test(#795): make PR diff fixtures hermetic

.prettierignore

@@ -7,4 +7,3 @@ pnpm-lock.yaml
 .claude/
 docs/tess/TASKS.md
 docs/scratchpads/
-packages/mosaic/src/fleet/testdata/documentation-publication-v1/inline-migration-v1.json

README.md

@@ -97,10 +97,7 @@ mosaic config path           # Print config file path
 ```bash
 mosaic doctor                # Health audit — detect drift and missing files
 mosaic sync                  # Sync skills from canonical source
-mosaic skill list            # Audit Claude skill registrations and conflicts
-mosaic skill register <name> # Register one canonical skill with Claude Code
-mosaic skill unregister <name> # Remove one Mosaic-owned Claude link
-mosaic update                # Update CLI/framework and auto-register canonical skills
+mosaic update                # Check for and install CLI updates
 mosaic wizard                # Full guided setup wizard
 mosaic bootstrap <path>      # Bootstrap a repo with Mosaic standards
 mosaic coord init            # Initialize a new orchestration mission
@@ -352,8 +349,6 @@ bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
-
 ## Contributing
 
 ```bash

docs/PRD.md

@@ -79,29 +79,6 @@ Jarvis (v0.2.0) is a self-hosted AI assistant with a Python FastAPI backend and
 
 ---
 
-## Compaction Refresh Trust Lifecycle (M1, #827–#830)
-
-### Problem and objective
-
-Context compaction, session replacement, and same-PID runtime reloads can leave a previously VERIFIED runtime lease attached to stale directives. M1 must revoke that authority mechanically for Claude (including Claudex) and Pi without trusting caller-asserted identity or forking the external broker state machine.
-
-### Requirements
-
-1. `CR-REQ-01`: Claude `PreCompact` and `SessionStart` with matcher `compact`, plus Pi `session_before_compact` and the first post-`session_compact` `context`, SHALL independently revoke the active broker lease.
-2. `CR-REQ-02`: Runtime generation increases—including same-PID Pi reload/new/resume/fork and Claude resume/clear—SHALL monotonically replace the prior broker incarnation and inherit no VERIFIED lease.
-3. `CR-REQ-03`: A fired observer that cannot confirm broker revocation SHALL fail closed through lifecycle cancellation, a private local generation fence, and/or a runtime-local tool latch. The existing all-tools broker gate remains authoritative.
-4. `CR-REQ-04`: The lease TTL SHALL remain monotonic and capped at 300 seconds. If both observers are missed, within-TTL consequential actions remain allowed and after-TTL actions are denied. This named bounded residual stale window SHALL be documented without claiming a mutator-action bound inside the window.
-5. `CR-REQ-05`: Hook descendants SHALL use the broker-minted session and owner-only current-generation state inherited from register-before-exec. Caller-minted sessions and parallel lease state machines remain forbidden.
-
-### Acceptance criteria
-
-1. `AC-CR-01`: Real-socket tests prove each Claude observer revokes, Pi lifecycle tests prove both observer paths, and Claudex isolated settings preserve and install the mandatory hooks.
-2. `AC-CR-02`: A same-PID generation test proves the old generation is stale and the replacement generation is UNVERIFIED across reload/resume/fork-equivalent lifecycle events.
-3. `AC-CR-03`: RED-first T12b/T30 evidence explicitly reports dual-hook miss within TTL as **ALLOWED** and after TTL as **DENIED**.
-4. `AC-CR-04`: Attributable executable coverage is at least 85%, the full repository suite is green on deterministic main, and independent code/security review completes before merge.
-
----
-
 ## Fleet Declarative Configuration Management Workstream (FCM, #758)
 
 ### Problem and objective

docs/SITEMAP.md

@@ -1,39 +1,11 @@
 # Documentation Sitemap
 
-## Compaction refresh lease broker
-
-- [Internal broker protocol](architecture/lease-broker-protocol.md) — kernel identity, ancestry and generation invariants, framed requests, responses, and persisted cycle bindings.
-- [Broker operations](guides/lease-broker-operations.md) — protected paths, startup, constrained recovery, fail-closed posture, distinct-principal deployment, and residual risk.
-- [Constrained recovery skill](../packages/mosaic/framework/skills/mosaic-context-refresh/SKILL.md) — source-resident thin wrapper, receipt scope, C4 replay boundary, and T-C middle-drop disclosure.
-- [Lease-broker security notes](architecture/lease-broker-security.md) — identity, whole-class authorization, threat boundaries, and coordinator review requirements.
-- [Whole mutator-class gate](architecture/mutator-class-gate.md) — default-deny policy, revoke-first/promote-last state machine, TTL, runtime adapters, and T-B/T-C assurance boundary.
-- [Compaction revocation lifecycle](architecture/compaction-revocation.md) — Claude/Pi observer matrix, same-PID generation rollover, failure fencing, and the named bounded residual stale window.
-
-## CLI and skill management
-
-- [Skill registration user guide](guides/user-guide.md#claude-code-skill-registration) — register, unregister, list statuses, automatic install/update reconciliation, and Claude reload behavior.
-- [Skill bridge developer guide](guides/dev-guide.md#claude-code-skill-bridge) — path-validation, ownership, clobber-protection, install/update wiring, tests, and Pi/Codex scope notes.
-
 ## Fleet configuration management
 
-- [Fleet configuration entry point](fleet/README.md) — desired-versus-observed decision tree and complete operator link map.
-- [Desired, derived, and observed state](fleet/concepts/desired-vs-observed-state.md) — roster authority, generation, ownership, and drift.
-- [Identity, class, and runtime](fleet/concepts/identity-class-runtime.md) — stable name, display alias, class, runtime, provider, and model separation.
-- [Role authority and leases](fleet/concepts/role-authority-and-leases.md) — validator/merge-gate separation and bounded lease authority.
-- [Generated launch chain](fleet/concepts/generated-env-launch-chain.md) — strict data parsing, precedence, and quarantine.
-- [Roster v2 structural contract](fleet/reference/roster-v2-fields.md) — schema, supported values, required fields, defaults, and constraints.
-- [Fleet CLI reference](fleet/reference/cli.md) — local desired-state commands, JSON/exit behavior, and gateway-catalog separation.
-- [Lifecycle transitions](fleet/reference/lifecycle-transitions.md) — create/apply/reboot/migration/rollback boundaries.
-- [Status and drift](fleet/reference/status-and-drift.md) — desired/managed/observed state and current/future classifications.
-- [Safe agent CRUD](fleet/how-to/create-update-delete-agent.md) — expected generation, dry-run, and partial-failure recovery.
-- [Local lifecycle operations](fleet/how-to/start-stop-restart.md) — persisted versus one-shot actions.
-- [Configurable interaction instance](fleet/how-to/configure-tess-interaction.md) and [validator instance](fleet/how-to/configure-ultron-validator.md) — generic identities and protected limits.
-- [Reconcile and recover](fleet/operations/reconcile-and-recover.md) — plan/apply lock and recovery behavior.
-- [Environment quarantine](fleet/operations/env-quarantine.md) — private evidence and value-free diagnostics.
-- [Systemd/tmux troubleshooting](fleet/operations/systemd-tmux-troubleshooting.md) — socket, holder, unmanaged-session, and lock decisions.
-- [Backup/restore boundary](fleet/operations/backup-restore.md) and [upgrade-assets hold](fleet/operations/upgrade-assets.md).
-- [v1-to-v2 migration preview](fleet/migration/v1-to-v2.md) and [executable artifact dispositions](fleet/migration/example-profile-disposition.md).
-- [FCM M5 closure evidence](reports/documentation/758-fleet-config-ia-closure.md) and [approved deferrals](reports/deferred/758-fleet-config-deferrals.md).
+- [Generated environment boundary](fleet/reference/generated-env-boundary.md) — roster-derived launch projection, strict local data, legacy quarantine, and downstream interface evidence.
+- [Roster v2 structural contract](fleet/reference/roster-v2-fields.md) — local-tmux schema v2 parsing and structural validation.
+- [Role classes and authority](fleet/reference/role-classes.md) — canonical role resolver and protected authority boundaries.
+- [Executable asset dispositions](fleet/migration/example-profile-disposition.md) — shipped v1 fixture/profile/service validation posture.
 
 ## Official channel plugins
 
@@ -96,8 +68,3 @@
 - [Logical identity and connector lease/fencing implementation](https://git.mosaicstack.dev/mosaicstack/stack/issues/755)
 - [M1 logical identity and fencing architecture](architecture/mos-runtime-portability-m1.md)
 - [M1 connector lease operations](guides/mos-connector-lease-operations.md)
-
-## Comms evolution — Matrix-native MACP (design, draft)
-
-- [RFC-001 — MACP: a Mosaic-native, Matrix-native comms layer](rfcs/RFC-001-MACP-MATRIX-NATIVE.md) — Synapse + Mosaic appservice backbone, MACP v1 protocol, presence/escalation, federation, strangler migration off the Hermes MCP bridge.
-- [RFC-002 — Install, configuration & topology for the Matrix/MACP comms system](rfcs/RFC-002-INSTALL-CONFIG-TOPOLOGY.md) — open-source install topology modes, ACME cert provisioning, pluggable secret backend, and config precedence.

docs/TASKS.md

@@ -52,20 +52,20 @@ Active workstream is **W1 — Federation v1**. Workers should:
 > the repository quality gates, independent code and security review, terminal-green CI, and
 > the applicable acceptance evidence before merge. Issue #758 remains open until M5 closes.
 
-| id         | status      | description                                                                                                                                                            | issue | agent         | repo              | branch                                  | depends_on                                     | estimate | notes                                                                                                                                                                                                              |
-| ---------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------------- | ----------------- | --------------------------------------- | ---------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| FCM-M0-001 | done        | Publish normative PRD requirements/acceptance criteria, this M0–M5 DAG, docs-IA checklist, and legacy example/profile disposition inventory; no implementation changes | #758  | sonnet        | mosaicstack/stack | `docs/758-fleet-config-management`      | —                                              | 18K      | Merged via #760 (`c32d85a`); parent #758 intentionally remains open through M5                                                                                                                                     |
-| FCM-M1-001 | done        | Implement narrow local-tmux v2 roster structural contract/compiler with YAML/JSON canonicalization and schema/parser parity tests                                      | #758  | coder0        | mosaicstack/stack | `feat/758-roster-v2-compiler`           | FCM-M0-001                                     | 30K      | #764 squash `aa5b43b`; exact-head RoR and PR/main terminal-green CI; no lifecycle or live mutation                                                                                                                 |
-| FCM-M1-002 | done        | Reuse existing profile/persona/provision resolver for roster semantics; add canonical class/authority validation and approved aliases                                  | #758  | native-sonnet | mosaicstack/stack | `feat/758-shared-role-resolution`       | FCM-M0-001                                     | 25K      | #768 squash `a5e8e55`; shared resolver and canonical authority/alias validation delivered                                                                                                                          |
-| FCM-M1-003 | done        | Convert the M0 legacy inventory into executable example/profile/service-preset validation and explicit v1-version/retirement checks                                    | #758  | codex         | mosaicstack/stack | `test/758-example-profile-dispositions` | FCM-M1-001, FCM-M1-002                         | 20K      | #770 squash `e9c4aa3`; shipped artifact disposition validation delivered                                                                                                                                           |
-| FCM-M2-001 | done        | Migrate generic launch chain to deterministic `.env.generated` plus strict data-only `.env.local`; quarantine forbidden legacy keys                                    | #758  | codex         | mosaicstack/stack | `feat/758-generated-env-boundary`       | FCM-M1-001, FCM-M1-002                         | 30K      | #772 squash `191efae`; generated/local boundary and private quarantine delivered                                                                                                                                   |
-| FCM-M2-002 | done        | Add generation-guarded local fleet agent create/get/update/delete mutations with plan/dry-run, atomic roster writes, and recovery output                               | #758  | codex         | mosaicstack/stack | `feat/758-fleet-agent-crud`             | FCM-M1-001, FCM-M2-001                         | 30K      | #773 squash `bc5e736`; generation-guarded atomic CRUD and recovery contracts delivered                                                                                                                             |
-| FCM-M3-001 | done        | Implement local roster-owned reconcile/apply plus lifecycle/status/verify/doctor contracts and stable JSON/exit codes                                                  | #758  | codex         | mosaicstack/stack | `feat/758-local-reconciler`             | FCM-M2-001, FCM-M2-002                         | 35K      | #785 squash `4990905`; exact roster-owned systemd/tmux reconcile and lifecycle contracts delivered                                                                                                                 |
-| FCM-M3-002 | in-progress | Add isolated systemd/tmux lifecycle, drift, socket, unmanaged-session, crash, and rollback acceptance coverage                                                         | #758  | sonnet        | mosaicstack/stack | `test/758-reconciler-lifecycle-gates`   | FCM-M3-001                                     | 25K      | Canonical v2 named-socket + legacy-v1 default-server boundaries; fake adapters/temp fixtures only                                                                                                                  |
-| FCM-M4-001 | done        | Implement field-complete v1-to-v2 inventory/preview/migrator with alias, lifecycle, env-quarantine, and remote/connector disposition evidence                          | #758  | codex         | mosaicstack/stack | `feat/758-v1-v2-migrator`               | FCM-M1-003, FCM-M3-001                         | 35K      | PR #788; final head `d63bb0206a1d312ab8352ec1d3ca3631146b0baa`; tree `4da210da9a71b035130d4160a4a2e691bdfde2da`; squash `9745bc3f29c26b021a478b7ad03cfb494f6c9de3`; descendant-main pipeline 1855 terminal success |
-| FCM-M4-002 | not-started | Add reversible canary migration, rollback, stale-projection/orphan classification, and current-host 9-managed/3-unmanaged fixture coverage                             | #758  | sonnet        | mosaicstack/stack | `test/758-migration-rollback-gates`     | FCM-M4-001, FCM-M3-002                         | 25K      | HOLD: never starts a previously stopped agent or kills an unproven unmanaged session; not authorized by FCM-M5-001                                                                                                 |
-| FCM-M5-001 | done        | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | #789 content squash 627cf2bb; de-flake repair PR#851/#849 squash 77c9a826; completion proof wp1937 @aa999daf push/ci step 49632 recovery_runtime_unittest.py 3/3 OK (closes wp1932 step 49576 Errno111)            |
-| FCM-M5-002 | not-started | Package/update asset-drift checks, rolling local canary, independent validation certificate, and release evidence                                                      | #758  | sonnet        | mosaicstack/stack | `feat/758-fleet-config-release-gate`    | FCM-M3-002, FCM-M4-002, FCM-M5-001             | 30K      | HOLD: final #758 gate; quality, independent code/security review, validator certificate, merge-gate approval, and green CI remain out of M5-001                                                                    |
+| id         | status      | description                                                                                                                                                            | issue | agent         | repo              | branch                                  | depends_on                                     | estimate | notes                                                                                                            |
+| ---------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------------- | ----------------- | --------------------------------------- | ---------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------- |
+| FCM-M0-001 | done        | Publish normative PRD requirements/acceptance criteria, this M0–M5 DAG, docs-IA checklist, and legacy example/profile disposition inventory; no implementation changes | #758  | sonnet        | mosaicstack/stack | `docs/758-fleet-config-management`      | —                                              | 18K      | Merged via #760 (`c32d85a`); parent #758 intentionally remains open through M5                                   |
+| FCM-M1-001 | done        | Implement narrow local-tmux v2 roster structural contract/compiler with YAML/JSON canonicalization and schema/parser parity tests                                      | #758  | coder0        | mosaicstack/stack | `feat/758-roster-v2-compiler`           | FCM-M0-001                                     | 30K      | #764 squash `aa5b43b`; exact-head RoR and PR/main terminal-green CI; no lifecycle or live mutation               |
+| FCM-M1-002 | done        | Reuse existing profile/persona/provision resolver for roster semantics; add canonical class/authority validation and approved aliases                                  | #758  | native-sonnet | mosaicstack/stack | `feat/758-shared-role-resolution`       | FCM-M0-001                                     | 25K      | #768 squash `a5e8e55`; shared resolver and canonical authority/alias validation delivered                        |
+| FCM-M1-003 | done        | Convert the M0 legacy inventory into executable example/profile/service-preset validation and explicit v1-version/retirement checks                                    | #758  | codex         | mosaicstack/stack | `test/758-example-profile-dispositions` | FCM-M1-001, FCM-M1-002                         | 20K      | #770 squash `e9c4aa3`; shipped artifact disposition validation delivered                                         |
+| FCM-M2-001 | done        | Migrate generic launch chain to deterministic `.env.generated` plus strict data-only `.env.local`; quarantine forbidden legacy keys                                    | #758  | codex         | mosaicstack/stack | `feat/758-generated-env-boundary`       | FCM-M1-001, FCM-M1-002                         | 30K      | #772 squash `191efae`; generated/local boundary and private quarantine delivered                                 |
+| FCM-M2-002 | done        | Add generation-guarded local fleet agent create/get/update/delete mutations with plan/dry-run, atomic roster writes, and recovery output                               | #758  | codex         | mosaicstack/stack | `feat/758-fleet-agent-crud`             | FCM-M1-001, FCM-M2-001                         | 30K      | #773 squash `bc5e736`; generation-guarded atomic CRUD and recovery contracts delivered                           |
+| FCM-M3-001 | done        | Implement local roster-owned reconcile/apply plus lifecycle/status/verify/doctor contracts and stable JSON/exit codes                                                  | #758  | codex         | mosaicstack/stack | `feat/758-local-reconciler`             | FCM-M2-001, FCM-M2-002                         | 35K      | #785 squash `4990905`; exact roster-owned systemd/tmux reconcile and lifecycle contracts delivered               |
+| FCM-M3-002 | in-progress | Add isolated systemd/tmux lifecycle, drift, socket, unmanaged-session, crash, and rollback acceptance coverage                                                         | #758  | sonnet        | mosaicstack/stack | `test/758-reconciler-lifecycle-gates`   | FCM-M3-001                                     | 25K      | Canonical v2 named-socket + legacy-v1 default-server boundaries; fake adapters/temp fixtures only                |
+| FCM-M4-001 | not-started | Implement field-complete v1-to-v2 inventory/preview/migrator with alias, lifecycle, env-quarantine, and remote/connector disposition evidence                          | #758  | codex         | mosaicstack/stack | `feat/758-v1-v2-migrator`               | FCM-M1-003, FCM-M3-001                         | 35K      | Preview first; no unreviewed lifecycle inference                                                                 |
+| FCM-M4-002 | not-started | Add reversible canary migration, rollback, stale-projection/orphan classification, and current-host 9-managed/3-unmanaged fixture coverage                             | #758  | sonnet        | mosaicstack/stack | `test/758-migration-rollback-gates`     | FCM-M4-001, FCM-M3-002                         | 25K      | Never starts a previously stopped agent or kills an unproven unmanaged session                                   |
+| FCM-M5-001 | not-started | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | Must close every checklist item or record an approved deferral                                                   |
+| FCM-M5-002 | not-started | Package/update asset-drift checks, rolling local canary, independent validation certificate, and release evidence                                                      | #758  | sonnet        | mosaicstack/stack | `feat/758-fleet-config-release-gate`    | FCM-M3-002, FCM-M4-002, FCM-M5-001             | 30K      | Final #758 gate: quality, independent code/security review, validator certificate, merge-gate approval, green CI |
 
 ## Thin-core prompt diet (#528) — feat/contract-thin-core
 

docs/architecture/compaction-revocation.md

@@ -1,59 +0,0 @@
-# Compaction observer revocation and runtime generations
-
-WI-3 connects Claude and Pi compaction/session lifecycle events to the existing authenticated lease-broker state machine. It does not add a second lease store or let runtime hooks assert identity. Each observer inherits the broker-minted session, resolves the current private runtime generation, and sends the existing `revoke_lease` action over the authenticated Unix socket.
-
-## Observer matrix
-
-| Runtime          | Lifecycle signal                                                 | Action                                                                                                                       |
-| ---------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| Claude / Claudex | `PreCompact`                                                     | Revoke the current lease before compaction. A non-zero hook result blocks the lifecycle transition.                          |
-| Claude / Claudex | `SessionStart` with matcher `compact`                            | Revoke again after compacted context starts.                                                                                 |
-| Claude / Claudex | `SessionStart` with matcher `resume\|clear`                      | Atomically advance the private generation, then revoke the replacement incarnation.                                          |
-| Pi               | `session_before_compact`                                         | Revoke before compaction; return `{ cancel: true }` if revocation cannot be confirmed.                                       |
-| Pi               | `session_compact` then the first `context`                       | Arm and run an independent post-compaction revoke. A failed post observer blocks later tools locally until a retry succeeds. |
-| Pi               | `session_start` with reason `reload`, `new`, `resume`, or `fork` | Atomically advance the private generation, then revoke the replacement incarnation before reuse.                             |
-
-The first observer that reaches the broker deletes pending promotion tokens and makes the lease `UNVERIFIED`. The second compaction observer is deliberate redundancy, not a prerequisite for the first. Claudex receives the same mandatory hooks in its isolated `CLAUDE_CONFIG_DIR`; hook merging preserves unrelated isolated settings and rejects malformed or symlinked settings fail-closed.
-
-## Private generation authority
-
-`launch-runtime.py` still registers before `exec`, preserving the kernel-authenticated PID/starttime anchor. It now also creates `generation-<broker-session>.state` beside the broker socket. The file is owner-only mode `0600` under the broker's mode-`0700` directory. Hook descendants read that file instead of relying only on an immutable inherited environment value.
-
-Generation changes use an exclusive file lock, validate owner/type/mode/size, increment monotonically, truncate and write the complete new value, and `fsync` before contacting the broker. Therefore reload, new-session, resume, and fork events may retain the same PID/starttime while still becoming a new broker incarnation. The higher generation causes the broker to atomically discard prior tokens and lease authority; the replacement generation inherits no VERIFIED lease.
-
-If an observer fires while broker transport is unavailable, `revoke-lease.py` advances the private generation as a local fence before returning non-zero. Every later all-tools gate reads that higher value. When the broker is reachable again, authentication of that value performs the same old-generation revocation before authorization. Pi also keeps a process-local post-compaction/rollover failure latch that blocks tool calls. An unsafe or unreadable generation file itself makes both lifecycle revocation and tool authorization fail closed.
-
-## Threat contract and stopping boundary
-
-### BOUNDED RESIDUAL STALE WINDOW
-
-If **both** pre- and post-compaction observers are missed entirely, no revocation signal exists. During the remaining unexpired lease, **within-TTL consequential actions are allowed**. Their count and timing are **bounded by lease expiry, not by the mutator gate**. WI-3 makes no claim that it bounds mutator actions inside this stale interval. The broker's monotonic lease TTL is capped at 300 seconds; after expiry, the next consequential tool is denied with `LEASE_EXPIRED`.
-
-This is the named D2-v5 T-A residual. It is distinct from an observer that fires but cannot contact the broker: the latter creates a local generation fence and fails closed. It is also distinct from T-C total rot, where the lifecycle observers and the all-tools gate are both absent or replaced. Server-side branch protection, required CI, and independent review remain the irreducible backstop for T-C.
-
-| Condition                                                       | Result                                                                                                                |
-| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
-| Either compaction observer succeeds                             | Existing lease and pending promotion tokens are revoked immediately.                                                  |
-| Observer runs but broker confirmation fails                     | Lifecycle transition is denied where supported; local generation fence and runtime latch prevent inherited authority. |
-| Both observers are missed, lease unexpired                      | **ALLOWED** inside the bounded residual stale window. No within-window mutator bound is claimed.                      |
-| Both observers are missed, lease expired                        | **DENIED** by monotonic TTL expiry.                                                                                   |
-| Generation advances on reload/new/resume/fork                   | Prior incarnation revoked; replacement starts `UNVERIFIED`.                                                           |
-| Lifecycle observers and all-tools gate both fail or are removed | T-C total-hook-miss residual; protected-branch controls remain required.                                              |
-
-## T-C server-side branch-protection posture
-
-The required posture is that `main` is push-blocked and PR-only-merge is **MANDATORY**, regardless
-of client-gate state. The client-side gate narrows the exposure window only; it is not the T-C
-guarantee. The server-side protected-branch configuration is the irreducible guarantee for protected
-repository actions. Status-check enforcement and approval enforcement are **RECOMMENDED**.
-
-## Current-vs-required gap (recorded, not enacted)
-
-The current empirical configuration is recorded here without re-probing or mutating live branch
-protection. `enable_push=False` (push-block present), so the mandatory push-block/PR-only-merge core
-holds. `require_approvals=0` (approvals not enforced), `enable_status_check=False` (status checks not
-enforced), and `block_on_official_review=False` (official review not enforced). Those recommended
-merge-quality controls are the current gap; changing them is a separate, owner-gated operations
-decision and is not enacted by this documentation change.
-
-The permanent T12b/T30 acceptance case prints both required outcomes: dual-hook miss within TTL is **ALLOWED**, and the same lease after TTL is **DENIED**. Separate real-socket tests prove each Claude observer and same-PID generation rollover; Pi lifecycle tests exercise pre/post observers, all four replacement reasons, and local failure closure.

docs/architecture/lease-broker-protocol.md

@@ -1,35 +0,0 @@
-# Authenticated external lease broker protocol
-
-The compaction-refresh lease broker is a Linux-only, newline-framed JSON protocol over a Unix stream socket. It is runtime-neutral; M1 consumers are limited to Claude and Pi. This is an internal process boundary, not an HTTP API, so it is intentionally absent from OpenAPI.
-
-The broker, never the caller, obtains `(pid, uid, gid)` from kernel `SO_PEERCRED`. It correlates the PID with `/proc/<pid>/stat` field 22 (`starttime`) and mints `session_id` on `register_anchor`. Presence of `session_id` in that request is refused even when its value is `null` or empty. Later requests must originate from the anchor or a descendant. The broker walks parent PIDs to the `(pid,starttime)` anchor and then rereads every walked PID's starttime before accepting the chain.
-
-## Request and response boundary
-
-Each connection carries exactly one UTF-8 JSON object followed by one newline, capped at 64 KiB. The protocol deliberately uses EOF to prove that there is exactly one frame: immediately after writing the newline, the client **MUST half-close its write side** with `shutdown(SHUT_WR)` (or Node `socket.end()`) before awaiting the response. A client that writes a newline but leaves its write side open receives no successful response; the broker's one-second connection deadline fails closed. Malformed, unterminated, multiple (including a delayed second frame), or oversized frames fail closed. Responses are one JSON object and one newline. Success has `{"ok":true,...}`; refusal has `{"ok":false,"code":"TYPED_CODE"}`. Requests are:
-
-- `register_anchor`: `action`, non-negative `runtime_generation`; no `session_id` field.
-- `authenticate`: `action`, broker-minted `session_id`, non-negative `runtime_generation`.
-- `mint_token`: authenticated identity plus `binding` containing exactly `compaction_epoch`, `request_epoch`, `h_source`, `h_payload`, and `schema_version`.
-- `consume_token`: authenticated identity plus `token`.
-- `begin_verification`: authenticated identity, runtime (`claude` or `pi`), cycle `binding`, and a TTL no greater than 300 seconds. The broker revokes existing authority first, enters `PENDING_VERIFICATION`, and returns a single-use promotion token.
-- `begin_recovery`: the constrained recovery entrypoint. It rejects caller-provided receipt/challenge fields and delegates to the same `begin_verification` transition, but reports `PENDING_DELIVERY` and marks the volatile cycle as recovery-owned.
-- `complete_recovery`: authenticated identity only. It rejects caller-provided receipt/challenge fields, obtains the current recovery challenge only from broker state, and delegates to the same trusted-observer → evidence → consume → promote sequence. An observation failure revokes recovery authority; retry starts a fresh challenge.
-
-The daemon owns a second protected production observer socket (mode `0600`) unless a private `--test-observer-file` fixture is selected. That transport accepts only the exact `record_runtime_observation` schema after kernel `SO_PEERCRED` plus the existing anchor/ancestry authentication; it validates the pending runtime/generation before storing one finalized assistant entry for the in-process `RuntimeReceiptObserver`. It is **not** a broker request action. Claude sends its latest assistant entry from the Stop-hook transport; Pi sends only finalized `message_end` assistant content. The public broker socket continues to reject request-supplied `latest_assistant_message` in begin, observe, and complete paths.
-
-- `promote_lease`: authenticated identity plus the exact pending promotion token. The broker commits token consumption before making `VERIFIED` visible.
-- `revoke_lease`: authenticated observer signal; deletes pending tokens and makes the session `UNVERIFIED` immediately. WI-3 Claude/Pi hooks send this existing action; `runtime` and bounded `reason` fields are diagnostic input only and never identity authority.
-- `authorize_tool`: authenticated identity, runtime, and exact runtime-reported tool name. The broker returns an explicit allow/deny decision from the whole-class policy and current lease.
-
-A higher generation for the same anchor atomically replaces the stored incarnation and deletes all prior tokens and lease authority for that session. A lower generation is stale. Runtime descendants resolve the current generation from an owner-only, locked generation file created by the register-before-exec launcher; reload/new/resume/fork observers advance and `fsync` it before broker revocation. This supports generation replacement even when PID/starttime do not change. Tokens are 256-bit values from the operating-system cryptographic RNG and are single use. At most 256 pending tokens may be persisted; another mint fails with `TOKEN_CAPACITY` before mutation. Successful consumption deletes the token, while a replay still fails with `TOKEN_REPLAY`. Live v1 token records retain the existing `consumed: false` schema.
-
-VERIFIED leases are volatile and monotonic-time bounded: broker restart, generation change, explicit observer revocation, or expiry returns the session to `UNVERIFIED`. `begin_verification` always revokes before minting a new prerequisite. `begin_recovery` reuses that exact transition and mints a new challenge, so a normal-path receipt/challenge cannot be replayed through recovery. `promote_lease` is valid only from the matching pending cycle; persistence failure rolls token and lease state back, while post-rename durability uncertainty terminates the broker. The WI-1 token is the atomic promotion prerequisite substrate.
-
-## Receipt boundary and T-C residual (R1)
-
-Receipt evidence is a T-A delivery/liveness prerequisite only; it cannot replace the mechanical
-mutator gate as safety authority. The receipt detects an **ABSENT** or **PREFIX-TRUNCATED** terminal
-token. A **MIDDLE-DROP** that preserves the tail is a T-C contract violation that is **NOT receipt-detectable**. It is covered by server-side protected-branch controls, **NOT** by the receipt; no category-wide receipt-detection claim is made for that tail-preserving transformation.
-
-State replacement serializes and enforces the 4 MiB maximum before opening a temporary file, then uses a mode-`0600` temporary file, `fsync`, atomic rename, and parent-directory `fsync`. Every broker mutation snapshots the prior v1 state. A commit failure before rename restores that snapshot and leaves durable state unchanged. A failure after rename makes durability uncertain, so the store is poisoned without rolling memory back and the daemon terminates rather than serving with divergent state. Existing state is opened without following symlinks, must be a bounded regular file at mode `0600`, and is fully schema- and invariant-validated before use. Persisted tokens must be unconsumed, match their session's current generation, and remain within the 256-token cap. Session identity is uniquely keyed by `(anchor_pid,anchor_starttime)`; duplicate logical sessions for one anchor refuse startup. State integrity or mode failures refuse startup. The daemon does not log session IDs or tokens.

docs/architecture/lease-broker-security.md

@@ -1,26 +0,0 @@
-# WI-1 lease broker security notes
-
-- Trusted identity comes only from Linux `SO_PEERCRED` plus `/proc` starttime, never request identity fields.
-- Descendant authorization is anchored to `(pid,starttime)` and uses a complete second starttime pass to fail closed on disappearance or PID-reuse races.
-- Runtime generations are monotonic per anchor; a bump revokes prior-incarnation tokens before persistence commits. WI-3 stores the live generation in an owner-only locked file so same-PID Pi reload/new/resume/fork and Claude resume/clear transitions cannot inherit a VERIFIED lease.
-- Session IDs and cycle tokens use the OS cryptographic RNG. `Math.random` and model output are not token sources.
-- Framing and persistence failures fail closed. Sensitive tokens are not logged.
-- Built-in `0700`/`0600` filesystem modes provide same-principal hardening only, not socket authenticity against the same UID. WI-1 provides no distinct-principal isolation. That stronger deployment requires an external protected proxy, ACL, or service boundary, and the boundary must preserve authenticated client identity for the broker's `SO_PEERCRED` and ancestry authorization rather than substituting a shared proxy identity.
-- WI-2 whole-class authorization denies every consequential, unknown, and custom tool while UNVERIFIED; it does not inspect shell strings or trust wrapper selection. First-class Claude/Pi, both Claudex dispatch modes, PRDY, QA remediation, coord, orchestrator, and fleet starts converge on broker register-before-exec; Claudex additionally installs the mandatory all-tools hook inside its preserved isolated config and fails closed on unsafe settings.
-- The permanent `check-runtime-launches.py` suite/CI guard scans production source for direct literal, absolute-path, process-API, command-array, and dynamic Claude/Pi launches. It has no bypass allowlist: an unrecognized launch form fails CI until routed through the common boundary.
-- WI-2 promotion consumes a WI-1 cycle token before VERIFIED becomes visible. Observer revocation, runtime-generation replacement, broker restart, and monotonic TTL expiry remove authority.
-- WI-3 wires redundant Claude `PreCompact`/`SessionStart(compact)` and Pi `session_before_compact`/post-`session_compact` `context` observers to that same revoke action. If broker confirmation fails after an observer fires, the revoker advances the private generation as a local fence; subsequent authorization revokes the stale broker incarnation before any consequential allow.
-- Dual observer absence while a lease remains live is the named **bounded residual stale window**: consequential tools remain allowed until monotonic expiry, with no claimed within-window action bound. After expiry they are denied. Total observer-plus-gate absence remains T-C.
-- Receipt observation, payload construction, and constrained recovery implementation remain later surfaces. A receipt can become a promotion prerequisite but is never the safety mechanism.
-
-## Named residual: promote-lease-lost-ACK (WI-3 D2-v5)
-
-A valid `promote_lease` can leave a session `VERIFIED` in the broker while the client never learns of it. This is a named, bounded D2-v5 T-A residual — an **authority-observability divergence, not an authority divergence, not an ALLOW-risk, and not a retry double-apply**. It is disclosed here, not laundered.
-
-**Window — where it can occur.** The broker commits token consumption and durable `VERIFIED` state _before_ the success reply becomes visible (see the promotion order in `lease-broker-protocol.md`). The residual is confined to the interval after that commit+fsync when the broker→client reply or peer-ACK is lost — for example an extreme-contention send failure or peer disconnect after `handle()` has already mutated and persisted state (the #838 fail-closed transport path). The lease mutation is already durable broker-side; only the acknowledgement to the client is lost. No uncommitted or partially-applied state is involved: the commit either happened (and is authoritative) or it did not (and no lease exists).
-
-**Fail-safe direction — the client can only under-claim.** Broker intent is the ceiling; client authority is always ≤ broker intent, never more. Client-side authority-belief is granted only by a _received_ acknowledgement; a lost acknowledgement conveys nothing, so the client cannot conclude "verified" and continues to treat itself as `UNVERIFIED` (it re-verifies or recovers). If the client retries `promote_lease` with the same token, the token is already consumed and the broker rejects the retry (`PROMOTION_TOKEN_MISMATCH` / `INVALID_LEASE_TRANSITION`); there is no double-apply. The committed `VERIFIED` state the broker holds is authority the lease _legitimately earned_ from a real promotion — the broker authorizing consequential tools under it is correct, not inflation. Divergence is therefore strictly toward _less_ client authority than the broker granted; it never produces authority the broker did not grant.
-
-**Bound — TTL plus the observer/gen-bump revoke backstop, self-healing.** The orphaned `VERIFIED` lease is indistinguishable to the broker from any other legitimately verified lease, so the identical D2-v5 revocation backstops dispose of it: any compaction observer (`PreCompact` / `SessionStart(compact)` for Claude; `session_before_compact` / post-`session_compact` `context` for Pi), any same-PID runtime-generation bump (reload/new/resume/fork), broker restart, or monotonic-time expiry returns the session to `UNVERIFIED`. Monotonic TTL expiry (capped at 300 seconds) is **unconditional** — it requires no observer at all — so the maximum exposure of the orphaned lease is one TTL, ≤ 300 s, after which the next consequential tool is denied with `LEASE_EXPIRED`. Any observer that fires shortens the window further. The residual self-heals: "≥1 observer fires OR expiry ⇒ revoke" catches the lost-ACK lease on the same terms as every other stale lease. As with the dual-observer-miss stale window, WI-3 makes no claim that the mutator gate bounds actions inside the residual interval; the interval is bounded by TTL and the revoke backstop, and the server-side branch-protection / required-CI / independent-review line remains the irreducible backstop for protected-repository mutations.
-
-Coordinator security review must rerun the real socket/peercred and mutator-gate acceptance suites on an unrestricted Linux runner and obtain the mandated independent Opus-SECREV review before integration.

docs/architecture/mutator-class-gate.md

@@ -1,72 +0,0 @@
-# Whole mutator-class lease gate
-
-WI-2 adds the framework-native authorization boundary for Claude (including the supported Claudex overlay) and Pi. Every runtime-reported tool name reaches the lease broker before execution. The gate classifies capabilities by the whole tool class; it never parses a Bash command to decide whether that particular string looks read-only.
-
-## Default-deny policy
-
-While a session is not VERIFIED, only these exact classes are allowed:
-
-- Claude: `Read`, `Grep`, `Glob`, `Ls`, `Find`
-- Pi: `read`, `grep`, `find`, `ls`
-- Both runtimes: the fixed `mosaic_context_recover` primitive
-
-Every other built-in, unknown tool, and custom/MCP tool is consequential by default and is denied. This includes Claude `Bash`, `Edit`, `Write`, and `NotebookEdit`, plus Pi `bash`, `edit`, and `write`. A compromised model therefore cannot bypass Mosaic wrappers by selecting raw `git`, `curl`, `kubectl`, provider, deployment, or filesystem commands inside a generic mutator—the generic mutator itself is blocked before its input executes.
-
-## Broker-owned transition order
-
-The authenticated broker is the sole lease writer:
-
-1. `begin_verification` revokes existing authority and pending tokens first, then records `PENDING_VERIFICATION` and mints one WI-1 single-use promotion token bound to the exact cycle.
-2. `promote_lease` accepts only that session/generation/binding/token combination.
-3. Token consumption commits before the volatile lease becomes VERIFIED. Promotion is last and cannot be reached directly from UNVERIFIED.
-4. `revoke_lease`, a runtime-generation increase, broker restart, or monotonic expiry removes mutator authority.
-
-The initial TTL is capped at the ratified 300-second maximum. A caller may request a shorter positive TTL but cannot lengthen the maximum. WI-3 installs the [compaction observer and generation lifecycle](compaction-revocation.md). Dual compaction-hook miss within an unexpired lease remains the ratified bounded T-A residual: consequential tools are allowed until expiry, with no claimed within-window action bound; once either observer revokes or TTL expires, the next consequential tool is denied.
-
-A receipt is only a future promotion prerequisite. It is not an obedience, residency, or safety proof and never replaces this mechanical gate.
-
-## Runtime adapters
-
-`launch-runtime.py` registers itself with the broker and then `exec`s Claude or Pi so PID/starttime remain the authenticated parent anchor. It exports the broker-minted session ID and an owner-only generation-file reference to descendants; lifecycle hooks advance that file for same-PID replacement generations.
-
-- Claude installs `mutator-gate.py` as an all-tools (`.*`) `PreToolUse` hook.
-- `mosaic claudex` and `mosaic yolo claudex` preserve their isolated `CLAUDE_CONFIG_DIR`, merge the mandatory hook into that isolated `settings.json`, and use the same register-before-exec launcher. Malformed or symlinked isolated settings deny launch.
-- Pi invokes the same executable from its `tool_call` handler.
-
-The executable submits the runtime's actual tool name to `authorize_tool`. Missing identity, malformed input/reply, timeout, broker unavailability, or denial exits with status 2 and blocks fail-closed.
-
-## Runtime-launch choke-point and permanent guard
-
-Every repository-owned Claude/Pi launch entry converges on `launch-runtime.py`, either directly or through `mosaic` → `execLeaseGatedRuntime`. PRDY init/update and QA remediation invoke the wrapper directly so their existing prompts, dangerous-permission behavior, working directory, and environment survive without skipping broker registration. The raw Claude `--dangerously-skip-permissions` primitive is owned only by `launch-runtime.py`; callers request semantic `--dangerous` mode, and the wrapper validates Claude before injecting the primitive. `@mosaicstack/coord` rewrites direct Claude commands to `mosaic claude` and rejects unknown custom Claude launchers.
-
-`check-runtime-launches.py` is the permanent completeness guard. It scans production shell, TypeScript/JavaScript, Python, and data launch definitions under `packages/`, `apps/`, `plugins/`, and `tools/`; direct literal, absolute-path, process-API, dynamic, command-substitution, `eval`, and variable-execution runtime launches fail. Shell comments are stripped with quote awareness, wrapper prefixes are tokenized with `shlex`, and only an invocation in command position with `--runtime` before the command separator is gated. Literal and tracked-variable command tokens use one terminal resolver after any nesting of `exec`, `command`, `nohup`, or `env` plus assignments. A direct command always wins over an inert marker on the same line. Independently, the raw dangerous primitive anywhere outside the choke-point is RED.
-
-The command parser is a best-effort CI defense, not a complete shell interpreter. Alias/function redefinition, sourced commands, generated scripts, and encoded pipelines are intentionally residual rather than an invitation to chase an unbounded shell language. Two runtime controls backstop that residual surface: primitive ownership rejects a dangerous launch even when command identity is alias-indirected, and Claude's global `.*` `PreToolUse` hook invokes the broker gate for non-dangerous launches. Without `MOSAIC_LEASE_SESSION_ID`, representative read, mutator, and custom/MCP tools all fail closed with `GATE_UNAVAILABLE`. Hook absence or replacement remains in the documented T-C boundary.
-
-### Parser stopping criterion
-
-- **A — realistic parser matrix:** comments, inert strings/assignments, heredocs, continuations, chained commands, command substitution, `eval`, bare tracked variables, and quoted/unquoted tracked variables behind `exec`, `command`, `nohup`, or `env` are permanent RED regressions. Prefix-variable forms are covered in both multiline and same-line assignment shapes.
-- **B — residual backstops:** a dangerous alias-indirected launch is RED solely through primitive anchoring; a parser-missed non-dangerous alias launch is paired with an acceptance test proving the global all-tools hook denies every representative tool class as `GATE_UNAVAILABLE` without a lease.
-- **C — independent fresh review:** the parser class is considered complete only when reviewers find no new non-overlapping realistic evasion on the exact head. A and B are repository evidence; C is supplied by the fresh review round.
-
-All three layers are load-bearing and complementary. The guard is mandatory in `@mosaicstack/mosaic`'s test script, so root CI fails on a future realistic bypass. Real-socket tests separately prove PRDY init/update and QA receive broker sessions and deny an unverified mutator.
-
-The live inventory is emitted by:
-
-```bash
-python3 packages/mosaic/framework/tools/lease-broker/check-runtime-launches.py --root . --json
-```
-
-| Production launch family                               | Gated entries |
-| ------------------------------------------------------ | ------------: |
-| `@mosaicstack/coord` default/configured Claude command |             2 |
-| Fleet runtime start                                    |             1 |
-| QA remediation + generated QA command                  |             2 |
-| Orchestrator command construction/session launches     |             3 |
-| PRDY init/update                                       |             2 |
-| Mosaic Claude/Pi/Claudex adapter and wrapper boundary  |             4 |
-| **Total**                                              |   **14 / 14** |
-
-## Assurance boundary
-
-This closes T-A after an observer fires or lease expiry and T-B for in-runtime tool calls. Hook/extension absence, a runtime executing outside the gated launcher, ptrace/same-UID broker replacement, and other fully rotted behavior remain T-C. Server-side branch protection and required PR review/CI remain the irreducible line for protected repository mutations.

docs/compaction-refresh/probes/p5_receipt_replay.py

@@ -1,228 +0,0 @@
-#!/usr/bin/env python3
-"""P5 Gate0 replay probe; BUILT ONLY, execution is Mos-gated.
-
-Run only under fresh-executor authorization:
-  python3 -I -S -B docs/compaction-refresh/probes/p5_receipt_replay.py
-
-Each of the default three isolated runs launches the shipped lease-broker daemon
-in a distinct private temporary directory.  This driver never changes broker
-state directly and does not replace the promote gate: every transition is sent
-over the daemon's real Unix socket.  It proves the shipped order is
-PENDING_DELIVERY -> observe/evidence commit -> consume -> VERIFIED and that a
-consumed challenge cannot be replayed or reopen/renew its lease.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import importlib.util
-import json
-import os
-import shutil
-import socket
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-
-
-HERE = Path(__file__).resolve().parent
-REPOSITORY = HERE.parents[2]
-TOOLS = REPOSITORY / "packages/mosaic/framework/tools/lease-broker"
-DAEMON = TOOLS / "daemon.py"
-FRAGMENTS = TOOLS / "normative_fragments.py"
-
-
-def load_shipped_fragments():
-    if not FRAGMENTS.is_file():
-        raise RuntimeError(f"shipped normative construction missing: {FRAGMENTS}")
-    spec = importlib.util.spec_from_file_location("p5_shipped_normative_fragments", FRAGMENTS)
-    if spec is None or spec.loader is None:
-        raise RuntimeError("unable to load shipped normative construction")
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-def request(socket_path: Path, value: dict[str, object]) -> dict[str, object]:
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
-        connection.settimeout(3.0)
-        connection.connect(str(socket_path))
-        connection.sendall((json.dumps(value, separators=(",", ":")) + "\n").encode())
-        connection.shutdown(socket.SHUT_WR)
-        response = bytearray()
-        while True:
-            chunk = connection.recv(4096)
-            if not chunk:
-                break
-            response.extend(chunk)
-    if not response.endswith(b"\n") or response.count(b"\n") != 1:
-        raise AssertionError(f"unframed broker reply: {bytes(response)!r}")
-    parsed = json.loads(response[:-1])
-    if not isinstance(parsed, dict):
-        raise AssertionError(f"non-object broker reply: {parsed!r}")
-    return parsed
-
-
-def wait_ready(process: subprocess.Popen[str], socket_path: Path) -> None:
-    deadline = time.monotonic() + 5.0
-    while time.monotonic() < deadline:
-        if socket_path.exists():
-            return
-        if process.poll() is not None:
-            output = process.stdout.read() if process.stdout is not None else ""
-            raise RuntimeError(f"shipped daemon exited before READY: {output}")
-        time.sleep(0.02)
-    raise TimeoutError("shipped daemon did not create private probe socket")
-
-
-def expect_refused(reply: dict[str, object], code: str) -> None:
-    if reply != {"ok": False, "code": code}:
-        raise AssertionError(f"expected refusal {code}, got {reply!r}")
-
-
-def run_once(index: int) -> str:
-    fragments = load_shipped_fragments()
-    root = Path(tempfile.mkdtemp(prefix=f"mosaic-p5-replay-{index}-"))
-    os.chmod(root, 0o700)
-    socket_path = root / "broker.sock"
-    state_path = root / "state.json"
-    observer_path = root / "test-observer.json"
-    process = subprocess.Popen(
-        [
-            sys.executable, "-I", "-S", "-B", str(DAEMON), "--socket", str(socket_path),
-            "--state", str(state_path), "--test-observer-file", str(observer_path),
-        ],
-        stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-        text=True,
-    )
-    try:
-        wait_ready(process, socket_path)
-        registered = request(socket_path, {"action": "register_anchor", "runtime_generation": 1})
-        if registered.get("ok") is not True or not isinstance(registered.get("session_id"), str):
-            raise AssertionError(f"registration failed: {registered!r}")
-        session_id = registered["session_id"]
-        construction = fragments.build_payload(
-            manifest_version=1,
-            generator_version="p5-replay-probe",
-            fragments=[
-                fragments.NormativeFragment(
-                    "authority/probe",
-                    b"P5 shipped transition driver\n",
-                    "63537df1a6cb0d80195a96757ab11d629e5b5e1f23be167218b84cb195b1c1d6",
-                ),
-            ],
-        )
-        if construction.injectionDecision != "ACCEPTED" or not construction.promotion:
-            raise AssertionError("shipped normative construction refused P5 fixture")
-        binding = {
-            "compaction_epoch": index,
-            "request_epoch": index + 100,
-            "h_source": construction.h_source,
-            "h_payload": construction.h_payload,
-            "schema_version": 1,
-        }
-        construction_request = {
-            "manifest_version": 1,
-            "generator_version": "p5-replay-probe",
-            "fragments": [{
-                "source_id": "authority/probe",
-                "content_base64": base64.b64encode(b"P5 shipped transition driver\n").decode("ascii"),
-                "expected_sha256": "63537df1a6cb0d80195a96757ab11d629e5b5e1f23be167218b84cb195b1c1d6",
-            }],
-        }
-        pending = request(socket_path, {
-            "action": "begin_verification",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "runtime": "pi",
-            "binding": binding,
-            "construction": construction_request,
-        })
-        if pending.get("ok") is not True or pending.get("state") != "PENDING_VERIFICATION":
-            raise AssertionError(f"shipped pending-delivery transition failed: {pending!r}")
-        challenge = pending.get("receipt_challenge")
-        receipt = pending.get("receipt")
-        if not isinstance(challenge, str) or not isinstance(receipt, str):
-            raise AssertionError(f"shipped broker did not mint a receipt challenge: {pending!r}")
-
-        # Promotion before observation/evidence/consumption is forbidden.
-        expect_refused(request(socket_path, {
-            "action": "promote_lease",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "receipt_challenge": challenge,
-        }), "INVALID_LEASE_TRANSITION")
-
-        observer_path.write_text(json.dumps({
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "latest_assistant_message": receipt,
-        }), encoding="utf-8")
-        os.chmod(observer_path, 0o600)
-        observed = request(socket_path, {
-            "action": "observe_receipt",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "receipt_challenge": challenge,
-        })
-        if observed.get("ok") is not True or observed.get("state") != "PENDING_PROMOTION":
-            raise AssertionError(f"shipped evidence transition failed: {observed!r}")
-        durable = json.loads(state_path.read_text(encoding="utf-8"))
-        evidence = durable["tokens"][challenge].get("evidence")
-        if not isinstance(evidence, dict) or not isinstance(evidence.get("h_latest_assistant"), str):
-            raise AssertionError("shipped receipt evidence was not committed before consume/promote")
-
-        promoted = request(socket_path, {
-            "action": "promote_lease",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "receipt_challenge": challenge,
-        })
-        if promoted.get("ok") is not True or promoted.get("state") != "VERIFIED":
-            raise AssertionError(f"shipped consume-before-promote transition failed: {promoted!r}")
-
-        # T25/T28: the actual consumed challenge, re-presented through the
-        # shipped daemon, can neither be observed again nor re-promote/reopen.
-        expect_refused(request(socket_path, {
-            "action": "observe_receipt",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "receipt_challenge": challenge,
-        }), "RECEIPT_REPLAY")
-        expect_refused(request(socket_path, {
-            "action": "promote_lease",
-            "session_id": session_id,
-            "runtime_generation": 1,
-            "receipt_challenge": challenge,
-        }), "RECEIPT_REPLAY")
-        return challenge
-    finally:
-        if process.poll() is None:
-            process.terminate()
-            try:
-                process.wait(timeout=3.0)
-            except subprocess.TimeoutExpired:
-                process.kill()
-                process.wait()
-        shutil.rmtree(root, ignore_errors=True)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--runs", type=int, default=3)
-    arguments = parser.parse_args()
-    if arguments.runs != 3:
-        raise SystemExit("P5 requires exactly three isolated runs")
-    challenges = [run_once(index) for index in range(arguments.runs)]
-    if len(set(challenges)) != arguments.runs:
-        raise AssertionError("separate shipped cycles did not mint unique challenges")
-    print("P5 receipt replay probe PASS: 3 isolated shipped-daemon runs")
-
-
-if __name__ == "__main__":
-    main()

docs/compaction-refresh/probes/p6_constrained_recovery.py

@@ -1,255 +0,0 @@
-#!/usr/bin/env python3
-"""P6 constrained-recovery probe; BUILT ONLY and Mos-gated.
-
-DO NOT self-fire. Under Mos authorization only:
-  python3 -I -S -B docs/compaction-refresh/probes/p6_constrained_recovery.py
-
-The default three isolated runs launch the shipped daemon plus its production
-observer transport on private sockets. The driver invokes the shipped recovery
-command and adapter gate identity; it never resets broker state, mocks promote,
-or taps a live model-output stream.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import hashlib
-import importlib.util
-import json
-import os
-import shutil
-import socket
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-
-
-HERE = Path(__file__).resolve().parent
-REPOSITORY = HERE.parents[2]
-TOOLS = REPOSITORY / "packages/mosaic/framework/tools/lease-broker"
-DAEMON = TOOLS / "daemon.py"
-GATE = TOOLS / "mutator-gate.py"
-RECOVERY_COMMAND = TOOLS / "recover-context.py"
-OBSERVER_CLIENT = TOOLS / "receipt-observer-client.py"
-FRAGMENTS = TOOLS / "normative_fragments.py"
-CLAUDE_SETTINGS = REPOSITORY / "packages/mosaic/framework/runtime/claude/settings.json"
-PI_EXTENSION = REPOSITORY / "packages/mosaic/framework/runtime/pi/mosaic-extension.ts"
-
-
-def load_shipped_fragments():
-    spec = importlib.util.spec_from_file_location("p6_shipped_fragments", FRAGMENTS)
-    if spec is None or spec.loader is None:
-        raise RuntimeError("shipped normative construction unavailable")
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-
-def request(socket_path: Path, value: dict[str, object]) -> dict[str, object]:
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
-        connection.settimeout(3.0)
-        connection.connect(str(socket_path))
-        connection.sendall((json.dumps(value, separators=(",", ":")) + "\n").encode())
-        connection.shutdown(socket.SHUT_WR)
-        response = bytearray()
-        while True:
-            chunk = connection.recv(4096)
-            if not chunk:
-                break
-            response.extend(chunk)
-    if not response.endswith(b"\n") or response.count(b"\n") != 1:
-        raise AssertionError(f"unframed broker reply: {bytes(response)!r}")
-    reply = json.loads(response[:-1])
-    if not isinstance(reply, dict):
-        raise AssertionError("broker reply is not an object")
-    return reply
-
-
-def wait_ready(process: subprocess.Popen[str], socket_path: Path) -> None:
-    deadline = time.monotonic() + 5.0
-    while time.monotonic() < deadline:
-        if socket_path.exists():
-            return
-        if process.poll() is not None:
-            output = process.stdout.read() if process.stdout is not None else ""
-            raise RuntimeError(f"shipped daemon exited before READY: {output}")
-        time.sleep(0.02)
-    raise TimeoutError("shipped daemon did not create private probe socket")
-
-
-def run_json(command: list[str], environment: dict[str, str], input_value: object | None = None) -> dict[str, object]:
-    completed = subprocess.run(
-        command,
-        input=None if input_value is None else json.dumps(input_value),
-        text=True,
-        capture_output=True,
-        env=environment,
-        check=False,
-    )
-    if not completed.stdout.endswith("\n"):
-        raise AssertionError(f"command omitted framed result: {completed.stderr!r}")
-    reply = json.loads(completed.stdout)
-    if not isinstance(reply, dict):
-        raise AssertionError("command result is not an object")
-    return reply
-
-
-def gate_recovery(runtime: str, phase: str, environment: dict[str, str]) -> None:
-    command = [sys.executable, "-I", "-S", "-B", str(GATE), "--runtime", runtime]
-    if runtime == "claude":
-        command.extend(["--recovery-command", str(RECOVERY_COMMAND)])
-        recovery_invocation = (
-            f"python3 {RECOVERY_COMMAND} begin --construction /tmp/p6.json "
-            "--compaction-epoch 1 --request-epoch 1"
-            if phase == "begin"
-            else f"python3 {RECOVERY_COMMAND} complete"
-        )
-        value = {"tool_name": "Bash", "tool_input": {"command": recovery_invocation}}
-    else:
-        value = {"tool_name": "mosaic_context_recover"}
-    completed = subprocess.run(command, input=json.dumps(value), text=True, capture_output=True, env=environment, check=False)
-    if completed.returncode != 0:
-        raise AssertionError(f"{runtime} recovery invocation remained gated: {completed.stderr!r}")
-
-
-def record_production_observation(runtime: str, message: str, root: Path, environment: dict[str, str]) -> None:
-    command = [sys.executable, "-I", "-S", "-B", str(OBSERVER_CLIENT), "--runtime", runtime]
-    if runtime == "claude":
-        transcript = root / "claude-transcript.jsonl"
-        transcript.write_text(json.dumps({"message": {"role": "assistant", "content": message}}) + "\n", encoding="utf-8")
-        payload = {"transcript_path": str(transcript)}
-        command.append("--latest-entry")
-    else:
-        payload = {"latest_assistant_message": message}
-    completed = subprocess.run(command, input=json.dumps(payload), text=True, capture_output=True, env=environment, check=False)
-    if completed.returncode != 0:
-        raise AssertionError(f"{runtime} production observer transport refused: {completed.stderr!r}")
-
-
-def run_once(index: int, runtime: str) -> None:
-    # Parity guard: drive the shipped command and the repaired adapter/observer
-    # bytes, not a shadow receipt or promotion implementation.
-    recovery_source = RECOVERY_COMMAND.read_text(encoding="utf-8")
-    if '"action": "begin_recovery"' not in recovery_source or '"action": "complete_recovery"' not in recovery_source:
-        raise AssertionError("P6 parity guard: recovery command no longer drives shipped broker entrypoints")
-    gate_source = GATE.read_text(encoding="utf-8")
-    if "--recovery-command" not in CLAUDE_SETTINGS.read_text(encoding="utf-8"):
-        raise AssertionError("P6 parity guard: Claude recovery mapping is missing")
-    if "_SHELL_ACTIVE" not in gate_source or "argv[1] != str(recovery_command)" not in gate_source:
-        raise AssertionError("P6 parity guard: Claude mapping is not literal-only")
-    if "const RECOVERY_TOOL = 'mosaic_context_recover'" not in PI_EXTENSION.read_text(encoding="utf-8"):
-        raise AssertionError("P6 parity guard: Pi recovery tool mapping is missing")
-
-    fragments = load_shipped_fragments()
-    root = Path(tempfile.mkdtemp(prefix=f"mosaic-p6-recovery-{index}-"))
-    os.chmod(root, 0o700)
-    socket_path = root / "broker.sock"
-    observer_socket = root / "observer.sock"
-    state_path = root / "state.json"
-    construction_path = root / "construction.json"
-    content = b"P6 constrained recovery fixture\n"
-    construction = {
-        "manifest_version": 1,
-        "generator_version": "p6-constrained-recovery",
-        "fragments": [{
-            "source_id": "authority/p6",
-            "content_base64": base64.b64encode(content).decode("ascii"),
-            "expected_sha256": hashlib.sha256(content).hexdigest(),
-        }],
-    }
-    construction_path.write_text(json.dumps(construction), encoding="utf-8")
-    os.chmod(construction_path, 0o600)
-    process = subprocess.Popen(
-        [sys.executable, "-I", "-S", "-B", str(DAEMON), "--socket", str(socket_path),
-         "--state", str(state_path), "--observer-socket", str(observer_socket)],
-        stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.STDOUT,
-        text=True,
-    )
-    try:
-        wait_ready(process, socket_path)
-        registered = request(socket_path, {"action": "register_anchor", "runtime_generation": 1})
-        session_id = registered.get("session_id")
-        if registered.get("ok") is not True or not isinstance(session_id, str):
-            raise AssertionError(f"broker anchor registration failed: {registered!r}")
-        built = fragments.build_payload_from_wire(construction)
-        normal = request(socket_path, {
-            "action": "begin_verification", "session_id": session_id, "runtime_generation": 1,
-            "runtime": runtime, "construction": construction,
-            "binding": {"compaction_epoch": index, "request_epoch": index + 100,
-                        "h_source": built.h_source, "h_payload": built.h_payload, "schema_version": 1},
-        })
-        normal_challenge = normal.get("receipt_challenge")
-        normal_receipt = normal.get("receipt")
-        if not isinstance(normal_challenge, str) or not isinstance(normal_receipt, str):
-            raise AssertionError("normal path did not mint a receipt challenge")
-        environment = {
-            **os.environ,
-            "MOSAIC_LEASE_BROKER_SOCKET": str(socket_path),
-            "MOSAIC_RECEIPT_OBSERVER_SOCKET": str(observer_socket),
-            "MOSAIC_LEASE_SESSION_ID": session_id,
-            "MOSAIC_RUNTIME_GENERATION": "1",
-            "MOSAIC_LEASE_RUNTIME": runtime,
-        }
-        gate_recovery(runtime, "begin", environment)
-        recovery = run_json([
-            sys.executable, "-I", "-S", "-B", str(RECOVERY_COMMAND), "begin", "--construction", str(construction_path),
-            "--compaction-epoch", str(index + 10), "--request-epoch", str(index + 110),
-        ], environment)
-        challenge = recovery.get("receipt_challenge")
-        receipt = recovery.get("receipt")
-        if recovery.get("state") != "PENDING_DELIVERY" or not isinstance(challenge, str) or not isinstance(receipt, str):
-            raise AssertionError(f"recovery command did not drive pending delivery: {recovery!r}")
-        if challenge == normal_challenge:
-            raise AssertionError("recovery reused a normal-path challenge")
-
-        # C4: production observer content is still exact-current-cycle only.
-        record_production_observation(runtime, normal_receipt, root, environment)
-        refused = run_json([sys.executable, "-I", "-S", "-B", str(RECOVERY_COMMAND), "complete"], environment)
-        if refused.get("ok") is not False or refused.get("code") != "RECEIPT_MISMATCH":
-            raise AssertionError(f"normal-path receipt replay was not refused: {refused!r}")
-
-        gate_recovery(runtime, "begin", environment)
-        recovery = run_json([
-            sys.executable, "-I", "-S", "-B", str(RECOVERY_COMMAND), "begin", "--construction", str(construction_path),
-            "--compaction-epoch", str(index + 20), "--request-epoch", str(index + 120),
-        ], environment)
-        receipt = recovery.get("receipt")
-        if recovery.get("state") != "PENDING_DELIVERY" or not isinstance(receipt, str):
-            raise AssertionError(f"fresh recovery retry did not pend: {recovery!r}")
-        record_production_observation(runtime, receipt, root, environment)
-        gate_recovery(runtime, "complete", environment)
-        promoted = run_json([sys.executable, "-I", "-S", "-B", str(RECOVERY_COMMAND), "complete"], environment)
-        if promoted.get("ok") is not True or promoted.get("state") != "VERIFIED":
-            raise AssertionError(f"recovery consume-before-promote failed: {promoted!r}")
-        replay = run_json([sys.executable, "-I", "-S", "-B", str(RECOVERY_COMMAND), "complete"], environment)
-        if replay.get("ok") is not False or replay.get("code") != "INVALID_LEASE_TRANSITION":
-            raise AssertionError(f"consumed recovery challenge re-promoted: {replay!r}")
-    finally:
-        if process.poll() is None:
-            process.terminate()
-            try:
-                process.wait(timeout=3.0)
-            except subprocess.TimeoutExpired:
-                process.kill()
-                process.wait()
-        shutil.rmtree(root, ignore_errors=True)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--runs", type=int, default=3)
-    arguments = parser.parse_args()
-    if arguments.runs != 3:
-        raise SystemExit("P6 requires exactly three isolated runs")
-    for index, runtime in enumerate(("pi", "claude", "pi")):
-        run_once(index, runtime)
-    print("P6 constrained recovery probe PASS: 3 isolated shipped recovery-command runs")
-
-
-if __name__ == "__main__":
-    main()

docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md

@@ -5,17 +5,28 @@
 This checklist is an acceptance contract for documentation and examples. It does not authorize
 schema, runtime, systemd, role, profile, or live-fleet changes. An item is complete only when its
 named artifact exists, is linked from the fleet documentation entry point, and its evidence is
-recorded in the M5 closure report and linked deferral evidence.
+recorded in the M0 task/PR.
 
 ## M0 baseline acceptance
 
-- [x] `docs/PRD.md` states the roster as desired-state SSOT; generated environment, systemd, tmux, and heartbeat artifacts as non-authoritative projections; and fail-closed handling of unsupported or quarantined legacy input.
-- [x] `docs/PRD.md` defines the required classes and authority boundary: `validator` certifies but does not merge; `merge-gate` remains sole approve-to-land/merge authority; `team-leader` capacity is lease-bounded; `interaction` is request/status only; instance names such as Tess and Ultron remain configurable.
-- [x] `docs/PRD.md` defines local lifecycle semantics for `enabled`, persisted desired state, and observed state, including stopped-state preservation through migration, apply, and reboot.
-- [x] `docs/PRD.md` defines the generated-env/local-override boundary, explicitly denies arbitrary command overrides in M1–M5, and requires key-name/hash-only quarantine diagnostics.
-- [x] `docs/PRD.md` identifies the M1–M5 local-tmux scope and excludes remote reconciliation, connector mutation, secret references, arbitrary commands/channels, gateway convergence, and UI configuration storage.
-- [x] `docs/TASKS.md` contains the complete M0–M5 one-card/one-PR dependency DAG for #758 with agent tier, branch, dependency, estimate, and evidence expectations.
-- [x] `docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md` classifies every current shipped fleet example, profile, and service preset before M1 implementation starts.
+- [ ] `docs/PRD.md` states the roster as desired-state SSOT; generated environment, systemd,
+      tmux, and heartbeat artifacts as non-authoritative projections; and fail-closed handling of
+      unsupported or quarantined legacy input.
+- [ ] `docs/PRD.md` defines the required classes and authority boundary: `validator` certifies but
+      does not merge; `merge-gate` remains sole approve-to-land/merge authority; `team-leader`
+      capacity is lease-bounded; `interaction` is request/status only; instance names such as Tess
+      and Ultron remain configurable.
+- [ ] `docs/PRD.md` defines local lifecycle semantics for `enabled`, persisted desired state, and
+      observed state, including stopped-state preservation through migration, apply, and reboot.
+- [ ] `docs/PRD.md` defines the generated-env/local-override boundary, explicitly denies arbitrary
+      command overrides in M1–M5, and requires key-name/hash-only quarantine diagnostics.
+- [ ] `docs/PRD.md` identifies the M1–M5 local-tmux scope and excludes remote reconciliation,
+      connector mutation, secret references, arbitrary commands/channels, gateway convergence, and
+      UI configuration storage.
+- [ ] `docs/TASKS.md` contains the complete M0–M5 one-card/one-PR dependency DAG for #758 with
+      agent tier, branch, dependency, estimate, and evidence expectations.
+- [ ] `docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md` classifies every current shipped
+      fleet example, profile, and service preset before M1 implementation starts.
 
 ## Required documentation IA for M1–M5
 
@@ -61,18 +72,15 @@ recorded in the M5 closure report and linked deferral evidence.
 
 ## Cross-cutting evidence gates
 
-- [x] Every retained or migrated YAML/JSON example, profile, and service preset validates through the same declared executable production parser/resolver path recorded by the disposition inventory; versioned v1 fixtures are not forced through the v2 compiler.
-- [x] Every retired example/profile/service preset has a replacement link and deprecation note; no unresolved legacy class or tool-policy alias remains silently shipped.
-- [x] Documentation examples contain no secret values, arbitrary command override, or product-hardcoded Tess/Ultron identity.
-- [x] CLI snippets distinguish local fleet desired-state commands from the separate gateway-backed mosaic agent catalog.
-- [x] Migration, quarantine, lifecycle, status, and troubleshooting documentation state that values of legacy sensitive keys are never printed.
-- [x] M5 documentation validation verifies required IA paths, local file and heading-fragment links, the canonical roster through the production compiler/resolver, and fenced/canonical-example safety checks.
-- [ ] FCM-M5-001 does not deterministically assert owner/evidence/deferral metadata for every checklist row. Closure and deferral reports provide human-reviewable evidence only; broader assertion coverage remains unclaimed.
-
-## Held downstream gates
-
-These unchecked items are intentionally outside FCM-M5-001 and are not authorized by this checklist:
-
-- [ ] FCM-M4-002 executes and evidences live cutover, canary, stopped-state preservation, and rollback.
-- [ ] FCM-M5-002 completes independent exact-head review and issues the validator certificate.
-- [ ] The exact PR head reaches terminal-green CI after independent review.
+- [ ] Every retained or migrated YAML/JSON example, profile, and service preset validates through the
+      same executable schema and shared baseline-plus-`roles.local` resolver used by the CLI.
+- [ ] Every retired example/profile/service preset has a replacement link and deprecation note; no
+      unresolved legacy class or tool-policy alias remains silently shipped.
+- [ ] Documentation examples contain no secret values, arbitrary command override, or product-hardcoded
+      Tess/Ultron identity.
+- [ ] CLI snippets distinguish local fleet desired-state commands from the separate gateway-backed
+      `mosaic agent` catalog.
+- [ ] Migration, quarantine, lifecycle, status, and troubleshooting documentation state that values of
+      legacy sensitive keys are never printed.
+- [ ] M5 release review verifies links, schema/example validation, and that all checklist rows have
+      owner/evidence or an explicit approved deferral.

docs/fleet/FLEET-LAUNCH.md

@@ -8,11 +8,11 @@ Generated environment files are rebuildable projections, not an operator-editabl
 | Layer               | Responsibility                                                                                                                  |
 | ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
 | Roster              | `fleet/roster.yaml` supplies the agent name, class, supported runtime, model, reasoning, tool policy, workdir, and tmux socket. |
-| Projection writer   | Renders deterministic fleet/agents/<name>.env.generated from the roster.                                                        |
-| Optional local data | Reads a strict, data-only fleet/agents/<name>.env.local; it cannot shadow generated keys.                                       |
-| systemd             | Starts the launcher with env -i and fixed bootstrap data. It does not preload either environment file.                          |
+| Projection writer   | Renders deterministic `fleet/agents/<name>.env.generated` from the roster.                                                      |
+| Optional local data | Reads a strict, data-only `fleet/agents/<name>.env.local`; it cannot shadow generated keys.                                     |
+| systemd             | Starts the launcher with `env -i` and fixed bootstrap data. It does not preload either environment file.                        |
 | session launcher    | Validates generated and local data before it queries, creates, or stops an exact tmux session.                                  |
-| runtime launch      | Derives the fixed mosaic yolo <runtime> argument array from validated roster data, then seeds the runtime contract.             |
+| runtime launch      | Derives the fixed `mosaic yolo <runtime>` argument array from validated roster data, then seeds the runtime contract.           |
 
 The launcher never `source`s or `eval`s an environment file and never accepts an environment-supplied
 command. `MOSAIC_AGENT_COMMAND`, command/channel overrides, unknown keys, generated-key shadowing,
@@ -20,7 +20,7 @@ secret-like key names, duplicate keys, comments, quoted/export syntax, and unsaf
 
 ## Generated and local files
 
-<name>.env.generated is complete, deterministic, and written only by Mosaic. Its ordered keys are:
+`<name>.env.generated` is complete, deterministic, and written only by Mosaic. Its ordered keys are:
 
 ```dotenv
 MOSAIC_AGENT_NAME=<roster name>
@@ -33,12 +33,12 @@ MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
 MOSAIC_TMUX_SOCKET=<roster socket or empty>
 ```
 
-The generated launch contract supports `claude`, `codex`, `opencode`, and `pi`. mosaic fleet add
+The generated launch contract supports `claude`, `codex`, `opencode`, and `pi`. `mosaic fleet add`
 rejects another runtime before it writes the roster or modifies generated, local, or quarantine state.
 The legacy dogfood stub remains an observability-only canary on its separate `mosaic-factory` socket;
 it has no generated-launch adapter and cannot be added through this path.
 
-<name>.env.local is optional and may contain only non-secret machine data:
+`<name>.env.local` is optional and may contain only non-secret machine data:
 
 - `MOSAIC_RUNTIME_BIN`
 - `MOSAIC_HEARTBEAT_RUN_DIR`
@@ -52,9 +52,9 @@ private, non-symlink paths. Violations fail closed before tmux interaction.
 
 ## Legacy input and diagnostics
 
-A legacy <name>.env is input only during projection generation. Roster-owned keys are regenerated;
+A legacy `<name>.env` is input only during projection generation. Roster-owned keys are regenerated;
 valid allowed local data can move to `.env.local`; invalid legacy input is privately retained at
-<name>.env.quarantine. Neither legacy nor quarantine files are launch authority.
+`<name>.env.quarantine`. Neither legacy nor quarantine files are launch authority.
 
 Diagnostics expose only rule code, key name, and a SHA-256 content hash. They do not reveal command
 text, credentials, or other values.
@@ -62,11 +62,11 @@ text, credentials, or other values.
 ## Launch and stop behavior
 
 The launcher obtains the agent's socket only from the validated generated projection. It creates or
-checks the exact =<agent-name> tmux target; it never uses an ambient socket or fuzzy session match.
+checks the exact `=<agent-name>` tmux target; it never uses an ambient socket or fuzzy session match.
 The same strict parser runs before exact-stop behavior. A fresh native Pi heartbeat remains authoritative;
 the shell sidecar only provides fallback state when the native marker is stale or absent.
 
-mosaic agent comms-block <exact-member> can inspect that exact roster member's resolved Fleet-Comms
+`mosaic agent comms-block <exact-member>` can inspect that exact roster member's resolved Fleet-Comms
 block. It is a read-only inspection tool and fails loudly for an unknown exact member or missing roster.
 On Linux, the installed roster, TOOLS contract, and executable helper are opened through a held
 descriptor chain rooted at `/`; every managed path component uses no-follow traversal, and content plus

docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md

@@ -14,7 +14,7 @@ parallel resolver. The current executable implementation and per-artifact outcom
 
 | Shipped file                                         | Current class evidence                                              | M0 disposition decision                                                                              | Required M1/M4 evidence                                              |
 | ---------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
-| `framework/fleet/examples/coding.yaml`               | `orchestrator`, `enhancer`, `implementer`, `reviewer`               | Migrate: implementer → code, reviewer → review; retain orchestration/enhancer intent                 | v2 fixture validates; role aliases and authority matrix tested       |
+| `framework/fleet/examples/coding.yaml`               | `orchestrator`, `enhancer`, `implementer`, `reviewer`               | Migrate: `implementer → code`, `reviewer → review`; retain orchestration/enhancer intent             | v2 fixture validates; role aliases and authority matrix tested       |
 | `framework/fleet/examples/general.yaml`              | `orchestrator`, `enhancer`, `worker`                                | Migrate only after operator chooses a concrete canonical role for `worker`; no implicit conversion   | Explicit replacement class, or versioned v1 fixture/retirement note  |
 | `framework/fleet/examples/hybrid.yaml`               | `orchestrator`, `enhancer`, `implementer`, `researcher`, `reviewer` | Migrate aliases; resolve `researcher` through existing role resolver or retain/version               | Shared resolver validation; no ad-hoc class scanner                  |
 | `framework/fleet/examples/local-canary.yaml`         | `orchestrator`, `implementer`, `reviewer`                           | Migrate aliases; preserve its local-tmux canary purpose                                              | v2 fixture validates and preserves safe stopped/running behavior     |
@@ -34,14 +34,14 @@ parallel resolver. The current executable implementation and per-artifact outcom
 
 ## Service presets
 
-| Shipped file                                         | Current policy evidence                                                                                                                                       | M0 disposition decision                                                                                                                                                                                                            | Required M1/M4 evidence                                                                                                                                                               |
-| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `framework/fleet/services/operator-interaction.yaml` | Generic policy only: runtime: pi, model: openai/gpt-5.6-sol, reasoning: high, tool_policy: operator-interaction; provisioning supplies the agent name as data | Retain as a generic service policy, not a Tess identity. Migrate tool_policy: operator-interaction only through the approved interaction tool-policy alias/semantic resolver; do not infer a class or machine name from this file. | Service-policy fixture validates runtime/model/reasoning and alias behavior; generic provisioning proves a configured interaction instance is supplied without a hardcoded Tess name. |
+| Shipped file                                         | Current policy evidence                                                                                                                                               | M0 disposition decision                                                                                                                                                                                                              | Required M1/M4 evidence                                                                                                                                                               |
+| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `framework/fleet/services/operator-interaction.yaml` | Generic policy only: `runtime: pi`, `model: openai/gpt-5.6-sol`, `reasoning: high`, `tool_policy: operator-interaction`; provisioning supplies the agent name as data | Retain as a generic service policy, not a Tess identity. Migrate `tool_policy: operator-interaction` only through the approved interaction tool-policy alias/semantic resolver; do not infer a class or machine name from this file. | Service-policy fixture validates runtime/model/reasoning and alias behavior; generic provisioning proves a configured interaction instance is supplied without a hardcoded Tess name. |
 
 ## Required disposition controls
 
-1. **No silent aliasing:** only implementer → code, reviewer → review, and
-   operator-interaction → interaction are approved deterministic aliases in this M0 baseline.
+1. **No silent aliasing:** only `implementer → code`, `reviewer → review`, and
+   `operator-interaction → interaction` are approved deterministic aliases in this M0 baseline.
    `worker`, `analyst`, `canary`, and domain-specific classes require resolver evidence or an
    explicit version/retirement decision.
 2. **No identity hardcoding:** Tess and Ultron are optional instance/display names. An example/profile

docs/fleet/NORTH_STAR.md

@@ -33,7 +33,7 @@ The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's
 - **AC-NS-4** — TTL is enforced on claims; token caps remain advisory until a real meter exists.
 - **AC-NS-5** — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
 - **AC-NS-6** — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
-- **AC-NS-7** — A user-customized persona (edited or added via the orchestrator) survives mosaic update: baseline reseed never clobbers user overrides.
+- **AC-NS-7** — A user-customized persona (edited or added via the orchestrator) survives `mosaic update`: baseline reseed never clobbers user overrides.
 
 ## Workstreams
 

docs/fleet/NORTH_STAR.yaml

@@ -97,7 +97,7 @@ success_criteria:
   - id: AC-NS-7
     text: >-
       A user-customized persona (edited or added via the orchestrator) survives
-      mosaic update: baseline reseed never clobbers user overrides.
+      `mosaic update`: baseline reseed never clobbers user overrides.
 
 workstreams:
   - id: A

docs/fleet/PRD-fleet-suite.md

@@ -8,7 +8,7 @@
 ## Mission
 
 Turn the proven fleet primitives into a **user-installable, AI-free-configurable fleet product**:
-a user runs mosaic fleet init, answers a few questions (general / coding / research / hybrid),
+a user runs `mosaic fleet init`, answers a few questions (general / coding / research / hybrid),
 gets a recommended set of agents plus one always-on orchestrator wired for chat-ops, and can
 operate, mutate, re-create, and observe the fleet — over tmux today and Matrix tomorrow — from
 CLI/TUI and (designed-for) the webUI.
@@ -21,25 +21,25 @@ functional, we use the fleet itself to continue the work.
 
 ### A. Configure-without-AI CLI
 
-| ID  | Requirement                                                                                                 |
-| --- | ----------------------------------------------------------------------------------------------------------- |
-| R1  | mosaic fleet command set is functional end-to-end (init/install/start/stop/status/ps/verify + agent verbs). |
-| R2  | mosaic fleet init is an interactive, **AI-free** CLI wizard.                                                |
-| R3  | Init asks the **configuration type**: `general`, `coding`, `research`, `hybrid`, … (extensible).            |
-| R4  | Based on the answer, the fleet is populated with a **recommended set of agents** (a preset).                |
-| R5  | **Exactly one main orchestrator agent** is always configured, regardless of type.                           |
-| R10 | A set of **recommended configurations (presets)** ships for easy duplication.                               |
-| R8  | User can **re-create** the fleet when config needs change (idempotent re-init / reconfigure).               |
-| R17 | Fleet controls are **simple and intuitive**.                                                                |
+| ID  | Requirement                                                                                                   |
+| --- | ------------------------------------------------------------------------------------------------------------- |
+| R1  | `mosaic fleet` command set is functional end-to-end (init/install/start/stop/status/ps/verify + agent verbs). |
+| R2  | `mosaic fleet init` is an interactive, **AI-free** CLI wizard.                                                |
+| R3  | Init asks the **configuration type**: `general`, `coding`, `research`, `hybrid`, … (extensible).              |
+| R4  | Based on the answer, the fleet is populated with a **recommended set of agents** (a preset).                  |
+| R5  | **Exactly one main orchestrator agent** is always configured, regardless of type.                             |
+| R10 | A set of **recommended configurations (presets)** ships for easy duplication.                                 |
+| R8  | User can **re-create** the fleet when config needs change (idempotent re-init / reconfigure).                 |
+| R17 | Fleet controls are **simple and intuitive**.                                                                  |
 
 ### B. Comms & orchestrator chat-ops
 
-| ID  | Requirement                                                                                                                   |
-| --- | ----------------------------------------------------------------------------------------------------------------------------- |
-| R6  | Init can wire the orchestrator to a chat connector — **Telegram / Discord / Matrix / Slack** — for command + comms.           |
-| R7  | Designed with the end-goal of **Matrix comms on a locally-controlled server**.                                                |
-| R16 | Fleet supports **tmux AND Matrix** comms, **user-configurable** at init or any time. Not all users want Matrix.               |
-| R19 | **"Mos" orchestrator on Discord** (chan 1517622518662434996 / srv 1112631390438166618) on `w-jarvis` — the first live target. |
+| ID  | Requirement                                                                                                                       |
+| --- | --------------------------------------------------------------------------------------------------------------------------------- |
+| R6  | Init can wire the orchestrator to a chat connector — **Telegram / Discord / Matrix / Slack** — for command + comms.               |
+| R7  | Designed with the end-goal of **Matrix comms on a locally-controlled server**.                                                    |
+| R16 | Fleet supports **tmux AND Matrix** comms, **user-configurable** at init or any time. Not all users want Matrix.                   |
+| R19 | **"Mos" orchestrator on Discord** (`chan 1517622518662434996` / `srv 1112631390438166618`) on `w-jarvis` — the first live target. |
 
 ### C. Runtime, health, lifecycle
 
@@ -64,46 +64,46 @@ functional, we use the fleet itself to continue the work.
 - **Orchestrator agent:** always present; carries the chat connector config (connector type + target IDs) so it can be commanded over chat. tmux is the substrate; the connector bridges chat ↔ the orchestrator session.
 - **Comms layers (R16):** (1) **tmux** inter-agent (`agent-send`, proven) — default, always available. (2) **chat connector** for human↔orchestrator (Discord now; Matrix the strategic target). (3) **Matrix** as the locally-controlled cross-agent bus (future). Connector is pluggable + reconfigurable.
 - **Heartbeat (R15):** runtime-agnostic launcher sidecar already covers pi/claude/codex (#584). Refine per-runtime (native HB) with the **custom Pi harness** (R14) + a Claude path.
-- **Updates (R13):** mosaic update (CLI) + a fleet-aware harness-update step that refreshes pi/claude/codex and re-launches agents safely (drain → update → relaunch via the durable launcher).
-- **webUI (R18):** the fleet exposes machine-readable state (fleet ps --json already carries tenant/host/heartbeat/managed) + control verbs (start/stop/watch/send); webUI consumes these (control plane rides federation per north star). Ensure a stable JSON contract + a terminate/attach(butt-in) path.
+- **Updates (R13):** `mosaic update` (CLI) + a fleet-aware harness-update step that refreshes pi/claude/codex and re-launches agents safely (drain → update → relaunch via the durable launcher).
+- **webUI (R18):** the fleet exposes machine-readable state (`fleet ps --json` already carries tenant/host/heartbeat/managed) + control verbs (start/stop/watch/send); webUI consumes these (control plane rides federation per north star). Ensure a stable JSON contract + a terminate/attach(butt-in) path.
 
