feat(config): installation minimal-subset — schema, adapters, core, render (CONFIGIMPL)

Implements the config minimal desired-state subset per the PASSED spec
docs/specs/2026-08-29_mosaic-config-minimal-subset.md (spec review PASS
deff617d, rev-code-02). Dependency gate honored: registry adapter is
an explicit stub; profile/role resolution and desired-roster generation
are notChecked. 26 test arms green.

.env.example

@@ -40,9 +40,12 @@ BETTER_AUTH_SECRET=change-me-to-a-random-32-char-string
 BETTER_AUTH_URL=http://localhost:14242
 
 
-# ─── Web App (Next.js) ───────────────────────────────────────────────────────
-# Public gateway URL — accessible from the browser, not just the server.
-NEXT_PUBLIC_GATEWAY_URL=http://localhost:14242
+# ─── Web App (SPA) ───────────────────────────────────────────────────────────
+# Directory holding the built SPA bundle (vite build output). When set, the
+# gateway serves the SPA same-origin; when unset (dev), run the Vite dev
+# server (pnpm --filter @mosaicstack/web dev), which proxies to the gateway.
+# safe-default: unset in dev — SPA serving is an opt-in production concern
+#WEB_DIST_DIR=apps/web/dist
 
 
 # ─── OpenTelemetry ───────────────────────────────────────────────────────────
@@ -149,6 +152,5 @@ OTEL_SERVICE_NAME=mosaic-gateway
 # KEYCLOAK_CLIENT_ID=mosaic
 # KEYCLOAK_CLIENT_SECRET=
 
-# Feature flags — set to true alongside provider credentials to show SSO buttons in the UI
-# NEXT_PUBLIC_WORKOS_ENABLED=true
-# NEXT_PUBLIC_KEYCLOAK_ENABLED=true
+# The web login page discovers configured providers dynamically from
+# GET /api/sso/providers. No NEXT_PUBLIC_* provider feature flag is required.

.gitignore

@@ -9,7 +9,7 @@ coverage
 *.tsbuildinfo
 .pnpm-store
 __pycache__/
-docs/reports/
+docs/.obsidian
 
 # Step-CA dev password — real file is gitignored; commit only the .example
 infra/step-ca/dev-password
@@ -23,3 +23,7 @@ infra/step-ca/dev-password
 # traversal error: ... .timestamp-*.mjs: No such file or directory" when the
 # file vanished mid-scan. Ignoring them removes the race.
 *.timestamp-*.mjs
+
+# Playwright run artifacts (#1445, P6 E2E gate)
+apps/web/test-results/
+apps/web/playwright-report/

.mosaic/repo.json

@@ -0,0 +1,11 @@
+{
+  "schema_version": 2,
+  "integration_trunk": "next",
+  "release_branch": "main",
+  "flow": "trunk-release",
+  "canonical_remote": "https://git.mosaicstack.dev/mosaicstack/stack",
+  "canonical_clone": "host:/src/mosaic-stack",
+  "worktree_root": "host:/src/mosaic-stack-worktrees",
+  "worktree_policy": "orchestrator-precreated",
+  "notes": "next=development/integration; main=production release. Never branch work off main. worktree_policy is TRANSITIONAL: the wrapper worktree consumer is BLOCKED on the J3/#1174 amendment (checked roots + capacity guard); pre-creation is the interim orchestration choice, not closed policy — it becomes a timing choice only after the wrapper can validate this root."
+}

.woodpecker/ci-image.yml

@@ -22,9 +22,9 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}

.woodpecker/ci.yml

@@ -2,24 +2,48 @@
 # node:24-alpine + python3/make/g++/postgresql-client + pnpm + a warm pnpm
 # store. The install step resolves from the baked store (--prefer-offline)
 # instead of paying a ~731s cold fetch + native compile every run.
+#
+# PINNED to an immutable lock-tag (#1328, brain D27): ci-image.yml pushes
+# lock-<sha256(pnpm-lock.yaml)[:12]> atomically with :latest, so the two are
+# byte-identical at push time. A mutable :latest resolves per-pod at pull time
+# on the k8s backend, which made CI verdicts non-reproducible (same tree, same
+# config, different images across runs; see #1324 comment 23382/23386). The pin
+# changes ONLY through reviewed commits; a wrong tag fails loudly at image pull.
+#
+# Bump procedure: when a recipe change (pnpm-lock.yaml / Dockerfile.ci) lands on
+# main, ci-image.yml pushes lock-<new>; a follow-up PR updates this anchor.
+# Until then pipelines keep the old pin: reproducible, with the documented
+# network-fallback lag (frozen-lockfile resolves missing packages from network).
+# Known limitation: lock- addresses the lockfile only, so a Dockerfile-only
+# change re-pushes the same tag with new content (#1328 follow-up: recipe-hash).
 variables:
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
+  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:lock-9cb7ffcd8828'
   - &enable_pnpm 'corepack enable'
 
 when:
-  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
-  # push CI is restricted to protected branches (main) so a feature-branch push no
-  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
-  # CI load on the storage-constrained runner with zero loss of gating (branch
-  # protection requires no push/ci status context; main still gets full push CI).
+  # PR + manual CI run on any branch: the pull_request pipeline is the merge
+  # gate (next is protected and the default branch since 2026-08-19).
+  # Push CI runs on main only. next deliberately runs NO push ci: post-merge
+  # verification on next is carried by publish.yml's `verify` step
+  # (pnpm verify:release), which mirrors this pipeline's complete mandatory
+  # set step-for-step, enforced by scripts/verify-release.test.mjs. PR CI
+  # tests the PR HEAD tree (refs/pull/N/head, measured 2026-08-19), not a
+  # merge ref, so if next advances before a merge the landed tree differs
+  # from the tested one; publish verify re-runs the full set on the landed
+  # tree (PGlite path). Measured 2026-08-19: the 21 most recent push events
+  # on next each ran exactly one pipeline (publish), zero ci.
+  # Keeping push ci off next also avoids a redundant second full-suite run
+  # per merge on the storage-constrained runner.
   - event: [pull_request, manual]
   - event: push
     branch: main
 
-# Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
-# repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).
-# This avoids from_secret which is blocked on pull_request events.
-# If the env vars aren't set, turbo falls back to local cache only.
+# Turbo remote cache (turbo.mosaicstack.dev) is wired in publish.yml via the
+# org-level Woodpecker secret `turbo_token` (events: push/tag/cron/manual/
+# deployment — never pull_request). This PR pipeline deliberately gets no
+# remote-cache credentials: an untrusted PR must not be able to write to (or
+# poison) the shared cache. Without TURBO_* env vars turbo falls back to
+# local cache only, which is the intended behavior here.
 
 steps:
   install:
@@ -30,6 +54,19 @@ steps:
       # the baked pnpm store.
       - pnpm install --frozen-lockfile --prefer-offline
 
+  # ---------------------------------------------------------------------------
+  # The steps below (sanitization, upgrade-guard, typecheck, lint, format,
+  # test) are the COMPLETE mandatory verification set. SDLC-D-034 mirrors them
+  # one-for-one in the canonical terminal verification command — root
+  # `pnpm verify:release` (scripts/verify-release.mjs) — which the publish
+  # pipeline (.woodpecker/publish.yml `verify` step) runs before ANY publish
+  # effect. These lines stay direct (not routed through the runner) because the
+  # #1017 test-enumeration guard audits framework tool paths through THIS
+  # surface; scripts/verify-release.test.mjs enforces that the runner's stage
+  # table keeps matching these commands exactly, so the two cannot drift.
+  # ---------------------------------------------------------------------------
+
+  # Canonical verify:release stage `sanitization`.
   # Blocking gate: public framework package must contain no operator-specific
   # personal data or private $HOME defaults. Runs early (no node_modules needed).
   sanitization:
@@ -46,7 +83,73 @@ steps:
       # [0] of the pnpm chain, so severing that chain would silence it together
       # with everything it guards; this direct line keeps one instrument running.
       - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
+      # Tool-index gate: a shipped wrapper that appears in no resident index doc
+      # is undiscoverable from inside a session, and an agent that cannot learn a
+      # wrapper exists reaches for raw curl instead — which is how a Gitea review
+      # got filed PENDING three times. Ships-and-documented is one commit, or red.
+      - bash packages/mosaic/framework/tools/quality/scripts/check-tools-index.sh --self-test
+      - bash packages/mosaic/framework/tools/quality/scripts/check-tools-index.sh
+      # Hermetic regression for issue-close.sh (#1081): mocks tea/curl onto PATH
+      # and sandboxes a throwaway git repo, so it resolves no real credentials and
+      # joins CI directly rather than the exclusions file.
+      - bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh
+      # Hermetic regression for the git identity ladder (#1356): mock tea on PATH,
+      # sandboxed repo, no real credentials (3/3 green under an empty HOME). Pins
+      # fail-closed: a seat whose login is missing gets a named error, never a
+      # borrowed identity. Joins CI directly; its #1007 exclusion is burned down.
+      - bash packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh
+      # Hermetic regression for issue-view.sh (#1357): mock tea/curl, sandboxed
+      # repo. Pins that comment BODIES render on both paths and that a tea
+      # failure is named as what it was (git-config vs credential).
+      - bash packages/mosaic/framework/tools/git/test-issue-view-comments.sh
+      # Hermetic behavioural regression for the PreToolUse wrapper guard: proves
+      # it still blocks the three mistakes AND still lets reads, unwrapped
+      # endpoints and ordinary commands through. Both directions are asserted —
+      # a guard that over-blocks gets routed around, which fails just as hard.
+      - bash packages/mosaic/framework/tools/git/test-wrapper-guard.sh
+      # Hermetic regression for mosaic-worktree.sh at fleet scale: stubs git onto
+      # PATH so `list` faces ~450 KB of porcelain. The defect it pins is invisible
+      # at small size — `git … | awk '…exit'` gives the producer SIGPIPE, which
+      # under `set -euo pipefail` aborts the caller silently with rc=141 and no
+      # output. A repo only reaches that once it has enough worktrees, so the
+      # stub supplies the scale instead of the host's own checkout.
+      - bash packages/mosaic/framework/tools/git/test-mosaic-worktree-large-repo.sh
 
+  # Canonical repo-structure declaration gate (T51 WP5c, spec §5.4 point 2):
+  # .mosaic/repo.json is the machine-readable structure SSOT consumed by git
+  # wrappers and the T32 gate seat; this is its repo-side CI enforcement.
+  # Path-conditional: runs when the declaration, the vendored validator, or this
+  # pipeline config changes (manual runs always include it). Fails the pipeline
+  # on any VALIDATION_ERROR and enforces the schema_version 2 authoring rule
+  # (--require-v2: edited/new declarations may not stay v1). The validator is
+  # vendored into the framework tree (spec §5.1 final home) — provenance in its
+  # header; the hostile-input suite (101 arms, hermetic) runs alongside so the
+  # gate's own instrument ships in the same commit as the gate.
+  structure-declaration:
+    image: *node_image
+    commands:
+      - apk add --no-cache bash git
+      # MOSAIC_HOST_ROOT is a runtime anchor (spec §1.2a: unset fails closed
+      # for managed validation). CI has no host, so the step provisions an
+      # EXPLICIT fixture root — honest configuration for the resolution path,
+      # never a guess about a real host; the per-host containment checks are
+      # runtime concerns and do not run against a fixture. Grammar, schema,
+      # refs, flow, remote normalization, and path grammar all prove here.
+      - mkdir -p /tmp/t51-ci-hostroot
+      - bash packages/mosaic/framework/tools/structure/validate-repo-json.sh .mosaic/repo.json --require-v2
+      - bash packages/mosaic/framework/tools/structure/test-validate-repo-json.sh
+    environment:
+      MOSAIC_HOST_ROOT: /tmp/t51-ci-hostroot
+    when:
+      - event: pull_request
+        path:
+          include:
+            - '.mosaic/repo.json'
+            - 'packages/mosaic/framework/tools/structure/**'
+            - '.woodpecker/ci.yml'
+      - event: manual
+
+  # Canonical verify:release stage `upgrade-guard`.
   # Blocking gate (#791): a framework upgrade must never write or delete an
   # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
   # survives a keep-mode reseed byte-identical (with rsync present AND absent —
@@ -68,6 +171,8 @@ steps:
       - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
       - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
 
+  # Canonical verify:release stage `typecheck` — the same `pnpm typecheck`
+  # invocation (which runs the checkout preflight first, then turbo).
   typecheck:
     image: *node_image
     commands:
@@ -78,7 +183,8 @@ steps:
       - sanitization
       - upgrade-guard
 
-  # lint, format, and test are independent — run in parallel after typecheck
+  # lint, format, and test are independent — run in parallel after typecheck.
+  # Each runs exactly its canonical verify:release stage command.
   lint:
     image: *node_image
     commands:
@@ -95,6 +201,12 @@ steps:
     depends_on:
       - typecheck
 
+  # Canonical verify:release stage `test` — the `pnpm test` line below is the
+  # shared command; everything else in this step is PIPELINE-LEVEL
+  # prerequisite the canonical command expects its caller to provide (SDLC-D-034):
+  # the ci-postgres service + pg_isready wait + db:migrate (postgres path),
+  # `apk add openssl`, and the pinned pi install. None of those can move into
+  # the runner (it must also work locally on the PGlite path with no database).
   test:
     image: *node_image
     environment:
@@ -109,6 +221,16 @@ steps:
       # `apk add` guarantees openssl is present on PR pipelines too (and is a
       # fast no-op once the rebuilt image already ships it).
       - apk add --no-cache openssl
+      # Pi runtime (Invariant R): invariant_r_unittest.py hard-requires an
+      # installed `pi` binary at exactly this measured version — the test
+      # boots Pi's real tool registry to prove the read-only carve-out
+      # resolves to real, unshadowed builtins, and fails loud (by design)
+      # when the runtime is absent or drifts. The canonical Pi is
+      # @earendil-works/[email protected] exactly (@mariozechner/* is
+      # embedded-legacy). Step-level install because ci-base image publishes
+      # are currently blocked on registry auth; fold into Dockerfile.ci once
+      # that is fixed, keeping this as a fast no-op guard.
+      - npm install -g @earendil-works/[email protected]
       # postgresql-client (pg_isready) is baked into ci-base.
       # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
       - |
@@ -132,6 +254,23 @@ steps:
     depends_on:
       - typecheck
 
+  # Canonical verify:release stage `build` (#1445, P6): every PR proves the
+  # full workspace build — including the SPA `vite build` — before merge,
+  # instead of leaving build breakage to surface post-merge in publish.yml's
+  # verify step. Same canonical command the publish pipeline's build step runs.
+  build:
+    image: *node_image
+    commands:
+      - *enable_pnpm
+      - pnpm build
+    depends_on:
+      # after test, not typecheck: turbo gives `test` a ^build dependency, so
+      # running this step concurrently with test would put two independent
+      # turbo builds on the same shared-workspace dist/ and turbo cache with
+      # no cross-process locking — the same serialization invariant
+      # publish.yml documents for #1411.
+      - test
+
 services:
   ci-postgres:
     image: pgvector/pgvector:pg17

.woodpecker/publish.yml

@@ -1,10 +1,29 @@
 # Build, publish npm packages, and push Docker images
 # Runs on main for stable publishes and on next for integration-line prereleases/images
+#
+# SDLC-D-034 publish gate: every publish effect (publish-npm, publish-next-npm,
+# and every image build/push step) depends DIRECTLY on the `verify` step below.
+# `verify` (a) asserts the provider's commit identity matches the actual
+# checkout (CI_COMMIT_SHA == git rev-parse HEAD, fail closed on mismatch or
+# emptiness) and (b) runs the canonical terminal verification command
+# (`pnpm verify:release`), which mirrors the PR CI pipeline's complete
+# mandatory set (sanitization, upgrade-guard, preflight+typecheck, lint,
+# format:check, test, build) — see scripts/verify-release.mjs. A missing,
+# failed, skipped, cancelled, or inconclusive verification therefore skips the
+# dependent publish effects (fail closed). Path-filtered short-circuits may
+# skip publish EFFECTS (e.g. docs-only merges) but never bypass `verify` for a
+# publish that does run: `verify` itself carries no path filter.
+# scripts/verify-release.test.mjs enforces this DAG invariant at checkout time.
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
   # toolchain + warm pnpm store. Kills the second cold install publish pays.
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
+  # PINNED to the immutable lock-tag, not :latest (#1328, brain D27): a mutable
+  # tag resolves per-pod at pull time on the k8s backend and made CI verdicts
+  # non-reproducible (#1324). Byte-identical to :latest at pin time (pushed
+  # atomically by the same kaniko run, main 712c770, 2026-07-26). Bump only via
+  # reviewed PR, per the procedure in .woodpecker/ci.yml's header comment.
+  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:lock-9cb7ffcd8828'
   - &enable_pnpm 'corepack enable'
   # Heavy kaniko image builds (~25 min) — gate them so a merge that only touches
   # the npm-only CLI (@mosaicstack/mosaic) or docs does NOT rebuild the platform
@@ -13,6 +32,11 @@ variables:
   # non-excluded change still builds, so no transitive dep can silently go stale.
   # (Woodpecker: `when` entries are OR'd; `path` applies to push/PR only — hence
   # the separate `event: tag` entry.)
+  # #1407: ONE shared anchor for all three image steps. A second main-only
+  # anchor previously gated build-web/build-appservice, so next-lane pushes
+  # published gateway sha images with no web/appservice counterpart — no
+  # sha-parity set existed for next-lane containerized deploys. Every image
+  # step now builds on next too (sha-only destinations, enforced per step).
   - &image_build_when
     - event: tag
     - event: [push, manual]
@@ -25,16 +49,6 @@ variables:
           - '.woodpecker/**'
     - event: [push, manual]
       branch: next
-  - &main_image_build_when
-    - event: tag
-    - event: [push, manual]
-      branch: main
-      path:
-        exclude:
-          - 'packages/mosaic/**'
-          - 'docs/**'
-          - '**/*.md'
-          - '.woodpecker/**'
 
 when:
   - branch: [main, next]
@@ -48,13 +62,67 @@ steps:
       # Resolve from the baked pnpm store instead of a cold network fetch.
       - pnpm install --frozen-lockfile --prefer-offline
 
+  # SDLC-D-034 exact-commit publish gate. No `when`/path filter on purpose: it
+  # runs for every event this pipeline serves so no publish effect can ever
+  # start without it. Fails closed on commit-identity mismatch (or either SHA
+  # being empty) and on any incomplete verification.
+  verify:
+    image: *node_image
+    environment:
+      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
+      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
+      TURBO_API: https://turbo.mosaicstack.dev
+      TURBO_TEAM: mosaic
+      TURBO_TOKEN:
+        from_secret: turbo_token
+    commands:
+      - *enable_pnpm
+      # (a) Commit identity: the provider's claimed SHA must equal the actual
+      # checkout HEAD — verification of anything else must never authorize a
+      # publish of this commit.
+      - |
+        if [ -z "$CI_COMMIT_SHA" ]; then
+          echo "[verify] FATAL: CI_COMMIT_SHA is empty — cannot certify commit identity" >&2
+          exit 1
+        fi
+        CHECKOUT_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
+        if [ -z "$CHECKOUT_SHA" ]; then
+          echo "[verify] FATAL: git rev-parse HEAD returned nothing — cannot certify commit identity" >&2
+          exit 1
+        fi
+        if [ "$CI_COMMIT_SHA" != "$CHECKOUT_SHA" ]; then
+          echo "[verify] FATAL: provider commit ($CI_COMMIT_SHA) != checkout HEAD ($CHECKOUT_SHA)" >&2
+          exit 1
+        fi
+        echo "[verify] commit identity confirmed: $CHECKOUT_SHA"
+      # (b) Canonical terminal verification. Caller-provided prerequisites the
+      # runner expects (see .woodpecker/ci.yml comments): bash/rsync for the
+      # guard stages, openssl + the pinned pi binary for the test stage. git is
+      # baked into ci-base but re-asserted here so the identity check above can
+      # never silently depend on a stale baked image. DATABASE_URL is
+      # deliberately NOT set: the canonical command must hold on the PGlite
+      # path too and never sets or requires a database itself.
+      - apk add --no-cache bash rsync openssl git
+      - npm install -g @earendil-works/[email protected]
+      - pnpm verify:release
+    depends_on:
+      - install
+
   build:
     image: *node_image
+    environment:
+      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
+      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
+      TURBO_API: https://turbo.mosaicstack.dev
+      TURBO_TEAM: mosaic
+      TURBO_TOKEN:
+        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build
     depends_on:
       - install
+      - verify
 
   publish-npm:
     image: *node_image
@@ -114,6 +182,7 @@ steps:
         exit 1
     depends_on:
       - build
+      - verify
 
   publish-next-npm:
     image: *node_image
@@ -142,6 +211,20 @@ steps:
         echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
         DIST_TAGS_JSON="$(npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json)"
         DIST_TAGS_JSON="$DIST_TAGS_JSON" node -e 'const tags = JSON.parse(process.env.DIST_TAGS_JSON || "{}"); if (!tags || typeof tags !== "object" || !Object.hasOwn(tags, "latest")) { throw new Error("Gitea npm registry did not return a usable dist-tags object"); } console.log("[publish-next] registry dist-tags OK: latest=" + tags.latest);'
+        # #1404: snapshot every publishable manifest BEFORE the transform so the
+        # workspace can be restored byte-exact after publish. The transform
+        # rewrites package.json in place (needed: pnpm publish reads the
+        # workspace manifests); without restore, later steps in this pipeline
+        # (build-gateway kaniko COPY + pnpm install --frozen-lockfile) see
+        # manifests that no longer match pnpm-lock.yaml and fail
+        # ERR_PNPM_OUTDATED_LOCKFILE. Snapshot dir is step-local tmp.
+        SNAPSHOT_DIR="$(mktemp -d /tmp/publish-next-manifests.XXXXXX)"
+        export SNAPSHOT_DIR
+        find apps packages plugins -name package.json -not -path "*/node_modules/*" -not -path "*/dist/*" | while read -r mf; do
+          mkdir -p "$SNAPSHOT_DIR/$(dirname "$mf")"
+          cp -p "$mf" "$SNAPSHOT_DIR/$mf"
+        done
+        echo "[publish-next] snapshotted $(find "$SNAPSHOT_DIR" -name package.json | wc -l) manifests to $SNAPSHOT_DIR"
         node <<'NODE'
         const fs = require('node:fs');
         const path = require('node:path');
@@ -149,23 +232,38 @@ steps:
         const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
         const roots = ['apps', 'packages', 'plugins'];
         const updated = [];
+        const exactVersions = new Map(); // name -> bumped next version
 
-        function walk(dir) {
+        function walk(dir, visit) {
           if (!fs.existsSync(dir)) return;
           for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
             if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
             const fullPath = path.join(dir, entry.name);
             if (entry.isDirectory()) {
               const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) updatePackage(packagePath);
-              walk(fullPath);
+              if (fs.existsSync(packagePath)) {
+                const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+                if (manifest.name?.startsWith('@mosaicstack/') && !manifest.private) {
+                  visit(manifest, packagePath);
+                }
+              }
+              walk(fullPath, visit);
             }
           }
         }
 
-        function updatePackage(packagePath) {
-          const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-          if (!manifest.name?.startsWith('@mosaicstack/') || manifest.private) return;
+        // #1389: two passes. Pass 1 bumps every publishable manifest to
+        // <stable+1>-next.<pipeline> exactly as before, recording name ->
+        // bumped version. Pass 2 rewrites every published manifest's
+        // @mosaicstack/* dependency entries (dependencies, devDependencies,
+        // peerDependencies, optionalDependencies) to the EXACT same-pipeline
+        // build. A caret range like ^0.0.3-next.2636 leaves the resolver free
+        // to pick any later build — and on a host with a stale cache, an
+        // installer-side scaffold pinned at stable, or a registry hiccup, that
+        // freedom is how a "next" install ends up executing stable-era code
+        // (web1 evidence: old tier validator, missing migrations). Exact pins
+        // make the defect class unrepresentable regardless of resolver path.
+        function bump(manifest, packagePath) {
           const stableMatch = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(manifest.version);
           if (!stableMatch) {
             throw new Error(manifest.name + " has unsupported semver version '" + manifest.version + "'");
@@ -174,13 +272,40 @@ steps:
           const oldVersion = manifest.version;
           manifest.version = major + '.' + minor + '.' + (Number(patch) + 1) + '-next.' + pipelineNumber;
           fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
+          exactVersions.set(manifest.name, manifest.version);
           updated.push(manifest.name + ' ' + oldVersion + ' -> ' + manifest.version);
         }
 
-        for (const root of roots) walk(root);
+        const DEP_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+        let pinnedEntries = 0;
+        function pin(manifest, packagePath) {
+          let changed = false;
+          for (const field of DEP_FIELDS) {
+            const deps = manifest[field];
+            if (!deps || typeof deps !== 'object') continue;
+            for (const [name, range] of Object.entries(deps)) {
+              if (!name.startsWith('@mosaicstack/')) continue;
+              const exact = exactVersions.get(name);
+              if (!exact) {
+                throw new Error(
+                  manifest.name + ' depends on ' + name +
+                  ' which has no bumped version in this publish set — cannot pin');
+              }
+              if (range === exact) continue;
+              deps[name] = exact;
+              pinnedEntries++;
+              changed = true;
+            }
+          }
+          if (changed) fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
+        }
+
+        for (const root of roots) walk(root, bump);
+        for (const root of roots) walk(root, pin);
         if (updated.length === 0) throw new Error('No publishable @mosaicstack/* packages found');
         console.log('[publish-next] computed prerelease versions for ' + updated.length + ' packages:');
         for (const line of updated) console.log('[publish-next] ' + line);
+        console.log('[publish-next] pinned ' + pinnedEntries + ' @mosaicstack/* dep entries to exact same-pipeline versions across ' + updated.length + ' manifests');
         NODE
         pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" --filter "!@mosaicstack/mosaic-as" publish --no-git-checks --access public --tag next
         EXPECTED_VERSION="$(node -p "require('./packages/mosaic/package.json').version")"
@@ -190,8 +315,187 @@ steps:
           exit 1
         fi
         echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
+        # #1389 post-publish guard: every freshly published manifest must carry
+        # EXACT same-pipeline @mosaicstack/* dep pins (no ranges, no stable
+        # fallback). A leak here fails the pipeline instead of shipping.
+        node <<'GUARD'
+        const { execFileSync } = require('node:child_process');
+        const fs = require('node:fs');
+        const path = require('node:path');
+        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
+        const registry = 'https://git.mosaicstack.dev/api/packages/mosaicstack/npm/';
+        const roots = ['apps', 'packages', 'plugins'];
+        const published = [];
+        function walk(dir) {
+          if (!fs.existsSync(dir)) return;
+          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+              const packagePath = path.join(fullPath, 'package.json');
+              if (fs.existsSync(packagePath)) {
+                const m = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+                if (m.name?.startsWith('@mosaicstack/') && !m.private) published.push(m.name);
+              }
+              walk(fullPath);
+            }
+          }
+        }
+        for (const root of roots) walk(root);
+        let failures = 0;
+        for (const name of published) {
+          let manifest;
+          try {
+            const out = execFileSync('npm', ['view', name + '@next', '--json', '--registry', registry],
+                                     { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+            const arr = JSON.parse(out);
+            manifest = Array.isArray(arr) ? arr[arr.length - 1] : arr;
+          } catch (e) {
+            console.error('[publish-next-guard] FAIL ' + name + ': npm view failed: ' + e.message);
+            failures++;
+            continue;
+          }
+          const fields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+          for (const field of fields) {
+            const deps = manifest[field];
+            if (!deps || typeof deps !== 'object') continue;
+            for (const [dep, range] of Object.entries(deps)) {
+              if (!dep.startsWith('@mosaicstack/')) continue;
+              const expected = dep === name ? manifest.version : null;
+              const isExactPin = /^\d+\.\d+\.\d+-next\./.test(range);
+              const samePipeline = range.endsWith('-next.' + pipelineNumber);
+              if (!isExactPin) {
+                console.error('[publish-next-guard] FAIL ' + name + ' -> ' + dep + ' range "' + range + '" is not an exact -next pin (stable-leak class, #1389)');
+                failures++;
+              } else if (!samePipeline) {
+                console.error('[publish-next-guard] FAIL ' + name + ' -> ' + dep + ' pinned "' + range + '" but this pipeline published -next.' + pipelineNumber + ' (cross-pipeline pin)');
+                failures++;
+              }
+            }
+          }
+        }
+        if (failures > 0) {
+          console.error('[publish-next-guard] FATAL: ' + failures + ' dep-pin violation(s) — stable-dep leak into next publish (#1389)');
+          process.exit(1);
+        }
+        console.log('[publish-next-guard] OK: all ' + published.length + ' published manifests carry exact same-pipeline @mosaicstack/* dep pins');
+        GUARD
+        # #1404 restore: put the workspace manifests back byte-exact so later
+        # steps (build-gateway frozen-lockfile install) see the committed tree.
+        RESTORE_FAIL=0
+        while read -r mf; do
+          if [ -f "$SNAPSHOT_DIR/$mf" ]; then
+            cp -p "$SNAPSHOT_DIR/$mf" "$mf"
+          else
+            echo "[publish-next] FATAL: no snapshot for $mf — cannot restore (snapshot incomplete?)" >&2
+            RESTORE_FAIL=1
+          fi
+        done < <(find apps packages plugins -name package.json -not -path "*/node_modules/*" -not -path "*/dist/*")
+        # Pristine guard (#1404 red-first control): the publish step must leave
+        # the workspace byte-identical to the checkout for every manifest.
+        # git diff is the arbiter — any residual mutation fails THIS step
+        # instead of surfacing as ERR_PNPM_OUTDATED_LOCKFILE in build-gateway.
+        if ! git diff --exit-code -- '**/package.json' >/dev/null 2>&1; then
+          echo "[publish-next] FATAL: workspace package.json files still differ from HEAD after restore (#1404 class)" >&2
+          git diff --stat -- '**/package.json' >&2 || true
+          RESTORE_FAIL=1
+        fi
+        rm -rf "$SNAPSHOT_DIR"
+        if [ "$RESTORE_FAIL" -ne 0 ]; then exit 1; fi
+        echo "[publish-next] workspace manifests restored byte-exact (git diff clean); later steps see the committed tree"
     depends_on:
       - build
+      - verify
+
+  # #1445 (P6): headless Playwright E2E gate on every trunk merge. Boots the
+  # real gateway on the embedded PGlite path (no DATABASE_URL, no services)
+  # serving the built SPA bundle via WEB_DIST_DIR — the exact serving path the
+  # gateway image ships (docker/gateway.Dockerfile sets WEB_DIST_DIR to the
+  # baked bundle), which keeps #1407's parity guarantee: the image build steps
+  # below depend on this gate, so a bundle that fails E2E never publishes.
+  #
+  # Image pinned to the @playwright/test version in pnpm-lock.yaml so the
+  # image's bundled browsers match the workspace driver exactly (bump the two
+  # together). The step installs no workspace packages (corepack does fetch
+  # the pinned pnpm itself): it reuses the workspace node_modules
+  # from `install` and the dist outputs from `build` — the gateway's runtime
+  # dependency path is pure JS/WASM (PGlite is WASM, postgres-js is pure JS),
+  # so the alpine-installed modules run unchanged under this glibc image.
+  # depends_on publish-next-npm per the #1411 serialization invariant: this
+  # step reads the workspace and must never run inside the manifest-transform
+  # window.
+  e2e:
+    image: mcr.microsoft.com/playwright:v1.58.2-noble
+    environment:
+      GATEWAY_PORT: '14242'
+      PLAYWRIGHT_BASE_URL: http://localhost:14242
+      # The database is seeded by Playwright's globalSetup in this step, so
+      # login failures are real failures: without this flag the suite's
+      # skip-when-login-fails guards (a live-environment affordance) could
+      # skip every authenticated spec and go green while proving nothing.
+      E2E_REQUIRE_SEEDED_AUTH: '1'
+    commands:
+      - corepack enable
+      - |
+        # Throwaway signing secret for this step's ephemeral embedded database
+        # (the gateway refuses to boot without one). Generated per run so no
+        # usable literal lives in the tree.
+        export BETTER_AUTH_SECRET="$(head -c 32 /dev/urandom | base64)"
+        export WEB_DIST_DIR="$(pwd)/apps/web/dist"
+        if [ ! -f "$WEB_DIST_DIR/index.html" ]; then
+          echo "[e2e] FATAL: $WEB_DIST_DIR/index.html missing — did the build step run?" >&2
+          exit 1
+        fi
+        # Boot the gateway from the built dist, cwd- AND HOME-isolated: the
+        # local-tier PGlite database lives under $HOME/.config/mosaic/gateway/
+        # (database.module.ts), not under cwd, so HOME must point at the
+        # throwaway dir too or the run would share a database with anything
+        # else in the container's home.
+        GATEWAY_RUN_DIR="$(mktemp -d /tmp/e2e-gateway.XXXXXX)"
+        (cd "$GATEWAY_RUN_DIR" && export HOME="$GATEWAY_RUN_DIR" && exec node "$OLDPWD/apps/gateway/dist/main.js") > /tmp/gateway.log 2>&1 &
+        GATEWAY_PID=$!
+        ready=0
+        for i in $(seq 1 90); do
+          if node -e "fetch('http://localhost:' + process.env.GATEWAY_PORT + '/health', { signal: AbortSignal.timeout(2000) }).then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"; then
+            ready=1
+            break
+          fi
+          if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then
+            echo "[e2e] FATAL: gateway process exited during startup" >&2
+            cat /tmp/gateway.log >&2
+            exit 1
+          fi
+          echo "[e2e] waiting for gateway ($i/90)..."
+          sleep 1
+        done
+        if [ "$ready" -ne 1 ]; then
+          echo "[e2e] FATAL: gateway did not become ready in 90s" >&2
+          cat /tmp/gateway.log >&2
+          exit 1
+        fi
+        echo "[e2e] gateway ready; running Playwright suite"
+        set +e
+        pnpm --filter @mosaicstack/web exec playwright test
+        E2E_EXIT=$?
+        set -e
+        kill "$GATEWAY_PID" 2>/dev/null || true
+        if [ "$E2E_EXIT" -ne 0 ]; then
+          echo "[e2e] FATAL: Playwright suite failed (exit $E2E_EXIT); gateway log follows" >&2
+          tail -100 /tmp/gateway.log >&2
+          echo "[e2e] browser-side traces/screenshots are under apps/web/test-results/ in the step workspace (not persisted past the pod)" >&2
+        fi
+        exit "$E2E_EXIT"
+    # Same filter as the image builds it gates: a merge that publishes no
+    # image (docs-only on main) pays no browser suite, and a skipped e2e does
+    # not block anything (skipped-dependency semantics, same as
+    # publish-next-npm on tag events).
+    when: *image_build_when
+    depends_on:
+      - build
+      - verify
+      # #1411: never read the workspace inside publish-next-npm's
+      # manifest-transform window.
+      - publish-next-npm
 
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
@@ -205,6 +509,7 @@ steps:
   #     - bash scripts/publish-npmjs.sh
   #   depends_on:
   #     - build
+  #     - verify
   #   when:
   #     - event: [tag]
 
@@ -213,9 +518,9 @@ steps:
     when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -242,15 +547,26 @@ steps:
         /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
     depends_on:
       - build
+      - verify
+      # #1411: publish-next-npm mutates workspace manifests in place during
+      # its transform window and restores them at step end. Any step that
+      # reads the pipeline workspace (kaniko COPY of manifests, later
+      # installs) must run AFTER publish-next-npm, never concurrently —
+      # pipeline 2648 raced a COPY inside the window and failed
+      # ERR_PNPM_OUTDATED_LOCKFILE despite a clean restore. This edge is the
+      # serialization invariant; add it to every new workspace consumer.
+      - publish-next-npm
+      # #1445 (P6): a bundle that fails the E2E gate never publishes an image.
+      - e2e
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
+    when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -259,8 +575,17 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/appservice:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
+          if [ -n "$CI_COMMIT_TAG" ]; then
+            echo "[publish] FATAL: next appservice publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
+            exit 1
+          fi
+          echo "[publish] next appservice publish is sha-only"
+        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:latest"
+        elif [ -z "$CI_COMMIT_TAG" ]; then
+          echo "[publish] FATAL: appservice image publish may only run for main, next, or tag events" >&2
+          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:$CI_COMMIT_TAG"
@@ -268,29 +593,14 @@ steps:
         /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
     depends_on:
       - build
-
-  build-web:
-    image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
-    environment:
-      REGISTRY_USER:
-        from_secret: gitea_username
-      REGISTRY_PASS:
-        from_secret: gitea_password
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
-    commands:
-      - mkdir -p /kaniko/.docker
-      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
-      - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/web:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:latest"
-        fi
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:$CI_COMMIT_TAG"
-        fi
-        /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
-    depends_on:
-      - build
+      - verify
+      # #1411: publish-next-npm mutates workspace manifests in place during
+      # its transform window and restores them at step end. Any step that
+      # reads the pipeline workspace (kaniko COPY of manifests, later
+      # installs) must run AFTER publish-next-npm, never concurrently —
+      # pipeline 2648 raced a COPY inside the window and failed
+      # ERR_PNPM_OUTDATED_LOCKFILE despite a clean restore. This edge is the
+      # serialization invariant; add it to every new workspace consumer.
+      - publish-next-npm
+      # #1445 (P6): a bundle that fails the E2E gate never publishes an image.
+      - e2e

AGENTS.md

@@ -11,48 +11,154 @@
 
 ## Project Context
 
-Mosaic Stack is a self-hosted, multi-user AI agent platform. TypeScript monorepo with NestJS gateway, Next.js web dashboard, Pi SDK agent runtime, and plugin architecture for Discord/Telegram.
+Mosaic Stack is a self-hosted, multi-user AI agent platform. It is a TypeScript monorepo with a NestJS gateway, Next.js dashboard, Pi SDK agent runtime, and Discord/Telegram plugin architecture.
 
-## Package Map
+### Stack
 
-| Package            | Purpose                         | Key Dependencies                 |
-| ------------------ | ------------------------------- | -------------------------------- |
-| `apps/gateway`     | NestJS API + WebSocket hub      | Fastify, Socket.IO, Pi SDK, OTEL |
-| `apps/web`         | Next.js dashboard               | React 19, Tailwind               |
-| `packages/types`   | Shared TypeScript contracts     | class-validator                  |
-| `packages/db`      | Drizzle ORM schema + migrations | drizzle-orm, postgres            |
-| `packages/auth`    | BetterAuth configuration        | better-auth, @mosaicstack/db     |
-| `packages/brain`   | Data layer (PG-backed)          | @mosaicstack/db                  |
-| `packages/queue`   | Valkey task queue + MCP         | ioredis                          |
-| `packages/coord`   | Mission coordination            | @mosaicstack/queue               |
-| `packages/mosaic`  | Unified `mosaic` CLI + TUI      | Ink, Pi SDK, commander           |
-| `plugins/discord`  | Discord channel plugin          | discord.js                       |
-| `plugins/telegram` | Telegram channel plugin         | Telegraf                         |
+- **API:** NestJS with Fastify (`apps/gateway`)
+- **Web:** Next.js 16 with React 19 (`apps/web`)
+- **ORM and database:** Drizzle ORM, PostgreSQL 17, and pgvector (`packages/db`)
+- **Authentication:** BetterAuth (`packages/auth`)
+- **Agent runtime:** Pi SDK (`apps/gateway`, `packages/mosaic`)
+- **Queue:** Valkey 8 (`packages/queue`)
+- **Build:** pnpm workspaces and Turborepo
+- **CI:** Woodpecker CI
+- **Observability:** OpenTelemetry and Jaeger
 
-## Architecture Rules
+### Package Map
 
-1. Gateway is the single API surface — all clients connect through it
-2. Pi SDK is ESM-only — gateway and CLI must use ESM
-3. Socket.IO typed events defined in `@mosaicstack/types` enforce compile-time contracts
-4. OTEL auto-instrumentation loads before NestJS bootstrap
-5. BetterAuth manages auth tables; schema defined in `@mosaicstack/db`
-6. Docker Compose provides PG (5433), Valkey (6380), OTEL Collector (4317/4318), Jaeger (16686)
-7. Explicit `@Inject()` decorators required in NestJS (tsx/esbuild doesn't emit decorator metadata)
+| Package            | Purpose                       | Key Dependencies                 |
+| ------------------ | ----------------------------- | -------------------------------- |
+| `apps/gateway`     | NestJS API + WebSocket hub    | Fastify, Socket.IO, Pi SDK, OTEL |
+| `apps/web`         | Next.js dashboard             | React 19, Tailwind               |
+| `packages/types`   | Shared TypeScript contracts   | class-validator                  |
+| `packages/db`      | Drizzle schema and migrations | drizzle-orm, postgres            |
+| `packages/auth`    | BetterAuth configuration      | better-auth, @mosaicstack/db     |
+| `packages/brain`   | Structured data layer         | @mosaicstack/db                  |
+| `packages/queue`   | Valkey task queue and MCP     | ioredis                          |
+| `packages/coord`   | Mission coordination          | @mosaicstack/queue               |
+| `packages/mosaic`  | Unified `mosaic` CLI and TUI  | Ink, Pi SDK, commander           |
+| `plugins/discord`  | Discord channel plugin        | discord.js                       |
+| `plugins/telegram` | Telegram channel plugin       | Telegraf                         |
+
+## Architecture and Code Conventions
+
+1. Gateway is the single API surface; all clients connect through it.
+2. Pi SDK is ESM-only; gateway and CLI code must remain ESM.
+3. Use `"type": "module"`, NodeNext module resolution, and `.js` extensions in imports.
+4. Keep typed Socket.IO events in `@mosaicstack/types` to enforce client/server contracts.
+5. Import OTEL tracing before NestJS bootstrap (`import './tracing.js'`).
+6. Use explicit `@Inject()` decorators in NestJS because tsx/esbuild does not emit decorator metadata.
+7. Keep DTOs in `*.dto.ts` files at module boundaries.
+8. BetterAuth owns authentication tables; their schema is defined in `@mosaicstack/db`.
+9. Create a task-specific scratchpad for non-trivial work.
 
 ## Development Workflow
 
+Requirements: Node.js 20+, pnpm 10.6.2, and Docker Compose when optional local services are needed.
+
 ```bash
-docker compose up -d          # Infrastructure
-pnpm install                  # Dependencies
-pnpm typecheck && pnpm lint && pnpm format:check  # Quality gates
+pnpm install --frozen-lockfile
+pnpm preflight
+
+# Optional local queue service only; do not start the full Compose stack.
+docker compose up -d valkey
 ```
 
-## Repo-Specific Notes
+The pre-push hook requires:
 
-- DTOs in `*.dto.ts` files at module boundaries
-- ESM everywhere (`"type": "module"`, `.js` extensions in imports)
-- NodeNext module resolution in all tsconfigs
-- Scratchpads are mandatory for non-trivial tasks
+```bash
+pnpm preflight && pnpm typecheck && pnpm lint && pnpm format:check
+```
+
+Software delivery also requires the applicable tests. Common repository commands are:
+
+```bash
+pnpm typecheck     # TypeScript checks across the workspace
+pnpm lint          # ESLint across the workspace
+pnpm test          # Checkout tests and package Vitest suites
+pnpm format:check  # Prettier check
+pnpm build         # Build all packages and applications
+```
+
+## Branch Model and Merge Process — `main` and `next` (CANONICAL)
+
+**Every contribution targets `next` first. No exceptions.** Features, fixes, tests,
+docs, and policy changes all take the same route; urgency changes queue priority,
+never the route. Agents never commit to or merge into `main`.
+
+| Branch | Role                                                             | Who merges into it                                                          |
+| ------ | ---------------------------------------------------------------- | --------------------------------------------------------------------------- |
+| `next` | Integration trunk — the only PR target for contributions         | The designated merge-gate agent, after all gates pass. Never the PR author. |
+| `main` | Stable/release line — receives promotion merges from `next` only | Jason only (or an agent he explicitly delegates for a named promotion).     |
+
+### Contribution sequencing (in order, no skipping)
+
+1. **Issue first.** Work is tracked in a Gitea issue before a branch exists. The
+   issue number appears in the branch name and the PR body.
+2. **Branch from the current `origin/next` head.** Name it
+   `feat/…`, `fix/…`, `docs/…`, or `test/…` with the issue number
+   (e.g. `docs/1214-branch-process`). Record the base SHA in the PR body.
+3. **Develop with evidence.** Applicable tests accompany the change. Hooks are
+   never bypassed (`--no-verify` is prohibited). Stage explicit paths — never
+   `git add -A`.
+4. **Open the PR against `next`.** The body states: scope, base SHA,
+   verification commands with results, and any known pre-existing failures on
+   the base — documented, not retried to green and not absorbed silently.
+5. **CI must be terminal-green on the exact head.** All bounded Woodpecker
+   steps succeed (`verify-terminal-green` contract). Pipelines for fork PRs
+   start `blocked`; a maintainer approves the run — approving CI is not
+   approving the PR.
+6. **Independent review. Self-merge is prohibited** — for every agent, on every
+   PR, including trivial ones. Where the change touches protected or
+   contract-bearing content, the reviewer verifies the exact head
+   (exact-byte/exact-blob comparison), not a description of it. An `AMEND`
+   verdict returns the PR to its author; the reviewer's gate stays held until
+   a fresh exact head passes.
+7. **Merge into `next`** happens only after CI green + review pass, pinned to
+   the reviewed head SHA (a post-review push voids the review).
+8. **Promotion `next` → `main`** is a deliberate, Jason-owned reconciliation
+   merge — not part of any contribution's lifecycle. Contributors are done at
+   step 7.
+
+### Responsibilities
+
+- **Contributor** — base pinning, green CI, evidence in the PR body,
+  responding to AMEND verdicts, never merging own work.
+- **Reviewer / merge gate** — independent verification on the exact head;
+  holds and lifts gates; executes the merge into `next`.
+- **Orchestrator / adjudicator** — cross-PR sequencing, disposition when PRs
+  collide, conflict adjudication.
+- **Jason** — `next` → `main` promotions, merge-authority grants, collaborator
+  and token provisioning. Agents cannot grant themselves or each other any of
+  these.
+
+### Hotfixes and divergence
+
+- A hotfix follows the same path: branch from `next`, PR to `next`, gates,
+  merge, then an expedited Jason-owned promotion if `main` needs it urgently.
+  Committing the fix to `main` directly is prohibited even under pressure.
+- **Never land work on `main` that is not on `next`.** This has happened
+  (issue #1152's goal controller reached `main` without reaching `next`) and
+  every later PR paid for it. If it happens anyway: transplant the work onto
+  a `next`-based branch with provenance-preserving commits
+  (`git cherry-pick -x` or explicit SHA references in the messages), PR it
+  through the normal gates, and let promotion re-align `main`. Do not
+  hand-patch `main` to compensate.
+- Force-pushing a branch you do not own is prohibited; rebasing your own PR
+  branch is fine before review, and voids any review already given.
+
+## Database and Local Runtime Safety
+
+- Current local data-layer work uses in-process PGlite; leave `DATABASE_URL` unset.
+- PostgreSQL execution is held until KBN-101-00, KBN-101-03, and KBN-101-05 land.
+- Do not invoke a migration runner, initialization SQL, or the Compose PostgreSQL service from this checkout.
+- Do not start Gateway/Web or run root `pnpm dev` as a local PGlite route. The current dotenv loader can inherit a daemon PostgreSQL DSN; KBN-101-02 must make that path fail closed first.
+- Migration artifact generation is offline and does not authorize PostgreSQL access:
+
+```bash
+pnpm --filter @mosaicstack/db db:generate
+```
 
 ## docs/TASKS.md — Schema (CANONICAL)
 

CLAUDE.md

@@ -1,46 +1,5 @@
-# CLAUDE.md — Mosaic Stack
+# Claude Compatibility Pointer
 
-## Project
+@AGENTS.md
 
-Self-hosted, multi-user AI agent platform. TypeScript monorepo.
-
-## Stack
-
-- **API**: NestJS + Fastify adapter (`apps/gateway`)
-- **Web**: Next.js 16 + React 19 (`apps/web`)
-- **ORM**: Drizzle ORM + PostgreSQL 17 + pgvector (`packages/db`)
-- **Auth**: BetterAuth (`packages/auth`)
-- **Agent**: Pi SDK (`packages/agent`, `packages/mosaic`)
-- **Queue**: Valkey 8 (`packages/queue`)
-- **Build**: pnpm workspaces + Turborepo
-- **CI**: Woodpecker CI
-- **Observability**: OpenTelemetry → Jaeger
-
-## Commands
-
-```bash
-pnpm typecheck        # TypeScript check (all packages)
-pnpm lint             # ESLint (all packages)
-pnpm format:check     # Prettier check
-pnpm test             # Vitest (all packages)
-pnpm build            # Build all packages
-
-# Database
-pnpm --filter @mosaicstack/db db:generate  # Offline migration artifact generation only
-# PostgreSQL execution is held until KBN-101-00/-03/-05 land. Do not invoke a runner,
-# init SQL, or Compose PostgreSQL service from this checkout.
-
-# Dev: local PGlite data-layer work needs no PostgreSQL. Optional local queue service only:
-docker compose up -d valkey
-# Do not start Gateway/Web or root pnpm dev as a local PGlite route: the current unguarded dotenv
-# loader can inherit a daemon PostgreSQL DSN. KBN-101-02 must make that state fail closed first.
-```
-
-## Conventions
-
-- ESM everywhere (`"type": "module"`, `.js` extensions in imports)
-- NodeNext module resolution
-- Explicit `@Inject()` decorators in NestJS (tsx/esbuild doesn't support emitDecoratorMetadata)
-- DTOs in `*.dto.ts` files at module boundaries
-- OTEL tracing imported before NestJS bootstrap (`import './tracing.js'`)
-- All three gates must pass before push: typecheck, lint, format:check
+Do not add project guidance here. Keep `AGENTS.md` authoritative so every agent runtime receives the same instructions.

README.md

@@ -48,9 +48,13 @@ mosaic wizard        # Full guided setup (gateway install → verify)
 
 ### Requirements
 
-- Node.js ≥ 20
+- Node.js ≥ 22
 - npm (for global @mosaicstack/mosaic install)
-- One or more runtimes: [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai), or [Pi](https://github.com/mariozechner/pi-coding-agent)
+- One or more runtimes:
+  - [Claude Code](https://docs.anthropic.com/en/docs/claude-code)
+  - [Codex](https://github.com/openai/codex)
+  - [OpenCode](https://opencode.ai)
+  - [Pi](https://pi.dev)
 
 ## Usage
 
@@ -70,6 +74,14 @@ The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md
 
 Pi launches default to a token-lean skill posture: `mosaic pi` passes `--no-skills` so Pi does not preload every global skill description into the system prompt. Use `MOSAIC_PI_SKILL_MODE=all mosaic pi` for the legacy all-skills catalog, or `MOSAIC_PI_SKILL_MODE=discover mosaic pi` to let Pi use its native settings/project skill discovery.
 
