
    emitEvent(eventsPath, 'rail.check.failed', taskId, 'gated', 'quality-gate', message);
  }

-  return { allPassed, gateResults };
+  const state: GateStatus = hasCapabilityFailure
+    ? 'capability_failure'
+    : hasSimulated
+      ? 'simulated'
+      : hasFailed
+        ? 'failed'
+        : hasWaiting
+          ? 'waiting'
+          : 'passed';
+
+  return { allPassed: state === 'passed', gateResults, state };
 }
@@ -6,11 +6,13 @@ export type {
  DependsOnPolicy,
  GateType,
  GateFailOn,
+  GateStatus,
  GateEntry,
  Task,
  EventType,
  MACPEvent,
  GateResult,
+  RunGatesResult,
  TaskResult,
  ProviderMeta,
  ProviderRegistry,
@@ -18,6 +20,11 @@ export type {

 export { CredentialError } from './types.js';

+// Typed fail-closed capability errors (RI-N2, SDLC-D-035)
+export { MACP_ERROR_CODES, MACPCapabilityError } from './errors.js';
+
+export type { MacpErrorCode } from './errors.js';
+
 // Credential resolver
 export {
  DEFAULT_CREDENTIALS_DIR,
@@ -35,9 +42,16 @@ export {
 export type { ResolveCredentialsOptions } from './credential-resolver.js';

 // Gate runner
-export { normalizeGate, runShell, countAIFindings, runGate, runGates } from './gate-runner.js';
+export {
+  normalizeGate,
+  runShell,
+  countAIFindings,
+  runGate,
+  runGates,
+  SIMULATED_GATE_REASON,
+} from './gate-runner.js';

-export type { NormalizedGate } from './gate-runner.js';
+export type { NormalizedGate, RunGateOptions } from './gate-runner.js';

 // Risk-floor (agent reflection loop — diff review classifier)
 export { evaluateRiskFloor, DEFAULT_RISK_THRESHOLD } from './risk-floor.js';
@@ -1,3 +1,5 @@
+import type { MacpErrorCode } from './errors.js';
+
 /** Task status values. */
 export type TaskStatus = 'pending' | 'running' | 'gated' | 'completed' | 'failed' | 'escalated';

@@ -17,7 +19,17 @@ export type DispatchMode = 'yolo' | 'acp' | 'exec';
 export type DependsOnPolicy = 'all' | 'any' | 'all_terminal';

 /** Quality gate type. */
-export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline';
+export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline' | 'manual';
+
+/**
+ * Typed execution state of a gate — closed set (RI-N2, SDLC-D-035).
+ *
+ * Only `passed` means "really executed and green". `simulated` is produced
+ * exclusively under an explicit simulate opt-in and never satisfies anything.
+ * `capability_failure` means a required executor/provider/command was absent.
+ * `waiting` means a manual gate awaits human sign-off (neither pass nor fail).
+ */
+export type GateStatus = 'passed' | 'failed' | 'simulated' | 'waiting' | 'capability_failure';

 /** Gate fail_on mode. */
 export type GateFailOn = 'blocker' | 'any';
@@ -67,7 +79,9 @@ export type EventType =
  | 'task.retry.scheduled'
  | 'rail.check.started'
  | 'rail.check.passed'
-  | 'rail.check.failed';
+  | 'rail.check.failed'
+  | 'rail.check.waiting'
+  | 'rail.check.simulated';

 /** Structured event record. */
 export interface MACPEvent {
@@ -88,7 +102,14 @@ export interface GateResult {
  type: string;
  output: string;
  timed_out: boolean;
+  /** Back-compat boolean view — true ONLY when `status === 'passed'`. */
  passed: boolean;
+  /** Typed discriminator — the authoritative gate outcome (RI-N2). */
+  status: GateStatus;
+  /** Typed capability error code, set when `status === 'capability_failure'`. */
+  capability_code?: MacpErrorCode;
+  /** Why a non-executed state (simulated/waiting/capability_failure) was reached. */
+  reason?: string;
  fail_on?: string;
  blockers?: number;
  findings?: number;
@@ -96,6 +117,22 @@ export interface GateResult {
  parse_error?: string;
 }

+/**
+ * Aggregate outcome of `runGates` (RI-N2).
+ *
+ * `state` is the typed aggregate: it is `passed` only when every gate really
+ * executed green. A `simulated` result makes the aggregate `simulated` (never
+ * `passed`); a `waiting` manual gate keeps the aggregate `waiting`; a missing
+ * capability makes it `capability_failure`. `allPassed` is exactly
+ * `state === 'passed'`, so a simulated or waiting result can never satisfy a
+ * dependency, acceptance criterion, gate, merge, or release check.
+ */
+export interface RunGatesResult {
+  allPassed: boolean;
+  gateResults: GateResult[];
+  state: GateStatus;
+}
+
 /** Result from a completed task. */
 export interface TaskResult {
  task_id: string;
@@ -1,149 +0,0 @@
-import { mkdtemp, readFile, readdir } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { parse as parseYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerMissionCommand } from './mission.js';
-import { PrdService } from '@mosaicstack/prdy';
-import type { MissionInfo } from '../tui/gateway-api.js';
-
-// ── Mocks: the gateway is not available in adapter tests ──────────────────────
-
-// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
-// be initialized there too.
-const MISSION = vi.hoisted(
-  (): MissionInfo => ({
-    id: 'mission-plan-1',
-    name: 'Plan Mission Alpha',
-    description: null,
-    status: 'planning',
-    projectId: null,
-    userId: null,
-    phase: null,
-    milestones: null,
-    config: null,
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-03-04T05:06:07.000Z',
-  }),
-);
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
-  fetchMission: vi.fn(),
-  createMission: vi.fn(),
-  updateMission: vi.fn(),
-  fetchMissionTasks: vi.fn().mockResolvedValue([]),
-  createMissionTask: vi.fn(),
-  updateMissionTask: vi.fn(),
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerMissionCommand(program);
-  return program;
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
-  process.chdir(projectDir);
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-  consoleStub.push(logSpy);
-});
-
-afterEach(() => {
-  // Restore only the per-test spies; module factory mocks keep their
-  // implementations across tests.
-  for (const stub of consoleStub) stub.mockRestore();
-  consoleStub = [];
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic mission --plan (thin adapter over PrdService)', () => {
-  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // PRD landed in the same store `mosaic prdy` uses.
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    // Fresh service instance (new-process equivalent) reads the linkage back.
-    const service = new PrdService({ projectPath: projectDir });
-    const docs = await service.list();
-    expect(docs).toHaveLength(1);
-
-    const prd = docs[0]!;
-    expect(prd.title).toBe('Plan Mission Alpha');
-    expect(prd.version).toBe(1);
-
-    const links = await service.listMissionLinks(prd.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: MISSION.id,
-      missionVersion: MISSION.updatedAt, // mission version marker
-      prdVersion: 1,
-    });
-
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
-  });
-
-  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
-    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
-
-    expect(persisted.missions).toHaveLength(1);
-    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
-  });
-
-  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
-    // Mission path.
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // prdy path (service, non-interactive entry).
-    const service = new PrdService({ projectPath: projectDir });
-    const direct = await service.create({ name: 'Directly Created' });
-
-    const all = await service.list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
-    expect(all).toHaveLength(2);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toContain(`${direct.id}.yaml`);
-
-    // Both are v1 in the same store with distinct stable ids.
-    for (const doc of all) {
-      expect(doc.version).toBe(1);
-      expect(files).toContain(`${doc.id}.yaml`);
-    }
-  });
-});
@@ -256,41 +256,14 @@ async function planMission(
  console.log(`Planning mission: ${mission.name}\n`);

