docs: finalize ri-4-001 scratchpad with verification evidence (#1275 )

docs: ri-4-001 scratchpad for PRD authority card (#1275 )
test(mosaic): RI-N3 contract specs for prdy and mission --plan adapters (#1275 )
2026-08-17 16:48:39 -05:00 · 2026-08-17 16:46:17 -05:00 · 2026-08-17 16:46:14 -05:00 · 2026-08-17 16:46:06 -05:00 · 2026-08-17 16:46:00 -05:00 · 2026-08-17 20:44:59 +00:00
18 changed files with 1570 additions and 1074 deletions
@@ -39,3 +39,20 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
+
+# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
+# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
+# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
+# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
+# real system path, so on a host that installs those binaries the missing-binary
+# cases cannot be measured at all. The suite's own guard (line 103) says so and
+# fails rather than reporting a pass it cannot back. That guard is correct.
+# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
+# dropped this exclusion, and the CI image provides `pi` in the system path, so
+# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
+# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
+# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
+# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
+# Because test:framework-shell is one && chain and this sat at position 44 of 48,
+# the four suites after it had not run at all since the merge.
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -20,7 +20,6 @@ import { registerMissionCommand } from './commands/mission.js';
 import { registerUninstallCommand } from './commands/uninstall.js';
 import { registerRestoreCommand } from './commands/restore.js';
 import { registerSkillCommand } from './commands/skill.js';
-import { registerStoreCommand } from './commands/store.js';
 // prdy is registered via launch.ts
 import { registerLaunchCommands } from './commands/launch.js';
 import { registerLeaseCapabilityProbe } from './commands/lease-activation-probe.js';
@@ -426,10 +425,6 @@ registerRestoreCommand(program);

 registerSkillCommand(program);

-// ─── store ───────────────────────────────────────────────────────────────────
-
-registerStoreCommand(program);
-
 // ─── telemetry ───────────────────────────────────────────────────────────────

 registerTelemetryCommand(program);
@@ -0,0 +1,149 @@
+import { mkdtemp, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { parse as parseYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerMissionCommand } from './mission.js';
+import { PrdService } from '@mosaicstack/prdy';
+import type { MissionInfo } from '../tui/gateway-api.js';
+
+// ── Mocks: the gateway is not available in adapter tests ──────────────────────
+
+// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
+// be initialized there too.
+const MISSION = vi.hoisted(
+  (): MissionInfo => ({
+    id: 'mission-plan-1',
+    name: 'Plan Mission Alpha',
+    description: null,
+    status: 'planning',
+    projectId: null,
+    userId: null,
+    phase: null,
+    milestones: null,
+    config: null,
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-03-04T05:06:07.000Z',
+  }),
+);
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
+  fetchMission: vi.fn(),
+  createMission: vi.fn(),
+  updateMission: vi.fn(),
+  fetchMissionTasks: vi.fn().mockResolvedValue([]),
+  createMissionTask: vi.fn(),
+  updateMissionTask: vi.fn(),
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerMissionCommand(program);
+  return program;
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
+  process.chdir(projectDir);
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  consoleStub.push(logSpy);
+});
+
+afterEach(() => {
+  // Restore only the per-test spies; module factory mocks keep their
+  // implementations across tests.
+  for (const stub of consoleStub) stub.mockRestore();
+  consoleStub = [];
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic mission --plan (thin adapter over PrdService)', () => {
+  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // PRD landed in the same store `mosaic prdy` uses.
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    // Fresh service instance (new-process equivalent) reads the linkage back.
+    const service = new PrdService({ projectPath: projectDir });
+    const docs = await service.list();
+    expect(docs).toHaveLength(1);
+
+    const prd = docs[0]!;
+    expect(prd.title).toBe('Plan Mission Alpha');
+    expect(prd.version).toBe(1);
+
+    const links = await service.listMissionLinks(prd.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: MISSION.id,
+      missionVersion: MISSION.updatedAt, // mission version marker
+      prdVersion: 1,
+    });
+
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
+  });
+
+  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
+    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
+
+    expect(persisted.missions).toHaveLength(1);
+    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
+  });
+
+  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
+    // Mission path.
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // prdy path (service, non-interactive entry).
+    const service = new PrdService({ projectPath: projectDir });
+    const direct = await service.create({ name: 'Directly Created' });
+
+    const all = await service.list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
+    expect(all).toHaveLength(2);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toContain(`${direct.id}.yaml`);
+
+    // Both are v1 in the same store with distinct stable ids.
+    for (const doc of all) {
+      expect(doc.version).toBe(1);
+      expect(files).toContain(`${doc.id}.yaml`);
+    }
+  });
+});
@@ -256,14 +256,41 @@ async function planMission(
  console.log(`Planning mission: ${mission.name}\n`);

  try {
-    const { runPrdWizard } = await import('@mosaicstack/prdy');
-    await runPrdWizard({
+    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
+    // PrdService — no second writer path. The mission's updatedAt serves as
+    // its version marker (the gateway exposes no numeric mission version).
+    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+    const service = new PrdService({ projectPath: process.cwd() });
+
+    if (process.stdout.isTTY) {
+      const created = await runPrdWizard({
+        name: mission.name,
+        projectPath: process.cwd(),
+        interactive: true,
+      });
+      const linked = await service.linkMission({
+        prdId: created.id,
+        missionId: mission.id,
+        missionVersion: mission.updatedAt,
+        requirementIds: [],
+      });
+      console.log(
+        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
+      );
+      return;
+    }
+
+    const doc = await service.planForMission({
      name: mission.name,
-      projectPath: process.cwd(),
-      interactive: true,
+      missionId: mission.id,
+      missionVersion: mission.updatedAt,
+      requirementIds: [],
    });
+    console.log(
+      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
+    );
  } catch (err) {
-    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
    process.exit(1);
  }
 }
@@ -0,0 +1,204 @@
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { stringify as stringifyYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerPrdyCommand } from './prdy.js';
+import { PrdService } from '@mosaicstack/prdy';
+
+// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
+//    outside the tmp project dir) ──────────────────────────────────────────────
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+class ProcessExitError extends Error {
+  constructor(readonly code: number) {
+    super(`process.exit(${code})`);
+  }
+}
+
+function stubProcessExit() {
+  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    throw new ProcessExitError(code ?? 0);
+  }) as never);
+}
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let errorSpy: ReturnType<typeof vi.spyOn>;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let exitStub: ReturnType<typeof stubProcessExit>;
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerPrdyCommand(program);
+  return program;
+}
+
+function runPrdy(args: string[]): Promise<unknown> {
+  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
+}
+
+function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    id: 'cmd-import-prd',
+    title: 'Command Import PRD',
+    status: 'approved', // must be forced to draft: validity is not approval
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
+  process.chdir(projectDir);
+  exitStub = stubProcessExit();
+  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+});
+
+afterEach(() => {
+  // Restore only the per-test spies: module factory mocks must keep their
+  // implementations for the next test.
+  exitStub.mockRestore();
+  errorSpy.mockRestore();
+  logSpy.mockRestore();
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic prdy (thin adapter over PrdService)', () => {
+  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
+    await runPrdy(['--init', 'Adapter Created']);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.title).toBe('Adapter Created');
+    expect(docs[0]?.version).toBe(1);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
+  });
+
+  it('--import <file> creates a valid import through the service', async () => {
+    const filePath = path.join(projectDir, 'incoming.yaml');
+    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
+
+    await runPrdy(['--import', filePath]);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.id).toBe('cmd-import-prd');
+    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
+  });
+
+  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
+    const filePath = path.join(projectDir, 'broken.yaml');
+    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    // Typed refusal surfaced to the user, nothing created.
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
+    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Conflict Target' });
+    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
+    const beforeBytes = await readFile(storeFile, 'utf8');
+
+    const filePath = path.join(projectDir, 'divergent.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Divergent Command Import',
+        }),
+      ),
+      'utf8',
+    );
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
+
+    // Original authority document is byte-identical on disk.
+    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
+  });
+
+  it('--import --accept-successor persists the successor version explicitly', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Successor Target' });
+
+    const filePath = path.join(projectDir, 'divergent2.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Accepted Via CLI',
+        }),
+      ),
+      'utf8',
+    );
+
+    await runPrdy(['--import', filePath, '--accept-successor']);
+
+    const doc = await service.get(existing.id);
+    expect(doc.version).toBe(2);
+    expect(doc.title).toBe('Accepted Via CLI');
+    expect(doc.status).toBe('draft');
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
+  });
+
+  it('--export writes a labeled generated view and never touches authority', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const created = await service.create({ name: 'Export Via CLI' });
+    const before = await service.get(created.id);
+
+    await runPrdy(['--export', created.id]);
+
+    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
+    const md = await readFile(mdPath, 'utf8');
+    expect(md).toContain('generated view — do not edit');
+    expect(md).toContain(`prd-id: ${created.id}`);
+    expect(md).toContain('prd-version: 1');
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining(`Generated view written: ${mdPath}`),
+    );
+
+    // Authority unchanged by the export.
+    expect(await service.get(created.id)).toEqual(before);
+  });
+});
@@ -2,6 +2,10 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';

+/**
+ * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
+ * All reads/writes go through the service; there is no local writer path.
+ */
 export function registerPrdyCommand(program: Command) {
  const cmd = program
    .command('prdy')
@@ -9,12 +13,18 @@ export function registerPrdyCommand(program: Command) {
    .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
    .option('--init [name]', 'Create a new PRD')
    .option('--update [name]', 'Update an existing PRD')
+    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
+    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
+    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
    .option('--project <idOrName>', 'Scope to project')
    .action(
      async (opts: {
        gateway: string;
        init?: string | boolean;
        update?: string | boolean;
+        import?: string;
+        acceptSuccessor?: boolean;
+        export?: string | boolean;
        project?: string;
      }) => {
        // Detect project context when --project flag is provided
@@ -31,20 +41,69 @@ export function registerPrdyCommand(program: Command) {
          }
        }

