docs: close installation and control-link gates

REPORT-A1207.md

@@ -1,71 +0,0 @@
-# REPORT A1207
-
-Date: 2026-08-13
-Branch: `fix/869-lease-probe-timeout`
-Starting head: `2373a5ad345fb316ad2460f6390baab1f45ba08f`
-Base: `216cd72226cd9ee17eea461cfe7cd0e010a22f02`
-
-## What changed
-
-- Added Python behavior tests using isolated temporary directories and marker-writing fake `mosaic` executables. They prove that the supplied `PATH` wins over ambient `os.environ["PATH"]`, and that absent or empty supplied `PATH` values do not search ambient paths, platform defaults, or the current directory.
-- Bound Python override behavior with executable fakes: a valid `MOSAIC_LEASE_VERSION_PROBE_COMMAND` wins over supplied and ambient `PATH`; an invalid override returns `None` without PATH fallback.
-- Added a Python runner binding test that captures kwargs and requires `timeout=10.0`. Existing timeout, transport-error, and nonzero-exit checks remain fail-closed with `None`.
-- Added the optional TypeScript dependency-injection seam `CapabilityProbeExecFile`, defaulting to the existing real `execFileSync` implementation. Production callers have no behavior change.
-- Added TypeScript tests that capture child-process options and require exactly `timeout: 10_000`. Injected timeout, spawn-error, nonzero-exit, unparseable JSON, and malformed-object cases all return `null`.
-- Removed the ambient no-dependency TypeScript smoke case that could execute a built checkout's real CLI. Default resolver and supervisor behavior retain their isolated tests, while capability transport tests now use an isolated artifact or the injected transport.
-
-No Python production code changed relative to `2373a5ad`. The only production delta is the optional TypeScript child-process injection seam.
-
-## Hermeticity incident and correction
-
-An initial ambient-lookup mutation run exposed that the pre-existing Python "not resolvable" test left ambient process PATH uncontrolled. On this host, that mutation resolved and executed the host `mosaic` capability probe. A post-build intermediate TypeScript run also let the pre-existing no-dependency smoke case execute the checkout's built `dist/cli.js` capability probe. No `claude` process was run. I then isolated the Python test's ambient PATH, removed the TypeScript ambient smoke case, repeated the PATH mutation using only marker-writing temporary fakes, and repeated the final suites without either real probe path.
-
-## Mutation evidence
-
-Each mutation was applied independently, its focused suite was run, and the production source was restored before the final run.
-
-| Mutation                                                                                   | Result              | Reddened test name(s)                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `shutil.which("mosaic", path=environ.get("PATH", ""))` to ambient `shutil.which("mosaic")` | RED, three failures | `ProbeActivationCapabilityTest.test_supplied_path_wins_over_ambient_process_path`; `ProbeActivationCapabilityTest.test_absent_or_empty_supplied_path_never_falls_back_or_executes` for both absent and empty PATH subtests |
-| Python `PROBE_TIMEOUT_SECONDS: 10.0` to `2.0`                                              | RED, one failure    | `ProbeActivationCapabilityTest.test_probe_passes_ten_second_timeout_to_runner`                                                                                                                                             |
-| TypeScript `LEASE_CAPABILITY_PROBE_TIMEOUT_MS: 10_000` to `2_000`                          | RED, one failure    | `defaultCapabilityProbe > passes the exact ten-second timeout to the injected child-process transport`                                                                                                                     |
-
-## Final test run
-
-Dependencies were installed first with `pnpm install --frozen-lockfile`. Workspace dependencies were then built with `pnpm --filter '@mosaicstack/mosaic...' run build` so package type declarations were available.
-
-```text
-$ cd packages/mosaic && python3 src/mutator-gate/version_coupling_unittest.py
-...................
-----------------------------------------------------------------------
-Ran 19 tests in 0.007s
-
-OK
-
-$ pnpm exec vitest run src/commands/lease-activation-probe.spec.ts
-✓ src/commands/lease-activation-probe.spec.ts (20 tests) 80ms
-Test Files  1 passed (1)
-Tests       20 passed (20)
-```
-
-```text
-$ pnpm exec prettier --check packages/mosaic/src/commands/lease-activation-probe.ts packages/mosaic/src/commands/lease-activation-probe.spec.ts
-Checking formatting...
-All matched files use Prettier code style!
-
-$ pnpm --filter @mosaicstack/mosaic lint
-> eslint src
-
-$ pnpm --filter @mosaicstack/mosaic typecheck
-> tsc --noEmit
-
-$ python3 -m py_compile packages/mosaic/src/mutator-gate/version_coupling_unittest.py packages/mosaic/framework/tools/lease-broker/activation_version_gate.py
-
-$ git diff --check
-```
-
-All commands above exited zero.
-
-## Ambiguities skipped
-
-None.

docs/ADMIN-GUIDE/README.md

@@ -9,19 +9,19 @@ This book is the canonical home for installation, configuration, deployment, rou
 - [Documentation atlas](../README.md) — placement rules and source-of-truth boundaries.
 - [Documentation sitemap](../SITEMAP.md) — resolvable current navigation and authority-gated migration summary.
 - [Product requirements](../PRD.md) — normative requirements, currently marked draft.
-- [Operations index](operations/README.md) — current local procedures, unattended fleet first-start handling, and explicitly held operational outlines.
+- [Operations index](operations/README.md) — current local procedures and explicitly held operational outlines.
 - [Security index](security/README.md) — current SSO provider configuration.
 
 ## Chapter map
 
-| Chapter                               | Scope                                                               | Status                                                                                         |
+| Chapter                               | Scope                                                               | Status                                                                  |
-| ------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| ------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------- |
-| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                                                 |
+| `installation/`                       | Prerequisites, installation, and first deployment.                  | Scaffold only.                                                          |
-| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                                                 |
+| `configuration/`                      | Environment, provider, tier, and runtime configuration.             | Scaffold only.                                                          |
-| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                                                 |
+| `deployment/`                         | Topologies, rollout, migration, and upgrade procedures.             | Scaffold only.                                                          |
-| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery and fleet first start are current; connector lease operations are held. |
+| [`operations/`](operations/README.md) | Health, observability, routine operation, and maintenance.          | Local upgrade/recovery is current; connector lease operations are held. |
-| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                                        |
+| [`security/`](security/README.md)     | Authentication, authorization, SSO, secrets, and security controls. | SSO provider guide is current; other pages are planned.                 |
-| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                                                 |
+| `recovery/`                           | Incident response, backup, rollback, and recovery.                  | Scaffold only.                                                          |
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/ADMIN-GUIDE/operations/README.md

@@ -5,7 +5,6 @@
 ## Current procedures
 
 - [Upgrade safety and recovery](upgrade-safety-and-recovery.md) — installed-CLI and local-PGlite upgrade, rollback, and framework-configuration recovery.
-- [Fleet unattended first start](fleet-unattended-first-start.md) — systemd/no-TTY identity initialization, failure handling, and isolated verification.
 
 ## Held procedures
 

docs/ADMIN-GUIDE/operations/fleet-unattended-first-start.md

@@ -1,70 +0,0 @@
-# Fleet Unattended First-Start Operations
-
-> **Status:** Current after issue #1264 lands. This runbook covers only Mosaic's first-run identity
-> gate; it does not install runtimes or credentials.
-
-## Operational contract
-
-A systemd fleet unit launches under a sanitized environment with no TTY. The generated environment
-sets `MOSAIC_AGENT_NAME`; Mosaic resolves that exact value against the canonical installed roster
-before writing identity files.
-
-If top-level identity contracts are missing, Mosaic atomically seeds them from the shipped generic
-sources:
-
-| Destination            | Source                          | New-file mode |
-| ---------------------- | ------------------------------- | ------------- |
-| `$MOSAIC_HOME/SOUL.md` | `$MOSAIC_HOME/defaults/SOUL.md` | `0600`        |
-| `$MOSAIC_HOME/USER.md` | `$MOSAIC_HOME/defaults/USER.md` | `0600`        |
-
-Creation is no-clobber and safe under concurrent seat starts. Existing regular files remain
-byte-for-byte and mode-for-mode unchanged. The runtime composer then injects the exact roster name
-and class; the generic source files grant no seat authority.
-
-## Failure handling
-
-The fleet path never falls back to an interactive wizard. It exits nonzero before runtime execution
-when:
-
-- `MOSAIC_AGENT_NAME` is not an exact roster member;
-- a defined ambient `MOSAIC_AGENT_CLASS` is blank/whitespace or disagrees with that member's
-  canonical class;
-- a missing destination has no safe regular default source;
-- a source or existing destination is a symlink (including dangling), directory, unavailable, or over the bounded size;
-- the fleet communications helper/roster cannot be validated; or
-- `USER.md` cannot be securely re-read at the point where its content is composed.
-
-Diagnostics begin with:
-
-```text
-[mosaic] ERROR: unattended fleet identity initialization failed: ...
-```
-
-Repair the exact named source, destination, roster, or helper and retry only that roster member. Do
-not delete or replace an existing personalized `SOUL.md`/`USER.md` merely to clear the check.
-
-## Verification without a live seat
-
-The source gate is:
-
-```bash
-pnpm --filter @mosaicstack/mosaic... build && \
-  pnpm --filter @mosaicstack/mosaic exec vitest run \
-    src/commands/launch-first-start.spec.ts
-```
-
-The build leg is load-bearing: `dist/` is ignored, so a direct Vitest invocation could otherwise run
-absent or stale CLI output. The gate runs the exact-source built CLI in subprocesses with piped stdin,
-temporary homes, a canonical fixture roster, fake runtime/broker executables, and no provider call. It
-covers no-TTY launch, exact identity,
-private modes, no-clobber, missing/symlink defaults, unknown members, blank/mismatched class,
-portable standalone composition/wizard preservation, and concurrent first start.
-
-Do not use this fixture as proof that a real provider credential is present or that a package has
-been deployed. Those require separate environment-specific evidence.
-
-## Related
-
-- [User workflow](../../USER-GUIDE/workflows/fleet-unattended-first-start.md)
-- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
-- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)

docs/DEVELOPER-GUIDE/README.md

@@ -26,7 +26,6 @@ This book is the canonical home for architecture, package and application guides
 
 - [Lease-broker operations and verification](testing/lease-broker-operations.md) — safe static/test commands plus explicitly held live operations.
 - [Channel adapters](integrations/channel-adapters.md) — current shared contracts and Discord reference boundary; future adapter parity is draft.
-- [Fleet first-start identity](architecture/fleet-first-start-identity.md) — no-TTY launch boundary, roster authority, and no-clobber filesystem design.
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/DEVELOPER-GUIDE/architecture/README.md

@@ -11,7 +11,6 @@ This chapter is the canonical home for Mosaic Stack's system model, component bo
 - [`mutator-class-gate.md`](mutator-class-gate.md) — default-deny tool authorization, runtime adapters, launch choke point, and parser assurance boundary.
 - [`compaction-revocation.md`](compaction-revocation.md) — Claude/Pi observer lifecycle, runtime generations, revocation, and the bounded residual stale window.
 - [`channel-protocol.md`](channel-protocol.md) — current shared channel DTOs and Discord compatibility baseline, with unimplemented adapter work explicitly marked draft.
-- [`fleet-first-start-identity.md`](fleet-first-start-identity.md) — roster-owned identity bootstrap for concurrent no-TTY fleet launches.
 - [`decisions/mos-runtime-portability-m1.md`](decisions/mos-runtime-portability-m1.md) — current logical identity, connector lease, grant, audit, and fencing decision; connector activation remains held.
 
 These pages are current security-contract references and are consumed by the lease-broker acceptance suites. Their live deployment gaps remain explicitly labeled in the pages; this migration does not change runtime behavior.

docs/DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md

@@ -1,81 +0,0 @@
-# Fleet First-Start Identity Boundary
-
-> **Status:** Implemented by issue #1264. Requirements: `FCM-REQ-12`, `AC-FCM-10`.
-
-## Problem
-
-`launchRuntime()` called `checkSoul()` before runtime execution. A missing top-level `SOUL.md`
-caused `checkSoul()` to spawn a child `mosaic wizard` with inherited stdio. Under a systemd-created
-fleet pane with no TTY, that child blocked or failed before the runtime boundary even though generic
-`defaults/SOUL.md` and `defaults/USER.md` already shipped in the same `MOSAIC_HOME`.
-
-## Chosen boundary
-
-The fix remains at `checkSoul()` and does not add flags to `yolo`, fleet commands, systemd units, or
-`start-agent-session.sh`:
-
-1. A present, nonblank, whitespace-exact `MOSAIC_AGENT_NAME` selects the fleet path.
-2. `resolveFleetIdentity()` must resolve that exact member through the existing roster/helper
-   boundary, and any defined `MOSAIC_AGENT_CLASS` (including blank/whitespace) must canonicalize to
-   the roster class, before any identity seed. Only undefined means absent.
-3. `lstatSync()` preflights every destination directory entry without following links, so a dangling
-   link is rejected before its counterpart can be published.
-4. Safe bounded snapshots are read from only the missing contracts under `defaults/`.
-5. Each snapshot is written to a random owner-private temporary file in `MOSAIC_HOME`.
-6. `linkSync()` publishes the complete file without overwriting an existing path. `EEXIST` means a
-   concurrent seat or operator won; the existing path is preserved and revalidated.
-7. Temporary files are removed, and both installed contracts are re-opened through the no-symlink
-   secure-file reader before launch continues.
-8. `composeContract()` independently re-resolves the roster, securely reads fleet `USER.md` through
-   a Linux descriptor at the point of use, and injects exact member identity and communications data.
-
-A standalone launch with no `MOSAIC_AGENT_NAME` retains the portable tolerant USER read and the
-interactive wizard. Fleet-only no-follow enforcement must not make supported standalone macOS
-composition depend on Linux `/proc` descriptor traversal.
-
-## Identity and authority
-
-The copied defaults deliberately say “Mosaic agent”; they are a generic behavioral base. They are
-not the source of a fleet seat's identity. The canonical roster controls:
-
-- exact agent/session name;
-- canonical role/class and persona;
-- peer rows and point of contact;
-- tmux socket and helper target; and
-- communications generation.
-
-An unknown/padded ambient name, mismatched class, or explicitly blank/whitespace class fails before
-any file is seeded. This avoids replacing the interactive wall with a fleet of indistinguishable or
-ambiently invented identities.
-
-## Concurrency and filesystem properties
-
-- Sources and final destinations are bounded regular files beneath `MOSAIC_HOME`; target and dangling
-  symlinks are not followed.
-- New files have mode `0600`.
-- Hard-link publication is same-filesystem, atomic, and no-clobber.
-- A temporary path is removed only when this process successfully created it.
-- All required source snapshots are validated before the first destination is published, preventing
-  a missing second default from leaving a partial seed.
-- Existing operator files are never chmodded or rewritten.
-
-## Verification
-
-`src/commands/launch-first-start.spec.ts` uses the production-kind boundary: the real built CLI in a
-no-TTY subprocess, not a direct wizard test. The package `test:vitest` gate builds Mosaic before
-Vitest, while the clean-checkout command builds its workspace dependencies first, so ignored
-`dist/cli.js` cannot be absent or stale. A fake lease launcher records whether execution reached the
-runtime boundary and captures the composed prompt.
-Positive and negative cases prove the check can both proceed and refuse. Fleet composition coverage
-replaces a previously validated `USER.md` with an external symlink and proves point-of-use refusal;
-a standalone unreadable-optional-USER case proves the portable tolerant branch remains separate.
-
-Real Pi authentication and provider task execution remain environment tests, not claims of this
-fixture.
-
-## Non-goals
-
-- Runtime installation or pane-PATH resolution (#1256/#1258).
-- The held `~/.mosaic` launch-composition layer in PR #1213.
-- Personalizing the operator's standalone identity without a wizard.
-- Changing fleet systemd or shell launcher code.

docs/PRD.md

@@ -146,29 +146,6 @@ lands. M0 consists only of these normative requirements, the complete task DAG,
 documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
 are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
 
-### Unattended fleet first-start amendment (#1264)
-
-`FCM-REQ-11` is reserved by #1256's concurrent runtime-preflight delivery. This amendment therefore
-uses the next non-colliding identifiers.
-
-1. `FCM-REQ-12`: A roster-owned fleet launch SHALL NOT invoke an interactive identity wizard when
-   top-level `SOUL.md` or `USER.md` is absent. It SHALL initialize only missing top-level identity
-   contracts from the shipped generic `defaults/` contracts without overwriting operator-owned
-   bytes. The canonical roster member remains the sole source of the seat's exact name and class;
-   generic defaults grant no fleet identity or authority. Missing or unsafe defaults SHALL fail
-   closed with actionable diagnostics before runtime execution. Non-fleet launches retain the
-   interactive identity flow.
-2. `AC-FCM-10`: A systemd-equivalent no-TTY test with a clean temporary Mosaic home SHALL prove a
-   named fleet seat reaches the runtime boundary without starting `mosaic wizard`, creates
-   byte-equal owner-private `SOUL.md` and `USER.md` seeds, and receives its exact roster name/class in
-   composed context. Tests SHALL also prove no-clobber behavior, concurrent/idempotent first start,
-   fail-closed invalid defaults, and preservation of the standalone interactive path.
-
-`ASSUMPTION:` `MOSAIC_AGENT_NAME` is the existing launch discriminator for roster-owned fleet
-processes. This amendment does not add a second fleet flag because generated fleet environments
-already set that value and the runtime composer independently resolves it against the canonical
-roster before execution.
-
 ---
 
 ## Exact Cross-Harness Fleet Communications Contract (#766)

docs/SITEMAP.md

@@ -38,13 +38,11 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Quickstart](USER-GUIDE/getting-started/quickstart.md) — installed-CLI first-use route with local PGlite safety boundaries.
 - [Web dashboard](USER-GUIDE/product/web-dashboard.md) — current routes, views, chat persistence, settings, and admin behavior.
 - [Discord conversations](USER-GUIDE/workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
-- [Fleet unattended first start](USER-GUIDE/workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap and exact roster identity.
 
 ## Administrator documentation
 
 - [Administrator operations](ADMIN-GUIDE/operations/README.md) — current local procedures and explicitly held outlines.
 - [Upgrade safety and recovery](ADMIN-GUIDE/operations/upgrade-safety-and-recovery.md) — installed-CLI/local-PGlite upgrade and framework recovery.
-- [Fleet unattended first-start operations](ADMIN-GUIDE/operations/fleet-unattended-first-start.md) — systemd identity initialization, refusal paths, and isolated verification.
 - [Mos connector lease operations](ADMIN-GUIDE/operations/mos-connector-lease-operations.md) — held/non-operative M1 outline while policy remains deny-all.
 - [Administrator security](ADMIN-GUIDE/security/README.md) — current security chapter index.
 - [SSO providers](ADMIN-GUIDE/security/sso-providers.md) — Authentik, WorkOS, and Keycloak configuration and discovery.
@@ -58,7 +56,6 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Lease-broker security](DEVELOPER-GUIDE/architecture/lease-broker-security.md) — identity, ancestry, filesystem, observer, and residual boundaries.
 - [Whole mutator-class gate](DEVELOPER-GUIDE/architecture/mutator-class-gate.md) — default-deny tool authorization and launch choke point.
 - [Compaction revocation](DEVELOPER-GUIDE/architecture/compaction-revocation.md) — lifecycle observers, generation fencing, and residual stale window.
-- [Fleet first-start identity](DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md) — roster authority and atomic no-clobber identity seeding.
 - [Architecture decisions](DEVELOPER-GUIDE/architecture/decisions/README.md) — implemented and accepted boundaries.
 - [Mos runtime portability M1](DEVELOPER-GUIDE/architecture/decisions/mos-runtime-portability-m1.md) — logical identity, connector lease, grants, audit, and fencing.
 - [Architecture RFCs](DEVELOPER-GUIDE/architecture/rfcs/README.md) — draft proposals without operational authority.
@@ -78,7 +75,6 @@ These paths remain canonical because current source/tests consume them or becaus
 - [Archived planning](archive/planning/README.md) — historical briefs, board reviews, and work-package specifications.
 - [Archived work records](archive/work-records/README.md) — historical task scratchpads without live consumers.
 - [P8-003 performance report](reports/qa/p8-003-performance-optimization.md) — historical implementation evidence, not a current SLO.
-- [Issue #1264 unattended fleet first-start verification](reports/qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence and explicit untested bounds.
 - [Plans index](plans/README.md) — approved intent and implementation/audit plans.
 - [Documentation information-architecture design](plans/2026-08-10-docs-information-architecture-design.md) — approved documentation structure decision.
 - [Documentation catalog-audit plan](plans/2026-08-10-docs-catalog-audit.md) — evidence method and migration acceptance criteria.

docs/USER-GUIDE/README.md

@@ -11,7 +11,6 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — install Mosaic, complete setup, and launch a session.
 - [Web dashboard](product/web-dashboard.md) — current routes, navigation, chat persistence, projects/tasks views, settings, and admin behavior.
 - [Discord conversations](workflows/discord-conversations.md) — current authorized parent-channel, thread, attachment, and control workflow.
-- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — no-TTY identity bootstrap, exact roster identity, and separate runtime prerequisites.
 
 ## Chapter map
 
@@ -19,7 +18,7 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 | ------------------ | ------------------------------------------------------------- | ---------------------------------------------------- |
 | `getting-started/` | First-use setup, orientation, and quickstarts.                | Quickstart is current; additional pages are planned. |
 | `concepts/`        | User-facing terminology, product concepts, and mental models. | Scaffold only.                                       |
-| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord and fleet first-start workflows are current. |
+| `workflows/`       | Task-oriented procedures for using Mosaic Stack.              | Discord conversation workflow is current.            |
 | `product/`         | Current product surfaces and visible behavior.                | Web dashboard reference is current.                  |
 | `troubleshooting/` | User-visible failures, diagnostics, and fixes.                | Scaffold only.                                       |
 
@@ -28,7 +27,6 @@ This book is the canonical home for end-user workflows, user-visible behavior, p
 - [Quickstart](getting-started/quickstart.md) — the verified installed-CLI first-use path.
 - [Web dashboard](product/web-dashboard.md) — verified current Next.js dashboard behavior and limitations.
 - [Discord conversations](workflows/discord-conversations.md) — verified current Discord user workflow.
-- [Fleet unattended first start](workflows/fleet-unattended-first-start.md) — verified no-TTY first-start behavior and prerequisite boundaries.
 
 Every promoted page must be added to this index and to [`SITEMAP.md`](../SITEMAP.md) in the same migration slice.
 

docs/USER-GUIDE/workflows/fleet-unattended-first-start.md

@@ -1,61 +0,0 @@
-# Fleet Unattended First Start
-
-> **Status:** Current for roster-owned local fleet launches after issue #1264 lands. Runtime
-> installation and provider authentication remain separate prerequisites.
-
-A fleet seat started by systemd has no operator at its pane. On its first launch, Mosaic must not
-stop at the interactive identity wizard.
-
-## What happens on first start
-
-When `MOSAIC_AGENT_NAME` names an exact member of the installed fleet roster and top-level identity
-contracts are absent, the launcher:
-
-1. validates the exact roster member, its canonical class, and the installed fleet communications
-   helper;
-2. reads the shipped generic contracts from
-   `~/.config/mosaic/defaults/SOUL.md` and `defaults/USER.md`;
-3. creates only the missing top-level `SOUL.md` and `USER.md` as owner-private files;
-4. preserves any existing top-level identity file byte-for-byte; and
-5. launches the runtime with the roster member's exact agent/session name and role/class in composed
-   context.
-
-The generic defaults do **not** make every seat the same identity. They provide a shared behavioral
-base. The canonical roster row supplies each seat's exact name, class, peers, socket, and authority.
-
-## Operator behavior
-
-A normal standalone launch without a fleet identity retains its portable configuration path and still
-uses the interactive wizard when `SOUL.md` is absent:
-
-```bash
-mosaic pi
-```
-
-A roster-owned seat may be started without attaching to its pane:
-
-```bash
-mosaic fleet start <exact-roster-name>
-```
-
-Mosaic refuses before runtime execution if the requested member is absent, its explicitly supplied
-ambient class is blank or conflicts with the roster, a required default is missing or unsafe, or an existing identity contract
-is not a safe regular file. Repair the named component and retry the same exact roster member; do not
-copy another seat's personalized identity.
-
-## Separate prerequisites
-
-This behavior clears the Mosaic identity-wizard wall only. A clean host still needs:
-
-- the declared runtime installed on the pane PATH;
-- the fleet transport and generated unit assets; and
-- runtime/provider authentication appropriate to that seat.
-
-Those checks are separate so a successful identity bootstrap is not reported as a fully authenticated
-agent session.
-
-## Related
-
-- [Administrator runbook](../../ADMIN-GUIDE/operations/fleet-unattended-first-start.md)
-- [Developer architecture](../../DEVELOPER-GUIDE/architecture/fleet-first-start-identity.md)
-- [Verification report](../../reports/qa/2026-08-16-1264-unattended-first-start.md)

docs/reports/README.md

@@ -12,13 +12,11 @@ Use the canonical guide, API contract, source, and tests to determine current be
 - [Issue #756 documentation checklist](documentation/756-discord-plugin-checklist.md) — historical completion checklist for the official Discord plugin workstream.
 - [Framework consistency audit — 2026-02-17](documentation/AUDIT-2026-02-17-framework-consistency.md) — historical framework consistency and remediation snapshot.
 - [Compaction-refresh #830 checklist](compaction-refresh/830-documentation-checklist.md) — historical incomplete-at-snapshot documentation checklist.
-- [Issue #1264 documentation checklist](documentation/1264-documentation-checklist.md) — current in-repo user/admin/developer/report coverage and review gate.
 
 ## Code-review evidence
 
 - [Issue #756 independent code review](code-review/756-code-review.md) — historical exact-scope review of the official Discord plugin workstream.
 - [Gateway security-hardening code review — 2026-03-13](code-review/gateway-security-20260313.md) — historical no-blocker review snapshot.
-- [Issue #1264 independent code and security review](code-review/1264-code-review.md) — initial finding, remediation, clean re-review, and remaining formal PR-review gate.
 
 ## Security evidence
 
@@ -28,7 +26,6 @@ Use the canonical guide, API contract, source, and tests to determine current be
 
 - [P8-003 performance optimization report](qa/p8-003-performance-optimization.md) — historical implementation evidence; not a current SLO or production benchmark.
 - [Gateway security-hardening QA report — 2026-03-13](qa/gateway-security-20260313.md) — historical test report with its original live-smoke-test limitation.
-- [Issue #1264 unattended fleet first-start verification](qa/2026-08-16-1264-unattended-first-start.md) — RED/GREEN no-TTY CLI evidence, baseline gates, and explicit real-provider limitation.
 
 ## Native Kanban/SOT evidence
 

docs/reports/code-review/1264-code-review.md

@@ -1,97 +0,0 @@
-# Issue #1264 Code and Security Review
-
-> Branch: `fix/1264-fleet-unattended-first-start` | Base:
-> `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
-
-## Initial automated review
-
-Codex reviewed the pre-PR uncommitted delta with:
-
-```bash
-~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
-  -o /tmp/1264-codex-code-review.json
-```
-
-Result: `request-changes`, confidence `0.93`, 20 files, one should-fix. `checkSoul()` trimmed
-`MOSAIC_AGENT_NAME` for pre-seed resolution while composition used the original value, so a padded
-name could seed files before later refusal.
-
-Remediation rejected blank/leading/trailing-whitespace values before roster lookup or writes and
-added three built-CLI no-side-effect regressions. Automated re-review approved that delta with no
-findings (confidence `0.86`). Initial security review reported risk `none` (confidence `0.91`).
-
-## Formal exact-head review
-
-Daphne reviewed PR #1268 at exact head `43fa0477877e0d0f110da8d11c3033b40ddeb191` and filed Gitea
-review ID 168 as `REQUEST_CHANGES`. The review was source/PR-only; the canary remained untouched.
-
-Blocking groups:
-
-1. class mismatch was validated after first-start mutation;
-2. secure `USER.md` validation was discarded before ordinary path-following composition;
-3. `existsSync()` treated a dangling destination symlink as missing, allowing counterpart partial
-   publication; and
-4. the built-CLI/evidence chain allowed stale ignored `dist/`, cited an unshipped canary object, and
-   carried conflicting test totals/pane wording.
-
-The diagnostic's defaults-only repair advice was also inaccurate for roster/class/destination
-failures.
-
-## Formal-review remediation
-
-All four blocking groups received regressions before production changes. The RED run produced four
-failures while 1,568 existing tests passed. Remediation then:
-
-- validates canonical name and class before seeding;
-- preflights destination directory entries with `lstatSync()` so target and dangling symlinks fail
-  before publication;
-- securely reads `USER.md` through an `O_NOFOLLOW` descriptor at composition time;
-- adds a Mosaic build before package Vitest and a dependency build in the clean-checkout command;
-- replaces defaults-only advice with neutral named-component repair guidance; and
-- reconciles shipping canary provenance, pane chronology, commands, and totals.
-
-Remediation code review:
-
-```bash
-~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted \
-  -o /tmp/1264-remediation-code-review.json
-```
-
-Result: `approve`, confidence `0.88`, 6 files, no findings. Summary: the fail-closed destination
-checks, class-validation order, secure composition, and build-before-Vitest path are coherent.
-
-Remediation security review:
-
-```bash
-~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted \
-  -o /tmp/1264-remediation-security-review.json
-```
-
-Result: risk `none`, confidence `0.93`, 9 files, no critical/high/medium/low findings. The sandbox
-could not run Vitest because Vite attempted to create a temporary config artifact on its read-only
-mount (`EROFS`); executor-owned focused and full results are recorded in the QA report.
-
-## Second exact-head review
-
-Daphne reviewed exact head `9dc90be7e13b1cd609f6df97d43d890ef5392ca0` and filed Gitea review
-ID 169 as `REQUEST_CHANGES`. Review 169 confirmed all review-168 closures, then found:
-
-1. the new point-of-use reader was Linux-only but had been applied to every standalone USER read,
-   breaking supported non-fleet macOS composition; and
-2. explicit blank/whitespace `MOSAIC_AGENT_CLASS` was treated as absent and could seed before
-   runtime, while only undefined should mean absent.
-
-Red-first remediation preserves legacy `readOptional()` for standalone composition, keeps descriptor
-no-follow consumption fleet-only, moves the replacement-symlink case under a valid fleet identity,
-and rejects defined blank/whitespace classes before seeding. Three blank-class CLI cases and one
-tolerant standalone composition case failed before the source change and pass after it.
-
-Review-169 remediation code review approved at confidence `0.90` (4 files, no findings). Security
-review reported risk `none` at confidence `0.90` (4 files, no findings). The review sandbox retained
-its known Vite `EROFS` limitation; executor-owned tests are in the QA report.
-
-## Remaining review gate
-
-Daphne must re-review the next exact pushed head. This report cannot record that future verdict
-without changing the reviewed head, so the authoritative terminal verdict belongs to PR #1268's
-Gitea review record. Fred and goals are excluded as reviewers.

docs/reports/documentation/1264-documentation-checklist.md

@@ -1,32 +0,0 @@
-# #1264 Documentation Completion Checklist
-
-## Required artifacts
-
-- [x] `docs/PRD.md` updated with `FCM-REQ-12` and `AC-FCM-10`.
-- [x] User workflow documents unattended fleet first start and separate prerequisites.
-- [x] Administrator operations page documents source/destination ownership, failure handling, and an
-      exact-source build-before-Vitest verification gate.
-- [x] Developer architecture page documents control flow, identity authority, concurrency, and non-goals.
-- [x] `docs/SITEMAP.md` and book indexes updated.
-- [x] QA evidence is under `docs/reports/qa/`; working notes are under `docs/scratchpads/`.
-- [x] Framework defaults README reflects fleet-versus-standalone behavior.
-
-## API coverage
-
-- [x] No HTTP/API endpoint or DTO changed; OpenAPI and endpoint indexes are not applicable.
-
-## Structural standards
-
-- [x] User, administrator, developer, report, and sitemap indexes link the new pages.
-- [x] No noncanonical file was added at the `docs/` root.
-- [x] Canonical documentation remains in-repo; no external publication was requested or performed.
-
-## Review gate
-
-- [x] Initial padded-name finding remediated and automated re-review approved.
-- [x] Daphne formal review ID 168 completed on exact first head `43fa0477` and requested changes.
-- [x] Four review-168 groups reproduced red and remediated; automated reviews are clean.
-- [x] Daphne review ID 169 completed on exact head `9dc90be7` and confirmed review-168 closures.
-- [x] Review-169 standalone-portability and blank-class blockers reproduced red and remediated;
-      automated reviews are clean.
-- [ ] Daphne exact-second-remediation-head re-review completed after push (Fred/goals excluded).

docs/reports/qa/2026-08-16-1264-unattended-first-start.md

@@ -1,220 +0,0 @@
-# #1264 Unattended Fleet First-Start Verification
-
-> Status: **IN PROGRESS — review-169 remediation complete locally; push/re-review pending** |
-> Executor: goals | Date: 2026-08-16 | Target: isolated local fixtures only
-
-## Objective
-
-Verify that a named fleet seat launched through a systemd-equivalent, no-TTY environment on a clean
-host reaches its runtime boundary without an interactive Mosaic identity wizard. Preserve standalone
-wizard behavior and canonical-roster ownership of exact seat identity.
-
-## Source evidence accepted for local verification
-
-Daphne's canary Run-7 report is reachable from jarvis-brain `origin/main` at
-`8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`,
-`docs/reports/2026-08-16_sbx-canary-greenfield-e2e.md`. The earlier local object
-`6c0b6fc70ae6a179a1b7ff9dedfc54e9adccd19a` is not reachable from an origin ref and is not used as
-shipping provenance. Run 7 measured:
-
-```text
-systemd -> start-agent-session.sh -> mosaic yolo pi (PID 3726)
-                                  -> child mosaic wizard (PID 3762)
-```
-
-The pane was preserved when Run 7 was captured. Formal review ID 168 records that an authorized
-rollback occurred later. This task never accessed or altered the canary VM, pane, snapshot, or
-rollback state. Product behavior is independently tested here with temporary roots and fake runtime
-executables.
-
-## Controls
-
-- Original base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`.
-- PR: #1268, first pushed head `43fa0477877e0d0f110da8d11c3033b40ddeb191`.
-- `DATABASE_URL` remains unset for local tests.
-- No runtime/provider credential or token value, VM, installed Mosaic tree, unit, timer, PATH profile,
-  or live tmux session is read or mutated. Standard Gitea/Woodpecker wrappers authenticate metadata
-  reads/writes without exposing credential values.
-- Tiny's runtime-preflight and `start-agent-session.sh` PATH work remain out of scope.
-- Held PR #1213 is not a dependency.
-
-## Requirements-to-evidence map
-
-| Acceptance criterion                                                   | Method                                                          | Evidence                      |
-| ---------------------------------------------------------------------- | --------------------------------------------------------------- | ----------------------------- |
-| No-TTY fleet first start avoids wizard and reaches runtime             | Exact-source built CLI with piped stdin                         | CLI GREEN                     |
-| Missing top-level identity files are initialized from shipped defaults | Exact-byte and `0600` assertions                                | CLI + filesystem GREEN        |
-| Exact seat identity remains roster-owned                               | Captured argv; mismatched/blank class no-side-effect refusals   | CLI GREEN                     |
-| Existing operator identity is never overwritten                        | Custom bytes/mode with defaults removed                         | CLI + filesystem GREEN        |
-| Concurrent/repeated first start is safe                                | Four parallel CLIs plus repeated launch                         | CLI GREEN                     |
-| Missing/unsafe defaults and destinations fail before partial mutation  | Missing, target/dangling symlink, oversized, invalid-root cases | Filesystem/CLI GREEN          |
-| Validated `USER.md` cannot be replaced by an external symlink          | Seed, replace, compose at point of use                          | Composition GREEN             |
-| Standalone launch retains wizard                                       | Same built CLI without fleet identity                           | CLI GREEN                     |
-| Built-CLI evidence cannot use stale ignored `dist/`                    | Build-with-dependencies gate before Vitest                      | Package script + command gate |
-
-## Initial RED
-
-Production source remained unchanged after adding the first reproducer. The CLI was built from
-`origin/next@476db12` before the test.
-
-```bash
-env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic exec vitest run \
-  src/commands/launch-first-start.spec.ts
-```
-
-Exit `1`; one file and one test failed. Output included:
-
-```text
-[mosaic] SOUL.md not found. Running setup wizard...
-◆  What would you like to do?
-[mosaic] Setup failed. Run: mosaic wizard
-AssertionError: expected 1 to be +0
-```
-
-The fake runtime-boundary capture was not created. Complete stdout/stderr was retained at
-`/tmp/1264-red.out` during that work session.
-
-## Formal-review remediation RED
-
-Daphne's exact-head review ID 168 requested changes at `43fa0477`. Before changing production code,
-new regressions were run against an exact-source build. Four tests failed while the existing 1,568
-passed:
-
-1. valid roster name plus mismatched ambient class seeded both files before refusal;
-2. dangling `SOUL.md` allowed `USER.md` to be published before refusal;
-3. dangling `USER.md` allowed `SOUL.md` to be published before refusal; and
-4. replacing a securely validated `USER.md` with an external symlink was followed by composition.
-
-This establishes that all four review-168 findings were observable on the pushed implementation.
-
-Daphne's review ID 169 then found two more exact-head failures at `9dc90be7`. Before production
-changes, four new assertions failed:
-
-1. standalone composition routed an unreadable optional `USER.md` through the Linux-only descriptor
-   reader instead of the legacy portable tolerant path; and
-2. explicit `MOSAIC_AGENT_CLASS` values `""`, `" "`, and tab were treated as absent, seeded both
-   identity files, and reached runtime.
-
-The replacement-symlink case was also moved under a valid roster identity so it tests the fleet-only
-security boundary rather than standalone behavior.
-
-## Final GREEN
-
-The production-kind command builds Mosaic and all workspace dependencies before invoking Vitest,
-because `dist/` is ignored and may otherwise be absent or stale:
-
-```bash
-env -u DATABASE_URL sh -c '
-  pnpm --filter @mosaicstack/mosaic... build &&
-  pnpm --filter @mosaicstack/mosaic exec vitest run \
-    src/commands/fleet-first-start-identity.spec.ts \
-    src/commands/launch-first-start.spec.ts \
-    src/commands/launch.spec.ts \
-    src/commands/compose-contract.spec.ts \
-    src/config/file-adapter.test.ts \
-    src/cli-smoke.spec.ts
-'
-```
-
-Exit `0`: `6/6` files, `128/128` tests.
-
-- 15 real-CLI/no-TTY tests cover exact roster name/class, byte-equal `0600` seeds, no-clobber,
-  partial seed, missing/symlink defaults, unknown/padded/blank name, mismatched or explicitly blank
-  class, standalone wizard preservation, and four concurrent starts.
-- 12 direct filesystem tests cover complete publication, existing operators, idempotence, source
-  prevalidation, target and dangling destination links, invalid roots, oversized input, and
-  unexpected link errors.
-- Composition coverage deterministically replaces a valid fleet seat's validated `USER.md` with an
-  external symlink and requires refusal at point of use. A separate standalone case proves tolerant
-  optional composition remains outside the Linux-only fleet reader.
-
-Full package gate (which rebuilds Mosaic itself after the clean-checkout dependency build):
-
-```bash
-env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic run test:vitest
-```
-
-Exit `0`: `88/88` files, `1,577/1,577` tests.
-
-Focused helper + point-of-use coverage:
-
-```text
-2 files, 53/53 tests
-Statements 97.84% | Branches 91.66% | Functions 100% | Lines 97.84%
-Exit 0
-```
-
-Final repository gates after remediation:
-
-```text
-pnpm preflight    exit 0
-pnpm typecheck    45/45 tasks, exit 0
-pnpm lint         25/25 tasks, exit 0
-pnpm build        25/25 tasks, exit 0
-pnpm format:check exit 0
-git diff --check  exit 0
-```
-
-Pre-PR targeted shell runs on the unchanged shell surfaces also passed:
-
-```text
-bash framework/tools/fleet/test-start-agent-session.sh                 exit 0 locally
-bash framework/tools/quality/scripts/test-install-migration.sh         21 passed, 0 failed
-bash framework/tools/_scripts/test-mosaic-init-rce.sh                   PASS
-```
-
-The aggregate local `test:framework-shell` run stopped at `invariant_r_unittest.py`: installed
-operator-global Pi is `0.84.2`, while the invariant is measured for `0.84.1`. Later aggregate stages
-remain unmeasured except the targeted suites above. Root `pnpm test` remains locally **UNTESTED**
-because this checkout prohibits the PostgreSQL-dependent gateway isolation path.
-
-## Review and security evidence
-
-- Initial Codex review found padded-name mutation-before-refusal; it was fixed with three
-  no-side-effect regressions.
-- Codex review of the formal-review remediation: `approve`, confidence `0.88`, 6 files, no findings.
-- Codex security review of the remediation: risk `none`, confidence `0.93`, 9 files, no findings.
-  Its sandbox could not execute Vitest because Vite attempted a write on a read-only mount; the
-  executor-owned results above are the test evidence.
-- Daphne formal review ID 168 at exact head `43fa0477`: `REQUEST_CHANGES`, four blocking groups; all
-  closed by review 169.
-- Daphne formal review ID 169 at exact head `9dc90be7`: `REQUEST_CHANGES`, two blocking groups
-  (standalone portability and explicit blank class). Both now have red-first regressions and local
-  green remediation.
-- Codex review of review-169 remediation: `approve`, confidence `0.90`, 4 files, no findings.
-- Codex security review of review-169 remediation: risk `none`, confidence `0.90`, 4 files, no
-  findings. Exact-new-head Daphne re-review is pending until that head is pushed.
-
-## CI evidence and external blocker
-
-Pipeline 2445 ran against exact first head `43fa0477`:
-
-- install, sanitization, upgrade guard, typecheck, lint, and format passed;
-- Mosaic Vitest passed `88/88`, `1,568/1,568`; and
-- the test step emitted exactly one `FAIL:` line:
-
-```text
-FAIL: host provides 'pi' in the system path; missing-binary cases are not measurable here
-```
-
-That line comes from the inherited `test-start-agent-session.sh` CI-fit guard, not #1264. Fred filed
-the correction as PR #1270. Its pipeline 2448 is terminal green and proves the four formerly masked
-suites execute, but #1270 is not merged, so `next` still carries the failing chain. A new #1268
-pipeline 2449 at `9dc90be7` reproduced the same single inherited `FAIL:` after Mosaic passed
-`1,573/1,573`. A new pipeline is pending the review-169 remediation push. Terminal-green #1268 CI is
-not claimed.
-
-PR #1268's envelope was read back as `user.login=mos-dt-0`; its commit is explicitly authored and
-committed by `goals <[email protected]>`. No goals Gitea login exists on this host, and no
-other principal was borrowed. The cross-wrapper principal defect is tracked in #1272.
-
-## Explicitly untested
-
-- Canary VM remediation/restart: **UNTESTED and prohibited**.
-- Real Pi authentication/provider prompt and task execution: **UNTESTED**.
-- PR #1213 composition layer: **UNTESTED and not required**.
-- Deployment/published npm behavior: **UNTESTED until merge/release**.
-- Local PostgreSQL execution/migration: **UNTESTED and prohibited**.
-
-The local gate proves Mosaic crosses its identity boundary and reaches a fake lease-runtime boundary;
-it does not claim provider readiness, deployment, or a currently running canary seat.

docs/scratchpads/1264-unattended-first-start.md

@@ -1,104 +0,0 @@
-# #1264 — Unattended fleet first start
-
-## Tracking
-
-- Issue: `mosaicstack/stack#1264`
-- PR: `mosaicstack/stack#1268`
-- Branch: `fix/1264-fleet-unattended-first-start`
-- Base: `origin/next@476db12b92971634b67fd2057b7577ee5894e449`
-- First pushed head: `43fa0477877e0d0f110da8d11c3033b40ddeb191`
-- Current remediation worktree: `/var/home/jason.woltje/agent-work/1264-review2-remediation`
-- Coordinator: Fred; reviewer must be neither Fred nor this implementation seat.
-- `docs/TASKS.md` is orchestrator-owned and is not modified by this worker.
-
-The original `/var/home/jason.woltje/agent-work/1264-unattended-first-start` and first remediation
-worktrees were removed without force after each pushed head and clean state were verified. The
-Fred-authorized plain-Git worktree exception was reused for exact-head review remediation because
-`/src` remains unavailable.
-
-## Objective
-
-A roster-owned fleet seat launched from systemd on a clean host must cross Mosaic's first-run identity
-gate without a human or TTY, while retaining exact name/class from the canonical roster and
-preserving the standalone interactive wizard.
-
-## Intake and boundaries
-
-- Shipping canary provenance is jarvis-brain `origin/main` commit
-  `8bf94afeb8c7d5df96cdd4a4508e75a1d2999710`. The earlier local `6c0b6fc...` object is not used.
-- The Run-7 pane was preserved when evidence was captured; formal review records a later authorized
-  rollback. This task never accessed or altered the canary.
-- Tiny's concurrent runtime-preflight, `start-agent-session.sh`, and #1258 PATH seam remain untouched.
-- Held PR #1213 is not a dependency.
-- No runtime/provider credential values or provider calls, installed-host changes, PostgreSQL, unit,
-  timer, or profile mutation. Tests use temporary roots and fake executables only; Gitea/Woodpecker
-  metadata operations use standard wrappers without exposing credentials.
-
-## Requirements and design
-
-- PRD IDs: `FCM-REQ-12`, `AC-FCM-10`; `FCM-REQ-11` is reserved by #1256.
-- A present fleet name must be nonblank, whitespace-exact, and resolve through the canonical roster.
-- Any defined ambient class, including blank/whitespace, must canonicalize to the roster class before
-  mutation; only undefined means absent.
-- Preflight all destination directory entries with no-follow existence semantics so dangling links
-  fail before counterpart publication.
-- Seed only missing top-level files from bounded regular defaults with owner-private, atomic,
-  no-clobber hard links.
-- Generic defaults are behavior, not identity or authority.
-- Securely consume fleet `USER.md` through a Linux descriptor at composition time.
-- Standalone composition retains the portable tolerant USER read and missing identity retains the
-  wizard.
-
-## Progress
-
-- [x] Issue, canary report, Tiny collision state, and PRD read/amended.
-- [x] Initial production-kind RED captured with a real built CLI and no TTY.
-- [x] Implementation, tests, user/admin/developer docs, QA, and indexes delivered.
-- [x] Initial automated review finding (padded name before write) remediated.
-- [x] Commit `43fa0477` pushed; PR #1268 opened against `next`; original worktree removed cleanly.
-- [x] Daphne formal review ID 168 completed on exact first head: `REQUEST_CHANGES` with four groups.
-- [x] All four review-168 groups reproduced red before remediation and passed at `9dc90be7`.
-- [x] Daphne review ID 169 completed on `9dc90be7`: review-168 closures confirmed; two new blockers.
-- [x] Review-169 portability and blank-class blockers reproduced red and now pass locally.
-- [x] Review-169 Codex review approved; security review risk `none`.
-- [ ] Commit/push second remediation with explicit goals author/committer; verify remote object/content.
-- [ ] Daphne exact-new-head re-review.
-- [ ] Terminal #1268 CI. Pipeline 2445's only `FAIL:` was the inherited Pi-PATH CI-fit guard; PR
-  #1270's pipeline 2448 is green, but #1270 is not merged.
-- [ ] Remove the clean remediation worktree after push.
-
-## Test evidence
-
-### Initial RED
-
-The built `origin/next` CLI entered `mosaic wizard`, rendered `What would you like to do?`, exited 1,
-and never created the fake runtime-boundary capture.
-
-### Formal-review RED
-
-Against exact first-head production code, four new tests failed while 1,568 existing tests passed:
-class mismatch mutated before refusal; each dangling destination left its counterpart; and a
-replacement `USER.md` symlink was consumed by composition. Review-169 RED then proved standalone
-composition hit the Linux-only reader and three explicit blank/whitespace class cases seeded and
-launched.
-
-### Final local GREEN
-
-- Exact-source focused gate: `6/6` files, `128/128` tests.
-- Full exact-source Mosaic Vitest: `88/88` files, `1,577/1,577` tests.
-- Helper + point-of-use coverage: `53/53`; 97.84% statements/lines, 91.66% branches, 100% functions.
-- Root preflight passed; typecheck `45/45`, lint `25/25`, build `25/25`.
-- Initial targeted shell gates passed: start-agent-session, install migration `21/21`, init-RCE.
-- Local aggregate framework shell stops at operator-global Pi `0.84.2` versus measured `0.84.1`.
-- Local root `pnpm test` remains unrun because the checkout prohibits its PostgreSQL-dependent path.
-
-The full evidence and command boundaries are in
-`docs/reports/qa/2026-08-16-1264-unattended-first-start.md`.
-
-## Review / delivery notes
-
-- Review-168 remediation Codex review: approve `0.88`; security risk `none` `0.93`.
-- Review-169 remediation Codex review: approve `0.90`; security risk `none` `0.90`.
-- PR envelope reads `mos-dt-0`; the commit reads goals/goals. No goals Gitea principal exists on this
-  host, so no other principal will be borrowed. Tracked in #1272.
-- PR #1270 is pushed, not merged. Do not represent `next` or #1268 CI as green until measured.

docs/scratchpads/README.md

@@ -7,10 +7,6 @@
 - [DOCS-IA-001 — information architecture](DOCS-IA-001.md) — completed structure-design and documentation-contract record.
 - [DOCS-IA-002 — catalog audit and migration](DOCS-IA-002-catalog-audit.md) — active coordinator progress, autonomous lane state, verification evidence, and authority blockers.
 
-## Active implementation records
-
-- [Issue #1264 — unattended fleet first start](1264-unattended-first-start.md) — plan, RED/GREEN evidence, collision boundaries, and PR lifecycle state.
-
 Completed scratchpads may remain here when they provide useful delivery provenance. Their conclusions must be reflected in the owning canonical page before the scratchpad is treated as complete.
 
 ## Related

packages/mosaic/__tests__/platform/detect.test.ts

@@ -1,74 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-// homedir/platform are read at call time, so they can be stubbed per case.
-vi.mock('node:os', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('node:os')>();
-  return {
-    ...actual,
-    homedir: () => '/home/tester',
-    platform: () => mockPlatform,
-  };
-});
-
-let mockPlatform: NodeJS.Platform = 'linux';
-
-const { getShellProfilePath, detectShell } = await import('../../src/platform/detect.js');
-
-describe('getShellProfilePath', () => {
-  const originalShell = process.env['SHELL'];
-  const originalZdotdir = process.env['ZDOTDIR'];
-
-  beforeEach(() => {
-    mockPlatform = 'linux';
-    delete process.env['ZDOTDIR'];
-  });
-
-  afterEach(() => {
-    if (originalShell === undefined) delete process.env['SHELL'];
-    else process.env['SHELL'] = originalShell;
-    if (originalZdotdir === undefined) delete process.env['ZDOTDIR'];
-    else process.env['ZDOTDIR'] = originalZdotdir;
-  });
-
-  // The regression this guards: setupPath() in stages/finalize.ts appends the
-  // PATH export to whatever this returns. A line written to ~/.bashrc is
-  // unreachable to `bash -lc`, systemd units and agent seats, because Debian's
-  // default .bashrc returns early for non-interactive shells — so an install
-  // reported success and left `mosaic: command not found`. Same for .zshrc,
-  // which zsh only reads for interactive shells.
-  it('never targets an interactive-only rc file', () => {
-    for (const shell of ['/bin/bash', '/usr/bin/zsh']) {
-      process.env['SHELL'] = shell;
-      const profile = getShellProfilePath();
-      expect(profile).not.toMatch(/\.bashrc$/);
-      expect(profile).not.toMatch(/\.zshrc$/);
-    }
-  });
-
-  it('uses ~/.profile for bash', () => {
-    process.env['SHELL'] = '/bin/bash';
-    expect(getShellProfilePath()).toBe('/home/tester/.profile');
-  });
-
-  it('uses ~/.zshenv for zsh', () => {
-    process.env['SHELL'] = '/usr/bin/zsh';
-    expect(getShellProfilePath()).toBe('/home/tester/.zshenv');
-  });
-
-  it('honours ZDOTDIR for zsh', () => {
-    process.env['SHELL'] = '/usr/bin/zsh';
-    process.env['ZDOTDIR'] = '/custom/zdot';
-    expect(getShellProfilePath()).toBe('/custom/zdot/.zshenv');
-  });
-
-  it('falls back to ~/.profile for an unknown shell', () => {
-    process.env['SHELL'] = '/bin/somethingelse';
-    expect(detectShell()).toBe('unknown');
-    expect(getShellProfilePath()).toBe('/home/tester/.profile');
-  });
-
-  it('still routes fish to its own config', () => {
-    process.env['SHELL'] = '/usr/bin/fish';
-    expect(getShellProfilePath()).toBe('/home/tester/.config/fish/config.fish');
-  });
-});

packages/mosaic/framework/defaults/README.md

@@ -102,7 +102,7 @@ mosaic yolo pi             # Launch Pi in yolo mode
 The launcher:
 
 1. Verifies `~/.config/mosaic` exists
-2. Resolves identity: standalone launches auto-run `mosaic init` when `SOUL.md` is missing; exact roster-owned fleet launches validate name/class, atomically seed only missing `SOUL.md`/`USER.md` from generic `defaults/`, securely consume `USER.md`, and never prompt
+2. Verifies `SOUL.md` exists (auto-runs `mosaic init` if missing)
 3. Injects `AGENTS.md` into the runtime
 4. Forwards all arguments to the runtime CLI
 

packages/mosaic/framework/install.sh

@@ -35,18 +35,6 @@ SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET_DIR="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 INSTALL_MODE="${MOSAIC_INSTALL_MODE:-prompt}"
 
-# Normalize the ambient umask so directory modes are a property of the installer
-# and not of whatever shell invoked it (#1236). Debian/Ubuntu ship umask 002, so
-# every `mkdir -p` below yielded 0775 — and the fleet env boundary rejects any
-# managed directory with `mode & 0o022`, which made `mosaic fleet init --write`
-# impossible on a stock install of those distros. Fedora/RHEL ship 022 and did
-# not trip it, so the product worked or did not depending on the operator's
-# login shell. 022 is what this script already assumes it produces: see the
-# umask note in make_durable_snapshot, which restores to the ambient value
-# precisely so "every later sync copy and new framework dir" gets 0644/0755.
-# Now that value is 022 rather than whatever was inherited.
-umask 022
-
 # Deliberately parsed from "$@" (a real, explicit, per-invocation argument) —
 # never an environment variable — so this opt-out can never sit silently
 # inherited in a shell profile. See #869 Point-1 C2.
@@ -708,52 +696,6 @@ sync_framework
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"
 
-# Three directories must be 0700, not merely not-group-writable (#1236).
-# The fleet code guards them with two different masks in two different
-# languages, and the strict one wins:
-#
-#   assertPrivateManagedDirectory (fleet-reconciler.js, `mode & 0o077`)
-#       -> MOSAIC_HOME and MOSAIC_HOME/fleet, checked before the roster lock is
-#          taken, so every mutating `mosaic fleet` command dies at 0755.
-#   assert_private_directory (tools/fleet/start-agent-session.sh, `mode & 077`)
-#       -> MOSAIC_HOME/fleet/agents, checked before a pane is ever spawned.
-#
-# Their laxer siblings (`mode & 0o022`) accept 0755, which is why normalizing
-# the umask above is necessary and not sufficient — a correct umask-022 install
-# still produces 0755 and still cannot run `mosaic fleet init --write`. Say the
-# strict modes outright rather than inferring them from a umask.
-#
-# Only these. The rest of the tree is content, stays 0755, and is only ever
-# reached by the 0o022 checks, which 0755 satisfies.
-chmod 700 "$TARGET_DIR" 2>/dev/null || \
-  warn "Could not set 0700 on $TARGET_DIR — 'mosaic fleet' mutations will fail as unsafe-permissions."
-if [[ -d "$TARGET_DIR/fleet" ]]; then
-  chmod 700 "$TARGET_DIR/fleet" 2>/dev/null || \
-    warn "Could not set 0700 on $TARGET_DIR/fleet — 'mosaic fleet' mutations will fail as unsafe-permissions."
-fi
-# fleet/agents does not exist on a first install — the CLI creates it 0700 on
-# demand. It is chmod'd here for the UPGRADE case: a tree built under umask 002
-# has it at 0775, and the repair sweep below cannot rescue it, because stripping
-# group/other write from 0755 leaves 0750 and `mode & 077` is still non-zero.
-if [[ -d "$TARGET_DIR/fleet/agents" ]]; then
-  chmod 700 "$TARGET_DIR/fleet/agents" 2>/dev/null || \
-    warn "Could not set 0700 on $TARGET_DIR/fleet/agents — agent sessions will fail to start as unsafe-permissions."
-fi
-# credentials/ holds secrets and was never meant to be group-readable either.
-# It is not on the fleet boundary, so a failure here breaks nothing — but it is
-# the one directory where a silently-failed chmod leaves secrets group-readable,
-# which is precisely the failure worth a line in the output.
-chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || \
-  warn "Could not set 0700 on $TARGET_DIR/credentials — stored secrets may be readable by other users on this host."
-
-# Repair an existing tree. The umask above only governs directories this run
-# creates, so a host installed under umask 002 before this fix keeps its 0775
-# dirs through every upgrade and stays broken. Strips group/other WRITE only —
-# never read or execute — so it can repair the boundary violation without
-# changing who can traverse or read anything. Scoped to directories: file modes
-# are the manifest's business, not this fix's.
-find "$TARGET_DIR" -type d -perm /022 -exec chmod go-w {} + 2>/dev/null || true
-
 # Reconcile contract files from defaults/ into the framework root: framework-owned
 # files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
 # copy is backed up once); user-seeded files (TOOLS) are written on first install only.

packages/mosaic/framework/systemd/user/mosaic-agent@.service

@@ -4,14 +4,6 @@ Documentation=https://git.mosaicstack.dev/mosaicstack/stack
 Requires=mosaic-tmux-holder.service
 After=mosaic-tmux-holder.service
 PartOf=mosaic-tmux-holder.service
-# Do not attempt a seat before its generated env exists. `install` enables this
-# unit (WantedBy=default.target) but on a roster-v2 fleet the reconciler owns the
-# generated env, so between `install` and the first `apply`/`regen --write` there
-# is a boot window where ExecStart would run against an absent env file and the
-# launcher would fail the unit. A skipped unit is the honest state for "enabled
-# but not yet configured"; systemd re-evaluates the condition on every start, so
-# the seat comes up on the next start once the reconciler has written env.
-ConditionPathExists=%h/.config/mosaic/fleet/agents/%i.env.generated
 
 [Service]
 Type=oneshot

packages/mosaic/framework/systemd/user/test-fleet-units.sh

@@ -128,14 +128,6 @@ EOF
 sleep 30
 EOF
   chmod 700 "$AGENT_BIN/mosaic"
-  # The launcher resolves the roster's runtime against PANE_PATH before it
-  # spawns anything (#1241), so the runtime this projection names has to be
-  # present here even though the fake `mosaic` above never execs it.
-  cat > "$AGENT_BIN/pi" <<'EOF'
-#!/bin/sh
-sleep 30
-EOF
-  chmod 700 "$AGENT_BIN/pi"
   server_environment_before=$(tmux -L "$TEST_SOCKET" show-environment -g | sort)
   server_sessions_before=$(tmux -L "$TEST_SOCKET" list-sessions | sort)
   if /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \

packages/mosaic/framework/tools/_scripts/mosaic-doctor

@@ -225,54 +225,6 @@ else
   warn "mosaic-ensure-sequential-thinking helper missing"
 fi
 
-# Fleet transport binary (#1240).
-#
-# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
-# roster the CLI scaffolds sets `transport: tmux`, but nothing in the install
-# path provides tmux and, until now, nothing here noticed it was absent. On a
-# greenfield host that produced a fleet which installed clean, started clean,
-# and had no live seat; `mosaic fleet ps` was the operator's first and only
-# signal that anything was wrong.
-#
-# The roster's own `transport:` is read rather than assumed, so a host that
-# declares something other than tmux is told about the binary it actually
-# needs. Absent a roster the check still runs — `mosaic fleet init` will
-# scaffold a tmux fleet on this host, and finding out beforehand is the point.
-#
-# `tools/install.sh` carries a deliberately parallel check at the end of its
-# summary. The two are separate because the installer must be able to say this
-# before the framework's own scripts are guaranteed to be on disk; keep their
-# wording in step.
-fleet_declared_transport() {
-  local roster="$MOSAIC_HOME/fleet/roster.yaml"
-  local declared=""
-
-  if [[ -f "$roster" ]]; then
-    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
-      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
-  fi
-
-  printf '%s\n' "${declared:-tmux}"
-}
-
-check_fleet_transport() {
-  local transport
-  transport="$(fleet_declared_transport)"
-
-  if command -v "$transport" >/dev/null 2>&1; then
-    pass "Fleet transport available: $transport"
-    return
-  fi
-
-  if [[ -f "$MOSAIC_HOME/fleet/roster.yaml" ]]; then
-    warn "Fleet transport '$transport' is not installed — this host has a roster and no seat can launch. Install it (e.g. sudo apt-get install -y $transport), then 'mosaic fleet start'."
-  else
-    warn "Fleet transport '$transport' is not installed — 'mosaic fleet' cannot run seats here. Install it (e.g. sudo apt-get install -y $transport) before 'mosaic fleet init'."
-  fi
-}
-
-check_fleet_transport
-
 # Legacy migration surfaces should no longer contain symlink trees.
 legacy_paths=(
   "$HOME/.claude/agent-guides"

packages/mosaic/framework/tools/_scripts/test-fleet-transport-check.sh

@@ -1,215 +0,0 @@
-#!/usr/bin/env bash
-# Covers the #1240 fleet-transport checks in `mosaic-doctor` and in
-# `tools/install.sh`.
-#
-# Both checks answer the same question — "can a seat actually launch on this
-# host?" — from two different places, because the installer has to be able to
-# answer it before the framework's own scripts are guaranteed to be on disk.
-# Two implementations of one rule is exactly the shape that drifts, so this
-# harness drives BOTH, in one file, from the same table of cases.
-#
-# The functions are extracted from the shipped scripts rather than copied here.
-# A test that carries its own copy of the logic is a test that keeps passing
-# after the shipped copy changes — the failure mode this whole change is about.
-# Extraction is by exact function header and a closing brace in column one; if
-# either script is reshaped so that stops matching, the extraction yields
-# nothing and this fails loudly instead of silently measuring an empty string.
-set -euo pipefail
-
-SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
-DOCTOR="$SCRIPT_DIR/mosaic-doctor"
-# framework/tools/_scripts -> framework/tools -> framework -> mosaic -> packages -> repo
-INSTALLER=$(cd -- "$SCRIPT_DIR/../../../../.." && pwd)/tools/install.sh
-
-fail() {
-  echo "FAIL: $*" >&2
-  exit 1
-}
-
-[ -f "$DOCTOR" ] || fail "missing mosaic-doctor at $DOCTOR"
-[ -f "$INSTALLER" ] || fail "missing install.sh at $INSTALLER"
-
-ROOT=$(mktemp -d)
-trap 'rm -rf "$ROOT"' EXIT
-
-# The cases below run with PATH set to a directory that deliberately does not
-# contain a shell, and a PATH assignment on a command also governs how that
-# command is looked up — so bash has to be named absolutely or it becomes the
-# thing that is missing.
-BASH_BIN=$(command -v bash) || fail "host is missing 'bash'"
-
-# A PATH containing exactly the utilities these functions use and nothing else.
-# The absent-transport cases are only meaningful on a PATH where the transport
-# is genuinely unresolvable, and this host (like most) has tmux in /usr/bin —
-# so the system path cannot be part of the path under test.
-FAKE_BIN="$ROOT/bin"
-mkdir -p "$FAKE_BIN"
-for utility in sed head tr awk; do
-  utility_path=$(command -v "$utility") || fail "host is missing '$utility'"
-  ln -s "$utility_path" "$FAKE_BIN/$utility"
-done
-
-if PATH="$FAKE_BIN" command -v tmux >/dev/null 2>&1; then
-  fail "'tmux' is resolvable on the minimal test path; absent-transport cases are not measurable"
-fi
-
-# Extract a function by its exact header, up to a closing brace in column one.
-extract_function() {
-  local source_file="$1"
-  local function_name="$2"
-  local destination="$3"
-
-  awk -v name="$function_name" '
-    $0 == name "() {" { collecting = 1 }
-    collecting { print }
-    collecting && $0 == "}" { exit }
-  ' "$source_file" > "$destination"
-
-  grep -qF "$function_name() {" "$destination" ||
-    fail "could not extract '$function_name' from $source_file — has it been renamed or reshaped?"
-  # An unterminated extraction would be a syntax error the moment it is sourced,
-  # but saying so here names the cause instead of leaving a bash parse error.
-  bash -n "$destination" ||
-    fail "extracted '$function_name' does not parse; the closing brace was probably not found"
-}
-
-extract_function "$DOCTOR" fleet_declared_transport "$ROOT/doctor-declared.sh"
-extract_function "$DOCTOR" check_fleet_transport "$ROOT/doctor-check.sh"
-extract_function "$INSTALLER" check_fleet_transport "$ROOT/installer-check.sh"
-
-# Build a MOSAIC_HOME, optionally with a roster declaring a transport.
-make_home() {
-  local home="$ROOT/$1"
-  local declared="${2-}"
-
-  rm -rf "$home"
-  mkdir -p "$home"
-  if [ -n "$declared" ]; then
-    mkdir -p "$home/fleet"
-    cat > "$home/fleet/roster.yaml" <<EOF
-version: 2
-generation: 1
-transport: $declared
-agents: []
-EOF
-  fi
-  printf '%s\n' "$home"
-}
-
-# Run the doctor's check against a given home and path, capturing which
-# reporter the check chose. The real `pass` prints only under `--verbose` and
-# the real `warn` always prints; these stubs make both unconditional on
-# purpose, because what is under test is the severity the check selects, not
-# whether the default verbosity happens to show it. A check that warned where
-# it should pass would otherwise be invisible here.
-run_doctor_check() {
-  local home="$1"
-  local path="$2"
-
-  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
-    set -euo pipefail
-    warn() { echo "[WARN] $*"; }
-    pass() { echo "[OK] $*"; }
-    MOSAIC_HOME="$1"
-    source "$2"
-    source "$3"
-    check_fleet_transport
-  ' _ "$home" "$ROOT/doctor-declared.sh" "$ROOT/doctor-check.sh" 2>&1
-}
-
-run_installer_check() {
-  local home="$1"
-  local path="$2"
-
-  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
-    set -euo pipefail
-    warn() { echo "[WARN] $*"; }
-    C="" RESET=""
-    MOSAIC_HOME="$1"
-    source "$2"
-    check_fleet_transport
-  ' _ "$home" "$ROOT/installer-check.sh" 2>&1
-}
-
-# A transport that exists. Named tmux because that is what the default roster
-# declares; the binary never runs, it only has to resolve.
-PRESENT_BIN="$ROOT/present-bin"
-mkdir -p "$PRESENT_BIN"
-printf '#!/usr/bin/env bash\nexit 0\n' > "$PRESENT_BIN/tmux"
-chmod +x "$PRESENT_BIN/tmux"
-PATH_WITH_TMUX="$PRESENT_BIN:$FAKE_BIN"
-
-# ── absent, no roster ────────────────────────────────────────────────────────
-# Nothing has been configured yet, so the honest thing to point at is `init`.
-home=$(make_home no-roster)
-
-output=$(run_doctor_check "$home" "$FAKE_BIN")
-echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn when tmux was absent"
-echo "$output" | grep -qF 'tmux' || fail "doctor warning did not name the transport"
-echo "$output" | grep -qF 'mosaic fleet init' || fail "doctor did not point a rosterless host at init"
-
-output=$(run_installer_check "$home" "$FAKE_BIN")
-echo "$output" | grep -qF '[WARN]' || fail "installer did not warn when tmux was absent"
-echo "$output" | grep -qF 'reports success and no seat comes up' ||
-  fail "installer warning did not say what the missing transport actually breaks"
-
-# ── absent, roster present ───────────────────────────────────────────────────
-# A configured fleet that cannot launch is a stronger statement than a
-# hypothetical one, and the message says so.
-home=$(make_home with-roster tmux)
-
-output=$(run_doctor_check "$home" "$FAKE_BIN")
-echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn with a roster present and tmux absent"
-echo "$output" | grep -qF 'roster' || fail "doctor did not mention the roster it found"
-echo "$output" | grep -qF 'mosaic fleet start' || fail "doctor did not point a configured host at start"
-
-# ── present ──────────────────────────────────────────────────────────────────
-# Silence from the installer, and a pass (not a warning) from the audit.
-for home_name in no-roster with-roster; do
-  home="$ROOT/$home_name"
-
-  output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
-  if echo "$output" | grep -qF '[WARN]'; then
-    fail "doctor warned about the transport while tmux was present ($home_name)"
-  fi
-  echo "$output" | grep -qF '[OK]' || fail "doctor did not record a pass with tmux present ($home_name)"
-
-  output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
-  if [ -n "$output" ]; then
-    fail "installer was not silent with tmux present ($home_name): $output"
-  fi
-done
-
-# ── the roster declares something other than tmux ────────────────────────────
-# The roster is read, not assumed. A host that declares a different transport
-# is told about the binary it actually needs, and never about tmux — being sent
-# to install the wrong package is worse than no advice at all.
-home=$(make_home other-transport zellij)
-
-output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
-echo "$output" | grep -qF 'zellij' || fail "doctor ignored the roster's declared transport"
-if echo "$output" | grep -qF 'tmux'; then
-  fail "doctor named tmux for a host whose roster declares zellij"
-fi
-
-output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
-echo "$output" | grep -qF 'zellij' || fail "installer ignored the roster's declared transport"
-if echo "$output" | grep -qF 'tmux'; then
-  fail "installer named tmux for a host whose roster declares zellij"
-fi
-
-# ── a quoted or trailing-comment transport value ─────────────────────────────
-# YAML permits both and neither is exotic; a check that installs `tmux"` or
-# reads `tmux # default` as a binary name would send the operator nowhere.
-home=$(make_home quoted-transport '"tmux"   # the only transport today')
-
-output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
-echo "$output" | grep -qF '[OK] Fleet transport available: tmux' ||
-  fail "doctor did not parse a quoted/commented transport value: $output"
-
-output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
-if [ -n "$output" ]; then
-  fail "installer did not parse a quoted/commented transport value: $output"
-fi
-
-echo "ok - fleet transport checks (mosaic-doctor + install.sh)"

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -286,36 +286,6 @@ _build_runtime_bin_prefix() {
 MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 PANE_PATH=${MOSAIC_RUNTIME_BIN_PREFIX:+${MOSAIC_RUNTIME_BIN_PREFIX}:}/usr/local/bin:/usr/bin:/bin
 
-# #1241. The pane runs `mosaic yolo <runtime>` under PANE_PATH with a cleared
-# environment. A binary missing from *that* path is a pane that dies in under a
-# second, inside a session nobody is attached to, with its diagnostic scrolled
-# into a pane tmux then destroys. Resolve both here, before any effect, where
-# the failure is still attributable to the thing that caused it.
-#
-# `mosaic yolo <runtime>` runs checkRuntime(runtime) and the binary it looks for
-# is named exactly like the runtime, so resolving the runtime name is the same
-# question the pane will ask a moment later — asked while an operator can still
-# see the answer.
-_resolve_in_pane_path() {
-  PATH="$PANE_PATH" command -v -- "$1" 2>/dev/null
-}
-
-# Exit 69 (EX_UNAVAILABLE): the seat cannot be provided. Distinguished from the
-# 64 (EX_USAGE) rejections above, which mean the projection itself was bad —
-# here the data is fine and the host is not ready. Callers tell the individual
-# cases apart by `code=`, the same way fail_env's many codes share exit 64.
-fail_launch() {
-  local code="$1"
-  shift
-  echo "ERROR: agent launch aborted: code=${code} agent=${AGENT_NAME} $*" >&2
-  exit 69
-}
-
-for required_binary in mosaic "$MOSAIC_AGENT_RUNTIME"; do
-  _resolve_in_pane_path "$required_binary" >/dev/null ||
-    fail_launch missing-binary "'${required_binary}' is not on the pane PATH (${PANE_PATH})"
-done
-
 _ensure_claude_workdir_trusted() {
   local workdir="$1"
   local resolved
@@ -414,19 +384,6 @@ if [ -n "$PANE_PID" ]; then
   _start_heartbeat_sidecar "$AGENT_NAME" "$PANE_PID" \
     "$MOSAIC_HEARTBEAT_RUN_DIR" "$MOSAIC_HEARTBEAT_INTERVAL" || \
     echo "WARNING: heartbeat sidecar could not be started for $AGENT_NAME" >&2
-elif _tmux has-session -t "=${AGENT_NAME}:0.0" 2>/dev/null; then
-  # #1241. Session present, no pane PID after a second of retries. Whatever this
-  # is, it is not a seat an operator can use, so it is not a success either.
-  fail_launch pane-pid-unresolved \
-    "tmux reports the session but no pane PID after 5 attempts"
 else
-  # #1241. This branch used to print a WARNING about the heartbeat sidecar and
+  echo "WARNING: could not resolve pane PID for $AGENT_NAME — heartbeat sidecar not started" >&2
-  # exit 0. It is not a heartbeat problem: tmux destroys a session when its pane
-  # command exits, so an absent session one second after new-session means the
-  # runtime died on startup. Reporting it as success is what let `fleet start`
-  # return 0 over three dead panes — the launcher knew, and said the wrong thing
-  # at the wrong severity to the wrong layer.
-  fail_launch pane-did-not-survive \
-    "the pane exited immediately and tmux destroyed the session;" \
-    "run 'mosaic yolo ${MOSAIC_AGENT_RUNTIME}' in ${MOSAIC_AGENT_WORKDIR} to see why"
 fi

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -23,26 +23,8 @@ index=0
 if [ "${args[0]:-}" = -L ]; then index=2; fi
 case "${args[$index]:-}" in
   has-session)
-    # The holder always answers. MOSAIC_TEST_HELD_SESSIONS lets a case add
-    # other targets that should answer too — without it there is no way to
-    # model "tmux still reports the session" for a non-holder agent, and the
-    # launcher's pane-pid-unresolved branch is unreachable from this harness.
-    #
-    # A listed target answers only AFTER new-session, because the launcher asks
-    # this question twice about the same name: once before launching, where a
-    # yes means "already running, nothing to do, exit 0", and once after, where
-    # a yes means "the session survived". A shim that answered yes to both
-    # would short-circuit at the first and never reach the branch under test —
-    # it would look like coverage and measure the idempotency path instead.
     for argument in "${args[@]}"; do
       [ "$argument" = '=_holder:0.0' ] && exit 0
-      case " ${MOSAIC_TEST_HELD_SESSIONS:-} " in
-        *" $argument "*)
-          if tr '\0' '\n' < "${MOSAIC_TEST_TMUX_CALLS:?}" | grep -qxF new-session; then
-            exit 0
-          fi
-          ;;
-      esac
     done
     exit 1
     ;;
@@ -80,30 +62,6 @@ env -0 > "${MOSAIC_HOME:?}/fleet/pane-environment"
 SHIM
 chmod +x "$FAKE_BIN/mosaic"
 
-# The runtime the rosters below name. The launcher resolves it against PANE_PATH
-# before spawning (#1241), so it has to exist somewhere the pane would find it —
-# not merely on the launcher's own PATH.
-printf '#!/usr/bin/env bash\nexit 0\n' > "$FAKE_BIN/pi"
-chmod +x "$FAKE_BIN/pi"
-
-# PANE_PATH is derived partly from `npm config get prefix`. Left to the real npm
-# it would splice whatever the host has installed into the path under test, and
-# the missing-binary cases below would pass or fail by accident of the machine.
-cat > "$FAKE_BIN/npm" <<'SHIM'
-#!/usr/bin/env bash
-printf '%s\n' "${MOSAIC_TEST_NPM_PREFIX:-/nonexistent}"
-SHIM
-chmod +x "$FAKE_BIN/npm"
-
-# PANE_PATH always ends in the system path. A host that installs these there can
-# not measure the missing-binary cases at all, and a green run would mean
-# nothing — so say so instead of passing.
-for host_binary in mosaic pi; do
-  if PATH=/usr/local/bin:/usr/bin:/bin command -v "$host_binary" >/dev/null 2>&1; then
-    fail "host provides '$host_binary' in the system path; missing-binary cases are not measurable here"
-  fi
-done
-
 write_generated() {
   local home="$1"
   local agent="$2"
@@ -123,19 +81,6 @@ MOSAIC_TMUX_SOCKET=mosaic-test
 EOF
   chmod 600 "$home/fleet/agents/$agent.env.generated"
   mkdir -p "$home/work"
-  install_pane_binaries "$home"
-}
-
-# `$PANE_HOME/.npm-global/bin` is one of the prefixes the launcher folds into
-# PANE_PATH, so this is the pane's own view of "installed", distinct from the
-# launcher's PATH. Tests that need a binary *absent* remove it from here.
-install_pane_binaries() {
-  local pane_home="$1"
-  mkdir -p "$pane_home/.npm-global/bin"
-  local binary
-  for binary in mosaic pi; do
-    ln -sf "$FAKE_BIN/$binary" "$pane_home/.npm-global/bin/$binary"
-  done
 }
 
 run_start() {
@@ -143,7 +88,6 @@ run_start() {
   local agent="$2"
   HOME="$home" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
     MOSAIC_TEST_PANE_PID="${MOSAIC_TEST_PANE_PID:-}" \
-    MOSAIC_TEST_HELD_SESSIONS="${MOSAIC_TEST_HELD_SESSIONS:-}" \
     MOSAIC_TEST_HOME="$home" \
     MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
     MOSAIC_HOME="$home" "$START" "$agent"
@@ -154,10 +98,7 @@ run_start() {
 HOME_VALID="$ROOT/valid"
 AGENT_VALID="coder0"
 write_generated "$HOME_VALID" "$AGENT_VALID"
-# A live pane PID is part of what "valid launch" means. Until #1241 this case
+run_start "$HOME_VALID" "$AGENT_VALID"
-# ran with none, so the suite's one success path was itself a dead pane the
-# launcher reported as fine.
-MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_VALID" "$AGENT_VALID"
 valid_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$valid_args" | grep -qF new-session || fail "valid generated projection did not reach tmux"
 echo "$valid_args" | grep -qF 'mosaic' || fail "fixed mosaic launcher command missing"
@@ -304,13 +245,6 @@ PANE_BASH_ENV="$ROOT/pane-boundary.bash-env"
 printf 'MOSAIC_RUNTIME_BIN=%s\n' "$FAKE_BIN" > \
   "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
 chmod 600 "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
-# This case does not go through run_start, so its pane binaries come from
-# MOSAIC_RUNTIME_BIN=$FAKE_BIN in the env.local written above — not from the
-# symlinks install_pane_binaries planted under the generated home, which this
-# launcher never consults because HOME here is the trusted parent. That is a
-# legitimate resolution path, but it means dropping MOSAIC_RUNTIME_BIN from
-# this case on the belief that the symlinks cover it would break the #1241
-# binary check rather than exercise it.
 LD_PRELOAD='/not/loaded/by-clean-bootstrap.so' \
 BASH_ENV="$PANE_BASH_ENV" \
 MOSAIC_UNTRUSTED_SENTINEL='must-not-reach-pane' \
@@ -324,7 +258,6 @@ PATH="$PANE_STALE_PATH" \
     "MOSAIC_TEST_HOME=$PANE_TRUSTED_HOME" \
     MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
     MOSAIC_TEST_EXECUTE_PANE=1 \
-    "MOSAIC_TEST_PANE_PID=$$" \
     "$START" coder-pane-boundary
 pane_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$pane_args" | grep -qxF "HOME=$PANE_TRUSTED_HOME" || \
@@ -459,75 +392,6 @@ echo "$interaction_policy_args" | grep -qF 'new-session' && \
 echo "$output" | grep -qF 'operator interaction service requires runtime pi' || \
   fail "interaction pinned-policy check did not follow strict parsing"
 
-# #1241. The pane runs `mosaic yolo <runtime>` against PANE_PATH. A binary
-# missing from that path is a launch failure, and it has to be named before the
-# session is created — after it, the diagnostic dies with the pane.
-assert_missing_pane_binary_rejected() {
-  local binary="$1"
-  local home="$ROOT/missing-$binary"
-  local agent="coder-missing-$binary"
-  write_generated "$home" "$agent"
-  rm -f "$home/.npm-global/bin/$binary"
-
-  : > "$TMUX_CALLS"
-  local output
-  if output=$(MOSAIC_TEST_PANE_PID=$$ run_start "$home" "$agent" 2>&1); then
-    fail "launch succeeded with '$binary' absent from the pane PATH"
-  fi
-  echo "$output" | grep -qF 'code=missing-binary' || fail "missing '$binary' diagnostic missing"
-  echo "$output" | grep -qF "'$binary'" || fail "missing-binary diagnostic did not name $binary"
-  if tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session; then
-    fail "launcher created a session it knew would die ($binary absent)"
-  fi
-}
-
-assert_missing_pane_binary_rejected mosaic
-assert_missing_pane_binary_rejected pi
-
-# #1241. tmux destroys a session when its pane command exits, so no pane PID a
-# second after new-session means the runtime died on startup. This used to be a
-# WARNING about the heartbeat sidecar followed by exit 0 — three layers above it
-# then reported a fleet that was not running.
-: > "$TMUX_CALLS"
-HOME_DEAD_PANE="$ROOT/dead-pane"
-write_generated "$HOME_DEAD_PANE" "coder-dead-pane"
-if output=$(MOSAIC_TEST_PANE_PID='' run_start "$HOME_DEAD_PANE" coder-dead-pane 2>&1); then
-  fail "launcher reported success over a pane that did not survive"
-fi
-echo "$output" | grep -qF 'code=pane-did-not-survive' || fail "dead-pane diagnostic missing"
-if echo "$output" | grep -qiF 'heartbeat'; then
-  fail "dead pane is still being reported as a heartbeat-sidecar problem"
-fi
-tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session || \
-  fail "dead-pane case did not reach the launch it is measuring"
-
-# #1241, the other way a pane fails. Above, tmux destroyed the session and
-# has-session said so. Here the session is still there and no PID comes back
-# after the retries — a different fault (the pane is alive but unusable, or
-# tmux is answering inconsistently) that an operator has to be told apart from
-# a runtime that died on startup.
-#
-# This case exists because the branch that handles it shipped with nothing able
-# to reach it: the shim answered has-session only for the holder, so every
-# non-holder agent landed in the session-is-gone branch no matter what. A
-# defensive branch nothing exercises is the same shape as the bug this whole
-# change is about, one layer down.
-: > "$TMUX_CALLS"
-HOME_NO_PID="$ROOT/pane-no-pid"
-write_generated "$HOME_NO_PID" "coder-no-pid"
-if output=$(MOSAIC_TEST_PANE_PID='' MOSAIC_TEST_HELD_SESSIONS='=coder-no-pid:0.0' \
-  run_start "$HOME_NO_PID" coder-no-pid 2>&1); then
-  fail "launcher reported success over a session with no resolvable pane PID"
-fi
-echo "$output" | grep -qF 'code=pane-pid-unresolved' || \
-  fail "session-present/no-PID was not reported as pane-pid-unresolved: $output"
-if echo "$output" | grep -qF 'code=pane-did-not-survive'; then
-  fail "a session tmux still reports was diagnosed as a destroyed session"
-fi
-if echo "$output" | grep -qiF 'heartbeat'; then
-  fail "an unresolvable pane PID is still being reported as a heartbeat-sidecar problem"
-fi
-
 # Exact stop derives the socket exclusively from the validated generated
 # projection and ignores an ambient socket supplied by the caller.
 : > "$TMUX_CALLS"

packages/mosaic/framework/tools/lease-broker/activation_version_gate.py

@@ -62,14 +62,7 @@ EXPECTED_ACTIVATION_CAPABILITY: Final[ActivationCapability] = {
 # capability as compact JSON.
 LEASE_CAPABILITY_PROBE_COMMAND: Final = "__lease-capability"
 
-# Budget for the out-of-process `mosaic __lease-capability` probe. The CLI
+PROBE_TIMEOUT_SECONDS: Final = 2.0
-# is a Node program whose cold start alone measures 2.2-2.3s on a mid-range
-# workstation (sb-it-1-dt, 2026-08-13), so a 2s budget made every launch on
-# such hosts fail closed with the #869 skew message even though the
-# capability matched. The timeout only bounds the pathological hang case —
-# the happy path returns as soon as the probe exits — so a generous budget
-# costs nothing on healthy hosts.
-PROBE_TIMEOUT_SECONDS: Final = 10.0
 
 # Override hook: a full shell-style command line (parsed with `shlex.split`)
 # to run INSTEAD of resolving `mosaic` on PATH and appending the probe
@@ -95,13 +88,7 @@ def _resolve_probe_command(environ: Mapping[str, str]) -> list[str] | None:
     if override:
         parsed = shlex.split(override)
         return parsed or None
-    # Resolve against the PROVIDED environment's PATH, not the ambient
+    resolved = shutil.which("mosaic")
-    # os.environ. Before this, a test passing a hermetic environ still
-    # resolved (and spawned) the host's real `mosaic` — masked only on hosts
-    # where the real probe happened to exceed the old 2s timeout. No PATH in
-    # the provided environment means nothing is resolvable (fail-closed),
-    # matching the probe's overall contract.
-    resolved = shutil.which("mosaic", path=environ.get("PATH", ""))
     if resolved is None:
         return None
     return [resolved, LEASE_CAPABILITY_PROBE_COMMAND]

packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt

@@ -32,6 +32,10 @@ packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a re
 packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)
 
 # --- single-suite directories: unmeasured in CI ---
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | unmeasured in CI image; stubs tmux via a fake bin dir, likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/glpi/test-list-http-status.sh | unmeasured in CI image; stub-based (#807 regression harness), likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/orchestrator/test-board-roll.sh | unmeasured in CI image; file-fixture based, likely CI-fit; #1017 burndown
+packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasured in CI image; drives ci-wait.sh against a stub pipeline-status.sh, likely CI-fit; #1017 burndown
 
 # --- naming-boundary files the strict test-*.sh prefix cannot even name ---
 # (#1017: three independent censuses handled the microtest file three different

packages/mosaic/package.json

@@ -24,9 +24,8 @@
     "build": "tsc",
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm run test:vitest && pnpm run test:framework-shell",
+    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:vitest": "pnpm run build && vitest run --passWithNoTests",
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/commands/compose-contract.spec.ts

@@ -15,7 +15,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { FileConfigAdapter } from '../config/file-adapter.js';
-import { seedFleetIdentityDefaults } from './fleet-first-start-identity.js';
 import { composeContract } from './launch.js';
 
 /**
@@ -320,7 +319,6 @@ describe('composeContract — overlay composer', () => {
         ].join('\n'),
       );
       process.env['MOSAIC_AGENT_NAME'] = 'exact-self';
-      expect(seedFleetIdentityDefaults(installedHome)).toEqual(['SOUL.md', 'USER.md']);
 
       const composed = composeContract('pi', installedHome);
       expect(composed).toContain(sourceTools);
@@ -334,49 +332,6 @@ describe('composeContract — overlay composer', () => {
     }
   });
 
-  it('refuses a fleet USER.md replacement symlink at the point of composition', () => {
-    mkdirSync(join(fixture.home, 'fleet'), { recursive: true });
-    writeFileSync(
-      join(fixture.home, 'fleet', 'roster.yaml'),
-      [
-        'version: 1',
-        'transport: tmux',
-        'agents:',
-        '  - name: exact-user-seat',
-        '    runtime: pi',
-        '    class: worker',
-        '',
-      ].join('\n'),
-    );
-    process.env['MOSAIC_AGENT_NAME'] = 'exact-user-seat';
-    process.env['MOSAIC_AGENT_CLASS'] = 'worker';
-    writeFileSync(join(fixture.home, 'defaults', 'SOUL.md'), '# Generic soul\n');
-    writeFileSync(join(fixture.home, 'defaults', 'USER.md'), '# Generic user\n');
-    expect(seedFleetIdentityDefaults(fixture.home)).toEqual(['SOUL.md']);
-
-    const userPath = join(fixture.home, 'USER.md');
-    const external = join(fixture.root, 'attacker-user.md');
-    writeFileSync(external, 'UNSAFE-REPLACEMENT-USER-CONTENT\n');
-    rmSync(userPath);
-    symlinkSync(external, userPath);
-
-    expect(() => composeContract('pi', fixture.home)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${userPath}`,
-    );
-    expect(readFileSync(external, 'utf8')).toBe('UNSAFE-REPLACEMENT-USER-CONTENT\n');
-  });
-
-  it('preserves tolerant standalone composition when optional USER.md is unreadable', () => {
-    const userPath = join(fixture.home, 'USER.md');
-    rmSync(userPath);
-    mkdirSync(userPath);
-
-    const out = composeContract('pi', fixture.home);
-
-    expect(out).toContain(AGENTS);
-    expect(out).not.toContain('# User Profile');
-  });
-
   it.each(['claude', 'codex', 'opencode', 'pi'] as const)(
     'never injects installed TOOLS.md through a target symlink for %s',
     (runtime) => {

packages/mosaic/src/commands/fleet-first-start-identity.spec.ts

@@ -1,182 +0,0 @@
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  lstatSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { afterEach, describe, expect, it } from 'vitest';
-import {
-  linkIdentityContractNoClobber,
-  seedFleetIdentityDefaults,
-} from './fleet-first-start-identity.js';
-
-const roots: string[] = [];
-const DEFAULT_SOUL = '# Generic soul\n';
-const DEFAULT_USER = '# Generic user\n';
-
-function writeFixture(path: string, content: string | Buffer, mode: number = 0o600): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  writeFileSync(path, content, { mode });
-  chmodSync(path, mode);
-}
-
-function createMosaicHome(): string {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-seed-'));
-  roots.push(root);
-  const mosaicHome = join(root, 'home', '.config', 'mosaic');
-  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), DEFAULT_SOUL);
-  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), DEFAULT_USER);
-  return mosaicHome;
-}
-
-function temporarySeeds(mosaicHome: string): string[] {
-  return readdirSync(mosaicHome).filter((entry) => entry.includes('.fleet-seed-'));
-}
-
-afterEach((): void => {
-  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
-});
-
-describe('linkIdentityContractNoClobber', () => {
-  it('returns false and preserves a destination that already exists', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'source.tmp');
-    const destination = join(mosaicHome, 'destination.md');
-    writeFixture(source, 'candidate\n');
-    writeFixture(destination, 'operator\n');
-
-    expect(linkIdentityContractNoClobber(source, destination)).toBe(false);
-    expect(readFileSync(destination, 'utf8')).toBe('operator\n');
-  });
-
-  it('does not misclassify an unexpected link failure as a concurrent winner', () => {
-    const mosaicHome = createMosaicHome();
-    const missingSource = join(mosaicHome, 'missing.tmp');
-
-    expect(() =>
-      linkIdentityContractNoClobber(missingSource, join(mosaicHome, 'destination.md')),
-    ).toThrow();
-  });
-});
-
-describe('seedFleetIdentityDefaults', () => {
-  it('publishes complete owner-private default snapshots', () => {
-    const mosaicHome = createMosaicHome();
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
-
-    for (const [entry, expected] of [
-      ['SOUL.md', DEFAULT_SOUL],
-      ['USER.md', DEFAULT_USER],
-    ] as const) {
-      const path = join(mosaicHome, entry);
-      expect(readFileSync(path, 'utf8')).toBe(expected);
-      expect(statSync(path).mode & 0o777).toBe(0o600);
-    }
-    expect(temporarySeeds(mosaicHome)).toEqual([]);
-  });
-
-  it('preserves an existing regular contract byte-for-byte and mode-for-mode', () => {
-    const mosaicHome = createMosaicHome();
-    const customSoul = '# Operator-owned soul\n';
-    writeFixture(join(mosaicHome, 'SOUL.md'), customSoul, 0o640);
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['USER.md']);
-    expect(readFileSync(join(mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(statSync(join(mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-  });
-
-  it('is idempotent after both installed contracts exist', () => {
-    const mosaicHome = createMosaicHome();
-
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual(['SOUL.md', 'USER.md']);
-    expect(seedFleetIdentityDefaults(mosaicHome)).toEqual([]);
-    expect(temporarySeeds(mosaicHome)).toEqual([]);
-  });
-
-  it('validates every required source before publishing any destination', () => {
-    const mosaicHome = createMosaicHome();
-    const missing = join(mosaicHome, 'defaults', 'USER.md');
-    rmSync(missing);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${missing}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('fails closed when the configured Mosaic home is not a directory', () => {
-    const root = mkdtempSync(join(tmpdir(), 'mosaic-identity-invalid-home-'));
-    roots.push(root);
-    const mosaicHome = join(root, 'mosaic-home');
-    writeFixture(mosaicHome, 'not a directory\n');
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${join(mosaicHome, 'SOUL.md')}`,
-    );
-  });
-
-  it('refuses a symlinked default instead of following it', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'defaults', 'SOUL.md');
-    rmSync(source);
-    symlinkSync(join(mosaicHome, 'defaults', 'USER.md'), source);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${source}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-  });
-
-  it('refuses an existing symlinked destination without replacing it', () => {
-    const mosaicHome = createMosaicHome();
-    const destination = join(mosaicHome, 'SOUL.md');
-    symlinkSync(join(mosaicHome, 'defaults', 'SOUL.md'), destination);
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity installed is unavailable or unsafe: ${destination}`,
-    );
-    expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it.each(['SOUL.md', 'USER.md'] as const)(
-    'rejects a dangling %s destination before publishing its counterpart',
-    (entry) => {
-      const mosaicHome = createMosaicHome();
-      const destination = join(mosaicHome, entry);
-      const counterpart = join(mosaicHome, entry === 'SOUL.md' ? 'USER.md' : 'SOUL.md');
-      symlinkSync(join(mosaicHome, 'missing-identity-target'), destination);
-
-      expect(existsSync(destination)).toBe(false);
-      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-      expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-        `fleet identity installed is unavailable or unsafe: ${destination}`,
-      );
-      expect(lstatSync(destination).isSymbolicLink()).toBe(true);
-      expect(existsSync(counterpart)).toBe(false);
-    },
-  );
-
-  it('rejects an oversized source before publishing a partial identity', () => {
-    const mosaicHome = createMosaicHome();
-    const source = join(mosaicHome, 'defaults', 'USER.md');
-    writeFixture(source, Buffer.alloc(256 * 1024 + 1, 0x61));
-
-    expect(() => seedFleetIdentityDefaults(mosaicHome)).toThrow(
-      `fleet identity default is unavailable or unsafe: ${source}`,
-    );
-    expect(existsSync(join(mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(mosaicHome, 'USER.md'))).toBe(false);
-  });
-});

packages/mosaic/src/commands/fleet-first-start-identity.ts

@@ -1,120 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { linkSync, lstatSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { readRegularFileSecure } from '../fleet/secure-file.js';
-
-const MAX_IDENTITY_CONTRACT_BYTES = 256 * 1024;
-export const FLEET_IDENTITY_DEFAULTS = ['SOUL.md', 'USER.md'] as const;
-
-function isFilesystemError(error: unknown, code: string): boolean {
-  return error instanceof Error && 'code' in error && error.code === code;
-}
-
-/** @internal Publish a complete temporary file without replacing any path. */
-export function linkIdentityContractNoClobber(source: string, destination: string): boolean {
-  try {
-    linkSync(source, destination);
-    return true;
-  } catch (error: unknown) {
-    if (isFilesystemError(error, 'EEXIST')) return false;
-    throw error;
-  }
-}
-
-function unsafeIdentityError(kind: 'default' | 'installed', path: string, error: unknown): Error {
-  const reason = error instanceof Error ? error.message : String(error);
-  return new Error(`fleet identity ${kind} is unavailable or unsafe: ${path} (${reason})`);
-}
-
-function readIdentityContract(
-  mosaicHome: string,
-  path: string,
-  kind: 'default' | 'installed',
-): Buffer {
-  try {
-    return readRegularFileSecure(path, {
-      root: mosaicHome,
-      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
-    }).content;
-  } catch (error: unknown) {
-    throw unsafeIdentityError(kind, path, error);
-  }
-}
-
-function installedEntryExists(path: string): boolean {
-  try {
-    lstatSync(path);
-    return true;
-  } catch (error: unknown) {
-    if (isFilesystemError(error, 'ENOENT')) return false;
-    throw unsafeIdentityError('installed', path, error);
-  }
-}
-
-/** Secure fleet point-of-use read for a top-level identity contract. */
-export function readInstalledIdentityContractAtPointOfUse(
-  mosaicHome: string,
-  entry: (typeof FLEET_IDENTITY_DEFAULTS)[number],
-): Buffer {
-  const configuredPath = join(mosaicHome, entry);
-  try {
-    // Preserve the launcher's established support for a symlinked Mosaic home,
-    // while pinning this read to the resolved directory. O_NOFOLLOW still
-    // rejects replacement of the identity file itself (or any child ancestor).
-    const canonicalHome = realpathSync(mosaicHome);
-    return readRegularFileSecure(join(canonicalHome, entry), {
-      root: canonicalHome,
-      maxBytes: MAX_IDENTITY_CONTRACT_BYTES,
-    }).content;
-  } catch (error: unknown) {
-    throw unsafeIdentityError('installed', configuredPath, error);
-  }
-}
-
-/**
- * Seed the generic identity base required by unattended fleet launches.
- *
- * Exact seat identity remains roster-owned and is injected later by the
- * runtime composer. Each destination appears atomically through a hard link to
- * a complete owner-private temporary file; a concurrent first seat may win the
- * link without allowing either process to overwrite operator content.
- */
-export function seedFleetIdentityDefaults(mosaicHome: string): string[] {
-  const snapshots = new Map<(typeof FLEET_IDENTITY_DEFAULTS)[number], Buffer>();
-
-  for (const entry of FLEET_IDENTITY_DEFAULTS) {
-    const destination = join(mosaicHome, entry);
-    if (installedEntryExists(destination)) {
-      readIdentityContract(mosaicHome, destination, 'installed');
-      continue;
-    }
-    const source = join(mosaicHome, 'defaults', entry);
-    snapshots.set(entry, readIdentityContract(mosaicHome, source, 'default'));
-  }
-
-  const seeded: string[] = [];
-  for (const [entry, content] of snapshots) {
-    const destination = join(mosaicHome, entry);
-    const temporary = join(
-      mosaicHome,
-      `.${entry}.fleet-seed-${process.pid.toString()}-${randomBytes(6).toString('hex')}`,
-    );
-    let temporaryCreated = false;
-    try {
-      writeFileSync(temporary, content, { flag: 'wx', mode: 0o600 });
-      temporaryCreated = true;
-      if (linkIdentityContractNoClobber(temporary, destination)) {
-        seeded.push(entry);
-      } else {
-        readIdentityContract(mosaicHome, destination, 'installed');
-      }
-    } finally {
-      if (temporaryCreated) rmSync(temporary, { force: true });
-    }
-  }
-
-  for (const entry of FLEET_IDENTITY_DEFAULTS) {
-    readIdentityContract(mosaicHome, join(mosaicHome, entry), 'installed');
-  }
-  return seeded;
-}

packages/mosaic/src/commands/fleet-roster-v2-dispatch.spec.ts

@@ -1,323 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { Command } from 'commander';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { registerFleetCommand, type CommandResult, type CommandRunner } from './fleet.js';
-
-/**
- * #1237: the v1-only commands (`ps`, `install`, `install-systemd`, `add`,
- * `remove`) rejected a roster-v2 fleet outright, so a greenfield v2 box could
- * never get its units placed. These tests pin the three behaviours that fix
- * gives it, and the two it deliberately does NOT give it.
- *
- * The load-bearing negative is that `install` on v2 writes no generated env:
- * the reconciler owns that file through projectRosterV2AgentGeneratedEnv, and a
- * second writer here — necessarily through the v1 mapping — is exactly the
- * drift the #791 single-SSOT invariant exists to prevent.
- */
-
-const rosterV2 = `
-version: 2
-generation: 4
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: /srv/mosaic
-  runtime: pi
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: coder0
-    alias: Coder 0
-    class: code
-    runtime: pi
-    provider: openai
-    model: gpt-5.6-sol
-    reasoning: high
-    tool_policy: code
-    working_directory: /srv/mosaic
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: true
-  - name: coder1
-    alias: Coder 1
-    class: code
-    runtime: pi
-    provider: openai
-    model: gpt-5.6-sol
-    reasoning: medium
-    tool_policy: code
-    working_directory: /srv/other
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: true
-`;
-
-let tempHome: string | undefined;
-const savedHome = process.env.HOME;
-const savedMosaicHome = process.env.MOSAIC_HOME;
-
-afterEach(async (): Promise<void> => {
-  vi.restoreAllMocks();
-  process.exitCode = undefined;
-  if (savedHome === undefined) delete process.env.HOME;
-  else process.env.HOME = savedHome;
-  if (savedMosaicHome === undefined) delete process.env.MOSAIC_HOME;
-  else process.env.MOSAIC_HOME = savedMosaicHome;
-  if (tempHome) await rm(tempHome, { recursive: true, force: true });
-  tempHome = undefined;
-});
-
-/**
- * A HOME with a roster-v2 fleet and nothing else — the greenfield shape, before
- * anything has been installed, applied or started.
- */
-async function v2Home(): Promise<string> {
-  tempHome = await mkdtemp(join(tmpdir(), 'mosaic-fleet-v2-dispatch-'));
-  process.env.HOME = tempHome;
-  delete process.env.MOSAIC_HOME;
-  const mosaicHome = join(tempHome, '.config', 'mosaic');
-  for (const directory of ['fleet', 'fleet/agents', 'fleet/roles']) {
-    await mkdir(join(mosaicHome, directory), { recursive: true, mode: 0o700 });
-  }
-  await writeFile(join(mosaicHome, 'fleet', 'roster.yaml'), rosterV2, { mode: 0o600 });
-  await writeFile(join(mosaicHome, 'fleet', 'roles', 'code.md'), '`class: code`\n\n# code\n', {
-    mode: 0o600,
-  });
-  return mosaicHome;
-}
-
-/**
- * Stands in for a box where nothing is running: every systemctl and tmux probe
- * fails the way it does before the holder has ever started. `ps` must survive
- * this — it is the command an operator reaches for to find out *why* there is
- * no seat, so it has to report the emptiness rather than fail on it.
- */
-const greenfieldRunner: CommandRunner = async (command): Promise<CommandResult> => {
-  if (command === 'tmux') {
-    return { stdout: '', stderr: 'no server running on /tmp/tmux-1000/mosaic-fleet', exitCode: 1 };
-  }
-  return { stdout: '', stderr: '', exitCode: 1 };
-};
-
-function program(runner: CommandRunner = greenfieldRunner): Command {
-  const result = new Command();
-  result.exitOverride();
-  registerFleetCommand(result, { runner, frameworkRoot: resolve(process.cwd(), 'framework') });
-  return result;
-}
-
-function capture(): string[] {
-  const lines: string[] = [];
-  vi.spyOn(console, 'log').mockImplementation((value: string): void => {
-    lines.push(value);
-  });
-  return lines;
-}
-
-async function exists(path: string): Promise<boolean> {
-  try {
-    await stat(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-describe('mosaic fleet ps — roster v2', (): void => {
-  it('lists every v2 agent on a greenfield box with nothing running, and does not throw', async (): Promise<void> => {
-    await v2Home();
-    const lines = capture();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'ps', '--json']),
-    ).resolves.toBeDefined();
-
-    const rows = JSON.parse(lines.join('\n')) as {
-      name: string;
-      runtime: string;
-      alias?: string;
-      paneAlive: boolean;
-      source: string;
-    }[];
-    expect(rows.map((row) => row.name).sort()).toEqual(['coder0', 'coder1']);
-    // The v2 roster's per-agent fields must survive the read model, not be
-    // flattened into defaults.
-    expect(rows.every((row) => row.runtime === 'pi')).toBe(true);
-    expect(rows.find((row) => row.name === 'coder0')?.alias).toBe('Coder 0');
-    // Nothing is running, and that is a report, not an error.
-    expect(rows.every((row) => row.paneAlive === false)).toBe(true);
-    expect(rows.every((row) => row.source === 'roster')).toBe(true);
-    expect(process.exitCode ?? 0).toBe(0);
-  });
-});
-
-describe('mosaic fleet install — roster v2', (): void => {
-  it('places the tool files and unit templates', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    capture();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']),
-    ).resolves.toBeDefined();
-
-    // Units live in the systemd user dir, not under the Mosaic home.
-    const systemdUserDir = join(tempHome!, '.config', 'systemd', 'user');
-    for (const unit of [
-      'mosaic-tmux-holder.service',
-      '[email protected]',
-      '[email protected]',
-    ]) {
-      expect(await exists(join(systemdUserDir, unit))).toBe(true);
-    }
-    const launcher = join(mosaicHome, 'tools', 'fleet', 'start-agent-session.sh');
-    expect(await exists(launcher)).toBe(true);
-    expect((await stat(launcher)).mode & 0o777).toBe(0o755);
-  });
-
-  it('writes NO generated env — that file belongs to the reconciler (#791)', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    capture();
-
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    const agentDir = join(mosaicHome, 'fleet', 'agents');
-    expect(await readdir(agentDir)).toEqual([]);
-  });
-
-  it('tells the operator which command does own the env', async (): Promise<void> => {
-    await v2Home();
-    const lines = capture();
-
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    expect(lines.join('\n')).toContain('mosaic fleet apply');
-  });
-});
-
-describe('[email protected]', (): void => {
-  const unitPath = resolve(process.cwd(), 'framework', 'systemd', 'user', '[email protected]');
-
-  /** The single `ConditionPathExists=` value declared by the unit template. */
-  async function conditionPath(): Promise<string> {
-    const unit = await readFile(unitPath, 'utf8');
-    const matches = unit.match(/^ConditionPathExists=(.+)$/gm) ?? [];
-    expect(matches).toHaveLength(1);
-    return matches[0]!.slice('ConditionPathExists='.length).trim();
-  }
-
-  it('will not attempt a seat before the reconciler has written its env', async (): Promise<void> => {
-    // The pairing that makes "install writes no env" safe: install enables the
-    // unit (WantedBy=default.target) but does not start it, so without this
-    // condition a reboot between `install` and the first `apply` would run
-    // ExecStart against an absent env file and fail every seat unit.
-    expect(await conditionPath()).toBe('%h/.config/mosaic/fleet/agents/%i.env.generated');
-  });
-
-  /**
-   * The two halves of the guard's *effect*, which no assertion on the literal
-   * string can cover on its own.
-   *
-   * Measured end to end on a real box (canary, 2026-08-16) rather than inferred:
-   * with the condition, `systemctl --user start mosaic-agent@<name>` on an agent
-   * with no generated env returns rc=0, `Result=success`, `ConditionResult=no`,
-   * and journals "skipped, unmet condition check". With the condition removed by
-   * drop-in and nothing else changed, the same start returns rc=1,
-   * `Result=exit-code`, `ExecMainStatus=64`, and the unit enters `failed`.
-   *
-   * systemd is not available in this suite, so these two tests pin the parts
-   * that can drift in code: the condition naming a *different* file than the one
-   * the fleet actually writes, and the launcher quietly becoming tolerant of an
-   * absent env — either of which turns the condition into decoration while the
-   * literal-string assertion above still passes.
-   */
-  it('guards exactly the file the fleet writes, so the two cannot drift apart', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    const rendered = (await conditionPath()).replace('%h', tempHome!).replace('%i', 'coder0');
-
-    // The path an installed fleet actually places for this agent.
-    expect(rendered).toBe(join(mosaicHome, 'fleet', 'agents', 'coder0.env.generated'));
-  });
-
-  it('guards a real failure — the launcher rejects an absent generated env', async (): Promise<void> => {
-    await v2Home();
-    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
-
-    // Exactly what ExecStart runs, against the state the condition exists to
-    // catch: unit enabled, reconciler has not written env yet.
-    const launched = await new Promise<{ code: number | null; stderr: string }>((settle) => {
-      const child = execFile(
-        '/bin/bash',
-        [
-          '--noprofile',
-          '--norc',
-          join(tempHome!, '.config', 'mosaic', 'tools', 'fleet', 'start-agent-session.sh'),
-          'coder0',
-        ],
-        { env: { HOME: tempHome!, MOSAIC_AGENT_NAME: 'coder0', PATH: '/usr/bin:/bin' } },
-        (_error, _stdout, stderr) => {
-          settle({ code: child.exitCode, stderr });
-        },
-      );
-    });
-
-    expect(launched.code).not.toBe(0);
-    expect(launched.stderr).toContain('missing-file');
-  });
-});
-
-describe('mosaic fleet add / remove — roster v2', (): void => {
-  it('add refuses, and names the two-step v2 sequence instead of inventing defaults', async (): Promise<void> => {
-    await v2Home();
-
-    await expect(
-      program().parseAsync([
-        'node',
-        'mosaic',
-        'fleet',
-        'add',
-        'coder2',
-        '--runtime',
-        'pi',
-        '--class',
-        'code',
-      ]),
-    ).rejects.toThrow(/mosaic fleet create[\s\S]*mosaic fleet apply/);
-  });
-
-  it('remove refuses, and names delete plus apply', async (): Promise<void> => {
-    await v2Home();
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
-    ).rejects.toThrow(/mosaic fleet delete coder1[\s\S]*mosaic fleet apply/);
-  });
-
-  // Note: this one passes on the unmodified tree too — there `remove` throws in
-  // the v1 parser, before it can touch anything. It is a regression guard on the
-  // ordering of the new guard clause, not evidence that the fix works.
-  it('refuses BEFORE mutating the roster', async (): Promise<void> => {
-    const mosaicHome = await v2Home();
-    const rosterPath = join(mosaicHome, 'fleet', 'roster.yaml');
-    const before = await readFile(rosterPath, 'utf8');
-
-    await expect(
-      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
-    ).rejects.toThrow();
-
-    expect(await readFile(rosterPath, 'utf8')).toBe(before);
-  });
-});

packages/mosaic/src/commands/fleet.ts

@@ -34,7 +34,6 @@ export {
   resolveInstalledFleetRosterPath,
 } from '../fleet/fleet-roster-v1.js';
 export type { FleetAgent, FleetRoster } from '../fleet/fleet-roster-v1.js';
-import { parseRosterV2 } from '../fleet/roster-v2.js';
 import {
   registerFleetAgentCrudCommands,
   type FleetAgentCrudCommandDeps,
@@ -821,7 +820,7 @@ export function buildEnableLingerCommand(user: string): string[] {
  */
 export async function enableFleetUnits(
   runner: CommandRunner,
-  roster: { readonly agents: readonly { readonly name: string }[] },
+  roster: FleetRoster,
   opts: { enable?: boolean },
 ): Promise<void> {
   if (opts.enable === false) {
@@ -1528,8 +1527,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      // Unit enablement needs agent names only, so it reads either version.
+      const roster = await loadRosterForCommand(cmd);
-      const roster = await loadRosterReadModel(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1539,8 +1537,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      // Unit enablement needs agent names only, so it reads either version.
+      const roster = await loadRosterForCommand(cmd);
-      const roster = await loadRosterReadModel(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1691,9 +1688,7 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .action(async (opts: { json?: boolean }) => {
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-      // ps only reads, so it takes the version-agnostic read model rather than
+      const roster = await loadRosterForCommand(cmd);
-      // the v1 parser, which rejects a v2 roster outright.
-      const roster = await loadRosterReadModel(cmd);
       const { tenant_id, host } = getDefaultTenantAndHost();
       const nowMs = Date.now();
 
@@ -1913,16 +1908,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
           start: boolean;
         },
       ) => {
-        if (await usesRosterV2ControlPlane(cmd)) {
-          // command.error, not a bare throw: this is operator guidance, and a
-          // bare throw reaches the top level uncaught and prints it under a Node
-          // stack trace. Measured on canary — the message is the whole point of
-          // the refusal, so it has to arrive readable.
-          cmd.error(rosterV2MutationGuidance('add', 'create', name), {
-            code: 'fleet.roster-v2',
-            exitCode: 1,
-          });
-        }
         if (!VALID_FLEET_RUNTIMES.includes(opts.runtime)) {
           throw new Error(
             `Invalid runtime "${opts.runtime}". Valid runtimes: ${VALID_FLEET_RUNTIMES.join(', ')}.`,
@@ -1988,12 +1973,6 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .description('Remove an agent from the fleet roster')
     .option('--keep-files', 'Skip deleting env and heartbeat files')
     .action(async (name: string, opts: { keepFiles?: boolean }) => {
-      if (await usesRosterV2ControlPlane(cmd)) {
-        cmd.error(rosterV2MutationGuidance('remove', 'delete', name), {
-          code: 'fleet.roster-v2',
-          exitCode: 1,
-        });
-      }
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
       const rosterPath = await resolveRosterPath(commandOpts.mosaicHome, commandOpts.roster);
@@ -2352,9 +2331,7 @@ export function registerFleetAgentCommands(
 async function installFleet(cmd: Command, frameworkRoot: string): Promise<void> {
   const activePaths = resolveFleetPaths(cmd.opts<{ mosaicHome: string }>().mosaicHome);
   assertDefaultMosaicHomeForSystemd(activePaths.mosaicHome);
-  // Read model first: every file this function places is roster-independent, and
+  const roster = await loadRosterForCommand(cmd);
-  // the v1 parser would reject a v2 roster before any of them were written.
-  const roster = await loadRosterReadModel(cmd);
   await ensureFleetHolderIdentity(activePaths.mosaicHome);
   await mkdir(activePaths.fleetToolsDir, { recursive: true });
   await mkdir(activePaths.tmuxToolsDir, { recursive: true });
@@ -2414,30 +2391,16 @@ async function installFleet(cmd: Command, frameworkRoot: string): Promise<void>
     join(activePaths.systemdUserDir, '[email protected]'),
   );
 
-  // On roster v2 the reconciler owns the generated env: `apply` writes it and
+  for (const agent of roster.agents) {
-  // `regen` rebuilds it, both from projectRosterV2AgentGeneratedEnv. Writing it
-  // here too — necessarily through the v1 mapping — would be the third writer of
-  // one file and would break the #791 single-SSOT invariant. So v2 gets the tool
-  // files and the units, and nothing else.
-  if (roster.version === 2) {
-    console.log(
-      `Installed fleet tools and systemd units for ${roster.agents.length} agent(s). ` +
-        `Generated env is owned by the reconciler on roster v2 — run: mosaic fleet apply --expected-generation <n>`,
-    );
-    return;
-  }
-
-  const v1Roster = await loadRosterForCommand(cmd);
-  for (const agent of v1Roster.agents) {
     await writeAgentEnvironmentProjection({
       mosaicHome: activePaths.mosaicHome,
       agentEnvDir: activePaths.agentEnvDir,
       agentName: agent.name,
-      generated: generateAgentEnvValues(v1Roster, agent),
+      generated: generateAgentEnvValues(roster, agent),
     });
   }
 
-  console.log(`Installed fleet files for ${v1Roster.agents.length} agent(s).`);
+  console.log(`Installed fleet files for ${roster.agents.length} agent(s).`);
 }
 
 async function loadRosterForCommand(cmd: Command): Promise<FleetRoster> {
@@ -2464,77 +2427,6 @@ async function usesRosterV2ControlPlane(cmd: Command): Promise<boolean> {
   );
 }
 
-/**
- * `add`/`remove` and `create`/`delete` are not two spellings of one operation.
- * The v1 pair edits the roster *and* drives systemd; the v2 pair is documented
- * as changing desired state "without runtime actions", leaving convergence to
- * `apply`. `add` also collects four fields where a v2 agent requires eleven, so
- * routing it to `create` would mean inventing provider, alias, reasoning and
- * tool-policy defaults on the operator's behalf. Refusing with the real command
- * is honest; silently guessing an agent's provider is not.
- */
-function rosterV2MutationGuidance(
-  v1Command: 'add' | 'remove',
-  v2Command: 'create' | 'delete',
-  name: string,
-): string {
-  const target = v2Command === 'delete' ? ` ${name}` : '';
-  return (
-    `mosaic fleet ${v1Command} does not operate on a roster-v2 fleet. ` +
-    `Roster v2 separates desired state from convergence:\n` +
-    `  1. mosaic fleet ${v2Command}${target} --expected-generation <current> ` +
-    `${v2Command === 'create' ? "--agent '<json>' " : ''}` +
-    `(edits the roster only)\n` +
-    `  2. mosaic fleet apply --expected-generation <new> (converges systemd and tmux)\n` +
-    `Read the current generation with: mosaic fleet status`
-  );
-}
-
-/**
- * The read-only fields shared by roster v1 and v2, for the commands that only
- * ever *read* the roster (`ps`, and unit enablement inside `install`).
- *
- * This is deliberately NOT a v2→v1 downshift. A downshifted `FleetRoster` would
- * be accepted by `generateAgentEnvValues`, and that would make a third writer of
- * `fleet/agents/<name>.env.generated` — through the v1 mapping — breaking the
- * #791 single-SSOT invariant that {@link projectRosterV2AgentGeneratedEnv} is
- * documented to hold. Keeping the read model this small makes that misuse
- * impossible: there is nothing here to write a roster or an env file back from.
- */
-interface FleetRosterReadModel {
-  readonly version: 1 | 2;
-  readonly tmux: { readonly socketName: string; readonly holderSession: string };
-  readonly agents: readonly {
-    readonly name: string;
-    readonly alias?: string;
-    readonly runtime: string;
-  }[];
-}
-
-/** Reads either roster version into the shared read-only view. */
-async function loadRosterReadModel(cmd: Command): Promise<FleetRosterReadModel> {
-  const opts = cmd.opts<{ mosaicHome: string; roster?: string }>();
-  const path = await resolveRosterPath(opts.mosaicHome, opts.roster);
-  if (!(await usesRosterV2ControlPlane(cmd))) {
-    const v1 = await loadRosterAtPath(cmd, path);
-    return {
-      version: 1,
-      tmux: { socketName: v1.tmux.socketName, holderSession: v1.tmux.holderSession },
-      agents: v1.agents,
-    };
-  }
-  try {
-    const v2 = parseRosterV2(await readFleetRosterText(path), 'yaml');
-    return {
-      version: 2,
-      tmux: { socketName: v2.tmux.socketName, holderSession: v2.tmux.holderSession },
-      agents: v2.agents,
-    };
-  } catch (error) {
-    reportFleetRosterConfigurationError(cmd, error);
-  }
-}
-
 async function loadRosterFromAgentCommand(
   command: Command,
   mosaicHomeOverride?: string,

packages/mosaic/src/commands/launch-first-start.spec.ts

@@ -1,393 +0,0 @@
-import { spawn, spawnSync, type SpawnSyncReturns } from 'node:child_process';
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  statSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { afterEach, describe, expect, it } from 'vitest';
-
-const CLI_PATH = fileURLToPath(new URL('../../dist/cli.js', import.meta.url));
-const DEFAULT_SOUL_PATH = fileURLToPath(
-  new URL('../../framework/defaults/SOUL.md', import.meta.url),
-);
-const DEFAULT_USER_PATH = fileURLToPath(
-  new URL('../../framework/defaults/USER.md', import.meta.url),
-);
-
-interface GreenfieldFixture {
-  readonly root: string;
-  readonly home: string;
-  readonly mosaicHome: string;
-  readonly binDir: string;
-  readonly capturePath: string;
-}
-
-interface AsyncLaunchResult {
-  readonly status: number | null;
-  readonly signal: NodeJS.Signals | null;
-  readonly stdout: string;
-  readonly stderr: string;
-}
-
-const fixtures: string[] = [];
-
-function writeFixture(path: string, content: string, mode: number = 0o600): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  writeFileSync(path, content, { encoding: 'utf8', mode });
-  chmodSync(path, mode);
-}
-
-function createGreenfieldFixture(): GreenfieldFixture {
-  const root = mkdtempSync(join(tmpdir(), 'mosaic-first-start-'));
-  fixtures.push(root);
-  const home = join(root, 'home');
-  const mosaicHome = join(home, '.config', 'mosaic');
-  const binDir = join(root, 'bin');
-  const capturePath = join(root, 'runtime-boundary.json');
-
-  mkdirSync(binDir, { recursive: true, mode: 0o700 });
-  writeFixture(join(mosaicHome, 'AGENTS.md'), '# Agent dispatcher\n');
-  writeFixture(join(mosaicHome, 'runtime', 'pi', 'RUNTIME.md'), '# Pi runtime\n');
-  writeFixture(join(mosaicHome, 'defaults', 'SOUL.md'), readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
-  writeFixture(join(mosaicHome, 'defaults', 'USER.md'), readFileSync(DEFAULT_USER_PATH, 'utf8'));
-  writeFixture(
-    join(mosaicHome, 'fleet', 'roster.yaml'),
-    `version: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: ~
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: unattended-seat
-    runtime: pi
-    class: worker
-`,
-  );
-  writeFixture(
-    join(mosaicHome, 'tools', 'tmux', 'agent-send.sh'),
-    '#!/usr/bin/env bash\nexit 0\n',
-    0o755,
-  );
-  writeFixture(
-    join(mosaicHome, 'tools', 'lease-broker', 'launch-runtime.py'),
-    `#!/usr/bin/env python3
-import json
-import os
-import pathlib
-import sys
-pathlib.Path(os.environ["MOSAIC_TEST_RUNTIME_CAPTURE"]).write_text(
-    json.dumps({"argv": sys.argv[1:]}), encoding="utf-8"
-)
-`,
-    0o755,
-  );
-  // checkRuntime() must find Pi, while the fake broker boundary prevents this
-  // executable from running or making a provider call.
-  writeFixture(join(binDir, 'pi'), '#!/usr/bin/env bash\nexit 97\n', 0o755);
-
-  return { root, home, mosaicHome, binDir, capturePath };
-}
-
-function launchEnvironment(
-  fixture: GreenfieldFixture,
-  capturePath: string,
-  fleet: boolean = true,
-  agentName: string = 'unattended-seat',
-  agentClass: string = 'worker',
-): NodeJS.ProcessEnv {
-  return {
-    HOME: fixture.home,
-    MOSAIC_HOME: fixture.mosaicHome,
-    ...(fleet
-      ? {
-          MOSAIC_AGENT_NAME: agentName,
-          MOSAIC_AGENT_CLASS: agentClass,
-        }
-      : {}),
-    MOSAIC_TEST_RUNTIME_CAPTURE: capturePath,
-    PATH: `${fixture.binDir}:/usr/bin:/bin`,
-  };
-}
-
-function launchSync(
-  fixture: GreenfieldFixture,
-  options: {
-    readonly capturePath?: string;
-    readonly fleet?: boolean;
-    readonly agentName?: string;
-    readonly agentClass?: string;
-  } = {},
-): SpawnSyncReturns<string> {
-  const capturePath = options.capturePath ?? fixture.capturePath;
-  return spawnSync(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
-    cwd: fixture.root,
-    encoding: 'utf8',
-    input: '',
-    timeout: 10_000,
-    env: launchEnvironment(
-      fixture,
-      capturePath,
-      options.fleet ?? true,
-      options.agentName ?? 'unattended-seat',
-      options.agentClass ?? 'worker',
-    ),
-  });
-}
-
-function launchAsync(fixture: GreenfieldFixture, capturePath: string): Promise<AsyncLaunchResult> {
-  return new Promise<AsyncLaunchResult>((resolve, reject): void => {
-    const child = spawn(process.execPath, [CLI_PATH, 'yolo', 'pi'], {
-      cwd: fixture.root,
-      env: launchEnvironment(fixture, capturePath),
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.setEncoding('utf8');
-    child.stderr.setEncoding('utf8');
-    child.stdout.on('data', (chunk: string): void => {
-      stdout += chunk;
-    });
-    child.stderr.on('data', (chunk: string): void => {
-      stderr += chunk;
-    });
-    child.on('error', reject);
-    child.on('close', (status: number | null, signal: NodeJS.Signals | null): void => {
-      resolve({ status, signal, stdout, stderr });
-    });
-    child.stdin.end();
-  });
-}
-
-function outputOf(result: { readonly stdout: string; readonly stderr: string }): string {
-  return `${result.stdout}${result.stderr}`;
-}
-
-function assertPrivateDefaultSeeds(fixture: GreenfieldFixture): void {
-  const soul = join(fixture.mosaicHome, 'SOUL.md');
-  const user = join(fixture.mosaicHome, 'USER.md');
-  expect(readFileSync(soul, 'utf8')).toBe(readFileSync(DEFAULT_SOUL_PATH, 'utf8'));
-  expect(readFileSync(user, 'utf8')).toBe(readFileSync(DEFAULT_USER_PATH, 'utf8'));
-  expect(statSync(soul).mode & 0o777).toBe(0o600);
-  expect(statSync(user).mode & 0o777).toBe(0o600);
-}
-
-function capturedArguments(path: string): string[] {
-  const capture = JSON.parse(readFileSync(path, 'utf8')) as { argv: string[] };
-  return capture.argv;
-}
-
-afterEach((): void => {
-  for (const root of fixtures.splice(0)) {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-describe('fleet unattended first start (#1264)', () => {
-  it('reaches the runtime boundary without a TTY or identity wizard on a clean install', () => {
-    const fixture = createGreenfieldFixture();
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.error, output).toBeUndefined();
-    expect(result.status, output).toBe(0);
-    expect(output).toContain('Initialized unattended fleet identity defaults: SOUL.md, USER.md');
-    expect(output).not.toContain('Running setup wizard');
-    expect(output).not.toContain('What would you like to do?');
-    expect(existsSync(fixture.capturePath), output).toBe(true);
-    assertPrivateDefaultSeeds(fixture);
-
-    const argv = capturedArguments(fixture.capturePath);
-    expect(argv).toContain('--runtime');
-    expect(argv.join('\n')).toContain('Agent/session: `unattended-seat`');
-    expect(argv.join('\n')).toContain('Role/class: `worker`');
-  });
-
-  it('preserves existing operator identity bytes without requiring defaults', () => {
-    const fixture = createGreenfieldFixture();
-    const customSoul = '# Operator soul\nNever replace this.\n';
-    const customUser = '# Operator user\nNever replace this either.\n';
-    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
-    writeFixture(join(fixture.mosaicHome, 'USER.md'), customUser, 0o600);
-    rmSync(join(fixture.mosaicHome, 'defaults'), { recursive: true, force: true });
-
-    const first = launchSync(fixture);
-    const secondCapture = join(fixture.root, 'runtime-boundary-second.json');
-    const second = launchSync(fixture, { capturePath: secondCapture });
-
-    expect(first.status, outputOf(first)).toBe(0);
-    expect(second.status, outputOf(second)).toBe(0);
-    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(customUser);
-    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-    expect(existsSync(fixture.capturePath)).toBe(true);
-    expect(existsSync(secondCapture)).toBe(true);
-  });
-
-  it('seeds only the missing identity contract and leaves a custom SOUL byte-exact', () => {
-    const fixture = createGreenfieldFixture();
-    const customSoul = '# Exact custom soul bytes\n';
-    writeFixture(join(fixture.mosaicHome, 'SOUL.md'), customSoul, 0o640);
-
-    const result = launchSync(fixture);
-
-    expect(result.status, outputOf(result)).toBe(0);
-    expect(outputOf(result)).toContain('Initialized unattended fleet identity defaults: USER.md');
-    expect(readFileSync(join(fixture.mosaicHome, 'SOUL.md'), 'utf8')).toBe(customSoul);
-    expect(statSync(join(fixture.mosaicHome, 'SOUL.md')).mode & 0o777).toBe(0o640);
-    expect(readFileSync(join(fixture.mosaicHome, 'USER.md'), 'utf8')).toBe(
-      readFileSync(DEFAULT_USER_PATH, 'utf8'),
-    );
-  });
-
-  it('fails closed without a wizard or partial seed when a required default is missing', () => {
-    const fixture = createGreenfieldFixture();
-    const missingDefault = join(fixture.mosaicHome, 'defaults', 'USER.md');
-    rmSync(missingDefault);
-
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('unattended fleet identity initialization failed');
-    expect(output).toContain(missingDefault);
-    expect(output).not.toContain('Running setup wizard');
-    expect(output).not.toContain('What would you like to do?');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('rejects a symlinked identity default without following it or prompting', () => {
-    const fixture = createGreenfieldFixture();
-    const soulDefault = join(fixture.mosaicHome, 'defaults', 'SOUL.md');
-    rmSync(soulDefault);
-    symlinkSync(DEFAULT_SOUL_PATH, soulDefault);
-
-    const result = launchSync(fixture);
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain(`fleet identity default is unavailable or unsafe: ${soulDefault}`);
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-  });
-
-  it('refuses an unknown ambient fleet name before seeding or prompting', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { agentName: 'not-in-the-roster' });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('canonical fleet identity is unavailable');
-    expect(output).toContain('Agent "not-in-the-roster" is not in the fleet roster');
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it('refuses a mismatched ambient fleet class before seeding or prompting', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { agentClass: 'reviewer' });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('Refusing split identity authority');
-    expect(output).not.toContain('Running setup wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-  });
-
-  it.each(['', ' ', '\t'])(
-    'refuses explicit blank ambient fleet class %j before seeding',
-    (agentClass: string) => {
-      const fixture = createGreenfieldFixture();
-
-      const result = launchSync(fixture, { agentClass });
-      const output = outputOf(result);
-
-      expect(result.status, output).toBe(1);
-      expect(output).toContain('Refusing split identity authority');
-      expect(output).not.toContain('Running setup wizard');
-      expect(existsSync(fixture.capturePath)).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-    },
-  );
-
-  it.each([' unattended-seat', 'unattended-seat ', ''])(
-    'refuses non-exact ambient fleet name %j before seeding',
-    (agentName: string) => {
-      const fixture = createGreenfieldFixture();
-
-      const result = launchSync(fixture, { agentName });
-      const output = outputOf(result);
-
-      expect(result.status, output).toBe(1);
-      expect(output).toContain(
-        'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
-      );
-      expect(output).not.toContain('Running setup wizard');
-      expect(existsSync(fixture.capturePath)).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-      expect(existsSync(join(fixture.mosaicHome, 'USER.md'))).toBe(false);
-    },
-  );
-
-  it('keeps the interactive wizard path for a standalone launch', () => {
-    const fixture = createGreenfieldFixture();
-
-    const result = launchSync(fixture, { fleet: false });
-    const output = outputOf(result);
-
-    expect(result.status, output).toBe(1);
-    expect(output).toContain('[mosaic] SOUL.md not found. Running setup wizard...');
-    expect(output).toContain('What would you like to do?');
-    expect(output).toContain('[mosaic] Setup failed. Run: mosaic wizard');
-    expect(existsSync(fixture.capturePath)).toBe(false);
-    expect(existsSync(join(fixture.mosaicHome, 'SOUL.md'))).toBe(false);
-  });
-
-  it('allows concurrent no-TTY seats to initialize the same defaults without clobber or residue', async () => {
-    const fixture = createGreenfieldFixture();
-    const captures = Array.from({ length: 4 }, (_, index) =>
-      join(fixture.root, `runtime-boundary-${index.toString()}.json`),
-    );
-
-    const results = await Promise.all(
-      captures.map(
-        async (capturePath): Promise<AsyncLaunchResult> => launchAsync(fixture, capturePath),
-      ),
-    );
-
-    for (const result of results) {
-      expect(result.status, outputOf(result)).toBe(0);
-      expect(result.signal, outputOf(result)).toBeNull();
-      expect(outputOf(result)).not.toContain('Running setup wizard');
-    }
-    assertPrivateDefaultSeeds(fixture);
-    expect(captures.every((capturePath) => existsSync(capturePath))).toBe(true);
-    expect(
-      readdirSync(fixture.mosaicHome).filter((entry) => entry.includes('.fleet-seed-')),
-    ).toEqual([]);
-  });
-});

packages/mosaic/src/commands/launch.ts

@@ -30,10 +30,6 @@ import { readRegularFileSecure } from '../fleet/secure-file.js';
 import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 import { canonicalizeRoleClass } from './fleet-personas.js';
 import { launchClaudex, type ClaudexHarnessAdapter } from './claudex.js';
-import {
-  readInstalledIdentityContractAtPointOfUse,
-  seedFleetIdentityDefaults,
-} from './fleet-first-start-identity.js';
 import { runLeaseEnforcementDoctorCheck } from './lease-doctor-check.js';
 
 const MOSAIC_HOME = process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
@@ -234,55 +230,8 @@ function checkRuntime(cmd: string): void {
   }
 }
 
-function assertAmbientFleetClassMatches(canonicalName: string, canonicalClass: string): void {
-  const configuredClass = process.env['MOSAIC_AGENT_CLASS'];
-  if (configuredClass === undefined) return;
-
-  const ambientClass = canonicalizeRoleClass(configuredClass).canonicalClass;
-  if (ambientClass !== canonicalClass) {
-    throw new Error(
-      `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalName}" resolves to "${canonicalClass}". Refusing split identity authority.`,
-    );
-  }
-}
-
 function checkSoul(): void {
   const soulPath = join(MOSAIC_HOME, 'SOUL.md');
-  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
-  if (fleetAgentName !== undefined) {
-    try {
-      if (fleetAgentName.length === 0 || fleetAgentName !== fleetAgentName.trim()) {
-        throw new Error(
-          'MOSAIC_AGENT_NAME must be a non-empty exact roster name with no surrounding whitespace',
-        );
-      }
-      const fleetIdentity = resolveFleetIdentity(MOSAIC_HOME, fleetAgentName);
-      if (!fleetIdentity.ok || !fleetIdentity.identity) {
-        throw new Error(
-          `canonical fleet identity is unavailable: ${fleetIdentity.error ?? 'exact roster member was not resolved'}`,
-        );
-      }
-      assertAmbientFleetClassMatches(
-        fleetIdentity.identity.member.name,
-        fleetIdentity.identity.member.className,
-      );
-      const seeded = seedFleetIdentityDefaults(MOSAIC_HOME);
-      if (seeded.length > 0) {
-        console.log(
-          `[mosaic] Initialized unattended fleet identity defaults: ${seeded.join(', ')}. Exact seat identity remains roster-owned.`,
-        );
-      }
-      return;
-    } catch (error: unknown) {
-      const reason = error instanceof Error ? error.message : String(error);
-      console.error(`[mosaic] ERROR: unattended fleet identity initialization failed: ${reason}`);
-      console.error(
-        '[mosaic] Repair the named fleet roster, launch identity, installed contract, or shipped default, then retry.',
-      );
-      process.exit(1);
-    }
-  }
-
   if (!existsSync(soulPath)) {
     console.log('[mosaic] SOUL.md not found. Running setup wizard...');
 
@@ -583,27 +532,26 @@ For required push/merge/issue-close/release actions, execute without routine con
   parts.push(readFileSync(join(mosaicHome, 'AGENTS.md'), 'utf-8'));
 
   // USER.md (+ USER.local.md operator overlay, appended directly under the
-  // profile its base owns). Fleet first start is Linux/systemd-owned and uses
+  // profile its base owns).
-  // the no-follow reader at point of use. Standalone launches retain the
+  const user = readOptional(join(mosaicHome, 'USER.md'));
-  // portable tolerant path used on macOS and other supported hosts.
-  const fleetAgentName = process.env['MOSAIC_AGENT_NAME'];
-  const user =
-    fleetAgentName === undefined
-      ? readOptional(join(mosaicHome, 'USER.md'))
-      : readInstalledIdentityContractAtPointOfUse(mosaicHome, 'USER.md').toString('utf8');
   if (user) parts.push('\n\n# User Profile\n\n' + user);
   const userLocal = readOptional(join(mosaicHome, 'USER.local.md'));
   if (userLocal.trim()) {
     parts.push('\n\n## Operator Overlay (USER.local.md)\n\n' + userLocal);
   }
 
-  const fleetIdentity = resolveFleetIdentity(mosaicHome, fleetAgentName);
+  const fleetIdentity = resolveFleetIdentity(mosaicHome, process.env['MOSAIC_AGENT_NAME']);
   if (!fleetIdentity.ok) {
     throw new Error(`Fleet communications contract unavailable: ${fleetIdentity.error}`);
   }
   const canonicalMember = fleetIdentity.identity?.member;
-  if (canonicalMember) {
+  if (canonicalMember && process.env['MOSAIC_AGENT_CLASS']?.trim()) {
-    assertAmbientFleetClassMatches(canonicalMember.name, canonicalMember.className);
+    const ambientClass = canonicalizeRoleClass(process.env['MOSAIC_AGENT_CLASS']).canonicalClass;
+    if (ambientClass !== canonicalMember.className) {
+      throw new Error(
+        `Ambient MOSAIC_AGENT_CLASS resolves to "${ambientClass}" but canonical roster member "${canonicalMember.name}" resolves to "${canonicalMember.className}". Refusing split identity authority.`,
+      );
+    }
   }
 
   // TOOLS.md

packages/mosaic/src/commands/lease-activation-probe.spec.ts

@@ -7,13 +7,11 @@ import { fileURLToPath } from 'node:url';
 import {
   LEASE_ACTIVATION_CAPABILITY,
   LEASE_CAPABILITY_PROBE_COMMAND,
-  LEASE_CAPABILITY_PROBE_TIMEOUT_MS,
   defaultCapabilityProbe,
   defaultResolveCliEntry,
   defaultSupervisorProbe,
   leaseEnforcementActivatable,
   registerLeaseCapabilityProbe,
-  type CapabilityProbeExecFile,
   type LeaseActivationCapability,
   type SupervisorProbeResult,
 } from './lease-activation-probe.js';
@@ -37,17 +35,6 @@ const presentSupervisor: SupervisorProbeResult = {
   socketPath: '/run/user/1000/mosaic-lease/broker.sock',
 };
 
-function withScratchCli<T>(run: (cliPath: string) => T): T {
-  const scratchDir = mkdtempSync(join(tmpdir(), 'mosaic-lease-capability-probe-'));
-  try {
-    const cliPath = join(scratchDir, 'cli.js');
-    writeFileSync(cliPath, '// isolated fake; injected execFile means this is never executed\n');
-    return run(cliPath);
-  } finally {
-    rmSync(scratchDir, { recursive: true, force: true });
-  }
-}
-
 describe('leaseEnforcementActivatable', () => {
   it('is false when the activation capability is absent (null)', () => {
     const result = leaseEnforcementActivatable({
@@ -113,6 +100,15 @@ describe('leaseEnforcementActivatable', () => {
     });
     expect(result).toBe(true);
   });
+
+  it('uses the real default probes when no deps are injected (does not throw)', () => {
+    // No live broker / built CLI is guaranteed in a test environment, so this
+    // only asserts the predicate degrades to a safe boolean rather than
+    // throwing — the fail-closed behavior itself is covered by the injected
+    // cases above.
+    expect(() => leaseEnforcementActivatable()).not.toThrow();
+    expect(typeof leaseEnforcementActivatable()).toBe('boolean');
+  });
 });
 
 describe('defaultCapabilityProbe', () => {
@@ -131,61 +127,6 @@ describe('defaultCapabilityProbe', () => {
     expect(result).toBeNull();
   });
 
-  it('passes the exact ten-second timeout to the injected child-process transport', () => {
-    withScratchCli((cliPath) => {
-      let captured:
-        | {
-            file: string;
-            args: string[];
-            options: Parameters<CapabilityProbeExecFile>[2];
-          }
-        | undefined;
-      const execFile: CapabilityProbeExecFile = (file, args, options) => {
-        captured = { file, args, options };
-        return JSON.stringify(LEASE_ACTIVATION_CAPABILITY);
-      };
-
-      const result = defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile });
-
-      expect(result).toEqual(LEASE_ACTIVATION_CAPABILITY);
-      expect(captured).toEqual({
-        file: process.execPath,
-        args: [cliPath, LEASE_CAPABILITY_PROBE_COMMAND],
-        options: {
-          encoding: 'utf-8',
-          timeout: 10_000,
-          stdio: ['ignore', 'pipe', 'ignore'],
-        },
-      });
-      expect(captured?.options.timeout).toBe(LEASE_CAPABILITY_PROBE_TIMEOUT_MS);
-    });
-  });
-
-  it.each([
-    ['timeout', Object.assign(new Error('timed out'), { code: 'ETIMEDOUT' })],
-    ['spawn error', Object.assign(new Error('spawn failed'), { code: 'ENOENT' })],
-    ['nonzero exit', Object.assign(new Error('child exited 1'), { status: 1 })],
-  ])('returns null (fail-closed) on child-process %s', (_failure, error) => {
-    withScratchCli((cliPath) => {
-      const execFile: CapabilityProbeExecFile = () => {
-        throw error;
-      };
-
-      expect(defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile })).toBeNull();
-    });
-  });
-
-  it.each([
-    ['unparseable JSON', 'not-json'],
-    ['malformed object', JSON.stringify({ name: LEASE_ACTIVATION_CAPABILITY.name })],
-  ])('returns null (fail-closed) on %s output', (_failure, output) => {
-    withScratchCli((cliPath) => {
-      const execFile: CapabilityProbeExecFile = () => output;
-
-      expect(defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile })).toBeNull();
-    });
-  });
-
   describe('positive path — injected resolver, isolated scratch dir (never the real dist/)', () => {
     // A prior version of this test staged the stub cli.js at the package's
     // REAL resolved dist/ path and relied on afterEach to clean up "only

packages/mosaic/src/commands/lease-activation-probe.ts

@@ -55,19 +55,6 @@ export const LEASE_ACTIVATION_CAPABILITY: LeaseActivationCapability = {
 /** Hidden CLI probe subcommand name — wired via {@link registerLeaseCapabilityProbe}. */
 export const LEASE_CAPABILITY_PROBE_COMMAND = '__lease-capability';
 
-/**
- * Budget for the out-of-process capability probe. The probe launches a fresh
- * Node process on the built CLI entrypoint, whose cold start alone measures
- * 2.2-2.3s on a mid-range workstation (sb-it-1-dt, 2026-08-13) — so the
- * previous 2s budget made the probe time out and report NO capability on
- * such hosts, failing every launch with the #869 skew message even though
- * the capability matched. The timeout only bounds the pathological hang
- * case; the happy path returns as soon as the probe exits. Mirrors
- * PROBE_TIMEOUT_SECONDS in the enforcement half
- * (framework/tools/lease-broker/activation_version_gate.py).
- */
-export const LEASE_CAPABILITY_PROBE_TIMEOUT_MS = 10_000;
-
 function capabilityMatches(candidate: LeaseActivationCapability | null): boolean {
   return (
     candidate !== null &&
@@ -123,28 +110,12 @@ export function defaultResolveCliEntry(
   return join(dirname(mainEntry), 'cli.js');
 }
 
-/** Narrow injectable seam for the synchronous child process used by the
- * capability probe. */
-export type CapabilityProbeExecFile = (
-  file: string,
-  args: string[],
-  options: {
-    encoding: BufferEncoding;
-    timeout: number;
-    stdio: ['ignore', 'pipe', 'ignore'];
-  },
-) => string;
-
 /** Injectable inputs for {@link defaultCapabilityProbe}. */
 export interface CapabilityProbeDeps {
   /** Resolve the CLI entrypoint (`cli.js`) to probe. Defaults to
    * {@link defaultResolveCliEntry}. Inject to point at an isolated scratch
    * location in tests — never at the real package's `dist/`. */
   resolveCliEntry?: () => string;
-  /** Execute the resolved CLI entrypoint. Defaults to the real
-   * `execFileSync`. Inject so transport behavior and options can be tested
-   * without spawning a process. */
-  execFile?: CapabilityProbeExecFile;
 }
 
 /**
@@ -168,10 +139,9 @@ export function defaultCapabilityProbe(
     const cliEntry = resolveCliEntry();
     if (!existsSync(cliEntry)) return null;
 
-    const execFile: CapabilityProbeExecFile = deps.execFile ?? execFileSync;
+    const output = execFileSync(process.execPath, [cliEntry, LEASE_CAPABILITY_PROBE_COMMAND], {
-    const output = execFile(process.execPath, [cliEntry, LEASE_CAPABILITY_PROBE_COMMAND], {
       encoding: 'utf-8',
-      timeout: LEASE_CAPABILITY_PROBE_TIMEOUT_MS,
+      timeout: 2000,
       stdio: ['ignore', 'pipe', 'ignore'],
     });
 

packages/mosaic/src/mutator-gate/version_coupling_unittest.py

@@ -24,15 +24,11 @@ from __future__ import annotations
 
 import importlib.util
 import io
-import os
-import shlex
 import subprocess
 import sys
-import tempfile
 import unittest
 from contextlib import redirect_stderr
 from pathlib import Path
-from unittest import mock
 
 
 TOOLS_DIR = Path(__file__).parents[2] / "framework/tools/lease-broker"
@@ -61,20 +57,6 @@ def matching_capability() -> dict[str, object]:
     return dict(VERSION_GATE.EXPECTED_ACTIVATION_CAPABILITY)
 
 
-def write_fake_mosaic(directory: Path, marker: Path) -> Path:
-    directory.mkdir(parents=True, exist_ok=True)
-    executable = directory / "mosaic"
-    executable.write_text(
-        "#!/bin/sh\n"
-        f"printf '%s\\n' executed >> {shlex.quote(str(marker))}\n"
-        "printf '%s\\n' "
-        "'{\"name\":\"lease-runtime-activation\",\"version\":1}'\n",
-        encoding="utf-8",
-    )
-    executable.chmod(0o755)
-    return executable
-
-
 class AssertActivationCapabilityMatchesTest(unittest.TestCase):
     """Unit-level coverage of `activation_version_gate.py`'s own assertion,
     isolated from the launch-runtime.py seam it is wired into below."""
@@ -128,102 +110,11 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
     handling — never spawns a real `mosaic` process."""
 
     def test_returns_none_when_mosaic_is_not_resolvable_on_path(self) -> None:
-        # Keep even a deliberate ambient-lookup mutation away from any host
+        result = VERSION_GATE.default_probe_activation_capability(
-        # installation. The dedicated hermeticity tests below provide fake
+            {"PATH": "/nonexistent-bin-dir-for-869-c4-test"}
-        # ambient executables and markers.
+        )
-        with mock.patch.dict(
-            os.environ, {"PATH": "/nonexistent-ambient-bin-dir-for-869-c4-test"}
-        ):
-            result = VERSION_GATE.default_probe_activation_capability(
-                {"PATH": "/nonexistent-bin-dir-for-869-c4-test"}
-            )
         self.assertIsNone(result)
 
-    def test_supplied_path_wins_over_ambient_process_path(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            supplied_marker = root / "supplied.marker"
-            ambient_marker = root / "ambient.marker"
-            supplied_bin = root / "supplied-bin"
-            ambient_bin = root / "ambient-bin"
-            write_fake_mosaic(supplied_bin, supplied_marker)
-            write_fake_mosaic(ambient_bin, ambient_marker)
-
-            with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {"PATH": str(supplied_bin)}
-                )
-
-            self.assertEqual(result, matching_capability())
-            self.assertTrue(supplied_marker.exists())
-            self.assertFalse(ambient_marker.exists())
-
-    def test_absent_or_empty_supplied_path_never_falls_back_or_executes(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            ambient_marker = root / "ambient.marker"
-            current_directory_marker = root / "current-directory.marker"
-            ambient_bin = root / "ambient-bin"
-            current_directory = root / "current-directory"
-            write_fake_mosaic(ambient_bin, ambient_marker)
-            write_fake_mosaic(current_directory, current_directory_marker)
-            original_directory = Path.cwd()
-
-            try:
-                os.chdir(current_directory)
-                with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                    for supplied_environment in ({}, {"PATH": ""}):
-                        with self.subTest(environ=supplied_environment):
-                            result = VERSION_GATE.default_probe_activation_capability(
-                                supplied_environment
-                            )
-                            self.assertIsNone(result)
-                            self.assertFalse(ambient_marker.exists())
-                            self.assertFalse(current_directory_marker.exists())
-            finally:
-                os.chdir(original_directory)
-
-    def test_valid_override_wins_and_invalid_override_does_not_fall_back_to_path(
-        self,
-    ) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            supplied_marker = root / "supplied.marker"
-            ambient_marker = root / "ambient.marker"
-            override_marker = root / "override.marker"
-            supplied_bin = root / "supplied-bin"
-            ambient_bin = root / "ambient-bin"
-            override_bin = root / "override-bin"
-            write_fake_mosaic(supplied_bin, supplied_marker)
-            write_fake_mosaic(ambient_bin, ambient_marker)
-            override_executable = write_fake_mosaic(override_bin, override_marker)
-
-            with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {
-                        "PATH": str(supplied_bin),
-                        VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: str(override_executable),
-                    }
-                )
-                self.assertEqual(result, matching_capability())
-                self.assertTrue(override_marker.exists())
-                self.assertFalse(supplied_marker.exists())
-                self.assertFalse(ambient_marker.exists())
-
-                override_marker.unlink()
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {
-                        "PATH": str(supplied_bin),
-                        VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: str(
-                            root / "invalid-override" / "mosaic"
-                        ),
-                    }
-                )
-                self.assertIsNone(result)
-                self.assertFalse(override_marker.exists())
-                self.assertFalse(supplied_marker.exists())
-                self.assertFalse(ambient_marker.exists())
-
     def test_override_command_is_parsed_and_the_probe_subcommand_is_not_double_appended(
         self,
     ) -> None:
@@ -244,29 +135,6 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
         self.assertEqual(result, {"name": "lease-runtime-activation", "version": 1})
         self.assertEqual(captured, [["/fake/mosaic", "__lease-capability"]])
 
-    def test_probe_passes_ten_second_timeout_to_runner(self) -> None:
-        captured_argv: list[str] = []
-        captured_kwargs: dict[str, object] = {}
-
-        class FakeCompleted:
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation", "version": 1}'
-
-        def fake_run(argv: list[str], **kwargs: object) -> FakeCompleted:
-            captured_argv.extend(argv)
-            captured_kwargs.update(kwargs)
-            return FakeCompleted()
-
-        result = VERSION_GATE.default_probe_activation_capability(
-            {VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: "/fake/mosaic"},
-            run=fake_run,
-        )
-
-        self.assertEqual(result, matching_capability())
-        self.assertEqual(captured_argv, ["/fake/mosaic"])
-        self.assertEqual(captured_kwargs["timeout"], 10.0)
-        self.assertEqual(captured_kwargs["check"], False)
-
     def test_fails_closed_on_nonzero_exit_malformed_json_and_missing_fields(self) -> None:
         class NonZeroExit:
             returncode = 1
@@ -306,7 +174,7 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
 
     def test_fails_closed_on_timeout_and_transport_error(self) -> None:
         def timeout_run(*_args: object, **_kwargs: object) -> None:
-            raise subprocess.TimeoutExpired(cmd="mosaic", timeout=10.0)
+            raise subprocess.TimeoutExpired(cmd="mosaic", timeout=2.0)
 
         def oserror_run(*_args: object, **_kwargs: object) -> None:
             raise OSError("no such file or directory")

packages/mosaic/src/platform/detect.ts

@@ -1,3 +1,4 @@
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';
 
@@ -21,18 +22,15 @@ export function getShellProfilePath(): string | null {
 
   const shell = detectShell();
   switch (shell) {
-    // Both of these deliberately avoid the interactive-only rc files.
-    // Debian's default .bashrc returns early for non-interactive shells, so a
-    // PATH line appended to it never runs for `bash -lc`, systemd units, or
-    // agent seats — an install could report success and still leave `mosaic`
-    // unreachable. .profile is read by login shells and sources .bashrc for
-    // interactive ones, so one line covers both; .zshenv is zsh's equivalent.
     case 'zsh': {
       const zdotdir = process.env['ZDOTDIR'] ?? home;
-      return join(zdotdir, '.zshenv');
+      return join(zdotdir, '.zshrc');
     }
-    case 'bash':
+    case 'bash': {
+      const bashrc = join(home, '.bashrc');
+      if (existsSync(bashrc)) return bashrc;
       return join(home, '.profile');
+    }
     case 'fish':
       return join(home, '.config', 'fish', 'config.fish');
     default:

tools/install.sh

@@ -309,124 +309,6 @@ require_cmd() {
   fi
 }
 
-# True if any shell rc file already puts $1 on PATH.
-#
-# Each file is tested for existence first and grepped one at a time, rather than
-# handed to a single `grep -qs ... "${rc_files[@]}"`. Handing grep a missing file
-# makes the exit status implementation-defined: GNU grep 3.11 returns 0 when -q
-# matched an earlier file, ugrep 7.5 returns 2 for the missing one regardless.
-# On the 2 path the caller reads "not present yet" and appends a duplicate PATH
-# line on every single install.
-path_entry_exists() {
-  local dir="$1" rc_file
-  for rc_file in "$HOME/.profile" "$HOME/.zshenv" "$HOME/.zshrc" "$HOME/.bashrc"; do
-    if [[ -f "$rc_file" ]] && grep -qF "$dir" "$rc_file"; then
-      return 0
-    fi
-  done
-  return 1
-}
-
-# Append `export PATH="$1:$PATH"` to the shell profile so $1 survives this
-# process. An `export` here reaches only the installer; every directory the
-# install leaves behind has to be written down somewhere a later shell reads.
-#
-# Deliberately NOT ~/.bashrc: Debian's default .bashrc returns early for
-# non-interactive shells, so a PATH line appended to the bottom of it is
-# unreachable to `bash -lc`, to systemd units, and to every agent seat — the
-# exact consumers that need these binaries. ~/.profile is read by login shells
-# and Debian's .profile sources .bashrc for interactive ones, so a single line
-# there reaches both. For zsh the always-sourced file is .zshenv, not .zshrc.
-#
-# $1 = directory to add, $2 = label for the comment line.
-# Returns 1 (having warned) if the profile could not be written.
-persist_on_path() {
-  local dir="$1" label="$2" profile
-
-  if path_entry_exists "$dir"; then
-    return 0
-  fi
-
-  if [[ -n "${ZSH_VERSION:-}" ]] || [[ "$(basename "${SHELL:-}")" == "zsh" ]]; then
-    profile="$HOME/.zshenv"
-  else
-    profile="$HOME/.profile"
-  fi
-
-  # Probe writability in a subshell. A redirection failure on a special built-in
-  # aborts the shell it runs in, so it has to be a child; and the redirection on
-  # the subshell is what silences the "Permission denied" the shell would
-  # otherwise print ahead of our own message.
-  if ! ( : >>"$profile" ) 2>/dev/null; then
-    warn "$dir is not on your PATH and $profile could not be written"
-    dim "  Add to your shell rc:  export PATH=\"$dir:\$PATH\""
-    return 1
-  fi
-
-  {
-    echo ""
-    echo "# $label"
-    echo "export PATH=\"$dir:\$PATH\""
-  } >>"$profile"
-  ok "Added $dir to PATH in $profile"
-  return 0
-}
-
-# Persist $PREFIX/bin on PATH instead of only warning about it.
-#
-# The warning it replaces was the last step of an otherwise successful install,
-# so the installer reported success and left `mosaic: command not found` — an
-# unattended install had no operator to read the advice and act on it.
-ensure_prefix_on_path() {
-  if [[ ":$PATH:" == *":$PREFIX/bin:"* ]]; then
-    return
-  fi
-
-  if path_entry_exists "$PREFIX/bin"; then
-    warn "$PREFIX/bin is in your shell profile but not in this shell"
-  elif ! persist_on_path "$PREFIX/bin" "Mosaic CLI"; then
-    return
-  fi
-  dim "  Run:  export PATH=\"$PREFIX/bin:\$PATH\"   (or start a new login shell)"
-}
-
-# Fleet transport binary (#1240).
-#
-# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
-# roster the CLI scaffolds sets `transport: tmux`, but nothing in this script
-# provides tmux and, until now, nothing in it mentioned tmux at all. A
-# greenfield host came out of this installer able to install a fleet, start a
-# fleet, and run no seat — the operator's first signal was `mosaic fleet ps`.
-#
-# Not a `require_cmd`: tmux is required by the fleet, not by mosaic. Plenty of
-# hosts install this to run `mosaic claude` and will never scaffold a roster,
-# and failing their install over a binary they do not need would be wrong. It
-# is a warning that names precisely what it blocks.
-#
-# `tools/_scripts/mosaic-doctor` carries a deliberately parallel check, so the
-# same host state gets the same answer from an audit as from an install. They
-# are separate implementations because this one has to work before the
-# framework's scripts are guaranteed to be on disk; keep their wording in step.
-check_fleet_transport() {
-  local transport=tmux
-  local roster="$MOSAIC_HOME/fleet/roster.yaml"
-  local declared=""
-
-  if [[ -f "$roster" ]]; then
-    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
-      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
-    [[ -n "$declared" ]] && transport="$declared"
-  fi
-
-  command -v "$transport" &>/dev/null && return 0
-
-  warn "Fleet transport '$transport' is not installed."
-  echo "  The Mosaic fleet runs its agent seats inside $transport. Without it,"
-  echo "  ${C}mosaic fleet start${RESET} reports success and no seat comes up."
-  echo "  Install it before using the fleet, e.g. ${C}sudo apt-get install -y $transport${RESET}"
-  echo "  (this does not affect ${C}mosaic claude${RESET} or the other single-runtime commands)."
-}
-
 installed_cli_version() {
   local json
   json="$(npm ls -g --depth=0 --json --prefix="$PREFIX" 2>/dev/null)" || true
@@ -634,175 +516,8 @@ install_next_cli_from_registry() {
   ok "Installed @next packages: CLI ${installed_cli}, gateway ${installed_gateway}"
 }
 
-# ─── node bootstrap ───────────────────────────────────────────────────────────
-#
-# Nothing on a greenfield host installs Node.js, yet this installer and the CLI
-# it installs both hard-require it. Measured on a clean Debian 13 image: the
-# installer stopped at `require_cmd node` with "Required command not found" and
-# nothing was installed, with no hint of how to proceed.
-#
-# Inlined rather than factored into a sibling file on purpose: this script is
-# fetched standalone by curl and has nothing to source.
-#
-# No-op when a suitable node is already on PATH, so it never fights an
-# operator's nvm/fnm/distro node.
-
-NODE_ROOT="${MOSAIC_NODE_ROOT:-$HOME/.mosaic/node}"
-NODE_BOOTSTRAP_VERSION="${MOSAIC_NODE_VERSION:-v22.23.2}"
-NODE_MIN_MAJOR="${MOSAIC_NODE_MIN_MAJOR:-20}"
-NODE_DIST_BASE="${MOSAIC_NODE_DIST_BASE:-https://nodejs.org/dist}"
-
-# Major version of the node at $1, or empty if it will not run.
-node_major_of() {
-  local candidate="$1" version
-  version="$("$candidate" -e 'process.stdout.write(process.versions.node)' 2>/dev/null)" || return 0
-  printf '%s' "${version%%.*}"
-}
-
-node_is_suitable() {
-  local major
-  major="$(node_major_of "$1")"
-  [[ -n "$major" ]] && [[ "$major" -ge "$NODE_MIN_MAJOR" ]]
-}
-
-install_node() {
-  local node_os node_arch tarball release_url work_dir extracted target node_bin
-
-  case "$(uname -s)" in
-    Linux)  node_os="linux" ;;
-    Darwin) node_os="darwin" ;;
-    *) fail "Unsupported OS '$(uname -s)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
-  esac
-
-  # Linux here means glibc. Node's official linux-x64 build is dynamically
-  # linked against glibc, so on musl (Alpine) the binary will not exec — but it
-  # fails visibly: node_is_suitable rejects it and ensure_node exits with
-  # "install Node.js manually". No silent breakage, just a wasted download.
-  # A musl host needs the unofficial build, which is out of scope here.
-  case "$(uname -m)" in
-    x86_64|amd64)  node_arch="x64" ;;
-    aarch64|arm64) node_arch="arm64" ;;
-    armv7l)        node_arch="armv7l" ;;
-    *) fail "Unsupported architecture '$(uname -m)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
-  esac
-
-  # .tar.gz rather than the smaller .tar.xz: gzip is universally present, xz is
-  # not, and a minimal image is exactly the case this exists to handle.
-  tarball="node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}.tar.gz"
-  release_url="${NODE_DIST_BASE}/${NODE_BOOTSTRAP_VERSION}"
-
-  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-node-XXXXXX")"
-
-  info "Installing Node.js $NODE_BOOTSTRAP_VERSION ($node_os-$node_arch) to $NODE_ROOT…"
-
-  if ! curl -fsSL "${release_url}/${tarball}" -o "$work_dir/$tarball"; then
-    fail "Download failed: ${release_url}/${tarball}"
-    rm -rf "$work_dir"; return 1
-  fi
-
-  # Trust assumption, stated so nobody has to infer it: this verifies INTEGRITY
-  # (the tarball matches the manifest), not AUTHENTICITY (the manifest is
-  # genuinely Node's). The only thing establishing that is TLS to
-  # $NODE_DIST_BASE. Node publishes SHASUMS256.txt.sig signed by its release
-  # keys and we do not check it, which is on par with nvm but means pointing
-  # MOSAIC_NODE_DIST_BASE at an untrusted mirror has no signature backstop.
-  # Tracked as a hardening follow-up (raised by scooby in the #1229 review).
-  if ! curl -fsSL "${release_url}/SHASUMS256.txt" -o "$work_dir/SHASUMS256.txt"; then
-    fail "Could not fetch SHASUMS256.txt; refusing to install an unverified runtime."
-    rm -rf "$work_dir"; return 1
-  fi
-
-  # Keep only our artifact's line, so a missing entry is an error not a pass.
-  if ! grep " ${tarball}\$" "$work_dir/SHASUMS256.txt" >"$work_dir/expected.sha256"; then
-    fail "$tarball has no entry in SHASUMS256.txt; refusing to install."
-    rm -rf "$work_dir"; return 1
-  fi
-
-  if ! (cd "$work_dir" && verify_sha256 expected.sha256); then
-    fail "Checksum mismatch for $tarball; refusing to install."
-    rm -rf "$work_dir"; return 1
-  fi
-  ok "Checksum verified"
-
-  tar xzf "$work_dir/$tarball" -C "$work_dir"
-  extracted="$work_dir/node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}"
-  if [[ ! -x "$extracted/bin/node" ]]; then
-    fail "Extracted archive has no bin/node"
-    rm -rf "$work_dir"; return 1
-  fi
-
-  mkdir -p "$NODE_ROOT"
-  target="$NODE_ROOT/$NODE_BOOTSTRAP_VERSION"
-  rm -rf "$target.incoming"
-  mv "$extracted" "$target.incoming"
-  rm -rf "$target"
-  mv "$target.incoming" "$target"
-  ln -sfn "$NODE_BOOTSTRAP_VERSION" "$NODE_ROOT/current"
-  rm -rf "$work_dir"
-
-  node_bin="$NODE_ROOT/current/bin"
-  if ! node_is_suitable "$node_bin/node"; then
-    fail "Installed node at $node_bin/node did not run"
-    return 1
-  fi
-
-  export PATH="$node_bin:$PATH"
-  ok "Node.js $(node -v) installed with npm $(npm -v 2>/dev/null || echo '?')"
-  return 0
-}
-
-# Make the Mosaic-managed Node reachable from the next shell as well as this
-# one. Measured on a greenfield canary run: without this the install finished
-# rc=0, wrote $PREFIX/bin to ~/.profile, and the next login shell found `mosaic`
-# and then died on `env: 'node': No such file or directory` — the CLI is a Node
-# script, so a CLI on PATH without its runtime is a successful install that
-# produces a broken command.
-persist_node_on_path() {
-  persist_on_path "$NODE_ROOT/current/bin" "Mosaic-managed Node.js" || true
-}
-
-ensure_node() {
-  if command -v node &>/dev/null && node_is_suitable node; then
-    return 0
-  fi
-
-  # A previous run may have installed one that is not on this shell's PATH.
-  if node_is_suitable "$NODE_ROOT/current/bin/node"; then
-    export PATH="$NODE_ROOT/current/bin:$PATH"
-    persist_node_on_path
-    return 0
-  fi
-
-  if [[ "${MOSAIC_SKIP_NODE_BOOTSTRAP:-0}" == "1" ]]; then
-    fail "No suitable Node.js and MOSAIC_SKIP_NODE_BOOTSTRAP=1; refusing to download."
-    echo "  Install Node.js >= $NODE_MIN_MAJOR yourself, then re-run this script."
-    exit 1
-  fi
-
-  require_cmd curl
-  require_cmd tar
-
-  # sha256sum on Linux, shasum on macOS. Verification is not optional: without a
-  # checksum this would install an unauthenticated runtime.
-  if command -v sha256sum &>/dev/null; then
-    verify_sha256() { sha256sum -c --status "$1"; }
-  elif command -v shasum &>/dev/null; then
-    verify_sha256() { shasum -a 256 -c --status "$1"; }
-  else
-    fail "sha256sum or shasum required to verify the Node.js download"
-    exit 1
-  fi
-
-  if ! install_node; then
-    fail "Could not bootstrap Node.js. Install Node.js >= $NODE_MIN_MAJOR and re-run."
-    exit 1
-  fi
-  persist_node_on_path
-}
-
 # ─── preflight ────────────────────────────────────────────────────────────────
 
-ensure_node
 require_cmd node
 require_cmd npm
 
@@ -967,7 +682,11 @@ if [[ "$FLAG_CLI" == "true" ]]; then
     ensure_monorepo
     install_cli_from_source
 
-    ensure_prefix_on_path
+    # PATH check for npm prefix
+    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
+      warn "$PREFIX/bin is not on your PATH"
+      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
+    fi
   elif is_next_registry_lane; then
     info "Next mode — trying fast npm @next install from ${REGISTRY}…"
     if install_next_cli_from_registry; then
@@ -980,7 +699,11 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       export MOSAIC_GATEWAY_SKIP_NPM_INSTALL=1
     fi
 
-    ensure_prefix_on_path
+    # PATH check for npm prefix
+    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
+      warn "$PREFIX/bin is not on your PATH"
+      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
+    fi
   else
     if [[ -z "$LATEST" ]]; then
       warn "Could not reach registry at $REGISTRY — skipping npm CLI."
@@ -998,7 +721,11 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       ok "CLI is at or ahead of registry ($CURRENT ≥ $LATEST)."
     fi
 
-    ensure_prefix_on_path
+    # PATH check for npm prefix
+    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
+      warn "$PREFIX/bin is not on your PATH"
+      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
+    fi
   fi
 fi
 
@@ -1143,11 +870,6 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
   ok "Done."
 fi
 
-# Fleet readiness (#1240). Runs in both normal and --check mode: "what is the
-# state of this host" is exactly the question --check is asked, and a host that
-# cannot run a seat should not have to discover it from `fleet ps`.
-check_fleet_transport
-
 } # end main
 
 main "$@"