  try {
-    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
-    // PrdService — no second writer path. The mission's updatedAt serves as
-    // its version marker (the gateway exposes no numeric mission version).
-    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-    const service = new PrdService({ projectPath: process.cwd() });
-
-    if (process.stdout.isTTY) {
-      const created = await runPrdWizard({
-        name: mission.name,
-        projectPath: process.cwd(),
-        interactive: true,
-      });
-      const linked = await service.linkMission({
-        prdId: created.id,
-        missionId: mission.id,
-        missionVersion: mission.updatedAt,
-        requirementIds: [],
-      });
-      console.log(
-        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
-      );
-      return;
-    }
-
-    const doc = await service.planForMission({
+    const { runPrdWizard } = await import('@mosaicstack/prdy');
+    await runPrdWizard({
      name: mission.name,
-      missionId: mission.id,
-      missionVersion: mission.updatedAt,
-      requirementIds: [],
+      projectPath: process.cwd(),
+      interactive: true,
    });
-    console.log(
-      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
-    );
  } catch (err) {
-    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
    process.exit(1);
  }
 }
@@ -1,204 +0,0 @@
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { stringify as stringifyYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerPrdyCommand } from './prdy.js';
-import { PrdService } from '@mosaicstack/prdy';
-
-// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
-//    outside the tmp project dir) ──────────────────────────────────────────────
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-class ProcessExitError extends Error {
-  constructor(readonly code: number) {
-    super(`process.exit(${code})`);
-  }
-}
-
-function stubProcessExit() {
-  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new ProcessExitError(code ?? 0);
-  }) as never);
-}
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let errorSpy: ReturnType<typeof vi.spyOn>;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let exitStub: ReturnType<typeof stubProcessExit>;
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerPrdyCommand(program);
-  return program;
-}
-
-function runPrdy(args: string[]): Promise<unknown> {
-  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
-}
-
-function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
-  return {
-    id: 'cmd-import-prd',
-    title: 'Command Import PRD',
-    status: 'approved', // must be forced to draft: validity is not approval
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
-  process.chdir(projectDir);
-  exitStub = stubProcessExit();
-  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-});
-
-afterEach(() => {
-  // Restore only the per-test spies: module factory mocks must keep their
-  // implementations for the next test.
-  exitStub.mockRestore();
-  errorSpy.mockRestore();
-  logSpy.mockRestore();
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic prdy (thin adapter over PrdService)', () => {
-  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
-    await runPrdy(['--init', 'Adapter Created']);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.title).toBe('Adapter Created');
-    expect(docs[0]?.version).toBe(1);
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
-  });
-
-  it('--import <file> creates a valid import through the service', async () => {
-    const filePath = path.join(projectDir, 'incoming.yaml');
-    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
-
-    await runPrdy(['--import', filePath]);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.id).toBe('cmd-import-prd');
-    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
-  });
-
-  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
-    const filePath = path.join(projectDir, 'broken.yaml');
-    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    // Typed refusal surfaced to the user, nothing created.
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
-    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Conflict Target' });
-    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
-    const beforeBytes = await readFile(storeFile, 'utf8');
-
-    const filePath = path.join(projectDir, 'divergent.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Divergent Command Import',
-        }),
-      ),
-      'utf8',
-    );
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
-
-    // Original authority document is byte-identical on disk.
-    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
-  });
-
-  it('--import --accept-successor persists the successor version explicitly', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Successor Target' });
-
-    const filePath = path.join(projectDir, 'divergent2.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Accepted Via CLI',
-        }),
-      ),
-      'utf8',
-    );
-
-    await runPrdy(['--import', filePath, '--accept-successor']);
-
-    const doc = await service.get(existing.id);
-    expect(doc.version).toBe(2);
-    expect(doc.title).toBe('Accepted Via CLI');
-    expect(doc.status).toBe('draft');
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
-  });
-
-  it('--export writes a labeled generated view and never touches authority', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const created = await service.create({ name: 'Export Via CLI' });
-    const before = await service.get(created.id);
-
-    await runPrdy(['--export', created.id]);
-
-    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
-    const md = await readFile(mdPath, 'utf8');
-    expect(md).toContain('generated view — do not edit');
-    expect(md).toContain(`prd-id: ${created.id}`);
-    expect(md).toContain('prd-version: 1');
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining(`Generated view written: ${mdPath}`),
-    );
-
-    // Authority unchanged by the export.
-    expect(await service.get(created.id)).toEqual(before);
-  });
-});
@@ -2,10 +2,6 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';