+Mosaic also loads its Pi extensions from `~/.config/mosaic/runtime/pi/`. Inside Pi,
+`/goal set <statement>` starts a bounded persistent loop that checks every turn and successful
+compaction, requires two evidence-bearing completion reports, and can be inspected or stopped with
+`/goal status`, `/goal pause`, `/goal resume`, and `/goal cancel`. Controller-owned goal-state
+entries redact common credential shapes, but Pi's model/tool-call history is separate, so goals and
+evidence must never contain secrets or raw sensitive output. Mosaic does not install this extension
+into `~/.pi/agent/extensions/`.
+
 ### TUI & Gateway
 
 ```bash
@@ -134,9 +146,9 @@ mosaic brain tasks
 mosaic brain conversations
 
 # Agent forge pipeline
-mosaic forge run
+mosaic forge run [--simulate]        # fails closed (FORGE_NO_EXECUTOR) with no executor wired; --simulate for typed simulated runs
 mosaic forge status
-mosaic forge resume
+mosaic forge resume [--simulate]     # same fail-closed rule as forge run
 mosaic forge personas
 
 # Structured logging
@@ -200,7 +212,7 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 
 ### Prerequisites
 
-- Node.js ≥ 20
+- Node.js ≥ 22
 - pnpm 10.6+
 - Docker & Docker Compose
 
@@ -327,7 +339,7 @@ The framework is the bash-based standards layer installed to every developer mac
 ├── bin/mosaic             ← Unified launcher (claude, codex, opencode, pi, yolo)
 ├── guides/                ← E2E delivery, orchestrator protocol, PRD, etc.
 ├── runtime/               ← Per-runtime configs (claude/, codex/, opencode/, pi/)
-├── skills/                ← Universal skills (synced from agent-skills repo)
+├── skills/                ← Universal skills (shipped with the framework package)
 ├── tools/                 ← Tool suites (orchestrator, git, quality, prdy, etc.)
 └── memory/                ← Persistent agent memory (preserved across upgrades)
 ```

REPORT-A1207.md

@@ -0,0 +1,71 @@
+# REPORT A1207
+
+Date: 2026-08-13
+Branch: `fix/869-lease-probe-timeout`
+Starting head: `2373a5ad345fb316ad2460f6390baab1f45ba08f`
+Base: `216cd72226cd9ee17eea461cfe7cd0e010a22f02`
+
+## What changed
+
+- Added Python behavior tests using isolated temporary directories and marker-writing fake `mosaic` executables. They prove that the supplied `PATH` wins over ambient `os.environ["PATH"]`, and that absent or empty supplied `PATH` values do not search ambient paths, platform defaults, or the current directory.
+- Bound Python override behavior with executable fakes: a valid `MOSAIC_LEASE_VERSION_PROBE_COMMAND` wins over supplied and ambient `PATH`; an invalid override returns `None` without PATH fallback.
+- Added a Python runner binding test that captures kwargs and requires `timeout=10.0`. Existing timeout, transport-error, and nonzero-exit checks remain fail-closed with `None`.
+- Added the optional TypeScript dependency-injection seam `CapabilityProbeExecFile`, defaulting to the existing real `execFileSync` implementation. Production callers have no behavior change.
+- Added TypeScript tests that capture child-process options and require exactly `timeout: 10_000`. Injected timeout, spawn-error, nonzero-exit, unparseable JSON, and malformed-object cases all return `null`.
+- Removed the ambient no-dependency TypeScript smoke case that could execute a built checkout's real CLI. Default resolver and supervisor behavior retain their isolated tests, while capability transport tests now use an isolated artifact or the injected transport.
+
+No Python production code changed relative to `2373a5ad`. The only production delta is the optional TypeScript child-process injection seam.
+
+## Hermeticity incident and correction
+
+An initial ambient-lookup mutation run exposed that the pre-existing Python "not resolvable" test left ambient process PATH uncontrolled. On this host, that mutation resolved and executed the host `mosaic` capability probe. A post-build intermediate TypeScript run also let the pre-existing no-dependency smoke case execute the checkout's built `dist/cli.js` capability probe. No `claude` process was run. I then isolated the Python test's ambient PATH, removed the TypeScript ambient smoke case, repeated the PATH mutation using only marker-writing temporary fakes, and repeated the final suites without either real probe path.
+
+## Mutation evidence
+
+Each mutation was applied independently, its focused suite was run, and the production source was restored before the final run.
+
+| Mutation                                                                                   | Result              | Reddened test name(s)                                                                                                                                                                                                      |
+| ------------------------------------------------------------------------------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `shutil.which("mosaic", path=environ.get("PATH", ""))` to ambient `shutil.which("mosaic")` | RED, three failures | `ProbeActivationCapabilityTest.test_supplied_path_wins_over_ambient_process_path`; `ProbeActivationCapabilityTest.test_absent_or_empty_supplied_path_never_falls_back_or_executes` for both absent and empty PATH subtests |
+| Python `PROBE_TIMEOUT_SECONDS: 10.0` to `2.0`                                              | RED, one failure    | `ProbeActivationCapabilityTest.test_probe_passes_ten_second_timeout_to_runner`                                                                                                                                             |
+| TypeScript `LEASE_CAPABILITY_PROBE_TIMEOUT_MS: 10_000` to `2_000`                          | RED, one failure    | `defaultCapabilityProbe > passes the exact ten-second timeout to the injected child-process transport`                                                                                                                     |
+
+## Final test run
+
+Dependencies were installed first with `pnpm install --frozen-lockfile`. Workspace dependencies were then built with `pnpm --filter '@mosaicstack/mosaic...' run build` so package type declarations were available.
+
+```text
+$ cd packages/mosaic && python3 src/mutator-gate/version_coupling_unittest.py
+...................
+----------------------------------------------------------------------
+Ran 19 tests in 0.007s
+
+OK
+
+$ pnpm exec vitest run src/commands/lease-activation-probe.spec.ts
+✓ src/commands/lease-activation-probe.spec.ts (20 tests) 80ms
+Test Files  1 passed (1)
+Tests       20 passed (20)
+```
+
+```text
+$ pnpm exec prettier --check packages/mosaic/src/commands/lease-activation-probe.ts packages/mosaic/src/commands/lease-activation-probe.spec.ts
+Checking formatting...
+All matched files use Prettier code style!
+
+$ pnpm --filter @mosaicstack/mosaic lint
+> eslint src
+
+$ pnpm --filter @mosaicstack/mosaic typecheck
+> tsc --noEmit
+
+$ python3 -m py_compile packages/mosaic/src/mutator-gate/version_coupling_unittest.py packages/mosaic/framework/tools/lease-broker/activation_version_gate.py
+
+$ git diff --check
+```
+
+All commands above exited zero.
+
+## Ambiguities skipped
+
+None.

apps/gateway/package.json

@@ -28,6 +28,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.80.0",
     "@fastify/helmet": "^13.0.2",
+    "@fastify/static": "^8.3.0",
     "@mariozechner/pi-ai": "^0.65.0",
     "@mariozechner/pi-coding-agent": "^0.65.0",
     "@modelcontextprotocol/sdk": "^1.27.1",

apps/gateway/src/__tests__/conversation-persistence.test.ts

@@ -417,7 +417,7 @@ describe('ConversationsController — search endpoint', () => {
       },
     ];
     brain = createMockBrain({ searchResults });
-    controller = new ConversationsController(brain as never);
+    controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
   });
 
   it('returns matching messages for a valid search query', async () => {
@@ -479,7 +479,7 @@ describe('ConversationsController — search endpoint', () => {
 describe('ConversationsController — message CRUD', () => {
   it('listMessages returns 404 when conversation is not owned by user', async () => {
     const brain = createMockBrain({ conversation: undefined });
-    const controller = new ConversationsController(brain as never);
+    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
 
     await expect(controller.listMessages(CONV_ID, { id: USER_ID })).rejects.toBeInstanceOf(
       NotFoundException,
@@ -489,7 +489,7 @@ describe('ConversationsController — message CRUD', () => {
   it('listMessages returns the messages for an owned conversation', async () => {
     const msgs = [makeMessage('user', 'Test message'), makeMessage('assistant', 'Test reply')];
     const brain = createMockBrain({ conversation: makeConversation(), messages: msgs });
-    const controller = new ConversationsController(brain as never);
+    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
 
     const result = await controller.listMessages(CONV_ID, { id: USER_ID });
 
@@ -500,7 +500,7 @@ describe('ConversationsController — message CRUD', () => {
 
   it('addMessage returns the persisted message', async () => {
     const brain = createMockBrain({ conversation: makeConversation() });
-    const controller = new ConversationsController(brain as never);
+    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
 
     const result = await controller.addMessage(
       CONV_ID,

apps/gateway/src/__tests__/cross-user-isolation.test.ts

@@ -190,7 +190,13 @@ beforeEach((ctx) => {
 });
 
 afterAll(async () => {
-  if (!handle) return;
+  // Cleanup only when the fixture actually installed rows. `handle` is set
+  // before the first query (createDb connects lazily), so on an unreachable
+  // database `handle` is truthy while nothing was inserted — cleanup must
+  // honor `dbAvailable` or the skip path fails the file with ECONNREFUSED in
+  // afterAll (caught live by the publish pipeline's no-DATABASE_URL verify
+  // step, pipeline 2486).
+  if (!handle || !dbAvailable) return;
   const db = handle.db;
 
   // Delete in dependency order (FK constraints)

apps/gateway/src/__tests__/hierarchy-route-inventory.test.ts

@@ -0,0 +1,106 @@
+import { RequestMethod, type Type } from '@nestjs/common';
+import { describe, expect, it } from 'vitest';
+import { AppModule } from '../app.module.js';
+import { HierarchyModule } from '../hierarchy/hierarchy.module.js';
+
+/**
+ * Hierarchy route-inventory baseline (contract 1 §6.3(a)).
+ *
+ * M4-1b-i ships the audit event + outbox machinery with NO mutation routes:
+ * the hierarchy command family (controllers + DTOs) lands in M4-1b-ii once
+ * contract 2 merges. This witness enumerates every route the AppModule graph
+ * declares and pins that baseline, so a hierarchy route appearing before its
+ * command-family witnesses exist fails here first. When M4-1b-ii lands, this
+ * baseline is replaced by an exact inventory of the command family.
+ */
+
+interface RouteEntry {
+  method: string;
+  path: string;
+  controller: string;
+}
+
+/** Module-metadata entry: a module class or a DynamicModule-shaped object. */
+type ModuleEntry =
+  | Type<unknown>
+  | { module: Type<unknown>; imports?: unknown[]; controllers?: Type<unknown>[] };
+
+function collectControllers(root: ModuleEntry): Type<unknown>[] {
+  const visited = new Set<unknown>();
+  const controllers: Type<unknown>[] = [];
+  const walk = (entry: ModuleEntry | undefined | null): void => {
+    if (!entry || visited.has(entry)) return;
+    visited.add(entry);
+    const moduleClass = typeof entry === 'function' ? entry : entry.module;
+    // Entries with no resolvable class (forwardRef wrappers, async dynamic
+    // modules) carry no decorator metadata to read here.
+    if (typeof moduleClass !== 'function') return;
+    if (visited.has(moduleClass) && typeof entry !== 'function') return;
+    visited.add(moduleClass);
+    // 'controllers' / 'imports' are the metadata keys the @Module decorator writes.
+    const declared = (Reflect.getMetadata('controllers', moduleClass) ?? []) as Type<unknown>[];
+    controllers.push(...declared);
+    if (typeof entry !== 'function' && entry.controllers) controllers.push(...entry.controllers);
+    const imports = [
+      ...((Reflect.getMetadata('imports', moduleClass) ?? []) as ModuleEntry[]),
+      ...(typeof entry !== 'function' ? ((entry.imports ?? []) as ModuleEntry[]) : []),
+    ];
+    for (const imported of imports) walk(imported);
+  };
+  walk(root);
+  return controllers;
+}
+
+function routesOf(controller: Type<unknown>): RouteEntry[] {
+  // 'path' on the class is the @Controller prefix; 'path'/'method' on a
+  // handler are written by the @Get/@Post/... route decorators.
+  const base = (Reflect.getMetadata('path', controller) ?? '') as string | string[];
+  const bases = Array.isArray(base) ? base : [base];
+  const routes: RouteEntry[] = [];
+  const prototype = controller.prototype as Record<string, unknown>;
+  for (const name of Object.getOwnPropertyNames(prototype)) {
+    if (name === 'constructor') continue;
+    const handler = Object.getOwnPropertyDescriptor(prototype, name)?.value;
+    if (typeof handler !== 'function') continue;
+    const method = Reflect.getMetadata('method', handler) as number | undefined;
+    if (method === undefined) continue;
+    const sub = (Reflect.getMetadata('path', handler) ?? '/') as string;
+    for (const prefix of bases) {
+      const path = `/${prefix}/${sub}`.replace(/\/+/g, '/').replace(/(.)\/$/, '$1');
+      routes.push({
+        method: RequestMethod[method] ?? String(method),
+        path,
+        controller: controller.name,
+      });
+    }
+  }
+  return routes;
+}
+
+describe('hierarchy route-inventory baseline (§6.3(a))', () => {
+  const inventory = collectControllers(AppModule).flatMap(routesOf);
+
+  it('control: the enumeration sees the known route surface', () => {
+    const paths = inventory.map((r) => `${r.method} ${r.path}`);
+    expect(paths).toContain('GET /health');
+    expect(paths).toContain('POST /api/workspaces');
+    expect(paths).toContain('GET /api/teams');
+    expect(inventory.length).toBeGreaterThan(20);
+  });
+
+  it('declares zero hierarchy mutation routes before M4-1b-ii', () => {
+    const hierarchyRoutes = inventory.filter((r) =>
+      /hierarch|compan|estate|platform[-_]?project/i.test(r.path),
+    );
+    expect(
+      hierarchyRoutes,
+      'a hierarchy route landed without replacing the §6.3(a) baseline with a command-family inventory',
+    ).toEqual([]);
+  });
+
+  it('HierarchyModule itself declares no controllers', () => {
+    expect((Reflect.getMetadata('controllers', HierarchyModule) ?? []) as unknown[]).toEqual([]);
+    const hierarchyControllers = collectControllers(HierarchyModule);
+    expect(hierarchyControllers).toEqual([]);
+  });
+});

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -35,6 +35,25 @@ function payload(content: string, messageId: string, correlationId: string): Dis
   };
 }
 
+/**
+ * The chat runtime router must never be exercised on the Discord approval/stop control paths —
+ * those paths run entirely through the command-authorization, runtime-provider and durable-session
+ * dependencies. Placed in the gateway's chat-runtime-router slot (the former direct `AgentService`
+ * slot) so any accidental chat-runtime dispatch throws loudly instead of silently passing. Because
+ * approval/stop never resolve a chat runtime, this fixture is never triggered and the integration
+ * stays a GREEN cross-surface control.
+ */
+function failIfUsedChatRuntimeRouter() {
+  return {
+    onModuleInit: () => {
+      throw new Error('chat runtime router must not initialise on the Discord control path');
+    },
+    get active(): never {
+      throw new Error('chat runtime must not be resolved on the Discord approval/stop path');
+    },
+  };
+}
+
 function authorization(): CommandAuthorizationService {
   const entries = new Map<string, string>();
   return new CommandAuthorizationService(
@@ -113,7 +132,7 @@ describe('interaction Discord/CLI durable-session integration', () => {
       },
     );
     const gateway = new ChatGateway(
-      {} as never,
+      failIfUsedChatRuntimeRouter() as never,
       {} as never,
       {} as never,
       {} as never,

apps/gateway/src/__tests__/required-security-wiring.test.ts

@@ -0,0 +1,332 @@
+import { type Type } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import type { SlashCommandPayload } from '@mosaicstack/types';
+import { describe, expect, it, vi } from 'vitest';
+import { AgentService, type AgentSession } from '../agent/agent.service.js';
+import { ProviderService } from '../agent/provider.service.js';
+import { AppModule } from '../app.module.js';
+import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
+import { CommandExecutorService } from '../commands/command-executor.service.js';
+import { CommandsModule } from '../commands/commands.module.js';
+import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
+import { PreferencesModule } from '../preferences/preferences.module.js';
+import { SystemOverrideService } from '../preferences/system-override.service.js';
+
+const fakeDb = {
+  $client: { exec: async (): Promise<void> => {} },
+  execute: async (): Promise<{ rows: unknown[] }> => ({ rows: [] }),
+  select: () => ({
+    from: () => ({
+      where: async (): Promise<Array<{ count: number }>> => [{ count: 1 }],
+    }),
+  }),
+  insert: () => ({ values: async (): Promise<void> => {} }),
+};
+
+const fakeProviderService = {
+  onModuleInit: async (): Promise<void> => {},
+  onModuleDestroy: (): void => {},
+  getRegistry: () => ({ getAvailable: () => [], getAll: () => [], find: () => undefined }),
+  getDefaultModel: () => undefined,
+  listAvailableModels: () => [],
+  listProviders: () => [],
+  getAdapter: () => undefined,
+  getProvidersHealth: () => [],
+};
+
+function compileRealAppGraph(): Promise<TestingModule> {
+  return Test.createTestingModule({ imports: [AppModule] })
+    .overrideProvider('DB_HANDLE')
+    .useValue({ db: fakeDb, close: async (): Promise<void> => {} })
+    .overrideProvider('DB')
+    .useValue(fakeDb)
+    .overrideProvider('STORAGE_ADAPTER')
+    .useValue({
+      name: 'required-security-wiring-test',
+      migrate: async (): Promise<void> => {},
+      close: async (): Promise<void> => {},
+    })
+    .overrideProvider('AUTH')
+    .useValue({})
+    .overrideProvider('BRAIN')
+    .useValue({ conversations: {}, agents: {} })
+    .overrideProvider('LOG_SERVICE')
+    .useValue({})
+    .overrideProvider('MEMORY')
+    .useValue({})
+    .overrideProvider('MEMORY_ADAPTER')
+    .useValue({})
+    .overrideProvider(ProviderService)
+    .useValue(fakeProviderService)
+    .compile();
+}
+
+function providerToken(provider: unknown): unknown {
+  return typeof provider === 'function' ? provider : (provider as { provide?: unknown })?.provide;
+}
+
+interface MaskingConsumer {
+  moduleType: Type<unknown>;
+  token: Type<unknown>;
+  useValue: object;
+}
+
+async function compileWithoutProvider(
+  moduleType: Type<unknown>,
+  missingToken: Type<unknown>,
+  maskingConsumer: MaskingConsumer,
+): Promise<{ error: unknown; moduleRef: TestingModule | undefined }> {
+  const touchedModules = new Set([moduleType, maskingConsumer.moduleType]);
+  const originals = Array.from(touchedModules, (touchedModule: Type<unknown>) => ({
+    moduleType: touchedModule,
+    providers: (Reflect.getMetadata('providers', touchedModule) ?? []) as unknown[],
+    exports: (Reflect.getMetadata('exports', touchedModule) ?? []) as unknown[],
+  }));
+
+  for (const original of originals) {
+    const providers = original.providers.flatMap((provider: unknown): unknown[] => {
+      const token = providerToken(provider);
+      if (original.moduleType === moduleType && token === missingToken) return [];
+      if (original.moduleType === maskingConsumer.moduleType && token === maskingConsumer.token) {
+        return [{ provide: maskingConsumer.token, useValue: maskingConsumer.useValue }];
+      }
+      return [provider];
+    });
+    const exports = original.exports.filter(
+      (exported: unknown): boolean =>
+        original.moduleType !== moduleType || providerToken(exported) !== missingToken,
+    );
+    Reflect.defineMetadata('providers', providers, original.moduleType);
+    Reflect.defineMetadata('exports', exports, original.moduleType);
+  }
+
+  let moduleRef: TestingModule | undefined;
+  let error: unknown;
+  try {
+    moduleRef = await compileRealAppGraph();
+  } catch (caught: unknown) {
+    error = caught;
+  } finally {
+    for (const original of originals) {
+      Reflect.defineMetadata('providers', original.providers, original.moduleType);
+      Reflect.defineMetadata('exports', original.exports, original.moduleType);
+    }
+  }
+  return { error, moduleRef };
+}
+
+async function closeIfCompiled(moduleRef: TestingModule | undefined): Promise<void> {
+  if (moduleRef) await moduleRef.close();
+}
+
+describe('required security wiring — real AppModule startup refusal', () => {
+  it('FL-01 positive control: the real graph compiles when CommandAuthorizationService is bound', async () => {
+    const moduleRef = await compileRealAppGraph();
+    try {
+      expect(moduleRef.get(CommandAuthorizationService, { strict: false })).toBeInstanceOf(
+        CommandAuthorizationService,
+      );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('FL-01 negative control: absence read as permission is refused at module compilation', async () => {
+    const { error, moduleRef } = await compileWithoutProvider(
+      CommandsModule,
+      CommandAuthorizationService,
+      {
+        moduleType: CommandsModule,
+        token: CommandRuntimeApprovalVerifier,
+        useValue: {},
+      },
+    );
+    await closeIfCompiled(moduleRef);
+
+    expect(
+      error,
+      'absence read as permission: AppModule compilation accepted a missing CommandAuthorizationService binding',
+    ).toBeInstanceOf(Error);
+    if (!(error instanceof Error)) return;
+    expect(error.message).toContain('CommandExecutorService');
+    expect(error.message).toContain('CommandAuthorizationService');
+  });
+
+  it('FL-11 positive control: the real graph compiles when SystemOverrideService is bound', async () => {
+    const moduleRef = await compileRealAppGraph();
+    try {
+      expect(moduleRef.get(SystemOverrideService, { strict: false })).toBeInstanceOf(
+        SystemOverrideService,
+      );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('FL-11 negative control: absence read as permission is refused at module compilation', async () => {
+    const { error, moduleRef } = await compileWithoutProvider(
+      PreferencesModule,
+      SystemOverrideService,
+      {
+        moduleType: CommandsModule,
+        token: CommandExecutorService,
+        useValue: {},
+      },
+    );
+    await closeIfCompiled(moduleRef);
+
+    expect(
+      error,
+      'absence read as permission: AppModule compilation accepted a missing SystemOverrideService binding',
+    ).toBeInstanceOf(Error);
+    if (!(error instanceof Error)) return;
+    expect(error.message).toContain('AgentService');
+    expect(error.message).toContain('SystemOverrideService');
+  });
+});
+
+const actorScope = { userId: 'security-user', tenantId: 'security-tenant' };
+const conversationId = 'security-conversation';
+
+function directExecutorWithoutAuthorization(systemOverrideSet: ReturnType<typeof vi.fn>) {
+  const registry = {
+    getManifest: vi.fn(() => ({
+      version: 1,
+      commands: [
+        {
+          name: 'system',
+          aliases: [],
+          description: 'Set instruction authority',
+          scope: 'agent' as const,
+          execution: 'socket' as const,
+          available: true,
+        },
+      ],
+      skills: [],
+    })),
+  };
+  return new CommandExecutorService(
+    registry as never,
+    { getSession: vi.fn() } as never,
+    { set: systemOverrideSet, clear: vi.fn() } as never,
+    { collect: vi.fn() } as never,
+    null,
+    { agents: {} } as never,
+    null,
+    null,
+    { getServerStatuses: vi.fn(() => []), getToolDefinitions: vi.fn(() => []) } as never,
+    undefined as never,
+  );
+}
+
+function directAgentWithoutSystemOverride(piPrompt: ReturnType<typeof vi.fn>): {
+  service: AgentService;
+  session: AgentSession;
+} {
+  const service = new AgentService(
+    {
+      getDefaultModel: vi.fn(() => null),
+      getRegistry: vi.fn(() => ({})),
+      findModel: vi.fn(),
+      listAvailableModels: vi.fn(() => []),
+    } as never,
+    {} as never,
+    {} as never,
+    { available: false } as never,
+    {} as never,
+    { getToolDefinitions: vi.fn(() => []) } as never,
+    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
+    undefined as never,
+    null,
+    { collect: vi.fn().mockResolvedValue(undefined) } as never,
+    null,
+  );
+  const session = {
+    id: conversationId,
+    provider: 'test-provider',
+    modelId: 'test-model',
+    piSession: { prompt: piPrompt },
+    listeners: new Set(),
+    unsubscribe: vi.fn(),
+    createdAt: Date.now(),
+    promptCount: 0,
+    channels: new Set(),
+    skillPromptAdditions: [],
+    sandboxDir: process.cwd(),
+    allowedTools: null,
+    userId: actorScope.userId,
+    tenantId: actorScope.tenantId,
+    metrics: {
+      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+      modelSwitches: 0,
+      messageCount: 0,
+      lastActivityAt: new Date(0).toISOString(),
+    },
+  } as unknown as AgentSession;
+  const internals = service as unknown as { sessions: Map<string, AgentSession> };
+  internals.sessions.set(conversationId, session);
+  return { service, session };
+}
+
+describe('required security wiring — malformed direct absence has zero effects', () => {
+  it('FL-01 refuses command execution before any command effect when authorization is absent', async () => {
+    const systemOverrideSet = vi.fn().mockResolvedValue(undefined);
+    const executor = directExecutorWithoutAuthorization(systemOverrideSet);
+    const payload: SlashCommandPayload = {
+      command: 'system',
+      args: 'authority that must not be stored',
+      conversationId,
+    };
+    let error: unknown;
+
+    try {
+      await executor.execute(payload, actorScope);
+    } catch (caught: unknown) {
+      error = caught;
+    }
+
+    expect
+      .soft(
+        error,
+        'absence read as permission: direct executor accepted missing command authorization',
+      )
+      .toBeInstanceOf(Error);
+    expect
+      .soft(
+        systemOverrideSet,
+        'absence read as permission: command effect occurred without command authorization',
+      )
+      .not.toHaveBeenCalled();
+  });
+
+  it('FL-11 refuses prompt execution before any provider or session effect when system override authority is absent', async () => {
+    const piPrompt = vi.fn().mockResolvedValue(undefined);
+    const { service, session } = directAgentWithoutSystemOverride(piPrompt);
+    let error: unknown;
+
+    try {
+      await service.prompt(conversationId, 'must not reach provider', actorScope);
+    } catch (caught: unknown) {
+      error = caught;
+    }
+
+    expect
+      .soft(
+        error,
+        'absence read as permission: direct session accepted missing system override authority',
+      )
+      .toBeInstanceOf(Error);
+    expect
+      .soft(
+        piPrompt,
+        'absence read as permission: provider prompt occurred without system override authority',
+      )
+      .not.toHaveBeenCalled();
+    expect
+      .soft(
+        session.promptCount,
+        'absence read as permission: session state changed without system override authority',
+      )
+      .toBe(0);
+  });
+});

apps/gateway/src/__tests__/resource-ownership.test.ts

@@ -60,7 +60,7 @@ describe('Resource ownership checks', () => {
     // The repo enforces ownership via the WHERE clause; it returns undefined when the
     // conversation does not belong to the requesting user.
     brain.conversations.findById.mockResolvedValue(undefined);
-    const controller = new ConversationsController(brain as never);
+    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
 
     await expect(controller.findOne('conv-1', { id: 'user-1' })).rejects.toBeInstanceOf(
       NotFoundException,

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -26,7 +26,7 @@ function makeService(operatorMemory: unknown = null): AgentService {
     {} as never,
     { getToolDefinitions: vi.fn(() => []) } as never,
     { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
-    null,
+    { get: vi.fn().mockResolvedValue(null), renew: vi.fn().mockResolvedValue(undefined) } as never,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
     operatorMemory as never,

apps/gateway/src/agent/__tests__/session-ownership.test.ts

@@ -1,6 +1,8 @@
+import 'reflect-metadata';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { ForbiddenException, NotFoundException } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
 import { describe, expect, it, vi } from 'vitest';
 
 vi.mock('../agent.service.js', () => ({ AgentService: class AgentService {} }));
@@ -12,10 +14,25 @@ vi.mock('../routing/routing-engine.service.js', () => ({
 }));
 
 import { SessionsController } from '../sessions.controller.js';
+import { AgentService } from '../agent.service.js';
 import { ChatController } from '../../chat/chat.controller.js';
 import { ChatGateway } from '../../chat/chat.gateway.js';
 import type { AgentSession } from '../agent.service.js';
 import type { SessionInfoDto } from '../session.dto.js';
+import type { HarnessAdapter, HarnessConversationService } from '@mosaicstack/types';
+import { AuthGuard } from '../../auth/auth.guard.js';
+import { AUTH } from '../../auth/auth.tokens.js';
+import { BRAIN } from '../../brain/brain.tokens.js';
+import { CommandRegistryService } from '../../commands/command-registry.service.js';
+import { CommandExecutorService } from '../../commands/command-executor.service.js';
+import { RoutingEngineService } from '../routing/routing-engine.service.js';
+import { ChatRuntimeRouter } from '../../chat/chat-runtime-router.js';
+import { EmbeddedChatRuntime } from '../../chat/embedded-chat.runtime.js';
+import { ownConversation } from '../../chat/chat-runtime.js';
+import type { LegacyRuntimeStream } from '../../chat/chat-runtime.js';
+import { HarnessChatRuntime } from '../../chat/harness-chat.runtime.js';
+import { HarnessRegistry } from '../../harness/harness.registry.js';
+import { HARNESS_CONVERSATION_SERVICE_UNAVAILABLE } from '../../harness/harness.tokens.js';
 
 const USER_A = { id: 'user-a', tenantId: 'tenant-a' };
 const USER_B = { id: 'user-b', tenantId: 'tenant-b' };
@@ -74,6 +91,12 @@ function makeAgentSession(owner = USER_A): AgentSession {
   };
 }
 
+/**
+ * A shape-complete, non-throwing AgentService fake scoped so that USER_B (a foreign owner guessing
+ * USER_A's conversation id) is never granted the session. Because every method exists and no method
+ * throws for a wrong shape, production runs to its real ownership decision — the RED never comes from
+ * a `getSession is not a function` TypeError, only from a router-boundary/scope assertion mismatch.
+ */
 function makeScopedAgentService() {
   const foreign = makeAgentSession(USER_A);
   return {
@@ -87,7 +110,7 @@ function makeScopedAgentService() {
     getSession: vi.fn((_id: string, scope?: { userId: string; tenantId?: string }) =>
       scope?.userId === USER_B.id ? undefined : foreign,
     ),
-    createSession: vi.fn().mockRejectedValue(new ForbiddenException('Session scope mismatch')),
+    createSession: vi.fn().mockRejectedValue(new NotFoundException('Session scope mismatch')),
     onEvent: vi.fn(() => vi.fn()),
     addChannel: vi.fn(),
     removeChannel: vi.fn(),
@@ -96,6 +119,201 @@ function makeScopedAgentService() {
   };
 }
 
+type ScopedAgentService = ReturnType<typeof makeScopedAgentService>;
+
+/**
+ * A structurally-complete harness conversation service that throws if any method is invoked.
+ * Fronted behind the legacy runtime's harness slot: the legacy path must never reach it.
+ */
+const failIfUsedConversationService = {
+  attach: () => {
+    throw new Error('harness conversation service must not be reached on the legacy path');
+  },
+  detach: () => {
+    throw new Error('harness conversation service must not be reached on the legacy path');
+  },
+  send: () => {
+    throw new Error('harness conversation service must not be reached on the legacy path');
+  },
+
+  subscribeFrom: async function* () {
+    throw new Error('harness conversation service must not be reached on the legacy path');
+  },
+} as unknown as HarnessConversationService;
+
+/** A structurally-complete, non-sentinel conversation service used to satisfy the pi-rpc readiness gate. */
+const boundConversationService = {
+  attach: () => Promise.reject(new Error('unused')),
+  detach: () => Promise.reject(new Error('unused')),
+  send: () => Promise.reject(new Error('unused')),
+
+  subscribeFrom: async function* () {
+    throw new Error('unused');
+  },
+} as unknown as HarnessConversationService;
+
+function registryWith(adapterIds: readonly string[]): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  for (const id of adapterIds) {
+    registry.register({
+      id,
+      describe: () => Promise.reject(new Error('unused')),
+      catalog: () => Promise.reject(new Error('unused')),
+      create: () => Promise.reject(new Error('unused')),
+      resume: () => Promise.reject(new Error('unused')),
+    } as HarnessAdapter);
+  }
+  return registry;
+}
+
+/**
+ * Build the real legacy-mode {@link ChatRuntimeRouter} fronting a real {@link EmbeddedChatRuntime}
+ * that holds the scoped AgentService fake. This is the ONLY path server-derived scope may travel to
+ * reach an AgentService: controller/gateway → ChatRuntimeRouter → EmbeddedChatRuntime → AgentService.
+ * The `embeddedAgentService` handed here is a SEPARATE instance from the directly-injected fake, so a
+ * call landing on it proves the router-delegation redesign is live rather than the old direct path.
+ */
+function legacyRouterFronting(agentService: unknown): ChatRuntimeRouter {
+  const embedded = new EmbeddedChatRuntime(agentService as never);
+  const harness = new HarnessChatRuntime(failIfUsedConversationService);
+  const router = new ChatRuntimeRouter(
+    new HarnessRegistry(),
+    HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    embedded,
+    harness,
+    'legacy',
+  );
+  router.onModuleInit();
+  return router;
+}
+
+/**
+ * The AgentService method names the controller/gateway must NEVER drive on the runtime at the
+ * delegation boundary. An AgentService-shaped router shim (a method-for-method mirror) would record
+ * one of these instead of the frozen legacy op, so asserting their ABSENCE from the observed runtime
+ * call set defeats the shim on INVOCATION evidence — never satisfiable by dead source text.
+ */
+const FORBIDDEN_AGENT_OPS = [
+  'getSession',
+  'createSession',
+  'onEvent',
+  'addChannel',
+  'prompt',
+  'setThinking',
+  'abort',
+] as const;
+
+/**
+ * Wrap a real {@link ChatRuntimeRouter} in a call-recording Proxy. Every property access that yields
+ * an OWN/inherited callable is returned as a thin wrapper that appends the method name to `calls` at
+ * INVOCATION time and forwards to the real method (bound to the real target, so the router's internal
+ * delegation to the embedded runtime runs untouched below this boundary). Non-function and MISSING
+ * properties are returned verbatim via Reflect.get — the observer NEVER fabricates a value, returns a
+ * canned outcome, or delegates a not-yet-implemented named op, so it cannot itself become a shim.
+ *
+ * The result is a RUNTIME call set of exactly the methods the controller/gateway invoke ON the router
+ * at the delegation seam. Only an actual call can enter it; a dead method, comment, or string in the
+ * production source cannot. This replaces the earlier `source.toContain('<frozen op>')` proof — which
+ * a dead declaration could satisfy while production still executed a shim — with invocation evidence.
+ */
+function makeRecordingRouter(target: ChatRuntimeRouter, calls: string[]): ChatRuntimeRouter {
+  return new Proxy(target, {
+    get(t, prop) {
+      const value = Reflect.get(t, prop);
+      if (typeof value === 'function' && typeof prop === 'string') {
+        return (...args: unknown[]) => {
+          calls.push(prop);
+          return (value as (...a: unknown[]) => unknown).apply(t, args);
+        };
+      }
+      return value;
+    },
+  }) as ChatRuntimeRouter;
+}
+
+/**
+ * Real Nest DI dual-provider fixture (mirrors the blessed group-3 pattern in chat-security.test.ts).
+ *
+ * BOTH an `AgentService` provider (the FORBIDDEN direct dependency) and a `ChatRuntimeRouter` provider
+ * (fronting a real EmbeddedChatRuntime over a SEPARATE scoped AgentService) are registered. Production
+ * resolves whichever its constructor declares:
+ *   - RED today: the controller/gateway `@Inject(AgentService)` → the direct fake is consulted, the
+ *     router (and its embedded fake) is never reached.
+ *   - GREEN later: the controller/gateway inject `ChatRuntimeRouter` → the direct fake is never
+ *     touched (stays at zero) and scope is observed inside the embedded fake behind the router.
+ * The SAME test body reds today and greens later; a method-for-method AgentService shim on the router
+ * records a FORBIDDEN op (and never the frozen legacy op) in the observed runtime call set, and
+ * restoring the direct injection cannot satisfy the "direct fake at zero" / "embedded fake observed
+ * scope" / "frozen op invoked on the router" anchors. The router is wrapped by {@link
+ * makeRecordingRouter} so those anchors are runtime invocation evidence, not source substrings.
+ */
+function buildRestModule(
+  directAgentService: ScopedAgentService,
+  embeddedAgentService: ScopedAgentService,
+  routerCalls: string[],
+): Promise<TestingModule> {
+  return (
+    Test.createTestingModule({
+      controllers: [ChatController],
+      providers: [
+        { provide: AgentService, useValue: directAgentService },
+        {
+          provide: ChatRuntimeRouter,
+          useFactory: () =>
+            makeRecordingRouter(legacyRouterFronting(embeddedAgentService), routerCalls),
+        },
+      ],
+    })
+      // ChatController's @UseGuards(AuthGuard) is resolved during instance loading; AuthGuard injects
+      // AUTH, an HTTP-only concern never exercised by a direct handler call. Stub it so the graph
+      // resolves and the test reds on BEHAVIOUR, not on a DI collection error.
+      .overrideGuard(AuthGuard)
+      .useValue({ canActivate: () => true })
+      .compile()
+  );
+}
+
+function buildGatewayModule(
+  directAgentService: ScopedAgentService,
+  embeddedAgentService: ScopedAgentService,
+  routerCalls: string[],
+): Promise<TestingModule> {
+  const brain = {
+    conversations: {
+      // The sender OWNS this durable conversation, so the browser-send admission gate lets the turn
+      // reach the router seam. Foreignness is asserted downstream at the in-memory agent session
+      // (getSession({USER_B}) -> undefined), not at durable admission — the admission-rejection
+      // property has its own dedicated coverage.
+      findById: vi.fn().mockResolvedValue({ id: CONVERSATION_ID, userId: USER_B.id }),
+      create: vi.fn().mockResolvedValue(undefined),
+      update: vi.fn().mockResolvedValue(undefined),
+      findMessages: vi.fn().mockResolvedValue([]),
+      addMessage: vi.fn().mockResolvedValue({ id: 'persisted-turn' }),
+    },
+  };
+  return Test.createTestingModule({
+    providers: [
+      ChatGateway,
+      { provide: AgentService, useValue: directAgentService },
+      { provide: AUTH, useValue: { api: { getSession: vi.fn().mockResolvedValue(null) } } },
+      { provide: BRAIN, useValue: brain },
+      { provide: CommandRegistryService, useValue: { getManifest: vi.fn().mockReturnValue([]) } },
+      { provide: CommandExecutorService, useValue: { execute: vi.fn() } },
+      {
+        provide: RoutingEngineService,
+        useValue: {
+          resolve: vi.fn().mockResolvedValue({ provider: 'test', model: 'test-model' }),
+        },
+      },
+      {
+        provide: ChatRuntimeRouter,
+        useFactory: () =>
+          makeRecordingRouter(legacyRouterFronting(embeddedAgentService), routerCalls),
+      },
+    ],
+  }).compile();
+}
+
 describe('TESS-M1-SEC-002 AgentService ownership boundary', () => {
   it('requires explicit owner+tenant scope on protected session operations', () => {
     const source = readFileSync(resolve('src/agent/agent.service.ts'), 'utf8');
@@ -152,50 +370,66 @@ describe('TESS-M1-SEC-002 REST session ownership and tenant binding', () => {
   });
 });
 
-describe('TESS-M1-SEC-002 REST chat send ownership and tenant binding', () => {
-  it('does not send a prompt into another owner/tenant session by guessed conversationId', async () => {
-    const agentService = makeScopedAgentService();
-    const controller = new ChatController(agentService as never);
+describe('TESS-M1-SEC-002 REST chat send ownership and tenant binding (router-delegated legacy runtime)', () => {
+  // TESS test A — REST /api/chat send. The genuine RED is the router-delegation redesign, not a slot
+  // swap: the forbidden directly-injected AgentService must go UNtouched while the server-derived
+  // scope is observed inside the real ChatRuntimeRouter → EmbeddedChatRuntime → AgentService path.
+  it('routes a REST send through completeLegacyRestTurn and never the directly-injected AgentService', async () => {
+    const directAgentService = makeScopedAgentService(); // FORBIDDEN direct dependency
+    const embeddedAgentService = makeScopedAgentService(); // reached ONLY via router → embedded delegation
+    const routerCalls: string[] = []; // runtime call set observed AT the controller → router seam
+    const moduleRef = await buildRestModule(directAgentService, embeddedAgentService, routerCalls);
+    try {
+      const controller = moduleRef.get(ChatController, { strict: false });
 
-    await expect(
-      controller.chat({ conversationId: CONVERSATION_ID, content: 'take over' }, USER_B),
-    ).rejects.toMatchObject({ status: 404 });
+      // Foreign ownership is denied (never resolves) — a control that holds today AND at GREEN.
+      await expect(
+        controller.chat({ conversationId: CONVERSATION_ID, content: 'take over' }, USER_B),
+      ).rejects.toBeDefined();
 
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(agentService.prompt).not.toHaveBeenCalled();
+      // Soft anchors so EVERY anchor is evaluated under each mutation, not just the first to fail.
+
+      // RUNTIME anchor A1 — delegation: the controller must INVOKE the frozen legacy op on the router.
+      // Only an actual call enters routerCalls; a dead method/comment/string cannot. RED today (the
+      // controller @Inject(AgentService) and never calls the router). GREEN once it drives the op.
+      expect
+        .soft(routerCalls, 'controller must invoke completeLegacyRestTurn on the router')
+        .toContain('completeLegacyRestTurn');
+      // RUNTIME anchor A2 — nondelegation: the controller must not drive any AgentService-shaped op on
+      // the router. An AgentService-shaped router shim records one of these → RED, defeating the shim
+      // on invocation evidence (not source text). A dead named method added alongside the shim does not
+      // help: it is never invoked, so it never enters routerCalls while a forbidden op still does.
+      for (const op of FORBIDDEN_AGENT_OPS) {
+        expect
+          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
+          .not.toContain(op);
+      }
+      // RUNTIME anchor A3 — the forbidden directly-injected AgentService stays at zero (fails today;
+      // restoring the direct injection keeps it failing).
+      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
+      // RUNTIME anchor A4 — server-derived scope observed INSIDE the separate embedded fake behind the
+      // router (fails today; the router path is never taken).
+      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+        userId: USER_B.id,
+        tenantId: USER_B.tenantId,
+      });
+
+      // Zero foreign mutation on either path (holds today and at GREEN).
+      expect.soft(directAgentService.prompt).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.prompt).not.toHaveBeenCalled();
+
+      // Defense-in-depth (NOT load-bearing; the runtime anchors above carry the anti-mask): the
+      // controller no longer declares the direct embedded AgentService dependency. A negative source
+      // check cannot be satisfied by dead text — it only fails when the injection is present.
+      const controllerSource = readFileSync(resolve('src/chat/chat.controller.ts'), 'utf8');
+      expect.soft(controllerSource).not.toContain('@Inject(AgentService)');
+    } finally {
+      await moduleRef.close();
+    }
   });
 });
 
-describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding', () => {
-  function makeGateway(agentService = makeScopedAgentService()) {
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue(undefined),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        findMessages: vi.fn().mockResolvedValue([]),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const commandRegistry = { getManifest: vi.fn().mockReturnValue([]) };
-    const commandExecutor = { execute: vi.fn() };
-    const routingEngine = {
-      resolve: vi.fn().mockResolvedValue({ provider: 'test', model: 'test-model' }),
-    };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      commandRegistry as never,
-      commandExecutor as never,
-      routingEngine as never,
-    );
-    return { gateway, agentService };
-  }
-
+describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding (router-delegated legacy runtime)', () => {
   function makeSocket() {
     return {
       id: 'socket-b',
@@ -206,57 +440,519 @@ describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding', () =>
     };
   }
 
-  it('does not attach or send to another owner/tenant session by guessed conversationId', async () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
+  // TESS test B — WebSocket send/attach.
+  it('routes a WebSocket send through prepareLegacySocketTurn and never the directly-injected AgentService', async () => {
+    const directAgentService = makeScopedAgentService();
+    const embeddedAgentService = makeScopedAgentService();
+    const routerCalls: string[] = [];
+    const moduleRef = await buildGatewayModule(
+      directAgentService,
+      embeddedAgentService,
+      routerCalls,
+    );
+    try {
+      const gateway = moduleRef.get(ChatGateway, { strict: false });
+      const socket = makeSocket();
 
-    await gateway.handleMessage(socket as never, {
-      conversationId: CONVERSATION_ID,
-      content: 'attach to foreign session',
-    });
+      await Promise.resolve(
+        gateway.handleMessage(socket as never, {
+          conversationId: CONVERSATION_ID,
+          content: 'attach to foreign session',
+        }),
+      ).catch(() => undefined);
 
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
-    });
-    expect(agentService.onEvent).not.toHaveBeenCalled();
-    expect(agentService.addChannel).not.toHaveBeenCalled();
+      // RUNTIME anchor B1 — delegation: the gateway must invoke the frozen socket op on the router.
+      expect
+        .soft(routerCalls, 'gateway must invoke prepareLegacySocketTurn on the router')
+        .toContain('prepareLegacySocketTurn');
+      // RUNTIME anchor B2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
+      for (const op of FORBIDDEN_AGENT_OPS) {
+        expect
+          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
+          .not.toContain(op);
+      }
+      // RED anchor B3 — forbidden direct AgentService untouched (fails today, gateway injects it).
+      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
+      // RED anchor B4 — scope observed inside router → embedded delegation (fails today, never reached).
+      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+        userId: USER_B.id,
+        tenantId: USER_B.tenantId,
+      });
+      // Foreign session gets zero lease/listener/channel/prompt on EITHER path (holds today and GREEN).
+      expect.soft(directAgentService.onEvent).not.toHaveBeenCalled();
+      expect.soft(directAgentService.addChannel).not.toHaveBeenCalled();
+      expect.soft(directAgentService.prompt).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.onEvent).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.addChannel).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.prompt).not.toHaveBeenCalled();
+      expect
+        .soft(socket.emit)
+        .toHaveBeenCalledWith(
+          'error',
+          expect.objectContaining({ conversationId: CONVERSATION_ID }),
+        );
+
+      // Defense-in-depth (NOT load-bearing): gateway no longer declares the direct dependency.
+      const gatewaySource = readFileSync(resolve('src/chat/chat.gateway.ts'), 'utf8');
+      expect.soft(gatewaySource).not.toContain('@Inject(AgentService)');
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  // TESS test C — WebSocket set:thinking.
+  it('routes set:thinking through setLegacyThinking and never the directly-injected AgentService', async () => {
+    const directAgentService = makeScopedAgentService();
+    const embeddedAgentService = makeScopedAgentService();
+    const routerCalls: string[] = [];
+    const moduleRef = await buildGatewayModule(
+      directAgentService,
+      embeddedAgentService,
+      routerCalls,
+    );
+    try {
+      const gateway = moduleRef.get(ChatGateway, { strict: false });
+      const socket = makeSocket();
+
+      await Promise.resolve(
+        gateway.handleSetThinking(socket as never, {
+          conversationId: CONVERSATION_ID,
+          level: 'high',
+        }),
+      ).catch(() => undefined);
+
+      // RUNTIME anchor C1 — delegation: the gateway must invoke the frozen thinking op on the router.
+      expect
+        .soft(routerCalls, 'gateway must invoke setLegacyThinking on the router')
+        .toContain('setLegacyThinking');
+      // RUNTIME anchor C2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
+      for (const op of FORBIDDEN_AGENT_OPS) {
+        expect
+          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
+          .not.toContain(op);
+      }
+      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+        userId: USER_B.id,
+        tenantId: USER_B.tenantId,
+      });
+      expect
+        .soft(socket.emit)
+        .toHaveBeenCalledWith(
+          'error',
+          expect.objectContaining({ conversationId: CONVERSATION_ID }),
+        );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  // TESS test D — WebSocket abort.
+  it('routes abort through abortLegacyTurn and never the directly-injected AgentService', async () => {
+    const directAgentService = makeScopedAgentService();
+    const embeddedAgentService = makeScopedAgentService();
+    const routerCalls: string[] = [];
+    const moduleRef = await buildGatewayModule(
+      directAgentService,
+      embeddedAgentService,
+      routerCalls,
+    );
+    try {
+      const gateway = moduleRef.get(ChatGateway, { strict: false });
+      const socket = makeSocket();
+
+      await Promise.resolve(
+        gateway.handleAbort(socket as never, { conversationId: CONVERSATION_ID }),
+      ).catch(() => undefined);
+
+      // RUNTIME anchor D1 — delegation: the gateway must invoke the frozen abort op on the router.
+      expect
+        .soft(routerCalls, 'gateway must invoke abortLegacyTurn on the router')
+        .toContain('abortLegacyTurn');
+      // RUNTIME anchor D2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
+      for (const op of FORBIDDEN_AGENT_OPS) {
+        expect
+          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
+          .not.toContain(op);
+      }
+      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
+      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+        userId: USER_B.id,
+        tenantId: USER_B.tenantId,
+      });
+      expect
+        .soft(socket.emit)
+        .toHaveBeenCalledWith(
+          'error',
+          expect.objectContaining({ conversationId: CONVERSATION_ID }),
+        );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  // TESS test E (genuine, unchanged) — pi-rpc browser-legacy refusal.
+  it('rejects a browser legacy raw message in pi-rpc mode with a fixed typed unsupported and executes nothing', async () => {
+    // pi-rpc: the harness runtime is live. The browser legacy `message` path is unsupported and
+    // must be refused with a fixed typed code, touching neither the embedded AgentService nor the
+    // harness conversation service.
+    const agentService = makeScopedAgentService();
+    const embedded = new EmbeddedChatRuntime(agentService as never);
+    const harnessConversation = {
+      attach: vi.fn(),
+      detach: vi.fn(),
+      send: vi.fn(),
+      subscribeFrom: vi.fn(),
+    };
+    const harness = new HarnessChatRuntime(harnessConversation as never);
+    const router = new ChatRuntimeRouter(
+      registryWith(['pi']),
+      boundConversationService,
+      embedded,
+      harness,
+      'pi-rpc',
+    );
+    router.onModuleInit();
+
+    const brain = {
+      conversations: {
+        findById: vi.fn().mockResolvedValue(undefined),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        findMessages: vi.fn().mockResolvedValue([]),
+        addMessage: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+    const gateway = new ChatGateway(
+      router as never,
+      {} as never,
+      brain as never,
+      { getManifest: vi.fn().mockReturnValue([]) } as never,
+      { execute: vi.fn() } as never,
+      { resolve: vi.fn() } as never,
+    );
+    const socket = {
+      id: 'socket-b',
+      connected: true,
+      data: { user: USER_B, session: { id: 'auth-session-b', userId: USER_B.id } },
+      emit: vi.fn(),
+      disconnect: vi.fn(),
+    };
+
+    await Promise.resolve(
+      gateway.handleMessage(socket as never, {
+        conversationId: CONVERSATION_ID,
+        content: 'route me',
+      }),
+    ).catch(() => undefined);
+
+    expect(socket.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ code: 'runtime_unsupported' }),
+    );
+    expect(agentService.getSession).not.toHaveBeenCalled();
     expect(agentService.prompt).not.toHaveBeenCalled();
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
+    expect(harnessConversation.attach).not.toHaveBeenCalled();
+    expect(harnessConversation.send).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Task-5 AMEND — embedded runtime lease lifecycle (G1) + ownership collapse (G5).
+// These drive the real EmbeddedChatRuntime directly over a shape-complete AgentService
+// fake (every touched method exists, so a RED can only come from behavior, never a
+// `getSession is not a function` TypeError). Ownership context is minted through the
+// real `ownConversation` factory — the only sanctioned way to reach a port op.
+// ---------------------------------------------------------------------------
+
+const EMBEDDED_SCOPE = { userId: USER_A.id, tenantId: USER_A.tenantId };
+const CONVERSATION_UNAVAILABLE_RESULT = {
+  ok: false,
+  code: 'conversation_unavailable',
+  retryable: false,
+} as const;
+
+/** A stream sink; `channelId` is server-derived, `onEvent` records nothing here. */
+function makeStream(): LegacyRuntimeStream {
+  return { channelId: 'websocket:test-1', onEvent: vi.fn() };
+}
+
+/**
+ * getSession → undefined (session missing), createSession → rejects with `err`. Exercises the
+ * `resolveOrCreate` collapse branch. `prompt` exists so its ABSENCE from the call record proves
+ * the turn short-circuited before any dispatch.
+ */
+function makeCollapsingAgentService(err: Error) {
+  return {
+    getSession: vi.fn(() => undefined),
+    createSession: vi.fn().mockRejectedValue(err),
+    onEvent: vi.fn(() => vi.fn()),
+    addChannel: vi.fn(),
+    removeChannel: vi.fn(),
+    prompt: vi.fn().mockResolvedValue(undefined),
+    recordTokenUsage: vi.fn(),
+  };
+}
+
+/** getSession → a live owned session, so `resolveOrCreate` succeeds and a lease is built. */
+function makeLeaseAgentService() {
+  const session = makeAgentSession(USER_A);
+  const unsubscribe = vi.fn();
+  const svc = {
+    getSession: vi.fn(() => session),
+    createSession: vi.fn(),
+    onEvent: vi.fn(() => unsubscribe),
+    addChannel: vi.fn(),
+    removeChannel: vi.fn(),
+    prompt: vi.fn().mockResolvedValue(undefined),
+    recordTokenUsage: vi.fn(),
+  };
+  return { svc, unsubscribe, session };
+}
+
+/**
+ * getSession → a live owned session (REST resolveOrCreate succeeds), onEvent returns a `detach`
+ * spy, and `prompt` REJECTS with a non-timeout error. Drives the REST-turn catch path so the single
+ * idempotent teardown must clear the 120s timeout and detach the listener exactly once.
+ */
+function makeRejectingPromptAgentService() {
+  const session = makeAgentSession(USER_A);
+  const detach = vi.fn();
+  const svc = {
+    getSession: vi.fn(() => session),
+    createSession: vi.fn(),
+    onEvent: vi.fn(() => detach),
+    addChannel: vi.fn(),
+    removeChannel: vi.fn(),
+    prompt: vi.fn().mockRejectedValue(new Error('agent backend exploded')),
+    recordTokenUsage: vi.fn(),
+  };
+  return { svc, detach };
+}
+
+describe('TESS Task-5 embedded ownership collapse (missing and foreign are indistinguishable, never throw)', () => {
+  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
+
+  it('collapses a foreign (Forbidden) create to conversation_unavailable and never throws', async () => {
+    const svc = makeCollapsingAgentService(new ForbiddenException('foreign owner'));
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    const result = await runtime.completeLegacyRestTurn(ctx, { content: 'take over' });
+
+    expect(result).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
+    expect(svc.prompt).not.toHaveBeenCalled();
+  });
+
+  it('collapses a missing (NotFound) create to conversation_unavailable and never throws', async () => {
+    const svc = makeCollapsingAgentService(new NotFoundException('no such conversation'));
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    const result = await runtime.completeLegacyRestTurn(ctx, { content: 'hello' });
+
+    expect(result).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
+    expect(svc.prompt).not.toHaveBeenCalled();
+  });
+
+  it('returns the IDENTICAL collapse for foreign and missing so neither can be distinguished', async () => {
+    const foreign = new EmbeddedChatRuntime(
+      makeCollapsingAgentService(new ForbiddenException('foreign owner')) as never,
     );
+    const missing = new EmbeddedChatRuntime(
+      makeCollapsingAgentService(new NotFoundException('no such conversation')) as never,
+    );
+
+    const foreignResult = await foreign.completeLegacyRestTurn(ctx, { content: 'x' });
+    const missingResult = await missing.completeLegacyRestTurn(ctx, { content: 'x' });
+
+    expect(foreignResult).toEqual(missingResult);
+    expect(foreignResult).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
   });
+});
+
+describe('TESS Task-5 embedded socket lease lifecycle (one-shot dispatch, idempotent dispose, partial-setup rollback)', () => {
+  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
+
+  it('dispatches the turn exactly once; a second dispatch is a no-op turn_already_dispatched', async () => {
+    const { svc } = makeLeaseAgentService();
+    const runtime = new EmbeddedChatRuntime(svc as never);
 
-  it('does not mutate thinking level on another owner/tenant session', () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
+    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'first' }, makeStream());
+    expect(prepared.ok).toBe(true);
+    if (!prepared.ok) throw new Error('prepareLegacySocketTurn should succeed');
+    const lease = prepared.value;
 
-    gateway.handleSetThinking(socket as never, { conversationId: CONVERSATION_ID, level: 'high' });
+    const first = await lease.dispatch();
+    expect(first).toEqual({ ok: true, value: undefined });
+    expect(svc.prompt).toHaveBeenCalledTimes(1);
 
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
+    const second = await lease.dispatch();
+    expect(second).toEqual({ ok: false, code: 'turn_already_dispatched', retryable: false });
+    // Zero additional effect — the second dispatch must not prompt again.
+    expect(svc.prompt).toHaveBeenCalledTimes(1);
+  });
+
+  it('disposes once; a second dispose is a silent no-op that never re-detaches or destroys the session', async () => {
+    const { svc, unsubscribe, session } = makeLeaseAgentService();
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'x' }, makeStream());
+    expect(prepared.ok).toBe(true);
+    if (!prepared.ok) throw new Error('prepareLegacySocketTurn should succeed');
+    const lease = prepared.value;
+
+    await lease.dispose();
+    await lease.dispose();
+
+    // Listener + channel torn down exactly once across two dispose calls.
+    expect(unsubscribe).toHaveBeenCalledTimes(1);
+    expect(svc.removeChannel).toHaveBeenCalledTimes(1);
+    // Disposal never terminates the underlying session or process.
+    expect(session.piSession.abort).not.toHaveBeenCalled();
+    expect(session.piSession.dispose).not.toHaveBeenCalled();
+  });
+
+  it('rolls back the acquired listener and returns a total safe failure when channel attach fails mid-setup', async () => {
+    const { svc, unsubscribe } = makeLeaseAgentService();
+    svc.addChannel = vi.fn(() => {
+      throw new Error('channel attach failed');
     });
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
-    );
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    // Must NOT throw out of the port — a partial setup collapses to a total safe failure.
+    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'x' }, makeStream());
+    expect(prepared.ok).toBe(false);
+    // Exactly what was acquired (the event listener) is rolled back.
+    expect(unsubscribe).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('TESS Task-5 embedded REST turn teardown (a prompt rejection frees the timer + listener exactly once)', () => {
+  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
+
+  it('clears the 120s timeout and detaches the listener exactly once when prompt() rejects, leaving no timer to reject the abandoned done-promise later (Task 5 finding 6)', async () => {
+    const { svc, detach } = makeRejectingPromptAgentService();
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    // A rejected `done` promise firing after completeLegacyRestTurn has already returned would
+    // surface as an unhandledRejection — the leak this test fences. Capture any that escape.
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown): void => {
+      unhandled.push(reason);
+    };
+    process.on('unhandledRejection', onUnhandled);
+    vi.useFakeTimers();
+    try {
+      const result = await runtime.completeLegacyRestTurn(ctx, {
+        content: 'trigger a backend failure',
+      });
+
+      // The rejection collapses to a total safe failure (not a timeout) — never throws out of the port.
+      expect(result).toEqual({ ok: false, code: 'operation_failed', retryable: false });
+      // The single idempotent dispose ran in the catch: listener detached exactly once.
+      expect(detach).toHaveBeenCalledTimes(1);
+
+      // dispose() cleared the REST timeout, so advancing far past it (120s) fires nothing: no second
+      // detach, and — the actual leak — no live timer left to reject the now-abandoned `done` promise.
+      vi.advanceTimersByTime(600_000);
+      expect(detach).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+    // Let any scheduled rejection surface on a real macrotask, then confirm none did.
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    process.off('unhandledRejection', onUnhandled);
+    expect(unhandled).toHaveLength(0);
   });
+
+  it('bounds a hung prompt: when prompt() never settles and no agent_end arrives, the 120s timeout ends the turn with a timeout result and exactly one teardown, no unhandledRejection (Task 5 finding 6 — pending-prompt timeout)', async () => {
+    const session = makeAgentSession(USER_A);
+    const detach = vi.fn();
+    const svc = {
+      getSession: vi.fn(() => session),
+      createSession: vi.fn(),
+      onEvent: vi.fn(() => detach),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      // The prompt never resolves or rejects — a hung agent backend. Under the pre-fix sequential
+      // `await prompt()` the timer could never even be observed, so the turn hung forever.
+      prompt: vi.fn(() => new Promise<void>(() => undefined)),
+      recordTokenUsage: vi.fn(),
+    };
+    const runtime = new EmbeddedChatRuntime(svc as never);
 
-  it('does not terminate another owner/tenant session over WebSocket abort', async () => {
-    const { gateway, agentService } = makeGateway();
-    const socket = makeSocket();
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown): void => {
+      unhandled.push(reason);
+    };
+    process.on('unhandledRejection', onUnhandled);
+    vi.useFakeTimers();
+    try {
+      const resultPromise = runtime.completeLegacyRestTurn(ctx, {
+        content: 'a prompt that never returns',
+      });
+      // No agent_end, prompt still pending: only the 120s timeout can end the turn. Promise.all
+      // installed a handler on `done` synchronously, so the timer bounds the turn while prompt hangs.
+      await vi.advanceTimersByTimeAsync(200_000);
+      const result = await resultPromise;
 
-    await gateway.handleAbort(socket as never, { conversationId: CONVERSATION_ID });
+      expect(result).toEqual({ ok: false, code: 'timeout', retryable: true });
+      // The single idempotent dispose ran on the timeout path: listener detached exactly once.
+      expect(detach).toHaveBeenCalledTimes(1);
+      // Advancing far past the deadline fires nothing more: dispose cleared the timer.
+      vi.advanceTimersByTime(600_000);
+      expect(detach).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    process.off('unhandledRejection', onUnhandled);
+    expect(unhandled).toHaveLength(0);
+  });
 