 ## Phases (incremental, each shippable)
 
-| Phase                             | Deliverable                                                                                                                       | Notes                                 |
-| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
-| **F1 Presets + init wizard**      | preset rosters (general/coding/research/hybrid) + always-orchestrator + AI-free fleet init selecting a preset; re-init idempotent | R1–R5, R8, R10, R17                   |
-| **F2 Connector + Mos-on-Discord** | orchestrator chat-connector config (Discord first) + **Mos live on Discord 1517…/1112…** on w-jarvis                              | R6, R19, partial R16                  |
-| **F3 Heartbeat + harness**        | HB confirmed for claude + pi/gpt; **custom Pi harness** (tool usage, native HB, model self-report); graceful harness updates      | R13, R14, R15                         |
-| **F4 Matrix + comms toggle**      | Matrix connector (local server) + user toggle tmux/Matrix at init/anytime                                                         | R7, R16                               |
-| **F5 Orchestrator-mutable fleet** | orchestrator can add/remove agents at runtime                                                                                     | R9                                    |
-| **F6 webUI hooks**                | stable JSON contract + terminate/attach surface for webUI view/monitor/terminate/butt-in                                          | R18                                   |
-| **F7 Test + docs**                | install+test on w-jarvis AND dragon-lin; user docs (install/configure/use)                                                        | R11, R12 (runs alongside every phase) |
+| Phase                             | Deliverable                                                                                                                         | Notes                                 |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
+| **F1 Presets + init wizard**      | preset rosters (general/coding/research/hybrid) + always-orchestrator + AI-free `fleet init` selecting a preset; re-init idempotent | R1–R5, R8, R10, R17                   |
+| **F2 Connector + Mos-on-Discord** | orchestrator chat-connector config (Discord first) + **Mos live on Discord `1517…`/`1112…`** on w-jarvis                            | R6, R19, partial R16                  |
+| **F3 Heartbeat + harness**        | HB confirmed for claude + pi/gpt; **custom Pi harness** (tool usage, native HB, model self-report); graceful harness updates        | R13, R14, R15                         |
+| **F4 Matrix + comms toggle**      | Matrix connector (local server) + user toggle tmux/Matrix at init/anytime                                                           | R7, R16                               |
+| **F5 Orchestrator-mutable fleet** | orchestrator can add/remove agents at runtime                                                                                       | R9                                    |
+| **F6 webUI hooks**                | stable JSON contract + terminate/attach surface for webUI view/monitor/terminate/butt-in                                            | R18                                   |
+| **F7 Test + docs**                | install+test on w-jarvis AND dragon-lin; user docs (install/configure/use)                                                          | R11, R12 (runs alongside every phase) |
 
 ## Work division (proposed — confirm with dragon-lin)
 
 - **Jarvis @ w-jarvis (Lead):** F1 presets+wizard, F2 connector+Mos-on-Discord, F5 mutability, F6 webUI hooks; merge authority + dual-engine reviews; co-testing on w-jarvis.
-- **coder @ dragon-lin:** F3 custom Pi harness + harness-update flow (pi/codex-savvy); plus its in-flight constitution P4–P6 (P4 installer rework underpins fleet init/updates — coordinate the install path). Co-testing on dragon-lin (R11).
+- **coder @ dragon-lin:** F3 custom Pi harness + harness-update flow (pi/codex-savvy); plus its in-flight constitution P4–P6 (P4 installer rework underpins `fleet init`/updates — coordinate the install path). Co-testing on dragon-lin (R11).
 - **Shared:** F4 Matrix (whoever has bandwidth); F7 testing/docs continuous.
 
 ## Immediate target: Mos on Discord (F2 first slice)
 
-The discord plugin is available (~/.claude.json). Path: configure the **orchestrator** as a durable
+The discord plugin is available (`~/.claude.json`). Path: configure the **orchestrator** as a durable
 fleet session running Claude Code with the discord plugin bridged to channel `1517622518662434996`
 (server `1112631390438166618`) on w-jarvis, with the existing Discord Bridge Protocol (ack within
 ~3s, reply via `mcp__discord__reply`, no `AskUserQuestion`). Heartbeat via the launcher sidecar.
 
 ## Success criteria
 
-- A non-AI user can mosaic fleet init, pick a type, and get a working fleet + orchestrator.
-- **Mos answers in Discord 1517…** on w-jarvis.
-- Fleet runs + is observable (fleet ps) on **both** w-jarvis and dragon-lin.
+- A non-AI user can `mosaic fleet init`, pick a type, and get a working fleet + orchestrator.
+- **Mos answers in Discord `1517…`** on w-jarvis.
+- Fleet runs + is observable (`fleet ps`) on **both** w-jarvis and dragon-lin.
 - Harness updates handled gracefully; HB healthy for claude + pi/gpt agents.
 - Docs let a new operator install/configure/use the fleet.
 - Re-init + orchestrator mutation work.
 
 ## Assumptions (veto-able)
 
-- `ASSUMPTION:` presets ship as example rosters under the framework (fleet/examples/\*.yaml), selected by `init`.
+- `ASSUMPTION:` presets ship as example rosters under the framework (`fleet/examples/*.yaml`), selected by `init`.
 - `ASSUMPTION:` chat connectors are pluggable; Discord first (target exists), Matrix is the strategic default later.
 - `ASSUMPTION:` "Mos" = a Claude Code orchestrator session with the discord plugin (reuses the documented Discord Bridge Protocol).
 - `ASSUMPTION:` per north star, runtimes default to Codex/pi-on-Codex for workers; the orchestrator "Mos" runs Claude Code (in Claude Code, which is allowed).

docs/fleet/PRD.md

@@ -10,8 +10,8 @@
 The durable tmux fleet runs on the isolated `mosaic-fleet` socket. That isolation
 (which protects the operator's default tmux) makes the fleet **invisible** to default
 tooling, and truth is split across three planes no single command joins — systemd
-(systemctl --user), tmux (-L mosaic-fleet), and the process tree (`pstree`).
-agent tail (`capture-pane`) returns **blank for full-screen TUIs**, and agent send
+(`systemctl --user`), tmux (`-L mosaic-fleet`), and the process tree (`pstree`).
+`agent tail` (`capture-pane`) returns **blank for full-screen TUIs**, and `agent send`
 confirms only keystroke injection, not acceptance. Net: the operator has near-zero
 observability and no safe way to watch a session.
 
@@ -32,22 +32,22 @@ observability and no safe way to watch a session.
 
 ## Functional requirements
 
-| ID   | Requirement                                                                                                                                                                                                                                                                                                  |
-| ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| FR-1 | mosaic fleet ps [--json] prints one row per roster agent joining: name · tenant · host · runtime · systemd(active/enabled) · pane(alive/dead) · pid · idle · **last-heartbeat age** · **drift** flag (roster runtime ≠ actual pane command) · **boot-enable** warning (active but `UnitFileState=disabled`). |
-| FR-2 | **Heartbeat protocol v1** (see below); `dogfood-agent.py` implements the responder. fleet ps issues probes (or reads last-seen) and reports health per FR-1.                                                                                                                                                 |
-| FR-3 | mosaic agent watch <name> opens a **read-only** view of the pane (grouped session or tmux attach -r) that cannot send keystrokes and does not shrink the agent's window.                                                                                                                                     |
-| FR-4 | mosaic agent attach <name> remains the **explicit** interactive-takeover path (separate verb, documented as the only one that can type).                                                                                                                                                                     |
-| FR-5 | mosaic agent send <name> --verify confirms the message was **accepted** (not left as an unsubmitted draft) and returns non-zero if delivery cannot be verified.                                                                                                                                              |
-| FR-6 | All structured output (`--json`) includes `tenant_id` and `host` fields.                                                                                                                                                                                                                                     |
+| ID   | Requirement                                                                                                                                                                                                                                                                                                    |
+| ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| FR-1 | `mosaic fleet ps [--json]` prints one row per roster agent joining: name · tenant · host · runtime · systemd(active/enabled) · pane(alive/dead) · pid · idle · **last-heartbeat age** · **drift** flag (roster runtime ≠ actual pane command) · **boot-enable** warning (active but `UnitFileState=disabled`). |
+| FR-2 | **Heartbeat protocol v1** (see below); `dogfood-agent.py` implements the responder. `fleet ps` issues probes (or reads last-seen) and reports health per FR-1.                                                                                                                                                 |
+| FR-3 | `mosaic agent watch <name>` opens a **read-only** view of the pane (grouped session or `tmux attach -r`) that cannot send keystrokes and does not shrink the agent's window.                                                                                                                                   |
+| FR-4 | `mosaic agent attach <name>` remains the **explicit** interactive-takeover path (separate verb, documented as the only one that can type).                                                                                                                                                                     |
+| FR-5 | `mosaic agent send <name> --verify` confirms the message was **accepted** (not left as an unsubmitted draft) and returns non-zero if delivery cannot be verified.                                                                                                                                              |
+| FR-6 | All structured output (`--json`) includes `tenant_id` and `host` fields.                                                                                                                                                                                                                                       |
 
 ## Heartbeat protocol v1
 
-- **Probe:** operator/fleet ps writes a sentinel line to the agent's input or a
-  well-known per-agent heartbeat file path ~/.config/mosaic/fleet/run/<agent>.hb.
-- **Response:** the runtime updates <agent>.hb with ts=<iso8601> pid=<pid> status=<ok|busy>
+- **Probe:** operator/`fleet ps` writes a sentinel line to the agent's input or a
+  well-known per-agent heartbeat file path `~/.config/mosaic/fleet/run/<agent>.hb`.
+- **Response:** the runtime updates `<agent>.hb` with `ts=<iso8601> pid=<pid> status=<ok|busy>`
   on a fixed interval (default 15s) and on demand when probed.
-- **Health rule:** `healthy` if now - ts <= 3 × interval; else `stale`; missing file = `unknown`.
+- **Health rule:** `healthy` if `now - ts <= 3 × interval`; else `stale`; missing file = `unknown`.
 - **Contract:** every runtime (dogfood stub now; claude/codex/pi/opencode in Phase 3)
   MUST emit the heartbeat. The protocol is file-based so it works for headless stubs and
   full-screen TUIs alike (no `capture-pane` dependency).
@@ -56,15 +56,15 @@ observability and no safe way to watch a session.
 
 ## Acceptance criteria
 
-- mosaic fleet ps shows all 5 live sessions on `mosaic-fleet` with correct
+- `mosaic fleet ps` shows all 5 live sessions on `mosaic-fleet` with correct
   pane/pid/idle and flags the dogfood **drift** (`canary-pi` runtime=pi but pane runs
   `dogfood-agent.py`) and the **boot-enable** gap (active but disabled).
 - Killing one agent's pane flips its row to dead/stale within one `interval`.
-- agent watch shows live output and provably cannot type into the pane; detaching
+- `agent watch` shows live output and provably cannot type into the pane; detaching
   leaves the agent's window size unchanged.
-- agent send --verify returns success on an accepting pane and non-zero on a wedged/draft pane.
-- Quality gates green: pnpm typecheck, pnpm lint, pnpm format:check, plus
-  pnpm --filter @mosaicstack/mosaic test.
+- `agent send --verify` returns success on an accepting pane and non-zero on a wedged/draft pane.
+- Quality gates green: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, plus
+  `pnpm --filter @mosaicstack/mosaic test`.
 - Independent review passed; dogfood evidence captured against the live fleet.
 
 ## Test plan
@@ -72,18 +72,18 @@ observability and no safe way to watch a session.
 - Unit/CLI specs in `packages/mosaic/src/commands/fleet.spec.ts` (and a new
   `fleet-ps`/`watch`/`send-verify` spec) using the injected `CommandRunner` to assert
   exact tmux/systemd command construction and JSON shape (tenant+host present).
-- Situational: run against the live `mosaic-fleet` fleet; capture fleet ps output,
-  a kill-and-detect cycle, a read-only `watch`, and a send --verify pass/fail pair.
+- Situational: run against the live `mosaic-fleet` fleet; capture `fleet ps` output,
+  a kill-and-detect cycle, a read-only `watch`, and a `send --verify` pass/fail pair.
 
 ## Known limitations
 
-- **Verify heuristic is best-effort:** agent send --verify uses a > -prefix draft
+- **Verify heuristic is best-effort:** `agent send --verify` uses a `>` -prefix draft
   heuristic that is specific to pi/claude TUIs. Draft detection for codex and opencode
   TUIs is best-effort only; those runtimes may not use the same input-line indicator.
 - **Pane-change check is the best Phase-2 signal; verify now polls up to a bounded
-  timeout:** agent send --verify captures a BEFORE snapshot, sends the message, then
+  timeout:** `agent send --verify` captures a BEFORE snapshot, sends the message, then
   polls `capture-pane` every ~400 ms up to a configurable total timeout (default ~6 s,
-  controlled by --verify-timeout <ms>). On each poll it runs classifySendResult: if
+  controlled by `--verify-timeout <ms>`). On each poll it runs classifySendResult: if
   the pane shows 'accepted' or 'draft' the loop exits immediately; while the result is
   'unverifiable' (no pane change yet) it keeps polling. After the timeout with no
   definitive result, it fails closed: exit 1 with "no pane change after send". This
@@ -92,15 +92,15 @@ observability and no safe way to watch a session.
   requires a runtime acknowledgement (Phase-3 heartbeat-ack); the bounded pane-change
   poll is the best signal available against an opaque TUI for Phase-2.
 - **Blank AFTER capture fails closed:** Full-screen TUIs (claude, codex, opencode, pi)
-  render blank for tmux capture-pane. When the AFTER snapshot is empty, send --verify
+  render blank for `tmux capture-pane`. When the AFTER snapshot is empty, `send --verify`
   returns non-zero with an "unverifiable" message rather than silently succeeding. This
   is an intentional fail-closed design (FR-5).
-- **agent watch uses a grouped viewer session:** tmux attach -r directly against the
-  agent session lets the viewer terminal shrink the agent's window. agent watch instead
-  creates a throwaway grouped session (tmux new-session -d -t '=<agent>' -s
-  '<agent>-watch-<pid>'), attaches read-only to that session, and kills it on detach.
+- **`agent watch` uses a grouped viewer session:** `tmux attach -r` directly against the
+  agent session lets the viewer terminal shrink the agent's window. `agent watch` instead
+  creates a throwaway grouped session (`tmux new-session -d -t '=<agent>' -s
+'<agent>-watch-<pid>'`), attaches read-only to that session, and kills it on detach.
   The grouped session shares the agent's windows but has independent sizing, so the
-  agent's window is never affected. tmux attach is still interactive and requires
+  agent's window is never affected. `tmux attach` is still interactive and requires
   inherited stdio; the `interactiveRunner` handles TTY passthrough.
 
 ## Surfaces & parity (MVP-X1)

docs/fleet/README.md

@@ -1,63 +0,0 @@
-# Fleet Configuration Management
-
-This book documents the local roster-v2 desired-state control plane delivered under issue #758. The normative requirements are the [FCM section of the repository PRD](../PRD.md#fleet-declarative-configuration-management-workstream-fcm-758), not the older fleet-suite or observability planning pages.
-
-## Authority boundary
-
-<MOSAIC_HOME>/fleet/roster.yaml is the sole writable desired-state authority for local fleet membership, launch policy, and persisted lifecycle. Generated environment files, systemd enablement, tmux sessions, heartbeat files, and status output are derived or observed. Rebuild projections from the roster; never edit them as desired state.
-
-This control plane is local tmux/systemd only. Remote/SSH entries and connectors are inventory, not reconciliation targets. Arbitrary commands, channels, secret references, gateway catalog convergence, and UI configuration storage are outside this workstream. `mos-comms` is temporary transport glue, not permanent fleet architecture.
-
-## Choose the right workflow
-
-1. **Need to inspect intent?** Read the roster and use mosaic fleet get; see [desired versus observed state](concepts/desired-vs-observed-state.md).
-2. **Need to inspect reality?** Use `status` or `doctor`; use `verify` for a strict non-zero drift/ownership gate. These commands do not repair anything.
-3. **Need to change membership or persisted policy?** Use generation-guarded `plan`, `create`, `update`, or `delete`; see [safe CRUD](how-to/create-update-delete-agent.md).
-4. **Need a one-time runtime action?** Use `start`, `stop`, or `restart`. These do not change persisted desired state.
-5. **Need convergence?** Review apply --dry-run, resolve blockers, then use `apply` with the same current generation; see [reconcile and recover](operations/reconcile-and-recover.md).
-6. **Need v1 migration evidence?** Use preview only. Cutover, canary, and rollback remain held for FCM-M4-002.
-7. **Need the gateway-backed agent catalog?** That is the separate mosaic agent surface, not local fleet desired state.
-
-## Concepts
-
-- [Desired versus observed state](concepts/desired-vs-observed-state.md)
-- [Identity, class, runtime, provider, and model](concepts/identity-class-runtime.md)
-- [Role authority and leases](concepts/role-authority-and-leases.md)
-- [Generated environment launch chain](concepts/generated-env-launch-chain.md)
-
-## Operator how-to
-
-- [Create, inspect, update, and delete](how-to/create-update-delete-agent.md)
-- [Start, stop, restart, and reconcile](how-to/start-stop-restart.md)
-- [Configure an interaction instance](how-to/configure-tess-interaction.md)
-- [Configure a validator instance](how-to/configure-ultron-validator.md)
-- [Customize roles](how-to/customize-roles.md)
-
-## Operations and recovery
-
-- [Reconcile and recover](operations/reconcile-and-recover.md)
-- [Environment quarantine](operations/env-quarantine.md)
-- [Systemd/tmux troubleshooting](operations/systemd-tmux-troubleshooting.md)
-- [Backup and restore boundary](operations/backup-restore.md)
-- [Upgrade and asset-drift hold](operations/upgrade-assets.md)
-
-## Reference and migration
-
-- [Roster v2 fields](reference/roster-v2-fields.md) · [executable JSON Schema](reference/roster-v2.schema.json) · [validated example](examples/roster-v2.yaml)
-- [CLI and exit codes](reference/cli.md)
-- [Role classes](reference/role-classes.md)
-- [Lifecycle transitions](reference/lifecycle-transitions.md)
-- [Status and drift](reference/status-and-drift.md)
-- [Generated environment boundary](reference/generated-env-boundary.md)
-- [v1-to-v2 preview](migration/v1-to-v2.md)
-- [Example/profile dispositions](migration/example-profile-disposition.md)
-- [Legacy class aliases](migration/legacy-class-aliases.md)
-
-## Acceptance evidence and holds
-
-- [M0/M5 IA checklist](FLEET-CONFIG-DOCS-IA-CHECKLIST.md)
-- [Legacy example/profile inventory](LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md)
-- [M5 closure evidence](../reports/documentation/758-fleet-config-ia-closure.md)
-- [Approved-existing deferrals and live-action holds](../reports/deferred/758-fleet-config-deferrals.md)
-
-The canonical publishing source remains this repository. This card does not publish externally, run a migration, operate a live fleet, or close parent issue #758.

docs/fleet/TASKS.md

@@ -7,21 +7,21 @@
 > Mission: `mvp-20260312` · PRD: [docs/fleet/PRD.md](./PRD.md) · North star: [docs/fleet/north-star.md](./north-star.md)
 > Status: `not-started` | `in-progress` | `done` | `blocked` | `failed`
 
-| id            | status      | description                                                                                                      | depends_on            | agent       | pr  | notes                                                                                                                       |
-| ------------- | ----------- | ---------------------------------------------------------------------------------------------------------------- | --------------------- | ----------- | --- | --------------------------------------------------------------------------------------------------------------------------- |
-| FLEET-OBS-000 | done        | Plan: north-star + Phase-2 PRD + workstream scaffolding                                                          | —                     | lead        | —   | persisted 2026-06-20 on `feat/fleet-observability`                                                                          |
-| FLEET-OBS-001 | done        | Heartbeat protocol v1 spec finalized in PRD + framework doc                                                      | FLEET-OBS-000         | lead        | —   | file-based ~/.config/mosaic/fleet/run/<agent>.hb; spec in PRD                                                               |
-| FLEET-OBS-002 | in-progress | Implement heartbeat responder in `dogfood-agent.py`                                                              | FLEET-OBS-001         | fleet-coder | —   | dispatched to ad-hoc mosaic yolo fleet agent (dogfood)                                                                      |
-| FLEET-OBS-003 | done        | mosaic fleet ps — join systemd+tmux+proc+idle+heartbeat; tenant+host tagged; drift + boot-enable flags; `--json` | FLEET-OBS-001         | worker      | —   | commit ab47831; LIVE-verified on mosaic-fleet; caught canary-pi DRIFT + BOOT-ENABLE. Polish: idleSeconds parse returns null |
-| FLEET-OBS-004 | done        | mosaic agent watch <name> — read-only join (no resize, no keystrokes)                                            | FLEET-OBS-000         | worker      | —   | attach -r; verb wired                                                                                                       |
-| FLEET-OBS-005 | done        | mosaic agent send --verify — delivery/acceptance receipt                                                         | FLEET-OBS-000         | worker      | —   | --verify flag; draft-heuristic verify                                                                                       |
-| FLEET-OBS-006 | done        | CLI specs for ps/watch/send-verify (tenant+host shape, command construction)                                     | FLEET-OBS-003,004,005 | worker      | —   | 62 tests green (31 new); re-verified by lead                                                                                |
-| FLEET-OBS-007 | not-started | Framework doc: fleet observability guide + verbs                                                                 | FLEET-OBS-003,004,005 | lead        | —   | `docs/guides/` or `framework/tools/.../README`                                                                              |
-| FLEET-OBS-008 | not-started | Independent review + dogfood verification on live fleet                                                          | FLEET-OBS-002..007    | reviewer    | —   | author ≠ reviewer; capture evidence in scratchpad                                                                           |
-| FLEET-OBS-009 | not-started | Open PR → green CI (queue guard) → squash-merge → close `fleet-observability-1`                                  | FLEET-OBS-008         | lead        | —   | trunk merge; no direct push to main                                                                                         |
+| id            | status      | description                                                                                                        | depends_on            | agent       | pr  | notes                                                                                                                       |
+| ------------- | ----------- | ------------------------------------------------------------------------------------------------------------------ | --------------------- | ----------- | --- | --------------------------------------------------------------------------------------------------------------------------- |
+| FLEET-OBS-000 | done        | Plan: north-star + Phase-2 PRD + workstream scaffolding                                                            | —                     | lead        | —   | persisted 2026-06-20 on `feat/fleet-observability`                                                                          |
+| FLEET-OBS-001 | done        | Heartbeat protocol v1 spec finalized in PRD + framework doc                                                        | FLEET-OBS-000         | lead        | —   | file-based `~/.config/mosaic/fleet/run/<agent>.hb`; spec in PRD                                                             |
+| FLEET-OBS-002 | in-progress | Implement heartbeat responder in `dogfood-agent.py`                                                                | FLEET-OBS-001         | fleet-coder | —   | dispatched to ad-hoc `mosaic yolo` fleet agent (dogfood)                                                                    |
+| FLEET-OBS-003 | done        | `mosaic fleet ps` — join systemd+tmux+proc+idle+heartbeat; tenant+host tagged; drift + boot-enable flags; `--json` | FLEET-OBS-001         | worker      | —   | commit ab47831; LIVE-verified on mosaic-fleet; caught canary-pi DRIFT + BOOT-ENABLE. Polish: idleSeconds parse returns null |
+| FLEET-OBS-004 | done        | `mosaic agent watch <name>` — read-only join (no resize, no keystrokes)                                            | FLEET-OBS-000         | worker      | —   | `attach -r`; verb wired                                                                                                     |
+| FLEET-OBS-005 | done        | `mosaic agent send --verify` — delivery/acceptance receipt                                                         | FLEET-OBS-000         | worker      | —   | --verify flag; draft-heuristic verify                                                                                       |
+| FLEET-OBS-006 | done        | CLI specs for ps/watch/send-verify (tenant+host shape, command construction)                                       | FLEET-OBS-003,004,005 | worker      | —   | 62 tests green (31 new); re-verified by lead                                                                                |
+| FLEET-OBS-007 | not-started | Framework doc: fleet observability guide + verbs                                                                   | FLEET-OBS-003,004,005 | lead        | —   | `docs/guides/` or `framework/tools/.../README`                                                                              |
+| FLEET-OBS-008 | not-started | Independent review + dogfood verification on live fleet                                                            | FLEET-OBS-002..007    | reviewer    | —   | author ≠ reviewer; capture evidence in scratchpad                                                                           |
+| FLEET-OBS-009 | not-started | Open PR → green CI (queue guard) → squash-merge → close `fleet-observability-1`                                    | FLEET-OBS-008         | lead        | —   | trunk merge; no direct push to main                                                                                         |
 
 ## Proposed MVP rollup row (for the MVP orchestrator — not written by this workstream)
 
-```text-table
+```
 | W-FLEET | in-progress | Fleet (agent-session execution layer) | Phase 2/5 | docs/fleet/TASKS.md | observability dogfooded on live stub fleet; control plane rides federation (W1) |
 ```

docs/fleet/backlog-conventions.md

@@ -2,10 +2,10 @@
 
 The **backlog** is Mosaic's native backlog-of-record for fleet work. It is built
 end-to-end on Mosaic's own storage layer (`@mosaicstack/db`, drizzle/Postgres)
-and surfaced as mosaic fleet backlog <sub> --json.
+and surfaced as `mosaic fleet backlog <sub> --json`.
 
 > **Mosaic-native, no Hermes.** This backlog REPLACES the former Hermes adapter.
-> There is **no** runtime dependency on Hermes, hermes kanban, or ~/.hermes
+> There is **no** runtime dependency on Hermes, `hermes kanban`, or `~/.hermes`
 > anywhere in this feature. Anything previously delegated to Hermes is recreated
 > here on Mosaic's own Postgres storage layer.
 
@@ -18,7 +18,7 @@ engine (no sqlite, no raw client).
 | ---------------------------------- | -------------------- | ---------------------------------------------------------------- |
 | `DATABASE_URL` injected at runtime | Full server Postgres | the verified runtime database; it never authorizes migration/DDL |
 | `PGLITE_DATA_DIR` set (no URL)     | Embedded PGlite      | that directory                                                   |
-| neither (default)                  | Embedded PGlite      | ~/.config/mosaic/fleet/backlog                                   |
+| neither (default)                  | Embedded PGlite      | `~/.config/mosaic/fleet/backlog`                                 |
 
 PGlite is real Postgres semantics in-process — including the row locks the atomic
 claim relies on — so the **same code** runs on a laptop (embedded, single-host
@@ -28,9 +28,9 @@ For embedded PGlite only, the local backlog routine may prepare its local schema
 
 ### Update safety
 
-The embedded PGlite store lives under ~/.config/mosaic/fleet/backlog, which is
+The embedded PGlite store lives under `~/.config/mosaic/fleet/backlog`, which is
 listed in `PRESERVE_PATHS` in `packages/mosaic/framework/install.sh`. This means
-mosaic update (which runs the framework sync with rsync --delete) will **not**
+`mosaic update` (which runs the framework sync with `rsync --delete`) will **not**
 wipe the operator's backlog — same protection as the roster, per-agent env, and
 heartbeat run dir.
 
@@ -46,10 +46,10 @@ A card is one row in the `backlog` table:
 | `phase`             | text (nullable)     | Board/phase grouping (see below).                             |
 | `priority`          | int (default 0)     | **Higher = sooner.** Claim picks the max-priority ready card. |
 | `status`            | enum                | `ready` \| `claimed` \| `blocked` \| `done`.                  |
-| `depends_on`        | jsonb string[]      | DAG edges — ids of cards this one depends on.                 |
+| `depends_on`        | jsonb `string[]`    | DAG edges — ids of cards this one depends on.                 |
 | `claim_owner`       | text (nullable)     | Owner token of the active claim.                              |
 | `claim_ttl_seconds` | int (nullable)      | TTL of the active claim.                                      |
-| `claimed_at`        | timestamptz (null)  | When the claim was taken. claimed_at + ttl = expiry.          |
+| `claimed_at`        | timestamptz (null)  | When the claim was taken. `claimed_at + ttl` = expiry.        |
 | `attempts`          | int (default 0)     | Incremented each time the card is claimed.                    |
 | `idempotency_key`   | text (unique, null) | Dedups `create`; NULLs are distinct in Postgres.              |
 | `acceptance`        | jsonb (nullable)    | Acceptance criteria (array of strings or object).             |
@@ -65,12 +65,12 @@ would add ceremony without benefit.
 ### Board / phase convention
 
 `phase` is a free-form grouping string used as the board column / milestone label
-(e.g. `M1`, `fleet`, `infra`). list --phase <phase> filters to one board lane.
+(e.g. `M1`, `fleet`, `infra`). `list --phase <phase>` filters to one board lane.
 `priority` orders cards **within** the ready pool regardless of phase.
 
 ## Status lifecycle
 
-```text-diagram
+```
             create
               │
               ▼
@@ -87,49 +87,51 @@ would add ceremony without benefit.
 - **blocked** — explicitly parked; never auto-claimed.
 - **done** — completed; satisfies dependents.
 
-## Atomic claim (FOR UPDATE SKIP LOCKED) + TTL
+## Atomic claim (`FOR UPDATE SKIP LOCKED`) + TTL
 
 `claim` is atomic. Inside a single transaction it locks candidate `ready` rows
-with SELECT ... FOR UPDATE SKIP LOCKED (via the drizzle `sql` operator), picks
+with `SELECT ... FOR UPDATE SKIP LOCKED` (via the drizzle `sql` operator), picks
 the highest-priority deps-satisfied card, and flips it to `claimed`. Because a row
 already locked by a concurrent claimer is **skipped**, two claimers can **never**
 both win the same card — the loser falls through to the next candidate or gets
 `null`. (Proven by the concurrency tests in `packages/db/src/backlog.spec.ts`.)
 
 - **Deps gate:** a card is only claimable when every id in `depends_on` is `done`.
-- **TTL:** claim --ttl <sec> (default **900s**) records `claim_ttl_seconds`.
-- **reclaim:** releases claims whose claimed_at + ttl is in the past (expired)
-  back to `ready`, clearing the claim fields. reclaim --id <id> force-releases a
+- **TTL:** `claim --ttl <sec>` (default **900s**) records `claim_ttl_seconds`.
+- **reclaim:** releases claims whose `claimed_at + ttl` is in the past (expired)
+  back to `ready`, clearing the claim fields. `reclaim --id <id>` force-releases a
   specific card regardless of expiry. This is how a crashed worker's card returns
   to the pool.
 
-## CLI — mosaic fleet backlog <sub> --json
+## CLI — `mosaic fleet backlog <sub> --json`
 
 All subcommands support `--json`.
 
-| Subcommand                                                                                  | Purpose                                                                                   |
-| ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| create --id --title [--body --phase --priority --depends-on --acceptance --idempotency-key] | Create a card; `idempotency_key` dedups (repeat returns the existing card).               |
-| list [--status --phase --ready-only]                                                        | List cards. `--ready-only` = status `ready` AND all deps `done`.                          |
-| claim --owner [--ttl <sec> --id <id>]                                                       | Atomically claim the highest-priority ready card (or `--id`). Returns the card or `null`. |
-| reclaim [--id <id>]                                                                         | Release expired claims (or a specific card) back to `ready`.                              |
-| link --from --to                                                                            | Add a `depends_on` edge (`--from` depends on `--to`).                                     |
-| `stats`                                                                                     | Counts by status, oldest-ready age, expired-claim count.                                  |
-| block --id                                                                                  | Set a card to `blocked`.                                                                  |
-| complete --id                                                                               | Set a card to `done` (releases any claim).                                                |
+| Subcommand                                                                                    | Purpose                                                                                   |
+| --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `create --id --title [--body --phase --priority --depends-on --acceptance --idempotency-key]` | Create a card; `idempotency_key` dedups (repeat returns the existing card).               |
+| `list [--status --phase --ready-only]`                                                        | List cards. `--ready-only` = status `ready` AND all deps `done`.                          |
+| `claim --owner [--ttl <sec> --id <id>]`                                                       | Atomically claim the highest-priority ready card (or `--id`). Returns the card or `null`. |
+| `reclaim [--id <id>]`                                                                         | Release expired claims (or a specific card) back to `ready`.                              |
+| `link --from --to`                                                                            | Add a `depends_on` edge (`--from` depends on `--to`).                                     |
+| `stats`                                                                                       | Counts by status, oldest-ready age, expired-claim count.                                  |
+| `block --id`                                                                                  | Set a card to `blocked`.                                                                  |
+| `complete --id`                                                                               | Set a card to `done` (releases any claim).                                                |
 
 ### Example
 
-Seed two cards; the second depends on the first. Because A2 is gated on A1, claim returns A1 first. Finish A1, then list A2 as ready. Recover stalled work.
-
-```fleet-command
+```sh
+# Seed two cards, the second depends on the first.
 mosaic fleet backlog create --id A1 --title "schema" --priority 5
 mosaic fleet backlog create --id A2 --title "service" --depends-on A1 --priority 9
 
+# A2 is gated on A1, so claim returns A1 first.
 mosaic fleet backlog claim --owner worker-1 --ttl 600 --json
 
+# Finish A1; now A2 is ready.
 mosaic fleet backlog complete --id A1
 mosaic fleet backlog list --ready-only --json
 
+# Recover stalled work.
 mosaic fleet backlog reclaim --json
 ```

docs/fleet/concepts/desired-vs-observed-state.md

@@ -1,42 +0,0 @@
-# Desired, Derived, and Observed Fleet State
-
-## One writable authority
-
-The canonical local v2 roster at <MOSAIC_HOME>/fleet/roster.yaml is desired state. Membership, stable identity, class, runtime/provider/model selection, launch policy, enablement, and persisted `running`/`stopped` intent are written only through generation-guarded roster mutations.
-
-Derived projections are reproducible consequences of that authority:
-
-- <name>.env.generated;
-- exact roster-named tmux sessions on the configured socket after reconciliation;
-- systemd service targets managed by installation/reconciliation.
-
-Current systemd unit enablement is not yet lifecycle-conformant at boot: installation can enable every
-agent unit, and the launcher projection does not carry `enabled` or `desired_state`. Therefore reboot
-preservation for stopped/disabled agents remains an FCM-M3-002 acceptance hold, not a guaranteed
-projection behavior.
-
-Observed evidence available to current roster-v2 status commands includes systemd active state, tmux
-presence, holder ownership, and unmanaged sessions. Heartbeat files are observational in the wider fleet,
-but roster-v2 `status`, `doctor`, and `verify` do not currently read them. Observation never writes back
-to the roster.
-
-## Generation and ownership
-
-`generation` is a positive integer concurrency fence. A mutating request must provide the current value. Successful changed CRUD increments it exactly once; stale or concurrent writers fail before mutation. Apply/reconcile rereads the canonical roster under a private exclusive lock and uses only that generation and content for effects.
-
-Ownership is exact, never fuzzy. Reconciliation is limited to roster names, the configured socket, the exact holder session, a private installation identity, and private managed paths. An ownership mismatch, unmanaged session, unsafe path, stale generation, or ambiguous lock fails closed.
-
-## Drift decisions
-
-| Observation                              | Interpretation           | Safe response                                                          |
-| ---------------------------------------- | ------------------------ | ---------------------------------------------------------------------- |
-| Generated file differs or is missing     | Derived projection drift | Review apply --dry-run; regenerate from the roster.                    |
-| Desired `running`, exact session missing | `missing-session`        | Diagnose ownership/runtime, then reconcile if safe.                    |
-| Desired `stopped`, exact session present | `unexpected-session`     | Inspect; reconciliation may stop only the proven roster target.        |
-| Disabled agent running                   | `disabled-running`       | Inspect; disabled state wins during explicit safe reconciliation.      |
-| Unknown session on the configured socket | Unmanaged state          | Report only. Do not adopt, rename, or kill it.                         |
-| Heartbeat stale in the wider fleet       | Liveness evidence        | Diagnose separately; current roster-v2 status does not read heartbeat. |
-
-`status` and `doctor` classify. `verify` is also observational but exits non-zero when ownership, drift, or unmanaged-state checks fail. `plan`/apply --dry-run validates proposed projection and lifecycle work without mutation. `apply` and `reconcile` converge only after all preconditions pass.
-
-A partial projection failure does not roll the roster back. Treat the committed roster as authority and regenerate. A lifecycle failure after projection completion preserves both roster and projections for inspection. Sensitive legacy values are never printed; diagnostics are bounded to stable codes, key names where applicable, and hashes.

docs/fleet/concepts/generated-env-launch-chain.md

@@ -1,23 +0,0 @@
-# Generated Environment Launch Chain
-
-The launcher consumes validated data, not shell configuration.
-
-1. Read and validate the canonical roster.
-2. Render deterministic <name>.env.generated data from that roster.
-3. Parse optional <name>.env.local through a strict allowlist.
-4. Reject generated-key shadowing, unknown or sensitive-looking keys, unsafe paths/values, duplicates, malformed lines, shell syntax, and command overrides.
-5. Derive the runtime command from validated runtime/model/reasoning data.
-6. Target only the exact configured tmux socket and roster session after ownership checks.
-
-## File precedence and ownership
-
-| File              | Owner                    | Use                                                                         |
-| ----------------- | ------------------------ | --------------------------------------------------------------------------- |
-| `.env.generated`  | Mosaic projection writer | Complete deterministic roster projection. Rebuild; do not edit.             |
-| `.env.local`      | Operator                 | Optional, private, strict machine-local data. Cannot shadow generated keys. |
-| `.env`            | Legacy input             | One-time migration input only; never launch authority.                      |
-| `.env.quarantine` | Private quarantine       | Retained unsafe legacy evidence; never loaded by the launcher.              |
-
-Neither systemd nor the launcher sources these files. No `eval`, shell expansion, arbitrary `MOSAIC_AGENT_COMMAND`, channel, or secret-reference compatibility path exists. Safe legacy generated keys are regenerated, allowed local keys are relocated, and unsafe material is quarantined.
-
-Diagnostics never expose the rejected value, credential material, or command text. They are bounded to stable rule code, key name where safe, and SHA-256 content identity. See [generated environment reference](../reference/generated-env-boundary.md) and [quarantine operations](../operations/env-quarantine.md).

docs/fleet/concepts/identity-class-runtime.md

@@ -1,20 +0,0 @@
-# Fleet Identity, Class, and Runtime
-
-Each roster field has one job. Do not use names or model strings as authority shortcuts.
-
-| Concern                 | Field                         | Contract                                                                                     |
-| ----------------------- | ----------------------------- | -------------------------------------------------------------------------------------------- |
-| Stable machine identity | agents[].name                 | Unique, immutable mutation target and exact service/session name.                            |
-| Display identity        | agents[].alias                | Human-facing label only; may be changed and grants no authority.                             |
-| Behavioral contract     | agents[].class                | Resolves through the shared baseline plus `roles.local` persona library.                     |
-| Tool boundary           | agents[].tool_policy          | Must match protected canonical classes; cannot independently grant authority.                |
-| Harness                 | agents[].runtime              | One of `claude`, `codex`, `opencode`, or `pi`, declared in `runtimes`.                       |
-| Backend selection       | agents[].provider and `model` | Explicit non-empty data; capability validity is not inferred from the display name or class. |
-| Effort                  | agents[].reasoning            | `low`, `medium`, or `high`.                                                                  |
-| Local placement         | `working_directory`           | Explicit safe local work path; not remote placement authority.                               |
-
-Tess and Ultron are conventional instance/display names only. They are not products, required machine identities, role aliases, or authority-bearing classes. A configurable interaction instance uses class: interaction; a configurable validation instance uses class: validator. Any stable name and alias satisfying the structural contract may be used.
-
-Class aliases are deliberately narrow: implementer → code, reviewer → review, and operator-interaction → interaction. No runtime, provider, model, persona prose, or instance name changes this mapping. See [role classes](../reference/role-classes.md) and the [validated generic example](../examples/roster-v2.yaml).
-
-Roster v2 is local-only. It contains no host/SSH placement, connector, channel, secret-reference, arbitrary-command, per-agent socket, or gateway mapping fields. Those concerns require separate requirements and threat models.

docs/fleet/concepts/role-authority-and-leases.md

@@ -1,22 +0,0 @@
-# Fleet Role Authority and Leases
-
-Role content describes behavior; protected authority is immutable code metadata derived only from the canonical class.
-
-## Required workstream classes
-
-`code`, `review`, `validator`, `orchestrator`, `team-leader`, `enhancer`, and `interaction` are required FCM classes. `merge-gate` is additionally protected because it remains the sole approve-to-land and merge authority.
-
-| Class                                        | Authority                                         | Boundary                                                                               |
-| -------------------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------- |
-| `merge-gate`                                 | Approve-to-land and merge                         | Sole merge authority.                                                                  |
-| `validator`                                  | Issue independent validation evidence/certificate | Never approves landing or merges.                                                      |
-| `orchestrator`                               | Orchestrate topology and issue bounded leases     | Does not gain merge authority.                                                         |
-| `team-leader`                                | Use explicitly leased capacity                    | Cannot issue leases or mutate roster, credentials, topology authority, or merge state. |
-| `interaction`                                | Receive requests and report status                | Cannot orchestrate, issue leases, mutate configuration, or merge.                      |
-| `code`, `review`, `enhancer`, custom classes | No protected authority by default                 | Persona prose cannot grant protected powers.                                           |
-
-A lease is capacity authorization from an orchestrator, not ownership. It must identify a bounded task or period and does not alter the leased agent's roster identity, role contract, credentials, authority, or persisted lifecycle. Expiry/revocation returns capacity; it does not rewrite the roster.
-
-Semantic validation rejects protected class/tool-policy mismatch in either direction. An instance named Ultron with class: validator remains validation-only. An instance named Tess with class: interaction remains request/status-only. Renaming either instance changes no authority.
-
-For resolver layering and safe customization, see [role classes](../reference/role-classes.md) and [customize roles](../how-to/customize-roles.md).

docs/fleet/examples/roster-v2.yaml

@@ -1,61 +0,0 @@
-version: 2
-generation: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: ~/src
-  runtime: pi
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: code-example
-    alias: Code Example
-    class: code
-    runtime: pi
-    provider: example-provider
-    model: example-model
-    reasoning: medium
-    tool_policy: code
-    working_directory: ~/src
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: false
-  - name: interaction-example
-    alias: Interaction Example
-    class: interaction
-    runtime: pi
-    provider: example-provider
-    model: example-model
-    reasoning: low
-    tool_policy: interaction
-    working_directory: ~/src
-    persistent_persona: true
-    reset_between_tasks: false
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: false
-  - name: validator-example
-    alias: Validator Example
-    class: validator
-    runtime: pi
-    provider: example-provider
-    model: example-model
-    reasoning: high
-    tool_policy: validator
-    working_directory: ~/src
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: false

docs/fleet/f4-matrix-connector.md

@@ -15,7 +15,7 @@ core.
 
 Connectors implement one small, uniform interface (`src/fleet/connectors/types.ts`):
 
-```typescript
+```ts
 interface OrchestratorConnector {
   readonly kind: 'tmux' | 'discord' | 'matrix';
   send(message: OutboundMessage): Promise<SendResult>; // orchestrator → human
@@ -25,11 +25,11 @@ interface OrchestratorConnector {
 ```
 
 - **send / subscribe / health** — the only surface fleet core depends on. `SendResult` is the
-  ack half; health() is the liveness half.
+  ack half; `health()` is the liveness half.
 - **Thread-aware by metadata** — `OutboundMessage.threadId` / `InboundMessage.threadId` are
   optional, so thread-capable connectors (Matrix rooms/threads, the future first-party Mosaic
   Discord plugin) fit **without an interface change**.
-- **Registry** (`registry.ts`) — implementations register a factory by kind; createConnector(config)
+- **Registry** (`registry.ts`) — implementations register a factory by kind; `createConnector(config)`
   resolves one from roster config. Phase 1 ships the registry + `resolveConnectorKind` (defaults
   `tmux` when a roster declares no connector — **back-compat**); the factories land in Phase 2.
 
@@ -39,7 +39,7 @@ A roster may carry an optional `connector` block (`roster.schema.json`); absent
 
 ```yaml
 connector:
-  kind: matrix
+  kind: matrix # tmux | discord | matrix
   matrix:
     homeserver_url: https://matrix.example.internal
     user_id: '@mos:example.internal'
@@ -55,12 +55,12 @@ reject a token committed to a shipped file anyway.
 The connector speaks the **Matrix client-server API** directly over HTTPS (`fetch` — no SDK needed
 for MVP), so it is **homeserver-agnostic**:
 
-| Op          | Matrix CS-API                                                           |
-| ----------- | ----------------------------------------------------------------------- |
-| `send`      | PUT /\_matrix/client/v3/rooms/{roomId}/send/m.room.message/{txnId}      |
-| `subscribe` | GET /\_matrix/client/v3/sync (long-poll, `since` token) → room timeline |
-| `health`    | GET /\_matrix/client/versions (reachable) + …/account/whoami (authed)   |
-| threads     | `m.thread` relations ↔ `threadId`                                       |
+| Op          | Matrix CS-API                                                            |
+| ----------- | ------------------------------------------------------------------------ |
+| `send`      | `PUT /_matrix/client/v3/rooms/{roomId}/send/m.room.message/{txnId}`      |
+| `subscribe` | `GET /_matrix/client/v3/sync` (long-poll, `since` token) → room timeline |
+| `health`    | `GET /_matrix/client/versions` (reachable) + `…/account/whoami` (authed) |
+| threads     | `m.thread` relations ↔ `threadId`                                        |
 
 ## Local homeserver (infra, not connector code)
 
@@ -79,7 +79,7 @@ homeserver choice is a **deployment** concern (a Phase-2 deploy guide), not conn
 | ----- | --------------------------------------------------------------------------------------- | ------- |
 | **1** | Connector interface + types, registry + kind resolution, roster `connector` schema, doc | ✅ yes  |
 | 2     | Matrix CS-API client (fetch-based send/sync/health) + registered factory + tests        | follow  |
-| 2     | fleet init / `configure` connector-selection UX; roster parse wires the block           | follow  |
+| 2     | `fleet init` / `configure` connector-selection UX; roster parse wires the block         | follow  |
 | 2     | systemd launch wiring so the orchestrator starts on the chosen connector                | follow  |
 | 3     | Conduit deploy guide; first-party Mosaic Discord (threads) registers as a connector     | follow  |
 

docs/fleet/how-to/configure-tess-interaction.md

@@ -1,21 +0,0 @@
-# Configure an Interaction Instance
-
-An interaction instance is a configurable local roster member with canonical class: interaction and matching tool_policy: interaction. “Tess” may be used as a display alias, but neither that alias nor the stable name is required or authority-bearing.
-
-Use the [validated generic roster](../examples/roster-v2.yaml) as the safe shape. Choose a unique stable `name`, any descriptive `alias`, a supported declared runtime, explicit provider/model/reasoning, and a safe work directory. Start with:
-
-```yaml
-name: interaction-example
-alias: Interaction Example
-class: interaction
-tool_policy: interaction
-lifecycle:
-  enabled: true
-  desired_state: stopped
-```
-
-Plan the complete agent payload with the current roster generation, then create it without `--persisted-start`. Creation defaults to enabled/stopped and performs no runtime action. Review the resulting roster and projection plan before any later lifecycle decision.
-
-The interaction class is request/status only. It cannot orchestrate, issue leases, mutate the roster/configuration, grant credentials, certify validation, approve landing, or merge. Connector and channel configuration are outside roster v2; do not add connector, channel, secret, command, remote-host, or gateway fields.
-
-See [safe CRUD](create-update-delete-agent.md), [identity separation](../concepts/identity-class-runtime.md), and [role authority](../concepts/role-authority-and-leases.md).

docs/fleet/how-to/configure-ultron-validator.md

@@ -1,21 +0,0 @@
-# Configure a Validator Instance
-
-A validator instance is a configurable local roster member with canonical class: validator and matching tool_policy: validator. “Ultron” may be used as a display alias, but it is not a required identity, class alias, product name, or source of authority.
-
-Use the [validated generic roster](../examples/roster-v2.yaml) as the safe shape. Choose a unique stable name and explicit supported runtime/provider/model/reasoning values. Start stopped:
-
-```yaml
-name: validator-example
-alias: Validator Example
-class: validator
-tool_policy: validator
-lifecycle:
-  enabled: true
-  desired_state: stopped
-```
-
-Plan the full payload with the current generation and create without `--persisted-start`. Creation writes desired state and projections only; it does not launch a validator.
-
-`validator` may issue independent validation evidence or a certificate. It has no approve-to-land or merge authority. `merge-gate` remains the sole protected merge authority, and changing the validator's name, alias, persona prose, runtime, provider, model, or tool-policy text cannot elevate it.
-
-Certificate consumption and final release evidence remain FCM-M5-002 gates. This page does not create a certificate or authorize merge. See [safe CRUD](create-update-delete-agent.md) and [role authority](../concepts/role-authority-and-leases.md).

docs/fleet/how-to/create-update-delete-agent.md

@@ -4,20 +4,20 @@ Use the local roster-v2 control plane only. These commands change desired state
 
 ## Read and plan first
 
-```fleet-synopsis
+```sh
 mosaic fleet get <name>
 mosaic fleet plan create --expected-generation <n> --agent '<json>'
 mosaic fleet plan update <name> --expected-generation <n> --agent '<json>'
 mosaic fleet plan delete <name> --expected-generation <n>
 ```
 
-plan create takes the name from `--agent`. plan update and plan delete require the target name immediately after the operation. A plan is deterministic and side-effect free: it validates the complete proposed roster and projection targets without changing files. Use `--dry-run` on `create`, `update`, or `delete` for the same no-write result.
+`plan create` takes the name from `--agent`. `plan update` and `plan delete` require the target name immediately after the operation. A plan is deterministic and side-effect free: it validates the complete proposed roster and projection targets without changing files. Use `--dry-run` on `create`, `update`, or `delete` for the same no-write result.
 
-Every successful command prints JSON. `get` returns { "generation", "agent" }; mutation results contain `plan`, `applied`, `authoritativeRoster`, and `projections`.
+Every successful command prints JSON. `get` returns `{ "generation", "agent" }`; mutation results contain `plan`, `applied`, `authoritativeRoster`, and `projections`.
 
 ## Create safely
 
-```fleet-command
+```sh
 mosaic fleet create --expected-generation 7 --agent '{
   "name":"coder0",
   "alias":"Coder 0",
@@ -34,20 +34,20 @@ mosaic fleet create --expected-generation 7 --agent '{
 }'
 ```
 
-Create defaults to enabled: true and desired_state: stopped. It does not start a process. Add `--persisted-start` only to persist desired_state: running; that still does not start a runtime in this M2 command. The JSON payload is an allowlist of the roster-v2 fields shown above plus `launch.yolo`; command, channel, secret-reference, and other unknown keys are rejected rather than ignored. The JSON error exposes only a stable code, never the rejected value.
+Create defaults to `enabled: true` and `desired_state: stopped`. It does not start a process. Add `--persisted-start` only to persist `desired_state: running`; that still does not start a runtime in this M2 command. The JSON payload is an allowlist of the roster-v2 fields shown above plus `launch.yolo`; command, channel, secret-reference, and other unknown keys are rejected rather than ignored. The JSON error exposes only a stable code, never the rejected value.
 
 ## Update and delete safely
 
-```fleet-synopsis
-mosaic fleet update <name> --expected-generation <n> --agent '<complete JSON agent payload>'
-mosaic fleet delete <name> --expected-generation <n>
+```sh
+mosaic fleet update coder0 --expected-generation 8 --agent '<complete JSON agent payload>'
+mosaic fleet delete coder0 --expected-generation 9
 ```
 
 Updates require a complete agent JSON payload and preserve the stable name. Delete removes only the exact roster-owned `coder0.env.generated` projection. It retains `coder0.env.local`, legacy `coder0.env`, `coder0.env.quarantine`, and every unrelated projection. A delete dry-run leaves all of those files byte-identical.
 
 ## Handle generation conflicts
 
-Every mutation requires the current authoritative `--expected-generation`. A stale value returns JSON error.code: "stale-generation" with a non-zero exit. Reload with mosaic fleet get <name> or reread the roster, plan again using the returned generation, then retry. A concurrent mutation returns `concurrent-mutation`; do not force or bypass the lock.
+Every mutation requires the current authoritative `--expected-generation`. A stale value returns JSON `error.code: "stale-generation"` with a non-zero exit. Reload with `mosaic fleet get <name>` or reread the roster, plan again using the returned generation, then retry. A concurrent mutation returns `concurrent-mutation`; do not force or bypass the lock.
 
 ## Interpret partial failures
 
@@ -71,4 +71,4 @@ This is not a rollback and not a no-op: reload the roster because its generation
 
 Handled validation errors and partial projection failures exit non-zero. `plan`/`--dry-run` and normal mutation JSON make the state explicit; scripts should use both the exit code and `authoritativeRoster`/`projections`, not `applied` alone.
 
-The commands operate only on <mosaic-home>/fleet/roster.yaml, the local roster desired-state authority. They do not accept arbitrary commands, channels, secrets, remote/connector actions, migration/canary actions, or runtime lifecycle operations.
+The commands operate only on `<mosaic-home>/fleet/roster.yaml`, the local roster desired-state authority. They do not accept arbitrary commands, channels, secrets, remote/connector actions, migration/canary actions, or runtime lifecycle operations.

docs/fleet/how-to/customize-roles.md

@@ -2,8 +2,8 @@
 
 Mosaic resolves persona contracts through two layers:
 
-1. fleet/roles/<canonical-class>.md — seeded baseline contract.
-2. fleet/roles.local/<canonical-class>.md — operator override or custom role; this layer wins.
+1. `fleet/roles/<canonical-class>.md` — seeded baseline contract.
+2. `fleet/roles.local/<canonical-class>.md` — operator override or custom role; this layer wins.
 
 The same shared resolver is used by profile validation, provisioning, roster-v2 semantic validation,
 and launch-time persona injection.
@@ -34,11 +34,11 @@ A custom class remains supported when a readable contract exists for the exact i
 The release-notes role (`class: release-notes`) prepares operator-reviewed release copy.
 ```
 
-Save it as `fleet/roles.local/release-notes.md`, then reference class: release-notes and a matching
-tool_policy: release-notes in roster v2. Adding only a `LIBRARY.md` row is insufficient.
+Save it as `fleet/roles.local/release-notes.md`, then reference `class: release-notes` and a matching
+`tool_policy: release-notes` in roster v2. Adding only a `LIBRARY.md` row is insufficient.
 
 Names such as `worker`, `analyst`, and `canary` are not built-in aliases; they need genuine custom
-contracts. agents[].alias, Tess, and Ultron are display names and cannot select a class.
+contracts. `agents[].alias`, Tess, and Ultron are display names and cannot select a class.
 
 ## Validation and authority boundaries
 

docs/fleet/how-to/start-stop-restart.md

@@ -2,22 +2,22 @@
 
 Use the canonical local roster-v2 command surface:
 
-```fleet-synopsis
+```sh
 mosaic fleet apply --expected-generation <n> --dry-run
 mosaic fleet apply --expected-generation <n>
 mosaic fleet reconcile --expected-generation <n>
 mosaic fleet start <name> --expected-generation <n>
 mosaic fleet stop <name> --expected-generation <n>
 mosaic fleet restart <name> --expected-generation <n>
-mosaic fleet status [<name>]
+mosaic fleet status [name]
 mosaic fleet verify
 mosaic fleet doctor
 ```
 
-Start with `--dry-run`. It validates roster semantics, deterministic projections, private managed paths, exact holder ownership, and named-socket state without changing files or lifecycle state. Explicit `apply` and `reconcile` rebuild derived projections and enforce persisted roster state: enabled `running` agents may start, while stopped or disabled agents are not started. This guarantee does not extend to reboot/service activation yet; boot preservation remains an FCM-M3-002 hold.
+Start with `--dry-run`. It validates roster semantics, deterministic projections, private managed paths, exact holder ownership, and named-socket state without changing files or lifecycle state. `apply` and `reconcile` rebuild derived projections and enforce only persisted roster state: enabled `running` agents may start, while stopped or disabled agents are not started.
 
-`start`, `stop`, and `restart` are explicit one-shot exact-service actions. They do not persist a lifecycle change. `update` preserves the agent's existing lifecycle, and no delivered operation changes durable lifecycle after creation.
+`start`, `stop`, and `restart` are explicit one-shot exact-service actions. They do not persist a lifecycle change. Roster CRUD is the only way to change persisted desired state.
 
-Every command prints JSON. Observation commands report drift without mutation; `verify` exits non-zero on ownership mismatch, unmanaged sessions, or drift. A failed apply that wrote some derived projections reports projections: "incomplete" with bounded recovery to regenerate from the roster. A lifecycle failure after projections reports incomplete lifecycle work; it is never represented as a rollback or no-op.
+Every command prints JSON. Observation commands report drift without mutation; `verify` exits non-zero on ownership mismatch, unmanaged sessions, or drift. A failed apply that wrote some derived projections reports `projections: "incomplete"` with bounded recovery to regenerate from the roster. A lifecycle failure after projections reports incomplete lifecycle work; it is never represented as a rollback or no-op.
 
 These commands are local only. Remote/SSH/connector entries are inventory/validation-only. Commands do not accept arbitrary runtime commands, channels, secrets, generated-file desired state, or arbitrary tmux sockets.

docs/fleet/migration/example-profile-disposition.md

@@ -11,7 +11,7 @@ artifact is added, removed, or left without one of the dispositions below.
 ## Disposition rules
 
 - **Explicit v1 fixture:** the artifact is loaded through the existing v1 roster parser and must
-  declare version: 1. It remains a compatibility fixture; it is not silently treated as a v2
+  declare `version: 1`. It remains a compatibility fixture; it is not silently treated as a v2
   roster or given inferred aliases.
 - **Canonical profile:** the artifact is loaded through `loadProfiles`, which uses the shared
   baseline-plus-`roles.local` persona resolver and rejects unreadable or unresolved classes.
@@ -59,7 +59,7 @@ rollback; those gates belong to FCM-M4-002. See [v1-to-v2 preview](./v1-to-v2.md
 
 ## Running the guard
 
-```fleet-command
+```bash
 pnpm --filter @mosaicstack/mosaic test -- v1-v2-migration.spec.ts \
   -t "validates all 13 shipped artifacts and executes ready previews for every v1 fixture"
 ```

docs/fleet/migration/v1-to-v2.md

@@ -2,14 +2,14 @@
 
 **Issue:** #758 · **Card:** FCM-M4-001 · **Effect boundary:** preview only
 
-mosaic fleet migrate-v1 preview inventories a v1 roster and emits a canonical v2 candidate plus
+`mosaic fleet migrate-v1 preview` inventories a v1 roster and emits a canonical v2 candidate plus
 recovery evidence. It does not write a roster, apply environment projections, invoke systemd or
 `tmux`, contact connectors or remote hosts, launch an agent, run a canary, or execute rollback.
 FCM-M4-002 owns reversible cutover and rollback.
 
 ## Inputs
 
-```fleet-command
+```bash
 mosaic fleet migrate-v1 preview \
   --source roster-v1.yaml \
   --decisions migration-decisions.json \
@@ -44,25 +44,25 @@ be marked disabled. Observed-stopped agents always remain stopped.
 
 ## Field disposition
 
-| v1 field                                                                 | v2 disposition                                                                                                                                                                                                                                                                                                                |
-| ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `version`, `transport`, `tmux`, `defaults`, `runtimes`                   | Inventoried and structurally compiled; omitted runtimes retain v1 built-in defaults, while each explicitly declared runtime without a reset field follows the production v1 `/clear` fallback; present-empty holder/work-directory/reset values block                                                                         |
-| agent `name`, `alias`, `runtime`, working directory, persona/reset flags | Copied or explicitly defaulted only when absent; present-empty alias/work-directory values block for explicit disposition. Canonical ~/~/... values stay unchanged in roster evidence and traversal-free forms expand only at the shared production environment-projection boundary before unchanged absolute-path validation |
-| `provider`, `model_hint`, `reasoning_level`                              | Explicit provider/model/reasoning decisions; no model-hint inference                                                                                                                                                                                                                                                          |
-| `class`, `tool_policy`                                                   | Only approved aliases canonicalize automatically; other classes require explicit preserve/replace disposition and shared-resolver validation                                                                                                                                                                                  |
-| `kickstart_template`                                                     | No v2 field; explicit inventory-only disposition required                                                                                                                                                                                                                                                                     |
-| agent `host`, `ssh`                                                      | host != fleetHost is demonstrably remote and inventory-only; host == fleetHost stays local; SSH targets with or without an explicit user must agree with `host`; ssh-only, missing fleet-host evidence, or contradictory targets block                                                                                        |
-| agent `socket`                                                           | Same-host candidate only when it matches the canonical fleet socket; conflicts block for explicit future disposition                                                                                                                                                                                                          |
-| root `connector`                                                         | Inventory-only; never contacted or reconciled                                                                                                                                                                                                                                                                                 |
-| unknown fields or snake/camel synonym collisions                         | Inventoried and block readiness                                                                                                                                                                                                                                                                                               |
-| `.env.generated`                                                         | Rebuild from canonical roster data                                                                                                                                                                                                                                                                                            |
-| no legacy `.env`                                                         | `absent`; no legacy action required                                                                                                                                                                                                                                                                                           |
-| legacy `.env` containing generated keys only                             | `regenerate-only`; replace later from canonical roster data                                                                                                                                                                                                                                                                   |
-| legacy `.env` containing strict local keys                               | `relocate-local`; preserve those keys in `.env.local` during a later reviewed cutover                                                                                                                                                                                                                                         |
-| legacy `.env` containing forbidden/unsafe/sensitive/malformed keys       | `quarantine`; private input only, with diagnostics limited to code, key, and SHA-256                                                                                                                                                                                                                                          |
+| v1 field                                                                 | v2 disposition                                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `version`, `transport`, `tmux`, `defaults`, `runtimes`                   | Inventoried and structurally compiled; omitted runtimes retain v1 built-in defaults, while each explicitly declared runtime without a reset field follows the production v1 `/clear` fallback; present-empty holder/work-directory/reset values block                                                                             |
+| agent `name`, `alias`, `runtime`, working directory, persona/reset flags | Copied or explicitly defaulted only when absent; present-empty alias/work-directory values block for explicit disposition. Canonical `~`/`~/...` values stay unchanged in roster evidence and traversal-free forms expand only at the shared production environment-projection boundary before unchanged absolute-path validation |
+| `provider`, `model_hint`, `reasoning_level`                              | Explicit provider/model/reasoning decisions; no model-hint inference                                                                                                                                                                                                                                                              |
+| `class`, `tool_policy`                                                   | Only approved aliases canonicalize automatically; other classes require explicit preserve/replace disposition and shared-resolver validation                                                                                                                                                                                      |
+| `kickstart_template`                                                     | No v2 field; explicit inventory-only disposition required                                                                                                                                                                                                                                                                         |
+| agent `host`, `ssh`                                                      | `host != fleetHost` is demonstrably remote and inventory-only; `host == fleetHost` stays local; SSH targets with or without an explicit user must agree with `host`; ssh-only, missing fleet-host evidence, or contradictory targets block                                                                                        |
+| agent `socket`                                                           | Same-host candidate only when it matches the canonical fleet socket; conflicts block for explicit future disposition                                                                                                                                                                                                              |
+| root `connector`                                                         | Inventory-only; never contacted or reconciled                                                                                                                                                                                                                                                                                     |
+| unknown fields or snake/camel synonym collisions                         | Inventoried and block readiness                                                                                                                                                                                                                                                                                                   |
+| `.env.generated`                                                         | Rebuild from canonical roster data                                                                                                                                                                                                                                                                                                |
+| no legacy `.env`                                                         | `absent`; no legacy action required                                                                                                                                                                                                                                                                                               |
+| legacy `.env` containing generated keys only                             | `regenerate-only`; replace later from canonical roster data                                                                                                                                                                                                                                                                       |
+| legacy `.env` containing strict local keys                               | `relocate-local`; preserve those keys in `.env.local` during a later reviewed cutover                                                                                                                                                                                                                                             |
+| legacy `.env` containing forbidden/unsafe/sensitive/malformed keys       | `quarantine`; private input only, with diagnostics limited to code, key, and SHA-256                                                                                                                                                                                                                                              |
 
-The only automatic aliases are implementer → code, reviewer → review, and
-operator-interaction → interaction. Similar or domain-specific names are never inferred. Automatic
+The only automatic aliases are `implementer → code`, `reviewer → review`, and
+`operator-interaction → interaction`. Similar or domain-specific names are never inferred. Automatic
 classes do not accept competing disposition records. Semantic validation delegates to the existing
 baseline-plus-`roles.local` resolver after the candidate is compiled by the existing v2 compiler.
 

docs/fleet/north-star.md

@@ -44,9 +44,9 @@ The Fleet inherits — does not re-invent — the MVP's hard requirements:
 | MVP req                       | What it means for the Fleet                                                                                             |
 | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
 | MVP-X1 three-surface parity   | fleet observability/control reachable via **CLI + TUI + webUI** (CLI first; webUI is required for parity, not optional) |
-| MVP-X2 multi-tenant isolation | one tenant = one **Linux uid** (own systemd --user, socket, ~/.config/mosaic); no cross-tenant leakage                  |
+| MVP-X2 multi-tenant isolation | one tenant = one **Linux uid** (own `systemd --user`, socket, `~/.config/mosaic`); no cross-tenant leakage              |
 | MVP-X3 auth (BetterAuth/SSO)  | operator→fleet and cross-host views are auth-gated through the platform's existing auth                                 |
-| MVP-X4 quality gates          | pnpm typecheck/`lint`/`format:check` green before any push                                                              |
+| MVP-X4 quality gates          | `pnpm typecheck`/`lint`/`format:check` green before any push                                                            |
 | MVP-X5 federated topology     | cross-host fleet visibility rides the **federation** boundary (W1), not a bespoke broker                                |
 | MVP-X6 OTEL tracing           | heartbeats, sends, and lifecycle events emit spans; `traceparent` crosses the federation boundary                       |
 | MVP-X7 trunk merge            | branch from `main`, squash-merge via PR, never push to `main`                                                           |
@@ -55,20 +55,20 @@ The Fleet inherits — does not re-invent — the MVP's hard requirements:
 
 One **definition** is the source of truth; the **session** is how it runs.
 
-| Layer                            | Owner                                                                                   | Phase-2 reality                                        | Destination                                                                                                                         |
-| -------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
-| **Definition + identity + auth** | gateway / `mosaic-as` (scoped tokens, #541)                                             | `roster.yaml` (tenant-tagged)                          | one definition; mosaic agent --new materializes it                                                                                  |
-| **Tenancy boundary**             | **Linux uid per tenant** (linger, own systemd --user, own socket, own ~/.config/mosaic) | one tenant: `jarvis` = tenant zero                     | uid-per-tenant; federation aggregates across hosts                                                                                  |
-| **Runtime**                      | per-tenant tmux session on isolated socket                                              | dogfood stub sessions (live now on `mosaic-factory`)   | claude/codex/pi/opencode TUIs                                                                                                       |
-| **Liveness**                     | **heartbeat protocol** every runtime answers                                            | protocol defined + dogfood stub answers it             | all runtimes answer; "healthy" ≠ "pane alive"                                                                                       |
-| **Observation**                  | read-only `watch` (native tmux) + `pipe-pane` stream                                    | CLI `watch`/`ps`; explicit opt-in `attach` for control | + auth-gated webUI streams                                                                                                          |
-| **Control plane**                | **federation** across hosts × tenants                                                   | records already carry `tenant_id` + `host`             | federated gateways expose fleet state; webUI in Phase 5                                                                             |
-| **Central register**             | Postgres `fleet` schema (gateway instance); access via gateway API only                 | _none in PoC_ (files + `roster.yaml`)                  | agents, missions, tasks, heartbeats, spend — single network-accessible SSOT; docs = generated projections                           |
-| **Budget / spend governance**    | **per-tenant budget policy** ingested by the orchestrator + routing layer               | none today (spend is unmetered)                        | usage-vs-limit feedback ingested; spend auto-paced to the limit window; per-provider/per-account/concurrency/API-$ budgets enforced |
+| Layer                            | Owner                                                                                       | Phase-2 reality                                        | Destination                                                                                                                         |
+| -------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
+| **Definition + identity + auth** | gateway / `mosaic-as` (scoped tokens, #541)                                                 | `roster.yaml` (tenant-tagged)                          | one definition; `mosaic agent --new` materializes it                                                                                |
+| **Tenancy boundary**             | **Linux uid per tenant** (linger, own `systemd --user`, own socket, own `~/.config/mosaic`) | one tenant: `jarvis` = tenant zero                     | uid-per-tenant; federation aggregates across hosts                                                                                  |
+| **Runtime**                      | per-tenant tmux session on isolated socket                                                  | dogfood stub sessions (live now on `mosaic-factory`)   | claude/codex/pi/opencode TUIs                                                                                                       |
+| **Liveness**                     | **heartbeat protocol** every runtime answers                                                | protocol defined + dogfood stub answers it             | all runtimes answer; "healthy" ≠ "pane alive"                                                                                       |
+| **Observation**                  | read-only `watch` (native tmux) + `pipe-pane` stream                                        | CLI `watch`/`ps`; explicit opt-in `attach` for control | + auth-gated webUI streams                                                                                                          |
+| **Control plane**                | **federation** across hosts × tenants                                                       | records already carry `tenant_id` + `host`             | federated gateways expose fleet state; webUI in Phase 5                                                                             |
+| **Central register**             | Postgres `fleet` schema (gateway instance); access via gateway API only                     | _none in PoC_ (files + `roster.yaml`)                  | agents, missions, tasks, heartbeats, spend — single network-accessible SSOT; docs = generated projections                           |
+| **Budget / spend governance**    | **per-tenant budget policy** ingested by the orchestrator + routing layer                   | none today (spend is unmetered)                        | usage-vs-limit feedback ingested; spend auto-paced to the limit window; per-provider/per-account/concurrency/API-$ budgets enforced |
 
 > **PoC socket hygiene:** the PoC fleet runs on the **default tmux socket** (no `-L`).
 > The named production-isolation socket is **`mosaic-fleet`** (matches the product brand);
-> an absent roster `socket_name` means the default socket everywhere (spawn, fleet ps,
+> an absent roster `socket_name` means the default socket everywhere (spawn, `fleet ps`,
 > onboarding cheat-sheet). The legacy dogfood canary still runs on the old `mosaic-factory`
 > socket pending migration.
 
@@ -177,22 +177,22 @@ routing flow**, **concurrency** (the spend multiplier), and **hard API-token $-l
 are enforced at the orchestrator + routing boundary, not inside individual workers (a worker never
 decides its own budget — see delegation discipline).
 
-**Budget CLI UX (#558):** mosaic budget set --reset-at sets the window reset; reset-datetimes
+**Budget CLI UX (#558):** `mosaic budget set --reset-at` sets the window reset; reset-datetimes
 carry **confidence tags** (`user` / `provider` / `estimated` / `unknown`); and **urgency/criticality
 is a dispatch-gate modifier** — high-urgency work may override even-spread pacing **within
 authorization**. (Also feeds the budgeting workstream, not only this doc.)
 
 ## Observation model
 
-| Verb                              | Behavior                                                                                           |
-| --------------------------------- | -------------------------------------------------------------------------------------------------- |
-| mosaic fleet ps                   | one table joining systemd + tmux + process + idle + last-heartbeat, with drift + boot-enable flags |
-| mosaic agent watch <name>         | **read-only** join (grouped session / `-r`), no resize tyranny, no keystrokes                      |
-| mosaic agent attach <name>        | explicit interactive takeover (the only path that can type)                                        |
-| mosaic agent send <name> --verify | confirms message **accepted**, not merely keystroke-injected                                       |
+| Verb                                | Behavior                                                                                           |
+| ----------------------------------- | -------------------------------------------------------------------------------------------------- |
+| `mosaic fleet ps`                   | one table joining systemd + tmux + process + idle + last-heartbeat, with drift + boot-enable flags |
+| `mosaic agent watch <name>`         | **read-only** join (grouped session / `-r`), no resize tyranny, no keystrokes                      |
+| `mosaic agent attach <name>`        | explicit interactive takeover (the only path that can type)                                        |
+| `mosaic agent send <name> --verify` | confirms message **accepted**, not merely keystroke-injected                                       |
 
 > Why the current PoC blocks observation: sessions live on the isolated `mosaic-factory`
-> socket (invisible to default tmux ls), the only sanctioned read is `capture-pane`
+> socket (invisible to default `tmux ls`), the only sanctioned read is `capture-pane`
 > (blank for full-screen TUIs), and `attach` is read-write + resizes the session. The
 > verbs above restore "join and observe" safely.
 
@@ -214,7 +214,7 @@ compromised pane cannot corrupt or exfiltrate the register.
 | Layer                  | Responsibility                                                                                                | Implementation                                                                                                                                                                                            |
 | ---------------------- | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Register**           | Source of truth: agents, missions, tasks, heartbeats, spend                                                   | Postgres `fleet` schema — existing stack instance (`@mosaicstack/db`)                                                                                                                                     |
-| **Access**             | Typed, auth-gated API                                                                                         | Gateway fleet/\* routes                                                                                                                                                                                   |
+| **Access**             | Typed, auth-gated API                                                                                         | Gateway `fleet/*` routes                                                                                                                                                                                  |
 | **Dispatcher**         | Brief classification, BOD review, planning/coding/review/test/deploy sequencing + gates → fleet task dispatch | **forge pipeline engine** (`runPipeline`/`resumePipeline`, brief classifier, BOD) **+ thin `forge-exec` adapter → `agent-send.sh`**; NOT a new daemon — forge is reused, only stage→agent dispatch is new |
 | **Orchestrator (Mos)** | Goals, missions, judgment, user/PA interface                                                                  | Context-light; sets intent → re-engages only for decisions                                                                                                                                                |
 
@@ -236,7 +236,7 @@ role implementation.
 
 `docs/TASKS.md` and `MISSION-MANIFEST.md` are **generated projections** of the DB,
 not hand-maintained. The dispatcher (or a scheduled job) renders Markdown from
-fleet.\* tables and commits the output. DB is authoritative; docs are for human
+`fleet.*` tables and commits the output. DB is authoritative; docs are for human
 reference.
 
 ### Spend
@@ -266,13 +266,13 @@ re-evaluate if isolation or write-volume demands it.
 
 ## Phased roadmap
 
-| Phase                  | Outcome                                                                                                                                                                                                | Status  |
-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
-| 0–1                    | tmux PoC, hardening, published CLI v0.0.34 (#565–#568)                                                                                                                                                 | ✅ done |
-| **2 — Observability**  | fleet ps (host+tenant aware join), heartbeat protocol + dogfood stub answers it, agent watch (read-only), agent send --verify receipts                                                                 | ▶ now   |
-| 3 — Real runtimes      | claude/codex/pi/opencode answer heartbeat; **hybrid lifecycle** (core always-on: **orchestrator + enhancer**; ephemeral workers per lane)                                                              | planned |
-| 4 — Unified definition | one agent schema in gateway; mosaic agent --new → materialized per-tenant session; uid-tenant provisioning; **`fleet` schema migration + `forge-exec` TaskExecutor adapter (forge → `agent-send.sh`)** | planned |
-| 5 — Control plane      | federation-backed cross-host × cross-tenant fleet view; **webUI** (surface chosen then) for MVP-X1 parity; **central register live (spend ledger, docs-as-projections, multi-host Kanban)**            | planned |
+| Phase                  | Outcome                                                                                                                                                                                                  | Status  |
+| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| 0–1                    | tmux PoC, hardening, published CLI v0.0.34 (#565–#568)                                                                                                                                                   | ✅ done |
+| **2 — Observability**  | `fleet ps` (host+tenant aware join), heartbeat protocol + dogfood stub answers it, `agent watch` (read-only), `agent send --verify` receipts                                                             | ▶ now   |
+| 3 — Real runtimes      | claude/codex/pi/opencode answer heartbeat; **hybrid lifecycle** (core always-on: **orchestrator + enhancer**; ephemeral workers per lane)                                                                | planned |
+| 4 — Unified definition | one agent schema in gateway; `mosaic agent --new` → materialized per-tenant session; uid-tenant provisioning; **`fleet` schema migration + `forge-exec` TaskExecutor adapter (forge → `agent-send.sh`)** | planned |
+| 5 — Control plane      | federation-backed cross-host × cross-tenant fleet view; **webUI** (surface chosen then) for MVP-X1 parity; **central register live (spend ledger, docs-as-projections, multi-host Kanban)**              | planned |
 
 ## Decisions of record (2026-06-20, with Jason)
 
@@ -285,9 +285,9 @@ re-evaluate if isolation or write-volume demands it.
 - Delivery: **CLI-first now**, dogfood against the live stub fleet; webUI deferred to Phase 5.
 - Runtimes: fleet agents default to **Codex / pi-on-Codex**; **Claude is reserved for Claude
   Code only** (avoid alternate-harness API pricing). Validated durable recipe:
-  mosaic yolo pi --model openai-codex/gpt-5.5:high. Durable detached launch requires the
+  `mosaic yolo pi --model openai-codex/gpt-5.5:high`. Durable detached launch requires the
   runtime-bin on PATH (baked into the pane command) + boot-survival (`enable` + linger),
-  which fleet init should automate.
+  which `fleet init` should automate.
 
 ## Decisions of record (2026-06-22, with Jason)
 
@@ -304,18 +304,19 @@ re-evaluate if isolation or write-volume demands it.
 - **Session context cap = 200k tokens (GLOBAL to all Claude sessions):** Claude Code sessions are
   capped at a **max 200k-token context window**. Long-running sessions extended toward 1M tokens
   have proven **worse in practice** (degraded steering, off-plan divergence); 200k is the standard.
-  **Enforcement split:** the _window_ lives in **~/.claude/settings.json** (host-global) as
-  "autoCompactWindow": 200000 + "autoCompactEnabled": true; the _1M-disable_ lives in **launch
+  **Enforcement split:** the _window_ lives in **`~/.claude/settings.json`** (host-global) as
+  `"autoCompactWindow": 200000` + `"autoCompactEnabled": true`; the _1M-disable_ lives in **launch
   ENV** (`CLAUDE_CODE_DISABLE_1M_CONTEXT=1`, plus `CLAUDE_CODE_AUTO_COMPACT_WINDOW=200000`) wherever
-  a [1m] model can be selected (`mos-claude.service` + the fleet Claude launcher), so every Claude
+  a `[1m]` model can be selected (`mos-claude.service` + the fleet Claude launcher), so every Claude
   agent is capped at spawn. (settings = window; env = 1M-disable.)
 - **Worker context bound (#8):** workers are kept context-bounded via the **ephemeral-per-lane
   lifecycle + native compaction**, not via the 200k knob. The explicit `autoCompactWindow` 200k knob
   **stays Claude-specific** — the _principle_ (bounded context) extends to workers, the _knob_ does not.
 - **Orchestrator delegation discipline:** the orchestrator **delegates all delivery work** to
-  subagents / workflows / ultracode / coder agents and confines its own context to the personal-assistant
-  lane. Keeping delivery out of the orchestrator's window keeps its context unpolluted and measurably
-  reduces off-plan divergence. The orchestrator coordinates and decides; it does not implement.
+  subagents / workflows / ultracode / coder agents and confines its own context to \*\*orchestration
+  - the personal-assistant lane\*\*. Keeping delivery out of the orchestrator's window keeps its
+    context unpolluted and measurably reduces off-plan divergence. The orchestrator coordinates and
+    decides; it does not implement.
 - **Budget governance is fleet doctrine:** token/API-dollar budgeting is a first-class fleet concern
   (see "Budget & token governance"). OAuth-sub usage-vs-limit feedback is ingested per account, spend
   is **auto-paced EVEN-SPREAD over remaining time** (rapid/overspend only on explicit authorization),
@@ -343,7 +344,7 @@ re-evaluate if isolation or write-volume demands it.
 ### Control plane & central register
 
 - **Store:** Postgres (existing stack instance, dedicated `fleet` schema via `@mosaicstack/db`). SQLite rejected: (1) it is a local file — structurally incompatible with a multi-host fleet; (2) concurrent multi-agent writes caused repeated corruption in Hermes. "SQLite + access service" rejected as reinventing a DB server badly; "LLM agent gating DB access" rejected as slow, expensive, and a single point of failure.
-- **Access:** gateway API only (`apps/gateway`, fleet/\* routes). No raw DB credentials in any agent/dispatcher pane — directly mitigates the tmux attack-surface concern.
+- **Access:** gateway API only (`apps/gateway`, `fleet/*` routes). No raw DB credentials in any agent/dispatcher pane — directly mitigates the tmux attack-surface concern.
 - **Dispatcher = forge (reuse, not a new build):** the dispatcher IS `@mosaicstack/forge`'s pipeline engine (`runPipeline`/`resumePipeline` + brief classifier + BOD persona loader), a fully-implemented software-factory pipeline (brief → BOD review → 3 planning stages → coding → review/remediation → testing → deploy). We do **not** design/build a new dispatcher and do **not** re-implement sequencing, gate logic, or brief classification. The only new fleet-owned piece is a thin **`forge-exec` TaskExecutor adapter** (suggested package `packages/forge-exec`) mapping a `ForgeTask` → `agent-send.sh` dispatch to a named fleet agent — forge's single missing piece. It is tracked as a Gitea issue and built **post-PoC** (not now).
 - **Register backs forge:** the Postgres `fleet` register is genuinely new (neither forge nor the fleet has cross-project state). It BACKS forge's pipeline state (durable `resumePipeline`, cross-host) plus cross-project missions/tasks/Kanban.
 - **'board' role = forge BOD:** the north-star role-library 'board' role IS forge's Board-of-Directors — reused, not reinvented.
@@ -356,9 +357,9 @@ re-evaluate if isolation or write-volume demands it.
 