-/**
- * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
- * All reads/writes go through the service; there is no local writer path.
- */
 export function registerPrdyCommand(program: Command) {
  const cmd = program
    .command('prdy')
@@ -13,18 +9,12 @@ export function registerPrdyCommand(program: Command) {
    .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
    .option('--init [name]', 'Create a new PRD')
    .option('--update [name]', 'Update an existing PRD')
-    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
-    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
-    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
    .option('--project <idOrName>', 'Scope to project')
    .action(
      async (opts: {
        gateway: string;
        init?: string | boolean;
        update?: string | boolean;
-        import?: string;
-        acceptSuccessor?: boolean;
-        export?: string | boolean;
        project?: string;
      }) => {
        // Detect project context when --project flag is provided
@@ -41,69 +31,20 @@ export function registerPrdyCommand(program: Command) {
          }
        }

-        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-        const service = new PrdService({ projectPath: process.cwd() });
-
        try {
-          if (opts.import !== undefined) {
-            const input = { filePath: opts.import };
-
-            if (opts.acceptSuccessor) {
-              const successor = await service.acceptSuccessor(input);
-              console.log(
-                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
-              );
-              return;
-            }
-
-            const result = await service.importDocument(input);
-            console.log(
-              result.kind === 'created'
-                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
-                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
-            );
-            return;
-          }
-
-          if (opts.export !== undefined) {
-            const id =
-              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
-            const result = await service.exportMarkdown({ id });
-            console.log(
-              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
-            );
-            return;
-          }
-
+          const { runPrdWizard } = await import('@mosaicstack/prdy');
          const name =
            typeof opts.init === 'string'
              ? opts.init
              : typeof opts.update === 'string'
                ? opts.update
                : 'untitled';
-
-          if (process.stdout.isTTY) {
-            await runPrdWizard({
-              name,
-              projectPath: process.cwd(),
-              interactive: true,
-            });
-            return;
-          }
-
-          // Non-interactive fallback routes through the service directly.
-          const doc = await service.create({ name });
-          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
+          await runPrdWizard({
+            name,
+            projectPath: process.cwd(),
+            interactive: true,
+          });
        } catch (err) {
-          if (err instanceof Error && err.name === 'PrdImportConflictError') {
-            const conflict = err as { proposal?: { version?: number } };
-            console.error(`${err.message}`);
-            console.error(
-              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
-            );
-            process.exit(1);
-          }
-
          console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
          process.exit(1);
        }
@@ -1,6 +1,6 @@
 import { Command } from 'commander';

-import { PrdService } from './service.js';
+import { createPrd, listPrds, loadPrd } from './prd.js';
 import { runPrdWizard } from './wizard.js';

 interface InitCommandOptions {
@@ -18,22 +18,6 @@ interface ShowCommandOptions {
  readonly id?: string;
 }

-interface ImportCommandOptions {
-  readonly project: string;
-  readonly file: string;
-  readonly acceptSuccessor?: boolean;
-}
-
-interface ExportCommandOptions {
-  readonly project: string;
-  readonly id?: string;
-  readonly out?: string;
-}
-
-function serviceFor(project: string): PrdService {
-  return new PrdService({ projectPath: project });
-}
-
 export function buildPrdyCli(): Command {
  const program = new Command();
  program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -54,9 +38,11 @@ export function buildPrdyCli(): Command {
            template: options.template,
            interactive: true,
          })
-        : await serviceFor(options.project).create({
+        : await createPrd({
            name: options.name,
+            projectPath: options.project,
            template: options.template,
+            interactive: false,
          });

      console.log(
@@ -66,7 +52,6 @@ export function buildPrdyCli(): Command {
            id: doc.id,
            title: doc.title,
            status: doc.status,
-            version: doc.version,
            projectPath: doc.projectPath,
          },
          null,
@@ -80,7 +65,7 @@ export function buildPrdyCli(): Command {
    .description('List PRD documents for a project')
    .requiredOption('--project <path>', 'Project path')
    .action(async (options: ListCommandOptions) => {
-      const docs = await serviceFor(options.project).list();
+      const docs = await listPrds(options.project);
      console.log(JSON.stringify(docs, null, 2));
    });

@@ -90,65 +75,20 @@ export function buildPrdyCli(): Command {
    .requiredOption('--project <path>', 'Project path')
    .option('--id <id>', 'PRD document id')
    .action(async (options: ShowCommandOptions) => {
-      const doc = await serviceFor(options.project).get(options.id);
-      console.log(JSON.stringify(doc, null, 2));
-    });
+      if (options.id !== undefined) {
+        const docs = await listPrds(options.project);
+        const match = docs.find((doc) => doc.id === options.id);

-  prdy
-    .command('import')
-    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
-    .requiredOption('--project <path>', 'Project path')
-    .requiredOption('--file <file>', 'Path to YAML PRD document')
-    .option('--accept-successor', 'Accept a conflicted import as the next version')
-    .action(async (options: ImportCommandOptions) => {
-      const service = serviceFor(options.project);
-      const input = { filePath: options.file };
+        if (match === undefined) {
+          throw new Error(`PRD id not found: ${options.id}`);
+        }

-      if (options.acceptSuccessor) {
-        const successor = await service.acceptSuccessor(input);
-        console.log(
-          JSON.stringify(
-            {
-              ok: true,
-              outcome: 'successor-accepted',
-              id: successor.id,
-              version: successor.version,
-            },
-            null,
-            2,
-          ),
-        );
+        console.log(JSON.stringify(match, null, 2));
        return;
      }