+        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+        const service = new PrdService({ projectPath: process.cwd() });
+
        try {
-          const { runPrdWizard } = await import('@mosaicstack/prdy');
+          if (opts.import !== undefined) {
+            const input = { filePath: opts.import };
+
+            if (opts.acceptSuccessor) {
+              const successor = await service.acceptSuccessor(input);
+              console.log(
+                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
+              );
+              return;
+            }
+
+            const result = await service.importDocument(input);
+            console.log(
+              result.kind === 'created'
+                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
+                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
+            );
+            return;
+          }
+
+          if (opts.export !== undefined) {
+            const id =
+              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
+            const result = await service.exportMarkdown({ id });
+            console.log(
+              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
+            );
+            return;
+          }
+
          const name =
            typeof opts.init === 'string'
              ? opts.init
              : typeof opts.update === 'string'
                ? opts.update
                : 'untitled';
-          await runPrdWizard({
-            name,
-            projectPath: process.cwd(),
-            interactive: true,
-          });
+
+          if (process.stdout.isTTY) {
+            await runPrdWizard({
+              name,
+              projectPath: process.cwd(),
+              interactive: true,
+            });
+            return;
+          }
+
+          // Non-interactive fallback routes through the service directly.
+          const doc = await service.create({ name });
+          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
        } catch (err) {
+          if (err instanceof Error && err.name === 'PrdImportConflictError') {
+            const conflict = err as { proposal?: { version?: number } };
+            console.error(`${err.message}`);
+            console.error(
+              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
+            );
+            process.exit(1);
+          }
+
          console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
          process.exit(1);
        }
@@ -1,458 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { Command } from 'commander';
-import {
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import {
-  addStoreEntry,
-  getDefaultStorePaths,
-  listStoreEntries,
-  registerStoreCommand,
-  StoreError,
-  storeKindDir,
-  validateStoreKind,
-  validateStoreName,
-  validateStoreVersion,
-  type StorePaths,
-} from './store.js';
-
-/** Assert a typed StoreError with exactly the expected code. */
-function expectStoreError(run: () => unknown, code: string): void {
-  try {
-    run();
-  } catch (error) {
-    expect(error).toBeInstanceOf(StoreError);
-    expect((error as StoreError).code).toBe(code);
-    return;
-  }
-  throw new Error(`expected StoreError ${code}, but nothing threw`);
-}
-
-describe('vetted user store (W-F4)', () => {
-  let root: string;
-  let paths: StorePaths;
-  let sourceRoot: string;
-
-  beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), 'mosaic-store-cli-'));
-    paths = { userRoot: join(root, '.mosaic') };
-    sourceRoot = join(root, 'sources');
-    mkdirSync(sourceRoot, { recursive: true });
-  });
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-  });
-
-  function createSource(name: string): string {
-    const dir = join(sourceRoot, name);
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, 'SKILL.md'), `# ${name}\n`);
-    return dir;
-  }
-
-  describe('name and version validation (before any filesystem call)', () => {
-    const invalidNames = [
-      '../../etc',
-      '/abs/path',
-      'a/b',
-      String.raw`a\b`,
-      '-rf',
-      '..',
-      'safe.',
-      'space name',
-      'line\nbreak',
-      'escape\u001B[31m',
-    ];
-
-    for (const name of invalidNames) {
-      it(`rejects name ${JSON.stringify(name)}`, () => {
-        expect(() => validateStoreName(name)).toThrow(StoreError);
-      });
-    }
-
-    const invalidVersions = ['', '-1', '1..0', 'a/b', '..', '1.0 beta', '/x'];
-    for (const version of invalidVersions) {
-      it(`rejects version ${JSON.stringify(version)}`, () => {
-        expect(() => validateStoreVersion(version)).toThrow(StoreError);
-      });
-    }
-
-    it('accepts semver-shaped versions including prerelease and build metadata', () => {
-      expect(() => validateStoreVersion('0.1.0-beta.1')).not.toThrow();
-      expect(() => validateStoreVersion('1.2.3+build.7')).not.toThrow();
-    });
-
-    it('rejects plural and unknown kinds', () => {
-      expectStoreError(() => validateStoreKind('plugins'), 'STORE_INVALID_KIND');
-      expectStoreError(() => validateStoreKind('widget'), 'STORE_INVALID_KIND');
-    });
-
-    it('accepts the two spec kinds', () => {
-      expect(() => validateStoreKind('plugin')).not.toThrow();
-      expect(() => validateStoreKind('skill')).not.toThrow();
-    });
-  });
-
-  describe('addStoreEntry', () => {
-    it('copies content into a versioned directory and writes the marker last', () => {
-      const result = addStoreEntry(
-        'skill',
-        'demo',
-        '1.0.0',
-        createSource('demo'),
-        'op',
-        undefined,
-        paths,
-      );
-      expect(result.status).toBe('added');
-      const entryPath = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      expect(result.entryPath).toBe(entryPath);
-      expect(existsSync(join(entryPath, 'SKILL.md'))).toBe(true);
-      expect(existsSync(join(entryPath, 'store-entry.json'))).toBe(true);
-      const meta = JSON.parse(readFileSync(join(entryPath, 'store-entry.json'), 'utf-8'));
-      expect(meta).toMatchObject({
-        schema: 1,
-        kind: 'skill',
-        name: 'demo',
-        version: '1.0.0',
-        vettedBy: 'op',
-      });
-      expect(typeof meta['vettedAt']).toBe('string');
-    });
-
-    it('writes plugins under plugins/ and skills under skills/', () => {
-      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'op', undefined, paths);
-      addStoreEntry('skill', 'beta', '2.0.0', createSource('beta'), 'op', undefined, paths);
-      expect(existsSync(join(paths.userRoot, 'plugins', 'alpha', '0.1.0'))).toBe(true);
-      expect(existsSync(join(paths.userRoot, 'skills', 'beta', '2.0.0'))).toBe(true);
-    });
-
-    it('is append-only: an existing version with a marker is refused, not overwritten', () => {
-      const sourceA = createSource('demo');
-      const sourceB = join(sourceRoot, 'demo-other');
-      mkdirSync(sourceB, { recursive: true });
-      writeFileSync(join(sourceB, 'SKILL.md'), '# changed\n');
-      addStoreEntry('skill', 'demo', '1.0.0', sourceA, 'op', undefined, paths);
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', sourceB, 'op', undefined, paths),
-        'STORE_ALREADY_PRESENT',
-      );
-      expect(
-        readFileSync(join(paths.userRoot, 'skills', 'demo', '1.0.0', 'SKILL.md'), 'utf-8'),
-      ).toBe('# demo\n');
-    });
-
-    it('allows a second version alongside the first', () => {
-      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
-      const result = addStoreEntry(
-        'skill',
-        'demo',
-        '1.1.0',
-        createSource('demo'),
-        'op',
-        undefined,
-        paths,
-      );
-      expect(result.status).toBe('added');
-      expect(readdirSync(join(paths.userRoot, 'skills', 'demo')).sort()).toEqual([
-        '1.0.0',
-        '1.1.0',
-      ]);
-    });
-
-    it('refuses an unmarked target directory by default and preserves its content', () => {
-      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      mkdirSync(unmarked, { recursive: true });
-      writeFileSync(join(unmarked, 'SKILL.md'), '# operator content\n');
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths),
-        'STORE_TARGET_UNMARKED',
-      );
-      // The operator's hand-placed content survives the refusal.
-      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# operator content\n');
-    });
-
-    it('reclaims an unmarked target only under explicit reclaim opt-in', () => {
-      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      mkdirSync(unmarked, { recursive: true });
-      writeFileSync(join(unmarked, 'SKILL.md'), '# torn write\n');
-      const result = addStoreEntry(
-        'skill',
-        'demo',
-        '1.0.0',
-        createSource('demo'),
-        'op',
-        undefined,
-        paths,
-        { reclaim: true },
-      );
-      expect(result.status).toBe('reclaimed-unmarked');
-      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# demo\n');
-    });
-
-    it('reclaim can never destroy a marked, vetted entry (append-only holds under --reclaim)', () => {
-      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
-      const marked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      const vettedContent = readFileSync(join(marked, 'SKILL.md'), 'utf-8');
-      expectStoreError(
-        () =>
-          addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths, {
-            reclaim: true,
-          }),
-        'STORE_ALREADY_PRESENT',
-      );
-      // Load-bearing half: the throw alone does not prove nothing was deleted
-      // before it. Pins the marker-check-before-reclaim-check ordering against
-      // the guard-clause-migrates-upward refactor (review finding on b2124c6).
-      expect(readFileSync(join(marked, 'SKILL.md'), 'utf-8')).toBe(vettedContent);
-      expect(existsSync(join(marked, 'store-entry.json'))).toBe(true);
-    });
-
-    it('refuses a missing source with a typed error', () => {
-      expectStoreError(
-        () =>
-          addStoreEntry('skill', 'demo', '1.0.0', join(sourceRoot, 'nope'), 'op', undefined, paths),
-        'STORE_SOURCE_MISSING',
-      );
-    });
-
-    it('refuses a file (non-directory) source with a typed error', () => {
-      const filePath = join(sourceRoot, 'file.txt');
-      writeFileSync(filePath, 'x');
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', filePath, 'op', undefined, paths),
-        'STORE_SOURCE_NOT_DIR',
-      );
-    });
-
-    it('refuses a symlinked source with a typed error and writes nothing', () => {
-      const real = createSource('demo');
-      const link = join(sourceRoot, 'demo-link');
-      symlinkSync(real, link);
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', link, 'op', undefined, paths),
-        'STORE_SOURCE_SYMLINK',
-      );
-      expect(existsSync(join(paths.userRoot, 'skills', 'demo'))).toBe(false);
-    });
-
-    it('refuses a source tree containing nested symlinks and writes nothing', () => {
-      const src = createSource('demo');
-      const target = join(sourceRoot, 'elsewhere');
-      mkdirSync(target, { recursive: true });
-      symlinkSync(target, join(src, 'escape'));
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', src, 'op', undefined, paths),
-        'STORE_SOURCE_SYMLINK',
-      );
-      expect(existsSync(join(paths.userRoot, 'skills', 'demo'))).toBe(false);
-    });
-
-    it('refuses adding from inside the store itself', () => {
-      const first = addStoreEntry(
-        'skill',
-        'demo',
-        '1.0.0',
-        createSource('demo'),
-        'op',
-        undefined,
-        paths,
-      );
-      expectStoreError(
-        () => addStoreEntry('skill', 'copy', '1.0.0', first.entryPath, 'op', undefined, paths),
-        'STORE_SOURCE_INSIDE_STORE',
-      );
-    });
-
-    it('refuses a symlinked user root ancestor', () => {
-      const linkedRoot = join(sourceRoot, 'linked-mosaic');
-      symlinkSync(paths.userRoot, linkedRoot);
-      expectStoreError(
-        () =>
-          addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, {
-            userRoot: linkedRoot,
-          }),
-        'STORE_SYMLINK_ROOT',
-      );
-    });
-
-    it('requires a non-empty vetting attribution', () => {
-      expectStoreError(
-        () => addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), '  ', undefined, paths),
-        'STORE_INVALID_VETTER',
-      );
-    });
-  });
-
-  describe('listStoreEntries', () => {
-    it('returns empty for an absent store without creating it', () => {
