fix: gateway install uses Gitea registry instead of npmjs

- Switch all @mosaicstack/gateway refs to @mosaic/gateway
- Install from Gitea registry (git.mosaicstack.dev)
- Remove duplicate entry resolution (was checking both package names)
- Bump @mosaic/mosaic and @mosaic/cli to 0.0.12

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -23,8 +23,8 @@ VALKEY_URL=redis://localhost:6380
 
 
 # ─── Gateway ─────────────────────────────────────────────────────────────────
-# TCP port the NestJS/Fastify gateway listens on (default: 14242)
+# TCP port the NestJS/Fastify gateway listens on (default: 4000)
-GATEWAY_PORT=14242
+GATEWAY_PORT=4000
 
 # Comma-separated list of allowed CORS origins.
 # Must include the web app origin in production.
@@ -37,12 +37,12 @@ GATEWAY_CORS_ORIGIN=http://localhost:3000
 BETTER_AUTH_SECRET=change-me-to-a-random-32-char-string
 
 # Public base URL of the gateway (used by BetterAuth for callback URLs)
-BETTER_AUTH_URL=http://localhost:14242
+BETTER_AUTH_URL=http://localhost:4000
 
 
 # ─── Web App (Next.js) ───────────────────────────────────────────────────────
 # Public gateway URL — accessible from the browser, not just the server.
-NEXT_PUBLIC_GATEWAY_URL=http://localhost:14242
+NEXT_PUBLIC_GATEWAY_URL=http://localhost:4000
 
 
 # ─── OpenTelemetry ───────────────────────────────────────────────────────────
@@ -121,12 +121,12 @@ OTEL_SERVICE_NAME=mosaic-gateway
 # ─── Discord Plugin (optional — set DISCORD_BOT_TOKEN to enable) ─────────────
 # DISCORD_BOT_TOKEN=
 # DISCORD_GUILD_ID=
-# DISCORD_GATEWAY_URL=http://localhost:14242
+# DISCORD_GATEWAY_URL=http://localhost:4000
 
 
 # ─── Telegram Plugin (optional — set TELEGRAM_BOT_TOKEN to enable) ───────────
 # TELEGRAM_BOT_TOKEN=
-# TELEGRAM_GATEWAY_URL=http://localhost:14242
+# TELEGRAM_GATEWAY_URL=http://localhost:4000
 
 
 # ─── SSO Providers (add credentials to enable) ───────────────────────────────

.gitignore

@@ -9,6 +9,3 @@ coverage
 *.tsbuildinfo
 .pnpm-store
 docs/reports/
-
-# Step-CA dev password — real file is gitignored; commit only the .example
-infra/step-ca/dev-password

.npmrc

@@ -1 +1 @@
-@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
+@mosaic:registry=https://git.mosaicstack.dev/api/packages/mosaic/npm/

.woodpecker/ci.yml

@@ -59,7 +59,7 @@ steps:
           sleep 1
         done
       # Run migrations (DATABASE_URL is set in environment above)
-      - pnpm --filter @mosaicstack/db run db:migrate
+      - pnpm --filter @mosaic/db run db:migrate
       # Run all tests
       - pnpm test
     depends_on:

.woodpecker/publish.yml

@@ -33,44 +33,15 @@ steps:
       - *enable_pnpm
       # Configure auth for Gitea npm registry
       - |
-        echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
+        echo "//git.mosaicstack.dev/api/packages/mosaic/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
-        echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
+        echo "@mosaic:registry=https://git.mosaicstack.dev/api/packages/mosaic/npm/" >> ~/.npmrc
-      # Publish non-private packages to Gitea.
+      # Publish non-private packages to Gitea (--no-git-checks skips dirty/branch checks in CI)
-      #
+      # --filter excludes web (private)
-      # The only publish failure we tolerate is "version already exists" —
+      - >
-      # that legitimately happens when only some packages were bumped in
+        pnpm --filter "@mosaic/*"
-      # the merge. Any other failure (registry 404, auth error, network
+        --filter "!@mosaic/web"
-      # error) MUST fail the pipeline loudly: the previous
+        publish --no-git-checks --access public
-      # `|| echo "... continuing"` fallback silently hid a 404 from the
+        || echo "[publish] Some packages may already exist at this version — continuing"
-      # Gitea org rename and caused every @mosaicstack/* publish to fall
-      # on the floor while CI still reported green.
-      - |
-        # Portable sh (Alpine ash) — avoid bashisms like PIPESTATUS.
-        set +e
-        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" publish --no-git-checks --access public >/tmp/publish.log 2>&1
-        EXIT=$?
-        set -e
-        cat /tmp/publish.log
-        if [ "$EXIT" -eq 0 ]; then
-          echo "[publish] all packages published successfully"
-          exit 0
-        fi
-        # Hard registry / auth / network errors → fatal. Match npm's own
-        # error lines specifically to avoid false positives on arbitrary
-        # log text that happens to contain "E404" etc.
-        if grep -qE "npm (error|ERR!) code (E404|E401|ENEEDAUTH|ECONNREFUSED|ETIMEDOUT|ENOTFOUND)" /tmp/publish.log; then
-          echo "[publish] FATAL: registry/auth/network error detected — failing pipeline" >&2
-          exit 1
-        fi
-        # Only tolerate the explicit "version already published" case.
-        # npm returns this as E403 with body "You cannot publish over..."
-        # or EPUBLISHCONFLICT depending on version.
-        if grep -qE "EPUBLISHCONFLICT|You cannot publish over|previously published" /tmp/publish.log; then
-          echo "[publish] some packages already at this version — continuing (non-fatal)"
-          exit 0
-        fi
-        echo "[publish] FATAL: publish failed with unrecognized error — failing pipeline" >&2
-        exit 1
     depends_on:
       - build
 
@@ -103,12 +74,12 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
+        DESTINATIONS="--destination git.mosaicstack.dev/mosaic/mosaic-stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
         if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:latest"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/mosaic-stack/gateway:latest"
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:$CI_COMMIT_TAG"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/mosaic-stack/gateway:$CI_COMMIT_TAG"
         fi
         /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
     depends_on:
@@ -128,12 +99,12 @@ steps:
       - mkdir -p /kaniko/.docker
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/web:sha-${CI_COMMIT_SHA:0:7}"
+        DESTINATIONS="--destination git.mosaicstack.dev/mosaic/mosaic-stack/web:sha-${CI_COMMIT_SHA:0:7}"
         if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:latest"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/mosaic-stack/web:latest"
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:$CI_COMMIT_TAG"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaic/mosaic-stack/web:$CI_COMMIT_TAG"
         fi
         /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
     depends_on:

AGENTS.md

@@ -21,11 +21,11 @@ Mosaic Stack is a self-hosted, multi-user AI agent platform. TypeScript monorepo
 | `apps/web`         | Next.js dashboard               | React 19, Tailwind               |
 | `packages/types`   | Shared TypeScript contracts     | class-validator                  |
 | `packages/db`      | Drizzle ORM schema + migrations | drizzle-orm, postgres            |
-| `packages/auth`    | BetterAuth configuration        | better-auth, @mosaicstack/db     |
+| `packages/auth`    | BetterAuth configuration        | better-auth, @mosaic/db          |
-| `packages/brain`   | Data layer (PG-backed)          | @mosaicstack/db                  |
+| `packages/brain`   | Data layer (PG-backed)          | @mosaic/db                       |
 | `packages/queue`   | Valkey task queue + MCP         | ioredis                          |
-| `packages/coord`   | Mission coordination            | @mosaicstack/queue               |
+| `packages/coord`   | Mission coordination            | @mosaic/queue                    |
-| `packages/mosaic`  | Unified `mosaic` CLI + TUI      | Ink, Pi SDK, commander           |
+| `packages/cli`     | Unified CLI + Pi TUI            | Ink, Pi SDK                      |
 | `plugins/discord`  | Discord channel plugin          | discord.js                       |
 | `plugins/telegram` | Telegram channel plugin         | Telegraf                         |
 
@@ -33,9 +33,9 @@ Mosaic Stack is a self-hosted, multi-user AI agent platform. TypeScript monorepo
 
 1. Gateway is the single API surface — all clients connect through it
 2. Pi SDK is ESM-only — gateway and CLI must use ESM
-3. Socket.IO typed events defined in `@mosaicstack/types` enforce compile-time contracts
+3. Socket.IO typed events defined in `@mosaic/types` enforce compile-time contracts
 4. OTEL auto-instrumentation loads before NestJS bootstrap
-5. BetterAuth manages auth tables; schema defined in `@mosaicstack/db`
+5. BetterAuth manages auth tables; schema defined in `@mosaic/db`
 6. Docker Compose provides PG (5433), Valkey (6380), OTEL Collector (4317/4318), Jaeger (16686)
 7. Explicit `@Inject()` decorators required in NestJS (tsx/esbuild doesn't emit decorator metadata)
 
@@ -59,9 +59,9 @@ pnpm typecheck && pnpm lint && pnpm format:check  # Quality gates
 The `agent` column specifies the required model for each task. **This is set at task creation by the orchestrator and must not be changed by workers.**
 
 | Value    | When to use                                                 | Budget                     |
-| --------- | ----------------------------------------------------------- | -------------------------- |
+| -------- | ----------------------------------------------------------- | -------------------------- |
 | `codex`  | All coding tasks (default for implementation)               | OpenAI credits — preferred |
-| `glm-5.1` | Cost-sensitive coding where Codex is unavailable            | Z.ai credits               |
+| `glm-5`  | Cost-sensitive coding where Codex is unavailable            | Z.ai credits               |
 | `haiku`  | Review gates, verify tasks, status checks, docs-only        | Cheapest Claude tier       |
 | `sonnet` | Complex planning, multi-file reasoning, architecture review | Claude quota               |
 | `opus`   | Major cross-cutting architecture decisions ONLY             | Most expensive — minimize  |

CLAUDE.md

@@ -10,7 +10,7 @@ Self-hosted, multi-user AI agent platform. TypeScript monorepo.
 - **Web**: Next.js 16 + React 19 (`apps/web`)
 - **ORM**: Drizzle ORM + PostgreSQL 17 + pgvector (`packages/db`)
 - **Auth**: BetterAuth (`packages/auth`)
-- **Agent**: Pi SDK (`packages/agent`, `packages/mosaic`)
+- **Agent**: Pi SDK (`packages/agent`, `packages/cli`)
 - **Queue**: Valkey 8 (`packages/queue`)
 - **Build**: pnpm workspaces + Turborepo
 - **CI**: Woodpecker CI
@@ -26,13 +26,13 @@ pnpm test             # Vitest (all packages)
 pnpm build            # Build all packages
 
 # Database
-pnpm --filter @mosaicstack/db db:push      # Push schema to PG (dev)
+pnpm --filter @mosaic/db db:push      # Push schema to PG (dev)
-pnpm --filter @mosaicstack/db db:generate  # Generate migrations
+pnpm --filter @mosaic/db db:generate  # Generate migrations
-pnpm --filter @mosaicstack/db db:migrate   # Run migrations
+pnpm --filter @mosaic/db db:migrate   # Run migrations
 
 # Dev
 docker compose up -d                  # Start PG, Valkey, OTEL, Jaeger
-pnpm --filter @mosaicstack/gateway exec tsx src/main.ts  # Start gateway
+pnpm --filter @mosaic/gateway exec tsx src/main.ts  # Start gateway
 ```
 
 ## Conventions

README.md

@@ -7,39 +7,26 @@ Mosaic gives you a unified launcher for Claude Code, Codex, OpenCode, and Pi —
 ## Quick Install
 
 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+bash <(curl -fsSL https://git.mosaicstack.dev/mosaic/mosaic-stack/raw/branch/main/tools/install.sh)
-```
-
-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
-```
-
-The installer auto-launches the setup wizard, which walks you through gateway install and verification. Flags for non-interactive use:
-
-```bash
-bash <(curl -fsSL …) --yes               # Accept all defaults
-bash <(curl -fsSL …) --yes --no-auto-launch  # Install only, skip wizard
 ```
 