-      const result = await service.importDocument(input);
-      console.log(
-        JSON.stringify(
-          {
-            ok: true,
-            outcome: result.kind,
-            id: result.document.id,
-            version: result.document.version,
-            status: result.document.status,
-          },
-          null,
-          2,
-        ),
-      );
-    });
-
-  prdy
-    .command('export')
-    .description('Render a PRD to a labeled generated-view Markdown file')
-    .requiredOption('--project <path>', 'Project path')
-    .option('--id <id>', 'PRD document id')
-    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
-    .action(async (options: ExportCommandOptions) => {
-      const result = await serviceFor(options.project).exportMarkdown({
-        id: options.id,
-        outPath: options.out,
-      });
-      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
+      const doc = await loadPrd(options.project);
+      console.log(JSON.stringify(doc, null, 2));
    });

  return program;
@@ -1,35 +1,12 @@
-// PrdService is the single authority surface for PRD documents. The raw store
-// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
-// goes through the service so there is no second writer path.
-export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
+export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
-export {
-  PrdService,
-  PRD_GENERATED_VIEW_LABEL,
-  PrdError,
-  PrdNotFoundError,
-  PrdUpdateError,
-  PrdImportInvalidError,
-  PrdImportConflictError,
-} from './service.js';
 export type {
  PrdStatus,
  PrdTemplate,
  PrdTemplateSection,
  PrdSection,
-  PrdMissionLinkage,
  PrdDocument,
  CreatePrdOptions,
-  PrdServiceOptions,
-  PrdCreateInput,
-  PrdSectionPatch,
-  PrdUpdateInput,
-  PrdLinkMissionInput,
-  PrdPlanForMissionInput,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
 } from './types.js';
@@ -17,49 +17,17 @@ const prdSectionSchema = z.object({
  fields: z.record(z.string(), z.string()),
 });

-const prdMissionLinkageSchema = z.object({
-  missionId: z.string().min(1),
-  missionVersion: z.string().min(1),
-  prdVersion: z.number().int().min(1),
-  requirementIds: z.array(z.string()),
-  linkedAt: z.string().datetime(),
-});
-
 const prdDocumentSchema = z.object({
  id: z.string().min(1),
  title: z.string().min(1),
  status: z.enum(['draft', 'review', 'approved', 'archived']),
  projectPath: z.string().min(1),
  template: z.string().min(1),
-  // Defaults keep documents written by older prdy versions loadable.
-  version: z.number().int().min(1).default(1),
  sections: z.array(prdSectionSchema),
-  missions: z.array(prdMissionLinkageSchema).default([]),
  createdAt: z.string().datetime(),
  updatedAt: z.string().datetime(),
 });

-/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
-function coerceTimestamps(value: unknown): unknown {
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  if (Array.isArray(value)) {
-    return value.map(coerceTimestamps);
-  }
-  if (typeof value === 'object' && value !== null) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
-    );
-  }
-  return value;
-}
-
-/** Validate an unknown value as a PRD document (throws zod errors on failure). */
-export function parsePrdDocument(value: unknown): PrdDocument {
-  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
-}
-
 function expandHome(projectPath: string): string {
  if (!projectPath.startsWith('~')) {
    return projectPath;
@@ -106,8 +74,6 @@ function prdDirectory(projectPath: string): string {
  return path.join(projectPath, PRD_DIRECTORY);
 }

-export { prdDirectory };
-
 function prdFilePath(projectPath: string, id: string): string {
  return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -147,13 +113,11 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
    status: 'draft',
    projectPath: resolvedProjectPath,
    template: template.id,
-    version: 1,
    sections: template.sections.map((section) => ({
      id: section.id,
      title: section.title,
      fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
    })),
-    missions: [],
    createdAt: now,
    updatedAt: now,
  };
@@ -226,7 +190,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
      throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
    }

-    const document = parsePrdDocument(parsed);
+    const document = prdDocumentSchema.parse(parsed);
    documents.push(document);
  }