 - **Per-agent model switch (operator-configurable, NOT a global lock):** model selection is
   **per-agent**, never a host-global pin. Claude sessions MUST NOT be locked to a single model in
-  ~/.claude/settings.json; each agent chooses its model independently. The plumbing already exists —
-  roster `model_hint` → `MOSAIC_AGENT_MODEL` → `start-agent-session.sh` appends --model <hint> to that
-  agent's harness (claude or pi); settable today via mosaic fleet add|edit <agent> --model <hint>.
+  `~/.claude/settings.json`; each agent chooses its model independently. The plumbing already exists —
+  roster `model_hint` → `MOSAIC_AGENT_MODEL` → `start-agent-session.sh` appends `--model <hint>` to that
+  agent's harness (claude or pi); settable today via `mosaic fleet add|edit <agent> --model <hint>`.
   **North-star target:** surface this as a **per-agent model switch in the webUI** (with CLI/TUI parity
   per MVP-X1) — read the roster, expose a per-agent model dropdown, write `model_hint` back, and restart
   that one agent to apply. Unset = inherit the harness default. This **composes with** the budget
@@ -384,7 +385,7 @@ re-evaluate if isolation or write-volume demands it.
   self-hosted homeserver (Conduit default, Synapse alt). Matrix is named here as the strategic
   future transport — peer to tmux/Discord, not superseded by them.
 - **tmux fleet attack-surface hardening.** Many always-on tmux sessions are an attack surface;
-  tmux send-keys / socket access could enable malicious action against agents directly.
+  `tmux send-keys` / socket access could enable malicious action against agents directly.
   Mitigations to build toward: socket ownership/perms, per-tenant socket isolation (already an
   invariant), authenticated `agent-send`, and an audit of who can write to any pane. **Post-MVP
   unless a P0 surfaces.** The control-plane register reinforces this (gateway-API access = no raw
@@ -417,9 +418,9 @@ re-evaluate if isolation or write-volume demands it.
 
 ---
 
-> **Release procedure (drift re-capture, 2026-06-22):** mosaic update only propagates new fleet
+> **Release procedure (drift re-capture, 2026-06-22):** `mosaic update` only propagates new fleet
 > commands when the **CLI version is bumped** — without a version bump, fleet command changes never
-> reach installed hosts. The release/version-bump procedure (bump → publish → mosaic update
+> reach installed hosts. The release/version-bump procedure (bump → publish → `mosaic update`
 > [→ `--relaunch`]) must be documented so fleet changes actually land. (Also feeds the budgeting
 > workstream.)
 >

docs/fleet/operations/backup-restore.md

@@ -30,7 +30,7 @@ connector entry.
 
 The preview evidence deliberately records:
 
-- executable: false;
+- `executable: false`;
 - required backup artifacts;
 - source and candidate identities;
 - lifecycle observations and resulting desired states;

docs/fleet/operations/env-quarantine.md

@@ -1,20 +0,0 @@
-# Environment Quarantine Operations
-
-Legacy <name>.env is input evidence, never current launch authority. Projection preparation classifies it deterministically:
-
-- generated roster keys → discard and regenerate;
-- allowed strict local keys → relocate to private `.env.local`;
-- malformed, duplicate, unknown, sensitive-looking, shell-bearing, unsafe, or command-override entries → move the legacy input to private `.env.quarantine`.
-
-## Safe response
-
-1. Stop and read the stable error code and reported key name/hash. Do not request or paste the value.
-2. Confirm the canonical roster contains the intended non-sensitive desired state.
-3. If the key is an allowed local machine-data field, place only its validated data form in `.env.local` under private permissions.
-4. Remove unsupported intent rather than translating it into commands, channels, secret references, or unknown MOSAIC*AGENT*\* keys.
-5. Regenerate `.env.generated` from the roster and rerun a dry-run/verification gate.
-6. Retain quarantine evidence privately until the operator's normal retention process permits removal.
-
-The launcher never reads quarantine. Public/JSON diagnostics expose stable code, key name where safe, and SHA-256 only—never a legacy sensitive value, credential, rejected command, or full line. Quarantine does not prove remediation, backup, migration, or rollback.
-
-See [generated launch chain](../concepts/generated-env-launch-chain.md), [generated environment boundary](../reference/generated-env-boundary.md), and [migration field disposition](../migration/v1-to-v2.md#field-disposition).

docs/fleet/operations/reconcile-and-recover.md

@@ -2,12 +2,10 @@
 
 ## Safe sequence
 
-1. Read mosaic fleet doctor and mosaic fleet status.
-2. Run mosaic fleet apply --expected-generation <n> --dry-run.
+1. Read `mosaic fleet doctor` and `mosaic fleet status`.
+2. Run `mosaic fleet apply --expected-generation <n> --dry-run`.
 3. Resolve stale generation, ownership mismatch, unsafe path, projection validation, or unmanaged-session findings before applying.
-4. Run mosaic fleet apply --expected-generation <n> only after the plan is understood.
-
-This is per-generation convergence, not a rolling canary. Executable canary cutover/rollback remains held for FCM-M4-002; rolling local release evidence remains FCM-M5-002. Do not approximate either with repeated live apply commands.
+4. Run `mosaic fleet apply --expected-generation <n>` only after the plan is understood.
 
 The reconciler uses the exact roster tmux socket, exact holder session, private installation holder identity, and the complete expected global environment. For mutations it acquires its exclusive lock before rereading the canonical roster and fencing its generation; only that under-lock roster drives validation, planning, projections, and lifecycle effects. Before effects, its exclusive lock proves real private `MOSAIC_HOME` and `fleet` ancestors, uses a private `0600` lock leaf, and binds cleanup to the created file identity and ownership token. A fake holder, contaminated global environment, missing identity, unsafe lock path, or unmanaged session fails closed. It does not adopt, kill, or rename any unproven session. A crash can leave a stale lock for explicit operator inspection; reconciliation deliberately does not guess ownership or remove it.
 
@@ -25,4 +23,4 @@ The roster is never changed by reconciliation. If derived projection application
 }
 ```
 
-If projections completed but lifecycle work failed, JSON reports projections: "complete", lifecycle: "incomplete", and the bounded action `rerun-after-inspecting-owned-resources`. If lock cleanup cannot be proven after an effect result, it adds cleanup: { "code": "lock-cleanup-failed", "action": "inspect-lock-before-retry" } without changing the known projection, lifecycle, or primary recovery truth. Inspect the retained lock before retrying; no rollback, release, or stale-lock removal is implied. Results do not include environment values, secrets, or privileged command content.
+If projections completed but lifecycle work failed, JSON reports `projections: "complete"`, `lifecycle: "incomplete"`, and the bounded action `rerun-after-inspecting-owned-resources`. If lock cleanup cannot be proven after an effect result, it adds `cleanup: { "code": "lock-cleanup-failed", "action": "inspect-lock-before-retry" }` without changing the known projection, lifecycle, or primary recovery truth. Inspect the retained lock before retrying; no rollback, release, or stale-lock removal is implied. Results do not include environment values, secrets, or privileged command content.

docs/fleet/operations/systemd-tmux-troubleshooting.md

@@ -1,24 +0,0 @@
-# Systemd and tmux Troubleshooting
-
-Start with read-only mosaic fleet status, `doctor`, and `verify`. Do not manually adopt, rename, terminate, or recreate sessions while ownership is ambiguous.
-
-## Decision table
-
-| Finding                         | Meaning                                              | Safe next step                                                                        |
-| ------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| Empty roster `tmux.socket_name` | Literal default tmux server                          | Do not substitute the named `mosaic-fleet` socket. Use roster-derived commands only.  |
-| Non-empty socket                | Exact named socket                                   | Never target another socket or infer a per-agent socket.                              |
-| holder: missing                 | Required exact holder absent                         | Inspect installation/projection readiness; do not create an unproven holder manually. |
-| `ownership-mismatch`            | Holder identity or global environment differs        | Stop. Verify private install identity and managed paths before retry.                 |
-| `missing-session`               | Desired-running roster agent lacks exact session     | Check service/runtime preconditions; review apply dry-run.                            |
-| `unexpected-session`            | Desired-stopped roster agent still has exact session | Confirm ownership; only reconciler may target the exact proven roster member.         |
-| `disabled-running`              | Disabled roster member is observed running           | Inspect and reconcile only after ownership proof.                                     |
-| `unmanagedSessions`             | Unknown session exists on configured named socket    | Report and investigate separately. Reconciler will not kill or adopt it.              |
-| stale/concurrent generation     | Desired state changed since plan                     | Reload roster/generation and recompute the plan.                                      |
-| stale or ambiguous lock         | Prior writer/cleanup cannot be proven                | Inspect ownership; do not blindly remove the lock.                                    |
-| projection failure              | Derived files incomplete                             | Keep roster as authority and regenerate projections.                                  |
-| lifecycle failure               | Projections complete, runtime convergence incomplete | Inspect the exact owned resource, then rerun with current generation.                 |
-
-Systemd state, tmux state, heartbeat, and generated files are observations/projections, not alternate desired state. Explicit apply/reconcile honors stopped/disabled intent, but current unit enablement and launcher projections do not yet prove lifecycle-safe reboot; inspect unit enablement before reboot and treat stopped/disabled boot preservation as an FCM-M3-002 hold. Current roster-v2 status commands also do not read heartbeat files. Executable gates do not provide site cutover/rollback or package asset-revision repair.
-
-Errors and troubleshooting output never print legacy sensitive values, credential contents, or privileged command text. Use stable codes, key names/hashes, exact roster identities, and bounded recovery actions. See [status and drift](../reference/status-and-drift.md) and [reconcile and recover](reconcile-and-recover.md).

docs/fleet/operations/upgrade-assets.md

@@ -1,18 +0,0 @@
-# Upgrade and Installed-Asset Drift
-
-Fleet source assets and installed assets can differ after an update, but FCM-M5-001 does not add a trustworthy source-versus-installed revision detector or refresh command. Do not infer freshness from checkout presence, timestamps, generated environment files, running sessions, or a ready migration preview.
-
-## Current safe boundary
-
-- The canonical roster remains authority and must survive package/framework refresh.
-- Generated projections are rebuilt from that roster after the installed contract is independently verified.
-- Operator `roles.local`, `.env.local`, and private quarantine evidence are not generated assets and must not be overwritten.
-- Baseline roles, schemas, examples, service presets, launcher helpers, and systemd templates must move as one reviewed release set.
-- Remote/connector inventory and `mos-comms` are not promoted into permanent architecture by an update.
-- No update may start an agent persisted stopped, adopt an unmanaged session, or bypass generation/ownership checks.
-
-## Explicit hold
-
-FCM-M5-002 owns deterministic asset-drift checks, safe package/update refresh evidence, rolling local canary, independent validation certificate, and release evidence. Until that card lands, this page is an operational hold rather than an executable procedure: use the repository/release review path, preserve backups, and do not claim source/installed parity without exact revision evidence from the future validator.
-
-See [approved deferrals](../../reports/deferred/758-fleet-config-deferrals.md) and [backup/restore boundary](backup-restore.md).

docs/fleet/reference/agent-mutations.md

@@ -4,17 +4,17 @@ FCM-M2-002 provides local roster-v2 create, get, update, delete, and plan operat
 
 ## CLI contract
 
-The commands operate only on the canonical <mosaic-home>/fleet/roster.yaml v2 authority and print one JSON object to stdout. `--agent` is a JSON object with the roster agent fields expressed as `className`, `toolPolicy`, `workingDirectory`, `persistentPersona`, `resetBetweenTasks`, and launch: { "yolo": boolean }.
+The commands operate only on the canonical `<mosaic-home>/fleet/roster.yaml` v2 authority and print one JSON object to stdout. `--agent` is a JSON object with the roster agent fields expressed as `className`, `toolPolicy`, `workingDirectory`, `persistentPersona`, `resetBetweenTasks`, and `launch: { "yolo": boolean }`.
 
-```fleet-synopsis
+```sh
 mosaic fleet get <name>
-mosaic fleet plan <create|update|delete> [<name>] --expected-generation <n> [--agent '<json>'] [--persisted-start]
+mosaic fleet plan <create|update|delete> [name] --expected-generation <n> [--agent '<json>'] [--persisted-start]
 mosaic fleet create --expected-generation <n> --agent '<json>' [--dry-run] [--persisted-start]
 mosaic fleet update <name> --expected-generation <n> --agent '<json>' [--dry-run]
 mosaic fleet delete <name> --expected-generation <n> [--dry-run]
 ```
 
-`get` returns the authoritative generation and the selected agent. plan create derives its name from `--agent`; plan update <name> and plan delete <name> require the target name. `--agent` accepts only the documented roster-v2 request fields and `launch.yolo`; unknown keys such as commands, channels, or secret references are rejected. Rejection diagnostics return only the stable `invalid-request` code and never echo a rejected value. `plan` and `--dry-run` validate the complete proposed roster and projections but write neither the roster nor projections. `--persisted-start` is available only for a create request: it records desired_state: running, but does not start a process. Without it, create records enabled: true and desired_state: stopped. Handled failures return JSON with `error.code` and exit non-zero; unclassified validation/projection failures use the redacted `mutation-failed` code.
+`get` returns the authoritative generation and the selected agent. `plan create` derives its name from `--agent`; `plan update <name>` and `plan delete <name>` require the target name. `--agent` accepts only the documented roster-v2 request fields and `launch.yolo`; unknown keys such as commands, channels, or secret references are rejected. Rejection diagnostics return only the stable `invalid-request` code and never echo a rejected value. `plan` and `--dry-run` validate the complete proposed roster and projections but write neither the roster nor projections. `--persisted-start` is available only for a create request: it records `desired_state: running`, but does not start a process. Without it, create records `enabled: true` and `desired_state: stopped`. Handled failures return JSON with `error.code` and exit non-zero; unclassified validation/projection failures use the redacted `mutation-failed` code.
 
 ## Generation, validation, and idempotency
 
@@ -22,7 +22,7 @@ Each create, update, or delete request includes `expectedGeneration`. A request
 
 `planFleetAgentMutation` is deterministic and side-effect free. `executeFleetAgentMutation` validates the complete proposed roster through the existing structural and shared persona resolver, prepares generated/local/quarantine projections, and writes the roster authority atomically before applying derived projections. Equivalent create retries and delete requests for an already-absent agent are idempotent no-ops.
 
-Delete removes only the exact <name>.env.generated projection for the removed roster entry. Operator-owned <name>.env.local, legacy <name>.env, quarantine records, and unrelated projections remain untouched. An already-absent generated projection is treated as stale derived state, not as a failed mutation.
+Delete removes only the exact `<name>.env.generated` projection for the removed roster entry. Operator-owned `<name>.env.local`, legacy `<name>.env`, quarantine records, and unrelated projections remain untouched. An already-absent generated projection is treated as stale derived state, not as a failed mutation.
 
 ## Result and recovery
 
@@ -40,4 +40,4 @@ Mutation results are JSON-safe objects with `applied`, `authoritativeRoster`, `p
 }
 ```
 
-Dry-runs and idempotent no-ops report authoritativeRoster: "unchanged" and projections: "not-applied"; a complete mutation reports "committed" and "complete". Recovery output identifies the authoritative roster path and regeneration action only. It never contains generated/local/quarantine values, credentials, or command text. A recovery result exits non-zero because the authoritative roster was persisted but derived projections require regeneration. Regenerate projections from the roster before attempting another mutation.
+Dry-runs and idempotent no-ops report `authoritativeRoster: "unchanged"` and `projections: "not-applied"`; a complete mutation reports `"committed"` and `"complete"`. Recovery output identifies the authoritative roster path and regeneration action only. It never contains generated/local/quarantine values, credentials, or command text. A recovery result exits non-zero because the authoritative roster was persisted but derived projections require regeneration. Regenerate projections from the roster before attempting another mutation.

docs/fleet/reference/cli.md

@@ -1,46 +1,27 @@
 # Fleet Control-Plane CLI
 
-The local desired-state surface is mosaic fleet. It is distinct from the gateway-backed mosaic agent catalog and from legacy compatibility commands that act on roster v1.
+The local roster-v2 control plane is `mosaic fleet`.
 
-## Roster-v2 desired-state commands
-
-| Command                                                    | Effect                                         | Generation | Output                     |
-| ---------------------------------------------------------- | ---------------------------------------------- | ---------- | -------------------------- |
-| mosaic fleet get <name>                                    | Read one authoritative agent                   | no         | One JSON object            |
-| mosaic fleet plan <create\|update\|delete> ...             | Validate proposed CRUD and projections         | required   | One JSON object; no writes |
-| mosaic fleet create ... [--dry-run] [--persisted-start]    | Add desired state; default enabled/stopped     | required   | One JSON object            |
-| mosaic fleet update <name> ... [--dry-run]                 | Replace mutable agent fields                   | required   | One JSON object            |
-| mosaic fleet delete <name> ... [--dry-run]                 | Remove roster member/generated projection      | required   | One JSON object            |
-| mosaic fleet apply ... [--dry-run]                         | Plan or converge projections/lifecycle         | required   | One JSON object            |
-| mosaic fleet reconcile ... [--dry-run]                     | Alias of the same convergence contract         | required   | One JSON object            |
-| mosaic fleet start\|stop\|restart [<name>] ... [--dry-run] | Exact one-shot lifecycle action                | required   | One JSON object            |
-| mosaic fleet status [<name>]                               | Observe desired/managed/runtime state          | no         | One JSON object            |
-| mosaic fleet verify                                        | Strict observational drift/ownership gate      | no         | One JSON object            |
-| mosaic fleet doctor                                        | Classify local drift and recovery context      | no         | One JSON object            |
-| mosaic fleet migrate-v1 preview ...                        | Non-mutating field-complete migration evidence | no         | One JSON object            |
-
-CRUD syntax and full payload shape are documented in [agent mutations](agent-mutations.md). Reconciliation syntax:
-
-```fleet-synopsis
-mosaic fleet apply --expected-generation <n>
-mosaic fleet reconcile --expected-generation <n>
-mosaic fleet start [<name>] --expected-generation <n> [--dry-run]
-mosaic fleet stop [<name>] --expected-generation <n> [--dry-run]
-mosaic fleet restart [<name>] --expected-generation <n> [--dry-run]
-mosaic fleet status [<name>]
+```text
+mosaic fleet apply --expected-generation <n> [--dry-run]
+mosaic fleet reconcile --expected-generation <n> [--dry-run]
+mosaic fleet start [name] --expected-generation <n> [--dry-run]
+mosaic fleet stop [name] --expected-generation <n> [--dry-run]
+mosaic fleet restart [name] --expected-generation <n> [--dry-run]
+mosaic fleet status [name]
 mosaic fleet verify
 mosaic fleet doctor
 mosaic fleet migrate-v1 preview --source <path> --decisions <path> --observations <path>
 ```
 
-`get` is the read/show operation for one v2 agent. Full roster parsing and semantic validation occur on every v2 mutation/reconcile path; there is no separate mutable “config store.” The executable JSON Schema and validated example provide offline structural evidence. The PRD requires an explicit programmatic mosaic fleet validate operation, but the current CLI does not expose one; do not substitute another command or claim that requirement is delivered. This remains an implementation gap for #758.
+`migrate-v1 preview` is non-mutating: it emits value-free v1 inventory, a canonical semantically
+validated v2 candidate when ready, sanitized environment dispositions, and non-executable recovery
+evidence. It has no write, apply, canary, or rollback option. Missing preview inputs also return one stable
+blocked JSON object and a non-zero exit, rather than Commander text. See
+[the migration preview contract](../migration/v1-to-v2.md).
 
-## JSON and exit behavior
+`apply` and `reconcile` use roster desired state. `start`, `stop`, and `restart` are exact local one-shot lifecycle effects and never persist a desired-state edit. `status`, `verify`, and `doctor` are observational.
 
-Roster-v2 CRUD and reconciler precondition failures emit { "error": { "code": "..." } } and exit non-zero. Migration preview has its own result envelope: a non-ready preview emits { "status": "blocked", "blockers": [...] } and exits non-zero rather than using the CRUD/reconciler error object. Use both exit status and command-specific state fields. A partial reconciliation result distinguishes `authoritativeRoster`, `projections`, `lifecycle`, `recovery`, and optional `cleanup`; it never claims automatic rollback. `verify` exits non-zero for drift, ownership failure, or unmanaged sessions. Sensitive legacy values, credentials, and rejected command text are never printed.
+Commands emit one JSON object. Handled precondition errors emit `{ "error": { "code": "..." } }` and exit non-zero. Partial derived/lifecycle effects use explicit `authoritativeRoster`, `projections`, `lifecycle`, and bounded `recovery` fields; they never claim rollback. Any additive `cleanup` diagnostic also exits non-zero, even where known effects are complete: it is not a clean completion and the lock requires inspection before retry.
 
-## Compatibility and scope
-
-Roster-v1 initialization, provisioning, profiles/personas, and historical fleet add/remove remain compatibility surfaces, not roster-v2 CRUD aliases. New v2 automation should use the table above. migrate-v1 preview writes nothing and has no cutover, canary, or rollback option.
-
-mosaic agent is a separate catalog/transport surface; it does not own <MOSAIC_HOME>/fleet/roster.yaml desired state. Remote/SSH reconciliation, connector mutation, arbitrary commands/channels, secret references, and gateway convergence are rejected or outside scope.
+This control plane is separate from the gateway-backed `mosaic agent` catalog. It is local-only and rejects remote/connector lifecycle mutation, arbitrary command/channel/secret input, and unproven tmux ownership.

docs/fleet/reference/generated-env-boundary.md

@@ -1,6 +1,6 @@
 # Fleet Generated Environment Boundary
 
-**Card:** FCM-M2-001 · **Issue:** #758 · **Status:** merged contract
+**Card:** FCM-M2-001 · **Issue:** #758 · **Status:** unreleased/card-local
 
 The local fleet roster is the desired-state authority. A launch reads a deterministic,
 roster-derived generated projection and an optional strictly data-only local file; neither file is
@@ -8,14 +8,14 @@ a second roster or a command configuration surface.
 
 ## Paths and ownership
 
-For agent <name> under <MOSAIC_HOME>/fleet/agents/:
+For agent `<name>` under `<MOSAIC_HOME>/fleet/agents/`:
 
-| Path                  | Owner                    | Purpose                                                                                                                      |
-| --------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
-| <name>.env.generated  | Mosaic projection writer | Complete deterministic launch data rendered from the authoritative roster.                                                   |
-| <name>.env.local      | Operator                 | Optional, constrained local machine data. It cannot shadow generated keys.                                                   |
-| <name>.env            | Legacy input only        | Read once during projection generation, then regenerated/relocated or privately quarantined. It is never a launch authority. |
-| <name>.env.quarantine | Mosaic quarantine        | Mode-`0600` private record of forbidden legacy input; it is never read by the launcher.                                      |
+| Path                    | Owner                    | Purpose                                                                                                                      |
+| ----------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| `<name>.env.generated`  | Mosaic projection writer | Complete deterministic launch data rendered from the authoritative roster.                                                   |
+| `<name>.env.local`      | Operator                 | Optional, constrained local machine data. It cannot shadow generated keys.                                                   |
+| `<name>.env`            | Legacy input only        | Read once during projection generation, then regenerated/relocated or privately quarantined. It is never a launch authority. |
+| `<name>.env.quarantine` | Mosaic quarantine        | Mode-`0600` private record of forbidden legacy input; it is never read by the launcher.                                      |
 
 The systemd templates do not load either environment file. They invoke Bash with a fixed, cleared
 bootstrap environment; the launcher reads and validates `.env.generated` and `.env.local` itself before
@@ -44,7 +44,7 @@ MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
 MOSAIC_TMUX_SOCKET=<roster socket or empty>
 ```
 
-The generated launch contract supports only `claude`, `codex`, `opencode`, and `pi`. fleet add
+The generated launch contract supports only `claude`, `codex`, `opencode`, and `pi`. `fleet add`
 uses that same runtime authority and rejects any other runtime before it writes the roster or changes
 projection, local, or quarantine files. The legacy dogfood stub on its separate `mosaic-factory`
 socket remains an observability canary; it has no generated-launch adapter and cannot be added through
@@ -62,7 +62,7 @@ Local paths must be safe absolute paths and the interval must be a positive inte
 quoted/export syntax, duplicate keys, unknown keys, generated-key shadowing, sensitive key names,
 and `MOSAIC_AGENT_COMMAND` are rejected. The launcher derives the only executable command from the
 validated runtime, model, and reasoning data; no arbitrary command compatibility path exists. When a
-Pi runtime writes a fresh <name>.hb.native marker, its native heartbeat remains authoritative; the
+Pi runtime writes a fresh `<name>.hb.native` marker, its native heartbeat remains authoritative; the
 shell sidecar resumes its `status=ok` fallback only after that marker is stale or absent.
 
 ## Legacy disposition
@@ -78,14 +78,14 @@ This card does not add a USC site file, write a USC roster, or run a site canary
 consolidated downstream interface packet. Status is deliberately separated from checkout presence: no
 product release version has been evidenced for this interface set.
 
-| Interface               | Canonical public path and version                                                                                                               | Tracker/release status                                                                                    | Downstream limit                                                                              |
-| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| M1 structural compiler  | `parseRosterV2` in `packages/mosaic/src/fleet/roster-v2.ts`; schema `docs/fleet/reference/roster-v2.schema.json`; roster version: 2             | FCM-M1-001 is recorded done, merged as #764 (`aa5b43b`); no released product version is asserted here.    | Parse YAML/JSON and canonicalize a supplied v2 site roster without writes.                    |
-| M1 semantic resolver    | `validateRosterV2Semantics` in `packages/mosaic/src/fleet/roster-v2.ts`; baseline `framework/fleet/roles/` plus `roles.local/`                  | FCM-M1-002 merged as #768 (`a5e8e55`); no released product version is asserted here.                      | Reuse the shared resolver only; no parallel role resolver or lifecycle action.                |
-| M1 disposition evidence | `packages/mosaic/src/fleet/example-profile-dispositions.ts`; `docs/fleet/migration/example-profile-disposition.md`; retained fixture version: 1 | FCM-M1-003 merged as #770 (`e9c4aa3`); checkout evidence remains validation, not migration authorization. | Inspect fixture/profile/service disposition evidence only; it is not migration authorization. |
-| M2 generated boundary   | `packages/mosaic/src/fleet/generated-env-boundary.ts`; generated projection contract in this document                                           | FCM-M2-001 merged as #772 (`191efae`); no released product version is asserted here.                      | Render/write a roster-derived projection; local input is never authority.                     |
+| Interface               | Canonical public path and version                                                                                                                 | Tracker/release status                                                                                                | Downstream limit                                                                              |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| M1 structural compiler  | `parseRosterV2` in `packages/mosaic/src/fleet/roster-v2.ts`; schema `docs/fleet/reference/roster-v2.schema.json`; roster `version: 2`             | FCM-M1-001 is recorded done, merged as #764 (`aa5b43b`); no released product version is asserted here.                | Parse YAML/JSON and canonicalize a supplied v2 site roster without writes.                    |
+| M1 semantic resolver    | `validateRosterV2Semantics` in `packages/mosaic/src/fleet/roster-v2.ts`; baseline `framework/fleet/roles/` plus `roles.local/`                    | FCM-M1-002 remains `in-progress` in `docs/TASKS.md`; unreleased.                                                      | Reuse the shared resolver only; no parallel role resolver or lifecycle action.                |
+| M1 disposition evidence | `packages/mosaic/src/fleet/example-profile-dispositions.ts`; `docs/fleet/migration/example-profile-disposition.md`; retained fixture `version: 1` | FCM-M1-003 remains `not-started` in `docs/TASKS.md`; unreleased even though these checkout artifacts are inspectable. | Inspect fixture/profile/service disposition evidence only; it is not migration authorization. |
+| M2 generated boundary   | `packages/mosaic/src/fleet/generated-env-boundary.ts`; generated projection contract in this document                                             | FCM-M2-001 card-local and uncommitted; unreleased.                                                                    | Render/write a roster-derived projection; local input is never authority.                     |
 
-The canonical source remains <MOSAIC_HOME>/fleet/roster.yaml for the current local fleet path.
+The canonical source remains `<MOSAIC_HOME>/fleet/roster.yaml` for the current local fleet path.
 Generated environment data is a rebuildable projection, not an operator-editable source of membership,
 runtime policy, or lifecycle state.
 

docs/fleet/reference/lifecycle-transitions.md

@@ -1,21 +1,14 @@
 # Local Fleet Lifecycle Transitions
 
-Roster-v2 `lifecycle.enabled` and `lifecycle.desired_state` are the only persisted lifecycle authority. Systemd, tmux, generated environment, and heartbeat state are derived or observed.
+FCM-M3-001 uses the roster-v2 `lifecycle.enabled` and `lifecycle.desired_state` fields as the only desired-state authority. Systemd, tmux, generated environment files, and heartbeats are derived or observed state.
 
-| Event                     | Desired-state write                                                        | Runtime effect                                                                              | Safety boundary                                                                                                                                             |
-| ------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| fleet create              | Adds enabled/stopped by default; `--persisted-start` records running       | None                                                                                        | Generation-guarded; validates full roster/projections.                                                                                                      |
-| fleet update              | Preserves the existing enabled/desired state; updates other mutable fields | None                                                                                        | Generation-guarded; stable name and lifecycle are immutable on this path.                                                                                   |
-| fleet delete              | Removes exact roster member                                                | None                                                                                        | Removes only generated projection; retains local/quarantine evidence.                                                                                       |
-| fleet apply / `reconcile` | Never                                                                      | Rebuilds projections; starts only enabled/running; stops disabled or stopped roster members | Current generation, private lock/paths, semantic validity, holder ownership, no unmanaged named-socket sessions.                                            |
-| fleet start <name>        | Never                                                                      | One-shot exact service start                                                                | Exact enabled roster name and proven ownership.                                                                                                             |
-| fleet stop <name>         | Never                                                                      | One-shot exact service stop                                                                 | Exact roster name and proven ownership.                                                                                                                     |
-| fleet restart <name>      | Never                                                                      | One-shot exact service restart                                                              | Exact enabled roster name and proven ownership.                                                                                                             |
-| Reboot/service activation | Never                                                                      | Current installation may activate enabled units without honoring roster lifecycle           | **Held for FCM-M3-002:** boot preservation for stopped/disabled agents is not yet proven; inspect/disable units rather than assuming lifecycle-safe reboot. |
-| v1 migration preview      | Never                                                                      | None                                                                                        | Observed active+present maps running; inactive+missing maps stopped; ambiguity blocks.                                                                      |
-| Cutover/canary            | Held for FCM-M4-002                                                        | Not implemented by preview                                                                  | Must preserve every observed stopped state.                                                                                                                 |
-| Rollback                  | Held for FCM-M4-002                                                        | Not implemented                                                                             | Must restore selected authority/projections without surprise starts or unmanaged targeting.                                                                 |
+| Command                           | Desired-state write | Runtime effect                                                                                                             | Preconditions                                                                                                             |
+| --------------------------------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
+| `fleet apply` / `fleet reconcile` | Never               | Rebuilds projections, then starts only enabled agents desired `running`; stops disabled or desired-`stopped` roster agents | Current generation; private managed paths; valid projections; proven holder ownership; no unmanaged named-socket sessions |
+| `fleet start <name>`              | Never               | One-shot exact `mosaic-agent@<name>.service` start                                                                         | Current generation; exact enabled roster name; proven ownership                                                           |
+| `fleet stop <name>`               | Never               | One-shot exact service stop                                                                                                | Current generation; exact roster name; proven ownership                                                                   |
+| `fleet restart <name>`            | Never               | One-shot exact service restart                                                                                             | Current generation; exact roster name; proven ownership                                                                   |
 
-Explicit apply/reconcile never starts a stopped roster agent. Direct lifecycle commands are explicit one-shot actions and do not persist intent. The current update operation preserves `existing.lifecycle`; there is no delivered generation-guarded CRUD operation for changing durable lifecycle after creation. Reboot preservation for stopped/disabled agents is not yet guaranteed because current enabled units and launcher projections do not carry the persisted lifecycle fence; that acceptance evidence remains FCM-M3-002.
+A stopped roster agent is never started by `apply` or `reconcile`. Direct lifecycle commands are explicit one-shot actions and do not change persisted desired state. Use roster CRUD with the explicit persisted-start option to change that desired state.
 
-Missing/stale generation, concurrent writer, unsafe path, ownership mismatch, unmanaged session, unsupported runtime, invalid projection, and lifecycle precondition failures return stable redacted JSON and non-zero status. No command targets fuzzy names, arbitrary sockets/commands/channels/secrets, or generated files as authority. Legacy sensitive values are never printed.
+All mutations require `--expected-generation <n>` and acquire one private roster-adjacent reconciliation lock before projection or lifecycle effects. Missing or stale generations and concurrent writers fail before effects; the lock is released after success, partial failure, or thrown lifecycle failure. Stale, ownership, unmanaged-session, unsupported-runtime, path, projection, and lifecycle-precondition failures return stable redacted JSON errors and a non-zero exit. No command targets a fuzzy tmux name, arbitrary socket, arbitrary command, channel, secret, or generated file as authority.

docs/fleet/reference/role-classes.md

@@ -16,7 +16,7 @@ Only these legacy class aliases are recognized:
 
 No other alias is inferred. In particular, `worker`, `analyst`, and `canary` are custom classes only
 when an operator supplies a readable contract for that exact class. Tess and Ultron are instance
-names, not classes. agents[].alias is display-only and cannot grant authority.
+names, not classes. `agents[].alias` is display-only and cannot grant authority.
 
 Canonicalization happens before role lookup. For example, requesting `implementer` resolves
 `code.md`; a separate `roles.local/implementer.md` cannot redefine the legacy alias. A canonical

docs/fleet/reference/roster-v2-fields.md

@@ -50,38 +50,36 @@ agents:
 
 ## Root fields
 
-| Field        | Required | Default | Constraint            | Meaning                                                                                           |
-| ------------ | -------- | ------- | --------------------- | ------------------------------------------------------------------------------------------------- |
-| `version`    | yes      | none    | integer constant `2`  | Identifies this contract. Version `1` stays on the compatibility path pending explicit migration. |
-| `generation` | yes      | none    | positive safe integer | Desired-state generation and mutation/reconcile concurrency fence.                                |
-| `transport`  | yes      | none    | constant `tmux`       | M1–M5 support local tmux only.                                                                    |
-| `tmux`       | yes      | none    | strict object         | Explicit local socket and holder-session configuration.                                           |
-| `defaults`   | yes      | none    | strict object         | Default work directory and one supported local runtime.                                           |
-| `runtimes`   | yes      | none    | non-empty object      | Declared local runtime reset policy map.                                                          |
-| `agents`     | yes      | none    | non-empty array       | Local fleet entries. Duplicate stable names are rejected.                                         |
+| Field        | Required | Constraint            | Meaning                                                                                                                               |
+| ------------ | -------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `version`    | yes      | integer constant `2`  | Identifies this contract. Version `1` is explicitly rejected by this compiler and remains on the existing v1 path until M4 migration. |
+| `generation` | yes      | positive safe integer | Desired-state generation. M2 uses it for mutation guards; M1 does not mutate it.                                                      |
+| `transport`  | yes      | constant `tmux`       | M1–M5 support local tmux only.                                                                                                        |
+| `tmux`       | yes      | strict object         | Explicit local socket and holder-session configuration.                                                                               |
+| `defaults`   | yes      | strict object         | Default work directory and one supported local runtime.                                                                               |
+| `runtimes`   | yes      | non-empty object      | Declared local runtime reset policy map.                                                                                              |
+| `agents`     | yes      | non-empty array       | Local fleet entries. Duplicate stable names are rejected.                                                                             |
 
 ## Nested fields
 
-All nested fields in the v2 schema are required and have no implicit default. CRUD `create` is the only higher-level convenience: it records lifecycle.enabled: true and desired_state: stopped unless `--persisted-start` explicitly records running. That convenience still performs no runtime action.
-
-| Path                                               | Required | Constraint                                                                                                   |
-| -------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------ |
-| `tmux.socket_name`                                 | yes      | [A-Za-z0-9_.-]\*; empty string means the literal default tmux server, while a non-empty value names a socket |
-| `tmux.holder_session`                              | yes      | non-empty [A-Za-z0-9_.-]+                                                                                    |
-| `defaults.working_directory`                       | yes      | non-empty string                                                                                             |
-| `defaults.runtime`                                 | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                                    |
-| runtimes.<runtime>.reset_command                   | yes      | non-empty string; runtime key must be a supported local runtime                                              |
-| agents[].name                                      | yes      | unique [A-Za-z0-9][A-Za-z0-9_.-]\* stable machine identity                                                   |
-| agents[].alias                                     | yes      | non-empty display string                                                                                     |
-| agents[].class                                     | yes      | [a-z][a-z0-9-]\*; structural only in M1, semantic role resolution is FCM-M1-002                              |
-| agents[].runtime                                   | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                                    |
-| agents[].provider, `model`, `working_directory`    | yes      | non-empty strings; provider/model capability resolution is a later card                                      |
-| agents[].reasoning                                 | yes      | `low`, `medium`, or `high`                                                                                   |
-| agents[].tool_policy                               | yes      | [a-z][a-z0-9-]\*; structural only in M1                                                                      |
-| agents[].persistent_persona, `reset_between_tasks` | yes      | booleans                                                                                                     |
-| agents[].lifecycle.enabled                         | yes      | boolean; stored now, reconciled in FCM-M3-001                                                                |
-| agents[].lifecycle.desired_state                   | yes      | `running` or `stopped`                                                                                       |
-| agents[].launch.yolo                               | yes      | boolean; structured data only, not an arbitrary command escape hatch                                         |
+| Path                                                 | Required | Constraint                                                                                                    |
+| ---------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------- |
+| `tmux.socket_name`                                   | yes      | `[A-Za-z0-9_.-]*`; empty string means the literal default tmux server, while a non-empty value names a socket |
+| `tmux.holder_session`                                | yes      | non-empty `[A-Za-z0-9_.-]+`                                                                                   |
+| `defaults.working_directory`                         | yes      | non-empty string                                                                                              |
+| `defaults.runtime`                                   | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                                     |
+| `runtimes.<runtime>.reset_command`                   | yes      | non-empty string; runtime key must be a supported local runtime                                               |
+| `agents[].name`                                      | yes      | unique `[A-Za-z0-9][A-Za-z0-9_.-]*` stable machine identity                                                   |
+| `agents[].alias`                                     | yes      | non-empty display string                                                                                      |
+| `agents[].class`                                     | yes      | `[a-z][a-z0-9-]*`; structural only in M1, semantic role resolution is FCM-M1-002                              |
+| `agents[].runtime`                                   | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                                     |
+| `agents[].provider`, `model`, `working_directory`    | yes      | non-empty strings; provider/model capability resolution is a later card                                       |
+| `agents[].reasoning`                                 | yes      | `low`, `medium`, or `high`                                                                                    |
+| `agents[].tool_policy`                               | yes      | `[a-z][a-z0-9-]*`; structural only in M1                                                                      |
+| `agents[].persistent_persona`, `reset_between_tasks` | yes      | booleans                                                                                                      |
+| `agents[].lifecycle.enabled`                         | yes      | boolean; stored now, reconciled in FCM-M3-001                                                                 |
+| `agents[].lifecycle.desired_state`                   | yes      | `running` or `stopped`                                                                                        |
+| `agents[].launch.yolo`                               | yes      | boolean; structured data only, not an arbitrary command escape hatch                                          |
 
 ## Semantic handoff
 
@@ -99,12 +97,12 @@ Semantic validation:
   `operator-interaction` to `interaction`;
 - canonicalizes `tool_policy` with the same exact alias table;
 - rejects protected class/tool-policy mismatches in either direction, while accepting
-  class: operator-interaction with tool_policy: operator-interaction as canonical
+  `class: operator-interaction` with `tool_policy: operator-interaction` as canonical
   `interaction`;
 - derives immutable protected authority only from canonical class; and
 - accepts custom baseline or `roles.local` classes without granting protected authority.
 
-agents[].alias remains display-only. Tess and Ultron are instance names, never semantic classes.
+`agents[].alias` remains display-only. Tess and Ultron are instance names, never semantic classes.
 Canonicalization happens before role-layer lookup, so a legacy-named override cannot redefine an
 alias as separate authority. See [Role Classes and Authority](./role-classes.md) and
 [Customize Fleet Roles](../how-to/customize-roles.md).
@@ -114,7 +112,7 @@ lifecycle mutation.
 
 ## Fail-closed boundary
 
-Every object is additionalProperties: false. The compiler rejects unknown, missing, malformed,
+Every object is `additionalProperties: false`. The compiler rejects unknown, missing, malformed,
 and wrong-type fields before producing a model. It specifically rejects remote/SSH/host/socket
 per-agent fields, connector blocks, secret references, channel fields, arbitrary command fields,
 and gateway fields because they are unsupported in the local-tmux M1 contract. It does not silently

docs/fleet/reference/status-and-drift.md

@@ -1,25 +1,13 @@
 # Local Fleet Status and Drift
 
-mosaic fleet status [<name>], `verify`, and `doctor` are observational roster-v2 commands. They emit one JSON result and do not write projections, mutate desired state, operate lifecycle, or change tmux.
+`mosaic fleet status [name]`, `verify`, and `doctor` are observational roster-v2 commands. They emit one JSON result and do not write projections, change desired state, start services, stop services, restart services, or mutate tmux.
 
-## State dimensions
+The report distinguishes:
 
-- **Desired:** roster membership, generation, enabled flag, and persisted running/stopped target.
-- **Managed/derived:** generated environment and expected exact service/session topology.
-- **Observed by current roster-v2 commands:** systemd active state, tmux presence, exact holder ownership, and unmanaged sessions.
+- `missing-session`: an enabled agent desired `running` has no exact roster-named tmux session.
+- `unexpected-session`: a desired-`stopped` agent still has its exact session.
+- `disabled-running`: a disabled roster agent has its exact session.
+- `unmanagedSessions`: sessions on the configured named socket that are neither the exact holder nor an exact roster agent.
+- `holder`: `owned`, `missing`, or `ownership-mismatch` after exact holder, private install identity, and complete global tmux environment validation.
 
-Implemented drift classifications include:
-
-- `missing-session`: enabled/desired-running agent lacks its exact session;
-- `unexpected-session`: desired-stopped agent has its exact session;
-- `disabled-running`: disabled roster agent has its exact session;
-- `unmanagedSessions`: named-socket sessions that are neither exact holder nor roster agent;
-- `holder`: `owned`, `missing`, or `ownership-mismatch` after private identity and global environment checks.
-
-Generated projection failures/staleness are surfaced by plan/apply preparation and bounded recovery fields rather than adopted as configuration. Heartbeat remains wider-fleet observational evidence, never desired state, but the current roster-v2 `status`, `doctor`, and `verify` commands do not read heartbeat files. A provable removed-agent projection may be treated as stale derived state during deletion, but general projection-orphan classification and installed source-versus-asset revision mismatch remain FCM-M4-002/M5-002 holds; current commands must not claim those future checks.
-
-## Command behavior
-
-`status` and `doctor` classify rather than adopt, destroy, or repair. `verify` is observational too, but exits non-zero if ownership cannot be proven, unmanaged sessions exist, or drift is present. Reconciliation fails closed under those conditions and never kills or adopts an unmanaged session.
-
-Doctor/error output uses stable codes and bounded recovery context. Migration, quarantine, lifecycle, status, and troubleshooting output never prints a legacy sensitive value, credential, or privileged command text.
+`doctor` and `status` classify rather than adopt, destroy, or repair unmanaged state. `verify` is observational too, but exits non-zero if ownership cannot be proven, unmanaged sessions exist, or drift is present. Reconciliation fails closed under those conditions and never kills or adopts an unmanaged session.

docs/guides/dev-guide.md

@@ -8,9 +8,8 @@
 4. [Adding New Agent Tools](#adding-new-agent-tools)
 5. [Adding New MCP Tools](#adding-new-mcp-tools)
 6. [Database Schema and Migrations](#database-schema-and-migrations)
-7. [Claude Code Skill Bridge](#claude-code-skill-bridge)
-8. [API Endpoint Reference](#api-endpoint-reference)
-9. [Local Fleet Canary](./fleet-local-canary.md)
+7. [API Endpoint Reference](#api-endpoint-reference)
+8. [Local Fleet Canary](./fleet-local-canary.md)
 
 ---
 
@@ -354,37 +353,6 @@ defined there.
 
 ---
 
-## Claude Code Skill Bridge
-
-The framework's canonical skill root is `~/.config/mosaic/skills/`; Claude Code
-requires registrations under `~/.claude/skills/`. The implementation in
-`packages/mosaic/src/commands/skill.ts` owns only direct-child symlinks whose
-resolved target remains inside the canonical root.
-
-Security invariants:
-
-1. Validate the user-supplied name before filesystem access against
-   `[A-Za-z0-9][A-Za-z0-9._-]*`. Separators, control characters, whitespace,
-   `..`, absolute paths, and leading `-` are invalid; filesystem-derived invalid
-   names are escaped before terminal output.
-2. Never replace a real file, directory, foreign symlink, or live misdirected
-   symlink in the Claude skill directory.
-3. Repair a dangling link only when its lexical target is inside the canonical
-   Mosaic skills root.
-4. Unregister only a symlink pointing inside that root.
-5. Enumerate canonical directories at runtime; never hardcode framework skill
-   names.
-
-`finalizeStage` reconciles after wizard/framework synchronization, and
-`runFrameworkReseed` reconciles after the sync-only `mosaic update` path. A
-foreign conflict is reported but does not prevent unrelated canonical skills
-from registering. Filesystem tests use injected temporary roots in
-`skill.spec.ts`, `finalize-skills.spec.ts`, and `update-checker.reseed.spec.ts`.
-
-M1 intentionally manages Claude Code only. Pi's Mosaic launcher can discover the
-canonical root directly. Codex still relies on the existing full skill-sync
-linker and needs separate parity analysis before this lifecycle API is extended.
-
 ## API Endpoint Reference
 
 All endpoints are served by the gateway at `http://localhost:14242` by default.

docs/guides/lease-broker-operations.md

@@ -1,44 +0,0 @@
-# Lease broker operations
-
-Place the socket and state file in a dedicated directory with mode `0700`. Start the packaged daemon with:
-
-```bash
-python3 "$MOSAIC_HOME/tools/lease-broker/daemon.py" \
-  --socket /run/user/1000/mosaic-lease/broker.sock \
-  --state /run/user/1000/mosaic-lease/state.json
-```
-
-The broker refuses an existing parent directory whose mode is not exactly `0700`, an existing state file not at `0600`, corrupt/incompatible state, or an already-existing socket path. After bind it sets the socket to `0600`. It never silently unlinks a pre-existing socket. On normal termination it unlinks only the socket inode it created, so it does not remove a replacement path.
-
-Before launching Claude, Claudex, or Pi, export the socket path; `mosaic` then runs the runtime through the packaged register-and-exec wrapper:
-
-```bash
-export MOSAIC_LEASE_BROKER_SOCKET=/run/user/1000/mosaic-lease/broker.sock
-mosaic claude # or: mosaic claudex, mosaic yolo claudex, mosaic pi
-```
-
-The wrapper obtains a broker-minted session ID, creates a private `generation-<session>.state` file beside the socket, and `exec`s the runtime without changing its PID/starttime anchor. The all-tools Claude `PreToolUse` hook and Pi `tool_call` handler inherit that identity and read the current generation from the file. Claudex retains its isolated proxy environment and config directory; Mosaic merges the mandatory all-tools and compaction-lifecycle hooks into that isolated `settings.json` before invoking the same wrapper. PRDY init/update, QA remediation, coord, orchestrator, and fleet launchers also converge on this boundary. Broker registration failure, unsafe isolated settings, unsafe generation state, or missing identity denies launch/tool execution fail-closed; broker timeout/unavailability and malformed replies also block tools.
-
-Claude `PreCompact` and `SessionStart(compact)` hooks and Pi pre-/post-compaction handlers invoke `revoke-lease.py`. Pi `session_start` reload/new/resume/fork and Claude resume/clear advance the locked generation before revocation, so a replacement session inherits no lease even when PID/starttime stay unchanged. Do not invoke the revoker manually as a way to restore authority; it only removes authority. If a lifecycle hook reports failure, stop consequential work and repair broker/generation-state availability before re-verification.
-
-Run the permanent launch inventory locally with:
-
-```bash
-python3 packages/mosaic/framework/tools/lease-broker/check-runtime-launches.py --root .
-```
-
-The same check runs in the Mosaic package test suite and therefore in root CI. Any direct Claude/Pi binary launch must be replaced with `launch-runtime.py`, `execLeaseGatedRuntime`, or the gated `mosaic` runtime command; do not add static allowlist exceptions.
-
-Clients must complete the request boundary before waiting for a reply. After sending the single JSON object and its terminating newline, the client **MUST half-close the socket's write side** (`shutdown(SHUT_WR)` in POSIX clients; `socket.end()` in Node) and only then await the response. Merely calling `write()` and waiting is invalid: the broker waits for EOF to enforce the exact-one-frame contract and fails closed at its one-second deadline. Do not replace `end()` with `write()` in client helpers. A delayed second frame remains malformed and is rejected.
-
-`mosaic_context_recover` is the only unverified mutator class. Its durable `mosaic-context-refresh` skill is a thin wrapper over `tools/lease-broker/recover-context.py`: `begin` has the broker rebuild the validated `B_payload`/`H_payload`, revoke first, and mint a new `PENDING_DELIVERY` receipt challenge; `complete` accepts neither receipt text nor a challenge argument. Claude maps only the exact direct recovery executable/validated arguments to this exempt tool identity; ordinary `Bash` remains gated. Pi exposes only the `mosaic_context_recover` custom tool; ordinary `bash` and all other tools remain gated. A normal-path receipt cannot be replayed through recovery because each retry begins a distinct recovery cycle and recovery completion cannot receive caller-presented evidence.
-
-Production daemon startup creates a separate private observer socket unless a test-only `--test-observer-file` fixture is selected. Claude's Stop hook sends its exact latest assistant entry and Pi's `message_end` handler sends only finalized assistant content to that authenticated transport; the broker public socket never accepts message text. This is byte-build and private out-of-process harness wiring only: do not activate it against a live daemon, live socket, systemd service, tmux session, or model-output stream outside the controlled integration procedure.
-
-Receipt honesty is load-bearing: absent, malformed, prefix-truncated, and observable adapter-mutated terminal receipts do not promote. A tail-only case is non-promoting only where the concrete terminal payload is malformed or observably incomplete. A tail-preserving middle drop is **not receipt-detectable**; it is the disclosed T-C injection-contract residual deferred to WI-7 server-side evidence. The receipt remains a T-A delivery/liveness prerequisite, never a safety, obedience, or residency proof. The framework skill is source-resident and bridge-projected on install/upgrade; do not hand-create a live runtime symlink.
-
-After a runtime exits, its `generation-<session>.state` file may be removed only after verifying that no process for that broker-minted session remains; stale files carry no lease authority but should be retained during incident analysis. After a broker crash, preserve the protected state file and restart only after verifying that no broker owns the socket. Restart intentionally clears all volatile VERIFIED leases. A leftover socket requires an operator to verify the owning service is stopped and remove that exact socket deliberately. Corrupt, oversized, symlinked, or non-regular state fails closed; do not overwrite it. Preserve it for incident review and establish new state only through an explicit operational decision, which invalidates prior sessions and tokens.
-
-## Security posture
-
-Directory `0700` plus socket/state `0600` is built-in same-principal hardening only: it excludes other UIDs but does **not** stop the same UID from unlinking and counterfeiting the socket. It therefore does not close T-C same-UID replacement. WI-1 does not provide a distinct-principal boundary. A stronger distinct-principal deployment requires an external protected proxy, ACL, or service boundary that clients cannot unlink or rebind and that preserves the authenticated client identity required by the broker's `SO_PEERCRED` and ancestry checks. Server-side branch protection remains the irreducible backstop.

docs/guides/user-guide.md

@@ -183,8 +183,6 @@ non-interactive use:
 --no-auto-launch    # Skip auto-launch of wizard after install
 ```
 