 This installs both components:
 
 | Component       | What                                                  | Where                |
-| ----------------------- | ---------------------------------------------------------------- | -------------------- |
+| --------------- | ----------------------------------------------------- | -------------------- |
 | **Framework**   | Bash launcher, guides, runtime configs, tools, skills | `~/.config/mosaic/`  |
-| **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |
+| **@mosaic/cli** | TUI, gateway client, wizard, auto-updater             | `~/.npm-global/bin/` |
 
-After install, the wizard runs automatically or you can invoke it manually:
+After install, set up your agent identity:
 
 ```bash
-mosaic wizard        # Full guided setup (gateway install → verify)
+mosaic init          # Interactive wizard
 ```
 
 ### Requirements
 
 - Node.js ≥ 20
-- npm (for global @mosaicstack/mosaic install)
+- npm (for global @mosaic/cli install)
 - One or more runtimes: [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai), or [Pi](https://github.com/mariozechner/pi-coding-agent)
 
 ## Usage
@@ -62,34 +49,10 @@ The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md
 
 ```bash
 mosaic tui                   # Interactive TUI connected to the gateway
-mosaic gateway login         # Authenticate with a gateway instance
+mosaic login                 # Authenticate with a gateway instance
 mosaic sessions list         # List active agent sessions
 ```
 
-### Gateway Management
-
-```bash
-mosaic gateway install       # Install and configure the gateway service
-mosaic gateway verify        # Post-install health check
-mosaic gateway login         # Authenticate and store a session token
-mosaic gateway config rotate-token    # Rotate your API token
-mosaic gateway config recover-token  # Recover a token via BetterAuth cookie
-```
-
-If you already have a gateway account but no token, use `mosaic gateway config recover-token` to retrieve one without recreating your account.
-
-### Configuration
-
-Mosaic supports three storage tiers: `local` (PGlite, single-host), `standalone` (PostgreSQL, single-host), and `federated` (PostgreSQL + pgvector + Valkey, multi-host). See [Federated Tier Setup](docs/federation/SETUP.md) for multi-user and production deployments, or [Migrating to Federated](docs/guides/migrate-tier.md) to upgrade from existing tiers.
-
-```bash
-mosaic config show           # Print full config as JSON
-mosaic config get <key>      # Read a specific key
-mosaic config set <key> <val># Write a key
-mosaic config edit           # Open config in $EDITOR
-mosaic config path           # Print config file path
-```
-
 ### Management
 
 ```bash
@@ -102,80 +65,6 @@ mosaic coord init            # Initialize a new orchestration mission
 mosaic prdy init             # Create a PRD via guided session
 ```
 
-### Sub-package Commands
-
-Each Mosaic sub-package exposes its API surface through the unified CLI:
-
-```bash
-# User management
-mosaic auth users list
-mosaic auth users create
-mosaic auth sso
-
-# Agent brain (projects, missions, tasks)
-mosaic brain projects
-mosaic brain missions
-mosaic brain tasks
-mosaic brain conversations
-
-# Agent forge pipeline
-mosaic forge run
-mosaic forge status
-mosaic forge resume
-mosaic forge personas
-
-# Structured logging
-mosaic log tail
-mosaic log search
-mosaic log export
-mosaic log level
-
-# MACP protocol
-mosaic macp tasks
-mosaic macp submit
-mosaic macp gate
-mosaic macp events
-
-# Agent memory
-mosaic memory search
-mosaic memory stats
-mosaic memory insights
-mosaic memory preferences
-
-# Task queue (Valkey)
-mosaic queue list
-mosaic queue stats
-mosaic queue pause
-mosaic queue resume
-mosaic queue jobs
-mosaic queue drain
-
-# Object storage
-mosaic storage status
-mosaic storage tier
-mosaic storage export
-mosaic storage import
-mosaic storage migrate
-```
-
-### Telemetry
-
-```bash
-# Local observability (OTEL / Jaeger)
-mosaic telemetry local status
-mosaic telemetry local tail
-mosaic telemetry local jaeger
-
-# Remote telemetry (dry-run by default)
-mosaic telemetry status
-mosaic telemetry opt-in
-mosaic telemetry opt-out
-mosaic telemetry test
-mosaic telemetry upload        # Dry-run unless opted in
-```
-
-Consent state is persisted in config. Remote upload is a no-op until you run `mosaic telemetry opt-in`.
-
 ## Development
 
 ### Prerequisites
@@ -187,8 +76,8 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 ### Setup
 
 ```bash
-git clone git@git.mosaicstack.dev:mosaicstack/stack.git
+git clone git@git.mosaicstack.dev:mosaic/mosaic-stack.git
-cd stack
+cd mosaic-stack
 
 # Start infrastructure (Postgres, Valkey, Jaeger)
 docker compose up -d
@@ -197,7 +86,7 @@ docker compose up -d
 pnpm install
 
 # Run migrations
-pnpm --filter @mosaicstack/db run db:migrate
+pnpm --filter @mosaic/db run db:migrate
 
 # Start all services in dev mode
 pnpm dev
@@ -237,12 +126,13 @@ npm packages are published to the Gitea package registry on main merges.
 ## Architecture
 
 ```
-stack/
+mosaic-stack/
 ├── apps/
 │   ├── gateway/             NestJS API + WebSocket hub (Fastify, Socket.IO, OTEL)
 │   └── web/                 Next.js dashboard (React 19, Tailwind)
 ├── packages/
-│   ├── mosaic/              Unified CLI — TUI, gateway client, wizard, sub-package commands
+│   ├── cli/                 Mosaic CLI — TUI, gateway client, wizard
+│   ├── mosaic/              Framework — wizard, runtime detection, update checker
 │   ├── types/               Shared TypeScript contracts (Socket.IO typed events)
 │   ├── db/                  Drizzle ORM schema + migrations (pgvector)
 │   ├── auth/                BetterAuth configuration
@@ -263,7 +153,7 @@ stack/
 │   ├── macp/                OpenClaw MACP runtime plugin
 │   └── mosaic-framework/    OpenClaw framework injection plugin
 ├── tools/
-│   └── install.sh           Unified installer (framework + npm CLI, --yes / --no-auto-launch)
+│   └── install.sh           Unified installer (framework + npm CLI)
 ├── scripts/agent/           Agent session lifecycle scripts
 ├── docker-compose.yml       Dev infrastructure
 └── .woodpecker/             CI pipeline configs
@@ -273,7 +163,7 @@ stack/
 
 - **Gateway is the single API surface** — all clients (TUI, web, Discord, Telegram) connect through it
 - **ESM everywhere** — `"type": "module"`, `.js` extensions in imports, NodeNext resolution
-- **Socket.IO typed events** — defined in `@mosaicstack/types`, enforced at compile time
+- **Socket.IO typed events** — defined in `@mosaic/types`, enforced at compile time
 - **OTEL auto-instrumentation** — loads before NestJS bootstrap
 - **Explicit `@Inject()` decorators** — required since tsx/esbuild doesn't emit decorator metadata
 
@@ -310,13 +200,7 @@ Each stage has a dispatch mode (`exec` for research/review, `yolo` for coding),
 Run the installer again — it handles upgrades automatically:
 