@@ -1,433 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-import { beforeEach, describe, expect, it } from 'vitest';
-
-import {
-  PRD_GENERATED_VIEW_LABEL,
-  PrdImportConflictError,
-  PrdImportInvalidError,
-  PrdNotFoundError,
-  PrdService,
-  PrdUpdateError,
-} from './index.js';
-import type { PrdDocument } from './index.js';
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-let projectDir: string;
-
-async function makeProject(): Promise<string> {
-  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
-}
-
-function service(): PrdService {
-  return new PrdService({ projectPath: projectDir });
-}
-
-function storeDir(): string {
-  return path.join(projectDir, 'docs', 'prdy');
-}
-
-/** Handcraft a full, schema-valid PRD document for import scenarios. */
-function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
-  return {
-    id: 'imported-prd-20260101-000000',
-    title: 'Imported PRD',
-    status: 'draft',
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
-      {
-        id: 'scope-non-goals',
-        title: 'Scope / Non-Goals',
-        fields: { inScope: '', outOfScope: '' },
-      },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-async function writeImportFile(doc: PrdDocument): Promise<string> {
-  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
-  await writeFile(filePath, yaml.dump(doc), 'utf8');
-  return filePath;
-}
-
-beforeEach(async () => {
-  projectDir = await makeProject();
-});
-
-// ── Single authority store (AC: prdy path and mission path resolve to the
-//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
-
-describe('PrdService single authority store', () => {
-  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
-    const direct = await service().create({ name: 'Direct PRD' });
-    const viaMission = await service().planForMission({
-      name: 'Mission PRD',
-      missionId: 'mission-1',
-      missionVersion: '2026-01-01T00:00:00.000Z',
-    });
-
-    const files = await readdir(storeDir());
-    expect(files).toContain(`${direct.id}.yaml`);
-    expect(files).toContain(`${viaMission.id}.yaml`);
-
-    // A fresh service instance (new process equivalent) resolves both.
-    const all = await service().list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
-
-    // Stable versions: creation is v1; linkage writes do not bump content version.
-    expect((await service().get(direct.id)).version).toBe(1);
-    expect((await service().get(viaMission.id)).version).toBe(1);
-  });
-
-  it('round-trips documents through the store with identity intact', async () => {
-    const created = await service().create({ name: 'Round Trip', template: 'feature' });
-    const fresh = await service().get(created.id);
-
-    expect(fresh).toEqual(created);
-    expect(fresh.id).toBe(created.id);
-    expect(fresh.template).toBe('feature');
-    expect(fresh.status).toBe('draft');
-  });
-
-  it('throws a typed error for unknown ids and empty stores', async () => {
-    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
-    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── Mission linkage persistence (AC: linkage survives restart via fresh
-//    service instances) ────────────────────────────────────────────────────────
-
-describe('PrdService mission linkage', () => {
-  it('persists linkage and reads it back from a fresh service instance', async () => {
-    const created = await service().planForMission({
-      name: 'Linked PRD',
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Fresh instance — nothing in memory from the creating call.
-    const links = await service().listMissionLinks(created.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      prdVersion: 1,
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Linkage is carried in the YAML authority file itself.
-    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    const persisted = yaml.load(raw) as PrdDocument;
-    expect(persisted.missions[0]?.missionId).toBe('mission-42');
-    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
-  });
-
-  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
-    const created = await service().planForMission({
-      name: 'Relink PRD',
-      missionId: 'mission-7',
-      missionVersion: 'v1',
-    });
-
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
-    });
-
-    const relinked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'mission-7',
-      missionVersion: 'v2',
-      requirementIds: ['NFR-1'],
-    });
-
-    expect(relinked.missions).toHaveLength(1);
-    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
-  });
-
-  it('does not bump the content version when writing linkage', async () => {
-    const created = await service().create({ name: 'Stable Version' });
-    const linked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'm',
-      missionVersion: 'v1',
-    });
-    expect(linked.version).toBe(1);
-  });
-});
-
-// ── Update semantics ──────────────────────────────────────────────────────────
-
-describe('PrdService update', () => {
-  it('applies section patches and bumps the content version', async () => {
-    const created = await service().create({ name: 'Updatable' });
-    const updated = await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
-    });
-
-    expect(updated.version).toBe(2);
-    expect(updated.sections[0]?.fields).toMatchObject({
-      context: 'Some context',
-      objective: 'Goal',
-    });
-    expect((await service().get(created.id)).version).toBe(2);
-  });
-
-  it('refuses unknown section ids with a typed error', async () => {
-    const created = await service().create({ name: 'Strict' });
-    await expect(
-      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
-    ).rejects.toBeInstanceOf(PrdUpdateError);
-  });
-});
-
-// ── Markdown export is a labeled generated view, never authority ──────────────
-
-describe('PrdService exportMarkdown', () => {
-  it('writes a generated view carrying the label and source identity', async () => {
-    const created = await service().create({ name: 'Exported PRD' });
-    const result = await service().exportMarkdown({ id: created.id });
-
-    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
-    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
-    expect(result.content).toContain(`prd-id: ${created.id}`);
-    expect(result.content).toContain('prd-version: 1');
-    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
-  });
-
-  it('reflects the current version after updates', async () => {
-    const created = await service().create({ name: 'Versioned Export' });
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
-    });
-    const result = await service().exportMarkdown({ id: created.id });
-    expect(result.content).toContain('prd-version: 2');
-  });
-
-  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
-    const created = await service().create({ name: 'Guarded PRD' });
-    const before = structuredClone(await service().get(created.id));
-
-    const result = await service().exportMarkdown({ id: created.id });
-    await writeFile(
-      result.filePath,
-      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
-      'utf8',
-    );
-
-    const after = await service().get(created.id);
-    expect(after).toEqual(before);
-    expect(after.version).toBe(1);
-    expect(after.title).toBe(before.title);
-  });
-
-  it('never parses Markdown files that sit in the store directory', async () => {
-    const created = await service().create({ name: 'Decoy Guard' });
-
-    // A decoy .md file with invalid YAML must be invisible to the store.
-    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
-    // And a decoy .yaml-named Markdown body must not silently validate either.
-    await service().exportMarkdown({ id: created.id });
-
-    const listed = await service().list();
-    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
-    await expect(service().get(created.id)).resolves.toBeTruthy();
-  });
-});
-
-// ── Import: validated, conflict-aware, never silently merging ─────────────────
-
-describe('PrdService importDocument', () => {
-  it('creates a valid import through the service, as draft — validity is not approval', async () => {
-    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
-
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('created');
-    expect(result.document.id).toBe('imported-prd-20260101-000000');
-    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
-    expect(result.document.version).toBe(1);
-
-    const persisted = await service().get('imported-prd-20260101-000000');
-    expect(persisted.status).toBe('draft');
-
-    const files = await readdir(storeDir());
-    expect(files).toContain('imported-prd-20260101-000000.yaml');
-  });
-
-  it('reports identical content as a no-op without writing', async () => {
-    const created = await service().create({ name: 'Existing PRD' });
-    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-
-    const filePath = await writeImportFile(importFixture({ ...created }));
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('identical');
-    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    expect(after).toBe(before);
-  });
-
-  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
-    const existing = await service().create({ name: 'Authority PRD' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-      requirementIds: ['FR-0'],
-    });
-    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Divergent Title',
-      sections: [
-        {
-          id: 'introduction',
-          title: 'Introduction',
-          fields: { context: 'changed', objective: '' },
-        },
-      ],
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const attempt = service().importDocument({ filePath });
-    let caught: unknown;
-    try {
-      await attempt;
-    } catch (error) {
-      caught = error;
-    }
-    expect(caught).toBeInstanceOf(PrdImportConflictError);
-
-    const error = caught as PrdImportConflictError;
-    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
-    expect(error.existing.id).toBe(existing.id);
-    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
-    expect(error.proposal.status).toBe('draft');
-
-    // Original authority content untouched on disk.
-    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-    expect(afterBytes).toBe(beforeBytes);
-  });
-
-  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
-    const existing = await service().create({ name: 'Successor Base' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-    });
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Accepted Successor Title',
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const successor = await service().acceptSuccessor({ filePath });
-    expect(successor.id).toBe(existing.id);
-    expect(successor.version).toBe(existing.version + 1);
-    expect(successor.title).toBe('Accepted Successor Title');
-    expect(successor.status).toBe('draft');
-    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
-
-    // Persisted for a fresh reader.
-    const fresh = await service().get(existing.id);
-    expect(fresh.version).toBe(2);
-    expect(fresh.title).toBe('Accepted Successor Title');
-  });
-
-  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
-    const cases: Array<{ name: string; body: string }> = [
-      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
-      {
-        name: 'bad-status.yaml',
-        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
-      },
-      {
-        name: 'bad-version.yaml',
-        body: yaml.dump(importFixture({ version: 0 })),
-      },
-      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
-    ];
-
-    for (const fixture of cases) {
-      const filePath = path.join(projectDir, fixture.name);
-      await writeFile(filePath, fixture.body, 'utf8');
-
-      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
-        PrdImportInvalidError,
-      );
-    }
-
-    // Nothing was created: the authority store does not even exist yet.
-    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
-    const filePath = await writeImportFile(importFixture());
-    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── No second writer: no code path reads exported Markdown back into authority ─
-
-describe('no-second-writer invariant (source-level)', () => {
-  // Resolve the package source dir whether vitest runs from the package root