-Unrecognized flags or positional arguments fail before installation starts and print the supported-option usage.
-
 Or if installed globally:
 
 ```bash
@@ -309,39 +307,6 @@ mosaic quality-rails
 
 ---
 
-### Claude Code Skill Registration
-
-Mosaic stores canonical skills under `~/.config/mosaic/skills/`. Claude Code scans
-`~/.claude/skills/`, so Mosaic maintains one symlink per skill between those
-directories.
-
-```bash
-mosaic skill list
-mosaic skill register <name>
-mosaic skill unregister <name>
-```
-
-- `register` is idempotent and repairs a dangling Mosaic-owned link. Names use
-  the safe grammar `[A-Za-z0-9][A-Za-z0-9._-]*`; files, directories, foreign
-  symlinks, path traversal, absolute paths, and names beginning with `-` are
-  refused.
-- `unregister` is idempotent when no entry exists. It removes only symlinks that
-  point inside `~/.config/mosaic/skills/`; foreign entries are never removed.
-- `list` reports `registered`, `unregistered`, `dangling`, `foreign`,
-  `foreign-dangling`, or `misdirected` for each canonical or Claude entry.
-
-Install, wizard finalization, and `mosaic update` framework re-seeding reconcile
-every canonical skill automatically. A skill directory added after initial
-setup therefore receives its Claude bridge without a per-skill code change or
-manual `ln -s`. If Claude Code is already running, use `/reload-skills` or start
-a new session after registration so its in-process skill registry rescans.
-
-This command group is Claude-only in M1. Pi can consume Mosaic's canonical skill
-root through its Mosaic launcher configuration and does not need this Claude
-bridge. Codex has a separate link path managed by the legacy full skill-sync
-script; equivalent lifecycle management remains follow-up scope and is not
-changed here.
-
 ## Sub-package Commands
 
 Each Mosaic sub-package exposes its full API surface through the `mosaic` CLI.

docs/native-kanban-sot/INDEX.md

@@ -12,7 +12,6 @@
 | [`MISSION-MANIFEST.md`](./MISSION-MANIFEST.md)                                                                 | Mission/authority boundaries, exact role chain, gate model, mandatory SecReview triggers, Certifier final/no-merge rule, and collision-free slice ownership                                                                                                                                                                                                                                                                                                                                                                                 |
 | [`TASKS.md`](./TASKS.md)                                                                                       | Dependency-ordered, bounded P0–P3 slices with IN/OUT scope, dependencies, shared contracts, file ownership, evidence, and USC coder2/3/4/5 parallelization                                                                                                                                                                                                                                                                                                                                                                                  |
 | [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md)                                                       | rc.16 direct-Drizzle current storage-wrapper hold: legacy N-1/uncertified/non-operative pending -02/-03/-06/-08; exact README commented/user-guide executable forms fail before masking and source-consistency rejects runner-delegation copy; held future bootstrap → TLS/roles → run → verify → readiness; plus prior production boundary, pgvector owner, attestation, inventory, manifests, DDL classifier, TLS/bootstrap, activation, and certification contract; foundation prerequisite of KBN-100 and real-role gate before KBN-105 |
-| [`KBN-101-ENVELOPE-A.md`](./KBN-101-ENVELOPE-A.md)                                                             | KBN-101 Envelope A (v6) — RATIFIED, part of the frozen SSOT: rc.20 declarative sink-RBAC + per-role connection-selection + RLS `WITH CHECK`/`USING` write-source + `FORCE ROW LEVEL SECURITY` + sink-resident `task_status_write_override`; adds owner card KBN-101-10 + responsibility-widenings; authority Jason B1 + Mos OPTION A/Q1/Q2                                                                                                                                                                                                  |
 | [`SHARED-CONTRACT.md`](./SHARED-CONTRACT.md)                                                                   | Remediated v1 integration contract: proof authority, exact failures/routes/DTOs/MCP ownership, concrete current-main field migration map, relational invariants, Coordinator split, recovery delivery                                                                                                                                                                                                                                                                                                                                       |
 | [`contracts/kanban-schema.v1.ts`](./contracts/kanban-schema.v1.ts)                                             | Drizzle target declarations including exact owner/principal membership, project congruence, tags/archive, proposals, persisted assignments, monotonic fences, durable retry, immutable evidence/audit                                                                                                                                                                                                                                                                                                                                       |
 | [`contracts/mechanical-coordinator.v1.ts`](./contracts/mechanical-coordinator.v1.ts)                           | Pure snapshot decision engine separated from persistence/service adapter; ID-bound approvals, bigint-safe fences, durable retry/quarantine, artifact-backed checkpoints, exact failures                                                                                                                                                                                                                                                                                                                                                     |

docs/native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md

@@ -138,24 +138,16 @@ Before any preflight that can decide migration state, `mosaic-db-migrator` acqui
 
 Role creation, passwords, membership, database ownership, certificates, and Vault values are platform/IaC/operator work—not Drizzle/application migrations. Application SQL must not issue credential/role management statements or embed credentials.
 
-| Role                                     | Attributes and ownership                                                                                                                                                                                                                                                    | Membership / session use                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `mosaic_platform_database_owner`         | `NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; platform-only database owner after bootstrap.                                                                                                                                                      | Never granted to application roles.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| external platform bootstrap actor        | Provider/operator/IaC-controlled, externally audited **superuser** identity outside the Mosaic role graph and Vault/application configuration.                                                                                                                              | Creates/transitions the database and roles, then retires from application use. It alone `SET ROLE`s the extension owner for `CREATE EXTENSION`, `ALTER EXTENSION ... UPDATE`, or `ALTER EXTENSION ... SET SCHEMA`, records the action, and `RESET ROLE`s.                                                                                                                                                                                                                                                                         |
-| `mosaic_schema_owner`                    | `NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; owns only `mosaic`/`drizzle` schemas and application/ledger objects. It has only `USAGE` on `mosaic_extensions` for fixed legacy type resolution.                                                  | Never an application login; no ownership, `CREATE`, `ALTER`, `DROP`, extension/member-change, or default-privilege authority in `mosaic_extensions`; its migrator subphase never receives temporary `CREATE` there.                                                                                                                                                                                                                                                                                                               |
-| `mosaic_extension_owner`                 | Dedicated `NOLOGIN SUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS` extension owner, distinct from platform/schema/migrator/runtime. It is used solely to own/maintain untrusted `vector`, `mosaic_extensions`, and every owner-bearing extension member there. | `rolcanlogin=false`, `rolsuper=true`, and **zero members** are catalog-proven. No application role has membership, `SET ROLE`, credential, or inheritable grant. An externally controlled, audited platform-bootstrap **superuser** session alone executes `SET ROLE mosaic_extension_owner` for fresh creation, approved-owner update/relocation, or shadow bootstrap, then `RESET ROLE`; no persistent membership is ever granted.                                                                                              |
-| `mosaic_migrator`                        | `LOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`.                                                                                                                                                                                            | Only `mosaic_schema_owner`; runner verifies `session_user=mosaic_migrator`, `SET ROLE mosaic_schema_owner`, then `current_user=mosaic_schema_owner`.                                                                                                                                                                                                                                                                                                                                                                              |
-| `mosaic_data_importer`                   | `LOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; dedicated data-copy identity, not a DDL or schema owner.                                                                                                                                   | It is used only after runner preparation/verification through the KBN-101-02 file-reference interface. It has no owner/migrator/extension membership and cannot `SET ROLE mosaic_extension_owner`, or `ALTER`/catalog-or-extension-member `UPDATE`/`DROP`/change extension membership. Its bounded data-copy DML is not extension authority.                                                                                                                                                                                      |
-| `mosaic_runtime_capability`              | `NOLOGIN` and no ownership/administrative attributes.                                                                                                                                                                                                                       | Holds only named runtime grants.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `mosaic_runtime`                         | `LOGIN INHERIT` with no ownership/administrative attributes.                                                                                                                                                                                                                | Only `mosaic_runtime_capability WITH INHERIT TRUE, SET FALSE, ADMIN FALSE`; never owner/migrator member.                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `mosaic_runtime_user_capability`         | `NOLOGIN`, no ownership/admin attrs.                                                                                                                                                                                                                                        | Holds the **User (god)** rung's named grants incl. `INSERT(status)`, `UPDATE(status)` + the status-transition RLS `WITH CHECK` policy on `tasks`; **plus the SOLE `INSERT/UPDATE/DELETE` grant on `task_status_write_override`** (B-1); never granted to Orchestrator/base.                                                                                                                                                                                                                                                       |
-| `mosaic_runtime_orchestrator_capability` | `NOLOGIN`, no ownership/admin attrs.                                                                                                                                                                                                                                        | Holds the **Orchestrator (near-god)** rung's grants; identical to User **except** (i) every `tasks` write policy **subqueries** the override table and is REJECTED at the sink when an active User deny row exists for that `(workspace_id, task_id, orchestrator)` (B-1); (ii) `INSERT(status)` is pinned by `WITH CHECK` to a **non-terminal initial status** (N-3) — only User may INSERT an arbitrary/terminal status; (iii) it has only `SELECT` (never write) on the override table. Scope is tier/task-identity only (F6). |
-| `mosaic_runtime_user`                    | **`LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`**, no ownership; **non-owner of every sink table + the override table**.                                                                                                                    | Member of `mosaic_runtime_user_capability` only (`WITH INHERIT TRUE, SET FALSE, ADMIN FALSE`); the connection-selection **User-rung** credential. **[AD-1]** Requires `CONNECT`, denied `TEMPORARY`.                                                                                                                                                                                                                                                                                                                              |
-| `mosaic_runtime_orchestrator`            | **`LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`**, no ownership; **non-owner of every sink table + the override table**.                                                                                                                    | Member of `mosaic_runtime_orchestrator_capability` only (same INHERIT/SET/ADMIN flags); the **Orchestrator-rung** credential. **[AD-1]** Requires `CONNECT`, denied `TEMPORARY`.                                                                                                                                                                                                                                                                                                                                                  |
-
-> The existing `mosaic_runtime` is confirmed already `LOGIN INHERIT` with no admin attrs (frozen L150) and non-owner; it becomes the **others / deny-by-default** base rung. On the sink it retains `SELECT` (workspace-scoped `USING`, B-2), `INSERT (explicit non-status column list)` (F1), and column-level `UPDATE` on **non-status, non-invariant, non-key, non-tenancy** columns only (F7), each `USING` workspace-scoped; it has **no** `INSERT(status)`, **no** `UPDATE(status)`, **no** `DELETE`, **no** `TRUNCATE` on `tasks`, **no** write on the override table, and RLS denies its status/override writes by default. The rung set is **fixed at three**.
->
-> **F2 note:** the three rung LOGIN roles' `NOBYPASSRLS` + `NOSUPERUSER` + **non-ownership** are load-bearing — `FORCE ROW LEVEL SECURITY` collapses for any SUPERUSER/BYPASSRLS role and RLS is silently bypassed by a table **owner**. These attributes are declared in -00 bootstrap, catalog-proven in -00 tests, and re-verified at every checkout by -01 (extended L222 assertion).
+| Role                              | Attributes and ownership                                                                                                                                                                                                                                                    | Membership / session use                                                                                                                                                                                                                                                                                                                                                                                                             |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `mosaic_platform_database_owner`  | `NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; platform-only database owner after bootstrap.                                                                                                                                                      | Never granted to application roles.                                                                                                                                                                                                                                                                                                                                                                                                  |
+| external platform bootstrap actor | Provider/operator/IaC-controlled, externally audited **superuser** identity outside the Mosaic role graph and Vault/application configuration.                                                                                                                              | Creates/transitions the database and roles, then retires from application use. It alone `SET ROLE`s the extension owner for `CREATE EXTENSION`, `ALTER EXTENSION ... UPDATE`, or `ALTER EXTENSION ... SET SCHEMA`, records the action, and `RESET ROLE`s.                                                                                                                                                                            |
+| `mosaic_schema_owner`             | `NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; owns only `mosaic`/`drizzle` schemas and application/ledger objects. It has only `USAGE` on `mosaic_extensions` for fixed legacy type resolution.                                                  | Never an application login; no ownership, `CREATE`, `ALTER`, `DROP`, extension/member-change, or default-privilege authority in `mosaic_extensions`; its migrator subphase never receives temporary `CREATE` there.                                                                                                                                                                                                                  |
+| `mosaic_extension_owner`          | Dedicated `NOLOGIN SUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS` extension owner, distinct from platform/schema/migrator/runtime. It is used solely to own/maintain untrusted `vector`, `mosaic_extensions`, and every owner-bearing extension member there. | `rolcanlogin=false`, `rolsuper=true`, and **zero members** are catalog-proven. No application role has membership, `SET ROLE`, credential, or inheritable grant. An externally controlled, audited platform-bootstrap **superuser** session alone executes `SET ROLE mosaic_extension_owner` for fresh creation, approved-owner update/relocation, or shadow bootstrap, then `RESET ROLE`; no persistent membership is ever granted. |
+| `mosaic_migrator`                 | `LOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`.                                                                                                                                                                                            | Only `mosaic_schema_owner`; runner verifies `session_user=mosaic_migrator`, `SET ROLE mosaic_schema_owner`, then `current_user=mosaic_schema_owner`.                                                                                                                                                                                                                                                                                 |
+| `mosaic_data_importer`            | `LOGIN NOINHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`; dedicated data-copy identity, not a DDL or schema owner.                                                                                                                                   | It is used only after runner preparation/verification through the KBN-101-02 file-reference interface. It has no owner/migrator/extension membership and cannot `SET ROLE mosaic_extension_owner`, or `ALTER`/catalog-or-extension-member `UPDATE`/`DROP`/change extension membership. Its bounded data-copy DML is not extension authority.                                                                                         |
+| `mosaic_runtime_capability`       | `NOLOGIN` and no ownership/administrative attributes.                                                                                                                                                                                                                       | Holds only named runtime grants.                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `mosaic_runtime`                  | `LOGIN INHERIT` with no ownership/administrative attributes.                                                                                                                                                                                                                | Only `mosaic_runtime_capability WITH INHERIT TRUE, SET FALSE, ADMIN FALSE`; never owner/migrator member.                                                                                                                                                                                                                                                                                                                             |
 
 The fixed application/runtime schema is **`mosaic`**. Every application/runtime pooled connection executes and verifies exactly `SET search_path TO pg_catalog, mosaic` before its first application query; connection checkout repeats this after reset/reconnect. Transactional application operations use `SET LOCAL search_path TO pg_catalog, mosaic` and verify it before query execution. `public` and `$user` are forbidden in all runtime paths.
 
@@ -181,36 +173,30 @@ Before relocation, the runner records a parameterized catalog inventory and depe
 
 No SQL identifier may come from URL/config/environment/operator input. Catalog comparisons use parameter values. The fixed identifiers above are constants; the external bootstrap artifact alone may use server-side `format('%I', fixed_allowlisted_identifier)` after allowlist validation. Raw client-side interpolation for identifiers, `SET search_path`, database, schema, role, table, or extension names is forbidden. Tests include injection-shaped values, a poisoned pooled-session reset, and transaction `SET LOCAL` restoration negatives.
 
-External bootstrap executes `REVOKE CONNECT, TEMPORARY ON DATABASE <fixed_database> FROM PUBLIC`, then grants `CONNECT` only to `mosaic_runtime`, `mosaic_runtime_user`, `mosaic_runtime_orchestrator`, `mosaic_migrator`, and the time-bounded external bootstrap actor while it is required. Certification fails if an unrelated login retains `CONNECT` or any of the three application logins retains `TEMPORARY`. Runtime receives `USAGE` on `mosaic`, named table/sequence grants through `mosaic_runtime_capability`, and `USAGE` on `drizzle` plus `SELECT` only on `drizzle.__drizzle_migrations` and `drizzle.__mosaic_migration_manifest`. **[NB-5]** The two new capability roles `mosaic_runtime_user_capability` and `mosaic_runtime_orchestrator_capability` additionally receive the identical baseline grants: `USAGE` on `mosaic`, `USAGE` on `drizzle` plus `SELECT` only on `drizzle.__drizzle_migrations` and `drizzle.__mosaic_migration_manifest`, and the relevant sequence `USAGE`/`SELECT` grants — mirroring `mosaic_runtime_capability` — so the frozen §6 L222 runtime verify does not fail closed on missing inherited/sequence/ledger grants for the two new rungs. `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, and DDL rights on ledger/manifest are revoked. Revoke public CREATE and function EXECUTE; `SECURITY DEFINER` is forbidden unless a separately reviewed exception pins trusted path and grants only the capability role. Database TEMPORARY, role management, extension, schema, and object ownership are denied.
+External bootstrap executes `REVOKE CONNECT, TEMPORARY ON DATABASE <fixed_database> FROM PUBLIC`, then grants `CONNECT` only to `mosaic_runtime`, `mosaic_migrator`, and the time-bounded external bootstrap actor while it is required. Certification fails if an unrelated login retains `CONNECT` or either application login retains `TEMPORARY`. Runtime receives `USAGE` on `mosaic`, named table/sequence grants through `mosaic_runtime_capability`, and `USAGE` on `drizzle` plus `SELECT` only on `drizzle.__drizzle_migrations` and `drizzle.__mosaic_migration_manifest`. `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, and DDL rights on ledger/manifest are revoked. Revoke public CREATE and function EXECUTE; `SECURITY DEFINER` is forbidden unless a separately reviewed exception pins trusted path and grants only the capability role. Database TEMPORARY, role management, extension, schema, and object ownership are denied.
 
 Immutable KBN relations, after KBN-100 creates them, grant runtime only `SELECT, INSERT` and explicitly deny `UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER`: `task_events`, `artifacts`, `task_checkpoints`, `task_checkpoint_artifacts`, and `approval_decision_artifacts`. KBN-100 retains RESTRICT/no-cascade semantics. Foundation certification verifies the role/schema boundary only; post-KBN-100 certification verifies this real deployed-role matrix.
 
-> **rc.20 (Envelope A) — authorized by Jason's declarative-RBAC B1 ruling + Mos OPTION A + Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS):** adds (i) the fixed **User/Orchestrator/others** runtime rung-roles (per-ROLE, deny-by-default); each rung **LOGIN** role is `NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`, **NON-OWNER** of every sink/override table, **added to the §4 L176 `CONNECT` allowlist**, and **asserted `TEMPORARY`-denied**. **No per-federated-user role or credential is created** — federated identity maps to a rung **at authorization time only**, and per-writer **attribution lives in metadata columns** (app-supplied `actor_id` on `task_events`), **never** in DB credentials/roles. (ii) Two new fixed rung DSN secrets **`mosaic-db-runtime-user-url`** and **`mosaic-db-runtime-orchestrator-url`** (Gateway-only, `0600 10001:10001`), extending the frozen runtime-URL secret row. (iii) **RLS `WITH CHECK` write-source policies (including the B2-INSERT per-rung INSERT tenant binding `workspace_id = current_setting('mosaic.workspace_id', true)::uuid`, composed as a SINGLE compound `WITH CHECK` or `AS RESTRICTIVE` — never multi-permissive-intended-to-AND, per the v5 composition mandate) + per-rung `SELECT`/`UPDATE` `USING` tenant policies + `FORCE ROW LEVEL SECURITY`** on the sink table `tasks` **and on the new sink-resident `task_status_write_override` table** (tighten-only, deny-by-default) — a §10 schema-v1 **mechanism addition** beyond the prior grant/revoke-only model, authorized by Mos Q2 as coordinator co-authorization with Jason's B1. **The two new rung capability roles additionally receive the baseline frozen §4 L176 runtime grants (`USAGE ON mosaic`, `drizzle` ledger `SELECT`, sequence grants) [NB-5] so they satisfy the frozen §6 L222 runtime verify.** (iv) The **`task_status_write_override` table** (keyed `(workspace_id, task_id, tier)`, no per-writer key), written only by the User rung, read by the Orchestrator/base rung `tasks` write-policy subquery, homes the User-override **at the sink**. The sink DDL (grants + RLS `USING`/`WITH CHECK` + override table + FORCE + unique key + trigger/view/rule invariants) is homed in the **KBN-100 producer** after it creates `tasks`, with `FORCE RLS` as the **terminal** migration step after all backfill/repair DML, per the §4 L178 producer/consumer precedent.
->
-> **Frozen-invariant note (authorization basis):** touching the frozen role graph, the §4 L176 CONNECT allowlist, and adding RLS + the override table are §10 contract-change classes (MISSION-MANIFEST §10; SHARED-CONTRACT L82 (rc.6 non-effect) / L88-90 (rc.5 non-effect), both amended by this rc.20; frozen §4 L176). They are authorized here by **Jason B1 + Mos OPTION A + Mos Q1 + Mos Q2**. The addition is strictly a **fixed per-ROLE** set + a **tighten-only** RLS mechanism + a **task/tier-scoped** override table. It stops exactly at the HALT boundary: **no** per-federated-user topology is introduced.
-
 ## 5. Deployable verified-TLS bootstrap
 
 `mosaicstack/stack` is the named repository/control plane. Ownership is intentionally non-overlapping: **KBN-101-00 exclusively owns** the versioned external bootstrap interface `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, and `infra/pg-bootstrap/README.md`, plus its bootstrap tests—roles, extension-owner transition, and no renderer/deployment manifests. **KBN-101-05 exclusively owns** `tools/db/render-postgres-secrets.ts`, its tests, the current `docker-compose.yml`, `docker-compose.federated.yml`, `deploy/portainer/federated-test.stack.yml`, `tools/federation-harness/docker-compose.two-gateways.yml`, and `apps/gateway/Dockerfile`; it consumes the versioned KBN-101-00 bootstrap interface and owns no bootstrap SQL. The named **Mosaic deployment control plane / Jason** is activation authority; the environment-specific IaC/Vault owner supplies only approved input secret versions and may not substitute an unreviewed current-repository artifact. The KBN-101-05 renderer is the only deployment handoff: it reads secret-provider references, validates owners/modes/digests/SANs, writes each output atomically (`mkstemp` on the target tmpfs, `fsync`, `chmod`/`chown`, atomic rename), and records only secret-version identifiers and hashes.
 
 `KBN-101-05` changes the Gateway image to fixed non-root `USER 10001:10001`, the importer image to fixed non-root `USER 10002:10002`, and the migrator process to fixed non-root `USER 10003:10003`; image and renderer tests freeze every UID:GID. A root-only migrator launch wrapper may open the private signing key before dropping to `10003:10003`, but the migrator process never regains root. Gateway CA and Gateway leaf-certificate mounts, and its own Gateway private key only when it terminates its HTTPS listener, must be readable by `10001:10001`; PostgreSQL private keys and migration-only material are never mounted there, and no secret is world-readable. PostgreSQL is not assigned a guessed UID/GID: its image must first be pinned by digest, and an image-inspection plus rendered Compose/Swarm test freezes the image's effective PostgreSQL UID:GID before the renderer selects mount owner/group. A digest, service UID/GID, rendered secret `uid`/`gid`/`mode`, or container `USER` mismatch is a KBN-101-05 failure. Mosaic applications never generate, self-sign, copy, or persist production certificates; the external bootstrap actor receives them only through the deployment secret mechanism and no plaintext development exception exists for production-like modes.
 
-| Material                               | Vault target / deployment secret                                                                                                                                                                                                                                                                                                                                                                                                           | Mount, injection, and authorized consumer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
-| Runtime URL                            | `secret-{env}/mosaic-stack/database/runtime` (`url`) → `mosaic-db-runtime-url-v1`                                                                                                                                                                                                                                                                                                                                                          | Gateway only: `/run/secrets/mosaic-db-runtime-url`, `0600`, `10001:10001`; entrypoint maps it to `DATABASE_URL` only at process exec. It is denied to every migrator, storage runtime, fleet, ordinary CLI, and test except an explicit runtime-negative fixture.                                                                                                                                                                                                                                                                                                                   |
-| Runtime URL (User rung)                | `secret-{env}/mosaic-stack/database/runtime-user` (`url`) → `mosaic-db-runtime-user-url-v1` **(PROVISIONAL-CONVENTION — the exact Vault subpath is inferred from the Runtime URL row's naming pattern and is TO-CONFIRM against the live Vault layout at KBN-101-03/-05 implementation; the secret NAME `mosaic-db-runtime-user-url` is envelope-fixed, the `.../database/runtime-user` subpath is not.)**                                 | Gateway only: `/run/secrets/mosaic-db-runtime-user-url`, `0600`, `10001:10001`; entrypoint maps it to the User-rung pool DSN only at process exec. Denied to every migrator, storage runtime, fleet, ordinary CLI, and test except an explicit runtime-negative fixture.                                                                                                                                                                                                                                                                                                            |
-| Runtime URL (Orchestrator rung)        | `secret-{env}/mosaic-stack/database/runtime-orchestrator` (`url`) → `mosaic-db-runtime-orchestrator-url-v1` **(PROVISIONAL-CONVENTION — the exact Vault subpath is inferred from the Runtime URL row's naming pattern and is TO-CONFIRM against the live Vault layout at KBN-101-03/-05 implementation; the secret NAME `mosaic-db-runtime-orchestrator-url` is envelope-fixed, the `.../database/runtime-orchestrator` subpath is not.)** | Gateway only: `/run/secrets/mosaic-db-runtime-orchestrator-url`, `0600`, `10001:10001`; entrypoint maps it to the Orchestrator-rung pool DSN only at process exec. Denied to every migrator, storage runtime, fleet, ordinary CLI, and test except an explicit runtime-negative fixture.                                                                                                                                                                                                                                                                                            |
-| Migration URL                          | `secret-{env}/mosaic-stack/database/migrator` (`url`) → `mosaic-db-migrator-url-v1`                                                                                                                                                                                                                                                                                                                                                        | Each one-shot migrator only: `/run/secrets/mosaic-db-migrator-url`, `0600`, fixed migrator UID:GID asserted by the image/render test; entrypoint maps it only to `DATABASE_MIGRATION_URL`. It is denied to Gateway, storage runtime, fleet, and ordinary CLI.                                                                                                                                                                                                                                                                                                                       |
-| Importer target URL + provider version | **Vault KV-v2** `secret-{env}/mosaic-stack/database/importer` (`url`) with the same successful response `data.metadata.version` → generation-pinned `mosaic-db-importer-url-v<version>` / `mosaic-db-importer-version-v<version>`                                                                                                                                                                                                          | The renderer consumes value and authenticated provider version as one generation, never derives version from DSN bytes. It renders separate immutable copies: migrator-attestation producer only gets `/run/secrets/mosaic-migrate-target-url` and `/run/secrets/mosaic-migrate-target-version`, each `10003:10003` `0400`; importer only gets the same two fixed paths, each `10002:10002` `0400`. Each consumer receives its own read-only mount, never a shared writable file. Runtime, Gateway, ordinary CLI, fleet, and unrelated containers receive neither file nor version. |
-| Attestation signing key                | `secret-{env}/mosaic-stack/database/migrate-target-attestation` (`private_key`) → `mosaic-db-migrate-target-ed25519-v1`                                                                                                                                                                                                                                                                                                                    | Runner root-wrapper only: fixed `/run/secrets/mosaic-db-migrate-target-ed25519`, `root:root` `0400`, referenced only by `MOSAIC_DB_ATTESTATION_SIGNING_KEY_FILE`; it opens once then drops to migrator `10003:10003`. No importer/runtime/Gateway mount or log/export is permitted.                                                                                                                                                                                                                                                                                                 |
-| Attestation public key ring            | versioned deployment public-key bundle → `mosaic-db-migrate-target-ed25519-public-v1`                                                                                                                                                                                                                                                                                                                                                      | Importer only: pinned `/run/mosaic-attestations/migrate-target.ed25519.pub`, `10002:10002` `0400`; active/overlap key IDs are explicit and revoked IDs fail closed. It contains no private key.                                                                                                                                                                                                                                                                                                                                                                                     |
-| Handoff verifier inputs                | root-owned non-secret generation descriptor (expected provider version, URL SHA-256, generation ID) plus pinned public verifier key                                                                                                                                                                                                                                                                                                        | Privileged controller only: `0400`; no importer URL bytes or private key. It verifies artifact bindings before copy/start.                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Target attestation artifact            | runner-produced non-secret file                                                                                                                                                                                                                                                                                                                                                                                                            | Migrator writes only `/run/mosaic-attestations-producer/migrate-target.v1.json`, `10003:10003` `0400`, on a producer-only mount. After runner success, privileged deployment handoff controller verifies and atomically copies the exact signed bytes to a distinct importer-only `/run/mosaic-attestations/migrate-target.v1.json` mount, `10002:10002` `0400`, seals it read-only, then creates importer. No importer write access, shared writable mount, Gateway/runtime access, or unrelated-container mount exists.                                                           |     |
-| CA bundle                              | `secret-{env}/mosaic-stack/database/tls-ca` (`certificate`) → generation-pinned `mosaic-db-ca-v<version>`                                                                                                                                                                                                                                                                                                                                  | Explicit DB-client consumers only: Gateway `/run/secrets/mosaic-db-ca.crt` `10001:10001` `0444`; migrator same path `10003:10003` `0444`; importer at the exact `DATABASE_TLS_CA_CERT_PATH=/run/secrets/mosaic-db-ca.crt`, `10002:10002` `0444`. PostgreSQL receives a distinct read-only CA copy only when client-cert validation is enabled; no unrelated container receives it.                                                                                                                                                                                                  |
-| Gateway leaf certificate               | `secret-{env}/mosaic-stack/federation/gateway-server-tls` (`certificate`) → `mosaic-gateway-server-cert-v1`                                                                                                                                                                                                                                                                                                                                | Gateway only: `/run/secrets/mosaic-gateway-server.crt`, `0444`, `10001:10001`; renderer emits this exact Compose and Swarm target and validates it before start.                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| Gateway private key                    | same Vault record (`private_key`) → `mosaic-gateway-server-key-v1`                                                                                                                                                                                                                                                                                                                                                                         | Gateway only: `/run/secrets/mosaic-gateway-server.key`, `0400`, `10001:10001`; not mounted to migrator or PostgreSQL and never world-readable.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| PostgreSQL leaf certificate            | `secret-{env}/mosaic-stack/database/postgres-server-tls` (`certificate`) → `mosaic-postgres-server-cert-v1`                                                                                                                                                                                                                                                                                                                                | PostgreSQL only: `/run/secrets/mosaic-postgres-server.crt`, `0444`, frozen verified postgres UID:GID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| PostgreSQL private key                 | same Vault record (`private_key`) → `mosaic-postgres-server-key-v1`                                                                                                                                                                                                                                                                                                                                                                        | PostgreSQL only: `/run/secrets/mosaic-postgres-server.key`, `0400`, frozen verified postgres UID:GID; never mounted to Gateway or migrator.                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Material                               | Vault target / deployment secret                                                                                                                                                                                                  | Mount, injection, and authorized consumer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
+| Runtime URL                            | `secret-{env}/mosaic-stack/database/runtime` (`url`) → `mosaic-db-runtime-url-v1`                                                                                                                                                 | Gateway only: `/run/secrets/mosaic-db-runtime-url`, `0600`, `10001:10001`; entrypoint maps it to `DATABASE_URL` only at process exec. It is denied to every migrator, storage runtime, fleet, ordinary CLI, and test except an explicit runtime-negative fixture.                                                                                                                                                                                                                                                                                                                   |
+| Migration URL                          | `secret-{env}/mosaic-stack/database/migrator` (`url`) → `mosaic-db-migrator-url-v1`                                                                                                                                               | Each one-shot migrator only: `/run/secrets/mosaic-db-migrator-url`, `0600`, fixed migrator UID:GID asserted by the image/render test; entrypoint maps it only to `DATABASE_MIGRATION_URL`. It is denied to Gateway, storage runtime, fleet, and ordinary CLI.                                                                                                                                                                                                                                                                                                                       |
+| Importer target URL + provider version | **Vault KV-v2** `secret-{env}/mosaic-stack/database/importer` (`url`) with the same successful response `data.metadata.version` → generation-pinned `mosaic-db-importer-url-v<version>` / `mosaic-db-importer-version-v<version>` | The renderer consumes value and authenticated provider version as one generation, never derives version from DSN bytes. It renders separate immutable copies: migrator-attestation producer only gets `/run/secrets/mosaic-migrate-target-url` and `/run/secrets/mosaic-migrate-target-version`, each `10003:10003` `0400`; importer only gets the same two fixed paths, each `10002:10002` `0400`. Each consumer receives its own read-only mount, never a shared writable file. Runtime, Gateway, ordinary CLI, fleet, and unrelated containers receive neither file nor version. |
+| Attestation signing key                | `secret-{env}/mosaic-stack/database/migrate-target-attestation` (`private_key`) → `mosaic-db-migrate-target-ed25519-v1`                                                                                                           | Runner root-wrapper only: fixed `/run/secrets/mosaic-db-migrate-target-ed25519`, `root:root` `0400`, referenced only by `MOSAIC_DB_ATTESTATION_SIGNING_KEY_FILE`; it opens once then drops to migrator `10003:10003`. No importer/runtime/Gateway mount or log/export is permitted.                                                                                                                                                                                                                                                                                                 |
+| Attestation public key ring            | versioned deployment public-key bundle → `mosaic-db-migrate-target-ed25519-public-v1`                                                                                                                                             | Importer only: pinned `/run/mosaic-attestations/migrate-target.ed25519.pub`, `10002:10002` `0400`; active/overlap key IDs are explicit and revoked IDs fail closed. It contains no private key.                                                                                                                                                                                                                                                                                                                                                                                     |
+| Handoff verifier inputs                | root-owned non-secret generation descriptor (expected provider version, URL SHA-256, generation ID) plus pinned public verifier key                                                                                               | Privileged controller only: `0400`; no importer URL bytes or private key. It verifies artifact bindings before copy/start.                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Target attestation artifact            | runner-produced non-secret file                                                                                                                                                                                                   | Migrator writes only `/run/mosaic-attestations-producer/migrate-target.v1.json`, `10003:10003` `0400`, on a producer-only mount. After runner success, privileged deployment handoff controller verifies and atomically copies the exact signed bytes to a distinct importer-only `/run/mosaic-attestations/migrate-target.v1.json` mount, `10002:10002` `0400`, seals it read-only, then creates importer. No importer write access, shared writable mount, Gateway/runtime access, or unrelated-container mount exists.                                                           |     |
+| CA bundle                              | `secret-{env}/mosaic-stack/database/tls-ca` (`certificate`) → generation-pinned `mosaic-db-ca-v<version>`                                                                                                                         | Explicit DB-client consumers only: Gateway `/run/secrets/mosaic-db-ca.crt` `10001:10001` `0444`; migrator same path `10003:10003` `0444`; importer at the exact `DATABASE_TLS_CA_CERT_PATH=/run/secrets/mosaic-db-ca.crt`, `10002:10002` `0444`. PostgreSQL receives a distinct read-only CA copy only when client-cert validation is enabled; no unrelated container receives it.                                                                                                                                                                                                  |
+| Gateway leaf certificate               | `secret-{env}/mosaic-stack/federation/gateway-server-tls` (`certificate`) → `mosaic-gateway-server-cert-v1`                                                                                                                       | Gateway only: `/run/secrets/mosaic-gateway-server.crt`, `0444`, `10001:10001`; renderer emits this exact Compose and Swarm target and validates it before start.                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Gateway private key                    | same Vault record (`private_key`) → `mosaic-gateway-server-key-v1`                                                                                                                                                                | Gateway only: `/run/secrets/mosaic-gateway-server.key`, `0400`, `10001:10001`; not mounted to migrator or PostgreSQL and never world-readable.                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| PostgreSQL leaf certificate            | `secret-{env}/mosaic-stack/database/postgres-server-tls` (`certificate`) → `mosaic-postgres-server-cert-v1`                                                                                                                       | PostgreSQL only: `/run/secrets/mosaic-postgres-server.crt`, `0444`, frozen verified postgres UID:GID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| PostgreSQL private key                 | same Vault record (`private_key`) → `mosaic-postgres-server-key-v1`                                                                                                                                                               | PostgreSQL only: `/run/secrets/mosaic-postgres-server.key`, `0400`, frozen verified postgres UID:GID; never mounted to Gateway or migrator.                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 
 Compose renders each value-plus-provider-version generation into a non-repository temporary generation directory, `fsync`s every file and directory, atomically renames the complete generation, and mounts immutable per-consumer copies only after the pair is complete. Swarm declares distinct versioned secret/config references for each migrator/importer consumer and generation. A deployment may not start, reload, or combine any URL/version/CA/attestation/public-key material across generations. The privileged handoff controller is the only bridge from migrator producer mount to importer mount: it verifies the signed producer artifact plus generation, copies atomically, seals importer read-only, and only then starts importer; it is tested for failed/partial copy, wrong generation, wrong owner/mode, and no importer start. KBN-101-05 rejects bind-mounted committed cert/key files, environment-encoded PEM, missing secrets, non-atomic renderer output, mixed generations, shared writable files, private-key access outside its named consumer (Gateway for Gateway key; PostgreSQL for PostgreSQL key), importer URL/version/attestation/key access outside their named consumer, CA outside explicit DB clients, and any world-readable URL/key. The existing target Vault names are planned canonical paths and must be verified/provisioned by the deployment-owner input; the planning card does not claim they exist.
 
@@ -243,21 +229,20 @@ Stable sanitized codes are `DATABASE_RUNTIME_URL_REQUIRED`, `DATABASE_MIGRATION_
 
 Every KBN-101 card remains one PR with exclusive ownership. Cards `00`–`07` may merge only as **prepared, inactive capability**: no current owner-runtime deployment consumes their image/config, and no compatibility switch is exposed to a runtime operator. They must not retain `ALLOW_LEGACY_*`, runtime DDL, `DATABASE_URL` migration fallback, plaintext TLS, direct Drizzle, or test-only bypass flags. Current owner-runtime deployments remain on their known N-1 release until final activation.
 
-| Card                                                                                    | Depends on     | Complete, disjoint file/glob manifest and required test/evidence paths                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| --------------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `KBN-101-00` platform bootstrap / IaC                                                   | contract       | **Only:** `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, `infra/pg-bootstrap/README.md`, `infra/pg-bootstrap/tests/**`. It creates the extension-owner role/schema/extension interface and proves fresh, approved-owner, legacy-shadow, catalog/default-privilege, and direct-denial bootstrap cases. No renderer, runner, Compose, CI, or deployment path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `KBN-101-01` typed runtime config and verifier                                          | 00             | **Only:** `packages/config/src/index.ts`, `packages/config/src/mosaic-config.ts`, `packages/config/src/mosaic-config.spec.ts`; `packages/db/src/client.ts`, `packages/db/src/defaults.ts`, `packages/db/src/connection-identity.ts`, `packages/db/src/client.spec.ts`, `packages/db/src/defaults.spec.ts`, `packages/db/src/connection-identity.spec.ts`; `apps/gateway/src/database/database.module.ts`, `apps/gateway/src/database/database.module.spec.ts`. It supplies runtime/migration/TLS DTO parsing plus runtime identity/search-path/readiness verification. No migrator, storage, installer, deploy, or CI path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `KBN-101-10` declarative sink-RBAC + per-role connection-selection + credential-handoff | 00,01          | **Only:** `packages/db/src/sink-rbac/**`, `packages/db/src/credential-handoff/**`. It homes: the source-controlled declarative RBAC policy artifact + schema + evaluator; the fixed **rung ladder** + federation-aware identity→rung resolver; the rung→DB-credential **connection-selection** module (consumes -01 pools; import direction `10→01`); the **status-preserving-UPSERT** contract + **invariant field-set** module + **no-status view/rule/trigger enumeration**; and the **SCM_RIGHTS** credential-handoff + **non-dumpable** assert/verify library. It creates no roles, no DDL, no Compose/CI/deploy path; it is consumed by -00 (role names), -01 (connection wiring + identity/attribute verify), -02/-03/-05 (write path + fd handoff), specified-against by **KBN-100** (sink DDL: grants/RLS/`USING`+`WITH CHECK` policies/override-table/FORCE/unique-key/trigger-view-rule-invariant on `tasks`), and certified deployed by KBN-101-09.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `KBN-101-03` sole runner, manifest, and schema foundation                               | 00,01,10       | **Only:** `.gitattributes`; `packages/db/package.json`; `packages/db/drizzle.config.ts`; `packages/db/src/cli.ts`, `packages/db/src/cli.spec.ts`, `packages/db/src/index.ts`, `packages/db/src/index.import-negative.spec.ts`, `packages/db/src/migrate.ts`, `packages/db/src/migrate.test.ts`, `packages/db/src/schema.ts`, `packages/db/src/schema.spec.ts`; `packages/db/src/migrator/**`; `packages/db/drizzle/*.sql`, `packages/db/drizzle/meta/*.json`; `docker/db-migrator.Dockerfile`, `docker/db-migrator.Dockerfile.spec.ts`; `packages/db/package-bin.spec.ts`. It alone publishes `"mosaic-db-migrator": "./dist/cli.js"`, verifies source/build/pack/discovery, and sets `ENTRYPOINT ["mosaic-db-migrator"]`; it exclusively owns `packages/db/src/migrator/target-attestation.dto.ts`, `target-attestation-signer.ts`, and their specs: fixed-key reference validation, JCS canonical payload, Ed25519 signing, producer TLS/identity/manifest binding, atomic artifact emission, and producer tests. It owns journal/manifest/ledger/lock/relocation/shadow tests. Shipped `0009` bytes stay unchanged.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `KBN-101-02` runtime DDL closure                                                        | 01,03,10       | **Only:** `docker/init-db.sql`, `infra/pg-init/01-extensions.sql`; `packages/storage/src/adapters/postgres.ts`, `packages/storage/src/adapters/postgres.spec.ts`, `packages/storage/src/factory.ts`, `packages/storage/src/factory.spec.ts`, `packages/storage/src/types.ts`, `packages/storage/src/tier-detection.ts`, `packages/storage/src/tier-detection.spec.ts`, `packages/storage/src/cli.ts`, `packages/storage/src/cli.spec.ts`, `packages/storage/src/migrate-tier.ts`, `packages/storage/src/migrate-tier.spec.ts`, `packages/storage/src/migrate-tier.integration.test.ts`; `apps/gateway/src/main.ts`, `apps/gateway/src/__tests__/integration/federated-boot.pg-unreachable.integration.test.ts`, `apps/gateway/src/__tests__/integration/federated-boot.success.integration.test.ts`, `apps/gateway/src/__tests__/integration/federated-pgvector.integration.test.ts`; `packages/db/src/federation.integration.test.ts`; `packages/mosaic/src/commands/fleet-backlog.ts`, `packages/mosaic/src/commands/fleet-backlog.spec.ts`. It consumes the -03 runner and exclusively owns importer verification/interface in `packages/storage/src/{cli,migrate-tier}.ts` and the named unit/integration specs: fixed URL/version/attestation/public-key safe-open fds (`O_RDONLY                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | O_CLOEXEC | O_NOFOLLOW`plus post-open regular-owner-mode-link-count validation), one-read protected-memory URL connection, fd zeroization/close, signature/key/expiry/replay/authenticated-provider-version/digest/generation/CA/binding validation, no forwarding/logging/oracle, post-TLS zero-DML comparison, consumer isolation, and DDL classifier. It closes runtime/retired-init DDL only; removes the current Gateway production`.env`/monorepo auto-load path in favor of the -05 renderer-backed process-exec or `LoadCredential` consumer boundary; and excludes every -03 signer/runner, index, migrate, and Drizzle-config asset, and every deployment/CI/doc path. |
-| `KBN-101-04` installer/wizard                                                           | 01             | **Only:** `packages/mosaic/src/stages/gateway-config.ts`, `packages/mosaic/src/stages/gateway-config.spec.ts`, `packages/mosaic/src/stages/gateway-config-cors.spec.ts`, `packages/mosaic/src/stages/wizard-menu.spec.ts`, `packages/mosaic/src/wizard.ts`. It persists only non-secret references/injected-variable contracts; source inspection excludes `tools/install.sh`, which does not read/write the database DSN.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `KBN-101-05` renderer and deployment                                                    | 00,03,10       | **Only:** `tools/db/render-postgres-secrets.ts`, `tools/db/render-postgres-secrets.spec.ts`; `apps/gateway/Dockerfile`, `apps/gateway/Dockerfile.spec.ts`; `docker-compose.yml`, `docker-compose.spec.ts`; `docker-compose.federated.yml`, `docker-compose.federated.spec.ts`; `deploy/portainer/federated-test.stack.yml`, `deploy/portainer/federated-test.stack.spec.ts`; `tools/federation-harness/docker-compose.two-gateways.yml`, `tools/federation-harness/docker-compose.two-gateways.spec.ts`. It consumes the -00 bootstrap interface and -03 immutable runner image, and exclusively renders/tests fixed Gateway/importer/migrator UIDs; runner-only root-owned signing-key reference; KV-v2 importer URL plus same-response `data.metadata.version`; separate immutable generation-pinned URL/version mounts for `10003:10003` migrator and `10002:10002` importer; importer-only CA at `DATABASE_TLS_CA_CERT_PATH`, public-key/key-ring, and controlled producer-only-to-importer-only attestation handoff mount; privileged controller verification/copy/fsync/atomic-rename/seal-before-importer-start behavior; Compose generation-dir fsync/atomic-rename and Swarm versioned-secret/config no-mixed-generation behavior. It owns no bootstrap, runner, config, storage, or CI file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `KBN-101-07` operator/runbook/docs                                                      | 02,03,04,05    | **Only:** `README.md`, `CLAUDE.md`, `docs/guides/admin-guide.md`, `docs/guides/dev-guide.md`, `docs/guides/deployment.md`, **`docs/guides/migrate-tier.md`**, `docs/guides/user-guide.md`, `docs/federation/MILESTONES.md`, `docs/federation/SETUP.md`, `docs/federation/TASKS.md`, `docs/fleet/backlog-conventions.md`, `docs/PERFORMANCE.md`, `docs/design/storage-abstraction-middleware.md`, `docs/plans/2026-03-15-agent-platform-architecture.md`, `docs/plans/2026-03-15-wave2-tui-layout-navigation.md`, `docs/runbooks/kbn-101-database-role-split.md`, `docs/reports/native-kanban-sot/kbn-101-operator-readiness-report.md`, `docs/native-kanban-sot/tests/kbn-101-operator-docs.spec.ts`. It exclusively owns the active migrate-tier operator route; local PGlite/non-PostgreSQL Compose disposition; the held PostgreSQL/federated activation order; and the non-operative production renderer/Vault generation-pinned process-exec or `LoadCredential` consumer-isolation schematic. It documents interfaces produced by -02/-03/-04/-05, including both file references, signing-key isolation, attestation bindings, rotation/replay, no-connection/no-DML errors, and the ban on current production `.env`, monorepo auto-load, environment-file, credential export/argv, or restart-as-secret-activation guidance; it owns no source, storage, CLI, runner, or CI file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `KBN-101-06` CI classifier and command matrix                                           | 02,03,05,07,10 | **Only:** `.woodpecker/ci.yml`, `tools/ci/kbn101-ddl-inventory.ts`, `tools/ci/kbn101-ddl-inventory.spec.ts`, `tools/ci/fixtures/kbn101-ddl-inventory.json`, `tools/ci/kbn101-entrypoint-matrix.ts`, `tools/ci/kbn101-entrypoint-matrix.spec.ts`. It invokes the already-produced bin/image/deployment/doc artifacts and edits no producer file. Its inventory test enforces manifest overlap, ownerless, duplicate-owner, path-existence, allowlist, active-route field completeness, finite operator-document inventory, normative/status-only non-masking, unknown-command, and historical/status-only masking failures. Before inventory, ownership, or status masking, its semantic suite fails the exact README commented code-fence generic-wrapper form and exact user-guide executable generic-wrapper form recorded in §2.2, and source-consistency opens `packages/storage/src/cli.ts` to prove its current direct-Drizzle `pnpm --filter @mosaicstack/db db:migrate` `execSync` implementation and absence of a `mosaic-db-migrator` bin make runner-delegation copy false. It also fails former `SETUP.md` automatic-first-boot/startup, the exact former `MILESTONES.md` wording, and the exact former README/dev/deployment Compose-first sequences before an inventory record can mask any path; it fails Compose-up-before-runner, extension/schema/migration automatic wording, init-script authority, production `.env`, `EnvironmentFile=`, credential shell export/argv, and restart-as-secret-activation. It passes the rc.16 held PGlite-data-layer/non-PostgreSQL-Compose disposition (and fails Gateway/Web local start while daemon/inherited/root/app-local DSN or non-local-tier input could select PostgreSQL), the one `Held future procedure` section with KBN-101-00/-03/-05 and external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose-readiness, and the README legacy-N-1 CI status assertion; every runner hit outside that section and every current-CI authority variant fails before masking. Its matrix invokes the -02 secure target route and verifies URL/version generation mismatch, provider rotation/revocation, consumer isolation, safe-open TOCTOU/link/mode/owner, absent/wrong importer CA, no log/oracle, every declared attestation refusal before target connection/DDL, and post-connect mismatch with zero DML. |
-| `KBN-101-08` foundation certification and **atomic activation release**                 | 00…07,10       | **Only evidence:** `docs/reports/native-kanban-sot/kbn-101-foundation-activation-certificate.md`, `docs/reports/native-kanban-sot/kbn-101-foundation-activation-evidence.json`. It changes no implementation path. Independent review and terminal-green CI must verify prepared artifacts before Mosaic control plane/Jason authorizes backup → drain/scale-zero N-1 → TLS → roles → runner → verified readiness → rolling runtime; any red result aborts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `KBN-101-09` post-KBN-100 certification                                                 | KBN-100,08     | **Only evidence:** `docs/reports/native-kanban-sot/kbn-101-immutable-role-certificate.md`, `docs/reports/native-kanban-sot/kbn-101-immutable-role-evidence.json`. It changes no implementation path and records real deployed runtime INSERT/SELECT plus UPDATE/DELETE-denial evidence and independent security/Ultron approval.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Card                                                                    | Depends on  | Complete, disjoint file/glob manifest and required test/evidence paths                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ----------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `KBN-101-00` platform bootstrap / IaC                                   | contract    | **Only:** `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, `infra/pg-bootstrap/README.md`, `infra/pg-bootstrap/tests/**`. It creates the extension-owner role/schema/extension interface and proves fresh, approved-owner, legacy-shadow, catalog/default-privilege, and direct-denial bootstrap cases. No renderer, runner, Compose, CI, or deployment path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `KBN-101-01` typed runtime config and verifier                          | 00          | **Only:** `packages/config/src/index.ts`, `packages/config/src/mosaic-config.ts`, `packages/config/src/mosaic-config.spec.ts`; `packages/db/src/client.ts`, `packages/db/src/defaults.ts`, `packages/db/src/connection-identity.ts`, `packages/db/src/client.spec.ts`, `packages/db/src/defaults.spec.ts`, `packages/db/src/connection-identity.spec.ts`; `apps/gateway/src/database/database.module.ts`, `apps/gateway/src/database/database.module.spec.ts`. It supplies runtime/migration/TLS DTO parsing plus runtime identity/search-path/readiness verification. No migrator, storage, installer, deploy, or CI path.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `KBN-101-03` sole runner, manifest, and schema foundation               | 00,01       | **Only:** `.gitattributes`; `packages/db/package.json`; `packages/db/drizzle.config.ts`; `packages/db/src/cli.ts`, `packages/db/src/cli.spec.ts`, `packages/db/src/index.ts`, `packages/db/src/index.import-negative.spec.ts`, `packages/db/src/migrate.ts`, `packages/db/src/migrate.test.ts`, `packages/db/src/schema.ts`, `packages/db/src/schema.spec.ts`; `packages/db/src/migrator/**`; `packages/db/drizzle/*.sql`, `packages/db/drizzle/meta/*.json`; `docker/db-migrator.Dockerfile`, `docker/db-migrator.Dockerfile.spec.ts`; `packages/db/package-bin.spec.ts`. It alone publishes `"mosaic-db-migrator": "./dist/cli.js"`, verifies source/build/pack/discovery, and sets `ENTRYPOINT ["mosaic-db-migrator"]`; it exclusively owns `packages/db/src/migrator/target-attestation.dto.ts`, `target-attestation-signer.ts`, and their specs: fixed-key reference validation, JCS canonical payload, Ed25519 signing, producer TLS/identity/manifest binding, atomic artifact emission, and producer tests. It owns journal/manifest/ledger/lock/relocation/shadow tests. Shipped `0009` bytes stay unchanged.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `KBN-101-02` runtime DDL closure                                        | 01,03       | **Only:** `docker/init-db.sql`, `infra/pg-init/01-extensions.sql`; `packages/storage/src/adapters/postgres.ts`, `packages/storage/src/adapters/postgres.spec.ts`, `packages/storage/src/factory.ts`, `packages/storage/src/factory.spec.ts`, `packages/storage/src/types.ts`, `packages/storage/src/tier-detection.ts`, `packages/storage/src/tier-detection.spec.ts`, `packages/storage/src/cli.ts`, `packages/storage/src/cli.spec.ts`, `packages/storage/src/migrate-tier.ts`, `packages/storage/src/migrate-tier.spec.ts`, `packages/storage/src/migrate-tier.integration.test.ts`; `apps/gateway/src/main.ts`, `apps/gateway/src/__tests__/integration/federated-boot.pg-unreachable.integration.test.ts`, `apps/gateway/src/__tests__/integration/federated-boot.success.integration.test.ts`, `apps/gateway/src/__tests__/integration/federated-pgvector.integration.test.ts`; `packages/db/src/federation.integration.test.ts`; `packages/mosaic/src/commands/fleet-backlog.ts`, `packages/mosaic/src/commands/fleet-backlog.spec.ts`. It consumes the -03 runner and exclusively owns importer verification/interface in `packages/storage/src/{cli,migrate-tier}.ts` and the named unit/integration specs: fixed URL/version/attestation/public-key safe-open fds (`O_RDONLY                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | O_CLOEXEC | O_NOFOLLOW`plus post-open regular-owner-mode-link-count validation), one-read protected-memory URL connection, fd zeroization/close, signature/key/expiry/replay/authenticated-provider-version/digest/generation/CA/binding validation, no forwarding/logging/oracle, post-TLS zero-DML comparison, consumer isolation, and DDL classifier. It closes runtime/retired-init DDL only; removes the current Gateway production`.env`/monorepo auto-load path in favor of the -05 renderer-backed process-exec or `LoadCredential` consumer boundary; and excludes every -03 signer/runner, index, migrate, and Drizzle-config asset, and every deployment/CI/doc path. |
+| `KBN-101-04` installer/wizard                                           | 01          | **Only:** `packages/mosaic/src/stages/gateway-config.ts`, `packages/mosaic/src/stages/gateway-config.spec.ts`, `packages/mosaic/src/stages/gateway-config-cors.spec.ts`, `packages/mosaic/src/stages/wizard-menu.spec.ts`, `packages/mosaic/src/wizard.ts`. It persists only non-secret references/injected-variable contracts; source inspection excludes `tools/install.sh`, which does not read/write the database DSN.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `KBN-101-05` renderer and deployment                                    | 00,03       | **Only:** `tools/db/render-postgres-secrets.ts`, `tools/db/render-postgres-secrets.spec.ts`; `apps/gateway/Dockerfile`, `apps/gateway/Dockerfile.spec.ts`; `docker-compose.yml`, `docker-compose.spec.ts`; `docker-compose.federated.yml`, `docker-compose.federated.spec.ts`; `deploy/portainer/federated-test.stack.yml`, `deploy/portainer/federated-test.stack.spec.ts`; `tools/federation-harness/docker-compose.two-gateways.yml`, `tools/federation-harness/docker-compose.two-gateways.spec.ts`. It consumes the -00 bootstrap interface and -03 immutable runner image, and exclusively renders/tests fixed Gateway/importer/migrator UIDs; runner-only root-owned signing-key reference; KV-v2 importer URL plus same-response `data.metadata.version`; separate immutable generation-pinned URL/version mounts for `10003:10003` migrator and `10002:10002` importer; importer-only CA at `DATABASE_TLS_CA_CERT_PATH`, public-key/key-ring, and controlled producer-only-to-importer-only attestation handoff mount; privileged controller verification/copy/fsync/atomic-rename/seal-before-importer-start behavior; Compose generation-dir fsync/atomic-rename and Swarm versioned-secret/config no-mixed-generation behavior. It owns no bootstrap, runner, config, storage, or CI file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `KBN-101-07` operator/runbook/docs                                      | 02,03,04,05 | **Only:** `README.md`, `CLAUDE.md`, `docs/guides/admin-guide.md`, `docs/guides/dev-guide.md`, `docs/guides/deployment.md`, **`docs/guides/migrate-tier.md`**, `docs/guides/user-guide.md`, `docs/federation/MILESTONES.md`, `docs/federation/SETUP.md`, `docs/federation/TASKS.md`, `docs/fleet/backlog-conventions.md`, `docs/PERFORMANCE.md`, `docs/design/storage-abstraction-middleware.md`, `docs/plans/2026-03-15-agent-platform-architecture.md`, `docs/plans/2026-03-15-wave2-tui-layout-navigation.md`, `docs/runbooks/kbn-101-database-role-split.md`, `docs/reports/native-kanban-sot/kbn-101-operator-readiness-report.md`, `docs/native-kanban-sot/tests/kbn-101-operator-docs.spec.ts`. It exclusively owns the active migrate-tier operator route; local PGlite/non-PostgreSQL Compose disposition; the held PostgreSQL/federated activation order; and the non-operative production renderer/Vault generation-pinned process-exec or `LoadCredential` consumer-isolation schematic. It documents interfaces produced by -02/-03/-04/-05, including both file references, signing-key isolation, attestation bindings, rotation/replay, no-connection/no-DML errors, and the ban on current production `.env`, monorepo auto-load, environment-file, credential export/argv, or restart-as-secret-activation guidance; it owns no source, storage, CLI, runner, or CI file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `KBN-101-06` CI classifier and command matrix                           | 02,03,05,07 | **Only:** `.woodpecker/ci.yml`, `tools/ci/kbn101-ddl-inventory.ts`, `tools/ci/kbn101-ddl-inventory.spec.ts`, `tools/ci/fixtures/kbn101-ddl-inventory.json`, `tools/ci/kbn101-entrypoint-matrix.ts`, `tools/ci/kbn101-entrypoint-matrix.spec.ts`. It invokes the already-produced bin/image/deployment/doc artifacts and edits no producer file. Its inventory test enforces manifest overlap, ownerless, duplicate-owner, path-existence, allowlist, active-route field completeness, finite operator-document inventory, normative/status-only non-masking, unknown-command, and historical/status-only masking failures. Before inventory, ownership, or status masking, its semantic suite fails the exact README commented code-fence generic-wrapper form and exact user-guide executable generic-wrapper form recorded in §2.2, and source-consistency opens `packages/storage/src/cli.ts` to prove its current direct-Drizzle `pnpm --filter @mosaicstack/db db:migrate` `execSync` implementation and absence of a `mosaic-db-migrator` bin make runner-delegation copy false. It also fails former `SETUP.md` automatic-first-boot/startup, the exact former `MILESTONES.md` wording, and the exact former README/dev/deployment Compose-first sequences before an inventory record can mask any path; it fails Compose-up-before-runner, extension/schema/migration automatic wording, init-script authority, production `.env`, `EnvironmentFile=`, credential shell export/argv, and restart-as-secret-activation. It passes the rc.16 held PGlite-data-layer/non-PostgreSQL-Compose disposition (and fails Gateway/Web local start while daemon/inherited/root/app-local DSN or non-local-tier input could select PostgreSQL), the one `Held future procedure` section with KBN-101-00/-03/-05 and external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose-readiness, and the README legacy-N-1 CI status assertion; every runner hit outside that section and every current-CI authority variant fails before masking. Its matrix invokes the -02 secure target route and verifies URL/version generation mismatch, provider rotation/revocation, consumer isolation, safe-open TOCTOU/link/mode/owner, absent/wrong importer CA, no log/oracle, every declared attestation refusal before target connection/DDL, and post-connect mismatch with zero DML. |
+| `KBN-101-08` foundation certification and **atomic activation release** | 00…07       | **Only evidence:** `docs/reports/native-kanban-sot/kbn-101-foundation-activation-certificate.md`, `docs/reports/native-kanban-sot/kbn-101-foundation-activation-evidence.json`. It changes no implementation path. Independent review and terminal-green CI must verify prepared artifacts before Mosaic control plane/Jason authorizes backup → drain/scale-zero N-1 → TLS → roles → runner → verified readiness → rolling runtime; any red result aborts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `KBN-101-09` post-KBN-100 certification                                 | KBN-100,08  | **Only evidence:** `docs/reports/native-kanban-sot/kbn-101-immutable-role-certificate.md`, `docs/reports/native-kanban-sot/kbn-101-immutable-role-evidence.json`. It changes no implementation path and records real deployed runtime INSERT/SELECT plus UPDATE/DELETE-denial evidence and independent security/Ultron approval.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 
-The manifests above are the complete ownership universe for KBN-101 implementation paths **including KBN-101-10**; the KBN-101-06 inventory test fails on overlap, an ownerless in-scope path, or a nonexistent declared path. Cards `00`–`07` are prepared artifacts, not independently deployed releases: the immutable N-1 owner-runtime image stays live until KBN-101-08 control-plane atomic activation. No activation card edits a source-changing path, and no runtime bypass or broken deployed intermediate exists.
+The manifests above are the complete ownership universe for KBN-101 implementation paths; the KBN-101-06 inventory test fails on overlap, an ownerless in-scope path, or a nonexistent declared path. Cards `00`–`07` are prepared artifacts, not independently deployed releases: the immutable N-1 owner-runtime image stays live until KBN-101-08 control-plane atomic activation. No activation card edits a source-changing path, and no runtime bypass or broken deployed intermediate exists.
 
 **Authority:** Mosaic control plane/Jason is the sole activation and rollback authority. CI, Gateway, migrator, Coordinator, and Certifier cannot activate, waive a red result, or force release. Before an incompatible KBN-100 switch, the authority stops/scales runtime, uses the approved backup/restore or separately reviewed runner artifact, restores only a known TLS-compatible runtime with its runtime secret after `hostssl` enforcement, and verifies no plaintext sessions plus TLS/readiness. Migration URL is never injected into Gateway to enable rollback. KBN-100 starts only after KBN-101-08; KBN-105 starts only after KBN-101-09.
 

docs/native-kanban-sot/KBN-101-ENVELOPE-A.md

@@ -1,377 +0,0 @@
-# KBN-101 — B1/B2 Envelope A (v6, FINAL) — Declarative Sink-RBAC + Per-Role Credential/Connection-Selection + RLS Write-Source (INSERT tenant-bound, single-compound-or-RESTRICTIVE composition) + Sink-Resident User-Override + Read/USING Enforcement
-
-**Ratification status:** RATIFIED — part of the frozen SSOT as of this PR (KBN-101 Envelope A, landed **FORM A — apply-in-place**). This is the converged **v6** envelope, ratified as the authoritative record of the **rc.20** contract amendment now inlined into [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md) §4/§10, [`SHARED-CONTRACT.md`](./SHARED-CONTRACT.md) (`### 1.0.0-rc.20`), and [`MISSION-MANIFEST.md`](./MISSION-MANIFEST.md) §10.
-
-**Ratification lineage (authoritative):** Jason B1 ruling (2026-07-20T23:08Z) + Mos coordinator **OPTION A** (home the layer) + **Mos Q1** ruling (TIER-LEVEL) + **Mos Q2** ruling (RLS `WITH CHECK` AUTHORIZED, two mandatory conditions — `ENABLE`/`FORCE ROW LEVEL SECURITY` as the terminal migration step, and non-owner rung roles) + **Gate A** (`a11a1e2c`) + **Gate B** (`a6aac2cd`).
-
-> **Ratification note.** The sections below are the converged v6 envelope text, retained **VERBATIM** for traceability. Their design-time framing — e.g. "**Scope:** DESIGN / CONTRACT-AMENDMENT only. No implementation code, no PRs, no SSOT edits." and "**Base:** … this doc modifies nothing there." — describes the envelope as originally authored against base `b0d78d86`. As of this PR that rc.20 amendment is **ratified and applied in-place (FORM A)** to the frozen SSOT; the design-time "no SSOT edits" wording is historical authoring context, not a live constraint on this ratified record. The Ratification lineage above is authoritative.
-
----
-
-**Status:** v6 envelope (design / contract-amendment), FINAL. **v6 = v5 + N1/N2/F-NB4 non-blocking test/lint/cert hardening ONLY; NO design predicate/policy/grant/role/table change.** v5 CONVERGED — BOTH terminal re-gate-4 gates returned GO (Gate A-delta-4 `a4ce075a`; Gate B-delta-4 `a379e0de`), NO HALT; Gate B-delta-4 flagged 3 EXPLICITLY NON-BLOCKING hardening notes "for the trunk-commit record," and v6 folds exactly those 3 as additive test/lint/cert wording on an already-BOTH-GO design: **N1** (strengthen the `pg_policy.polpermissive` lint — group by effective role incl. `PUBLIC`/inheritance; reject an internally-disjunctive single `WITH CHECK`; behavioral positive-controls remain the PRIMARY proof), **N2** (state the option-(b) vacuous-deny guard invariant — ≥1 permissive policy per writable (rung, command)), and **F-NB4** (extend owner non-reachability to SET-ROLE assumability — conjoin the `MEMBER` variant of `pg_has_role`). No design predicate, policy, grant, role, or table is changed. v6 supersedes v5 (`a6e790fd`), which supersedes v4 (`a48ad69c`). Preserves EVERY verified v4 closure (all checks passed on v4 EXCEPT one bounded item) and closes the SINGLE remaining BLOCKING finding raised identically by BOTH re-gate-3 gates (Gate A-delta-3 `aa5cbf73` = CHANGES-NEEDED; Gate B-delta-3 `aa881074` = 1 blocking): the **RLS `WITH CHECK` composition semantics** — v4's construction is right but it justifies the composition with a FALSE PostgreSQL claim ("PostgreSQL requires ALL applicable `WITH CHECK` clauses to pass / they AND") and leaves the _realization_ unspecified, so an implementation could realize the status-pin, the workspace-bind, and the override as SEPARATE PERMISSIVE policies which combine with **OR** (not AND) → a foreign-workspace INSERT satisfying only the status-pin would be admitted (B2-INSERT / B-1 re-open). v5 (a) corrects the semantics, (b) **mandates** the composition be realized as a SINGLE compound `WITH CHECK` OR as `AS RESTRICTIVE` policies and **explicitly forbids** the multi-permissive-intended-to-AND realization, and (c) hardens the red-first negatives to an otherwise-valid row + adds a positive-control. It also folds Gate B-delta-3's NB-4-transitive nit (state owner non-reachability as TRANSITIVE membership). This is a PRECISE, LIGHT revision: every v4 closure (3-rung ladder / zero per-user; F1–F7; GA-1/3/4; B-1/B-2/B-3; B2-INSERT workspace bind itself; N-1..N-5; AD-1/AD-2; NB-1..NB-5; continuous -06 scan + L174 GUC fold; rc.20) carries forward intact. Prior rc.18/rc.19 evidence does NOT carry.
-**Authoring authority:** Jason B1 ruling (2026-07-20T23:08Z) + Mos coordinator **OPTION A** (home the layer) + **Mos Q1 ruling (TIER-LEVEL)** + **Mos Q2 ruling (RLS `WITH CHECK` AUTHORIZED, two mandatory conditions)**. No new coordinator authority is required for v5: the composition fix is a DDL-realization detail + corrected PostgreSQL-semantics statement + test-wording hardening entirely inside the already-authorized `WITH CHECK`/`FORCE RLS` mechanism (Q2); it introduces no new principal, key, or authority axis. **Both delta-3 gates independently confirmed the per-user/same-tier boundary HOLDS** (the crit-1 defect is a TENANT-ISOLATION correctness risk, NOT a per-user authority axis).
-**Base:** frozen SSOT at `b0d78d86`, `/src/mosaic-stack/docs/native-kanban-sot/` (READ-ONLY; this doc modifies nothing there).
-**Scope:** DESIGN / CONTRACT-AMENDMENT only. No implementation code, no PRs, no SSOT edits.
-
-**HALT self-check result (re-run for v5): NO HALT.** No v5 change forces two SAME-TIER writers to hold DIFFERENT WRITE AUTHORITY. The v5 composition fix pins **how** the already-uniform predicates are physically composed (one compound `WITH CHECK`, or `AS RESTRICTIVE`) — it changes no predicate's _content_ and adds no writer-varying axis; both delta-3 gates confirmed this is a tenant-isolation correctness pin, not a per-user distinction. The B2-INSERT fix ANDs a **shared, per-request workspace predicate** (`workspace_id = current_setting('mosaic.workspace_id', true)::uuid`) into every rung's INSERT `WITH CHECK` — applied **uniformly** to every writer in a tier, exactly like the B-2 read/`USING` predicate; it is tenant isolation, never a per-writer distinction. The B-1 sink-resident User-override remains keyed on **(workspace_id, task_id, tier)** — task-identity + tier ONLY, **NO per-federated-writer key** — so every writer inside a given tier is subject to the _identical_ veto for a given task. The five NB fixes (override-relation no-status enumeration; two claim-scopings; owner-toggle-FORCE containment naming; baseline runtime grants for the two capability roles) introduce **zero** per-writer authority. Per-writer _attribution_ remains an AUDIT concern routed to metadata (`task_events.actor_id`), never a DB credential/role/RLS key. The design remains satisfiable with the **fixed 3-rung role ladder** (User / Orchestrator / others), federated identity → rung at authorization time. The Q1 hard re-open trigger (same-tier / different write-authority) is **not** hit. See §5.
-
----
-
-## 0. What the "raw task-status sink" is (grounding — unchanged from v1/v2)
-
-- The canonical task-status store is **`tasks.status`** (SHARED-CONTRACT §5.4 L214 "canonical authority"); legacy **`mission_tasks.status`** is frozen read-only / prohibited as a write source (SHARED-CONTRACT §5.4 L219; §5.1 phase 1 L165). `tasks` is a **mutable** relation created by **KBN-100**. Canonical statuses are `backlog | ready | in_progress | blocked | in_review | done | cancelled` (SHARED-CONTRACT §3 L134); initial creation state is `backlog` (§5.4 L214 not-started→backlog).
-- The append-only event relations `task_events, artifacts, task_checkpoints, task_checkpoint_artifacts, approval_decision_artifacts` receive runtime-only `SELECT, INSERT` with `UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER` **denied** (frozen §4 L178). That producer/consumer precedent — grants applied **after** KBN-100 creates the relations — is the mechanism this envelope extends to the mutable `tasks.status` sink and to the new sink-resident override table (§2.9).
-- Today there is exactly one runtime login, `mosaic_runtime` (LOGIN INHERIT), sole member of NOLOGIN `mosaic_runtime_capability` (§4 L149-150). The sink therefore has **no writer-authority discrimination** — the root of RC19-B1-01.
-
-The three B1 findings are writes to this sink; the two B2 findings are the privileged-fd → UID-drop handoff used by the runner/importer (§5 L184/L191). This envelope homes one coherent layer over both, now with the User-override and the SELECT/tenant predicate **resident at the sink**.
-
-**[NB-2 / NB-3 — precise compromise-resistance scope (Mos Q1 accepted co-resident-pool residual; NO HALT).]** The prior "a compromised Gateway cannot bypass a User deny or read cross-workspace" framing is **overstated** and is corrected here. All three rung credentials are co-resident in one Gateway process (DB authenticates the _credential_, never the federated end-user — the accepted Mos Q1 residual), and the workspace GUC is _app-set_ with no per-tenant DB check. Precisely:
-
-- **B-1 sink-enforces the User veto against the _Orchestrator-rung path_** — an Orchestrator-pool write to a task carrying an active User deny ERRORS in PostgreSQL regardless of app-layer behavior (a _buggy_ or Orchestrator-path-compromised Gateway cannot skip it). It does **NOT** stop a Gateway compromised badly enough to hold the **User** pool: User = god and may itself clear any veto (User-write-only on the override table). That is the accepted co-resident-pool residual, not a new hole.
-- **B-2 + B2-INSERT sink-enforce tenant isolation against a _buggy_ Gateway** — an omitted/wrong workspace predicate fails **closed** (reads return zero rows; INSERTs ERROR on the NULL/mismatched GUC). They do **NOT** defend a _compromised_ Gateway that forges `mosaic.workspace_id` to a victim tenant, because the GUC carries no per-tenant DB authentication (accepted Mos Q1 residual). The genuine, real closure B2-INSERT delivers is the **buggy / unbound-INSERT** hole: without it, _any_ rung could write a foreign `workspace_id` on INSERT even with a correct GUC set — that is now impossible.
-
-Defending against a fully compromised Gateway forging identity/tenant requires per-federated-user DB credentials = the HALT boundary; Mos Q1 explicitly accepts this residual and rules NO HALT. The claims in §2.9 (B-1) and §2.2/§2.4 (B-2/INSERT) are scoped to match.
-
----
-
-## 1. Contract amendment (exact ownership + text changes)
-
-### 1.1 Homing decision — one NEW owner card + minimal responsibility-widenings
-
-The layer is genuinely **new scope**. The **minimal** closed/disjoint expansion adds **one new owner card, `KBN-101-10`**, owning two brand-new, currently-unowned globs (disjoint from every existing manifest → KBN-101-06 overlap/ownerless/path-existence still pass):
-
-- `packages/db/src/sink-rbac/**` — B1 layer (policy artifact + schema + evaluator + ladder + connection-selection + status-UPSERT + invariant-set + view/rule-forbid enumeration).
-- `packages/db/src/credential-handoff/**` — B2 library (SCM_RIGHTS + non-dumpable assert/verify).
-
-Plus **responsibility-widenings of already-owned files** (no manifest-glob change → no overlap):
-
-| Existing card                            | Already-owned path(s) touched                                                                             | Widened responsibility (v4; v3 items preserved)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| ---------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `KBN-101-00`                             | `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/tests/**`                                             | **[GA-1 FIX]** Create the **fixed rung-ROLES** (3 LOGIN roles + their capability roles) with **deny-by-default base attributes** and **CONNECT** grants; bootstrap catalog tests that each rung role carries the safe attributes (F2) and is **non-owner** of the sink. **[AD-1 FIX]** Amend the frozen §4 **L176 CONNECT-allowlist certification** so the two new LOGIN rungs (`mosaic_runtime_user`, `mosaic_runtime_orchestrator`) are admitted to the `CONNECT` allowlist **and asserted `TEMPORARY`-denied**; otherwise the frozen L176 cert test REDS (it fails if an app login retains TEMPORARY, and it enumerates the CONNECT allowlist). **[NB-5 FIX]** Grant the two new capability roles (`mosaic_runtime_user_capability`, `mosaic_runtime_orchestrator_capability`) the **baseline frozen §4 L176 runtime grants** they need to function: `USAGE ON SCHEMA mosaic`, `USAGE ON SCHEMA drizzle` + `SELECT ON drizzle.__drizzle_migrations, drizzle.__mosaic_migration_manifest` (ledger read), and the relevant sequence `USAGE`/`SELECT` grants — mirroring what `mosaic_runtime_capability` already holds; without these the two new rungs cannot connect/operate and would FAIL the frozen §6 L222 runtime verify (missing inherited capability/sequence/ledger grants → fail-closed). **It owns NO DDL on `tasks` or the override table** — those relations do not exist at bootstrap time, so RLS/column-grant/policy/FORCE/unique-key/trigger DDL **cannot** live here.                                                                                                                                                                                                                                                                                                                 |
-| `KBN-100` (producer; SPEC target of -10) | its own `packages/db/src/schema.ts` + generated `packages/db/drizzle/**` migration + migration tests      | **[GA-1 + GA-2/Q2 + B-1 + B-2 + B-3 + B2-INSERT FIX]** Homes ALL `tasks`-specific sink DDL **and the new `task_status_write_override` table DDL** **after** it creates `tasks`, per the frozen §4 L178 producer/consumer precedent: the rung column-grant matrix (F1/F7/N-3), the **RLS `WITH CHECK` write-source policies** (Q2/F1/N-3), **[B2-INSERT] the workspace-predicate `workspace_id = current_setting('mosaic.workspace_id', true)::uuid` as a conjunct of EVERY rung's INSERT enforced check on `tasks` — realized as a single compound `WITH CHECK` OR `AS RESTRICTIVE`, NEVER as separate permissive policies (v5 composition mandate, §1.4 item 3-bis) — (and thus into the UPSERT INSERT arm), and the symmetric INSERT workspace binding on `task_status_write_override`** so tenant isolation is homed at the sink on the write path too, the **per-rung `SELECT`/`UPDATE` `USING` tenant policies** (B-2), the **override-table subquery** in every `tasks` write policy (B-1), the `tasks (workspace_id,id)` **UNIQUE** candidate key (F4), the `actor_id` attribution metadata column (Q1 audit channel), the **no-status-normalizing-trigger / no-status-view / no-status-rule** invariants (F3/N-1/N-2) — **[NB-1] extended to cover the `task_status_write_override` relation as well** (no status-writing trigger/RULE/SECURITY DEFINER function on the override relation may write `tasks.status`), and — as the **TERMINAL migration step** — `ENABLE`/`FORCE ROW LEVEL SECURITY` on `tasks` and on the override table, run strictly **AFTER** all expand/backfill/repair DML (B-3). **KBN-100's DDL scope statement is explicitly amended** to include RLS + the override table on `tasks` under Mos Q2 coordinator co-authorization (§1.4). Certified deployed by KBN-101-09. |
-| `KBN-101-01`                             | `packages/db/src/connection-identity.ts`(+spec), `apps/gateway/src/database/database.module.ts`(+spec)    | Provision **only the three generic rung pools** at boot; set the per-request **workspace session predicate** (B-2) on each checked-out connection. **[F2 FIX]** Extend the frozen L222 unsafe-attribute checkout assertion to **each** rung connection: effective role == authorized rung **AND** fail closed on SUPERUSER / CREATEROLE / CREATEDB / REPLICATION / **BYPASSRLS** / ownership of the sink tables (`DATABASE_ROLE_UNSAFE`). **[AD-2/N-5 FIX]** -01 **provisions pools only**; it does **not** import -10. The rung→pool SELECTION lives in -10's `connection-selection.ts`, which **consumes** -01's provisioned pools (import direction `10→01`; §2.2).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `KBN-101-03`                             | `packages/db/src/migrator/**` (glob), **`docker/db-migrator.Dockerfile`**                                 | Consume -10's credential-handoff: **SCM_RIGHTS-only** fd acquisition + **non-dumpable re-verify** after the drop to `10003:10003`. **[GA-4(ii) FIX]** The root-only **migrator launch wrapper** homes here (the migrator image).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `KBN-101-05`                             | `apps/gateway/Dockerfile`(+spec), renderer secret matrix                                                  | Renderer mounts **three** rung DSN secrets (`mosaic-db-runtime-url` + `mosaic-db-runtime-user-url` + `mosaic-db-runtime-orchestrator-url`), each `0600 10001:10001`, Gateway-only. Gateway rung-connection selection is a **DB-role choice, not a UID drop**, so -05 owns **no** SCM_RIGHTS/dumpable behavior (moved to -03 per GA-4(ii)).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `KBN-101-02`                             | `packages/storage/src/{cli,migrate-tier}.ts`, `packages/storage/src/adapters/postgres.ts` (already-owned) | Importer privileged-fd case uses SCM_RIGHTS (extends existing safe-open, drop to `10002:10002`); status writes go through the -10 status-preserving-UPSERT helper.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `KBN-101-06`                             | `tools/ci/fixtures/kbn101-ddl-inventory.json`, `.woodpecker/ci.yml`                                       | Add `KBN-101-10` to the inventory fixture/command matrix; add the rung-selection + SCM_RIGHTS + **per-tier RLS negatives** + **override-veto negative** + **cross-workspace read negative** + **[B2-INSERT] cross-workspace INSERT/UPSERT negative** + **NULL-GUC INSERT negative** + **owner/backfill-ordering** cases to the matrix. **[Gate A-delta-2 obs #2 / N-2 continuous — ADOPTED]** Home the **continuous no-status catalog scan as a -06 CI gate that runs on EVERY migration** (promoted from the v3 one-shot -09 recommendation): the scan asserts no status-writing trigger/RULE/`SECURITY DEFINER` function/view on `tasks` **or on `task_status_write_override`** (NB-1), so a future migration that adds a status-write path fails CI, not only the one-time cert.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-
-### 1.2 §7 manifest expansion (KBN-101-06 must still pass)
-
-Add exactly one row to the §7 card table (complete, disjoint ownership universe):
-
-> | `KBN-101-10` declarative sink-RBAC + per-role connection-selection + credential-handoff | 00,01 | **Only:** `packages/db/src/sink-rbac/**`, `packages/db/src/credential-handoff/**`. It homes: the source-controlled declarative RBAC policy artifact + schema + evaluator; the fixed **rung ladder** + federation-aware identity→rung resolver; the rung→DB-credential **connection-selection** module (consumes -01 pools; import direction `10→01`); the **status-preserving-UPSERT** contract + **invariant field-set** module + **no-status view/rule/trigger enumeration**; and the **SCM_RIGHTS** credential-handoff + **non-dumpable** assert/verify library. It creates no roles, no DDL, no Compose/CI/deploy path; it is consumed by -00 (role names), -01 (connection wiring + identity/attribute verify), -02/-03/-05 (write path + fd handoff), specified-against by **KBN-100** (sink DDL: grants/RLS/`USING`+`WITH CHECK` policies/override-table/FORCE/unique-key/trigger-view-rule-invariant on `tasks`), and certified deployed by KBN-101-09. |
-
-Amend the §7 L245 closing sentence (added clause **bold**): "The manifests above are the complete ownership universe for KBN-101 implementation paths **including KBN-101-10**; the KBN-101-06 inventory test fails on overlap, an ownerless in-scope path, or a nonexistent declared path."
-
-**Dependency edges (v3, unchanged from v2 — acyclic; -10 depends only on 00,01):**
-
-- `KBN-101-10 depends on 00,01`
-- `KBN-101-02 depends on 01,03,10`
-- `KBN-101-03 depends on 00,01,10`
-- `KBN-101-05 depends on 00,03,10`
-- `KBN-101-06 depends on 02,03,05,07,10`
-- `KBN-101-08 depends on 00…07,10`
-- `KBN-101-09 depends on KBN-100,08` (unchanged; evidence-only)
-
-**Why still disjoint (KBN-101-06 green — UNCHANGED from v2):** the only NEW ownership is the two -10 globs. The B-1 override table, B-2 `USING` policies, and B-3 terminal-FORCE ordering are **all producer DDL homed in KBN-100's already-owned `schema.ts`/`drizzle/**`** (a *responsibility* widening on files KBN-100 already owns, exactly like the `tasks`sink DDL). The N-1/N-5 additions live inside -10's already-declared`sink-rbac/**`glob. AD-1 amends -00's already-owned`roles.sql`/tests. **No glob is split, narrowed, or shared → KBN-101-06 overlap/ownerless/path-existence stay green.\*\*
-
-### 1.3 §4 identity-model amendment (per-role, closed additive set — F2 hardened; AD-1 CONNECT cert)
-
-Add these rows to the §4 role table (§4 L141-151). **Per-ROLE, not per-user.** Implements Jason's B1 (User = god; main Orchestrator near-god, User-overridable; others deny-by-default):
-
-| Role (added)                             | Attributes (F2-hardened)                                                                                                                                 | Membership / session use                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `mosaic_runtime_user_capability`         | `NOLOGIN`, no ownership/admin attrs.                                                                                                                     | Holds the **User (god)** rung's named grants incl. `INSERT(status)`, `UPDATE(status)` + the status-transition RLS `WITH CHECK` policy on `tasks`; **plus the SOLE `INSERT/UPDATE/DELETE` grant on `task_status_write_override`** (B-1); never granted to Orchestrator/base.                                                                                                                                                                                                                                                       |
-| `mosaic_runtime_orchestrator_capability` | `NOLOGIN`, no ownership/admin attrs.                                                                                                                     | Holds the **Orchestrator (near-god)** rung's grants; identical to User **except** (i) every `tasks` write policy **subqueries** the override table and is REJECTED at the sink when an active User deny row exists for that `(workspace_id, task_id, orchestrator)` (B-1); (ii) `INSERT(status)` is pinned by `WITH CHECK` to a **non-terminal initial status** (N-3) — only User may INSERT an arbitrary/terminal status; (iii) it has only `SELECT` (never write) on the override table. Scope is tier/task-identity only (F6). |
-| `mosaic_runtime_user`                    | **`LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`**, no ownership; **non-owner of every sink table + the override table**. | Member of `mosaic_runtime_user_capability` only (`WITH INHERIT TRUE, SET FALSE, ADMIN FALSE`); the connection-selection **User-rung** credential. **[AD-1]** Requires `CONNECT`, denied `TEMPORARY`.                                                                                                                                                                                                                                                                                                                              |
-| `mosaic_runtime_orchestrator`            | **`LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`**, no ownership; **non-owner of every sink table + the override table**. | Member of `mosaic_runtime_orchestrator_capability` only (same INHERIT/SET/ADMIN flags); the **Orchestrator-rung** credential. **[AD-1]** Requires `CONNECT`, denied `TEMPORARY`.                                                                                                                                                                                                                                                                                                                                                  |
-
-The existing `mosaic_runtime` is confirmed already `LOGIN INHERIT` with no admin attrs (frozen L150) and non-owner; it becomes the **others / deny-by-default** base rung. On the sink it retains `SELECT` (workspace-scoped `USING`, B-2), `INSERT (explicit non-status column list)` (F1), and column-level `UPDATE` on **non-status, non-invariant, non-key, non-tenancy** columns only (F7), each `USING` workspace-scoped; it has **no** `INSERT(status)`, **no** `UPDATE(status)`, **no** `DELETE`, **no** `TRUNCATE` on `tasks`, **no** write on the override table, and RLS denies its status/override writes by default. The rung set is **fixed at three**.
-
-**F2 note:** the three rung LOGIN roles' `NOBYPASSRLS` + `NOSUPERUSER` + **non-ownership** are load-bearing — `FORCE ROW LEVEL SECURITY` collapses for any SUPERUSER/BYPASSRLS role and RLS is silently bypassed by a table **owner**. These attributes are declared in -00 bootstrap, catalog-proven in -00 tests, and re-verified at every checkout by -01 (extended L222 assertion).
-
-**[AD-1] CONNECT-allowlist certification amendment (frozen §4 L176):** L176 today grants `CONNECT` only to `mosaic_runtime`, `mosaic_migrator`, and the bootstrap actor, and its cert **fails if an unrelated login retains `CONNECT` or either application login retains `TEMPORARY`.** The two new LOGIN rungs are additional application logins that require `CONNECT` and must be `TEMPORARY`-denied. The -00 row + rc.20 text **explicitly amend the L176 allowlist** to `{mosaic_runtime, mosaic_runtime_user, mosaic_runtime_orchestrator, mosaic_migrator, bootstrap-actor}`, and the -00 cert asserts `TEMPORARY` denial for all three runtime rungs. Without this amendment the frozen -00 cert test REDS on the two new logins.
-
-**rc.20 amendment text (v3 — extends v2)** — amend §4's closing note and SHARED-CONTRACT rc.5 L82/L88-90 ("Non-effect: role graph … unchanged / neither creates roles/secrets") with:
-
-> **rc.20 (Envelope A) — authorized by Jason's declarative-RBAC B1 ruling + Mos OPTION A + Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS):** adds (i) the fixed **User/Orchestrator/others** runtime rung-roles (per-ROLE, deny-by-default); each rung **LOGIN** role is `NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`, **NON-OWNER** of every sink/override table, **added to the §4 L176 `CONNECT` allowlist**, and **asserted `TEMPORARY`-denied**. **No per-federated-user role or credential is created** — federated identity maps to a rung **at authorization time only**, and per-writer **attribution lives in metadata columns** (app-supplied `actor_id` on `task_events`), **never** in DB credentials/roles. (ii) Two new fixed rung DSN secrets **`mosaic-db-runtime-user-url`** and **`mosaic-db-runtime-orchestrator-url`** (Gateway-only, `0600 10001:10001`), extending the frozen runtime-URL secret row. (iii) **RLS `WITH CHECK` write-source policies (including the B2-INSERT per-rung INSERT tenant binding `workspace_id = current_setting('mosaic.workspace_id', true)::uuid`, composed as a SINGLE compound `WITH CHECK` or `AS RESTRICTIVE` — never multi-permissive-intended-to-AND, per the v5 composition mandate §1.4 item 3-bis) + per-rung `SELECT`/`UPDATE` `USING` tenant policies + `FORCE ROW LEVEL SECURITY`** on the sink table `tasks` **and on the new sink-resident `task_status_write_override` table** (tighten-only, deny-by-default) — a §10 schema-v1 **mechanism addition** beyond the prior grant/revoke-only model, authorized by Mos Q2 as coordinator co-authorization with Jason's B1. **The two new rung capability roles additionally receive the baseline frozen §4 L176 runtime grants (`USAGE ON mosaic`, `drizzle` ledger `SELECT`, sequence grants) [NB-5] so they satisfy the frozen §6 L222 runtime verify.** (iv) The **`task_status_write_override` table** (keyed `(workspace_id, task_id, tier)`, no per-writer key), written only by the User rung, read by the Orchestrator/base rung `tasks` write-policy subquery, homes the User-override **at the sink**. The sink DDL (grants + RLS `USING`/`WITH CHECK` + override table + FORCE + unique key + trigger/view/rule invariants) is homed in the **KBN-100 producer** after it creates `tasks`, with `FORCE RLS` as the **terminal** migration step after all backfill/repair DML, per the §4 L178 producer/consumer precedent.
-
-> **Frozen-invariant note (authorization basis):** touching the frozen role graph, the §4 L176 CONNECT allowlist, and adding RLS + the override table are §10 contract-change classes (MISSION-MANIFEST §10; SHARED-CONTRACT L82/L88-90; frozen §4 L176). They are authorized here by **Jason B1 + Mos OPTION A + Mos Q1 + Mos Q2**. The addition is strictly a **fixed per-ROLE** set + a **tighten-only** RLS mechanism + a **task/tier-scoped** override table. It stops exactly at the HALT boundary: **no** per-federated-user topology is introduced (§5 proof).
-
-### 1.4 §10 mechanism amendment — RLS `WITH CHECK` (write-source + INSERT tenant-bound) + `USING` + sink-resident override at the sink (Q2), with the two mandatory conditions
-
-The frozen write-authority model is grant/revoke-only; **RLS appears nowhere in the frozen contract.** Mos Q2 **AUTHORIZES** adding declarative, deny-by-default, **enforce-AT-THE-SINK, fail-closed** RLS policies, because grant/revoke alone cannot express (a) row-level _write-source_ enforcement (pin new-row status, F1/N-3), (b) a _sink-enforced_ User-override that the Orchestrator-rung path cannot skip (B-1), (c) _tenant-scoped reads/updates_ (B-2), or (d) **[B2-INSERT] _tenant-scoped INSERTs_ — binding `workspace_id` on the write/create path**, which neither column grants nor the `USING` read policy can do (PostgreSQL does not apply `USING` to INSERT). RLS is **tighten-only**: it can only further restrict beyond the column grants, never widen them.
-
-**KBN-100 producer DDL scope is explicitly amended** to include, on `tasks` (and, where noted, the override table):
-
-1. `ALTER TABLE tasks ENABLE ROW LEVEL SECURITY;` — and the same on `task_status_write_override`.
-2. **CONDITION (b) — EXPLICIT DECISION: `ALTER TABLE tasks FORCE ROW LEVEL SECURITY;`** (and on the override table) — DECIDED **YES/ON**, stated explicitly and not left defaulted, so that **even the table owner (`mosaic_schema_owner`) and any maintenance connection cannot silently bypass RLS**. (Directly closes the live U-Connect failure mode where an owner connection with `rls_forced=false` silently VOIDED RLS.)
-3. A **deny-all default** posture (no permissive policy) plus per-rung policies:
-   - **Write (`WITH CHECK`):** base/others rung → new-row `status = <initial state 'backlog'>` only, no status UPDATE; **Orchestrator rung → status INSERT pinned to a non-terminal initial status (N-3), and every write (`INSERT`/`UPDATE`/transition) additionally `WITH CHECK`'d against `NOT EXISTS(<active User deny row for (workspace_id, id, 'orchestrator')>)` (B-1)**; User rung → status INSERT (any legal status) / transition. Every write policy is `WITH CHECK` (write-source), tighten-only.
-   - **[B2-INSERT — tenant isolation on the write path] Every rung's INSERT `WITH CHECK` on `tasks` MUST include the workspace predicate `workspace_id = current_setting('mosaic.workspace_id', true)::uuid` as a conjunct of the _same_ enforced check that carries the status-pin (and, for the Orchestrator rung, the B-1 override subquery) — see the COMPOSITION MANDATE (item 3-bis) for the exact realization.** This is REQUIRED because PostgreSQL does **NOT** apply `USING` to INSERT, and the explicit status-pinning `WITH CHECK` **suppresses** the `USING`→`WITH CHECK` substitution — so in v3 `workspace_id` was **unbound on the INSERT path** and any rung could `INSERT INTO tasks (workspace_id, …) VALUES (<foreign W2>, …)` (directly or via the sanctioned status-upsert INSERT arm) into a victim workspace, defeating B-2's "tenant isolation homed at the sink" goal and evading SHARED-CONTRACT §7.1 (body workspace forbidden). **CORRECTED SEMANTICS (v5 — the delta-3 fix):** multiple **PERMISSIVE** policies for the same command combine with **OR** — a row is admitted if it satisfies **ANY** one permissive policy's `WITH CHECK`, ANDed with all `AS RESTRICTIVE` policies' checks. "All applicable `WITH CHECK` clauses must pass / they AND" is **FALSE as a general rule** and is struck from this envelope; the AND-conjunction the B2-INSERT closure depends on holds ONLY (a) _within a single policy_ whose `WITH CHECK` is one AND-conjoined expression, or (b) _across `AS RESTRICTIVE` policies_. Realizing the status-pin, the workspace-bind, and the override as separate _permissive_ policies would let a foreign-workspace INSERT that satisfies only the status-pin be admitted by OR — re-opening B2-INSERT/B-1 — which item 3-bis forbids. **Fail-closed on NULL:** an absent GUC makes `current_setting(...,true)` return NULL, the equality yields NULL (not true), and — provided the predicate is a conjunct of the single enforced check (item 3-bis) — the INSERT **ERRORS at the sink**. The **same INSERT workspace binding is applied symmetrically to `task_status_write_override`**, under the identical composition mandate (its own single compound `WITH CHECK` or `AS RESTRICTIVE`).
-   - **Read/lock (`USING`) — B-2:** per-rung `SELECT` and `UPDATE` `USING` policies **workspace-scoped** by the session predicate `workspace_id = current_setting('mosaic.workspace_id', true)::uuid` (set per request by -01, §2.2). **`USING(true)` is explicitly FORBIDDEN** — tenant isolation rides on this predicate; a lazy `USING(true)` would expose every workspace's rows to every rung and is a fail-closed contract violation caught by a negative test.
-   - **3-bis. [v5 — LOAD-BEARING] COMPOSITION MANDATE (how the sink check MUST be realized; both delta-3 gates prescribed it).** Per rung, per command (INSERT / UPDATE / transition), the sink enforcement of the status-pin **AND** the workspace-bind **AND** (Orchestrator rung only) the User-override subquery MUST be realized as EITHER:
-     - **(a) a SINGLE policy** whose `WITH CHECK` is the _full conjunction_ — `<status-pin> AND workspace_id = current_setting('mosaic.workspace_id', true)::uuid` and, for the Orchestrator rung, `AND NOT EXISTS(<active User-override deny row for (workspace_id, id, 'orchestrator')>)`; **OR**
-     - **(b)** the status-pin as the **SOLE PERMISSIVE** policy for that command, **plus** the workspace-bind and (Orchestrator) the override subquery authored **`AS RESTRICTIVE`** (restrictive policies AND with everything, so a row must pass every restrictive check _and_ at least one permissive check).
-     - **EXPLICITLY FORBIDDEN:** realizing the status-pin, the workspace-bind, and the override as **multiple _permissive_ policies whose predicates are intended to AND.** Permissive policies combine with **OR**, so that realization admits a foreign-workspace INSERT that satisfies only the status-pin (cross-tenant injection) and equally bypasses the B-1 override — exactly the delta-3 defect. This mandate applies to the `tasks` INSERT/UPDATE/transition policies **AND** to the `task_status_write_override` table's own policies (same single-compound-`WITH CHECK`-or-`AS RESTRICTIVE` requirement; never multi-permissive-intended-to-AND). The producer DDL and the -09/-06 certification assert the realized policies are either single-compound or `AS RESTRICTIVE` (never separate permissive policies expected to AND) — a lint/catalog check over `pg_policy.polpermissive` backs it.
-     - **[v6 — N1: strengthened `pg_policy.polpermissive` lint (supplementary, NOT sufficient).]** The `pg_policy.polpermissive` lint (continuous -06 scan, §2.7) MUST (a) count permissive policies **grouped by EFFECTIVE role — including `PUBLIC` and role inheritance**, not merely by the policy's named `TO` role: a `TO PUBLIC` (or inherited-through-a-capability-role) permissive policy applicable to a rung's command is counted **alongside** that rung's status-pin, because at evaluation time it OR-widens exactly like a second same-role permissive policy — so a `TO PUBLIC` permissive next to a rung's status-pin is a **lint failure**; and (b) ideally **reject an internally-disjunctive single `WITH CHECK`** — a single policy whose expression is itself `status_pin OR workspace_bind` satisfies the naive one-permissive-policy count yet violates the composition mandate exactly as two permissive policies would, so the lint should detect a top-level `OR` between the status-pin and the workspace-bind/override conjuncts within one policy expression. **The lint is SUPPLEMENTARY, not sufficient:** the **behavioral positive-controls remain the PRIMARY proof** of correct composition (dropping the workspace conjunct — resp. the override subquery — alone flips the hardened negative to a PASS; §2.4 clause 5 / §2.9). The lint backstops the catalog shape; it does not replace the behavioral proof.
-     - **[v6 — N2: option-(b) vacuous-deny guard invariant — ≥1 permissive per writable (rung, command).]** Under option (b) (status-pin as the **sole PERMISSIVE** policy + workspace-bind/override `AS RESTRICTIVE`), PostgreSQL admits a row only if **≥1 PERMISSIVE `WITH CHECK` is TRUE AND all RESTRICTIVE checks pass** — so if a writable (rung, command) has **zero** permissive policies, every restrictive-only evaluation denies and the command **over-denies / fails closed** (nothing can ever be written). Therefore there **MUST be ≥1 PERMISSIVE policy per writable (rung, command)** — this "≥1 permissive per writable (rung, command)" is the **load-bearing option-(b) guard invariant** (the workspace-bind/override being restrictive is safe _only_ because the status-pin supplies the required permissive). It is verified by the mandated **"same-workspace valid-status write succeeds" positive tests** for each writable command — INSERT, transition/UPDATE, and SELECT — which would FAIL (spurious over-deny) if the permissive were dropped, and by the N1 lint confirming exactly one permissive status-pin (grouped by effective role) is present per writable (rung, command).
-4. **B-3 migration ordering (TERMINAL FORCE):** all expand/backfill/repair DML on `tasks` (SHARED-CONTRACT §5.1 phase-3 L165-171, §5.3 L188) runs **FIRST**, while `tasks` has RLS **disabled**; the `ENABLE`/`FORCE ROW LEVEL SECURITY` statements are the **TERMINAL** DDL of the activation migration. **No standing `mosaic_schema_owner` ALLOW write policy exists after activation** (that would recreate the unconstrained owner write path = U-Connect mode). Any schema_owner maintenance policy, if ever needed, is **migration-only** and must be proven **unreachable by the 3 runtime LOGIN roles** + a negative test.
-