 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+bash <(curl -fsSL https://git.mosaicstack.dev/mosaic/mosaic-stack/raw/branch/main/tools/install.sh)
-```
-
-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
 ```
 
 Or use the CLI:
@@ -335,8 +219,6 @@ bash tools/install.sh --check           # Version check only
 bash tools/install.sh --framework    # Framework only (skip npm CLI)
 bash tools/install.sh --cli          # npm CLI only (skip framework)
 bash tools/install.sh --ref v1.0     # Install from a specific git ref
-bash tools/install.sh --yes             # Non-interactive, accept all defaults
-bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
 ## Contributing

apps/gateway/package.json

@@ -1,9 +1,9 @@
 {
-  "name": "@mosaicstack/gateway",
+  "name": "@mosaic/gateway",
-  "version": "0.0.6",
+  "version": "0.0.2",
   "repository": {
     "type": "git",
-    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
+    "url": "https://git.mosaicstack.dev/mosaic/mosaic-stack.git",
     "directory": "apps/gateway"
   },
   "type": "module",
@@ -15,7 +15,7 @@
     "dist"
   ],
   "publishConfig": {
-    "registry": "https://git.mosaicstack.dev/api/packages/mosaicstack/npm/",
+    "registry": "https://git.mosaicstack.dev/api/packages/mosaic/npm/",
     "access": "public"
   },
   "scripts": {
@@ -28,28 +28,28 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.80.0",
     "@fastify/helmet": "^13.0.2",
-    "@mariozechner/pi-ai": "^0.65.0",
+    "@mariozechner/pi-ai": "~0.57.1",
-    "@mariozechner/pi-coding-agent": "^0.65.0",
+    "@mariozechner/pi-coding-agent": "~0.57.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@mosaicstack/auth": "workspace:^",
+    "@mosaic/auth": "workspace:^",
-    "@mosaicstack/brain": "workspace:^",
+    "@mosaic/brain": "workspace:^",
-    "@mosaicstack/config": "workspace:^",
+    "@mosaic/config": "workspace:^",
-    "@mosaicstack/coord": "workspace:^",
+    "@mosaic/coord": "workspace:^",
-    "@mosaicstack/db": "workspace:^",
+    "@mosaic/db": "workspace:^",
-    "@mosaicstack/discord-plugin": "workspace:^",
+    "@mosaic/discord-plugin": "workspace:^",
-    "@mosaicstack/log": "workspace:^",
+    "@mosaic/log": "workspace:^",
-    "@mosaicstack/memory": "workspace:^",
+    "@mosaic/memory": "workspace:^",
-    "@mosaicstack/queue": "workspace:^",
+    "@mosaic/queue": "workspace:^",
-    "@mosaicstack/storage": "workspace:^",
+    "@mosaic/storage": "workspace:^",
-    "@mosaicstack/telegram-plugin": "workspace:^",
+    "@mosaic/telegram-plugin": "workspace:^",
-    "@mosaicstack/types": "workspace:^",
+    "@mosaic/types": "workspace:^",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-fastify": "^11.0.0",
     "@nestjs/platform-socket.io": "^11.0.0",
     "@nestjs/throttler": "^6.5.0",
     "@nestjs/websockets": "^11.0.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.72.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.71.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.213.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
     "@opentelemetry/resources": "^2.6.0",
@@ -63,10 +63,8 @@
     "class-validator": "^0.15.1",
     "dotenv": "^17.3.1",
     "fastify": "^5.0.0",
-    "ioredis": "^5.10.0",
     "node-cron": "^4.2.1",
     "openai": "^6.32.0",
-    "postgres": "^3.4.8",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",
     "socket.io": "^4.8.0",
@@ -74,17 +72,11 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@nestjs/testing": "^11.1.18",
-    "@swc/core": "^1.15.24",
-    "@swc/helpers": "^0.5.21",
     "@types/node": "^22.0.0",
     "@types/node-cron": "^3.0.11",
-    "@types/supertest": "^7.2.0",
     "@types/uuid": "^10.0.0",
-    "supertest": "^7.2.2",
     "tsx": "^4.0.0",
     "typescript": "^5.8.0",
-    "unplugin-swc": "^1.5.9",
     "vitest": "^2.0.0"
   }
 }

apps/gateway/src/__tests__/conversation-persistence.test.ts

@@ -12,7 +12,7 @@ import { BadRequestException, NotFoundException } from '@nestjs/common';
 import { describe, expect, it, vi, beforeEach } from 'vitest';
 import type { ConversationHistoryMessage } from '../agent/agent.service.js';
 import { ConversationsController } from '../conversations/conversations.controller.js';
-import type { Message } from '@mosaicstack/brain';
+import type { Message } from '@mosaic/brain';
 
 // ---------------------------------------------------------------------------
 // Shared test data

apps/gateway/src/__tests__/cross-user-isolation.test.ts

@@ -18,13 +18,13 @@
  */
 
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
-import { createDb } from '@mosaicstack/db';
+import { createDb } from '@mosaic/db';
-import { createConversationsRepo } from '@mosaicstack/brain';
+import { createConversationsRepo } from '@mosaic/brain';
-import { createAgentsRepo } from '@mosaicstack/brain';
+import { createAgentsRepo } from '@mosaic/brain';
-import { createPreferencesRepo, createInsightsRepo } from '@mosaicstack/memory';
+import { createPreferencesRepo, createInsightsRepo } from '@mosaic/memory';
-import { users, conversations, messages, agents, preferences, insights } from '@mosaicstack/db';
+import { users, conversations, messages, agents, preferences, insights } from '@mosaic/db';
-import { eq } from '@mosaicstack/db';
+import { eq } from '@mosaic/db';
-import type { DbHandle } from '@mosaicstack/db';
+import type { DbHandle } from '@mosaic/db';
 
 // ─── Fixed IDs so the afterAll cleanup is deterministic ──────────────────────
 

apps/gateway/src/__tests__/integration/federated-boot.pg-unreachable.integration.test.ts

@@ -1,64 +0,0 @@
-/**
- * Test B — Gateway boot refuses (fail-fast) when PG is unreachable.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- *         (Valkey must be running; only PG is intentionally misconfigured.)
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-boot.pg-unreachable.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import net from 'node:net';
-import { beforeAll, describe, expect, it } from 'vitest';
-import { TierDetectionError, detectAndAssertTier } from '@mosaicstack/storage';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const VALKEY_URL = 'redis://localhost:6380';
-
-/**
- * Reserves a guaranteed-closed port at runtime by binding to an ephemeral OS
- * port (port 0) and immediately releasing it. The OS will not reassign the
- * port during the TIME_WAIT window, so it remains closed for the duration of
- * this test.
- */
-async function reserveClosedPort(): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const server = net.createServer();
-    server.listen(0, '127.0.0.1', () => {
-      const addr = server.address();
-      if (typeof addr !== 'object' || !addr) return reject(new Error('no addr'));
-      const port = addr.port;
-      server.close(() => resolve(port));
-    });
-    server.on('error', reject);
-  });
-}
-
-describe.skipIf(!run)('federated boot — PG unreachable', () => {
-  let badPgUrl: string;
-
-  beforeAll(async () => {
-    const closedPort = await reserveClosedPort();
-    badPgUrl = `postgresql://mosaic:mosaic@localhost:${closedPort}/mosaic`;
-  });
-
-  it('detectAndAssertTier throws TierDetectionError with service: postgres when PG is down', async () => {
-    const brokenConfig = {
-      tier: 'federated' as const,
-      storage: {
-        type: 'postgres' as const,
-        url: badPgUrl,
-        enableVector: true,
-      },
-      queue: {
-        type: 'bullmq',
-        url: VALKEY_URL,
-      },
-    };
-
-    await expect(detectAndAssertTier(brokenConfig)).rejects.toSatisfy(
-      (err: unknown) => err instanceof TierDetectionError && err.service === 'postgres',
-    );
-  }, 10_000);
-});

apps/gateway/src/__tests__/integration/federated-boot.success.integration.test.ts

@@ -1,50 +0,0 @@
-/**
- * Test A — Gateway boot succeeds when federated services are up.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-boot.success.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import postgres from 'postgres';
-import { afterAll, describe, expect, it } from 'vitest';
-import { detectAndAssertTier } from '@mosaicstack/storage';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const VALKEY_URL = 'redis://localhost:6380';
-
-const federatedConfig = {
-  tier: 'federated' as const,
-  storage: {
-    type: 'postgres' as const,
-    url: PG_URL,
-    enableVector: true,
-  },
-  queue: {
-    type: 'bullmq',
-    url: VALKEY_URL,
-  },
-};
-
-describe.skipIf(!run)('federated boot — success path', () => {
-  let sql: ReturnType<typeof postgres> | undefined;
-
-  afterAll(async () => {
-    if (sql) {
-      await sql.end({ timeout: 2 }).catch(() => {});
-    }
-  });
-
-  it('detectAndAssertTier resolves without throwing when federated services are up', async () => {
-    await expect(detectAndAssertTier(federatedConfig)).resolves.toBeUndefined();
-  }, 10_000);
-
-  it('pgvector extension is registered (pg_extension row exists)', async () => {
-    sql = postgres(PG_URL, { max: 1, connect_timeout: 5, idle_timeout: 5 });
-    const rows = await sql`SELECT * FROM pg_extension WHERE extname = 'vector'`;
-    expect(rows).toHaveLength(1);
-  }, 10_000);
-});

apps/gateway/src/__tests__/integration/federated-pgvector.integration.test.ts

@@ -1,43 +0,0 @@
-/**
- * Test C — pgvector extension is functional end-to-end.
- *
- * Creates a temp table with a vector(3) column, inserts a row, and queries it
- * back — confirming the extension is not just registered but operational.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-pgvector.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import postgres from 'postgres';
-import { afterAll, describe, expect, it } from 'vitest';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-
-let sql: ReturnType<typeof postgres> | undefined;
-
-afterAll(async () => {
-  if (sql) {
-    await sql.end({ timeout: 2 }).catch(() => {});
-  }
-});
-
-describe.skipIf(!run)('federated pgvector — functional end-to-end', () => {
-  it('vector ops round-trip: INSERT [1,2,3] and SELECT returns [1,2,3]', async () => {
-    sql = postgres(PG_URL, { max: 1, connect_timeout: 5, idle_timeout: 5 });
-
-    await sql`CREATE TEMP TABLE t (id int, embedding vector(3))`;
-    await sql`INSERT INTO t VALUES (1, '[1,2,3]')`;
-    const rows = await sql`SELECT embedding FROM t`;
-
-    expect(rows).toHaveLength(1);
-    // The postgres driver returns vector columns as strings like '[1,2,3]'.
-    // Normalise by parsing the string representation.
-    const raw = rows[0]?.['embedding'] as string;
-    const parsed = JSON.parse(raw) as number[];
-    expect(parsed).toEqual([1, 2, 3]);
-  }, 10_000);
-});

apps/gateway/src/admin/admin-health.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get, Inject, UseGuards } from '@nestjs/common';
-import { sql, type Db } from '@mosaicstack/db';
+import { sql, type Db } from '@mosaic/db';
-import { createQueue } from '@mosaicstack/queue';
+import { createQueue } from '@mosaic/queue';
 import { DB } from '../database/database.module.js';
 import { AgentService } from '../agent/agent.service.js';
 import { ProviderService } from '../agent/provider.service.js';

apps/gateway/src/admin/admin-tokens.controller.ts

@@ -11,7 +11,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { randomBytes, createHash } from 'node:crypto';
-import { eq, type Db, adminTokens } from '@mosaicstack/db';
+import { eq, type Db, adminTokens } from '@mosaic/db';
 import { v4 as uuid } from 'uuid';
 import { DB } from '../database/database.module.js';
 import { AdminGuard } from './admin.guard.js';

apps/gateway/src/admin/admin.controller.ts

@@ -13,8 +13,8 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import { eq, type Db, users as usersTable } from '@mosaicstack/db';
+import { eq, type Db, users as usersTable } from '@mosaic/db';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
 import { AUTH } from '../auth/auth.tokens.js';
 import { DB } from '../database/database.module.js';
 import { AdminGuard } from './admin.guard.js';

apps/gateway/src/admin/admin.guard.ts

@@ -8,9 +8,9 @@ import {
 } from '@nestjs/common';
 import { createHash } from 'node:crypto';
 import { fromNodeHeaders } from 'better-auth/node';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
-import { eq, adminTokens, users as usersTable } from '@mosaicstack/db';
+import { eq, adminTokens, users as usersTable } from '@mosaic/db';
 import type { FastifyRequest } from 'fastify';
 import { AUTH } from '../auth/auth.tokens.js';
 import { DB } from '../database/database.module.js';

apps/gateway/src/admin/bootstrap.controller.ts

@@ -8,13 +8,12 @@ import {
   Post,
 } from '@nestjs/common';
 import { randomBytes, createHash } from 'node:crypto';
-import { count, eq, type Db, users as usersTable, adminTokens } from '@mosaicstack/db';
+import { count, eq, type Db, users as usersTable, adminTokens } from '@mosaic/db';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