-      expect(listStoreEntries(paths)).toEqual([]);
-      expect(existsSync(paths.userRoot)).toBe(false);
-    });
-
-    it('lists entries deterministically with vetting metadata', () => {
-      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'fred', undefined, paths);
-      addStoreEntry('skill', 'beta', '2.0.0', createSource('beta'), 'fargo', 'looked fine', paths);
-      addStoreEntry('skill', 'beta', '2.1.0', createSource('beta'), 'fargo', undefined, paths);
-
-      const entries = listStoreEntries(paths);
-      expect(entries.map((e) => `${e.kind}:${e.name}:${e.version}`)).toEqual([
-        'plugin:alpha:0.1.0',
-        'skill:beta:2.0.0',
-        'skill:beta:2.1.0',
-      ]);
-      expect(entries[0]?.meta?.vettedBy).toBe('fred');
-      expect(entries[1]?.meta?.notes).toBe('looked fine');
-    });
-
-    it('classifies markerless version directories as incomplete', () => {
-      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
-      mkdirSync(join(paths.userRoot, 'skills', 'demo', '2.0.0'), { recursive: true });
-      const entries = listStoreEntries(paths, { kind: 'skill', name: 'demo' });
-      expect(entries.find((e) => e.version === '1.0.0')?.status).toBe('vetted');
-      expect(entries.find((e) => e.version === '2.0.0')?.status).toBe('incomplete');
-    });
-
-    it('classifies malformed marker JSON as invalid-metadata, not vetted', () => {
-      addStoreEntry('skill', 'demo', '1.0.0', createSource('demo'), 'op', undefined, paths);
-      writeFileSync(
-        join(paths.userRoot, 'skills', 'demo', '1.0.0', 'store-entry.json'),
-        '{not json',
-      );
-      const entries = listStoreEntries(paths);
-      expect(entries[0]?.status).toBe('invalid-metadata');
-    });
-
-    it('surfaces foreign files (never mutates them)', () => {
-      mkdirSync(join(paths.userRoot, 'skills'), { recursive: true });
-      writeFileSync(join(paths.userRoot, 'skills', 'stray.txt'), 'x');
-      const entries = listStoreEntries(paths);
-      expect(entries[0]?.status).toBe('foreign');
-      expect(existsSync(join(paths.userRoot, 'skills', 'stray.txt'))).toBe(true);
-    });
-
-    it('filters by kind and name', () => {
-      addStoreEntry('plugin', 'alpha', '0.1.0', createSource('alpha'), 'op', undefined, paths);
-      addStoreEntry('skill', 'beta', '1.0.0', createSource('beta'), 'op', undefined, paths);
-      expect(listStoreEntries(paths, { kind: 'plugin' }).map((e) => e.name)).toEqual(['alpha']);
-      expect(listStoreEntries(paths, { name: 'beta' }).map((e) => e.name)).toEqual(['beta']);
-      expect(() => listStoreEntries(paths, { name: '../escape' })).toThrow(StoreError);
-    });
-  });
-
-  describe('default paths seam', () => {
-    it('honors MOSAIC_USER_HOME', () => {
-      const previous = process.env['MOSAIC_USER_HOME'];
-      try {
-        process.env['MOSAIC_USER_HOME'] = join(root, 'custom-user-home');
-        expect(getDefaultStorePaths().userRoot).toBe(join(root, 'custom-user-home'));
-        expect(storeKindDir('plugin')).toBe(join(root, 'custom-user-home', 'plugins'));
-      } finally {
-        if (previous === undefined) delete process.env['MOSAIC_USER_HOME'];
-        else process.env['MOSAIC_USER_HOME'] = previous;
-      }
-    });
-  });
-
-  describe('CLI', () => {
-    let previousExitCode: string | number | null | undefined;
-
-    beforeEach(() => {
-      previousExitCode = process.exitCode;
-      process.exitCode = undefined;
-    });
-
-    afterEach(() => {
-      process.exitCode = previousExitCode;
-    });
-
-    const parse = (args: string[]) => {
-      const program = new Command().exitOverride();
-      registerStoreCommand(program, paths);
-      return program.parseAsync(['node', 'mosaic', 'store', ...args]);
-    };
-
-    it('registers on the parent program and renders help', () => {
-      const program = new Command().exitOverride();
-      registerStoreCommand(program, paths);
-      const cmd = program.commands.find((c) => c.name() === 'store');
-      expect(cmd).toBeDefined();
-      expect(() => cmd?.helpInformation()).not.toThrow();
-    });
-
-    it('add exits nonzero with a typed code for an invalid name', async () => {
-      await parse([
-        'add',
-        'skill',
-        '../../etc',
-        '1.0.0',
-        '--from',
-        createSource('x'),
-        '--by',
-        'op',
-      ]);
-      expect(process.exitCode).toBe(1);
-    });
-
-    it('add exits nonzero when the kind is plural', async () => {
-      await parse(['add', 'skills', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
-      expect(process.exitCode).toBe(1);
-    });
-
-    it('add succeeds and creates the entry directory', async () => {
-      await parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
-      expect(process.exitCode).toBeUndefined();
-      expect(lstatSync(join(paths.userRoot, 'skills', 'demo', '1.0.0')).isDirectory()).toBe(true);
-    });
-
-    it('add requires --by (commander requiredOption)', async () => {
-      await expect(
-        parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo')]),
-      ).rejects.toThrow(/--by/);
-    });
-
-    it('add exits nonzero on an unmarked target without --reclaim, preserving content', async () => {
-      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      mkdirSync(unmarked, { recursive: true });
-      writeFileSync(join(unmarked, 'SKILL.md'), '# operator\n');
-      await parse(['add', 'skill', 'demo', '1.0.0', '--from', createSource('demo'), '--by', 'op']);
-      expect(process.exitCode).toBe(1);
-      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# operator\n');
-    });
-
-    it('add --reclaim replaces the unmarked target and succeeds', async () => {
-      const unmarked = join(paths.userRoot, 'skills', 'demo', '1.0.0');
-      mkdirSync(unmarked, { recursive: true });
-      writeFileSync(join(unmarked, 'SKILL.md'), '# torn\n');
-      await parse([
-        'add',
-        'skill',
-        'demo',
-        '1.0.0',
-        '--from',
-        createSource('demo'),
-        '--by',
-        'op',
-        '--reclaim',
-      ]);
-      expect(process.exitCode).toBeUndefined();
-      expect(readFileSync(join(unmarked, 'SKILL.md'), 'utf-8')).toBe('# demo\n');
-    });
-
-    it('list exits 0 on an empty store', async () => {
-      await parse(['list']);
-      expect(process.exitCode).toBeUndefined();
-    });
-  });
-});
@@ -1,544 +0,0 @@
-import {
-  cpSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-  type Dirent,
-  type Stats,
-} from 'node:fs';
-import { isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
-import type { Command } from 'commander';
-import { DEFAULT_MOSAIC_USER_HOME } from '../constants.js';
-
-/**
- * `mosaic store` — the vetted user store under `~/.mosaic/{plugins,skills}` (W-F4).
- *
- * Two roots with distinct ownership (HARNESS-HOMES design, frozen REV3):
- * - `~/.config/mosaic/` is the SYSTEM root: update-owned, replaceable wholesale.
- * - `~/.mosaic/` is the USER root: never touched by installs or updates.
- *
- * This module only ever writes under the USER root. The store is the vetting
- * boundary: content lands here only through an explicit `store add` carrying a
- * named vetting attribution, and every entry is versioned
- * (`store/<kind>s/<name>/<version>/`) with a `store-entry.json` marker written
- * LAST — a version directory without its marker is never a usable entry, and
- * an unmarked target is REFUSED by default: it may be this tool's own debris
- * from an interrupted add, or content the operator placed by hand, and the
- * code cannot tell those apart — so deletion happens only under an explicit
- * `--reclaim` opt-in, and the result status names what was done.
- *
- * Deferred by design (W-F6 and later): activation/symlink-install into agent
- * homes, `current`-pointer pinning, network acquisition. `add` accepts a local
- * source path only — no network, no credentials, ever.
- */
-
-export type StoreKind = 'plugin' | 'skill';
-export const STORE_KINDS: readonly StoreKind[] = ['plugin', 'skill'];
-
-/** On-disk metadata marker; written last so its presence commits an entry. */
-export const STORE_ENTRY_MARKER = 'store-entry.json';
-
-export interface StorePaths {
-  /** User data root, e.g. `~/.mosaic`. */
-  userRoot: string;
-}
-
-export interface StoreEntryMeta {
-  schema: 1;
-  kind: StoreKind;
-  name: string;
-  version: string;
-  /** Absolute source path the content was vetted from, as resolved at add time. */
-  sourcePath: string;
-  /** Operator who vouched for the content — required, non-empty. */
-  vettedBy: string;
-  /** ISO timestamp of the add. */
-  vettedAt: string;
-  /** Free-form vetting notes, if any. */
-  notes?: string;
-}
-
-export type StoreAddStatus = 'added' | 'reclaimed-unmarked';
-
-export interface StoreAddResult {
-  kind: StoreKind;
-  name: string;
-  version: string;
-  status: StoreAddStatus;
-  entryPath: string;
-  sourcePath: string;
-}
-
-export type StoreEntryStatus = 'vetted' | 'incomplete' | 'invalid-metadata' | 'foreign';
-
-export interface StoreListEntry {
-  kind: StoreKind;
-  name: string;
-  /** Undefined for name-level foreign files (not a directory at all). */
-  version?: string;
-  status: StoreEntryStatus;
-  entryPath: string;
-  meta?: StoreEntryMeta;
-}
-
-const SAFE_STORE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-const SAFE_STORE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
-
-export class StoreError extends Error {
-  public readonly code: string;
-
-  public constructor(code: string, message: string) {
-    super(message);
-    this.name = 'StoreError';
-    this.code = code;
-  }
-}
-
-/** Resolve the user store root while keeping tests injectable. */
-export function getDefaultStorePaths(): StorePaths {
-  const userRoot = process.env['MOSAIC_USER_HOME'] ?? DEFAULT_MOSAIC_USER_HOME;
-  return { userRoot };
-}
-
-/**
- * Reject a user-supplied name before any filesystem operation.
- * A store name identifies one directory under `store/<kind>s/`.
- */
-export function validateStoreName(name: string): void {
-  if (
-    name.length === 0 ||
-    name.startsWith('-') ||
-    name.endsWith('.') ||
-    name.includes('..') ||
-    name.includes('/') ||
-    name.includes('\\') ||
-    isAbsolute(name) ||
-    !SAFE_STORE_NAME.test(name)
-  ) {
-    throw new StoreError(
-      'STORE_INVALID_NAME',
-      `Invalid store name ${JSON.stringify(name)}: use letters, numbers, dots, underscores, or hyphens; start with a letter or number; and do not use paths, "..", or a leading "-".`,
-    );
-  }
-}
-
-/** Versions share the name discipline plus `+` (semver build metadata). */
-export function validateStoreVersion(version: string): void {
-  if (
-    version.length === 0 ||
-    version.startsWith('-') ||
-    version.endsWith('.') ||
-    version.includes('..') ||
-    version.includes('/') ||
-    version.includes('\\') ||
-    isAbsolute(version) ||
-    !SAFE_STORE_VERSION.test(version)
-  ) {
-    throw new StoreError(
-      'STORE_INVALID_VERSION',
-      `Invalid version ${JSON.stringify(version)}: use letters, numbers, dots, underscores, hyphens, or plus; start with a letter or number; and do not use paths, "..", or a leading "-".`,
-    );
-  }
-}
-
-export function validateStoreKind(kind: string): asserts kind is StoreKind {
-  if (!(STORE_KINDS as readonly string[]).includes(kind)) {
-    throw new StoreError(
-      'STORE_INVALID_KIND',
-      `Invalid store kind ${JSON.stringify(kind)}: expected one of ${STORE_KINDS.map((k) => `"${k}"`).join(', ')}.`,
-    );
-  }
-}
-
-function validateVettedBy(vettedBy: string): void {
-  if (vettedBy.trim().length === 0 || vettedBy.includes('\n') || vettedBy.length > 80) {
-    throw new StoreError(
-      'STORE_INVALID_VETTER',
-      'Invalid --by value: name the operator vouching for this content (single line, at most 80 characters).',
-    );
-  }
-}
-
-function lstatIfPresent(path: string): Stats | undefined {
-  try {
-    return lstatSync(path);
-  } catch (error: unknown) {
-    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return undefined;
-    throw error;
-  }
-}
-
-function assertNoSymlinkAncestors(path: string): void {
-  const absolute = resolve(path);
-  const pathRoot = parse(absolute).root;
-  let current = pathRoot;
-
-  for (const segment of relative(pathRoot, absolute).split(sep)) {
-    if (segment.length === 0) continue;
-    current = join(current, segment);
-    const entry = lstatIfPresent(current);
-    if (!entry) break;