-**CONDITION (a):** every runtime per-role LOGIN role (`mosaic_runtime`, `mosaic_runtime_user`, `mosaic_runtime_orchestrator`) **MUST remain NON-OWNER** of every sink table **and the override table** (owner stays `mosaic_schema_owner`). Enforced by -00 bootstrap catalog assertion + re-verified at each checkout by -01 (F2). A rung role that owns a sink/override table is a fail-closed contract violation.
-
-**Break-glass boundary (B-3, named explicitly in KBN-101-09 cert):** the ONLY identities that legitimately bypass `FORCE RLS` are the sanctioned break-glass actors named in the frozen contract — `mosaic_extension_owner` (`NOLOGIN SUPERUSER`, §4.1 L146) and the external platform bootstrap actor (superuser, §4/§7; §9 L266 residual authority). Both are `NOLOGIN`/external, carry no runtime credential, and are outside application containment. The -09 cert **names these two as the accepted, audited boundary** — not a new hole — and asserts the three runtime LOGIN rungs are NOT superuser/NOT BYPASSRLS and cannot assume either.
-
-**[NB-4 — owner-toggle-FORCE containment is NON-REACHABILITY, not incapability.]** The -09 break-glass enumeration must **additionally name `mosaic_schema_owner`** (frozen §4 L145, `NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`) as a **contained-but-CAPABLE** path. A table **owner** — regardless of `NOSUPERUSER`/`NOBYPASSRLS` — can `ALTER TABLE tasks DISABLE ROW LEVEL SECURITY` or `ALTER TABLE tasks NO FORCE ROW LEVEL SECURITY` and then write freely; `FORCE`/`NOBYPASSRLS` do **not** make an owner incapable. So the containment claim is **NOT** "the owner cannot bypass RLS" — it is **"the owner role is NOT REACHABLE from the three runtime LOGIN rungs."** The -09 cert asserts this non-reachability **explicitly**: (i) `mosaic_schema_owner` is `NOLOGIN` (no direct credential); (ii) it is reachable only via `mosaic_migrator`'s `SET ROLE` (frozen §4 L147, migrator runner-before-Gateway, `max:1` locked migration session), which is **not** one of the three runtime rungs and holds no runtime pool; (iii) none of `mosaic_runtime` / `mosaic_runtime_user` / `mosaic_runtime_orchestrator` is a member of, or can `SET ROLE` to, `mosaic_schema_owner` or `mosaic_migrator` (catalog-proven at -00, re-verified at every checkout by -01's L222 non-owner/assumability assertion). **[NB-4-transitive — Gate B-delta-3 nit, folded]** the non-reachability assertion in the -09 cert MUST be stated as **TRANSITIVE membership**, not merely the absence of a **direct** `pg_auth_members` row: PostgreSQL's ownership/privilege check returns true for an **inherited** membership reached _through a capability role_, which would confer the owner's `ALTER TABLE … NO FORCE` / `DISABLE ROW LEVEL SECURITY` right. The assertion therefore uses the recursive predicates — `NOT pg_has_role('mosaic_runtime_user', 'mosaic_schema_owner', 'USAGE')` (and the same for each runtime rung against `mosaic_schema_owner` and `mosaic_migrator`), equivalently `NOT has_privs_of_role(<rung>, 'mosaic_schema_owner')` — which fold in transitive/inherited membership through any intermediate (capability) role. The frozen §6 L222 fail-closed-on "owner/migrator identity **or assumability**" check plausibly already covers this transitive case; v5 states "**transitive membership**" **explicitly** in the -09 cert assertion so no implementation reads "non-member" as only the direct-edge check. **[v6 — F-NB4: cover SET-ROLE assumability, not only inherited privilege.]** The v5 predicates `NOT pg_has_role(<rung>, 'mosaic_schema_owner', 'USAGE')` / `NOT has_privs_of_role(<rung>, 'mosaic_schema_owner')` capture the **inherited-privilege** axis, but a membership granted `WITH INHERIT FALSE, SET TRUE` yields `has_privs_of_role = FALSE` **yet still allows `SET ROLE mosaic_schema_owner`** followed by `ALTER TABLE … NO FORCE ROW LEVEL SECURITY` — an assumability path the `USAGE`/`has_privs_of_role` predicate alone does **not** close. The -09 cert assertion therefore **conjoins the `MEMBER` variant** — `NOT pg_has_role(<rung>, 'mosaic_schema_owner', 'MEMBER')` **AND** `NOT pg_has_role(<rung>, 'mosaic_migrator', 'MEMBER')` — for **each of the three runtime rungs** (`mosaic_runtime`, `mosaic_runtime_user`, `mosaic_runtime_orchestrator`); the `MEMBER` privilege captures SET-ROLE reachability **regardless of `INHERIT`**, so `pg_has_role(rung, owner, 'USAGE')` **AND** `pg_has_role(rung, owner, 'MEMBER')` are asserted false together. This is stated explicitly rather than leaning on "frozen §6 L222 assumability plausibly covers it." (The intended role graph is already safe — per envelope §1.3 + frozen §4 L150, each rung is a member of **only** its own capability role, `WITH INHERIT TRUE, SET FALSE, ADMIN FALSE`, and of no owner/migrator role — so no live `SET TRUE` edge to the owner/migrator exists; this fold is **assertion-completeness hardening, not a live hole.**) The owner's toggle-then-write capability is therefore real but confined to the migrator/owner phase (frozen §5, runner-before-Gateway), never to a live runtime rung — that is the containment, stated as **transitive non-reachability** rather than incapability.
-
-**Red-team requirement (baked into §3/§4; v5-HARDENED so the negatives cannot false-green under the OR-trap):** each per-rung policy is proven **deny-by-default via NEGATIVE tests PER TIER** in real PostgreSQL:
-
-- an unauthorized write-source (base terminal-status INSERT/transition) that **ERRORS**;
-- **[B2-INSERT — hardened] a cross-workspace INSERT/UPSERT using a row OTHERWISE VALID for the rung** — a status the rung's pin **ACCEPTS** (e.g. **base rung + `status='backlog'`**, and no active override), differing from a passing insert ONLY in `workspace_id = <foreign W2>` — so the rejection **isolates the workspace bind** (not a status/override rejection). Tested both directly and via the status-upsert INSERT arm; it **ERRORS at the sink**. **Positive-control:** removing the workspace-bind conjunct **alone** (leaving the status-pin) flips this negative to a **PASS**, proving the _workspace bind_, not the status-pin, is doing the rejecting (and proving the composition is a single enforced conjunction / RESTRICTIVE, not an OR of separate permissive policies).
-- **[B-1 — hardened] an Orchestrator write vetoed by an active User-override deny row, using a transition the Orchestrator pin OTHERWISE ACCEPTS** (a legal non-terminal transition on `(W, T)` that would succeed absent the deny row) — so the rejection **isolates the override subquery**. It **ERRORS at the sink**. **Positive-control:** removing the override subquery **alone** flips this negative to a **PASS**, proving the _override_, not the status-pin/workspace-bind, is doing the rejecting.
-- a **cross-workspace `SELECT` under the wrong/absent session predicate** → zero rows;
-- **[B2-INSERT] a NULL-GUC INSERT** (absent `mosaic.workspace_id`) that **ERRORS** (fail-closed on NULL);
-- a **same-workspace INSERT with a valid status** that **succeeds** (proving the predicate composes with F1/N-3 and does not over-deny);
-- an **owner/maintenance connection attempting a post-activation `tasks` write** that must **fail under `FORCE`**.
-  All rejections **ERROR at the sink**. The two positive-controls are load-bearing: they are the direct proof that the composition is single-compound-`WITH CHECK`-or-`AS RESTRICTIVE` (delta-3), because under the forbidden multi-permissive-OR realization the hardened cross-workspace / override negatives would already PASS (false-green) without removing anything.
-
----
-
-## 2. Design
-
-### 2.1 Declarative RBAC policy (source-controlled artifact + schema)
-
-- **Artifact:** `packages/db/src/sink-rbac/policy.task-status.v1.ts` — a source-controlled, versioned, deny-by-default policy object; the single source of truth for "who may write the sink." No policy lives in the database except the _derived_ GRANT/RLS state the KBN-100 producer emits from it.
-- **Schema:** `packages/db/src/sink-rbac/policy.schema.ts` — a typed schema (zod/TS) validating: `rungs` (exactly the fixed ladder), per-rung `allow`/`deny` verbs (`insert`, `insert:status`, `update:<column-set>`, `transition:status`, `delete` — always deny), `federationMap` (federated-identity-claim → **rung**, never a role/credential per user), and `userOverride`.
-  - **[F6 FIX] `userOverride` scope guardrail:** the schema **constrains** override predicates to **tier- + task-identity (row) scope `(workspace_id, task_id, tier)`** and **explicitly FORBIDS** a per-federated-writer identity as an override or authority key (the Q1 re-open trigger). A policy that names a per-federated-writer identity as an override/authority key **fails schema validation** (fail-closed at load). The override is realized as the sink-resident `task_status_write_override` table (§2.9), NOT as app-resolved state. Per-writer attribution is not an authority input; it flows only to the audit metadata column (§2.6).
-- **Evaluator:** `packages/db/src/sink-rbac/evaluate.ts` — pure `(identityClaims, requestedWrite) → Decision ∈ {allow(rung), deny(reason)}`, **deny-by-default**, tier resolution only. It **only chooses a rung**; it never mints credentials and — critically (B-1) — **it is NOT the enforcement point for the User-override**: the override is enforced in PostgreSQL by the write-policy subquery, so a compromised Gateway that skips the evaluator still cannot bypass a User deny.
-- **Ladder / federation-awareness:** `packages/db/src/sink-rbac/ladder.ts` — fixed order `User > Orchestrator > others` and `resolveRung(federatedIdentity) → rung` at authorization time (Q1: federation-awareness lives in the resolver; the sink authorizes by the writer's declared ROLE/tier).
-- **Enforcement is AT THE SINK, fail-closed:** the evaluator's rung choice only selects _which pre-provisioned connection_ is used; PostgreSQL then enforces via (a) revoked base privileges, (b) column-level `INSERT(status)`/`UPDATE(status)` granted only to the User/Orchestrator capabilities, (c) `FORCE ROW LEVEL SECURITY` + deny-all default + per-rung `WITH CHECK` policies **including the override subquery** (B-1), (d) per-rung `SELECT`/`UPDATE` `USING` **workspace predicate** (B-2, tenant isolation at the sink), (e) `DELETE/TRUNCATE` revoked from all runtime rungs, and (f) `UPDATE` on key/tenancy/invariant columns revoked from **all** rungs (F7). A mis-authorized OR override-vetoed OR cross-workspace write **fails closed in PostgreSQL** because the connection's effective DB role lacks the privilege or the policy predicate rejects the row — caller discipline is not trusted.
-
-### 2.2 Per-role credential + connection-selection model (NO per-user roles; import direction pinned)
-
-```
-federated writer ──(verified identity claim)──► evaluate.ts ──► rung (one of 3, fixed)
-                                                                 │
-                                      connection-selection.ts ───┤ selects the PRE-PROVISIONED
-                                        (in -10; consumes -01)    │ pool for that rung; sets
-                                                                 │ SET LOCAL mosaic.workspace_id
-                                                                 ▼
-                    mosaic_runtime_user | mosaic_runtime_orchestrator | mosaic_runtime
-                     └── PostgreSQL enforces grants + FORCE RLS WITH CHECK(+override) + USING(workspace) ──┘
-```
-
-- **`packages/db/src/sink-rbac/connection-selection.ts`** maps `rung → pooled connection`. **Exactly three** connection pools, one per rung, each opened with that rung's **fixed** mounted-secret DSN. Credentials = rungs = **3**, constant.
-- **[AD-2/N-5 — import direction pinned]** `-01` (`database.module.ts`) **provisions ONLY the three generic rung pools** at boot and knows nothing of rung _selection_. The rung→pool SELECTION lives entirely in **-10's `connection-selection.ts`**, which is **consumed by the write-path cards (`-02`/`-03`/`-05`, which already `depends on 10`)** and is **NEVER imported by `-01`**. Direction is therefore `10 → 01` (10's selection consumes 01's pools) — **acyclic; there is no `01 → 10` cycle.** An impl lane must not read "01 wires 10" as `01 → 10`.
-- **[B-2 — workspace session predicate]** on checkout, before the first query, -01 sets `SET LOCAL mosaic.workspace_id = <verified request workspace>` inside the request transaction; the per-rung `USING` policies **and the B2-INSERT `WITH CHECK`** read `current_setting('mosaic.workspace_id', true)::uuid`. The predicate is set from the **server-verified** tenant context, never from a body field (SHARED-CONTRACT §7.1 "Body workspace fields are forbidden"). A missing/invalid setting → `USING` yields no rows (fail-closed read) and INSERT `WITH CHECK` yields NULL→ERROR (fail-closed write), never cross-workspace exposure.
-  - **[NB-3 — compromise scope]** the GUC is **app-set with no per-tenant DB authentication**, so B-2 (reads/UPDATE `USING`) and B2-INSERT protect a **buggy** Gateway (omitted/wrong predicate → fail-closed), NOT a **compromised** Gateway that forges `mosaic.workspace_id` to a victim tenant (accepted Mos Q1 co-resident-pool residual; defending it requires per-user DB creds = the HALT boundary). The genuine closure B2-INSERT delivers is the **buggy / unbound-INSERT** hole: even with a correct GUC, v3 left `workspace_id` unbound on INSERT so any rung could stamp a foreign workspace — now impossible.
-  - **[Gate B 2(a) — poisoned-pool / SET LOCAL negative]** the `mosaic.workspace_id` GUC is folded into the frozen L174 **poisoned-pooled-session-reset + transaction `SET LOCAL` restoration** negative test (which already covers `search_path`): a negative proves `mosaic.workspace_id` is **transaction-scoped via `SET LOCAL`** (mirroring the frozen `SET LOCAL search_path` discipline, §4 L152) so a pooled connection **cannot leak a stale workspace** across requests — an un-reset/poisoned session fails closed, and a committed/rolled-back transaction does not carry the prior request's workspace.
-- **[F2 FIX] Identity + attribute verification at checkout** (`connection-identity.ts`): verify effective role == the rung's expected DB role **AND** assert the safe attributes — fail closed (`DATABASE_ROLE_UNSAFE`) on SUPERUSER, CREATEROLE, CREATEDB, REPLICATION, **BYPASSRLS**, or ownership of any sink/override table. Extends the frozen L222 check to **each** rung connection.
-- **No per-federated-user role/credential:** a new federated user needs **zero** new DB roles/credentials/secrets/pools — it resolves to an existing rung. Federation growth is O(1) in DB-role count.
-
-### 2.3 Status-preserving UPSERT on a stable natural key (F4 bound)
-
-- **`packages/db/src/sink-rbac/status-upsert.ts`** — the single sanctioned refresh helper: `INSERT INTO tasks (natural_key…, <mutable non-status cols…>) VALUES (…) ON CONFLICT (<natural key>) DO UPDATE SET <mutable non-status cols…>` — **`status` is never in the `DO UPDATE SET` list**, so a refresh preserves existing `status` byte-for-byte.
-- **[B-2 dependency]** the `ON CONFLICT` conflict-probe/refresh reads the existing row; under `FORCE RLS` this requires the per-rung `SELECT`/`UPDATE` `USING` policy to admit the row (workspace-scoped). Without B-2's `USING` policies the probe would see zero rows and the UPSERT would spuriously INSERT-conflict or mis-refresh — B-2 is what makes the sanctioned UPSERT actually work post-activation.
-- **[B2-INSERT dependency]** the UPSERT's **INSERT arm** is a `tasks` INSERT and is therefore subject to the B2-INSERT workspace `WITH CHECK` (§1.4/§2.4): a status-upsert that supplies a foreign `workspace_id` (or runs under an absent GUC) **ERRORS at the sink**, closing the sanctioned-UPSERT INSERT path that v3 left tenant-unbound. The helper sets `workspace_id` from the server-verified tenant context (never a body field, §7.1); it matches the session GUC by construction.
-- **[F4 FIX] Natural key:** the tenant-scoped stable identity **`(workspace_id, id)`**. No frozen `tasks(workspace_id,id)` unique key exists (only `missions_workspace_id_uidx`, rc.4 L94) — `ON CONFLICT` against a nonexistent unique index is a **HARD planning error** that fails loud. Therefore **KBN-100 MUST create `tasks (workspace_id,id)` UNIQUE** (aligned to the SI-001 pattern, SHARED-CONTRACT §5.2). **Fallback:** if KBN-100 keys `tasks` on global `id` only, the UPSERT natural key **re-binds to `(id)`** (spec-level, no HALT).
-- **Status changes only via an authorized transition:** `transitionStatus()` guarded by (a) the rung's `transition:status` policy verb, (b) `UPDATE(status)` present only on User/Orchestrator capabilities, (c) the RLS `WITH CHECK` transition policy (admits the update only as an explicit transition, never as a refresh/grant side effect) **plus the override subquery for the Orchestrator rung (B-1)**, and (d) the `USING` workspace predicate to see/lock the row (B-2). `DELETE` is denied to all runtime rungs → **DELETE + default-INSERT status reset is impossible at the sink** (fails closed on the DELETE).
-
-### 2.4 INSERT-time status constraint (F1 BLOCKING + N-3 hardening)
-
-Base `mosaic_runtime` must not stamp an arbitrary terminal status at creation, **and the Orchestrator rung must not create a task directly at a terminal status** (N-3). Layered fail-closed controls (homed in the KBN-100 producer DDL):
-
-1. **Column-privilege:** `GRANT INSERT (<explicit non-status column list>) ON tasks TO mosaic_runtime_capability;` — the base rung **cannot name `status` on INSERT**, so `status` takes its column **DEFAULT** (`backlog`). `INSERT(status)` is granted **only** to the User/Orchestrator capabilities.
-2. **RLS `INSERT … WITH CHECK` (base):** pins **new-row `status = 'backlog'`** for the base rung.
-3. **[N-3 FIX] RLS `INSERT … WITH CHECK` (Orchestrator):** pins the Orchestrator rung's new-row status to a **non-terminal initial status** (`status IN {backlog, ready}`; never `done`/`cancelled`/`in_review`). **Only the User (god) rung may INSERT an arbitrary/terminal status.** This prevents an Orchestrator creating a task directly at `done`/`cancelled`, skipping the transition/lease/review trail (SHARED-CONTRACT §7.2 `POST /tasks` L272 vs `POST /tasks/:taskId/transition` L275). The exact terminal/non-terminal set is bound by KBN-100 to the §3 L134 vocabulary.
-4. **[B2-INSERT FIX] RLS `INSERT … WITH CHECK` (EVERY rung, tenant binding):** every rung's INSERT sink-check MUST include `workspace_id = current_setting('mosaic.workspace_id', true)::uuid` as a conjunct of the **same enforced check** that carries the status-pin (base=`backlog`, Orch=non-terminal, User=any) **and** the B-1 override subquery on the Orchestrator rung. `status` is bound by clause 2/3; `workspace_id` is bound by this conjunct; they are orthogonal columns so there is no conflict. **[v5 — corrected PostgreSQL semantics; the delta-3 fix]** the earlier justification "because PostgreSQL requires all applicable `WITH CHECK` clauses to pass, they AND" is **FALSE and is struck**: multiple **PERMISSIVE** policies for a command combine with **OR** (a row is admitted if it satisfies **ANY** one permissive `WITH CHECK`, ANDed with all `AS RESTRICTIVE` checks). The AND this closure needs holds ONLY (a) within a _single_ policy whose `WITH CHECK` is one AND-conjoined expression, or (b) across `AS RESTRICTIVE` policies. **Fail-closed on NULL:** an absent GUC → NULL equality → INSERT ERRORS — _provided_ the workspace conjunct sits in the single enforced check (clause 5). This closes the v3 gap where the explicit status `WITH CHECK` suppressed the `USING`→`WITH CHECK` substitution, leaving `workspace_id` unbound on INSERT and allowing any rung to INSERT into a foreign workspace.
-5. **[v5 COMPOSITION MANDATE — LOAD-BEARING] Single-compound-`WITH CHECK`-or-`AS RESTRICTIVE`, never multi-permissive-intended-to-AND.** The status-pin (clause 2/3), the workspace-bind (clause 4), and (Orchestrator) the B-1 override subquery MUST be realized per rung, per command as EITHER **(a)** a **SINGLE policy** whose `WITH CHECK` is the full conjunction `<status-pin> AND workspace_id = current_setting('mosaic.workspace_id', true)::uuid [AND NOT EXISTS(<active override deny row>)]`; **OR (b)** the status-pin as the **sole PERMISSIVE** policy **plus** the workspace-bind and (Orchestrator) the override authored **`AS RESTRICTIVE`**. Realizing them as **multiple _permissive_ policies intended to AND is EXPLICITLY FORBIDDEN** — permissive policies OR, so a foreign-workspace INSERT satisfying only the status-pin (e.g. base + `backlog` + foreign `workspace_id`) would be OR-admitted, re-opening B2-INSERT, and an override-vetoed Orchestrator write satisfying the status-pin would likewise slip the B-1 veto. The **identical mandate applies to `task_status_write_override`'s own policies** (single compound `WITH CHECK` or `AS RESTRICTIVE`; never multi-permissive-AND). A `pg_policy.polpermissive` catalog check + the hardened positive-control negatives (below) prove the realization. **[v6 — N1]** the `pg_policy.polpermissive` check is strengthened to count permissive policies **grouped by EFFECTIVE role (including `PUBLIC` and role inheritance)** — a `TO PUBLIC`/inherited permissive applicable to a rung's command counts alongside its status-pin — and to **reject an internally-disjunctive single `WITH CHECK`** (a lone policy whose expression is `status_pin OR workspace_bind` OR-widens exactly like two permissive policies); the lint is **supplementary, and the behavioral positive-controls below remain the PRIMARY proof** (§1.4 item 3-bis). **[v6 — N2]** because option (b) admits a row only when **≥1 permissive `WITH CHECK` is TRUE AND all restrictive checks pass**, there **MUST be ≥1 PERMISSIVE policy per writable (rung, command)** — the load-bearing option-(b) vacuous-deny guard — else the command over-denies (fails closed); this invariant is proven by the mandated "same-workspace valid-status write succeeds" positive tests (INSERT, transition/UPDATE, SELECT).
-
-**Red-first tests (v5-hardened):** base-rung `INSERT … status='done'` **ERRORS** (column-privilege and/or RLS); base-rung INSERT omitting status succeeds at DEFAULT; **Orchestrator `INSERT … status='done'` ERRORS (N-3)**, Orchestrator `INSERT … status='backlog'` succeeds; User-rung `INSERT … status='done'` succeeds. **[B2-INSERT — hardened valid-status form]** the cross-workspace negative uses a row **otherwise valid for the rung** — **base rung + `status='backlog'` + `workspace_id=<foreign W2>`, no active override** — differing from a passing insert ONLY in `workspace_id`, so the **ERROR** isolates the _workspace bind_ (not a status/override rejection); tested direct and via the status-upsert INSERT arm. **Positive-control:** removing the workspace-bind conjunct **alone** flips this to a **PASS** (proving the bind — not the status-pin — rejects, hence a single enforced conjunction / RESTRICTIVE, not a permissive OR). An INSERT under an absent `mosaic.workspace_id` GUC **ERRORS** (fail-closed on NULL); a same-workspace INSERT with a valid status **succeeds** (predicate composes with F1/N-3, does not over-deny).
-
-### 2.5 Invariant / key / tenancy field-set (F7 — closure)
-
-- **`packages/db/src/sink-rbac/invariant-set.ts`** defines the invariant field-set = every sink column NOT in the explicitly-mutable set: `{ natural-key columns (workspace_id, id), status, creation/tenancy columns, immutable metadata }`. The complement (title, tags-normalized, due_at, rank, …) is the mutable set the UPSERT `DO UPDATE` touches.
-- **[F7 FIX] `UPDATE` on key/tenancy/invariant columns (`workspace_id`, `id`, tenancy columns) is REVOKED from ALL rungs — including User and Orchestrator.** A re-key would otherwise **launder status** (relocate a row into a new identity to escape the status invariant). Column-level `UPDATE` grants for every rung exclude these columns.
-- **Grant/data-plane disjointness (RC19-B1-03):** grants are declarative + physically separate from the data plane, so a grant/policy mutation writes **zero** `tasks` rows. A test applies an arbitrary policy/grant delta → asserts **zero byte delta** on any `tasks` row (closes RC19-B1-03 by construction).
-
-### 2.6 Per-writer attribution → metadata column (Q1 audit channel)
-
-- Per-writer attribution (which federated writer inside a tier acted) is an **AUDIT** concern, not an authority concern. It is captured as an **app-supplied `actor_id` metadata column on `task_events`** (append-only, already runtime `INSERT/SELECT`-only per frozen §4 L178). KBN-100 owns the column; the application supplies the verified federated-writer identity as **data**.
-- It is **never** a DB credential, role, or RLS predicate key, and (per F6) never a `userOverride`/authority key (the override is keyed on task+tier, not writer). This keeps "which writer acted" auditable **without** a per-writer DB topology — i.e. without hitting the Q1 HALT trigger.
-
-### 2.7 No-status-write via trigger / view / rule (F3 BLOCKING + N-1 + N-2)
-
-Column-level `UPDATE(status)` alone does not close every indirect status-write path. Three complementary invariants (homed in KBN-100 producer; enumerated by -10's `invariant-set.ts`/no-status enumeration; certified deployed by KBN-101-09):
-
-- **F3 — no status-normalizing trigger on `tasks`:** no trigger on `tasks` writes/normalizes `status` outside the sanctioned `transitionStatus()` path. The transition path is the **only** status writer.
-- **[N-2 FIX + NB-1 + continuous-scan ADOPTED] Complete no-status-write enumeration (F3 completeness):** the cert asserts, in addition to F3: **no AFTER trigger** on `tasks` executing `UPDATE tasks SET status`; **no `SECURITY DEFINER` function** that writes `tasks.status` (frozen §4 L176 already forbids `SECURITY DEFINER` unless a separately reviewed exception — cited as the backstop); **no trigger on a RELATED runtime-writable table** (`task_events` and the other §4 L178 relations) that writes `tasks.status`; and **no `CREATE RULE`** on `tasks`. **[NB-1]** The enumeration is **extended to the `task_status_write_override` relation**: no status-writing trigger / RULE / `SECURITY DEFINER` function on the override relation may write `tasks.status` (the override table is runtime-writable by the User rung, so it is exactly the class §2.7's related-table clause must cover). The enumeration **scans function BODIES** (`pg_proc.prosrc` / dependency graph) for `tasks.status` writes, not merely `pg_trigger` rows. **[Gate A-delta-2 obs #2 — ADOPTED, not just recommended]** this enumeration is now a **continuous -06 CI catalog scan run on EVERY migration** (promoted from the v3 one-shot -09 recommendation), so a _later_ migration that adds a status-writing trigger/function/rule/view on `tasks` **or** on `task_status_write_override` **fails CI**, not only the one-time -09 cert. The -09 deployed cert still records the final deployed proof; the -06 scan is the standing gate. **[v6 — N1]** the same continuous -06 scan family carries the **strengthened `pg_policy.polpermissive` composition lint** (§1.4 item 3-bis / §2.4 clause 5): on every migration it counts permissive policies **grouped by effective role — including `PUBLIC` and role inheritance** (a `TO PUBLIC`/inherited permissive applicable to a writable command counts alongside that rung's status-pin) and flags an **internally-disjunctive single `WITH CHECK`** (`status_pin OR workspace_bind` within one policy). This lint is **supplementary**: it backstops the catalog shape but is **not sufficient** — the behavioral positive-controls (§2.4 clause 5 / §2.9) remain the PRIMARY proof that the composition is single-compound/`AS RESTRICTIVE` rather than an OR of permissive policies.
-- **[N-1 FIX] no status-write via VIEW or RULE:** forbid any `VIEW` or `RULE` on `tasks` that yields a status-write path. An owner-owned view runs with the owner's privileges (`security_invoker = false` by default), side-stepping rung grants; an `ON INSERT/UPDATE DO INSTEAD` rule rewrites a write onto `tasks` similarly. The `invariant-set.ts` enumeration **forbids such views/rules OR mandates `security_invoker = true` + ZERO runtime grants** on any view over `tasks`. A negative test proves a rung cannot mutate `tasks.status` through any view/rule.
-
-### 2.8 B2 — SCM_RIGHTS credential-acquisition + non-dumpable re-verify (F5 hardened — unchanged from v2)
-
-- **`packages/db/src/credential-handoff/scm-rights.ts`** — the privileged process (the **-03 migrator launch wrapper**) opens the privileged fd (attestation signing key, §5 L191) **before** the UID drop and passes the **descriptor itself** over a Unix-domain socket via an `SCM_RIGHTS` ancillary message. The receiver **never** re-opens `/proc/self/fd/N` (the kernel re-checks permission and returns EACCES after the drop — the FD5 failure). `O_CLOEXEC` managed explicitly on both ends.
-  - **[F5 FIX] Socket authentication:** the transfer socket **MUST** be a `socketpair()` created **pre-fork** (no filesystem socket) **OR** a filesystem socket in a `0700` directory verified with **`SO_PEERCRED`** (assert peer UID/GID/PID). The receiver sets **`MSG_CMSG_CLOEXEC`** on `recvmsg`. An unauthenticated/anonymous peer is rejected fail-closed.
-- **`packages/db/src/credential-handoff/process-hardening.ts`** — after **every** credential/UID transition, re-assert `prctl(PR_SET_DUMPABLE, 0)` and **verify** `prctl(PR_GET_DUMPABLE) == 0`; treat `dumpable != 0` as a fail-closed abort.
-- **Consumers:** KBN-101-03 migrator wrapper (drop to `10003:10003`), KBN-101-02 importer (privileged-fd case, drop to `10002:10002`). The runtime rung-connection selection is a **DB-role choice, NOT an OS-UID transition** — no new setuid surface, no dumpability handling, reinforcing the no-per-user / no-new-privilege-drop property.
-
-### 2.9 [B-1 FIX] Sink-resident, task/tier-scoped User-override table (the User deny is now enforced IN PostgreSQL)
-
-**Problem (Gate B-delta B-1):** in v2 the evaluator resolved the User-override in-app _before_ selecting a connection, so a compromised/buggy Gateway on the Orchestrator pool could bypass a User deny — contradicting v2 §1.4/Q2, which mandates that "an Orchestrator write vetoed by a User-override deny must ERROR at the sink." App-resolution is not sink-enforcement.
-
-**Fix (option a — DB-resident override, RLS-forced):**
-
-- **New relation `mosaic.task_status_write_override`** (owned/created by the KBN-100 producer, exactly like `tasks`), columns: `workspace_id`, `task_id`, `tier` (enum `{orchestrator}` for v1 — the only vetoable sub-god tier; extensible to a future 4th rung), `active boolean`, `created_by_actor_id` (audit metadata, NOT an authority key), timestamps. **Primary/unique key `(workspace_id, task_id, tier)`** — **task-identity + tier ONLY; NO per-federated-writer column is part of the key or an authority input** (preserves F6 + the Q1 HALT boundary: every Orchestrator-tier writer is vetoed identically for a given task).
-- **Who may WRITE it (sink-enforced):** `INSERT/UPDATE/DELETE` on the override table is granted **ONLY** to `mosaic_runtime_user_capability` (the User god rung), with the table under `FORCE RLS` and a `WITH CHECK` policy binding the row's `workspace_id` to the session workspace predicate. **[B2-INSERT parity]** that `WITH CHECK` workspace binding applies to the override table's **INSERT** path too (`workspace_id = current_setting('mosaic.workspace_id', true)::uuid`, fail-closed on NULL), so the override table's write path carries the identical symmetric tenant isolation as `tasks` — a User-rung INSERT of a veto row for a foreign workspace, or under an absent GUC, **ERRORS at the sink**. **[v5 COMPOSITION MANDATE parity]** the override table's write policies are subject to the SAME composition rule as `tasks` (§1.4 item 3-bis / §2.4 clause 5): the workspace-bind (and any status/authority conjunct) MUST be realized as a **single compound `WITH CHECK`** OR **`AS RESTRICTIVE`** — **never as multiple _permissive_ policies intended to AND** (which would OR-admit a foreign-workspace veto row). The Orchestrator and base rungs have **no** write privilege — a non-User attempt to author/clear a veto **ERRORS at the sink**. Thus only the User rung can raise or lift a veto.
-- **Who READS it:** all three rung capabilities get **`SELECT`** on the override table (workspace-scoped `USING`), because the `tasks` write policy subquery evaluates as the current (querying) rung role. The read is confined to the querying connection's workspace by the override table's own `USING` predicate.
-- **How it vetoes (the subquery):** every `tasks` **write policy** for the **Orchestrator rung** (`INSERT … WITH CHECK`, `UPDATE … WITH CHECK`, and the transition `WITH CHECK`) is extended with:
-
-  ```sql
-  AND NOT EXISTS (
-    SELECT 1 FROM mosaic.task_status_write_override o
-    WHERE o.workspace_id = tasks.workspace_id
-      AND o.task_id      = tasks.id
-      AND o.tier         = 'orchestrator'
-      AND o.active
-  )
-  ```
-
-  So an Orchestrator-tier write to a task carrying an active User deny is **REJECTED in PostgreSQL**, regardless of app-layer behavior. **[v5 COMPOSITION MANDATE]** this `NOT EXISTS(<override>)` subquery MUST be a **conjunct of the Orchestrator rung's single compound `WITH CHECK`** (alongside the status-pin and the workspace-bind), OR authored **`AS RESTRICTIVE`** — it may **NOT** be a separate _permissive_ policy intended to AND, because permissive policies OR and an Orchestrator write satisfying the status-pin permissive policy would then be OR-admitted despite an active deny (bypassing B-1). The User rung's own `tasks` policies do **not** subquery the override (User = god; the User authored the deny and overrides it). The base rung already cannot write status.
-
-- **Per-tier NEGATIVE test (real PostgreSQL, red-first; v5-HARDENED):** insert an active override row for `(W, T, orchestrator)` via the User rung; then an Orchestrator-rung write on `(W, T)` **using a transition the Orchestrator pin OTHERWISE ACCEPTS** (a legal non-terminal `UPDATE`/transition that would succeed absent the deny row, and under the correct workspace GUC) **must ERROR at the sink** — so the rejection **isolates the override subquery** (not a status/workspace rejection). **Positive-control:** removing the override subquery **alone** flips this negative to a **PASS**, proving the _override_ — not the status-pin or workspace-bind — is doing the rejecting (and proving the subquery is a single-enforced conjunct / RESTRICTIVE, not an OR of separate permissive policies). Clearing the row (`active=false`, User rung only) re-permits the Orchestrator write; a non-User attempt to write the override table **ERRORS**. This proves the User-override is **sink-enforced** (satisfies v2 Q2) and stays within Mos Q1 tier-level (task/tier-scoped, not per-writer).
-
-**[NB-2 — compromise-resistance scope of B-1.]** B-1 sink-enforces the veto against the **Orchestrator-rung path** — an Orchestrator-pool write to a vetoed task ERRORS in PostgreSQL regardless of app behavior. It does **NOT** claim to stop a Gateway compromised badly enough to hold the **User** pool: User = god and holds the sole write on the override table, so a compromised-User-pool Gateway can itself clear the veto. That is the **accepted co-resident-pool residual** (Mos Q1, NO HALT), not a defended boundary. The v3 §0 framing "a compromised Gateway cannot bypass a User deny" is corrected to "an Orchestrator-**path** write cannot bypass a User deny at the sink." Defending against a compromised User-pool Gateway would require per-federated-user DB credentials = the HALT boundary, which Mos Q1 explicitly declines.
-
-**HALT note:** because the key is `(workspace_id, task_id, tier)` and never `writer`, this fix does **not** give two same-tier writers different authority — it gives the _whole_ Orchestrator tier the _same_ per-task veto. The B2-INSERT workspace predicate is likewise applied uniformly to every writer in a tier. NO HALT.
-
----
-
-## 3. Findings-closure map (each → fail-closed, red-first testable)
-
-| Finding                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Closure                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Fail-closed enforcement point                                                                                                                                                                                                      | Test (red-first, real PostgreSQL / real UID drop)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **RC19-B1-01** raw sink has no enforceable authority boundary                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Declarative deny-by-default RBAC (§2.1) → fixed rung → per-rung DB credential; PG enforces via revoked base privileges + `FORCE RLS` deny-all + per-rung `WITH CHECK`.                                                                                                                                                                                                                                                                                                                                                       | At the sink: effective DB role lacks the privilege; mis-authorized write errors in PG.                                                                                                                                             | -00: rung roles created, safe attrs, non-owner. KBN-100: base `UPDATE(status)`/`DELETE` denied, User/Orch allowed. -01: checkout identity==rung + safe-attr.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| **RC19-B1-02** DELETE+default-INSERT resets status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Status-preserving UPSERT on `(workspace_id,id)`; `status` excluded from `DO UPDATE`; `DELETE` revoked all rungs; status only via authorized transition.                                                                                                                                                                                                                                                                                                                                                                      | At the sink: DELETE fails closed; refresh cannot touch `status`.                                                                                                                                                                   | KBN-100 + -09: refresh preserves `status` byte-stable; DELETE denied; transition-only status change.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| **RC19-B1-03** grant change breaks non-status compatibility                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | Invariant field-set (§2.5); grants declarative + physically separate → grant mutation writes zero `tasks` rows.                                                                                                                                                                                                                                                                                                                                                                                                              | Structural: data plane and grant plane disjoint.                                                                                                                                                                                   | Apply arbitrary policy/grant delta → **zero byte delta** on all `tasks` rows + invariant-set membership test.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **RC19-B2-01** FD5 `/proc/self/fd` EACCES after UID drop                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | SCM_RIGHTS descriptor-passing (§2.8); never re-open `/proc/self/fd/N` post-drop; explicit `O_CLOEXEC`; authenticated socket (F5).                                                                                                                                                                                                                                                                                                                                                                                            | Post-drop process receives a live fd; no privileged re-open.                                                                                                                                                                       | Drop UID → `/proc/self/fd` re-open EACCES/absent vs SCM_RIGHTS receive succeeds; unauthenticated peer rejected.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| **RC19-B2-02** dumpability resets after credential transition                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Re-assert + **verify** `PR_SET_DUMPABLE=0` after every transition; fail closed if `PR_GET_DUMPABLE != 0`.                                                                                                                                                                                                                                                                                                                                                                                                                    | Process aborts if dumpable ≠ 0 post-transition.                                                                                                                                                                                    | After simulated setuid: assert `PR_GET_DUMPABLE == 0`; inject reset → fail-closed abort.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| **F1 (BLOCKING)** INSERT-time status unconstrained for base rung                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `GRANT INSERT (non-status list)` → status DEFAULT for base; RLS `INSERT … WITH CHECK` pins new-row status to initial; `INSERT(status)` only User/Orch (§2.4).                                                                                                                                                                                                                                                                                                                                                                | At the sink: base status-on-insert denied by column-privilege and/or RLS `WITH CHECK`.                                                                                                                                             | **Red-first:** base `INSERT … status='done'` ERRORS; base INSERT omitting status → DEFAULT; User/Orch initial-status INSERT succeeds.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| **F2 (BLOCKING)** rung LOGIN roles lack declared/verified safe attributes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Declare both rung roles `NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS` + non-owner (§1.3); extend L222 checkout assertion (§2.2).                                                                                                                                                                                                                                                                                                                                                                           | Bootstrap catalog + every checkout: fail closed on SUPERUSER/BYPASSRLS/ownership.                                                                                                                                                  | -00 catalog asserts attrs + non-ownership; -01 injects unsafe attr/ownership → `DATABASE_ROLE_UNSAFE`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **F3 (BLOCKING)** BEFORE-trigger status bypass                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Invariant: no trigger on `tasks` writes/normalizes `status` outside `transitionStatus()` (§2.7); homed in KBN-100 producer.                                                                                                                                                                                                                                                                                                                                                                                                  | Producer DDL admits no status-normalizing trigger; transition path is only status writer.                                                                                                                                          | KBN-100 static: enumerate triggers on `tasks`, none assign status. **-09 deployed:** base UPDATE of a permitted col cannot change status via any trigger.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| **F4 (non-blocking)** no frozen `tasks(workspace_id,id)` unique key                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Bind `tasks (workspace_id,id)` UNIQUE as explicit KBN-100 req; else re-bind UPSERT to `(id)` (§2.3).                                                                                                                                                                                                                                                                                                                                                                                                                         | `ON CONFLICT` resolves to a real unique index; else hard planning error (fails loud).                                                                                                                                              | KBN-100 migration: unique key exists; UPSERT plans/executes; missing-key variant fails loud.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| **F5 (non-blocking)** SCM_RIGHTS socket unauthenticated                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `socketpair()` pre-fork **or** `SO_PEERCRED` + `0700` dir; `MSG_CMSG_CLOEXEC` on `recvmsg` (§2.8).                                                                                                                                                                                                                                                                                                                                                                                                                           | Fd transfer only over an authenticated peer; received fd close-on-exec.                                                                                                                                                            | Unauthenticated/wrong-peer rejected; `SO_PEERCRED` mismatch fails closed; `MSG_CMSG_CLOEXEC` asserted.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| **F6 (non-blocking)** `userOverride` scope                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Schema constrains override to `(workspace_id,task_id,tier)`; **forbids** per-writer key (§2.1); realized as the sink-resident override table (§2.9). Attribution → metadata (§2.6).                                                                                                                                                                                                                                                                                                                                          | Fail-closed at policy load: a per-writer authority key **fails schema validation**.                                                                                                                                                | Schema test: per-writer override/authority key **rejected**; tier/task-scoped accepted.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **F7 (non-blocking)** re-key launders status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Revoke `UPDATE(workspace_id,id,tenancy)` from **all** rungs incl. User/Orch (§2.5).                                                                                                                                                                                                                                                                                                                                                                                                                                          | At the sink: no rung may UPDATE key/tenancy columns.                                                                                                                                                                               | Each rung (incl. User) `UPDATE workspace_id`/`id` **ERRORS**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **B-1 (BLOCKING; composition PINNED in v5)** User-override was app-enforced, not sink-enforced                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Sink-resident `task_status_write_override` table `(workspace_id,task_id,tier)`, User-rung-write-only; the `NOT EXISTS(<active deny>)` subquery is a **conjunct of the Orchestrator rung's single compound `WITH CHECK`** (or authored **`AS RESTRICTIVE`**), **never a separate permissive policy** — else an Orchestrator write satisfying the status-pin permissive policy is OR-admitted despite the deny (§2.9 / §1.4 item 3-bis).                                                                                       | At the sink: an active User deny → Orchestrator write REJECTED in PG (single enforced check, not OR-bypassable); non-User cannot author the veto.                                                                                  | **Per-tier NEGATIVE (real PG; v5-hardened):** User inserts deny row → Orchestrator write **using a transition the pin OTHERWISE ACCEPTS** **ERRORS** (isolates the override). **Positive-control:** dropping the override subquery alone flips it to PASS (proves single-conjunction/RESTRICTIVE, not permissive-OR). Clear row → re-permitted; Orch/base write to override table **ERRORS**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **B-2 (BLOCKING)** FORCE + `WITH CHECK`-only bricks all reads (SELECT returns 0 rows for every rung and owner)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Add per-rung `SELECT`/`UPDATE` `USING` policies, **workspace-scoped** via `current_setting('mosaic.workspace_id')`; forbid `USING(true)` (§1.4/§2.2). Homes tenant isolation at the sink.                                                                                                                                                                                                                                                                                                                                    | At the sink: reads succeed only for the session's workspace; wrong/absent predicate → zero rows (no cross-tenant leak).                                                                                                            | Post-activation: each rung `SELECT`/UPSERT-probe within its workspace **succeeds**; a `SELECT` under a foreign/absent `mosaic.workspace_id` returns **zero** rows; a `USING(true)` variant **fails the isolation negative**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| **B-3 (BLOCKING)** owner/backfill write path under FORCE RLS                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Backfill/repair DML runs FIRST (RLS disabled); `ENABLE`/`FORCE RLS` is the **TERMINAL** migration step; **no standing schema_owner ALLOW write policy** after activation; break-glass (`mosaic_extension_owner` §4.1 L146 + external bootstrap actor §9 L266) named in -09 cert (§1.4).                                                                                                                                                                                                                                      | Migration ordering: backfill completes before FORCE binds; post-activation owner write has no policy → fails closed.                                                                                                               | KBN-100 migration test: backfill INSERTs succeed pre-FORCE; **post-activation `mosaic_schema_owner` `tasks` write ERRORS under FORCE**; no runtime rung is superuser/BYPASSRLS; -09 names the two break-glass actors as the accepted boundary.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| **N-1 (non-blocking)** VIEW/RULE status-write path                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Forbid views/rules on `tasks` yielding a status write, OR mandate `security_invoker=true` + zero runtime grants; enumerated by `invariant-set.ts` (§2.7).                                                                                                                                                                                                                                                                                                                                                                    | Enumeration admits no status-writable view/rule; any view over `tasks` is invoker-rights + ungranted.                                                                                                                              | Negative: a rung cannot mutate `tasks.status` through any view/rule; enumeration fails an owner-rights view with runtime grants.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| **N-2 (non-blocking)** F3 enumeration incomplete                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Extend enumeration: no AFTER trigger `UPDATE tasks SET status`; no `SECURITY DEFINER` fn writing `tasks.status` (L176 backstop); no trigger on related runtime-writable table (`task_events`, L178) writing `tasks.status`; no `CREATE RULE`; scan function **BODIES** (§2.7). One-shot -09 cert; recommend continuous -06 CI scan.                                                                                                                                                                                          | Producer/-09 cert admits no indirect status-write path.                                                                                                                                                                            | Catalog scan of `pg_proc.prosrc`/triggers/rules asserts none write `tasks.status`; deployed behavioral proof; (recommended) -06 CI re-scan per migration.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| **N-3 (non-blocking)** Orchestrator can INSERT terminal status                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Orchestrator `INSERT(status)` `WITH CHECK` pinned to non-terminal initial status; only User may INSERT arbitrary/terminal (§2.4).                                                                                                                                                                                                                                                                                                                                                                                            | At the sink: Orchestrator terminal-status INSERT rejected by `WITH CHECK`.                                                                                                                                                         | Orch `INSERT … status='done'` **ERRORS**; Orch `status='backlog'` succeeds; User `status='done'` succeeds.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| **N-4 (non-blocking)** transition-graph legality not DB-enforced (`done→backlog` reset by another name)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | **DECISION (documented, §2.10):** edge-legality is **app-enforced** within near-god/god authority; the sink closes RC19-B1-02 **for base only** (DELETE-denial + no base status write). No status-writing trigger is added (would collide with F3/N-2); a validation-only guard is deferred.                                                                                                                                                                                                                                 | Documented boundary: User/Orch hold near-god/god authority; illegal edges are an app-layer concern, not a sink guarantee.                                                                                                          | -09 records the decision + asserts base cannot reset status at the sink; app-layer transition-graph tests are owned by the Gateway command lane (out of KBN-101 scope).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **N-5 / AD-2 (non-blocking)** import direction ambiguity                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `-01` provisions generic pools only; rung→pool SELECTION lives in `-10`'s `connection-selection.ts`, consumed by `-02/-03/-05`; **never imported by `-01`** → `10→01`, acyclic (§2.2).                                                                                                                                                                                                                                                                                                                                       | Structural: no `01→10` edge exists.                                                                                                                                                                                                | Static import test: `-01` has no import of `sink-rbac/connection-selection`; `-02/-03/-05` do; graph acyclic.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **AD-1 (completeness)** frozen §4 L176 CONNECT cert reds on the 2 new logins                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | Amend the L176 allowlist to admit `mosaic_runtime_user`/`mosaic_runtime_orchestrator` + assert their `TEMPORARY` denial; named in -00 row/rc.20 (§1.3).                                                                                                                                                                                                                                                                                                                                                                      | -00 cert: CONNECT allowlist includes the 2 new logins; all 3 runtime rungs `TEMPORARY`-denied.                                                                                                                                     | -00 cert asserts CONNECT granted to the 2 new logins and no runtime rung retains `TEMPORARY`; an un-amended allowlist REDS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| **B2-INSERT (BLOCKING; composition PINNED in v5)** tenant isolation not enforced on the INSERT write path (v3 bound workspace only in `SELECT`/`UPDATE` `USING`; PostgreSQL does not apply `USING` to INSERT, and the explicit status `WITH CHECK` suppresses `USING` substitution → `workspace_id` unbound on INSERT → any rung can INSERT/UPSERT into a foreign workspace). **[v5 delta-3]** the v4 justification ("all `WITH CHECK` AND") was FALSE — multiple permissive policies OR — so the workspace conjunct must be pinned into a _single compound check or `AS RESTRICTIVE`_, else the bind is bypassable. | Include `workspace_id = current_setting('mosaic.workspace_id', true)::uuid` as a **conjunct of the single compound INSERT `WITH CHECK`** (with the F1/N-3 status-pin and, Orchestrator, the B-1 override subquery) **OR** author it **`AS RESTRICTIVE`**, on `tasks` (and the UPSERT INSERT arm) + symmetric on `task_status_write_override`. **Multiple _permissive_ policies intended to AND are EXPLICITLY FORBIDDEN** (they OR). Corrected semantics + realization mandate in §1.4 item 3-bis / §2.4 clauses 4–5 / §2.9. | At the sink: an INSERT/UPSERT with a foreign `workspace_id` fails the single enforced check; a NULL GUC → NULL predicate → INSERT ERRORS (fail-closed). Write-side tenant isolation homed at the sink and no longer OR-bypassable. | **Red-first (real PG; v5-hardened):** the cross-workspace negative uses an **otherwise-valid row** (base + `status='backlog'` + no override, differing only in `workspace_id=<foreign W2>`) so the **ERROR** isolates the workspace bind; direct and via status-upsert INSERT arm. **Positive-control:** dropping the workspace conjunct alone flips it to PASS (proves single-conjunction/RESTRICTIVE, not permissive-OR). NULL-`mosaic.workspace_id` INSERT **ERRORS**; same-workspace valid-status INSERT **succeeds** (no over-deny); override-table foreign-workspace INSERT **ERRORS**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| **NB-1 (non-blocking)** override relation absent from the no-status enumeration                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Extend the F3/N-1/N-2 no-status-write enumeration **and the -09 cert / continuous -06 scan** to `task_status_write_override`: no status-writing trigger / RULE / `SECURITY DEFINER` function on the override relation writes `tasks.status` (§2.7).                                                                                                                                                                                                                                                                          | Enumeration/CI admits no indirect status-write path via the override relation.                                                                                                                                                     | Catalog + fn-body scan asserts no trigger/rule/SECURITY-DEFINER on `task_status_write_override` writes `tasks.status`; a planted one REDS the -06 scan.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **NB-2 (non-blocking)** overstated B-1 compromise claim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Scope §0/§2.9 wording: B-1 sink-enforces the veto against the **Orchestrator-rung path**; a compromised **User**-pool Gateway (User=god) can clear a veto — accepted Mos Q1 co-resident residual, NO HALT (§0/§2.9).                                                                                                                                                                                                                                                                                                         | Documented boundary: sink-enforcement is Orchestrator-path-scoped; the User-pool residual is accepted, not defended.                                                                                                               | Doc/claim assertion in -09 cert notes: the override-veto negative proves the **Orchestrator-path** ERROR; the framing no longer claims User-pool compromise resistance.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **NB-3 (non-blocking)** overstated B-2 compromise claim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Scope §0/§2.2 wording: the workspace GUC is app-set with no per-tenant DB check → B-2 + B2-INSERT protect a **buggy** Gateway (omitted predicate → fail-closed), NOT a **compromised** one forging the GUC (accepted residual). The B2-INSERT unbound-INSERT closure remains a real fail-closed win (§0/§2.2).                                                                                                                                                                                                               | Documented boundary: fail-closed on omission/NULL; forged-GUC cross-tenant is the accepted per-user residual.                                                                                                                      | Cross-workspace read → zero rows; NULL/foreign-GUC INSERT ERRORS (buggy-Gateway closure proven); doc states forged-GUC is out of scope (HALT boundary).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| **NB-4 (non-blocking; v5 states transitive)** owner-toggle-FORCE containment mis-stated as incapability                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | Name `mosaic_schema_owner` (reachable via `mosaic_migrator` `SET ROLE`) in the -09 break-glass enum as **contained-but-CAPABLE**: an owner can `ALTER TABLE tasks DISABLE/NO FORCE RLS` then write regardless of NOSUPERUSER/NOBYPASSRLS → containment = **transitive non-reachability from the 3 runtime LOGIN rungs**, asserted explicitly (§1.4).                                                                                                                                                                         | -09 cert: owner toggle-then-write is real but confined to the migrator/owner phase; runtime rungs cannot reach `mosaic_schema_owner`/`mosaic_migrator` through any inherited (capability-role) path.                               | **[NB-4-transitive]** -09 asserts non-reachability as **TRANSITIVE membership** — `NOT pg_has_role(<rung>, 'mosaic_schema_owner', 'USAGE')` / `NOT has_privs_of_role(...)` recursion, NOT merely the absence of a direct `pg_auth_members` row (ownership check returns true for an _inherited_ membership through a capability role). Frozen §6 L222 "assumability" plausibly already covers this; "transitive membership" is stated explicitly. **[v6 — F-NB4]** the assertion additionally **conjoins the `MEMBER` variant** — `NOT pg_has_role(<rung>, 'mosaic_schema_owner', 'MEMBER')` **AND** `NOT pg_has_role(<rung>, 'mosaic_migrator', 'MEMBER')` for each of the 3 runtime rungs — because a `WITH INHERIT FALSE, SET TRUE` membership yields `has_privs_of_role = FALSE` yet still permits `SET ROLE … ; ALTER TABLE … NO FORCE`; the `MEMBER` privilege captures SET-ROLE reachability regardless of `INHERIT` (the intended graph has each rung `SET FALSE` to only its capability role, so this is assertion-completeness, not a live hole). `mosaic_schema_owner` is `NOLOGIN`, reachable only via `mosaic_migrator` `SET ROLE`; the 3 runtime rungs are transitive non-members and non-assumers (catalog + L222 checkout). |
-| **NB-5 (non-blocking)** 2 new capability roles lack baseline runtime grants → fail frozen §6 L222 verify                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Grant `mosaic_runtime_user_capability` / `mosaic_runtime_orchestrator_capability` the frozen §4 L176 baseline runtime grants (`USAGE ON SCHEMA mosaic`; `USAGE ON SCHEMA drizzle` + `SELECT` on the two ledger relations; relevant sequence `USAGE`/`SELECT`) at -00 (§1.1/§1.3).                                                                                                                                                                                                                                            | Bootstrap: the 2 new rungs hold the baseline grants → they connect/operate and pass the L222 runtime verify.                                                                                                                       | -00 catalog asserts each new capability role holds `USAGE ON mosaic`, ledger `SELECT`, sequence grants; an omission → L222 runtime verify fails closed (missing inherited grant).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| **Q2 per-tier deny-by-default (red-team requirement; v5 composition-pinned)**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Per-rung **single compound `WITH CHECK`** (status-pin + B2-INSERT workspace bind + Orchestrator override) **or `AS RESTRICTIVE`** — **never multi-permissive-intended-to-AND** — plus `USING` + `FORCE RLS`; deny-all default (§1.4 item 3-bis).                                                                                                                                                                                                                                                                             | At the sink, every tier: unauthorized write-source rejected even for owner/maintenance (`FORCE`); tenant/override binds not OR-bypassable.                                                                                         | **NEGATIVE per tier (v5-hardened):** base terminal-status INSERT/transition ERROR; **Orchestrator write under User-override deny, using an otherwise-accepted transition, ERROR (+ positive-control: drop override subquery → PASS)**; **cross-workspace INSERT/UPSERT with an otherwise-valid status ERROR (+ positive-control: drop workspace conjunct → PASS)**; NULL-GUC INSERT ERROR; owner/maintenance post-activation write ERROR (`FORCE` proven); cross-workspace read → zero rows; **same-workspace valid-status write SUCCEEDS per writable command (INSERT, transition/UPDATE, SELECT) — the [v6 — N2] ≥1-permissive-per-writable(rung,command) option-(b) vacuous-deny guard**; `pg_policy.polpermissive` check confirms single-compound-or-RESTRICTIVE, **[v6 — N1] grouped by effective role incl. `PUBLIC`/inheritance and rejecting an internally-disjunctive single `WITH CHECK` — supplementary to, never a substitute for, the behavioral positive-controls (PRIMARY proof)**.                                                                                                                                                                                                                                          |
-
----
-
-## 4. Implementation card DAG (owner + disjoint manifest, red-first at Gate A/B)
-
-```
-contract(amended) ─► KBN-101-00 (rung-ROLES + capability roles, safe attrs [F2],
-                     │            deny-default base, CONNECT + [AD-1] L176 allowlist
-                     │            amend (2 new logins CONNECT, TEMPORARY-denied);
-                     │            bootstrap catalog tests. NO tasks/override DDL [GA-1])
-                     │
-        KBN-101-01 ──┤ (provisions 3 generic rung pools; sets mosaic.workspace_id
-                     │  session predicate [B-2]; checkout identity==rung AND
-                     │  safe-attribute/non-owner verify [F2, extended L222].
-                     │  Does NOT import -10 [AD-2/N-5])
-                     │
-        KBN-101-10 ──┘ depends 00,01:
-                        packages/db/src/sink-rbac/**  (policy+schema[F6]+evaluator+ladder+
-                                                       connection-selection[consumes 01; 10→01, N-5]+
-                                                       status-upsert[F4]+invariant-set[F7]+
-                                                       no-status trigger/view/rule enum[N-1,N-2])
-                        packages/db/src/credential-handoff/** (scm-rights[F5] + process-hardening +specs)
-                              │
-      ┌─────────────┬────────┼──────────────────────┬──────────────────────────────┐
- KBN-101-03     KBN-101-05  KBN-101-02          KBN-100 (producer lane)          KBN-101-09 (evidence-only)
- (dep 00,01,10) (dep 00,03, (dep 01,03,10)      SPEC target of -10:              (dep KBN-100,08)
- migrator        10)         importer fd +       homes tasks + override DDL       DEPLOYED cert:
- wrapper:        renderer:   sink adapter uses    AFTER create:                   real rung INSERT/
- SCM_RIGHTS      3 rung DSN   status-upsert       - rung column-grant matrix       transition success;
- SEND + dumpable secret       (drop 10002)         [F1,F7,N-3]                     override-veto [B-1];
- re-assert       mounts;                          - RLS WITH CHECK(+override)      cross-workspace read
- (drop 10003)    Gateway                           + USING workspace pred          zero-rows [B-2];
- [GA-4(ii):      Dockerfile;                       [Q2,B-1,B-2, conds a&b]         backfill-then-FORCE
- docker/db-      NO SCM_RIGHTS                     - task_status_write_override     ordering + owner-write
- migrator.       (DB-role, no                       table [B-1]                    denial [B-3] + break-
- Dockerfile]     UID drop)                         - tasks(workspace_id,id) UNIQUE  glass named;
-                              │                     [F4]                            base status
-                        KBN-101-06 (dep 02,03,05,07,10): inventory += KBN-101-10;   INSERT/UPDATE/DELETE
-                                    overlap/ownerless/path-existence green;         denial; refresh
-                                    matrix += rung selection + SCM_RIGHTS[F5] +      status-preservation;
-                                    per-tier RLS negatives + override-veto[B-1] +    no-status trigger/
-                                    cross-workspace read[B-2] + backfill-order[B-3]  view/rule [F3,N-1,N-2];
-                                    + ADOPTED continuous no-status scan[N-2,NB-1]    grant-delta zero-byte;
-                                    + cross-workspace/NULL-GUC INSERT neg[B2-INSERT]
-                              │                                                      dumpable=0 evidence
-                        KBN-101-08 (dep 00…07,10): foundation + atomic activation cert
-```
-
-- **Gate A (re-review):** every element traces to a manifest owner; disjointness/overlap/ownerless proven against amended §7; the SPEC-vs-implement split for `tasks`+override sink DDL matches the frozen §4 L178 precedent (producer = KBN-100, applied **after** table creation — GA-1); dep edges acyclic with `10→01` import direction (AD-2/N-5); the L176 CONNECT amendment named (AD-1).
-- **Gate B (red-team):** each B1/B2 finding **and** F1–F7 **and** B-1/B-2/B-3 **and** B2-INSERT **and** N-1..N-4 **and** NB-1..NB-5 **and** the Q2 per-tier deny-by-default has a **red-first** test that fails on the current design and passes only with the enforcement point; sink privilege/RLS/override/tenant denials — **including cross-workspace and NULL-GUC INSERT/UPSERT [B2-INSERT]** — proven **in PostgreSQL** (not PGlite — §5 L218); SCM_RIGHTS/dumpable against a real UID drop with an authenticated socket.
-
----
-
-## 5. Executability self-audit (re-run for v5)
-
-**Every element has an owner in the amended manifest — nothing ownerless:**
-
-| Element                                                                                                                                                                                                                                                                                                                                                                                                                 | Owner                                                                                  |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
-| Declarative RBAC policy artifact + schema [F6] + evaluator + ladder + no-status trigger/view/rule enum [N-1,N-2]                                                                                                                                                                                                                                                                                                        | KBN-101-10 (`packages/db/src/sink-rbac/**`)                                            |
-| Rung→credential connection-selection module (consumes -01 pools; `10→01` [N-5])                                                                                                                                                                                                                                                                                                                                         | KBN-101-10; pools provisioned in KBN-101-01 (`database.module.ts`)                     |
-| Status-preserving-UPSERT [F4] + invariant-set [F7] module                                                                                                                                                                                                                                                                                                                                                               | KBN-101-10 (`packages/db/src/sink-rbac/**`)                                            |
-| SCM_RIGHTS handoff [F5] + non-dumpable assert/verify                                                                                                                                                                                                                                                                                                                                                                    | KBN-101-10 (`packages/db/src/credential-handoff/**`)                                   |
-| Fixed rung DB roles + safe attributes [F2] + deny-default base + CONNECT + **[AD-1] L176 allowlist amend + TEMPORARY denial** + **[NB-5] baseline L176 runtime grants (`USAGE mosaic`, ledger `SELECT`, sequence grants) on the 2 new capability roles**                                                                                                                                                                | KBN-101-00 (`infra/pg-bootstrap/roles.sql` + tests) — **no tasks/override DDL [GA-1]** |
-| `tasks` sink DDL: rung grants [F1,F7,N-3] + RLS `WITH CHECK`(+override) [Q2,B-1] + **INSERT `WITH CHECK` workspace bind on every rung [B2-INSERT]** + `SELECT`/`UPDATE` `USING` workspace predicate [B-2] + `FORCE RLS` terminal-after-backfill [B-3, conds a&b] + `(workspace_id,id)` UNIQUE [F4] + `actor_id` col [Q1] + no-status trigger/view/rule invariant on `tasks` **and override relation** [F3,N-1,N-2,NB-1] | **KBN-100 producer** (SPEC by -10; §4 L178 precedent; scope amended per Q2)            |
-| **`task_status_write_override` table [B-1]** (create + grants + FORCE RLS + policies; User-write-only incl. **INSERT `WITH CHECK` workspace bind [B2-INSERT parity]**, all-rung-SELECT)                                                                                                                                                                                                                                 | **KBN-100 producer** (SPEC by -10; same L178 precedent)                                |
-| `mosaic.workspace_id` session predicate set at checkout [B-2]                                                                                                                                                                                                                                                                                                                                                           | KBN-101-01 (`database.module.ts` / `connection-identity.ts`)                           |
-| Rung DSN secret mounts (3 fixed)                                                                                                                                                                                                                                                                                                                                                                                        | KBN-101-05 (renderer, extends runtime-URL row)                                         |
-| Checkout identity==rung + safe-attribute/non-owner verify [F2]                                                                                                                                                                                                                                                                                                                                                          | KBN-101-01 (`connection-identity.ts`, extended L222)                                   |
-| Migrator launch wrapper SCM_RIGHTS send + dumpable re-assert                                                                                                                                                                                                                                                                                                                                                            | KBN-101-03 (`docker/db-migrator.Dockerfile` [GA-4(ii)])                                |
-| Importer privileged-fd case                                                                                                                                                                                                                                                                                                                                                                                             | KBN-101-02                                                                             |
-| Deployed enforcement certification (F3/N-1/N-2 **+ NB-1 override-relation scan**, per-tier RLS negatives, B-1 override-veto, B-2 cross-workspace read, **B2-INSERT cross-workspace/NULL-GUC INSERT negatives**, B-3 ordering + break-glass naming **incl. [NB-4] `mosaic_schema_owner` contained-but-capable / non-reachability assertion**, N-4 decision)                                                              | KBN-101-09 (evidence-only)                                                             |
-| Inventory/overlap/path-existence + command matrix (rung sel + SCM_RIGHTS + per-tier RLS + override-veto + cross-workspace read + **[B2-INSERT] cross-workspace/NULL-GUC INSERT negatives** + backfill-order + **[ADOPTED] continuous no-status scan on `tasks` + override relation**)                                                                                                                                   | KBN-101-06 (fixture += -10)                                                            |
-
-**Manifest closure (KBN-101-06 green):** the only NEW ownership is the two disjoint -10 globs. The B-1 override table, B-2 `USING` policies, B-3 terminal-FORCE ordering, **and the v4 B2-INSERT INSERT `WITH CHECK` workspace binding (+ its override-table parity) and the NB-1 override-relation no-status enumeration** are ALL producer DDL homed in KBN-100's already-owned `schema.ts`/`drizzle/**` (a _responsibility_ widening, not a glob change — identical treatment to the v3 `tasks` sink DDL). The **NB-5 baseline capability-role grants** amend -00's already-owned `roles.sql`/tests (like AD-1); the **continuous -06 no-status scan** lives in -06's already-owned `tools/ci/fixtures/kbn101-ddl-inventory.json` + `.woodpecker/ci.yml`; the NB-2/NB-3/NB-4 claim-scopings/enumeration are doc + -09 cert wording on already-owned paths. N-1/N-2/N-5 additions live in -10's already-declared `sink-rbac/**`. **No glob is split/shared/narrowed → overlap/ownerless/path-existence stay green (KBN-101-06 unchanged-green vs v3).**
-
-**NO per-federated-user topology (HALT boundary respected — re-verified for v5):** DB-role/credential cardinality = **3** (User / Orchestrator / others), fixed and independent of the federated-user count. Federated identity → rung happens in the evaluator at authorization time. A new federated user creates **zero** roles/credentials/secrets/pools. The **B-1 override table is keyed `(workspace_id, task_id, tier)` — task+tier, never writer** — so it homes a tier-level veto, not a per-user distinction. The **B-2 read `USING` predicate AND the B2-INSERT INSERT check predicate are the SAME shared per-request session var** (`mosaic.workspace_id`), applied uniformly to whichever rung role holds the connection — tenant isolation, not writer discrimination (and, per v5, composed into a single compound check or `AS RESTRICTIVE` rather than an OR of separate permissive policies). Per-writer **attribution** is a metadata column (`task_events.actor_id`, §2.6), not a DB principal. `userOverride` forbids a per-writer authority key (F6, fail-closed at load). The NB-1..NB-5 fixes add no principal, key, or predicate that varies by writer. Enforce-at-sink is satisfied by the fixed rung roles' grants + `FORCE RLS WITH CHECK`(+override, +workspace-bound INSERT) + `USING` — it does **not** require, and this design does **not** use, a DB role/credential per federated user.
-
-**Q1 same-tier / different-authority check (the ONLY HALT trigger):** no v5 change gives two SAME-TIER writers different WRITE authority. The v5 composition pin fixes only **how** the already-uniform predicates are physically composed (single compound `WITH CHECK` or `AS RESTRICTIVE`, never multi-permissive-OR) — it changes no predicate's content and introduces no writer-varying axis. F1/F2/F3/F7/N-3 tighten authority uniformly per tier; **B2-INSERT binds the same workspace predicate uniformly into every rung's INSERT check** (tenant isolation, not writer discrimination); B-1 vetoes the _entire_ Orchestrator tier per task (not a subset of Orchestrator writers); B-2 isolates by workspace uniformly; F6 forbids per-writer authority keys; attribution is audit-only. The NB-4-transitive nit only _strengthens_ the owner non-reachability assertion (transitive membership) — no authority axis. **No same-tier-different-authority requirement exists → NO HALT — an executable envelope is delivered.**
-
----
-
-## 6. Flagged ambiguities in the frozen contract (for reviewer awareness)
-
-1. **Sink identity of the status store.** The RBAC-guarded sink is `tasks.status`; legacy `mission_tasks.status` stays frozen read-only. Confirm no reviewer reads "raw sink" as the legacy column.
-2. **Frozen "role graph unchanged" + "no RLS" + L176 CONNECT allowlist vs. the rulings.** SHARED-CONTRACT rc.5 L82/L88-90 froze the role graph and grant/revoke-only (no RLS); frozen §4 L176 froze the CONNECT allowlist. Jason B1 + Mos OPTION A add fixed rung-roles; **Mos Q2** authorizes RLS `WITH CHECK`/`USING` + `FORCE RLS` + the override table; **AD-1** amends the L176 allowlist for the 2 new logins. The rc.20 amendment text (§1.3/§1.4) records all three as deliberate, human-authorized departures. Reviewer should confirm rc.20 is **adopted** (not treated as a violation), that KBN-100's DDL scope is amended to include RLS + the override table on `tasks`, and that the -00 row amends the L176 allowlist.
-3. **Natural-key column list for `tasks` (F4).** `tasks (workspace_id, id)` UNIQUE is asserted by the SI-001 pattern but must be **bound + created by KBN-100**. If KBN-100's `tasks` identity differs, the UPSERT natural key re-binds to `(id)` (spec-level, no HALT).
-4. **Initial/terminal status values (F1/N-3).** F1 pins base new-row status to `backlog` (§5.4 L214); N-3 pins the Orchestrator's INSERT set to non-terminal (`{backlog, ready}`) and reserves terminal (`{done, cancelled}`; `in_review` treated as non-initial) to the User rung. KBN-100 binds the exact column DEFAULT and the RLS `WITH CHECK` literals against the §3 L134 vocabulary so they agree.
-5. **Workspace session-var name + set-site (B-2 + B2-INSERT).** The `USING` predicate **and the v4 INSERT `WITH CHECK` predicate** both use `current_setting('mosaic.workspace_id', true)`. -01 sets it per request from the server-verified tenant (never a body field, §7.1). Reviewer should confirm the exact GUC name and that a transaction-local `SET LOCAL` is used so a pooled connection cannot leak a stale workspace across requests (mirrors the frozen `SET LOCAL search_path` discipline, §4 L152) — now **explicitly folded into the frozen L174 poisoned-pooled-session-reset + `SET LOCAL` restoration negative test** (Gate B 2(a), §2.2). Reviewer should also confirm the accepted scope (NB-3): fail-closed on an omitted/NULL GUC (buggy Gateway), but a _forged_ GUC to a victim tenant is the accepted per-user residual (Mos Q1), not defended.
-6. **N-4 transition-graph decision.** Edge-legality (illegal/backward transitions such as `done→backlog`) is **app-enforced** within near-god/god authority; the sink closes RC19-B1-02 for **base only** (DELETE-denial + no base status write). A validation-only sink guard is deferred to avoid colliding with the F3/N-2 no-status-trigger invariant. Reviewer should confirm this decision is acceptable (it is stated, not silently dropped).
-7. **N-2 continuous scan — now ADOPTED.** The complete no-status-write enumeration (trigger/view/rule/SECURITY DEFINER/function-body), covering `tasks` **and `task_status_write_override` (NB-1)**, is now a **continuous -06 CI catalog scan run on every migration** (promoted from the v3 one-shot -09 recommendation, per Gate A-delta-2 obs #2); the -09 deployed cert still records the final proof. Reviewer should confirm the -06 scan is owned/wired in `tools/ci/fixtures/kbn101-ddl-inventory.json` + `.woodpecker/ci.yml` (already-owned -06 paths).
-8. **KBN-101-09 is evidence-only.** B-1/B-2/B-3/F3/N-1/N-2 negative tests are _authored/owned_ by the producing implementation cards (KBN-100 producer for `tasks`/override triggers/RLS; -10/-01 for the rung path); KBN-101-09 records the **deployed** certification evidence and changes no implementation path. Confirm the test-ownership split is acceptable (mirrors the frozen -09 "evidence-only" role).
-9. **B2-INSERT / B-1 `WITH CHECK` composition — SEMANTICS CORRECTED + REALIZATION MANDATED (v5; the delta-3 fix).** v4 justified the composition with a **FALSE** PostgreSQL claim — "multiple applicable `WITH CHECK` clauses must all pass (they AND)". **That is struck.** The **correct** semantics: multiple **PERMISSIVE** policies for a command combine with **OR** (a row is admitted if it satisfies **ANY** one permissive `WITH CHECK`, ANDed with all `AS RESTRICTIVE` checks); the AND this closure needs holds **ONLY** (a) within a _single_ policy whose `WITH CHECK` is one AND-conjoined expression, or (b) across `AS RESTRICTIVE` policies. Accordingly v5 **MANDATES** (§1.4 item 3-bis / §2.4 clause 5 / §2.9) that, per rung per command, the status-pin **AND** the workspace-bind **AND** (Orchestrator) the override subquery be realized as EITHER a **single compound `WITH CHECK`** OR the status-pin-as-sole-permissive **plus** the workspace-bind/override **`AS RESTRICTIVE`**, and **EXPLICITLY FORBIDS** realizing them as multiple _permissive_ policies intended to AND (which would OR-admit a foreign-workspace INSERT satisfying only the status-pin — cross-tenant injection — and equally bypass the B-1 veto). Reviewer should confirm: (i) the corrected OR-semantics statement replaces every "all `WITH CHECK` AND" assertion; (ii) the realized policies are single-compound or `AS RESTRICTIVE` (a `pg_policy.polpermissive` catalog check backs it); (iii) the hardened red-first negatives use an _otherwise-valid_ row (cross-workspace: base + `backlog` + foreign ws; override: an otherwise-accepted Orchestrator transition) so each rejection isolates the bind/override under test, **and each carries a positive-control** (dropping the workspace conjunct — resp. the override subquery — alone flips the negative to a PASS, proving the bind/override, not the status-pin, is rejecting). Confirm the accepted scope (NB-2/NB-3) is unchanged: write-side sink tenant isolation is complete against a _buggy_ Gateway; a _compromised_ Gateway forging the GUC or holding the User pool is the accepted Mos Q1 residual.
-
----
-
-_Envelope A **v6** authored from base `b0d78d86`. **v6 = v5 + N1/N2/F-NB4 non-blocking test/lint/cert hardening ONLY — NO design predicate, policy, grant, role, or table is changed** (only test/lint/cert wording). v5 CONVERGED with BOTH terminal re-gate-4 gates GO (Gate A-delta-4 `a4ce075a`; Gate B-delta-4 `a379e0de`), NO HALT; Gate B-delta-4 flagged 3 EXPLICITLY NON-BLOCKING hardening notes "for the trunk-commit record," folded here additively: **N1** — the `pg_policy.polpermissive` lint is strengthened to count permissive policies grouped by EFFECTIVE role (incl. `PUBLIC`/inheritance) and to reject an internally-disjunctive single `WITH CHECK`, stated as SUPPLEMENTARY with the behavioral positive-controls remaining the PRIMARY proof (§1.4 item 3-bis / §2.4 clause 5 / §2.7 / §3 Q2 row); **N2** — the option-(b) vacuous-deny guard is stated explicitly as the load-bearing "≥1 PERMISSIVE policy per writable (rung, command)" invariant, verified by the "same-workspace valid-status write succeeds" positive tests for INSERT / transition-UPDATE / SELECT (§1.4 item 3-bis / §2.4 clause 5 / §3 Q2 row); **F-NB4** — owner non-reachability is extended to SET-ROLE assumability by conjoining the `MEMBER` variant `NOT pg_has_role(<rung>, 'mosaic_schema_owner', 'MEMBER')` AND `NOT pg_has_role(<rung>, 'mosaic_migrator', 'MEMBER')` for each of the 3 runtime rungs in the -09 cert (§1.4 NB-4 para / §3 NB-4 row). All three are assertion/test/lint completeness on an already-BOTH-GO design; the intended role graph is already safe. The v6 body otherwise preserves the v5 text verbatim, which in turn preserved EVERY v4 closure (all v4 checks passed except one bounded item) and closed the SINGLE remaining BLOCKING finding raised identically by BOTH re-gate-3 gates (Gate A-delta-3 `aa5cbf73` CHANGES-NEEDED; Gate B-delta-3 `aa881074` 1 blocking) — the **RLS `WITH CHECK` composition semantics**: (1) **corrected semantics** — struck the FALSE "PostgreSQL requires ALL applicable `WITH CHECK` to pass / they AND" from §1.4/§2.4/§6.9 and stated the true rule (multiple PERMISSIVE policies OR; AND holds only within a single compound `WITH CHECK` or across `AS RESTRICTIVE`); (2) **mandated the realization** — per rung per command, status-pin + workspace-bind + (Orchestrator) override subquery MUST be a **single compound `WITH CHECK`** OR the status-pin-as-sole-permissive **plus** the bind/override **`AS RESTRICTIVE`**, with **multi-permissive-intended-to-AND EXPLICITLY FORBIDDEN**, applied to `tasks` **and** `task_status_write_override` (§1.4 item 3-bis, §2.4 clauses 4–5, §2.9); (3) **hardened the red-first negatives** — cross-workspace INSERT uses an otherwise-valid row (base + `backlog` + foreign ws) and the B-1 override negative uses an otherwise-accepted Orchestrator transition, so each rejection isolates the bind/override, **each with a positive-control** (dropping the workspace conjunct — resp. override subquery — alone flips the negative to PASS); plus **NB-4-transitive** (owner non-reachability stated as TRANSITIVE membership — `NOT pg_has_role(...)`/`has_privs_of_role(...)` recursion, not a direct `pg_auth_members` edge; frozen L222 "assumability" noted as plausibly already covering it). Every other v4 closure carries forward intact (3-rung ladder / 0 per-user; F1–F7; GA-1/3/4; B-1/B-2/B-3; the B2-INSERT workspace bind itself; N-1..N-5; AD-1/AD-2; NB-1..NB-5; continuous -06 no-status scan; L174 poisoned-pool `SET LOCAL` GUC fold; rc.20). Manifest disjoint (KBN-101-06 green) — all v5 changes land on already-owned KBN-100-producer / -09 / -06 paths (DDL realization detail + test wording; no glob change). Design/contract only; no SSOT file modified, no code, no PR. HALT self-check: NO HALT (fixed 3-rung ladder; override keyed task+tier not writer; workspace predicate shared per-request and uniform per tier, now composed as single-compound/`RESTRICTIVE`; attribution → metadata; no per-federated-user DB role/credential; no same-tier different-authority requirement — both delta-3 gates independently confirmed the boundary HOLDS). **v6 changes NOTHING in this HALT calculus: N1/N2/F-NB4 add only lint-scope, a vacuous-deny test invariant, and a `MEMBER` assumability assertion — zero new principal, key, predicate, grant, role, or table, and no writer-varying axis — so NO HALT is re-confirmed for v6.** Manifest remains disjoint (KBN-101-06 green): every v6 fold lands on already-owned paths — the -06 continuous scan / `pg_policy.polpermissive` lint in `tools/ci/fixtures/kbn101-ddl-inventory.json` + `.woodpecker/ci.yml`; the option-(b) positive tests in the KBN-100-producer / -09 evidence paths; the `MEMBER` assertion in the -09 cert — no glob split/shared/narrowed. NO code, NO PR, NO SSOT edit._

docs/native-kanban-sot/MISSION-MANIFEST.md

@@ -192,6 +192,4 @@ No role can transform a missing gate into a warning by changing status, editing
 
 This manifest is derived from the ratified source plan. Any change to SOT authority, workspace tenancy, fixed statuses, Coordinator/Certifier authority, health-state semantics, schema v1, migration direction, or recovery-tier field set is a contract change. Contract changes require Jason/Mos authorization and cannot be inferred by an implementation lane.
 
-> KBN-101 Envelope A (rc.20, `KBN-101-DB-ROLE-SPLIT.md` §4/§10) is the specific authorized instance of a schema-v1 contract change under this clause, ruled by Jason B1 + Mos OPTION A/Q1/Q2; see `KBN-101-DB-ROLE-SPLIT.md` rc.20.
-
 No coder lane may start while the build hold is active. KBN-010 must complete before KBN-100; KBN-105 exact endpoint/DTO freeze must complete before any API consumer implementation.

docs/native-kanban-sot/SHARED-CONTRACT.md

@@ -8,14 +8,6 @@
 
 ## Amendment record
 
-### 1.0.0-rc.20 — KBN-101 Envelope A: declarative sink-RBAC + per-role connection-selection + RLS write-source + sink-resident User-override
-
-- **Choice:** adds the fixed User/Orchestrator/others runtime rung-roles (per-ROLE, deny-by-default; `mosaic_runtime_user`, `mosaic_runtime_orchestrator` + their capability roles), amends the frozen §4 L176 CONNECT allowlist for the two new logins (TEMPORARY-denied), and authorizes declarative RLS `WITH CHECK`/`USING` + `FORCE ROW LEVEL SECURITY` + a sink-resident `task_status_write_override` table on `tasks` — a schema-v1 mechanism addition beyond the prior grant/revoke-only model.
-- **No per-federated-user topology:** DB-role/credential cardinality remains fixed at 3, independent of federated-user count; the override table is keyed `(workspace_id, task_id, tier)`, never per-writer; per-writer attribution is a metadata column (`task_events.actor_id`), never a DB principal.
-- **Non-effect:** rc.4 SI-001, all KCR-001–016 decisions, and every prior rc (rc.5–rc.16) invariant not explicitly named above remain unchanged. Introduces no new principal, key, or per-user authority axis (Q1 HALT boundary not hit).
-- **Authority:** Jason B1 ruling + Mos OPTION A (home the layer) + Mos Q1 (TIER-LEVEL) + Mos Q2 (RLS `WITH CHECK` authorized, two mandatory conditions — `ENABLE`/`FORCE ROW LEVEL SECURITY` as terminal migration step, non-owner rung roles). Exact implementation detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md) §4/§10 and the KBN-101 Envelope A v6 record.
-- **Gate:** lands as `KBN-101-10` (new owner card) + responsibility-widenings on `KBN-101-00/01/02/03/05/06`; the `tasks`/override-table DDL itself is homed in the **KBN-100** producer (starts after KBN-101-08) per the existing §4 L178 producer/consumer precedent — a SPEC note today, not an immediate implementation.
-
 ### 1.0.0-rc.16 — Current generic storage-wrapper authority closure
 
 - **Current-source truth:** `packages/storage/src/cli.ts` currently shells `storage migrate --run` directly to `pnpm --filter @mosaicstack/db db:migrate` through `execSync`; no `mosaic-db-migrator` executable exists. README and user-guide command guidance therefore remove that command and any runner-delegation claim. The current wrapper is legacy N-1, uncertified, non-operative, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
@@ -87,14 +79,14 @@
 - **Exact ledger:** manifest v1 canonically serializes journal logical index/tag and SHA-256 of exact shipped migration bytes. It maps each observed ledger hash to one tuple; physical insertion order is non-normative, while missing/unknown/duplicate/ambiguous/corrupt/stale states fail closed. Shipped `0009` bytes remain unchanged; a missing/effects-absent `0009` runs normally, an applied-late hash maps normally, and partial/full effects with missing hash require backup restoration or separately reviewed repair—not manual adoption.
 - **TLS/search path:** operator/IaC owns CA and server leaf lifecycle, exact compose/Swarm secret mounts, server TLS activation, service-DNS SANs, verified-TLS readiness, transition, CA overlap rotation, and rollback. Runtime/migrator use `verify-full`; PGlite is not PostgreSQL TLS evidence. Application sessions use only `pg_catalog,mosaic`; no URL/config-derived identifier reaches SQL.
 - **Safe release:** cards 00–07 land prepared but inactive; owner-runtime deployments remain N-1. Mosaic control plane/Jason alone authorizes one atomic TLS/roles → runner → readiness → runtime activation or rollback. No runtime-operator compatibility switch, bypass, plaintext interval, or force-on-red exists; all temporary support is removed before KBN-101-08.
-- **Non-effect:** role graph (**except as amended by rc.20 — see below**), immutable certification after KBN-100, KBN-105 gate, rc.5’s preserved rc.4 SI-001 invariants, and all KCR-001–016 decisions remain unchanged. Exact detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
+- **Non-effect:** role graph, immutable certification after KBN-100, KBN-105 gate, rc.5’s preserved rc.4 SI-001 invariants, and all KCR-001–016 decisions remain unchanged. Exact detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
 
 ### 1.0.0-rc.5 — KBN-101 role/connection split
 
 - **Choice:** PostgreSQL `standalone` and `federated` runtime uses `DATABASE_URL` only as a non-owner `mosaic_runtime` login; an explicit migration phase uses `DATABASE_MIGRATION_URL` only as `mosaic_migrator`, which `SET ROLE`s to non-login `mosaic_schema_owner` for DDL. Local PGlite remains an explicit embedded exception.
 - **No fallback / no startup DDL:** missing migration URL fails the migration phase; it never falls back to runtime URL/default/config. Gateway replicas do not run migrations. An advisory-locked migration phase verifies the exact ordered Drizzle ledger fingerprint before replicas may become ready.
 - **Privilege model:** non-login `mosaic_platform_database_owner` is outside application paths; `mosaic_schema_owner` owns only application/ledger schemas. `mosaic_runtime` has only `mosaic_runtime_capability`, owns no object/schema, cannot assume owner/migrator, has no TEMPORARY privilege, has only read access to the Drizzle ledger, and must fail startup if effective identity, unsafe attributes, authenticated TLS, search path, schema version, grants, or immutable relation privileges differ from the frozen contract. `task_events`, `artifacts`, `task_checkpoints`, `task_checkpoint_artifacts`, and `approval_decision_artifacts` grant runtime only INSERT/SELECT; KBN-100 retains RESTRICT/no-cascade semantics.
-- **Non-effect:** rc.4 SI-001 candidate-key/FK order and all KCR-001–016 tenancy, SOT, proposal-audit, approval, fence, recovery, no-cascade, endpoint, and wire invariants are unchanged. This amendment neither creates roles/secrets nor changes production deployment (**except as amended by rc.20 — see below**).
+- **Non-effect:** rc.4 SI-001 candidate-key/FK order and all KCR-001–016 tenancy, SOT, proposal-audit, approval, fence, recovery, no-cascade, endpoint, and wire invariants are unchanged. This amendment neither creates roles/secrets nor changes production deployment.
 - **Gate:** KBN-101’s role/schema-boundary foundation certificate, Vault/redaction/rotation, N-1/rollback, and independent security GO are mandatory before KBN-100. After KBN-100 creates the immutable relations, KBN-101 real deployed-role immutable-operation certification plus Ultron GO is mandatory before KBN-105; synthetic test-role success alone is insufficient. Exact implementation detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
 
 ### 1.0.0-rc.4 — KBN010-SI-001 (preserved)

docs/reports/compaction-refresh/830-documentation-checklist.md

@@ -1,34 +0,0 @@
-# #830 Documentation Completion Checklist
-
-## Required artifacts
-
-- [x] `docs/PRD.md` contains the M1 compaction-refresh trust-lifecycle requirements and acceptance criteria.
-- [x] Operator behavior and recovery are documented in `docs/guides/lease-broker-operations.md`.
-- [x] Developer architecture and protocol behavior are documented in `docs/architecture/compaction-revocation.md`, `lease-broker-protocol.md`, and `mutator-class-gate.md`.
-- [x] Security boundaries and residuals are documented in `docs/architecture/lease-broker-security.md` and `compaction-revocation.md`.
-- [x] `docs/SITEMAP.md` links the new architecture page.
-- [x] User-guide changes are not applicable: observers are mandatory internal runtime controls with no end-user workflow.
-- [x] OpenAPI/endpoint changes are not applicable: the broker remains an internal Unix-socket protocol, not a public HTTP API.
-
-## Contract coverage
-
-- [x] Claude and Claudex lifecycle signals, matchers, commands, and fail-closed behavior are documented.
-- [x] Pi pre-/post-compaction signals and session replacement reasons are documented.
-- [x] Private generation-file ownership, monotonic update, same-PID replacement, and failure fencing are documented.
-- [x] `revoke_lease` input purpose, broker response state, and denial behavior are documented.
-- [x] T12b/T30 explicitly names the bounded residual stale window and reports within-TTL **ALLOWED** / after-TTL **DENIED**.
-- [x] Documentation explicitly disclaims a within-window mutator-action bound.
-- [x] T-A, T-C, same-principal, and protected-branch boundaries are retained.
-
-## Structure and review
-
-- [x] New architecture content is under `docs/architecture/`.
-- [x] This report is under `docs/reports/compaction-refresh/`.
-- [x] Session evidence is under `docs/scratchpads/`.
-- [x] Documentation changes are in the same logical change set as code and tests.
-- [ ] Independent exact-head code and Opus security reviews pending coordinator sequencing after the deterministic-main rebase gate.
-
-## Publishing
-
-- [x] Canonical documentation remains in-repository.
-- [x] No external publishing target is required for this internal M1 control.

docs/reports/deferred/758-fleet-config-deferrals.md

@@ -1,54 +0,0 @@
-# FCM-M5-001 Fleet Documentation Deferrals and Holds
-
-**Issue:** #758 · **Branch:** `docs/758-fleet-config-operator-docs`
-
-These are accepted existing DAG boundaries, not omissions silently claimed as delivered.
-
-## FCM-M3-002 hold
-
-- Boot/reboot preservation for roster members persisted stopped or disabled.
-- Current installation may enable all agent units, while the launcher projection does not yet carry
-  `lifecycle.enabled` or `desired_state`; documentation therefore does not claim lifecycle-safe reboot.
-- Heartbeat/liveness integration into roster-v2 `status`, `doctor`, and `verify`; current observations
-  cover systemd active state, tmux sessions, holder ownership, and unmanaged sessions only.
-
-## FCM-M4-002 hold
-
-- Executable v1-to-v2 cutover, reversible canary, and rollback.
-- Stale-projection/orphan migration classification and current-host managed/unmanaged fixture coverage.
-- Any live migration, lifecycle, systemd/tmux/session, or rollback action.
-
-M5 docs describe prerequisites and the preview boundary only. A ready preview is not migration or rollback evidence.
-
-## Explicit validate-operation gap
-
-- `FCM-REQ-03` requires a documented programmatic `mosaic fleet validate` operation.
-- The current CLI does not expose that operation. Existing mutation/reconcile validation and the
-  documentation example test are not a replacement for the missing command.
-- FCM-M5-001 documents this implementation gap without inventing syntax, JSON, exit behavior, or an
-  owning implementation card. Parent #758 must remain open until the requirement is implemented and
-  evidenced or the PRD/DAG is explicitly revised through the authoritative process.
-
-## FCM-M5-002 hold
-
-- Deterministic source-versus-installed asset revision detection and safe refresh implementation.
-- Rolling local canary, independent validator certificate, final release evidence, merge-gate approval, and parent #758 closure.
-
-`operations/upgrade-assets.md` is therefore a fail-closed hold, not an invented procedure.
-
-## Compatibility interpretation
-
-The M0 cross-cutting row requiring every retained/migrated artifact to validate through the executable contract is satisfied by each artifact's declared executable disposition, not by forcing versioned v1 fixtures through the v2 parser:
-
-- retained examples are explicit `version: 1` fixtures validated by the production v1 parser;
-- canonical profiles validate through the shared baseline plus `roles.local` resolver;
-- the service preset validates through its production service-policy reader;
-- migration candidates validate through the production v2 compiler and shared semantic resolver.
-
-The executable disposition inventory rejects undeclared additions/removals and prevents silent legacy drift.
-
-## Repository-wide documentation structure
-
-The accepted #758 IA is the domain book under `docs/fleet/`. Creating global `USER-GUIDE`, `ADMIN-GUIDE`, or `DEVELOPER-GUIDE` books and cleaning unrelated pre-existing `docs/` root files are outside this bounded card. The repository sitemap links the fleet book. No HTTP/API/auth contract changed, so OpenAPI and endpoint-index updates are not applicable.
-
-Canonical documentation remains in-repository; no external publishing or generated publishing output is in scope. Parent issue #758 stays open through M5.

docs/reports/documentation/758-fleet-config-ia-closure.md

@@ -1,44 +0,0 @@
-# FCM-M5-001 Fleet Documentation IA Closure Evidence
-
-**Issue:** #758 · **Task:** FCM-M5-001
-
-## Artifact map
-
-- Fleet entry point and desired/observed decision tree: `docs/fleet/README.md`.
-- Concepts: `docs/fleet/concepts/` covers authority/projections, identity separation, role authority/leases, and the generated launch chain.
-- Operator workflows: `docs/fleet/how-to/` covers CRUD, lifecycle, interaction and validator instances, and role overrides.
-- Operations: `docs/fleet/operations/` covers reconciliation/recovery, quarantine, systemd/tmux troubleshooting, backup/restore boundaries, and upgrade-asset holds.
-- References: executable schema, complete field/default/constraint reference, CLI/JSON/exit behavior, lifecycle/status/drift, role authority, and generated environment boundary under `docs/fleet/reference/`.
-- Migration: preview field map, lifecycle preservation, backup/recovery prerequisites, aliases, and executable artifact dispositions under `docs/fleet/migration/`.
-- Navigation: `docs/SITEMAP.md` and the fleet entry point.
-
-## Acceptance mapping
-
-| Checklist area                                   | Evidence                                                                                                                                                                                                             |
-| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Roster authority and fail-closed legacy handling | Root PRD FCM-REQ-01/05/08; desired/observed and quarantine pages.                                                                                                                                                    |
-| Classes and authority                            | Root PRD FCM-REQ-07; role authority concept/reference; configurable interaction/validator how-tos.                                                                                                                   |
-| Lifecycle                                        | Root PRD FCM-REQ-04; lifecycle transition table and operator lifecycle how-to.                                                                                                                                       |
-| Local-only generated launch boundary             | Root PRD FCM-REQ-05/09; generated launch concept/reference.                                                                                                                                                          |
-| Complete DAG and artifact inventory              | `docs/TASKS.md`; M0 inventory; executable disposition tests.                                                                                                                                                         |
-| IA pages                                         | Every path named by the M0 checklist exists and is linked from `docs/fleet/README.md`.                                                                                                                               |
-| Examples                                         | `docs/fleet/examples/roster-v2.yaml` validates through production v2 compiler/shared resolver; shipped artifact dispositions validate through declared production readers.                                           |
-| Links                                            | Deterministic local Markdown link test covers the entire fleet book and sitemap, including local heading-fragment resolution.                                                                                      |
-| Sensitive/example safety                         | Validator scans backtick- and tilde-fenced fleet-book examples plus the canonical roster for sensitive-looking keys, common credential formats (including Anthropic, OpenAI project, and Stripe restricted keys), path-qualified privileged commands, package-manager/root commands, arbitrary command override, and hardcoded Tess/Ultron identities; findings report only file/block and violation kind, never matched values. |
-| Holds                                            | `docs/reports/deferred/758-fleet-config-deferrals.md` records M3-002, M4-002, M5-002, compatibility, and repository-structure boundaries.                                                                            |
-
-## Documentation completion checklist
-
-- [x] Root PRD exists and remains the #758 requirements authority.
-- [ ] The accepted project-specific fleet book is indexed, but it is not complete against `FCM-REQ-03`: the required explicit programmatic `mosaic fleet validate` operation is not implemented. The CLI reference and deferral report record this gap without inventing behavior.
-- [x] Sitemap links the fleet entry point and operator-critical pages.
-- [x] No HTTP/API/auth contract changed; OpenAPI/endpoint rows are not applicable.
-- [x] Working evidence remains under `docs/scratchpads/`; closure and deferral evidence remains under `docs/reports/`.
-- [x] Canonical source remains in-repository; no external publishing action is in scope.
-- [ ] Independent exact-head documentation review, PR CI, and FCM-M5-002 release certificate remain post-PR gates and are not claimed here.
-
-## Live-action boundary
-
-No migration, canary, rollback, deployment, systemd/tmux/session operation, generated projection, or product mutation was performed. `roster.yaml` remains the sole writable desired-state authority. `mos-comms` remains temporary. Parent issue #758 remains open.
-
-Validation command results and exact commit/tree evidence are recorded in the task scratchpad and PR body after execution.

docs/rfcs/RFC-001-MACP-MATRIX-NATIVE.md

@@ -1,449 +0,0 @@
-# RFC-001 — MACP: A Mosaic-Native, Matrix-Native Comms Layer
-
-- **Status:** DRAFT — for Team Lead → Orchestrator staffing
-- **Author:** MS-LEAD (reviewer identity `ms-lead-reviewer`)
-- **Sponsor / veto:** Jason (human lead)
-- **Date:** 2026-07-24
-- **Program:** Mosaic Stack comms-evolution
-- **Supersedes backbone:** the Hermes MCP chat bridge (strangler-retired, see §9)
-- **Audience:** Team Leads, the Mosaic orchestrator, infra, and any harness maintainer (Claude Code / Codex / Pi / Goose)
-
-> This is a **design document**. No code ships from this RFC. It exists to be decomposed into missions (P1→P5, §10) with per-phase acceptance criteria. Where a claim is uncertain or needs live validation, it is flagged **[VERIFY]**.
-
----
-
-## 0. TL;DR
-
-We are building a **Mosaic-native comms layer on Matrix**. We self-host a **Synapse** homeserver and register a privileged **Mosaic Application Service** (the "appservice") that the orchestrator controls. The appservice bulk-provisions one Matrix identity per agent-spin, creates and manages rooms, posts agent introductions, and tracks presence/liveness. Agents talk to it through a thin `packages/comms` client SDK. **tmux stays the P0 same-host fast path**; Matrix is the durable, presence-aware, federated layer above it, and **MACP** (the Mosaic Agent Comms Protocol) is the standard that says which path to use when. Federation is **per-site Synapse homeservers federated over TLS we control** — a direct answer to "the homelab agent went dark and took comms with it." We adopt **Buzz's patterns** (auto-detect/enroll, signed identity, unified event log, humans-and-agents on one surface) without adopting Buzz/Nostr as transport. We migrate off Hermes by the **strangler** pattern: stand native alongside, move channels as proven, retire at parity.
-
-The **first standalone shippable slice is presence** (P1).
-
----
-
-## 1. Goals / Non-Goals
-
-### 1.1 Goals
-
-- **G1 — Presence & liveness first.** A Team Lead must be able to answer "is my coordinator online, away, or dead?" in seconds, not by polling for 13 hours. Presence is the P1 slice and ships before anything else.
-- **G2 — A native backbone we own.** Replace _Hermes-as-backbone_ with a self-hosted Synapse + a Mosaic-controlled appservice. External chat bridging becomes an optional edge, not the spine.
-- **G3 — Turnkey harness enrollment.** `mosaic enroll` auto-detects the harness and self-registers the agent via the appservice on spin. No hand-rolled per-bot identity juggling.
-- **G4 — A real protocol (MACP v1).** Structured, versioned event schema over Matrix custom event types; a documented routing contract for tmux vs Matrix; a documented escalation policy.
-- **G5 — No central SPOF.** Per-site homeservers federated over TLS/DNS we already control, so one site going dark cannot take the fleet's comms with it.
-- **G6 — Gate-action integrity.** Reviews / merges / approvals carry **signed authorship** (Buzz pattern) so a gate-critical action is cryptographically attributable, retiring the fragile "distinct bot identity" juggling.
-
-### 1.2 Non-Goals
-
-- **NG1 — Do NOT rip out working comms mid-MVP.** tmux fast-path and the existing `mos-comms` git-branch channel keep working until their replacement is proven at parity. This RFC is strangler, not big-bang.
-- **NG2 — tmux is NOT being replaced.** tmux inter-agent comms remains **P0**. Matrix is _above_ it, not instead of it. MACP defines the boundary; it does not move it.
-- **NG3 — Not adopting Buzz/Nostr as transport.** We adopt Buzz's _patterns_; the wire is Matrix.
-- **NG4 — Not building a new chat client in P1–P4.** HIL uses an existing Matrix client (Element or equivalent) until/unless a custom client is justified (open question, §11).
-- **NG5 — Not federating to the public Matrix network.** Federation is Mosaic-site-to-Mosaic-site over infrastructure we control. Public `matrix.org` federation is out of scope (and should likely be firewalled off).
-- **NG6 — Not a Hermes feature-clone.** We reach _parity on the channels that matter_ (§9 checklist), not bug-for-bug Hermes compatibility.
-
----
-
-## 2. Architecture
-
-### 2.1 Layer diagram
-
-```
-                          ┌───────────────────────────────────────────────┐
-                          │                 HUMAN (Jason / HIL)            │
-                          │        Element (or custom client) — §11        │
-                          └───────────────────────┬───────────────────────┘
-                                                  │  (same Matrix surface as agents)
-                                                  │
-   ┌──────────────────────────────────────────────▼──────────────────────────────────────────────┐
-   │                              SYNAPSE HOMESERVER  (self-hosted, ours)                          │
-   │   - Client-Server API (agents + humans send/receive events)                                   │
-   │   - Application Service API (privileged AS hooks: transactions, user/room namespaces)         │
-   │   - Presence EDUs, receipts, typing                                                           │
-   │   - Federation API (S2S) over TLS  ── to peer site homeservers (§6, P4)                       │
-   └───────▲───────────────────────────────────▲──────────────────────────────────────▲───────────┘
-           │ AS API (hs_token / as_token)       │ C-S API (per-agent access_token)      │ S2S
-           │                                     │                                       │
-   ┌───────┴───────────────────────┐    ┌────────┴─────────────────┐          ┌─────────┴──────────┐
-   │   MOSAIC APPSERVICE           │    │   packages/comms  (SDK)   │          │  PEER SITE Synapse │
-   │   (apps/matrix-appservice)    │    │   used by every harness   │          │  (site-B, site-C…) │
-   │   THE "native layer"          │    │   - login/whoami          │          │  own appservice    │
-   │   replacing Hermes-backbone   │    │   - send MACP events      │          │  own agents        │
-   │                               │    │   - subscribe/sync        │          └────────────────────┘
-   │  - bulk-provision MXIDs       │◄───┤   - presence heartbeat    │
-   │    (@mosaic_<agent>:site)     │    │   - signed-authorship     │
-   │  - create/manage rooms        │    │     envelope (gate acts)  │
-   │  - post introductions         │    └────────────┬─────────────┘
-   │  - track presence/liveness    │                 │ in-process / IPC
-   │  - enforce room taxonomy      │        ┌─────────▼──────────────────────────────────────────┐
-   │  - escalation watchdog (§5)   │        │                 AGENT HARNESS                        │
-   │  - controlled by ORCHESTRATOR │        │   Claude Code / Codex / Pi / Goose                   │