 import { v4 as uuid } from 'uuid';
 import { AUTH } from '../auth/auth.tokens.js';
 import { DB } from '../database/database.module.js';
-import { BootstrapSetupDto } from './bootstrap.dto.js';
+import type { BootstrapSetupDto, BootstrapStatusDto, BootstrapResultDto } from './bootstrap.dto.js';
-import type { BootstrapStatusDto, BootstrapResultDto } from './bootstrap.dto.js';
 
 @Controller('api/bootstrap')
 export class BootstrapController {

apps/gateway/src/admin/bootstrap.e2e.spec.ts

@@ -1,190 +0,0 @@
-/**
- * E2E integration test — POST /api/bootstrap/setup
- *
- * Regression guard for the `import type { BootstrapSetupDto }` class-erasure
- * bug (IUV-M01, issue #436).
- *
- * When `BootstrapSetupDto` is imported with `import type`, TypeScript erases
- * the class at compile time. NestJS then sees `Object` as the `@Body()`
- * metatype, and ValidationPipe with `whitelist:true + forbidNonWhitelisted:true`
- * treats every property as non-whitelisted, returning:
- *
- *   400 { message: ["property email should not exist", "property password should not exist"] }
- *
- * The fix is a plain value import (`import { BootstrapSetupDto }`), which
- * preserves the class reference so Nest can read the class-validator decorators.
- *
- * This test MUST fail if `import type` is re-introduced on `BootstrapSetupDto`.
- * A controller unit test that constructs ValidationPipe manually won't catch
- * this — only the real DI binding path exercises the metatype lookup.
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, afterAll, beforeAll } from 'vitest';
-import { Test } from '@nestjs/testing';
-import { ValidationPipe, type INestApplication } from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import request from 'supertest';
-import { BootstrapController } from './bootstrap.controller.js';
-import type { BootstrapResultDto } from './bootstrap.dto.js';
-
-// ─── Minimal mock dependencies ───────────────────────────────────────────────
-
-/**
- * We use explicit `@Inject(AUTH)` / `@Inject(DB)` in the controller so we
- * can provide mock values by token without spinning up the real DB or Auth.
- */
-import { AUTH } from '../auth/auth.tokens.js';
-import { DB } from '../database/database.module.js';
-
-const MOCK_USER_ID = 'mock-user-id-001';
-
-const mockAuth = {
-  api: {
-    createUser: () =>
-      Promise.resolve({
-        user: {
-          id: MOCK_USER_ID,
-          name: 'Admin',
-          email: 'admin@example.com',
-        },
-      }),
-  },
-};
-
-// Override db.select() so the second query (verify user exists) returns a user.
-// The bootstrap controller calls select().from() twice:
-//   1. count() to check zero users  → returns [{total: 0}]
-//   2. select().where().limit()     → returns [the created user]
-let selectCallCount = 0;
-const mockDbWithUser = {
-  select: () => {
-    selectCallCount++;
-    return {
-      from: () => {
-        if (selectCallCount === 1) {
-          // First call: count — zero users
-          return Promise.resolve([{ total: 0 }]);
-        }
-        // Subsequent calls: return a mock user row
-        return {
-          where: () => ({
-            limit: () =>
-              Promise.resolve([
-                {
-                  id: MOCK_USER_ID,
-                  name: 'Admin',
-                  email: 'admin@example.com',
-                  role: 'admin',
-                },
-              ]),
-          }),
-        };
-      },
-    };
-  },
-  update: () => ({
-    set: () => ({
-      where: () => Promise.resolve([]),
-    }),
-  }),
-  insert: () => ({
-    values: () => ({
-      returning: () =>
-        Promise.resolve([
-          {
-            id: 'token-id-001',
-            label: 'Initial setup token',
-          },
-        ]),
-    }),
-  }),
-};
-
-// ─── Test suite ───────────────────────────────────────────────────────────────
-
-describe('POST /api/bootstrap/setup — ValidationPipe DTO binding', () => {
-  let app: INestApplication;
-
-  beforeAll(async () => {
-    selectCallCount = 0;
-
-    const moduleRef = await Test.createTestingModule({
-      controllers: [BootstrapController],
-      providers: [
-        { provide: AUTH, useValue: mockAuth },
-        { provide: DB, useValue: mockDbWithUser },
-      ],
-    }).compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-
-    // Mirror main.ts configuration exactly — this is what reproduced the 400.
-    app.useGlobalPipes(
-      new ValidationPipe({
-        whitelist: true,
-        forbidNonWhitelisted: true,
-        transform: true,
-      }),
-    );
-
-    await app.init();
-    // Fastify requires waiting for the adapter to be ready
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it('returns 201 (not 400) when a valid {name, email, password} body is sent', async () => {
-    const res = await request(app.getHttpServer())
-      .post('/api/bootstrap/setup')
-      .send({ name: 'Admin', email: 'admin@example.com', password: 'password123' })
-      .set('Content-Type', 'application/json');
-
-    // Before the fix (import type), Nest ValidationPipe returned 400 with
-    // "property email should not exist" / "property password should not exist"
-    // because the DTO class was erased and every field looked non-whitelisted.
-    expect(res.status).not.toBe(400);
-    expect(res.status).toBe(201);
-    const body = res.body as BootstrapResultDto;
-    expect(body.user).toBeDefined();
-    expect(body.user.email).toBe('admin@example.com');
-    expect(body.token).toBeDefined();
-    expect(body.token.plaintext).toBeDefined();
-  });
-
-  it('returns 400 when extra forbidden properties are sent', async () => {
-    // This proves ValidationPipe IS active and working (forbidNonWhitelisted).
-    const res = await request(app.getHttpServer())
-      .post('/api/bootstrap/setup')
-      .send({
-        name: 'Admin',
-        email: 'admin@example.com',
-        password: 'password123',
-        extraField: 'should-be-rejected',
-      })
-      .set('Content-Type', 'application/json');
-
-    expect(res.status).toBe(400);
-  });
-
-  it('returns 400 when email is invalid', async () => {
-    const res = await request(app.getHttpServer())
-      .post('/api/bootstrap/setup')
-      .send({ name: 'Admin', email: 'not-an-email', password: 'password123' })
-      .set('Content-Type', 'application/json');
-
-    expect(res.status).toBe(400);
-  });
-
-  it('returns 400 when password is too short', async () => {
-    const res = await request(app.getHttpServer())
-      .post('/api/bootstrap/setup')
-      .send({ name: 'Admin', email: 'admin@example.com', password: 'short' })
-      .set('Content-Type', 'application/json');
-
-    expect(res.status).toBe(400);
-  });
-});

apps/gateway/src/agent/__tests__/provider-adapters.test.ts

@@ -62,7 +62,7 @@ function restoreEnv(saved: Map<EnvKey, string | undefined>): void {
 }
 
 function makeRegistry(): ModelRegistry {
-  return ModelRegistry.inMemory(AuthStorage.inMemory());
+  return new ModelRegistry(AuthStorage.inMemory());
 }
 
 // ---------------------------------------------------------------------------

apps/gateway/src/agent/__tests__/routing.service.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { RoutingService } from '../routing.service.js';
-import type { ModelInfo } from '@mosaicstack/types';
+import type { ModelInfo } from '@mosaic/types';
 
 const mockModels: ModelInfo[] = [
   {

apps/gateway/src/agent/adapters/anthropic.adapter.ts

@@ -7,7 +7,7 @@ import type {
   IProviderAdapter,
   ModelInfo,
   ProviderHealth,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 
 /**
  * Anthropic provider adapter.

apps/gateway/src/agent/adapters/ollama.adapter.ts

@@ -6,7 +6,7 @@ import type {
   IProviderAdapter,
   ModelInfo,
   ProviderHealth,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 
 /** Embedding models that Ollama ships with out of the box */
 const OLLAMA_EMBEDDING_MODELS: ReadonlyArray<{

apps/gateway/src/agent/adapters/openai.adapter.ts

@@ -7,7 +7,7 @@ import type {
   IProviderAdapter,
   ModelInfo,
   ProviderHealth,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 
 /**
  * OpenAI provider adapter.

apps/gateway/src/agent/adapters/openrouter.adapter.ts

@@ -6,7 +6,7 @@ import type {
   IProviderAdapter,
   ModelInfo,
   ProviderHealth,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 
 const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 

apps/gateway/src/agent/adapters/zai.adapter.ts

@@ -6,7 +6,7 @@ import type {
   IProviderAdapter,
   ModelInfo,
   ProviderHealth,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 import { getModelCapability } from '../model-capabilities.js';
 
 /**

apps/gateway/src/agent/agent-configs.controller.ts

@@ -13,7 +13,7 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/agent/agent.service.ts

@@ -7,8 +7,8 @@ import {
   type AgentSessionEvent,
   type ToolDefinition,
 } from '@mariozechner/pi-coding-agent';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
-import type { Memory } from '@mosaicstack/memory';
+import type { Memory } from '@mosaic/memory';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
 import { EmbeddingService } from '../memory/embedding.service.js';

apps/gateway/src/agent/model-capabilities.ts

@@ -1,4 +1,4 @@
-import type { ModelCapability } from '@mosaicstack/types';
+import type { ModelCapability } from '@mosaic/types';
 
 /**
  * Comprehensive capability matrix for all target models.

apps/gateway/src/agent/provider-credentials.service.ts

@@ -1,7 +1,7 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
-import { providerCredentials, eq, and } from '@mosaicstack/db';
+import { providerCredentials, eq, and } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 import type { ProviderCredentialSummaryDto } from './provider-credentials.dto.js';
 

apps/gateway/src/agent/provider.service.ts

@@ -14,7 +14,7 @@ import type {
   ModelInfo,
   ProviderHealth,
   ProviderInfo,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 import {
   AnthropicAdapter,
   OllamaAdapter,
@@ -67,7 +67,7 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
 
   async onModuleInit(): Promise<void> {
     const authStorage = AuthStorage.inMemory();
-    this.registry = ModelRegistry.inMemory(authStorage);
+    this.registry = new ModelRegistry(authStorage);
 
     // Build the default set of adapters that rely on the registry
     this.adapters = [

apps/gateway/src/agent/providers.controller.ts

@@ -1,5 +1,5 @@
 import { Body, Controller, Delete, Get, Inject, Param, Post, UseGuards } from '@nestjs/common';
-import type { RoutingCriteria } from '@mosaicstack/types';
+import type { RoutingCriteria } from '@mosaic/types';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
 import { ProviderService } from './provider.service.js';

apps/gateway/src/agent/routing.service.ts

@@ -1,6 +1,6 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import type { ModelInfo } from '@mosaicstack/types';
+import type { ModelInfo } from '@mosaic/types';
-import type { RoutingCriteria, RoutingResult, CostTier } from '@mosaicstack/types';
+import type { RoutingCriteria, RoutingResult, CostTier } from '@mosaic/types';
 import { ProviderService } from './provider.service.js';
 
 /** Per-million-token cost thresholds for tier classification */

apps/gateway/src/agent/routing/default-rules.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
-import { routingRules, type Db, sql } from '@mosaicstack/db';
+import { routingRules, type Db, sql } from '@mosaic/db';
 import { DB } from '../../database/database.module.js';
 import type { RoutingCondition, RoutingAction } from './routing.types.js';
 

apps/gateway/src/agent/routing/routing-engine.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { routingRules, type Db, and, asc, eq, or } from '@mosaicstack/db';
+import { routingRules, type Db, and, asc, eq, or } from '@mosaic/db';
 import { DB } from '../../database/database.module.js';
 import { ProviderService } from '../provider.service.js';
 import { classifyTask } from './task-classifier.js';

apps/gateway/src/agent/routing/routing.controller.ts

@@ -13,7 +13,7 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import { routingRules, type Db, and, asc, eq, or, inArray } from '@mosaicstack/db';
+import { routingRules, type Db, and, asc, eq, or, inArray } from '@mosaic/db';
 import { DB } from '../../database/database.module.js';
 import { AuthGuard } from '../../auth/auth.guard.js';
 import { CurrentUser } from '../../auth/current-user.decorator.js';

apps/gateway/src/agent/routing/routing.types.ts

@@ -1,7 +1,7 @@
 /**
  * Routing engine types — M4-002 (condition types) and M4-003 (action types).
  *
- * These types are re-exported from `@mosaicstack/types` for shared use across packages.
+ * These types are re-exported from `@mosaic/types` for shared use across packages.
  */
 
 // ─── Classification primitives ───────────────────────────────────────────────
@@ -23,7 +23,7 @@ export type Domain = 'frontend' | 'backend' | 'devops' | 'docs' | 'general';
 
 /**
  * Cost tier for model selection.
- * Extends the existing `CostTier` in `@mosaicstack/types` with `local` for self-hosted models.
+ * Extends the existing `CostTier` in `@mosaic/types` with `local` for self-hosted models.
  */
 export type CostTier = 'cheap' | 'standard' | 'premium' | 'local';
 

apps/gateway/src/agent/tools/brain-tools.ts

@@ -1,6 +1,6 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 
 export function createBrainTools(brain: Brain): ToolDefinition[] {
   const listProjects: ToolDefinition = {

apps/gateway/src/agent/tools/memory-tools.ts

@@ -1,7 +1,7 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import type { Memory } from '@mosaicstack/memory';
+import type { Memory } from '@mosaic/memory';
-import type { EmbeddingProvider } from '@mosaicstack/memory';
+import type { EmbeddingProvider } from '@mosaic/memory';
 
 /**
  * Create memory tools bound to the session's authenticated userId.

apps/gateway/src/auth/auth.controller.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { toNodeHandler } from 'better-auth/node';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
 import type { NestFastifyApplication } from '@nestjs/platform-fastify';
 import { AUTH } from './auth.tokens.js';
 

apps/gateway/src/auth/auth.guard.ts

@@ -6,7 +6,7 @@ import {
   UnauthorizedException,
 } from '@nestjs/common';
 import { fromNodeHeaders } from 'better-auth/node';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
 import type { FastifyRequest } from 'fastify';
 import { AUTH } from './auth.tokens.js';
 

apps/gateway/src/auth/auth.module.ts

@@ -1,6 +1,6 @@
 import { Global, Module } from '@nestjs/common';
-import { createAuth, type Auth } from '@mosaicstack/auth';
+import { createAuth, type Auth } from '@mosaic/auth';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 import { AUTH } from './auth.tokens.js';
 import { SsoController } from './sso.controller.js';
@@ -14,7 +14,7 @@ import { SsoController } from './sso.controller.js';
       useFactory: (db: Db): Auth =>
         createAuth({
           db,
-          baseURL: process.env['BETTER_AUTH_URL'] ?? 'http://localhost:14242',
+          baseURL: process.env['BETTER_AUTH_URL'] ?? 'http://localhost:4000',
           secret: process.env['BETTER_AUTH_SECRET'],
         }),
       inject: [DB],

apps/gateway/src/auth/sso.controller.ts

@@ -1,5 +1,5 @@
 import { Controller, Get } from '@nestjs/common';
-import { buildSsoDiscovery, type SsoProviderDiscovery } from '@mosaicstack/auth';
+import { buildSsoDiscovery, type SsoProviderDiscovery } from '@mosaic/auth';
 
 @Controller('api/sso/providers')
 export class SsoController {

apps/gateway/src/brain/brain.module.ts

@@ -1,6 +1,6 @@
 import { Global, Module } from '@nestjs/common';
-import { createBrain, type Brain } from '@mosaicstack/brain';
+import { createBrain, type Brain } from '@mosaic/brain';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 import { BRAIN } from './brain.tokens.js';
 

apps/gateway/src/chat/chat.gateway.ts

@@ -11,15 +11,15 @@ import {
 } from '@nestjs/websockets';
 import { Server, Socket } from 'socket.io';
 import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import type {
   SetThinkingPayload,
   SlashCommandPayload,
   SystemReloadPayload,
   RoutingDecisionInfo,
   AbortPayload,
-} from '@mosaicstack/types';
+} from '@mosaic/types';
 import { AgentService, type ConversationHistoryMessage } from '../agent/agent.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
 import { BRAIN } from '../brain/brain.tokens.js';

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { CommandExecutorService } from './command-executor.service.js';
-import type { SlashCommandPayload } from '@mosaicstack/types';
+import type { SlashCommandPayload } from '@mosaic/types';
 
 // Minimal mock implementations
 const mockRegistry = {

apps/gateway/src/commands/command-executor.service.ts

@@ -1,7 +1,7 @@
 import { forwardRef, Inject, Injectable, Logger, Optional } from '@nestjs/common';
-import type { QueueHandle } from '@mosaicstack/queue';
+import type { QueueHandle } from '@mosaic/queue';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
-import type { SlashCommandPayload, SlashCommandResultPayload } from '@mosaicstack/types';
+import type { SlashCommandPayload, SlashCommandResultPayload } from '@mosaic/types';
 import { AgentService } from '../agent/agent.service.js';
 import { ChatGateway } from '../chat/chat.gateway.js';
 import { SessionGCService } from '../gc/session-gc.service.js';

apps/gateway/src/commands/command-registry.service.spec.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeEach } from 'vitest';
 import { CommandRegistryService } from './command-registry.service.js';
-import type { CommandDef } from '@mosaicstack/types';
+import type { CommandDef } from '@mosaic/types';
 
 const mockCmd: CommandDef = {
   name: 'test',

apps/gateway/src/commands/command-registry.service.ts

@@ -1,5 +1,5 @@
 import { Injectable, type OnModuleInit } from '@nestjs/common';
-import type { CommandDef, CommandManifest } from '@mosaicstack/types';
+import type { CommandDef, CommandManifest } from '@mosaic/types';
 
 @Injectable()
 export class CommandRegistryService implements OnModuleInit {

apps/gateway/src/commands/commands.integration.spec.ts

@@ -13,7 +13,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { CommandRegistryService } from './command-registry.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
-import type { SlashCommandPayload } from '@mosaicstack/types';
+import type { SlashCommandPayload } from '@mosaic/types';
 
 // ─── Mocks ───────────────────────────────────────────────────────────────────
 

apps/gateway/src/commands/commands.module.ts

@@ -1,5 +1,5 @@
 import { forwardRef, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
-import { createQueue, type QueueHandle } from '@mosaicstack/queue';
+import { createQueue, type QueueHandle } from '@mosaic/queue';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';

apps/gateway/src/config/config.module.ts

@@ -1,5 +1,5 @@
 import { Global, Module } from '@nestjs/common';
-import { loadConfig, type MosaicConfig } from '@mosaicstack/config';
+import { loadConfig, type MosaicConfig } from '@mosaic/config';
 
 export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
 

apps/gateway/src/conversations/conversations.controller.ts

@@ -15,7 +15,7 @@ import {
   Query,
   UseGuards,
 } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/coord/coord.service.ts

@@ -8,7 +8,7 @@ import {
   type MissionStatusSummary,
   type MissionTask,
   type TaskDetail,
-} from '@mosaicstack/coord';
+} from '@mosaic/coord';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 

apps/gateway/src/database/database.module.ts

@@ -2,9 +2,9 @@ import { mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { Global, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
-import { createDb, createPgliteDb, type Db, type DbHandle } from '@mosaicstack/db';
+import { createDb, createPgliteDb, type Db, type DbHandle } from '@mosaic/db';
-import { createStorageAdapter, type StorageAdapter } from '@mosaicstack/storage';
+import { createStorageAdapter, type StorageAdapter } from '@mosaic/storage';
-import type { MosaicConfig } from '@mosaicstack/config';
+import type { MosaicConfig } from '@mosaic/config';
 import { MOSAIC_CONFIG } from '../config/config.module.js';
 
 export const DB_HANDLE = 'DB_HANDLE';

apps/gateway/src/federation/scope-schema.spec.ts

@@ -1,187 +0,0 @@
-/**
- * Unit tests for FederationScopeSchema and parseFederationScope.
- *
- * Coverage:
- *  - Valid: minimal scope
- *  - Valid: full PRD §8.1 example
- *  - Valid: resources + excluded_resources (no overlap)
- *  - Invalid: empty resources
- *  - Invalid: unknown resource value
- *  - Invalid: resources / excluded_resources intersection
- *  - Invalid: filter key not in resources
- *  - Invalid: max_rows_per_query = 0
- *  - Invalid: max_rows_per_query = 10001
- *  - Invalid: not an object / null
- *  - Defaults: include_personal defaults to true; excluded_resources defaults to []
- *  - Sentinel: console.warn fires for sensitive resources
- */
-
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import {
-  parseFederationScope,
-  FederationScopeError,
-  FederationScopeSchema,
-} from './scope-schema.js';
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-describe('parseFederationScope — valid inputs', () => {
-  it('accepts a minimal scope (resources + max_rows_per_query only)', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks'],
-      max_rows_per_query: 100,
-    });
-    expect(scope.resources).toEqual(['tasks']);
-    expect(scope.max_rows_per_query).toBe(100);
-    expect(scope.excluded_resources).toEqual([]);
-    expect(scope.filters).toBeUndefined();
-  });
-
-  it('accepts the full PRD §8.1 example', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks', 'notes', 'memory'],
-      filters: {
-        tasks: { include_teams: ['team_uuid_1', 'team_uuid_2'], include_personal: true },
-        notes: { include_personal: true, include_teams: [] },
-        memory: { include_personal: true },
-      },
-      excluded_resources: ['credentials', 'api_keys'],
-      max_rows_per_query: 500,
-    });
-    expect(scope.resources).toEqual(['tasks', 'notes', 'memory']);
-    expect(scope.excluded_resources).toEqual(['credentials', 'api_keys']);
-    expect(scope.filters?.tasks?.include_teams).toEqual(['team_uuid_1', 'team_uuid_2']);
-    expect(scope.max_rows_per_query).toBe(500);
-  });
-
-  it('accepts a scope with excluded_resources and no filter overlap', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks', 'notes'],
-      excluded_resources: ['memory'],
-      max_rows_per_query: 250,
-    });
-    expect(scope.resources).toEqual(['tasks', 'notes']);
-    expect(scope.excluded_resources).toEqual(['memory']);
-  });
-});
-
-describe('parseFederationScope — defaults', () => {
-  it('defaults excluded_resources to []', () => {
-    const scope = parseFederationScope({ resources: ['tasks'], max_rows_per_query: 1 });
-    expect(scope.excluded_resources).toEqual([]);
-  });
-
-  it('defaults include_personal to true when filter is provided without it', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks'],
-      filters: { tasks: { include_teams: ['t1'] } },
-      max_rows_per_query: 10,
-    });
-    expect(scope.filters?.tasks?.include_personal).toBe(true);
-  });
-});
-
-describe('parseFederationScope — invalid inputs', () => {
-  it('throws FederationScopeError for empty resources array', () => {
-    expect(() => parseFederationScope({ resources: [], max_rows_per_query: 100 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for unknown resource value in resources', () => {
-    expect(() =>
-      parseFederationScope({ resources: ['unknown_resource'], max_rows_per_query: 100 }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws when resources and excluded_resources intersect', () => {
-    expect(() =>
-      parseFederationScope({
-        resources: ['tasks', 'memory'],
-        excluded_resources: ['memory'],
-        max_rows_per_query: 100,
-      }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws when filters references a resource not in resources', () => {
-    expect(() =>
-      parseFederationScope({
-        resources: ['tasks'],
-        filters: { notes: { include_personal: true } },
-        max_rows_per_query: 100,
-      }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws for max_rows_per_query = 0', () => {
-    expect(() => parseFederationScope({ resources: ['tasks'], max_rows_per_query: 0 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for max_rows_per_query = 10001', () => {
-    expect(() => parseFederationScope({ resources: ['tasks'], max_rows_per_query: 10001 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for null input', () => {
-    expect(() => parseFederationScope(null)).toThrow(FederationScopeError);
-  });
-
-  it('throws for non-object input (string)', () => {
-    expect(() => parseFederationScope('not-an-object')).toThrow(FederationScopeError);
-  });
-});
-
-describe('parseFederationScope — sentinel warning', () => {
-  it('emits console.warn when resources includes "credentials"', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({
-      resources: ['tasks', 'credentials'],
-      max_rows_per_query: 100,
-    });
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining(
-        '[FederationScope] WARNING: scope grants sensitive resource "credentials"',
-      ),
-    );
-  });
-
-  it('emits console.warn when resources includes "api_keys"', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({
-      resources: ['tasks', 'api_keys'],
-      max_rows_per_query: 100,
-    });
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining(
-        '[FederationScope] WARNING: scope grants sensitive resource "api_keys"',
-      ),
-    );
-  });
-
-  it('does NOT emit console.warn for non-sensitive resources', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({ resources: ['tasks', 'notes', 'memory'], max_rows_per_query: 100 });
-    expect(warnSpy).not.toHaveBeenCalled();
-  });
-});
-
-describe('FederationScopeSchema — boundary values', () => {
-  it('accepts max_rows_per_query = 1 (lower bound)', () => {
-    const result = FederationScopeSchema.safeParse({ resources: ['tasks'], max_rows_per_query: 1 });
-    expect(result.success).toBe(true);
-  });
-
-  it('accepts max_rows_per_query = 10000 (upper bound)', () => {
-    const result = FederationScopeSchema.safeParse({
-      resources: ['tasks'],
-      max_rows_per_query: 10000,
-    });
-    expect(result.success).toBe(true);
-  });
-});

apps/gateway/src/federation/scope-schema.ts

@@ -1,147 +0,0 @@
-/**
- * Federation grant scope schema and validator.
- *
- * Source of truth: docs/federation/PRD.md §8.1
- *
- * This module is intentionally pure — no DB, no NestJS, no CA wiring.
- * It is reusable from grant CRUD (M2-06) and scope enforcement (M3+).
- */
-
-import { z } from 'zod';
-
-// ---------------------------------------------------------------------------
-// Allowlist of federation resources (canonical — M3+ will extend this list)
-// ---------------------------------------------------------------------------
-export const FEDERATION_RESOURCE_VALUES = [
-  'tasks',
-  'notes',
-  'memory',
-  'credentials',
-  'api_keys',
-] as const;
-
-export type FederationResource = (typeof FEDERATION_RESOURCE_VALUES)[number];
-
-/**
- * Sensitive resources require explicit admin approval (PRD §8.4).
- * The parser warns when these appear in `resources`; M2-06 grant CRUD
- * will add a hard gate on top of this warning.
- */
-const SENSITIVE_RESOURCES: ReadonlySet<FederationResource> = new Set(['credentials', 'api_keys']);
-
-// ---------------------------------------------------------------------------
-// Sub-schemas
-// ---------------------------------------------------------------------------
-
-const ResourceArraySchema = z
-  .array(z.enum(FEDERATION_RESOURCE_VALUES))
-  .nonempty({ message: 'resources must contain at least one value' })
-  .refine((arr) => new Set(arr).size === arr.length, {
-    message: 'resources must not contain duplicate values',
-  });
-
-const ResourceFilterSchema = z.object({
-  include_teams: z.array(z.string()).optional(),
-  include_personal: z.boolean().default(true),
-});
-
-// ---------------------------------------------------------------------------
-// Top-level schema
-// ---------------------------------------------------------------------------
-
-export const FederationScopeSchema = z
-  .object({
-    resources: ResourceArraySchema,
-
-    excluded_resources: z
-      .array(z.enum(FEDERATION_RESOURCE_VALUES))
-      .default([])
-      .refine((arr) => new Set(arr).size === arr.length, {
-        message: 'excluded_resources must not contain duplicate values',
-      }),
-
-    filters: z.record(z.string(), ResourceFilterSchema).optional(),
-
-    max_rows_per_query: z
-      .number()
-      .int({ message: 'max_rows_per_query must be an integer' })
-      .min(1, { message: 'max_rows_per_query must be at least 1' })
-      .max(10000, { message: 'max_rows_per_query must be at most 10000' }),
-  })
-  .superRefine((data, ctx) => {
-    const resourceSet = new Set(data.resources);
-
-    // Intersection guard: a resource cannot be both granted and excluded
-    for (const r of data.excluded_resources) {
-      if (resourceSet.has(r)) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: `Resource "${r}" appears in both resources and excluded_resources`,
-          path: ['excluded_resources'],
-        });
-      }
-    }
-
-    // Filter keys must be a subset of resources
-    if (data.filters) {
-      for (const key of Object.keys(data.filters)) {
-        if (!resourceSet.has(key as FederationResource)) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: `filters key "${key}" references a resource not present in resources`,
-            path: ['filters', key],
-          });
-        }
-      }
-    }
-  });
-
-export type FederationScope = z.infer<typeof FederationScopeSchema>;
-
-// ---------------------------------------------------------------------------
-// Error class
-// ---------------------------------------------------------------------------
-
-export class FederationScopeError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'FederationScopeError';
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Typed parser
-// ---------------------------------------------------------------------------
-
-/**
- * Parse and validate an unknown value as a FederationScope.
- *
- * Throws `FederationScopeError` with aggregated Zod issues on failure.
- *
- * Emits `console.warn` when sensitive resources (`credentials`, `api_keys`)
- * are present in `resources` — per PRD §8.4, these require explicit admin
- * approval. M2-06 grant CRUD will add a hard gate on top of this warning.
- */
-export function parseFederationScope(input: unknown): FederationScope {
-  const result = FederationScopeSchema.safeParse(input);
-
-  if (!result.success) {
-    const issues = result.error.issues
-      .map((e) => `  - [${e.path.join('.') || 'root'}] ${e.message}`)
-      .join('\n');
-    throw new FederationScopeError(`Invalid federation scope:\n${issues}`);
-  }
-
-  const scope = result.data;
-
-  // Sentinel warning for sensitive resources (PRD §8.4)
-  for (const resource of scope.resources) {
-    if (SENSITIVE_RESOURCES.has(resource)) {
-      console.warn(
-        `[FederationScope] WARNING: scope grants sensitive resource "${resource}". Per PRD §8.4 this requires explicit admin approval and is logged.`,
-      );
-    }
-  }
-
-  return scope;
-}

apps/gateway/src/gc/gc.module.ts

@@ -1,5 +1,5 @@
 import { Module, type OnApplicationShutdown, Inject } from '@nestjs/common';
-import { createQueue, type QueueHandle } from '@mosaicstack/queue';
+import { createQueue, type QueueHandle } from '@mosaic/queue';
 import { SessionGCService } from './session-gc.service.js';
 import { REDIS } from './gc.tokens.js';
 

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { Logger } from '@nestjs/common';
-import type { QueueHandle } from '@mosaicstack/queue';
+import type { QueueHandle } from '@mosaic/queue';
-import type { LogService } from '@mosaicstack/log';
+import type { LogService } from '@mosaic/log';
 import { SessionGCService } from './session-gc.service.js';
 
 type MockRedis = {

apps/gateway/src/gc/session-gc.service.ts

@@ -1,6 +1,6 @@
 import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
-import type { QueueHandle } from '@mosaicstack/queue';
+import type { QueueHandle } from '@mosaic/queue';
-import type { LogService } from '@mosaicstack/log';
+import type { LogService } from '@mosaic/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
 import { REDIS } from './gc.tokens.js';
 

apps/gateway/src/log/log.controller.ts

@@ -1,5 +1,5 @@
 import { Body, Controller, Get, Inject, Param, Post, Query, UseGuards } from '@nestjs/common';
-import type { LogService } from '@mosaicstack/log';
+import type { LogService } from '@mosaic/log';
 import { LOG_SERVICE } from './log.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import type { IngestLogDto, QueryLogsDto } from './log.dto.js';

apps/gateway/src/log/log.module.ts

@@ -1,6 +1,6 @@
 import { Global, Module } from '@nestjs/common';
-import { createLogService, type LogService } from '@mosaicstack/log';
+import { createLogService, type LogService } from '@mosaic/log';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 import { LOG_SERVICE } from './log.tokens.js';
 import { LogController } from './log.controller.js';

apps/gateway/src/log/summarization.service.ts

@@ -1,11 +1,11 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import type { LogService } from '@mosaicstack/log';
+import type { LogService } from '@mosaic/log';
-import type { Memory } from '@mosaicstack/memory';
+import type { Memory } from '@mosaic/memory';
 import { LOG_SERVICE } from './log.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
 import { EmbeddingService } from '../memory/embedding.service.js';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
-import { sql, summarizationJobs } from '@mosaicstack/db';
+import { sql, summarizationJobs } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 
 const SUMMARIZATION_PROMPT = `You are a knowledge extraction assistant. Given the following agent interaction logs, extract the key decisions, learnings, and patterns. Output a concise summary (2-4 sentences) that captures the most important information for future reference. Focus on actionable insights, not raw events.

apps/gateway/src/main.ts

@@ -19,13 +19,11 @@ import { NestFactory } from '@nestjs/core';
 import { Logger, ValidationPipe } from '@nestjs/common';
 import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
 import helmet from '@fastify/helmet';
-import { listSsoStartupWarnings } from '@mosaicstack/auth';
+import { listSsoStartupWarnings } from '@mosaic/auth';
-import { loadConfig } from '@mosaicstack/config';
 import { AppModule } from './app.module.js';
 import { mountAuthHandler } from './auth/auth.controller.js';
 import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
-import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';
 
 async function bootstrap(): Promise<void> {
   const logger = new Logger('Bootstrap');
@@ -34,20 +32,6 @@ async function bootstrap(): Promise<void> {
     throw new Error('BETTER_AUTH_SECRET is required');
   }
 
-  // Pre-flight: assert all external services required by the configured tier
-  // are reachable. Runs before NestFactory.create() so failures are visible
-  // immediately with actionable remediation hints.
-  const mosaicConfig = loadConfig();
-  try {
-    await detectAndAssertTier(mosaicConfig);
-  } catch (err) {
-    if (err instanceof TierDetectionError) {
-      logger.error(`Tier detection failed: ${err.message}`);
-      logger.error(`Remediation: ${err.remediation}`);
-    }
-    throw err;
-  }
-
   for (const warning of listSsoStartupWarnings()) {
     logger.warn(warning);
   }
@@ -75,7 +59,7 @@ async function bootstrap(): Promise<void> {
   mountAuthHandler(app);
   mountMcpHandler(app, app.get(McpService));
 
-  const port = Number(process.env['GATEWAY_PORT'] ?? 14242);
+  const port = Number(process.env['GATEWAY_PORT'] ?? 4000);
   await app.listen(port, '0.0.0.0');
   logger.log(`Gateway listening on port ${port}`);
 }

apps/gateway/src/mcp/mcp.controller.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { Logger } from '@nestjs/common';
 import { fromNodeHeaders } from 'better-auth/node';
-import type { Auth } from '@mosaicstack/auth';
+import type { Auth } from '@mosaic/auth';
 import type { NestFastifyApplication } from '@nestjs/platform-fastify';
 import type { McpService } from './mcp.service.js';
 import { AUTH } from '../auth/auth.tokens.js';

apps/gateway/src/mcp/mcp.service.ts

@@ -3,8 +3,8 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
-import type { Memory } from '@mosaicstack/memory';
+import type { Memory } from '@mosaic/memory';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
 import { EmbeddingService } from '../memory/embedding.service.js';

apps/gateway/src/memory/embedding.service.ts

@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import type { EmbeddingProvider } from '@mosaicstack/memory';
+import type { EmbeddingProvider } from '@mosaic/memory';
 
 // ---------------------------------------------------------------------------
 // Environment-driven configuration

apps/gateway/src/memory/memory.controller.ts

@@ -12,7 +12,7 @@ import {
   Query,
   UseGuards,
 } from '@nestjs/common';
-import type { Memory } from '@mosaicstack/memory';
+import type { Memory } from '@mosaic/memory';
 import { MEMORY } from './memory.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/memory/memory.module.ts

@@ -5,10 +5,10 @@ import {
   createMemoryAdapter,
   type MemoryAdapter,
   type MemoryConfig,
-} from '@mosaicstack/memory';
+} from '@mosaic/memory';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
-import type { StorageAdapter } from '@mosaicstack/storage';
+import type { StorageAdapter } from '@mosaic/storage';
-import type { MosaicConfig } from '@mosaicstack/config';
+import type { MosaicConfig } from '@mosaic/config';
 import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { DB, STORAGE_ADAPTER } from '../database/database.module.js';
 import { MEMORY } from './memory.tokens.js';