-  // (turbo/pnpm test) or from the worktree root.
-  function resolveSrcDir(): string {
-    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
-    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
-  }
-
-  const srcDir = resolveSrcDir();
-  const sourceFiles = [
-    'cli.ts',
-    'index.ts',
-    'prd.ts',
-    'service.ts',
-    'templates.ts',
-    'types.ts',
-    'wizard.ts',
-  ];
-
-  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
-    for (const file of sourceFiles) {
-      const text = await readFile(path.join(srcDir, file), 'utf8');
-      const readLines = text
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
-
-      for (const line of readLines) {
-        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
-      }
-    }
-  });
-
-  it('the mosaic prdy/mission adapters never read a .md file', async () => {
-    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
-    for (const file of ['prdy.ts', 'mission.ts']) {
-      const text = await readFile(path.join(adapterDir, file), 'utf8');
-      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
-        false,
-      );
-    }
-  });
-});
@@ -1,379 +0,0 @@
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-
-import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
-import type {
-  PrdCreateInput,
-  PrdDocument,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
-  PrdLinkMissionInput,
-  PrdMissionLinkage,
-  PrdPlanForMissionInput,
-  PrdServiceOptions,
-  PrdUpdateInput,
-} from './types.js';
-
-/**
- * PrdService is the SINGLE authority surface for PRD documents.
- *
- * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
- * through this service; the YAML store under `docs/prdy/` is the authority and
- * exported Markdown is a generated view that no code path reads back.
- */
-
-// ── Typed errors ───────────────────────────────────────────────────────────────
-
-export class PrdError extends Error {
-  constructor(
-    message: string,
-    readonly code: string,
-  ) {
-    super(message);
-    this.name = 'PrdError';
-  }
-}
-
-export class PrdNotFoundError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_NOT_FOUND');
-    this.name = 'PrdNotFoundError';
-  }
-}
-
-export class PrdUpdateError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_UPDATE_INVALID');
-    this.name = 'PrdUpdateError';
-  }
-}
-
-/** Structural refusal: the import payload failed schema validation. Nothing is written. */
-export class PrdImportInvalidError extends PrdError {
-  constructor(
-    message: string,
-    readonly issues?: string,
-  ) {
-    super(message, 'PRD_IMPORT_INVALID');
-    this.name = 'PrdImportInvalidError';
-  }
-}
-
-/**
- * Conflict refusal: an existing PRD shares the imported id but the content
- * diverges. Carries a PROPOSED successor (existing version + 1) that is only
- * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
- * never overwrites and never merges.
- */
-export class PrdImportConflictError extends PrdError {
-  constructor(
-    message: string,
-    readonly existing: PrdDocument,
-    readonly proposal: PrdDocument,
-  ) {
-    super(message, 'PRD_IMPORT_CONFLICT');
-    this.name = 'PrdImportConflictError';
-  }
-}
-
-// ── Service ────────────────────────────────────────────────────────────────────
-
-/** The generated-view label carried by every Markdown export. */
-export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
-
-export class PrdService {
-  private readonly projectPath: string;
-
-  constructor(options: PrdServiceOptions) {
-    this.projectPath = options.projectPath;
-  }
-
-  /** Create a new PRD (version 1, draft) in the authority store. */
-  async create(input: PrdCreateInput): Promise<PrdDocument> {
-    return createPrd({
-      name: input.name,
-      projectPath: this.projectPath,
-      template: input.template,
-      interactive: false,
-    });
-  }
-
-  /** Read a PRD by id, or the most recently updated one. */
-  async get(id?: string): Promise<PrdDocument> {
-    const documents = await listPrds(this.projectPath);
-
-    if (id === undefined) {
-      const latest = documents[0];
-      if (latest === undefined) {
-        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
-      }
-      return latest;
-    }
-
-    const match = documents.find((doc) => doc.id === id);
-    if (match === undefined) {
-      throw new PrdNotFoundError(`PRD id not found: ${id}`);
-    }
-    return match;
-  }
-
-  /** List all PRDs in the authority store (most recently updated first). */
-  async list(): Promise<PrdDocument[]> {
-    return listPrds(this.projectPath);
-  }
-
-  /**
-   * Apply section field patches and bump the content version.
-   * Linkage entries are preserved; linkage writes do NOT bump the version.
-   */
-  async update(input: PrdUpdateInput): Promise<PrdDocument> {
-    const doc = await this.get(input.id);
-
-    for (const patch of input.sections) {
-      const section = doc.sections.find((candidate) => candidate.id === patch.id);
-      if (section === undefined) {
-        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
-      }
-      for (const [field, value] of Object.entries(patch.fields)) {
-        if (!(field in section.fields)) {
-          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
-        }
-        section.fields[field] = value;
-      }
-    }
-
-    doc.version += 1;
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  /**
-   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
-   * Persisted in the YAML authority, so it survives restarts.
-   */
-  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const doc = await this.get(input.prdId);
-    return this.applyLinkage(doc, input);
-  }
-
-  /** Read back the mission linkages recorded on a PRD. */
-  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
-    const doc = await this.get(prdId);
-    return doc.missions;
-  }
-
-  /**
-   * Mission planning path: create a PRD for a mission AND persist the
-   * mission↔PRD linkage in a single authority write.
-   */
-  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
-    const doc = await this.create({ name: input.name, template: input.template });
-    return this.applyLinkage(doc, {
-      prdId: doc.id,
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      requirementIds: input.requirementIds,
-    });
-  }
-
-  /**
-   * Render the PRD to a Markdown GENERATED VIEW.
-   *
-   * The output carries source identity (PRD id + version + generated-view
-   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
-   * the authority store only loads `.yaml`/`.yml` files, and no code path in
-   * this package parses the exported Markdown.
-   */
-  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
-    const doc = await this.get(input?.id);
-    const content = renderMarkdown(doc);
-    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
-
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, content, 'utf8');
-    return { filePath, content };
-  }
-
-  /**
-   * Import a YAML PRD document.
-   *
-   * Structural validation (zod) happens BEFORE anything is proposed or
-   * written. A structurally-valid import is persisted as `draft` — validity is
-   * NOT approval. If an existing PRD shares the id with divergent content, a
-   * typed {@link PrdImportConflictError} is thrown carrying a proposed
-   * successor; the original authority document is left byte-identical on disk.
-   */
-  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      const document = this.buildImportedDocument(incoming);
-      await savePrd(document);
-      return { kind: 'created', document };
-    }
-
-    if (canonicalCore(existing) === canonicalCore(incoming)) {
-      return { kind: 'identical', document: existing };
-    }
-
-    throw new PrdImportConflictError(
-      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
-        `Proposed successor: version ${existing.version + 1} (draft). ` +
-        `Accept explicitly with acceptSuccessor().`,
-      existing,
-      this.buildSuccessor(existing, incoming),
-    );
-  }
-
-  /**
-   * Explicitly accept a conflicted import as a successor version of the
-   * existing PRD. Re-validates the source file before writing; the successor
-   * is persisted with status `draft` (acceptance of the import is not approval
-   * of the PRD) and the existing mission linkages are carried forward.
-   */
-  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      throw new PrdNotFoundError(
-        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
-      );
-    }
-
-    const successor = this.buildSuccessor(existing, incoming);
-    await savePrd(successor);
-    return successor;
-  }
-
-  // ── internals ──────────────────────────────────────────────────────────────
-
-  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const entry: PrdMissionLinkage = {
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      prdVersion: doc.version,
-      requirementIds: input.requirementIds ?? [],
-      linkedAt: new Date().toISOString(),
-    };
-
-    // One entry per mission: refresh in place if the mission is already linked.
-    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
-    if (index === -1) {
-      doc.missions.push(entry);
-    } else {
-      doc.missions[index] = entry;
-    }
-
-    // Linkage is mission-side metadata, not a content revision: bump the
-    // timestamp only so ids/versions stay stable for consumers.
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  private async readImportFile(filePath: string): Promise<PrdDocument> {
-    let raw: string;
-    try {
-      raw = await fs.readFile(filePath, 'utf8');
-    } catch (error) {
-      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
-    }
-
-    let parsed: unknown;
-    try {
-      parsed = yaml.load(raw);
-    } catch (error) {
-      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
-    }
-
-    try {
-      return parsePrdDocument(parsed);
-    } catch (error) {
-      throw new PrdImportInvalidError(
-        `Import file failed PRD schema validation: ${filePath}`,
-        error instanceof Error ? error.message : String(error),
-      );
-    }
-  }
-
-  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
-    const now = new Date().toISOString();
-    return {
-      ...incoming,
-      // The import lands in THIS project's authority store.
-      projectPath: this.projectPath,
-      // A structurally-valid import is not thereby approved.
-      status: 'draft',
-      version: 1,
-      missions: [],
-      createdAt: now,
-      updatedAt: now,
-    };
-  }
-
-  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
-    return {
-      ...incoming,
-      id: existing.id,
-      projectPath: existing.projectPath,
-      status: 'draft',
-      version: existing.version + 1,
-      missions: existing.missions,
-      createdAt: existing.createdAt,
-      updatedAt: new Date().toISOString(),
-    };
-  }
-}
-
-// ── Markdown rendering (generated view) ───────────────────────────────────────
-
-function canonicalCore(doc: PrdDocument): string {
-  return JSON.stringify([doc.title, doc.template, doc.sections]);
-}
-
-function renderMarkdown(doc: PrdDocument): string {
-  const lines: string[] = [
-    '<!--',
-    `${PRD_GENERATED_VIEW_LABEL}`,
-    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
-    `prd-id: ${doc.id}`,
-    `prd-version: ${doc.version}`,
-    `generated-at: ${new Date().toISOString()}`,
-    '-->',
-    '',
-    `# ${doc.title}`,
-    '',
-    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
-    '',
-  ];
-
-  if (doc.missions.length > 0) {
-    lines.push('## Mission Linkage', '');
-    for (const mission of doc.missions) {
-      const requirements =
-        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
-      lines.push(
-        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
-          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
-      );
-    }
-    lines.push('');
-  }
-
-  for (const section of doc.sections) {
-    lines.push(`## ${section.title}`, '');
-    for (const [field, value] of Object.entries(section.fields)) {
-      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
-    }
-  }
-
-  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
-  return lines.join('\n');
-}
@@ -19,31 +19,13 @@ export interface PrdSection {
  fields: Record<string, string>;
 }