-    if (entry.isSymbolicLink()) {
-      throw new StoreError(
-        'STORE_SYMLINK_ROOT',
-        `Refusing symlink ancestor at ${current}; the user store root must resolve without symlink traversal.`,
-      );
-    }
-  }
-}
-
-/** `plugins` for plugin, `skills` for skill — plural on disk per the layout. */
-function kindDirName(kind: StoreKind): string {
-  return kind === 'plugin' ? 'plugins' : 'skills';
-}
-
-export function storeKindDir(kind: StoreKind, paths: StorePaths = getDefaultStorePaths()): string {
-  return join(paths.userRoot, kindDirName(kind));
-}
-
-function entryDir(kind: StoreKind, name: string, version: string, paths: StorePaths): string {
-  return join(storeKindDir(kind, paths), name, version);
-}
-
-function isInsideRoot(candidate: string, root: string): boolean {
-  const rel = relative(resolve(root), resolve(candidate));
-  return rel.length > 0 && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-
-/**
- * Refuse any symlink in the source tree — the vetting boundary copies real
- * content only, so a vetted entry can never carry a link that escapes it.
- *
- * NOTE: known check-then-use window between this walk and the `cpSync` below:
- * a symlink created concurrently with the add could slip through. Accepted
- * for a local, operator-run CLI; revisit before any unattended or networked
- * acquisition path exists.
- */
-function assertSourceTreeHasNoSymlinks(sourcePath: string): void {
-  const stack: string[] = [sourcePath];
-  while (stack.length > 0) {
-    const current = stack.pop()!;
-    for (const dirent of readdirSync(current, { withFileTypes: true })) {
-      const child = join(current, dirent.name);
-      if (dirent.isSymbolicLink()) {
-        throw new StoreError(
-          'STORE_SOURCE_SYMLINK',
-          `Refusing to vet content containing a symlink: ${child}. Resolve or remove symlinks before adding to the store.`,
-        );
-      }
-      if (dirent.isDirectory()) stack.push(child);
-    }
-  }
-}
-
-/**
- * Vet and add one versioned entry to the user store.
- *
- * Copies the source directory (real content, no symlinks) to
- * `<userRoot>/<kind>s/<name>/<version>/` and writes the `store-entry.json`
- * marker LAST: a crash mid-copy leaves at most a recoverable partial, never a
- * half-vetted entry that lists as present.
- */
-export function addStoreEntry(
-  kind: StoreKind,
-  name: string,
-  version: string,
-  sourcePath: string,
-  vettedBy: string,
-  notes: string | undefined,
-  paths: StorePaths = getDefaultStorePaths(),
-  options: { reclaim?: boolean } = {},
-): StoreAddResult {
-  validateStoreKind(kind);
-  validateStoreName(name);
-  validateStoreVersion(version);
-  validateVettedBy(vettedBy);
-  assertNoSymlinkAncestors(paths.userRoot);
-
-  const resolvedSource = resolve(sourcePath);
-  const source = lstatIfPresent(resolvedSource);
-  if (!source) {
-    throw new StoreError('STORE_SOURCE_MISSING', `Source path does not exist: ${resolvedSource}`);
-  }
-  if (source.isSymbolicLink()) {
-    throw new StoreError(
-      'STORE_SOURCE_SYMLINK',
-      `Refusing to vet a symlink as store content: ${resolvedSource} (points at ${resolve(sourcePath)}). Add the real directory.`,
-    );
-  }
-  if (!source.isDirectory()) {
-    throw new StoreError(
-      'STORE_SOURCE_NOT_DIR',
-      `Source path is not a directory: ${resolvedSource}`,
-    );
-  }
-  if (isInsideRoot(resolvedSource, paths.userRoot)) {
-    throw new StoreError(
-      'STORE_SOURCE_INSIDE_STORE',
-      `Refusing to add store content from inside the store itself: ${resolvedSource}`,
-    );
-  }
-  assertSourceTreeHasNoSymlinks(resolvedSource);
-
-  const target = entryDir(kind, name, version, paths);
-  const existing = lstatIfPresent(target);
-  let status: StoreAddStatus = 'added';
-  if (existing) {
-    if (existsSync(join(target, STORE_ENTRY_MARKER))) {
-      throw new StoreError(
-        'STORE_ALREADY_PRESENT',
-        `${kind} "${name}" version "${version}" is already present at ${target}; stores are append-only — add a new version instead.`,
-      );
-    }
-    // Unmarked target: either this tool's own debris from an interrupted add,
-    // or content the operator placed by hand — indistinguishable on disk. The
-    // USER root's contract is that tooling never destroys operator content,
-    // so deletion requires the explicit --reclaim opt-in (review finding on
-    // c23a71d7: silent rmSync under a benign-sounding status).
-    if (!options.reclaim) {
-      throw new StoreError(
-        'STORE_TARGET_UNMARKED',
-        `Target exists without ${STORE_ENTRY_MARKER}: ${target}. Refusing to delete unmarked content — if this is debris from an interrupted add, re-run with --reclaim to replace it.`,
-      );
-    }
-    rmSync(target, { recursive: true, force: true });
-    status = 'reclaimed-unmarked';
-  }
-
-  mkdirSync(target, { recursive: true });
-  cpSync(resolvedSource, target, { recursive: true });
-
-  const meta: StoreEntryMeta = {
-    schema: 1,
-    kind,
-    name,
-    version,
-    sourcePath: resolvedSource,
-    vettedBy: vettedBy.trim(),
-    vettedAt: new Date().toISOString(),
-    ...(notes === undefined ? {} : { notes }),
-  };
-  writeFileSync(join(target, STORE_ENTRY_MARKER), `${JSON.stringify(meta, null, 2)}\n`);
-
-  return { kind, name, version, status, entryPath: target, sourcePath: resolvedSource };
-}
-
-function readEntryMeta(markerPath: string): { meta?: StoreEntryMeta; status: StoreEntryStatus } {
-  let raw: string;
-  try {
-    raw = readFileSync(markerPath, 'utf-8');
-  } catch {
-    return { status: 'invalid-metadata' };
-  }
-  try {
-    const parsed = JSON.parse(raw) as StoreEntryMeta;
-    if (
-      parsed?.schema === 1 &&
-      (STORE_KINDS as readonly string[]).includes(parsed.kind) &&
-      typeof parsed.name === 'string' &&
-      typeof parsed.version === 'string' &&
-      typeof parsed.vettedBy === 'string' &&
-      typeof parsed.vettedAt === 'string'
-    ) {
-      return { meta: parsed, status: 'vetted' };
-    }
-  } catch {
-    // fall through
-  }
-  return { status: 'invalid-metadata' };
-}
-
-/**
- * Enumerate every store entry deterministically (kind, then name, then
- * version). Version directories without a marker list as `incomplete`; files
- * where directories were expected list as `foreign` — surfaced, never mutated.
- */
-export function listStoreEntries(
-  paths: StorePaths = getDefaultStorePaths(),
-  filter: { kind?: StoreKind; name?: string } = {},
-): StoreListEntry[] {
-  if (filter.name !== undefined) validateStoreName(filter.name);
-  assertNoSymlinkAncestors(paths.userRoot);
-
-  const kinds = filter.kind ? [filter.kind] : [...STORE_KINDS];
-  const entries: StoreListEntry[] = [];
-
-  for (const kind of kinds) {
-    const kindRoot = lstatIfPresent(storeKindDir(kind, paths));
-    if (!kindRoot) continue;
-    if (!kindRoot.isDirectory()) {
-      entries.push({
-        kind,
-        name: kindDirName(kind),
-        status: 'foreign',
-        entryPath: storeKindDir(kind, paths),
-      });
-      continue;
-    }
-
-    for (const nameDirent of readdirSync(storeKindDir(kind, paths), {
-      withFileTypes: true,
-    }).sort(byName) as Dirent[]) {
-      if (filter.name !== undefined && nameDirent.name !== filter.name) continue;
-      const namePath = join(storeKindDir(kind, paths), nameDirent.name);
-
-      if (!nameDirent.isDirectory()) {
-        entries.push({ kind, name: nameDirent.name, status: 'foreign', entryPath: namePath });
-        continue;
-      }
-
-      const versionDirents = readdirSync(namePath, { withFileTypes: true }).sort(byName);
-      if (versionDirents.length === 0) {
-        entries.push({ kind, name: nameDirent.name, status: 'incomplete', entryPath: namePath });
-        continue;
-      }
-      for (const versionDirent of versionDirents) {
-        const versionPath = join(namePath, versionDirent.name);
-        if (!versionDirent.isDirectory()) {
-          entries.push({
-            kind,
-            name: nameDirent.name,
-            version: versionDirent.name,
-            status: 'foreign',
-            entryPath: versionPath,
-          });
-          continue;
-        }
-        const markerPath = join(versionPath, STORE_ENTRY_MARKER);
-        if (!existsSync(markerPath)) {
-          entries.push({
-            kind,
-            name: nameDirent.name,
-            version: versionDirent.name,
-            status: 'incomplete',
-            entryPath: versionPath,
-          });
-          continue;
-        }
-        const { meta, status } = readEntryMeta(markerPath);
-        entries.push({
-          kind,
-          name: nameDirent.name,
-          version: versionDirent.name,
-          status,
-          entryPath: versionPath,
-          ...(meta === undefined ? {} : { meta }),
-        });
-      }
-    }
-  }
-
-  return entries;
-}
-
-function byName(a: Dirent, b: Dirent): number {
-  return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
-}
-
-function reportCommandError(error: unknown): void {
-  if (error instanceof StoreError) {
-    console.error(`store: ${error.code}: ${error.message}`);
-  } else {
-    console.error(error instanceof Error ? error.message : String(error));
-  }
-  process.exitCode = 1;
-}
-
-function displayStoreName(name: string): string {
-  return SAFE_STORE_NAME.test(name) ? name : JSON.stringify(name);
-}
-
-/** Register the `mosaic store` command group (W-F4). */
-export function registerStoreCommand(
-  program: Command,
-  paths: StorePaths = getDefaultStorePaths(),
-): void {
-  const store = program
-    .command('store')
-    .description('Manage the vetted user store under ~/.mosaic (plugins, skills)')
-    .configureHelp({ sortSubcommands: true });
-
-  store
-    .command('add <kind> <name> <version>')
-    .description(
-      'Vet and add a local plugin/skill directory to the user store (versioned, append-only)',
-    )
-    .requiredOption('--from <path>', 'Local source directory to vet (no network acquisition)')
-    .requiredOption('--by <operator>', 'Name of the operator vouching for this content')
-    .option('--notes <notes>', 'Vetting notes recorded in the entry metadata')
-    .option(
-      '--reclaim',
-      'Replace an existing UNMARKED target directory (e.g. debris from an interrupted add); refuses without this flag',
-    )
-    .action(
-      async (
-        kind: string,
-        name: string,
-        version: string,
-        opts: {
-          from: string;
-          by: string;
-          notes?: string;
-          reclaim: boolean;
-        },
-      ) => {
-        try {
-          const result = addStoreEntry(
-            kind as StoreKind,
-            name,
-            version,
-            opts.from,
-            opts.by,
-            opts.notes,
-            paths,
-            { reclaim: opts.reclaim },
-          );
-          const suffix =
-            result.status === 'reclaimed-unmarked' ? ' (replaced unmarked directory)' : '';
-          console.log(
-            `${result.kind} ${displayStoreName(result.name)} ${result.version}: added${suffix}`,
-          );
-          console.log(`  entry: ${result.entryPath}`);
-          console.log(`  vetted by ${opts.by.trim()}`);
-        } catch (error: unknown) {
-          reportCommandError(error);
-        }
-      },
-    );
-
-  store
-    .command('list')
-    .description('List store entries with vetting status')
-    .option('--kind <kind>', 'Filter by kind (plugin | skill)')
-    .option('--name <name>', 'Filter by entry name')
-    .action((opts: { kind?: string; name?: string }) => {
-      try {
-        let kind: StoreKind | undefined;
-        if (opts.kind !== undefined) {
-          validateStoreKind(opts.kind);
-          kind = opts.kind;
-        }
-        const entries = listStoreEntries(paths, {
-          ...(kind === undefined ? {} : { kind }),
-          ...(opts.name === undefined ? {} : { name: opts.name }),
-        });
-        if (entries.length === 0) {
-          console.log('No store entries found.');
-          return;
-        }
-        for (const entry of entries) {
-          const version = entry.version ?? '-';
-          const vetter = entry.meta?.vettedBy ?? '-';
-          console.log(
-            `${entry.status.padEnd(17)}${entry.kind.padEnd(8)}${displayStoreName(entry.name).padEnd(24)}${version.padEnd(16)}${vetter}`,
-          );
-        }
-      } catch (error: unknown) {
-        reportCommandError(error);
-      }
-    });
-}
@@ -5,13 +5,6 @@ export const VERSION = '0.0.2';