apps/gateway/src/missions/missions.controller.ts

@@ -12,7 +12,7 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/plugin/plugin.module.ts

@@ -6,8 +6,8 @@ import {
   type OnModuleDestroy,
   type OnModuleInit,
 } from '@nestjs/common';
-import { DiscordPlugin } from '@mosaicstack/discord-plugin';
+import { DiscordPlugin } from '@mosaic/discord-plugin';
-import { TelegramPlugin } from '@mosaicstack/telegram-plugin';
+import { TelegramPlugin } from '@mosaic/telegram-plugin';
 import { PluginService } from './plugin.service.js';
 import type { IChannelPlugin } from './plugin.interface.js';
 import { PLUGIN_REGISTRY } from './plugin.tokens.js';
@@ -48,7 +48,7 @@ class TelegramChannelPluginAdapter implements IChannelPlugin {
   }
 }
 
-const DEFAULT_GATEWAY_URL = 'http://localhost:14242';
+const DEFAULT_GATEWAY_URL = 'http://localhost:4000';
 
 function createPluginRegistry(): IChannelPlugin[] {
   const plugins: IChannelPlugin[] = [];

apps/gateway/src/preferences/preferences.service.spec.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi } from 'vitest';
 import { PreferencesService, PLATFORM_DEFAULTS, IMMUTABLE_KEYS } from './preferences.service.js';
-import type { Db } from '@mosaicstack/db';
+import type { Db } from '@mosaic/db';
 
 /**
  * Build a mock Drizzle DB where the select chain supports:

apps/gateway/src/preferences/preferences.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { eq, and, sql, type Db, preferences as preferencesTable } from '@mosaicstack/db';
+import { eq, and, sql, type Db, preferences as preferencesTable } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 
 export const PLATFORM_DEFAULTS: Record<string, unknown> = {

apps/gateway/src/preferences/system-override.service.ts

@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { createQueue, type QueueHandle } from '@mosaicstack/queue';
+import { createQueue, type QueueHandle } from '@mosaic/queue';
 
 const SESSION_SYSTEM_KEY = (sessionId: string) => `mosaic:session:${sessionId}:system`;
 const SESSION_SYSTEM_FRAGMENTS_KEY = (sessionId: string) =>

apps/gateway/src/projects/projects.controller.ts

@@ -13,7 +13,7 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/queue/queue.module.ts

@@ -1,6 +1,6 @@
 import { Global, Module } from '@nestjs/common';
-import { createQueueAdapter, type QueueAdapter } from '@mosaicstack/queue';
+import { createQueueAdapter, type QueueAdapter } from '@mosaic/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
+import type { MosaicConfig } from '@mosaic/config';
 import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { QueueService } from './queue.service.js';
 

apps/gateway/src/queue/queue.service.ts

@@ -7,7 +7,7 @@ import {
   type OnModuleDestroy,
 } from '@nestjs/common';
 import { Queue, Worker, type Job, type ConnectionOptions } from 'bullmq';
-import type { LogService } from '@mosaicstack/log';
+import type { LogService } from '@mosaic/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
 import type { JobDto, JobStatus } from './queue-admin.dto.js';
 

apps/gateway/src/reload/reload.controller.ts

@@ -1,5 +1,5 @@
 import { Controller, HttpCode, HttpStatus, Inject, Post, UseGuards } from '@nestjs/common';
-import type { SystemReloadPayload } from '@mosaicstack/types';
+import type { SystemReloadPayload } from '@mosaic/types';
 import { AdminGuard } from '../admin/admin.guard.js';
 import { ChatGateway } from '../chat/chat.gateway.js';
 import { ReloadService } from './reload.service.js';

apps/gateway/src/reload/reload.service.ts

@@ -5,7 +5,7 @@ import {
   type OnApplicationBootstrap,
   type OnApplicationShutdown,
 } from '@nestjs/common';
-import type { SystemReloadPayload } from '@mosaicstack/types';
+import type { SystemReloadPayload } from '@mosaic/types';
 import { CommandRegistryService } from '../commands/command-registry.service.js';
 import { isMosaicPlugin } from './mosaic-plugin.interface.js';
 

apps/gateway/src/skills/skills.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { eq, type Db, skills } from '@mosaicstack/db';
+import { eq, type Db, skills } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 
 type Skill = typeof skills.$inferSelect;

apps/gateway/src/tasks/tasks.controller.ts

@@ -14,7 +14,7 @@ import {
   Query,
   UseGuards,
 } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';

apps/gateway/src/workspace/project-bootstrap.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import type { Brain } from '@mosaicstack/brain';
+import type { Brain } from '@mosaic/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { PluginService } from '../plugin/plugin.service.js';
 import { WorkspaceService } from './workspace.service.js';

apps/gateway/src/workspace/teams.service.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { eq, and, type Db, teams, teamMembers, projects } from '@mosaicstack/db';
+import { eq, and, type Db, teams, teamMembers, projects } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
 
 @Injectable()

apps/gateway/tsconfig.typecheck.json

@@ -4,15 +4,15 @@
     "rootDir": "../..",
     "baseUrl": ".",
     "paths": {
-      "@mosaicstack/auth": ["../../packages/auth/src/index.ts"],
+      "@mosaic/auth": ["../../packages/auth/src/index.ts"],
-      "@mosaicstack/brain": ["../../packages/brain/src/index.ts"],
+      "@mosaic/brain": ["../../packages/brain/src/index.ts"],
-      "@mosaicstack/coord": ["../../packages/coord/src/index.ts"],
+      "@mosaic/coord": ["../../packages/coord/src/index.ts"],
-      "@mosaicstack/db": ["../../packages/db/src/index.ts"],
+      "@mosaic/db": ["../../packages/db/src/index.ts"],
-      "@mosaicstack/log": ["../../packages/log/src/index.ts"],
+      "@mosaic/log": ["../../packages/log/src/index.ts"],
-      "@mosaicstack/memory": ["../../packages/memory/src/index.ts"],
+      "@mosaic/memory": ["../../packages/memory/src/index.ts"],
-      "@mosaicstack/types": ["../../packages/types/src/index.ts"],
+      "@mosaic/types": ["../../packages/types/src/index.ts"],
-      "@mosaicstack/discord-plugin": ["../../plugins/discord/src/index.ts"],
+      "@mosaic/discord-plugin": ["../../plugins/discord/src/index.ts"],
-      "@mosaicstack/telegram-plugin": ["../../plugins/telegram/src/index.ts"]
+      "@mosaic/telegram-plugin": ["../../plugins/telegram/src/index.ts"]
     }
   }
 }

apps/gateway/vitest.config.ts

@@ -1,4 +1,3 @@
-import swc from 'unplugin-swc';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
@@ -6,22 +5,4 @@ export default defineConfig({
     globals: true,
     environment: 'node',
   },
-  plugins: [
-    swc.vite({
-      jsc: {
-        parser: {
-          syntax: 'typescript',
-          decorators: true,
-        },
-        transform: {
-          decoratorMetadata: true,
-          legacyDecorator: true,
-        },
-        target: 'es2022',
-      },
-      module: {
-        type: 'nodenext',
-      },
-    }),
-  ],
 });

apps/web/next.config.ts

@@ -2,7 +2,7 @@ import type { NextConfig } from 'next';
 
 const nextConfig: NextConfig = {
   output: 'standalone',
-  transpilePackages: ['@mosaicstack/design-tokens'],
+  transpilePackages: ['@mosaic/design-tokens'],
 
   // Enable gzip/brotli compression for all responses.
   compress: true,

apps/web/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@mosaicstack/web",
+  "name": "@mosaic/web",
   "version": "0.0.2",
   "private": true,
   "scripts": {
@@ -12,7 +12,7 @@
     "start": "next start"
   },
   "dependencies": {
-    "@mosaicstack/design-tokens": "workspace:^",
+    "@mosaic/design-tokens": "workspace:^",
     "better-auth": "^1.5.5",
     "clsx": "^2.1.0",
     "next": "^16.0.0",

apps/web/playwright.config.ts

@@ -5,9 +5,9 @@ import { defineConfig, devices } from '@playwright/test';
  *
  * Assumes:
  *   - Next.js web app running on http://localhost:3000
- *   - NestJS gateway running on http://localhost:14242
+ *   - NestJS gateway running on http://localhost:4000
  *
- * Run with:   pnpm --filter @mosaicstack/web test:e2e
+ * Run with:   pnpm --filter @mosaic/web test:e2e
  */
 export default defineConfig({
   testDir: './e2e',

apps/web/src/lib/api.ts

@@ -1,4 +1,4 @@
-const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:4000';
 
 export interface ApiRequestInit extends Omit<RequestInit, 'body'> {
   body?: unknown;

apps/web/src/lib/auth-client.ts

@@ -2,7 +2,7 @@ import { createAuthClient } from 'better-auth/react';
 import { adminClient, genericOAuthClient } from 'better-auth/client/plugins';
 
 export const authClient = createAuthClient({
-  baseURL: process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242',
+  baseURL: process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:4000',
   plugins: [adminClient(), genericOAuthClient()],
 });
 

apps/web/src/lib/socket.ts

@@ -1,6 +1,6 @@
 import { io, type Socket } from 'socket.io-client';
 
-const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:14242';
+const GATEWAY_URL = process.env['NEXT_PUBLIC_GATEWAY_URL'] ?? 'http://localhost:4000';
 
 let socket: Socket | null = null;
 

deploy/portainer/README.md

@@ -1,70 +0,0 @@
-# deploy/portainer/
-
-Portainer stack templates for Mosaic Stack deployments.
-
-## Files
-
-| File                       | Purpose                                                                                                        |
-| -------------------------- | -------------------------------------------------------------------------------------------------------------- |
-| `federated-test.stack.yml` | Docker Swarm stack for federation end-to-end test instances (`mos-test-1.woltje.com`, `mos-test-2.woltje.com`) |
-
----
-
-## federated-test.stack.yml
-
-A self-contained Swarm stack that boots a federated-tier Mosaic gateway with co-located Postgres 17 (pgvector) and Valkey 8. This is a **test template** — production deployments will use a separate template with stricter resource limits and Docker secrets.
-
-### Deploy via Portainer UI
-
-1. Log into Portainer.
-2. Navigate to **Stacks → Add stack**.
-3. Set a stack name matching `STACK_NAME` below (e.g. `mos-test-1`).
-4. Choose **Web editor** and paste the contents of `federated-test.stack.yml`.
-5. Scroll to **Environment variables** and add each variable listed below.
-6. Click **Deploy the stack**.
-
-### Required environment variables
-
-| Variable             | Example                                 | Notes                                                    |
-| -------------------- | --------------------------------------- | -------------------------------------------------------- |
-| `STACK_NAME`         | `mos-test-1`                            | Unique per stack — used in Traefik router/service names. |
-| `HOST_FQDN`          | `mos-test-1.woltje.com`                 | Fully-qualified hostname served by this stack.           |
-| `POSTGRES_PASSWORD`  | _(generate randomly)_                   | Database password. Do **not** reuse between stacks.      |
-| `BETTER_AUTH_SECRET` | _(generate: `openssl rand -base64 32`)_ | BetterAuth session signing key.                          |
-| `BETTER_AUTH_URL`    | `https://mos-test-1.woltje.com`         | Public base URL of the gateway.                          |
-
-Optional variables (uncomment in the YAML or set in Portainer):
-
-| Variable                      | Notes                                                      |
-| ----------------------------- | ---------------------------------------------------------- |
-| `ANTHROPIC_API_KEY`           | Enable Claude models.                                      |
-| `OPENAI_API_KEY`              | Enable OpenAI models.                                      |
-| `OTEL_EXPORTER_OTLP_ENDPOINT` | Forward traces to a collector (e.g. `http://jaeger:4318`). |
-
-### Required external resources
-
-Before deploying, ensure the following exist on the Swarm:
-
-1. **`traefik-public` overlay network** — shared network Traefik uses to route traffic to stacks.
-   ```bash
-   docker network create --driver overlay --attachable traefik-public
-   ```
-2. **`letsencrypt` cert resolver** — configured in the Traefik Swarm stack. The stack template references `tls.certresolver=letsencrypt`; the name must match your Traefik config.
-3. **DNS A record** — `${HOST_FQDN}` must resolve to the Swarm ingress IP (or a Cloudflare-proxied address pointing there).
-
-### Deployed instances
-
-| Stack name   | HOST_FQDN               | Purpose                            |
-| ------------ | ----------------------- | ---------------------------------- |
-| `mos-test-1` | `mos-test-1.woltje.com` | DEPLOY-03 — first federation peer  |
-| `mos-test-2` | `mos-test-2.woltje.com` | DEPLOY-04 — second federation peer |
-
-### Image
-
-The gateway image is pinned by digest to `fed-v0.1.0-m1` (verified in DEPLOY-01). Update the digest in the YAML when promoting a new build — never use `:latest` or a mutable tag in Swarm.
-
-### Notes
-