-   └───────▲───────────────────────┘        │   `mosaic enroll` runs on spin (§4.1)                │
-           │ orchestrator drives AS          └─────────┬───────────────────────────────────────────┘
-   ┌───────┴───────────────────────┐                  │
-   │   MOSAIC ORCHESTRATOR          │                  │  P0 FAST PATH (same host, low-latency)
-   │   (~/.config/mosaic)           │        ┌─────────▼──────────┐   tmux send-keys / pane I/O
-   │   spins agents, owns rooms,    │◄──────►│   tmux (P0)        │◄─►│ peer agent on same host │
-   │   sets escalation policy       │  MACP  └────────────────────┘   └─────────────────────────┘
-   └───────────────────────────────┘  routing rules decide tmux vs Matrix per message (§4.6)
-```
-
-Key idea: **the appservice is the backbone.** It is a long-lived privileged process registered with Synapse via an appservice registration file (`hs_token`/`as_token`, namespaces). It is the thing that used to be "Hermes-as-backbone," except we own it, it is inside the orchestrator's control plane, and it speaks native Matrix.
-
-### 2.2 Message flow: agent spin-up → auto-enroll → room join → introduction → presence-online
-
-```
-Orchestrator                Harness (mosaic enroll)        Mosaic Appservice           Synapse
-    │                              │                              │                        │
- 1. spin agent  ─────────────────► │                              │                        │
-    │                              │ 2. auto-detect harness       │                        │
-    │                              │    (Claude/Codex/Pi/Goose)   │                        │
-    │                              │ 3. POST /enroll {agent meta} ─►                        │
-    │                              │                              │ 4. provision MXID       │
-    │                              │                              │    @mosaic_<agent>:site │
-    │                              │                              │    via AS API register ─►  (201, in namespace)
-    │                              │                              │ 5. mint access_token   │
-    │                              │ 6. ◄── {mxid, token, rooms}──┤    (or as_token masq)  │
-    │                              │                              │ 7. invite+join rooms   ─► (mission/team/fleet)
-    │                              │ 8. /sync (via packages/comms)─────────────────────────►  (joined state)
-    │                              │                              │ 9. post introduction    ─► m.room.message +
-    │                              │                              │    (mosaic.introduction)    custom event → rooms
-    │                              │ 10. set presence ONLINE ─────────────────────────────►   presence EDU
-    │                              │ 11. start heartbeat loop     │                        │
-    │                              │     (mosaic.presence ping)   │                        │
-    │ 12. appservice reports agent │                              │                        │
-    │ ◄──── live in fleet room ────┤ (watchdog now tracks liveness)                         │
-```
-
-Notes on the steps that matter:
-
-- **Step 4/5** use the **Application Service API**: the appservice can register users inside its namespace (`@mosaic_*:site`) and act on their behalf. Two viable modes: (a) mint a real per-agent `access_token` via appservice login, or (b) have the appservice **masquerade** using `user_id` query param on C-S calls with the `as_token`. **Recommendation: mint per-agent tokens** for P2 so the agent process holds only its own credential (blast-radius containment, §8); reserve masquerade for bulk/bootstrap operations the appservice itself performs. **[VERIFY]** exact token-lifetime and refresh behavior against the running Synapse version.
-- **Step 9** — the introduction is both a human-readable `m.room.message` _and_ a structured `mosaic.introduction` custom event (so other agents can machine-parse capabilities without scraping prose).
-- **Step 10/11** — presence goes online immediately, then a **heartbeat** keeps liveness fresh. Native Matrix presence auto-decays to `unavailable`/`offline`, but we do **not** rely solely on it (Synapse presence timeouts are coarse and federation presence is lossy **[VERIFY]**); MACP adds an explicit `mosaic.presence` heartbeat event for deterministic liveness (§4.5, §5).
-
----
-
-## 3. Repo-home decision (RESOLVED — recommendation)
-
-The core tension: **product monorepo** (`mosaicstack/stack`, this checkout `/src/mosaic-stack`) vs **framework** (`~/.config/mosaic`, the agent/harness runtime that every agent shares regardless of product). The boundary rule I am ratifying:
-
-> **Product-monorepo owns the deployed _services and libraries_. Framework owns the _agent/harness contract_ — anything an agent needs the moment it spins, before any product code is checked out.**
-
-Applying that rule:
-
-| Piece                                                                        | Home                                                                                             | Rationale                                                                                                                                                                                                                                                                                 |
-| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Synapse deployment** (compose/helm, config, TLS, `.well-known`, pipelines) | **Product monorepo** → `infra/matrix/` + CI in the monorepo's pipeline dir                       | It is deployed infrastructure with the same lifecycle/observability as Gateway/Web/DB. Lives beside other `infra/` and Woodpecker pipelines.                                                                                                                                              |
-| **Mosaic Appservice**                                                        | **Product monorepo** → `apps/matrix-appservice`                                                  | It is a first-class deployed service (NestJS-style app, same conventions: ESM, `@Inject()`, DTOs, OTEL-before-bootstrap). It talks to Synapse, holds `hs_token`/`as_token`, and is operated like any other app. It is **controlled by** the orchestrator but **is not** the orchestrator. |
-| **Client SDK**                                                               | **Product monorepo** → `packages/comms`                                                          | A workspace library consumed by product apps _and_ by harnesses. Published/linked like `packages/queue`, `packages/db`. Versioned with the product.                                                                                                                                       |
-| **MACP spec** (the standard doc + JSON schemas)                              | **Framework** → `~/.config/mosaic/spec/macp/` (mirrored/vendored into `packages/comms` at build) | The protocol is an agent-level contract that must exist independent of any one product checkout. Framework is the source of truth; `packages/comms` vendors a pinned copy so the SDK and spec cannot drift silently.                                                                      |
-| **`mosaic enroll` harness glue** (auto-detect, spin hook)                    | **Framework** → `~/.config/mosaic/tools/enroll/`                                                 | Agents/harnesses are framework-level. Enrollment must run _before_ the agent has product context; it cannot depend on `/src/mosaic-stack` being present. This is exactly parallel to the existing `~/.config/mosaic/tools/*` wrappers.                                                    |
-
-**Boundary summary:** _the wire and the services are product; the contract and the spin-time glue are framework._ The one deliberate coupling is **MACP**: framework is authoritative, but `packages/comms` pins a vendored copy and CI fails if they diverge, so an agent enrolling via framework and a service validating via `packages/comms` agree on the schema by construction.
-
-**Rejected alternative:** putting the appservice in the framework. Rejected because the appservice is a stateful, deployed, secret-holding network service that needs the product's CI/observability/secret plumbing; burying it in `~/.config/mosaic` would split its operational story from every other Mosaic service.
-
----
-
-## 4. MACP v1 — the standard
-
-MACP (Mosaic Agent Comms Protocol) v1 is a **profile of Matrix**: it does not invent a transport, it constrains how Mosaic agents use Matrix so that behavior is uniform across harnesses. Versioned via a `macp_version` field on every custom event; v1 is frozen at ratification (P3).
-
-### 4.1 Enrollment contract
-
-`mosaic enroll` MUST, on agent spin, in order:
-
-1. **Auto-detect harness.** Detection order + signal:
-   - Claude Code — presence of the Claude Code runtime/env (e.g. `CLAUDE_CODE_*` env, `~/.claude`) **[VERIFY exact signal per harness]**
-   - Codex — Codex runtime markers
-   - Pi — Pi SDK runtime (`packages/agent` / `packages/mosaic` context)
-   - Goose — Goose runtime markers
-   - Fallback: explicit `--harness` flag; if undetectable, enroll as `generic` and warn.
-2. **Provision identity** — call appservice `POST /enroll` with `{agent_slug, harness, host, mission_id?, team_id?, capabilities[]}`. Appservice returns `{mxid, access_token, homeserver, rooms[]}` (§2.2 step 4–6).
-3. **Join rooms** — accept invites / join the returned room set per taxonomy (§4.6).
-4. **Introduce** — post `mosaic.introduction` (+ human-readable `m.room.message`) to each joined room.
-5. **Go present** — set Matrix presence `online` and start the `mosaic.presence` heartbeat loop.
-
-Enrollment is **idempotent**: re-running `mosaic enroll` for an existing agent slug rebinds to the same MXID (re-mints token if needed) rather than creating a duplicate identity. This is what retires the "distinct bot identity juggling."
-
-### 4.2 Structured event schema (Matrix custom event types)
-
-All MACP events carry a common envelope in `content`:
-
-```jsonc
-{
-  "macp_version": "1.0",
-  "macp_type": "<see below>",
-  "agent": { "mxid": "@mosaic_teamlead-3:site-a", "slug": "teamlead-3", "harness": "claude-code" },
-  "ts": 1753300000000,
-  "mission_id": "KBN-101",         // optional
-  "signature": { ... }             // present ONLY for gate actions, §4.4
-  // ...type-specific fields...
-}
-```
-
-Event types (Matrix `type` shown; timeline events use `m.room.message` with a custom `msgtype` where a human-visible fallback is desirable, state events use a dotted custom `type`):
-
-| MACP type             | Matrix carrier                                                                          | Purpose                                      | Notable fields                                                                                 |
-| --------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------- | ---------------------------------------------------------------------------------------------- |
-| **message**           | `m.room.message`, `msgtype: "mosaic.message"` (+ `body` fallback)                       | ordinary agent/human chat                    | `body`, `thread?`                                                                              |
-| **presence**          | `m.room.message` msgtype `mosaic.presence` in fleet room **or** custom EDU-backed state | heartbeat/liveness ping                      | `status: online\|away\|offline`, `seq`, `interval_ms`                                          |
-| **workflow-step**     | state event `mosaic.workflow.step` (state_key = step id)                                | durable record of a workflow/mission step    | `step`, `status: started\|blocked\|done\|failed`, `detail`                                     |
-| **review / approval** | `m.room.message` msgtype `mosaic.review`                                                | a review verdict or merge/approval           | `subject` (PR/commit ref), `verdict: approve\|reject\|request-changes`, `signature` (REQUIRED) |
-| **escalation**        | `m.room.message` msgtype `mosaic.escalation`                                            | raise a stuck/dark condition to HIL/fallback | `reason`, `target`, `severity`, `since_ts`                                                     |
-
-Rationale for the carrier split: **timeline events** (`m.room.message` variants) are the durable, receipted, replayable log (this _is_ Buzz's "unified event log," §7). **State events** (`mosaic.workflow.step`, presence-as-state) give last-writer-wins current status that a newly-joined agent reads instantly from room state without replaying history.
-
-Every custom event is validated against a JSON Schema shipped in the MACP spec (§3). Unknown/newer `macp_version` → consumers MUST degrade gracefully (render `body`, ignore unknown fields).
-
-### 4.3 Agent identity model
-
-- **MXID:** appservice-namespaced `@mosaic_<slug>:<site-domain>`. The `mosaic_` prefix is the AS **user namespace** declared in the registration file (`namespaces.users` regex `@mosaic_.*`), so Synapse routes those users to our appservice and no human can squat the namespace.
-- **Provisioning:** exclusively via the appservice (AS API register). Never hand-created. One MXID per agent-spin; idempotent rebind on re-enroll (§4.1).
-- **Signed authorship** overlays identity for gate actions only (§4.4). MXID answers "who is this account"; signature answers "did the real key-holder authorize this gate action."
-
-### 4.4 Signed-authorship for gate-critical actions (Buzz pattern, scoped)
-
-Gate-critical = **reviews, merges, approvals** — anything that can move code to `main` or unblock a mission gate.
-
-- Each enrolled agent is issued (or generates) an **Ed25519 keypair**; the **public** key is registered with the appservice at enrollment and published as agent profile state (`mosaic.identity.pubkey`). Private key custody per §8.
-- A gate action event carries `content.signature = { alg: "ed25519", key_id, sig }` over a canonical serialization of the envelope (canonical-JSON of `{macp_type, agent.mxid, subject, verdict, ts, mission_id}`).
-- Verifiers (the appservice gate-watcher, and any agent acting on a verdict) MUST reject an unsigned or bad-signature gate event. Non-gate events are unsigned (keeps the hot path cheap).
-
-This is deliberately **narrow**: we do not sign every chat line (Buzz signs everything; we take the pattern only where forgery has teeth). Scope may widen post-P5 if warranted.
-
-### 4.5 Presence & liveness model
-
-Three visible states plus an explicit heartbeat:
-
-- **online** — agent set presence online AND last `mosaic.presence` heartbeat within `heartbeat_interval` (default **30s [VERIFY tuning]**) × miss-tolerance (default 2).
-- **away** — presence `unavailable`, or heartbeats late but < dark threshold.
-- **offline / dark** — no heartbeat for `dark_threshold` (default **N minutes**, policy value, §5/§11) OR presence `offline`.
-
-Why not rely on native Matrix presence alone: Synapse presence is (a) coarse-grained, (b) can be disabled for load reasons, and (c) **degrades across federation** **[VERIFY]**. So MACP layers an explicit heartbeat carried as a lightweight timeline/state event in the **fleet presence room**, giving a deterministic, federation-safe liveness signal the escalation watchdog (§5) can reason about. Native presence EDUs are still emitted (they make Element show the right dot for humans) but the _authoritative_ liveness source is the heartbeat.
-
-### 4.6 Room / channel taxonomy (orchestrator-owned)
-
-The **orchestrator** (via the appservice) owns room lifecycle. Agents never create backbone rooms ad hoc.
-
-| Room                    | Scope                                      | Membership                               | Purpose                                                                 |
-| ----------------------- | ------------------------------------------ | ---------------------------------------- | ----------------------------------------------------------------------- |
-| **Fleet presence room** | one per site (federated view across sites) | every enrolled agent + HIL               | heartbeats, the single "who's alive" board. This is the P1 deliverable. |
-| **Per-mission room**    | one per mission (e.g. `#mission-KBN-101`)  | agents on that mission + Team Lead + HIL | workflow-steps, mission chat, reviews for that mission                  |
-| **Per-team room**       | one per team                               | team members + Team Lead                 | intra-team coordination                                                 |
-| **HIL room**            | one (or one per site)                      | humans + escalation-privileged agents    | where escalations land; Jason's pane on the fleet                       |
-
-Rooms are created with orchestrator-controlled power levels: appservice = admin (PL100), Team Leads elevated, worker agents default. Room aliases (`#mission-KBN-101:site-a`) are stable handles.
-
-### 4.7 tmux ↔ Matrix routing rules (the fast-path/durable boundary)
-
-MACP mandates this decision per message. **Default bias: if it must survive the agent, be seen by an offline party, cross a host, or be audited — Matrix. If it is same-host, synchronous, and ephemeral — tmux.**
-
-| Signal                                                           | Route                                          | Why                                                                         |
-| ---------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------- |
-| Same-host, live pane-to-pane prompt/nudge, sub-second need       | **tmux (P0)**                                  | lowest latency, no server round-trip; this is the working fast path we keep |
-| Recipient may be offline / on another host                       | **Matrix**                                     | durability + store-and-forward; tmux can't reach a dark or remote pane      |
-| Presence / heartbeat / liveness                                  | **Matrix**                                     | must be observable fleet-wide, including by the watchdog and HIL            |
-| Workflow-step, review/approval, escalation                       | **Matrix**                                     | must be durable, receipted, auditable, signed (gate acts)                   |
-| Cross-site anything                                              | **Matrix (federated)**                         | tmux is same-host only                                                      |
-| Bulk log spew / high-frequency scratch between co-located agents | **tmux**, with periodic **Matrix** checkpoints | avoid flooding the durable log; keep an audit checkpoint                    |
-
-Rule of thumb encoded in the SDK: `comms.send()` takes a `durability` hint; `ephemeral+same-host` short-circuits to tmux, everything else goes Matrix. A message can be **dual-routed** (tmux for immediacy + a Matrix checkpoint) when both speed and durability matter.
-
----
-
-## 5. Coordinator-availability + HIL escalation (the 13h-stall / homelab-dark fix)
-
-**The failure we are killing:** a Team Lead blocked ~13h, polling every 15 min, unable to distinguish "coordinator offline" from "coordinator busy"; and a homelab agent that goes dark taking comms with it.
-
-**The fix — presence-driven, policy-encoded escalation:**
-
-1. **Deterministic liveness (§4.5).** Every agent heartbeats into the fleet presence room. The appservice **escalation watchdog** subscribes and maintains `last_seen` per agent. No polling by the Team Lead — it _subscribes_ (Matrix `/sync` long-poll) and is pushed state changes.
-
-2. **Encoded policy in MACP:** a machine-readable escalation policy attached to each agent/role, e.g.:
-
-   ```jsonc
-   {
-     "role": "team-lead",
-     "coordinator": "@mosaic_coordinator-1:site-a",
-     "dark_threshold_min": 10, // OPEN QUESTION §11 — Jason/Mos to set N
-     "on_coordinator_dark": {
-       "action": "escalate",
-       "fallback": "@mosaic_coordinator-2:site-b", // cross-site fallback
-       "then": "notify-HIL",
-       "hil_room": "#hil:site-a",
-     },
-   }
-   ```
-
-3. **Detection & action by the Team Lead:** when the watchdog (or the Team Lead's own SDK) observes `coordinator.last_seen > dark_threshold`, it:
-   - emits a `mosaic.escalation` event into the mission room and the HIL room (`reason: "coordinator dark", since_ts, severity`),
-   - **re-routes** to the declared fallback coordinator (possibly on another site — this is why federation matters),
-   - if no fallback answers within a second threshold, pages **HIL** (Jason) in the HIL room.
-     The Team Lead **never sits blocked polling**; a dark coordinator is a _pushed event_, and the fallback/HIL path is automatic.
-
-4. **Homelab-dark specifically:** because heartbeats are federated into a cross-site fleet room, a whole _site_ going dark is visible from other sites — the watchdog on site-B sees site-A's coordinator stop heartbeating and triggers the same escalation. A dark homelab can no longer silently strand its agents, because the liveness signal and the fallback live _off that host_.
-
-**Design invariant:** liveness authority and fallback targets must never be co-located with the thing they monitor. The watchdog for site-A's coordinator should also run (or be mirrored) on site-B.
-
----
-
-## 6. Federation (P4)
-
-**Model:** each site runs its **own Synapse homeserver** with its **own Mosaic appservice** and its own agents. Sites **federate** with each other over the standard Matrix server-to-server (S2S) API, restricted to Mosaic sites.
-
-**Why per-site, not one central server:**
-
-- **No SPOF.** The homelab going dark is the founding trauma of this program. A single central homeserver would recreate exactly that risk at fleet scale. Per-site means a site outage is contained: its agents drop, but every other site's comms and the cross-site fleet room survive.
-- **Locality.** Same-site agents get low-latency local homeserver traffic; only cross-site events pay the federation cost.
-- **Blast radius.** A compromised or misbehaving site can be defederated without touching the rest.
-
-**How federation is wired (real Matrix mechanics):**
-
-- **Server discovery** via `https://<domain>/.well-known/matrix/server` returning `{"m.server": "matrix.<domain>:443"}`, and/or an `_matrix._tcp` **SRV** record. We control the DNS/domains, so we control the federation graph. **[VERIFY]** current `.well-known` vs SRV precedence for the deployed Synapse version.
-- **TLS:** federation requires valid TLS on the federation endpoint; we terminate with certs from our own CA/ACME on domains we own.
-- **Allowlist:** use Synapse `federation_domain_whitelist` to restrict federation to the set of Mosaic site domains — **no public-network federation** (NG5). This is a hard security boundary.
-- **Cross-site rooms:** the fleet presence room and any cross-mission rooms are federated rooms whose membership spans site homeservers. Room state replicates via S2S; presence heartbeats propagate as events (not relying on lossy presence EDUs across federation, §4.5).
-
-**Cross-site identity:** an agent on site-B is `@mosaic_<slug>:site-b`. The signed-authorship pubkey travels in profile state, so a site-A verifier can validate a site-B agent's gate action without trusting site-B's homeserver blindly (signature ≠ homeserver trust).
-
----
-
-## 7. Buzz-pattern adoption map
-
-We adopt Buzz's **ideas**, on Matrix rails, phased:
-
-| Buzz idea                                           | Adopt?            | How, on Matrix                                                                                                            | Phase                                                      |
-| --------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
-| **Harness auto-detect / enroll**                    | **Yes**           | `mosaic enroll` detects Claude/Codex/Pi/Goose and self-registers via the appservice (§4.1)                                | P2 (enroll v1); scan-machine-and-offer-integrate is **v2** |
-| **Keypair signed identity**                         | **Yes, scoped**   | Ed25519 signed-authorship on **gate actions only** (reviews/merges/approvals), pubkey in profile state (§4.4)             | P5 (hardening); keys issued at enroll from P2              |
-| **Unified event log (humans + agents, one log)**    | **Yes**           | Matrix room timeline _is_ the unified, receipted, replayable event log; MACP custom events are first-class entries (§4.2) | P2→P3                                                      |
-| **Humans and agents on the same surface**           | **Yes**           | HIL uses the same Matrix rooms via Element/custom client; escalations land where Jason already is (§4.6, §5)              | P1 (fleet room) → P2                                       |
-| **Scan machine, offer to integrate existing tools** | **Deferred (v2)** | enroll v1 auto-detects the _harness_; scanning a host for other integratable tools is explicitly **enroll v2**, post-P5   | v2                                                         |
-| **Buzz/Nostr as transport**                         | **No**            | transport is Matrix; only patterns are borrowed (NG3)                                                                     | —                                                          |
-
----
-
-## 8. Security
-
-- **Homeserver hardening.** Disable open registration (`enable_registration: false`); agents come only via the appservice. `federation_domain_whitelist` to Mosaic sites only (§6). Rate-limiting on. Media repo locked down or disabled if unused. Admin API bound to localhost / behind auth. Run Synapse behind our reverse proxy with TLS termination we control. **[VERIFY]** current recommended hardening flags for the deployed Synapse version.
-- **Appservice token custody (`hs_token` / `as_token`).** These are the crown jewels — `as_token` lets the holder act as any user in the namespace; `hs_token` authenticates the homeserver → appservice callbacks. They live **only** in the appservice's secret store (see Vault interaction below), never in an agent process, never in the SDK, never in git. Registration file (which contains them) is a secret artifact, mounted at deploy, not committed. Rotate on suspected exposure; rotation requires updating both Synapse's registration and the appservice.
-- **Per-agent credentials (the hard part — fleet key management).**
-  - Agents hold **only their own** per-agent `access_token` (minted by the appservice at enroll), not the `as_token`. Compromise of one agent ≠ compromise of the namespace.
-  - **Issuance:** at `mosaic enroll`, the appservice mints the token and returns it over the enroll channel (which must itself be authenticated — enroll requests carry a spin-time bootstrap secret / orchestrator-signed nonce **[VERIFY design in P2]**, so a random process can't enroll a rogue agent).
-  - **Signed-authorship keys:** Ed25519 private keys should be generated agent-side and only the public key leaves the agent (best custody: private key never transits the network). Where agents are ephemeral, keys are minted per-spin and discarded on teardown; the pubkey-in-profile record remains for audit.
-  - **Rotation:** tokens are short-lived where the Synapse version supports refresh **[VERIFY]**; otherwise the appservice supports explicit re-issue on re-enroll. A rotation runbook is a P2 deliverable.
-- **Federation TLS.** Valid certs on federation endpoints; whitelist-only federation; monitor for cert expiry (a cert lapse silently defederates a site — add to observability).
-- **Interaction with existing Vault/secrets.** The appservice's `hs_token`/`as_token` and the enroll bootstrap secret are stored in the existing secret manager (Vault or the project's chosen store — **open question §11**) and injected at deploy, consistent with how Gateway/DB secrets are handled today. No new bespoke secret store. Per-agent tokens are _transient runtime_ secrets, not persisted to Vault (they're re-mintable). **[VERIFY]** current Mosaic secret-management choice — the CLAUDE.md notes secrets/KBN work in flight, so align with whatever KBN-101 lands.
-
----
-
-## 9. Migration — strangler off Hermes
-
-**Principle:** stand the native layer up _alongside_ Hermes, move channels over **as each is proven at parity**, retire Hermes only when the parity checklist is green. Never a flag-day cutover (NG1).
-
-**Sequence:**
-
-1. **Stand alongside.** Native Synapse + appservice + fleet presence room live in parallel; Hermes still carries everything it carries today. Presence (P1) is _additive_ — it gives us something Hermes never had, at zero risk to existing flows.
-2. **Move channels as proven.** Per channel (fleet presence → mission coordination → reviews/approvals → external-chat edge), cut traffic to Matrix, keep Hermes as hot fallback until the channel meets parity for a soak period.
-3. **Retire at parity.** When every checklist item is green and soaked, decommission the Hermes MCP bridge as backbone. (External chat platforms, if still needed, can be re-attached as a _bridge at the edge_ of Matrix rather than the spine.)
-
-**Parity checklist (must all be green before Hermes retires):**
-
-- [ ] Every message class Hermes carries today has a MACP equivalent (message, review/approval, escalation, workflow-step).
-- [ ] Presence/liveness is strictly better than today (it is: today = none).
-- [ ] Cross-site delivery works over federation with no central SPOF.
-- [ ] HIL (Jason) can see and act on escalations on the Matrix surface.
-- [ ] Signed-authorship enforced on gate actions (no unsigned merge/approve accepted).
-- [ ] `mosaic enroll` auto-onboards all four harnesses (Claude/Codex/Pi/Goose) with zero manual identity setup.
-- [ ] Delivery receipts / durability demonstrably ≥ Hermes (no lost messages over a soak window).
-- [ ] Runbooks exist: appservice token rotation, site defederation, dark-site escalation, homeserver restore.
-- [ ] Observability: appservice + Synapse traced into OTEL/Jaeger like the rest of the stack.
-- [ ] Rollback path documented (re-enable Hermes channel) for the soak period.
-
----
-
-## 10. Phased delivery plan (P1 → P5) with acceptance criteria
-
-> This section is the decomposition surface: each phase → one or more missions for the orchestrator.
-
-### P1 — Presence / availability on a minimal single-site Synapse _(the first standalone shippable slice)_
-
-**Scope:** one Synapse homeserver, a **minimal** appservice (or even a scripted provisioner) whose only job is: register a handful of agent MXIDs, create the **fleet presence room**, and carry heartbeats; a minimal `packages/comms` slice that sets presence and heartbeats; native presence surfaced to a human via Element.
-**Acceptance criteria:**
-
-- A1. Single-site Synapse deployed (`infra/matrix/`), reachable over TLS, open registration OFF.
-- A2. ≥3 agents enroll (even if semi-manually) and appear in a **fleet presence room** with a live online/away/offline indicator.
-- A3. `mosaic.presence` heartbeat implemented; an agent killed hard flips to **offline/dark** within `dark_threshold` deterministically (not dependent on native presence timeout alone).
-- A4. A human (Jason) can open Element, join the fleet room, and see fleet liveness at a glance.
-- A5. Zero impact to existing tmux + `mos-comms` flows (they still work untouched).
-
-### P2 — Native appservice + orchestrator auto-enroll / room-provisioning
-
-**Scope:** full **`apps/matrix-appservice`** registered with Synapse (`hs_token`/`as_token`, namespaces); `mosaic enroll` harness auto-detect; orchestrator-owned room taxonomy; per-agent token minting; introductions.
-**Acceptance criteria:**
-
-- B1. Appservice registered with Synapse via registration file; owns `@mosaic_*` user namespace and room-alias namespace.
-- B2. `mosaic enroll` auto-detects all four harnesses (Claude/Codex/Pi/Goose) and self-registers on spin, idempotently.
-- B3. On spin, an agent is provisioned an MXID, minted its **own** access token, joined to the correct mission/team/fleet rooms, and posts a `mosaic.introduction`.
-- B4. Orchestrator can create/destroy mission & team rooms with correct power levels via the appservice.
-- B5. Enroll bootstrap is authenticated (a rogue local process cannot enroll a rogue agent).
-- B6. Appservice + Synapse traced into OTEL/Jaeger.
-
-### P3 — MACP v1 spec ratified
-
-**Scope:** freeze the standard (§4): envelope, event types + JSON Schemas, identity model, presence model, room taxonomy, tmux↔Matrix routing rules. Spec lives in framework (`~/.config/mosaic/spec/macp`), vendored+pinned into `packages/comms` with CI drift-check.
-**Acceptance criteria:**
-
-- C1. MACP v1 document ratified (MS-LEAD sign-off, Jason veto window closed).
-- C2. JSON Schemas for all five event types published; `packages/comms` validates outbound/inbound against them.
-- C3. CI fails if framework spec and vendored `packages/comms` copy diverge.
-- C4. Routing-rule conformance test: SDK provably sends ephemeral+same-host over tmux, everything else over Matrix.
-- C5. Unknown-`macp_version` graceful-degrade behavior tested.
-
-### P4 — Federation
-
-**Scope:** a second site homeserver + appservice; S2S federation over our DNS/TLS; cross-site fleet room; whitelist-only federation; cross-site escalation.
-**Acceptance criteria:**
-
-- D1. Two sites federate via `.well-known`/SRV over TLS we control; `federation_domain_whitelist` restricts to Mosaic sites (no public federation).
-- D2. A cross-site fleet presence room shows agents from both sites; heartbeats propagate as events across federation.
-- D3. **Homelab-dark test:** killing site-A's coordinator is observed from site-B within `dark_threshold`, and the escalation/fallback fires cross-site (§5).
-- D4. Cross-site gate action: a site-B agent's signed review is verified by a site-A verifier.
-- D5. Defederation runbook proven (a site can be cut off cleanly).
-
-### P5 — Buzz-hardening + signed-authorship + Hermes retired
-
-**Scope:** Ed25519 signed-authorship enforced on gate actions; security hardening pass; complete the strangler and retire Hermes at parity.
-**Acceptance criteria:**
-
-- E1. Every merge/approve/review gate action is signed; unsigned or bad-sig gate events are rejected by the appservice watcher and by consuming agents.
-- E2. Token/key rotation runbooks executed at least once in anger (rotate `as_token`, rotate a per-agent key).
-- E3. Security review complete: homeserver hardening flags, token custody, federation TLS/whitelist all verified.
-- E4. **Parity checklist (§9) fully green + soaked.**
-- E5. Hermes MCP bridge retired as backbone (optionally re-attached as an edge bridge only).
-
----
-
-## 11. Open questions for Jason / Mos (need a human/coordinator ruling)
-
-1. **DNS / domains per site.** What domain(s) do we own and want to use per site for homeserver names and `.well-known` (e.g. `site-a.mosaicstack.dev`)? Federation identity is permanent-ish once agents mint MXIDs against it — this needs a ruling **before P1 hardens** because MXIDs bake in the domain.
-2. **Secret-management choice.** Is it Vault, or whatever KBN-101 lands? The appservice `hs_token`/`as_token` and enroll bootstrap secret custody depend on this (§8). CLAUDE.md signals secrets work is in flight — need the authoritative target.
-3. **N-minute escalation threshold.** What is `dark_threshold_min` for a coordinator, and the second threshold before HIL is paged (§5)? Default proposed: 10 min → fallback, +5 min → HIL. Jason/Mos to confirm per role.
-4. **HIL client: Element vs custom.** Do humans use off-the-shelf **Element** (fast, free, P1-ready) or do we invest in a custom HIL client? Proposed: **Element for P1–P4**, revisit custom only if HIL ergonomics demand it.
-5. **Ephemeral vs persistent agent keys.** For signed-authorship, do we mint Ed25519 keys per-spin (simplest custody, no long-term private key at rest) or issue durable per-agent keys (stable identity across spins, but key-at-rest custody problem)? Proposed: **per-spin**, pubkey retained for audit.
-6. **Federation topology / trust.** Full mesh between all sites, or hub-and-spoke-with-redundancy? Full mesh maximizes no-SPOF but grows O(n²); needs a call once site count is known.
-7. **Fallback-coordinator assignment authority.** Who assigns each Team Lead's fallback coordinator, and is it always cross-site? (Design invariant §5 wants the fallback off the monitored host — confirm this is acceptable operationally.)
-8. **Retention / compliance.** How long do we retain the Matrix event log (the unified audit trail)? Affects Synapse storage sizing and any purge policy.
-
----
-
-## Appendix A — Real Matrix concepts this RFC leans on (quick reference)
-
-- **Application Service (AS) API** — a privileged service registered with the homeserver via a registration YAML declaring `id`, `url`, `as_token`, `hs_token`, and `namespaces` (users/aliases/rooms regexes). The homeserver pushes events to the AS in transactions; the AS can register/act-as users in its namespace. _(This is our appservice backbone.)_
-- **`hs_token` / `as_token`** — `hs_token`: homeserver→AS authentication on pushed transactions; `as_token`: AS→homeserver authentication, grants acting-as any namespaced user. Both are high-value secrets (§8).
-- **Masquerade (`user_id` query param)** — the AS may act as a namespaced user on C-S calls using `as_token` + `?user_id=`. We prefer per-agent tokens for blast-radius; masquerade for AS-internal bulk ops.
-- **Custom event types** — timeline events via `m.room.message` with a custom `msgtype` (keeps a human-visible `body` fallback) and/or fully custom `type` (dotted, e.g. `mosaic.workflow.step`); **state events** for last-writer-wins current status readable from room state without history replay.
-- **Presence EDUs** — native online/unavailable/offline signals; coarse and lossy over federation, so MACP adds an explicit heartbeat event as the authoritative liveness source (§4.5).
-- **Federation (S2S API)** — server-to-server over TLS; discovery via `/.well-known/matrix/server` and/or `_matrix._tcp` SRV; restrictable with `federation_domain_whitelist`.
-- **Synapse config knobs cited** — `enable_registration`, `federation_domain_whitelist`, appservice registration file, rate-limiting, admin API binding. **[VERIFY]** exact flags/paths against the deployed Synapse version at implementation time.
-
-_All Matrix mechanics above are cited from architecture knowledge and MUST be re-verified against the actual deployed Synapse version during P1 — every **[VERIFY]** in this document is a checkpoint, not an assumption._

docs/rfcs/RFC-002-INSTALL-CONFIG-TOPOLOGY.md

@@ -1,622 +0,0 @@
-# RFC-002 — Install, Configuration & Topology for the Mosaic Matrix/MACP Comms System
-
-- **Status:** DRAFT — for Team Lead → Orchestrator staffing
-- **Author:** MS-LEAD (reviewer identity `ms-lead-reviewer`)
-- **Sponsor / veto:** Jason (human lead)
-- **Date:** 2026-07-24
-- **Program:** Mosaic Stack comms-evolution
-- **Companion to:** RFC-001 — _MACP: A Mosaic-Native, Matrix-Native Comms Layer_. RFC-001 is the architecture (self-hosted Synapse + Mosaic appservice backbone + `packages/comms` SDK + MACP standard + per-site federation). **RFC-002 is the config substrate the whole thing installs and runs on.**
-- **Audience:** Team Leads, the Mosaic orchestrator, infra, harness maintainers, and — critically — **strangers who install this open-source product on hardware we will never see.**
-
-> This is a **design document**. No code ships from this RFC. It is written to be decomposed into missions with per-phase acceptance criteria, and it slots under RFC-001's P1→P5. Every uncertain or must-live-validate claim is flagged **[VERIFY]**.
-
-> **The one framing that governs every decision below:** this is an **open-source product**. Someone we have never met will `git clone` it and run it on their own domains, their own DNS, their own certs, their own hardware. **NOTHING may hardcode our fleet's topology.** There is no `woltje.com` in the code, no assumption that DNS exists, no assumption that a second site exists. Every topology fact is **user-supplied config**. Where this doc uses `mosaic.woltje.com` / `mosaic.uscllc.com`, those are **illustrative operator values** (Jason's real installs), never defaults and never literals in the product.
-
----
-
-## 0. TL;DR
-
-The comms system installs against a **user-supplied topology**, never a baked-in one. At install the operator declares exactly one of **three topology modes**: **(A) split-domain** (identity `server_name` ≠ homeserver host, wired via Matrix delegation — this is Jason's `mosaic.woltje.com` identity + `matrix.woltje.com` host setup), **(B) single-domain** (`server_name` == homeserver host), or **(C) IP-only standalone** (no DNS, no federation, fully supported for local/airgapped). **The PRIMARY/home instance is ALWAYS configured; federation is OPTIONAL.** A single standalone instance MUST work with zero federation.
-
-**Federation is a hard-gated capability: it REQUIRES DNS + valid certificates. IP-only federation is not possible and is not supported.** IP-only means standalone-only, forever, until the operator acquires DNS + certs.
-
-Certificates are **one ACME integration** with a user-chosen **directory URL**: either **step-ca** (self-hosted private ACME CA, for total control and private/internal domains public CAs can't issue for) or **Let's Encrypt** (public ACME, ease-of-use). The operator also picks a challenge type (HTTP-01 / DNS-01 / TLS-ALPN-01); **DNS-01 is the answer for private/split-horizon domains.**
-
-Secrets go through a **pluggable `SecretBackend` interface** — no forced paid dependency. Ships with a **Vault** implementation and a **Vaultwarden** implementation; the operator picks at install. The Vaultwarden model (org + orchestrator enrolled as authority + per-agent scoped access) is designed-for, with an honest **[VERIFY]** on how far Vaultwarden's machine-account coverage has matured.
-
-Config is **DB-backed with sane defaults and install-time overrides**. Precedence: **install-time → DB override → default.** Config is split into **install-time-immutable** (e.g. `server_name`, which is baked into every MXID and cannot change without re-homing every identity) and **runtime-tunable** (e.g. dark-threshold).
-
-RFC-002 is the substrate; **RFC-001's P1 (presence) needs only Mode A/B single-instance clean-domain and does NOT require federation, IP-only, or the secret-backend rotation story resolved.**
-
----
-
-## 1. Goals / Non-Goals
-
-### 1.1 Goals
-
-- **G1 — Installable by a stranger.** A person with no relationship to our fleet can install, configure, and run the comms system from published artifacts and a guided installer, on their own hardware and domains, with no edits to product code.
-- **G2 — Zero hardcoded topology.** Every topology fact — `server_name`, homeserver host/IP, delegation method, federation peers, cert mode, secret backend — is **user-supplied config**, validated at install, stored in the product DB. No fleet-specific literal ships in the product.
-- **G3 — Standalone MUST work.** The PRIMARY instance is always fully functional with **zero federation**, including with **no DNS at all** (Mode C, IP-only). Presence, rooms, MACP, HIL-via-Element all work single-instance.
-- **G4 — Federation is optional but honestly gated.** Federation is opt-in and, when opted into, **requires DNS + valid certificates as a hard precondition.** The installer must refuse to _claim_ federation is working when the DNS/cert preconditions aren't met.
-- **G5 — One ACME integration, two CA choices.** Build a single ACME cert-provisioning path; the operator selects step-ca or Let's Encrypt by supplying an **ACME directory URL** plus a challenge type. No second, bespoke cert path.
-- **G6 — No forced paid dependency for secrets.** A pluggable `SecretBackend` with at least Vault and Vaultwarden implementations, chosen at install. Open-source ethos: the free/self-hostable path must be first-class.
-- **G7 — Defaults that just work, overrides where they matter.** DB-backed config with sane defaults so most operators change little; install-time overrides for the topology-critical values; a clear immutable-vs-tunable boundary so operators can't foot-gun `server_name`.
-- **G8 — A clean upgrade path.** An operator who starts standalone can later turn on federation with a documented, honest procedure (including the real cost if they started IP-only and must now acquire a stable `server_name`).
-
-### 1.2 Non-Goals
-
-- **NG1 — Not hosting a managed service.** This RFC is about _self-install_. We are not building multi-tenant SaaS provisioning; each operator runs their own instance(s).
-- **NG2 — Not a new cert stack.** We do not write our own CA, our own ACME client protocol, or a non-ACME cert path. We integrate ACME and let the operator point it at step-ca or Let's Encrypt. (We _may_ bundle/recommend step-ca as the self-hosted CA, but via its standard ACME provisioner, not a fork.)
-- **NG3 — Not a new secret manager.** We define an interface and ship adapters. We do not build a secret store; we do not force one.
-- **NG4 — Not public-network Matrix federation.** Consistent with RFC-001 NG5: federation is Mosaic-site-to-Mosaic-site over infrastructure the operator controls, allowlisted. No `matrix.org` federation.
-- **NG5 — Not making IP-only federate.** We will not ship a hack (self-signed S2S trust bundles, `/etc/hosts` federation) that pretends IP-only can federate. IP-only is standalone. This is a deliberate, honest boundary (§2.4, §7).
-- **NG6 — Not re-homing identities silently.** We will not offer a "just change your `server_name`" button that quietly orphans every MXID. Any path that changes `server_name` is a flagged, gated, documented identity re-home (§5.3, §7).
-
----
-
-## 2. The topology model
-
-### 2.1 The core split: `server_name` vs homeserver host
-
-Matrix has exactly the split Jason described, natively:
-
-- **`server_name`** — the Synapse config value that is the server's **identity domain**. It is the part after the colon in every MXID (`@mosaic_agent:mosaic.woltje.com`) and every room alias (`#mission-KBN-101:mosaic.woltje.com`). It is **baked into every identity the moment that identity is minted.** Changing it re-homes everything. This is `server_name` in Synapse's `homeserver.yaml`.
-- **Homeserver host** — the actual network location (hostname:port or IP:port) where the Synapse process answers federation and (optionally proxied) client traffic. It **can differ** from `server_name`. Matrix reconciles the difference through **delegation**: `https://<server_name>/.well-known/matrix/server` returning `{"m.server": "matrix.woltje.com:443"}`, and/or a `_matrix._tcp.<server_name>` **SRV** record. **[VERIFY]** `.well-known` vs SRV precedence on the deployed Synapse version (RFC-001 §6 flags the same).
-
-So Jason's "mosaic._ app-domain + matrix._ homeserver-domain" split maps precisely: **`server_name = mosaic.woltje.com` (identity, in MXIDs), homeserver runs at `matrix.woltje.com` (discovered via delegation).** That is **Mode A**.
-
-### 2.2 The topology config schema
-
-One canonical config object, stored in the product DB (§5), populated at install (§6). Illustrative shape (field names decomposition-ready, not frozen):
-
-```jsonc
-{
-  "topology": {
-    "mode": "split-domain | single-domain | ip-only-standalone", // A | B | C — install-time-immutable
-
-    "identity": {
-      "server_name": "mosaic.woltje.com", // INSTALL-TIME-IMMUTABLE. In MXIDs. Never change without re-home (§5.3).
-      "server_name_kind": "domain | ip", // "ip" only legal in Mode C
-    },
-
-    "homeserver": {
-      "host": "matrix.woltje.com", // where Synapse actually listens (Mode A: differs from server_name)
-      "port": 8448, // federation port (default 8448) or 443 if proxied — [VERIFY] per deploy
-      "client_bind": "https://matrix.woltje.com", // C-S API public URL (proxied)
-      "bind_ip": null, // Mode C: e.g. "192.168.1.50" ; Modes A/B: null (DNS-resolved)
-    },
-
-    "delegation": {
-      "method": "well-known | srv | none", // Mode A: well-known or srv ; Mode B/C: none
-      "well_known_server": { "m.server": "matrix.woltje.com:443" }, // if method=well-known
-      "srv_record": "_matrix._tcp.mosaic.woltje.com. 3600 IN SRV 10 0 443 matrix.woltje.com.", // if method=srv (documented, operator provisions)
-    },
-
-    "federation": {
-      "enabled": true, // OPTIONAL. Mode C forces false.
-      "domain_whitelist": [
-        // Synapse federation_domain_whitelist — allowlist ONLY
-        "mosaic.woltje.com",
-        "mosaic.uscllc.com",
-      ],
-      "peers": [
-        // operator-declared peer sites (for room/fleet wiring)
-        { "server_name": "mosaic.uscllc.com", "role": "secondary", "fleet_room": true },
-      ],
-    },
-
-    "tls": {
-      "acme": {
-        "directory_url": "https://acme.mosaic.woltje.com/acme/acme/directory", // step-ca OR https://acme-v02.api.letsencrypt.org/directory
-        "ca_kind": "step-ca | letsencrypt", // informational label; the directory_url is the real switch
-        "challenge": "dns-01 | http-01 | tls-alpn-01",
-        "account_email": "ops@woltje.com", // ACME account contact
-        "eab": { "kid": null, "hmac_key_ref": null }, // External Account Binding if the CA requires it (some step-ca provisioners) — secret via SecretBackend
-      },
-      "client_tls_mode": "acme | self-signed", // Mode C may use self-signed for local C-S TLS (weaker trust, §8)
-    },
-
-    "secrets": {
-      "backend": "vault | vaultwarden", // pluggable, install-time choice (§4)
-      "connection": {
-        "address": "https://vault.woltje.com:8200", // or Vaultwarden/Bitwarden server URL
-        "auth_ref": "…", // how the appservice authenticates to the backend (bootstrap, §4/§8)
-        "namespace_or_org": "mosaic-fleet", // Vault namespace / mount, OR Vaultwarden org id
-      },
-    },
-  },
-}
-```
-
-### 2.3 The three modes, concretely
-
-Exactly three supported modes (Jason's ruling — no others):
-
-**Mode A — split-domain (identity ≠ host, delegated).** _Jason's PRIMARY._ Federation-capable. This is the recommended production shape because it lets identity live on a clean app-domain while the homeserver runs on a separate operational host.
-
-```jsonc
-// Mode A — mosaic.woltje.com identity, matrix.woltje.com host, federated with a second site
-{
-  "topology": {
-    "mode": "split-domain",
-    "identity": { "server_name": "mosaic.woltje.com", "server_name_kind": "domain" },
-    "homeserver": {
-      "host": "matrix.woltje.com",
-      "port": 443,
-      "client_bind": "https://matrix.woltje.com",
-      "bind_ip": null,
-    },
-    "delegation": {
-      "method": "well-known",
-      "well_known_server": { "m.server": "matrix.woltje.com:443" },
-    },
-    "federation": {
-      "enabled": true,
-      "domain_whitelist": ["mosaic.woltje.com", "mosaic.uscllc.com"],
-      "peers": [{ "server_name": "mosaic.uscllc.com", "role": "secondary", "fleet_room": true }],
-    },
-    "tls": {
-      "acme": {
-        "directory_url": "https://acme-v02.api.letsencrypt.org/directory", // public LE, or a step-ca directory
-        "ca_kind": "letsencrypt",
-        "challenge": "dns-01",
-        "account_email": "ops@woltje.com",
-      },
-      "client_tls_mode": "acme",
-    },
-    "secrets": {
-      "backend": "vaultwarden",
-      "connection": { "address": "https://vw.woltje.com", "namespace_or_org": "mosaic-fleet" },
-    },
-  },
-}
-```
-
-MXIDs on this instance: `@mosaic_coordinator-1:mosaic.woltje.com`. A human/agent's homeserver is discovered by resolving `.well-known/matrix/server` on `mosaic.woltje.com` → `matrix.woltje.com:443`.
-
-**Mode B — single-domain (identity == host).** Simpler; the `server_name` _is_ the host. No delegation needed. Federation-capable (still needs DNS + cert on that one domain).
-
-```jsonc
-// Mode B — one domain does everything
-{
-  "topology": {
-    "mode": "single-domain",
-    "identity": { "server_name": "matrix.example.org", "server_name_kind": "domain" },
-    "homeserver": {
-      "host": "matrix.example.org",
-      "port": 8448,
-      "client_bind": "https://matrix.example.org",
-      "bind_ip": null,
-    },
-    "delegation": { "method": "none" },
-    "federation": { "enabled": false, "domain_whitelist": [], "peers": [] }, // optional — off here
-    "tls": {
-      "acme": {
-        "directory_url": "https://acme-v02.api.letsencrypt.org/directory",
-        "ca_kind": "letsencrypt",
-        "challenge": "http-01",
-        "account_email": "admin@example.org",
-      },
-      "client_tls_mode": "acme",
-    },
-    "secrets": {
-      "backend": "vault",
-      "connection": { "address": "https://vault.example.org:8200", "namespace_or_org": "mosaic" },
-    },
-  },
-}
-```
-
-MXIDs: `@mosaic_coordinator-1:matrix.example.org`. Here `server_name == host`, so `@:matrix.example.org` is both the identity domain and where Synapse actually answers.
-
-**Mode C — IP-only standalone (no DNS, no federation).** Fully supported for local/airgapped/homelab-without-DNS. `server_name` is an IP:port literal. **Cannot federate — ever — in this mode** (federation requires a real domain + valid CA cert; §2.4). Client TLS may be self-signed (weaker trust, §8).
-
-```jsonc
-// Mode C — airgapped / local, no DNS, standalone only
-{
-  "topology": {
-    "mode": "ip-only-standalone",
-    "identity": { "server_name": "192.168.1.50:8448", "server_name_kind": "ip" },
-    "homeserver": {
-      "host": "192.168.1.50",
-      "port": 8448,
-      "client_bind": "https://192.168.1.50:8448",
-      "bind_ip": "192.168.1.50",
-    },
-    "delegation": { "method": "none" },
-    "federation": { "enabled": false, "domain_whitelist": [], "peers": [] }, // FORCED false in Mode C
-    "tls": { "acme": null, "client_tls_mode": "self-signed" }, // may use a private step-ca or self-signed for C-S TLS
-    "secrets": {
-      "backend": "vaultwarden",
-      "connection": { "address": "http://192.168.1.51:8080", "namespace_or_org": "mosaic-local" },
-    },
-  },
-}
-```
-
-MXIDs: `@mosaic_coordinator-1:192.168.1.50:8448`. **Warning surfaced at install:** this `server_name` is an IP literal; if the operator ever wants federation they must move to a domain, which is an **identity re-home** (§5.3, §7).
-
-> **[VERIFY]** Synapse accepts an `ip:port` `server_name` and mints usable MXIDs against it for local/standalone use. This is believed workable for non-federated operation but must be validated against the deployed Synapse version; some Synapse versions/tools assume a DNS-resolvable `server_name`. If an IP literal is rejected, Mode C falls back to a **fabricated local domain** (e.g. `mosaic.local`) resolved via `/etc/hosts` or a local resolver — still standalone-only, same re-home caveat.
-
-### 2.4 The hard federation gate (Jason's HARD STOP)
-
-**Federation REQUIRES DNS + valid certificates. This is a hard stop, enforced by the installer and by the config validator, not a suggestion.**
-
-| Precondition                                                               | Why                                                                                                | Enforced where                                                                                                   |
-| -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `server_name` resolves in public/peer DNS (or delegated target does)       | S2S discovery uses `.well-known`/SRV over DNS; peers must resolve you                              | installer reachability check (§6); config validator rejects `federation.enabled=true` with `server_name_kind=ip` |
-| Valid TLS cert on the federation endpoint, chained to a CA the peer trusts | S2S is TLS; a peer validates your cert. Self-signed/untrusted ⇒ peer refuses ⇒ you are defederated | installer cert probe (§6); cert monitor (§3.4)                                                                   |
-| Federation `domain_whitelist` non-empty and mutually consistent with peers | allowlist-only federation (RFC-001 NG5/§6)                                                         | config validator                                                                                                 |
-
-**IP-only ⇒ federation is impossible.** There is no valid public/peer CA cert for a bare IP in our trust model (and we will not ship a self-signed S2S trust hack — NG5). Therefore **Mode C is standalone-only by construction**, and the config validator makes `mode=ip-only-standalone ∧ federation.enabled=true` an **illegal state that cannot be persisted.**
-
-This is the honest, load-bearing boundary of the whole topology model:
-
-```
-        DNS + valid cert?
-        ┌─────────────┴─────────────┐
-       YES                          NO
-        │                            │
- Mode A or B                     Mode C (IP-only)
- federation OPTIONAL          STANDALONE ONLY
- (opt-in, allowlisted)        (federation impossible)
-```
-
----
-
-## 3. Certificate provisioning — one ACME integration
-
-### 3.1 Single integration, directory-URL as the switch
-
-We build **exactly one** cert-provisioning integration: an **ACME client integration**. Both supported CAs are ACME CAs. The operator does **not** choose between two code paths; they choose an **ACME directory URL** and a **challenge type**. That is the entire surface.
-
-| CA choice               | What it is                      | ACME directory URL (illustrative)                                                     | Why an operator picks it                                                                                                                                                       |
-| ----------------------- | ------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **step-ca (Smallstep)** | self-hosted **private** ACME CA | `https://acme.<internal-domain>/acme/<provisioner>/directory`                         | **Total control**; issues for **private/internal/split-horizon domains** a public CA can't (e.g. `mosaic.internal`, RFC-1918 split-horizon); airgap-friendly; you own the root |
-| **Let's Encrypt**       | public ACME CA                  | `https://acme-v02.api.letsencrypt.org/directory` (staging: `.../acme-staging-v02...`) | **Ease of use**; universally trusted chain (ISRG Root X1); zero CA to operate; ideal for public domains                                                                        |
-
-Because both speak ACME, the same client (account key, order, authorization, challenge, finalize, cert-fetch, renew) drives either. The `ca_kind` label in config is informational for UX; the **`directory_url` is the real determinant**. **[VERIFY]** whether the chosen ACME library requires per-CA quirks (LE rate limits, staging switch; step-ca **External Account Binding** on some provisioners — if EAB is required the `kid`/`hmac_key` come from the SecretBackend, §4).
-
-### 3.2 Challenge-type matrix (which challenge for which topology)
-
-The operator picks one challenge type per the domains they're covering. This is the crux for **public vs private/split-horizon**:
-
-| Challenge       | How it proves control                                                   | Best for                                                                                                                   | Cannot / caveat                                                                                                                                                                                                                         |
-| --------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **HTTP-01**     | CA GETs `http://<domain>/.well-known/acme-challenge/<token>` on port 80 | **Public, single hostname**, port 80 reachable from CA (Mode B, or Mode A's homeserver host)                               | Needs inbound :80 from the CA; **cannot** do wildcards; **useless for private domains** a public CA can't reach                                                                                                                         |
-| **DNS-01**      | CA checks a `_acme-challenge.<domain>` **TXT** record you publish       | **Private / split-horizon / internal domains**, **wildcards**, and any domain where inbound HTTP from the CA is impossible | Requires **programmatic DNS API** access to publish TXT (or manual for step-ca where you own the resolver). **This is the answer for step-ca on private domains** and for Mode A when the homeserver host isn't publicly HTTP-reachable |
-| **TLS-ALPN-01** | CA connects TLS on :443 with ALPN `acme-tls/1`                          | Public host where **:443 is free** but :80 is blocked                                                                      | Needs the ACME client to own the :443 TLS handshake briefly; awkward behind some reverse proxies — **[VERIFY]** against our proxy (RFC-001 terminates TLS at a reverse proxy)                                                           |
-
-**Guidance baked into the installer:**
-
-- **Let's Encrypt + public domain, port 80 open →** HTTP-01 (simplest). Wildcard or no inbound :80 → DNS-01.
-- **step-ca + private/internal/split-horizon domain →** **DNS-01** (the private CA can validate against a resolver you control; public HTTP reachability is irrelevant). This is the combination that lets a private homelab domain get real certs.
-- **:443-only public host →** TLS-ALPN-01.
-
-### 3.3 Delegation setup for split-domain (Mode A)
-
-For Mode A, the cert and the delegation must agree. Concretely, at install for `server_name=mosaic.woltje.com`, host `matrix.woltje.com`:
-
-1. **Cert(s):** obtain a valid cert for **`matrix.woltje.com`** (the federation/host endpoint — this is where the TLS handshake actually lands). If serving `.well-known` over HTTPS on `mosaic.woltje.com`, that origin **also** needs a valid cert for `mosaic.woltje.com`. So Mode A typically provisions **two** SANs/certs: identity-domain (`mosaic.woltje.com`, serves `.well-known`) and host (`matrix.woltje.com`, serves S2S+C-S). **[VERIFY]** whether a single multi-SAN cert is preferable operationally.
-2. **Delegation record**, one of:
-   - **`.well-known`:** serve `https://mosaic.woltje.com/.well-known/matrix/server` → `{"m.server":"matrix.woltje.com:443"}` (and `.well-known/matrix/client` for C-S discovery so agents/Element find the host).
-   - **SRV:** `_matrix._tcp.mosaic.woltje.com. IN SRV 10 0 443 matrix.woltje.com.` The installer **documents and validates** the record but the operator provisions it in their DNS (we don't run their DNS). **[VERIFY]** `.well-known` vs SRV precedence on the deployed Synapse.
-3. **Validate:** installer fetches the operator's own `.well-known`/SRV and confirms it points at the configured host, and that the host presents a valid cert (§6). Only then does it declare Mode A "federation-ready."
-
-### 3.4 Renewal & monitoring — a lapsed federation cert silently defederates
-
-**This is the operational trap and it must alarm.** ACME certs are short-lived (LE = 90 days; step-ca often shorter by policy). A federation cert that lapses does **not** throw a loud error — peers simply **stop trusting the S2S handshake and the site silently drops out of federation.** From inside, everything looks fine; from peers, the site went dark. That is exactly the "homelab went dark and took comms with it" trauma (RFC-001 §5), but caused by a cert, not a host.
-
-Requirements:
-
-- **Auto-renew** on the standard ACME schedule (renew at ~⅓ lifetime remaining; LE guidance ~30 days before expiry). The ACME integration owns this loop.
-- **Expiry monitoring as a first-class alarm.** Emit cert-days-remaining into OTEL/Jaeger metrics (consistent with RFC-001 §8's "monitor for cert expiry — a cert lapse silently defederates"). Alarm thresholds (e.g. warn <14d, critical <3d) are **runtime-tunable** config (§5).
-- **Federation-health probe:** periodically resolve our own delegation and validate our own cert _as a peer would_ (external vantage where possible), so a broken renewal is caught as "we would fail a peer's validation" before a peer notices.
-- **Escalation tie-in:** a critical cert-expiry or federation-health failure raises a `mosaic.escalation` (RFC-001 §4.2/§5) into the HIL room. A cert lapse is a fleet-visibility incident, not a silent config drift.
-
----
-
-## 4. Secret backend interface
-
-### 4.1 The `SecretBackend` contract
-
-A single pluggable interface. The appservice and orchestrator depend on the **interface**, never on Vault or Vaultwarden directly. Chosen at install; swappable without touching callers. Illustrative contract (decomposition-ready, not frozen):
-
-```ts
-interface SecretBackend {
-  // --- static secret CRUD (appservice tokens, ACME EAB, DB creds) ---
-  get(ref: SecretRef): Promise<SecretValue>;
-  put(ref: SecretRef, value: SecretValue, opts?: { immutable?: boolean }): Promise<void>;
-  rotate(
-    ref: SecretRef,
-    next: SecretValue,
-  ): Promise<{ previous: SecretVersion; current: SecretVersion }>;
-  list(prefix: SecretRef): Promise<SecretRef[]>;
-  delete(ref: SecretRef): Promise<void>;
-
-  // --- agent-credential lifecycle (the fleet-identity part) ---
-  enrollAgent(input: {
-    agentSlug: string;
-    scope: CredentialScope; // which rooms/secrets this agent may read
-    ttl?: Duration; // ephemeral-by-default per RFC-001 §8
-  }): Promise<AgentCredentialHandle>; // wraps the per-agent access_token + optional pubkey record
-
-  revokeAgent(agentSlug: string): Promise<void>; // must be authoritative & immediate
-
-  // --- health / bootstrap ---
-  health(): Promise<BackendHealth>;
-  authenticateSelf(bootstrap: BootstrapAuth): Promise<void>; // how the appservice/orchestrator logs into the backend
-}
-```
-
-Design intent: **`get/put/rotate`** cover the static crown-jewel secrets (appservice `hs_token`/`as_token`, ACME account/EAB keys, DB DSN). **`enrollAgent/revokeAgent`** cover the _fleet-identity_ lifecycle — this is where RFC-001's "mint per-agent token at enroll, discard on teardown" (RFC-001 §4.1, §8) actually lands.
-
-### 4.2 How appservice / agent tokens map onto it
-
-RFC-001 defines three tiers of Matrix secret. They map cleanly:
-
-| RFC-001 secret                                          | Sensitivity        | `SecretBackend` treatment                                                                                                                                                                                                                                                         |
-| ------------------------------------------------------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **`as_token`** (AS→HS, acts as any namespaced user)     | crown jewel        | `put(immutable-ish)` + `rotate`; **only** the appservice may `get` it; stored under a fleet-admin scope; never handed to an agent                                                                                                                                                 |
-| **`hs_token`** (HS→AS callback auth)                    | crown jewel        | same as `as_token`; both live only in appservice scope (RFC-001 §8)                                                                                                                                                                                                               |
-| **enroll bootstrap secret / orchestrator-signed nonce** | high               | `get` by orchestrator + appservice only; used to authenticate `POST /enroll` so a rogue process can't enroll a rogue agent (RFC-001 §8, B5)                                                                                                                                       |
-| **per-agent `access_token`**                            | transient runtime  | minted via `enrollAgent`, scoped to that agent, **short-TTL / re-mintable**, discarded on teardown; **not** durably persisted (RFC-001 §8 says per-agent tokens are transient) — the backend may hold a short-lived handle or a personal-vault entry for the agent's own lifetime |
-| **Ed25519 signed-authorship keypair**                   | high (private key) | private key generated **agent-side**, only pubkey leaves the agent (RFC-001 §4.4/§8); the SecretBackend stores the **pubkey record** for audit; per-spin keys need no at-rest custody                                                                                             |
-
-The key blast-radius property (RFC-001 §8) is preserved: agents receive **only their own** credential via `enrollAgent`; the `as_token` never leaves appservice scope.
-
-### 4.3 Vault implementation
-
-Vault maps naturally:
-
-- Static secrets → **KV v2** at a mount/namespace (`mosaic-fleet/`), with versioning giving `rotate` semantics for free.
-- **`enrollAgent`** → issue a scoped, TTL'd token or use **AppRole** / a scoped policy per agent; Vault's native TTL + revocation is exactly the transient per-agent model. `revokeAgent` → Vault token/lease revoke (authoritative, immediate).
-- **`authenticateSelf`** → the appservice authenticates to Vault via AppRole (role_id from config, secret_id injected at deploy) or a platform auth method; consistent with how Gateway/DB secrets are handled today (RFC-001 §8). **[VERIFY]** align with whatever KBN-101 lands for Mosaic secret management (CLAUDE.md flags secrets work in flight).
-- **Trade-off (honesty):** Vault is the most capable backend but is **not** the free-and-simple default for a hobbyist stranger; hence it must not be _forced_ (G6).
-
-### 4.4 Vaultwarden implementation + the org/enroll/revoke agent-account model
-
-Vaultwarden (self-hostable Bitwarden-compatible server) is the **open-source-ethos default candidate** — free, self-hostable, familiar. Jason's model, mapped onto Bitwarden/Vaultwarden's org primitives:
-
-1. **Operator creates one or more Bitwarden orgs** at install (e.g. `mosaic-fleet`).
-2. **The orchestrator is enrolled into the org and granted authority** to enroll/revoke agent sessions — it is the org's automation principal (admin/manager over an agents **collection**).
-3. **Agents get scoped credential access:** each agent gets access to a **collection** (or a personal vault provisioned for its spin) holding exactly the secrets its scope allows. `enrollAgent` = grant the agent principal access to its collection + provision its per-agent Matrix token entry; `revokeAgent` = remove the agent principal / revoke its access, immediately.
-4. **User + agents share scoped access:** the human operator and the agents both hold credentials in the same org, scoped by collection — humans and agents on one secret surface, mirroring RFC-001's "humans and agents on one comms surface" pattern.
-
-Mapping to the interface:
-
-| Interface op              | Vaultwarden mechanism                                                                                                                                                   |
-| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `get/put/rotate` (static) | items in an org **collection**; rotate = new item version / replace + old-version audit                                                                                 |
-| `enrollAgent`             | create/attach agent principal to its **collection**; provision per-agent token item, TTL enforced by our teardown (Vaultwarden itself is not TTL-native — see [VERIFY]) |
-| `revokeAgent`             | revoke the agent principal's org membership / collection access                                                                                                         |
-| `authenticateSelf`        | orchestrator authenticates as the org automation principal                                                                                                              |
-
-**HONEST MATURITY FLAG — [VERIFY]:** Bitwarden's clean **machine-account / service-account** primitive lives in **Bitwarden Secrets Manager**, and **Vaultwarden's coverage of Secrets Manager / machine accounts is partial and evolving.** What is known to work today on Vaultwarden: **orgs, collections, per-user (incl. a per-agent "user") vaults, and collection-scoped sharing.** What **may not** be fully there: the polished **machine-account API**, native short-TTL service credentials, and fine-grained programmatic access-token issuance equivalent to hosted Bitwarden Secrets Manager. **[VERIFY]** current Vaultwarden version's Secrets Manager / machine-account support before P-level commitment.
-
-**Why this is not a blocker:** the interface is designed so **either backend is viable**. If Vaultwarden's machine-account API isn't ready, the Vaultwarden adapter implements `enrollAgent` via the **personal-vault-per-agent + org-collection** model that works _today_ (create an agent principal, share the scoped collection, we enforce TTL via orchestrator teardown rather than backend-native TTL). If an operator needs backend-native short-TTL machine credentials now, they choose the **Vault** adapter. **We are not blocked on Vaultwarden maturing**, because the `SecretBackend` abstraction lets the polished-machine-account behavior land later without changing any caller.
-
----
-
-## 5. Config system
-
-### 5.1 Storage & precedence
-
-Config is **DB-backed** (Postgres, per the stack — CLAUDE.md/RFC-001), with sane defaults compiled into the product and install-time overrides. **Precedence, highest wins:**
-
-```
-install-time value   >   DB override (runtime)   >   compiled default
-```
-
-- **Compiled default** — ships in the product; what a stranger gets with zero config for every non-topology-critical key.
-- **Install-time value** — captured by the installer (§6), written to DB, and for **install-time-immutable** keys, **locked** (marked non-overridable).
-- **DB override** — runtime tuning via admin surface, allowed **only** for keys classified runtime-tunable.
-
-> Nuance: "install-time > DB override" applies to **immutable** keys — the install-time value is frozen and a DB override of it is rejected. For **tunable** keys, the DB override is the live value and the install-time value is just the initial seed. The classification (§5.3) is what makes the precedence unambiguous per key.
-
-### 5.2 DB schema shape
-
-Illustrative (Drizzle/Postgres, per stack conventions):
-
-```sql
--- one row per config key
-CREATE TABLE comms_config (
-  key            text PRIMARY KEY,            -- e.g. 'topology.identity.server_name'
-  value          jsonb NOT NULL,              -- current effective value
-  source         text NOT NULL,               -- 'install' | 'db-override' | 'default'
-  mutability     text NOT NULL,               -- 'install-immutable' | 'runtime-tunable'
-  set_by         text,                        -- operator/agent/system that set it
-  set_at         timestamptz NOT NULL DEFAULT now(),
-  CONSTRAINT immutable_not_overridable
-    CHECK (NOT (mutability = 'install-immutable' AND source = 'db-override'))
-);
-
--- append-only audit of every change (esp. attempted immutable changes)
-CREATE TABLE comms_config_audit (
-  id         bigserial PRIMARY KEY,
-  key        text NOT NULL,
-  old_value  jsonb,
-  new_value  jsonb,
-  actor      text NOT NULL,
-  action     text NOT NULL,     -- 'set' | 'override' | 'rejected-immutable'
-  at         timestamptz NOT NULL DEFAULT now()
-);
-```
-
-The DB `CHECK` is a belt-and-braces backstop; the application-layer config service enforces mutability and records rejected immutable-change attempts in the audit table. Secrets are **referenced** here (a `SecretRef`), never stored inline — actual secret values live in the `SecretBackend` (§4).
-
-### 5.3 Install-time-immutable vs runtime-tunable — the key table
-
-The single most important classification: **what can never change after install** vs **what an operator tunes anytime.** Getting `server_name` on the wrong side of this line is a foot-gun that orphans every identity.
-
-| Config key                                       | Mutability                                 | Rationale / cost of change                                                                                                                   |
-| ------------------------------------------------ | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| `topology.mode` (A/B/C)                          | **install-immutable**                      | changing mode changes identity/federation semantics; a mode change is effectively a reinstall/re-home                                        |
-| `topology.identity.server_name`                  | **install-immutable**                      | **baked into every MXID and room alias.** Changing it re-homes every identity — see re-home note below. **This is THE immutable value.**     |
-| `topology.identity.server_name_kind`             | **install-immutable**                      | domain↔ip change is a re-home (Mode C→A/B)                                                                                                   |
-| `topology.homeserver.host`                       | install-immutable (**delegation-tunable**) | in Mode A you _can_ move the host if you update delegation to match — the identity is unchanged; treat as immutable-with-migration, not free |
-| `topology.homeserver.bind_ip` / `port`           | runtime-tunable (ops)                      | operational network binding; no identity impact                                                                                              |
-| `topology.delegation.method` / records           | tunable-with-care                          | can switch well-known↔SRV as long as both still resolve to the same host; validated on change                                                |
-| `topology.federation.enabled`                    | **runtime-tunable (gated)**                | can flip **on** only if DNS+cert preconditions pass (§2.4); flipping standalone→federated is the §7 upgrade path                             |
-| `topology.federation.domain_whitelist` / `peers` | runtime-tunable                            | add/remove peers over time; each add re-validated                                                                                            |
-| `tls.acme.directory_url` / `ca_kind`             | runtime-tunable                            | can switch CA (e.g. LE→step-ca); triggers re-issue; monitor for trust-chain change                                                           |
-| `tls.acme.challenge`                             | runtime-tunable                            | switch challenge type if DNS/HTTP reachability changes                                                                                       |
-| `tls.client_tls_mode`                            | tunable-with-care                          | self-signed→acme is fine; acme→self-signed weakens trust (§8)                                                                                |
-| `secrets.backend`                                | install-immutable (**migration-only**)     | switching Vault↔Vaultwarden requires a secret migration; not a live flip                                                                     |
-| `secrets.connection.*`                           | runtime-tunable                            | rotate backend address/auth without changing which backend                                                                                   |
-| `presence.heartbeat_interval_ms`                 | runtime-tunable                            | RFC-001 §4.5 default ~30s; pure tuning                                                                                                       |
-| `presence.miss_tolerance`                        | runtime-tunable                            | RFC-001 §4.5 default 2                                                                                                                       |
-| `escalation.dark_threshold_min`                  | runtime-tunable                            | RFC-001 §5/§11 — default 10min → fallback                                                                                                    |
-| `escalation.hil_threshold_min`                   | runtime-tunable                            | RFC-001 §5 — default +5min → HIL                                                                                                             |
-| `cert.expiry_warn_days` / `expiry_critical_days` | runtime-tunable                            | §3.4 alarm thresholds (default 14 / 3)                                                                                                       |
-| `federation.health_probe_interval`               | runtime-tunable                            | §3.4                                                                                                                                         |
-
-**Identity re-home note (the cost of changing `server_name`):** because every MXID (`@mosaic_*:server_name`) and room alias (`#…:server_name`) embeds `server_name`, changing it means: every agent gets a **new identity**, all rooms must be **recreated/re-aliased**, signed-authorship pubkey records re-published, and federation peers re-pointed. There is **no in-place rename** in Matrix. Hence `server_name` is install-immutable and the installer gates it behind an explicit warning (§6.7). Changing it is a **migration/reinstall**, honestly (§7).
-
-### 5.4 How the appservice / homeserver read config
-
-- **Synapse (homeserver)** reads a _rendered_ `homeserver.yaml`. The config service **renders** Synapse's config (server_name, listeners, `federation_domain_whitelist`, `enable_registration: false`, appservice registration path, TLS/delegation) from the DB-backed config at deploy/reconfigure time. Synapse itself is not DB-config-aware; the source of truth is the product DB, and Synapse config is a **generated artifact**. Certain Synapse values (notably `server_name`) require a **Synapse restart** and are exactly the immutable ones — reinforcing §5.3.
-- **The appservice** reads config **live** from the DB config service for runtime-tunable values (thresholds, whitelist changes, cert alarm thresholds) and from the `SecretBackend` for secrets. Immutable topology values are read once at boot (they can't change under it).
-- **`packages/comms` SDK** receives the values it needs (homeserver client URL, presence intervals) from the appservice at enroll (RFC-001 §4.1 returns `{mxid, access_token, homeserver, rooms[]}`), so agents never read the config DB directly.
-- **Delegation artifacts** (`.well-known/matrix/server`, `.well-known/matrix/client`) are likewise **rendered** from config and served by the reverse proxy / homeserver.
-
----
-
-## 6. Installer UX flow
-
-A guided installer (`mosaic comms install` or equivalent) that captures topology, provisions certs, wires secrets, and **validates before declaring success.** It must never report success it hasn't proven. Steps:
-
-**6.1 — Preflight & detection.** Detect existing DNS records for a candidate domain, existing certs, an existing reachable Synapse, an existing Vault/Vaultwarden. Offer detected values as suggestions (never as silent defaults). Detect whether the host has public inbound :80/:443 (informs challenge-type guidance, §3.2).
-
-**6.2 — Primary instance (ALWAYS).** The PRIMARY/home instance is always configured — there is no "skip primary." Prompt for its identity. This is non-optional and is what makes standalone work out of the box.
-
-**6.3 — Pick topology mode (A/B/C).** Ask the shape:
-
-- Do you have a domain? **No →** Mode C (IP-only standalone); warn federation is impossible here (§2.4) and that `server_name` will be an IP (re-home cost if they later want federation).
-- Yes, and identity domain differs from the homeserver host? **Yes →** Mode A (split-domain); capture `server_name` + host + delegation method.
-- Yes, one domain does everything? **→** Mode B (single-domain).
-
-**6.4 — Pick CA (ACME directory).** step-ca vs Let's Encrypt → capture `directory_url`, account email, and challenge type with the §3.2 guidance surfaced (e.g. "private/internal domain? → DNS-01"). Capture EAB if the CA requires it (→ SecretBackend). For step-ca, offer to point at an existing step-ca or document standing one up.
-
-**6.5 — Pick secret backend.** Vault vs Vaultwarden → capture connection (address, org/namespace, bootstrap auth). If Vaultwarden, walk the org/collection setup (§4.4) and **surface the machine-account maturity [VERIFY]** honestly so the operator chooses eyes-open.
-
-**6.6 — Federation (OPTIONAL).** Only offered if Mode A/B. Ask whether to enable federation now; if yes, capture peer `server_name`s and build the `domain_whitelist`. If Mode C, federation is not offered (greyed out with the explanation). Federation-off is a first-class, fully-supported outcome.
-
-**6.7 — The "what can't be changed later" warning gate.** Before writing immutable config, present an explicit confirmation:
-
-```
-⚠  IMMUTABLE CHOICES — read before confirming
-   server_name = "mosaic.woltje.com"
-   This becomes part of every agent identity (e.g. @mosaic_coordinator-1:mosaic.woltje.com)
-   and every room alias. It CANNOT be changed later without re-homing every identity
-   (new MXIDs for all agents, recreating all rooms). There is no in-place rename in Matrix.
-   topology.mode = "split-domain"   — changing modes later is a reinstall.
-   secrets.backend = "vaultwarden"  — switching backends later requires a secret migration.
-   Type the server_name to confirm you understand it is permanent:  ____________
-```
-
-The operator must **retype `server_name`** to proceed — a deliberate friction gate on the one truly permanent value.
-
-**6.8 — Provision & validate (no success claim until proven).** The installer then:
-
-1. Renders Synapse config + delegation artifacts; brings up Synapse with `enable_registration: false`.
-2. Runs the ACME flow; obtains cert(s); verifies they're valid and installed.
-3. Authenticates to the SecretBackend; stores `hs_token`/`as_token`, enroll bootstrap; runs `health()`.
-4. **Reachability & cert validation** appropriate to mode:
-   - Mode A: fetch our own `.well-known`/SRV, confirm it points at host; TLS-probe host cert as a peer would; confirm C-S discovery.
-   - Mode B: TLS-probe the single domain; confirm C-S + (if federation) S2S.
-   - Mode C: confirm local C-S reachability over the bind IP; confirm (self-signed or private-CA) client TLS; **explicitly report "standalone — federation not available."**
-   - If federation enabled: validate each peer resolves + presents a peer-trusted cert; confirm `domain_whitelist` mutual consistency. If any peer fails, **federation is reported NOT-ready** — the primary still succeeds standalone.
-5. **Only now** declare success, with a per-capability report: `PRIMARY: ✅  |  CERT: ✅ (expires in 90d, auto-renew on)  |  SECRETS: ✅ (vaultwarden)  |  FEDERATION: ✅ 1 peer  /  ⚠ not-ready / ⛔ n-a (Mode C)`.
-
-**6.9 — Post-install.** Emit the cert-expiry monitor + federation-health probe (§3.4) into OTEL; write config to DB with correct mutability flags; print the immutable-values summary again for the record.
-
----
-
-## 7. Standalone → federated upgrade path
-
-An operator who started standalone later wants federation. The path depends on **whether they started with a domain**:
-
-**Case 1 — started Mode A or B (had a domain), federation was just off.** _Cheap, no re-home._ `server_name` is already a real domain and identities are already minted against it. To federate:
-
-1. Ensure DNS resolves for peers (their `server_name`s and yours) — likely already true.
-2. Ensure a **valid, peer-trusted cert** on the federation endpoint (if they were running client-only self-signed, they now need a real ACME cert; if already ACME, done).
-3. Set `federation.enabled = true`, populate `domain_whitelist` + `peers` (all runtime-tunable, §5.3).
-4. Re-run the installer's **federation validation** (§6.8 step 4) against each peer. On green, federation is live. **No identity change** — existing MXIDs simply become reachable cross-site. This is the intended, low-friction upgrade.
-
-**Case 2 — started Mode C (IP-only), now wants federation.** _Expensive — an identity re-home, and we say so plainly._ Federation requires DNS + a valid cert (§2.4), which an IP `server_name` can never satisfy. So the operator must:
-
-1. **Acquire a domain** and DNS, and provision a **valid ACME cert** (LE public, or step-ca if the domain is private — but note a _private_ domain can only federate with peers who trust that private CA root, §8).
-2. **Change `server_name` from the IP literal to the domain** — this is the **install-immutable value**, so this is a **re-home, not a config tweak**:
-   - Every agent identity `@mosaic_*:192.168.1.50:8448` becomes `@mosaic_*:newdomain` — **all new MXIDs.**
-   - Every room + alias must be **recreated** under the new `server_name`.
-   - Signed-authorship pubkey records re-published under the new identities.
-   - Any durable references to old MXIDs (escalation policies, fallback-coordinator targets, RFC-001 §5) must be re-pointed.
-3. Effectively: **treat it as a fresh install in Mode A/B with a data migration of rooms/history**, not an in-place flip. Matrix has **no in-place `server_name` rename**; this cost is intrinsic to Matrix, not to our design.
-
-**Honest guidance the installer gives Mode C operators up front (§6.3):** "If there is _any_ chance you'll want to federate later, start with a domain (Mode A/B) even if you keep federation off — flipping federation on later is free, but changing an IP `server_name` to a domain later is a full identity re-home." This lets an informed operator avoid the expensive path by choosing Mode B-with-federation-off instead of Mode C.
-
----
-
-## 8. Security
-
-**8.1 — Cert trust model per CA choice.**
-
-- **Let's Encrypt (public):** chains to a universally-trusted root (ISRG). Peers, humans' browsers, and Element trust it with no extra distribution. Best for public domains; nothing to distribute.
-- **step-ca (private):** chains to a **root you operate**. Nothing trusts it by default. Therefore the **step-ca root must be distributed** to everyone who validates certs: peer homeservers (so cross-site S2S validates — a peer must add your root to its federation trust store, **[VERIFY]** Synapse's mechanism for trusting a custom federation CA), agent hosts, and any human client. This is the price of "total control" and airgap capability. For **federation between two private-CA sites**, both sites must trust each other's roots (or a shared root). Getting this wrong reproduces the silent-defederation failure (§3.4) — a peer that doesn't trust your root silently refuses your S2S.
-- **Mode C self-signed client TLS:** weakest — see 8.4.
-
-**8.2 — Federation whitelist.** `federation_domain_whitelist` is a **hard allowlist** (RFC-001 §6/NG5): only listed Mosaic site domains may federate; no public-network federation. The installer/config validator keeps the whitelist consistent with the declared peer list. Adding a peer is an explicit, audited config change.
-
-**8.3 — Secret-backend auth.** The appservice/orchestrator authenticate to the `SecretBackend` via a **bootstrap credential injected at deploy** (Vault AppRole secret_id, or Vaultwarden org automation principal), never committed, consistent with existing Gateway/DB secret handling (RFC-001 §8). The `as_token`/`hs_token` live **only** in backend + appservice memory; agents get only their own scoped, re-mintable token (§4.2). Enroll is authenticated (RFC-001 B5) so a rogue local process can't enroll a rogue agent. Backend access is scoped: an agent's credential can read only its collection/policy, never the fleet-admin scope holding the crown jewels.
-
-**8.4 — Honest note: IP-only standalone with self-signed client TLS is a weaker-trust local mode.** In Mode C, client TLS may be self-signed (or a local private CA). This means: no third party vouches for the endpoint; clients must be told to trust the self-signed cert (TOFU or manual root import); there is no external validation of who's on the other end. This is **acceptable and supported for local/airgapped/homelab** use where the network is already trusted, but it is **explicitly a weaker trust posture** than a real CA. The installer states this plainly at install (§6.8 Mode C). It is one more reason Mode C cannot federate: we will not extend this weaker-trust local posture across sites (NG5).
-
-**8.5 — Homeserver hardening** (inherited from RFC-001 §8, config-rendered here): `enable_registration: false` always (agents come only via the appservice), rate-limiting on, admin API bound to localhost/behind auth, media repo locked/disabled if unused, TLS terminated at our controlled proxy. These are **rendered from config** (§5.4) so a stranger gets them by default, not by remembering to set them. **[VERIFY]** current recommended Synapse hardening flags at implementation.
-
----
-
-## 9. How RFC-002 integrates with RFC-001's P1–P5
-
-RFC-002 is the **substrate**. Each RFC-001 phase consumes a subset of it. Critically, **P1 does not need the hard parts** — presence ships on a single clean-domain instance with no federation, no IP-only, and no secret-rotation story resolved.
-
-| RFC-001 phase                                           | RFC-002 pieces it NEEDS                                                                                                                                                                                                                                                                                                                                             | RFC-002 pieces it does NOT need yet                                                                                                                                                                                                                                                    |
-| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **P1 — Presence (first shippable slice)**               | **Mode A or B, single-instance, clean domain** (§2.3). One ACME cert (LE or step-ca) via the single integration (§3). Config system minimal: `server_name` immutable + presence thresholds tunable (§5.3). Installer path 6.1–6.3, 6.4 (cert), 6.7 (immutable gate), 6.8 (validate single-instance). A **minimal** SecretBackend just holding the appservice token. | **No federation** (§2.4 gate irrelevant — single site). **No IP-only** needed for P1 (P1 wants a clean domain so Element/humans connect cleanly). **No agent-credential rotation** maturity. **No peer/whitelist** config. Vaultwarden machine-account [VERIFY] does **not** block P1. |
-| **P2 — Appservice + auto-enroll**                       | Full `SecretBackend` **`enrollAgent`/`revokeAgent`** (§4.1), `hs_token`/`as_token` custody (§4.2), enroll-bootstrap secret. Config: room taxonomy, per-agent token classification. Chosen backend (Vault or Vaultwarden) real.                                                                                                                                      | Federation, cross-site, IP-only.                                                                                                                                                                                                                                                       |
-| **P3 — MACP v1 spec**                                   | Config keys for MACP versioning/thresholds as runtime-tunable (§5.3); nothing new topology-wise.                                                                                                                                                                                                                                                                    | Federation, secret rotation-in-anger.                                                                                                                                                                                                                                                  |
-| **P4 — Federation**                                     | **The whole federation half of RFC-002:** Mode A delegation (§3.3), the hard DNS+cert gate (§2.4), `domain_whitelist`+peers config, cert monitoring/silent-defederation alarm (§3.4), per-CA trust distribution for cross-site (§8.1). This is where standalone→federated (§7 Case 1) and Jason's `mosaic.woltje.com`↔`mosaic.uscllc.com` shape land.               | IP-only (federation excludes it by construction).                                                                                                                                                                                                                                      |
-| **P5 — Hardening + signed-authorship + Hermes retired** | Secret **rotation runbooks** executed in anger (§4, RFC-001 E2), pubkey-record custody for Ed25519 (§4.2), cert-rotation runbook (§3.4), full homeserver hardening validated (§8.5), backend auth review (§8.3).                                                                                                                                                    | —                                                                                                                                                                                                                                                                                      |
-
-**One-line integration statement:** P1 rides on the _smallest_ slice of RFC-002 (single clean-domain instance + one cert + minimal config + minimal secret storage); the federation/IP-only/backend-maturity complexity is deferred to exactly the phases that need it (mostly P4/P5). RFC-002 therefore does not gate P1.
-
----
-
-## 10. Open questions
-
-Deliberately few — most topology/cert/secret decisions are resolved by Jason's rulings and baked in above.
-
-1. **[VERIFY] IP-only `server_name` acceptance.** Does the deployed Synapse version accept an `ip:port` `server_name` and mint usable MXIDs for standalone (§2.3)? If not, Mode C uses a fabricated local domain (`mosaic.local` via local resolver) — confirm which, since it affects the re-home wording for Mode C→A/B (§7).
-2. **[VERIFY] Vaultwarden machine-account maturity.** Confirm the current Vaultwarden version's Secrets Manager / machine-account coverage (§4.4). Determines whether the Vaultwarden adapter's `enrollAgent` uses native machine accounts or the personal-vault-per-agent + collection model. Does **not** block (interface absorbs either), but sets P2 expectations.
-3. **[VERIFY] step-ca root distribution for cross-site federation.** Confirm Synapse's supported mechanism for trusting a **custom federation CA root** (§8.1) so two private-CA sites can federate. If Synapse won't easily trust a private federation CA, private-domain federation may in practice require public certs (LE) on the federation SANs even when internal traffic uses step-ca.
-4. **Default secret backend for the published installer.** Given the open-source ethos (G6), should the installer _default-suggest_ Vaultwarden (free, self-hostable) while clearly offering Vault, or present them neutrally? Recommendation: suggest Vaultwarden as the zero-cost path with the maturity caveat surfaced, Vault as the "I need native short-TTL machine creds now" path. Jason to confirm the framing.
-5. **Single multi-SAN cert vs two certs in Mode A** (§3.3) — operational preference for identity-domain + host coverage. Minor; validate during P4.
-6. **Reconfigure-time Synapse restart policy.** Which rendered-config changes (§5.4) require a Synapse restart vs hot-reload on the deployed version, so the config service knows when a tunable change needs a bounce. **[VERIFY]** at implementation.
-
----
-
-## Appendix A — Real mechanics this RFC leans on (quick reference)
-
-- **`server_name`** — Synapse identity domain; the `:suffix` of every MXID/alias; install-immutable; changing it = re-home (no in-place rename). Distinct from where Synapse _listens_.
-- **Delegation** — `https://<server_name>/.well-known/matrix/server` → `{"m.server":"host:port"}` and/or `_matrix._tcp.<server_name>` **SRV**; how identity-domain ≠ host is reconciled (Mode A). **[VERIFY]** precedence on deployed Synapse.
-- **`.well-known/matrix/client`** — C-S discovery so agents/Element find the homeserver host from the identity domain.
-- **`federation_domain_whitelist`** — Synapse allowlist; only listed domains federate; our hard no-public-federation boundary.
-- **ACME** — single provisioning protocol for both CAs; operator supplies **directory URL** (step-ca vs Let's Encrypt) + **challenge type**.
-- **HTTP-01 / DNS-01 / TLS-ALPN-01** — challenge types; **DNS-01 is the one for private/split-horizon/wildcard**; HTTP-01 for public single host with :80; TLS-ALPN-01 for :443-only public.
-- **step-ca ACME provisioner** — Smallstep's self-hosted CA exposing an ACME directory; enables private/internal-domain certs and total control; may require **EAB**; root must be distributed to validators.
-- **Let's Encrypt** — public ACME CA; universally-trusted chain; 90-day certs; staging endpoint for testing.
-- **Bitwarden/Vaultwarden org + collection + machine/service-account** — org holds collections; collections scope access; machine/service accounts (Bitwarden **Secrets Manager**) are the clean automation primitive but **Vaultwarden coverage is partial/evolving [VERIFY]**; personal-vault-per-agent + org-collection works today.
-- **Vault KV v2 / AppRole / lease-TTL / revoke** — the capable backend; native versioning=rotate, TTL+revoke=transient per-agent creds.
-- **Silent defederation** — a lapsed/renewal-failed federation cert causes peers to stop trusting S2S with no local error; must be monitored + alarmed (§3.4).
-
-_All Matrix/ACME/secret-backend mechanics above are cited from architecture knowledge and MUST be re-verified against the actually deployed versions during implementation — every **[VERIFY]** is a checkpoint, not an assumption. Every illustrative domain (`mosaic.woltje.com`, `mosaic.uscllc.com`, `matrix.woltje.com`) is an operator-supplied example, never a product default or literal._

docs/scratchpads/804-install-unknown-flags.md

@@ -1,86 +0,0 @@
-# Issue #804 — fail closed on unknown installer arguments
-
-## Objective
-
-Implement Part 1 of Gitea issue #804 only: `tools/install.sh` must reject every unrecognized flag or argument with an actionable STDERR error and nonzero exit before installation starts.
-
-## Scope and constraints
-
-- Preserve all currently recognized options and behavior, including `-y` and `--ref <branch>`.
-- No positional arguments are currently accepted by the parser.
-- Do not add `--next`, `MOSAIC_NEXT`, prerelease routing, or any Part 2 behavior.
-- TDD is mandatory: add and observe a failing process-level regression test before changing `tools/install.sh`.
-- Worker lifecycle ends after branch push, PR creation, and coordinator notification; do not merge or close #804.
-- Existing launcher-owned changes in `.mosaic/orchestrator/mission.json` and `.mosaic/orchestrator/session.lock` are out of scope and must not be committed.
-
-## Requirements and acceptance criteria
-
-- Unknown input names the offending argument on STDERR.
-- STDERR includes a short installer usage hint.
-- Exit status is nonzero.
-- The installer does not invoke npm or otherwise proceed into installation.
-- Existing recognized flags remain unchanged.
-
-## Plan
-
-1. Add a process-level Vitest regression using the installer test location under `packages/mosaic/src/commands/`.
-2. Run the focused test and record the expected RED failure.
-3. Commit the RED test as `test(#804): ...`.
-4. Replace the parser catch-all with a fail-closed STDERR error and usage hint.
-5. Update concise installer-facing documentation without introducing prerelease behavior.
-6. Run focused tests, shell syntax validation, package tests, lint, typecheck, and format checks.
-7. Run independent review tooling and remediate findings.
-8. Commit as `fix(#804): ...`, queue-guard, push, open a PR containing `Closes #804.`, notify the coordinator, and exit.
-
-## Budget
-
-- No explicit token cap supplied.
-- Working estimate: 8K tokens; narrow two-file behavior/test change plus concise docs and delivery gates.
-
-## Progress
-
-- 2026-07-17: Loaded mission state, issue #804, delivery/QA/documentation rails, and relevant TDD/Vitest/pnpm/Gitea skills.
-- 2026-07-17: Confirmed the parser has no legitimate positional arguments and currently drops all unmatched input via `*) shift ;;`.
-- 2026-07-17: Installed locked workspace dependencies with a worktree-local pnpm store; no lockfile changes.
-- 2026-07-17: Added the process-level unknown-argument regression with an isolated `$HOME` and npm shim.
-- 2026-07-17: Replaced the silent catch-all with STDERR error + usage output and exit 2 before preflight or installation.
-- 2026-07-17: Initial Codex code review found an unknown option could still be consumed as the `--ref` value. Added a second RED reproducer, then rejected option-shaped/missing `--ref` values without changing valid `--ref <branch>` behavior. The review's launcher-state note is handled by excluding both `.mosaic/orchestrator/` files from commits.
-- 2026-07-17: Updated README, user guide, and packaged framework README with the fail-closed argument contract. No API, auth, admin, sitemap/navigation, or publishing surface changed.
-
-## Verification
-
-- RED: `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/install-arguments.spec.ts` — expected failure: installer exited `0` instead of nonzero at the exit-status assertion; confirms the test reproduces the silent-drop defect before production changes.
-- Remediation RED: the added `--cli --ref --bogus` case exited `0`, proving `--ref` could swallow an unknown option before the guard was added.
-- GREEN: `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/install-arguments.spec.ts src/commands/install-heading.spec.ts` — 2 files, 3 tests passed.
-- Situational process check: unknown positional input exited 2, named the input on STDERR, printed usage, and did not call the npm shim.
-- `bash -n tools/install.sh` — passed.
-- Bare `--ref` process check — exited 2 with `Missing value for --ref` and usage.
-- `pnpm --filter @mosaicstack/mosaic test` — 69 files, 1,287 tests passed; framework shell checks passed. The first attempt lacked generated `dist/cli.js`; `pnpm --filter @mosaicstack/mosaic build` restored the required test precondition and the full rerun passed.
-- `pnpm lint` — 23/23 tasks passed.
-- `pnpm typecheck` — 42/42 tasks passed.
-- `pnpm format:check` — passed.
-- Codex code re-review against `origin/main` — `approve`, 0 blockers/should-fix/suggestions.
-- Codex security re-review against `origin/main` — risk `none`, 0 findings.
-
-## Acceptance evidence
-
-| Criterion | Evidence |
-| --- | --- |
-| Unknown input is named on STDERR | Process-level Vitest assertions for `--bogus`, including after `--ref` |
-| Short usage hint is printed on STDERR | Vitest usage regex + manual process output |
-| Exit is nonzero | Vitest status assertions and manual exit 2 |
-| Installation does not proceed | Isolated npm shim marker remains absent |
-| Recognized behavior is preserved | Parser cases are unchanged except validation of malformed `--ref`; full Mosaic package suite passed |
-| Part 2 is excluded | No `--next`, `MOSAIC_NEXT`, dist-tag, or prerelease routing changes |
-
-## Documentation checklist
-
-- Current canonical `docs/PRD.md` remains unchanged; issue #804 and the coordinator brief supply this bounded defect's acceptance contract.
-- Updated installer behavior in root README, user guide, and packaged framework README in the same logical change set.
-- API/OpenAPI, auth/permissions, admin operations, developer architecture, sitemap/navigation, and external publishing are not affected.
-- Scratchpad remains under `docs/scratchpads/`; no root-hygiene changes.
-
-## Risks and blockers
-
-- Part 2 remains owner-gated under #805 and is intentionally excluded.
-- No implementation blocker remains. Independent coordinator RoR, CI, merge, and issue closure remain pending after worker handoff.

docs/scratchpads/812-pr-review-comment.md

@@ -1,58 +0,0 @@
-# Issue #812 — durable Gitea PR review comments
-
-- **Lane:** ms-812
-- **Branch:** `fix/812-pr-review-comment`
-- **Issue:** mosaicstack/stack#812
-- **Budget:** 15K working estimate; single focused shell-wrapper/test/docs change.
-
-## Objective
-
-Make the Gitea `comment` action in `packages/mosaic/framework/tools/git/pr-review.sh` use the supported Gitea comments REST API and report success only after provider read-back verifies the created comment against the intended repository, PR, and exact body.
-
-## Plan
-
-1. Add and commit a failing shell regression harness before production changes.
-2. Verify RED against the nonexistent `tea pr comment` fallback false-positive.
-3. Implement the minimal supported write plus ID-based provider read-back.
-4. Document that wrapper write output is not durable provenance until read-back succeeds.
-5. Run focused regression tests, touched-package tests, and repository quality gates.
-6. Remediate review findings, queue-guard, and push for coordinator-owned independent review. Do not open or merge a PR.
-
-## Progress checkpoints
-
-- [x] RED regression committed and reported to mosaic-100 (rebased commit `770e3f57`)
-- [x] Initial minimal fix implemented (rebased commit `ea7f8c57`)
-- [x] Rebased cleanly onto main `627cf2bb387f7c84a532d88819903a7679ce0d72`
-- [x] Codex blocker remediated by replacing unsupported `tea api` with authenticated REST write/read-back
-- [x] Focused, package, and repository gates green
-- [ ] Coordinator-owned independent review pending after push
-- [x] No PR opened; no self-review or self-merge
-
-## Tests run
-
-- RED after rebase: the regression harness failed against `origin/main` with status 1 after reproducing the old `tea pr comment` zero-exit fallback and false success echo.
-- GREEN at resumed head: the same harness passed with REST POST 201 plus GET 200 read-back.
-- All `packages/mosaic/framework/tools/git/test-*.sh` harnesses passed.
-- `shellcheck -x` passed for the changed scripts; `bash -n` passed.
-- Manifest resolver returned `framework` for `tools/git/test-pr-review-gitea-comment.sh`.
-- `pnpm test` passed (43/43 Turbo tasks; Mosaic 75 files/1434 tests; Gateway 56 files/628 tests plus documented skips).
-- `pnpm typecheck` passed (42/42 tasks), `pnpm lint` passed (23/23), and `pnpm format:check` passed.
-- Firewall checks found no user-home paths or operator identities in changed shipped files; no token value is logged or echoed.
-
-## Risks / blockers
-
-- No active implementation blocker. #789 reached terminal merged state and the coordination hold was lifted.
-- Review round 1 found one portability blocker: the API base reconstructed `https://$host` and discarded configured schemes/path prefixes.
-- Review round 2 found a second subpath portability blocker: clone-derived `get_repo_slug` retained the deployment prefix, duplicating it under `/api/v1/repos/`.
-- Round 3 resolves owner/repo relative to the configured Gitea base path for HTTP(S) clones while preserving root-mounted and SSH clone forms. Host matching now compares non-default ports consistently.
-- REST transport failures, non-201 writes, malformed/missing created IDs, non-200 read-backs, and read-back mismatches all fail closed.
-- Existing approve/request-changes behavior remains covered.
-- Independent exact-head re-review remains coordinator-owned.
-
-## Final verification evidence
-
-- URL-portability regression was RED before remediation at the new `http://git.mosaicstack.dev` case and GREEN afterward.
-- Round-3 genuine subpath regression was RED against round-2 head `1b190201` and GREEN after the fix: `https://git.example/gitea/owner/repo.git` maps to API repository `owner/repo` under configured base `/gitea`.
-- Regression coverage verifies POST and read-back GET for root-mounted HTTP(S), path-prefixed HTTP(S), non-default HTTP port, scp-style SSH, and `ssh://` clone forms.
-- Focused shell checks, all git-wrapper harnesses, and full repository test/typecheck/lint/format gates passed after remediation.
-- Branch will be force-pushed with lease for coordinator re-verification; no PR opened.

docs/scratchpads/824-mosaic-skill-cli.md

@@ -1,112 +0,0 @@
-# Issue #824 — Mosaic skill CLI and Claude bridge auto-sync
-
-## Objective
-
-Deliver `mosaic skill register|unregister|list` plus install/upgrade reconciliation of every canonical `~/.config/mosaic/skills/*` entry into `~/.claude/skills/`, without clobbering runtime-owned files or directories.
-
-## Scope and constraints
-
-- Issue: mosaicstack/stack#824
-- Branch: `feat/824-mosaic-skill-cli`
-- M1 runtime: Claude Code only.
-- Pi/Codex parity is documentation-only; no non-Claude bridge implementation.
-- Do not author the downstream `mosaic-context-refresh` skill.
-- Workers do not modify `docs/TASKS.md`, merge, close #824, or touch `main`.
-- TDD is mandatory and red-first; filesystem tests use temporary directories only.
-- Budget: no explicit token cap supplied; use a focused single-worker implementation with no new dependencies.
-
-## Requirements mapping
-
-1. Register creates the canonical Claude symlink and is idempotent.
-2. Names are untrusted: reject empty/escaping/absolute/separator/`..`/leading-dash names before filesystem mutation, with clear CLI stderr and nonzero status.
-3. Register repairs only Mosaic-owned dangling symlinks and refuses foreign files, directories, and symlinks.
-4. Unregister removes only symlinks pointing inside the canonical Mosaic skills root and is idempotent when absent.
-5. List reports registered, dangling, foreign, and canonical-but-unregistered skills.
-6. Install and upgrade generically reconcile all canonical skills after framework sync/re-seed, continuing past foreign conflicts without clobbering them.
-7. User/developer documentation describes commands, status meanings, security boundaries, and Claude-only M1 scope.
-
-## Plan
-
-1. Add co-located failing Vitest coverage for all filesystem behaviors and auto-sync.
-2. Run the focused spec and record the expected RED failure.
-3. Commit the red contract as `test(#824): ...`.
-4. Implement the skill bridge and Commander command registration.
-5. Wire reconciliation into wizard finalize and `mosaic update` re-seed, preserving non-clobber behavior.
-6. Update canonical docs and sitemap if navigation changes.
-7. Run focused tests, package tests, typecheck, lint, and formatting.
-8. Commit implementation/docs as `feat(#824): ...`, queue-guard, push, open PR with `Closes #824.`, fire completion event, and notify the coordinator.
-
-## Progress
-
-- 2026-07-17: Loaded mission/delivery/TDD/documentation rails, issue #824, active mission state, and relevant installer/update paths.
-- 2026-07-17: Confirmed `mosaic update` invokes `framework/install.sh` with `MOSAIC_SYNC_ONLY=1`; that path exits before existing post-install skill linking, leaving newly present canonical skills unregistered.
-- 2026-07-17: Coordinator addendum classified the user-supplied skill name and runtime symlink target as a path-traversal/symlink-injection surface. Expanded the initial red contract to reject traversal before mutation, preserve every foreign entry, and unregister Mosaic-owned links only.
-- 2026-07-17: Implemented the Commander command group and secure generic bridge; wired wizard finalize and successful framework re-seed reconciliation; updated user/developer/installed/root docs and sitemap.
-- 2026-07-17: Focused, package-wide, repository baseline, temp-home situational, and independent review gates completed. Ready for scoped feature commit, queue guard, push, and PR handoff.
-
-## Tests and evidence
-
-### TDD evidence
-
-- RED environment attempt: `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/skill.spec.ts` initially could not locate Vitest because this fresh worktree had no dependencies.
-- Dependency setup: `pnpm install --frozen-lockfile --store-dir /home/hermes/.local/share/pnpm/store` succeeded. The explicit store was required because machine pnpm config incorrectly resolves the default store under `/root`.
-- RED behavior: focused Vitest failed with `Failed to load url ./skill.js ... Does the file exist?`, proving the bridge API was absent.
-- RED integration: finalize/update specs failed because no Claude links or `skillSync` result existed.
-- RED symlink injection: symlinked Claude/canonical root tests failed because the initial implementation followed ancestor links.
-- GREEN after review remediation: `skill.spec.ts` 36/36, `finalize-skills.spec.ts` 6/6, and `update-checker.reseed.spec.ts` 30/30.
-
-### Baseline gates
-
-- `pnpm --filter '@mosaicstack/mosaic...' run build` — pass (fresh-worktree dependency outputs built).
-- `pnpm --filter @mosaicstack/mosaic run typecheck` — pass.
-- `pnpm --filter @mosaicstack/mosaic run lint` — pass.
-- `pnpm --filter @mosaicstack/mosaic test` — pass: 69 files, 1,325 Vitest tests plus framework shell suite.
-- `pnpm typecheck` — pass: 42/42 Turbo tasks.
-- `pnpm lint` — pass: 23/23 Turbo tasks.
-- `pnpm format:check` — pass.
-
-### Situational evidence
-
-A built-CLI temp-home smoke test (no real `~/.claude` or Mosaic config touched) proved:
-
-- register creates the exact link and a second run reports `already registered`;
-- list reports registered and unregistered canonical skills;
-- `../../etc` exits 1 with `Invalid skill name` and creates no escaped path;
-- unregister removes the managed link and a second run reports `already unregistered`;
-- a fake successful framework re-seed generically registered both `added-after-setup` and `second-skill` from runtime directory enumeration.
-
-### Review evidence
-
-- Initial uncommitted Codex code/security review described name validation/clobber protection as strong; its only finding was the harness-owned, unrelated `.mosaic/orchestrator/session.lock`, which is excluded from all commits and the PR.
-- Exact branch review then identified two remediations: preserve successful framework re-seed status when bridge-wide reconciliation fails, and reject/escape control-character names to prevent terminal/log injection.
-- Both findings were reproduced red-first and remediated. A subsequent exact review identified one finalize failure-isolation blocker; a root-wide bridge error now warns and allows wizard doctor/summary/next-steps completion, with a red-first regression.
-- All remediations passed the full package and repository gates. Final exact-head review is rerun after amending the feature commit.
-
-### Acceptance mapping
-
-| Acceptance criterion | Evidence |
-| --- | --- |
-| register/unregister/list, idempotent | `skill.spec.ts` and built-CLI temp-home smoke |
-| traversal/symlink-injection protection | invalid-name matrix, foreign file/dir/link tests, symlinked-root tests |
-| list flags dangling and foreign entries | deterministic list status test |
-| install and upgrade auto-sync every canonical directory | finalize + framework re-seed integration specs; two-skill built-module smoke |
-| newly added skill becomes discoverable without manual link | `added-after-setup` auto-sync creates exact Claude link; Claude can rescan with `/reload-skills` or a new session |
-| Pi/Codex parity captured as scope note | user guide, developer guide, installed framework README |
-| documentation gate | root README, user guide, developer guide, framework README, sitemap |
-
-## Risks
-
-- Symlink replacement uses `lstat` semantics so dangling links are detectable without following them.
-- Link ownership is determined lexically against the canonical skills root, and existing symlink ancestors in either managed root are rejected before mutation.
-- Auto-sync continues across per-skill conflicts while never deleting real files/directories or foreign symlinks.
-- Claude Code discovers filesystem skills at session launch/reload boundaries; bridge creation makes a later `/reload-skills` or new session able to discover the skill, but cannot mutate an already-cached in-process registry by itself.
-- Pi does not need this Claude bridge because its Mosaic launcher can consume the canonical root. Codex lifecycle parity remains explicitly deferred.
-- No deployment surface is affected.
-
-## PR #826 review remediation
-
-- 2026-07-17: Exact-head RoR requested changes for two ownership bugs: installer pruning deleted foreign-name links under `MOSAIC_HOME` outside canonical skills, and unregister deleted a same-root link targeting a different skill. It also requested trailing-dot rejection and executable coverage support.
-- RED evidence: focused regression run failed 4 tests: register/unregister accepted `safe.`, misdirected unregister did not throw, and the install linker deleted the foreign-name link.