 export const DEFAULT_MOSAIC_HOME = join(homedir(), '.config', 'mosaic');

-/**
- * USER data root (HARNESS-HOMES two-root split): everything under here is user
- * content — never replaced or removed by installs, updates, or uninstallers.
- * Distinct from the SYSTEM root above, which is update-owned.
- */
-export const DEFAULT_MOSAIC_USER_HOME = join(homedir(), '.mosaic');
-
 export const DEFAULTS = {
  agentName: 'Assistant',
  roleDescription: 'execution partner and visibility engine',
@@ -1,6 +1,6 @@
 import { Command } from 'commander';

-import { createPrd, listPrds, loadPrd } from './prd.js';
+import { PrdService } from './service.js';
 import { runPrdWizard } from './wizard.js';

 interface InitCommandOptions {
@@ -18,6 +18,22 @@ interface ShowCommandOptions {
  readonly id?: string;
 }

+interface ImportCommandOptions {
+  readonly project: string;
+  readonly file: string;
+  readonly acceptSuccessor?: boolean;
+}
+
+interface ExportCommandOptions {
+  readonly project: string;
+  readonly id?: string;
+  readonly out?: string;
+}
+
+function serviceFor(project: string): PrdService {
+  return new PrdService({ projectPath: project });
+}
+
 export function buildPrdyCli(): Command {
  const program = new Command();
  program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -38,11 +54,9 @@ export function buildPrdyCli(): Command {
            template: options.template,
            interactive: true,
          })
-        : await createPrd({
+        : await serviceFor(options.project).create({
            name: options.name,
-            projectPath: options.project,
            template: options.template,
-            interactive: false,
          });

      console.log(
@@ -52,6 +66,7 @@ export function buildPrdyCli(): Command {
            id: doc.id,
            title: doc.title,
            status: doc.status,
+            version: doc.version,
            projectPath: doc.projectPath,
          },
          null,
@@ -65,7 +80,7 @@ export function buildPrdyCli(): Command {
    .description('List PRD documents for a project')
    .requiredOption('--project <path>', 'Project path')
    .action(async (options: ListCommandOptions) => {
-      const docs = await listPrds(options.project);
+      const docs = await serviceFor(options.project).list();
      console.log(JSON.stringify(docs, null, 2));
    });

@@ -75,20 +90,65 @@ export function buildPrdyCli(): Command {
    .requiredOption('--project <path>', 'Project path')
    .option('--id <id>', 'PRD document id')
    .action(async (options: ShowCommandOptions) => {
-      if (options.id !== undefined) {
-        const docs = await listPrds(options.project);
-        const match = docs.find((doc) => doc.id === options.id);
+      const doc = await serviceFor(options.project).get(options.id);
+      console.log(JSON.stringify(doc, null, 2));
+    });

-        if (match === undefined) {
-          throw new Error(`PRD id not found: ${options.id}`);
-        }
+  prdy
+    .command('import')
+    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
+    .requiredOption('--project <path>', 'Project path')
+    .requiredOption('--file <file>', 'Path to YAML PRD document')
+    .option('--accept-successor', 'Accept a conflicted import as the next version')
+    .action(async (options: ImportCommandOptions) => {
+      const service = serviceFor(options.project);
+      const input = { filePath: options.file };

-        console.log(JSON.stringify(match, null, 2));
+      if (options.acceptSuccessor) {
+        const successor = await service.acceptSuccessor(input);
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              outcome: 'successor-accepted',
+              id: successor.id,
+              version: successor.version,
+            },
+            null,
+            2,
+          ),
+        );
        return;
      }

-      const doc = await loadPrd(options.project);
-      console.log(JSON.stringify(doc, null, 2));
+      const result = await service.importDocument(input);
+      console.log(
+        JSON.stringify(
+          {
+            ok: true,
+            outcome: result.kind,
+            id: result.document.id,
+            version: result.document.version,
+            status: result.document.status,
+          },
+          null,
+          2,
+        ),
+      );
+    });
+
+  prdy
+    .command('export')
+    .description('Render a PRD to a labeled generated-view Markdown file')
+    .requiredOption('--project <path>', 'Project path')
+    .option('--id <id>', 'PRD document id')
+    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
+    .action(async (options: ExportCommandOptions) => {
+      const result = await serviceFor(options.project).exportMarkdown({
+        id: options.id,
+        outPath: options.out,
+      });
+      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
    });

  return program;
@@ -1,12 +1,35 @@
-export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
+// PrdService is the single authority surface for PRD documents. The raw store
+// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
+// goes through the service so there is no second writer path.
+export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
+export {
+  PrdService,
+  PRD_GENERATED_VIEW_LABEL,
+  PrdError,
+  PrdNotFoundError,
+  PrdUpdateError,
+  PrdImportInvalidError,
+  PrdImportConflictError,
+} from './service.js';
 export type {
  PrdStatus,
  PrdTemplate,
  PrdTemplateSection,
  PrdSection,
+  PrdMissionLinkage,
  PrdDocument,
  CreatePrdOptions,
+  PrdServiceOptions,
+  PrdCreateInput,
+  PrdSectionPatch,
+  PrdUpdateInput,
+  PrdLinkMissionInput,
+  PrdPlanForMissionInput,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
 } from './types.js';
@@ -17,17 +17,49 @@ const prdSectionSchema = z.object({
  fields: z.record(z.string(), z.string()),
 });

+const prdMissionLinkageSchema = z.object({
+  missionId: z.string().min(1),
+  missionVersion: z.string().min(1),
+  prdVersion: z.number().int().min(1),
+  requirementIds: z.array(z.string()),
+  linkedAt: z.string().datetime(),
+});
+
 const prdDocumentSchema = z.object({
  id: z.string().min(1),
  title: z.string().min(1),
  status: z.enum(['draft', 'review', 'approved', 'archived']),
  projectPath: z.string().min(1),
  template: z.string().min(1),
+  // Defaults keep documents written by older prdy versions loadable.
+  version: z.number().int().min(1).default(1),
  sections: z.array(prdSectionSchema),
+  missions: z.array(prdMissionLinkageSchema).default([]),
  createdAt: z.string().datetime(),
  updatedAt: z.string().datetime(),
 });