-/**
- * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
- *
- * `missionVersion` is the mission-side revision marker available to the CLI
- * (the gateway exposes `updatedAt` for missions — there is no numeric mission
- * version yet). `prdVersion` snapshots the PRD content version at link time.
- */
-export interface PrdMissionLinkage {
-  missionId: string;
-  missionVersion: string;
-  prdVersion: number;
-  requirementIds: string[];
-  linkedAt: string;
-}
-
 export interface PrdDocument {
  id: string;
  title: string;
  status: PrdStatus;
  projectPath: string;
  template: string;
-  /** Content revision counter. Bumped by updates and accepted imports. */
-  version: number;
  sections: PrdSection[];
-  missions: PrdMissionLinkage[];
  createdAt: string;
  updatedAt: string;
 }
@@ -54,60 +36,3 @@ export interface CreatePrdOptions {
  template?: string;
  interactive?: boolean;
 }
-
-// ── PrdService surface (single authority entry point) ─────────────────────────
-
-export interface PrdServiceOptions {
-  projectPath: string;
-}
-
-export interface PrdCreateInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdSectionPatch {
-  id: string;
-  fields: Record<string, string>;
-}
-
-export interface PrdUpdateInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  sections: PrdSectionPatch[];
-}
-
-export interface PrdLinkMissionInput {
-  /** Defaults to the most recently updated PRD. */
-  prdId?: string;
-  missionId: string;
-  missionVersion: string;
-  requirementIds?: string[];
-}
-
-export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdExportInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  /** Override the generated-view output path. */
-  outPath?: string;
-}
-
-export interface PrdExportResult {
-  filePath: string;
-  content: string;
-}
-
-/** Discriminated result of a non-conflicting import. */
-export type PrdImportResult =
-  | { kind: 'created'; document: PrdDocument }
-  | { kind: 'identical'; document: PrdDocument };
-
-export interface PrdImportInput {
-  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
-  filePath: string;
-}
@@ -2,8 +2,8 @@ import path from 'node:path';