-    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-      userId: USER_B.id,
-      tenantId: USER_B.tenantId,
+  it('when the 120s timeout fires while prompt() is still pending, returns timeout with one teardown, and a later prompt rejection surfaces no unhandledRejection (Task 5 finding 6 — timeout/prompt race)', async () => {
+    const session = makeAgentSession(USER_A);
+    const detach = vi.fn();
+    let rejectPrompt: (reason: unknown) => void = () => undefined;
+    const prompting = new Promise<void>((_resolve, reject) => {
+      rejectPrompt = reject;
     });
-    expect(socket.emit).toHaveBeenCalledWith(
-      'error',
-      expect.objectContaining({ conversationId: CONVERSATION_ID }),
-    );
+    const svc = {
+      getSession: vi.fn(() => session),
+      createSession: vi.fn(),
+      onEvent: vi.fn(() => detach),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt: vi.fn(() => prompting),
+      recordTokenUsage: vi.fn(),
+    };
+    const runtime = new EmbeddedChatRuntime(svc as never);
+
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown): void => {
+      unhandled.push(reason);
+    };
+    process.on('unhandledRejection', onUnhandled);
+    vi.useFakeTimers();
+    try {
+      const resultPromise = runtime.completeLegacyRestTurn(ctx, {
+        content: 'prompt settles after the deadline',
+      });
+      // The timeout wins the race while prompt is still pending.
+      await vi.advanceTimersByTimeAsync(200_000);
+      const result = await resultPromise;
+
+      expect(result).toEqual({ ok: false, code: 'timeout', retryable: true });
+      expect(detach).toHaveBeenCalledTimes(1);
+
+      // The prompt now rejects LATE — after the turn already returned its timeout result. Because
+      // Promise.all installed a rejection handler on `prompting` synchronously (the fix), this late
+      // rejection is already observed and must not escape as an unhandledRejection.
+      rejectPrompt(new Error('late backend failure'));
+    } finally {
+      vi.useRealTimers();
+    }
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    process.off('unhandledRejection', onUnhandled);
+    expect(unhandled).toHaveLength(0);
   });
 });

apps/gateway/src/agent/agent.service.ts

@@ -132,9 +132,8 @@ export class AgentService implements OnModuleDestroy {
     @Inject(CoordService) private readonly coordService: CoordService,
     @Inject(McpClientService) private readonly mcpClientService: McpClientService,
     @Inject(SkillLoaderService) private readonly skillLoaderService: SkillLoaderService,
-    @Optional()
     @Inject(SystemOverrideService)
-    private readonly systemOverride: SystemOverrideService | null,
+    private readonly systemOverride: SystemOverrideService,
     @Optional()
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
@@ -709,23 +708,22 @@ export class AgentService implements OnModuleDestroy {
       throw new Error(`No agent session found: ${sessionId}`);
     }
     this.assertSessionScope(session, scope);
-    session.promptCount += 1;
 
     // Channel attachments are untrusted URI references. Preserve exact,
     // authenticated metadata for the agent without treating it as authority.
     const attachmentContext = this.attachmentContext(attachments);
 
-    // Prepend session-scoped system override if present (renew TTL on each turn)
+    // Prepend session-scoped system override if present (renew TTL on each turn).
+    // Required instruction-authority wiring is consulted before session/provider effects.
     let effectiveMessage = `${message}${attachmentContext}`;
-    if (this.systemOverride) {
-      const override = await this.systemOverride.get(sessionId, scope);
-      if (override) {
-        effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
-        await this.systemOverride.renew(sessionId, scope);
-        this.logger.debug(`Applied system override for session ${sessionId}`);
-      }
+    const override = await this.systemOverride.get(sessionId, scope);
+    if (override) {
+      effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
+      await this.systemOverride.renew(sessionId, scope);
+      this.logger.debug(`Applied system override for session ${sessionId}`);
     }
 
+    session.promptCount += 1;
     try {
       await session.piSession.prompt(effectiveMessage);
     } catch (err) {

apps/gateway/src/agent/routing/routing-e2e.test.ts

@@ -8,6 +8,7 @@
  * to avoid real I/O — they verify the complete classify → match → decide path.
  */
 import { describe, it, expect, vi } from 'vitest';
+import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { RoutingEngineService } from './routing-engine.service.js';
 import { DEFAULT_ROUTING_RULES } from '../routing/default-rules.js';
 import type { RoutingRule } from './routing.types.js';
@@ -17,7 +18,7 @@ import type { RoutingRule } from './routing.types.js';
 /** Build a RoutingEngineService backed by the given rule set and health map. */
 function makeService(
   rules: RoutingRule[],
-  healthMap: Record<string, { status: string }>,
+  healthMap: Record<string, { status: ProviderHealthStatus }>,
 ): RoutingEngineService {
   const mockDb = {
     select: vi.fn().mockReturnValue({
@@ -67,11 +68,11 @@ function defaultRules(): RoutingRule[] {
 }
 
 /** A health map where anthropic, openai, and zai are all healthy. */
-const allHealthy: Record<string, { status: string }> = {
-  anthropic: { status: 'up' },
-  openai: { status: 'up' },
-  zai: { status: 'up' },
-  ollama: { status: 'up' },
+const allHealthy: Record<string, { status: ProviderHealthStatus }> = {
+  anthropic: { status: 'healthy' },
+  openai: { status: 'healthy' },
+  zai: { status: 'healthy' },
+  ollama: { status: 'healthy' },
 };
 
 // ─── M4-013 E2E tests ─────────────────────────────────────────────────────────
@@ -212,10 +213,10 @@ describe('M4-013: routing end-to-end pipeline', () => {
     // Let's use a simple coding message to target Simple coding → Codex (openai)
     const message = 'implement a sort function';
 
-    const unhealthyHealth = {
+    const unhealthyHealth: Record<string, { status: ProviderHealthStatus }> = {
       anthropic: { status: 'down' },
-      openai: { status: 'up' },
-      zai: { status: 'up' },
+      openai: { status: 'healthy' },
+      zai: { status: 'healthy' },
       ollama: { status: 'down' },
     };
 

apps/gateway/src/agent/routing/routing-engine.service.ts

@@ -1,5 +1,6 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { routingRules, type Db, and, asc, eq, or } from '@mosaicstack/db';
+import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { DB } from '../../database/database.module.js';
 import { ProviderService } from '../provider.service.js';
 import { classifyTask } from './task-classifier.js';
@@ -49,7 +50,7 @@ export class RoutingEngineService {
   async resolve(
     message: string,
     userId?: string,
-    availableProviders?: Record<string, { status: string }>,
+    availableProviders?: Record<string, { status: ProviderHealthStatus }>,
   ): Promise<RoutingDecision> {
     const classification = classifyTask(message);
     this.logger.debug(
@@ -69,9 +70,8 @@ export class RoutingEngineService {
       if (!this.matchConditions(rule, classification)) continue;
 
       const providerStatus = health[rule.action.provider]?.status;
-      const isHealthy = providerStatus === 'up' || providerStatus === 'ok';
 
-      if (!isHealthy) {
+      if (!this.isRoutable(providerStatus)) {
         this.logger.debug(
           `Rule "${rule.name}" matched but provider "${rule.action.provider}" is unhealthy (status: ${providerStatus ?? 'unknown'})`,
         );
@@ -111,6 +111,10 @@ export class RoutingEngineService {
 
   // ─── Private helpers ───────────────────────────────────────────────────────
 
+  private isRoutable(status: ProviderHealthStatus | undefined): boolean {
+    return status === 'healthy' || status === 'degraded';
+  }
+
   private evaluateCondition(
     condition: RoutingCondition,
     classification: TaskClassification,
@@ -186,11 +190,12 @@ export class RoutingEngineService {
    * Walk the fallback chain and return the first healthy provider/model pair.
    * If none are healthy, return the first entry unconditionally (last resort).
    */
-  private applyFallbackChain(health: Record<string, { status: string }>): RoutingDecision {
+  private applyFallbackChain(
+    health: Record<string, { status: ProviderHealthStatus }>,
+  ): RoutingDecision {
     for (const candidate of FALLBACK_CHAIN) {
       const providerStatus = health[candidate.provider]?.status;
-      const isHealthy = providerStatus === 'up' || providerStatus === 'ok';
-      if (isHealthy) {
+      if (this.isRoutable(providerStatus)) {
         this.logger.debug(`Fallback resolved: ${candidate.provider}/${candidate.model}`);
         return {
           provider: candidate.provider,

apps/gateway/src/agent/routing/routing-engine.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { RoutingEngineService } from './routing-engine.service.js';
 import type { RoutingRule, TaskClassification } from './routing.types.js';
 
@@ -29,7 +30,7 @@ function makeClassification(overrides: Partial<TaskClassification> = {}): TaskCl
 /** Build a minimal RoutingEngineService with mocked DB and ProviderService. */
 function makeService(
   rules: RoutingRule[] = [],
-  healthMap: Record<string, { status: string }> = {},
+  healthMap: Record<string, { status: ProviderHealthStatus }> = {},
 ): RoutingEngineService {
   const mockDb = {
     select: vi.fn().mockReturnValue({
@@ -217,7 +218,10 @@ describe('RoutingEngineService.resolve — priority ordering', () => {
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'up' }, openai: { status: 'up' } });
+    const service = makeService(rules, {
+      anthropic: { status: 'healthy' },
+      openai: { status: 'healthy' },
+    });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('high priority');
@@ -241,7 +245,10 @@ describe('RoutingEngineService.resolve — priority ordering', () => {
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'up' }, openai: { status: 'up' } });
+    const service = makeService(rules, {
+      anthropic: { status: 'healthy' },
+      openai: { status: 'healthy' },
+    });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('coding rule');
@@ -270,7 +277,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
 
     const service = makeService(rules, {
       anthropic: { status: 'down' }, // primary is unhealthy
-      openai: { status: 'up' },
+      openai: { status: 'healthy' },
     });
 
     const decision = await service.resolve('implement a function');
@@ -290,7 +297,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
     ];
 
     const service2 = makeService(unhealthyRules, {
-      anthropic: { status: 'up' },
+      anthropic: { status: 'healthy' },
       openai: { status: 'down' },
     });
 
@@ -306,7 +313,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
 
     const service = makeService(rules, {
       anthropic: { status: 'down' }, // Sonnet is on anthropic — down
-      ollama: { status: 'up' }, // Haiku is also on anthropic — use Ollama as next
+      ollama: { status: 'healthy' }, // Haiku is also on anthropic — use Ollama as next
     });
 
     const decision = await service.resolve('hello there');
@@ -345,7 +352,7 @@ describe('RoutingEngineService.resolve — empty conditions (fallback rule)', ()
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'up' } });
+    const service = makeService(rules, { anthropic: { status: 'healthy' } });
 
     const decision = await service.resolve('completely unrelated message xyz');
     expect(decision.ruleName).toBe('catch-all');
@@ -369,7 +376,7 @@ describe('RoutingEngineService.resolve — empty conditions (fallback rule)', ()
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'up' } });
+    const service = makeService(rules, { anthropic: { status: 'healthy' } });
 
     const codingDecision = await service.resolve('implement a function');
     expect(codingDecision.ruleName).toBe('specific coding rule');
@@ -401,7 +408,7 @@ describe('RoutingEngineService.resolve — disabled rules', () => {
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'up' } });
+    const service = makeService(rules, { anthropic: { status: 'healthy' } });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('enabled fallback');
@@ -452,9 +459,45 @@ describe('RoutingEngineService.resolve — availableProviders override', () => {
       ps: unknown,
     ) => RoutingEngineService)(mockDb, mockProviderService);
 
-    const preSupplied = { anthropic: { status: 'up' } };
+    const preSupplied: Record<string, { status: ProviderHealthStatus }> = {
+      anthropic: { status: 'healthy' },
+    };
     await service.resolve('implement a function', undefined, preSupplied);
 
     expect(mockHealthCheckAll).not.toHaveBeenCalled();
   });
 });
+
+// ─── resolve — canonical ProviderHealthStatus values ──────────────────────────
+
+describe('RoutingEngineService.resolve — canonical health status routing', () => {
+  it('routes healthy and degraded providers by rule, and falls through to fallback when down', async () => {
+    const codingRule = makeRule({
+      name: 'coding rule',
+      priority: 1,
+      conditions: [{ field: 'taskType', operator: 'eq', value: 'coding' }],
+      action: { provider: 'openai', model: 'gpt-4o' },
+    });
+
+    // healthy → selected by its own rule, not the fallback chain
+    const healthyService = makeService([codingRule], { openai: { status: 'healthy' } });
+    const healthyDecision = await healthyService.resolve('implement a function');
+    expect(healthyDecision.ruleName).toBe('coding rule');
+    expect(healthyDecision.provider).toBe('openai');
+
+    // down → rule is skipped as unroutable, falls through to the fallback chain
+    const downService = makeService([codingRule], {
+      openai: { status: 'down' },
+      anthropic: { status: 'healthy' },
+    });
+    const downDecision = await downService.resolve('implement a function');
+    expect(downDecision.ruleName).toBe('fallback');
+    expect(downDecision.provider).toBe('anthropic');
+
+    // degraded → still routable, selected by its own rule, not the fallback chain
+    const degradedService = makeService([codingRule], { openai: { status: 'degraded' } });
+    const degradedDecision = await degradedService.resolve('implement a function');
+    expect(degradedDecision.ruleName).toBe('coding rule');
+    expect(degradedDecision.provider).toBe('openai');
+  });
+});

apps/gateway/src/app.module.spec.ts

@@ -0,0 +1,624 @@
+import 'reflect-metadata';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import * as nodeOs from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import * as nodeUrl from 'node:url';
+import { MODULE_METADATA } from '@nestjs/common/constants.js';
+import { describe, expect, it, vi } from 'vitest';
+import type { MosaicConfig } from '@mosaicstack/config';
+
+interface ComposedModuleGraph {
+  imports: readonly unknown[];
+  federationModule: unknown;
+  bootLogLines: readonly string[];
+  mosaicConfig: MosaicConfig;
+  resolvedConfigPath: string;
+}
+
+type StorageTier = 'local' | 'standalone' | 'federated';
+
+interface ModuleGraphFixture {
+  tempRoot: string;
+  anchor: string;
+  homePath: string;
+  cwdPath: string;
+  monorepoRootEnvPath: string;
+  gatewayLocalEnvPath: string;
+  daemonEnvPath: string;
+  monorepoRootConfigPath: string;
+  gatewayLocalConfigPath: string;
+}
+
+interface ModuleGraphFixtureOptions {
+  rootEnvMode?: 'present' | 'absent';
+  rootTier?: StorageTier;
+  rootEnvContents?: string;
+  redactionMarker?: string;
+  gatewayLocalTier?: StorageTier;
+  gatewayLocalEnvContents?: string;
+  daemonEnvContents?: string;
+  inheritedTier?: StorageTier;
+  expectedProcessTier?: string;
+  setup?: (fixture: ModuleGraphFixture) => Promise<void>;
+}
+
+// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
+const MODULE_IMPORT_TIMEOUT_MS = 120_000;
+const MONOREPO_ROOT_DOTENV_LABEL = 'monorepo-root .env';
+const DAEMON_DOTENV_LABEL = 'daemon .env';
+
+function configJson(tier: StorageTier): string {
+  if (tier === 'local') {
+    return JSON.stringify({
+      tier,
+      storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
+      queue: { type: 'local', dataDir: '.mosaic/queue' },
+      memory: { type: 'keyword' },
+    });
+  }
+
+  return JSON.stringify({
+    tier,
+    storage: { type: 'postgres', url: 'postgresql://fixture.invalid/mosaic' },
+    queue: { type: 'bullmq' },
+    memory: { type: tier === 'federated' ? 'pgvector' : 'keyword' },
+  });
+}
+
+function snapshotProcessEnv(): Record<string, string | undefined> {
+  return { ...process.env };
+}
+
+function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
+  for (const key of Object.keys(process.env)) {
+    if (!(key in snapshot)) {
+      delete process.env[key];
+    }
+  }
+
+  for (const [key, value] of Object.entries(snapshot)) {
+    if (value === undefined) {
+      delete process.env[key];
+      continue;
+    }
+
+    process.env[key] = value;
+  }
+}
+
+function expectPathUnderTempRoot(path: string, tempRoot: string): void {
+  const relativePath = relative(tempRoot, path);
+  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
+    true,
+  );
+}
+
+async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
+  expectPathUnderTempRoot(path, tempRoot);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, contents, 'utf8');
+}
+
+interface ConfigModuleProvider {
+  provide: string;
+  useFactory: () => MosaicConfig;
+}
+
+function isConfigModuleProvider(value: unknown): value is ConfigModuleProvider {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+
+  if (!('provide' in value) || typeof value.provide !== 'string') {
+    return false;
+  }
+
+  return 'useFactory' in value && typeof value.useFactory === 'function';
+}
+
+function singleBootLogLine(bootLogLines: readonly string[]): string {
+  expect(bootLogLines).toHaveLength(1);
+  const [bootLogLine] = bootLogLines;
+  if (bootLogLine === undefined) {
+    throw new Error('Expected a single boot log line');
+  }
+
+  return bootLogLine;
+}
+
+function expectBootLogLine(
+  bootLogLines: readonly string[],
+  tier: StorageTier,
+  source: string,
+): void {
+  const bootLogLine = singleBootLogLine(bootLogLines);
+
+  expect(bootLogLine).toContain(`storage tier=${tier}`);
+  expect(bootLogLine).toContain(`source=${source}`);
+}
+
+async function loadModuleGraphFromDotenv(
+  options: ModuleGraphFixtureOptions,
+): Promise<ComposedModuleGraph> {
+  const originalEnv = snapshotProcessEnv();
+  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-module-'));
+  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
+  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+  try {
+    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
+    const homePath = join(tempRoot, 'home');
+    const cwdPath = join(tempRoot, 'ambient', 'parent', 'cwd');
+    const fixture: ModuleGraphFixture = {
+      tempRoot,
+      anchor,
+      homePath,
+      cwdPath,
+      monorepoRootEnvPath: resolve(anchor, '../../..', '.env'),
+      gatewayLocalEnvPath: resolve(anchor, '..', '.env'),
+      daemonEnvPath: join(homePath, '.config', 'mosaic', 'gateway', '.env'),
+      monorepoRootConfigPath: resolve(anchor, '../../..', 'mosaic.config.json'),
+      gatewayLocalConfigPath: resolve(anchor, '..', 'mosaic.config.json'),
+    };
+    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
+
+    for (const path of Object.values(fixture)) {
+      expectPathUnderTempRoot(path, tempRoot);
+    }
+
+    await mkdir(anchor, { recursive: true });
+    await mkdir(cwdPath, { recursive: true });
+
+    if ((options.rootEnvMode ?? 'present') === 'absent') {
+      if (
+        options.rootEnvContents !== undefined ||
+        options.rootTier !== undefined ||
+        options.redactionMarker !== undefined
+      ) {
+        throw new Error('Expected no root env fixture values when rootEnvMode is absent');
+      }
+    } else {
+      if (options.rootEnvContents === undefined && options.rootTier === undefined) {
+        throw new Error('Expected rootTier or rootEnvContents');
+      }
+
+      const rootFixture = options.rootEnvContents ?? `MOSAIC_STORAGE_TIER=${options.rootTier}\n`;
+      const rootFixtureWithMarker = options.redactionMarker
+        ? `${rootFixture}BETTER_AUTH_SECRET=${options.redactionMarker}\n`
+        : rootFixture;
+      await writeFixture(fixture.monorepoRootEnvPath, rootFixtureWithMarker, tempRoot);
+    }
+
+    if (options.daemonEnvContents !== undefined) {
+      await writeFixture(fixture.daemonEnvPath, options.daemonEnvContents, tempRoot);
+    }
+
+    if (options.gatewayLocalEnvContents !== undefined) {
+      await writeFixture(fixture.gatewayLocalEnvPath, options.gatewayLocalEnvContents, tempRoot);
+    } else if (options.gatewayLocalTier !== undefined) {
+      await writeFixture(
+        fixture.gatewayLocalEnvPath,
+        `MOSAIC_STORAGE_TIER=${options.gatewayLocalTier}\n`,
+        tempRoot,
+      );
+    }
+
+    process.env['HOME'] = homePath;
+    delete process.env['MOSAIC_STORAGE_TIER'];
+    delete process.env['DATABASE_URL'];
+    delete process.env['VALKEY_URL'];
+    delete process.env['MOSAIC_GATEWAY_HOME'];
+
+    await options.setup?.(fixture);
+
+    if (options.inheritedTier !== undefined) {
+      process.env['MOSAIC_STORAGE_TIER'] = options.inheritedTier;
+    }
+
+    vi.resetModules();
+    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
+    vi.doMock('node:url', () => ({
+      ...nodeUrl,
+      fileURLToPath: (url: string | URL): string => {
+        const actualPath = nodeUrl.fileURLToPath(url);
+        if (
+          actualPath.endsWith('/apps/gateway/src/env.ts') ||
+          actualPath.endsWith('/apps/gateway/src/env.js')
+        ) {
+          return join(anchor, 'env.ts');
+        }
+        return actualPath;
+      },
+    }));
+    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
+
+    if (options.inheritedTier === undefined) {
+      expect(process.env['MOSAIC_STORAGE_TIER']).toBeUndefined();
+    } else {
+      expect(process.env['MOSAIC_STORAGE_TIER']).toBe(options.inheritedTier);
+    }
+
+    const envModule = await import('./env.js');
+    expect(process.env['MOSAIC_STORAGE_TIER']).toBe(
+      options.expectedProcessTier ?? options.rootTier,
+    );
+
+    const { AppModule } = await import('./app.module.js');
+    const { FederationModule } = await import('./federation/federation.module.js');
+    const imports: unknown = Reflect.getMetadata(MODULE_METADATA.IMPORTS, AppModule);
+
+    if (!Array.isArray(imports)) {
+      throw new Error('AppModule imports metadata is not an array');
+    }
+
+    const { ConfigModule, MOSAIC_CONFIG } = await import('./config/config.module.js');
+    const providers: unknown = Reflect.getMetadata(MODULE_METADATA.PROVIDERS, ConfigModule);
+
+    if (!Array.isArray(providers)) {
+      throw new Error('ConfigModule providers metadata is not an array');
+    }
+
+    const configProvider = providers
+      .filter(isConfigModuleProvider)
+      .find((provider: ConfigModuleProvider): boolean => provider.provide === MOSAIC_CONFIG);
+
+    if (!configProvider) {
+      throw new Error('MOSAIC_CONFIG provider factory not found');
+    }
+
+    return {
+      imports,
+      federationModule: FederationModule,
+      bootLogLines: consoleInfoSpy.mock.calls.map((args: readonly unknown[]): string =>
+        args.map((value: unknown): string => String(value)).join(' '),
+      ),
+      mosaicConfig: configProvider.useFactory(),
+      resolvedConfigPath: envModule.resolveGatewayConfigPath(),
+    };
+  } finally {
+    cwdSpy?.mockRestore();
+    vi.doUnmock('node:url');
+    vi.doUnmock('node:os');
+    vi.resetModules();
+    consoleInfoSpy?.mockRestore();
+    restoreProcessEnv(originalEnv);
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+describe('AppModule federation gating', (): void => {
+  it('loads dotenv before tracing and AppModule evaluation', async (): Promise<void> => {
+    const mainSource = await readFile(new URL('./main.ts', import.meta.url), 'utf8');
+    const envImportIndex = mainSource.indexOf("import './env.js';");
+    const tracingImportIndex = mainSource.indexOf("import './tracing.js';");
+    const appModuleImportIndex = mainSource.indexOf("import { AppModule } from './app.module.js';");
+
+    expect(envImportIndex).toBeGreaterThan(-1);
+    expect(envImportIndex).toBeLessThan(tracingImportIndex);
+    expect(envImportIndex).toBeLessThan(appModuleImportIndex);
+  });
+
+  it(
+    'ignores ambient cwd/.env and cwd/../.env files',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            join(fixture.cwdPath, '.env'),
+            'MOSAIC_STORAGE_TIER=federated\n',
+            fixture.tempRoot,
+          );
+          await writeFixture(
+            resolve(fixture.cwdPath, '..', '.env'),
+            'MOSAIC_STORAGE_TIER=federated\n',
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'ignores an ambient cwd/mosaic.config.json federated config',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            join(fixture.cwdPath, 'mosaic.config.json'),
+            configJson('federated'),
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'ignores an ambient cwd/../../mosaic.config.json federated config',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            resolve(fixture.cwdPath, '../..', 'mosaic.config.json'),
+            configJson('federated'),
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'anchored gateway-local config wins monorepo-root config and registers FederationModule',
+    async (): Promise<void> => {
+      let gatewayLocalConfigPath = '';
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          gatewayLocalConfigPath = fixture.gatewayLocalConfigPath;
+          await writeFixture(
+            fixture.gatewayLocalConfigPath,
+            configJson('federated'),
+            fixture.tempRoot,
+          );
+          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
+        },
+      });
+
+      expect(graph.resolvedConfigPath).toBe(gatewayLocalConfigPath);
+      expect(graph.mosaicConfig.tier).toBe('federated');
+      expect(graph.imports).toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'resolves the daemon-installed GATEWAY_HOME/mosaic.config.json ahead of gateway-local and monorepo-root configs',
+    async (): Promise<void> => {
+      let daemonConfigPath = '';
+      const graph = await loadModuleGraphFromDotenv({
+        rootEnvMode: 'absent',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          const externalGatewayHome = join(fixture.tempRoot, 'external-gateway-home');
+          daemonConfigPath = join(externalGatewayHome, 'mosaic.config.json');
+          await writeFixture(daemonConfigPath, configJson('federated'), fixture.tempRoot);
+          await writeFixture(
+            fixture.gatewayLocalConfigPath,
+            configJson('standalone'),
+            fixture.tempRoot,
+          );
+          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
+          process.env['MOSAIC_GATEWAY_HOME'] = externalGatewayHome;
+          process.env['DATABASE_URL'] = 'postgresql://fixture.invalid/mosaic';
+        },
+      });
+
+      expect(graph.resolvedConfigPath).toBe(daemonConfigPath);
+      expect(graph.mosaicConfig.tier).toBe('federated');
+      expect(graph.imports).toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'logs mosaic.config.json when anchored config and env tiers are both federated',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'federated',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            fixture.monorepoRootConfigPath,
+            configJson('federated'),
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.imports).toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'logs standalone from a monorepo-root .env DATABASE_URL fallback',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootEnvContents: 'DATABASE_URL=fixture-database-url\n',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'attributes an invalid monorepo-root dotenv tier to the default',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootEnvContents: 'MOSAIC_STORAGE_TIER=invalid\n',
+        expectedProcessTier: 'invalid',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'local', 'default');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'attributes DATABASE_URL fallback to daemon .env ahead of inherited local tier',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootEnvMode: 'absent',
+        daemonEnvContents: 'DATABASE_URL=fixture-database-url\n',
+        inheritedTier: 'local',
+        expectedProcessTier: 'local',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'daemon .env wins over monorepo-root and gateway-local tier values',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        gatewayLocalTier: 'federated',
+        daemonEnvContents: 'MOSAIC_STORAGE_TIER=standalone\n',
+        expectedProcessTier: 'standalone',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'inherits process.env.MOSAIC_STORAGE_TIER over daemon, monorepo-root, and gateway-local dotenv values',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        gatewayLocalTier: 'federated',
+        daemonEnvContents: 'MOSAIC_STORAGE_TIER=federated\n',
+        inheritedTier: 'standalone',
+        expectedProcessTier: 'standalone',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'standalone', 'process environment');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'gateway-local .env configures the tier and source when the monorepo-root .env is absent',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootEnvMode: 'absent',
+        gatewayLocalTier: 'federated',
+        expectedProcessTier: 'federated',
+      });
+
+      expect(graph.imports).toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'federated', 'gateway-local .env');
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'monorepo-root .env wins over gateway-local tier values',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'standalone',
+        gatewayLocalTier: 'federated',
+      });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it.each(['local', 'standalone'] as const)(
+    'does not register FederationModule for the %s tier',
+    async (tier): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({ rootTier: tier });
+
+      expect(graph.imports).not.toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, tier, MONOREPO_ROOT_DOTENV_LABEL);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'registers FederationModule when federated tier is supplied by the anchored monorepo root .env',
+    async (): Promise<void> => {
+      const redactionMarker = 'redaction-fixture-marker';
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'federated',
+        redactionMarker,
+      });
+
+      expect(graph.imports).toContain(graph.federationModule);
+      expectBootLogLine(graph.bootLogLines, 'federated', MONOREPO_ROOT_DOTENV_LABEL);
+      expect(singleBootLogLine(graph.bootLogLines)).not.toContain(redactionMarker);
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'MOSAIC_CONFIG provider ignores an ambient cwd/mosaic.config.json config',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            join(fixture.cwdPath, 'mosaic.config.json'),
+            JSON.stringify({
+              tier: 'federated',
+              storage: {
+                type: 'postgres',
+                url: 'postgresql://ambient-attacker.invalid/mosaic',
+                enableVector: true,
+              },
+              queue: { type: 'bullmq' },
+              memory: { type: 'pgvector' },
+            }),
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.mosaicConfig.tier).toBe('local');
+      expect(graph.mosaicConfig.storage).not.toEqual(
+        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
+      );
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+
+  it(
+    'MOSAIC_CONFIG provider resolves from the anchored monorepo-root mosaic.config.json',
+    async (): Promise<void> => {
+      const graph = await loadModuleGraphFromDotenv({
+        rootTier: 'local',
+        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
+          await writeFixture(
+            fixture.monorepoRootConfigPath,
+            configJson('federated'),
+            fixture.tempRoot,
+          );
+        },
+      });
+
+      expect(graph.mosaicConfig.tier).toBe('federated');
+      expect(graph.mosaicConfig.storage).toEqual(
+        expect.objectContaining({ url: 'postgresql://fixture.invalid/mosaic' }),
+      );
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+});

apps/gateway/src/app.module.ts

@@ -21,11 +21,23 @@ import { AdminModule } from './admin/admin.module.js';
 import { CommandsModule } from './commands/commands.module.js';
 import { PreferencesModule } from './preferences/preferences.module.js';
 import { GCModule } from './gc/gc.module.js';
+import { HarnessModule } from './harness/harness.module.js';
 import { ReloadModule } from './reload/reload.module.js';
 import { WorkspaceModule } from './workspace/workspace.module.js';
+import { HierarchyModule } from './hierarchy/hierarchy.module.js';
 import { QueueModule } from './queue/queue.module.js';
 import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
+import { loadConfig } from '@mosaicstack/config';
+import { resolveGatewayConfigPath } from './env.js';
+
+// Federation (step-ca client, enrollment, federation verbs) is only wired for
+// tier 'federated' — CaService hard-requires STEP_CA_* at construction, which
+// must not gate standalone/local boots (docker-compose.federated.yml: the
+// federation profile "must not start in non-federated dev"). The gateway
+// entrypoint loads env.ts before evaluating this module so dotenv-backed tier
+// configuration is visible here.
+const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'federated';
 
 @Module({
   imports: [
@@ -50,10 +62,12 @@ import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
     PreferencesModule,
     CommandsModule,
     GCModule,
+    HarnessModule,
     QueueModule,
     ReloadModule,
     WorkspaceModule,
-    FederationModule,
+    HierarchyModule,
+    ...(federationEnabled ? [FederationModule] : []),
   ],
   controllers: [HealthController],
   providers: [

apps/gateway/src/chat/chat-runtime-router.spec.ts

@@ -0,0 +1,920 @@
+import 'reflect-metadata';
+import { Global, Module } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
+import type { HarnessAdapter, HarnessConversationService } from '@mosaicstack/types';
+import { AgentService } from '../agent/agent.service.js';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { CommandsModule } from '../commands/commands.module.js';
+import { HarnessModule } from '../harness/harness.module.js';
+import { ChatModule } from './chat.module.js';
+import { ChatGateway } from './chat.gateway.js';
+import { HarnessRegistry } from '../harness/harness.registry.js';
+import {
+  HARNESS_CONVERSATION_SERVICE,
+  HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+  HARNESS_REGISTRY,
+  type HarnessConversationServiceBinding,
+} from '../harness/harness.tokens.js';
+import { ChatRuntimeRouter } from './chat-runtime-router.js';
+import {
+  ChatRuntimeUnavailableError,
+  ownConversation,
+  type ChatRuntime,
+  type ChatRuntimeMode,
+  type LegacyEmbeddedChatPort,
+  type LegacyRuntimeStream,
+  type LegacySessionPresentation,
+  type LegacySocketTurnLease,
+  type OwnedConversationContext,
+} from './chat-runtime.js';
+import { AppModule } from '../app.module.js';
+import { ProviderService } from '../agent/provider.service.js';
+
+/**
+ * Task Five, Step One (router). Proves the `ChatRuntimeRouter` resolves exactly one
+ * runtime by mode, fails closed at init when `pi-rpc` preconditions are unmet, and
+ * never downgrades `pi-rpc` to embedded execution. Red-first: the router is an
+ * unimplemented stub, so every behavioural assertion below fails until Step Three.
+ */
+
+const embedded: ChatRuntime = { kind: 'embedded' };
+const harness: ChatRuntime = { kind: 'harness' };
+
+/** A structurally-complete, non-sentinel conversation service. Its methods are never invoked here. */
+const boundConversationService = {
+  attach: () => Promise.reject(new Error('unused')),
+  detach: () => Promise.reject(new Error('unused')),
+  send: () => Promise.reject(new Error('unused')),
+
+  subscribeFrom: async function* () {
+    throw new Error('unused');
+  },
+} as unknown as HarnessConversationService;
+
+function registryWith(adapterIds: readonly string[]): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  for (const id of adapterIds) {
+    registry.register({
+      id,
+      describe: () => Promise.reject(new Error('unused')),
+      catalog: () => Promise.reject(new Error('unused')),
+      create: () => Promise.reject(new Error('unused')),
+      resume: () => Promise.reject(new Error('unused')),
+    } as HarnessAdapter);
+  }
+  return registry;
+}
+
+function buildRouter(
+  mode: ChatRuntimeMode,
+  opts: { adapters: readonly string[]; service: HarnessConversationServiceBinding },
+): ChatRuntimeRouter {
+  return new ChatRuntimeRouter(registryWith(opts.adapters), opts.service, embedded, harness, mode);
+}
+
+/**
+ * Tear down a module that was deliberately driven to a fail-closed init.
+ * `NestApplicationContext.close()` re-awaits the module's `initializationPromise` before disposing
+ * (nest-application-context.js:127); when `init()` rejected, that await re-throws the SAME typed
+ * startup error, this time into teardown. Each caller here has already captured and asserted that
+ * exact `ChatRuntimeUnavailableError` via `initError`, so the re-throw is expected teardown noise —
+ * swallow ONLY that error, and surface anything else so a genuine teardown fault still fails loudly.
+ */
+async function closeIgnoringFailedInit(moduleRef: TestingModule): Promise<void> {
+  await moduleRef.close().catch((err: unknown) => {
+    if (err instanceof ChatRuntimeUnavailableError) return;
+    throw err;
+  });
+}
+
+describe('ChatRuntimeRouter', () => {
+  it('resolves only the harness runtime in pi-rpc mode when pi adapter and conversation service are present', () => {
+    const router = buildRouter('pi-rpc', {
+      adapters: ['pi'],
+      service: boundConversationService,
+    });
+
+    expect(() => router.onModuleInit()).not.toThrow();
+    expect(router.active).toBe(harness);
+    expect(router.active.kind).toBe('harness');
+  });
+
+  it('resolves only the embedded runtime in legacy mode and skips the pi preconditions', () => {
+    // Empty registry + unavailable service: legacy must ignore both and still start.
+    const router = buildRouter('legacy', {
+      adapters: [],
+      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+
+    expect(() => router.onModuleInit()).not.toThrow();
+    expect(router.active).toBe(embedded);
+    expect(router.active.kind).toBe('embedded');
+  });
+
+  it('fails closed at init when pi-rpc mode has no registered pi adapter', () => {
+    const router = buildRouter('pi-rpc', {
+      adapters: [],
+      service: boundConversationService,
+    });
+
+    expect(() => router.onModuleInit()).toThrow(ChatRuntimeUnavailableError);
+    try {
+      router.onModuleInit();
+      expect.unreachable('onModuleInit must throw when the pi adapter is absent');
+    } catch (err) {
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    }
+  });
+
+  it('fails closed at init when pi-rpc mode has the unavailable conversation-service sentinel', () => {
+    const router = buildRouter('pi-rpc', {
+      adapters: ['pi'],
+      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+
+    try {
+      router.onModuleInit();
+      expect.unreachable('onModuleInit must throw when the conversation service is unbound');
+    } catch (err) {
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    }
+  });
+
+  it('never falls back to embedded execution when pi-rpc preconditions are unmet', () => {
+    const router = buildRouter('pi-rpc', {
+      adapters: [],
+      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+
+    expect(() => router.onModuleInit()).toThrow(ChatRuntimeUnavailableError);
+    // A failed pi-rpc init must not silently expose the embedded runtime.
+    expect(() => router.active).toThrow();
+    let leaked: ChatRuntime | undefined;
+    try {
+      leaked = router.active;
+    } catch {
+      leaked = undefined;
+    }
+    expect(leaked).not.toBe(embedded);
+  });
+
+  it('exposes only fixed, browser-safe failure text (no raw provider or exception detail)', () => {
+    const router = buildRouter('pi-rpc', {
+      adapters: [],
+      service: boundConversationService,
+    });
+
+    try {
+      router.onModuleInit();
+      expect.unreachable('onModuleInit must throw');
+    } catch (err) {
+      const message = (err as ChatRuntimeUnavailableError).message;
+      expect(message).toBe(
+        'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.',
+      );
+      expect(message).not.toMatch(/Error:|\bat \b|node_modules|Symbol\(/);
+    }
+  });
+});
+
+/**
+ * Task Five, Step Three — legacy port operations fail closed under pi-rpc (direct valid-input).
+ *
+ * The unit suite above constructs the router but never invokes a legacy port operation, so the
+ * six per-operation inner `if (this.mode === 'pi-rpc')` guards are unexercised — a mutation that
+ * deletes one of them SURVIVES for lack of a test that drives that operation. This group closes
+ * that gap the right way: it drives each of the six operations DIRECTLY, in pi-rpc mode, with a
+ * valid branded {@link OwnedConversationContext} and valid input, against a recording embedded
+ * stub whose method returns a distinguishable `ok:true` success and increments a per-op counter.
+ *
+ * For each operation:
+ *  - pi-rpc test asserts the exact frozen `{ ok:false, code:'runtime_unsupported', retryable:false }`
+ *    result AND that the embedded stub was touched zero times (no effects);
+ *  - the paired legacy test proves that same stub method IS reached and returns its distinguishable
+ *    success when the mode does not refuse — so the pi-rpc zero-invocation assertion is meaningful,
+ *    not vacuously true because the stub could never be called.
+ *
+ * Deleting ONLY one operation's inner guard makes THAT operation's pi-rpc test behaviorally RED
+ * (the router returns the embedded `ok:true` value and records the call), with every outer guard
+ * and the other five inner guards intact. `next` is untouched; nothing here changes production.
+ */
+describe('ChatRuntimeRouter — legacy port ops fail closed under pi-rpc (Task Five, Step Three)', () => {
+  const RUNTIME_UNSUPPORTED = {
+    ok: false,
+    code: 'runtime_unsupported',
+    retryable: false,
+  } as const;
+
+  const PRESENTATION: LegacySessionPresentation = {
+    provider: 'embedded-provider',
+    modelId: 'embedded-model',
+    thinkingLevel: 'low',
+    availableThinkingLevels: ['low', 'high'],
+  };
+
+  const stream: LegacyRuntimeStream = {
+    channelId: 'websocket:test-socket',
+    onEvent: () => {},
+  };
+
+  const ctx = (): OwnedConversationContext =>
+    ownConversation('conversation-1', { userId: 'user-1', tenantId: 'tenant-1' });
+
+  /**
+   * Per-operation invocation counters with declared keys (not an index signature) so each
+   * `calls.<op>` is definitely `number` under `noUncheckedIndexedAccess`.
+   */
+  type LegacyPortCallCounts = {
+    completeLegacyRestTurn: number;
+    prepareLegacySocketTurn: number;
+    setLegacyThinking: number;
+    abortLegacyTurn: number;
+    applyLegacyModelOverride: number;
+    readLegacySessionPresentation: number;
+    dispatchVerifiedDiscordIngress: number;
+  };
+
+  /**
+   * An embedded port that records every invocation and returns a distinguishable `ok:true`
+   * value per operation. If a router op reaches it (its guard removed), both the recorded call
+   * count and the returned `ok:true` value diverge from the frozen `runtime_unsupported` result.
+   */
+  function recordingEmbeddedPort(): {
+    port: ChatRuntime & LegacyEmbeddedChatPort;
+    calls: LegacyPortCallCounts;
+  } {
+    const calls: LegacyPortCallCounts = {
+      completeLegacyRestTurn: 0,
+      prepareLegacySocketTurn: 0,
+      setLegacyThinking: 0,
+      abortLegacyTurn: 0,
+      applyLegacyModelOverride: 0,
+      readLegacySessionPresentation: 0,
+      dispatchVerifiedDiscordIngress: 0,
+    };
+    const lease: LegacySocketTurnLease = {
+      presentation: PRESENTATION,
+      dispatch: () => Promise.resolve({ ok: true, value: undefined }),
+      dispose: () => Promise.resolve(),
+    };
+    const port: ChatRuntime & LegacyEmbeddedChatPort = {
+      kind: 'embedded',
+      completeLegacyRestTurn: () => {
+        calls.completeLegacyRestTurn += 1;
+        return Promise.resolve({
+          ok: true,
+          value: { text: 'EMBEDDED-REST', presentation: PRESENTATION },
+        });
+      },
+      prepareLegacySocketTurn: () => {
+        calls.prepareLegacySocketTurn += 1;
+        return Promise.resolve({ ok: true, value: lease });
+      },
+      setLegacyThinking: () => {
+        calls.setLegacyThinking += 1;
+        return { ok: true, value: PRESENTATION };
+      },
+      abortLegacyTurn: () => {
+        calls.abortLegacyTurn += 1;
+        return Promise.resolve({ ok: true, value: undefined });
+      },
+      applyLegacyModelOverride: () => {
+        calls.applyLegacyModelOverride += 1;
+        return { ok: true, value: PRESENTATION };
+      },
+      readLegacySessionPresentation: () => {
+        calls.readLegacySessionPresentation += 1;
+        return { ok: true, value: PRESENTATION };
+      },
+      dispatchVerifiedDiscordIngress: () => {
+        calls.dispatchVerifiedDiscordIngress += 1;
+        return Promise.resolve({
+          ok: true,
+          value: {
+            presentation: PRESENTATION,
+            dispatch: () => Promise.resolve({ ok: true, value: undefined }),
+            dispose: () => Promise.resolve(),
+          },
+        });
+      },
+    };
+    return { port, calls };
+  }
+
+  function piRouter(port: ChatRuntime & LegacyEmbeddedChatPort): ChatRuntimeRouter {
+    return new ChatRuntimeRouter(
+      registryWith(['pi']),
+      boundConversationService,
+      port,
+      harness,
+      'pi-rpc',
+    );
+  }
+  function legacyRouter(port: ChatRuntime & LegacyEmbeddedChatPort): ChatRuntimeRouter {
+    return new ChatRuntimeRouter(
+      registryWith([]),
+      boundConversationService,
+      port,
+      harness,
+      'legacy',
+    );
+  }
+
+  // completeLegacyRestTurn ---------------------------------------------------
+  it('completeLegacyRestTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await piRouter(port).completeLegacyRestTurn(ctx(), { content: 'hello' });
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.completeLegacyRestTurn).toBe(0);
+  });
+  it('completeLegacyRestTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await legacyRouter(port).completeLegacyRestTurn(ctx(), { content: 'hello' });
+    expect(result.ok).toBe(true);
+    expect(calls.completeLegacyRestTurn).toBe(1);
+  });
+
+  // prepareLegacySocketTurn --------------------------------------------------
+  it('prepareLegacySocketTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await piRouter(port).prepareLegacySocketTurn(
+      ctx(),
+      { content: 'hello' },
+      stream,
+    );
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.prepareLegacySocketTurn).toBe(0);
+  });
+  it('prepareLegacySocketTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await legacyRouter(port).prepareLegacySocketTurn(
+      ctx(),
+      { content: 'hello' },
+      stream,
+    );
+    expect(result.ok).toBe(true);
+    expect(calls.prepareLegacySocketTurn).toBe(1);
+  });
+
+  // setLegacyThinking (sync) -------------------------------------------------
+  it('setLegacyThinking refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = piRouter(port).setLegacyThinking(ctx(), 'high');
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.setLegacyThinking).toBe(0);
+  });
+  it('setLegacyThinking delegates to embedded under legacy (guard is the sole gate)', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = legacyRouter(port).setLegacyThinking(ctx(), 'high');
+    expect(result.ok).toBe(true);
+    expect(calls.setLegacyThinking).toBe(1);
+  });
+
+  // abortLegacyTurn ----------------------------------------------------------
+  it('abortLegacyTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await piRouter(port).abortLegacyTurn(ctx());
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.abortLegacyTurn).toBe(0);
+  });
+  it('abortLegacyTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = await legacyRouter(port).abortLegacyTurn(ctx());
+    expect(result.ok).toBe(true);
+    expect(calls.abortLegacyTurn).toBe(1);
+  });
+
+  // applyLegacyModelOverride (sync) ------------------------------------------
+  it('applyLegacyModelOverride refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = piRouter(port).applyLegacyModelOverride(ctx(), 'model-x');
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.applyLegacyModelOverride).toBe(0);
+  });
+  it('applyLegacyModelOverride delegates to embedded under legacy (guard is the sole gate)', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = legacyRouter(port).applyLegacyModelOverride(ctx(), 'model-x');
+    expect(result.ok).toBe(true);
+    expect(calls.applyLegacyModelOverride).toBe(1);
+  });
+
+  // readLegacySessionPresentation (sync) -------------------------------------
+  it('readLegacySessionPresentation refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = piRouter(port).readLegacySessionPresentation(ctx());
+    expect(result).toEqual(RUNTIME_UNSUPPORTED);
+    expect(calls.readLegacySessionPresentation).toBe(0);
+  });
+  it('readLegacySessionPresentation delegates to embedded under legacy (guard is the sole gate)', () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const result = legacyRouter(port).readLegacySessionPresentation(ctx());
+    expect(result.ok).toBe(true);
+    expect(calls.readLegacySessionPresentation).toBe(1);
+  });
+
+  // dispatchVerifiedDiscordIngress delegates in BOTH modes (embedded-only, no guard) ---------
+  it('dispatchVerifiedDiscordIngress delegates to embedded under pi-rpc (embedded-only, no mode guard)', async () => {
+    const { port, calls } = recordingEmbeddedPort();
+    const discordCtx = ctx() as unknown as Parameters<
+      ChatRuntimeRouter['dispatchVerifiedDiscordIngress']
+    >[0];
+    const result = await piRouter(port).dispatchVerifiedDiscordIngress(discordCtx, stream);
+    expect(result.ok).toBe(true);
+    expect(calls.dispatchVerifiedDiscordIngress).toBe(1);
+  });
+});
+
+/**
+ * Task Five, Step Two — group 1 (real Nest module-graph readiness).
+ *
+ * The unit suite above constructs the router directly. This group drives the SAME contract
+ * through a real NestJS graph: it imports the production `HarnessModule` (the proven-booting
+ * idiom from harness.controller.spec.ts) so the router resolves the REAL, empty `HarnessRegistry`
+ * via the real `HARNESS_REGISTRY` token, then runs the router's `OnModuleInit` through the Nest
+ * lifecycle (`moduleRef.init()`). Red-first: the router is an unimplemented stub whose
+ * `onModuleInit` throws a generic Error, so:
+ *   - readiness cases fail because the graph never comes up (init rejects), and
+ *   - fail-closed cases fail because a generic stub throw is NOT the SPECIFIC typed
+ *     `ChatRuntimeUnavailableError` (reason/code) the contract demands — a stub that
+ *     "throws anything" cannot mask these greens.
+ * The router is NOT wired into a production module yet, so it is provided here via a factory
+ * over the real registry token. Importing the real `ChatModule` bare is deliberately avoided:
+ * it injects `AgentService` without importing `AgentModule`, so its graph fails to RESOLVE — a
+ * collection/DI error, not a behavioural red. `next` is untouched; nothing here implements the router.
+ */
+describe('ChatRuntimeRouter — real Nest module-graph readiness (Task Five, Step Two group 1)', () => {
+  async function bootRouterGraph(
+    mode: ChatRuntimeMode,
+    opts: { adapters: readonly string[]; service: HarnessConversationServiceBinding },
+  ) {
+    const moduleRef = await Test.createTestingModule({
+      imports: [HarnessModule],
+      providers: [
+        {
+          provide: ChatRuntimeRouter,
+          useFactory: (registry: HarnessRegistry) =>
+            new ChatRuntimeRouter(registry, opts.service, embedded, harness, mode),
+          inject: [HARNESS_REGISTRY],
+        },
+      ],
+    })
+      // The imported HarnessModule's controllers reference AuthGuard (an HTTP-only concern,
+      // never exercised here); stub it so the graph resolves. The registry is NOT overridden —
+      // group 1 asserts against the genuine production HarnessRegistry.
+      .overrideGuard(AuthGuard)
+      .useValue({ canActivate: () => true })
+      .compile();
+
+    // Resolve the production registry singleton and register the requested adapters ON IT, so
+    // the router (which injects the same singleton) sees them when its lifecycle hook runs.
+    const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
+    for (const id of opts.adapters) {
+      registry.register({
+        id,
+        describe: () => Promise.reject(new Error('unused')),
+        catalog: () => Promise.reject(new Error('unused')),
+        create: () => Promise.reject(new Error('unused')),
+        resume: () => Promise.reject(new Error('unused')),
+      } as HarnessAdapter);
+    }
+    return moduleRef;
+  }
+
+  // Capture an init rejection without letting a resolved init masquerade as success.
+  const initError = (moduleRef: { init(): Promise<unknown> }): Promise<unknown> =>
+    moduleRef.init().then(
+      () => new Error('module init resolved but the contract requires it to reject'),
+      (err: unknown) => err,
+    );
+
+  it('brings the graph up and resolves only the harness runtime in pi-rpc mode (pi adapter + bound service)', async () => {
+    const moduleRef = await bootRouterGraph('pi-rpc', {
+      adapters: ['pi'],
+      service: boundConversationService,
+    });
+    try {
+      await moduleRef.init();
+      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
+      expect(router.active).toBe(harness);
+      expect(router.active.kind).toBe('harness');
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('brings the graph up in legacy mode over the REAL empty HarnessRegistry and resolves only the embedded runtime', async () => {
+    const moduleRef = await bootRouterGraph('legacy', {
+      adapters: [],
+      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+    try {
+      // Defense-in-depth: the production module wires the genuine registry, empty by default —
+      // guards against a test-double registry silently satisfying the readiness check.
+      const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
+      expect(registry).toBeInstanceOf(HarnessRegistry);
+      expect(registry.list()).toHaveLength(0);
+
+      await moduleRef.init();
+      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
+      expect(router.active).toBe(embedded);
+      expect(router.active.kind).toBe('embedded');
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('fails closed at module init when pi-rpc mode has no registered pi adapter (specific typed error, not a stub throw)', async () => {
+    const moduleRef = await bootRouterGraph('pi-rpc', {
+      adapters: [],
+      service: boundConversationService,
+    });
+    try {
+      const err = await initError(moduleRef);
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    } finally {
+      await closeIgnoringFailedInit(moduleRef);
+    }
+  });
+
+  it('fails closed at module init when pi-rpc mode has the unavailable conversation-service sentinel', async () => {
+    const moduleRef = await bootRouterGraph('pi-rpc', {
+      adapters: ['pi'],
+      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+    try {
+      const err = await initError(moduleRef);
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    } finally {
+      await closeIgnoringFailedInit(moduleRef);
+    }
+  });
+
+  it('surfaces only fixed, browser-safe failure text when the graph fails closed (no stub/exception detail)', async () => {
+    const moduleRef = await bootRouterGraph('pi-rpc', {
+      adapters: [],
+      service: boundConversationService,
+    });
+    try {
+      const err = await initError(moduleRef);
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      const message = (err as ChatRuntimeUnavailableError).message;
+      expect(message).toBe(
+        'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.',
+      );
+      expect(message).not.toMatch(/Error:|\bat \b|node_modules|Symbol\(|not implemented/);
+    } finally {
+      await closeIgnoringFailedInit(moduleRef);
+    }
+  });
+});
+
+/**
+ * Task Five, Step Two — group 1b (production ChatModule wiring, declaration proof).
+ *
+ * Correction #1 (Scrappy fe3e02) asked for a red that imports the real `ChatModule` and calls
+ * `module.init()`. Investigated and found impractical/masking-prone: `ChatModule` provides
+ * `ChatGateway`, whose 10-argument constructor injects app-global providers (AgentService, AUTH,
+ * BRAIN, RoutingEngineService) plus the Commands/GC/Mcp/Reload subsystems across a forwardRef
+ * cycle. Booting it in isolation is a full-app integration boot — "override only unrelated
+ * dependencies" balloons into faking ~4 subsystems, and `overrideProvider` cannot even grant the
+ * cross-module export-scope visibility ChatGateway needs (probe: `ChatGateway` unresolved at
+ * `CommandExecutorService`). That is exactly the STOP-and-return branch of the directive.
+ *
+ * The faithful, unmaskable cover instead of a fragile boot: read the PRODUCTION `ChatModule`'s own
+ * Nest `@Module` metadata to prove it DECLARES the exclusive router provider and imports the real
+ * `HarnessModule` (the genuine registry source). This inspects the actual module object — not
+ * source text, not a test factory — so nothing can mask it. Group 1 above separately proves the
+ * router RESOLVES against the real, empty `HarnessRegistry` through the Nest lifecycle; the union
+ * of the two covers "the router is wired through ChatModule to the real registry" without the
+ * impractical single-graph boot. RED today (ChatModule provides only ChatGateway and imports only
+ * CommandsModule); GREEN once Step Three registers the router and imports HarnessModule.
+ */
+describe('ChatModule production wiring (Task Five, Step Two group 1b — declaration proof)', () => {
+  // Unwrap a forwardRef(() => Module) import to the module it references; pass others through.
+  const resolveImport = (imp: unknown): unknown =>
+    imp &&
+    typeof imp === 'object' &&
+    typeof (imp as { forwardRef?: unknown }).forwardRef === 'function'
+      ? (imp as { forwardRef: () => unknown }).forwardRef()
+      : imp;
+
+  // A provider entry is either a class (shorthand) or a { provide, ... } object; take its token.
+  const providerToken = (provider: unknown): unknown =>
+    typeof provider === 'function' ? provider : (provider as { provide?: unknown })?.provide;
+
+  it('declares the exclusive ChatRuntimeRouter as a provider on the production ChatModule', () => {
+    const providers: unknown[] = Reflect.getMetadata('providers', ChatModule) ?? [];
+    expect(providers.map(providerToken)).toContain(ChatRuntimeRouter);
+  });
+
+  it('imports the real HarnessModule into the production ChatModule (registry source, not a test double)', () => {
+    const imports: unknown[] = Reflect.getMetadata('imports', ChatModule) ?? [];
+    expect(imports.map(resolveImport)).toContain(HarnessModule);
+  });
+});
+
+/**
+ * Task Five, Step Two — group 1c (bounded real-`ChatModule` boot).
+ *
+ * Scrappy adjudication d67d2b (option c): boot the ACTUAL production `ChatModule` as the SUT and
+ * assert the exclusive router resolves THROUGH it — the single-graph proof group 1 (router over the
+ * real registry) and group 1b (production-module metadata) each cover only a half of. The heavy,
+ * UNRELATED cycle is the only thing bounded away, per the established isolation pattern in
+ * `apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts`:
+ *   - `CommandsModule` (drags the Commands <-> Reload <-> Chat forwardRef cycle plus GC/Mcp/queue)
+ *     is replaced wholesale with an empty module via `.overrideModule(...).useModule(...)`;
+ *   - `ChatGateway` (10-arg constructor, an HTTP/socket concern never exercised here) is replaced
+ *     with an inert value;
+ *   - the sole legacy-controller dependency, `AgentService`, is supplied by a tiny `@Global()` stub;
+ *   - the HTTP-only `AuthGuard` is stubbed.
+ * Nothing about the router, `HarnessModule`, the registry, or the conversation-service binding is
+ * faked in the production-legacy case — those are retrieved from the REAL `ChatModule` graph. Mode
+ * is driven only through the production `CHAT_HARNESS_RUNTIME` env contract (`resolveChatRuntimeMode`).
+ *
+ * Red-first: today `ChatModule` neither imports `HarnessModule` nor provides `ChatRuntimeRouter`, so
+ * the booted graph contains no router/registry/conversation-service tokens. `init()` may resolve
+ * (there is no router lifecycle hook yet to reject), so every case fails on the MISSING actual
+ * router/registry/service wiring — not on unrelated DI, which is bounded away. GREEN at Step Three
+ * once `ChatModule` imports `HarnessModule`, provides the exclusive router, and binds the
+ * conversation-service token (defaulting to the unavailable sentinel).
+ */
+describe('ChatModule bounded real boot (Task Five, Step Two group 1c)', () => {
+  // The unrelated heavy cycle, replaced wholesale — not stubbed provider-by-provider.
+  @Module({})
+  class EmptyCommandsModule {}
+
+  // The ONLY genuine legacy dependency of the real ChatController, supplied inertly and globally so
+  // the pre-refactor controller instantiates without dragging AgentModule into the graph.
+  @Global()
+  @Module({
+    providers: [{ provide: AgentService, useValue: {} }],
+    exports: [AgentService],
+  })
+  class LegacyControllerDepsModule {}
+
+  const ORIGINAL_RUNTIME_ENV = process.env['CHAT_HARNESS_RUNTIME'];
+  afterEach(() => {
+    if (ORIGINAL_RUNTIME_ENV === undefined) delete process.env['CHAT_HARNESS_RUNTIME'];
+    else process.env['CHAT_HARNESS_RUNTIME'] = ORIGINAL_RUNTIME_ENV;
+  });
+
+  /**
+   * Boot the real ChatModule with only the unrelated cycle bounded away. `mode` is set through the
+   * genuine production env contract before providers instantiate. The optional overrides replace
+   * the registry / conversation-service the router injects, exercising the pi-rpc precondition
+   * branches through the ACTUAL module (they are no-ops today because those tokens are not yet in
+   * the graph — which is exactly why the router-retrieval assertions go red).
+   */
+  async function bootChatModule(
+    mode: ChatRuntimeMode,
+    overrides: {
+      registryAdapters?: readonly string[];
+      conversationService?: HarnessConversationServiceBinding;
+    } = {},
+  ): Promise<TestingModule> {
+    if (mode === 'pi-rpc') process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    else delete process.env['CHAT_HARNESS_RUNTIME'];
+
+    let builder = Test.createTestingModule({
+      imports: [LegacyControllerDepsModule, ChatModule],
+    })
+      .overrideModule(CommandsModule)
+      .useModule(EmptyCommandsModule)
+      .overrideProvider(ChatGateway)
+      .useValue({})
+      .overrideGuard(AuthGuard)
+      .useValue({ canActivate: () => true });
+
+    if (overrides.registryAdapters) {
+      builder = builder
+        .overrideProvider(HARNESS_REGISTRY)
+        .useValue(registryWith(overrides.registryAdapters));
+    }
+    if (overrides.conversationService !== undefined) {
+      builder = builder
+        .overrideProvider(HARNESS_CONVERSATION_SERVICE)
+        .useValue(overrides.conversationService);
+    }
+    return builder.compile();
+  }
+
+  // Capture an init rejection without letting a resolved init masquerade as success.
+  const initError = (moduleRef: TestingModule): Promise<unknown> =>
+    moduleRef.init().then(
+      () => new Error('module init resolved but the contract requires it to reject'),
+      (err: unknown) => err,
+    );
+
+  it('legacy mode: the actual router resolves the embedded runtime, the actual registry is empty, and the conversation-service token is the unavailable sentinel', async () => {
+    const moduleRef = await bootChatModule('legacy');
+    try {
+      await moduleRef.init();
+      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
+      expect(router.active.kind).toBe('embedded');
+
+      const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
+      expect(registry).toBeInstanceOf(HarnessRegistry);
+      expect(registry.list()).toHaveLength(0);
+
+      const service = moduleRef.get<HarnessConversationServiceBinding>(
+        HARNESS_CONVERSATION_SERVICE,
+        {
+          strict: false,
+        },
+      );
+      expect(service).toBe(HARNESS_CONVERSATION_SERVICE_UNAVAILABLE);
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('pi-rpc mode over the REAL empty registry fails closed at init with the typed adapter-unavailable error', async () => {
+    const moduleRef = await bootChatModule('pi-rpc');
+    try {
+      const err = await initError(moduleRef);
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    } finally {
+      await closeIgnoringFailedInit(moduleRef);
+    }
+  });
+
+  it('pi-rpc mode with a pi adapter present but the sentinel conversation service fails closed with the typed conversation-service-unavailable error', async () => {
+    const moduleRef = await bootChatModule('pi-rpc', {
+      registryAdapters: ['pi'],
+      conversationService: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+    });
+    try {
+      const err = await initError(moduleRef);
+      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
+      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
+      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
+    } finally {
+      await closeIgnoringFailedInit(moduleRef);
+    }
+  });
+
+  it('pi-rpc mode with a pi adapter and a bound conversation service: the actual router selects the harness runtime', async () => {
+    const moduleRef = await bootChatModule('pi-rpc', {
+      registryAdapters: ['pi'],
+      conversationService: boundConversationService,
+    });
+    try {
+      await moduleRef.init();
+      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
+      expect(router.active.kind).toBe('harness');
+    } finally {
+      await moduleRef.close();
+    }
+  });
+});
+
+/**
+ * Task Five, Step Two — group 2 (WHOLE production `AppModule` boot, legacy end-to-end wiring).
+ *
+ * The groups above bound away the heavy cycle to isolate the router. This group instead boots the
+ * ACTUAL production `AppModule` (the exact graph `main.ts` runs) in the default LEGACY chat-runtime
+ * mode, overriding ONLY the storage/network side-effect adapters so the boot is bounded and offline
+ * — never the chat/router/harness/reload/commands surface under test. The bounded fakes are exactly
+ * the disk/network leaves:
+ *   - `ProviderService` (the #1 hang risk: its real `onModuleInit` starts an unref'd health-check
+ *     `setInterval` and fetches Ollama over HTTP) → inert no-op instance;
+ *   - `DB_HANDLE`/`DB` → a fake Drizzle-shaped handle that satisfies `runPgliteMigrations` (the local
+ *     tier's `DatabaseModule.onModuleInit`) AND `DefaultRoutingRulesSeed.onModuleInit` (which reads a
+ *     system-rule count — the fake reports rules already present so the seed insert is skipped),
+ *     opening no real database;
+ *   - `STORAGE_ADAPTER`/`MEMORY`/`MEMORY_ADAPTER`/`AUTH`/`BRAIN`/`LOG_SERVICE` → inert fakes so no
+ *     storage/auth/log backend is contacted.
+ * Local tier (the repo's `mosaic.config.json`) already disables BullMQ/Redis and the queue handles;
+ * Discord/Telegram/MCP plugins are env-gated and disarmed by deleting their tokens. Nothing about the
+ * router, `ChatModule`, `HarnessModule`, or `ChatGateway` is faked — those come from the REAL graph.
+ *
+ * The boot+init MUST SUCCEED cleanly (proven by `beforeAll` completing and the ChatGateway test
+ * passing). Red-first: on this branch `ChatRuntimeRouter` is registered in NO module (ChatModule
+ * provides only ChatGateway), so `moduleRef.get(ChatRuntimeRouter)` throws `UnknownElementException`
+ * — a WIRING gap, NOT an init failure. That single retrieval is the intended behavioural red; it
+ * flips green once Step Three registers the exclusive router. The ChatGateway retrieval and its
+ * browser-facing method surface are asserted alongside and pass today, pinning that the boot itself
+ * is healthy so the router failure cannot be mistaken for a mis-shaped fake or an unbounded side
+ * effect.
+ */
+describe('AppModule production boot — legacy ChatRuntimeRouter wiring (Task Five, Step Two group 2)', () => {
+  // A Drizzle-shaped fake that satisfies both DB consumers reached during a local-tier init:
+  //   • runPgliteMigrations(): reads handle.db.$client.exec + handle.db.execute(SELECT hashes);
+  //     exec is a no-op and execute yields an empty ledger, so migration statements no-op through.
+  //   • DefaultRoutingRulesSeed.seedDefaultRules(): db.select().from().where() must resolve to a
+  //     row set — we report a non-zero system-rule count so the seeding INSERT branch is skipped.
+  const fakeDb = {
+    $client: { exec: async (): Promise<void> => {} },
+    execute: async (): Promise<{ rows: unknown[] }> => ({ rows: [] }),
+    select: () => ({
+      from: () => ({
+        where: async (): Promise<Array<{ count: number }>> => [{ count: 1 }],
+      }),
+    }),
+    insert: () => ({ values: async (): Promise<void> => {} }),
+  };
+  const fakeDbHandle = { db: fakeDb, close: async (): Promise<void> => {} };
+  const fakeStorageAdapter = {
+    name: 'fake',
+    migrate: async (): Promise<void> => {},
+    close: async (): Promise<void> => {},
+  };
+  // Inert stand-in for the real ProviderService: no health-check interval, no Ollama fetch.
+  const fakeProviderService = {
+    onModuleInit: async (): Promise<void> => {},
+    onModuleDestroy: (): void => {},
+    getRegistry: () => ({
+      getAvailable: () => [],
+      getAll: () => [],
+      find: () => undefined,
+    }),
+    getDefaultModel: () => undefined,
+    listAvailableModels: () => [],
+    listProviders: () => [],
+    getAdapter: () => undefined,
+    getProvidersHealth: () => [],
+  };
+  const fakeBrain = { conversations: {}, agents: {} };
+
+  const BOOT_TIMEOUT_MS = 120_000;
+
+  let moduleRef: TestingModule;
+  let envSnapshot: Record<string, string | undefined>;
+
+  beforeAll(async () => {
+    envSnapshot = { ...process.env };
+    // Env hygiene: disarm the network-facing plugins/adapters and pin the legacy runtime mode.
+    delete process.env['DATABASE_URL'];
+    delete process.env['DISCORD_BOT_TOKEN'];
+    delete process.env['TELEGRAM_BOT_TOKEN'];
+    delete process.env['MCP_SERVERS'];
+    delete process.env['CHAT_HARNESS_RUNTIME']; // resolveChatRuntimeMode → 'legacy'
+    process.env['MOSAIC_STORAGE_TIER'] = 'local';
+
+    moduleRef = await Test.createTestingModule({ imports: [AppModule] })
+      // Storage/network side-effect adapters ONLY — never the router/chat/harness surface under test.
+      .overrideProvider('DB_HANDLE')
+      .useValue(fakeDbHandle)
+      .overrideProvider('DB')
+      .useValue(fakeDb)
+      .overrideProvider('STORAGE_ADAPTER')
+      .useValue(fakeStorageAdapter)
+      .overrideProvider('AUTH')
+      .useValue({})
+      .overrideProvider('BRAIN')
+      .useValue(fakeBrain)
+      .overrideProvider('LOG_SERVICE')
+      .useValue({})
+      .overrideProvider('MEMORY')
+      .useValue({})
+      .overrideProvider('MEMORY_ADAPTER')
+      .useValue({})
+      .overrideProvider(ProviderService)
+      .useValue(fakeProviderService)
+      .compile();
+
+    // The boot itself MUST succeed cleanly — a rejection here is a bounding failure, not the red.
+    await moduleRef.init();
+  }, BOOT_TIMEOUT_MS);
+
+  afterAll(async () => {
+    if (moduleRef) await moduleRef.close();
+    for (const key of Object.keys(process.env)) {
+      if (!(key in envSnapshot)) delete process.env[key];
+    }
+    for (const [key, value] of Object.entries(envSnapshot)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+
+  // Passes TODAY: the real ChatGateway is provided by the real ChatModule and its browser-facing
+  // surface exists. This pins that the whole-AppModule boot came up healthy, so the router failure
+  // below is unambiguously a wiring gap and not a mis-shaped fake or an unbounded side effect.
+  it('boots the whole AppModule and exposes the real ChatGateway with its browser-facing methods', () => {
+    const gateway = moduleRef.get(ChatGateway, { strict: false });
+    expect(typeof gateway.broadcastReload).toBe('function');
+    expect(typeof gateway.getModelOverride).toBe('function');
+    expect(typeof gateway.setModelOverride).toBe('function');
+    expect(typeof gateway.broadcastSessionInfo).toBe('function');
+  });
+
+  // RED TODAY: ChatRuntimeRouter is registered in no module on this branch, so this retrieval throws
+  // UnknownElementException — the intended red-first wiring failure. GREEN once Step Three registers
+  // the exclusive router in the production graph, where legacy mode resolves the embedded runtime.
+  it('resolves the exclusive ChatRuntimeRouter to the embedded runtime in legacy mode', () => {
+    const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
+    expect(router.active.kind).toBe('embedded');
+  });
+});