+/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
+function coerceTimestamps(value: unknown): unknown {
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(coerceTimestamps);
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
+    );
+  }
+  return value;
+}
+
+/** Validate an unknown value as a PRD document (throws zod errors on failure). */
+export function parsePrdDocument(value: unknown): PrdDocument {
+  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
+}
+
 function expandHome(projectPath: string): string {
  if (!projectPath.startsWith('~')) {
    return projectPath;
@@ -74,6 +106,8 @@ function prdDirectory(projectPath: string): string {
  return path.join(projectPath, PRD_DIRECTORY);
 }

+export { prdDirectory };
+
 function prdFilePath(projectPath: string, id: string): string {
  return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -113,11 +147,13 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
    status: 'draft',
    projectPath: resolvedProjectPath,
    template: template.id,
+    version: 1,
    sections: template.sections.map((section) => ({
      id: section.id,
      title: section.title,
      fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
    })),
+    missions: [],
    createdAt: now,
    updatedAt: now,
  };
@@ -190,7 +226,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
      throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
    }

-    const document = prdDocumentSchema.parse(parsed);
+    const document = parsePrdDocument(parsed);
    documents.push(document);
  }

@@ -0,0 +1,433 @@
+import { existsSync } from 'node:fs';
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import {
+  PRD_GENERATED_VIEW_LABEL,
+  PrdImportConflictError,
+  PrdImportInvalidError,
+  PrdNotFoundError,
+  PrdService,
+  PrdUpdateError,
+} from './index.js';
+import type { PrdDocument } from './index.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+let projectDir: string;
+
+async function makeProject(): Promise<string> {
+  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
+}
+
+function service(): PrdService {
+  return new PrdService({ projectPath: projectDir });
+}
+
+function storeDir(): string {
+  return path.join(projectDir, 'docs', 'prdy');
+}
+
+/** Handcraft a full, schema-valid PRD document for import scenarios. */
+function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
+  return {
+    id: 'imported-prd-20260101-000000',
+    title: 'Imported PRD',
+    status: 'draft',
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
+      {
+        id: 'scope-non-goals',
+        title: 'Scope / Non-Goals',
+        fields: { inScope: '', outOfScope: '' },
+      },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+async function writeImportFile(doc: PrdDocument): Promise<string> {
+  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
+  await writeFile(filePath, yaml.dump(doc), 'utf8');
+  return filePath;
+}
+
+beforeEach(async () => {
+  projectDir = await makeProject();
+});
+
+// ── Single authority store (AC: prdy path and mission path resolve to the
+//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
+
+describe('PrdService single authority store', () => {
+  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
+    const direct = await service().create({ name: 'Direct PRD' });
+    const viaMission = await service().planForMission({
+      name: 'Mission PRD',
+      missionId: 'mission-1',
+      missionVersion: '2026-01-01T00:00:00.000Z',
+    });
+
+    const files = await readdir(storeDir());
+    expect(files).toContain(`${direct.id}.yaml`);
+    expect(files).toContain(`${viaMission.id}.yaml`);
+
+    // A fresh service instance (new process equivalent) resolves both.
+    const all = await service().list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
+
+    // Stable versions: creation is v1; linkage writes do not bump content version.
+    expect((await service().get(direct.id)).version).toBe(1);
+    expect((await service().get(viaMission.id)).version).toBe(1);
+  });
+
+  it('round-trips documents through the store with identity intact', async () => {
+    const created = await service().create({ name: 'Round Trip', template: 'feature' });
+    const fresh = await service().get(created.id);
+
+    expect(fresh).toEqual(created);
+    expect(fresh.id).toBe(created.id);
+    expect(fresh.template).toBe('feature');
+    expect(fresh.status).toBe('draft');
+  });
+
+  it('throws a typed error for unknown ids and empty stores', async () => {
+    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
+    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── Mission linkage persistence (AC: linkage survives restart via fresh
+//    service instances) ────────────────────────────────────────────────────────
+
+describe('PrdService mission linkage', () => {
+  it('persists linkage and reads it back from a fresh service instance', async () => {
+    const created = await service().planForMission({
+      name: 'Linked PRD',
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Fresh instance — nothing in memory from the creating call.
+    const links = await service().listMissionLinks(created.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      prdVersion: 1,
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Linkage is carried in the YAML authority file itself.
+    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    const persisted = yaml.load(raw) as PrdDocument;
+    expect(persisted.missions[0]?.missionId).toBe('mission-42');
+    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
+  });
+
+  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
+    const created = await service().planForMission({
+      name: 'Relink PRD',
+      missionId: 'mission-7',
+      missionVersion: 'v1',
+    });
+
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
+    });
+
+    const relinked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'mission-7',
+      missionVersion: 'v2',
+      requirementIds: ['NFR-1'],
+    });
+
+    expect(relinked.missions).toHaveLength(1);
+    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
+  });
+
+  it('does not bump the content version when writing linkage', async () => {
+    const created = await service().create({ name: 'Stable Version' });
+    const linked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'm',
+      missionVersion: 'v1',
+    });
+    expect(linked.version).toBe(1);
+  });
+});
+
+// ── Update semantics ──────────────────────────────────────────────────────────
+
+describe('PrdService update', () => {
+  it('applies section patches and bumps the content version', async () => {
+    const created = await service().create({ name: 'Updatable' });
+    const updated = await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
+    });
+
+    expect(updated.version).toBe(2);
+    expect(updated.sections[0]?.fields).toMatchObject({
+      context: 'Some context',
+      objective: 'Goal',
+    });
+    expect((await service().get(created.id)).version).toBe(2);
+  });
+
+  it('refuses unknown section ids with a typed error', async () => {
+    const created = await service().create({ name: 'Strict' });
+    await expect(
+      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
+    ).rejects.toBeInstanceOf(PrdUpdateError);
+  });
+});
+
+// ── Markdown export is a labeled generated view, never authority ──────────────
+
+describe('PrdService exportMarkdown', () => {
+  it('writes a generated view carrying the label and source identity', async () => {
+    const created = await service().create({ name: 'Exported PRD' });
+    const result = await service().exportMarkdown({ id: created.id });
+
+    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
+    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
+    expect(result.content).toContain(`prd-id: ${created.id}`);
+    expect(result.content).toContain('prd-version: 1');
+    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
+  });
+
+  it('reflects the current version after updates', async () => {
+    const created = await service().create({ name: 'Versioned Export' });
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
+    });
+    const result = await service().exportMarkdown({ id: created.id });
+    expect(result.content).toContain('prd-version: 2');
+  });
+
+  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
+    const created = await service().create({ name: 'Guarded PRD' });
+    const before = structuredClone(await service().get(created.id));
+
+    const result = await service().exportMarkdown({ id: created.id });
+    await writeFile(
+      result.filePath,
+      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
+      'utf8',
+    );
+
+    const after = await service().get(created.id);
+    expect(after).toEqual(before);
+    expect(after.version).toBe(1);
+    expect(after.title).toBe(before.title);
+  });
+
+  it('never parses Markdown files that sit in the store directory', async () => {
+    const created = await service().create({ name: 'Decoy Guard' });
+
+    // A decoy .md file with invalid YAML must be invisible to the store.
+    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
+    // And a decoy .yaml-named Markdown body must not silently validate either.
+    await service().exportMarkdown({ id: created.id });
+
+    const listed = await service().list();
+    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
+    await expect(service().get(created.id)).resolves.toBeTruthy();
+  });
+});
+
+// ── Import: validated, conflict-aware, never silently merging ─────────────────
+
+describe('PrdService importDocument', () => {
+  it('creates a valid import through the service, as draft — validity is not approval', async () => {
+    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
+
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('created');
+    expect(result.document.id).toBe('imported-prd-20260101-000000');
+    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
+    expect(result.document.version).toBe(1);
+
+    const persisted = await service().get('imported-prd-20260101-000000');
+    expect(persisted.status).toBe('draft');
+
+    const files = await readdir(storeDir());
+    expect(files).toContain('imported-prd-20260101-000000.yaml');
+  });
+
+  it('reports identical content as a no-op without writing', async () => {
+    const created = await service().create({ name: 'Existing PRD' });
+    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+
+    const filePath = await writeImportFile(importFixture({ ...created }));
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('identical');
+    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    expect(after).toBe(before);
+  });
+
+  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
+    const existing = await service().create({ name: 'Authority PRD' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+      requirementIds: ['FR-0'],
+    });
+    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Divergent Title',
+      sections: [
+        {
+          id: 'introduction',
+          title: 'Introduction',
+          fields: { context: 'changed', objective: '' },
+        },
+      ],
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const attempt = service().importDocument({ filePath });
+    let caught: unknown;
+    try {
+      await attempt;
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(PrdImportConflictError);
+
+    const error = caught as PrdImportConflictError;
+    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
+    expect(error.existing.id).toBe(existing.id);
+    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
+    expect(error.proposal.status).toBe('draft');
+
+    // Original authority content untouched on disk.
+    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+    expect(afterBytes).toBe(beforeBytes);
+  });
+
+  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
+    const existing = await service().create({ name: 'Successor Base' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+    });
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Accepted Successor Title',
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const successor = await service().acceptSuccessor({ filePath });
+    expect(successor.id).toBe(existing.id);
+    expect(successor.version).toBe(existing.version + 1);
+    expect(successor.title).toBe('Accepted Successor Title');
+    expect(successor.status).toBe('draft');
+    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
+
+    // Persisted for a fresh reader.
+    const fresh = await service().get(existing.id);
+    expect(fresh.version).toBe(2);
+    expect(fresh.title).toBe('Accepted Successor Title');
+  });
+
+  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
+    const cases: Array<{ name: string; body: string }> = [
+      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
+      {
+        name: 'bad-status.yaml',
+        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
+      },
+      {
+        name: 'bad-version.yaml',