-- GREEN evidence: `skill.spec.ts` passes 43/43, including live and dangling foreign-name links in a temp HOME/MOSAIC_HOME and the misdirected unregister invariant.
-- Coverage: `vitest run src/commands/skill.spec.ts --coverage` passes configured 85% thresholds for `skill.ts`: 91.05% statements/lines, 86.27% branches, 95.23% functions.
-- Full gates: package build passed; package tests passed 69 files / 1,332 tests plus framework shell suite; repository typecheck 42/42, lint 23/23, and format check passed.

docs/scratchpads/828-lease-broker.md

@@ -1,86 +0,0 @@
-# WI-1 Scratchpad — Authenticated external lease broker
-
-- **Issue:** Gitea #828
-- **Milestone:** 188 — Compaction-Refresh Mechanism (M1: Claude + Pi)
-- **Branch:** `feat/828-lease-broker`
-- **Starting HEAD:** `d801d6c4c8a984d6a95033c49714210018d3d9a8`
-- **Session role:** Orchestrator coordinating implementation; Mos retains merge authority.
-
-## Objective
-
-Implement the ratified WI-1 product lease broker under `packages/mosaic/`: Linux `SO_PEERCRED` identity, broker-minted logical session IDs, `(pid,starttime)` launcher anchors with per-hop `/proc` starttime revalidation, sibling-substitution rejection, same-PID runtime-generation revocation, crypto-RNG single-use token persistence, and protected Unix-socket posture.
-
-## Authority verification
-
-Verified before code on session start; all exact SHA-256 values matched:
-
-- BUILD-BRIEF: `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b`
-- SPEC-v5: `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433`
-- Ratification: `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67`
-- P6 planner ruling: `b7bbb6ea6e8d9a5c3366993642ab4e4f65b961af04936dcac20bfbcdcbaf1a09`
-- WI-0 Gate0 evidence: `5d418306fcc597fd514e500bee40d1509f0bf467e46ee13fc5c280ed8274759d`
-
-## Locked constraints
-
-- Build against the ratified design; do not re-derive it.
-- Product code only in `packages/mosaic`; Gate0 Python probes are reference prototypes and are not shipped.
-- Caller-supplied/asserted `session_id` is refused.
-- Tokens use the operating-system CSPRNG via Python `secrets`; never `Math.random` or model output.
-- Socket parent directory mode `0700`, socket mode `0600` minimum; document distinct-principal deployment as the stronger T-C-closing posture.
-- Red-first TDD for six named cases; new-code coverage >=85%.
-- No merge. PR must say `closes #828`; exact 40-character head handed to Mos for Opus-SECREV and independent review.
-
-## Plan
-
-1. Load security/testing/docs guidance and inspect existing `packages/mosaic` architecture.
-2. Write the six required tests first and capture RED evidence.
-3. Implement minimal broker modules and CLI/runtime integration necessary for product use.
-4. Run focused tests with coverage, package gates, then full repository gates/suite.
-5. Run author-side review/remediation, commit `closes #828`, queue guard, push, and open PR through Mosaic wrappers.
-6. Send PR number + exact head SHA to `web1:mosaic-100`; stop without merging.
-
-## Risks / boundaries
-
-- Same-UID counterfeit socket replacement remains the disclosed T-C residual unless broker runs under a distinct principal; filesystem modes alone are minimum hardening, not a complete authenticity proof.
-- `.mosaic/orchestrator/mission.json` and `.mosaic/orchestrator/session.lock` were already modified at session start and must not be included in this PR.
-- Repository Woodpecker pipelines exist; CI is the canonical build path. No manual image build/deploy is in scope.
-
-## Progress / evidence
-
-- 2026-07-18 session start: mandatory mission files and orchestration guides loaded.
-- STEP 0: all four authority hashes matched; artifacts read in full.
-- Branch/HEAD confirmed; issue #828 open; Gate0 evidence hash confirmed.
-- Initial RED: focused Vitest acceptance suite failed 11/11 because the product daemon did not exist; the expected missing-product failure was observed before implementation.
-- Review-remediation RED: partial/zero-progress state writes, nested corrupt state, symlink state, canonical starttime, and duplicate-anchor generation behavior failed before their fixes. Real socket RED/GREEN runs were executed by the unrestricted parent harness because the delegated worker sandbox denies `AF_UNIX.bind()`.
-- Product implementation added at `packages/mosaic/framework/tools/lease-broker/daemon.py`; Gate0 probe scripts were read as references but not copied or shipped.
-- Independent Codex code review round 1 found 2 blockers + 1 should-fix (connection stall/crash, partial writes, packet-dependent framing); all were remediated with tests.
-- Independent Codex code review round 2 found 2 blockers + 1 relevant should-fix (half-close contract ambiguity, incomplete persisted-state validation, symlink/non-regular state); all were remediated with tests and documentation. Pre-existing `.mosaic/*` session dirt remains excluded from the PR.
-- Unrestricted focused situational suite: `35/35` GREEN.
-- New Python product module coverage: `90%` (`356` statements, `36` missed), above the user-required 85%.
-- Root typecheck: `42/42` Turbo tasks GREEN.
-- Root lint: `23/23` Turbo tasks GREEN.
-- Root format check: GREEN.
-- Package build + suite: `71/71` files and `1,369/1,369` tests GREEN, including framework shell tests.
-- Full root suite: `43/43` Turbo tasks GREEN after the oversized-frame production race fix.
-- Focused acceptance suite: `35/35` GREEN in three consecutive unrestricted runs; exact-head instrumented run also `35/35` GREEN.
-- Exact-head Python product coverage: `90%` (`365` statements, `37` missed), above the required 85%.
-- Review-triggered oversized-frame race was fixed in production by bounded drain-to-EOF; tests were not changed.
-- Commits banked in red/green cadence: `d61c5441` (RED contract), `deb11df7` (GREEN implementation/docs), `57770e34` (oversized-frame production fix).
-- Final-review blocker remediated: added a 256-token pending-state cap, deletion on consume/generation revocation, pre-open serialized-size enforcement, and request-wide in-memory rollback for every broker mutation/commit failure while retaining the v1 live-token schema.
-- Distinct-principal docs now state built-in `0700`/`0600` is same-principal only; WI-1 does not provide the external identity-preserving proxy/ACL/service boundary needed for the stronger deployment.
-- Exact Python unit suite: `8/8` GREEN. Unrestricted focused acceptance: `35/35` GREEN.
-- Exact-head package build/suite: `71/71` files and `1,369/1,369` tests GREEN.
-- Exact-head Python product coverage: `90%` (`376` statements, `36` missed), above required 85%.
-- Root typecheck: `42/42` GREEN. Root lint: `23/23` GREEN. Root format check and `git diff --check`: GREEN.
-- Final exact-head rereview found two persistence blockers: post-rename directory-fsync uncertainty and acceptance of impossible persisted token records. RED was captured as three invariant failures plus one missing fail-stop error; commits `a94b1220` (RED) and `d05465e5` (GREEN) remediate both without weakening tests.
-- Post-remediation evidence: Python unit suite `10/10`, focused real-socket acceptance `35/35`, full root suite `43/43` Turbo tasks, broker coverage `90%` (`395` statements, `38` missed), lint `23/23`, typecheck `42/42`, format check and `git diff --check` GREEN.
-- Independent Codex review of remediation commit `d05465e54736c4966294c4af8fbd6a4ad8fe81aa`: APPROVE, confidence `0.94`, zero findings. Reviewer sandbox could not allocate temp directories; unrestricted parent test evidence above is canonical.
-
-- Remediation session: terra review comment `18072` reproduced a SERIAL-ACCEPT DoS; scope is RED regressions plus bounded concurrent connection handling on PR #836, preserving all existing broker security properties.
-- RED evidence against reviewed daemon: four silent peers delayed registration `3920 ms` beyond the `1500 ms` bound; 16 silent peers were not reaped within `2500 ms`. The first bounded implementation then exposed slot exhaustion by rejecting the valid queued caller with `EPIPE`; admission was corrected to wait for a reclaimed bounded slot. GREEN evidence: queued-peer test `211 ms`; strengthened cap/reap/reclaim test `1118 ms`; complete real-socket acceptance `37/37` and Python persistence suite `10/10`.
-
-## Coordinator handoff requirements
-
-1. Mandatory Opus-SECREV on the exact PR head; no GPT/terra substitute.
-2. Independent exact-head code review and exact-head RoR before Mos-authorized merge.
-3. Mos retains merge authority; this WI author stops after PR + full 40-character head handoff.

docs/scratchpads/829-mutator-gate.md

@@ -1,130 +0,0 @@
-# WI-2 Scratchpad — Whole mutator-class gate
-
-- **Issue:** Gitea #829
-- **Branch:** `feat/829-mutator-gate`
-- **Base HEAD:** `8ec67a1126adb0dcd4c3a2bf5525f3e239c0b201`
-- **Role:** sol author/build lane only; terra code review and Opus security review are coordinator-owned.
-
-## Mission prompt
-
-Implement BUILD-BRIEF Deliverable 2 as a framework-native whole mutator-class gate under `packages/mosaic/`, building against the merged WI-1 lease broker. No consequential mutator may succeed while UNVERIFIED after a compaction observer fires or after TTL. Carry the T-B compromised-tool acceptance criteria. Enforce revoke-first and promote-last structurally. A receipt is only a promotion prerequisite; the mutator-class gate remains the safety mechanism. M1 is Claude + Pi only.
-
-## Authority verification
-
-Verified exact SHA-256 before design/code:
-
-- BUILD-BRIEF: `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b`
-- SPEC-v5: `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433`
-- Ratification: `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67`
-- sol final red-team: `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa`
-
-Carried authority chain also verified/read for the locked T-B gate contract: SPEC-v4 `a5e9c261…`, v4 sol `1e76ee59…`, SPEC-v3 `e0830ba0…`, v3 sol `9f321ade…`.
-
-## Plan
-
-1. RED real-socket acceptance tests for default-deny whole classes, T-B raw-tool bypass, observer/TTL revocation, and structural revoke-first/promote-last.
-2. Extend the merged WI-1 broker as the sole lease authority; authenticate every transition through existing peercred/ancestry/session logic and consume WI-1 single-use cycle tokens atomically before promotion.
-3. Add one broker-backed runtime gate executable and wire it across all Claude `PreToolUse` tools and Pi `tool_call`; unknown/custom tools deny by default.
-4. Add proportional protocol/security/operations documentation and requirements-to-evidence mapping.
-5. Run focused coverage, package/full suites, lint/typecheck/format, then queue-guard, push, open an unmerged PR with `closes #829`, and hand off the exact head.
-
-## Risks and bounds
-
-- Receipt parsing/builders and compaction observers are later WIs; WI-2 exposes the promotion prerequisite boundary but does not treat a receipt as safety authority.
-- Broker restart intentionally loses volatile VERIFIED leases and therefore restarts UNVERIFIED; persistent WI-1 identity/token state remains unchanged.
-- The gate is whole-class and does not parse shell command strings. T-C extension/hook absence and same-UID broker replacement remain outside the client guarantee and server branch protection remains the backstop.
-- Initial lease TTL is capped at ratified 300 seconds; callers may only shorten it.
-- Working budget assumption: 35K tokens; reduce documentation/refactor breadth before touching locked scope if pressure rises.
-
-## Progress and verification
-
-- RED #1: all 5 initial real-socket contract tests failed on WI-1 with `UNKNOWN_ACTION` or missing adapter behavior.
-- RED #2: register-before-exec runtime test failed because `launch-runtime.py` did not exist.
-- GREEN: broker-owned volatile lease state, 300-second maximum monotonic TTL, WI-1 token-backed promotion, all-tools runtime gate, Claude/Pi wiring, and register-before-exec launcher delivered without changing WI-1 peercred/ancestry authority.
-- Focused broker + gate acceptance: `43/43` GREEN.
-- Instrumented Python coverage: `88%` total — daemon `89%`, register/exec launcher `86%`, runtime gate `86%`.
-- Full repository suite: `43/43` Turbo tasks GREEN; `@mosaicstack/mosaic` `72/72` files and `1,377/1,377` tests GREEN.
-- Root typecheck: `42/42`; lint: `23/23`; format check and `git diff --check`: GREEN.
-- No author self-review was run. Exact-head terra CODE and Opus SECREV remain coordinator-owned gates.
-
-## Acceptance mapping
-
-| Acceptance criterion | Evidence |
-| --- | --- |
-| No consequential mutator succeeds while UNVERIFIED after observer revoke or TTL | `observer revocation and monotonic TTL expiry deny the next mutator` real-socket acceptance test |
-| T-B compromised-tool bypass is covered by the whole gate | `T-B raw and custom mutator tools are default-denied without shell parsing` across Claude/Pi built-ins, raw Bash class, MCP/custom/unknown tools |
-| Revoke-first / promote-last is structural | `revoke-first and promote-last structurally bracket mutator authority`; direct promotion rejected, pending remains denied, token consumption commits before VERIFIED |
-| Consume WI-1 auth/lease substrate | All transitions and decisions traverse merged peercred/ancestry authentication; promotion consumes the exact WI-1 CSPRNG cycle token |
-| M1 Claude + Pi | Claude `.*` PreToolUse and Pi `tool_call` invoke the same broker gate; register-before-exec test proves broker-minted parent identity reaches runtime descendants |
-
-## Locked discipline
-
-- Re-verify and read the four authority artifacts before design or code.
-- RED-first tests must cover unverified mutation refusal, T-B compromised-tool refusal, and revoke-first/promote-last ordering.
-- Consume WI-1 VERIFIED-lease state; do not re-derive kernel identity, ancestry, sessions, or token authentication.
-- Minimum 85% new-code coverage; full suite, lint, typecheck, and format checks green.
-- Build only: no self-review and no merge. Open a PR containing `closes #829`, report its exact 40-character head, then exit.
-
-## Remediation — terra CODE comment 18091
-
-- Coordinator correction: terra returned REQUEST CHANGES at head `77b137ccc04b5be035cac5ca21bbbf3df8b94f97`; Opus SECREV was GO and CI green, but no evidence transfers to the remediated head.
-- BLOCKER 1 verified: first-class Claude/Pi route through `execLeaseGatedRuntime`, while the supported Claudex path preserves isolation but directly invokes `claude`; it therefore registers no anchor, injects no lease session, and the isolated config has no guaranteed all-tools gate hook.
-- BLOCKER 2 accepted: prior 88% was aggregate evidence. Remediation must produce independently measured branch coverage of at least 85% for each new executable (`launch-runtime.py`, `mutator-gate.py`, and daemon delta evidence), including successful exec-boundary collection and validation/error branches.
-- Remediation discipline: RED tests first; preserve the reviewed-good broker lock/state-transition ordering; update PR #837 on the same branch; no self-review or merge.
-
-### Remediation evidence
-
-- RED commit `046896c6`: both `mosaic claudex` and `mosaic yolo claudex` behavioral probes exited 1 because the direct path supplied neither a broker session nor the isolated all-tools hook; branch-focused Python tests failed on the absent injectable boundaries. Fresh WI-2 daemon-delta instrumentation also failed the ≥85% branch gate at 75%.
-- GREEN: Claudex now exposes only `execLeaseGated`, passes the preserved isolated proxy environment through the shared register-before-exec wrapper, and merges the exact `.*` mutator hook into isolated `settings.json` with mode `0600`. Missing broker/identity, malformed or symlinked settings, and an unverified consequential tool all fail closed. The broker transition/lock implementation was not changed.
-- Behavioral regression: normal and YOLO Claudex both receive a 64-hex broker session, retain their mode-specific arguments, observe the exact all-tools hook, and receive status 2 for unverified `Bash`.
-- Independent branch coverage: `launch-runtime.py` 16/18 = **89%** (statements 98%); `mutator-gate.py` 21/22 = **95%** (statements 99%); `daemon.py` WI-2 delta 35/40 = **88%** (whole-file branch 80%, statements 90%).
-- Fresh focused real-socket coverage run: WI-1 + WI-2 acceptance `46/46`; persistence `10/10`; branch unit suite `10/10`.
-- Fresh full repository suite: `43/43` Turbo tasks; `@mosaicstack/mosaic` `72/72` files and `1,381/1,381` tests.
-- Fresh root gates: typecheck `42/42`; lint `23/23`; format and `git diff --check` GREEN.
-- PR #837 remains open and unmerged. Terra CODE and Opus SECREV must both rerun from zero on the exact remediated head before coordinator-owned merge authorization.
-
-## Remediation round 3 — terra CODE comment 18099 + binding upgrade
-
-- Locked-good surfaces: Claudex gating and B2 per-executable coverage are verified; do not regress them. Broker state-transition/lock ordering remains untouched.
-- Mechanical repository sweep found direct executing Claude entries in PRDY init, PRDY update, QA remediation, and `@mosaicstack/coord` task launch. It also found a direct Claude command rendered into the QA report template and documentation examples. Existing Mosaic CLI Claude/Pi/Claudex, orchestrator session-run, and fleet starts already reach the gated boundary.
-- Elevated hard requirements: ship a permanent suite/CI guard that scans production source and fails on any direct Claude/Pi launch; route every executing entry through one common gated wrapper; add real-broker RED/GREEN tests for PRDY init/update and QA; preserve each environment and denial behavior; independently measure all new executable coverage at ≥85%.
-- Round-3 plan: first commit RED behavioral and scanner-contract tests; then add one framework `launch-runtime.sh` choke-point over `launch-runtime.py`, make Mosaic CLI and shell launchers use it, make coord route through `mosaic`, and wire the permanent guard into package tests. Update all discovered operator-facing direct-launch examples so the scanner inventory remains complete.
-
-### Round-3 outcome
-
-- RED commit `7f3418fa`: PRDY init, PRDY update, and QA remediation all reached the fake Claude binary without a broker session even when the configured socket did not exist; the permanent-guard contract initially failed because its executable was absent, then failed against the five discovered direct entries (four executing plus the QA command template).
-- Choke-point decision: a new shell layer was unnecessary. Every executing repository entry now converges directly or through `mosaic`/`execLeaseGatedRuntime` on the existing single `launch-runtime.py` register-then-exec wrapper. PRDY and QA preserve their working directories, prompts, flags, logging pipe, and environment. Coord rewrites direct Claude commands to `mosaic claude` and rejects unknown custom Claude launchers fail-closed.
-- Permanent guard: `packages/mosaic/framework/tools/lease-broker/check-runtime-launches.py`, invoked by `packages/mosaic/package.json` `test:framework-shell` and therefore root `pnpm test`/CI. It scans production code under `packages/`, `apps/`, `plugins/`, and `tools/` and rejects literal, absolute-path, process-API, command-array, and dynamic Claude/Pi launch forms. Synthetic bypass tests are permanent at `runtime_launch_guard_unittest.py`.
-- Mechanical inventory: **14 gated / 14 total** — coord 2, fleet 1, QA 2, orchestrator 3, PRDY 2, Mosaic Claude/Pi/Claudex adapter/boundary 4. No verification-layer fallback or follow-up issue is needed because the single code-level wrapper was achieved.
-- Real-socket behavioral evidence: PRDY init, PRDY update, and QA remediation each fail before runtime execution when the broker is absent; with the broker present they receive a broker-minted 64-hex session and the unverified `Bash` authorization exits 2. Claudex normal/YOLO and the broker state machine remain GREEN.
-- Fresh branch coverage: `launch-runtime.py` **18/18 = 100%**; `mutator-gate.py` **22/22 = 100%**; permanent guard **36/38 = 95%**; `daemon.py` WI-2 delta **35/40 = 87.5%**. All attributable executable statement coverage is at least 98%.
-- Fresh focused suites: broker + mutator real-socket acceptance `49/49`; persistence `10/10`; launcher/gate branch suite `13/13`; permanent guard suite `7/7`; coord `19/19`.
-- Fresh full repository suite: `43/43` Turbo tasks; `@mosaicstack/mosaic` `72/72` files and `1,384/1,384` tests. Root typecheck `42/42`, lint `23/23`, format, and diff checks GREEN.
-- PR #837 remains open and unmerged. Terra CODE and Opus SECREV must both rerun from zero on the exact round-3 head before coordinator-owned merge authorization.
-
-## Remediation round 4 — terra CODE comment 18104
-
-- Locked-good surfaces: the 14/14 launch inventory, single `launch-runtime.py` choke-point, real-socket launcher behavior, coverage, Claudex gating, and broker state machine must not change.
-- Reproduced RIDER E exactly at head `1792b7934dda7eff64a207b8b0edb9c460d4164b`: a temporary production file containing `exec claude --dangerously-skip-permissions "terra-r3" # launch-runtime.py` made the guard exit 0 and report `1 gated/1 total`.
-- Root cause: classification searched the unparsed physical line, and the broad gated regex treated any `launch-runtime.py` substring—including comments and inert arguments—as an invocation before the direct-launch finding was evaluated.
-- Round-4 plan: add permanent RED cases for the exact comment evasion plus string-argument, echo, and unrelated-variable marker evasions; tokenize/strip comments by launcher syntax; recognize only command-position wrapper invocations with `--runtime` and the gated command separator; retain 14/14 real inventory; rerun guard coverage and all gates fresh.
-- Mos Rider A/B decision: adopt **both** defenses. Command-position parsing remains necessary because a normal `claude -p` launch is consequential even without the dangerous flag. The primitive-location invariant is more mechanically robust for dangerous mode because it does not need to recognize a wrapper marker at all. Move the sole raw `--dangerously-skip-permissions` literal into `launch-runtime.py`; any occurrence in another production file is independently RED.
-- Rider-A RED matrix adds heredoc body, backslash continuation, non-first `;`/`&&`/pipe commands, command substitution, `eval`, and variable-execution indirection in addition to the six marker/comment evasions. Before the augmented implementation, primitive ownership, command substitution, `eval`, variable execution, and the preserved 14-site inventory all fail.
-- Round-4 GREEN uses both defenses. Quote-aware comment stripping removes shell/Python `#` and JS/TS line/block comments; shell command prefixes are segmented with `shlex`; validated wrappers require `launch-runtime.py` in command position, `--runtime`, and the `--` command separator; multiline TypeScript wrapper calls are validated as complete invocations. Direct command syntax wins over markers, while tracked runtime assignments plus `eval`/variable execution, command substitution, chained commands, heredocs, continuations, and `env`/`command`/`nohup` prefixes are rejected.
-- Primitive ownership is independently load-bearing: `launch-runtime.py` is the sole production owner of the raw Claude dangerous flag. Mosaic, Claudex, and PRDY request semantic `--dangerous`; the wrapper validates Claude and injects the primitive immediately before register/exec. This preserves actual YOLO argv behavior while making any raw primitive elsewhere fail without relying on wrapper-name recognition.
-- Permanent guard suite now has 10 tests and 31 direct-launch forms, including 18 new round-4 marker/comment/indirection/prefix evasions plus harmless-marker and multiline-wrapper controls. Terra's exact add-ungated source is exercised through the CLI effectiveness test. Repository inventory remains exactly **14 gated / 14 total**.
-- Fresh round-4 coverage: guard **97%** branch-aware aggregate (241 statements, 110 branches); `launch-runtime.py` **100%**; `mutator-gate.py` **100%**. The daemon is byte-unchanged from the round-3 head whose WI-2 delta is **87.5%**.
-- Fresh round-4 gates: real-socket acceptance **49/49**; persistence **10/10**; launcher/gate **14/14**; guard **10/10**; coord **19/19**; Mosaic **1384/1384**; root **43/43**; typecheck **42/42**; lint **23/23**; format and diff checks green.
-
-## Remediation round 5 — terra 18116 + Opus 18114
-
-- Both independent gates converged on one guard-only completeness gap at round-4 head `1eb77c17f3147d4fa9944f77f1826243135b9cc0`; all round-4 primitive anchoring, command-position parsing, 14/14 inventory, broker ordering, and coverage remain locked-good.
-- Reproduced exactly: a temporary production source containing `launcher=claude` followed by `exec "$launcher" -p x` exits 0 with `0 gated / 0 total`. The literal command resolver skips prefixes but cannot resolve a tracked variable; the variable resolver handles only bare/eval references and cannot skip prefixes.
-- Round-5 plan: add 10 permanent RED forms (quoted/unquoted `exec`, `command`, `nohup`, and `env` with assignment, each multiline and same-line), then unify shell command-position resolution so literal and tracked-variable terminal tokens traverse the same prefix parser. Retain an independent variable-reference backstop, the 14/14 inventory, and every round-4 regression.
-- Mos stopping-criterion augment: command parsing is explicitly best-effort rather than a complete shell interpreter. Add B1 proving a parser-exotic alias launch with the raw dangerous flag is still RED by primitive anchoring, and B2 proving a parser-missed non-dangerous alias launch reaches the global `.*` hook and fails closed with `GATE_UNAVAILABLE` when no lease session exists. Document A (realistic parser matrix) + B (robust residual backstops); fresh reviewers supply criterion C (no new non-overlapping finding).
-- RED commit `91a4a983`: all 10 prefix×variable cases failed as expected before the fix—quoted/unquoted `exec`, `command`, `nohup`, and `env A=1`, each in multiline and same-line assignment shapes.
-- GREEN structural resolution: `shell_command_tokens()` now owns command-position prefix skipping for both literal and variable callers, including nested `exec`/`command`/`nohup`/`env` ordering. `runtime_variables` is threaded into `is_shell_direct_invocation()` and the same terminal-token resolver backs `executes_runtime_variable()`; exact `$v` and `${v}` references are resolved after `shlex` removes quoting. Same-line runtime assignment delimiters include shell operators.
-- Residual backstops: B1 proves alias-indirected dangerous mode is classified `dangerous-primitive` even though the parser does not resolve the alias. B2 proves a non-dangerous alias residual remains parser-missed, then verifies the shipped global `.*` Claude hook and status-2 `GATE_UNAVAILABLE` denial for representative read, mutator, and custom/MCP tools without a lease session.
-- Stopping-criterion evidence A+B is committed in tests and architecture docs; C remains the fresh exact-head terra/Opus determination. Repository inventory remains exactly **14 gated / 14 total**.
-- Fresh round-5 coverage: permanent guard remains **97%** branch-aware aggregate (251 statements, 112 branches). Locked-good launcher and mutator-gate executables remain unchanged at their round-4 **100% / 100%** evidence.
-- Fresh round-5 gates: real-socket acceptance **50/50**; persistence **10/10**; launcher/gate **14/14**; guard **12/12**; coord **19/19**; Mosaic **1385/1385**; root **43/43**; typecheck **42/42**; lint **23/23**; format and diff checks green.

docs/scratchpads/830-compaction-revoke.md

@@ -1,95 +0,0 @@
-# WI-3 Scratchpad — Compaction revocation and runtime-generation rollover
-
-- **Issue:** Gitea #830
-- **Branch:** `feat/830-compaction-revoke`
-- **Base HEAD:** `abd2791f59b3f06f46dd08e55298ced72f6aa7c2`
-- **Role:** sol author/build lane only; terra CODE and Opus SECREV are coordinator-owned.
-
-## Mission prompt
-
-Implement BUILD-BRIEF Deliverable 3.3 and D4 on merged WI-1/WI-2 under `packages/mosaic/`. Claude `PreCompact` and `SessionStart(matcher=compact)` plus Pi `session_before_compact`/`context` equivalents must revoke the active lease through the existing broker state machine. Any `runtime_generation` bump—including same-PID reload/resume/fork—must auto-revoke the prior incarnation so the new generation inherits no prior lease. M1 is Claude + Pi only.
-
-Honor amended D2-v5 exactly: hard fail-closure when at least one observer fires or after lease expiry; both observers missing within TTL is an explicitly named bounded residual stale window (maximum 300 seconds, soak-tighten only), with no claim that the mutator gate bounds actions inside that window; total gate-hook miss is T-C. T12b/T30 must report both the within-TTL ALLOWED outcome and after-TTL DENIED outcome.
-
-## Session start verification
-
-- Worktree is clean on `feat/830-compaction-revoke` at exact required base `abd2791f59b3f06f46dd08e55298ced72f6aa7c2`; `origin/main` is the same SHA and includes merged WI-2 atop WI-1.
-- Authority SHA-256 verified:
-  - BUILD-BRIEF: `89fdbc27ed0e5050dc7b52f3ef2ddaea691edf17fd89d51b15e26fb5ed47171b`
-  - SPEC-v5: `a6d07ade835758e8488ca10d3b0631caf0beb93ea3a6733631f151b0c2f01433`
-  - Ratification: `bac58319c9c4028b5b40e1129e0033cdb5a6b7b02033c25f06f4cb77d7779c67`
-  - sol red-team: `3da326a4ea91767b731e128a93b13194e8002358101e30de3fcb8ca2f8f54faa`
-- WI-0 evidence pack SHA-256 `5d418306fcc597fd514e500bee40d1509f0bf467e46ee13fc5c280ed8274759d` read directly. Probe P3 is **PASS**: real Pi retained the same PID/starttime through reload/fork/new/resume while generations advanced and a prior VERIFIED generation was revoked.
-- P6 planner-return ruling SHA-256 `b7bbb6ea6e8d9a5c3366993642ab4e4f65b961af04936dcac20bfbcdcbaf1a09` read directly: feature WI admission is GO with the exact-delivery empirical compatibility fact and disclosed T-C middle-drop residual; no receipt redesign.
-
-## Plan and budget
-
-1. RED real-socket acceptance for T12b/T30, each Claude observer, same-PID generation rollover, Claude/Claudex hook wiring, and Pi lifecycle wiring.
-2. Add one broker client executable for observer revocation plus a private monotonic generation-file helper shared by launcher, gate, and revoker.
-3. Wire Claude `PreCompact`, `SessionStart(compact)`, and resume/clear generation rollover; merge equivalent mandatory hooks into isolated Claudex settings.
-4. Wire Pi pre/post compaction observers and reload/new/resume/fork generation rollover with local fail-closed tool blocking if lifecycle revocation fails.
-5. Document the D2-v5 bounded stale window without claiming the mutator gate bounds within-TTL actions; update protocol/security/operations/sitemap/checklist.
-6. Run focused real tests, independently measured executable coverage ≥85%, full repository gates, commit/push, open an unmerged `closes #830` PR, and hand off for terra CODE + mandatory Opus SECREV.
-
-Working estimate: **35K tokens**. No explicit hard cap was supplied; reduce refactor breadth before touching locked broker authority/state-machine semantics.
-
-## RED evidence
-
-- New T12b/T30 test already reports the inherited primitive honestly: within-TTL **ALLOWED**, after-TTL **DENIED**. The complete AC remains RED because the mandatory threat-contract document is absent.
-- Focused real-socket suite is RED with 7 expected failures: missing revoker executable (both Claude observers + generation bump), missing Claude/Pi wiring, missing isolated Claudex observers, and missing D2-v5 disclosure.
-- Branch-focused Python suite is RED on the wished generation initializer/resolver interfaces and missing `lease_generation.py` / `revoke-lease.py`.
-- Pi lifecycle suite is RED because the wished standalone `lease-lifecycle.ts` observer/generation module does not exist.
-
-## Locked discipline
-
-- RED-first T12b/T30 and observer/generation tests; test commit precedes implementation.
-- Reuse broker `revoke_lease`; do not fork identity, lease, or transition authority.
-- Preserve revoke-first/promote-last and WI-1/WI-2 reviewed state machine.
-- ≥85% attributable executable coverage with real tests.
-- No author self-review, no merge, no `--no-verify`.
-
-## Local implementation complete (push held)
-
-Implemented on the WI-3 base `abd2791f59b3f06f46dd08e55298ced72f6aa7c2` without changing the reviewed broker state machine:
-
-- Added `revoke-lease.py`, which authenticates through the existing broker session/generation and invokes `revoke_lease`. A fired observer that cannot confirm broker revocation advances the private generation as a local fence before returning non-zero.
-- Added `lease_generation.py`: owner/type/mode/size validation, no-follow opens, exclusive bump lock, monotonic `int64` generation, write-all + `fsync`, and fail-closed exhaustion/corruption handling.
-- `launch-runtime.py` creates `generation-<broker-session>.state` mode `0600` beside the socket before `exec`; `mutator-gate.py` resolves that current file value on every tool check.
-- Claude settings and isolated Claudex settings now preserve/install `PreCompact`, `SessionStart(compact)`, and resume/clear rollover hooks in addition to the global all-tools gate.
-- Pi now registers tested `session_before_compact`, `session_compact`→first `context`, and `session_start(reload|new|resume|fork)` handlers. Failed pre-compact revocation cancels compaction; failed post-compact/rollover revocation latches local all-tool denial.
-- Added PRD requirements, architecture/security/protocol/operations updates, sitemap entry, and the ignored-by-default documentation checklist (force-add required at commit).
-
-### Acceptance and coverage evidence
-
-- Focused acceptance: `19/19`; T12b/T30 prints within-TTL **ALLOWED** and after-TTL **DENIED**.
-- Pi lifecycle: `8/8`, with **100% statements/branches/functions/lines** attributable coverage.
-- New Python generation/revoker: `24/24`, **99% branch-aware aggregate coverage** (`lease_generation.py` 98%, `revoke-lease.py` 100%).
-- Mosaic package: `1399/1399`; framework shell Python `24/24`, launch guard `12/12`, permanent launch inventory `14 gated/14 total`.
-- Existing lease-broker real-socket acceptance: `37/37` within the package run.
-- Full repository: `43/43` Turbo tasks green; gateway `628 passed / 12 skipped`; Mosaic `1399/1399`.
-- Root typecheck: `42/42`; lint: `23/23`; format and `git diff --check` green.
-- Initial direct package test without first building the package reproduced the known missing-`dist/cli.js` harness condition; the canonical root Turbo test (which schedules `@mosaicstack/mosaic#build`) and explicit package build+test are green. No test was weakened.
-
-### Review evidence
-
-- Codex uncommitted code review: **APPROVE**, confidence `0.88`, zero findings. Its read-only sandbox could not rerun Vitest, but the author-side focused and full suites above were green.
-- Codex uncommitted security review: risk **none**, confidence `0.91`, zero findings.
-- Coordinator-mandated fresh exact-head terra CODE and Opus SECREV remain pending after rebase/push clearance; these local reviews do not replace that final gate.
-
-### Hold and residuals
-
-- **DO NOT PUSH OR OPEN A PR YET.** Coordinator requires flake-fix #838 to land, then WI-3 must rebase onto deterministic-green `main` before push.
-- Merge remains gated on #838, #827 Probe 3, and combined GO.
-- Named residual retained verbatim: when both observers are entirely missed, within-TTL consequential actions remain allowed; only lease expiry denies after the bounded stale window. No within-window mutator-action bound is claimed.
-
-## Deterministic-main rebase evidence
-
-- Fetched and confirmed `origin/main` at `8dfcf1903e385f977121069f798f476eb671fffc` (`#838` bounded broker deadlines, empty-read fail-closure, and de-flaked acceptance client).
-- Linear rebase completed. The only content conflict was `packages/mosaic/src/mutator-gate/runtime_tools_unittest.py`; resolution retained #838's `subprocess`/`threading` deadline regressions and WI-3's `stat` generation-state coverage. No authority/state-machine choice was ambiguous.
-- `packages/mosaic/src/mutator-gate/mutator-gate.acceptance.spec.ts` auto-merged on top of #838's shared `requestBrokerReply` helper. No inline socket/`JSON.parse` client was resurrected.
-- Verified WI-3 has zero diff from `origin/main` for #838-owned `daemon.py`, `broker-test-client.ts`, `lease-broker.acceptance.spec.ts`, `vitest.config.ts`, and `packages/mosaic/package.json`; bounded deadlines and the de-flaked harness are preserved byte-for-byte.
-- Required verbose acceptance command: **2 files / 56 tests green**. T12b/T30 still prints within-TTL **ALLOWED** and after-TTL **DENIED**.
-- Full Mosaic package after explicit build: **74 files / 1408 tests green**; deadline unit `2/2`, runtime tools `25/25`, launch guard `12/12`, inventory `14/14`.
-- Full repository: **43/43 Turbo tasks green**. Root typecheck `42/42`, lint `23/23`, format and diff checks green.
-- Attributable coverage remains Python **99%** branch-aware and Pi lifecycle **100%** statements/branches/functions/lines.
-- Push and PR remain held pending combined GO and all WI-3 merge gates. The coordinator-owned promote-lease-lost-ACK SPEC amendment/backstop is acknowledged as a future merge prerequisite and was not retro-expanded into this core rebase/build.

docs/scratchpads/832-receipt-challenge-protocol.md

@@ -1,13 +0,0 @@
-# #832 Receipt-challenge protocol — build scratchpad
-
-- **Objective:** Deliver WI-5 receipt-challenge protocol ACs T25, T26, T28, and T29 only.
-- **Authority:** BUILD-BRIEF, SPEC-v5, ratification, and red-team hashes verified in STEP-0.
-- **Base:** `e522b22fa4492861b0fcd4a956a8795c54eb9bfe` (`origin/main`).
-- **Constraints:** Byte-build only: no live broker/socket/systemd/tmux mutation. No PR, self-review, or probe fire. T27/T30 are out of scope.
-- **Plan:**
-  1. Add red-first deterministic T26/T29 in-build tests that call shipped normative construction and broker path.
-  2. Add an unexecuted, isolated P5 out-of-process replay harness that drives the shipped daemon and asserts consume-before-promote for T25/T28.
-  3. Implement the broker-minted receipt challenge and exact receipt observation/consume/promote path.
-  4. Run unit, framework-shell, compile, lint, and type checks; push after the required queue guard; report to `mosaic-100`.
-- **Risks:** The standalone harness must drive the real daemon without a divergent fixture. If that is impossible, stop and flag Mos.
-- **Evidence:** Initial RED recorded in `/home/hermes/agent-work/reviews/832-wi5-red-receipt-challenge.log`; initial green checks passed. Remediation RED recorded in `/home/hermes/agent-work/reviews/832-wi5-remediation-red.log` before observer/payload implementation; remediation green passed. Remediation-2 RED recorded in `/home/hermes/agent-work/reviews/832-wi5-remediation2-red.log`: each rejected begin restored prior VERIFIED authority. Remediation-2 GREEN: receipt unittest (5: all `INVALID_CONSTRUCTION`, `PAYLOAD_CONSTRUCTION_REFUSED`, and `PAYLOAD_BINDING_MISMATCH` cases preserve UNVERIFIED and deny the next mutator), normative-fragments unittest (5), state-store regression (10), full mutator-gate acceptance (20, including the real begin → observer → consume → promote path), `py_compile`, Mosaic package lint/typecheck, and targeted Prettier check. The P5 harness remains unfired. Coverage tooling remains unavailable (`python3 -m coverage`: module not installed). Push pending.

docs/scratchpads/833-constrained-recovery-command.md

@@ -1,15 +0,0 @@
-# #833 constrained recovery command — build scratchpad
-
-- **Objective:** Deliver WI-6 plus Mos-ruled B1/B2 and R2 Claude-only literal-argv repair: no shell-active recovery mapping bypass, unchanged Pi gate/B2 observer, AC-1/C4 preservation, and an unfired P6 probe.
-- **Authority:** STEP-0 SHA-256 verified 4/4 against the supplied BUILD-BRIEF, SPEC-v5, ratification, and red-team records.
-- **Base:** exact `07553ead337a70a9241f826d27571650262b289c`; new branch `feat/833-constrained-recovery-command`; merge-base assertion passed before any commit.
-- **Constraints:** No rebase/pull during build; no live install/symlink or live broker/socket/tmux/systemd/model-stream activation; no self-review, PR, merge, push, or P6 fire. `docs/TASKS.md` is orchestrator-owned and will not be modified.
-- **Plan:**
-  1. Add red-first unit tests against the recovery broker entrypoint for fresh recovery challenge, normal-receipt replay refusal, observable partial-delivery refusal, and the explicit middle-drop negative capability; commit the RED test and preserve its command output.
-  2. Implement the recovery command as a thin driver over shared WI-5 broker transitions and the trusted observer seam; it never accepts caller receipt text.
-  3. Add the source-resident skill under `packages/mosaic/framework/skills/`, plus a tmp-only #824 bridge projection test.
-  4. Build an unfired, default-3-run P6 standalone real-socket driver; it is not added to package scripts and will not be run.
-  5. Run targeted broker/mutator/receipt suites, lint, and format check; report head to `mosaic-100` and stop.
-- **Risks:** The observer can only represent an exact latest message. Tail-preserving middle-drop is intentionally not claimed receipt-detectable (T-C residual deferred to WI-7 server evidence).
-- **Evidence:** Original RED test committed at `3b5513bd6efad0c06b599fc759a66cff4286db04`; expected `UNKNOWN_ACTION` is logged in `/home/hermes/agent-work/reviews/833-wi6-red.log`. B1/B2 repair RED is `f4beedc3e7ac2e142dcbdeefb0e5ee40c20d9b86` in `/home/hermes/agent-work/reviews/833-wi6-repair-red.log`. R2 adversarial RED is committed at `65e2bd71cf360b6f45c86eec0b06ae24494832d8` in `/home/hermes/agent-work/reviews/833-wi6-repair-R2-red.log` before the literal-only gate source: the private real-gate/real-daemon battery covers every argv position (executable, path, phase, each flag, each value) for command substitution, backticks, parameter/arithmetic expansion, brace/tilde, process substitution, glob, redirects, control operations, embedded newline, and quotes. P6 remains rebuilt and unfired. The ordinary package Vitest/lint/typecheck/root-format commands cannot resolve their executables in this intentionally dependency-free fresh worktree (`node_modules` absent); no install/symlink workaround was used.
-- **Budget:** No explicit task token cap was supplied; scope is fixed to WI-6 and no unrelated behavior will be added.

docs/scratchpads/838-broker-acceptance-flake.md

@@ -1,44 +0,0 @@
-# Issue #838 — Broker acceptance socket flake
-
-## Objective
-
-Eliminate high-contention uncaught JSON parse failures in lease-broker and mutator-gate acceptance helpers without laundering malformed/empty replies into passing assertions.
-
-## Constraints
-
-- Branch: `fix/838-broker-acceptance-flake` in `/home/hermes/agent-work/stack-838-flakefix`.
-- Red-first TDD with a forced empty/truncated reply path and deterministic rejection or documented retry.
-- Read newline-framed replies completely; reject malformed broker replies with byte length/content context.
-- Determine RIDER2 branch before finalizing: test-harness-only `(a)` or daemon write truncation `(b)`.
-- If product-side, prove the real Claude/Pi adapter read path fails closed; fix any allow-risk.
-- Coverage >=85% per changed executable through real tests.
-- Full suite and repository gates green; independent exact-head review required.
-- Push and open a PR containing `closes #838`; do not merge.
-
-## Progress
-
-- 2026-07-17: Reclaimed from #824. Confirmed clean worktree on `fix/838-broker-acceptance-flake` at main base `abd2791f59b3f06f46dd08e55298ced72f6aa7c2`.
-- RED evidence: after dependency setup, `broker-test-client.spec.ts` failed to load the intentionally absent shared client module. Its contract forces empty-close retry, repeated truncated-close rejection with byte context, and newline-terminated malformed-reply rejection.
-- RIDER2 verdict: branch **(b)**. `daemon.py` starts one connection deadline before request reading, then may spend that budget waiting for `broker_lock`; after handling, `remaining <= 0` returns without writing. A timed `sendall` failure can likewise close after a partial write. A deterministic socketpair probe held the lock past `CONNECTION_DEADLINE_SECONDS` and observed `deadline_probe_reply_length=0`.
-- Adapter tripwire: real subprocess executions of `mutator-gate.py` for both `--runtime claude` and `--runtime pi` against actual Unix servers returning empty and truncated replies all exited 2 with `GATE_UNAVAILABLE`. Adapter fail-close is proven; there is no ALLOW risk.
-- Residual: production broker reply loss remains an availability-denial path under extreme contention, but cannot grant mutator authority. The acceptance-only client retries early closes and otherwise rejects with response byte length, escaped bytes, and hex; malformed newline-framed replies are never retried or converted to reply objects.
-- Shared client now owns newline framing and parsing for both acceptance suites. Focused suites pass 60 tests, including the real adapter tripwire.
-- Coverage gate: changed helper is 100% statements/lines/functions and 90% branches; existing `skill.ts` remains above 85% per-file thresholds.
-
-## Scope corrections and bounded product repair
-
-- Coordinator correction superseded the initial push/PR and retry language: this lane is BUILD-ONLY, and early-close retries are forbidden because they can mask a committed broker transaction. Nothing may be pushed or opened until explicitly cleared.
-- Revised RED evidence: the no-retry empty/truncated tests failed because the first failed exchange was retried into `{ ok: true }`; the daemon regression failed because a slow completed `broker.handle()` produced `b''` instead of a newline-framed reply.
-- Client repair: both former duplicated helpers use one shared reader. Empty, truncated, malformed, oversized, timed-out, and socket-error replies reject `BrokerTransportError` with a typed `kind`, attempt count fixed at one, response length, escaped bytes, and hex. No retry and no catch-to-reply conversion exists.
-- Product repair: `daemon.py` now has independent bounded read, broker-lock queue, and send budgets. Lock queue exhaustion returns explicit `BROKER_BUSY` before `broker.handle()` can mutate state. Once handling starts it finishes atomically, and its reply always receives a fresh send timeout instead of being skipped because read/lock/fsync consumed a shared deadline.
-- Product GREEN evidence: deterministic socketpair tests prove lock saturation returns framed `BROKER_BUSY` without invoking `handle()`, and a handle that completes after the former one-second shared deadline still returns its complete framed reply.
-- RIDER2b remains **fail-closed**: real Claude and Pi `mutator-gate.py` subprocesses against empty and truncated Unix-socket replies exit 2 with `GATE_UNAVAILABLE`; no malformed/default ALLOW was observed.
-- Residual/tripwire: an unavoidable peer disconnect or send failure can still lose acknowledgement after a valid transaction commits. The affected adapter call fails closed. A valid `promote_lease` may nevertheless remain VERIFIED after its acknowledgement is lost; that is authority-observability divergence requiring WI-3/Opus security review rather than expansion of #838. #838 does not add retries or attempt a protocol redesign.
-- Final package evidence: recursive Mosaic dependency build passed; 73 Vitest files / 1,392 tests passed; deadline unit tests 2/2, real runtime tool tests 15/15, launch guard tests 12/12, inventory 14/14, and shell regressions passed.
-- Final coverage: `broker-test-client.ts` 99.24% statements/lines, 86.11% branches, 100% functions under per-file >=85% thresholds. Repository typecheck 42/42, lint 23/23, and format check passed.
-- Independent Codex exact-head review requested one framing fix: a valid frame followed by trailing bytes in a later socket chunk could resolve before the garbage arrived. Security review also flagged complete token-bearing reply bodies in diagnostic properties/logs.
-- Review RED evidence: delayed cross-chunk garbage resolved `{ ok: true }` instead of rejecting, and a truncated `promotion_token` remained in the typed error. The tests use separate timed writes to prevent kernel/event-loop coalescing.
-- Review remediation: the shared client now accumulates through EOF, requires exactly one terminal newline, then parses inside a rejecting error boundary. Diagnostic bodies are capped at 256 bytes, sensitive broker fields are fully redacted, and a SHA-256 digest preserves correlation without credential disclosure.
-- Post-review coverage: `broker-test-client.ts` 99.35% statements/lines, 86.66% branches, 100% functions. Final full suite is 73 files / 1,394 tests plus all Python/shell gates; recursive build, typecheck, lint, and format are green.
-- Fresh exact-head Codex security review: risk `none`, no findings. Fresh code review found only that the real-adapter subprocess proof lacked a timeout; it now has a five-second bound and fails with runtime/wire context while closing the fake server. The focused Python suite remains 15/15 green.
-- Mandatory Opus SECREV remains coordinator-owned and pending before any push/PR decision; this build is intentionally local-only.

docs/scratchpads/fcm-m5-001-fleet-config-operator-docs.md

@@ -1,85 +0,0 @@
-# FCM-M5-001 — Fleet configuration operator documentation
-
-- Task: `FCM-M5-001`
-- Issue: `#758`
-- Branch: `docs/758-fleet-config-operator-docs`
-- Exact base: `9745bc3f29c26b021a478b7ad03cfb494f6c9de3` (tree `4da210da9a71b035130d4160a4a2e691bdfde2da`)
-
-## Objective
-
-Deliver the accepted fleet documentation information architecture, operator workflows, operations and migration references, comprehensive contract documentation, and deterministic link/example validation without live fleet action or product mutation.
-
-## Scope and constraints
-
-- Documentation, examples, documentation validation, and tracking only.
-- `roster.yaml` remains the sole writable desired-state authority; generated state is derived/observed.
-- No M4-002 implementation or execution; no canary, migration, rollback, deployment, systemd/tmux/session, generated projection, or product mutation.
-- `mos-comms` is temporary and is not permanent architecture.
-- Parent issue `#758` remains open through M5.
-- No credentials, sensitive values, or privileged command content.
-
-## Plan
-
-1. Update tracking first with exact M4-001 evidence and mark M5-001 in progress.
-2. Map the M0 checklist and current implementation behavior to documentation pages.
-3. Author operator, operations, migration, schema/reference, recovery, troubleshooting, and security/authority docs.
-4. Add or extend deterministic documentation/link/example validation if required, red-first.
-5. Run repository documentation, link, example, and relevant package checks; review and remediate.
-6. Commit, queue-guard, push one branch, and open one wrapper-created PR; stop for independent review.
-
-## Budget
-
-- Task estimate: `24K`.
-- Working cap: stay within the card estimate by parallelizing read-only discovery and limiting edits to checklist-required artifacts.
-
-## Progress checkpoints
-
-- [x] Loaded repository/global delivery and documentation contracts.
-- [x] Verified `origin/main` is exact required base and created isolated worktree.
-- [x] Tracking updated first.
-- [x] Checklist mapped and docs authored.
-- [x] Validation green.
-- [x] Review/remediation complete.
-- [x] Commit, queue guard, push, PR #789.
-- [x] Rejected exact-head RoR findings repaired on a new descendant commit candidate.
-- [ ] New exact-head review and CI after repair push.
-
-## Tests and verification
-
-- Red-first documentation validator initially failed for the absent fleet entry point and canonical
-  example, then passed after the IA and example were added.
-- `pnpm --filter @mosaicstack/mosaic exec vitest run src/fleet/roster-v2.spec.ts src/fleet/example-profile-dispositions.spec.ts src/fleet/fleet-documentation.spec.ts src/fleet/v1-v2-migration.spec.ts src/fleet/generated-env-boundary.spec.ts src/fleet/fleet-agent-crud.spec.ts src/fleet/fleet-reconciler.spec.ts` — 7 files, 195 tests passed after building workspace dependencies.
-- `pnpm format:check` — passed.
-- `pnpm lint` — 23 tasks passed.
-- `pnpm typecheck` — 42 tasks passed.
-- `pnpm test` — 43 tasks passed; `@mosaicstack/mosaic` contributed 61 files and 1,045 tests.
-- `bash packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh` — passed.
-- `bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh` — passed.
-- `git diff --check` — passed before final review.
-- Independent staged-snapshot review identified four documentation/validation blockers: reboot safety,
-  heartbeat observation, migration failure envelope, and example-scan coverage. All were remediated;
-  focused rereview approved the staged remediations with no blockers. Exact committed-head review remains
-  a post-PR gate.
-- Post-remediation `@mosaicstack/mosaic` lint/typecheck passed; package test passed 61 files / 1,045
-  tests; sanitization and resident-budget gates passed again.
-
-- Post-PR exact-head RoR on rejected head `0aee2c09819fd06e28f927384ea56fa2ef374edf`
-  identified five blockers: update-lifecycle overclaim, missing explicit `fleet validate` gap,
-  fragment-blind link validation, unsupported checklist-evidence claim, and insufficient example safety
-  validation. Red-first regressions failed before implementation for missing-heading, privileged-command,
-  and credential-format fixtures. Repairs now preserve/document implementation truth, validate heading
-  fragments, narrow checklist claims, and scan fenced/canonical examples for common credential formats
-  and privileged commands without printing fixture values.
-- Repair-focused fleet contracts: 7 files, 192 tests passed after review remediation; documentation
-  validator contributed 11 tests. Full gates passed: format; lint 23/23; typecheck 42/42; test 43/43
-  tasks with `@mosaicstack/mosaic` 61 files / 1,052 tests; sanitization; resident budget; and
-  `git diff --check`. New exact-head review/CI remain pending until the repair commit is pushed.
-
-## Risks/blockers
-
-- Checklist may include behavior intentionally deferred to M4-002/M5-002; such items must be recorded as approved-existing holds rather than claimed delivered.
-- Commands/examples must remain non-live and avoid privileged/sensitive content.
-
-## Final evidence
-
-- Pending.

docs/scratchpads/ms-792-fleet-enoent-installer.md

@@ -1,38 +0,0 @@
-# ms-792 — Fleet roster error handling and installer heading
-
-## Objective
-
-Make expected missing or malformed fleet roster configuration fail with an actionable message and nonzero exit instead of a raw Node stack trace. Ensure the installer preserves the `@mosaicstack/mosaic` heading.
-
-## Plan
-
-1. Add failing coverage for missing and malformed roster input.
-2. Centralize roster-file read and parse error translation; add the CLI async error boundary.
-3. Sweep fleet command read paths that bypass the roster loader.
-4. Replace the installer heading output with format-safe rendering and test it.
-5. Run focused and repository quality checks; request independent review.
-
-## Progress
-
-- 2026-07-16: Confirmed issue #792 and branch base `9745bc3f`.
-- 2026-07-16: Installed locked workspace dependencies using a worktree-local pnpm store; no `.mosaic/` files were changed intentionally.
-- 2026-07-16: Added a shared roster read/parse guard and routed v1 fleet commands plus v1/v2 selection through Commander’s actionable nonzero error path. V2 command modules already return structured nonzero JSON errors for their guarded reads.
-- 2026-07-16: Replaced installer heading `echo` with format-safe `printf`; added a regression check for the scoped package heading.
-- 2026-07-16: Rebuilt CLI and manually verified `fleet ps` with no roster prints the initialization hint, exits 1, and has no stack trace.
-- 2026-07-17: Rebased #818 onto `origin/main` at `9ddc6fbd` (#791 PR3). The added `fleet regen` command had a canonical roster read in its sibling module; it now uses the same missing-roster guard and Commander exit path. Internal NORTH_STAR, preset, and post-write invariant reads remain intentionally unguarded.
-- 2026-07-17: RoR found that semantically invalid v1 documents still escaped as plain `Error` values. `normalizeFleetRosterV1` now preserves each validation message while converting it to `FleetRosterConfigurationError`, so its command callers use the actionable nonzero Commander path.
-
-## Verification
-
-- `pnpm --filter @mosaicstack/mosaic test` — PASS (61 files, 1,046 tests; executed outside sandbox because CLI smoke tests spawn Node)
-- `pnpm typecheck` — PASS
-- `pnpm lint` — PASS
-- `pnpm format:check` — PASS
-- `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/fleet.spec.ts src/commands/install-heading.spec.ts` — PASS (209 tests)
-- `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/fleet-regen-command.spec.ts` — PASS (27 tests, including missing canonical roster)
-- `pnpm --filter @mosaicstack/mosaic exec vitest run src/commands/fleet.spec.ts -t "semantically invalid v1 roster"` — RED then PASS; verifies duplicate agent names are reported as `fleet.roster` exit 1 without a stack trace.
-- Instrumented Vitest coverage is unavailable because `@vitest/coverage-v8` is not declared in this repository. Each branch added in the roster guard has direct unit coverage.
-
-## Risks / blockers
-
-- Dependency installation is required before executing Vitest, TypeScript, lint, and formatting gates.

eslint.config.mjs

@@ -29,7 +29,6 @@ export default tseslint.config(
             'apps/web/playwright.config.ts',
             'apps/gateway/vitest.config.ts',
             'plugins/discord/vitest.config.ts',
-            'packages/comms/vitest.config.ts',
             'packages/db/vitest.config.ts',
             'packages/storage/vitest.config.ts',
             'packages/mosaic/vitest.config.ts',

infra/matrix/.gitignore

@@ -1,3 +0,0 @@
-# DEV runtime state: rendered config, sqlite db, signing key, self-signed
-# certs, throwaway secrets. Never committed.
-.data/

infra/matrix/README.md

@@ -1,53 +0,0 @@
-# infra/matrix — DEV Synapse for RFC-001 P1 (presence)
-
-> **DEV-ONLY. LOCAL SANDBOX.** This stack is for local presence validation. It
-> must **never** be pointed at, or run alongside, a live/production homeserver.
-> It is single-instance, federation-OFF, self-signed TLS — the smallest slice
-> RFC-002 §9 says P1 needs (Mode B single-domain, no federation, no IP-only, no
-> secret-rotation story).
-
-## What this is
-
-A single Synapse homeserver rendered from committed **templates** (no hardcoded
-topology — RFC-002 G2). Every topology fact is an environment variable with a
-dev default:
-
-| Var                  | Default            | Meaning                                             |
-| -------------------- | ------------------ | --------------------------------------------------- |
-| `MATRIX_SERVER_NAME` | `matrix.localhost` | Synapse `server_name` (the `:suffix` of every MXID) |
-| `MOSAIC_AS_ID`       | `mosaic-as`        | appservice id / registration filename               |
-| `MATRIX_HTTP_PORT`   | `18008`            | host port → Synapse 8008 (plain HTTP)               |
-| `MATRIX_TLS_PORT`    | `18448`            | host port → Synapse 8448 (self-signed TLS)          |
-
-Secrets (`as_token`, `hs_token`, Synapse macaroon/form/registration secrets)
-are **throwaway values generated at bring-up** into `.data/dev-secrets.env`
-(gitignored). In production these are crown-jewel secrets held by the
-SecretBackend (RFC-001 §8 / RFC-002 §4) — never committed.
-
-## Files
-
-- `docker-compose.dev.yml` — Synapse (+ optional Element under `--profile element`).
-- `synapse/homeserver.dev.yaml.tpl` — rendered Synapse config (Mode B, `enable_registration: false`, appservice wired, native TLS).
-- `synapse/log.config` — Synapse logging.
-- `appservice/mosaic-as.dev.yaml.tpl` — minimal AS registration (declares the `@agent-*` user namespace).
-- `dev-up.sh` / `dev-down.sh` — bring up / tear down (`--purge` wipes `.data`).
-- `.data/` — **gitignored** runtime state (rendered config, sqlite db, signing key, self-signed certs, dev secrets).
-
-## Usage
-
-```bash
-./dev-up.sh                       # render config, gen signing key + TLS cert, boot Synapse
-# ... run the validation harness (tools/matrix-presence-harness/run.sh) ...
-./dev-down.sh            # stop, keep .data
-./dev-down.sh --purge   # stop and wipe .data for a pristine next boot
-
-# optional human view (A4) — Element pointed at the dev server:
-docker compose -f docker-compose.dev.yml --profile element up -d element
-#   -> http://127.0.0.1:18080
-```
-
-## Acceptance evidence (A1)
-
-- TLS (self-signed) reachable: `curl -sk https://127.0.0.1:18448/_matrix/client/versions` → `200`.
-- Open registration OFF: `POST /_matrix/client/v3/register` → `M_FORBIDDEN "Registration has been disabled"`.
-- AS-token registration bypasses the flag by design (that is how agents are provisioned).

infra/matrix/appservice/mosaic-as.dev.yaml.tpl

@@ -1,30 +0,0 @@
-# ============================================================================
-# mosaic-as.dev.yaml.tpl — Mosaic Appservice registration (DEV)
-# ============================================================================
-#
-#   *** DEV-ONLY. The tokens below are throwaway placeholders rendered at
-#       bring-up by dev-up.sh. NEVER commit real hs_token/as_token — in
-#       production they are crown-jewel secrets held by the SecretBackend
-#       (RFC-001 §8, RFC-002 §4). ***
-#
-# This is the MINIMAL P1 registration: it declares the @agent-* user
-# namespace so the P1 provisioner can register a few virtual agent MXIDs and
-# carry heartbeats. It intentionally does NOT model the full P2 taxonomy /
-# token-minting appservice.
-#
-# Rendered by infra/matrix/dev-up.sh (envsubst -> .data/${MOSAIC_AS_ID}.yaml).
-# ----------------------------------------------------------------------------
-id: "${MOSAIC_AS_ID}"
-url: null                      # P1: provisioner drives the AS API directly; Synapse pushes no txns.
-as_token: "${MOSAIC_AS_TOKEN}"
-hs_token: "${MOSAIC_HS_TOKEN}"
-sender_localpart: "mosaic-as"
-rate_limited: false
-namespaces:
-  users:
-    - exclusive: true
-      regex: "@agent-.*:${MATRIX_SERVER_NAME}"
-  aliases:
-    - exclusive: false
-      regex: "#mosaic-.*:${MATRIX_SERVER_NAME}"
-  rooms: []

infra/matrix/dev-down.sh

@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# dev-down.sh — tear down the DEV Synapse (matrix-p1-dev). DEV-ONLY.
-#   ./dev-down.sh            # stop + remove containers, keep ./.data
-#   ./dev-down.sh --purge    # also delete ./.data (fresh next bring-up)
-set -euo pipefail
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-docker compose -f "${HERE}/docker-compose.dev.yml" --profile element down -v --remove-orphans || true
-if [[ "${1:-}" == "--purge" ]]; then
-  rm -rf "${HERE}/.data"
-  echo "[dev-down] purged ${HERE}/.data"
-fi
-echo "[dev-down] matrix-p1-dev stopped"

infra/matrix/dev-up.sh

@@ -1,108 +0,0 @@
-#!/usr/bin/env bash
-# ============================================================================
-# dev-up.sh — bring up the DEV Synapse for RFC-001 P1 (presence)
-# ============================================================================
-#
-#   *** DEV-ONLY. LOCAL SANDBOX. This script must never be pointed at live
-#       infra. It writes only into infra/matrix/.data (gitignored) and drives
-#       a dedicated compose project (matrix-p1-dev). ***
-#
-# It renders the Synapse config + appservice registration from the committed
-# templates (envsubst), generates a DEV signing key + self-signed TLS cert,
-# and starts Synapse. All topology facts come from the environment with dev
-# defaults (RFC-002 G2: nothing hardcoded).
-# ----------------------------------------------------------------------------
-set -euo pipefail
-
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-DATA="${HERE}/.data"
-COMPOSE=(docker compose -f "${HERE}/docker-compose.dev.yml")
-
-# ---- Topology inputs (dev defaults; override via env) ----------------------
-export MATRIX_SERVER_NAME="${MATRIX_SERVER_NAME:-matrix.localhost}"
-export MOSAIC_AS_ID="${MOSAIC_AS_ID:-mosaic-as}"
-export MATRIX_HTTP_PORT="${MATRIX_HTTP_PORT:-18008}"
-export MATRIX_TLS_PORT="${MATRIX_TLS_PORT:-18448}"
-
-# ---- DEV secrets (throwaway; regenerated if absent) ------------------------
-SECRETS_ENV="${DATA}/dev-secrets.env"
-mkdir -p "${DATA}"
-if [[ ! -f "${SECRETS_ENV}" ]]; then
-  {
-    echo "MOSAIC_AS_TOKEN=devas_$(openssl rand -hex 16)"
-    echo "MOSAIC_HS_TOKEN=devhs_$(openssl rand -hex 16)"
-    echo "SYNAPSE_REG_SHARED_SECRET=devreg_$(openssl rand -hex 16)"
-    echo "SYNAPSE_MACAROON_SECRET=devmac_$(openssl rand -hex 16)"
-    echo "SYNAPSE_FORM_SECRET=devform_$(openssl rand -hex 16)"
-  } > "${SECRETS_ENV}"
-  echo "[dev-up] generated throwaway DEV secrets -> ${SECRETS_ENV}"
-fi
-# shellcheck disable=SC1090
-set -a; source "${SECRETS_ENV}"; set +a
-
-# DEV: let the synapse container user (uid 991) write the sqlite db / media.
-chmod 0777 "${DATA}" || true
-
-# ---- Render config from templates ------------------------------------------
-envsubst < "${HERE}/synapse/homeserver.dev.yaml.tpl" > "${DATA}/homeserver.yaml"
-envsubst < "${HERE}/appservice/mosaic-as.dev.yaml.tpl" > "${DATA}/${MOSAIC_AS_ID}.yaml"
-cp "${HERE}/synapse/log.config" "${DATA}/log.config"
-echo "[dev-up] rendered homeserver.yaml + ${MOSAIC_AS_ID}.yaml (server_name=${MATRIX_SERVER_NAME})"
-
-# ---- DEV signing key -------------------------------------------------------
-# Generate as the synapse container user (uid 991) so the running container
-# can read it; owned-by-991 mode-600 is fine (the container IS 991).
-SIGNING_KEY="${DATA}/${MATRIX_SERVER_NAME}.signing.key"
-if [[ ! -f "${SIGNING_KEY}" ]]; then
-  docker run --rm --user 991:991 -v "${DATA}:/data" --entrypoint generate_signing_key \
-    matrixdotorg/synapse:latest -o "/data/${MATRIX_SERVER_NAME}.signing.key"
-  echo "[dev-up] generated DEV signing key"
-fi
-
-# ---- DEV self-signed TLS cert (A1) -----------------------------------------
-if [[ ! -f "${DATA}/dev-cert.pem" ]]; then
-  openssl req -x509 -newkey rsa:2048 -nodes \
-    -keyout "${DATA}/dev-key.pem" -out "${DATA}/dev-cert.pem" \
-    -days 90 -subj "/CN=${MATRIX_SERVER_NAME}" \
-    -addext "subjectAltName=DNS:${MATRIX_SERVER_NAME},DNS:localhost,IP:127.0.0.1" >/dev/null 2>&1
-  echo "[dev-up] generated DEV self-signed TLS cert for ${MATRIX_SERVER_NAME}"
-fi
-# Files hermes owns must be world-readable so the synapse (uid 991) container
-# can read them (DEV-only; the signing key stays owned by 991 from above).
-chmod 0644 "${DATA}/dev-cert.pem" "${DATA}/dev-key.pem" \
-  "${DATA}/homeserver.yaml" "${DATA}/${MOSAIC_AS_ID}.yaml" "${DATA}/log.config" || true
-
-# ---- Element config (optional human view, A4) ------------------------------
-cat > "${DATA}/element-config.json" <<JSON
-{
-  "default_server_config": {
-    "m.homeserver": {
-      "base_url": "https://localhost:${MATRIX_TLS_PORT}",
-      "server_name": "${MATRIX_SERVER_NAME}"
-    }
-  },
-  "disable_guests": true,
-  "brand": "Mosaic P1 (DEV)"
-}
-JSON
-
-# ---- Boot ------------------------------------------------------------------
-"${COMPOSE[@]}" up -d synapse
-
-echo -n "[dev-up] waiting for Synapse health"
-for _ in $(seq 1 60); do
-  status="$("${COMPOSE[@]}" ps --format '{{.Health}}' synapse 2>/dev/null || true)"
-  if [[ "${status}" == "healthy" ]]; then echo " ... healthy"; break; fi
-  echo -n "."; sleep 2
-done
-
-if ! curl -fsS "http://127.0.0.1:${MATRIX_HTTP_PORT}/health" >/dev/null 2>&1; then
-  echo "[dev-up] ERROR: Synapse did not become healthy" >&2
-  "${COMPOSE[@]}" logs --tail 60 synapse >&2 || true
-  exit 1
-fi
-
-echo "[dev-up] Synapse UP:"
-echo "         plain HTTP : http://127.0.0.1:${MATRIX_HTTP_PORT}"
-echo "         TLS        : https://127.0.0.1:${MATRIX_TLS_PORT} (self-signed, DEV)"
-echo "         server_name: ${MATRIX_SERVER_NAME}   registration: OFF"

infra/matrix/docker-compose.dev.yml

@@ -1,60 +0,0 @@
-# ============================================================================
-# docker-compose.dev.yml — Synapse DEV homeserver for RFC-001 P1 (presence)
-# ============================================================================
-#
-#   *** DEV-ONLY. LOCAL SANDBOX. Do NOT point this at, or run alongside, any
-#       live/production homeserver. ***
-#
-# Single-instance Synapse (RFC-002 Mode B, federation OFF) + an optional
-# Element web client for the human view (A4). Brought up by ./dev-up.sh, which
-# renders config into ./.data (gitignored) first.
-#
-# Isolated by design: dedicated project name + network + high host ports so it
-# never collides with other stacks on the box (A5).
-#
-#   Host ports:  ${MATRIX_HTTP_PORT:-18008}  -> Synapse 8008 (plain HTTP)
-#                ${MATRIX_TLS_PORT:-18448}   -> Synapse 8448 (self-signed TLS)
-#                ${ELEMENT_PORT:-18080}      -> Element web (profile: element)
-# ----------------------------------------------------------------------------
-name: matrix-p1-dev
-
-services:
-  synapse:
-    image: matrixdotorg/synapse:latest
-    container_name: matrix-p1-synapse
-    restart: 'no'
-    # Run against the rendered config in /data (dev-up.sh puts it there).
-    environment:
-      SYNAPSE_CONFIG_DIR: /data
-      SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
-    volumes:
-      - ./.data:/data
-    ports:
-      - '127.0.0.1:${MATRIX_HTTP_PORT:-18008}:8008'
-      - '127.0.0.1:${MATRIX_TLS_PORT:-18448}:8448'
-    networks:
-      - matrix-p1-net
-    healthcheck:
-      test: ['CMD-SHELL', 'curl -fsS http://localhost:8008/health || exit 1']
-      interval: 3s
-      timeout: 5s
-      retries: 40
-      start_period: 5s
-
-  # Optional human view (A4). `docker compose --profile element up -d element`.
-  element:
-    image: vectorim/element-web:latest
-    container_name: matrix-p1-element
-    restart: 'no'
-    profiles: [element]
-    volumes:
-      - ./.data/element-config.json:/app/config.json:ro
-    ports:
-      - '127.0.0.1:${ELEMENT_PORT:-18080}:80'
-    networks:
-      - matrix-p1-net
-
-networks:
-  matrix-p1-net:
-    name: matrix-p1-net
-    driver: bridge

infra/matrix/synapse/homeserver.dev.yaml.tpl

@@ -1,84 +0,0 @@
-# ============================================================================
-# homeserver.dev.yaml.tpl — Synapse DEV homeserver config (RFC-002 Mode B)
-# ============================================================================
-#
-#   *** DEV-ONLY. NOT FOR PRODUCTION. ***
-#
-# This is the RFC-001 P1 (presence) single-instance homeserver. It is
-# RFC-002 "Mode B — single-domain" (server_name == homeserver host), with
-# federation OFF (standalone), which is all P1 needs (RFC-002 §9 P1 row).
-#
-# NOTHING here is a production value. Every topology fact is a variable
-# rendered by dev-up.sh from the environment; there is no baked-in fleet
-# domain (RFC-002 G2 "zero hardcoded topology"). The secrets below are
-# throwaway DEV placeholders rendered at bring-up — never reuse them.
-#
-# Rendered by:  infra/matrix/dev-up.sh   (envsubst -> .data/homeserver.yaml)
-# Variables:    MATRIX_SERVER_NAME, MOSAIC_AS_ID (+ dev secrets)
-# ----------------------------------------------------------------------------
-
-server_name: "${MATRIX_SERVER_NAME}"
-pid_file: /data/homeserver.pid
-report_stats: false
-suppress_key_server_warning: true
-
-# --- Listeners -------------------------------------------------------------
-# 8008: plain HTTP (client + federation) for in-container/local tooling.
-# 8448: TLS (self-signed in DEV) — satisfies A1 "reachable over TLS".
-listeners:
-  - port: 8008
-    type: http
-    tls: false
-    bind_addresses: ['0.0.0.0']
-    x_forwarded: true
-    resources:
-      - names: [client, federation]
-        compress: false
-
-  - port: 8448
-    type: http
-    tls: true
-    bind_addresses: ['0.0.0.0']
-    resources:
-      - names: [client, federation]
-        compress: false
-
-# --- DEV TLS (self-signed; generated by dev-up.sh) -------------------------
-tls_certificate_path: "/data/dev-cert.pem"
-tls_private_key_path: "/data/dev-key.pem"
-
-# --- Store: sqlite is the simplest dev store (RFC-002 §1 allows it) --------
-database:
-  name: sqlite3
-  args:
-    database: /data/homeserver.db
-
-log_config: "/data/log.config"
-media_store_path: /data/media_store
-signing_key_path: "/data/${MATRIX_SERVER_NAME}.signing.key"
-
-# --- Hardening (RFC-001 §8 / RFC-002 §8.5), rendered so a dev gets it ------
-# Registration is OFF: agents come ONLY via the appservice (A1). AS user
-# registration bypasses this flag, which is exactly the design.
-enable_registration: false
-enable_registration_without_verification: false
-registration_shared_secret: "${SYNAPSE_REG_SHARED_SECRET}"
-macaroon_secret_key: "${SYNAPSE_MACAROON_SECRET}"
-form_secret: "${SYNAPSE_FORM_SECRET}"
-
-# Presence EDUs ON so Element shows the native dot for humans (RFC-001 §4.5);
-# the AUTHORITATIVE liveness is still the mosaic.presence heartbeat.
-presence:
-  enabled: true
-
-# --- Federation: OFF for P1 (standalone). Empty whitelist = federate with
-# nobody (RFC-002 §2.4 / NG5). No public-network federation. ----------------
-federation_domain_whitelist: []
-trusted_key_servers: []
-
-# --- Appservice registration wired in (A1). The file is rendered next to
-# this one by dev-up.sh. -----------------------------------------------------
-app_service_config_files:
-  - "/data/${MOSAIC_AS_ID}.yaml"
-
-# Keep default rate-limiting ON (RFC-001 §8). No overrides here.

infra/matrix/synapse/log.config

@@ -1,16 +0,0 @@
-# Synapse DEV log config. DEV-ONLY.
-version: 1
-formatters:
-  precise:
-    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
-handlers:
-  console:
-    class: logging.StreamHandler
-    formatter: precise
-loggers:
-  synapse.storage.SQL:
-    level: WARNING
-root:
-  level: INFO
-  handlers: [console]
-disable_existing_loggers: false

packages/comms/README.md

@@ -1,41 +0,0 @@
-# @mosaicstack/comms
-
-MACP presence SDK — the **P1 (presence)** slice of RFC-001 (§4.5 liveness,
-§4.2 event envelope). Minimal by design: set Matrix presence, run the
-`mosaic.presence` heartbeat, and compute **deterministic** fleet liveness.
-
-Out of P1 scope (later phases): enrollment/auto-detect, room taxonomy,
-per-agent token minting, signed-authorship, federation.
-
-## API
-
-- `classifyLiveness(ageMs, policy)` / `computeFleetLiveness(observations, now, policy)`
-  — pure, deterministic online/away/offline from heartbeat age. The
-  authoritative liveness source (RFC-001 §4.5): native Matrix presence is _not_
-  relied upon.
-- `HeartbeatEmitter` / `startHeartbeatLoop(...)` — build and drive the
-  `mosaic.presence` heartbeat (monotonic `seq`, `interval_ms`).
-- `MinimalMatrixClient` — tiny C-S client: `setPresence`, `sendHeartbeat`,
-  `readHeartbeats`, `joinRoom`. Supports Application-Service masquerade
-  (`actAsUserId`) for the P1 provisioner, or a per-agent `accessToken`.
-- `PresenceAgent` — high-level: join the fleet room, go present, heartbeat.
-  `pauseHeartbeat()` models a crash (no graceful signal).
-- `FleetLivenessReader` — reads the fleet room and computes the liveness board
-  (`read()` / `formatBoard()`), the surface a human or watchdog reads.
-
-## Liveness policy (RFC-001 §4.5)
-
-```
-online : age <= heartbeatIntervalMs * missTolerance
-away   : age <  darkThresholdMs
-offline: otherwise (or never-seen / non-finite age -> fail safe to offline)
-```
-
-Defaults: interval 30s, miss-tolerance 2, dark-threshold 10min
-(`DEFAULT_LIVENESS_POLICY`). All runtime-tunable per RFC-002 §5.3.
-
-## Tests
-
-`pnpm --filter @mosaicstack/comms test` — the liveness core is written
-RED-FIRST; an end-to-end proof against a real Synapse lives in
-`tools/matrix-presence-harness`.

packages/comms/package.json

@@ -1,37 +0,0 @@
-{
-  "name": "@mosaicstack/comms",
-  "version": "0.0.1",
-  "type": "module",
-  "repository": {
-    "type": "git",
-    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
-    "directory": "packages/comms"
-  },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
-  },
-  "scripts": {
-    "build": "tsc",
-    "lint": "eslint src",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^2.0.0",
-    "typescript": "^5.8.0",
-    "vitest": "^2.0.0"
-  },
-  "publishConfig": {
-    "registry": "https://git.mosaicstack.dev/api/packages/mosaicstack/npm/",
-    "access": "public"
-  },
-  "files": [
-    "dist"
-  ]
-}

packages/comms/src/__tests__/heartbeat.test.ts

@@ -1,90 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { HeartbeatEmitter, startHeartbeatLoop } from '../heartbeat.js';
-import type { PresenceHeartbeatContent } from '../types.js';
-
-const agent = { mxid: '@agent-alpha:matrix.localhost', slug: 'alpha', harness: 'claude-code' };
-
-describe('HeartbeatEmitter', () => {
-  it('increments seq starting at 1 and stamps the envelope', () => {
-    let t = 1000;
-    const em = new HeartbeatEmitter({ agent, intervalMs: 5000, now: () => t });
-    const a = em.next();
-    t = 6000;
-    const b = em.next('away');
-
-    expect(a.seq).toBe(1);
-    expect(a.ts).toBe(1000);
-    expect(a.status).toBe('online');
-    expect(a.macp_type).toBe('presence');
-    expect(a.msgtype).toBe('mosaic.presence');
-    expect(a.macp_version).toBe('1.0');
-    expect(a.interval_ms).toBe(5000);
-    expect(a.agent).toEqual(agent);
-    expect(a.body).toContain('alpha');
-
-    expect(b.seq).toBe(2);
-    expect(b.ts).toBe(6000);
-    expect(b.status).toBe('away');
-    expect(em.currentSeq).toBe(2);
-  });
-
-  it('includes mission_id only when provided', () => {
-    const withMission = new HeartbeatEmitter({
-      agent,
-      intervalMs: 1000,
-      missionId: 'KBN-101',
-    }).next();
-    const without = new HeartbeatEmitter({ agent, intervalMs: 1000 }).next();
-    expect(withMission.mission_id).toBe('KBN-101');
-    expect(without.mission_id).toBeUndefined();
-  });
-});
-
-describe('startHeartbeatLoop', () => {
-  afterEach(() => vi.useRealTimers());
-
-  it('emits immediately, then once per interval, until stopped', () => {
-    vi.useFakeTimers();
-    const sent: PresenceHeartbeatContent[] = [];
-    const em = new HeartbeatEmitter({ agent, intervalMs: 1000, now: () => Date.now() });
-    const loop = startHeartbeatLoop({
-      emitter: em,
-      intervalMs: 1000,
-      send: (c) => {
-        sent.push(c);
-      },
-    });
-
-    expect(sent).toHaveLength(1); // immediate beat
-    vi.advanceTimersByTime(3000);
-    expect(sent).toHaveLength(4); // +3 beats
-    expect(sent.map((s) => s.seq)).toEqual([1, 2, 3, 4]);
-
-    loop.stop();
-    vi.advanceTimersByTime(5000);
-    expect(sent).toHaveLength(4); // no more after stop
-    loop.stop(); // idempotent
-  });
-
-  it('routes a rejected async send to onError without killing the loop', async () => {
-    vi.useFakeTimers();
-    const onError = vi.fn();
-    let n = 0;
-    const em = new HeartbeatEmitter({ agent, intervalMs: 1000 });
-    const loop = startHeartbeatLoop({
-      emitter: em,
-      intervalMs: 1000,
-      onError,
-      send: () => {
-        n += 1;
-        return Promise.reject(new Error(`boom ${n}`));
-      },
-    });
-
-    await vi.advanceTimersByTimeAsync(2000); // immediate + 2
-    expect(n).toBe(3);
-    expect(onError).toHaveBeenCalledTimes(3);
-    loop.stop();
-  });
-});

packages/comms/src/__tests__/liveness.test.ts

@@ -1,89 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { classifyLiveness, computeFleetLiveness } from '../liveness.js';
-import type { HeartbeatObservation, LivenessPolicy } from '../types.js';
-
-// Small, dev-scale policy so the arithmetic is obvious:
-//   online window = interval * missTolerance = 1000 * 2 = 2000ms
-//   dark threshold = 5000ms
-const policy: LivenessPolicy = {
-  heartbeatIntervalMs: 1000,
-  missTolerance: 2,
-  darkThresholdMs: 5000,
-};
-
-describe('classifyLiveness (deterministic, heartbeat-age based — RFC-001 §4.5)', () => {
-  it('is online when age is within interval * missTolerance', () => {
-    expect(classifyLiveness(0, policy)).toBe('online');
-    expect(classifyLiveness(1999, policy)).toBe('online');
-    expect(classifyLiveness(2000, policy)).toBe('online'); // inclusive boundary
-  });
-
-  it('is away when past the online window but before dark threshold', () => {
-    expect(classifyLiveness(2001, policy)).toBe('away');
-    expect(classifyLiveness(4999, policy)).toBe('away');
-  });
-
-  it('is offline/dark at or past the dark threshold', () => {
-    expect(classifyLiveness(5000, policy)).toBe('offline');
-    expect(classifyLiveness(50_000, policy)).toBe('offline');
-  });
-
-  it('treats a never-seen agent (Infinity age) as offline', () => {
-    expect(classifyLiveness(Number.POSITIVE_INFINITY, policy)).toBe('offline');
-  });
-
-  it('never returns online for a negative-but-huge misconfig (guards NaN)', () => {
-    // A NaN age must fail safe to offline, not silently report online.
-    expect(classifyLiveness(Number.NaN, policy)).toBe('offline');
-  });
-});
-
-describe('computeFleetLiveness (A2/A3 core)', () => {
-  const now = 100_000;
-  const obs = (slug: string, lastSeenTs: number, lastSeq = 1): HeartbeatObservation => ({
-    slug,
-    mxid: `@agent-${slug}:matrix.localhost`,
-    lastSeenTs,
-    lastSeq,
-    assertedStatus: 'online',
-  });
-
-  it('classifies a live fleet: fresh=online, stale=away, dark=offline', () => {
-    const result = computeFleetLiveness(
-      [
-        obs('alpha', now - 500), // 500ms old  -> online
-        obs('bravo', now - 3000), // 3000ms old -> away
-        obs('charlie', now - 8000), // 8000ms old -> offline
-      ],
-      now,
-      policy,
-    );
-    const byslug = Object.fromEntries(result.map((r) => [r.slug, r.status]));
-    expect(byslug).toEqual({ alpha: 'online', bravo: 'away', charlie: 'offline' });
-  });
-
-  it('A3: a previously-online agent flips to offline once age crosses dark threshold', () => {
-    const lastBeat = 100_000; // agent was hard-killed right after this beat
-    // Just before the threshold it is still merely "away"...
-    const justBefore = computeFleetLiveness([obs('victim', lastBeat, 7)], lastBeat + 4999, policy);
-    expect(justBefore[0]?.status).toBe('away');
-    // ...and the instant age reaches darkThresholdMs it is deterministically offline,
-    // with no dependence on native Matrix presence timeouts.
-    const atThreshold = computeFleetLiveness([obs('victim', lastBeat, 7)], lastBeat + 5000, policy);
-    expect(atThreshold[0]?.status).toBe('offline');
-    expect(atThreshold[0]?.ageMs).toBe(5000);
-    expect(atThreshold[0]?.lastSeq).toBe(7);
-  });
-
-  it('reports ageMs and preserves mxid/slug/seq for the human view', () => {
-    const [row] = computeFleetLiveness([obs('alpha', now - 1200, 42)], now, policy);
-    expect(row).toMatchObject({
-      slug: 'alpha',
-      mxid: '@agent-alpha:matrix.localhost',
-      ageMs: 1200,
-      lastSeq: 42,
-      status: 'online',
-    });
-  });
-});

packages/comms/src/__tests__/matrix-client.test.ts

@@ -1,131 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-
-import { MatrixError, MinimalMatrixClient, toMatrixPresence } from '../matrix-client.js';
-
-const jsonResponse = (status: number, body: unknown): Response =>
-  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
-
-// A fetch mock typed with the (URL, RequestInit?) shape the client actually
-// calls, so mock.calls has a proper tuple type under noUncheckedIndexedAccess.
-const mkFetch = (impl: (url: URL, init?: RequestInit) => Promise<Response>) => vi.fn(impl);
-
-const cfg = {
-  homeserverUrl: 'https://matrix.localhost:8448',
-  accessToken: 'as-secret',
-  actAsUserId: '@agent-alpha:matrix.localhost',
-};
-
-describe('toMatrixPresence', () => {
-  it('maps liveness states to native presence EDU values', () => {
-    expect(toMatrixPresence('online')).toBe('online');
-    expect(toMatrixPresence('away')).toBe('unavailable');
-    expect(toMatrixPresence('offline')).toBe('offline');
-  });
-});
-
-describe('MinimalMatrixClient', () => {
-  it('setPresence PUTs native presence and masquerades via user_id', async () => {
-    const fetchMock = mkFetch(async () => jsonResponse(200, {}));
-    const client = new MinimalMatrixClient(cfg, fetchMock as unknown as typeof fetch);
-    await client.setPresence('@agent-alpha:matrix.localhost', 'away', 'hb');
-
-    const [url, init] = fetchMock.mock.calls[0]!;
-    const u = new URL((url as URL).toString());
-    expect(u.pathname).toBe('/_matrix/client/v3/presence/%40agent-alpha%3Amatrix.localhost/status');
-    expect(u.searchParams.get('user_id')).toBe('@agent-alpha:matrix.localhost');
-    expect(JSON.parse((init as RequestInit).body as string)).toEqual({
-      presence: 'unavailable',
-      status_msg: 'hb',
-    });
-    expect((init as RequestInit).method).toBe('PUT');
-  });
-
-  it('sendHeartbeat posts an m.room.message and returns the event_id', async () => {
-    const fetchMock = mkFetch(async () => jsonResponse(200, { event_id: '$evt1' }));
-    const client = new MinimalMatrixClient(cfg, fetchMock as unknown as typeof fetch);
-    const id = await client.sendHeartbeat('!room:matrix.localhost', {
-      macp_version: '1.0',
-      macp_type: 'presence',
-      msgtype: 'mosaic.presence',
-      agent: { mxid: cfg.actAsUserId, slug: 'alpha', harness: 'claude-code' },
-      ts: 1,
-      body: 'alpha online (seq 1)',
-      status: 'online',
-      seq: 1,
-      interval_ms: 1000,
-    });
-    expect(id).toBe('$evt1');
-    const [url] = fetchMock.mock.calls[0]!;
-    expect((url as URL).pathname).toContain('/rooms/!room%3Amatrix.localhost/send/m.room.message/');
-  });
-
-  it('throws a MatrixError carrying errcode on a non-2xx', async () => {
-    const fetchMock = mkFetch(async () =>
-      jsonResponse(403, { errcode: 'M_FORBIDDEN', error: 'nope' }),
-    );
-    const client = new MinimalMatrixClient(cfg, fetchMock as unknown as typeof fetch);
-    await expect(client.whoami()).rejects.toMatchObject({
-      name: 'MatrixError',
-      status: 403,
-      errcode: 'M_FORBIDDEN',
-    });
-    await expect(client.whoami()).rejects.toBeInstanceOf(MatrixError);
-  });
-
-  it('readHeartbeats reduces the timeline to the latest beat per agent', async () => {
-    // Timeline (dir=b => most-recent first). alpha has two beats; keep highest seq.
-    const chunk = [
-      {
-        sender: '@agent-bravo:matrix.localhost',
-        origin_server_ts: 9000,
-        content: {
-          msgtype: 'mosaic.presence',
-          agent: { slug: 'bravo', mxid: '@agent-bravo:matrix.localhost' },
-          seq: 5,
-          status: 'online',
-          ts: 8999,
-        },
-      },
-      {
-        sender: '@agent-alpha:matrix.localhost',
-        origin_server_ts: 8000,
-        content: {
-          msgtype: 'mosaic.presence',
-          agent: { slug: 'alpha', mxid: '@agent-alpha:matrix.localhost' },
-          seq: 12,
-          status: 'online',
-          ts: 7999,
-        },
-      },
-      {
-        // an ordinary chat message must be ignored
-        sender: '@human:matrix.localhost',
-        origin_server_ts: 7000,
-        content: { msgtype: 'm.text', body: 'hi' },
-      },
-      {
-        sender: '@agent-alpha:matrix.localhost',
-        origin_server_ts: 6000,
-        content: {
-          msgtype: 'mosaic.presence',
-          agent: { slug: 'alpha', mxid: '@agent-alpha:matrix.localhost' },
-          seq: 11,
-          status: 'online',
-          ts: 5999,
-        },
-      },
-    ];
-    const fetchMock = mkFetch(async () => jsonResponse(200, { chunk }));
-    const client = new MinimalMatrixClient(cfg, fetchMock as unknown as typeof fetch);
-    const obs = await client.readHeartbeats('!room:matrix.localhost');
-
-    const bySlug = Object.fromEntries(obs.map((o) => [o.slug, o]));
-    expect(Object.keys(bySlug).sort()).toEqual(['alpha', 'bravo']);
-    expect(bySlug.alpha).toMatchObject({ lastSeq: 12, lastSeenTs: 8000 }); // highest seq wins, server ts
-    expect(bySlug.bravo).toMatchObject({ lastSeq: 5, lastSeenTs: 9000 });
-
-    const [url] = fetchMock.mock.calls[0]!;
-    const u = new URL((url as URL).toString());
-    expect(u.searchParams.get('dir')).toBe('b');
-  });
-});

packages/comms/src/__tests__/presence-flow.test.ts

@@ -1,151 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { FleetLivenessReader } from '../liveness-reader.js';
-import type { MinimalMatrixClient } from '../matrix-client.js';
-import { PresenceAgent } from '../presence-agent.js';
-import type { HeartbeatObservation, LivenessPolicy, PresenceStatus } from '../types.js';
-
-/**
- * An in-memory fake homeserver room: records heartbeats with a controllable
- * server clock and reduces them exactly like the real readHeartbeats. Lets us
- * prove the PresenceAgent -> room -> FleetLivenessReader flow (including the A3
- * hard-kill -> offline transition) deterministically, with no network.
- */
-class FakeRoomClient {
-  readonly beats: Array<{
-    slug: string;
-    mxid: string;
-    seq: number;
-    ts: number;
-    status: PresenceStatus;
-  }> = [];
-  presence: Record<string, PresenceStatus> = {};
-
-  constructor(private readonly clock: () => number) {}
-
-  async joinRoom(roomId: string): Promise<string> {
-    return roomId;
-  }
-  async setPresence(userId: string, status: PresenceStatus): Promise<void> {
-    this.presence[userId] = status;
-  }
-  async sendHeartbeat(
-    _roomId: string,
-    content: { agent: { slug: string; mxid: string }; seq: number; status: PresenceStatus },
-  ): Promise<string> {
-    this.beats.push({
-      slug: content.agent.slug,
-      mxid: content.agent.mxid,
-      seq: content.seq,
-      ts: this.clock(), // server receive time
-      status: content.status,
-    });
-    return `$evt${this.beats.length}`;
-  }
-  async readHeartbeats(): Promise<HeartbeatObservation[]> {
-    const bySlug = new Map<string, HeartbeatObservation>();
-    for (const b of this.beats) {
-      const prev = bySlug.get(b.slug);
-      if (!prev || b.seq > prev.lastSeq) {
-        bySlug.set(b.slug, {
-          slug: b.slug,
-          mxid: b.mxid,
-          lastSeenTs: b.ts,
-          lastSeq: b.seq,
-          assertedStatus: b.status,
-        });
-      }
-    }
-    return [...bySlug.values()];
-  }
-}
-
-const policy: LivenessPolicy = {
-  heartbeatIntervalMs: 1000,
-  missTolerance: 2,
-  darkThresholdMs: 5000,
-};
-
-describe('presence flow (A2 + A3 at unit level)', () => {
-  afterEach(() => vi.useRealTimers());
-
-  it('shows agents online while beating, then A3: a hard-killed agent goes offline within dark_threshold', async () => {
-    vi.useFakeTimers();
-    vi.setSystemTime(0);
-
-    const fake = new FakeRoomClient(() => Date.now());
-    const client = fake as unknown as MinimalMatrixClient;
-    const reader = new FleetLivenessReader({
-      client,
-      roomId: '!fleet',
-      policy,
-      now: () => Date.now(),
-    });
-
-    const mk = (slug: string) =>
-      new PresenceAgent({
-        client,
-        agent: { mxid: `@agent-${slug}:matrix.localhost`, slug, harness: 'claude-code' },
-        roomId: '!fleet',
-        intervalMs: 1000,
-        policy,
-      });
-
-    const alpha = mk('alpha');
-    const bravo = mk('bravo');
-    const charlie = mk('charlie');
-
-    for (const a of [alpha, bravo, charlie]) {
-      await a.connect();
-      a.start();
-    }
-    // native presence set online for all three (Element dot)
-    expect(fake.presence['@agent-alpha:matrix.localhost']).toBe('online');
-
-    // let a couple of beats flow — all three fresh => online (A2)
-    await vi.advanceTimersByTimeAsync(1500);
-    const board1 = Object.fromEntries((await reader.read()).map((r) => [r.slug, r.status]));
-    expect(board1).toEqual({ alpha: 'online', bravo: 'online', charlie: 'online' });
-
-    // HARD-KILL charlie: stop its loop, no more beats. alpha/bravo keep beating.
-    charlie.pauseHeartbeat(); // hard-kill: no graceful presence signal
-
-    // advance to just before dark threshold from charlie's last beat...
-    await vi.advanceTimersByTimeAsync(3000);
-    const mid = Object.fromEntries((await reader.read()).map((r) => [r.slug, r.status]));
-    expect(mid.alpha).toBe('online');
-    expect(mid.charlie).not.toBe('online'); // already stale (away)
-
-    // ...advance past dark_threshold: charlie is deterministically offline.
-    await vi.advanceTimersByTimeAsync(4000);
-    const final = await reader.read();
-    const byslug = Object.fromEntries(final.map((r) => [r.slug, r]));
-    expect(byslug.charlie!.status).toBe('offline');
-    expect(byslug.alpha!.status).toBe('online');
-    expect(byslug.bravo!.status).toBe('online');
-
-    for (const a of [alpha, bravo]) await a.stop();
-  });
-
-  it('formatBoard renders a human-readable liveness board (A4)', async () => {
-    const fake = new FakeRoomClient(() => 10_000);
-    fake.beats.push({
-      slug: 'alpha',
-      mxid: '@agent-alpha:matrix.localhost',
-      seq: 3,
-      ts: 9_500,
-      status: 'online',
-    });
-    const reader = new FleetLivenessReader({
-      client: fake as unknown as MinimalMatrixClient,
-      roomId: '!fleet',
-      policy,
-      now: () => 10_000,
-    });
-    const board = await reader.formatBoard();
-    expect(board).toContain('Fleet presence');
-    expect(board).toContain('alpha');
-    expect(board).toContain('online');
-    expect(board).toContain('online=1');
-  });
-});

packages/comms/src/heartbeat.ts

@@ -1,124 +0,0 @@
-/**
- * `mosaic.presence` heartbeat construction and loop (RFC-001 §4.2/§4.5).
- *
- * The emitter is deterministic and side-effect free (easy to unit test): it
- * owns the monotonic `seq` and stamps each beat. The loop wires the emitter to
- * a sender on an interval; timers are injectable so the loop is testable with
- * fake clocks.
- */
-
-import { MACP_VERSION, type PresenceHeartbeatContent, type PresenceStatus } from './types.js';
-
-export interface HeartbeatAgentIdentity {
-  mxid: string;
-  slug: string;
-  harness: string;
-}
-
-export interface HeartbeatEmitterOptions {
-  agent: HeartbeatAgentIdentity;
-  /** Nominal interval advertised in each beat (interval_ms). */
-  intervalMs: number;
-  /** Optional mission correlation (RFC-001 §4.2 envelope). */
-  missionId?: string;
-  /** Injectable clock for deterministic tests. Default Date.now. */
-  now?: () => number;
-}
-
-/**
- * Produces successive heartbeat contents with a monotonically increasing seq.
- * The first `next()` returns seq=1.
- */
-export class HeartbeatEmitter {
-  private seq = 0;
-  private readonly now: () => number;
-
-  constructor(private readonly opts: HeartbeatEmitterOptions) {
-    this.now = opts.now ?? Date.now;
-  }
-
-  /** Current sequence number (0 before the first beat). */
-  get currentSeq(): number {
-    return this.seq;
-  }
-
-  /** Build the next heartbeat content, advancing the sequence. */
-  next(status: PresenceStatus = 'online'): PresenceHeartbeatContent {
-    this.seq += 1;
-    const ts = this.now();
-    const content: PresenceHeartbeatContent = {
-      macp_version: MACP_VERSION,
-      macp_type: 'presence',
-      msgtype: 'mosaic.presence',
-      agent: {
-        mxid: this.opts.agent.mxid,
-        slug: this.opts.agent.slug,
-        harness: this.opts.agent.harness,
-      },
-      ts,
-      body: `${this.opts.agent.slug} ${status} (seq ${this.seq})`,
-      status,
-      seq: this.seq,
-      interval_ms: this.opts.intervalMs,
-    };
-    if (this.opts.missionId !== undefined) {
-      content.mission_id = this.opts.missionId;
-    }
-    return content;
-  }
-}
-
-export type HeartbeatSender = (content: PresenceHeartbeatContent) => void | Promise<void>;
-
-export interface HeartbeatLoopOptions {
-  emitter: HeartbeatEmitter;
-  send: HeartbeatSender;
-  intervalMs: number;
-  /** Status supplier evaluated each beat. Default: always 'online'. */
-  status?: () => PresenceStatus;
-  /** Called if a beat's send rejects (so a transient failure doesn't kill the loop). */
-  onError?: (err: unknown) => void;
-  /** Injectable timer (tests). Defaults to global setInterval/clearInterval. */
-  setIntervalFn?: (cb: () => void, ms: number) => unknown;
-  clearIntervalFn?: (handle: unknown) => void;
-}
-
-/** A running heartbeat loop; call stop() to end it. */
-export interface HeartbeatLoopHandle {
-  stop: () => void;
-}
-
-/**
- * Start a heartbeat loop: emits one beat immediately, then every intervalMs.
- * Returns a handle whose `stop()` is idempotent.
- */
-export function startHeartbeatLoop(opts: HeartbeatLoopOptions): HeartbeatLoopHandle {
-  const status = opts.status ?? (() => 'online' as PresenceStatus);
-  const onError = opts.onError ?? (() => {});
-  const setIntervalFn = opts.setIntervalFn ?? ((cb, ms) => setInterval(cb, ms));
-  const clearIntervalFn =
-    opts.clearIntervalFn ?? ((h) => clearInterval(h as ReturnType<typeof setInterval>));
-
-  const beat = (): void => {
-    try {
-      const result = opts.send(opts.emitter.next(status()));
-      if (result instanceof Promise) {
-        result.catch(onError);
-      }
-    } catch (err) {
-      onError(err);
-    }
-  };
-
-  beat(); // immediate first beat so liveness is fresh at once
-  const handle = setIntervalFn(beat, opts.intervalMs);
-
-  let stopped = false;
-  return {
-    stop: () => {
-      if (stopped) return;
-      stopped = true;
-      clearIntervalFn(handle);
-    },
-  };
-}

packages/comms/src/index.ts

@@ -1,42 +0,0 @@
-/**
- * @mosaicstack/comms — MACP presence SDK (RFC-001 P1).
- *
- * Minimal, dev-validated slice: set Matrix presence, run the `mosaic.presence`
- * heartbeat, and compute deterministic fleet liveness. Enrollment, room
- * taxonomy, token minting and signed-authorship are explicitly out of P1.
- */
-
-export { classifyLiveness, computeFleetLiveness } from './liveness.js';
-
-export {
-  HeartbeatEmitter,
-  startHeartbeatLoop,
-  type HeartbeatAgentIdentity,
-  type HeartbeatEmitterOptions,
-  type HeartbeatSender,
-  type HeartbeatLoopOptions,
-  type HeartbeatLoopHandle,
-} from './heartbeat.js';
-
-export {
-  MinimalMatrixClient,
-  MatrixError,
-  toMatrixPresence,
-  type MatrixClientConfig,
-} from './matrix-client.js';
-
-export { FleetLivenessReader, type FleetLivenessReaderOptions } from './liveness-reader.js';
-
-export { PresenceAgent, type PresenceAgentOptions } from './presence-agent.js';
-
-export {
-  DEFAULT_LIVENESS_POLICY,
-  MACP_VERSION,
-  type AgentLiveness,
-  type HeartbeatObservation,
-  type LivenessPolicy,
-  type MacpEnvelope,
-  type MatrixPresence,
-  type PresenceHeartbeatContent,
-  type PresenceStatus,
-} from './types.js';

packages/comms/src/liveness-reader.ts

@@ -1,58 +0,0 @@
-/**
- * Fleet liveness reader (RFC-001 §4.5, A2/A4).
- *
- * Reads `mosaic.presence` heartbeats from the fleet presence room and computes
- * deterministic online/away/offline for every agent. This is the surface a
- * human (or the escalation watchdog, P2+) reads to answer "who's alive?".
- */
-
-import { computeFleetLiveness } from './liveness.js';
-import type { MinimalMatrixClient } from './matrix-client.js';
-import { DEFAULT_LIVENESS_POLICY, type AgentLiveness, type LivenessPolicy } from './types.js';
-
-export interface FleetLivenessReaderOptions {
-  client: MinimalMatrixClient;
-  /** The fleet presence room (id or resolved id). */
-  roomId: string;
-  policy?: LivenessPolicy;
-  /** Injectable clock for tests. Default Date.now. */
-  now?: () => number;
-  /** How many timeline events to scan back. Default 200. */
-  scanLimit?: number;
-}
-
-export class FleetLivenessReader {
-  private readonly policy: LivenessPolicy;
-  private readonly now: () => number;
-
-  constructor(private readonly opts: FleetLivenessReaderOptions) {
-    this.policy = opts.policy ?? DEFAULT_LIVENESS_POLICY;
-    this.now = opts.now ?? Date.now;
-  }
-
-  /** Read the room and compute current liveness for every seen agent. */
-  async read(): Promise<AgentLiveness[]> {
-    const observations = await this.opts.client.readHeartbeats(
-      this.opts.roomId,
-      this.opts.scanLimit ?? 200,
-    );
-    return computeFleetLiveness(observations, this.now(), this.policy);
-  }
-
-  /** A compact human-readable liveness board (A4 CLI view). */
-  async formatBoard(): Promise<string> {
-    const rows = await this.read();
-    rows.sort((a, b) => a.slug.localeCompare(b.slug));
-    const dot: Record<string, string> = { online: '🟢', away: '🟡', offline: '🔴' };
-    const lines = rows.map(
-      (r) =>
-        `${dot[r.status] ?? '⚪'} ${r.slug.padEnd(16)} ${r.status.padEnd(8)} ` +
-        `age=${(r.ageMs / 1000).toFixed(1)}s seq=${r.lastSeq} ${r.mxid}`,
-    );
-    const summary =
-      `online=${rows.filter((r) => r.status === 'online').length} ` +
-      `away=${rows.filter((r) => r.status === 'away').length} ` +
-      `offline=${rows.filter((r) => r.status === 'offline').length}`;
-    return [`Fleet presence — ${summary}`, ...lines].join('\n');
-  }
-}

packages/comms/src/liveness.ts

@@ -1,63 +0,0 @@
-/**
- * Deterministic liveness computation (RFC-001 §4.5).
- *
- * The authoritative liveness signal is the `mosaic.presence` heartbeat, NOT
- * native Matrix presence. Given the age of an agent's last heartbeat and a
- * policy, these pure functions classify online/away/offline the same way every
- * time — which is exactly what makes the A3 "hard-killed agent flips to
- * offline within dark_threshold" guarantee deterministic and testable without
- * standing up a homeserver.
- */
-
-import type {
-  AgentLiveness,
-  HeartbeatObservation,
-  LivenessPolicy,
-  PresenceStatus,
-} from './types.js';
-
-/**
- * Classify a single agent from the age (ms) of its last heartbeat.
- *
- * - `age <= heartbeatIntervalMs * missTolerance` → **online**
- * - `age <  darkThresholdMs`                      → **away**
- * - otherwise (or non-finite age)                 → **offline / dark**
- *
- * A non-finite age (never seen / NaN) fails safe to `offline`: we never assert
- * a liveness we cannot substantiate.
- */
-export function classifyLiveness(ageMs: number, policy: LivenessPolicy): PresenceStatus {
-  if (!Number.isFinite(ageMs)) {
-    return 'offline';
-  }
-  const onlineWindowMs = policy.heartbeatIntervalMs * policy.missTolerance;
-  if (ageMs <= onlineWindowMs) {
-    return 'online';
-  }
-  if (ageMs < policy.darkThresholdMs) {
-    return 'away';
-  }
-  return 'offline';
-}
-
-/**
- * Compute liveness for every observed agent at wall-clock `nowMs`.
- * The result order mirrors the input order (stable for display).
- */
-export function computeFleetLiveness(
-  observations: readonly HeartbeatObservation[],
-  nowMs: number,
-  policy: LivenessPolicy,
-): AgentLiveness[] {
-  return observations.map((o) => {
-    const ageMs = nowMs - o.lastSeenTs;
-    return {
-      slug: o.slug,
-      mxid: o.mxid,
-      status: classifyLiveness(ageMs, policy),
-      lastSeenTs: o.lastSeenTs,
-      ageMs,
-      lastSeq: o.lastSeq,
-    };
-  });
-}

packages/comms/src/matrix-client.ts

@@ -1,204 +0,0 @@
-/**
- * Minimal Matrix Client-Server API client for the P1 presence slice.
- *
- * Deliberately tiny: only the calls presence needs (whoami, set native
- * presence, send a timeline event, read recent timeline). Auth is a single
- * bearer token; an optional `actAsUserId` enables Application-Service
- * masquerade (`?user_id=`) so the P1 provisioner can drive several virtual
- * agents with one as_token in dev (RFC-001 §2.2 step 4/Appendix A). Agents
- * holding their own access_token simply omit `actAsUserId`.
- *
- * `fetch` is injectable for unit tests.
- */
-
-import crypto from 'node:crypto';
-
-import type {
-  HeartbeatObservation,
-  MatrixPresence,
-  PresenceHeartbeatContent,
-  PresenceStatus,
-} from './types.js';
-
-export interface MatrixClientConfig {
-  /** Client-Server API base, e.g. https://matrix.localhost:8448 */
-  homeserverUrl: string;
-  /** Bearer token (a per-agent access_token, or an as_token for masquerade). */
-  accessToken: string;
-  /** If set, all calls masquerade as this MXID via ?user_id= (AS mode). */
-  actAsUserId?: string;
-}
-
-export class MatrixError extends Error {
-  constructor(
-    readonly status: number,
-    readonly errcode: string | undefined,
-    message: string,
-  ) {
-    super(message);
-    this.name = 'MatrixError';
-  }
-}
-
-type FetchLike = typeof fetch;
-
-/** Map our authoritative liveness state to the native Matrix presence EDU. */
-export function toMatrixPresence(status: PresenceStatus): MatrixPresence {
-  switch (status) {
-    case 'online':
-      return 'online';
-    case 'away':
-      return 'unavailable';
-    case 'offline':
-      return 'offline';
-  }
-}
-
-export class MinimalMatrixClient {
-  private readonly fetchImpl: FetchLike;
-
-  constructor(
-    private readonly cfg: MatrixClientConfig,
-    fetchImpl?: FetchLike,
-  ) {
-    this.fetchImpl = fetchImpl ?? fetch;
-  }
-
-  private async request(
-    method: string,
-    path: string,
-    options: { query?: Record<string, string>; body?: unknown } = {},
-  ): Promise<Record<string, unknown>> {
-    const url = new URL(this.cfg.homeserverUrl.replace(/\/$/, '') + path);
-    if (this.cfg.actAsUserId) {
-      url.searchParams.set('user_id', this.cfg.actAsUserId);
-    }
-    for (const [k, v] of Object.entries(options.query ?? {})) {
-      url.searchParams.set(k, v);
-    }
-    const res = await this.fetchImpl(url, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.cfg.accessToken}`,
-        'Content-Type': 'application/json',
-      },
-      body: options.body === undefined ? undefined : JSON.stringify(options.body),
-    });
-    const text = await res.text();
-    const data = (text ? JSON.parse(text) : {}) as Record<string, unknown>;
-    if (!res.ok) {
-      throw new MatrixError(
-        res.status,
-        typeof data.errcode === 'string' ? data.errcode : undefined,
-        `${method} ${path} -> ${res.status}: ${text.slice(0, 300)}`,
-      );
-    }
-    return data;
-  }
-
-  /** GET /account/whoami — resolves the acting MXID. */
-  async whoami(): Promise<string> {
-    const data = await this.request('GET', '/_matrix/client/v3/account/whoami');
-    if (typeof data.user_id !== 'string') {
-      throw new MatrixError(500, undefined, 'whoami returned no user_id');
-    }
-    return data.user_id;
-  }
-
-  /**
-   * Set the native Matrix presence EDU (so Element shows the right dot for
-   * humans). NOT the authoritative liveness signal — the heartbeat is.
-   */
-  async setPresence(userId: string, status: PresenceStatus, statusMsg?: string): Promise<void> {
-    const user = encodeURIComponent(userId);
-    await this.request('PUT', `/_matrix/client/v3/presence/${user}/status`, {
-      body: {
-        presence: toMatrixPresence(status),
-        ...(statusMsg ? { status_msg: statusMsg } : {}),
-      },
-    });
-  }
-
-  /** Send an arbitrary timeline event; returns its event_id. */
-  async sendEvent(
-    roomId: string,
-    eventType: string,
-    content: Record<string, unknown>,
-  ): Promise<string> {
-    const room = encodeURIComponent(roomId);
-    const txn = `mosaic-comms-${crypto.randomUUID()}`;
-    const data = await this.request(
-      'PUT',
-      `/_matrix/client/v3/rooms/${room}/send/${encodeURIComponent(eventType)}/${txn}`,
-      { body: content },
-    );
-    if (typeof data.event_id !== 'string') {
-      throw new MatrixError(500, undefined, 'send returned no event_id');
-    }
-    return data.event_id;
-  }
-
-  /** Post a `mosaic.presence` heartbeat (m.room.message carrier) to the room. */
-  async sendHeartbeat(roomId: string, content: PresenceHeartbeatContent): Promise<string> {
-    return this.sendEvent(roomId, 'm.room.message', content as unknown as Record<string, unknown>);
-  }
-
-  /** Join a room (by id or alias). Idempotent on the server. */
-  async joinRoom(roomIdOrAlias: string): Promise<string> {
-    const data = await this.request(
-      'POST',
-      `/_matrix/client/v3/join/${encodeURIComponent(roomIdOrAlias)}`,
-      { body: {} },
-    );
-    if (typeof data.room_id !== 'string') {
-      throw new MatrixError(500, undefined, 'join returned no room_id');
-    }
-    return data.room_id;
-  }
-
-  /**
-   * Read recent `mosaic.presence` heartbeats from a room and reduce them to the
-   * latest observation per agent. Walks the timeline backwards (most-recent
-   * first) and keeps, per slug, the beat with the highest seq.
-   *
-   * `lastSeenTs` uses the server's `origin_server_ts` (honest "when we last
-   * heard from it"), falling back to the agent-stamped envelope `ts`.
-   */
-  async readHeartbeats(roomId: string, limit = 200): Promise<HeartbeatObservation[]> {
-    const room = encodeURIComponent(roomId);
-    const data = await this.request('GET', `/_matrix/client/v3/rooms/${room}/messages`, {
-      query: { dir: 'b', limit: String(limit) },
-    });
-    const chunk = Array.isArray(data.chunk) ? (data.chunk as Array<Record<string, unknown>>) : [];
-    const bySlug = new Map<string, HeartbeatObservation>();
-
-    for (const ev of chunk) {
-      const content = ev.content as Record<string, unknown> | undefined;
-      if (!content || content.msgtype !== 'mosaic.presence') continue;
-      const agent = content.agent as Record<string, unknown> | undefined;
-      const slug = agent && typeof agent.slug === 'string' ? agent.slug : undefined;
-      const mxid =
-        agent && typeof agent.mxid === 'string'
-          ? agent.mxid
-          : typeof ev.sender === 'string'
-            ? ev.sender
-            : undefined;
-      if (!slug || !mxid) continue;
-
-      const seq = typeof content.seq === 'number' ? content.seq : 0;
-      const serverTs = typeof ev.origin_server_ts === 'number' ? ev.origin_server_ts : undefined;
-      const envelopeTs = typeof content.ts === 'number' ? content.ts : undefined;
-      const lastSeenTs = serverTs ?? envelopeTs ?? 0;
-      const assertedStatus =
-        content.status === 'online' || content.status === 'away' || content.status === 'offline'
-          ? (content.status as PresenceStatus)
-          : 'offline';
-
-      const prev = bySlug.get(slug);
-      if (!prev || seq > prev.lastSeq) {
-        bySlug.set(slug, { slug, mxid, lastSeenTs, lastSeq: seq, assertedStatus });
-      }
-    }
-    return [...bySlug.values()];
-  }
-}

packages/comms/src/presence-agent.ts

@@ -1,92 +0,0 @@
-/**
- * High-level presence agent (RFC-001 §4.1 steps 10–11, §4.5).
- *
- * Ties the pieces together for one agent: join the fleet presence room, set
- * native Matrix presence online (for Element's dot), and run the authoritative
- * `mosaic.presence` heartbeat loop. This is the P1 slice of what a harness does
- * on spin — no enrollment/token-minting/introductions (those are P2).
- */
-
-import {
-  HeartbeatEmitter,
-  startHeartbeatLoop,
-  type HeartbeatAgentIdentity,
-  type HeartbeatLoopHandle,
-} from './heartbeat.js';
-import type { MinimalMatrixClient } from './matrix-client.js';
-import { DEFAULT_LIVENESS_POLICY, type LivenessPolicy, type PresenceStatus } from './types.js';
-
-export interface PresenceAgentOptions {
-  client: MinimalMatrixClient;
-  agent: HeartbeatAgentIdentity;
-  /** Fleet presence room id (or alias) to heartbeat into. */
-  roomId: string;
-  /** Heartbeat cadence; defaults to the policy interval. */
-  intervalMs?: number;
-  policy?: LivenessPolicy;
-  missionId?: string;
-  onError?: (err: unknown) => void;
-}
-
-export class PresenceAgent {
-  private readonly intervalMs: number;
-  private readonly emitter: HeartbeatEmitter;
-  private loop: HeartbeatLoopHandle | undefined;
-  private resolvedRoomId: string | undefined;
-
-  constructor(private readonly opts: PresenceAgentOptions) {
-    const policy = opts.policy ?? DEFAULT_LIVENESS_POLICY;
-    this.intervalMs = opts.intervalMs ?? policy.heartbeatIntervalMs;
-    this.emitter = new HeartbeatEmitter({
-      agent: opts.agent,
-      intervalMs: this.intervalMs,
-      missionId: opts.missionId,
-    });
-  }
-
-  /** Join the fleet room and go present. Returns the resolved room id. */
-  async connect(): Promise<string> {
-    this.resolvedRoomId = await this.opts.client.joinRoom(this.opts.roomId);
-    await this.opts.client.setPresence(this.opts.agent.mxid, 'online', 'mosaic.presence heartbeat');
-    return this.resolvedRoomId;
-  }
-
-  /** Start the heartbeat loop (emits immediately, then every intervalMs). */
-  start(status: () => PresenceStatus = () => 'online'): void {
-    const roomId = this.resolvedRoomId ?? this.opts.roomId;
-    this.loop = startHeartbeatLoop({
-      emitter: this.emitter,
-      intervalMs: this.intervalMs,
-      status,
-      onError: this.opts.onError,
-      send: async (content) => {
-        await this.opts.client.sendHeartbeat(roomId, content);
-      },
-    });
-  }
-
-  get currentSeq(): number {
-    return this.emitter.currentSeq;
-  }
-
-  /**
-   * Stop only the heartbeat loop, sending NO graceful signal. This models a
-   * hard crash/kill: the authoritative liveness path must detect it purely from
-   * the absence of heartbeats (RFC-001 §4.5, A3), not from any native presence
-   * change. Idempotent.
-   */
-  pauseHeartbeat(): void {
-    this.loop?.stop();
-    this.loop = undefined;
-  }
-
-  /** Graceful stop: stop heartbeating and drop native presence to offline. */
-  async stop(): Promise<void> {
-    this.pauseHeartbeat();
-    try {
-      await this.opts.client.setPresence(this.opts.agent.mxid, 'offline');
-    } catch (err) {
-      this.opts.onError?.(err);
-    }
-  }
-}

packages/comms/src/types.ts

@@ -1,99 +0,0 @@
-/**
- * @mosaicstack/comms — MACP P1 (presence) types.
- *
- * Implements the presence/liveness slice of RFC-001 §4.5 and the MACP event
- * envelope of RFC-001 §4.2. P1 scope only: presence heartbeat + deterministic
- * liveness. No enrollment, room-taxonomy, token-minting or signed-authorship
- * (those are P2+).
- */
-
-/** The three human-visible liveness states (RFC-001 §4.5). */
-export type PresenceStatus = 'online' | 'away' | 'offline';
-
-/**
- * Native Matrix presence EDU states. We still emit these (so Element shows the
- * right dot for humans, RFC-001 §4.5) but they are NOT the authoritative
- * liveness source — the heartbeat is.
- */
-export type MatrixPresence = 'online' | 'unavailable' | 'offline';
-
-/**
- * Common MACP event envelope carried in `content` on every custom event
- * (RFC-001 §4.2). P1 uses only the fields the presence heartbeat needs; the
- * `signature` field (gate actions, §4.4) is intentionally absent in P1.
- */
-export interface MacpEnvelope {
-  macp_version: string;
-  macp_type: string;
-  agent: {
-    mxid: string;
-    slug: string;
-    harness: string;
-  };
-  ts: number;
-  mission_id?: string;
-}
-
-/**
- * `mosaic.presence` heartbeat content (RFC-001 §4.2 "presence" row + §4.5).
- * Carried as an `m.room.message` with `msgtype: "mosaic.presence"` and a
- * human-visible `body` fallback, posted into the fleet presence room.
- */
-export interface PresenceHeartbeatContent extends MacpEnvelope {
-  macp_type: 'presence';
-  msgtype: 'mosaic.presence';
-  /** Human-visible fallback so the event renders in a stock client. */
-  body: string;
-  /** Liveness state the agent asserts about itself. */
-  status: PresenceStatus;
-  /** Monotonic per-agent sequence number, increments once per beat. */
-  seq: number;
-  /** The agent's configured heartbeat interval, so readers can reason. */
-  interval_ms: number;
-}
-
-/**
- * Deterministic liveness policy (RFC-001 §4.5). Defaults per §4.5/§5.3:
- * interval 30s, miss-tolerance 2, dark threshold a policy value (10 min in
- * prod §5; small in dev harness).
- */
-export interface LivenessPolicy {
-  /** Nominal heartbeat interval in ms. Default 30_000. */
-  heartbeatIntervalMs: number;
-  /** How many intervals may be missed before "away". Default 2. */
-  missTolerance: number;
-  /** Age past which an agent is declared offline/dark. Default 600_000. */
-  darkThresholdMs: number;
-}
-
-/** A single agent's last observed heartbeat, as read from the fleet room. */
-export interface HeartbeatObservation {
-  slug: string;
-  mxid: string;
-  /** Wall-clock ms of the last heartbeat seen for this agent. */
-  lastSeenTs: number;
-  /** Last seq observed (monotonic per agent). */
-  lastSeq: number;
-  /** The status the agent last asserted about itself. */
-  assertedStatus: PresenceStatus;
-}
-
-/** Computed liveness for one agent (what a human/watchdog reads). */
-export interface AgentLiveness {
-  slug: string;
-  mxid: string;
-  /** Authoritative, heartbeat-derived status. */
-  status: PresenceStatus;
-  lastSeenTs: number;
-  /** now - lastSeenTs, in ms. */
-  ageMs: number;
-  lastSeq: number;
-}
-
-export const DEFAULT_LIVENESS_POLICY: LivenessPolicy = {
-  heartbeatIntervalMs: 30_000,
-  missTolerance: 2,
-  darkThresholdMs: 600_000,
-};
-
-export const MACP_VERSION = '1.0';

packages/comms/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

packages/comms/vitest.config.ts

@@ -1,13 +0,0 @@
-import { defineConfig } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    globals: true,
-    environment: 'node',
-    coverage: {
-      provider: 'v8',
-      include: ['src/**/*.ts'],
-      exclude: ['src/index.ts'],
-    },
-  },
-});

packages/coord/src/__tests__/runtime-launch-gate.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { resolveLaunchCommand } from '../runner.js';
-
-describe('coord consequential-runtime launch gate', () => {
-  it('routes default and direct configured Claude commands through mosaic', () => {
-    expect(resolveLaunchCommand('claude', 'continue', undefined)).toEqual([
-      'mosaic',
-      'claude',
-      '-p',
-      'continue',
-    ]);
-    expect(resolveLaunchCommand('claude', 'continue', ['claude', '-p', '{prompt}'])).toEqual([
-      'mosaic',
-      'claude',
-      '-p',
-      'continue',
-    ]);
-  });
-
-  it('preserves an already-gated Claude command and rejects unknown launchers', () => {
-    expect(
-      resolveLaunchCommand('claude', 'continue', ['mosaic', 'yolo', 'claude', '{prompt}']),
-    ).toEqual(['mosaic', 'yolo', 'claude', 'continue']);
-    expect(() => resolveLaunchCommand('claude', 'continue', ['custom-launcher'])).toThrow(
-      /must use `mosaic claude`/,
-    );
-  });
-
-  it('does not change the out-of-scope Codex command contract', () => {
-    expect(resolveLaunchCommand('codex', 'continue', undefined)).toEqual([
-      'codex',
-      '-p',
-      'continue',
-    ]);
-    expect(resolveLaunchCommand('codex', 'continue', ['codex', '{prompt}'])).toEqual([
-      'codex',
-      'continue',
-    ]);
-  });
-});

packages/coord/src/runner.ts

@@ -179,41 +179,32 @@ function buildContinuationPrompt(params: {
     `3. Read \`${mission.scratchpadFile}\` for session history and decisions`,
     `4. Read \`${mission.tasksFile}\` for current task state`,
     '5. `git pull --rebase` to sync latest changes',
-    `6. Launch runtime with \`mosaic ${runtime} -p\``,
+    `6. Launch runtime with \`${runtime} -p\``,
     `7. Continue execution from task **${taskId}**`,
     '8. Follow Two-Phase Completion Protocol',
     `9. You are the SOLE writer of \`${mission.tasksFile}\``,
   ].join('\n');
 }
 
-export function resolveLaunchCommand(
+function resolveLaunchCommand(
   runtime: 'claude' | 'codex',
   prompt: string,
   configuredCommand: string[] | undefined,
 ): string[] {
   if (configuredCommand === undefined || configuredCommand.length === 0) {
-    return runtime === 'claude' ? ['mosaic', 'claude', '-p', prompt] : [runtime, '-p', prompt];
+    return [runtime, '-p', prompt];
   }
 
   const hasPromptPlaceholder = configuredCommand.some((value) => value === '{prompt}');
   const withInterpolation = configuredCommand.map((value) =>
     value === '{prompt}' ? prompt : value,
   );
-  const command = hasPromptPlaceholder ? withInterpolation : [...withInterpolation, prompt];
 
-  if (runtime !== 'claude') return command;
-  if (
-    command[0] === 'mosaic' &&
-    (command[1] === 'claude' || (command[1] === 'yolo' && command[2] === 'claude'))
-  ) {
-    return command;
+  if (hasPromptPlaceholder) {
+    return withInterpolation;
   }
-  if (command[0] === 'claude') {
-    return ['mosaic', 'claude', ...command.slice(1)];
-  }
-  throw new Error(
-    'Custom Claude task commands must use `mosaic claude` so lease registration cannot be bypassed.',
-  );
+
+  return [...withInterpolation, prompt];
 }
 
 async function writeAtomicJson(filePath: string, payload: unknown): Promise<void> {

packages/mosaic/framework/defaults/README.md

@@ -177,23 +177,15 @@ bash tools/install.sh --cli         # npm CLI only (skip framework)
 bash tools/install.sh --ref v1.0    # Install from a specific git ref
 ```
 
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
-
 ## Universal Skills
 
-The installer syncs skills from `mosaic/agent-skills` into `~/.config/mosaic/skills/`. Install, wizard finalization, and `mosaic update` automatically reconcile every canonical skill into Claude Code's `~/.claude/skills/` directory.
+The installer syncs skills from `mosaic/agent-skills` into `~/.config/mosaic/skills/`, then links each skill into runtime directories.
 
 ```bash
-mosaic sync                         # Full canonical catalog sync
-mosaic skill list                   # Show registered, missing, dangling, and foreign entries
-mosaic skill register <name>        # Register or repair one canonical Claude link
-mosaic skill unregister <name>      # Remove one Mosaic-owned Claude link
+mosaic sync                                    # Full sync (clone + link)
+~/.config/mosaic/bin/mosaic-sync-skills --link-only   # Re-link only
 ```
 
-Skill names are direct children using `[A-Za-z0-9][A-Za-z0-9._-]*`, not paths. Registration rejects traversal/control characters and never replaces foreign files, directories, or symlinks; unregister removes only links that point inside the canonical Mosaic skill root. After registering during a running Claude Code session, use `/reload-skills` or start a new session.
-
-M1 lifecycle management targets Claude Code. Pi can discover the canonical Mosaic root through its launcher configuration. Codex parity remains follow-up scope and continues to use the existing full skill-sync linker.
-
 ## Health Audit
 
 ```bash

packages/mosaic/framework/defaults/wake-watch-list.schema.json

@@ -1,166 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mosaicstack.dev/schemas/wake-watch-list.schema.json",
-  "title": "Mosaic Wake Watch-List",
-  "description": "Declarative watch-list for the wake/heartbeat detector (EPIC #892). The SCHEMA is framework-owned; the VALUES are operator-supplied (repos, board files, lane anchors, per-class SLOs). This is the W2 schema contract only — the detector (W4) and digest renderer (W3) consume it. Per CONVERGED-DESIGN §1.4: 'operator repo; schema is framework, values are operator.'",
-  "type": "object",
-  "required": ["schema_version", "watches"],
-  "additionalProperties": false,
-  "properties": {
-    "schema_version": {
-      "type": "integer",
-      "minimum": 1,
-      "description": "Watch-list schema version. The wake component's manifest.txt declares the supported range (schema_min/schema_max, Gate B); a watch-list outside that range is rejected by the component, not silently coerced."
-    },
-    "host": {
-      "type": "string",
-      "description": "Optional operator label for the host this watch-list serves. Per-host single-instance detector (§1.1). Operator-supplied; no semantic meaning to the schema."
-    },
-    "repos": {
-      "type": "array",
-      "description": "Git repositories to watch. Source SHAs are descriptors, not the cursor (§2.4).",
-      "items": {
-        "type": "object",
-        "required": ["id"],
-        "additionalProperties": false,
-        "properties": {
-          "id": {
-            "type": "string",
-            "description": "Operator-chosen stable identifier for this repo watch."
-          },
-          "remote": {
-            "type": "string",
-            "description": "Remote/clone locator (operator-supplied). No credentials inline; secrets are by-name via load_credentials."
-          },
-          "branches": {
-            "type": "array",
-            "items": { "type": "string" },
-            "description": "Branch refs to track. Empty => default branch."
-          },
-          "class": { "$ref": "#/$defs/class" },
-          "slo": { "$ref": "#/$defs/slo_ref" },
-          "aba_sensitive": {
-            "type": "boolean",
-            "default": false,
-            "description": "If true, this source needs an event-stream/webhook rather than poll-only (intra-poll ABA mitigation, §2.4 / gate G5). Poll-only remains a mitigation, not elimination."
-          }
-        }
-      }
-    },
-    "board_files": {
-      "type": "array",
-      "description": "Board / decision files whose edits must be caught (repo-section/anchor-scoped hashing, §1.1). Human-decision file edits, not just API-visible state.",
-      "items": {
-        "type": "object",
-        "required": ["id", "path"],
-        "additionalProperties": false,
-        "properties": {
-          "id": { "type": "string" },
-          "repo": {
-            "type": "string",
-            "description": "Optional reference to a repos[].id this file lives in."
-          },
-          "path": {
-            "type": "string",
-            "description": "File path (operator-supplied). Locators are hard: repo/issue#/SHA/file:anchor (§2.1)."
-          },
-          "class": { "$ref": "#/$defs/class" },
-          "slo": { "$ref": "#/$defs/slo_ref" }
-        }
-      }
-    },
-    "lane_anchors": {
-      "type": "array",
-      "description": "In-file anchors (headings/markers) scoping a lane's obligations, so a file edit outside the lane's anchor does not wake it.",
-      "items": {
-        "type": "object",
-        "required": ["id", "anchor"],
-        "additionalProperties": false,
-        "properties": {
-          "id": { "type": "string" },
-          "board_file": {
-            "type": "string",
-            "description": "Optional reference to a board_files[].id this anchor lives in."
-          },
-          "anchor": {
-            "type": "string",
-            "description": "Anchor text/marker delimiting the lane's section within the file."
-          },
-          "class": { "$ref": "#/$defs/class" },
-          "slo": { "$ref": "#/$defs/slo_ref" }
-        }
-      }
-    },
-    "slos": {
-      "type": "object",
-      "description": "Named per-class urgency SLO tiers. SYMBOLIC — the operator sets concrete durations; the schema only fixes the shape and the class ordering intent (§4: security/lease/CI = tight; board = tens of minutes; routine = hours). No numeric parameters are baked into the framework.",
-      "additionalProperties": {
-        "type": "object",
-        "additionalProperties": false,
-        "properties": {
-          "class": { "$ref": "#/$defs/class" },
-          "fallback_bound": {
-            "type": "string",
-            "description": "Operator-supplied duration (e.g. '5m', '30m', '4h'). Symbolic tier is set by the operator, not the framework."
-          },
-          "quiet_hours_may_suppress": {
-            "type": "boolean",
-            "default": false,
-            "description": "If true, quiet-hours may suppress the cold fallback for this tier. MUST remain false for actionable/critical classes (§3: quiet-hours never gate an actionable/critical class)."
-          },
-          "measure_to": {
-            "type": "string",
-            "enum": ["consumed", "qualified-action-or-handoff"],
-            "description": "Terminal the SLO is measured to (§4/G8): CONSUMED measures reading; qualified-action-or-handoff measures doing. Actionable/critical classes measure to the action terminal."
-          }
-        }
-      }
-    },
-    "watches": {
-      "type": "array",
-      "description": "The declared source-coverage inventory: a lane-by-lane list of every operational source the lane depends on, so an omitted source cannot make the retirement vector pass vacuously (§4/G3 parity inventory). Each entry references a source declared above by kind+id.",
-      "items": {
-        "type": "object",
-        "required": ["lane", "sources"],
-        "additionalProperties": false,
-        "properties": {
-          "lane": {
-            "type": "string",
-            "description": "Operator lane identifier this watch serves."
-          },
-          "sources": {
-            "type": "array",
-            "minItems": 1,
-            "items": {
-              "type": "object",
-              "required": ["kind", "id"],
-              "additionalProperties": false,
-              "properties": {
-                "kind": {
-                  "type": "string",
-                  "enum": ["repo", "board_file", "lane_anchor"],
-                  "description": "Which top-level collection the id refers to."
-                },
-                "id": {
-                  "type": "string",
-                  "description": "Reference to repos[].id / board_files[].id / lane_anchors[].id."
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  },
-  "$defs": {
-    "class": {
-      "type": "string",
-      "enum": ["digest", "actionable", "human", "terminal-log", "reaction"],
-      "description": "Wake class (§2.3). Only `digest` coalesces (cumulative-state replace); actionable/human APPEND. ALL classes are durable. Absent class => the consumer treats it as `actionable` (fail-safe)."
-    },
-    "slo_ref": {
-      "type": "string",
-      "description": "Name of an entry in the top-level `slos` map to apply to this source."
-    }
-  }
-}

packages/mosaic/framework/framework-manifest.txt

@@ -35,8 +35,6 @@ CONTRIBUTING.md
 defaults/**
 examples/**
 guides/**
-# Shipped framework subtree — canonical skills are upgrade-reconciled.
-skills/**
 install.sh
 install.ps1
 LICENSE
@@ -69,9 +67,6 @@ policy/**
 memory/**
 sources/**
 credentials/**
-# Operator-authored/customized skills live separately from canonical skills/ and
-# must remain structurally unprunable even as skills/** is framework-owned.
-skills-local/**
 # Secret-bearing operator file INSIDE the framework-owned tools/ subtree.
 # Listed explicitly so the deny-wins rule carves it out of tools/**.
 tools/_lib/credentials.json