apps/gateway/src/chat/chat-runtime-router.ts

@@ -0,0 +1,173 @@
+import { Injectable, type OnModuleInit } from '@nestjs/common';
+import { HarnessRegistry } from '../harness/harness.registry.js';
+import {
+  isHarnessConversationServiceAvailable,
+  type HarnessConversationServiceBinding,
+} from '../harness/harness.tokens.js';
+import type {
+  ChatRuntime,
+  ChatRuntimeMode,
+  LegacyBrowserMessagePayload,
+  LegacyEmbeddedChatPort,
+  LegacyRuntimeResult,
+  LegacyRuntimeStream,
+  LegacySessionPresentation,
+  LegacySocketTurnLease,
+  OwnedConversationContext,
+  VerifiedDiscordIngressContext,
+  VerifiedDiscordTurnLease,
+} from './chat-runtime.js';
+import { ChatRuntimeUnavailableError, resolveChatRuntimeMode } from './chat-runtime.js';
+
+/** The fixed fail-closed result for a legacy browser operation issued under `pi-rpc`. */
+const RUNTIME_UNSUPPORTED = {
+  ok: false as const,
+  code: 'runtime_unsupported' as const,
+  retryable: false as const,
+};
+
+/**
+ * Resolves the one live {@link ChatRuntime} for this process and enforces the
+ * `pi-rpc` readiness preconditions at module init — before the gateway accepts
+ * traffic. It never falls back from `pi-rpc` to embedded execution: an unmet
+ * `pi-rpc` precondition is a typed startup failure ({@link ChatRuntimeUnavailableError}),
+ * and until `onModuleInit` selects a runtime, {@link active} throws rather than
+ * exposing any runtime — a failed `pi-rpc` init can never leak the embedded one.
+ */
+@Injectable()
+export class ChatRuntimeRouter implements OnModuleInit, LegacyEmbeddedChatPort {
+  private readonly mode: ChatRuntimeMode;
+
+  /** The single resolved runtime. Undefined until a successful `onModuleInit`. */
+  private resolved: ChatRuntime | undefined;
+
+  constructor(
+    private readonly harnessRegistry: HarnessRegistry,
+    private readonly conversationService: HarnessConversationServiceBinding,
+    private readonly embedded: ChatRuntime,
+    private readonly harness: ChatRuntime,
+    mode: ChatRuntimeMode = resolveChatRuntimeMode(),
+  ) {
+    this.mode = mode;
+  }
+
+  onModuleInit(): void {
+    if (this.mode === 'legacy') {
+      // Legacy ignores the pi-rpc preconditions entirely and always runs embedded.
+      this.resolved = this.embedded;
+      return;
+    }
+
+    // pi-rpc: both preconditions are hard startup failures, checked in a fixed order.
+    if (!this.harnessRegistry.has('pi')) {
+      this.resolved = undefined;
+      throw new ChatRuntimeUnavailableError('adapter_unavailable');
+    }
+    if (!isHarnessConversationServiceAvailable(this.conversationService)) {
+      this.resolved = undefined;
+      throw new ChatRuntimeUnavailableError('conversation_service_unavailable');
+    }
+
+    this.resolved = this.harness;
+  }
+
+  get active(): ChatRuntime {
+    if (this.resolved === undefined) {
+      // Reached only if init has not run or failed closed; never expose a runtime here.
+      throw new Error('The chat runtime is not available: startup did not resolve a runtime.');
+    }
+    return this.resolved;
+  }
+
+  /**
+   * The process-wide mode, available before {@link onModuleInit}. Production handlers read
+   * this to fail a legacy browser turn closed under `pi-rpc` *before* parsing the payload as
+   * either browser-legacy input or a Discord envelope — never to branch into a fallback.
+   */
+  get runtimeMode(): ChatRuntimeMode {
+    return this.mode;
+  }
+
+  /**
+   * The embedded runtime narrowed to its port. Only reached on the legacy path (and for the
+   * verified-Discord op in both modes), where the injected runtime is always a real
+   * `EmbeddedChatRuntime`. The router spec constructs the router with a bare `{ kind }` stub
+   * but never invokes a port op, so this narrowing is never exercised against the stub.
+   */
+  private get embeddedPort(): LegacyEmbeddedChatPort {
+    return this.embedded as unknown as LegacyEmbeddedChatPort;
+  }
+
+  // --- LegacyEmbeddedChatPort: legacy browser operations fail closed under pi-rpc ---
+
+  completeLegacyRestTurn(
+    context: OwnedConversationContext,
+    input: Readonly<{ content: string }>,
+  ): Promise<
+    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
+  > {
+    if (this.mode === 'pi-rpc') {
+      return Promise.resolve(RUNTIME_UNSUPPORTED);
+    }
+    return this.embeddedPort.completeLegacyRestTurn(context, input);
+  }
+
+  prepareLegacySocketTurn(
+    context: OwnedConversationContext,
+    input: LegacyBrowserMessagePayload,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>> {
+    if (this.mode === 'pi-rpc') {
+      return Promise.resolve(RUNTIME_UNSUPPORTED);
+    }
+    return this.embeddedPort.prepareLegacySocketTurn(context, input, stream);
+  }
+
+  setLegacyThinking(
+    context: OwnedConversationContext,
+    level: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    if (this.mode === 'pi-rpc') {
+      return RUNTIME_UNSUPPORTED;
+    }
+    return this.embeddedPort.setLegacyThinking(context, level);
+  }
+
+  abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>> {
+    if (this.mode === 'pi-rpc') {
+      return Promise.resolve(RUNTIME_UNSUPPORTED);
+    }
+    return this.embeddedPort.abortLegacyTurn(context);
+  }
+
+  applyLegacyModelOverride(
+    context: OwnedConversationContext,
+    modelId: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    if (this.mode === 'pi-rpc') {
+      return RUNTIME_UNSUPPORTED;
+    }
+    return this.embeddedPort.applyLegacyModelOverride(context, modelId);
+  }
+
+  readLegacySessionPresentation(
+    context: OwnedConversationContext,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    if (this.mode === 'pi-rpc') {
+      return RUNTIME_UNSUPPORTED;
+    }
+    return this.embeddedPort.readLegacySessionPresentation(context);
+  }
+
+  /**
+   * Verified Discord ingress bypasses browser mode: it is embedded-only in BOTH modes and
+   * never reaches the harness or routing-engine selection. It is reached only through a
+   * {@link VerifiedDiscordIngressContext}, which exists only after every ingress check.
+   */
+  dispatchVerifiedDiscordIngress(
+    context: VerifiedDiscordIngressContext,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>> {
+    return this.embeddedPort.dispatchVerifiedDiscordIngress(context, stream);
+  }
+}

apps/gateway/src/chat/chat-runtime.ts

@@ -0,0 +1,273 @@
+import type { ChannelAttachmentDto, RoutingDecisionInfo } from '@mosaicstack/types';
+
+/**
+ * The single chat execution strategy resolved by {@link ChatRuntimeRouter}.
+ *
+ * Exactly one runtime is live per process. There is no union that lets a
+ * `pi-rpc` deployment silently fall back to embedded execution: an unmet
+ * `pi-rpc` precondition is a typed startup failure, never a downgrade.
+ */
+export type ChatRuntimeMode = 'legacy' | 'pi-rpc';
+
+export type ChatRuntimeKind = 'embedded' | 'harness';
+
+/** The resolved runtime. Slice Zero exposes only its immutable {@link ChatRuntimeKind}. */
+export interface ChatRuntime {
+  readonly kind: ChatRuntimeKind;
+}
+
+/** Why the `pi-rpc` runtime could not be made ready. Both are hard startup failures. */
+export type ChatRuntimeUnavailableReason =
+  | 'adapter_unavailable'
+  | 'conversation_service_unavailable';
+
+/**
+ * Raised at module init when `pi-rpc` mode is selected but its preconditions are
+ * unmet. Carries only fixed, browser-safe text — never a raw exception message,
+ * stack, or provider detail — and reports the frozen ack code `runtime_unsupported`.
+ */
+export class ChatRuntimeUnavailableError extends Error {
+  readonly code = 'runtime_unsupported' as const;
+  readonly reason: ChatRuntimeUnavailableReason;
+
+  constructor(reason: ChatRuntimeUnavailableReason) {
+    super(
+      reason === 'adapter_unavailable'
+        ? 'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.'
+        : 'The pi-rpc chat runtime is unavailable: the harness conversation service is not bound.',
+    );
+    this.name = 'ChatRuntimeUnavailableError';
+    this.reason = reason;
+  }
+}
+
+/**
+ * Resolves the process-wide chat runtime mode from the environment. Anything other
+ * than the exact opt-in token `pi-rpc` keeps the legacy embedded runtime.
+ */
+export function resolveChatRuntimeMode(
+  env: Record<string, string | undefined> = process.env,
+): ChatRuntimeMode {
+  return env['CHAT_HARNESS_RUNTIME'] === 'pi-rpc' ? 'pi-rpc' : 'legacy';
+}
+
+// ---------------------------------------------------------------------------
+// Transitional embedded chat port (Task Five).
+//
+// The legacy embedded browser behaviour is moved behind this exact interface so
+// neither the controller nor the gateway retains AgentService, RoutingEngine,
+// session, `piSession`, metric, listener, or channel access. `EmbeddedChatRuntime`
+// implements the port; `ChatRuntimeRouter` exposes the same narrowly named
+// operations and returns `runtime_unsupported` before touching Embedded for legacy
+// browser operations when the mode is `pi-rpc`.
+//
+// The names are frozen (spec jarvis-brain@1c629b06). Legacy REST completion,
+// legacy Socket streaming, P3 harness turns, and verified Discord are distinct
+// transport/trust capabilities — there is deliberately no generic
+// `sendConversationTurn` nor an AgentService-shaped mirror on the router.
+// ---------------------------------------------------------------------------
+
+/**
+ * Phantom brand keeping {@link OwnedConversationContext} nominally distinct so browser
+ * DTOs are never structurally assignable to it. The factory that mints one may be called
+ * only after authentication with `scopeFromUser(...)`, never with payload authority fields.
+ */
+declare const ownedConversationContextBrand: unique symbol;
+
+/** Gateway-only ownership context. Embedded rechecks owner+tenant on every operation. */
+export interface OwnedConversationContext {
+  readonly [ownedConversationContextBrand]: true;
+  readonly conversationId: string;
+  readonly scope: Readonly<{ userId: string; tenantId: string }>;
+}
+
+/**
+ * Every non-`ok` legacy runtime outcome. Missing, foreign, and no-longer-owned
+ * conversations all collapse to `conversation_unavailable`. Ownership/mode/validation
+ * failures are total results and never throw.
+ */
+export type LegacyRuntimeFailure =
+  | { readonly ok: false; readonly code: 'runtime_unsupported'; readonly retryable: false }
+  | { readonly ok: false; readonly code: 'conversation_unavailable'; readonly retryable: false }
+  | { readonly ok: false; readonly code: 'request_invalid'; readonly retryable: false }
+  | {
+      readonly ok: false;
+      readonly code: 'thinking_level_invalid';
+      readonly retryable: false;
+      readonly availableThinkingLevels: readonly string[];
+    }
+  | { readonly ok: false; readonly code: 'runtime_unavailable'; readonly retryable: true }
+  | { readonly ok: false; readonly code: 'turn_already_dispatched'; readonly retryable: false }
+  | { readonly ok: false; readonly code: 'operation_failed'; readonly retryable: boolean }
+  | { readonly ok: false; readonly code: 'timeout'; readonly retryable: true };
+
+/** Total result: an `ok` value or one of the fixed {@link LegacyRuntimeFailure} codes. */
+export type LegacyRuntimeResult<T> =
+  | { readonly ok: true; readonly value: T }
+  | LegacyRuntimeFailure;
+
+/** User-facing session projection. Carries no session object, handle, or credential path. */
+export interface LegacySessionPresentation {
+  readonly provider: string;
+  readonly modelId: string;
+  readonly thinkingLevel: string;
+  readonly availableThinkingLevels: readonly string[];
+  readonly agentName?: string;
+  readonly routingDecision?: RoutingDecisionInfo;
+}
+
+/** Terminal usage stats, normalized by Embedded from AgentService metrics. */
+export interface LegacyUsage {
+  readonly provider: string;
+  readonly modelId: string;
+  readonly thinkingLevel: string;
+  readonly tokens: Readonly<{
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    total: number;
+  }>;
+  readonly cost: number;
+  readonly context: Readonly<{ percent: number | null; window: number }>;
+}
+
+/**
+ * Normalized stream event. Exposes no `AgentSession`, `piSession`, native handle, raw
+ * exception, tool arguments, or credential-bearing path — the gateway sees only these.
+ */
+export type LegacyRuntimeEvent =
+  | { readonly type: 'started' }
+  | { readonly type: 'text_delta'; readonly text: string }
+  | { readonly type: 'thinking_delta'; readonly text: string }
+  | {
+      readonly type: 'tool_started';
+      readonly toolCallId: string;
+      readonly toolName: string;
+    }
+  | {
+      readonly type: 'tool_finished';
+      readonly toolCallId: string;
+      readonly toolName: string;
+      readonly isError: boolean;
+    }
+  | { readonly type: 'settled'; readonly usage?: LegacyUsage };
+
+/** Legacy browser message input. Authority fields are advisory only; scope comes from the context. */
+export interface LegacyBrowserMessagePayload {
+  readonly content: string;
+  readonly provider?: string;
+  readonly modelId?: string;
+  readonly agentId?: string;
+  readonly attachments?: readonly ChannelAttachmentDto[];
+}
+
+/** A prepared-but-not-yet-dispatched legacy socket turn. */
+export interface LegacySocketTurnLease {
+  readonly presentation: LegacySessionPresentation;
+  /**
+   * Atomically one-shot and scope-rechecking. A second call returns
+   * `turn_already_dispatched` and performs zero prompt/tool effects.
+   */
+  dispatch(): Promise<LegacyRuntimeResult<void>>;
+  /** Idempotent, non-throwing. Removes listener and channel, including partial setup. */
+  dispose(): Promise<void>;
+}
+
+/**
+ * Phantom brand for {@link VerifiedDiscordIngressContext}. Minted only after service-token
+ * auth plus signature, allowlist, binding, expected-route, replay, configured-agent,
+ * forced-scope, and attachment-normalization checks.
+ */
+declare const verifiedDiscordIngressContextBrand: unique symbol;
+
+/** Fully-verified Discord ingress. Contains no socket, envelope, signature, token, or escape hatch. */
+export interface VerifiedDiscordIngressContext {
+  readonly [verifiedDiscordIngressContextBrand]: true;
+  readonly conversationId: string;
+  readonly scope: Readonly<{ userId: string; tenantId: string }>;
+  readonly configuredAgent: Readonly<{ agentConfigId: string; instanceId: string }>;
+  readonly content: string;
+  readonly attachments?: readonly ChannelAttachmentDto[];
+  readonly correlationId: string;
+  readonly discordMessageId: string;
+  readonly discordUserId: string;
+}
+
+/** Verified-Discord turn lease. Same atomic one-shot dispatch and idempotent dispose rules. */
+export interface VerifiedDiscordTurnLease {
+  readonly presentation: LegacySessionPresentation;
+  dispatch(): Promise<LegacyRuntimeResult<void>>;
+  dispose(): Promise<void>;
+}
+
+/** Server-owned egress projection the runtime pushes normalized events into. */
+export interface LegacyRuntimeStream {
+  /** Server-derived, e.g. `websocket:<socket-id>`. Never client-supplied. */
+  readonly channelId: string;
+  onEvent(event: LegacyRuntimeEvent): void;
+}
+
+/**
+ * The exact transitional port. `EmbeddedChatRuntime` implements it; `ChatRuntimeRouter`
+ * mirrors the operation names and fails closed with `runtime_unsupported` for legacy
+ * browser operations under `pi-rpc`.
+ */
+export interface LegacyEmbeddedChatPort {
+  completeLegacyRestTurn(
+    context: OwnedConversationContext,
+    input: Readonly<{ content: string }>,
+  ): Promise<
+    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
+  >;
+
+  prepareLegacySocketTurn(
+    context: OwnedConversationContext,
+    input: LegacyBrowserMessagePayload,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>>;
+
+  setLegacyThinking(
+    context: OwnedConversationContext,
+    level: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation>;
+
+  abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>>;
+
+  applyLegacyModelOverride(
+    context: OwnedConversationContext,
+    modelId: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation>;
+
+  readLegacySessionPresentation(
+    context: OwnedConversationContext,
+  ): LegacyRuntimeResult<LegacySessionPresentation>;
+
+  dispatchVerifiedDiscordIngress(
+    context: VerifiedDiscordIngressContext,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>>;
+}
+
+/**
+ * Mints an {@link OwnedConversationContext} from a server-derived scope. Callers must pass
+ * a scope produced by `scopeFromUser(...)` after authentication — never a client-supplied
+ * authority field. The brand is phantom, so this is the only way to obtain the branded type.
+ */
+export function ownConversation(
+  conversationId: string,
+  scope: Readonly<{ userId: string; tenantId: string }>,
+): OwnedConversationContext {
+  return { conversationId, scope } as unknown as OwnedConversationContext;
+}
+
+/**
+ * Mints a {@link VerifiedDiscordIngressContext}. Callers must have already completed every
+ * ingress check (service-token auth, signature, allowlist, binding, expected-route, replay,
+ * configured-agent, forced-scope, attachment normalization) before calling this.
+ */
+export function verifyDiscordIngress(
+  fields: Omit<VerifiedDiscordIngressContext, typeof verifiedDiscordIngressContextBrand>,
+): VerifiedDiscordIngressContext {
+  return { ...fields } as unknown as VerifiedDiscordIngressContext;
+}

apps/gateway/src/chat/chat.controller.ts

@@ -3,21 +3,20 @@ import {
   Post,
   Body,
   Logger,
-  ForbiddenException,
   HttpException,
   HttpStatus,
   NotFoundException,
-  Inject,
   UseGuards,
 } from '@nestjs/common';
-import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
 import { Throttle } from '@nestjs/throttler';
-import { AgentService } from '../agent/agent.service.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
 import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
 import { v4 as uuid } from 'uuid';
 import { ChatRequestDto } from './chat.dto.js';
+import { ChatRuntimeRouter } from './chat-runtime-router.js';
+import { ownConversation } from './chat-runtime.js';
+import type { LegacyRuntimeFailure } from './chat-runtime.js';
 
 interface ChatResponse {
   conversationId: string;
@@ -29,7 +28,7 @@ interface ChatResponse {
 export class ChatController {
   private readonly logger = new Logger(ChatController.name);
 
-  constructor(@Inject(AgentService) private readonly agentService: AgentService) {}
+  constructor(private readonly runtime: ChatRuntimeRouter) {}
 
   @Post()
   @Throttle({ default: { limit: 10, ttl: 60_000 } })
@@ -40,68 +39,38 @@ export class ChatController {
     const conversationId = body.conversationId ?? uuid();
     const scope = scopeFromUser(user);
 
-    try {
-      let agentSession = this.agentService.getSession(conversationId, scope);
-      if (!agentSession) {
-        agentSession = await this.agentService.createSession(conversationId, {
-          userId: scope.userId,
-          tenantId: scope.tenantId,
-        });
-      }
-    } catch (err) {
-      if (err instanceof ForbiddenException) {
-        throw new NotFoundException('Session not found');
-      }
-      this.logger.error(
-        `Session creation failed for conversation=${conversationId}`,
-        err instanceof Error ? err.stack : String(err),
-      );
-      throw new HttpException('Agent session unavailable', HttpStatus.SERVICE_UNAVAILABLE);
-    }
-
     this.logger.debug(`Handling chat request for user=${user.id}, conversation=${conversationId}`);
 
-    let responseText = '';
+    // The one exclusive runtime owns execution. In legacy mode this reaches the embedded runtime;
+    // in pi-rpc it fails closed with `runtime_unsupported` before ever touching embedded execution.
+    const result = await this.runtime.completeLegacyRestTurn(
+      ownConversation(conversationId, scope),
+      { content: body.content },
+    );
 
-    const done = new Promise<void>((resolve, reject) => {
-      const timer = setTimeout(() => {
-        cleanup();
-        this.logger.error(`Agent response timed out after 120s for conversation=${conversationId}`);
-        reject(new Error('Agent response timed out'));
-      }, 120_000);
-
-      const cleanup = this.agentService.onEvent(
-        conversationId,
-        (event: AgentSessionEvent) => {
-          if (
-            event.type === 'message_update' &&
-            event.assistantMessageEvent.type === 'text_delta'
-          ) {
-            responseText += event.assistantMessageEvent.delta;
-          }
-          if (event.type === 'agent_end') {
-            clearTimeout(timer);
-            cleanup();
-            resolve();
-          }
-        },
-        scope,
-      );
-    });
-
-    try {
-      await this.agentService.prompt(conversationId, body.content, scope);
-      await done;
-    } catch (err) {
-      if (err instanceof HttpException) throw err;
-      const message = err instanceof Error ? err.message : String(err);
-      if (message.includes('timed out')) {
-        throw new HttpException('Agent response timed out', HttpStatus.GATEWAY_TIMEOUT);
-      }
-      this.logger.error(`Chat prompt failed for conversation=${conversationId}`, String(err));
-      throw new HttpException('Agent processing failed', HttpStatus.INTERNAL_SERVER_ERROR);
+    if (result.ok) {
+      return { conversationId, text: result.value.text };
     }
 
-    return { conversationId, text: responseText };
+    throw this.toHttpException(result, conversationId);
+  }
+
+  /** Maps a total {@link LegacyRuntimeFailure} to the fixed browser-safe HTTP surface. */
+  private toHttpException(failure: LegacyRuntimeFailure, conversationId: string): HttpException {
+    switch (failure.code) {
+      case 'conversation_unavailable':
+        return new NotFoundException('Session not found');
+      case 'request_invalid':
+      case 'thinking_level_invalid':
+        return new HttpException('Invalid chat request', HttpStatus.BAD_REQUEST);
+      case 'timeout':
+        return new HttpException('Agent response timed out', HttpStatus.GATEWAY_TIMEOUT);
+      case 'runtime_unsupported':
+      case 'runtime_unavailable':
+        return new HttpException('Agent runtime unavailable', HttpStatus.SERVICE_UNAVAILABLE);
+      default:
+        this.logger.error(`Chat turn failed for conversation=${conversationId}: ${failure.code}`);
+        return new HttpException('Agent processing failed', HttpStatus.INTERNAL_SERVER_ERROR);
+    }
   }
 }

apps/gateway/src/chat/chat.dto.ts

@@ -1,5 +1,14 @@
 import type { ChannelAttachmentDto } from '@mosaicstack/types';
-import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
+import { Transform, Type } from 'class-transformer';
+import {
+  IsNotEmpty,
+  IsObject,
+  IsOptional,
+  IsString,
+  IsUUID,
+  MaxLength,
+  ValidateNested,
+} from 'class-validator';
 
 export class ChatRequestDto {
   @IsOptional()
@@ -37,3 +46,56 @@ export class ChatSocketMessageDto {
   /** Validated channel attachment references; binary content is not embedded. */
   attachments?: readonly ChannelAttachmentDto[];
 }
+
+/**
+ * Task Five, group 2 — the frozen pi-rpc `turn:send` selection triple.
+ *
+ * Each id is a required, non-empty, bounded string. There is no `@IsOptional` and no extra
+ * field: under `forbidNonWhitelisted` an unknown selection key is rejected, and a missing id
+ * fails `@IsString` (undefined is not a string) rather than silently passing.
+ */
+export class HarnessTurnSelectionDto {
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(255)
+  harnessId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(255)
+  providerId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(255)
+  modelId!: string;
+}
+
+/**
+ * Task Five, group 2 — the frozen wire contract for a pi-rpc `turn:send`.
+ *
+ * Validated through the production `ValidationPipe({ whitelist, forbidNonWhitelisted, transform })`:
+ * a UUID conversation id; `content` trimmed then bounded to 1..10_000 characters (whitespace-only
+ * collapses to empty and fails `@IsNotEmpty`); a nested `selection` object recursed with an
+ * explicit `@Type` (a bare `@ValidateNested` is masked green by class-validator's empty-metadata
+ * `unknownValue`); and a UUID-v4 idempotency key. No `provider`/`modelId`/`attachments` or other
+ * authority field is declared, so `forbidNonWhitelisted` rejects every unknown top-level key.
+ */
+export class HarnessTurnSendDto {
+  @IsUUID()
+  conversationId!: string;
+
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(10_000)
+  content!: string;
+
+  @IsObject()
+  @ValidateNested()
+  @Type(() => HarnessTurnSelectionDto)
+  selection!: HarnessTurnSelectionDto;
+
+  @IsUUID('4')
+  idempotencyKey!: string;
+}

apps/gateway/src/chat/chat.gateway-command-approval.spec.ts

@@ -8,12 +8,31 @@ const payload: SlashCommandPayload = {
   approvalId: 'approval-1',
 };
 
+/**
+ * Task 5 fence (F, existing control): gateway-owned command authorization/approval must
+ * cause ZERO chat-runtime dispatch. Placed in the gateway's chat-runtime-router slot (the
+ * former direct `AgentService` slot) so any accidental chat-runtime resolution throws
+ * loudly instead of silently passing. Because execute/approval run entirely through the
+ * command executor dependency and never resolve a chat runtime, this fixture is never
+ * triggered and the ingress stays a GREEN control.
+ */
+function failIfUsedChatRuntimeRouter() {
+  return {
+    onModuleInit: () => {
+      throw new Error('chat runtime router must not initialise on the command approval path');
+    },
+    get active(): never {
+      throw new Error('chat runtime must not be resolved on the command approval path');
+    },
+  };
+}
+
 function buildGateway(commandExecutor: {
   execute: ReturnType<typeof vi.fn>;
   createApproval: ReturnType<typeof vi.fn>;
 }): ChatGateway {
   return new ChatGateway(
-    {} as never,
+    failIfUsedChatRuntimeRouter() as never,
     {} as never,
     {} as never,
     {} as never,
@@ -72,3 +91,114 @@ describe('ChatGateway command approval ingress', () => {
     });
   });
 });
+
+/**
+ * Task 5 (G3) command runtime fence. Under pi-rpc there is no embedded chat session, so
+ * embedded slash-commands (/model, /agent, and every other non-audited command) are fixed
+ * "unsupported" and MUST fail closed BEFORE reaching the command executor — never a silent
+ * fall-through to embedded execution. Only runtime-independent audited system commands
+ * (/reload) pass through as a positive control, and the approval path stays runtime-independent.
+ * The router stub here carries `runtimeMode: 'pi-rpc'` and throws if any runtime is resolved, so
+ * a fence bypass surfaces as a thrown error rather than a silent embedded dispatch.
+ */
+function buildPiRpcGateway(commandExecutor: {
+  execute: ReturnType<typeof vi.fn>;
+  createApproval: ReturnType<typeof vi.fn>;
+}): ChatGateway {
+  const piRpcRouter = {
+    runtimeMode: 'pi-rpc' as const,
+    onModuleInit: () => {
+      throw new Error('chat runtime router must not initialise on the pi-rpc command path');
+    },
+    get active(): never {
+      throw new Error('chat runtime must not be resolved on the pi-rpc command path');
+    },
+  };
+  return new ChatGateway(
+    piRpcRouter as never,
+    {} as never,
+    {} as never,
+    {} as never,
+    commandExecutor as never,
+    {} as never,
+  );
+}
+
+describe('ChatGateway command runtime fence (Task 5 G3, pi-rpc)', () => {
+  const UNSUPPORTED = 'Slash commands are not available on this deployment.';
+
+  it.each(['model', 'agent', 'gc'])(
+    'fails /%s closed before the executor under pi-rpc (execute never called)',
+    async (command): Promise<void> => {
+      const commandExecutor = {
+        execute: vi
+          .fn()
+          .mockResolvedValue({ command, conversationId: 'conversation-1', success: true }),
+        createApproval: vi.fn(),
+      };
+      const gateway = buildPiRpcGateway(commandExecutor);
+      const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
+
+      await gateway.handleCommandExecute(client as never, {
+        command,
+        conversationId: 'conversation-1',
+      });
+
+      expect(commandExecutor.execute).toHaveBeenCalledTimes(0);
+      expect(client.emit).toHaveBeenCalledWith('command:result', {
+        command,
+        conversationId: 'conversation-1',
+        success: false,
+        message: UNSUPPORTED,
+      });
+    },
+  );
+
+  it('passes the audited /reload system command through as a positive control under pi-rpc', async (): Promise<void> => {
+    const reloadResult = { command: 'reload', conversationId: 'conversation-1', success: true };
+    const commandExecutor = {
+      execute: vi.fn().mockResolvedValue(reloadResult),
+      createApproval: vi.fn(),
+    };
+    const gateway = buildPiRpcGateway(commandExecutor);
+    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
+
+    await gateway.handleCommandExecute(client as never, {
+      command: 'reload',
+      conversationId: 'conversation-1',
+    });
+
+    expect(commandExecutor.execute).toHaveBeenCalledTimes(1);
+    expect(commandExecutor.execute).toHaveBeenCalledWith(
+      { command: 'reload', conversationId: 'conversation-1' },
+      { userId: 'admin-1', tenantId: 'admin-1' },
+    );
+    expect(client.emit).toHaveBeenCalledWith('command:result', reloadResult);
+  });
+
+  it('keeps command approval runtime-independent under pi-rpc (createApproval still runs)', async (): Promise<void> => {
+    const commandExecutor = {
+      execute: vi.fn(),
+      createApproval: vi.fn().mockResolvedValue({
+        approvalId: 'approval-1',
+        expiresAt: '2026-07-12T00:05:00.000Z',
+      }),
+    };
+    const gateway = buildPiRpcGateway(commandExecutor);
+    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
+
+    await gateway.handleCommandApproval(client as never, {
+      command: 'gc',
+      conversationId: 'conversation-1',
+    });
+
+    expect(commandExecutor.createApproval).toHaveBeenCalledWith(
+      { command: 'gc', conversationId: 'conversation-1' },
+      { userId: 'admin-1', tenantId: 'admin-1' },
+    );
+    expect(client.emit).toHaveBeenCalledWith(
+      'command:approval',
+      expect.objectContaining({ success: true, approvalId: 'approval-1' }),
+    );
+  });
+});

apps/gateway/src/chat/chat.module.ts

@@ -1,12 +1,59 @@
 import { forwardRef, Module } from '@nestjs/common';
 import { CommandsModule } from '../commands/commands.module.js';
+import { HarnessModule } from '../harness/harness.module.js';
+import { HarnessRegistry } from '../harness/harness.registry.js';
+import {
+  HARNESS_CONVERSATION_SERVICE,
+  HARNESS_REGISTRY,
+  type HarnessConversationServiceBinding,
+} from '../harness/harness.tokens.js';
+import type { HarnessConversationService } from '@mosaicstack/types';
 import { ChatGateway } from './chat.gateway.js';
 import { ChatController } from './chat.controller.js';
+import { ChatRuntimeRouter } from './chat-runtime-router.js';
+import { EmbeddedChatRuntime } from './embedded-chat.runtime.js';
+import { HarnessChatRuntime } from './harness-chat.runtime.js';
 
+/**
+ * Task Five wiring. The exclusive {@link ChatRuntimeRouter} is the single chat-execution
+ * authority: the controller and gateway inject only the router, never `AgentService`,
+ * `RoutingEngineService`, or a session/`piSession` handle. The router resolves exactly one
+ * runtime at module init — {@link EmbeddedChatRuntime} in legacy mode, {@link HarnessChatRuntime}
+ * in `pi-rpc` — over the REAL {@link HarnessModule} registry and conversation-service binding.
+ *
+ * The router and the harness runtime are constructed through factories because their
+ * dependencies are interface/union types with no runtime injection token (the registry and
+ * conversation-service arrive via the string tokens exported by `HarnessModule`); the embedded
+ * runtime injects the class-typed `AgentService` and is provided directly.
+ */
 @Module({
-  imports: [forwardRef(() => CommandsModule)],
+  imports: [forwardRef(() => CommandsModule), HarnessModule],
   controllers: [ChatController],
-  providers: [ChatGateway],
-  exports: [ChatGateway],
+  providers: [
+    ChatGateway,
+    EmbeddedChatRuntime,
+    {
+      provide: HarnessChatRuntime,
+      useFactory: (conversationService: HarnessConversationServiceBinding) =>
+        new HarnessChatRuntime(conversationService as HarnessConversationService),
+      inject: [HARNESS_CONVERSATION_SERVICE],
+    },
+    {
+      provide: ChatRuntimeRouter,
+      useFactory: (
+        registry: HarnessRegistry,
+        conversationService: HarnessConversationServiceBinding,
+        embedded: EmbeddedChatRuntime,
+        harness: HarnessChatRuntime,
+      ) => new ChatRuntimeRouter(registry, conversationService, embedded, harness),
+      inject: [
+        HARNESS_REGISTRY,
+        HARNESS_CONVERSATION_SERVICE,
+        EmbeddedChatRuntime,
+        HarnessChatRuntime,
+      ],
+    },
+  ],
+  exports: [ChatGateway, ChatRuntimeRouter],
 })
 export class ChatModule {}

apps/gateway/src/chat/embedded-chat.runtime.ts

@@ -0,0 +1,532 @@
+import { ForbiddenException, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
+import { AgentService, type AgentSession } from '../agent/agent.service.js';
+import type { ActorTenantScope } from '../auth/session-scope.js';
+import type {
+  ChatRuntime,
+  LegacyBrowserMessagePayload,
+  LegacyEmbeddedChatPort,
+  LegacyRuntimeEvent,
+  LegacyRuntimeResult,
+  LegacySessionPresentation,
+  LegacySocketTurnLease,
+  LegacyUsage,
+  OwnedConversationContext,
+  VerifiedDiscordIngressContext,
+  VerifiedDiscordTurnLease,
+  LegacyRuntimeStream,
+} from './chat-runtime.js';
+
+/** Fixed timeout for a synchronous REST turn, matching the historical controller budget. */
+const REST_TURN_TIMEOUT_MS = 120_000;
+
+/**
+ * The `legacy` chat runtime and the sole implementation of {@link LegacyEmbeddedChatPort}.
+ *
+ * It owns the embedded in-process execution path — the `AgentService` stack that the
+ * `ChatController` and `ChatGateway` drove directly before Task Five. Once the
+ * {@link import('./chat-runtime-router.js').ChatRuntimeRouter} fronts it, the browser
+ * HTTP/WebSocket legacy path and verified-Discord ingress route through THIS runtime, so
+ * neither the controller nor the gateway retains `AgentService`, `piSession`, session,
+ * listener, channel, or metric access. Ownership (`userId`/`tenantId`) is re-checked by
+ * `AgentService` on every operation; a missing, foreign, or no-longer-owned conversation
+ * collapses to `conversation_unavailable` and never throws out of the port.
+ */
+@Injectable()
+export class EmbeddedChatRuntime implements ChatRuntime, LegacyEmbeddedChatPort {
+  readonly kind = 'embedded' as const;
+  private readonly logger = new Logger(EmbeddedChatRuntime.name);
+
+  constructor(readonly agentService: AgentService) {}
+
+  // -------------------------------------------------------------------------
+  // Legacy REST completion (op A)
+  // -------------------------------------------------------------------------
+
+  async completeLegacyRestTurn(
+    context: OwnedConversationContext,
+    input: Readonly<{ content: string }>,
+  ): Promise<
+    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
+  > {
+    const scope = toScope(context.scope);
+    const { conversationId } = context;
+
+    const resolved = await this.resolveOrCreate(conversationId, scope, {});
+    if (!resolved.ok) return resolved;
+
+    let responseText = '';
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let detach: (() => void) | undefined;
+    let disposed = false;
+    // One idempotent teardown owned OUTSIDE the completion promise: it clears the timeout and
+    // detaches the event listener exactly once, whichever of agent_end, timeout, or a prompt
+    // rejection fires first. Without this, a prompt() rejection surfaced through the catch below
+    // would return while leaving the listener attached (free to consume a later turn's events) and
+    // the 120s timer live (its rejection later going unobserved).
+    const dispose = (): void => {
+      if (disposed) return;
+      disposed = true;
+      if (timer !== undefined) clearTimeout(timer);
+      detach?.();
+    };
+    const done = new Promise<void>((resolve, reject) => {
+      timer = setTimeout(() => {
+        dispose();
+        reject(new Error('Agent response timed out'));
+      }, REST_TURN_TIMEOUT_MS);
+
+      detach = this.agentService.onEvent(
+        conversationId,
+        (event: AgentSessionEvent) => {
+          if (
+            event.type === 'message_update' &&
+            event.assistantMessageEvent.type === 'text_delta'
+          ) {
+            responseText += event.assistantMessageEvent.delta;
+          }
+          if (event.type === 'agent_end') {
+            dispose();
+            resolve();
+          }
+        },
+        scope,
+      );
+    });
+
+    // Attach the prompt and the completion promise CONCURRENTLY. Awaiting prompt() first left the
+    // timeout unobservable until prompt settled (a hung prompt could never time out) and, worse,
+    // let the 120s timer reject `done` while nothing yet awaited it — a transient unhandledRejection
+    // window. Promise.all installs handlers on BOTH synchronously, so the timeout bounds the whole
+    // turn even while prompt is pending, and neither promise can reject unobserved. Success still
+    // requires both prompt() to resolve AND agent_end to arrive (identical to the prior sequential
+    // await). The idempotent dispose() clears the timer + detaches on whichever settles first.
+    const prompting = this.agentService.prompt(conversationId, input.content, scope);
+    try {
+      await Promise.all([prompting, done]);
+    } catch (err) {
+      dispose();
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes('timed out')) {
+        return { ok: false, code: 'timeout', retryable: true };
+      }
+      this.logger.error(`Legacy REST turn failed for conversation=${conversationId}`, message);
+      return { ok: false, code: 'operation_failed', retryable: false };
+    }
+
+    const presentation = this.presentationFor(conversationId, scope) ?? resolved.presentation;
+    return { ok: true, value: { text: responseText, presentation } };
+  }
+
+  // -------------------------------------------------------------------------
+  // Legacy Socket streaming (op B)
+  // -------------------------------------------------------------------------
+
+  async prepareLegacySocketTurn(
+    context: OwnedConversationContext,
+    input: LegacyBrowserMessagePayload,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>> {
+    const scope = toScope(context.scope);
+    const { conversationId } = context;
+
+    const resolved = await this.resolveOrCreate(conversationId, scope, {
+      ...(input.provider ? { provider: input.provider } : {}),
+      ...(input.modelId ? { modelId: input.modelId } : {}),
+      ...(input.agentId ? { agentConfigId: input.agentId } : {}),
+    });
+    if (!resolved.ok) return resolved;
+
+    let detach: () => void;
+    try {
+      detach = this.subscribe(conversationId, scope, stream);
+    } catch (err) {
+      // A partial listener/channel setup rolled itself back inside subscribe(); surface a total
+      // safe failure instead of throwing out of the port. Retryable — the attach is transient.
+      this.logger.error(
+        `Embedded socket subscription failed for conversation=${conversationId}`,
+        err instanceof Error ? err.message : String(err),
+      );
+      return { ok: false, code: 'runtime_unavailable', retryable: true };
+    }
+
+    return {
+      ok: true,
+      value: this.buildLease(
+        conversationId,
+        scope,
+        input.content,
+        input.attachments,
+        detach,
+        resolved.presentation,
+      ),
+    };
+  }
+
+  // -------------------------------------------------------------------------
+  // Thinking level (op C) — synchronous, total
+  // -------------------------------------------------------------------------
+
+  setLegacyThinking(
+    context: OwnedConversationContext,
+    level: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    const scope = toScope(context.scope);
+    const session = this.agentService.getSession(context.conversationId, scope);
+    if (!session) return CONVERSATION_UNAVAILABLE;
+
+    const availableThinkingLevels = session.piSession.getAvailableThinkingLevels();
+    if (!(availableThinkingLevels as readonly string[]).includes(level)) {
+      return {
+        ok: false,
+        code: 'thinking_level_invalid',
+        retryable: false,
+        availableThinkingLevels,
+      };
+    }
+
+    session.piSession.setThinkingLevel(level as never);
+    return { ok: true, value: this.presentationForSession(session) };
+  }
+
+  // -------------------------------------------------------------------------
+  // Abort (op D)
+  // -------------------------------------------------------------------------
+
+  async abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>> {
+    const scope = toScope(context.scope);
+    const session = this.agentService.getSession(context.conversationId, scope);
+    if (!session) return CONVERSATION_UNAVAILABLE;
+
+    try {
+      await session.piSession.abort();
+    } catch (err) {
+      this.logger.error(
+        `Legacy abort failed for conversation=${context.conversationId}`,
+        err instanceof Error ? err.message : String(err),
+      );
+      return { ok: false, code: 'operation_failed', retryable: false };
+    }
+    return { ok: true, value: undefined };
+  }
+
+  // -------------------------------------------------------------------------
+  // Model override (synchronous, total)
+  // -------------------------------------------------------------------------
+
+  applyLegacyModelOverride(
+    context: OwnedConversationContext,
+    modelId: string,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    const scope = toScope(context.scope);
+    const session = this.agentService.getSession(context.conversationId, scope);
+    if (!session) return CONVERSATION_UNAVAILABLE;
+
+    this.agentService.updateSessionModel(context.conversationId, modelId, scope);
+    const refreshed = this.agentService.getSession(context.conversationId, scope) ?? session;
+    return { ok: true, value: this.presentationForSession(refreshed) };
+  }
+
+  // -------------------------------------------------------------------------
+  // Presentation read (synchronous, total)
+  // -------------------------------------------------------------------------
+
+  readLegacySessionPresentation(
+    context: OwnedConversationContext,
+  ): LegacyRuntimeResult<LegacySessionPresentation> {
+    const scope = toScope(context.scope);
+    const session = this.agentService.getSession(context.conversationId, scope);
+    if (!session) return CONVERSATION_UNAVAILABLE;
+    return { ok: true, value: this.presentationForSession(session) };
+  }
+
+  // -------------------------------------------------------------------------
+  // Verified Discord ingress (embedded-only in both modes)
+  // -------------------------------------------------------------------------
+
+  async dispatchVerifiedDiscordIngress(
+    context: VerifiedDiscordIngressContext,
+    stream: LegacyRuntimeStream,
+  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>> {
+    const scope = toScope(context.scope);
+    const { conversationId } = context;
+
+    const resolved = await this.resolveOrCreate(
+      conversationId,
+      scope,
+      { agentConfigId: context.configuredAgent.agentConfigId },
+      {
+        agentConfigId: context.configuredAgent.agentConfigId,
+        instanceId: context.configuredAgent.instanceId,
+      },
+    );
+    if (!resolved.ok) return resolved;
+
+    let detach: () => void;
+    try {
+      detach = this.subscribe(conversationId, scope, stream);
+    } catch (err) {
+      // A partial listener/channel setup rolled itself back inside subscribe(); surface a total
+      // safe failure instead of throwing out of the port. Retryable — the attach is transient.
+      this.logger.error(
+        `Embedded Discord subscription failed for conversation=${conversationId}`,
+        err instanceof Error ? err.message : String(err),
+      );
+      return { ok: false, code: 'runtime_unavailable', retryable: true };
+    }
+
+    return {
+      ok: true,
+      value: this.buildLease(
+        conversationId,
+        scope,
+        context.content,
+        context.attachments,
+        detach,
+        resolved.presentation,
+      ),
+    };
+  }
+
+  // -------------------------------------------------------------------------
+  // Shared helpers
+  // -------------------------------------------------------------------------
+
+  /**
+   * Resolves the owned session, creating it on first use. Ownership/scope rejections
+   * (`Forbidden`/`NotFound`) collapse to `conversation_unavailable`; any other creation
+   * failure surfaces as the retryable `runtime_unavailable`. On success returns the
+   * session presentation so callers avoid a redundant `getSession`.
+   */
+  private async resolveOrCreate(
+    conversationId: string,
+    scope: ActorTenantScope,
+    extraOptions: Readonly<{ provider?: string; modelId?: string; agentConfigId?: string }>,
+    expectedAgent?: Readonly<{ agentConfigId: string; instanceId: string }>,
+  ): Promise<
+    | { readonly ok: true; readonly presentation: LegacySessionPresentation }
+    | Exclude<LegacyRuntimeResult<never>, { ok: true }>
+  > {
+    // A verified-Discord turn may only run under a session whose configured identity matches the
+    // reconciled agent record EXACTLY (config id + resolved name). This holds for BOTH a reused
+    // pre-existing session AND a freshly created one: a session carrying a different configured
+    // agent — however it arose — is rejected rather than executed under the verified label, so we
+    // never silently run a different prompt/model/tool policy. A plain (non-verified) turn passes
+    // no expectedAgent and skips the check.
+    const identityMatches = (candidate: AgentSession): boolean =>
+      expectedAgent === undefined ||
+      (candidate.agentConfigId === expectedAgent.agentConfigId &&
+        candidate.agentName === expectedAgent.instanceId);
+
+    let session = this.agentService.getSession(conversationId, scope);
+    if (session && !identityMatches(session)) {
+      // Reused same-scope session minted under a different configured identity — reject with zero
+      // effects rather than dispatch a verified turn onto a foreign agent's session.
+      return CONVERSATION_UNAVAILABLE;
+    }
+    if (!session) {
+      try {
+        session = await this.agentService.createSession(conversationId, {
+          userId: scope.userId,
+          tenantId: scope.tenantId,
+          ...extraOptions,
+        });
+      } catch (err) {
+        if (err instanceof ForbiddenException || err instanceof NotFoundException) {
+          return CONVERSATION_UNAVAILABLE;
+        }
+        this.logger.error(
+          `Embedded session creation failed for conversation=${conversationId}`,
+          err instanceof Error ? err.stack : String(err),
+        );
+        return { ok: false, code: 'runtime_unavailable', retryable: true };
+      }
+      // The just-created session must ALSO carry the reconciled identity before any effect. A
+      // createSession that returns a session under a different configured agent (misconfiguration
+      // or a substituted factory) is rejected here, before subscribe/persist/ack/prompt.
+      if (!identityMatches(session)) {
+        return CONVERSATION_UNAVAILABLE;
+      }
+    }
+    return { ok: true, presentation: this.presentationForSession(session) };
+  }
+
+  /** Installs a normalizing event listener that forwards to the server-owned stream. */
+  private subscribe(
+    conversationId: string,
+    scope: ActorTenantScope,
+    stream: LegacyRuntimeStream,
+  ): () => void {
+    const unsubscribe = this.agentService.onEvent(
+      conversationId,
+      (event: AgentSessionEvent) => {
+        const normalized = this.normalizeEvent(conversationId, scope, event);
+        if (normalized) stream.onEvent(normalized);
+      },
+      scope,
+    );
+    try {
+      this.agentService.addChannel(conversationId, stream.channelId, scope);
+    } catch (err) {
+      // Partial setup: the listener was acquired but the channel attach failed. Roll back
+      // exactly what was acquired (the listener) before the failure escapes, so no leaked
+      // subscription survives; the caller converts the rethrow into a total safe failure.
+      try {
+        unsubscribe();
+      } catch {
+        /* idempotent teardown */
+      }
+      throw err;
+    }
+    return () => {
+      try {
+        unsubscribe();
+      } catch {
+        /* idempotent teardown */
+      }
+      try {
+        this.agentService.removeChannel(conversationId, stream.channelId, scope);
+      } catch {
+        /* idempotent teardown */
+      }
+    };
+  }
+
+  /** Builds an atomically one-shot, scope-rechecking dispatch lease. */
+  private buildLease(
+    conversationId: string,
+    scope: ActorTenantScope,
+    content: string,
+    attachments: VerifiedDiscordIngressContext['attachments'],
+    detach: () => void,
+    presentation: LegacySessionPresentation,
+  ): LegacySocketTurnLease & VerifiedDiscordTurnLease {
+    let dispatched = false;
+    let disposed = false;
+    return {
+      presentation,
+      dispatch: async (): Promise<LegacyRuntimeResult<void>> => {
+        if (dispatched) {
+          return { ok: false, code: 'turn_already_dispatched', retryable: false };
+        }
+        dispatched = true;
+        try {
+          await this.agentService.prompt(conversationId, content, scope, attachments);
+        } catch (err) {
+          this.logger.error(
+            `Legacy dispatch failed for conversation=${conversationId}`,
+            err instanceof Error ? err.message : String(err),
+          );
+          return { ok: false, code: 'operation_failed', retryable: false };
+        }
+        return { ok: true, value: undefined };
+      },
+      dispose: async (): Promise<void> => {
+        if (disposed) return;
+        disposed = true;
+        detach();
+      },
+    };
+  }
+
+  /** Normalizes a raw agent event into the redaction-agnostic transport event, or drops it. */
+  private normalizeEvent(
+    conversationId: string,
+    scope: ActorTenantScope,
+    event: AgentSessionEvent,
+  ): LegacyRuntimeEvent | undefined {
+    switch (event.type) {
+      case 'agent_start':
+        return { type: 'started' };
+      case 'agent_end':
+        return { type: 'settled', ...this.usageFor(conversationId, scope) };
+      case 'message_update': {
+        const assistant = event.assistantMessageEvent;
+        if (assistant.type === 'text_delta') return { type: 'text_delta', text: assistant.delta };
+        if (assistant.type === 'thinking_delta') {
+          return { type: 'thinking_delta', text: assistant.delta };
+        }
+        return undefined;
+      }
+      case 'tool_execution_start':
+        return { type: 'tool_started', toolCallId: event.toolCallId, toolName: event.toolName };
+      case 'tool_execution_end':
+        return {
+          type: 'tool_finished',
+          toolCallId: event.toolCallId,
+          toolName: event.toolName,
+          isError: event.isError,
+        };
+      default:
+        return undefined;
+    }
+  }
+
+  /**
+   * Gathers terminal usage from the Pi session and records it into session metrics.
+   * Embedded owns AgentService metrics; the gateway never touches `piSession` stats.
+   */
+  private usageFor(conversationId: string, scope: ActorTenantScope): { usage?: LegacyUsage } {
+    const session = this.agentService.getSession(conversationId, scope);
+    const piSession = session?.piSession;
+    const stats = piSession?.getSessionStats();
+    if (!session || !stats) return {};
+    const contextUsage = piSession?.getContextUsage();
+
+    const tokens = {
+      input: stats.tokens?.input ?? 0,
+      output: stats.tokens?.output ?? 0,
+      cacheRead: stats.tokens?.cacheRead ?? 0,
+      cacheWrite: stats.tokens?.cacheWrite ?? 0,
+      total: stats.tokens?.total ?? 0,
+    };
+
+    this.agentService.recordTokenUsage(conversationId, { ...tokens });
+
+    return {
+      usage: {
+        provider: session.provider,
+        modelId: session.modelId,
+        thinkingLevel: piSession?.thinkingLevel ?? 'off',
+        tokens,
+        cost: stats.cost ?? 0,
+        context: {
+          percent: contextUsage?.percent ?? null,
+          window: contextUsage?.contextWindow ?? 0,
+        },
+      },
+    };
+  }
+
+  /** Presentation from a live session id, or undefined when no owned session exists. */
+  private presentationFor(
+    conversationId: string,
+    scope: ActorTenantScope,
+  ): LegacySessionPresentation | undefined {
+    const session = this.agentService.getSession(conversationId, scope);
+    return session ? this.presentationForSession(session) : undefined;
+  }
+
+  /** User-facing projection carrying no session handle, credential, or raw stats. */
+  private presentationForSession(session: AgentSession): LegacySessionPresentation {
+    return {
+      provider: session.provider,
+      modelId: session.modelId,
+      thinkingLevel: session.piSession.thinkingLevel,
+      availableThinkingLevels: session.piSession.getAvailableThinkingLevels(),
+      ...(session.agentName ? { agentName: session.agentName } : {}),
+    };
+  }
+}
+
+/** The shared terminal `conversation_unavailable` failure (missing/foreign/lost ownership). */
+const CONVERSATION_UNAVAILABLE = {
+  ok: false as const,
+  code: 'conversation_unavailable' as const,
+  retryable: false as const,
+};
+
+/** Narrows a branded context scope to the `AgentService` actor/tenant scope (identical shape). */
+function toScope(scope: Readonly<{ userId: string; tenantId: string }>): ActorTenantScope {
+  return { userId: scope.userId, tenantId: scope.tenantId };
+}

apps/gateway/src/chat/harness-chat.runtime.spec.ts

@@ -0,0 +1,170 @@
+import { describe, expect, it } from 'vitest';
+import type {
+  AttachConversation,
+  ConversationSnapshot,
+  DetachConversation,
+  HarnessActorContext,
+  HarnessConversationService,
+  HarnessEventEnvelope,
+  HarnessSelection,
+  SendHarnessTurn,
+  TurnReceipt,
+} from '@mosaicstack/types';
+import { HarnessChatRuntime } from './harness-chat.runtime.js';
+
+/**
+ * Task Five, Step One (harness runtime). Proves the `pi-rpc` runtime executes
+ * exclusively through the {@link HarnessConversationService} RPC boundary and
+ * forwards the caller's exact selection tuple and idempotency key without
+ * substitution. Red-first: the runtime is an unimplemented stub, so every
+ * delegation assertion fails until Step Three.
+ */
+
+const context: HarnessActorContext = {
+  actorId: 'actor-1',
+  tenantId: 'tenant-1',
+  seatId: 'seat-1',
+  correlationId: 'corr-1',
+};
+
+const selection: HarnessSelection = {
+  harnessId: 'pi',
+  providerId: 'anthropic',
+  modelId: 'claude-opus-4-8',
+};
+
+const conversationId = '11111111-1111-4111-8111-111111111111';
+const idempotencyKey = '22222222-2222-4222-8222-222222222222';
+
+const sendInput: SendHarnessTurn & { idempotencyKey: string } = {
+  context,
+  conversationId,
+  selection,
+  turnId: 'turn-abc',
+  correlationId: 'corr-1',
+  content: 'hello',
+  idempotencyKey,
+};
+
+const attachInput: AttachConversation & { afterSequence?: number } = {
+  context,
+  conversationId,
+  clientId: 'client-1',
+  selection,
+  afterSequence: 0,
+};
+
+const detachInput: DetachConversation = {
+  context,
+  conversationId,
+  clientId: 'client-1',
+};
+
+interface RecordedCalls {
+  attach: (AttachConversation & { afterSequence?: number })[];
+  detach: DetachConversation[];
+  send: (SendHarnessTurn & { idempotencyKey: string })[];
+  subscribeFrom: { conversationId: string; afterSequence: number }[];
+}
+
+const snapshot: ConversationSnapshot = {
+  session: {
+    conversationId,
+    nativeSessionId: 'native-1',
+    seatId: 'seat-1',
+    selection,
+    state: 'idle',
+    attachedClientIds: ['client-1'],
+  },
+  lastSequence: 0,
+  replay: [],
+};
+
+function build(): { runtime: HarnessChatRuntime; calls: RecordedCalls } {
+  const calls: RecordedCalls = { attach: [], detach: [], send: [], subscribeFrom: [] };
+  const service: HarnessConversationService = {
+    attach: (input) => {
+      calls.attach.push(input);
+      return Promise.resolve(snapshot);
+    },
+    detach: (input) => {
+      calls.detach.push(input);
+      return Promise.resolve();
+    },
+    send: (input) => {
+      calls.send.push(input);
+      // The service echoes only the requested tuple; there is no representable substitute.
+      const receipt: TurnReceipt = {
+        conversationId: input.conversationId,
+        turnId: 'turn-server',
+        correlationId: input.correlationId,
+        state: 'accepted',
+        selection: input.selection,
+      };
+      return Promise.resolve(receipt);
+    },
+    subscribeFrom: (id, afterSequence) => {
+      calls.subscribeFrom.push({ conversationId: id, afterSequence });
+
+      return (async function* (): AsyncIterable<HarnessEventEnvelope> {
+        return;
+      })();
+    },
+  };
+  return { runtime: new HarnessChatRuntime(service), calls };
+}
+
+describe('HarnessChatRuntime', () => {
+  it('is the harness runtime kind and needs only a HarnessConversationService', () => {
+    const { runtime } = build();
+    expect(runtime.kind).toBe('harness');
+  });
+
+  it('delegates send to the conversation service with the exact tuple and idempotency key', async () => {
+    const { runtime, calls } = build();
+
+    const receipt = await runtime.send(sendInput);
+
+    expect(calls.send).toHaveLength(1);
+    const firstSend = calls.send[0]!;
+    expect(firstSend).toEqual(sendInput);
+    expect(firstSend.idempotencyKey).toBe(idempotencyKey);
+    expect(firstSend.selection).toEqual(selection);
+    // The runtime must not substitute an effective tuple onto the receipt.
+    expect(receipt.selection).toEqual(selection);
+  });
+
+  it('delegates attach to the conversation service and returns its snapshot', async () => {
+    const { runtime, calls } = build();
+
+    const result = await runtime.attach(attachInput);
+
+    expect(calls.attach).toHaveLength(1);
+    expect(calls.attach[0]).toEqual(attachInput);
+    expect(result).toBe(snapshot);
+  });
+
+  it('delegates detach to the conversation service', async () => {
+    const { runtime, calls } = build();
+
+    await runtime.detach(detachInput);
+
+    expect(calls.detach).toHaveLength(1);
+    expect(calls.detach[0]).toEqual(detachInput);
+  });
+
+  it('delegates subscribeFrom to the conversation service journal replay', async () => {
+    const { runtime, calls } = build();
+
+    const iterable = runtime.subscribeFrom(conversationId, 7);
+    // Drain to prove it is the service-backed async iterable, not a fabricated one.
+    const drained: unknown[] = [];
+    for await (const event of iterable) {
+      drained.push(event);
+    }
+    expect(drained).toHaveLength(0);
+
+    expect(calls.subscribeFrom).toHaveLength(1);
+    expect(calls.subscribeFrom[0]).toEqual({ conversationId, afterSequence: 7 });
+  });
+});

apps/gateway/src/chat/harness-chat.runtime.ts

@@ -0,0 +1,47 @@
+import type {
+  AttachConversation,
+  ConversationSnapshot,
+  DetachConversation,
+  HarnessConversationService,
+  HarnessEventEnvelope,
+  SendHarnessTurn,
+  TurnReceipt,
+} from '@mosaicstack/types';
+import type { ChatRuntime } from './chat-runtime.js';
+
+/**
+ * The `pi-rpc` chat runtime. It executes browser chat exclusively through the
+ * harness-neutral {@link HarnessConversationService} RPC boundary — it never
+ * touches the embedded `AgentService`/`ProviderService`/`RoutingEngineService`
+ * stack, and it forwards the caller's exact selection tuple and idempotency key
+ * without substitution.
+ *
+ * It owns no state and adds no policy: every method forwards the caller's exact
+ * argument to the injected {@link HarnessConversationService} and returns its
+ * result unchanged, so the requested selection tuple and idempotency key can
+ * never be substituted on the way through.
+ */
+export class HarnessChatRuntime implements ChatRuntime {
+  readonly kind = 'harness' as const;
+
+  constructor(private readonly conversations: HarnessConversationService) {}
+
+  attach(input: AttachConversation & { afterSequence?: number }): Promise<ConversationSnapshot> {
+    return this.conversations.attach(input);
+  }
+
+  detach(input: DetachConversation): Promise<void> {
+    return this.conversations.detach(input);
+  }
+
+  send(input: SendHarnessTurn & { idempotencyKey: string }): Promise<TurnReceipt> {
+    return this.conversations.send(input);
+  }
+
+  subscribeFrom(
+    conversationId: string,
+    afterSequence: number,
+  ): AsyncIterable<HarnessEventEnvelope> {
+    return this.conversations.subscribeFrom(conversationId, afterSequence);
+  }
+}

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -74,13 +74,23 @@ const mockChatGateway = {
   broadcastSessionInfo: vi.fn(),
 };
 
+const mockMcpClient = {
+  reconnectServer: vi.fn().mockResolvedValue(undefined),
+  getServerStatuses: vi.fn(() => []),
+  getToolDefinitions: vi.fn(() => []),
+};
+
+const allowAuthorization = {
+  authorize: vi.fn().mockResolvedValue({ allowed: true }),
+};
+
 function buildService(
   redis: typeof mockRedis | null = mockRedis,
   mcpClient: {
     reconnectServer: ReturnType<typeof vi.fn>;
     getServerStatuses: ReturnType<typeof vi.fn>;
     getToolDefinitions: ReturnType<typeof vi.fn>;
-  } | null = null,
+  } = mockMcpClient,
 ): CommandExecutorService {
   return new CommandExecutorService(
     mockRegistry as never,
@@ -92,6 +102,7 @@ function buildService(
     null,
     mockChatGateway as never,
     mcpClient as never,
+    allowAuthorization as never,
   );
 }
 

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -36,6 +36,12 @@ const authorization = {
   ),
 };
 
+const mockMcpClient = {
+  getServerStatuses: vi.fn(() => []),
+  getToolDefinitions: vi.fn(() => []),
+  reconnectServer: vi.fn().mockResolvedValue(undefined),
+};
+
 function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
   return new CommandExecutorService(
     registry as never,
@@ -46,7 +52,7 @@ function buildExecutor(authorizationService: unknown = authorization): CommandEx
     { agents: {} } as never,
     null,
     null,
-    null,
+    mockMcpClient as never,
     authorizationService as never,
   );
 }

apps/gateway/src/commands/command-executor.service.ts

@@ -34,12 +34,9 @@ export class CommandExecutorService {
     @Optional()
     @Inject(forwardRef(() => ChatGateway))
     private readonly chatGateway: ChatGateway | null,
-    @Optional()
-    @Inject(McpClientService)
-    private readonly mcpClient: McpClientService | null,
-    @Optional()
+    @Inject(McpClientService) private readonly mcpClient: McpClientService,
     @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService | null = null,
+    private readonly authorization: CommandAuthorizationService,
   ) {}
 
   async execute(
@@ -59,13 +56,13 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization?.authorize(
+    const authorization = await this.authorization.authorize(
       def,
       payload,
       userId,
       payload.approvalId,
     );
-    if (authorization && !authorization.allowed) {
+    if (!authorization.allowed) {
       return { command, conversationId, success: false, message: authorization.reason };
     }
 
@@ -173,7 +170,7 @@ export class CommandExecutorService {
     const def = this.registry
       .getManifest()
       .commands.find((command) => command.name === payload.command);
-    if (!def || !this.authorization) return null;
+    if (!def) return null;
     return this.authorization.createApproval(def, payload, scope.userId);
   }
 
@@ -548,15 +545,6 @@ export class CommandExecutorService {
     args: string | null,
     conversationId: string,
   ): Promise<SlashCommandResultPayload> {
-    if (!this.mcpClient) {
-      return {
-        command: 'mcp',
-        conversationId,
-        success: false,
-        message: 'MCP client service is not available.',
-      };
-    }
-
     const action = args?.trim().split(/\s+/)[0] ?? 'status';
 
     switch (action) {

apps/gateway/src/commands/commands.integration.spec.ts

@@ -11,6 +11,8 @@
  * - Unknown command returns descriptive error
  */
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { CommandsModule } from './commands.module.js';
+import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { CommandRegistryService } from './command-registry.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 import type { SlashCommandPayload } from '@mosaicstack/types';
@@ -47,6 +49,16 @@ const mockBrain = {
   },
 };
 
+const mockMcpClient = {
+  getServerStatuses: vi.fn(() => []),
+  getToolDefinitions: vi.fn(() => []),
+  reconnectServer: vi.fn().mockResolvedValue(undefined),
+};
+
+const allowAuthorization = {
+  authorize: vi.fn().mockResolvedValue({ allowed: true }),
+};
+
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
 function buildRegistry(): CommandRegistryService {
@@ -65,7 +77,8 @@ function buildExecutor(registry: CommandRegistryService): CommandExecutorService
     mockBrain as never,
     null, // reloadService (optional)
     null, // chatGateway (optional)
-    null, // mcpClient (optional)
+    mockMcpClient as never,
+    allowAuthorization as never,
   );
 }
 
@@ -153,6 +166,15 @@ describe('CommandRegistryService — integration', () => {
   }
 });
 
+// ─── Module Wiring Tests ──────────────────────────────────────────────────────
+
+describe('CommandsModule — Nest wiring', () => {
+  it('CommandsModule imports McpClientModule in its Nest metadata', () => {
+    const imports = Reflect.getMetadata('imports', CommandsModule) ?? [];
+    expect(imports).toContain(McpClientModule);
+  });
+});
+
 // ─── Executor Tests ───────────────────────────────────────────────────────────
 
 describe('CommandExecutorService — integration', () => {
@@ -259,4 +281,14 @@ describe('CommandExecutorService — integration', () => {
       expect(result.command).toBe(cmd);
     });
   }
+
+  // /mcp status reaches the required McpClientService and never reports it unavailable
+  it('/mcp status calls the wired McpClientService and reports the no-servers message', async () => {
+    const payload: SlashCommandPayload = { command: 'mcp', conversationId };
+    const result = await executor.execute(payload, userScope);
+    expect(mockMcpClient.getServerStatuses).toHaveBeenCalledOnce();
+    expect(result.success).toBe(true);
+    expect(result.message).toContain('No MCP servers configured.');
+    expect(result.message).not.toBe('MCP client service is not available.');
+  });
 });

apps/gateway/src/commands/commands.module.ts

@@ -4,6 +4,7 @@ import type { MosaicConfig } from '@mosaicstack/config';
 import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
+import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
 import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
@@ -14,7 +15,12 @@ import { COMMANDS_REDIS } from './commands.tokens.js';
 const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
 
 @Module({
-  imports: [GCModule, forwardRef(() => ReloadModule), forwardRef(() => ChatModule)],
+  imports: [
+    GCModule,
+    McpClientModule,
+    forwardRef(() => ReloadModule),
+    forwardRef(() => ChatModule),
+  ],
   providers: [
     {
       provide: COMMANDS_QUEUE_HANDLE,

apps/gateway/src/config/config.module.ts

@@ -1,5 +1,6 @@
 import { Global, Module } from '@nestjs/common';
 import { loadConfig, type MosaicConfig } from '@mosaicstack/config';
+import { resolveGatewayConfigPath } from '../env.js';
 
 export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
 
@@ -8,7 +9,7 @@ export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
   providers: [
     {
       provide: MOSAIC_CONFIG,
-      useFactory: (): MosaicConfig => loadConfig(),
+      useFactory: (): MosaicConfig => loadConfig(resolveGatewayConfigPath()),
     },
   ],
   exports: [MOSAIC_CONFIG],

apps/gateway/src/conversations/conversations-harness-fence.spec.ts

@@ -0,0 +1,116 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { ChatRuntimeMode } from '../chat/chat-runtime.js';
+import { ConversationsController } from './conversations.controller.js';
+
+/**
+ * Task 5 harness fence for the conversations REST write path.
+ *
+ * Under `pi-rpc` the durable/harness conversation path (Task 15) owns message persistence, so the
+ * legacy direct-repository write via `POST /api/conversations/:id/messages` must be refused with a
+ * fixed typed `runtime_unsupported` BEFORE the repository is touched — never a duplicate write.
+ * Under `legacy` the endpoint keeps its current behaviour and writes through `brain.conversations`.
+ *
+ * Item 3 (single runtime-mode source of truth): the mode is the router's ONE init-time resolution,
+ * injected into the controller and read as `router.runtimeMode`. It is NOT re-derived from
+ * `process.env` at request time. The two "env is flipped after construction" tests below are the
+ * load-bearing guard: they pass only because the controller reads the fixed injected mode, and turn
+ * RED the instant the fence is reverted to `resolveChatRuntimeMode(process.env)`.
+ */
+const CONVERSATION_ID = '22222222-2222-4222-8222-222222222222';
+const USER = { id: 'user-1' };
+
+function sendMessageDto() {
+  return {
+    role: 'user' as const,
+    content: 'hello from the legacy REST write path',
+    metadata: undefined,
+  };
+}
+
+function brainWithMessageSpy() {
+  const addMessage = vi.fn().mockResolvedValue({
+    id: 'message-1',
+    conversationId: CONVERSATION_ID,
+    role: 'user',
+    content: 'hello from the legacy REST write path',
+  });
+  return {
+    brain: { conversations: { addMessage } } as never,
+    addMessage,
+  };
+}
+
+/** The controller only needs the router's immutable `runtimeMode`; supply exactly that. */
+function routerFixedTo(mode: ChatRuntimeMode) {
+  return { runtimeMode: mode };
+}
+
+let priorMode: string | undefined;
+
+describe('conversations REST write path — Task 5 harness fence', () => {
+  beforeEach(() => {
+    priorMode = process.env['CHAT_HARNESS_RUNTIME'];
+  });
+
+  afterEach(() => {
+    if (priorMode === undefined) delete process.env['CHAT_HARNESS_RUNTIME'];
+    else process.env['CHAT_HARNESS_RUNTIME'] = priorMode;
+  });
+
+  it('refuses the legacy repository write when the router resolved pi-rpc, before any write', async () => {
+    const { brain, addMessage } = brainWithMessageSpy();
+    const controller = new ConversationsController(brain, routerFixedTo('pi-rpc'));
+
+    await expect(
+      controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER),
+    ).rejects.toMatchObject({ code: 'runtime_unsupported' });
+
+    // Load-bearing: the durable/harness path owns pi-rpc persistence — the legacy repo must not be
+    // written, so no duplicate message can be produced.
+    expect(addMessage).not.toHaveBeenCalled();
+  });
+
+  it('writes through the repository when the router resolved legacy (GREEN control)', async () => {
+    const { brain, addMessage } = brainWithMessageSpy();
+    const controller = new ConversationsController(brain, routerFixedTo('legacy'));
+
+    const result = await controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER);
+
+    expect(addMessage).toHaveBeenCalledWith(
+      {
+        conversationId: CONVERSATION_ID,
+        role: 'user',
+        content: 'hello from the legacy REST write path',
+        metadata: undefined,
+      },
+      USER.id,
+    );
+    expect(result).toMatchObject({ id: 'message-1', conversationId: CONVERSATION_ID });
+  });
+
+  it('keeps refusing under a pi-rpc router even when CHAT_HARNESS_RUNTIME is flipped to legacy after startup', async () => {
+    // The runtime mode is fixed at module init. A later env mutation must not reopen the fence:
+    // a request-time `resolveChatRuntimeMode(process.env)` read would see `legacy` and wrongly write.
+    process.env['CHAT_HARNESS_RUNTIME'] = 'legacy';
+    const { brain, addMessage } = brainWithMessageSpy();
+    const controller = new ConversationsController(brain, routerFixedTo('pi-rpc'));
+
+    await expect(
+      controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER),
+    ).rejects.toMatchObject({ code: 'runtime_unsupported' });
+
+    expect(addMessage).not.toHaveBeenCalled();
+  });
+
+  it('keeps writing under a legacy router even when CHAT_HARNESS_RUNTIME is flipped to pi-rpc after startup', async () => {
+    // Symmetric guard: a legacy-resolved router must keep writing regardless of the live env, so a
+    // request-time env read of `pi-rpc` cannot spuriously refuse a legitimate legacy write.
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    const { brain, addMessage } = brainWithMessageSpy();
+    const controller = new ConversationsController(brain, routerFixedTo('legacy'));
+
+    await controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER);
+
+    expect(addMessage).toHaveBeenCalledTimes(1);
+  });
+});

apps/gateway/src/conversations/conversations.controller.ts

@@ -6,6 +6,7 @@ import {
   ForbiddenException,
   Get,
   HttpCode,
+  HttpException,
   HttpStatus,
   Inject,
   NotFoundException,
@@ -19,6 +20,7 @@ import type { Brain } from '@mosaicstack/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
+import { ChatRuntimeRouter } from '../chat/chat-runtime-router.js';
 import {
   CreateConversationDto,
   UpdateConversationDto,
@@ -26,10 +28,41 @@ import {
   SearchMessagesDto,
 } from './conversations.dto.js';
 
+/**
+ * Under `pi-rpc` the durable/harness conversation path (Task 15) owns message persistence, so the
+ * legacy direct-repository write must fail closed with a fixed typed `runtime_unsupported` before
+ * the repository is touched — never a duplicate write. The `code` field is exposed at the top level
+ * so callers can discriminate the refusal while the 503 status carries the browser-safe surface.
+ */
+class HarnessRuntimeWriteUnsupportedException extends HttpException {
+  readonly code = 'runtime_unsupported' as const;
+
+  constructor() {
+    super(
+      {
+        code: 'runtime_unsupported',
+        message:
+          'Conversation message writes are handled by the harness runtime on this deployment.',
+      },
+      HttpStatus.SERVICE_UNAVAILABLE,
+    );
+  }
+}
+
 @Controller('api/conversations')
 @UseGuards(AuthGuard)
 export class ConversationsController {
-  constructor(@Inject(BRAIN) private readonly brain: Brain) {}
+  /**
+   * `router` supplies the ONE immutable runtime mode resolved at module init (Task 5, item 3).
+   * The pre-write fence reads `router.runtimeMode`, never `resolveChatRuntimeMode(process.env)` at
+   * request time — a single source of truth, so the controller cannot disagree with the router
+   * about the live runtime if the environment is mutated after startup. Narrowed to `runtimeMode`
+   * so this class depends on nothing else the router exposes.
+   */
+  constructor(
+    @Inject(BRAIN) private readonly brain: Brain,
+    @Inject(ChatRuntimeRouter) private readonly router: Pick<ChatRuntimeRouter, 'runtimeMode'>,
+  ) {}
 
   @Get()
   async list(@CurrentUser() user: { id: string }) {
@@ -94,6 +127,13 @@ export class ConversationsController {
     @Body() dto: SendMessageDto,
     @CurrentUser() user: { id: string },
   ) {
+    // Fail the legacy repository write closed under pi-rpc BEFORE touching the repository — the
+    // harness path owns persistence there, so a direct write would duplicate the message. The mode
+    // comes from the router's init-time resolution, not a request-time env read.
+    if (this.router.runtimeMode === 'pi-rpc') {
+      throw new HarnessRuntimeWriteUnsupportedException();
+    }
+
     const message = await this.brain.conversations.addMessage(
       {
         conversationId: id,

apps/gateway/src/conversations/conversations.module.ts

@@ -1,7 +1,14 @@
 import { Module } from '@nestjs/common';
+import { ChatModule } from '../chat/chat.module.js';
 import { ConversationsController } from './conversations.controller.js';
 
+/**
+ * Imports {@link ChatModule} solely to inject its exported {@link ChatRuntimeRouter} into
+ * {@link ConversationsController}, so the REST write fence reads the same init-time runtime mode the
+ * router resolved — one source of truth, no duplicate provider, no global token, no AppModule edit.
+ */
 @Module({
+  imports: [ChatModule],
   controllers: [ConversationsController],
 })
 export class ConversationsModule {}

apps/gateway/src/coord/interaction-coordination.di.test.ts

@@ -0,0 +1,19 @@
+import 'reflect-metadata';
+import { Test } from '@nestjs/testing';
+import { describe, expect, it } from 'vitest';
+import { CoordModule } from './coord.module.js';
+import { InteractionCoordinationService } from './interaction-coordination.service.js';
+import { AuthGuard } from '../auth/auth.guard.js';
+
+describe('CoordModule DI (compiled-metadata boot)', () => {
+  it('resolves InteractionCoordinationService through Nest DI', async () => {
+    const moduleRef = await Test.createTestingModule({ imports: [CoordModule] })
+      .overrideGuard(AuthGuard)
+      .useValue({ canActivate: (): boolean => true })
+      .compile();
+    expect(moduleRef.get(InteractionCoordinationService)).toBeInstanceOf(
+      InteractionCoordinationService,
+    );
+    await moduleRef.close();
+  });
+});

apps/gateway/src/coord/interaction-coordination.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Optional } from '@nestjs/common';
 import {
   InteractionCoordinationClient,
   type CoordinationObservation,
@@ -13,6 +13,7 @@ import type { CreateHandoffDto } from './interaction-coordination.dto.js';
 
 export const COORDINATION_PORT = Symbol('COORDINATION_PORT');
 export const COORDINATION_CONFIG = Symbol('COORDINATION_CONFIG');
+export const HANDOFF_ID_FACTORY = Symbol('HANDOFF_ID_FACTORY');
 
 const HANDOFF_TRACKING_TTL_MS = 60 * 60 * 1_000;
 const MAX_TRACKED_HANDOFFS = 1_000;
@@ -60,6 +61,8 @@ export class InteractionCoordinationService {
   constructor(
     @Inject(COORDINATION_PORT) private readonly port: InteractionCoordinationPort,
     @Inject(COORDINATION_CONFIG) private readonly config: InteractionCoordinationConfig,
+    @Optional()
+    @Inject(HANDOFF_ID_FACTORY)
     private readonly handoffIdFactory: () => string = (): string => crypto.randomUUID(),
   ) {}
 

apps/gateway/src/database/database.module.1392.spec.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect, vi } from 'vitest';
+
+// The module under test imports @mosaicstack/db at module scope; we replace only the
+// pieces DatabaseModule uses (partial mock — the real module also exports the
+// schema the storage adapter's import chain needs) so the test pins the #1392
+// contract (refuse to start on an incomplete schema) without a live database.
+vi.mock('@mosaicstack/db', async (importOriginal) => {
+  const actual: object = await importOriginal();
+  return {
+    ...actual,
+    createDb: vi.fn(),
+    createPgliteDb: vi.fn(),
+    getMigrationStatus: vi.fn(),
+    runPgliteMigrations: vi.fn(),
+  };
+});
+
+import { DatabaseModule } from './database.module.js';
+import { getMigrationStatus } from '@mosaicstack/db';
+import type { DbHandle } from '@mosaicstack/db';
+import type { StorageAdapter } from '@mosaicstack/storage';
+import type { MosaicConfig } from '@mosaicstack/config';
+
+function makeModule(storageType: 'postgres' | 'pglite', tier: string) {
+  const storageAdapter = {
+    name: storageType,
+    migrate: vi.fn(),
+    close: vi.fn(),
+  } as unknown as StorageAdapter;
+  const handle = { close: vi.fn() } as unknown as DbHandle;
+  const config = {
+    tier,
+    storage: { type: storageType, url: 'postgresql://x' },
+  } as unknown as MosaicConfig;
+  return {
+    mod: new DatabaseModule(handle, storageAdapter, config),
+    storageAdapter,
+  };
+}
+
+describe('DatabaseModule.onModuleInit — #1392 schema verification', () => {
+  it('refuses to start when the postgres schema is incomplete', async () => {
+    const { mod, storageAdapter } = makeModule('postgres', 'standalone');
+    vi.mocked(getMigrationStatus).mockResolvedValue({
+      appliedCount: 15,
+      expectedCount: 17,
+      expectedLastTag: '0016_salty_morlocks',
+      complete: false,
+    });
+    await expect(mod.onModuleInit()).rejects.toThrow('Database schema incomplete: 15/17');
+    expect(storageAdapter.migrate).toHaveBeenCalled(); // migrations attempted first
+  });
+
+  it('starts normally when the schema is complete', async () => {
+    const { mod } = makeModule('postgres', 'standalone');
+    vi.mocked(getMigrationStatus).mockResolvedValue({
+      appliedCount: 17,
+      expectedCount: 17,
+      expectedLastTag: '0016_salty_morlocks',
+      complete: true,
+    });
+    await expect(mod.onModuleInit()).resolves.toBeUndefined();
+  });
+
+  it('does not verify postgres status for the local tier (PGlite migrates itself)', async () => {
+    const { mod } = makeModule('pglite', 'local');
+    vi.mocked(getMigrationStatus).mockClear();
+    await expect(mod.onModuleInit()).resolves.toBeUndefined();
+    expect(getMigrationStatus).not.toHaveBeenCalled();
+  });
+});

apps/gateway/src/database/database.module.ts

@@ -12,6 +12,7 @@ import {
 import {
   createDb,
   createPgliteDb,
+  getMigrationStatus,
   runPgliteMigrations,
   type Db,
   type DbHandle,
@@ -74,6 +75,11 @@ export class DatabaseModule implements OnApplicationShutdown, OnModuleInit {
   // the same DATABASE_URL, so a single call covers both the gateway DB and
   // the storage tables. We deliberately do NOT call runMigrations() here to
   // avoid opening a second short-lived connection and doubling startup cost.
+  //
+  // #1392: we DO verify afterwards (getMigrationStatus opens one short-lived
+  // connection) and refuse to start on an incomplete schema. A gateway that
+  // boots "healthy" on an empty or partial database is precisely the failure
+  // that shipped in the T63 batch: silent at startup, catastrophic later.
   async onModuleInit(): Promise<void> {
     if (this.config.tier === 'local') {
       this.logger.log('Applying PGlite schema migrations...');
@@ -81,6 +87,24 @@ export class DatabaseModule implements OnApplicationShutdown, OnModuleInit {
     }
     this.logger.log(`Initializing storage adapter (${this.storageAdapter.name})...`);
     await this.storageAdapter.migrate();
+
+    if (this.config.storage.type === 'postgres') {
+      const status = await getMigrationStatus(this.config.storage.url);
+      if (!status.complete) {
+        this.logger.error(
+          `Database schema incomplete: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied ` +
+            `(last expected: ${status.expectedLastTag}). ` +
+            'Refusing to start on a partial schema — see issues #1392/#1402. ' +
+            "Remediation: re-run 'mosaic gateway install' (it now verifies), or apply migrations manually.",
+        );
+        throw new Error(
+          `Database schema incomplete: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied`,
+        );
+      }
+      this.logger.log(
+        `Database schema verified: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied.`,
+      );
+    }
   }
 
   async onApplicationShutdown(): Promise<void> {

apps/gateway/src/env.ts

@@ -0,0 +1,133 @@
+import { config } from 'dotenv';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { detectFromEnv, loadConfig } from '@mosaicstack/config';
+
+type TierSource =
+  | 'process environment'
+  | 'daemon .env'
+  | 'monorepo-root .env'
+  | 'gateway-local .env'
+  | 'default';
+
+type BootSource = TierSource | 'mosaic.config.json';
+
+export interface GatewayDotenvPaths {
+  daemonEnv: string;
+  monorepoRootEnv: string;
+  gatewayLocalEnv: string;
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+export function resolveGatewayDotenvPaths(
+  anchor: string = here,
+  homeBase: string = homedir(),
+): GatewayDotenvPaths {
+  return {
+    daemonEnv: join(homeBase, '.config', 'mosaic', 'gateway', '.env'),
+    monorepoRootEnv: resolve(anchor, '../../..', '.env'),
+    gatewayLocalEnv: resolve(anchor, '..', '.env'),
+  };
+}
+
+export function resolveGatewayConfigPath(anchor: string = here): string {
+  // GATEWAY_HOME is daemon-created 0700; its env override adds no authority because env can set MOSAIC_STORAGE_TIER.
+  const gatewayHome = resolve(
+    process.env['MOSAIC_GATEWAY_HOME'] ?? join(homedir(), '.config', 'mosaic', 'gateway'),
+  );
+  const daemonConfig = join(gatewayHome, 'mosaic.config.json');
+  const gatewayLocalConfig = resolve(anchor, '..', 'mosaic.config.json');
+  const monorepoRootConfig = resolve(anchor, '../../..', 'mosaic.config.json');
+
+  if (existsSync(daemonConfig)) {
+    return daemonConfig;
+  }
+  if (existsSync(gatewayLocalConfig)) {
+    return gatewayLocalConfig;
+  }
+  if (existsSync(monorepoRootConfig)) {
+    return monorepoRootConfig;
+  }
+
+  return monorepoRootConfig;
+}
+
+export function loadGatewayEnv(anchor: string = here, homeBase: string = homedir()): void {
+  const { daemonEnv, monorepoRootEnv, gatewayLocalEnv } = resolveGatewayDotenvPaths(
+    anchor,
+    homeBase,
+  );
+  const inheritedTier = process.env['MOSAIC_STORAGE_TIER'];
+  let tierSource: TierSource = inheritedTier === undefined ? 'default' : 'process environment';
+  const inheritedDatabaseUrl = process.env['DATABASE_URL'];
+  let databaseUrlSource: TierSource =
+    inheritedDatabaseUrl === undefined ? 'default' : 'process environment';
+
+  function loadAnchoredDotenv(
+    path: string,
+    sourceLabel: Exclude<TierSource, 'process environment' | 'default'>,
+  ): void {
+    if (!existsSync(path)) {
+      return;
+    }
+
+    const beforeTier = process.env['MOSAIC_STORAGE_TIER'];
+    const beforeDatabaseUrl = process.env['DATABASE_URL'];
+    config({ path, quiet: true });
+
+    if (
+      beforeTier === undefined &&
+      process.env['MOSAIC_STORAGE_TIER'] !== undefined &&
+      tierSource === 'default'
+    ) {
+      tierSource = sourceLabel;
+    }
+
+    if (
+      beforeDatabaseUrl === undefined &&
+      process.env['DATABASE_URL'] !== undefined &&
+      databaseUrlSource === 'default'
+    ) {
+      databaseUrlSource = sourceLabel;
+    }
+  }
+
+  // Load .env from daemon config dir (global install / daemon mode) first.
+  // It takes precedence over file-based local-dev configuration.
+  loadAnchoredDotenv(daemonEnv, 'daemon .env');
+
+  // Load .env from the anchored monorepo root, then fill any remaining values
+  // from apps/gateway/.env when present.
+  loadAnchoredDotenv(monorepoRootEnv, 'monorepo-root .env');
+  loadAnchoredDotenv(gatewayLocalEnv, 'gateway-local .env');
+
+  const envOnlyTier = detectFromEnv().tier;
+  const configPath = resolveGatewayConfigPath(anchor);
+  const anchoredConfigExists = existsSync(configPath);
+  const resolvedTier = loadConfig(configPath).tier;
+  const configuredTier = process.env['MOSAIC_STORAGE_TIER'];
+  const databaseUrlDeterminesTier = envOnlyTier === 'standalone' && configuredTier !== 'standalone';
+  const recognizedTierDeterminesTier =
+    (configuredTier === 'federated' ||
+      configuredTier === 'standalone' ||
+      configuredTier === 'local') &&
+    configuredTier === envOnlyTier;
+
+  let source: BootSource;
+  if (anchoredConfigExists) {
+    source = 'mosaic.config.json';
+  } else if (databaseUrlDeterminesTier && databaseUrlSource !== 'default') {
+    source = databaseUrlSource;
+  } else if (recognizedTierDeterminesTier && tierSource !== 'default') {
+    source = tierSource;
+  } else {
+    source = 'default';
+  }
+
+  console.info(`[gateway env] storage tier=${resolvedTier} source=${source}`);
+}
+
+loadGatewayEnv();

apps/gateway/src/federation/__tests__/enrollment.service.spec.ts

@@ -245,9 +245,21 @@ describe('EnrollmentService.createToken', () => {
     const after = Date.now();
 
     const expiresMs = new Date(result.expiresAt).getTime();
-    // Should be at most 900s from now
-    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100);
+
+    // The property under test is CLAMPING: a 9999s request must come back as 900s.
+    // The gap between clamped and unclamped is 9_099_000 ms, so the tolerance below
+    // only has to exceed CI scheduling jitter — it does not need to be tight to keep
+    // the assertion discriminating. A 5s allowance consumes 0.05% of that margin and
+    // an unclamped result still misses by three orders of magnitude.
+    //
+    // It was 100ms and failed on a loaded agent at 900_106 — 6ms over (#1090). A
+    // wall-clock budget sized to a fast machine is a flake, not a tighter test.
+    const CI_JITTER_MS = 5_000;
+    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + CI_JITTER_MS);
     expect(expiresMs - after).toBeGreaterThanOrEqual(0);
+    // Explicitly pin the clamp itself, independent of any timing allowance:
+    // unclamped (9999s) would exceed this by ~9_099_000 ms.
+    expect(expiresMs - before).toBeLessThan(1_000_000);
   });
 });
 

apps/gateway/src/harness/harness-selection.controller.spec.ts

@@ -0,0 +1,164 @@
+import 'reflect-metadata';
+import {
+  type CanActivate,
+  type ExecutionContext,
+  type INestApplication,
+  ValidationPipe,
+} from '@nestjs/common';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { HarnessRegistry } from './harness.registry.js';
+import { HARNESS_REGISTRY } from './harness.tokens.js';
+import { HarnessSelectionRepository } from './harness-selection.repository.js';
+import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
+// Import the REAL module (not a hand-listed controllers+mocks list) so an
+// unresolved provider fails at app.init() — the #1145-class DI-boot guard.
+import { HarnessModule } from './harness.module.js';
+
+// A known-available tuple from the fake adapter's default catalog.
+const VALID = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-mini' };
+// A tuple whose provider/model are not in any catalog.
+const UNKNOWN = { harnessId: 'fake', providerId: 'ghost-provider', modelId: 'ghost-model' };
+// A tuple that is known in the catalog but flagged unavailable.
+const UNAVAILABLE = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-legacy' };
+
+const authGuard: CanActivate = {
+  canActivate(context: ExecutionContext): boolean {
+    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
+    requestContext.user = { id: 'user-1' };
+    return true;
+  },
+};
+
+function registryWithFake(): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  registry.register(new FakeHarnessAdapter({ id: 'fake' }));
+  return registry;
+}
+
+describe('Harness selection HTTP surface', () => {
+  let app: INestApplication;
+  let repository: HarnessSelectionRepository;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [HarnessModule],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue(authGuard)
+      .overrideProvider(HARNESS_REGISTRY)
+      .useValue(registryWithFake())
+      .compile();
+
+    // Real in-memory repository from the module graph — proves the module wired it.
+    repository = moduleRef.get(HarnessSelectionRepository);
+
+    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
+    app.useGlobalPipes(
+      new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
+    );
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  beforeEach(() => {
+    // Reset owner-scoped state between tests via the public API surface.
+    repository.set({ userId: 'user-1', tenantId: 'user-1' }, VALID);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('GET selection is server-scoped and ignores caller-supplied scope in the query', async () => {
+    const response = await request(app.getHttpServer())
+      .get('/api/chat/preferences/selection')
+      .query({ userId: 'attacker', tenantId: 'attacker-tenant', seatId: 'attacker-seat' });
+
+    expect(response.status).toBe(200);
+    // The returned selection is user-1's (guard-derived scope), not the query's.
+    expect(response.body.selection).toEqual(VALID);
+  });
+
+  it('PUT with a valid structured tuple persists and round-trips via GET', async () => {
+    const next = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-pro' };
+
+    const put = await request(app.getHttpServer())
+      .put('/api/chat/preferences/selection')
+      .send(next)
+      .set('Content-Type', 'application/json');
+    expect(put.status).toBe(200);
+    expect(put.body.selection).toEqual(next);
+
+    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
+    expect(get.status).toBe(200);
+    expect(get.body.selection).toEqual(next);
+  });
+
+  it('PUT with FREE TEXT is rejected 400 and does not mutate the stored selection', async () => {
+    const response = await request(app.getHttpServer())
+      .put('/api/chat/preferences/selection')
+      .send({ selection: 'gpt-4o' })
+      .set('Content-Type', 'application/json');
+
+    expect(response.status).toBe(400);
+
+    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
+    expect(get.body.selection).toEqual(VALID);
+  });
+
+  it.each([
+    ['seatId', { ...VALID, seatId: 'attacker-seat' }],
+    ['tenantId', { ...VALID, tenantId: 'attacker-tenant' }],
+    ['userId', { ...VALID, userId: 'attacker' }],
+    ['nativeSessionPath', { ...VALID, nativeSessionPath: '/var/native/x.jsonl' }],
+    ['executable', { ...VALID, executable: '/usr/bin/evil' }],
+    ['home', { ...VALID, home: '/home/attacker' }],
+    ['cwd', { ...VALID, cwd: '/tmp/attacker' }],
+  ])(
+    'PUT with an extra authority-bearing field (%s) is rejected 400 and does not mutate stored selection',
+    async (_name, body) => {
+      const response = await request(app.getHttpServer())
+        .put('/api/chat/preferences/selection')
+        .send(body)
+        .set('Content-Type', 'application/json');
+
+      expect(response.status).toBe(400);
+
+      const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
+      expect(get.body.selection).toEqual(VALID);
+    },
+  );
+
+  it('PUT with an UNKNOWN tuple returns selection_invalid, unchanged and echoed unchanged (no fallback)', async () => {
+    const response = await request(app.getHttpServer())
+      .put('/api/chat/preferences/selection')
+      .send(UNKNOWN)
+      .set('Content-Type', 'application/json');
+
+    expect(response.status).toBe(422);
+    expect(response.body.code).toBe('selection_invalid');
+    // Echoed back unchanged: no first-row / first-provider substitution.
+    expect(response.body.selection).toEqual(UNKNOWN);
+
+    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
+    expect(get.body.selection).toEqual(VALID);
+  });
+
+  it('PUT with a KNOWN-but-UNAVAILABLE tuple returns model_unavailable, unchanged (distinct from selection_invalid)', async () => {
+    const response = await request(app.getHttpServer())
+      .put('/api/chat/preferences/selection')
+      .send(UNAVAILABLE)
+      .set('Content-Type', 'application/json');
+
+    expect(response.status).toBe(422);
+    expect(response.body.code).toBe('model_unavailable');
+    expect(response.body.selection).toEqual(UNAVAILABLE);
+
+    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
+    expect(get.body.selection).toEqual(VALID);
+  });
+});

apps/gateway/src/harness/harness-selection.controller.ts

@@ -0,0 +1,46 @@
+import { Body, Controller, Get, HttpException, HttpStatus, Put, UseGuards } from '@nestjs/common';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { CurrentUser } from '../auth/current-user.decorator.js';
+import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
+import { HarnessOperationError } from './harness.registry.js';
+import { HarnessSelectionService } from './harness-selection.service.js';
+import { HarnessSelectionInputDto, type SelectionResponseDto } from './harness.dto.js';
+
+/**
+ * Chat-preferences selection surface. The scope is ALWAYS derived on the server
+ * from the authenticated user (`scopeFromUser(CurrentUser)`); the request body and
+ * query string can never name another user, tenant, or seat. A typed selection
+ * failure (unknown tuple → `selection_invalid`, known-but-unavailable →
+ * `model_unavailable`) is returned as 422 with the requested tuple echoed back
+ * unchanged, and never mutates the stored selection.
+ */
+@Controller('api/chat/preferences/selection')
+@UseGuards(AuthGuard)
+export class HarnessSelectionController {
+  constructor(private readonly selection: HarnessSelectionService) {}
+
+  @Get()
+  get(@CurrentUser() user: AuthenticatedUserLike): SelectionResponseDto {
+    return { selection: this.selection.getSelection(scopeFromUser(user)) };
+  }
+
+  @Put()
+  async put(
+    @CurrentUser() user: AuthenticatedUserLike,
+    @Body() dto: HarnessSelectionInputDto,
+  ): Promise<SelectionResponseDto> {
+    try {
+      const stored = await this.selection.setSelection(scopeFromUser(user), {
+        harnessId: dto.harnessId,
+        providerId: dto.providerId,
+        modelId: dto.modelId,
+      });
+      return { selection: stored };
+    } catch (error) {
+      if (error instanceof HarnessOperationError) {
+        throw new HttpException(error.dto, HttpStatus.UNPROCESSABLE_ENTITY);
+      }
+      throw error;
+    }
+  }
+}

apps/gateway/src/harness/harness-selection.service.ts

@@ -0,0 +1,90 @@
+import { randomUUID } from 'node:crypto';
+import { Inject, Injectable } from '@nestjs/common';
+import type { HarnessSelection } from '@mosaicstack/types';
+import type { ActorTenantScope } from '../auth/session-scope.js';
+import {
+  HarnessAdapterUnavailableError,
+  HarnessRegistry,
+  operationError,
+} from './harness.registry.js';
+import { HARNESS_REGISTRY } from './harness.tokens.js';
+import { readContextFromScope } from './harness.dto.js';
+import { HarnessSelectionRepository } from './harness-selection.repository.js';
+
+/**
+ * Selection logic for the Slice-Zero chat-preferences surface. It validates the
+ * requested harness/provider/model tuple against the live catalog with NO
+ * fallback substitution, then persists it owner-scoped. The stored selection is
+ * only ever mutated when the tuple is valid AND available.
+ */
+@Injectable()
+export class HarnessSelectionService {
+  constructor(
+    @Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry,
+    private readonly repository: HarnessSelectionRepository,
+  ) {}
+
+  getSelection(scope: ActorTenantScope): HarnessSelection | null {
+    return this.repository.get(scope);
+  }
+
+  async setSelection(
+    scope: ActorTenantScope,
+    selection: HarnessSelection,
+  ): Promise<HarnessSelection> {
+    // Throws HarnessOperationError (selection_invalid / model_unavailable) with the
+    // requested tuple echoed back unchanged. The store is untouched on any throw.
+    await this.assertSelectionAvailable(scope, selection);
+    return this.repository.set(scope, selection);
+  }
+
+  private async assertSelectionAvailable(
+    scope: ActorTenantScope,
+    selection: HarnessSelection,
+  ): Promise<void> {
+    const correlationId = randomUUID();
+
+    let adapter;
+    try {
+      adapter = this.registry.get(selection.harnessId);
+    } catch (error) {
+      if (error instanceof HarnessAdapterUnavailableError) {
+        // An unknown harness makes the whole tuple invalid — no fallback adapter.
+        throw operationError(
+          'selection_invalid',
+          'The requested harness/provider/model tuple is not in the catalog.',
+          selection,
+          correlationId,
+        );
+      }
+      throw error;
+    }
+
+    const catalog = await adapter.catalog(readContextFromScope(scope));
+    const entry = catalog.models.find(
+      (candidate) =>
+        candidate.harnessId === selection.harnessId &&
+        candidate.providerId === selection.providerId &&
+        candidate.modelId === selection.modelId,
+    );
+
+    if (!entry) {
+      // No first-row / first-provider fallback: reject the requested tuple unchanged.
+      throw operationError(
+        'selection_invalid',
+        'The requested harness/provider/model tuple is not in the catalog.',
+        selection,
+        correlationId,
+      );
+    }
+    if (entry.availability === 'unavailable') {
+      throw operationError(
+        'model_unavailable',
+        'The requested model is currently unavailable.',
+        selection,
+        correlationId,
+        true,
+      );
+    }
+  }
+}

apps/gateway/src/harness/harness.controller.spec.ts

@@ -0,0 +1,138 @@
+import 'reflect-metadata';
+import {
+  type CanActivate,
+  type ExecutionContext,
+  type INestApplication,
+  ValidationPipe,
+} from '@nestjs/common';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { HarnessRegistry } from './harness.registry.js';
+import { HARNESS_REGISTRY } from './harness.tokens.js';
+import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
+// The real module under test — importing it (not a hand-listed controllers/mocks
+// list) is what makes an unresolved provider fail loudly at app.init() (#1145 guard).
+import { HarnessModule } from './harness.module.js';
+
+// Fields that must NEVER surface on a browser-facing catalog/list response.
+const FORBIDDEN_KEYS = [
+  'executable',
+  'executablePath',
+  'home',
+  'homeDir',
+  'cwd',
+  'workingDir',
+  'workingDirectory',
+  'nativeSessionPath',
+  'sessionPath',
+  'env',
+  'secret',
+  'secrets',
+  'token',
+  'apiKey',
+];
+
+function assertNoForbiddenLeak(payload: unknown): void {
+  const serialized = JSON.stringify(payload).toLowerCase();
+  for (const key of FORBIDDEN_KEYS) {
+    expect(serialized).not.toContain(key.toLowerCase());
+  }
+}
+
+const authGuard: CanActivate = {
+  canActivate(context: ExecutionContext): boolean {
+    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
+    requestContext.user = { id: 'user-1' };
+    return true;
+  },
+};
+
+function registryWithFake(): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  registry.register(new FakeHarnessAdapter({ id: 'fake' }));
+  return registry;
+}
+
+describe('Harness catalog HTTP surface', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [HarnessModule],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue(authGuard)
+      .overrideProvider(HARNESS_REGISTRY)
+      .useValue(registryWithFake())
+      .compile();
+
+    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
+    app.useGlobalPipes(
+      new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
+    );
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('boots the real HarnessModule so all providers resolve at app.init()', () => {
+    // If HarnessModule failed to resolve a provider, beforeAll's app.init() would
+    // have thrown and this suite would never reach here.
+    expect(app).toBeDefined();
+  });
+
+  it('GET /api/harnesses returns 200 with safe fields only', async () => {
+    const response = await request(app.getHttpServer()).get('/api/harnesses');
+
+    expect(response.status).toBe(200);
+    expect(Array.isArray(response.body)).toBe(true);
+    expect(response.body.length).toBeGreaterThan(0);
+    const summary = response.body[0];
+    expect(Object.keys(summary).sort()).toEqual(['capabilities', 'displayName', 'id']);
+    expect(summary.id).toBe('fake');
+    expect(typeof summary.displayName).toBe('string');
+    expect(Array.isArray(summary.capabilities)).toBe(true);
+    assertNoForbiddenLeak(response.body);
+  });
+
+  it('GET /api/harnesses/:harnessId/catalog returns 200 with safe catalog fields only', async () => {
+    const response = await request(app.getHttpServer()).get('/api/harnesses/fake/catalog');
+
+    expect(response.status).toBe(200);
+    expect(response.body.harnessId).toBe('fake');
+    expect(typeof response.body.version).toBe('string');
+    expect(typeof response.body.fingerprint).toBe('string');
+    expect(Array.isArray(response.body.models)).toBe(true);
+    expect(response.body.models.length).toBeGreaterThan(0);
+    const entry = response.body.models[0];
+    // Whitelisted catalog-entry fields only (no executables/paths/secrets).
+    expect(Object.keys(entry).sort()).toEqual(
+      [
+        'authState',
+        'availability',
+        'displayName',
+        'harnessId',
+        'inputTypes',
+        'modelId',
+        'providerId',
+        'reasoningCapability',
+      ].sort(),
+    );
+    assertNoForbiddenLeak(response.body);
+  });
+
+  it('GET catalog for an unknown harnessId returns a typed adapter_unavailable error, never a fallback catalog', async () => {
+    const response = await request(app.getHttpServer()).get('/api/harnesses/ghost-harness/catalog');
+
+    expect(response.status).toBe(404);
+    expect(response.body.code).toBe('adapter_unavailable');
+    // A fallback catalog would carry a models array; a typed error must not.
+    expect(response.body.models).toBeUndefined();
+  });
+});

apps/gateway/src/harness/harness.controller.ts

@@ -0,0 +1,65 @@
+import {
+  Controller,
+  Get,
+  HttpException,
+  HttpStatus,
+  Inject,
+  Param,
+  UseGuards,
+} from '@nestjs/common';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { CurrentUser } from '../auth/current-user.decorator.js';
+import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
+import { HarnessAdapterUnavailableError, HarnessRegistry } from './harness.registry.js';
+import { HARNESS_REGISTRY } from './harness.tokens.js';
+import {
+  readContextFromScope,
+  toHarnessSummary,
+  toSafeCatalog,
+  type HarnessCatalogDto,
+  type HarnessSummaryDto,
+} from './harness.dto.js';
+
+/**
+ * Generic harness catalog surface. It exposes only harness-neutral, browser-safe
+ * fields (identity, capabilities, provider/model catalog) — never executables,
+ * native paths, home/cwd, env, or secrets. There is NO provider-probe route here;
+ * `/api/providers` and `POST /api/providers/test` are intentionally out of scope.
+ */
+@Controller('api/harnesses')
+@UseGuards(AuthGuard)
+export class HarnessController {
+  constructor(@Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry) {}
+
+  @Get()
+  async list(@CurrentUser() user: AuthenticatedUserLike): Promise<HarnessSummaryDto[]> {
+    const context = readContextFromScope(scopeFromUser(user));
+    const summaries: HarnessSummaryDto[] = [];
+    for (const adapter of this.registry.list()) {
+      summaries.push(toHarnessSummary(await adapter.describe(context)));
+    }
+    return summaries;
+  }
+
+  @Get(':harnessId/catalog')
+  async catalog(
+    @CurrentUser() user: AuthenticatedUserLike,
+    @Param('harnessId') harnessId: string,
+  ): Promise<HarnessCatalogDto> {
+    const context = readContextFromScope(scopeFromUser(user));
+    let adapter;
+    try {
+      adapter = this.registry.get(harnessId);
+    } catch (error) {
+      if (error instanceof HarnessAdapterUnavailableError) {
+        // Typed failure — NEVER a fallback catalog for an unknown harness id.
+        throw new HttpException(
+          { code: error.code, message: error.message, harnessId },
+          HttpStatus.NOT_FOUND,
+        );
+      }
+      throw error;
+    }
+    return toSafeCatalog(await adapter.catalog(context));
+  }
+}

apps/gateway/src/harness/harness.dto.ts

@@ -0,0 +1,116 @@
+import { randomUUID } from 'node:crypto';
+import { IsNotEmpty, IsString } from 'class-validator';
+import type {
+  HarnessActorContext,
+  HarnessAuthState,
+  HarnessCapability,
+  HarnessCatalog,
+  HarnessCatalogEntry,
+  HarnessDescriptor,
+  HarnessInputType,
+  HarnessModelAvailability,
+  HarnessSelection,
+} from '@mosaicstack/types';
+import type { ActorTenantScope } from '../auth/session-scope.js';
+
+/**
+ * Structured selection tuple accepted on `PUT /api/chat/preferences/selection`.
+ *
+ * The body is a STRUCTURED tuple (harness + provider + model), never a free-text
+ * model string. With `ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })`
+ * any extra property — including smuggled server-authority fields such as
+ * `seatId`, `tenantId`, `userId`, `nativeSessionPath`, `executable`, `home`, `cwd` —
+ * is rejected with 400. There is deliberately no field through which a caller can
+ * name a scope; scope is derived on the server from the authenticated session.
+ */
+export class HarnessSelectionInputDto {
+  @IsString()
+  @IsNotEmpty()
+  harnessId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  providerId!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  modelId!: string;
+}
+
+/** Browser-safe harness summary — identity and capabilities only. */
+export interface HarnessSummaryDto {
+  readonly id: string;
+  readonly displayName: string;
+  readonly capabilities: readonly HarnessCapability[];
+}
+
+/** Browser-safe catalog entry — no executables, paths, secrets, or env. */
+export interface HarnessCatalogEntryDto {
+  readonly harnessId: string;
+  readonly providerId: string;
+  readonly modelId: string;
+  readonly displayName: string;
+  readonly reasoningCapability: boolean;
+  readonly inputTypes: readonly HarnessInputType[];
+  readonly authState: HarnessAuthState;
+  readonly availability: HarnessModelAvailability;
+}
+
+/** Browser-safe catalog envelope. */
+export interface HarnessCatalogDto {
+  readonly harnessId: string;
+  readonly version: string;
+  readonly fingerprint: string;
+  readonly models: readonly HarnessCatalogEntryDto[];
+}
+
+/** Response envelope for the caller's current selection (null when unset). */
+export interface SelectionResponseDto {
+  readonly selection: HarnessSelection | null;
+}
+
+/**
+ * Derive a server-trusted {@link HarnessActorContext} for read operations from the
+ * session-derived {@link ActorTenantScope}. All authority originates on the server;
+ * nothing here is caller-supplied. A fresh correlation id is minted per call.
+ */
+export function readContextFromScope(scope: ActorTenantScope): HarnessActorContext {
+  return {
+    actorId: scope.userId,
+    tenantId: scope.tenantId,
+    seatId: scope.userId,
+    correlationId: randomUUID(),
+  };
+}
+
+/** Project a descriptor onto the browser-safe summary shape (whitelist by construction). */
+export function toHarnessSummary(descriptor: HarnessDescriptor): HarnessSummaryDto {
+  return {
+    id: descriptor.id,
+    displayName: descriptor.displayName,
+    capabilities: [...descriptor.capabilities],
+  };
+}
+
+/** Project a catalog onto the browser-safe shape (whitelist by construction). */
+export function toSafeCatalog(catalog: HarnessCatalog): HarnessCatalogDto {
+  return {
+    harnessId: catalog.harnessId,
+    version: catalog.version,
+    fingerprint: catalog.fingerprint,
+    models: catalog.models.map(toSafeCatalogEntry),
+  };
+}
+
+function toSafeCatalogEntry(entry: HarnessCatalogEntry): HarnessCatalogEntryDto {
+  return {
+    harnessId: entry.harnessId,
+    providerId: entry.providerId,
+    modelId: entry.modelId,
+    displayName: entry.displayName,
+    reasoningCapability: entry.reasoningCapability,
+    inputTypes: [...entry.inputTypes],
+    authState: entry.authState,
+    availability: entry.availability,
+  };
+}

apps/gateway/src/harness/harness.module.ts

@@ -0,0 +1,37 @@
+import { Module } from '@nestjs/common';
+import { HarnessRegistry } from './harness.registry.js';
+import { HarnessService } from './harness.service.js';
+import {
+  HARNESS_CONVERSATION_SERVICE,
+  HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
+  HARNESS_REGISTRY,
+  HARNESS_SERVICE,
+} from './harness.tokens.js';
+import { HarnessController } from './harness.controller.js';
+import { HarnessSelectionController } from './harness-selection.controller.js';
+import { HarnessSelectionService } from './harness-selection.service.js';
+import { HarnessSelectionRepository } from './harness-selection.repository.js';
+
+/**
+ * Wires the harness-neutral registry/service (Task Two) together with the
+ * Slice-Zero catalog and selection HTTP surfaces (Task Three).
+ *
+ * The registry is provided empty here; real harness adapters are registered in a
+ * later task. Because the controllers/services resolve their collaborators through
+ * this real module graph, an unresolved provider fails loudly at `app.init()`.
+ */
+@Module({
+  controllers: [HarnessController, HarnessSelectionController],
+  providers: [
+    { provide: HARNESS_REGISTRY, useFactory: () => new HarnessRegistry() },
+    { provide: HARNESS_SERVICE, useClass: HarnessService },
+    // Task Five: bind the conversation-service token to its explicit "not yet bound"
+    // sentinel. The pi-rpc router treats this as a hard, typed startup failure; Task 14
+    // replaces it with a real service. Exported so ChatModule's router can inject it.
+    { provide: HARNESS_CONVERSATION_SERVICE, useValue: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE },
+    HarnessSelectionRepository,
+    HarnessSelectionService,
+  ],
+  exports: [HARNESS_REGISTRY, HARNESS_SERVICE, HARNESS_CONVERSATION_SERVICE],
+})
+export class HarnessModule {}

apps/gateway/src/harness/harness.registry.spec.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import {
+  HarnessAdapterUnavailableError,
+  HarnessRegistrationError,
+  HarnessRegistry,
+} from './harness.registry.js';
+import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
+
+describe('HarnessRegistry', () => {
+  it('registers and looks up an adapter by harness id', () => {
+    const registry = new HarnessRegistry();
+    const adapter = new FakeHarnessAdapter({ id: 'fake' });
+
+    registry.register(adapter);
+
+    expect(registry.get('fake')).toBe(adapter);
+    expect(registry.has('fake')).toBe(true);
+    expect(registry.list().map((entry) => entry.id)).toEqual(['fake']);
+  });
+
+  it('rejects a blank adapter id', () => {
+    const registry = new HarnessRegistry();
+
+    let error: unknown;
+    try {
+      registry.register(new FakeHarnessAdapter({ id: '   ' }));
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessRegistrationError);
+    expect((error as HarnessRegistrationError).reason).toBe('blank_id');
+    expect(registry.list()).toEqual([]);
+  });
+
+  it('rejects a duplicate adapter id', () => {
+    const registry = new HarnessRegistry();
+    registry.register(new FakeHarnessAdapter({ id: 'fake' }));
+
+    let error: unknown;
+    try {
+      registry.register(new FakeHarnessAdapter({ id: 'fake' }));
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessRegistrationError);
+    expect((error as HarnessRegistrationError).reason).toBe('duplicate_id');
+    expect((error as HarnessRegistrationError).harnessId).toBe('fake');
+    // The original registration is untouched.
+    expect(registry.list()).toHaveLength(1);
+  });
+
+  it('returns adapter_unavailable for an unknown harness id', () => {
+    const registry = new HarnessRegistry();
+
+    let error: unknown;
+    try {
+      registry.get('missing');
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessAdapterUnavailableError);
+    expect((error as HarnessAdapterUnavailableError).code).toBe('adapter_unavailable');
+    expect((error as HarnessAdapterUnavailableError).harnessId).toBe('missing');
+    expect(registry.has('missing')).toBe(false);
+  });
+});

apps/gateway/src/harness/harness.registry.ts

@@ -0,0 +1,100 @@
+import { Injectable } from '@nestjs/common';
+import type {
+  HarnessAdapter,
+  HarnessErrorCode,
+  HarnessErrorDto,
+  HarnessSelection,
+} from '@mosaicstack/types';
+
+/**
+ * A typed harness operation failure that carries a fully-formed, browser-safe
+ * {@link HarnessErrorDto}. The DTO's `selection` is always the exact requested
+ * tuple — there is no field through which a substituted "effective" selection
+ * could ever be reported.
+ */
+export class HarnessOperationError extends Error {
+  readonly code: HarnessErrorCode;
+  readonly dto: HarnessErrorDto;
+
+  constructor(dto: HarnessErrorDto) {
+    super(dto.message);
+    this.name = 'HarnessOperationError';
+    this.code = dto.code;
+    this.dto = dto;
+  }
+}
+
+/** Build a {@link HarnessOperationError} that echoes the requested selection unchanged. */
+export function operationError(
+  code: HarnessErrorCode,
+  message: string,
+  selection: HarnessSelection,
+  correlationId: string,
+  retryable = false,
+): HarnessOperationError {
+  return new HarnessOperationError({ code, message, retryable, correlationId, selection });
+}
+
+/** Raised when an unknown harness id is looked up. Discriminated by `code`. */
+export class HarnessAdapterUnavailableError extends Error {
+  readonly code = 'adapter_unavailable' as const satisfies HarnessErrorCode;
+
+  constructor(readonly harnessId: string) {
+    super(`No harness adapter is registered for id "${harnessId}".`);
+    this.name = 'HarnessAdapterUnavailableError';
+  }
+}
+
+export type HarnessRegistrationFailure = 'blank_id' | 'duplicate_id';
+
+/** Raised when an adapter cannot be registered (blank or duplicate id). */
+export class HarnessRegistrationError extends Error {
+  constructor(
+    readonly reason: HarnessRegistrationFailure,
+    readonly harnessId: string,
+  ) {
+    super(
+      reason === 'blank_id'
+        ? 'A harness adapter id must be a non-empty string.'
+        : `A harness adapter is already registered for id "${harnessId}".`,
+    );
+    this.name = 'HarnessRegistrationError';
+  }
+}
+
+/**
+ * Harness-neutral adapter registry. Adapters are keyed by their harness id.
+ * Registration rejects blank and duplicate ids; lookup of an unknown id fails
+ * with {@link HarnessAdapterUnavailableError} (`adapter_unavailable`).
+ */
+@Injectable()
+export class HarnessRegistry {
+  private readonly adapters = new Map<string, HarnessAdapter>();
+
+  register(adapter: HarnessAdapter): void {
+    const id = adapter.id;
+    if (typeof id !== 'string' || id.trim().length === 0) {
+      throw new HarnessRegistrationError('blank_id', id ?? '');
+    }
+    if (this.adapters.has(id)) {
+      throw new HarnessRegistrationError('duplicate_id', id);
+    }
+    this.adapters.set(id, adapter);
+  }
+
+  get(harnessId: string): HarnessAdapter {
+    const adapter = this.adapters.get(harnessId);
+    if (!adapter) {
+      throw new HarnessAdapterUnavailableError(harnessId);
+    }
+    return adapter;
+  }
+
+  has(harnessId: string): boolean {
+    return this.adapters.has(harnessId);
+  }
+
+  list(): readonly HarnessAdapter[] {
+    return [...this.adapters.values()];
+  }
+}

apps/gateway/src/harness/harness.service.spec.ts

@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest';
+import type { HarnessActorContext, HarnessCapability, HarnessSelection } from '@mosaicstack/types';
+import { HARNESS_CAPABILITIES } from '@mosaicstack/types';
+import { HarnessOperationError, HarnessRegistry } from './harness.registry.js';
+import {
+  HarnessScopeViolationError,
+  HarnessService,
+  type TrustedGatewayScope,
+} from './harness.service.js';
+import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
+
+const SCOPE: TrustedGatewayScope = {
+  actorId: 'actor-trusted',
+  tenantId: 'tenant-trusted',
+  seatId: 'seat-trusted',
+  correlationId: 'correlation-trusted',
+};
+
+const READ_CONTEXT: HarnessActorContext = {
+  actorId: SCOPE.actorId,
+  tenantId: SCOPE.tenantId,
+  seatId: SCOPE.seatId,
+  correlationId: SCOPE.correlationId,
+};
+
+function setup(capabilities?: readonly HarnessCapability[]) {
+  const registry = new HarnessRegistry();
+  const adapter = new FakeHarnessAdapter({ id: 'fake', capabilities });
+  registry.register(adapter);
+  const service = new HarnessService(registry);
+  return { registry, adapter, service };
+}
+
+async function availableSelection(adapter: FakeHarnessAdapter): Promise<HarnessSelection> {
+  const catalog = await adapter.catalog(READ_CONTEXT);
+  const entry = catalog.models.find((model) => model.availability === 'available');
+  if (!entry) {
+    throw new Error('fixture requires an available model');
+  }
+  return { harnessId: entry.harnessId, providerId: entry.providerId, modelId: entry.modelId };
+}
+
+describe('HarnessService', () => {
+  it('derives the actor context from trusted scope on create', async () => {
+    const { service, adapter } = setup();
+    const selection = await availableSelection(adapter);
+
+    const snapshot = await service.createSession(SCOPE, {
+      conversationId: 'conversation-1',
+      selection,
+    });
+
+    expect(snapshot.seatId).toBe(SCOPE.seatId);
+    expect(snapshot.state).toBe('idle');
+    expect(snapshot.selection).toEqual(selection);
+    expect(snapshot.nativeSessionId).toBeTruthy();
+  });
+
+  it('rejects server-authority fields supplied by an external caller', async () => {
+    const { service, adapter } = setup();
+    const selection = await availableSelection(adapter);
+
+    const hostile = {
+      conversationId: 'conversation-1',
+      selection,
+      seatId: 'attacker-seat',
+      executablePath: '/usr/bin/evil',
+      home: '/home/attacker',
+      cwd: '/tmp/attacker',
+      nativeSessionPath: '/var/native/attacker.jsonl',
+    } as unknown as Parameters<HarnessService['createSession']>[1];
+
+    let error: unknown;
+    try {
+      await service.createSession(SCOPE, hostile);
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessScopeViolationError);
+    expect((error as HarnessScopeViolationError).field).toBe('seatId');
+  });
+
+  it('returns adapter_unavailable for an unknown harness id, echoing the requested tuple', async () => {
+    const { service } = setup();
+    const selection: HarnessSelection = {
+      harnessId: 'ghost-harness',
+      providerId: 'p',
+      modelId: 'm',
+    };
+
+    let error: unknown;
+    try {
+      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    const dto = (error as HarnessOperationError).dto;
+    expect(dto.code).toBe('adapter_unavailable');
+    expect(dto.selection).toEqual(selection);
+    expect(dto.correlationId).toBe(SCOPE.correlationId);
+  });
+
+  it('returns selection_invalid for an unknown provider/model tuple, unchanged', async () => {
+    const { service } = setup();
+    const selection: HarnessSelection = {
+      harnessId: 'fake',
+      providerId: 'ghost-provider',
+      modelId: 'ghost-model',
+    };
+
+    let error: unknown;
+    try {
+      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    const dto = (error as HarnessOperationError).dto;
+    expect(dto.code).toBe('selection_invalid');
+    expect(dto.selection).toEqual(selection);
+  });
+
+  it('returns model_unavailable without falling back for a known unavailable model', async () => {
+    const { service, adapter } = setup();
+    const catalog = await adapter.catalog(READ_CONTEXT);
+    const unavailable = catalog.models.find((entry) => entry.availability === 'unavailable');
+    expect(unavailable).toBeDefined();
+    const selection: HarnessSelection = {
+      harnessId: unavailable!.harnessId,
+      providerId: unavailable!.providerId,
+      modelId: unavailable!.modelId,
+    };
+
+    let error: unknown;
+    try {
+      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    const dto = (error as HarnessOperationError).dto;
+    expect(dto.code).toBe('model_unavailable');
+    // No substitution: the DTO tuple is exactly what was requested.
+    expect(dto.selection).toEqual(selection);
+  });
+
+  it('gives create, resume, detach, evict, and end distinct observable effects', async () => {
+    const { service, adapter } = setup();
+    const selection = await availableSelection(adapter);
+
+    const created = await service.createSession(SCOPE, {
+      conversationId: 'conversation-create',
+      selection,
+    });
+    expect(created.state).toBe('idle');
+    expect(created.processId).toBeTruthy();
+    expect(created.attachedClientIds).toEqual([]);
+
+    const resumed = await service.resumeSession(SCOPE, {
+      conversationId: 'conversation-resume',
+      nativeSessionId: 'native-preexisting-123',
+      selection,
+    });
+    // Resume binds the supplied native session; create mints a fresh one.
+    expect(resumed.nativeSessionId).toBe('native-preexisting-123');
+    expect(resumed.nativeSessionId).not.toBe(created.nativeSessionId);
+
+    await service.attach(SCOPE, {
+      conversationId: 'conversation-create',
+      clientId: 'browser-1',
+    });
+    const afterAttach = await service.snapshot(SCOPE, 'conversation-create');
+    expect(afterAttach.attachedClientIds).toEqual(['browser-1']);
+
+    const afterDetach = await service.detach(SCOPE, {
+      conversationId: 'conversation-create',
+      clientId: 'browser-1',
+    });
+    // Detach removes the browser attachment only; the process stays alive.
+    expect(afterDetach.attachedClientIds).toEqual([]);
+    expect(afterDetach.state).toBe('idle');
+    expect(afterDetach.processId).toBeTruthy();
+
+    const afterEvict = await service.evict(SCOPE, {
+      conversationId: 'conversation-create',
+      reason: 'idle_timeout',
+    });
+    // Evict stops the process but retains the resumable native session.
+    expect(afterEvict.state).toBe('evicted');
+    expect(afterEvict.processId).toBeUndefined();
+    expect(afterEvict.nativeSessionId).toBe(created.nativeSessionId);
+
+    const afterEnd = await service.end(SCOPE, {
+      conversationId: 'conversation-create',
+      reason: 'session_ended',
+    });
+    // End destructively terminates the native session.
+    expect(afterEnd.state).toBe('ended');
+  });
+
+  it('fails typed when an unsupported capability is exercised', async () => {
+    const withoutExtensionUi = HARNESS_CAPABILITIES.filter(
+      (capability) => capability !== 'extensionUi',
+    );
+    const { service, adapter } = setup(withoutExtensionUi);
+    const selection = await availableSelection(adapter);
+    await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
+
+    let error: unknown;
+    try {
+      await service.respondInteraction(SCOPE, {
+        conversationId: 'conversation-1',
+        response: { requestId: 'interaction-1', type: 'confirm', accepted: true },
+      });
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    expect((error as HarnessOperationError).dto.code).toBe('interaction_unsupported');
+  });
+});

apps/gateway/src/harness/harness.service.ts

@@ -0,0 +1,285 @@
+import { Inject, Injectable } from '@nestjs/common';
+import type {
+  HarnessActorContext,
+  HarnessAdapter,
+  HarnessCatalog,
+  HarnessCloseReason,
+  HarnessInteractionResponse,
+  HarnessSelection,
+  HarnessSessionHandle,
+  HarnessSessionSnapshot,
+} from '@mosaicstack/types';
+import {
+  HarnessAdapterUnavailableError,
+  HarnessRegistry,
+  operationError,
+} from './harness.registry.js';
+import { HARNESS_REGISTRY } from './harness.tokens.js';
+
+/**
+ * Trusted, server-derived authority. In production this is produced by the
+ * Gateway from the authenticated session — never from a browser/caller DTO.
+ */
+export interface TrustedGatewayScope {
+  readonly actorId: string;
+  readonly tenantId: string;
+  readonly seatId: string;
+  readonly correlationId: string;
+}
+
+/** Server-authority fields that must never arrive from an external request DTO. */
+const FORBIDDEN_REQUEST_FIELDS = [
+  'actorId',
+  'tenantId',
+  'correlationId',
+  'seatId',
+  'seat',
+  'executable',
+  'executablePath',
+  'home',
+  'homeDir',
+  'cwd',
+  'workingDir',
+  'workingDirectory',
+  'nativeSessionPath',
+  'sessionPath',
+] as const;
+
+/** Raised when an external request DTO smuggles a server-authority field. */
+export class HarnessScopeViolationError extends Error {
+  constructor(readonly field: string) {
+    super(`External request supplied server-authority field "${field}".`);
+    this.name = 'HarnessScopeViolationError';
+  }
+}
+
+export interface CreateHarnessSessionRequest {
+  readonly conversationId: string;
+  readonly selection: HarnessSelection;
+}
+
+export interface ResumeHarnessSessionRequest {
+  readonly conversationId: string;
+  readonly nativeSessionId: string;
+  readonly selection: HarnessSelection;
+}
+
+export interface AttachClientRequest {
+  readonly conversationId: string;
+  readonly clientId: string;
+}
+
+export interface DetachClientRequest {
+  readonly conversationId: string;
+  readonly clientId: string;
+}
+
+export interface EvictSessionRequest {
+  readonly conversationId: string;
+  readonly reason: HarnessCloseReason;
+}
+
+export interface EndSessionRequest {
+  readonly conversationId: string;
+  readonly reason: HarnessCloseReason;
+}
+
+export interface RespondInteractionRequest {
+  readonly conversationId: string;
+  readonly response: HarnessInteractionResponse;
+}
+
+interface ActiveSession {
+  readonly harnessId: string;
+  readonly handle: HarnessSessionHandle;
+  readonly correlationId: string;
+}
+
+/**
+ * Harness-neutral service. It derives the {@link HarnessActorContext} strictly
+ * from trusted Gateway scope, validates the selected provider/model tuple with
+ * NO fallback substitution, and exposes distinct create/resume/detach/evict/end
+ * lifecycle operations.
+ */
+@Injectable()
+export class HarnessService {
+  private readonly sessions = new Map<string, ActiveSession>();
+
+  constructor(@Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry) {}
+
+  async createSession(
+    scope: TrustedGatewayScope,
+    request: CreateHarnessSessionRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const { conversationId, selection } = request;
+    const adapter = this.resolveAdapter(scope, selection);
+    const context = deriveActorContext(scope);
+    await this.assertSelectionAvailable(scope, adapter.catalog(context), selection);
+
+    const handle = await adapter.create({ context, conversationId, selection });
+    this.sessions.set(conversationId, {
+      harnessId: selection.harnessId,
+      handle,
+      correlationId: scope.correlationId,
+    });
+    return handle.snapshot();
+  }
+
+  async resumeSession(
+    scope: TrustedGatewayScope,
+    request: ResumeHarnessSessionRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const { conversationId, nativeSessionId, selection } = request;
+    const adapter = this.resolveAdapter(scope, selection);
+    const context = deriveActorContext(scope);
+    await this.assertSelectionAvailable(scope, adapter.catalog(context), selection);
+
+    const handle = await adapter.resume({ context, conversationId, nativeSessionId, selection });
+    this.sessions.set(conversationId, {
+      harnessId: selection.harnessId,
+      handle,
+      correlationId: scope.correlationId,
+    });
+    return handle.snapshot();
+  }
+
+  async attach(
+    scope: TrustedGatewayScope,
+    request: AttachClientRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const handle = this.requireHandle(scope, request.conversationId);
+    await handle.attach({ clientId: request.clientId });
+    return handle.snapshot();
+  }
+
+  async detach(
+    scope: TrustedGatewayScope,
+    request: DetachClientRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const handle = this.requireHandle(scope, request.conversationId);
+    await handle.detach(request.clientId);
+    return handle.snapshot();
+  }
+
+  async evict(
+    scope: TrustedGatewayScope,
+    request: EvictSessionRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const handle = this.requireHandle(scope, request.conversationId);
+    await handle.evictProcess(request.reason);
+    return handle.snapshot();
+  }
+
+  async end(
+    scope: TrustedGatewayScope,
+    request: EndSessionRequest,
+  ): Promise<HarnessSessionSnapshot> {
+    assertTrustedRequest(request);
+    const handle = this.requireHandle(scope, request.conversationId);
+    await handle.endSession(request.reason);
+    const snapshot = await handle.snapshot();
+    this.sessions.delete(request.conversationId);
+    return snapshot;
+  }
+
+  async respondInteraction(
+    scope: TrustedGatewayScope,
+    request: RespondInteractionRequest,
+  ): Promise<void> {
+    assertTrustedRequest(request);
+    const handle = this.requireHandle(scope, request.conversationId);
+    await handle.respondInteraction(request.response);
+  }
+
+  async snapshot(
+    scope: TrustedGatewayScope,
+    conversationId: string,
+  ): Promise<HarnessSessionSnapshot> {
+    const handle = this.requireHandle(scope, conversationId);
+    return handle.snapshot();
+  }
+
+  private resolveAdapter(scope: TrustedGatewayScope, selection: HarnessSelection): HarnessAdapter {
+    try {
+      return this.registry.get(selection.harnessId);
+    } catch (error) {
+      if (error instanceof HarnessAdapterUnavailableError) {
+        throw operationError('adapter_unavailable', error.message, selection, scope.correlationId);
+      }
+      throw error;
+    }
+  }
+
+  private async assertSelectionAvailable(
+    scope: TrustedGatewayScope,
+    catalogPromise: Promise<HarnessCatalog>,
+    selection: HarnessSelection,
+  ): Promise<void> {
+    const catalog = await catalogPromise;
+    const entry = catalog.models.find(
+      (candidate) =>
+        candidate.harnessId === selection.harnessId &&
+        candidate.providerId === selection.providerId &&
+        candidate.modelId === selection.modelId,
+    );
+    if (!entry) {
+      // No first-row fallback: reject the requested tuple unchanged.
+      throw operationError(
+        'selection_invalid',
+        'The requested harness/provider/model tuple is not in the catalog.',
+        selection,
+        scope.correlationId,
+      );
+    }
+    if (entry.availability === 'unavailable') {
+      throw operationError(
+        'model_unavailable',
+        'The requested model is currently unavailable.',
+        selection,
+        scope.correlationId,
+        true,
+      );
+    }
+  }
+
+  private requireHandle(scope: TrustedGatewayScope, conversationId: string): HarnessSessionHandle {
+    const active = this.sessions.get(conversationId);
+    if (!active) {
+      throw operationError(
+        'session_not_found',
+        `No active harness session for conversation "${conversationId}".`,
+        { harnessId: '', providerId: '', modelId: '' },
+        scope.correlationId,
+      );
+    }
+    return active.handle;
+  }
+}
+
+/** Build the actor context strictly from trusted scope. No caller data leaks in. */
+export function deriveActorContext(scope: TrustedGatewayScope): HarnessActorContext {
+  return {
+    actorId: scope.actorId,
+    tenantId: scope.tenantId,
+    seatId: scope.seatId,
+    correlationId: scope.correlationId,
+  };
+}
+
+/** Reject any request object that carries a server-authority field. */
+function assertTrustedRequest(request: object): void {
+  for (const field of FORBIDDEN_REQUEST_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(request, field)) {
+      throw new HarnessScopeViolationError(field);
+    }
+  }
+}
+
+// Re-export the typed operation error so callers importing from the service
+// have the discriminated failure type without reaching into the registry.
+export { HarnessOperationError } from './harness.registry.js';

apps/gateway/src/harness/harness.tokens.ts

@@ -0,0 +1,45 @@
+/**
+ * Nest dependency-injection tokens for the harness-neutral registry and service.
+ *
+ * String tokens follow the existing Gateway convention (see `memory/memory.tokens.ts`)
+ * and remain valid Nest `InjectionToken`s for `@Inject(...)`.
+ */
+import type { HarnessConversationService } from '@mosaicstack/types';
+
+export const HARNESS_REGISTRY = 'HARNESS_REGISTRY' as const;
+export const HARNESS_SERVICE = 'HARNESS_SERVICE' as const;
+
+export type HarnessRegistryToken = typeof HARNESS_REGISTRY;
+export type HarnessServiceToken = typeof HARNESS_SERVICE;
+
+/**
+ * Token for the {@link HarnessConversationService} that {@link HarnessChatRuntime}
+ * depends on. Until Task 14 provides a real implementation, `HarnessModule` binds
+ * the {@link HARNESS_CONVERSATION_SERVICE_UNAVAILABLE} sentinel here, and the
+ * `pi-rpc` router treats that sentinel as a hard, typed startup failure.
+ */
+export const HARNESS_CONVERSATION_SERVICE = 'HARNESS_CONVERSATION_SERVICE' as const;
+
+export type HarnessConversationServiceToken = typeof HARNESS_CONVERSATION_SERVICE;
+
+/**
+ * Explicit "not yet bound" value for {@link HARNESS_CONVERSATION_SERVICE}. It is a
+ * distinct sentinel — never `null`/`undefined` — so an unbound service is an
+ * intentional, checkable state rather than an accidental nil that could read as
+ * "present". Replaced by a real service in Task 14.
+ */
+export const HARNESS_CONVERSATION_SERVICE_UNAVAILABLE: unique symbol = Symbol(
+  'HARNESS_CONVERSATION_SERVICE_UNAVAILABLE',
+);
+
+/** A binding for {@link HARNESS_CONVERSATION_SERVICE}: a real service or the sentinel. */
+export type HarnessConversationServiceBinding =
+  | HarnessConversationService
+  | typeof HARNESS_CONVERSATION_SERVICE_UNAVAILABLE;
+
+/** Narrows a binding to a usable service, excluding the unavailable sentinel. */
+export function isHarnessConversationServiceAvailable(
+  binding: HarnessConversationServiceBinding,
+): binding is HarnessConversationService {
+  return binding !== HARNESS_CONVERSATION_SERVICE_UNAVAILABLE;
+}

apps/gateway/src/harness/testing/fake-harness.adapter.spec.ts

@@ -0,0 +1,107 @@
+import { describe, expect, it } from 'vitest';
+import type { HarnessActorContext, HarnessSelection } from '@mosaicstack/types';
+import { HarnessOperationError } from '../harness.registry.js';
+import { FakeHarnessAdapter } from './fake-harness.adapter.js';
+import { runHarnessAdapterContract } from './harness-adapter.contract.js';
+
+const CONTEXT: HarnessActorContext = {
+  actorId: 'actor-1',
+  tenantId: 'tenant-1',
+  seatId: 'seat-1',
+  correlationId: 'correlation-1',
+};
+
+// The reusable conformance suite. Task 13 re-runs it against the native Pi adapter.
+runHarnessAdapterContract('FakeHarnessAdapter', () => new FakeHarnessAdapter({ id: 'fake' }));
+
+describe('FakeHarnessAdapter no-substitution', () => {
+  it('never substitutes the first catalog row when a bogus selection is requested', async () => {
+    const adapter = new FakeHarnessAdapter({ id: 'fake' });
+    const catalog = await adapter.catalog(CONTEXT);
+    const firstRow = catalog.models[0];
+    if (!firstRow) {
+      throw new Error('fixture requires a catalog model');
+    }
+    const available = catalog.models.find(
+      (entry) => entry.availability === 'available' && entry.modelId !== firstRow.modelId,
+    );
+    expect(available).toBeDefined();
+    const selected: HarnessSelection = {
+      harnessId: available!.harnessId,
+      providerId: available!.providerId,
+      modelId: available!.modelId,
+    };
+
+    const handle = await adapter.create({
+      context: CONTEXT,
+      conversationId: 'conversation-1',
+      selection: selected,
+    });
+
+    const bogus: HarnessSelection = {
+      harnessId: 'fake',
+      providerId: 'ghost-provider',
+      modelId: 'ghost-model',
+    };
+
+    let error: unknown;
+    try {
+      await handle.setModel(bogus);
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    const dto = (error as HarnessOperationError).dto;
+    expect(dto.code).toBe('selection_invalid');
+    // The DTO echoes the exact requested tuple, unchanged.
+    expect(dto.selection).toEqual(bogus);
+    // No substitution to the first catalog row.
+    expect(dto.selection).not.toEqual({
+      harnessId: firstRow.harnessId,
+      providerId: firstRow.providerId,
+      modelId: firstRow.modelId,
+    });
+    // The active selection is untouched by the rejected request.
+    expect((await handle.snapshot()).selection).toEqual(selected);
+  });
+
+  it('reports model_unavailable with the unchanged tuple for a known but unavailable model', async () => {
+    const adapter = new FakeHarnessAdapter({ id: 'fake' });
+    const catalog = await adapter.catalog(CONTEXT);
+    const unavailable = catalog.models.find((entry) => entry.availability === 'unavailable');
+    const available = catalog.models.find((entry) => entry.availability === 'available');
+    expect(unavailable).toBeDefined();
+    expect(available).toBeDefined();
+
+    const startingSelection: HarnessSelection = {
+      harnessId: available!.harnessId,
+      providerId: available!.providerId,
+      modelId: available!.modelId,
+    };
+    const handle = await adapter.create({
+      context: CONTEXT,
+      conversationId: 'conversation-2',
+      selection: startingSelection,
+    });
+
+    const requested: HarnessSelection = {
+      harnessId: unavailable!.harnessId,
+      providerId: unavailable!.providerId,
+      modelId: unavailable!.modelId,
+    };
+
+    let error: unknown;
+    try {
+      await handle.setModel(requested);
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(error).toBeInstanceOf(HarnessOperationError);
+    const dto = (error as HarnessOperationError).dto;
+    expect(dto.code).toBe('model_unavailable');
+    expect(dto.selection).toEqual(requested);
+    expect((await handle.snapshot()).selection).toEqual(startingSelection);
+  });
+});

apps/gateway/src/harness/testing/fake-harness.adapter.ts

@@ -0,0 +1,248 @@
+import type {
+  AttachClient,
+  CreateHarnessSession,
+  HarnessAdapter,
+  HarnessActorContext,
+  HarnessCapability,
+  HarnessCatalog,
+  HarnessCatalogEntry,
+  HarnessCloseReason,
+  HarnessDescriptor,
+  HarnessEvent,
+  HarnessInteractionResponse,
+  HarnessPrompt,
+  HarnessPromptReceipt,
+  HarnessSelection,
+  HarnessSessionHandle,
+  HarnessSessionSnapshot,
+  HarnessSessionState,
+  ResumeHarnessSession,
+} from '@mosaicstack/types';
+import { HARNESS_CAPABILITIES } from '@mosaicstack/types';
+import { operationError } from '../harness.registry.js';
+
+export interface FakeHarnessAdapterOptions {
+  readonly id: string;
+  readonly capabilities?: readonly HarnessCapability[];
+  readonly catalog?: readonly HarnessCatalogEntry[];
+}
+
+const FAKE_PROVIDER = 'fake-openai';
+
+function defaultCatalog(harnessId: string): readonly HarnessCatalogEntry[] {
+  return [
+    {
+      harnessId,
+      providerId: FAKE_PROVIDER,
+      modelId: 'fake-mini',
+      displayName: 'Fake Mini',
+      reasoningCapability: false,
+      inputTypes: ['text'],
+      authState: 'ready',
+      availability: 'available',
+    },
+    {
+      harnessId,
+      providerId: FAKE_PROVIDER,
+      modelId: 'fake-pro',
+      displayName: 'Fake Pro',
+      reasoningCapability: true,
+      inputTypes: ['text', 'image'],
+      authState: 'ready',
+      availability: 'available',
+    },
+    {
+      harnessId,
+      providerId: FAKE_PROVIDER,
+      modelId: 'fake-legacy',
+      displayName: 'Fake Legacy',
+      reasoningCapability: false,
+      inputTypes: ['text'],
+      authState: 'unavailable',
+      availability: 'unavailable',
+    },
+  ];
+}
+
+function matches(entry: HarnessCatalogEntry, selection: HarnessSelection): boolean {
+  return (
+    entry.harnessId === selection.harnessId &&
+    entry.providerId === selection.providerId &&
+    entry.modelId === selection.modelId
+  );
+}
+
+/**
+ * In-memory harness session handle used by the fake adapter and by the shared
+ * conformance suite. It enforces the two invariants the real adapters must also
+ * honor: model selection is validated against the catalog and is NEVER
+ * substituted, and unsupported capabilities fail with a typed error.
+ */
+export class FakeHarnessSessionHandle implements HarnessSessionHandle {
+  private state: HarnessSessionState = 'idle';
+  private processId: string | undefined;
+  private readonly attachedClientIds = new Set<string>();
+  private readonly listeners = new Set<(event: HarnessEvent) => void>();
+
+  constructor(
+    private readonly conversationId: string,
+    private readonly nativeSessionId: string,
+    private readonly seatId: string,
+    private selection: HarnessSelection,
+    private readonly correlationId: string,
+    private readonly capabilities: readonly HarnessCapability[],
+    private readonly catalog: readonly HarnessCatalogEntry[],
+  ) {
+    this.processId = `process-${nativeSessionId}`;
+  }
+
+  async snapshot(): Promise<HarnessSessionSnapshot> {
+    return {
+      conversationId: this.conversationId,
+      nativeSessionId: this.nativeSessionId,
+      processId: this.processId,
+      seatId: this.seatId,
+      selection: this.selection,
+      state: this.state,
+      attachedClientIds: [...this.attachedClientIds],
+    };
+  }
+
+  async attach(input: AttachClient): Promise<void> {
+    this.attachedClientIds.add(input.clientId);
+  }
+
+  async detach(clientId: string): Promise<void> {
+    // Removes the browser attachment only; the process and native session persist.
+    this.attachedClientIds.delete(clientId);
+  }
+
+  async prompt(input: HarnessPrompt & { idempotencyKey: string }): Promise<HarnessPromptReceipt> {
+    return {
+      conversationId: this.conversationId,
+      turnId: input.turnId,
+      correlationId: input.correlationId,
+      state: 'accepted',
+      selection: this.selection,
+    };
+  }
+
+  async setModel(selection: HarnessSelection): Promise<HarnessSelection> {
+    const entry = this.catalog.find((candidate) => matches(candidate, selection));
+    if (!entry) {
+      // No fallback to the first catalog row: reject with the requested tuple, unchanged.
+      throw operationError(
+        'selection_invalid',
+        'The requested harness/provider/model tuple is not in the catalog.',
+        selection,
+        this.correlationId,
+      );
+    }
+    if (entry.availability === 'unavailable') {
+      throw operationError(
+        'model_unavailable',
+        'The requested model is currently unavailable.',
+        selection,
+        this.correlationId,
+        true,
+      );
+    }
+    this.selection = selection;
+    return this.selection;
+  }
+
+  async abort(_turnId: string): Promise<void> {
+    // No active turn machinery in the fake; abort is a no-op acknowledgement.
+  }
+
+  async respondInteraction(_input: HarnessInteractionResponse): Promise<void> {
+    if (!this.capabilities.includes('extensionUi')) {
+      throw operationError(
+        'interaction_unsupported',
+        'This harness does not support interactive responses.',
+        this.selection,
+        this.correlationId,
+      );
+    }
+  }
+
+  events(listener: (event: HarnessEvent) => void): () => void {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+
+  async evictProcess(_reason: HarnessCloseReason): Promise<void> {
+    // Stop the process but keep the resumable native session.
+    this.processId = undefined;
+    this.state = 'evicted';
+  }
+
+  async endSession(_reason: HarnessCloseReason): Promise<void> {
+    // Destructively end the native session.
+    this.processId = undefined;
+    this.state = 'ended';
+  }
+}
+
+/**
+ * Minimal in-memory {@link HarnessAdapter} for Slice Zero. It mints a fresh
+ * native session id on `create` and binds the supplied one on `resume`, so the
+ * two paths are observably distinct.
+ */
+export class FakeHarnessAdapter implements HarnessAdapter {
+  readonly id: string;
+  private readonly capabilities: readonly HarnessCapability[];
+  private readonly catalogEntries: readonly HarnessCatalogEntry[];
+  private createdCount = 0;
+
+  constructor(options: FakeHarnessAdapterOptions) {
+    this.id = options.id;
+    this.capabilities = options.capabilities ?? [...HARNESS_CAPABILITIES];
+    this.catalogEntries = options.catalog ?? defaultCatalog(options.id);
+  }
+
+  async describe(_context: HarnessActorContext): Promise<HarnessDescriptor> {
+    return {
+      id: this.id,
+      displayName: `Fake harness (${this.id})`,
+      capabilities: this.capabilities,
+    };
+  }
+
+  async catalog(_context: HarnessActorContext): Promise<HarnessCatalog> {
+    return {
+      harnessId: this.id,
+      version: '1.0.0',
+      fingerprint: `fake-${this.id}-${this.catalogEntries.length}`,
+      models: this.catalogEntries,
+    };
+  }
+
+  async create(input: CreateHarnessSession): Promise<HarnessSessionHandle> {
+    this.createdCount += 1;
+    const nativeSessionId = `native-${input.conversationId}-${this.createdCount}`;
+    return new FakeHarnessSessionHandle(
+      input.conversationId,
+      nativeSessionId,
+      input.context.seatId,
+      input.selection,
+      input.context.correlationId,
+      this.capabilities,
+      this.catalogEntries,
+    );
+  }
+
+  async resume(input: ResumeHarnessSession): Promise<HarnessSessionHandle> {
+    return new FakeHarnessSessionHandle(
+      input.conversationId,
+      input.nativeSessionId,
+      input.context.seatId,
+      input.selection,
+      input.context.correlationId,
+      this.capabilities,
+      this.catalogEntries,
+    );
+  }
+}

apps/gateway/src/harness/testing/harness-adapter.contract.ts

@@ -0,0 +1,157 @@
+import { describe, expect, it } from 'vitest';
+import type {
+  HarnessActorContext,
+  HarnessAdapter,
+  HarnessCatalogEntry,
+  HarnessSelection,
+} from '@mosaicstack/types';
+import { HarnessOperationError } from '../harness.registry.js';
+
+const CONTEXT: HarnessActorContext = {
+  actorId: 'contract-actor',
+  tenantId: 'contract-tenant',
+  seatId: 'contract-seat',
+  correlationId: 'contract-correlation',
+};
+
+function toSelection(entry: HarnessCatalogEntry): HarnessSelection {
+  return { harnessId: entry.harnessId, providerId: entry.providerId, modelId: entry.modelId };
+}
+
+function pickAvailable(models: readonly HarnessCatalogEntry[]): HarnessCatalogEntry {
+  const entry = models.find((candidate) => candidate.availability === 'available') ?? models[0];
+  if (!entry) {
+    throw new Error('contract fixture requires at least one catalog model');
+  }
+  return entry;
+}
+
+async function captureError(run: () => Promise<unknown>): Promise<unknown> {
+  try {
+    await run();
+    return undefined;
+  } catch (caught) {
+    return caught;
+  }
+}
+
+/**
+ * Shared conformance suite every {@link HarnessAdapter} must pass. Slice Zero
+ * runs it against the fake adapter; Task 13 re-runs the identical suite against
+ * the native Pi adapter so both share one behavioral contract.
+ */
+export function runHarnessAdapterContract(
+  label: string,
+  createAdapter: () => HarnessAdapter,
+): void {
+  describe(`harness adapter contract: ${label}`, () => {
+    it('mints a fresh native session on create and binds the supplied one on resume', async () => {
+      const adapter = createAdapter();
+      const catalog = await adapter.catalog(CONTEXT);
+      const selection = toSelection(pickAvailable(catalog.models));
+
+      const created = await (
+        await adapter.create({ context: CONTEXT, conversationId: 'conv-create', selection })
+      ).snapshot();
+      const resumed = await (
+        await adapter.resume({
+          context: CONTEXT,
+          conversationId: 'conv-resume',
+          nativeSessionId: 'native-supplied-1',
+          selection,
+        })
+      ).snapshot();
+
+      expect(created.nativeSessionId).toBeTruthy();
+      expect(resumed.nativeSessionId).toBe('native-supplied-1');
+      expect(created.nativeSessionId).not.toBe(resumed.nativeSessionId);
+      expect(created.seatId).toBe(CONTEXT.seatId);
+    });
+
+    it('gives detach, evict, and end distinct effects (not aliases)', async () => {
+      const adapter = createAdapter();
+      const catalog = await adapter.catalog(CONTEXT);
+      const selection = toSelection(pickAvailable(catalog.models));
+      const handle = await adapter.create({
+        context: CONTEXT,
+        conversationId: 'conv-lifecycle',
+        selection,
+      });
+
+      await handle.attach({ clientId: 'browser-1' });
+      await handle.detach('browser-1');
+      const afterDetach = await handle.snapshot();
+      expect(afterDetach.attachedClientIds).toEqual([]);
+      expect(afterDetach.state).not.toBe('evicted');
+      expect(afterDetach.state).not.toBe('ended');
+
+      await handle.evictProcess('idle_timeout');
+      const afterEvict = await handle.snapshot();
+      expect(afterEvict.state).toBe('evicted');
+      // The native session survives eviction (resumable); the process does not.
+      expect(afterEvict.nativeSessionId).toBe(afterDetach.nativeSessionId);
+      expect(afterEvict.processId).toBeUndefined();
+
+      await handle.endSession('session_ended');
+      const afterEnd = await handle.snapshot();
+      expect(afterEnd.state).toBe('ended');
+      // End is not an alias of evict.
+      expect(afterEnd.state).not.toBe(afterEvict.state);
+    });
+
+    it('never substitutes the first catalog row for an unknown selection', async () => {
+      const adapter = createAdapter();
+      const catalog = await adapter.catalog(CONTEXT);
+      const firstRow = catalog.models[0];
+      if (!firstRow) {
+        throw new Error('contract fixture requires a catalog model');
+      }
+      const start = toSelection(pickAvailable(catalog.models));
+      const handle = await adapter.create({
+        context: CONTEXT,
+        conversationId: 'conv-nosub',
+        selection: start,
+      });
+
+      const bogus: HarnessSelection = {
+        harnessId: adapter.id,
+        providerId: 'contract-ghost-provider',
+        modelId: 'contract-ghost-model',
+      };
+      const error = await captureError(() => handle.setModel(bogus));
+
+      expect(error).toBeInstanceOf(HarnessOperationError);
+      const dto = (error as HarnessOperationError).dto;
+      expect(dto.code).toBe('selection_invalid');
+      expect(dto.selection).toEqual(bogus);
+      expect(dto.selection).not.toEqual(toSelection(firstRow));
+      expect((await handle.snapshot()).selection).toEqual(start);
+    });
+
+    it('validates capability-gated interactions with a typed error, not a silent no-op', async () => {
+      const adapter = createAdapter();
+      const descriptor = await adapter.describe(CONTEXT);
+      const catalog = await adapter.catalog(CONTEXT);
+      const selection = toSelection(pickAvailable(catalog.models));
+      const handle = await adapter.create({
+        context: CONTEXT,
+        conversationId: 'conv-interaction',
+        selection,
+      });
+
+      const response = {
+        requestId: 'interaction-1',
+        type: 'confirm',
+        accepted: true,
+      } as const;
+
+      if (descriptor.capabilities.includes('extensionUi')) {
+        await expect(handle.respondInteraction(response)).resolves.toBeUndefined();
+      } else {
+        const error = await captureError(() => handle.respondInteraction(response));
+        expect(error).toBeInstanceOf(HarnessOperationError);
+        expect((error as HarnessOperationError).dto.code).toBe('interaction_unsupported');
+      }
+    });
+  });
+}

apps/gateway/src/hierarchy/hierarchy-audit.integration.test.ts

@@ -0,0 +1,247 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { Test, type TestingModule } from '@nestjs/testing';
+import {
+  companies,
+  createPgliteDb,
+  eq,
+  estates,
+  hierarchyAuditEvents,
+  hierarchyOutbox,
+  platformProjects,
+  runPgliteMigrations,
+  type DbHandle,
+} from '@mosaicstack/db';
+import { DB } from '../database/database.module.js';
+import {
+  HierarchyAuditIdempotencyConflictError,
+  HierarchyAuditRepository,
+  HierarchyNodeNotFoundError,
+  type AppendHierarchyEventInput,
+} from './hierarchy-audit.repository.js';
+
+/**
+ * Repository-level §6.4 witnesses for the hierarchy audit machinery
+ * (contract 1 §5.2, REQ-AUD-001): same-transaction atomicity of state +
+ * event + outbox, rollback leaving no residue, idempotent replay, snapshot
+ * parent chains, events surviving target deletion, per-target ordering, and
+ * the outbox claim/complete/release CAS. The schema-level constraints are
+ * witnessed in packages/db/src/hierarchy-audit.witness.test.ts.
+ */
+describe('hierarchy audit repository integration', (): void => {
+  let dataDir: string;
+  let handle: DbHandle;
+  let moduleRef: TestingModule;
+  let repo: HierarchyAuditRepository;
+
+  const input = (
+    overrides: Partial<AppendHierarchyEventInput> = {},
+  ): AppendHierarchyEventInput => ({
+    actorId: 'user-actor',
+    verb: 'create',
+    targetKind: 'company',
+    targetId: randomUUID(),
+    targetSnapshot: { id: 'x', slug: 'x', name: 'x', parentChain: [] },
+    correlationId: 'corr-1',
+    idempotencyKey: `key-${randomUUID()}`,
+    ...overrides,
+  });
+
+  beforeAll(async (): Promise<void> => {
+    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-hierarchy-audit-'));
+    handle = createPgliteDb(dataDir);
+    await runPgliteMigrations(handle);
+    moduleRef = await Test.createTestingModule({
+      providers: [HierarchyAuditRepository, { provide: DB, useValue: handle.db }],
+    }).compile();
+    repo = moduleRef.get(HierarchyAuditRepository);
+  });
+
+  afterAll(async (): Promise<void> => {
+    await moduleRef.close();
+    await handle.close();
+    await rm(dataDir, { recursive: true, force: true });
+  });
+
+  it('commits state, event, and outbox record atomically in one transaction', async () => {
+    const companyId = randomUUID();
+    const key = `key-${randomUUID()}`;
+    await handle.db.transaction(async (tx) => {
+      await tx.insert(companies).values({ id: companyId, name: 'Atomic Co', slug: 'atomic-co' });
+      const snapshot = await repo.snapshot(tx, 'company', companyId);
+      const result = await repo.append(tx, {
+        ...input({ targetId: companyId, idempotencyKey: key }),
+        targetSnapshot: { ...snapshot },
+      });
+      expect(result.replayed).toBe(false);
+      expect(result.event.idempotencyKey).toBe(key);
+    });
+    const events = await handle.db
+      .select()
+      .from(hierarchyAuditEvents)
+      .where(eq(hierarchyAuditEvents.idempotencyKey, key));
+    expect(events).toHaveLength(1);
+    const outbox = await handle.db
+      .select()
+      .from(hierarchyOutbox)
+      .where(eq(hierarchyOutbox.eventId, events[0]!.id));
+    expect(outbox).toHaveLength(1);
+    expect(outbox[0]).toMatchObject({
+      status: 'pending',
+      idempotencyKey: key,
+      correlationId: 'corr-1',
+    });
+  });
+
+  it('a rolled-back transaction leaves no state, no event, and no outbox record', async () => {
+    const companyId = randomUUID();
+    const key = `key-${randomUUID()}`;
+    await expect(
+      handle.db.transaction(async (tx) => {
+        await tx.insert(companies).values({ id: companyId, name: 'Doomed Co', slug: 'doomed-co' });
+        await repo.append(tx, input({ targetId: companyId, idempotencyKey: key }));
+        throw new Error('deliberate rollback');
+      }),
+    ).rejects.toThrow('deliberate rollback');
+    const [companyRows, eventRows, outboxRows] = await Promise.all([
+      handle.db.select().from(companies).where(eq(companies.id, companyId)),
+      handle.db
+        .select()
+        .from(hierarchyAuditEvents)
+        .where(eq(hierarchyAuditEvents.idempotencyKey, key)),
+      handle.db.select().from(hierarchyOutbox).where(eq(hierarchyOutbox.idempotencyKey, key)),
+    ]);
+    expect(companyRows).toHaveLength(0);
+    expect(eventRows).toHaveLength(0);
+    expect(outboxRows).toHaveLength(0);
+  });
+
+  it('replays a duplicate idempotency key without inserting a second event or outbox record', async () => {
+    const first = input();
+    const original = await handle.db.transaction(async (tx) => repo.append(tx, first));
+    const replay = await handle.db.transaction(async (tx) => repo.append(tx, first));
+    expect(original.replayed).toBe(false);
+    expect(replay.replayed).toBe(true);
+    expect(replay.event.id).toBe(original.event.id);
+    const outbox = await handle.db
+      .select()
+      .from(hierarchyOutbox)
+      .where(eq(hierarchyOutbox.eventId, original.event.id));
+    expect(outbox).toHaveLength(1);
+  });
+
+  it('throws on a duplicate idempotency key carrying different event content', async () => {
+    const first = input();
+    await handle.db.transaction(async (tx) => repo.append(tx, first));
+    await expect(
+      handle.db.transaction(async (tx) =>
+        repo.append(tx, { ...first, verb: 'rename', targetId: randomUUID() }),
+      ),
+    ).rejects.toThrow(HierarchyAuditIdempotencyConflictError);
+  });
+
+  it('throws on a duplicate idempotency key whose transfer destination differs', async () => {
+    const from = { kind: 'company' as const, id: randomUUID(), slug: 'src-co' };
+    const to = { kind: 'company' as const, id: randomUUID(), slug: 'dst-co' };
+    const first = input({
+      verb: 'transfer',
+      targetKind: 'estate',
+      transferFrom: from,
+      transferTo: to,
+    });
+    const original = await handle.db.transaction(async (tx) => repo.append(tx, first));
+    expect(original.replayed).toBe(false);
+    // Identical retry replays; a retry re-routed to a different destination must conflict.
+    const replay = await handle.db.transaction(async (tx) => repo.append(tx, first));
+    expect(replay.replayed).toBe(true);
+    await expect(
+      handle.db.transaction(async (tx) =>
+        repo.append(tx, { ...first, transferTo: { ...to, id: randomUUID() } }),
+      ),
+    ).rejects.toThrow(HierarchyAuditIdempotencyConflictError);
+  });
+
+  it('builds root-first parent chains and rejects unknown nodes', async () => {
+    const companyId = randomUUID();
+    const estateId = randomUUID();
+    const projectId = randomUUID();
+    await handle.db.transaction(async (tx) => {
+      await tx.insert(companies).values({ id: companyId, name: 'Chain Co', slug: 'chain-co' });
+      await tx
+        .insert(estates)
+        .values({ id: estateId, name: 'Chain Estate', slug: 'chain-estate', companyId });
+      await tx
+        .insert(platformProjects)
+        .values({ id: projectId, name: 'Chain Project', slug: 'chain-project', estateId });
+    });
+    const snapshot = await repo.snapshot(handle.db, 'platform_project', projectId);
+    expect(snapshot).toMatchObject({ id: projectId, slug: 'chain-project', name: 'Chain Project' });
+    expect(snapshot.parentChain).toEqual([
+      { kind: 'company', id: companyId, slug: 'chain-co' },
+      { kind: 'estate', id: estateId, slug: 'chain-estate' },
+    ]);
+    await expect(repo.snapshot(handle.db, 'estate', randomUUID())).rejects.toThrow(
+      HierarchyNodeNotFoundError,
+    );
+  });
+
+  it('keeps events readable, in per-target seq order, after the target row is deleted', async () => {
+    const companyId = randomUUID();
+    await handle.db.transaction(async (tx) => {
+      await tx.insert(companies).values({ id: companyId, name: 'Mortal Co', slug: 'mortal-co' });
+      const snapshot = await repo.snapshot(tx, 'company', companyId);
+      await repo.append(tx, input({ targetId: companyId, targetSnapshot: { ...snapshot } }));
+    });
+    await handle.db.transaction(async (tx) => {
+      const snapshot = await repo.snapshot(tx, 'company', companyId);
+      await repo.append(tx, {
+        ...input({ verb: 'delete', targetId: companyId }),
+        targetSnapshot: { ...snapshot },
+      });
+      await tx.delete(companies).where(eq(companies.id, companyId));
+    });
+    const events = await repo.eventsForTarget(companyId);
+    expect(events.map((e) => e.verb)).toEqual(['create', 'delete']);
+    expect(events[1]!.seq).toBeGreaterThan(events[0]!.seq);
+    expect((events[1]!.targetSnapshot as { id: string }).id).toBe(companyId);
+  });
+
+  it('claims the oldest pending outbox record exactly once, completes and releases by CAS', async () => {
+    // Drain records left pending by earlier cases so ordering is deterministic.
+    for (;;) {
+      const drained = await repo.claimPendingOutbox();
+      if (!drained) break;
+      await repo.completeOutbox(drained.id);
+    }
+    const older = await handle.db.transaction(async (tx) => repo.append(tx, input()));
+    const newer = await handle.db.transaction(async (tx) => repo.append(tx, input()));
+
+    const claimed = await repo.claimPendingOutbox();
+    expect(claimed).not.toBeNull();
+    expect(claimed!.eventId).toBe(older.event.id);
+    expect(claimed!.status).toBe('processing');
+
+    // Delivery fails: release returns it to pending and it is claimable again.
+    await repo.releaseOutbox(claimed!.id);
+    const reclaimed = await repo.claimPendingOutbox();
+    expect(reclaimed!.id).toBe(claimed!.id);
+
+    await repo.completeOutbox(reclaimed!.id);
+    const done = await handle.db
+      .select()
+      .from(hierarchyOutbox)
+      .where(eq(hierarchyOutbox.id, reclaimed!.id));
+    expect(done[0]!.status).toBe('delivered');
+    expect(done[0]!.deliveredAt).not.toBeNull();
+    // completeOutbox is CAS-guarded on 'processing': completing again is a no-op.
+    await repo.completeOutbox(reclaimed!.id);
+
+    const second = await repo.claimPendingOutbox();
+    expect(second!.eventId).toBe(newer.event.id);
+    await repo.completeOutbox(second!.id);
+    expect(await repo.claimPendingOutbox()).toBeNull();
+  });
+});

apps/gateway/src/hierarchy/hierarchy-audit.repository.ts

@@ -0,0 +1,274 @@
+import { Inject, Injectable } from '@nestjs/common';
+import {
+  and,
+  asc,
+  companies,
+  eq,
+  estates,
+  hierarchyAuditEvents,
+  hierarchyOutbox,
+  platformProjects,
+  type Db,
+  type HIERARCHY_AUDIT_TARGET_KINDS,
+  type HIERARCHY_AUDIT_VERBS,
+} from '@mosaicstack/db';
+import { DB } from '../database/database.module.js';
+
+/**
+ * Hierarchy audit event + outbox machinery (contract 1 §5.2).
+ *
+ * Every hierarchy mutation writes its semantic audit event AND the event's
+ * outbox record on the caller's transaction, so state, event, and outbox
+ * commit or roll back together. Events reference their target by an
+ * immutable snapshot (id, slug, parent chain at event time), never by a
+ * foreign key into the class tables — append-only events survive the
+ * deletion of their target. This module exposes no update or delete path
+ * for events: append-only is a property of the code surface, witnessed by
+ * the integration tests.
+ *
+ * This is NOT a class-table writer: it touches only the audit/outbox
+ * tables, so it does not appear on the writer-coverage allowlist. The
+ * hierarchy command repositories (M4-1b-ii) are the allowlisted writers and
+ * call into this on their own transactions.
+ */
+
+export type HierarchyAuditVerb = (typeof HIERARCHY_AUDIT_VERBS)[number];
+export type HierarchyTargetKind = (typeof HIERARCHY_AUDIT_TARGET_KINDS)[number];
+export type HierarchyNodeKind = Exclude<HierarchyTargetKind, 'grant'>;
+
+export interface ParentChainEntry {
+  readonly kind: HierarchyNodeKind;
+  readonly id: string;
+  readonly slug: string;
+}
+
+/** Immutable node snapshot at event time; parentChain is root-first. */
+export interface HierarchyNodeSnapshot {
+  readonly id: string;
+  readonly slug: string;
+  readonly name: string;
+  readonly parentChain: readonly ParentChainEntry[];
+}
+
+export interface AppendHierarchyEventInput {
+  readonly actorId: string;
+  readonly verb: HierarchyAuditVerb;
+  readonly targetKind: HierarchyTargetKind;
+  readonly targetId: string;
+  /** Node events: HierarchyNodeSnapshot. Grant events: subject/target/role snapshot (contract 2 §4.4). */
+  readonly targetSnapshot: Record<string, unknown>;
+  /** Present exactly on transfers (CHECK-enforced): source/destination parent { kind, id, slug }. */
+  readonly transferFrom?: ParentChainEntry;
+  readonly transferTo?: ParentChainEntry;
+  readonly correlationId: string;
+  /** Prior event in the causal chain (e.g. the delete event causing cascaded grant_revoke events). */
+  readonly causationId?: string;
+  readonly idempotencyKey: string;
+}
+
+export type HierarchyAuditEventRow = typeof hierarchyAuditEvents.$inferSelect;
+export type HierarchyOutboxRow = typeof hierarchyOutbox.$inferSelect;
+
+export interface AppendHierarchyEventResult {
+  readonly event: HierarchyAuditEventRow;
+  /** True when the idempotency key had already committed an identical event (REQ-AUD-001 duplicate suppression). */
+  readonly replayed: boolean;
+}
+
+type Tx = Pick<Db, 'insert' | 'select'>;
+
+export class HierarchyAuditIdempotencyConflictError extends Error {
+  constructor(idempotencyKey: string) {
+    super(
+      `hierarchy audit idempotency key ${idempotencyKey} already exists with different event content`,
+    );
+    this.name = 'HierarchyAuditIdempotencyConflictError';
+  }
+}
+
+export class HierarchyNodeNotFoundError extends Error {
+  constructor(kind: HierarchyNodeKind, id: string) {
+    super(`hierarchy node not found: ${kind} ${id}`);
+    this.name = 'HierarchyNodeNotFoundError';
+  }
+}
+
+/**
+ * Append one audit event and its outbox record on the caller's transaction.
+ * A duplicate idempotency key with identical semantic content returns the
+ * prior event (replayed: true) without inserting anything; a duplicate key
+ * with different content throws.
+ */
+export async function appendHierarchyEvent(
+  tx: Tx,
+  input: AppendHierarchyEventInput,
+): Promise<AppendHierarchyEventResult> {
+  const inserted = await tx
+    .insert(hierarchyAuditEvents)
+    .values({
+      actorId: input.actorId,
+      verb: input.verb,
+      targetKind: input.targetKind,
+      targetId: input.targetId,
+      targetSnapshot: input.targetSnapshot,
+      transferFrom: input.transferFrom ?? null,
+      transferTo: input.transferTo ?? null,
+      correlationId: input.correlationId,
+      causationId: input.causationId ?? null,
+      idempotencyKey: input.idempotencyKey,
+    })
+    .onConflictDoNothing()
+    .returning();
+  const event = inserted[0];
+  if (event) {
+    await tx.insert(hierarchyOutbox).values({
+      eventId: event.id,
+      idempotencyKey: input.idempotencyKey,
+      correlationId: input.correlationId,
+    });
+    return { event, replayed: false };
+  }
+
+  const prior = await tx
+    .select()
+    .from(hierarchyAuditEvents)
+    .where(eq(hierarchyAuditEvents.idempotencyKey, input.idempotencyKey))
+    .limit(1);
+  const existing = prior[0];
+  if (!existing || !sameEvent(existing, input)) {
+    throw new HierarchyAuditIdempotencyConflictError(input.idempotencyKey);
+  }
+  // Event and outbox committed atomically the first time, so the outbox
+  // record already exists; a replay inserts nothing.
+  return { event: existing, replayed: true };
+}
+
+/** Key-order-independent serialization: jsonb does not preserve key order. */
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  if (value !== null && typeof value === 'object') {
+    const record = value as Record<string, unknown>;
+    const body = Object.keys(record)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`)
+      .join(',');
+    return `{${body}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function sameEvent(row: HierarchyAuditEventRow, input: AppendHierarchyEventInput): boolean {
+  return (
+    row.actorId === input.actorId &&
+    row.verb === input.verb &&
+    row.targetKind === input.targetKind &&
+    row.targetId === input.targetId &&
+    row.correlationId === input.correlationId &&
+    (row.causationId ?? null) === (input.causationId ?? null) &&
+    canonicalJson(row.targetSnapshot) === canonicalJson(input.targetSnapshot) &&
+    // Transfer source/destination are semantic content (§5.2): a retry with a
+    // different destination must conflict, never silently replay.
+    canonicalJson(row.transferFrom ?? null) === canonicalJson(input.transferFrom ?? null) &&
+    canonicalJson(row.transferTo ?? null) === canonicalJson(input.transferTo ?? null)
+  );
+}
+
+/**
+ * Build the immutable snapshot for a node: its row plus the parent chain up
+ * to the company root, root-first, read on the caller's transaction so the
+ * snapshot is consistent with the mutation it audits.
+ */
+export async function buildNodeSnapshot(
+  tx: Tx,
+  kind: HierarchyNodeKind,
+  id: string,
+): Promise<HierarchyNodeSnapshot> {
+  if (kind === 'company') {
+    const rows = await tx.select().from(companies).where(eq(companies.id, id)).limit(1);
+    const row = rows[0];
+    if (!row) throw new HierarchyNodeNotFoundError(kind, id);
+    return { id: row.id, slug: row.slug, name: row.name, parentChain: [] };
+  }
+  if (kind === 'estate') {
+    const rows = await tx.select().from(estates).where(eq(estates.id, id)).limit(1);
+    const row = rows[0];
+    if (!row) throw new HierarchyNodeNotFoundError(kind, id);
+    const parent = await buildNodeSnapshot(tx, 'company', row.companyId);
+    return {
+      id: row.id,
+      slug: row.slug,
+      name: row.name,
+      parentChain: [...parent.parentChain, { kind: 'company', id: parent.id, slug: parent.slug }],
+    };
+  }
+  const rows = await tx.select().from(platformProjects).where(eq(platformProjects.id, id)).limit(1);
+  const row = rows[0];
+  if (!row) throw new HierarchyNodeNotFoundError(kind, id);
+  const parent = await buildNodeSnapshot(tx, 'estate', row.estateId);
+  return {
+    id: row.id,
+    slug: row.slug,
+    name: row.name,
+    parentChain: [...parent.parentChain, { kind: 'estate', id: parent.id, slug: parent.slug }],
+  };
+}
+
+@Injectable()
+export class HierarchyAuditRepository {
+  constructor(@Inject(DB) private readonly db: Db) {}
+
+  /** Compose an event+outbox append into a caller-owned transaction. */
+  append(tx: Tx, input: AppendHierarchyEventInput): Promise<AppendHierarchyEventResult> {
+    return appendHierarchyEvent(tx, input);
+  }
+
+  snapshot(tx: Tx, kind: HierarchyNodeKind, id: string): Promise<HierarchyNodeSnapshot> {
+    return buildNodeSnapshot(tx, kind, id);
+  }
+
+  /** Per-target ordered event history (REQ-AUD-001 per-target ordering; read-only). */
+  async eventsForTarget(targetId: string): Promise<HierarchyAuditEventRow[]> {
+    return this.db
+      .select()
+      .from(hierarchyAuditEvents)
+      .where(eq(hierarchyAuditEvents.targetId, targetId))
+      .orderBy(asc(hierarchyAuditEvents.seq));
+  }
+
+  /**
+   * Claim the oldest pending outbox record (claim-by-CAS: the UPDATE is
+   * guarded on status so a lost race returns null and the caller retries).
+   */
+  async claimPendingOutbox(): Promise<HierarchyOutboxRow | null> {
+    const candidates = await this.db
+      .select()
+      .from(hierarchyOutbox)
+      .where(eq(hierarchyOutbox.status, 'pending'))
+      .orderBy(asc(hierarchyOutbox.createdAt))
+      .limit(1);
+    const candidate = candidates[0];
+    if (!candidate) return null;
+    const claimed = await this.db
+      .update(hierarchyOutbox)
+      .set({ status: 'processing', updatedAt: new Date() })
+      .where(and(eq(hierarchyOutbox.id, candidate.id), eq(hierarchyOutbox.status, 'pending')))
+      .returning();
+    return claimed[0] ?? null;
+  }
+
+  async completeOutbox(id: string): Promise<void> {
+    const now = new Date();
+    await this.db
+      .update(hierarchyOutbox)
+      .set({ status: 'delivered', deliveredAt: now, updatedAt: now })
+      .where(and(eq(hierarchyOutbox.id, id), eq(hierarchyOutbox.status, 'processing')));
+  }
+
+  /** Return a claimed record to pending (delivery failed; it stays replayable). */
+  async releaseOutbox(id: string): Promise<void> {
+    await this.db
+      .update(hierarchyOutbox)
+      .set({ status: 'pending', updatedAt: new Date() })
+      .where(and(eq(hierarchyOutbox.id, id), eq(hierarchyOutbox.status, 'processing')));
+  }
+}

apps/gateway/src/hierarchy/hierarchy.module.ts

@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { HierarchyAuditRepository } from './hierarchy-audit.repository.js';
+
+/**
+ * Hierarchy (tenancy/authorization structure) feature module.
+ *
+ * M4-1b-i ships the audit event + outbox machinery only (contract 1 §5.2).
+ * The hierarchy command family — controllers, DTOs, and the allowlisted
+ * class-table repositories — lands in M4-1b-ii once contract 2 (RBAC grant
+ * model) merges; until then this module exposes no routes, which the
+ * route-inventory witness asserts.
+ */
+@Module({
+  providers: [HierarchyAuditRepository],
+  exports: [HierarchyAuditRepository],
+})
+export class HierarchyModule {}

apps/gateway/src/main.spec.ts

@@ -0,0 +1,164 @@
+import 'reflect-metadata';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import * as nodeOs from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import * as nodeUrl from 'node:url';
+import type { MosaicConfig } from '@mosaicstack/config';
+import type * as MosaicStorage from '@mosaicstack/storage';
+import { describe, expect, it, vi, type MockInstance } from 'vitest';
+
+// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
+const MODULE_IMPORT_TIMEOUT_MS = 120_000;
+
+function snapshotProcessEnv(): Record<string, string | undefined> {
+  return { ...process.env };
+}
+
+function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
+  for (const key of Object.keys(process.env)) {
+    if (!(key in snapshot)) {
+      delete process.env[key];
+    }
+  }
+
+  for (const [key, value] of Object.entries(snapshot)) {
+    if (value === undefined) {
+      delete process.env[key];
+      continue;
+    }
+
+    process.env[key] = value;
+  }
+}
+
+function expectPathUnderTempRoot(path: string, tempRoot: string): void {
+  const relativePath = relative(tempRoot, path);
+  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
+    true,
+  );
+}
+
+async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
+  expectPathUnderTempRoot(path, tempRoot);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, contents, 'utf8');
+}
+
+interface BootstrapPreflightResult {
+  capturedConfig: MosaicConfig | undefined;
+}
+
+async function runBootstrapPreflight(
+  anchoredConfigContents: string,
+  ambientConfigContents: string,
+): Promise<BootstrapPreflightResult> {
+  const originalEnv = snapshotProcessEnv();
+  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-main-preflight-'));
+  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
+  let exitSpy: MockInstance<typeof process.exit> | undefined;
+  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
+  let capturedConfig: MosaicConfig | undefined;
+
+  try {
+    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
+    const homePath = join(tempRoot, 'home');
+    const cwdPath = join(tempRoot, 'ambient', 'cwd');
+    const monorepoRootConfigPath = resolve(anchor, '../../..', 'mosaic.config.json');
+
+    await mkdir(anchor, { recursive: true });
+    await mkdir(cwdPath, { recursive: true });
+
+    await writeFixture(monorepoRootConfigPath, anchoredConfigContents, tempRoot);
+    await writeFixture(join(cwdPath, 'mosaic.config.json'), ambientConfigContents, tempRoot);
+
+    process.env['HOME'] = homePath;
+    process.env['BETTER_AUTH_SECRET'] = 'fixture-secret';
+    delete process.env['MOSAIC_STORAGE_TIER'];
+    delete process.env['DATABASE_URL'];
+    delete process.env['VALKEY_URL'];
+
+    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
+    const exitMock = vi.fn<typeof process.exit>();
+    exitSpy = vi.spyOn(process, 'exit').mockImplementation(exitMock);
+
+    vi.resetModules();
+    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
+    vi.doMock('node:url', () => ({
+      ...nodeUrl,
+      fileURLToPath: (url: string | URL): string => {
+        const actualPath = nodeUrl.fileURLToPath(url);
+        if (
+          actualPath.endsWith('/apps/gateway/src/env.ts') ||
+          actualPath.endsWith('/apps/gateway/src/env.js')
+        ) {
+          return join(anchor, 'env.ts');
+        }
+        return actualPath;
+      },
+    }));
+    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
+    vi.doMock('./tracing.js', () => ({}));
+
+    const preflightSentinel = new Error('preflight-capture-sentinel');
+    vi.doMock('@mosaicstack/storage', async () => {
+      const actual = await vi.importActual<typeof MosaicStorage>('@mosaicstack/storage');
+      return {
+        ...actual,
+        detectAndAssertTier: vi.fn((config: MosaicConfig): Promise<void> => {
+          capturedConfig = config;
+          throw preflightSentinel;
+        }),
+      };
+    });
+
+    await import('./main.js');
+    await vi.waitFor((): void => {
+      expect(exitSpy).toHaveBeenCalled();
+    });
+
+    return { capturedConfig };
+  } finally {
+    cwdSpy?.mockRestore();
+    exitSpy?.mockRestore();
+    consoleInfoSpy?.mockRestore();
+    vi.doUnmock('@mosaicstack/storage');
+    vi.doUnmock('./tracing.js');
+    vi.doUnmock('node:url');
+    vi.doUnmock('node:os');
+    vi.resetModules();
+    restoreProcessEnv(originalEnv);
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+}
+
+describe('main bootstrap preflight config anchoring', (): void => {
+  it(
+    'passes the anchored monorepo-root config to detectAndAssertTier, not an ambient cwd config',
+    async (): Promise<void> => {
+      const anchoredConfig = JSON.stringify({
+        tier: 'local',
+        storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
+        queue: { type: 'local', dataDir: '.mosaic/queue' },
+        memory: { type: 'keyword' },
+      });
+      const ambientConfig = JSON.stringify({
+        tier: 'federated',
+        storage: {
+          type: 'postgres',
+          url: 'postgresql://ambient-attacker.invalid/mosaic',
+          enableVector: true,
+        },
+        queue: { type: 'bullmq' },
+        memory: { type: 'pgvector' },
+      });
+
+      const { capturedConfig } = await runBootstrapPreflight(anchoredConfig, ambientConfig);
+
+      expect(capturedConfig?.tier).toBe('local');
+      expect(capturedConfig?.storage).not.toEqual(
+        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
+      );
+    },
+    MODULE_IMPORT_TIMEOUT_MS,
+  );
+});

apps/gateway/src/main.ts

@@ -1,18 +1,5 @@
 #!/usr/bin/env node
-import { config } from 'dotenv';
-import { existsSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { homedir } from 'node:os';
-
-// Load .env from daemon config dir (global install / daemon mode).
-// Loaded first so monorepo .env can override for local dev.
-const daemonEnv = join(homedir(), '.config', 'mosaic', 'gateway', '.env');
-if (existsSync(daemonEnv)) config({ path: daemonEnv });
-
-// Load .env from monorepo root (cwd is apps/gateway when run via pnpm filter)
-config({ path: resolve(process.cwd(), '../../.env') });
-config(); // Also load apps/gateway/.env if present (overrides)
-
+import './env.js';
 import './tracing.js';
 import 'reflect-metadata';
 import { NestFactory } from '@nestjs/core';
@@ -25,11 +12,19 @@ import { AppModule } from './app.module.js';
 import { mountAuthHandler } from './auth/auth.controller.js';
 import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
+import { mountSpaStatic } from './spa/serve-spa.js';
 import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';
+import { resolveGatewayConfigPath } from './env.js';
+import { assertValidationPipeSeesDtoDecorators } from './validation-pipe-check.js';
 
 async function bootstrap(): Promise<void> {
   const logger = new Logger('Bootstrap');
 
+  // Fail loud BEFORE anything else if the global ValidationPipe cannot see
+  // the guarded DTOs' decorated properties (#1391): a broken metatype turns
+  // every request body into a 400 at first use; this surfaces it at boot.
+  assertValidationPipeSeesDtoDecorators();
+
   if (!process.env['BETTER_AUTH_SECRET']) {
     throw new Error('BETTER_AUTH_SECRET is required');
   }
@@ -37,7 +32,7 @@ async function bootstrap(): Promise<void> {
   // Pre-flight: assert all external services required by the configured tier
   // are reachable. Runs before NestFactory.create() so failures are visible
   // immediately with actionable remediation hints.
-  const mosaicConfig = loadConfig();
+  const mosaicConfig = loadConfig(resolveGatewayConfigPath());
   try {
     await detectAndAssertTier(mosaicConfig);
   } catch (err) {
@@ -74,6 +69,7 @@ async function bootstrap(): Promise<void> {
 
   mountAuthHandler(app);
   mountMcpHandler(app, app.get(McpService));
+  await mountSpaStatic(app);
 
   const port = Number(process.env['GATEWAY_PORT'] ?? 14242);
   await app.listen(port, '0.0.0.0');

apps/gateway/src/plugin/discord-ingress.security.spec.ts

@@ -12,6 +12,10 @@ import { RuntimeProviderService } from '../agent/runtime-provider-registry.servi
 import { ChatGateway } from '../chat/chat.gateway.js';
 import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { validateDiscordServiceToken } from '../chat/chat.gateway-auth.js';
+import { ChatRuntimeRouter } from '../chat/chat-runtime-router.js';
+import { EmbeddedChatRuntime } from '../chat/embedded-chat.runtime.js';
+import { HarnessChatRuntime } from '../chat/harness-chat.runtime.js';
+import { HarnessRegistry } from '../harness/harness.registry.js';
 import { DiscordReplayProtector } from './discord-replay-protector.js';
 
 const SERVICE_TOKEN = 'test-service-token';
@@ -25,6 +29,7 @@ const ENV_KEYS = [
   'DISCORD_ALLOWED_USER_IDS',
   'MOSAIC_AGENT_NAME',
   'MOSAIC_AGENT_CONFIG_ID',
+  'CHAT_HARNESS_RUNTIME',
 ] as const;
 const savedEnv = new Map<string, string | undefined>();
 
@@ -150,6 +155,57 @@ function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordI
   };
 }
 
+/**
+ * Task 5 fence (C): the Discord SEND path runs through the exclusive {@link ChatRuntimeRouter},
+ * constructed here in `pi-rpc` mode with a fully-resolved runtime (`active` = harness). A verified
+ * Discord *service* turn must nonetheless execute on the {@link EmbeddedChatRuntime} — never the
+ * harness, never the routing engine — per the Q1/Q2 adjudication: the router owns a dedicated
+ * verified-ingress dispatch that delegates to embedded regardless of mode, with zero harness
+ * fallback. The gateway is given the router in the former direct-`AgentService` constructor slot.
+ *
+ * RED today: production still reads that slot as a bare `AgentService`, so `this.agentService`
+ * resolves to the router, `getSession(...)` is not a function, the send path throws and is caught
+ * (an `error` is emitted and the handler returns) BEFORE it ever reaches the embedded runtime. The
+ * failure is behavioural wiring — collection, DI, and `onModuleInit` all succeed. GREEN re-routes
+ * the verified Discord dispatch through the router into the embedded runtime, satisfying the
+ * preserved create/prompt assertions without weakening any control. `harnessConversations.append`
+ * proves the harness path is never touched even though the pi-rpc router resolved it as `active`.
+ *
+ * Correction #4 is proved behaviourally, not by naming an accessor: the verified-ingress dispatch
+ * is reachable only from the fully-verified `discordService` branch (the create/prompt tests below)
+ * and never from a browser-emittable socket event (the browser-forgery refusal test).
+ */
+function readyPiRpcRegistry(): HarnessRegistry {
+  const registry = new HarnessRegistry();
+  // A registered 'pi' adapter + an available (non-sentinel) conversation service let the pi-rpc
+  // router resolve `active` = harness instead of failing closed at init, so these tests model the
+  // real hostile condition — the harness runtime IS live — rather than a degraded router.
+  registry.register({ id: 'pi' } as never);
+  return registry;
+}
+
+function piRpcRouterFronting(
+  agentService: unknown,
+  harnessConversations: { append: ReturnType<typeof vi.fn> },
+): ChatRuntimeRouter {
+  const routerConversationServiceTripwire = {
+    append: () => {
+      throw new Error('router conversation service must not be resolved on the Discord path');
+    },
+  };
+  const embedded = new EmbeddedChatRuntime(agentService as never);
+  const harness = new HarnessChatRuntime(harnessConversations as never);
+  const router = new ChatRuntimeRouter(
+    readyPiRpcRegistry(),
+    routerConversationServiceTripwire as never,
+    embedded,
+    harness,
+    'pi-rpc',
+  );
+  router.onModuleInit();
+  return router;
+}
+
 describe('Discord ingress security', () => {
   it('keeps legacy role-only bindings valid while withholding privileged actor identity', () => {
     const [binding] = parseDiscordInteractionBindings(
@@ -433,6 +489,7 @@ describe('Discord ingress security', () => {
 
   it("selects each binding's trusted logical-agent config when creating Discord sessions", async () => {
     configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
     process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001,channel-002';
     process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
       {
@@ -489,8 +546,9 @@ describe('Discord ingress security', () => {
       },
     };
     const routingEngine = { resolve: vi.fn() };
+    const harnessConversations = { append: vi.fn() };
     const gateway = new ChatGateway(
-      agentService as never,
+      piRpcRouterFronting(agentService, harnessConversations) as never,
       {} as never,
       brain as never,
       {} as never,
@@ -531,6 +589,575 @@ describe('Discord ingress security', () => {
       expect.objectContaining({ agentConfigId: 'agent-config-orion' }),
     );
     expect(routingEngine.resolve).not.toHaveBeenCalled();
+    // Even though the pi-rpc router resolved the harness as `active`, verified Discord ingress must
+    // never touch it — the create path stays on the embedded runtime.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('dispatches a verified Discord SEND once and drops a byte-identical replay with zero additional dispatch/persist/ack (Task 5 G4)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-replay',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    // One fully-valid signed envelope; the replay reuses the SAME object (same messageId).
+    const envelope = ingressEnvelope('verified once', 'discord-replay-001', {
+      conversationId: 'Nova:discord:channel-001',
+    });
+
+    // First delivery: the verified-Discord SEND runs the full embedded dispatch exactly once.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // Byte-identical replay: the messageId is already claimed, so resolveDiscordIngress returns
+    // null and the SEND handler bails before dispatch/persist/ack. Every effect stays at exactly one.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    // The harness runtime is never touched on either delivery.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND that fails the configured service identity consumes no replay claim, so a corrected byte-identical retry dispatches/persists/acks exactly once and a later duplicate stays fail-closed (Task 5 item 4 — claim ordering)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-claim-ordering',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    // A single fully-valid signed envelope, reused byte-for-byte across all three deliveries.
+    const envelope = ingressEnvelope('verified once with late identity', 'discord-order-001', {
+      conversationId: 'Nova:discord:channel-001',
+    });
+
+    // (1) Configured service identity is MISSING. The envelope is validly signed and passes the
+    //     binding + route checks, but the SEND must refuse at the identity gate BEFORE any claim
+    //     or effect. If the claim fires ahead of that gate, this delivery silently burns the
+    //     replay claim for `discord-order-001` even though nothing dispatched.
+    delete process.env['DISCORD_SERVICE_USER_ID'];
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) Identity is now configured; the operator resends the SAME envelope byte-for-byte. Because
+    //     step (1) consumed no claim, this corrected retry claims once and runs the full embedded
+    //     dispatch exactly once. (Under the pre-fix ordering the claim was already spent in step (1),
+    //     so this retry is dropped as a replay and never dispatches — the RED this test drives.)
+    process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after a committed turn stays fail-closed: the claim taken in step (2)
+    //     blocks it, so every effect remains at exactly one.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND whose configured agent record fails reconciliation consumes no replay claim, so a corrected byte-identical retry dispatches/persists/acks exactly once (Task 5 finding 3)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    // The durable agent record does not reconcile on the first delivery (its name no longer matches
+    // the verified binding's instance id), then reconciles cleanly on the corrected retry.
+    const findAgent = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'agent-config-nova', name: 'Renamed-Away' })
+      .mockResolvedValue({ id: 'agent-config-nova', name: 'Nova' });
+    const brain = {
+      agents: { findById: findAgent },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-reconcile',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    const envelope = ingressEnvelope(
+      'verified once with stale agent record',
+      'discord-reconcile-001',
+      {
+        conversationId: 'Nova:discord:channel-001',
+      },
+    );
+
+    // (1) The configured-agent reconcile runs BEFORE the replay claim. A mismatch refuses the turn
+    //     and, crucially, consumes no claim for discord-reconcile-001 — nothing dispatches.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) The record now reconciles; because step (1) took no claim, this byte-identical retry claims
+    //     once and runs the full embedded dispatch exactly once. (Pre-fix, the claim was spent ahead
+    //     of the reconcile in step (1), so this retry was dropped as a replay — the RED this drives.)
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after the committed turn stays fail-closed.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND refuses to reuse a same-scope embedded session minted under a different configured identity, with zero prompt/persist/ack (Task 5 finding 3)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    // A live session already exists for this conversation/scope, but it was minted under a DIFFERENT
+    // configured agent (Orion). The verified binding reconciles to Nova, so reusing this session would
+    // execute one agent's turn under another agent's verified label — the reuse guard must refuse it.
+    const foreignIdentitySession = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-orion',
+      agentName: 'Orion',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const createSession = vi.fn().mockResolvedValue(foreignIdentitySession);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(foreignIdentitySession),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-identity-swap',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('reuse under a different identity', 'discord-identity-swap-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    // Refused at the embedded reuse guard: no prompt, no persist, no ack — only a typed refusal.
+    expect(prompt).not.toHaveBeenCalled();
+    expect(addMessage).not.toHaveBeenCalled();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(client.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: 'Nova:discord:channel-001' }),
+    );
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND whose configured agent record resolves under a different id fails reconciliation, consumes no replay claim, and a corrected byte-identical retry dispatches/persists/acks exactly once (Task 5 finding 3 — id axis)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    const session = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const createSession = vi.fn().mockResolvedValue(session);
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    // The name matches the verified binding, but the record's own id is a DIFFERENT agent config —
+    // an aliased/substituted lookup. Exact-id reconciliation must refuse it on the first delivery,
+    // then admit the corrected record whose id matches the binding.
+    const findAgent = vi
+      .fn()
+      .mockResolvedValueOnce({ id: 'agent-config-elsewhere', name: 'Nova' })
+      .mockResolvedValue({ id: 'agent-config-nova', name: 'Nova' });
+    const brain = {
+      agents: { findById: findAgent },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-reconcile-id',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+    const ackCount = (): number =>
+      client.emit.mock.calls.filter((call) => call[0] === 'message:ack').length;
+
+    const envelope = ingressEnvelope(
+      'verified once with aliased agent id',
+      'discord-reconcile-id-001',
+      {
+        conversationId: 'Nova:discord:channel-001',
+      },
+    );
+
+    // (1) The record's id differs from the binding's agentConfigId. Exact-id reconcile refuses the
+    //     turn BEFORE the replay claim, so nothing dispatches and the claim stays available.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(0);
+    expect(prompt).toHaveBeenCalledTimes(0);
+    expect(addMessage).toHaveBeenCalledTimes(0);
+    expect(ackCount()).toBe(0);
+
+    // (2) The record now reconciles on both id and name; because step (1) took no claim, this
+    //     byte-identical retry claims once and runs the full embedded dispatch exactly once.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+
+    // (3) A genuine duplicate after the committed turn stays fail-closed.
+    await gateway.handleMessage(client as never, envelope);
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).toHaveBeenCalledTimes(1);
+    expect(addMessage).toHaveBeenCalledTimes(1);
+    expect(ackCount()).toBe(1);
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('a verified SEND refuses a freshly minted same-scope session whose identity differs from the reconciled configured agent, with zero prompt/persist/ack (Task 5 finding 3 — post-create)', async () => {
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
+    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
+      {
+        instanceId: 'Nova',
+        agentConfigId: 'agent-config-nova',
+        guildId: 'guild-001',
+        channelId: 'channel-001',
+        pairedUsers: {
+          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
+        },
+      },
+    ]);
+    // No live session exists for this scope, so the runtime MINTS one — but createSession returns a
+    // session carrying a DIFFERENT configured identity (Orion) than the reconciled binding (Nova).
+    // The post-create identity recheck must refuse it rather than dispatch one agent's turn under
+    // another agent's verified label. (The existing reuse test covers the getSession path; this
+    // covers the createSession path scrappy flagged as unvalidated.)
+    const mintedForeignSession = {
+      provider: 'configured-provider',
+      modelId: 'configured-model',
+      agentConfigId: 'agent-config-orion',
+      agentName: 'Orion',
+      piSession: {
+        thinkingLevel: 'medium',
+        getAvailableThinkingLevels: (): string[] => ['medium'],
+      },
+    };
+    const prompt = vi.fn().mockResolvedValue(undefined);
+    const createSession = vi.fn().mockResolvedValue(mintedForeignSession);
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession,
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      removeChannel: vi.fn(),
+      prompt,
+    };
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
+    const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
+      conversations: {
+        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
+        findMessages: vi.fn().mockResolvedValue([]),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        addMessage,
+      },
+    };
+    const harnessConversations = { append: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      brain as never,
+      {} as never,
+      {} as never,
+      { resolve: vi.fn() } as never,
+    );
+    const client = {
+      id: 'discord-client-postcreate-mismatch',
+      data: { discordService: true },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('mint under a different identity', 'discord-postcreate-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    // The freshly minted session failed the post-create identity recheck: refused with a typed
+    // error, no prompt, no persist, no ack.
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(prompt).not.toHaveBeenCalled();
+    expect(addMessage).not.toHaveBeenCalled();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(client.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: 'Nova:discord:channel-001' }),
+    );
+    expect(harnessConversations.append).not.toHaveBeenCalled();
   });
 
   it('retains validated persisted attachments in resumed conversation history', async () => {
@@ -593,11 +1220,16 @@ describe('Discord ingress security', () => {
 
   it('preserves authenticated attachment metadata through persistence and agent dispatch', async () => {
     configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
     const prompt = vi.fn().mockResolvedValue(undefined);
-    const addMessage = vi.fn().mockResolvedValue(undefined);
+    const addMessage = vi.fn().mockResolvedValue({ id: 'discord-persisted-message' });
     const session = {
       provider: 'test-provider',
       modelId: 'test-model',
+      // The reused embedded session carries the SAME reconciled identity as the verified binding,
+      // so the finding-3 session-reuse guard admits it rather than refusing an identity swap.
+      agentConfigId: 'agent-config-nova',
+      agentName: 'Nova',
       piSession: {
         thinkingLevel: 'medium',
         getAvailableThinkingLevels: (): string[] => ['medium'],
@@ -611,6 +1243,7 @@ describe('Discord ingress security', () => {
       prompt,
     };
     const brain = {
+      agents: { findById: vi.fn((id: string) => Promise.resolve({ id, name: 'Nova' })) },
       conversations: {
         findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
         create: vi.fn().mockResolvedValue(undefined),
@@ -618,8 +1251,9 @@ describe('Discord ingress security', () => {
         addMessage,
       },
     };
+    const harnessConversations = { append: vi.fn() };
     const gateway = new ChatGateway(
-      agentService as never,
+      piRpcRouterFronting(agentService, harnessConversations) as never,
       {} as never,
       brain as never,
       {} as never,
@@ -667,6 +1301,66 @@ describe('Discord ingress security', () => {
       }),
       'discord-service',
     );
+    // The verified Discord prompt dispatch stays on the embedded runtime; the pi-rpc harness that
+    // the router resolved as `active` is never reached.
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+  });
+
+  it('refuses a browser-forged Discord ingress envelope in pi-rpc with a fixed typed refusal and zero dispatch', async () => {
+    // Correction #2 + #4 (behavioural). A browser socket is never `discordService` (that flag is
+    // set only on a valid service-token handshake), so it cannot forge the trusted Discord path by
+    // emitting an envelope-shaped payload. In pi-rpc it must receive a FIXED TYPED refusal
+    // (`runtime_unsupported`, the same typed code the sibling harness-fence uses) and reach neither
+    // the forced Discord service scope, the verified Discord operation, the embedded runtime, nor
+    // the harness. There is no dedicated socket event for verified ingress — the only ingress
+    // surface is the generic `message` handler, and a non-service client is refused there.
+    //
+    // RED today: a non-service client emitting an envelope-shaped payload falls to the browser
+    // branch, fails the chat-message shape check, and is dropped SILENTLY (a warn + return) with no
+    // typed refusal emitted — so the refusal assertion fails. Collection and construction succeed;
+    // the gap is behavioural. GREEN emits the fixed typed refusal before any dispatch.
+    configureDiscordEnv();
+    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
+    const agentService = {
+      getSession: vi.fn().mockReturnValue(undefined),
+      createSession: vi.fn(),
+      recordMessage: vi.fn(),
+      onEvent: vi.fn().mockReturnValue((): void => undefined),
+      addChannel: vi.fn(),
+      prompt: vi.fn().mockResolvedValue(undefined),
+    };
+    const harnessConversations = { append: vi.fn() };
+    const routingEngine = { resolve: vi.fn() };
+    const gateway = new ChatGateway(
+      piRpcRouterFronting(agentService, harnessConversations) as never,
+      {} as never,
+      { conversations: { addMessage: vi.fn().mockResolvedValue(undefined) } } as never,
+      {} as never,
+      {} as never,
+      routingEngine as never,
+    );
+    const client = {
+      id: 'browser-forging-discord',
+      data: { discordService: false },
+      emit: vi.fn(),
+    };
+
+    await gateway.handleMessage(
+      client as never,
+      ingressEnvelope('forged from a browser', 'browser-forgery-001', {
+        conversationId: 'Nova:discord:channel-001',
+      }),
+    );
+
+    const refusal = client.emit.mock.calls.find(
+      ([, payload]) => (payload as { code?: string } | undefined)?.code === 'runtime_unsupported',
+    );
+    expect(refusal).toBeDefined();
+    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
+    expect(agentService.createSession).not.toHaveBeenCalled();
+    expect(agentService.prompt).not.toHaveBeenCalled();
+    expect(harnessConversations.append).not.toHaveBeenCalled();
+    expect(routingEngine.resolve).not.toHaveBeenCalled();
   });
 
   it('accepts a thread message through its allowed bound parent channel', () => {

apps/gateway/src/reload/reload.service.spec.ts

@@ -143,6 +143,12 @@ describe('ReloadService — /reload command sanitizes plugin errors', () => {
     const mockSessionGC = { sweepOrphans: vi.fn() };
     const mockBrain = { agents: { findByName: vi.fn(), findById: vi.fn(), create: vi.fn() } };
 
+    const mockMcpClient = {
+      getServerStatuses: vi.fn(() => []),
+      getToolDefinitions: vi.fn(() => []),
+      reconnectServer: vi.fn().mockResolvedValue(undefined),
+    };
+
     const executor = new CommandExecutorService(
       registry as never,
       mockAgentService as never,
@@ -152,7 +158,8 @@ describe('ReloadService — /reload command sanitizes plugin errors', () => {
       mockBrain as never,
       reloadService,
       mockChatGateway as never,
-      null,
+      mockMcpClient as never,
+      { authorize: vi.fn().mockResolvedValue({ allowed: true }) } as never,
     );
 
     const payload: SlashCommandPayload = { command: 'reload', conversationId: 'conv-1' };

apps/gateway/src/spa/serve-spa.e2e.spec.ts

@@ -0,0 +1,192 @@
+/**
+ * E2E integration test — SPA static serving (Phase P5 cutover, #1444; tests
+ * added in P6, #1445, review follow-up SF1 on PR #1453).
+ *
+ * Boots a real Nest+Fastify app the way main.ts does (mountSpaStatic after the
+ * controllers) against a fixture dist directory, and pins the serving
+ * contract:
+ *
+ *   1. `/` and client-side deep links fall back to index.html.
+ *   2. Declared API routes win over the catch-all.
+ *   3. Unknown backend paths (/api, /mcp, /socket.io) are JSON 404s, never the
+ *      SPA page — including with a query string (`/api?x=1`).
+ *   4. Static files are served exactly; hashed /assets/ files get immutable
+ *      cache headers, everything else revalidates (max-age=0), and a missing
+ *      /assets/ file is a 404 — never the SPA fallback.
+ *   5. WEB_DIST_DIR unset disables SPA serving entirely.
+ *   6. WEB_DIST_DIR pointing at a directory without index.html fails at boot.
+ */
+
+import 'reflect-metadata';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { describe, it, expect, afterAll, beforeAll } from 'vitest';
+import { Test } from '@nestjs/testing';
+import { Controller, Get, type INestApplication } from '@nestjs/common';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import request from 'supertest';
+import { mountSpaStatic } from './serve-spa.js';
+
+const INDEX_HTML = '<!doctype html><html><body>mosaic spa fixture</body></html>\n';
+const ASSET_JS = 'console.log("hashed asset");\n';
+
+@Controller('api/spa-test')
+class SpaTestController {
+  @Get('ping')
+  ping(): { ok: boolean } {
+    return { ok: true };
+  }
+}
+
+async function createApp(): Promise<INestApplication> {
+  const moduleRef = await Test.createTestingModule({
+    controllers: [SpaTestController],
+  }).compile();
+
+  const app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
+  await app.init();
+  // Mirror main.ts ordering: SPA mounting happens after the app (and its
+  // controllers) exist, before listen.
+  await mountSpaStatic(app as NestFastifyApplication);
+  await (app as NestFastifyApplication).getHttpAdapter().getInstance().ready();
+  return app;
+}
+
+describe('SPA static serving — fixture dist dir', () => {
+  let app: INestApplication;
+  let distDir: string;
+  let previousWebDistDir: string | undefined;
+
+  beforeAll(async () => {
+    distDir = await mkdtemp(path.join(tmpdir(), 'serve-spa-fixture-'));
+    await writeFile(path.join(distDir, 'index.html'), INDEX_HTML);
+    await writeFile(path.join(distDir, 'favicon.svg'), '<svg></svg>\n');
+    await mkdir(path.join(distDir, 'assets'), { recursive: true });
+    await writeFile(path.join(distDir, 'assets', 'app-abc123.js'), ASSET_JS);
+
+    previousWebDistDir = process.env['WEB_DIST_DIR'];
+    process.env['WEB_DIST_DIR'] = distDir;
+    app = await createApp();
+  });
+
+  afterAll(async () => {
+    if (previousWebDistDir === undefined) {
+      delete process.env['WEB_DIST_DIR'];
+    } else {
+      process.env['WEB_DIST_DIR'] = previousWebDistDir;
+    }
+    await app.close();
+    await rm(distDir, { recursive: true, force: true });
+  });
+
+  it('serves index.html at /', async () => {
+    const res = await request(app.getHttpServer()).get('/');
+    expect(res.status).toBe(200);
+    expect(res.text).toBe(INDEX_HTML);
+    expect(res.headers['content-type']).toContain('text/html');
+  });
+
+  it('falls back to index.html for client-side deep links', async () => {
+    for (const deepLink of ['/chat', '/projects/42', '/settings']) {
+      const res = await request(app.getHttpServer()).get(deepLink);
+      expect(res.status, deepLink).toBe(200);
+      expect(res.text, deepLink).toBe(INDEX_HTML);
+    }
+  });
+
+  it('declared API routes win over the SPA catch-all', async () => {
+    const res = await request(app.getHttpServer()).get('/api/spa-test/ping');
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ ok: true });
+  });
+
+  it('unknown backend paths are JSON 404s, never the SPA page', async () => {
+    for (const backendPath of ['/api/nope', '/api', '/mcp/nope', '/socket.io/nope']) {
+      const res = await request(app.getHttpServer()).get(backendPath);
+      expect(res.status, backendPath).toBe(404);
+      expect(res.headers['content-type'], backendPath).toContain('application/json');
+      expect(res.body, backendPath).toMatchObject({ error: 'Not Found', statusCode: 404 });
+    }
+  });
+
+  it('a backend path with a query string is still a backend 404 (/api?x=1)', async () => {
+    const res = await request(app.getHttpServer()).get('/api?x=1');
+    expect(res.status).toBe(404);
+    expect(res.headers['content-type']).toContain('application/json');
+  });
+
+  it('serves static files exactly', async () => {
+    const res = await request(app.getHttpServer()).get('/favicon.svg');
+    expect(res.status).toBe(200);
+    // supertest buffers image/svg+xml as a Buffer body, not res.text.
+    const body = res.text || (res.body as Buffer).toString('utf8');
+    expect(body).toBe('<svg></svg>\n');
+  });
+
+  it('hashed /assets/ files get immutable cache headers', async () => {
+    const res = await request(app.getHttpServer()).get('/assets/app-abc123.js');
+    expect(res.status).toBe(200);
+    expect(res.text).toBe(ASSET_JS);
+    expect(res.headers['cache-control']).toBe('public, max-age=31536000, immutable');
+  });
+
+  it('missing /assets/ files are 404s, never the SPA page with an immutable header', async () => {
+    // The exact request a browser with a stale index.html makes after a
+    // deploy: the old hashed filename. Serving index.html here would poison
+    // caches with a year-long immutable entry whose body is HTML.
+    for (const missingAsset of ['/assets/app-old999.js', '/assets/app-old999.js?v=1']) {
+      const res = await request(app.getHttpServer()).get(missingAsset);
+      expect(res.status, missingAsset).toBe(404);
+      expect(res.text, missingAsset).not.toContain('mosaic spa fixture');
+      // The 404 carries no cache-control at all; ?? '' keeps the assertion valid.
+      expect(res.headers['cache-control'] ?? '', missingAsset).not.toContain('immutable');
+    }
+  });
+
+  it('index.html and non-asset files revalidate (no immutable caching)', async () => {
+    for (const revalidating of ['/', '/chat', '/favicon.svg']) {
+      const res = await request(app.getHttpServer()).get(revalidating);
+      expect(res.headers['cache-control'], revalidating).not.toContain('immutable');
+    }
+  });
+
+  it('non-GET unmatched requests keep the stock 404 (catch-all is GET/HEAD only)', async () => {
+    const res = await request(app.getHttpServer()).post('/chat');
+    expect(res.status).toBe(404);
+    expect(res.text).not.toContain('mosaic spa fixture');
+  });
+});
+
+describe('SPA static serving — configuration edges', () => {
+  it('WEB_DIST_DIR unset disables SPA serving', async () => {
+    const previous = process.env['WEB_DIST_DIR'];
+    delete process.env['WEB_DIST_DIR'];
+    try {
+      const app = await createApp();
+      const res = await request(app.getHttpServer()).get('/chat');
+      expect(res.status).toBe(404);
+      await app.close();
+    } finally {
+      if (previous !== undefined) {
+        process.env['WEB_DIST_DIR'] = previous;
+      }
+    }
+  });
+
+  it('WEB_DIST_DIR without index.html fails at boot', async () => {
+    const emptyDir = await mkdtemp(path.join(tmpdir(), 'serve-spa-empty-'));
+    const previous = process.env['WEB_DIST_DIR'];
+    process.env['WEB_DIST_DIR'] = emptyDir;
+    try {
+      await expect(createApp()).rejects.toThrow(/index\.html.*does not exist/);
+    } finally {
+      if (previous === undefined) {
+        delete process.env['WEB_DIST_DIR'];
+      } else {
+        process.env['WEB_DIST_DIR'] = previous;
+      }
+      await rm(emptyDir, { recursive: true, force: true });
+    }
+  });
+});

apps/gateway/src/spa/serve-spa.ts

@@ -0,0 +1,106 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { Logger } from '@nestjs/common';
+import fastifyStatic from '@fastify/static';
+import type { NestFastifyApplication } from '@nestjs/platform-fastify';
+
+/** Request paths that belong to the backend, never to the SPA fallback. */
+const BACKEND_PREFIXES = ['/api', '/mcp', '/socket.io'] as const;
+
+function isBackendPath(url: string): boolean {
+  // Match on the path only: `/api?x=1` is a backend request, and the query
+  // string must never turn it into an SPA fallback.
+  const pathOnly = url.split('?', 1)[0] ?? url;
+  return BACKEND_PREFIXES.some(
+    (prefix) => pathOnly === prefix || pathOnly.startsWith(`${prefix}/`),
+  );
+}
+
+/**
+ * Serve the built web SPA bundle (Phase P5 cutover, #1444).
+ *
+ * WEB_DIST_DIR unset: SPA serving is disabled — dev runs the Vite dev server,
+ * which proxies /api and /socket.io here. WEB_DIST_DIR set but not holding a
+ * built bundle: fail at boot, because a gateway configured to serve the UI
+ * silently serving 404s is an outage, not a degraded mode.
+ *
+ * Static files get exact routes (wildcard: false, so nothing shadows the API
+ * routes); every other GET/HEAD outside the backend prefixes falls back to
+ * index.html so client-side routes deep-link correctly.
+ */
+export async function mountSpaStatic(app: NestFastifyApplication): Promise<void> {
+  const logger = new Logger('SpaStatic');
+  const distDir = process.env['WEB_DIST_DIR'];
+  if (!distDir) {
+    logger.log('WEB_DIST_DIR not set; SPA serving disabled (dev mode uses the Vite dev server)');
+    return;
+  }
+
+  const root = path.resolve(distDir);
+  const indexFile = path.join(root, 'index.html');
+  if (!existsSync(indexFile)) {
+    throw new Error(`WEB_DIST_DIR is '${distDir}' but '${indexFile}' does not exist`);
+  }
+
+  // Default cache semantics: public, max-age=0 with ETag/Last-Modified, so
+  // every response revalidates (304 when unchanged). Always correct, including
+  // for index.html after a deploy.
+  await app.register(
+    fastifyStatic as never,
+    {
+      root,
+      wildcard: false,
+      index: false,
+    } as never,
+  );
+
+  const fastify = app.getHttpAdapter().getInstance();
+
+  // Files under /assets/ carry a content hash in their name (Vite emits them
+  // that way), so they get long-lived immutable caching: a changed file is a
+  // new URL, never a stale cache hit. An onSend hook rather than the plugin's
+  // `setHeaders` option, because @fastify/static applies its own computed
+  // cache-control (reply.headers) after calling setHeaders, overriding it.
+  fastify.addHook('onSend', (req, reply, payload, done) => {
+    const pathOnly = (req.raw.url ?? '').split('?', 1)[0] ?? '';
+    if (reply.statusCode === 200 && pathOnly.startsWith('/assets/')) {
+      void reply.header('cache-control', 'public, max-age=31536000, immutable');
+    }
+    done(null, payload);
+  });
+
+  // A wildcard route, not setNotFoundHandler: Nest installs its own not-found
+  // handler during init and Fastify allows only one. find-my-way matches
+  // most-specific-first, so every declared route (API, static files) wins over
+  // this catch-all; non-GET unmatched requests keep Fastify's stock 404.
+  fastify.get('/*', (req, reply) => {
+    const url = req.raw.url ?? '';
+    const pathOnly = url.split('?', 1)[0] ?? url;
+    if (isBackendPath(url)) {
+      // An unknown backend path is an API 404, never the SPA page.
+      void reply.code(404).send({
+        message: `Route ${req.raw.method ?? 'GET'}:${url} not found`,
+        error: 'Not Found',
+        statusCode: 404,
+      });
+      return;
+    }
+    if (pathOnly === '/assets' || pathOnly.startsWith('/assets/')) {
+      // A missing hashed asset — typically a browser holding a stale
+      // index.html after a deploy — must 404. Falling through to the SPA
+      // fallback would return index.html as the asset body, and the onSend
+      // hook above would stamp it with a year-long immutable cache-control.
+      void reply.code(404).send({
+        message: `Asset ${pathOnly} not found`,
+        error: 'Not Found',
+        statusCode: 404,
+      });
+      return;
+    }
+    // sendFile is decorated by @fastify/static; its type augmentation targets
+    // a different fastify copy in the pnpm tree than the Nest adapter's.
+    (reply as unknown as { sendFile: (file: string) => unknown }).sendFile('index.html');
+  });
+
+  logger.log(`Serving SPA bundle from ${root}`);
+}