+        body: yaml.dump(importFixture({ version: 0 })),
+      },
+      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
+    ];
+
+    for (const fixture of cases) {
+      const filePath = path.join(projectDir, fixture.name);
+      await writeFile(filePath, fixture.body, 'utf8');
+
+      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
+        PrdImportInvalidError,
+      );
+    }
+
+    // Nothing was created: the authority store does not even exist yet.
+    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
+    const filePath = await writeImportFile(importFixture());
+    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── No second writer: no code path reads exported Markdown back into authority ─
+
+describe('no-second-writer invariant (source-level)', () => {
+  // Resolve the package source dir whether vitest runs from the package root
+  // (turbo/pnpm test) or from the worktree root.
+  function resolveSrcDir(): string {
+    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
+    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
+  }
+
+  const srcDir = resolveSrcDir();
+  const sourceFiles = [
+    'cli.ts',
+    'index.ts',
+    'prd.ts',
+    'service.ts',
+    'templates.ts',
+    'types.ts',
+    'wizard.ts',
+  ];
+
+  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
+    for (const file of sourceFiles) {
+      const text = await readFile(path.join(srcDir, file), 'utf8');
+      const readLines = text
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
+
+      for (const line of readLines) {
+        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
+      }
+    }
+  });
+
+  it('the mosaic prdy/mission adapters never read a .md file', async () => {
+    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
+    for (const file of ['prdy.ts', 'mission.ts']) {
+      const text = await readFile(path.join(adapterDir, file), 'utf8');
+      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
+        false,
+      );
+    }
+  });
+});
@@ -0,0 +1,379 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+
+import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
+import type {
+  PrdCreateInput,
+  PrdDocument,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
+  PrdLinkMissionInput,
+  PrdMissionLinkage,
+  PrdPlanForMissionInput,
+  PrdServiceOptions,
+  PrdUpdateInput,
+} from './types.js';
+
+/**
+ * PrdService is the SINGLE authority surface for PRD documents.
+ *
+ * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
+ * through this service; the YAML store under `docs/prdy/` is the authority and
+ * exported Markdown is a generated view that no code path reads back.
+ */
+
+// ── Typed errors ───────────────────────────────────────────────────────────────
+
+export class PrdError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'PrdError';
+  }
+}
+
+export class PrdNotFoundError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_NOT_FOUND');
+    this.name = 'PrdNotFoundError';
+  }
+}
+
+export class PrdUpdateError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_UPDATE_INVALID');
+    this.name = 'PrdUpdateError';
+  }
+}
+
+/** Structural refusal: the import payload failed schema validation. Nothing is written. */
+export class PrdImportInvalidError extends PrdError {
+  constructor(
+    message: string,
+    readonly issues?: string,
+  ) {
+    super(message, 'PRD_IMPORT_INVALID');
+    this.name = 'PrdImportInvalidError';
+  }
+}
+
+/**
+ * Conflict refusal: an existing PRD shares the imported id but the content
+ * diverges. Carries a PROPOSED successor (existing version + 1) that is only
+ * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
+ * never overwrites and never merges.
+ */
+export class PrdImportConflictError extends PrdError {
+  constructor(
+    message: string,
+    readonly existing: PrdDocument,
+    readonly proposal: PrdDocument,
+  ) {
+    super(message, 'PRD_IMPORT_CONFLICT');
+    this.name = 'PrdImportConflictError';
+  }
+}
+
+// ── Service ────────────────────────────────────────────────────────────────────
+
+/** The generated-view label carried by every Markdown export. */
+export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
+
+export class PrdService {
+  private readonly projectPath: string;
+
+  constructor(options: PrdServiceOptions) {
+    this.projectPath = options.projectPath;
+  }
+
+  /** Create a new PRD (version 1, draft) in the authority store. */
+  async create(input: PrdCreateInput): Promise<PrdDocument> {
+    return createPrd({
+      name: input.name,
+      projectPath: this.projectPath,
+      template: input.template,
+      interactive: false,
+    });
+  }
+
+  /** Read a PRD by id, or the most recently updated one. */
+  async get(id?: string): Promise<PrdDocument> {
+    const documents = await listPrds(this.projectPath);
+
+    if (id === undefined) {
+      const latest = documents[0];
+      if (latest === undefined) {
+        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
+      }
+      return latest;
+    }
+
+    const match = documents.find((doc) => doc.id === id);
+    if (match === undefined) {
+      throw new PrdNotFoundError(`PRD id not found: ${id}`);
+    }
+    return match;
+  }
+
+  /** List all PRDs in the authority store (most recently updated first). */
+  async list(): Promise<PrdDocument[]> {
+    return listPrds(this.projectPath);
+  }
+
+  /**
+   * Apply section field patches and bump the content version.
+   * Linkage entries are preserved; linkage writes do NOT bump the version.
+   */
+  async update(input: PrdUpdateInput): Promise<PrdDocument> {
+    const doc = await this.get(input.id);
+
+    for (const patch of input.sections) {
+      const section = doc.sections.find((candidate) => candidate.id === patch.id);
+      if (section === undefined) {
+        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
+      }
+      for (const [field, value] of Object.entries(patch.fields)) {
+        if (!(field in section.fields)) {
+          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
+        }
+        section.fields[field] = value;
+      }
+    }
+
+    doc.version += 1;
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  /**
+   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
+   * Persisted in the YAML authority, so it survives restarts.
+   */
+  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const doc = await this.get(input.prdId);
+    return this.applyLinkage(doc, input);
+  }
+
+  /** Read back the mission linkages recorded on a PRD. */
+  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
+    const doc = await this.get(prdId);
+    return doc.missions;
+  }
+
+  /**
+   * Mission planning path: create a PRD for a mission AND persist the
+   * mission↔PRD linkage in a single authority write.
+   */
+  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
+    const doc = await this.create({ name: input.name, template: input.template });
+    return this.applyLinkage(doc, {
+      prdId: doc.id,
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      requirementIds: input.requirementIds,
+    });
+  }
+
+  /**
+   * Render the PRD to a Markdown GENERATED VIEW.
+   *
+   * The output carries source identity (PRD id + version + generated-view
+   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
+   * the authority store only loads `.yaml`/`.yml` files, and no code path in
+   * this package parses the exported Markdown.
+   */
+  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
+    const doc = await this.get(input?.id);
+    const content = renderMarkdown(doc);
+    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
+
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, content, 'utf8');
+    return { filePath, content };
+  }
+
+  /**
+   * Import a YAML PRD document.
+   *
+   * Structural validation (zod) happens BEFORE anything is proposed or
+   * written. A structurally-valid import is persisted as `draft` — validity is
+   * NOT approval. If an existing PRD shares the id with divergent content, a
+   * typed {@link PrdImportConflictError} is thrown carrying a proposed
+   * successor; the original authority document is left byte-identical on disk.
+   */
+  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      const document = this.buildImportedDocument(incoming);
+      await savePrd(document);
+      return { kind: 'created', document };
+    }
+
+    if (canonicalCore(existing) === canonicalCore(incoming)) {
+      return { kind: 'identical', document: existing };
+    }
+
+    throw new PrdImportConflictError(
+      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
+        `Proposed successor: version ${existing.version + 1} (draft). ` +
+        `Accept explicitly with acceptSuccessor().`,
+      existing,
+      this.buildSuccessor(existing, incoming),
+    );
+  }
+
+  /**
+   * Explicitly accept a conflicted import as a successor version of the
+   * existing PRD. Re-validates the source file before writing; the successor
+   * is persisted with status `draft` (acceptance of the import is not approval
+   * of the PRD) and the existing mission linkages are carried forward.
+   */
+  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      throw new PrdNotFoundError(
+        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
+      );
+    }
+
+    const successor = this.buildSuccessor(existing, incoming);
+    await savePrd(successor);
+    return successor;
+  }
+
+  // ── internals ──────────────────────────────────────────────────────────────
+
+  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const entry: PrdMissionLinkage = {
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      prdVersion: doc.version,
+      requirementIds: input.requirementIds ?? [],
+      linkedAt: new Date().toISOString(),
+    };
+
+    // One entry per mission: refresh in place if the mission is already linked.
+    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
+    if (index === -1) {
+      doc.missions.push(entry);
+    } else {
+      doc.missions[index] = entry;
+    }
+
+    // Linkage is mission-side metadata, not a content revision: bump the
+    // timestamp only so ids/versions stay stable for consumers.
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  private async readImportFile(filePath: string): Promise<PrdDocument> {
+    let raw: string;
+    try {
+      raw = await fs.readFile(filePath, 'utf8');
+    } catch (error) {
+      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = yaml.load(raw);
+    } catch (error) {
+      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
+    }
+
+    try {
+      return parsePrdDocument(parsed);
+    } catch (error) {
+      throw new PrdImportInvalidError(
+        `Import file failed PRD schema validation: ${filePath}`,
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+  }
+
+  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
+    const now = new Date().toISOString();
+    return {
+      ...incoming,
+      // The import lands in THIS project's authority store.
+      projectPath: this.projectPath,
+      // A structurally-valid import is not thereby approved.
+      status: 'draft',
+      version: 1,
+      missions: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+  }
+
+  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
+    return {
+      ...incoming,
+      id: existing.id,
+      projectPath: existing.projectPath,
+      status: 'draft',
+      version: existing.version + 1,
+      missions: existing.missions,
+      createdAt: existing.createdAt,
+      updatedAt: new Date().toISOString(),
+    };
+  }
+}
+
+// ── Markdown rendering (generated view) ───────────────────────────────────────
+
+function canonicalCore(doc: PrdDocument): string {
+  return JSON.stringify([doc.title, doc.template, doc.sections]);
+}
+
+function renderMarkdown(doc: PrdDocument): string {
+  const lines: string[] = [
+    '<!--',
+    `${PRD_GENERATED_VIEW_LABEL}`,
+    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
+    `prd-id: ${doc.id}`,
+    `prd-version: ${doc.version}`,
+    `generated-at: ${new Date().toISOString()}`,
+    '-->',
+    '',
+    `# ${doc.title}`,
+    '',
+    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
+    '',
+  ];
+
+  if (doc.missions.length > 0) {
+    lines.push('## Mission Linkage', '');
+    for (const mission of doc.missions) {
+      const requirements =
+        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
+      lines.push(
+        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
+          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
+      );
+    }
+    lines.push('');
+  }
+
+  for (const section of doc.sections) {
+    lines.push(`## ${section.title}`, '');
+    for (const [field, value] of Object.entries(section.fields)) {
+      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
+    }
+  }
+
+  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
+  return lines.join('\n');
+}
@@ -19,13 +19,31 @@ export interface PrdSection {
  fields: Record<string, string>;
 }