 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';

-import { PrdService } from './service.js';
-import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';
+import { createPrd, savePrd } from './prd.js';
+import type { CreatePrdOptions, PrdDocument } from './types.js';

 interface WizardAnswers {
  goals: string;
@@ -11,41 +11,20 @@ interface WizardAnswers {
  milestones: string;
 }

-/**
- * Translate wizard answers into section patches using the same keyword
- * matching the wizard always used (first section whose id contains the
- * keyword, then first field whose name contains it, else first field).
- */
-function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
-  const bySection = new Map<string, PrdSectionPatch>();
+function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
+  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));

-  const add = (keyword: string, value: string): void => {
-    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
-    if (section === undefined) {
-      return;
-    }
+  if (section === undefined) {
+    return;
+  }

-    const fieldName =
-      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
-      Object.keys(section.fields)[0];
+  const fieldName =
+    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
+    Object.keys(section.fields)[0];

-    if (fieldName === undefined || section.fields[fieldName] === value) {
-      return;
-    }
-
-    const existing = bySection.get(section.id);
-    if (existing === undefined) {
-      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
-    } else {
-      existing.fields[fieldName] = value;
-    }
-  };
-
-  add('goal', answers.goals);
-  add('constraint', answers.constraints);
-  add('milestone', answers.milestones);
-
-  return [...bySection.values()];
+  if (fieldName !== undefined) {
+    section.fields[fieldName] = value;
+  }
 }

 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -84,10 +63,15 @@ async function promptTemplate(template?: string): Promise<string> {
  return choice;
 }

-/**
- * Interactive PRD wizard. All writes go through PrdService — the wizard is a
- * prompt layer, never a second writer path.
- */
+function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
+  updateSectionField(doc, 'goal', answers.goals);
+  updateSectionField(doc, 'constraint', answers.constraints);
+  updateSectionField(doc, 'milestone', answers.milestones);
+
+  doc.updatedAt = new Date().toISOString();
+  return doc;
+}
+
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
  intro('Mosaic PRD wizard');

@@ -98,15 +82,20 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
  const constraints = await promptText('Key constraints');
  const milestones = await promptText('Planned milestones');

-  const service = new PrdService({ projectPath: options.projectPath });
-  const doc = await service.create({
+  const doc = await createPrd({
+    ...options,
    name,
    template,
+    interactive: true,
  });

-  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
-  const updated =
-    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;
+  const updated = applyWizardAnswers(doc, {
+    goals,
+    constraints,
+    milestones,
+  });
+
+  await savePrd(updated);

  outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);

@@ -1,37 +0,0 @@
-# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
-
- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
-  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
-  Markdown export is a labeled generated view (never read back); import is
-  validated/conflict-aware with typed refusals.
- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
-  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
-  root build rc=0.
- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
-  typed errors (3) wizard/cli route through service (4) mosaic adapters
-  (5) contract specs both packages (6) gates (7) sabotage control (8) report
-  to /var/tmp/ri-050/ri-4-001-report.md.
- Decisions:
-  - Linkage lives ON the PRD document (`missions` array) — one authority file,
-    survives restart, no sidecar sync problems.
-  - `version` = content revision of sections/status (bumped by update/import
-    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
-    for the card's "stable ids/versions" contract.
-  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
-    numeric version field).
-  - Import reads YAML documents only — never the exported Markdown (keeps the
-    "no code path reads exported Markdown" invariant).
-  - Import of an existing id with identical core content → `identical` no-op;
-    divergent → typed `PrdImportConflictError` carrying proposed successor
-    (existing.version + 1, status draft, linkages preserved). Original bytes
-    untouched until explicit `acceptSuccessor`.
-  - `requirementIds` default `[]` at the mission command (no requirement
-    selection UI yet) — service accepts ids when a caller has them.
- Progress log:
-  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
-  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
-  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
-  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
-  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
-  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
-  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete