test(#1338): amend runtime_tools pins that encoded the D29 defect semantics

Two assertions in packages/mosaic/src/mutator-gate/runtime_tools_unittest.py
pinned the behaviour D29 identifies as the defect: an envless revoke-lease.py
returning rc=2. They are changed here under the test-is-the-defect exemption,
stated on the record rather than made quietly. One new assertion is added to
cover what the relaxation must NOT reach.

Why the reclassification is justified. Not because the old pin was careless: it
was deliberate entrypoint doctrine, born in e4d7d45 (WI-3, #842) alongside the
tool itself, and its twin pins the identical property for mutator-gate. Two
measurements beat the doctrine.

  1. Unsatisfiable precondition. The doctrine's only reachable firing point
     cannot be reached by the live fleet. Seats launch with zero MOSAIC_LEASE_*
     (measured, pane pid 8596; 19 of 19 live panes, see #1340), the framework
     ships no provisioning path for fleet launches, and the deployed extension
     does not enforce the total gate, since live seats use tools daily.

  2. Gate-enforced redundancy. For the one case the doctrine protects, a leased
     session whose identity env is stripped: the strip must occur in the
     extension host's own env to reach the observer, at which point the gate
     also loses identity and denies GATE_UNAVAILABLE rc=2 on every tool call
     (measured). The stripped session may compact but cannot mutate. Pre-fix it
     merely died at compaction instead. No mutation path opens either way.

The no-ungated-mutation property lives in the gate, not the revoker. That is
why the revoker moves and the gate does not.

Changes:

1. test_revoker_entrypoint_denies_when_identity_environment_is_absent becomes
   test_revoker_entrypoint_noops_when_identity_environment_is_absent and asserts
   rc=0. The stem is kept so history greps still find it.

2. NEW: test_revoker_entrypoint_denies_when_identity_environment_is_half_provisioned
   asserts rc=2 for socket-only and session-only environments. The no-op is
   reachable only on TOTAL absence; half-provisioned is a machinery-present
   failure and must still fail closed. main() already pinned this, but the
   entrypoint did not, and the entrypoint is what the runtime extension spawns.

3. In test_revoker_fails_closed_on_identity_reply_and_transport_errors, ONLY the
   ({}, ...) element leaves the cases list. The five machinery-present cases
   (malformed session id, ok:false, state:VERIFIED, OSError, JSONDecodeError)
   stay fail-closed and are untouched.

4. test_gate_entrypoint_denies_when_identity_environment_is_absent is left
   UNCHANGED, with a comment recording why. Relaxing it the same way would be a
   real downgrade. The revoker/gate asymmetry is intentional and must not be
   "fixed" later.

Controls run, all three directions, none assumed:

  - Fix plus amendments: 26/26 OK, rc=0.
  - revoke-lease.py alone reverted to origin/next, amendments kept:
    FAILED (failures=1), rc=1. The amended entrypoint assertion still bites.
  - Guard weakened to `len(present) < 2` so half-provisioned falls through to
    the no-op: FAILED (failures=1), rc=1. The new assertion bites.

Required by two independent re-verdicts, both REQUEST_CHANGES on head 9fed3838,
both of which superseded their own earlier APPROVE after CI surfaced the pinned
contract: rev-security-01 review id 242, rev-security-02 review id 243. Each was
asked to refute the reclassification before accepting it and each attempted it
in writing. Item 2 above is rev-security-02's requirement and was not in the
first re-verdict. Both re-affirm the guard's own semantics as correct; what was
missing was the second half of a deliberate contract change.

Refs #1338, #1340

.woodpecker/ci.yml

@@ -91,15 +91,6 @@ steps:
       # and sandboxes a throwaway git repo, so it resolves no real credentials and
       # joins CI directly rather than the exclusions file.
       - bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh
-      # Hermetic regression for the git identity ladder (#1356): mock tea on PATH,
-      # sandboxed repo, no real credentials (3/3 green under an empty HOME). Pins
-      # fail-closed: a seat whose login is missing gets a named error, never a
-      # borrowed identity. Joins CI directly; its #1007 exclusion is burned down.
-      - bash packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh
-      # Hermetic regression for issue-view.sh (#1357): mock tea/curl, sandboxed
-      # repo. Pins that comment BODIES render on both paths and that a tea
-      # failure is named as what it was (git-config vs credential).
-      - bash packages/mosaic/framework/tools/git/test-issue-view-comments.sh
       # Hermetic behavioural regression for the PreToolUse wrapper guard: proves
       # it still blocks the three mistakes AND still lets reads, unwrapped
       # endpoints and ordinary commands through. Both directions are asserted —

docs/ADMIN-GUIDE/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Administrator Guide
 
 > **Status:** Partially migrated. Current SSO and local upgrade/recovery procedures are available; held procedures are labeled non-operative.

docs/ADMIN-GUIDE/operations/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Administrator Operations
 
 > **Status:** Partially migrated. Procedures explicitly identify whether they are current or held.

docs/ADMIN-GUIDE/operations/mos-connector-lease-operations.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Mos Connector Lease Operations — M1
 
 > **Status:** Held / non-operative.

docs/ADMIN-GUIDE/operations/upgrade-safety-and-recovery.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Upgrade safety and recovery
 
 > **Supported route:** an already installed `mosaic` CLI using the local PGlite

docs/ADMIN-GUIDE/security/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Security
 
 > **Status:** Partially migrated. The SSO provider and Discord ingress security pages are current.

docs/ADMIN-GUIDE/security/discord-ingress.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Discord ingress security
 
 > **Status:** Current Discord behavior only. Telegram shared-contract parity, Matrix channel ingress, and a gateway-wide shared adapter registry are not implemented or are not proven by the current source/tests.

docs/ADMIN-GUIDE/security/sso-providers.md

@@ -1,8 +1,8 @@
 ---
-kind: guide
-status: active
 title: SSO Providers
+type: runbook
 audience: admin
+status: current
 source_of_truth: false
 ---
 

docs/API/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # API Documentation
 
 > **Status:** Scaffold only. The canonical gateway contract has not yet been migrated into this directory.

docs/DEVELOPER-GUIDE/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Developer Guide
 
 > **Status:** Partially migrated. Architecture, lease-broker verification, and channel-adapter authoring pages are current; other contributor chapters remain unmigrated.

docs/DEVELOPER-GUIDE/architecture/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Architecture
 
 > **Status:** Partially migrated. The lease-broker security-contract pages below are current references; the remaining architecture pages are still being classified.

docs/DEVELOPER-GUIDE/architecture/channel-protocol.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Channel protocol architecture
 
 > **Status:** Current shared type contract and Discord compatibility baseline. The shared gateway registry, Telegram parity, Matrix integration, identity-linking, and multi-surface multiplexing described below are draft or unimplemented.

docs/DEVELOPER-GUIDE/architecture/compaction-revocation.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Compaction observer revocation and runtime generations
 
 > **Status:** Current contract reference.

docs/DEVELOPER-GUIDE/architecture/decisions/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Architecture Decisions
 
 > **Status:** Current decision index. A decision describes an implemented and accepted boundary; draft proposals belong under `rfcs/` or `docs/plans/`.

docs/DEVELOPER-GUIDE/architecture/decisions/mos-runtime-portability-m1.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Mos Runtime Portability M1 — Logical Identity and Fencing
 
 > **Decision status:** Current implemented decision (M1).

docs/DEVELOPER-GUIDE/architecture/lease-broker-protocol.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Authenticated external lease broker protocol
 
 > **Status:** Current contract reference.

docs/DEVELOPER-GUIDE/architecture/lease-broker-security.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # WI-1 lease broker security notes
 
 > **Status:** Current contract reference.

docs/DEVELOPER-GUIDE/architecture/mutator-class-gate.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Whole mutator-class lease gate
 
 > **Status:** Current contract reference.

docs/DEVELOPER-GUIDE/architecture/rfcs/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Architecture RFCs
 
 > **Status:** Current proposal index. RFCs are draft design material and have no operational or implementation authority until an approved decision and implementation evidence supersede them.

docs/DEVELOPER-GUIDE/architecture/rfcs/optional-ai-egress-gateways.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: active
----
-
 # RFC: Optional AI Egress Gateways
 
 > **Status:** Draft / proposed — not approved, not current, and not integrated.

docs/DEVELOPER-GUIDE/integrations/channel-adapters.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Channel adapters
 
 > **Status:** Current shared channel types plus the Discord reference/compatibility implementation. A shared gateway adapter registry, Telegram parity, and Matrix channel integration remain unimplemented or unproven.

docs/DEVELOPER-GUIDE/testing/lease-broker-operations.md

@@ -1,8 +1,8 @@
 ---
-kind: guide
-status: active
 title: Lease-broker operations
+type: runbook
 audience: developer
+status: current
 source_of_truth: false
 ---
 

docs/MISSION-MANIFEST.md

@@ -1,8 +1,3 @@
----
-kind: tracking
-status: active
----
-
 # Mission Manifest — MVP
 
 > Top-level rollup tracking Mosaic Stack MVP execution.

docs/PRD.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: active
----
-
 # PRD: Mosaic Stack v0.1.0
 
 ## Current addendum: #1194 — Installed framework-tool drift detection

docs/README.md

@@ -1,9 +1,3 @@
----
-kind: spec
-source_of_truth: true
-status: active
----
-
 # Mosaic Stack Documentation
 
 This directory is the canonical home for Mosaic Stack product, architecture, API, operations, and delivery documentation.
@@ -152,51 +146,21 @@ Every canonical page should:
 7. Include an owner or maintenance responsibility for operationally sensitive content.
 8. Link to the relevant book index and related canonical pages.
 
-Required front matter for every canonical page:
+Recommended front matter for canonical pages:
 
 ```yaml
 ---
-kind: tracking | projection | spec | guide | record | superseded
-status: active # or: completed | superseded-by: <path>
-source_of_truth: false # optional, defaults false
-audience: developer # optional: user | admin | developer | all
-title: Human-readable page title # optional
+title: Human-readable page title
+type: guide
+audience: developer
+status: current
+source_of_truth: false
 ---
 ```
 
-`kind` says what the document **is**. One value, required, and it follows the document's content,
-never its filename: a file named `TASKS.md` whose body says "this is a build plan, not a task
-tracker" is a `spec`.
+Allowed `type` values include `guide`, `concept`, `reference`, `decision`, `rfc`, and `runbook`. Allowed `audience` values are `user`, `admin`, `developer`, and `all`. Allowed `status` values are `current`, `draft`, `deprecated`, and `historical`.
 
-| kind       | rule                                                             |
-| ---------- | ---------------------------------------------------------------- |
-| tracking   | Live state, single-writer. Never a spec                          |
-| projection | Generated. Never hand-edited. MUST have a drift test             |
-| spec       | How to build one goal or workstream                              |
-| guide      | Explains use. Decides nothing                                    |
-| record     | What happened. Never authoritative, never updated after the fact |
-| superseded | Kept for history, and NAMES its replacement                      |
-
-`source_of_truth` is a separate boolean because authority is **orthogonal to kind**. A document can
-be a `spec` and still be the thing everything else answers to;
-`docs/requirements/native-kanban-sot.md` is exactly that. Folding authority into `kind` forced one
-field to carry two independent facts, which is why an earlier draft of this contract could not
-classify that file at all.
-
-`status` has three values. `active` means in force. `completed` means the work the document
-describes landed and the document is now finished rather than stale; executed implementation plans
-take this. `superseded-by: <path>` replaces `status` entirely and names the replacement.
-
-**This contract covers `.md` files only.** It is not an omission: a YAML document cannot carry YAML
-front matter. The repository's own `[email protected]` throws `Source contains multiple documents` on a
-front-mattered `.yaml`, and `parseNorthStar` (`packages/mosaic/src/commands/fleet.ts:242`) is a live
-consumer that would break. `.yaml` sources declare their own kind inside the document or not at all.
-
-A `parent` field is planned and is deliberately not yet required; it lands once the docs flatten
-settles the paths it would point at.
-
-Indexes may omit front matter when their purpose is self-evident. A page with normative authority
-must explicitly identify the authority it owns and the boundaries of that authority.
+Indexes may omit front matter when their purpose is self-evident. A page with normative authority must explicitly identify the authority it owns and the boundaries of that authority.
 
 ## Obsidian and link conventions
 

docs/TASKS.md

@@ -1,19 +1,5 @@
 # Tasks — MVP (Top-Level Rollup)
 
-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Single-writer: orchestrator only. Workers read but never modify.
 >
 > **Mission:** mvp-20260312
@@ -122,7 +108,7 @@ Active workstream is **W1 — Federation v1**. Workers should:
 
 ## north-star doctrine consolidation — doc PR — feat/north-star-doctrine
 
-- Status: applied Mos's consolidated merge-map to docs/fleet/FLEET-DOCTRINE.md (budget governance + control plane/central register + 200k cap + delegation + unified-identity Fleet + role-based naming + tmux security + drift re-captures). Doctrine only; #622/#623/#625/#628 out-of-scope. Conflict checklist green. Detail: scratchpads/north-star-doctrine.md.
+- Status: applied Mos's consolidated merge-map to docs/fleet/north-star.md (budget governance + control plane/central register + 200k cap + delegation + unified-identity Fleet + role-based naming + tmux security + drift re-captures). Doctrine only; #622/#623/#625/#628 out-of-scope. Conflict checklist green. Detail: scratchpads/north-star-doctrine.md.
 
 ## #631 — re-seed preserves user fleet data (CRITICAL) — fix/631-reseed-preserves-fleet-data
 

docs/USER-GUIDE/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # User Guide
 
 > **Status:** Partially migrated. The quickstart, web-dashboard reference, and Discord conversation workflow are current.

docs/USER-GUIDE/getting-started/quickstart.md

@@ -1,8 +1,8 @@
 ---
-kind: guide
-status: active
 title: Mosaic Stack Quickstart
+type: guide
 audience: user
+status: current
 source_of_truth: false
 ---
 

docs/USER-GUIDE/product/web-dashboard.md

@@ -1,8 +1,8 @@
 ---
-kind: guide
-status: active
 title: Mosaic web dashboard
+type: guide
 audience: user
+status: current
 source_of_truth: false
 ---
 

docs/USER-GUIDE/workflows/discord-conversations.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Discord conversations
 
 > **Status:** Current Discord workflow for an administrator-provisioned, authorized guild channel.

docs/federation/MISSION-MANIFEST.md

@@ -1,8 +1,3 @@
----
-kind: tracking
-status: active
----
-
 # Mission Manifest — Federation v1
 
 > Persistent document tracking full mission scope, status, and session history.

docs/federation/TASKS.md

@@ -1,21 +1,5 @@
 # Tasks — Federation v1
 
-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago. `FED-M3-06` is marked not-started and `get.controller.ts`
-> has existed for eight weeks; `FED-M3-10/11` claim no tests exist while fifteen spec files
-> do. `FED-M2-DEPLOY-IMG-FIX` names `apps/gateway/Dockerfile`, which is not in the repo.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Single-writer: orchestrator only. Workers read but never modify.
 >
 > **Mission:** federation-v1-20260419

docs/fleet/NORTH_STAR.md

@@ -3,7 +3,7 @@
 > **Generated file — do not edit by hand.**
 > Projected deterministically from [`NORTH_STAR.yaml`](./NORTH_STAR.yaml) by the pure
 > generator in `packages/mosaic/src/commands/fleet.ts` (`renderNorthStarMarkdown`).
-> Edit the YAML, then regenerate. Self-contained Mosaic.
+> Edit the YAML, then regenerate. Self-contained Mosaic — no Hermes dependency.
 
 ## Mission
 
@@ -11,7 +11,7 @@ A self-driving Mosaic system that 24/7 unattended converts a machine-readable go
 
 ## Substrate
 
-The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's native Postgres storage service (@mosaicstack/db drizzle; PGlite-embedded by default, full Postgres by config).
+The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's native Postgres storage service (@mosaicstack/db drizzle; PGlite-embedded by default, full Postgres by config). NOT Hermes.
 
 ## Standing objectives
 
@@ -24,18 +24,16 @@ The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's
 - **NS-7** — Meta-loop (session-review + enhancer) continuously proposes small fleet-improvement PRs.
 - **NS-8** — Single operator-flippable PAUSE kill-switch (fleet/run/PAUSED) honored before every dispatch and every merge.
 - **NS-9** — Mosaic is a general-purpose multi-agent system: the user declares the SYSTEM TYPE to run (e.g. software delivery, personal assistant, research, business/operations) and the orchestrator provisions the matching persona roster and org structure from a cross-domain baseline persona library; the delivery/coding fleet is one profile among many.
-- **NS-10** — An adoption is not complete until the mechanism it replaces is removed. Two live conventions for one concern is the defect, not a transition state. Measured 2026-08-20: brain-home adopted by 9 modules and not 10; MOSAIC_HOME honored in 4 places, each re-deriving it; backlog cards declared while TASKS.md files stayed authoritative. Every one was decided correctly and left half-applied.
 
 ## Success criteria
 
-- **AC-NS-0** (tier 0) — The operator launches an agent on any configured harness with one command, observes its state and sends it work without attaching to a terminal multiplexer.
-- **AC-NS-1** (tier 1) — The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer) healthy across reboot.
-- **AC-NS-2** (tier 1) — A goal added to this YAML is decomposed to cards and either merged or escalated, with no human in the loop.
-- **AC-NS-3** (tier 1) — No PR merges with failure/error/no-status/timeout CI, and none bypass pr-merge.sh.
-- **AC-NS-4** (tier 1) — TTL is enforced on claims; token caps remain advisory until a real meter exists.
-- **AC-NS-5** (tier 1) — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
-- **AC-NS-6** (tier 2) — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
-- **AC-NS-7** (tier 2) — A user-customized persona (edited or added via the orchestrator) survives mosaic update: baseline reseed never clobbers user overrides.
+- **AC-NS-1** — The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer) healthy across reboot.
+- **AC-NS-2** — A goal added to this YAML is decomposed to cards and either merged or escalated, with no human in the loop.
+- **AC-NS-3** — No PR merges with failure/error/no-status/timeout CI, and none bypass pr-merge.sh.
+- **AC-NS-4** — TTL is enforced on claims; token caps remain advisory until a real meter exists.
+- **AC-NS-5** — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
+- **AC-NS-6** — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
+- **AC-NS-7** — A user-customized persona (edited or added via the orchestrator) survives mosaic update: baseline reseed never clobbers user overrides.
 
 ## Workstreams
 
@@ -47,44 +45,26 @@ The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's
 | D   | Merge-gate — single approver, pr-merge.sh after CI wait                                                     |
 | E   | Meta-loop — session-review + enhancer improvement PRs                                                       |
 | F   | Safety-rails — TTL claims, advisory spend, PAUSE kill-switch                                                |
-| G   | Kill-switch — operator PAUSE honored before dispatch and merge                                              |
 | H   | Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization |
-| I   | Operator surface — launcher, fleet visibility, reliable steering (tier 0)                                   |
-| J   | Web control plane — browser surface over the gateway (tier 1)                                               |
-| K   | Clients — desktop and mobile over the same backend (tier 2)                                                 |
-| L   | Auth profiles — per-provider accounts, per-session selection (tier 2)                                       |
 
 ## Goals (backlog projection)
 
-| id  | title                                                                                                                                                                                                                                                                                                                                                                              | tier | phase | priority    | depends_on     |
-| --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ----- | ----------- | -------------- |
-| A1  | Machine-readable NORTH_STAR.yaml + Markdown projection                                                                                                                                                                                                                                                                                                                             | 1    | 1     | must-have   | —              |
-| A2  | Mosaic Backlog schema + storage-service card store (drizzle/PGlite)                                                                                                                                                                                                                                                                                                                | 1    | 1     | must-have   | A1             |
-| A3a | Card lifecycle — create/claim/release with stable ids + depends_on DAG                                                                                                                                                                                                                                                                                                             | 1    | 1     | must-have   | A2             |
-| A3b | TTL-bounded claim enforcement (wall-clock) on cards                                                                                                                                                                                                                                                                                                                                | 1    | 1     | must-have   | A3a            |
-| A4  | Advisory spend projection per card (degrades to TTL, no real meter)                                                                                                                                                                                                                                                                                                                | 1    | 1     | should-have | A3a            |
-| B1  | Supervisor tick — readiness scan, two-agent-floor health check                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A3a            |
-| B2  | Native dispatch/claim — assign ready dependency-satisfied work                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A3b, B1        |
-| B3a | Planner decompose — goal added to YAML → cards                                                                                                                                                                                                                                                                                                                                     | 1    | 2     | must-have   | A2, B1         |
-| B3b | Replan request on empty backlog; escalate on no-decompose                                                                                                                                                                                                                                                                                                                          | 1    | 2     | should-have | B3a            |
-| G1  | PAUSE kill-switch + merge-gate honored before dispatch and merge                                                                                                                                                                                                                                                                                                                   | 1    | 2     | must-have   | B2             |
-| H1  | Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)                                                                                                                                                                                                                                                                              | 2    | 1     | must-have   | A1             |
-| H2  | System-type profiles — declarative mapping of system type to persona roster + topology                                                                                                                                                                                                                                                                                             | 2    | 2     | must-have   | H1             |
-| H3  | System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure                                                                                                                                                                                                                                                                           | 2    | 2     | must-have   | H2             |
-| H4  | Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides)                                                                                                                                                                                                                                  | 2    | 2     | must-have   | H1             |
-| A5  | NORTH_STAR schema validator — every goal's workstream declared, every workstream has a goal, every depends_on id exists, every tier has a success criterion; runs in CI beside the Markdown regeneration check                                                                                                                                                                     | 0    | 1     | must-have   | A1             |
-| I1  | One home resolver — a single function resolving MOSAIC_HOME with a sane default, adopted by every module. Today brain-home.ts is imported by 9 modules while 10 still use DEFAULT_MOSAIC_HOME, and MOSAIC_HOME is re-derived ad hoc in 4 places. NS-10 applies - finish the adoption and delete the second path                                                                    | 0    | 1     | must-have   | —              |
-| I2  | mosaic fleet ps sees the fleet that is actually running. Three measured blockers: the roster declares socket `mosaic-fleet` which does not exist, the 18 live sessions are on the default socket, and nothing writes a roster because seats are launched outside the CLI. Make the socket configurable and the roster written at launch, or make ps read tmux + seat dirs directly | 0    | 1     | must-have   | I1             |
-| I3  | Migrate fleet steering onto mosaic agent send --verify (exists, FLEET-OBS-005, spec FR-5) and retire tools/tmux/agent-send.sh, which forges the sender (D33) and returns an uninformative rc (D16, D34). FR-5 predates those defects by a month                                                                                                                                    | 0    | 1     | must-have   | I1             |
-| I4  | mosaic fleet absorbs what launch-seat.sh does and launch-seat.sh is deprecated: compose the prompt file set, force the skill set, wire the style hook, fail closed on any unreadable input, export per-seat git identity, and register the seat in the roster. launch-seat.sh was a manual method; it is the reference implementation, not the destination                         | 0    | 1     | must-have   | I1, I5         |
-| I5  | Harness probe matrix — verify a working prompt-injection path for claude, codex, opencode and pi, and refuse any runtime whose path is unverified. AC-NS-0 clause 1 ("any configured harness") rests on this. The probe work in docs/plans/2026-08-19_launch-seat-multi-runtime.md (brain, untracked) transfers; its launch-seat.sh target does not                                | 0    | 1     | must-have   | —              |
-| I6  | Finish the heartbeat responder (FLEET-OBS-002, the only Phase-2 task still in-progress; spec FR-2). Health must mean "answered a heartbeat", not "pane alive" — pane state measured two seats wrong on 2026-08-20                                                                                                                                                                  | 0    | 1     | must-have   | —              |
-| I7  | Independent review and live-fleet dogfood of the Phase-2 verbs (FLEET-OBS-008), then land them (FLEET-OBS-009). Implementation is done and verification is not; "done" in a task file frozen five weeks is not evidence                                                                                                                                                            | 0    | 1     | must-have   | I2, I3, I4, I6 |
-| I8  | Neutralize misleading documentation — supersede headers on docs that state a stale status, a false blocker or a retired mechanism. Cheap, and it is tier 0 because a stale doc does not merely fail to help an agent, it actively misroutes one. Rebuilding the documentation is a separate and later job                                                                          | 0    | 1     | must-have   | —              |
-| I9  | Study t3code's agent-attach and multi-provider auth methods and record what transfers. Reference only — Mosaic implements its own within the stack, never adopts the code and never takes the dependency. Informs HOW I/J/K/L are built, not whether                                                                                                                               | 0    | 1     | should-have | —              |
-| J1  | Web control plane over the gateway — fleet visibility and steering in a browser, same data source as I2                                                                                                                                                                                                                                                                            | 1    | 3     | must-have   | I2             |
-| K1  | Desktop and mobile clients against the gateway, authenticated                                                                                                                                                                                                                                                                                                                      | 2    | 4     | must-have   | J1             |
-| L1  | Per-provider auth profiles with per-session selection                                                                                                                                                                                                                                                                                                                              | 2    | 4     | must-have   | I4             |
+| id  | title                                                                                                                                             | phase | priority    | depends_on |
+| --- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------- | ---------- |
+| A1  | Machine-readable NORTH_STAR.yaml + Markdown projection                                                                                            | 1     | must-have   | —          |
+| A2  | Mosaic Backlog schema + storage-service card store (drizzle/PGlite)                                                                               | 1     | must-have   | A1         |
+| A3a | Card lifecycle — create/claim/release with stable ids + depends_on DAG                                                                            | 1     | must-have   | A2         |
+| A3b | TTL-bounded claim enforcement (wall-clock) on cards                                                                                               | 1     | must-have   | A3a        |
+| A4  | Advisory spend projection per card (degrades to TTL, no real meter)                                                                               | 1     | should-have | A3a        |
+| B1  | Supervisor tick — readiness scan, two-agent-floor health check                                                                                    | 2     | must-have   | A3a        |
+| B2  | Native dispatch/claim — assign ready dependency-satisfied work                                                                                    | 2     | must-have   | A3b, B1    |
+| B3a | Planner decompose — goal added to YAML → cards                                                                                                    | 2     | must-have   | A2, B1     |
+| B3b | Replan request on empty backlog; escalate on no-decompose                                                                                         | 2     | should-have | B3a        |
+| G1  | PAUSE kill-switch + merge-gate honored before dispatch and merge                                                                                  | 2     | must-have   | B2         |
+| H1  | Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)                                             | 1     | must-have   | A1         |
+| H2  | System-type profiles — declarative mapping of system type to persona roster + topology                                                            | 2     | must-have   | H1         |
+| H3  | System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure                                          | 2     | must-have   | H2         |
+| H4  | Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides) | 2     | must-have   | H1         |
 
 ## Assumptions (vetoable)
 

docs/fleet/NORTH_STAR.yaml

@@ -6,7 +6,7 @@
 # packages/mosaic/src/commands/fleet.ts (renderNorthStarMarkdown). Edit the YAML,
 # never the .md.
 #
-# Self-contained Mosaic. The backlog of record is
+# Self-contained Mosaic. NO Hermes runtime dependency. The backlog of record is
 # the Mosaic Backlog on Mosaic's OWN native Postgres storage service.
 
 version: 1
@@ -24,7 +24,7 @@ substrate:
   note: >-
     The Mosaic Backlog is the backlog of record + dispatch engine, built on
     Mosaic's native Postgres storage service (@mosaicstack/db drizzle;
-    PGlite-embedded by default, full Postgres by config).
+    PGlite-embedded by default, full Postgres by config). NOT Hermes.
 
 standing_objectives:
   - id: NS-1
@@ -69,53 +69,32 @@ standing_objectives:
       business/operations) and the orchestrator provisions the matching persona
       roster and org structure from a cross-domain baseline persona library; the
       delivery/coding fleet is one profile among many.
-  - id: NS-10
-    text: >-
-      An adoption is not complete until the mechanism it replaces is removed.
-      Two live conventions for one concern is the defect, not a transition
-      state. Measured 2026-08-20: brain-home adopted by 9 modules and not 10;
-      MOSAIC_HOME honored in 4 places, each re-deriving it; backlog cards
-      declared while TASKS.md files stayed authoritative. Every one was decided
-      correctly and left half-applied.
 
 success_criteria:
-  - id: AC-NS-0
-    tier: 0
-    text: >-
-      The operator launches an agent on any configured harness with one
-      command, observes its state and sends it work without attaching to a
-      terminal multiplexer.
   - id: AC-NS-1
-    tier: 1
     text: >-
       The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer)
       healthy across reboot.
   - id: AC-NS-2
-    tier: 1
     text: >-
       A goal added to this YAML is decomposed to cards and either merged or
       escalated, with no human in the loop.
   - id: AC-NS-3
-    tier: 1
     text: >-
       No PR merges with failure/error/no-status/timeout CI, and none bypass
       pr-merge.sh.
   - id: AC-NS-4
-    tier: 1
     text: >-
       TTL is enforced on claims; token caps remain advisory until a real meter
       exists.
   - id: AC-NS-5
-    tier: 1
     text: >-
       Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
   - id: AC-NS-6
-    tier: 2
     text: >-
       A user can declare a system type and the fleet provisions the matching
       persona roster + topology from the baseline library, with no code change.
   - id: AC-NS-7
-    tier: 2
     text: >-
       A user-customized persona (edited or added via the orchestrator) survives
       mosaic update: baseline reseed never clobbers user overrides.
@@ -133,186 +112,80 @@ workstreams:
     title: Meta-loop — session-review + enhancer improvement PRs
   - id: F
     title: Safety-rails — TTL claims, advisory spend, PAUSE kill-switch
-  - id: G
-    title: Kill-switch — operator PAUSE honored before dispatch and merge
   - id: H
     title: Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization
-  - id: I
-    title: Operator surface — launcher, fleet visibility, reliable steering (tier 0)
-  - id: J
-    title: Web control plane — browser surface over the gateway (tier 1)
-  - id: K
-    title: Clients — desktop and mobile over the same backend (tier 2)
-  - id: L
-    title: Auth profiles — per-provider accounts, per-session selection (tier 2)
-
-# NOTE: workstreams C, D, E and F are declared but currently project no goals.
-# That is planning debt, not an editing error: their goals have not been written
-# yet. The A5 validator below reports it rather than letting it stay invisible.
 
 goals:
   - id: A1
     title: Machine-readable NORTH_STAR.yaml + Markdown projection
     phase: 1
-    tier: 1
     priority: must-have
     depends_on: []
   - id: A2
     title: Mosaic Backlog schema + storage-service card store (drizzle/PGlite)
     phase: 1
-    tier: 1
     priority: must-have
     depends_on: [A1]
   - id: A3a
     title: Card lifecycle — create/claim/release with stable ids + depends_on DAG
     phase: 1
-    tier: 1
     priority: must-have
     depends_on: [A2]
   - id: A3b
     title: TTL-bounded claim enforcement (wall-clock) on cards
     phase: 1
-    tier: 1
     priority: must-have
     depends_on: [A3a]
   - id: A4
     title: Advisory spend projection per card (degrades to TTL, no real meter)
     phase: 1
-    tier: 1
     priority: should-have
     depends_on: [A3a]
   - id: B1
     title: Supervisor tick — readiness scan, two-agent-floor health check
     phase: 2
-    tier: 1
     priority: must-have
     depends_on: [A3a]
   - id: B2
     title: Native dispatch/claim — assign ready dependency-satisfied work
     phase: 2
-    tier: 1
     priority: must-have
     depends_on: [A3b, B1]
   - id: B3a
     title: Planner decompose — goal added to YAML → cards
     phase: 2
-    tier: 1
     priority: must-have
     depends_on: [A2, B1]
   - id: B3b
     title: Replan request on empty backlog; escalate on no-decompose
     phase: 2
-    tier: 1
     priority: should-have
     depends_on: [B3a]
   - id: G1
     title: PAUSE kill-switch + merge-gate honored before dispatch and merge
     phase: 2
-    tier: 1
     priority: must-have
     depends_on: [B2]
   - id: H1
     title: Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)
     phase: 1
-    tier: 2
     priority: must-have
     depends_on: [A1]
   - id: H2
     title: System-type profiles — declarative mapping of system type to persona roster + topology
     phase: 2
-    tier: 2
     priority: must-have
     depends_on: [H1]
   - id: H3
     title: System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure
     phase: 2
-    tier: 2
     priority: must-have
     depends_on: [H2]
   - id: H4
     title: Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides)
     phase: 2
-    tier: 2
     priority: must-have
     depends_on: [H1]
-  - id: A5
-    title: NORTH_STAR schema validator — every goal's workstream declared, every workstream has a goal, every depends_on id exists, every tier has a success criterion; runs in CI beside the Markdown regeneration check
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [A1]
-  - id: I1
-    title: One home resolver — a single function resolving MOSAIC_HOME with a sane default, adopted by every module. Today brain-home.ts is imported by 9 modules while 10 still use DEFAULT_MOSAIC_HOME, and MOSAIC_HOME is re-derived ad hoc in 4 places. NS-10 applies - finish the adoption and delete the second path
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I2
-    title: 'mosaic fleet ps sees the fleet that is actually running. Three measured blockers: the roster declares socket `mosaic-fleet` which does not exist, the 18 live sessions are on the default socket, and nothing writes a roster because seats are launched outside the CLI. Make the socket configurable and the roster written at launch, or make ps read tmux + seat dirs directly'
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1]
-  - id: I3
-    title: Migrate fleet steering onto mosaic agent send --verify (exists, FLEET-OBS-005, spec FR-5) and retire tools/tmux/agent-send.sh, which forges the sender (D33) and returns an uninformative rc (D16, D34). FR-5 predates those defects by a month
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1]
-  - id: I4
-    title: 'mosaic fleet absorbs what launch-seat.sh does and launch-seat.sh is deprecated: compose the prompt file set, force the skill set, wire the style hook, fail closed on any unreadable input, export per-seat git identity, and register the seat in the roster. launch-seat.sh was a manual method; it is the reference implementation, not the destination'
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I1, I5]
-  - id: I5
-    title: Harness probe matrix — verify a working prompt-injection path for claude, codex, opencode and pi, and refuse any runtime whose path is unverified. AC-NS-0 clause 1 ("any configured harness") rests on this. The probe work in docs/plans/2026-08-19_launch-seat-multi-runtime.md (brain, untracked) transfers; its launch-seat.sh target does not
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I6
-    title: Finish the heartbeat responder (FLEET-OBS-002, the only Phase-2 task still in-progress; spec FR-2). Health must mean "answered a heartbeat", not "pane alive" — pane state measured two seats wrong on 2026-08-20
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I7
-    title: Independent review and live-fleet dogfood of the Phase-2 verbs (FLEET-OBS-008), then land them (FLEET-OBS-009). Implementation is done and verification is not; "done" in a task file frozen five weeks is not evidence
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: [I2, I3, I4, I6]
-  - id: I8
-    title: Neutralize misleading documentation — supersede headers on docs that state a stale status, a false blocker or a retired mechanism. Cheap, and it is tier 0 because a stale doc does not merely fail to help an agent, it actively misroutes one. Rebuilding the documentation is a separate and later job
-    phase: 1
-    tier: 0
-    priority: must-have
-    depends_on: []
-  - id: I9
-    title: Study t3code's agent-attach and multi-provider auth methods and record what transfers. Reference only — Mosaic implements its own within the stack, never adopts the code and never takes the dependency. Informs HOW I/J/K/L are built, not whether
-    phase: 1
-    tier: 0
-    priority: should-have
-    depends_on: []
-  - id: J1
-    title: Web control plane over the gateway — fleet visibility and steering in a browser, same data source as I2
-    phase: 3
-    tier: 1
-    priority: must-have
-    depends_on: [I2]
-  - id: K1
-    title: Desktop and mobile clients against the gateway, authenticated
-    phase: 4
-    tier: 2
-    priority: must-have
-    depends_on: [J1]
-  - id: L1
-    title: Per-provider auth profiles with per-session selection
-    phase: 4
-    tier: 2
-    priority: must-have
-    depends_on: [I4]
 
 assumptions:
   - id: ASM-1

docs/fleet/PRD-fleet-suite.md

@@ -1,12 +1,7 @@
----
-kind: spec
-status: active
----
-
 # PRD — Mosaic Fleet Suite (init, configure, operate)
 
 > **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312` · **Phase:** 3→4 productization
-> **North star:** [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
+> **North star:** [docs/fleet/north-star.md](./north-star.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
 > **Lead:** Jarvis @ `w-jarvis`. **Collaborator:** coder agent @ `dragon-lin` (jwoltje@10.1.10.37:coder0-0).
 > Owner of this file: Fleet workstream lead. Does not modify MVP single-writer control-plane files.
 

docs/fleet/PRD.md

@@ -1,12 +1,7 @@
----
-kind: spec
-status: active
----
-
 # PRD — Fleet Phase 2: Operator Observability
 
 > **Workstream:** W-FLEET under `mvp-20260312` · **Phase:** 2
-> **North star:** [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md)
+> **North star:** [docs/fleet/north-star.md](./north-star.md)
 > **Source umbrella PRD:** [docs/PRD.md](../PRD.md) (Mosaic Stack v0.1.0)
 > **Tracks task:** `fleet-observability-1` — restore operator observability into fleet agent sessions.
 

docs/fleet/TASKS.md

@@ -1,25 +1,10 @@
 # Tasks — W-FLEET (Fleet) Phase 2: Observability
 
-> ---
->
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
->
-> This file is the pre-backlog tracking mechanism. `NS-2` in the north star declares the
-> replacement: every backlog item is a Mosaic Backlog card projected from the YAML. That
-> model replaced this one and nobody retired the old file, so it kept reading as
-> authoritative while going stale.
->
-> **Do not trust a status in this file.** Verified 2026-08-20: it was already behind the
-> code when it froze five weeks ago. The `FLEET-OBS` series was the one thing worth salvaging and
-> is now carried as goals `I2`, `I3`, `I6` and `I7` at tier 0.
->
-> Kept as a record of what was believed. Do not update it; update the YAML.
-
 > Workstream task file for the Fleet. Single-writer: Fleet workstream lead (orchestrator).
 > Workers read but never modify. This is **not** the MVP rollup (`docs/TASKS.md`) — a
 > rollup row is proposed to the MVP orchestrator, not written here.
 >
-> Mission: `mvp-20260312` · PRD: [docs/fleet/PRD.md](./PRD.md) · North star: [docs/fleet/FLEET-DOCTRINE.md](./FLEET-DOCTRINE.md)
+> Mission: `mvp-20260312` · PRD: [docs/fleet/PRD.md](./PRD.md) · North star: [docs/fleet/north-star.md](./north-star.md)
 > Status: `not-started` | `in-progress` | `done` | `blocked` | `failed`
 
 | id            | status      | description                                                                                                      | depends_on            | agent       | pr  | notes                                                                                                                       |

docs/fleet/concepts/desired-vs-observed-state.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Desired, Derived, and Observed Fleet State
 
 ## One writable authority

docs/fleet/concepts/generated-env-launch-chain.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Generated Environment Launch Chain
 
 The launcher consumes validated data, not shell configuration.

docs/fleet/concepts/identity-class-runtime.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Identity, Class, and Runtime
 
 Each roster field has one job. Do not use names or model strings as authority shortcuts.

docs/fleet/concepts/role-authority-and-leases.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Role Authority and Leases
 
 Role content describes behavior; protected authority is immutable code metadata derived only from the canonical class.

docs/fleet/f4-matrix-connector.md

@@ -1,6 +1,6 @@
 # F4 — Orchestrator chat connector + Matrix (local homeserver)
 
-> **Issue:** #616 · **Doctrine:** `docs/fleet/FLEET-DOCTRINE.md` (#613) — orchestrator-chat-connector decision.
+> **Issue:** #616 · **Doctrine:** `docs/fleet/north-star.md` (#613) — orchestrator-chat-connector decision.
 > **Status:** Phase 1 (abstraction + scaffold) in this PR; Phase 2+ are follow-ups (below).
 
 ## Goal

docs/fleet/how-to/configure-tess-interaction.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Configure an Interaction Instance
 
 An interaction instance is a configurable local roster member with canonical class: interaction and matching tool_policy: interaction. “Tess” may be used as a display alias, but neither that alias nor the stable name is required or authority-bearing.

docs/fleet/how-to/configure-ultron-validator.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Configure a Validator Instance
 
 A validator instance is a configurable local roster member with canonical class: validator and matching tool_policy: validator. “Ultron” may be used as a display alias, but it is not a required identity, class alias, product name, or source of authority.

docs/fleet/how-to/create-update-delete-agent.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Create, Inspect, Update, and Delete a Local Fleet Agent
 
 Use the local roster-v2 control plane only. These commands change desired state and derived environment projections; they never start, stop, reconcile, inspect, or otherwise act on systemd, tmux, sessions, or runtimes.

docs/fleet/how-to/customize-roles.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Customize Fleet Roles
 
 Mosaic resolves persona contracts through two layers:

docs/fleet/how-to/start-stop-restart.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Safely Reconcile and Control a Local Fleet Agent
 
 Use the canonical local roster-v2 command surface:

docs/fleet/migration/example-profile-disposition.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Executable Fleet Example, Profile, and Service-Preset Dispositions
 
 **Issue:** #758 · **Card:** FCM-M1-003 · **Status:** M1 executable disposition evidence

docs/fleet/migration/legacy-class-aliases.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Legacy Fleet Class Aliases
 
 Fleet class compatibility is intentionally narrow. The shared resolver accepts exactly three legacy

docs/fleet/migration/v1-to-v2.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Previewing a Fleet Roster v1-to-v2 Migration
 
 **Issue:** #758 · **Card:** FCM-M4-001 · **Effect boundary:** preview only

docs/fleet/north-star.md

@@ -1,26 +1,9 @@
----
-kind: spec
-parent: docs/fleet/NORTH_STAR.yaml
-status: active
----
+# Mosaic Fleet — North Star
 
-# Mosaic Fleet — Doctrine
-
-> **This is the WHY. `NORTH_STAR.yaml` is the WHAT and WHEN.**
-> Renamed from `north-star.md` on 2026-08-20. It sat one character away from the
-> generated `NORTH_STAR.md` in the same directory, and the two are read by different
-> populations — the PRDs and TASKS files cite this one, while the agent role contracts
-> and the generator spec cite the YAML pair. Same-name-different-thing was the confusion;
-> the content was never in conflict.
->
-> **Nothing here overrides `NORTH_STAR.yaml`.** Where this document states a plan item,
-> the YAML is authoritative. Where it states a decision, a rationale, or a role
-> definition, this document is the record and the YAML carries none of it.
->
 > **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312`
-> **Umbrella:** [docs/MISSION-MANIFEST.md](../MISSION-MANIFEST.md)
-> **Authored:** 2026-06-20. Owner: Fleet workstream lead.
-> This document does **not** modify the MVP rollup.
+> **Umbrella:** [docs/MISSION-MANIFEST.md](../MISSION-MANIFEST.md) · [docs/PRD.md](../PRD.md) (Mosaic Stack v0.1.0)
+> **Status:** doctrine — authored 2026-06-20. Owner of this file: Fleet workstream lead.
+> This document does **not** modify the MVP rollup; a rollup row is proposed, not written here.
 
 ## Vision
 
@@ -281,17 +264,15 @@ Dedicated Postgres **instance** vs. dedicated **schema** in the existing instanc
 Recommendation: dedicated schema, existing instance (a migration file, not new infra);
 re-evaluate if isolation or write-volume demands it.
 
-## Phased roadmap — SUPERSEDED
+## Phased roadmap
 
-Superseded 2026-08-20 by [`NORTH_STAR.yaml`](./NORTH_STAR.yaml), whose `goals` carry both
-a `phase` (build order) and a `tier` (which promise the goal delivers). The five-phase
-table that stood here could not express those as separate axes, and its "Phase 2 —
-Observability ▶ now" row stayed unfalsified for two months because a phase has no exit
-test. Tiers do: see `AC-NS-0` through `AC-NS-7`.
-
-The phase-2 content itself is not lost — it is specified in
-[`PRD.md`](./PRD.md) (Fleet Phase 2: Operator Observability) and is now tracked as
-goals `I1`–`I5` at tier 0.
+| Phase                  | Outcome                                                                                                                                                                                                | Status  |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- |
+| 0–1                    | tmux PoC, hardening, published CLI v0.0.34 (#565–#568)                                                                                                                                                 | ✅ done |
+| **2 — Observability**  | fleet ps (host+tenant aware join), heartbeat protocol + dogfood stub answers it, agent watch (read-only), agent send --verify receipts                                                                 | ▶ now   |
+| 3 — Real runtimes      | claude/codex/pi/opencode answer heartbeat; **hybrid lifecycle** (core always-on: **orchestrator + enhancer**; ephemeral workers per lane)                                                              | planned |
+| 4 — Unified definition | one agent schema in gateway; mosaic agent --new → materialized per-tenant session; uid-tenant provisioning; **`fleet` schema migration + `forge-exec` TaskExecutor adapter (forge → `agent-send.sh`)** | planned |
+| 5 — Control plane      | federation-backed cross-host × cross-tenant fleet view; **webUI** (surface chosen then) for MVP-X1 parity; **central register live (spend ledger, docs-as-projections, multi-host Kanban)**            | planned |
 
 ## Decisions of record (2026-06-20, with Jason)
 

docs/fleet/operations/backup-restore.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Configuration Backup and Restore Boundary
 
 **Issue:** #758 · **Card:** FCM-M4-001

docs/fleet/operations/env-quarantine.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Environment Quarantine Operations
 
 Legacy <name>.env is input evidence, never current launch authority. Projection preparation classifies it deterministically:

docs/fleet/operations/reconcile-and-recover.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Reconcile and Recover a Local Fleet
 
 ## Safe sequence

docs/fleet/operations/systemd-tmux-troubleshooting.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Systemd and tmux Troubleshooting
 
 Start with read-only mosaic fleet status, `doctor`, and `verify`. Do not manually adopt, rename, terminate, or recreate sessions while ownership is ambiguous.

docs/fleet/operations/upgrade-assets.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Upgrade and Installed-Asset Drift
 
 Fleet source assets and installed assets can differ after an update, but FCM-M5-001 does not add a trustworthy source-versus-installed revision detector or refresh command. Do not infer freshness from checkout presence, timestamps, generated environment files, running sessions, or a ready migration preview.

docs/fleet/reference/agent-mutations.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Local Fleet Agent Mutations
 
 FCM-M2-002 provides local roster-v2 create, get, update, delete, and plan operations. They only change desired state and derived environment projections. They never start, stop, inspect, reconcile, or otherwise act on runtimes, systemd units, tmux sessions, or heartbeats.

docs/fleet/reference/cli.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Control-Plane CLI
 
 The local desired-state surface is mosaic fleet. It is distinct from the gateway-backed mosaic agent catalog and from legacy compatibility commands that act on roster v1.

docs/fleet/reference/generated-env-boundary.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Generated Environment Boundary
 
 **Card:** FCM-M2-001 · **Issue:** #758 · **Status:** merged contract

docs/fleet/reference/lifecycle-transitions.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Local Fleet Lifecycle Transitions
 
 Roster-v2 `lifecycle.enabled` and `lifecycle.desired_state` are the only persisted lifecycle authority. Systemd, tmux, generated environment, and heartbeat state are derived or observed.

docs/fleet/reference/role-classes.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Role Classes and Authority
 
 A fleet role class is a machine identity resolved from the persona library. Resolution uses the

docs/fleet/reference/roster-v2-fields.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Fleet Roster v2 Structural Contract
 
 **Status:** FCM-M1-001 local-tmux structural compiler contract. This document describes parsing,

docs/fleet/reference/status-and-drift.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Local Fleet Status and Drift
 
 mosaic fleet status [<name>], `verify`, and `doctor` are observational roster-v2 commands. They emit one JSON result and do not write projections, mutate desired state, operate lifecycle, or change tmux.

docs/guides/deployment.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Deployment Guide
 
 > **Status: non-operative for PostgreSQL, federated, and bare-metal production.** The checked-in

docs/guides/dev-guide.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Mosaic Stack — Developer Guide
 
 ## Table of Contents

docs/guides/fleet-local-canary.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Local Fleet Canary
 
 The local fleet canary runs a small tmux-backed Mosaic agent fleet on an

docs/guides/migrate-tier.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Migrating to the Federated Tier
 
 > **KBN-101-07 ownership:** This active documentation is a **non-operative KBN-101

docs/native-kanban-sot/MISSION-MANIFEST.md

@@ -1,8 +1,3 @@
----
-kind: tracking
-status: active
----
-
 # Mission Manifest — Mosaic Native Kanban and Canonical Task SOT P0–P3
 
 **Mission status:** CANON INDEPENDENTLY APPROVED; publication in progress under issue [#751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)

docs/native-kanban-sot/TASKS.md

@@ -1,24 +1,10 @@
----
-kind: spec
-status: active
----
-
 # Native Kanban/SOT P0–P3 — Dependency-Ordered Build Slices
 
 **Status:** CANON INDEPENDENTLY APPROVED; PUBLICATION IN PROGRESS
 **Tracking:** [Mosaic Stack issue #751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)
 **Execution:** USC web1 only; collision-free GPT coder2/3/4/5 lanes
 **Contract:** `SHARED-CONTRACT.md` + four `contracts/*.v1.ts` files
-
-> **HOLD LIFTED — 2026-08-20.** The stated condition ("no feature slice starts until the
-> canon PR is merged to `main` with terminal-green CI") was **met on 2026-07-14** by
-> `49e8a541` — _docs(#751): Publish native Kanban/SOT canon (#752)_ — which is on both
-> `main` and `next`, and `docs/requirements/native-kanban-sot.md` is present on `main`.
-> The line below was never updated, so for five weeks this file advertised a blocker that
-> did not exist. The status line above ("PUBLICATION IN PROGRESS") is stale for the same
-> reason. This file is a build plan, not a task tracker, and is NOT superseded.
-
-**Implementation hold (SATISFIED — see note above):** no feature slice starts until the canon PR is merged to `main` with terminal-green CI; after merge, each slice remains held until every declared KBN prerequisite is complete.
+**Implementation hold:** no feature slice starts until the canon PR is merged to `main` with terminal-green CI; after merge, each slice remains held until every declared KBN prerequisite is complete.
 
 > This publication file is not a runtime task authority. After cutover, repository `TASKS.md` is generated read-only and never imported.
 

docs/plans/2026-08-10-ci-queue-purpose-design.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: active
----
-
 # CI Queue Guard Purpose Semantics
 
 - **Issue:** #1146

docs/plans/2026-08-10-ci-queue-purpose-implementation.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: completed
----
-
 # CI Queue Guard Purpose Semantics Implementation Plan
 
 > **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

docs/plans/2026-08-10-docs-catalog-audit.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: active
----
-
 # Documentation Catalog and Truth Audit Plan
 
 **Task:** DOCS-IA-002

docs/plans/2026-08-10-docs-information-architecture-design.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: active
----
-
 # Documentation Information Architecture Design
 
 **Status:** Approved

docs/plans/2026-08-10-docs-structure-readme.md

@@ -1,8 +1,3 @@
----
-kind: spec
-status: completed
----
-
 # Documentation Structure README Implementation Plan
 
 > **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

docs/plans/2026-08-20_w4-document-contract-worklist.md

@@ -1,429 +0,0 @@
----
-kind: tracking
-status: active
----
-
-# W4 — document contract worklist
-
-Companion to `2026-08-20_stack-docs-flatten-and-alignment.md`. That document proposes the
-contract; this one records what was applied, what was held, and what still needs a decision.
-
-Measured on `origin/next` at `63069149`. Author: veronica. Review: fred (Gate-16, author is
-not reviewer), then a pi seat for the adversarial pass.
-
-## What "live" means here
-
-All `*.md` under `docs/`, minus `docs/archive/`, minus `docs/_old_structure/`. That is **127**
-files. The flatten plan says 130; the arithmetic does not close (318 total = 134 archive +
-57 `_old_structure` + 127 live, not 130).
-
-## Applied
-
-**These are the FIRST-PASS counts and they are superseded. The current tree is counted in
-"Verification arithmetic, re-closed" at the end of this document.** They are left standing rather
-than overwritten, for the same reason every other correction here is: a record of what a pass
-produced is worth more than a number silently updated to still look right.
-
-| bucket                      | count | note                                   |
-| --------------------------- | ----- | -------------------------------------- |
-| stamped `kind` + `status`   | 107   | this pass                              |
-| held, operator judgement    | 17    | section "Needs a decision" below       |
-| held, cites the moving path | 3     | the three `SUPERSEDED` TASKS.md stamps |
-| held, generated file        | 1     | `docs/fleet/NORTH_STAR.md`, see below  |
-
-128 live `.md` under `docs/`, which is the 127 baseline plus this document. 107 + 17 + 3 + 1 = 128.
-
-Kinds: 53 `guide`, 34 `record`, 13 `spec`, 7 `tracking`. Status: 105 `active`, 2 `completed`.
-
-After fred's Q1 ruling stamped `docs/README.md`, one file moved from the held bucket to the stamped
-one and nothing else changed: **108 stamped + 16 + 3 + 1 = 128**, kinds 54 `guide`, 34 `record`,
-13 `spec`, 7 `tracking`, status 106 `active`, 2 `completed`. Two files carry
-`source_of_truth: true`, `docs/README.md` and `docs/requirements/native-kanban-sot.md`.
-
-`parent` is **not** applied. It points at `docs/fleet/NORTH_STAR.yaml`, which the flatten moves
-to `docs/NORTH_STAR.yaml`. Stamping it now means re-pointing 127 files by hand later. It lands
-after the move, in one pass, with the post-move path.
-
-## Held: the three superseded stamps
-
-`docs/TASKS.md:5`, `docs/federation/TASKS.md:5`, and `docs/fleet/TASKS.md:5` each carry a W1
-stamp of the form:
-
-> **STATUS: SUPERSEDED — 2026-08-20.** kind `tracking` · superseded by `docs/fleet/NORTH_STAR.yaml`
-
-Two problems, both real:
-
-1. **The tooling cannot read them.** That line is a blockquote below the H1, not YAML front
-   matter. Plan section 6 check 5 ("every live document has a header; no document is
-   unclassified") parses front matter, so all three read as unclassified. The control that the
-   parse itself works is `docs/fleet/FLEET-DOCTRINE.md:3`, which is genuine front matter.
-2. **They cite the moving path.** Three of the six citations of `docs/fleet/NORTH_STAR.yaml`
-   are these stamps. Converting them before the flatten lands makes them stale on merge.
-
-Converted after the flatten, not before.
-
-## Held: the one generated file
-
-`docs/fleet/NORTH_STAR.md` is a `projection` and was stamped in the first pass. The stamp was
-**reverted before review**, because stamping it is self-contradictory in a way that is not
-merely theoretical:
-
-- The contract says a `projection` is "Generated. Never hand-edited." Adding front matter by
-  hand is a hand edit of a generated file, and the file's own banner says
-  "**Generated file — do not edit by hand.**"
-- `renderNorthStarMarkdown()` at `packages/mosaic/src/commands/fleet.ts:373` emits the H1 as
-  its first line and no front matter at all.
-- `fleet-north-star.spec.ts:110-114` asserts full-string equality between the renderer's output
-  and the committed file: `expect(rendered).toBe(committed)`. Before the stamp, line 1 of the
-  committed file was `# Mosaic Fleet — NORTH STAR`, matching the renderer. After it, line 1 was
-  `---`. The assertion fails.
-
-So the header for a projection cannot live in the file. It has to be emitted by
-`renderNorthStarMarkdown()`, which is a code change and belongs in the flatten PR alongside the
-`resolveNorthStarPaths()` fix, not in a documentation pass.
-
-This generalises: **the contract as written cannot classify any generated document without a
-matching change to its generator.** `NORTH_STAR.md` is the only projection today, so the cost
-is one function. It will not stay one.
-
-## Needs a decision
-
-Nineteen rows. Seventeen are the plan's section 9 list, minus `docs/fleet/north-star.md`
-(renamed to `FLEET-DOCTRINE.md` by W1, so the row is closed) and minus the two `.yaml` rows,
-which are a different problem — see the next section. Two rows are new, found while
-classifying.
-
-Fill the `kind` column with a value from the contract, or `superseded-by: <path>`.
-
-| path                                                            | proposed                | why it is not mechanical                                                                                                                                                                                                                                                                                                                             |
-| --------------------------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `docs/README.md`                                                | `guide`                 | It also **prescribes** the competing front-matter convention (see below). Whatever kind it gets, its body needs an edit.                                                                                                                                                                                                                             |
-| `docs/SITEMAP.md`                                               | `guide` or `projection` | If it is generated from the tree it is a projection and needs a drift test. If hand-maintained it is a guide that goes stale silently. Nobody has said which.                                                                                                                                                                                        |
-| `docs/federation/SETUP.md`                                      | `guide`                 | Reads as a guide. Federation tier status is the open part: if the tier is shelved this is `superseded`.                                                                                                                                                                                                                                              |
-| `docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md`                  | `record`                | An acceptance checklist is evidence of a past gate, which is `record`. But if it is still being checked against, it is `tracking`.                                                                                                                                                                                                                   |
-| `docs/fleet/FLEET-LAUNCH.md`                                    | `guide`                 | Runbook. Depends on whether `launch-seat.sh` is deprecated in favour of `mosaic fleet` (campaign W3). If so, `superseded`.                                                                                                                                                                                                                           |
-| `docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md`    | `record`                | An inventory of dispositions taken. `record` unless dispositions are still pending, which the title implies they were once.                                                                                                                                                                                                                          |
-| `docs/fleet/README.md`                                          | `guide`                 | Section index. Low risk; listed only because the plan lists it.                                                                                                                                                                                                                                                                                      |
-| `docs/fleet/backlog-conventions.md`                             | `guide`                 | Conventions decide things, and `guide` explicitly decides nothing. May be `spec`.                                                                                                                                                                                                                                                                    |
-| `docs/fleet/f4-matrix-connector.md`                             | `spec`                  | F4 is a workstream. Whether it is live or abandoned decides `spec` versus `superseded`.                                                                                                                                                                                                                                                              |
-| `docs/native-kanban-sot/DOCUMENTATION-CHECKLIST.md`             | `record`                | Same question as the fleet IA checklist.                                                                                                                                                                                                                                                                                                             |
-| `docs/native-kanban-sot/INDEX.md`                               | `guide`                 | Index of the canon. If it is generated from the canon it is a projection.                                                                                                                                                                                                                                                                            |
-| `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` | `spec`                  | 415 lines of normative gate. `spec` fits; confirm it is not superseded by the shared contract.                                                                                                                                                                                                                                                       |
-| `docs/native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md`               | `spec`                  | As above.                                                                                                                                                                                                                                                                                                                                            |
-| `docs/native-kanban-sot/KBN-101-ENVELOPE-A.md`                  | `spec`                  | Title says "v6, FINAL". If v6 supersedes v1-v5 elsewhere, those need `superseded-by` pointing here.                                                                                                                                                                                                                                                  |
-| `docs/native-kanban-sot/SHARED-CONTRACT.md`                     | `spec`                  | "Remediated Shared Contract v1". Same versioning question.                                                                                                                                                                                                                                                                                           |
-| `docs/release-integrity/probe-inventory.md`                     | `record`                | An inventory. `tracking` if probes are still being added to it.                                                                                                                                                                                                                                                                                      |
-| `docs/webui/PHASE-P-STRUCTURE.md`                               | `spec`                  | Zero inbound references (plan section 5.4). Either wire it in or mark it superseded; the kind is the smaller question.                                                                                                                                                                                                                               |
-| `docs/native-kanban-sot/TASKS.md`                               | **conflict**            | The file says of itself: "This file is a build plan, not a task tracker, and is NOT superseded." The contract says `tracking` is "live state, single-writer (manifests, `TASKS.md`). **Never a spec**." The file claims to be the thing its name forbids. Either the file is wrong or the contract's `TASKS.md` shorthand is.                        |
-| `docs/requirements/native-kanban-sot.md`                        | **conflict**            | Plan section 5.2 says if it is hand-authored canon it is `source-of-truth`. The contract's own table says `source-of-truth` is **machine-readable**. This is prose markdown with normative MUST/MUST NOT, RATIFIED 2026-07-14, decision owner Jason. It cannot satisfy both rules. Either it is a `spec` or the machine-readable criterion is wrong. |
-
-The last two are not slow rows, they are contradictions inside the contract. They want an
-answer about the contract, not about the file.
-
-## The contract collides with an existing one
-
-`docs/README.md` lines 150-160 already document a front-matter convention, with its own
-allowed values:
-
-```yaml
----
-title: Human-readable page title
-type: guide # guide | concept | reference | decision | rfc | runbook
-audience: developer # user | admin | developer | all
-status: current # current | draft | deprecated | historical
-source_of_truth: false
----
-```
-
-Adoption is 4 of 127 files: `docs/ADMIN-GUIDE/security/sso-providers.md`,
-`docs/DEVELOPER-GUIDE/testing/lease-broker-operations.md`,
-`docs/USER-GUIDE/getting-started/quickstart.md`, `docs/USER-GUIDE/product/web-dashboard.md`.
-
-`status` is in both schemas with **disjoint vocabularies**. `type` and `kind` are two names for
-one idea with different value sets. `source_of_truth: false` is a boolean spelling of
-`kind: source-of-truth`.
-
-What this pass did, and it is a decision someone should ratify or reverse: the new contract
-wins. Those 4 files had `status: current` rewritten to `status: active` and gained `kind:`.
-Their `title`, `type`, `audience` and `source_of_truth` keys were left alone. Nothing reads any
-of them — `git grep source_of_truth` outside `docs/` returns zero hits — so no consumer broke.
-
-`docs/README.md` still prescribes the old convention. It is an operator row above, so this pass
-did not edit it. Until it is edited, the repository documents two conflicting header
-conventions and points authors at the one being retired.
-
-## The contract has no form for a YAML document
-
-Two of the plan's 20 rows are not markdown: `docs/fleet/examples/roster-v2.yaml` and
-`docs/openapi-tess.yaml`. Front matter is a markdown convention. A `.yaml` file can carry a
-leading `---` document, but then it is two YAML documents and every existing parser of that
-file sees a change.
-
-This is not an edge case. It applies to **`docs/fleet/NORTH_STAR.yaml`, the source of truth
-itself**, which is the one file the contract most needs to classify. Section 6 check 5 says no
-document is unclassified. As written, the source of truth cannot comply.
-
-Options, none of them chosen here: exclude `.yaml` from the contract and say so; carry their
-metadata in a sidecar; or add a top-level `kind:` key inside the YAML body rather than as front
-matter, which for `NORTH_STAR.yaml` is a schema change.
-
-## Method, and what it cannot tell you
-
-Classification is per-file, by title and path, recorded with a confidence. It is not a regex
-sweep. The plan's own warning stands and is why the 19 rows above are held rather than guessed:
-the first classifier pass classed a RATIFIED requirements document as a projection.
-
-Rows marked `med` in the working manifest and not listed above: the five `docs/plans/*` specs,
-`docs/fleet/migration/example-profile-disposition.md`, the one ADR
-(`decisions/mos-runtime-portability-m1.md`, called `record` because an ADR records a decision
-taken), and the one RFC (`rfcs/optional-ai-egress-gateways.md`, called `spec` because it
-proposes work not yet built). Those eight are stamped and are the most likely to be wrong.
-
-## Verification
-
-- 103 of 103 files parse with the expected `kind` and `status` in front matter.
-- The check was shown to reject a wrong kind before it was trusted (asserting
-  `kind: record` on a file stamped `guide` fails).
-- The whole diff removes 4 lines, all of them `status: current`.
-- 24 files untouched, matching 19 + 3 + 1 + 1.
-
-## Response to the W5 adversarial pass
-
-vision ran a refute-first pass on this branch at `37cd00e` from a fresh worktree. Three of its
-points changed the branch. Everything is re-measured here before being acted on; where my
-measurement disagrees with its stated evidence I say so.
-
-### 1. `docs/fleet/NORTH_STAR.md` stamp reverted (`bea47543`)
-
-vision raised this as **latent** and scoped to the flatten PR. It is **live in this PR**, so it
-could not wait.
-
-`fleet-north-star.spec.ts:110-114` is a drift test that reads the committed file from disk and
-asserts full-string equality against `renderNorthStarMarkdown()`, whose first emitted line is the
-H1 and which emits no front matter. Stamping changed line 1 from the H1 to `---`.
-
-CI 2589 confirms it directly, no longer by construction:
-
-```
-× renderNorthStarMarkdown > matches the committed NORTH_STAR.md projection (regenerate if this fails)
-  → expected '# Mosaic Fleet — NORTH STAR\n\n> **Ge…' to be '---\nkind: projection\nstatus: active…'
-```
-
-Reverted to `origin/next` verbatim. `git diff origin/next -- docs/fleet/NORTH_STAR.md` is 0 lines;
-control on `docs/fleet/reference/cli.md` returns 13, so the diff command does report differences.
-
-The consequence is a contract-level one, recorded in the worklist: **the contract as written
-cannot classify any generated document without a matching change to its generator.** A `projection`
-is "Generated. Never hand-edited," so its header has to come out of the renderer. That is a code
-change and belongs in the flatten PR beside the `resolveNorthStarPaths()` fix. vision's
-recommendation, and I agree with it.
-
-Counts: stamped 104 → **103**. Untouched 23 → **24**.
-
-### 2. The `docs/` qualifier (vision's C1)
-
-Stated as asked. **"127 live documentation files" is true for `docs/` only.** Definition: all
-`*.md` under `docs/`, minus `docs/archive/` and `docs/_old_structure/`. 318 total = 134 archive +
-57 `_old_structure` + 127 live.
-
-Repo-wide the phrase undercounts: 21 live markdown files sit outside `docs/` and outside any named
-exclusion (17 under `guides/`, plus `README.md`, `AGENTS.md`, `CLAUDE.md`, `REPORT-A1207.md` at
-root). This PR does not stamp them and does not claim to.
-
-### 3. `format` failure, and what it says about the header (`8a55c041`)
-
-CI 2589 also failed `prettier --check` on **exactly one file**: the plan document I hand-wrote.
-Reproduced locally, rc=1, same single file. Fixed; the diff is 31 lines in, 31 out, all table
-column padding.
-
-Worth stating for the review rather than burying: **the other 103 stamped documents pass
-`prettier --check` unchanged.** The `---\nkind:\nstatus:\n---` block is prettier-clean as applied.
-The formatting failure was in my prose, not in the contract header.
-
-### 4. R1: the evidence inverts, the finding gets stronger
-
-vision asks for a `kind` change on `docs/DEVELOPER-GUIDE/architecture/channel-protocol.md`, on the
-grounds that it "carries 7 normative MUSTs" while the contract says `guide` "decides nothing."
-
-**The MUST count does not hold.** Uppercase RFC2119 terms (`MUST`, `MUST NOT`, `SHOULD`,
-`SHOULD NOT`, `SHALL`, `MAY`, `REQUIRED`) in that file: **0 lines**. Control: the identical grep
-returns 25 lines in `docs/requirements/native-kanban-sot.md`, so it finds them where they exist.
-The seven lowercase "must" occurrences all _disclaim_ authority rather than assert it: "must not be
-used as instructions", "must not be treated as current behavior", "must remain planned work", "must
-first specify", "before it can become architecture guidance." The file's own banner reads "it is
-not a runtime registry, an API contract, a requirements document."
-
-**The citation half holds, and is larger than stated.** vision's line numbers are exact. I
-restated them earlier with wrong directories, which is worth naming because it is the same method
-failure fred and I already wrote up as C3 in the flatten plan: I matched on basename and assumed
-the path. The real ones, plus the two vision did not list:
-
-| citing document                                         | line | words used                                          |
-| ------------------------------------------------------- | ---- | --------------------------------------------------- |
-| `docs/ADMIN-GUIDE/security/discord-ingress.md`          | 141  | "**canonical** shared-contract and parity boundary" |
-| `docs/DEVELOPER-GUIDE/integrations/channel-adapters.md` | 28   | "The **canonical** architecture summary is"         |
-| `docs/DEVELOPER-GUIDE/integrations/channel-adapters.md` | 183  | "**Canonical** channel protocol architecture"       |
-| `docs/USER-GUIDE/workflows/discord-conversations.md`    | 127  | "current shared types ... explicit parity boundary" |
-| `docs/SITEMAP.md`                                       | 54   | index entry                                         |
-| `docs/DEVELOPER-GUIDE/architecture/README.md`           | 18   | index entry                                         |
-
-So the tension is real. Three live documents outside the two indexes cite it, across four
-citations, and three of those four use the word "canonical" for a document that spends its own
-banner denying it is canonical. **It is just not a MUST problem, and that
-changes what the fix is.** If the file is telling the truth about itself, the three "canonical"
-citations are wrong and the edit belongs in those three files, not in this one's `kind`.
-
-**Left as `kind: guide` in this PR and flagged for the reviewer's call.** Restamping on evidence
-that inverts on reading would be worse than leaving it stamped and named.
-
-### Unchanged
-
-vision's C2 (no consumer), C4 (holding `parent` blocks nothing) and C5 (a front-mattered `.yaml`
-throws in `YAML.parse`) all reverified. C1's arithmetic closes at the stated ref.
-
-## fred's six decisions, applied
-
-Ruled on PR #1350 as comment 23693. Each is applied here; each is his call, not mine, and any of
-them is one line to reverse.
-
-| #   | decision                                                                                                        | applied as                                                                                                       |
-| --- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| A   | New contract wins; `docs/README.md` is rewritten in this PR and the 4 old-schema files convert in the same pass | `docs/README.md:149-190` rewritten; `type:` dropped from the 4 files, `title`/`audience`/`source_of_truth` kept  |
-| B   | `source-of-truth` leaves the `kind` enum and returns as an orthogonal boolean                                   | enum is now 6 values; `docs/requirements/native-kanban-sot.md` stamped `kind: spec` + `source_of_truth: true`    |
-| C   | `status` gains a third value, `completed`                                                                       | the two executed plans take it (evidence below)                                                                  |
-| D   | Kind follows content, never filename                                                                            | `docs/native-kanban-sot/TASKS.md` stamped `kind: spec`, because its body says "a build plan, not a task tracker" |
-| E   | The contract covers `.md` only, stated as a decision rather than left as a gap                                  | written into `docs/README.md` with vision's `YAML.parse` measurement as the reason                               |
-| F   | `channel-protocol.md` becomes `spec`                                                                            | applied, with one correction and one consequence below                                                           |
-
-### C: evidence the two plans are complete
-
-Neither plan self-declares completion, so this is measured from the artifacts rather than taken
-from the documents:
-
-- `2026-08-10-ci-queue-purpose-implementation.md` — the shipped guard carries the flag the plan
-  specifies: `ci-queue-wait.sh --purpose push|merge`, exercised in this session at rc=0.
-- `2026-08-10-docs-structure-readme.md` — every section the plan specifies exists in
-  `docs/README.md` today, including the Obsidian conventions and the source-of-truth precedence
-  block. This PR is editing the artifact that plan produced.
-
-### F: the MUST count does not hold, and the fix changes shape
-
-Applied as ruled. But the ruling's stated grounds are half wrong, and the half that survives points
-somewhere else, so this is the one to look at again.
-
-**Zero** uppercase RFC2119 terms in `channel-protocol.md`, not seven. Control: the identical grep
-returns 25 lines in `docs/requirements/native-kanban-sot.md`. The seven lowercase "must"
-occurrences all _disclaim_ authority: "must not be used as instructions", "must not be treated as
-current behavior", "must remain planned work".
-
-**The citation half holds and is bigger than stated** (table in the section above).
-
-**The consequence of applying F:** the file is now stamped `spec` while its own banner says "it is
-not a runtime registry, an API contract, a requirements document." Header and body now contradict
-each other, which is the defect this pass exists to remove. Either the banner is edited in this PR,
-or the three documents calling it canonical are the ones that are wrong. That is a content call and
-it is left to the reviewer rather than folded into a stamping pass.
-
-## Q1 — the one question this pass cannot answer for itself
-
-`docs/README.md` now **prescribes** the document contract, and it is the only live document under
-`docs/` with no `kind`. It is still on the operator-held list, so it is left unstamped.
-
-By decision B it is arguably `kind: spec` with `source_of_truth: true` for the subject "document
-contract". The reason this is not applied unilaterally: it decides which document outranks the
-other when `docs/README.md` and `docs/plans/2026-08-20_stack-docs-flatten-and-alignment.md` disagree
-about the contract, and they already differ (the plan's enum has 7 values, the README's now has 6).
-That is an authority question, not a classification one.
-
-## The old schema DID have a consumer, and CI found it
-
-vision's C2 concluded "no consumer found" after searching by parsing primitive rather than by key
-name. fred's decision A rested on "no installed base to protect." I accepted both. **All three of
-us were wrong, and the full test suite is what proved it.**
-
-`packages/mosaic/src/installation-documentation.spec.ts:39` asserted:
-
-```ts
-expect(markdown).toMatch(/^---\n[\s\S]*?\nstatus: current\n[\s\S]*?\n---\n/);
-```
-
-That is a raw regex over the markdown text, not a front-matter parse and not a key lookup, which is
-exactly why a search organised around parsing primitives could not see it. It pins
-`docs/USER-GUIDE/getting-started/quickstart.md` to the old vocabulary. Replacing `status: current`
-with `status: active` turned it red.
-
-Updated to `status: active`, the contract's value for "in force", with the reason in a comment
-beside it. Verified by evaluating both regexes against the real file: old `false`, new `true`.
-Control: a page carrying `superseded-by` still fails the new regex, so the assertion still asserts
-something rather than matching anything with front matter.
-
-**The method point, which outlives this file.** CI 2592 ran the whole suite against the stamped
-tree, 46 turbo tasks, and returned exactly one failing spec: this one. That is a stronger consumer
-search than any grep the three of us ran, because it does not depend on guessing how a consumer
-reads the file.
-
-An earlier draft of this paragraph put a test count here, "1617 tests, 1 failed". **That number was
-wrong and it is withdrawn.** Extracting per-test totals from these pipeline logs is not reliable:
-the same regex over the same log format returns 1003 for 2592, 1022 for 2593 and 3471 for 2594,
-which are runs of the same suite. Three irreconcilable answers from one method is proof the method
-does not measure what it claims. What the log does carry reliably is the FAIL list and the turbo
-task line, so the claim is stated in those terms instead. The point never needed the count: one
-named failing spec is what refuted three hand-searches. **Run the suite before concluding a
-documentation change has no code consumers.** Two independent seats and a reviewer searching by
-hand missed the one that existed.
-
-## fred's second pass: F withdrawn, Q1 answered
-
-Both changes below are fred's rulings, applied. Neither is my judgement and I record whose it is.
-
-### F is withdrawn: `channel-protocol.md` returns to `kind: guide`
-
-Reverted. fred re-measured the file himself with a control and reached the count I reported: zero
-uppercase RFC2119 terms case-sensitive, seven lowercase `must`, every one disclaiming authority,
-under a banner that refuses requirements status. A page like that is a guide.
-
-The reason this matters past one stamp is fred's own: F rested on "the doc graph outranks the
-page's own banner", which contradicts his decision D, "kind follows content, never the filename and
-never what other documents say about it". D is the rule. F was a counterexample to it, written in
-the same comment.
-
-Neither rescue was taken. vision's adjective edit on the three citing docs and an edit to the
-page's banner would both have preserved a stamp that should not have been made. The three citing
-documents stay as they are: under vision's index-pointer reading, "canonical" claims the best page
-on a subject rather than normative force, so there is nothing to correct.
-
-**What this costs the contract: nothing, and that is the point.** A kind that survives only by
-editing the evidence around it is not a classification.
-
-### Q1 answered: `docs/README.md` is stamped `kind: spec`, `source_of_truth: true`
-
-Applied. By D, a document that prescribes the contract has spec content. By B, `source_of_truth` is
-an orthogonal boolean and this is the authoritative statement of the contract, so it carries both.
-
-The authority half of Q1 was whether stamping the README settles a conflict with the flatten plan,
-whose enum still has seven values against the README's six. fred's ruling: **a plan never outranks
-the artifact it planned.** The plan's enum is pre-decision-B staleness, not a competing authority.
-The plan is fred's file and he corrects it there.
-
-The contract now applies to the document that states it. That was the only state in which it could
-be credible.
-
-### Verification arithmetic, re-closed
-
-128 live `.md` under `docs/` = **108 stamped** + 16 operator-held + 3 supersede deferrals + 1
-generated. The stamped count rose by one and the operator-held set fell by one, both because of the
-README; every other row is unchanged. Control unchanged: the verifier reports `valid=False` when a
-kind is corrupted to `nonsense`.
-
-### One consumer finding that is not a defect
-
-A sweep of every spec reading a path under `docs/` returns 10 files. Four read a live file:
-`fleet-north-star.spec.ts` and `installation-documentation.spec.ts` (both already caught by CI),
-`mutator-gate.acceptance.spec.ts` reading `compaction-revocation.md`, which passes under its `guide`
-stamp, and `roster-v2.spec.ts:366`, which reads `docs/fleet/reference/roster-v2.schema.json`.
-
-The fourth is a real read of a real live file under `docs/` and is untouched only because decision E
-scopes the contract to `.md`. Had the contract covered every file under `docs/`, front matter in
-that JSON schema would have broken the spec, the same failure as the quickstart regex. E was
-load-bearing beyond the YAML-parse grounds it was decided on. No action; recorded so the `.md`
-boundary is not widened later without re-running this sweep.

docs/plans/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Documentation Plans
 
 > **Status:** Current artifact index. Plans record approved intent and execution approach; they are not current product behavior or operational authority.

docs/release-integrity/TASKS.md

@@ -1,8 +1,3 @@
----
-kind: tracking
-status: active
----
-
 # Tasks — Release Integrity Workstream (RI-050, #1275)
 
 > Single-writer: the RI-050 orchestrator (jarvis, dragon-lin) only. Workers read but never modify.

docs/reports/README.md

@@ -1,8 +1,3 @@
----
-kind: guide
-status: active
----
-
 # Documentation Reports
 
 > **Status:** Current evidence index. Reports record reviews, tests, audits, and deferred findings; they are not requirements or operational instructions by themselves.

docs/reports/code-review/756-code-review.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Independent Code Review — #756 Official Discord Channel Plugin
 
 **Verdict: APPROVE**

docs/reports/code-review/gateway-security-20260313.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Code Review Report — Gateway Security Hardening
 
 ## Scope Reviewed

docs/reports/compaction-refresh/830-documentation-checklist.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #830 Documentation Completion Checklist
 
 ## Required artifacts

docs/reports/deferred/758-fleet-config-deferrals.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # FCM-M5-001 Fleet Documentation Deferrals and Holds
 
 **Issue:** #758 · **Branch:** `docs/758-fleet-config-operator-docs`

docs/reports/documentation/2026-08-10-docs-catalog-audit.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Mosaic Stack Documentation Catalog and Truth Audit
 
 > **Status:** First-pass static audit — 2026-08-10

docs/reports/documentation/756-discord-plugin-checklist.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Documentation Completion Checklist — #756 Official Discord plugin
 
 ## Required artifacts

docs/reports/documentation/758-fleet-config-ia-closure.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # FCM-M5-001 Fleet Documentation IA Closure Evidence
 
 **Issue:** #758 · **Task:** FCM-M5-001

docs/reports/documentation/AUDIT-2026-02-17-framework-consistency.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Mosaic Framework Consistency Audit
 
 Date: 2026-02-17

docs/reports/native-kanban-sot/canon-final-rereview-go.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 VERDICT: GO
 
 # Native Kanban/SOT canon independent re-review 2

docs/reports/native-kanban-sot/canon-initial-review-no-go.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Independent Review — Native Kanban/SOT Canon
 
 **Reviewer:** `enhance-sol` (independent of author `planner-sol`)

docs/reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # KBN-101 contract independent security/architecture review
 
 **Verdict: REQUEST CHANGES**

docs/reports/native-kanban-sot/ultron-final-go.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #751 Native Kanban/SOT canonical publication — Ultron final gate
 
 **Verdict: GO** — zero BLOCKER/HIGH findings.

docs/reports/qa/gateway-security-20260313.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # QA Report — Gateway Security Hardening
 
 ## Scope

docs/reports/qa/p8-003-performance-optimization.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Performance Optimization — P8-003
 
 **Branch:** `feat/p8-003-performance`  

docs/reports/quality/1099-pipefail-sweep.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1099 pipefail + early-exit sweep
 
 Baseline: `df4c591ab42aa1ae62c12935fdc0e772684864a0`

docs/reports/security/756-security-review.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # Security Review — Issue #756
 
 **Scope:** final current uncommitted Discord plugin, shared channel contract, gateway ingress, AgentService, and plugin registration delta  

docs/requirements/native-kanban-sot.md

@@ -1,9 +1,3 @@
----
-kind: spec
-status: active
-source_of_truth: true
----
-
 # Native Kanban and Canonical Task SOT — Canonical Requirements
 
 **Status:** RATIFIED and independently approved for canonical publication under issue [#751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)

docs/scratchpads/1019-zero-timeout-harness.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1019 — Zero-timeout queue-guard harness race
 
 - **Issue:** #1019 (parent status remains `believed-fixed, pending jarvis validation`; do not close)

docs/scratchpads/1043-pane-git-identity.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1043 — Fleet pane git-identity propagation
 
 ## Objective

docs/scratchpads/1098-framework-shell-portability.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1098 — Framework shell portability / red main
 
 ## Objective

docs/scratchpads/1099-pipefail-sweep.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1099 — pipefail + early-exit sweep
 
 ## Scope and decisions

docs/scratchpads/1146-ci-queue-purpose.md

@@ -1,8 +1,3 @@
----
-kind: record
-status: active
----
-
 # #1146 — CI Queue Guard Purpose Semantics
 
 ## Objective