+/**
+ * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
+ *
+ * `missionVersion` is the mission-side revision marker available to the CLI
+ * (the gateway exposes `updatedAt` for missions — there is no numeric mission
+ * version yet). `prdVersion` snapshots the PRD content version at link time.
+ */
+export interface PrdMissionLinkage {
+  missionId: string;
+  missionVersion: string;
+  prdVersion: number;
+  requirementIds: string[];
+  linkedAt: string;
+}
+
 export interface PrdDocument {
  id: string;
  title: string;
  status: PrdStatus;
  projectPath: string;
  template: string;
+  /** Content revision counter. Bumped by updates and accepted imports. */
+  version: number;
  sections: PrdSection[];
+  missions: PrdMissionLinkage[];
  createdAt: string;
  updatedAt: string;
 }
@@ -36,3 +54,60 @@ export interface CreatePrdOptions {
  template?: string;
  interactive?: boolean;
 }
+
+// ── PrdService surface (single authority entry point) ─────────────────────────
+
+export interface PrdServiceOptions {
+  projectPath: string;
+}
+
+export interface PrdCreateInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdSectionPatch {
+  id: string;
+  fields: Record<string, string>;
+}
+
+export interface PrdUpdateInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  sections: PrdSectionPatch[];
+}
+
+export interface PrdLinkMissionInput {
+  /** Defaults to the most recently updated PRD. */
+  prdId?: string;
+  missionId: string;
+  missionVersion: string;
+  requirementIds?: string[];
+}
+
+export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdExportInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  /** Override the generated-view output path. */
+  outPath?: string;
+}
+
+export interface PrdExportResult {
+  filePath: string;
+  content: string;
+}
+
+/** Discriminated result of a non-conflicting import. */
+export type PrdImportResult =
+  | { kind: 'created'; document: PrdDocument }
+  | { kind: 'identical'; document: PrdDocument };
+
+export interface PrdImportInput {
+  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
+  filePath: string;
+}
@@ -2,8 +2,8 @@ import path from 'node:path';

 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';

-import { createPrd, savePrd } from './prd.js';
-import type { CreatePrdOptions, PrdDocument } from './types.js';
+import { PrdService } from './service.js';
+import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';

 interface WizardAnswers {
  goals: string;
@@ -11,20 +11,41 @@ interface WizardAnswers {
  milestones: string;
 }

-function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
-  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));
+/**
+ * Translate wizard answers into section patches using the same keyword
+ * matching the wizard always used (first section whose id contains the
+ * keyword, then first field whose name contains it, else first field).
+ */
+function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
+  const bySection = new Map<string, PrdSectionPatch>();

-  if (section === undefined) {
-    return;
-  }
+  const add = (keyword: string, value: string): void => {
+    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
+    if (section === undefined) {
+      return;
+    }

-  const fieldName =
-    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
-    Object.keys(section.fields)[0];
+    const fieldName =
+      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
+      Object.keys(section.fields)[0];

-  if (fieldName !== undefined) {
-    section.fields[fieldName] = value;
-  }
+    if (fieldName === undefined || section.fields[fieldName] === value) {
+      return;
+    }
+
+    const existing = bySection.get(section.id);
+    if (existing === undefined) {
+      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
+    } else {
+      existing.fields[fieldName] = value;
+    }
+  };
+
+  add('goal', answers.goals);
+  add('constraint', answers.constraints);
+  add('milestone', answers.milestones);
+
+  return [...bySection.values()];
 }

 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -63,15 +84,10 @@ async function promptTemplate(template?: string): Promise<string> {
  return choice;
 }

-function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
-  updateSectionField(doc, 'goal', answers.goals);
-  updateSectionField(doc, 'constraint', answers.constraints);
-  updateSectionField(doc, 'milestone', answers.milestones);
-
-  doc.updatedAt = new Date().toISOString();
-  return doc;
-}
-
+/**
+ * Interactive PRD wizard. All writes go through PrdService — the wizard is a
+ * prompt layer, never a second writer path.
+ */
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
  intro('Mosaic PRD wizard');

@@ -82,20 +98,15 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
  const constraints = await promptText('Key constraints');
  const milestones = await promptText('Planned milestones');

-  const doc = await createPrd({
-    ...options,
+  const service = new PrdService({ projectPath: options.projectPath });
+  const doc = await service.create({
    name,
    template,
-    interactive: true,
  });

-  const updated = applyWizardAnswers(doc, {
-    goals,
-    constraints,
-    milestones,
-  });
-
-  await savePrd(updated);
+  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
+  const updated =
+    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;

  outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);

@@ -0,0 +1,37 @@
+# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
+
+- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
+  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
+  Markdown export is a labeled generated view (never read back); import is
+  validated/conflict-aware with typed refusals.
+- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
+  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
+  root build rc=0.
+- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
+  typed errors (3) wizard/cli route through service (4) mosaic adapters
+  (5) contract specs both packages (6) gates (7) sabotage control (8) report
+  to /var/tmp/ri-050/ri-4-001-report.md.
+- Decisions:
+  - Linkage lives ON the PRD document (`missions` array) — one authority file,
+    survives restart, no sidecar sync problems.
+  - `version` = content revision of sections/status (bumped by update/import
+    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
+    for the card's "stable ids/versions" contract.
+  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
+    numeric version field).
+  - Import reads YAML documents only — never the exported Markdown (keeps the
+    "no code path reads exported Markdown" invariant).
+  - Import of an existing id with identical core content → `identical` no-op;
+    divergent → typed `PrdImportConflictError` carrying proposed successor
+    (existing.version + 1, status draft, linkages preserved). Original bytes
+    untouched until explicit `acceptSuccessor`.
+  - `requirementIds` default `[]` at the mission command (no requirement
+    selection UI yet) — service accepts ids when a caller has them.
+- Progress log:
+  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
+  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
+  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
+  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
+  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
+  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
+  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete
Author	SHA1	Message	Date
fargo	8d258e1d07	docs: finalize ri-4-001 scratchpad with verification evidence (#1275 ) ci/woodpecker/pr/ci Pipeline was successful Details	2026-08-17 16:48:39 -05:00
fargo	540d6f17d1	docs: ri-4-001 scratchpad for PRD authority card (#1275 )	2026-08-17 16:46:17 -05:00
fargo	a23826ccba	test(mosaic): RI-N3 contract specs for prdy and mission --plan adapters (#1275 ) - import paths: created/draft, typed refusal creates nothing, conflict refusal leaves bytes untouched, --accept-successor persists v+1 - export writes the labeled generated view; authority unchanged - mission --plan persists linkage readable by a fresh service instance; mission path and prdy path share the docs/prdy store with stable ids/versions	2026-08-17 16:46:14 -05:00
fargo	2c5d208691	feat(mosaic): route prdy and mission --plan through PrdService (#1275 ) - mosaic prdy becomes a thin adapter: --init/--update (wizard for TTY, service otherwise), --import with --accept-successor, --export - mosaic mission --plan persists the mission↔PRD linkage (mission id + version marker, PRD id + version) through the service instead of invoking the wizard as a second writer; non-TTY runs create non-interactively	2026-08-17 16:46:06 -05:00
fargo	e291bfb837	feat(prdy): add PrdService as the single PRD authority surface (#1275 ) - PrdService owns create/read/update/link/import/export; wizard and package CLI become prompt layers over the service (no second writer path) - PRD documents gain a content version and a missions linkage array persisted in the YAML authority store (survives restart); linkage writes do not bump the content version - exportMarkdown renders a labeled generated view (id + version + do-not-edit header) that no code path reads back; the store loads .yaml/.yml only - importDocument validates structure with zod before anything else, persists valid imports as draft (validity is not approval), and refuses conflicts with a typed PrdImportConflictError carrying a proposed successor; the original document stays byte-identical until acceptSuccessor - raw store writers (createPrd/savePrd) are no longer exported from the package entry point	2026-08-17 16:46:00 -05:00
jason.woltje	8199261caa	Merge pull request 'fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion — unblocks every PR on next' (#1270 ) from fix/1269-ci-chain-unblock into next ci/woodpecker/push/publish Pipeline failed Details Reviewed-on: #1270	2026-08-17 20:44:59 +00:00
fred	57a2f2b40e	docs(ci): point the exclusion at tracking issue #1271 , not the closed first filing ci/woodpecker/pr/ci Pipeline was successful Details The first PR for this change was filed under the retired mos-dt-0 principal (pr-create.sh has no --login flag and find_tea_login_for_host returns the first host match) and was closed and refiled as #1270. That left in-tree references pointing at a closed duplicate PR rather than at the burn-down issue, which is the wrong target for them anyway: the open design question belongs on #1271.	2026-08-16 18:03:02 -05:00
fred	93c1de51e1	fix(ci): unwire test-start-agent-session.sh, restore its signed exclusion (#1269 ) ci/woodpecker/pr/ci Pipeline was canceled Details The `test` step has failed on every `next` pipeline since #1017 on exactly one assertion, and it is the same one on unrelated PRs: FAIL: host provides 'pi' in the system path; missing-binary cases are not measurable here (framework/tools/fleet/test-start-agent-session.sh:103) Measured 2026-08-16 across pipelines 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in each full log, identical, this line. Control `zzz-not-present-zzz` -> 0 on all three. Cause. #1241 (`5c35a250`) added the guard: the suite shims fake mosaic/pi/npm into $FAKE_BIN, but the constructed PANE_PATH always ends in the real system path, so on a host that installs those binaries the missing-binary cases cannot be measured and a green run would mean nothing. The guard says so instead of passing. Its own pipeline 2430 was green only because the suite was CI-excluded at the time, so the guard had never run in CI. #1017 (`c56483eb`) then enumerated it and dropped the exclusion. The CI image installs @earendil-works/[email protected].1 on purpose, so the precondition is unsatisfiable there. Both commits are mine. The guard is correct and is not being softened. A check that cannot measure its property and reports success is the failure mode this repo has been cataloguing all week; the error was wiring the suite into an image that violates its precondition, so the wiring is what gets reverted. Second effect, which is the reason this cost a day rather than an hour: test:framework-shell is one && chain and this sat at position 44 of 48, so glpi/test-list-http-status.sh, orchestrator/test-board-roll.sh, woodpecker/test-ci-wait-exit-matrix.sh and _scripts/test-fleet-transport-check.sh have not run at all since the merge. The pipeline reported one failure, never "one failure plus four unrun". All four are green when run directly on sb-it-1-dt, so the mask hid nothing broken -- but that is a local result on one host, not a CI-image result. Verification, with controls: - enumeration guard OK (population 52, enumerated 36, signed-excluded 16). - control A, exclusion line removed while unwired -> FAIL UNENUMERATED. - control B, exclusion line kept while rewired -> FAIL CONTRADICTORY EXCLUSION. The gate discriminates in both directions, so its OK is load-bearing. - the four formerly-masked suites: rc=0 each, run directly. - the full chain cannot be run to completion on sb-it-1-dt: it stops earlier, at the lease-broker Invariant R test, because this host carries the quarantined operator-global pi 0.84.2 against a measured 0.84.1. That is host-specific and out of scope here -- CI pins 0.84.1, and the single FAIL line in those three pipelines proves positions 1-43 passed there. Burn-down is to control the tail of PANE_PATH inside the test, not to remove pi from the image. Recorded in the exclusion reason and in #1269.	2026-08-16 17:58:49 -05:00