apps/gateway/src/validation-pipe-check.spec.ts

@@ -0,0 +1,104 @@
+/**
+ * Boot-time ValidationPipe metatype self-check (#1391).
+ *
+ * The check exists to fail loud at boot when the global pipe cannot see a
+ * guarded DTO's decorated properties — the #436 class-erasure signature and
+ * its dependency-graph cousins. Red/green arms:
+ *
+ *   GREEN  real module state: BootstrapSetupDto's three properties are
+ *          decorated and visible through the globalThis-shared storage.
+ *   RED    a control class with NO decorators (the erasure shape): the
+ *          check throws PipeMetatypeCheckError naming every property.
+ *   RED-2  a control where one property is decorated and two are not: the
+ *          error names exactly the missing two — the miss list is precise,
+ *          not a blanket failure.
+ */
+import { describe, expect, it } from 'vitest';
+import { IsString } from 'class-validator';
+import {
+  assertValidationPipeSeesDtoDecorators,
+  PipeMetatypeCheckError,
+} from './validation-pipe-check.js';
+
+describe('assertValidationPipeSeesDtoDecorators (#1391 boot check)', () => {
+  it('GREEN: passes on real module state (decorated DTO visible to the pipe)', () => {
+    expect(() => assertValidationPipeSeesDtoDecorators()).not.toThrow();
+  });
+
+  it('RED control: a class whose properties lost their decorators throws, naming them', async () => {
+    // Simulate metatype erasure: an undecorated class standing where a
+    // decorated DTO should be. Redefine the guard table for the test by
+    // importing the module and pointing its table at the eroded class —
+    // the check reads the table at call time, so a fresh module instance
+    // with a swapped table reproduces the boot failure deterministically.
+    const { PIPE_GUARDED_DTOS } = await import('./validation-pipe-check.js');
+
+    class ErodedDto {
+      name?: string;
+      email?: string;
+      password?: string;
+    }
+
+    const original = PIPE_GUARDED_DTOS[0];
+    expect(original).toBeDefined();
+    // Swap in the eroded target (same declared properties, zero decorators).
+    (
+      PIPE_GUARDED_DTOS as unknown as Array<{ name: string; target: object; properties: string[] }>
+    ).splice(0, PIPE_GUARDED_DTOS.length, {
+      name: 'ErodedDto',
+      target: ErodedDto,
+      properties: ['name', 'email', 'password'],
+    });
+
+    try {
+      expect(() => assertValidationPipeSeesDtoDecorators()).toThrow(PipeMetatypeCheckError);
+      try {
+        assertValidationPipeSeesDtoDecorators();
+      } catch (err) {
+        const message = err instanceof Error ? err.message : '';
+        expect(message).toContain('ErodedDto.name');
+        expect(message).toContain('ErodedDto.email');
+        expect(message).toContain('ErodedDto.password');
+      }
+    } finally {
+      // Restore real module state for any later test in this file.
+      (PIPE_GUARDED_DTOS as unknown as unknown[]).splice(0, PIPE_GUARDED_DTOS.length, original);
+    }
+    // And confirm the restore is real.
+    expect(() => assertValidationPipeSeesDtoDecorators()).not.toThrow();
+  });
+
+  it('RED-2 control: a partially decorated class names exactly the missing properties', async () => {
+    const { PIPE_GUARDED_DTOS } = await import('./validation-pipe-check.js');
+
+    class HalfErodedDto {
+      @IsString()
+      name?: string;
+      email?: string;
+      password?: string;
+    }
+
+    const original = PIPE_GUARDED_DTOS[0];
+    (
+      PIPE_GUARDED_DTOS as unknown as Array<{ name: string; target: object; properties: string[] }>
+    ).splice(0, PIPE_GUARDED_DTOS.length, {
+      name: 'HalfErodedDto',
+      target: HalfErodedDto,
+      properties: ['name', 'email', 'password'],
+    });
+
+    try {
+      try {
+        assertValidationPipeSeesDtoDecorators();
+        expect.unreachable('partially decorated DTO must fail the boot check');
+      } catch (err) {
+        const message = err instanceof Error ? err.message : '';
+        expect(message).toContain('HalfErodedDto.email');
+        expect(message).toContain('HalfErodedDto.password');
+        expect(message).not.toContain('HalfErodedDto.name has no');
+      }
+    } finally {
+      (PIPE_GUARDED_DTOS as unknown as unknown[]).splice(0, PIPE_GUARDED_DTOS.length, original);
+    }
+  });
+});

apps/gateway/src/validation-pipe-check.ts

@@ -0,0 +1,94 @@
+import 'reflect-metadata';
+import { getMetadataStorage } from 'class-validator';
+import { BootstrapSetupDto } from './admin/bootstrap.dto.js';
+
+/**
+ * Boot-time self-check: the global ValidationPipe must be able to SEE the
+ * decorated properties of the DTOs it guards (#1391, #436 class).
+ *
+ * WHY THIS EXISTS. When Nest resolves a @Body() metatype to Object — via
+ * `import type` class erasure (#436), or a dependency graph where the
+ * controller's decorators and the application's route enhancers disagree
+ * (#1391's hypothesized dual-@nestjs/common on a mixed install) — the
+ * ValidationPipe's whitelist treats every property as forbidden. The first
+ * symptom is a 400 on the FIRST bootstrap attempt of a fresh install, the
+ * worst place to discover wiring damage: the operator cannot tell a broken
+ * payload from a broken daemon.
+ *
+ * This check fails LOUD at boot instead: if the pipe cannot see the DTO's
+ * decorated properties, the gateway refuses to start with a named cause.
+ * It catches the whole class — erasure, decorator metadata loss — on every
+ * host, at the moment the damage exists rather than at first use.
+ *
+ * Storage sharing note: class-validator keys its metadata storage on
+ * globalThis, so duplicate package copies do NOT hide metadata (measured,
+ * #1391 diagnosis). What hides it is losing the metatype itself, which is
+ * what this asserts against.
+ */
+
+/**
+ * DTOs the global pipe guards, mapped to the properties the whitelist must
+ * admit. Target is the CONSTRUCTOR (the object class itself): class-validator
+ * decorators register metadata keyed on the constructor, and its executor
+ * looks up `object.constructor` (ValidationExecutor.js:50) — the probe
+ * through `prototype` returns zero. Extend when adding DTOs to the app.
+ */
+export const PIPE_GUARDED_DTOS: Array<{
+  name: string;
+  target: abstract new (...args: never[]) => unknown;
+  properties: string[];
+}> = [
+  {
+    name: 'BootstrapSetupDto',
+    target: BootstrapSetupDto,
+    properties: ['name', 'email', 'password'],
+  },
+];
+
+export class PipeMetatypeCheckError extends Error {
+  constructor(missing: string[]) {
+    super(
+      'ValidationPipe metatype check failed: ' +
+        missing.join('; ') +
+        '. The global ValidationPipe cannot see decorated DTO properties — ' +
+        'every request body would be rejected as non-whitelisted. ' +
+        'Check for import-type erasure or decorator metadata loss in the ' +
+        'dependency graph (see issues #436, #1391).',
+    );
+    this.name = 'PipeMetatypeCheckError';
+  }
+}
+
+/**
+ * Assert the pipe's whitelist can see every guarded DTO's decorated
+ * properties. Throws PipeMetatypeCheckError (fail-loud at boot) listing
+ * each miss. Pure function of module state: no I/O, safe to call twice.
+ */
+export function assertValidationPipeSeesDtoDecorators(): void {
+  const storage = getMetadataStorage();
+  const missing: string[] = [];
+
+  for (const dto of PIPE_GUARDED_DTOS) {
+    // class-validator records constraints keyed on the DTO's constructor
+    // (decorators run on the class), and its executor resolves them via
+    // object.constructor. A property with no recorded metadata is invisible
+    // to the whitelist — whatever the cause — and fails here.
+    // Signature mirrors ValidationExecutor.js:50 — (constructor, schema, always,
+    // strictGroups, groups?). No schema, always=true, no groups: every
+    // constraint regardless of grouping, which is what the whitelist sees.
+    const metadatas = storage.getTargetValidationMetadatas(dto.target, '', true, false);
+    const decorated = new Set(metadatas.map((m) => m.propertyName));
+
+    for (const property of dto.properties) {
+      if (!decorated.has(property)) {
+        missing.push(
+          `${dto.name}.${property} has no class-validator constraints visible to the pipe`,
+        );
+      }
+    }
+  }
+
+  if (missing.length > 0) {
+    throw new PipeMetatypeCheckError(missing);
+  }
+}

apps/gateway/src/workspace/teams.controller.spec.ts

@@ -0,0 +1,123 @@
+import 'reflect-metadata';
+import { type CanActivate, type ExecutionContext, type INestApplication } from '@nestjs/common';
+import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { TeamsController } from './teams.controller.js';
+import { TeamsService } from './teams.service.js';
+
+const teamAlpha = { id: 'team-alpha', name: 'Alpha' };
+const teamBeta = { id: 'team-beta', name: 'Beta' };
+
+// user-1 is a member of team-alpha only; admin-1 has role admin.
+let currentUser: { id: string; role?: string } = { id: 'user-1' };
+
+const teamsServiceMock = {
+  findAll: vi.fn(() => Promise.resolve([teamAlpha, teamBeta])),
+  findAllForUser: vi.fn((userId: string) =>
+    Promise.resolve(userId === 'user-1' ? [teamAlpha] : []),
+  ),
+  findById: vi.fn((id: string) => Promise.resolve([teamAlpha, teamBeta].find((t) => t.id === id))),
+  listMembers: vi.fn(() => Promise.resolve([{ teamId: 'team-alpha', userId: 'user-1' }])),
+  isMember: vi.fn((teamId: string, userId: string) =>
+    Promise.resolve(teamId === 'team-alpha' && userId === 'user-1'),
+  ),
+};
+
+const authGuard: CanActivate = {
+  canActivate(context: ExecutionContext): boolean {
+    const requestContext = context
+      .switchToHttp()
+      .getRequest<{ user?: { id: string; role?: string } }>();
+    requestContext.user = currentUser;
+    return true;
+  },
+};
+
+describe('teams endpoints are scoped to membership', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      controllers: [TeamsController],
+      providers: [{ provide: TeamsService, useValue: teamsServiceMock }],
+    })
+      .overrideGuard(AuthGuard)
+      .useValue(authGuard)
+      .compile();
+
+    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
+    await app.init();
+    await app.getHttpAdapter().getInstance().ready();
+  });
+
+  beforeEach(() => {
+    currentUser = { id: 'user-1' };
+    vi.clearAllMocks();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('GET /api/teams returns only the teams the user belongs to', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams');
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual([teamAlpha]);
+    expect(teamsServiceMock.findAll).not.toHaveBeenCalled();
+  });
+
+  it('GET /api/teams returns every team for an admin', async () => {
+    currentUser = { id: 'admin-1', role: 'admin' };
+    const response = await request(app.getHttpServer()).get('/api/teams');
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual([teamAlpha, teamBeta]);
+    expect(teamsServiceMock.findAllForUser).not.toHaveBeenCalled();
+  });
+
+  it('GET /api/teams/:teamId returns 403 for a non-member', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams/team-beta');
+    expect(response.status).toBe(403);
+  });
+
+  it('GET /api/teams/:teamId returns 404 for a missing team', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams/team-missing');
+    expect(response.status).toBe(404);
+  });
+
+  it('GET /api/teams/:teamId returns the team for a member', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams/team-alpha');
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual(teamAlpha);
+  });
+
+  it('GET /api/teams/:teamId/members returns 403 for a non-member and members for a member', async () => {
+    const denied = await request(app.getHttpServer()).get('/api/teams/team-beta/members');
+    expect(denied.status).toBe(403);
+    expect(teamsServiceMock.listMembers).not.toHaveBeenCalled();
+
+    const allowed = await request(app.getHttpServer()).get('/api/teams/team-alpha/members');
+    expect(allowed.status).toBe(200);
+    expect(allowed.body).toEqual([{ teamId: 'team-alpha', userId: 'user-1' }]);
+  });
+
+  it('GET /api/teams/:teamId/members/:userId allows a self-lookup on any team', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams/team-beta/members/user-1');
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({ isMember: false });
+  });
+
+  it('GET /api/teams/:teamId/members/:userId denies looking up another user on a foreign team', async () => {
+    const response = await request(app.getHttpServer()).get('/api/teams/team-beta/members/user-2');
+    expect(response.status).toBe(403);
+  });
+
+  it('an admin can look up any membership', async () => {
+    currentUser = { id: 'admin-1', role: 'admin' };
+    const response = await request(app.getHttpServer()).get('/api/teams/team-alpha/members/user-1');
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({ isMember: true });
+  });
+});

apps/gateway/src/workspace/teams.controller.ts

@@ -1,30 +1,68 @@
-import { Controller, Get, Param, UseGuards } from '@nestjs/common';
+import {
+  Controller,
+  ForbiddenException,
+  Get,
+  NotFoundException,
+  Param,
+  UseGuards,
+} from '@nestjs/common';
 import { AuthGuard } from '../auth/auth.guard.js';
+import { CurrentUser } from '../auth/current-user.decorator.js';
 import { TeamsService } from './teams.service.js';
 
+type RequestUser = { id: string; role?: string };
+
 @Controller('api/teams')
 @UseGuards(AuthGuard)
 export class TeamsController {
   constructor(private readonly teams: TeamsService) {}
 
   @Get()
-  async list() {
-    return this.teams.findAll();
+  async list(@CurrentUser() user: RequestUser) {
+    if (user.role === 'admin') {
+      return this.teams.findAll();
+    }
+    return this.teams.findAllForUser(user.id);
   }
 
   @Get(':teamId')
-  async findOne(@Param('teamId') teamId: string) {
-    return this.teams.findById(teamId);
+  async findOne(@Param('teamId') teamId: string, @CurrentUser() user: RequestUser) {
+    return this.getAccessibleTeam(teamId, user);
   }
 
   @Get(':teamId/members')
-  async listMembers(@Param('teamId') teamId: string) {
+  async listMembers(@Param('teamId') teamId: string, @CurrentUser() user: RequestUser) {
+    await this.getAccessibleTeam(teamId, user);
     return this.teams.listMembers(teamId);
   }
 
   @Get(':teamId/members/:userId')
-  async checkMembership(@Param('teamId') teamId: string, @Param('userId') userId: string) {
+  async checkMembership(
+    @Param('teamId') teamId: string,
+    @Param('userId') userId: string,
+    @CurrentUser() user: RequestUser,
+  ) {
+    // A user may always ask about their own membership; anything else is
+    // team-scoped like the other routes.
+    if (userId !== user.id) {
+      await this.getAccessibleTeam(teamId, user);
+    }
     const isMember = await this.teams.isMember(teamId, userId);
     return { isMember };
   }
+
+  /**
+   * Team-scoped access: admins see any team; everyone else only teams they
+   * are a member of. NotFoundException when the team does not exist and
+   * ForbiddenException when the user lacks access (same convention as the
+   * projects controller).
+   */
+  private async getAccessibleTeam(teamId: string, user: RequestUser) {
+    const team = await this.teams.findById(teamId);
+    if (!team) throw new NotFoundException('Team not found');
+    if (user.role === 'admin') return team;
+    const isMember = await this.teams.isMember(teamId, user.id);
+    if (!isMember) throw new ForbiddenException('Not a member of this team');
+    return team;
+  }
 }

apps/gateway/src/workspace/teams.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { eq, and, type Db, teams, teamMembers, projects } from '@mosaicstack/db';
+import { eq, and, inArray, type Db, teams, teamMembers, projects } from '@mosaicstack/db';
 import { DB } from '../database/database.module.js';
 
 @Injectable()
@@ -56,6 +56,21 @@ export class TeamsService {
     return this.db.select().from(teams);
   }
 
+  /**
+   * List only the teams the user is a member of.
+   */
+  async findAllForUser(userId: string) {
+    const memberRows = await this.db
+      .select({ teamId: teamMembers.teamId })
+      .from(teamMembers)
+      .where(eq(teamMembers.userId, userId));
+
+    const teamIds = memberRows.map((r) => r.teamId);
+    if (teamIds.length === 0) return [];
+
+    return this.db.select().from(teams).where(inArray(teams.id, teamIds));
+  }
+
   /**
    * Find a team by ID.
    */

apps/web/e2e/admin.spec.ts

@@ -1,11 +1,14 @@
 import { test, expect } from '@playwright/test';
-import { loginAs, ADMIN_USER, TEST_USER } from './helpers/auth.js';
+import { loginAs, ADMIN_USER, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 test.describe('Admin page — admin user', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, ADMIN_USER.email, ADMIN_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded admin user — skipping admin tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded admin user — skipping admin tests',
+    );
   });
 
   test('admin page loads with the Admin Panel heading', async ({ page }) => {
@@ -31,15 +34,11 @@ test.describe('Admin page — admin user', () => {
     await page.goto('/admin');
     await page.getByRole('button', { name: /system health/i }).click();
     // Health cards or loading indicator should appear
-    const hasLoading = await page
+    const loadingOrCard = page
       .getByText(/loading health/i)
-      .isVisible()
-      .catch(() => false);
-    const hasCard = await page
-      .getByText(/database/i)
-      .isVisible()
-      .catch(() => false);
-    expect(hasLoading || hasCard).toBe(true);
+      .or(page.getByText(/database/i))
+      .first();
+    await expect(loadingOrCard).toBeVisible({ timeout: 10_000 });
   });
 });
 
@@ -47,26 +46,19 @@ test.describe('Admin page — non-admin user', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping non-admin tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping non-admin tests',
+    );
   });
 
-  test('non-admin visiting /admin sees access denied or is redirected', async ({ page }) => {
+  test('non-admin visiting /admin never sees the admin panel', async ({ page }) => {
     await page.goto('/admin');
-    // Either redirected away or shown an access-denied message
-    const onAdmin = page.url().includes('/admin');
-    if (onAdmin) {
-      // Should show some access-denied content rather than the full admin panel
-      const hasPanel = await page
-        .getByRole('heading', { name: /admin panel/i })
-        .isVisible()
-        .catch(() => false);
-      // If heading is visible, the guard allowed access (user may have admin role in this env)
-      // — not a failure, just informational
-      if (!hasPanel) {
-        // access denied message, redirect, or guard placeholder
-        const url = page.url();
-        expect(url).toBeTruthy(); // environment-dependent — no hard assertion
-      }
-    }
+    // Wait for the app shell to render (redirect and access-denied views both
+    // keep the sidebar), then assert the panel itself is absent. globalSetup
+    // seeds TEST_USER with role 'member', so this is a real authorization
+    // assertion, not environment-dependent.
+    await expect(page.getByRole('img', { name: /mosaic logo/i })).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByRole('heading', { name: /admin panel/i })).not.toBeVisible();
   });
 });

apps/web/e2e/auth.spec.ts

@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { TEST_USER } from './helpers/auth.js';
+import { REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 // ── Login page ────────────────────────────────────────────────────────────────
 
@@ -49,18 +49,14 @@ test.describe('Login page', () => {
   });
 
   test('redirects to /chat after successful login', async ({ page }) => {
+    // Only meaningful with known-good credentials; against a live environment
+    // this would just probe someone else's user table.
+    test.skip(!REQUIRE_SEEDED_AUTH, 'needs seeded credentials (E2E_REQUIRE_SEEDED_AUTH=1)');
     await page.goto('/login');
     await page.getByLabel('Email').fill(TEST_USER.email);
     await page.getByLabel('Password').fill(TEST_USER.password);
     await page.getByRole('button', { name: /sign in/i }).click();
-    // Either reaches /chat or shows an error (if credentials are wrong in this env).
-    // We assert a navigation away from /login, or the alert is shown.
-    await Promise.race([
-      expect(page).toHaveURL(/\/chat/, { timeout: 10_000 }),
-      expect(page.getByRole('alert')).toBeVisible({ timeout: 10_000 }),
-    ]).catch(() => {
-      // Acceptable — environment may not have seeded credentials
-    });
+    await expect(page).toHaveURL(/\/chat/, { timeout: 10_000 });
   });
 });
 

apps/web/e2e/chat.spec.ts

@@ -1,45 +1,38 @@
 import { test, expect } from '@playwright/test';
-import { loginAs, TEST_USER } from './helpers/auth.js';
+import { loginAs, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 test.describe('Chat page', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     // If login failed (no seeded user in env) we may be on /login — skip
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping authenticated tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping authenticated tests',
+    );
   });
 
-  test('chat page loads and shows the welcome message or conversation list', async ({ page }) => {
+  test('chat page loads and shows the conversation area', async ({ page }) => {
     await page.goto('/chat');
-    // Either there are conversations listed or the welcome empty-state is shown
-    const hasWelcome = await page
-      .getByRole('heading', { name: /welcome to mosaic chat/i })
-      .isVisible()
-      .catch(() => false);
-    const hasConversationPanel = await page
-      .locator('[data-testid="conversation-list"], nav, aside')
-      .first()
-      .isVisible()
-      .catch(() => false);
-
-    expect(hasWelcome || hasConversationPanel).toBe(true);
+    await expect(page.getByRole('heading', { level: 1, name: /chat/i })).toBeVisible({
+      timeout: 10_000,
+    });
+    await expect(page.getByRole('log', { name: /conversation/i })).toBeVisible();
   });
 
-  test('new conversation button is visible', async ({ page }) => {
+  test('message composer input is visible', async ({ page }) => {
     await page.goto('/chat');
-    // "Start new conversation" button or a "+" button in the sidebar
-    const newConvButton = page.getByRole('button', { name: /new conversation|start new/i }).first();
-    await expect(newConvButton).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByLabel('Message')).toBeVisible({ timeout: 10_000 });
   });
 
-  test('clicking new conversation shows a chat input area', async ({ page }) => {
+  test('command panel lists /new and exposes the run controls', async ({ page }) => {
     await page.goto('/chat');
-    // Find any button that creates a new conversation
-    const newBtn = page.getByRole('button', { name: /new conversation|start new/i }).first();
-    await newBtn.click();
-    // After creating, a text input for sending messages should appear
-    const chatInput = page.getByRole('textbox').or(page.locator('textarea')).first();
-    await expect(chatInput).toBeVisible({ timeout: 10_000 });
+    // Conversations are command-driven: /new starts one via the commands panel.
+    const commandList = page.getByRole('list', { name: /available commands/i });
+    await expect(commandList).toBeVisible({ timeout: 10_000 });
+    await expect(commandList.getByText('/new', { exact: true })).toBeVisible();
+    await expect(page.getByLabel('Command name')).toBeVisible();
+    await expect(page.getByRole('button', { name: /run command/i })).toBeVisible();
   });
 
   test('sidebar navigation is present on chat page', async ({ page }) => {

apps/web/e2e/global-setup.ts

@@ -0,0 +1,95 @@
+import type { FullConfig } from '@playwright/test';
+import { ADMIN_USER, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
+
+/**
+ * Seed the E2E users through the gateway's real APIs (#1445, P6).
+ *
+ * On a fresh database (CI boots the gateway on the embedded PGlite path):
+ *   1. POST /api/bootstrap/setup creates ADMIN_USER as the first admin.
+ *   2. The admin signs in and creates TEST_USER via the better-auth admin API.
+ *
+ * Against an environment that already has users (needsSetup=false), seeding is
+ * skipped entirely: the specs keep their own skip-when-login-fails guards, so
+ * a live environment stays usable as a test target without mutation. Under
+ * E2E_REQUIRE_SEEDED_AUTH=1 (CI) that state is instead a hard failure and the
+ * guards are disabled — see helpers/auth.ts.
+ *
+ * On a fresh database, any seeding failure throws and fails the whole run: an
+ * E2E gate whose authenticated suites silently skip would pass while proving
+ * nothing.
+ */
+export default async function globalSetup(config: FullConfig): Promise<void> {
+  const baseURL = config.projects[0]?.use?.baseURL ?? 'http://localhost:14242';
+
+  const statusRes = await fetch(`${baseURL}/api/bootstrap/status`);
+  if (!statusRes.ok) {
+    throw new Error(`GET /api/bootstrap/status returned ${statusRes.status} — is the gateway up?`);
+  }
+  const status = (await statusRes.json()) as { needsSetup: boolean };
+  if (!status.needsSetup) {
+    if (REQUIRE_SEEDED_AUTH) {
+      // CI boots the gateway on a fresh HOME-isolated database, so an
+      // already-populated one means the isolation regressed — refuse to run
+      // against unknown data rather than skip-and-pass.
+      throw new Error(
+        'E2E_REQUIRE_SEEDED_AUTH=1 but the database already has users — gateway HOME isolation regressed?',
+      );
+    }
+    console.info('[e2e setup] users already exist; skipping seed');
+    return;
+  }
+
+  const setupRes = await fetch(`${baseURL}/api/bootstrap/setup`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      name: ADMIN_USER.name,
+      email: ADMIN_USER.email,
+      password: ADMIN_USER.password,
+    }),
+  });
+  if (!setupRes.ok) {
+    throw new Error(
+      `POST /api/bootstrap/setup failed (${setupRes.status}): ${await setupRes.text()}`,
+    );
+  }
+  console.info(`[e2e setup] bootstrap admin created: ${ADMIN_USER.email}`);
+
+  // better-auth's CSRF protection rejects requests without an Origin header
+  // (403 MISSING_OR_NULL_ORIGIN), so the server-side fetches here send the
+  // gateway's own origin — the same value a browser tab on the SPA would send.
+  const authHeaders = { 'content-type': 'application/json', origin: baseURL };
+
+  const signInRes = await fetch(`${baseURL}/api/auth/sign-in/email`, {
+    method: 'POST',
+    headers: authHeaders,
+    body: JSON.stringify({ email: ADMIN_USER.email, password: ADMIN_USER.password }),
+  });
+  if (!signInRes.ok) {
+    throw new Error(`admin sign-in failed (${signInRes.status}): ${await signInRes.text()}`);
+  }
+  const cookies = signInRes.headers
+    .getSetCookie()
+    .map((cookie) => cookie.split(';', 1)[0])
+    .join('; ');
+  if (!cookies) {
+    throw new Error('admin sign-in returned no session cookie');
+  }
+
+  const createRes = await fetch(`${baseURL}/api/auth/admin/create-user`, {
+    method: 'POST',
+    headers: { ...authHeaders, cookie: cookies },
+    body: JSON.stringify({
+      name: TEST_USER.name,
+      email: TEST_USER.email,
+      password: TEST_USER.password,
+      role: 'member',
+    }),
+  });
+  if (!createRes.ok) {
+    throw new Error(
+      `POST /api/auth/admin/create-user failed (${createRes.status}): ${await createRes.text()}`,
+    );
+  }
+  console.info(`[e2e setup] test user created: ${TEST_USER.email}`);
+}

apps/web/e2e/helpers/auth.ts

@@ -13,11 +13,28 @@ export const ADMIN_USER = {
 };
 
 /**
- * Fill the login form and submit. Waits for navigation after success.
+ * Set when the database was seeded by global-setup (CI sets it in the
+ * publish.yml e2e step). Seeded credentials MUST work, so login failures are
+ * hard failures and the skip-when-login-fails guards are disabled — otherwise
+ * a login regression would skip every authenticated suite and the gate would
+ * pass while proving nothing. Unset (a live environment used as a test
+ * target), the guards stay on and unseeded credentials skip their suites.
+ */
+export const REQUIRE_SEEDED_AUTH = process.env['E2E_REQUIRE_SEEDED_AUTH'] === '1';
+
+/**
+ * Fill the login form and submit, then wait for the post-login redirect to
+ * /chat. Under REQUIRE_SEEDED_AUTH a missed redirect throws (failing the
+ * test). Otherwise the timeout is swallowed: the page stays on /login and the
+ * callers' `test.skip(...)` guards see that. Without this wait, every guard
+ * read page.url() before the redirect happened and skipped its suite even
+ * when login succeeded (#1445).
  */
 export async function loginAs(page: Page, email: string, password: string): Promise<void> {
   await page.goto('/login');
   await page.getByLabel('Email').fill(email);
   await page.getByLabel('Password').fill(password);
   await page.getByRole('button', { name: /sign in/i }).click();
+  const redirect = page.waitForURL(/\/chat/, { timeout: 10_000 });
+  await (REQUIRE_SEEDED_AUTH ? redirect : redirect.catch(() => {}));
 }

apps/web/e2e/navigation.spec.ts

@@ -1,16 +1,22 @@
 import { test, expect } from '@playwright/test';
-import { loginAs, TEST_USER } from './helpers/auth.js';
+import { loginAs, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 test.describe('Sidebar navigation', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping authenticated tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping authenticated tests',
+    );
   });
 
-  test('sidebar shows Mosaic brand link', async ({ page }) => {
+  test('sidebar shows the Mosaic brand', async ({ page }) => {
     await page.goto('/chat');
-    await expect(page.getByRole('link', { name: /mosaic/i }).first()).toBeVisible();
+    // The brand block is a logo image plus "Mosaic / Mission Control" text,
+    // not a link.
+    await expect(page.getByRole('img', { name: /mosaic logo/i })).toBeVisible();
+    await expect(page.getByText('Mission Control')).toBeVisible();
   });
 
   test('Chat nav link navigates to /chat', async ({ page }) => {
@@ -48,11 +54,12 @@ test.describe('Sidebar navigation', () => {
 
   test('active link is visually highlighted', async ({ page }) => {
     await page.goto('/chat');
-    // The active link should have a distinct class — check that the Chat link
-    // has the active style class (bg-blue-600/20 text-blue-400)
+    // The sidebar marks the active item with `font-medium` (plus an inline
+    // primary-color style); inactive items get the hover class instead.
     const chatLink = page.getByRole('link', { name: /^chat$/i }).first();
-    const cls = await chatLink.getAttribute('class');
-    expect(cls).toContain('blue');
+    const projectsLink = page.getByRole('link', { name: /^projects$/i }).first();
+    await expect(chatLink).toHaveClass(/font-medium/);
+    await expect(projectsLink).not.toHaveClass(/font-medium/);
   });
 });
 
@@ -60,18 +67,23 @@ test.describe('Route transitions', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping authenticated tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping authenticated tests',
+    );
   });
 
   test('navigating chat → projects → settings → chat works without errors', async ({ page }) => {
     await page.goto('/chat');
     await expect(page).toHaveURL(/\/chat/);
 
+    // level: 1 — empty-state h2s ("No projects yet") also match the loose
+    // patterns, and a two-element match is a strict-mode violation.
     await page.goto('/projects');
-    await expect(page.getByRole('heading', { name: /projects/i })).toBeVisible();
+    await expect(page.getByRole('heading', { level: 1, name: /projects/i })).toBeVisible();
 
     await page.goto('/settings');
-    await expect(page.getByRole('heading', { name: /settings/i })).toBeVisible();
+    await expect(page.getByRole('heading', { level: 1, name: /settings/i })).toBeVisible();
 
     await page.goto('/chat');
     await expect(page).toHaveURL(/\/chat/);

apps/web/e2e/projects.spec.ts

@@ -1,16 +1,23 @@
 import { test, expect } from '@playwright/test';
-import { loginAs, TEST_USER } from './helpers/auth.js';
+import { loginAs, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 test.describe('Projects page', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping authenticated tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping authenticated tests',
+    );
   });
 
   test('projects page loads with heading', async ({ page }) => {
     await page.goto('/projects');
-    await expect(page.getByRole('heading', { name: /projects/i })).toBeVisible({ timeout: 10_000 });
+    // level: 1 — the "No projects yet" empty-state h2 also matches /projects/i
+    // and a two-element match is a strict-mode violation.
+    await expect(page.getByRole('heading', { level: 1, name: /projects/i })).toBeVisible({
+      timeout: 10_000,
+    });
   });
 
   test('shows empty state or project cards when loaded', async ({ page }) => {
@@ -18,23 +25,11 @@ test.describe('Projects page', () => {
     // Wait for loading state to clear
     await expect(page.getByText(/loading projects/i)).not.toBeVisible({ timeout: 10_000 });
 
-    const hasProjects = await page
+    const cardsOrEmpty = page
       .locator('[class*="grid"]')
-      .isVisible()
-      .catch(() => false);
-    const hasEmpty = await page
-      .getByText(/no projects yet/i)
-      .isVisible()
-      .catch(() => false);
-
-    expect(hasProjects || hasEmpty).toBe(true);
-  });
-
-  test('shows Active Mission section', async ({ page }) => {
-    await page.goto('/projects');
-    await expect(page.getByRole('heading', { name: /active mission/i })).toBeVisible({
-      timeout: 10_000,
-    });
+      .or(page.getByText(/no projects yet/i))
+      .first();
+    await expect(cardsOrEmpty).toBeVisible({ timeout: 10_000 });
   });
 
   test('sidebar navigation is present', async ({ page }) => {

apps/web/e2e/settings.spec.ts

@@ -1,11 +1,14 @@
 import { test, expect } from '@playwright/test';
-import { loginAs, TEST_USER } from './helpers/auth.js';
+import { loginAs, REQUIRE_SEEDED_AUTH, TEST_USER } from './helpers/auth.js';
 
 test.describe('Settings page', () => {
   test.beforeEach(async ({ page }) => {
     await loginAs(page, TEST_USER.email, TEST_USER.password);
     const url = page.url();
-    test.skip(!url.includes('/chat'), 'No seeded test user — skipping authenticated tests');
+    test.skip(
+      !REQUIRE_SEEDED_AUTH && !url.includes('/chat'),
+      'No seeded test user — skipping authenticated tests',
+    );
   });
 
   test('settings page loads with heading', async ({ page }) => {

apps/web/next-env.d.ts

@@ -1,6 +0,0 @@
-/// <reference types="next" />
-/// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
-
-// NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

apps/web/next.config.ts

@@ -1,32 +0,0 @@
-import type { NextConfig } from 'next';
-
-const nextConfig: NextConfig = {
-  output: 'standalone',
-  transpilePackages: ['@mosaicstack/design-tokens'],
-
-  // Enable gzip/brotli compression for all responses.
-  compress: true,
-
-  // Reduce bundle size: disable source maps in production builds.
-  productionBrowserSourceMaps: false,
-
-  // Image optimisation: allow the gateway origin as an external image source.
-  images: {
-    formats: ['image/avif', 'image/webp'],
-    remotePatterns: [
-      {
-        protocol: 'https',
-        hostname: '**',
-      },
-    ],
-  },
-
-  // Experimental: enable React compiler for automatic memoisation (Next 15+).
-  // Falls back gracefully if the compiler plugin is not installed.
-  experimental: {
-    // Turbopack is the default in dev for Next 15; keep it opt-in for now.
-    // turbo: {},
-  },
-};
-
-export default nextConfig;

apps/web/package.json

@@ -3,22 +3,19 @@
   "version": "0.0.2",
   "private": true,
   "scripts": {
-    "build": "node ../../scripts/build-web.mjs",
-    "build:vite": "vite build",
-    "dev": "next dev",
-    "dev:vite": "vite",
+    "build": "vite build",
+    "dev": "vite",
+    "preview": "vite preview",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",
-    "test:e2e": "playwright test",
-    "start": "next start"
+    "test:e2e": "playwright test"
   },
   "dependencies": {
     "@mosaicstack/design-tokens": "workspace:^",
     "@mosaicstack/types": "workspace:^",
     "better-auth": "^1.5.5",
     "clsx": "^2.1.0",
-    "next": "^16.0.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",

apps/web/playwright.config.ts

@@ -1,23 +1,30 @@
 import { defineConfig, devices } from '@playwright/test';
 
 /**
- * Playwright E2E configuration for Mosaic web app.
+ * Playwright E2E configuration for the Mosaic web SPA.
  *
- * Assumes:
- *   - Next.js web app running on http://localhost:3000
- *   - NestJS gateway running on http://localhost:14242
+ * Assumes the NestJS gateway is already running on http://localhost:14242 and
+ * serving the built SPA bundle (WEB_DIST_DIR pointing at apps/web/dist) — the
+ * same serving path production uses (Phase P5, #1444). Override the target
+ * with PLAYWRIGHT_BASE_URL.
+ *
+ * global-setup seeds the E2E users through the real bootstrap and admin APIs
+ * when the database is empty; against an already-populated environment it
+ * seeds nothing.
  *
  * Run with:   pnpm --filter @mosaicstack/web test:e2e
  */
 export default defineConfig({
   testDir: './e2e',
+  globalSetup: './e2e/global-setup.ts',
   fullyParallel: true,
   forbidOnly: !!process.env['CI'],
   retries: process.env['CI'] ? 2 : 0,
   workers: process.env['CI'] ? 1 : undefined,
-  reporter: 'html',
+  // CI needs the verdict in the step log; the html report is a local tool.
+  reporter: process.env['CI'] ? 'list' : 'html',
   use: {
-    baseURL: process.env['PLAYWRIGHT_BASE_URL'] ?? 'http://localhost:3000',
+    baseURL: process.env['PLAYWRIGHT_BASE_URL'] ?? 'http://localhost:14242',
     trace: 'on-first-retry',
     screenshot: 'only-on-failure',
   },
@@ -27,6 +34,6 @@ export default defineConfig({
       use: { ...devices['Desktop Chrome'] },
     },
   ],
-  // Do NOT auto-start the dev server — tests assume it is already running.
+  // Do NOT auto-start a server — tests assume the gateway is already running.
   // webServer is intentionally omitted so tests can run against a live env.
 });

apps/web/src/app/(auth)/layout.tsx

@@ -1,14 +0,0 @@
-import type { ReactNode } from 'react';
-import { GuestGuard } from '@/components/guest-guard';
-
-export default function AuthLayout({ children }: { children: ReactNode }): React.ReactElement {
-  return (
-    <GuestGuard>
-      <div className="flex min-h-screen items-center justify-center bg-surface-bg">
-        <div className="w-full max-w-md rounded-xl border border-surface-border bg-surface-card p-8 shadow-lg">
-          {children}
-        </div>
-      </div>
-    </GuestGuard>
-  );
-}

apps/web/src/app/(auth)/login/page.tsx

@@ -1,139 +0,0 @@
-'use client';
-
-import { useEffect, useState } from 'react';
-import { useRouter } from 'next/navigation';
-import Link from 'next/link';
-import { api } from '@/lib/api';
-import { authClient, signIn } from '@/lib/auth-client';
-import type { SsoProviderDiscovery } from '@/lib/sso';
-import { SsoProviderButtons } from '@/components/auth/sso-provider-buttons';
-
-export default function LoginPage(): React.ReactElement {
-  const router = useRouter();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-  const [ssoProviders, setSsoProviders] = useState<SsoProviderDiscovery[]>([]);
-  const [ssoLoadingProviderId, setSsoLoadingProviderId] = useState<
-    SsoProviderDiscovery['id'] | null
-  >(null);
-
-  useEffect(() => {
-    api<SsoProviderDiscovery[]>('/api/sso/providers')
-      .catch(() => [] as SsoProviderDiscovery[])
-      .then((providers) => setSsoProviders(providers.filter((provider) => provider.configured)));
-  }, []);
-
-  async function handleSubmit(e: React.FormEvent<HTMLFormElement>): Promise<void> {
-    e.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(e.currentTarget);
-    const email = form.get('email') as string;
-    const password = form.get('password') as string;
-
-    const result = await signIn.email({ email, password });
-
-    if (result.error) {
-      setError(result.error.message ?? 'Sign in failed');
-      setLoading(false);
-      return;
-    }
-
-    router.push('/chat');
-  }
-
-  async function handleSsoSignIn(providerId: SsoProviderDiscovery['id']): Promise<void> {
-    setError(null);
-    setSsoLoadingProviderId(providerId);
-
-    try {
-      const result = await authClient.signIn.oauth2({
-        providerId,
-        callbackURL: '/chat',
-        newUserCallbackURL: '/chat',
-      });
-
-      if (result.error) {
-        setError(result.error.message ?? `Sign in with ${providerId} failed`);
-        setSsoLoadingProviderId(null);
-      }
-    } catch (err: unknown) {
-      setError(err instanceof Error ? err.message : `Sign in with ${providerId} failed`);
-      setSsoLoadingProviderId(null);
-    }
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Sign in</h1>
-      <p className="mt-1 text-sm text-text-secondary">Sign in to your Mosaic account</p>
-
-      {error && (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      )}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="current-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Signing in...' : 'Sign in'}
-        </button>
-      </form>
-
-      <SsoProviderButtons
-        providers={ssoProviders}
-        loadingProviderId={ssoLoadingProviderId}
-        onOidcSignIn={(providerId) => {
-          void handleSsoSignIn(providerId);
-        }}
-      />
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Don&apos;t have an account?{' '}
-        <Link href="/register" className="text-blue-400 hover:text-blue-300">
-          Sign up
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/app/(auth)/register/page.tsx

@@ -1,114 +0,0 @@
-'use client';
-
-import { useState } from 'react';
-import { useRouter } from 'next/navigation';
-import Link from 'next/link';
-import { signUp } from '@/lib/auth-client';
-
-export default function RegisterPage(): React.ReactElement {
-  const router = useRouter();
-  const [error, setError] = useState<string | null>(null);
-  const [loading, setLoading] = useState(false);
-
-  async function handleSubmit(e: React.FormEvent<HTMLFormElement>): Promise<void> {
-    e.preventDefault();
-    setError(null);
-    setLoading(true);
-
-    const form = new FormData(e.currentTarget);
-    const name = form.get('name') as string;
-    const email = form.get('email') as string;
-    const password = form.get('password') as string;
-
-    const result = await signUp.email({ name, email, password });
-
-    if (result.error) {
-      setError(result.error.message ?? 'Registration failed');
-      setLoading(false);
-      return;
-    }
-
-    router.push('/chat');
-  }
-
-  return (
-    <div>
-      <h1 className="text-2xl font-semibold">Create account</h1>
-      <p className="mt-1 text-sm text-text-secondary">Get started with Mosaic</p>
-
-      {error && (
-        <div
-          role="alert"
-          className="mt-4 rounded-lg border border-error/30 bg-error/10 px-4 py-3 text-sm text-error"
-        >
-          {error}
-        </div>
-      )}
-
-      <form className="mt-6 space-y-4" onSubmit={handleSubmit}>
-        <div>
-          <label htmlFor="name" className="block text-sm font-medium text-text-secondary">
-            Name
-          </label>
-          <input
-            id="name"
-            name="name"
-            type="text"
-            autoComplete="name"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="Your name"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="email" className="block text-sm font-medium text-text-secondary">
-            Email
-          </label>
-          <input
-            id="email"
-            name="email"
-            type="email"
-            autoComplete="email"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="[email protected]"
-          />
-        </div>
-
-        <div>
-          <label htmlFor="password" className="block text-sm font-medium text-text-secondary">
-            Password
-          </label>
-          <input
-            id="password"
-            name="password"
-            type="password"
-            autoComplete="new-password"
-            required
-            disabled={loading}
-            className="mt-1 block w-full rounded-lg border border-surface-border bg-surface-elevated px-3 py-2 text-sm text-text-primary placeholder:text-text-muted focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 disabled:opacity-50"
-            placeholder="••••••••"
-          />
-        </div>
-
-        <button
-          type="submit"
-          disabled={loading}
-          className="w-full rounded-lg bg-blue-600 px-4 py-2.5 text-sm font-medium text-white transition-colors hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-surface-card disabled:opacity-50"
-        >
-          {loading ? 'Creating account...' : 'Create account'}
-        </button>
-      </form>
-
-      <p className="mt-4 text-center text-sm text-text-muted">
-        Already have an account?{' '}
-        <Link href="/login" className="text-blue-400 hover:text-blue-300">
-          Sign in
-        </Link>
-      </p>
-    </div>
-  );
-}

apps/web/src/app/(dashboard)/chat/page.tsx

@@ -1,365 +0,0 @@
-'use client';
-
-import { useCallback, useEffect, useRef, useState } from 'react';
-import { api } from '@/lib/api';
-import { destroySocket, getSocket } from '@/lib/socket';
-import type { Conversation, Message } from '@/lib/types';
-import {
-  ConversationSidebar,
-  type ConversationSidebarRef,
-} from '@/components/chat/conversation-sidebar';
-import { MessageBubble } from '@/components/chat/message-bubble';
-import { ChatInput } from '@/components/chat/chat-input';
-import { StreamingMessage } from '@/components/chat/streaming-message';
-
-interface ModelInfo {
-  id: string;
-  provider: string;
-  name: string;
-  reasoning: boolean;
-  contextWindow: number;
-  maxTokens: number;
-  inputTypes: ('text' | 'image')[];
-  cost: { input: number; output: number; cacheRead: number; cacheWrite: number };
-}
-
-interface ProviderInfo {
-  id: string;
-  name: string;
-  available: boolean;
-  models: ModelInfo[];
-}
-
-export default function ChatPage(): React.ReactElement {
-  const [activeId, setActiveId] = useState<string | null>(null);
-  const [messages, setMessages] = useState<Message[]>([]);
-  const [streamingText, setStreamingText] = useState('');
-  const [isStreaming, setIsStreaming] = useState(false);
-  const [isSidebarOpen, setIsSidebarOpen] = useState(true);
-  const [models, setModels] = useState<ModelInfo[]>([]);
-  const [selectedModelId, setSelectedModelId] = useState('');
-  const messagesEndRef = useRef<HTMLDivElement>(null);
-  const sidebarRef = useRef<ConversationSidebarRef>(null);
-
-  // Track the active conversation ID in a ref so socket event handlers always
-  // see the current value without needing to be re-registered.
-  const activeIdRef = useRef<string | null>(null);
-  activeIdRef.current = activeId;
-
-  // Accumulate streamed text in a ref so agent:end can read the full content
-  // without stale-closure issues.
-  const streamingTextRef = useRef('');
-
-  useEffect(() => {
-    const savedState = window.localStorage.getItem('mosaic-sidebar-open');
-    if (savedState !== null) {
-      setIsSidebarOpen(savedState === 'true');
-    }
-  }, []);
-
-  useEffect(() => {
-    window.localStorage.setItem('mosaic-sidebar-open', String(isSidebarOpen));
-  }, [isSidebarOpen]);
-
-  useEffect(() => {
-    api<ProviderInfo[]>('/api/providers')
-      .then((providers) => {
-        const availableModels = providers
-          .filter((provider) => provider.available)
-          .flatMap((provider) => provider.models);
-        setModels(availableModels);
-        setSelectedModelId((current) => current || availableModels[0]?.id || '');
-      })
-      .catch(() => {
-        setModels([]);
-        setSelectedModelId('');
-      });
-  }, []);
-
-  // Load messages when active conversation changes
-  useEffect(() => {
-    if (!activeId) {
-      setMessages([]);
-      return;
-    }
-    // Clear streaming state when switching conversations
-    setIsStreaming(false);
-    setStreamingText('');
-    streamingTextRef.current = '';
-    api<Message[]>(`/api/conversations/${activeId}/messages`)
-      .then(setMessages)
-      .catch(() => {});
-  }, [activeId]);
-
-  // Auto-scroll to bottom
-  useEffect(() => {
-    messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
-  }, [messages, streamingText]);
-
-  // Socket.io setup — connect once for the page lifetime
-  useEffect(() => {
-    const socket = getSocket();
-
-    function onAgentStart(data: { conversationId: string }): void {
-      // Only update state if the event belongs to the currently viewed conversation
-      if (activeIdRef.current !== data.conversationId) return;
-      setIsStreaming(true);
-      setStreamingText('');
-      streamingTextRef.current = '';
-    }
-
-    function onAgentText(data: { conversationId: string; text: string }): void {
-      if (activeIdRef.current !== data.conversationId) return;
-      streamingTextRef.current += data.text;
-      setStreamingText((prev) => prev + data.text);
-    }
-
-    function onAgentEnd(data: { conversationId: string }): void {
-      if (activeIdRef.current !== data.conversationId) return;
-      const finalText = streamingTextRef.current;
-      setIsStreaming(false);
-      setStreamingText('');
-      streamingTextRef.current = '';
-      // Append the completed assistant message to the local message list.
-      // The Pi agent session is in-memory so the assistant response is not
-      // persisted to the DB — we build the local UI state instead.
-      if (finalText) {
-        setMessages((prev) => [
-          ...prev,
-          {
-            id: `assistant-${Date.now()}`,
-            conversationId: data.conversationId,
-            role: 'assistant' as const,
-            content: finalText,
-            createdAt: new Date().toISOString(),
-          },
-        ]);
-        sidebarRef.current?.refresh();
-      }
-    }
-
-    function onError(data: { error: string; conversationId?: string }): void {
-      setIsStreaming(false);
-      setStreamingText('');
-      streamingTextRef.current = '';
-      setMessages((prev) => [
-        ...prev,
-        {
-          id: `error-${Date.now()}`,
-          conversationId: data.conversationId ?? '',
-          role: 'system' as const,
-          content: `Error: ${data.error}`,
-          createdAt: new Date().toISOString(),
-        },
-      ]);
-    }
-
-    socket.on('agent:start', onAgentStart);
-    socket.on('agent:text', onAgentText);
-    socket.on('agent:end', onAgentEnd);
-    socket.on('error', onError);
-
-    // Connect if not already connected
-    if (!socket.connected) {
-      socket.connect();
-    }
-
-    return () => {
-      socket.off('agent:start', onAgentStart);
-      socket.off('agent:text', onAgentText);
-      socket.off('agent:end', onAgentEnd);
-      socket.off('error', onError);
-      // Fully tear down the socket when the chat page unmounts so we get a
-      // fresh authenticated connection next time the page is visited.
-      destroySocket();
-    };
-  }, []);
-
-  const handleNewConversation = useCallback(async (projectId?: string | null) => {
-    const conv = await api<Conversation>('/api/conversations', {
-      method: 'POST',
-      body: { title: 'New conversation', projectId: projectId ?? null },
-    });
-
-    sidebarRef.current?.addConversation({
-      id: conv.id,
-      title: conv.title,
-      projectId: conv.projectId,
-      updatedAt: conv.updatedAt,
-      archived: conv.archived,
-    });
-
-    setActiveId(conv.id);
-    setMessages([]);
-    setIsSidebarOpen(true);
-  }, []);
-
-  const handleSend = useCallback(
-    async (content: string, options?: { modelId?: string }) => {
-      let convId = activeId;
-
-      // Auto-create conversation if none selected
-      if (!convId) {
-        const autoTitle = content.slice(0, 60);
-        const conv = await api<Conversation>('/api/conversations', {
-          method: 'POST',
-          body: { title: autoTitle },
-        });
-        sidebarRef.current?.addConversation({
-          id: conv.id,
-          title: conv.title,
-          projectId: conv.projectId,
-          updatedAt: conv.updatedAt,
-          archived: conv.archived,
-        });
-        setActiveId(conv.id);
-        convId = conv.id;
-      } else if (messages.length === 0) {
-        // Auto-title the initial placeholder conversation from the first user message.
-        const autoTitle = content.slice(0, 60);
-        api<Conversation>(`/api/conversations/${convId}`, {
-          method: 'PATCH',
-          body: { title: autoTitle },
-        })
-          .then(() => sidebarRef.current?.refresh())
-          .catch(() => {});
-      }
-
-      // Optimistic user message in local UI state
-      setMessages((prev) => [
-        ...prev,
-        {
-          id: `user-${Date.now()}`,
-          conversationId: convId,
-          role: 'user' as const,
-          content,
-          createdAt: new Date().toISOString(),
-        },
-      ]);
-
-      // Persist the user message to the DB so conversation history is
-      // available when the page is reloaded or a new session starts.
-      api<Message>(`/api/conversations/${convId}/messages`, {
-        method: 'POST',
-        body: { role: 'user', content },
-      }).catch(() => {
-        // Non-fatal: the agent can still process the message even if
-        // REST persistence fails.
-      });
-
-      // Send to WebSocket — gateway creates/resumes the agent session and
-      // streams the response back via agent:start / agent:text / agent:end.
-      const socket = getSocket();
-      if (!socket.connected) {
-        socket.connect();
-      }
-      socket.emit('message', {
-        conversationId: convId,
-        content,
-        modelId: (options?.modelId ?? selectedModelId) || undefined,
-      });
-    },
-    [activeId, messages, selectedModelId],
-  );
-
-  return (
-    <div
-      className="-m-6 flex h-[calc(100vh-3.5rem)] overflow-hidden"
-      style={{ background: 'var(--bg-deep, var(--color-surface-bg, #0a0f1a))' }}
-    >
-      <ConversationSidebar
-        ref={sidebarRef}
-        isOpen={isSidebarOpen}
-        onClose={() => setIsSidebarOpen(false)}
-        currentConversationId={activeId}
-        onSelectConversation={(conversationId) => {
-          setActiveId(conversationId);
-          setMessages([]);
-          if (conversationId && window.innerWidth < 768) {
-            setIsSidebarOpen(false);
-          }
-        }}
-        onNewConversation={(projectId) => {
-          void handleNewConversation(projectId);
-        }}
-      />
-
-      <div className="flex min-w-0 flex-1 flex-col">
-        <div
-          className="flex items-center gap-3 border-b px-4 py-3"
-          style={{ borderColor: 'var(--border)' }}
-        >
-          <button
-            type="button"
-            onClick={() => setIsSidebarOpen((open) => !open)}
-            className="rounded-lg border p-2 transition-colors"
-            style={{
-              borderColor: 'var(--border)',
-              background: 'var(--surface)',
-              color: 'var(--text)',
-            }}
-            aria-label={isSidebarOpen ? 'Close conversation sidebar' : 'Open conversation sidebar'}
-          >
-            <svg viewBox="0 0 24 24" className="h-4 w-4" fill="none" stroke="currentColor">
-              <path strokeWidth="2" strokeLinecap="round" d="M4 7h16M4 12h16M4 17h16" />
-            </svg>
-          </button>
-          <div>
-            <h1 className="text-sm font-semibold" style={{ color: 'var(--text)' }}>
-              Mosaic Chat
-            </h1>
-            <p className="text-xs" style={{ color: 'var(--muted)' }}>
-              {activeId ? 'Active conversation selected' : 'Choose or start a conversation'}
-            </p>
-          </div>
-        </div>
-
-        {activeId ? (
-          <>
-            <div className="flex-1 space-y-4 overflow-y-auto p-6">
-              {messages.map((msg) => (
-                <MessageBubble key={msg.id} message={msg} />
-              ))}
-              {isStreaming && <StreamingMessage text={streamingText} />}
-              <div ref={messagesEndRef} />
-            </div>
-            <ChatInput
-              onSend={handleSend}
-              isStreaming={isStreaming}
-              models={models}
-              selectedModelId={selectedModelId}
-              onModelChange={setSelectedModelId}
-            />
-          </>
-        ) : (
-          <div className="flex flex-1 items-center justify-center px-6">
-            <div
-              className="max-w-md rounded-2xl border px-8 py-10 text-center"
-              style={{
-                borderColor: 'var(--border)',
-                background: 'var(--surface)',
-              }}
-            >
-              <h2 className="text-lg font-medium" style={{ color: 'var(--text)' }}>
-                Welcome to Mosaic Chat
-              </h2>
-              <p className="mt-1 text-sm" style={{ color: 'var(--muted)' }}>
-                Select a conversation or start a new one
-              </p>
-              <button
-                type="button"
-                onClick={() => {
-                  void handleNewConversation();
-                }}
-                className="mt-4 rounded-lg px-4 py-2 text-sm font-medium text-white transition-colors"
-                style={{ background: 'var(--primary)' }}
-              >
-                Start new conversation
-              </button>
-            </div>
-          </div>
-        )}
-      </div>
-    </div>
-  );
-}

apps/web/src/app/(dashboard)/layout.tsx

@@ -1,11 +0,0 @@
-import type { ReactNode } from 'react';
-import { AppShell } from '@/components/layout/app-shell';
-import { AuthGuard } from '@/components/auth-guard';
-
-export default function DashboardLayout({ children }: { children: ReactNode }): React.ReactElement {
-  return (
-    <AuthGuard>
-      <AppShell>{children}</AppShell>
-    </AuthGuard>
-  );
-}