-- This template boots a **vanilla M1-baseline gateway** in federated tier. Federation grants (Step-CA, mTLS) are M2+ scope and not included here.
-- Each stack gets its own Postgres volume (`postgres-data`) and Valkey volume (`valkey-data`) scoped to the stack name by Swarm.
-- `depends_on` is honoured by Compose but ignored by Swarm — healthchecks on Postgres and Valkey ensure the gateway retries until they are ready.

deploy/portainer/federated-test.stack.yml

@@ -1,160 +0,0 @@
-# deploy/portainer/federated-test.stack.yml
-#
-# Portainer / Docker Swarm stack template — federated-tier test instance
-#
-# PURPOSE
-#   Deploys a single federated-tier Mosaic gateway with co-located Postgres
-#   (pgvector) and Valkey for end-to-end federation testing. Intended for
-#   mos-test-1.woltje.com and mos-test-2.woltje.com (DEPLOY-03/04).
-#
-# REQUIRED ENV VARS (set per-stack in Portainer → Stacks → Environment variables)
-#   STACK_NAME          Unique name for Traefik router/service labels.
-#                       Examples: mos-test-1, mos-test-2
-#   HOST_FQDN           Fully-qualified domain name served by this stack.
-#                       Examples: mos-test-1.woltje.com, mos-test-2.woltje.com
-#   POSTGRES_PASSWORD   Database password — set per stack; do NOT commit a default.
-#   BETTER_AUTH_SECRET  Random 32-char string for BetterAuth session signing.
-#                       Generate: openssl rand -base64 32
-#   BETTER_AUTH_URL     Public gateway base URL, e.g. https://mos-test-1.woltje.com
-#
-# OPTIONAL ENV VARS (uncomment and set in Portainer to enable features)
-#   ANTHROPIC_API_KEY   sk-ant-...
-#   OPENAI_API_KEY      sk-...
-#   OTEL_EXPORTER_OTLP_ENDPOINT  http://<collector>:4318
-#   OTEL_SERVICE_NAME   (default: mosaic-gateway)
-#
-# REQUIRED EXTERNAL RESOURCES
-#   traefik-public      Docker overlay network — must exist before deploying.
-#                       Create: docker network create --driver overlay --attachable traefik-public
-#   letsencrypt         Traefik cert resolver configured on the Swarm manager.
-#   DNS A record        ${HOST_FQDN} → Swarm ingress IP (or Cloudflare proxy).
-#
-# IMAGE
-#   Pinned to sha-9f1a081 (main HEAD post-#488 Dockerfile fix). The previous
-#   pin (fed-v0.1.0-m1, sha256:9b72e2...) had a broken pnpm copy and could
-#   not resolve @mosaicstack/storage at runtime. The new digest was smoke-
-#   tested locally — gateway boots, imports resolve, tier-detector runs.
-#   Update digest here when promoting a new build.
-#
-# HEALTHCHECK NOTE (2026-04-21)
-#   Switched from busybox wget to node http.get on 127.0.0.1 (not localhost) to
-#   avoid IPv6 resolution issues on Alpine. Retries increased to 5 and
-#   start_period to 60s to cover the NestJS/GC cold-start window (~40-50s).
-#   restart_policy set to `any` so SIGTERM/clean-exit also triggers restart.
-#
-# NOTE: This is a TEST template — production deployments use a separate
-#       parameterised template with stricter resource limits and secrets.
-
-version: '3.9'
-
-services:
-  gateway:
-    image: git.mosaicstack.dev/mosaicstack/stack/gateway@sha256:1069117740e00ccfeba357cae38c43f3729fe5ae702740ce474f6512414d7c02
-    # Tag for human reference: sha-9f1a081 (post-#488 Dockerfile fix; smoke-tested locally)
-    environment:
-      # ── Tier ───────────────────────────────────────────────────────────────
-      MOSAIC_TIER: federated
-
-      # ── Database ───────────────────────────────────────────────────────────
-      DATABASE_URL: postgres://gateway:${POSTGRES_PASSWORD}@postgres:5432/mosaic
-
-      # ── Queue ──────────────────────────────────────────────────────────────
-      VALKEY_URL: redis://valkey:6379
-
-      # ── Gateway ────────────────────────────────────────────────────────────
-      GATEWAY_PORT: '3000'
-      GATEWAY_CORS_ORIGIN: https://${HOST_FQDN}
-
-      # ── Auth ───────────────────────────────────────────────────────────────
-      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
-      BETTER_AUTH_URL: https://${HOST_FQDN}
-
-      # ── Observability ──────────────────────────────────────────────────────
-      OTEL_SERVICE_NAME: ${STACK_NAME:-mosaic-gateway}
-      # OTEL_EXPORTER_OTLP_ENDPOINT: http://<collector>:4318
-
-      # ── AI Providers (uncomment to enable) ─────────────────────────────────
-      # ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
-      # OPENAI_API_KEY: ${OPENAI_API_KEY}
-    networks:
-      - federated-test
-      - traefik-public
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: any
-        delay: 5s
-        max_attempts: 3
-      labels:
-        - 'traefik.enable=true'
-        - 'traefik.docker.network=traefik-public'
-        - 'traefik.http.routers.${STACK_NAME}.rule=Host(`${HOST_FQDN}`)'
-        - 'traefik.http.routers.${STACK_NAME}.entrypoints=websecure'
-        - 'traefik.http.routers.${STACK_NAME}.tls=true'
-        - 'traefik.http.routers.${STACK_NAME}.tls.certresolver=letsencrypt'
-        - 'traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000'
-    healthcheck:
-      test:
-        - 'CMD'
-        - 'node'
-        - '-e'
-        - "require('http').get('http://127.0.0.1:3000/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 60s
-    depends_on:
-      - postgres
-      - valkey
-
-  postgres:
-    image: pgvector/pgvector:pg17
-    environment:
-      POSTGRES_USER: gateway
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: mosaic
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    networks:
-      - federated-test
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U gateway']
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 10s
-
-  valkey:
-    image: valkey/valkey:8-alpine
-    volumes:
-      - valkey-data:/data
-    networks:
-      - federated-test
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-    healthcheck:
-      test: ['CMD', 'valkey-cli', 'ping']
-      interval: 10s
-      timeout: 3s
-      retries: 5
-      start_period: 5s
-
-volumes:
-  postgres-data:
-  valkey-data:
-
-networks:
-  federated-test:
-    driver: overlay
-  traefik-public:
-    external: true

docker-compose.federated.yml

@@ -1,120 +0,0 @@
-# docker-compose.federated.yml — Federated tier overlay
-#
-# USAGE:
-#   docker compose -f docker-compose.federated.yml --profile federated up -d
-#
-# This file is a standalone overlay for the Mosaic federated tier.
-# It is NOT an extension of docker-compose.yml — it defines its own services
-# and named volumes so it can run independently of the base dev stack.
-#
-# IMPORTANT — HOST PORT CONFLICTS:
-#   The federated services bind the same host ports as the base dev stack
-#   (5433 for Postgres, 6380 for Valkey). You must stop the base dev stack
-#   before starting the federated stack on the same machine:
-#     docker compose down
-#     docker compose -f docker-compose.federated.yml --profile federated up -d
-#
-# pgvector extension:
-#   The vector extension is created automatically at first boot via
-#   ./infra/pg-init/01-extensions.sql (CREATE EXTENSION IF NOT EXISTS vector).
-#
-# Tier configuration:
-#   Used by `mosaic` instances configured with `tier: federated`.
-#   DEFAULT_FEDERATED_CONFIG points at:
-#     postgresql://mosaic:mosaic@localhost:5433/mosaic
-
-services:
-  postgres-federated:
-    image: pgvector/pgvector:pg17
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${PG_FEDERATED_HOST_PORT:-5433}:5432'
-    environment:
-      POSTGRES_USER: mosaic
-      POSTGRES_PASSWORD: mosaic
-      POSTGRES_DB: mosaic
-    volumes:
-      - pg_federated_data:/var/lib/postgresql/data
-      - ./infra/pg-init:/docker-entrypoint-initdb.d:ro
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U mosaic']
-      interval: 5s
-      timeout: 3s
-      retries: 5
-
-  valkey-federated:
-    image: valkey/valkey:8-alpine
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${VALKEY_FEDERATED_HOST_PORT:-6380}:6379'
-    volumes:
-      - valkey_federated_data:/data
-    healthcheck:
-      test: ['CMD', 'valkey-cli', 'ping']
-      interval: 5s
-      timeout: 3s
-      retries: 5
-
-  # ---------------------------------------------------------------------------
-  # Step-CA — Mosaic Federation internal certificate authority
-  #
-  # Image: pinned to 0.27.4 (latest stable as of late 2025).
-  # `latest` is forbidden per Mosaic image policy (immutable tag required for
-  # reproducible deployments and digest-first promotion in CI).
-  #
-  # Profile: `federated` — this service must not start in non-federated dev.
-  #
-  # Password:
-  #   Dev:  bind-mount ./infra/step-ca/dev-password (gitignored; copy from
-  #         ./infra/step-ca/dev-password.example and customise locally).
-  #   Prod: replace the bind-mount with a Docker secret:
-  #           secrets:
-  #             ca_password:
-  #               external: true
-  #         and reference it as `/run/secrets/ca_password` (same path the
-  #         init script already uses).
-  #
-  # Provisioner: "mosaic-fed" (consumed by apps/gateway/src/federation/ca.service.ts)
-  # ---------------------------------------------------------------------------
-  step-ca:
-    image: smallstep/step-ca:0.27.4
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${STEP_CA_HOST_PORT:-9000}:9000'
-    volumes:
-      - step_ca_data:/home/step
-      # init script — executed as the container entrypoint
-      - ./infra/step-ca/init.sh:/usr/local/bin/mosaic-step-ca-init.sh:ro
-      # X.509 template skeleton (wired in M2-04)
-      - ./infra/step-ca/templates:/etc/step-ca-templates:ro
-      # Dev password file — GITIGNORED; copy from dev-password.example
-      # In production, replace this with a Docker secret (see comment above).
-      - ./infra/step-ca/dev-password:/run/secrets/ca_password:ro
-    entrypoint: ['/bin/sh', '/usr/local/bin/mosaic-step-ca-init.sh']
-    healthcheck:
-      # The healthcheck requires the root cert to exist, which is only true
-      # after init.sh has completed on first boot. start_period gives init
-      # time to finish before Docker starts counting retries.
-      test:
-        [
-          'CMD',
-          'step',
-          'ca',
-          'health',
-          '--ca-url',
-          'https://localhost:9000',
-          '--root',
-          '/home/step/certs/root_ca.crt',
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-
-volumes:
-  pg_federated_data:
-  valkey_federated_data:
-  step_ca_data:

docker/gateway.Dockerfile

@@ -5,27 +5,18 @@ RUN corepack enable
 
 FROM base AS builder
 WORKDIR /app
-# Copy workspace manifests first for layer-cached install
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/gateway/package.json ./apps/gateway/
 COPY packages/ ./packages/
-COPY plugins/ ./plugins/
 RUN pnpm install --frozen-lockfile
 COPY . .
-# Build gateway and all of its workspace dependencies via turbo dependency graph
+RUN pnpm --filter @mosaic/gateway build
-RUN pnpm turbo run build --filter @mosaicstack/gateway...
-# Produce a self-contained deploy artifact: flat node_modules, no pnpm symlinks
-# --legacy is required for pnpm v10 when inject-workspace-packages is not set
-RUN pnpm --filter @mosaicstack/gateway --prod deploy --legacy /deploy
 
 FROM base AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
-COPY --from=builder /deploy/node_modules ./node_modules
-COPY --from=builder /deploy/package.json ./package.json
-# dist is declared in package.json "files" so pnpm deploy copies it into /deploy;
-# copy from builder explicitly as belt-and-suspenders
 COPY --from=builder /app/apps/gateway/dist ./dist
+COPY --from=builder /app/apps/gateway/package.json ./package.json
+COPY --from=builder /app/node_modules ./node_modules
 EXPOSE 4000
 CMD ["node", "dist/main.js"]

docs/MISSION-MANIFEST.md

@@ -1,116 +1,70 @@
-# Mission Manifest — MVP
+# Mission Manifest — Harness Foundation
 
-> Top-level rollup tracking Mosaic Stack MVP execution.
+> Persistent document tracking full mission scope, status, and session history.
-> Workstreams have their own manifests; this document is the source of truth for MVP scope, status, and history.
+> Updated by the orchestrator at each phase transition and milestone completion.
-> Owner: Orchestrator (sole writer).
 
 ## Mission
 
-**ID:** mvp-20260312
+**ID:** harness-20260321
-**Statement:** Ship a self-hosted, multi-user AI agent platform that consolidates the user's disparate jarvis-brain usage across home and USC workstations into a single coherent system reachable via three first-class surfaces — webUI, TUI, and CLI — with federation as the data-layer mechanism that makes cross-host agent sessions work in real time without copying user data across the boundary.
+**Statement:** Transform Mosaic Stack from a functional demo into a real multi-provider, task-routing AI harness. Persist all conversations, integrate frontier LLM providers (Anthropic, OpenAI, OpenRouter, Z.ai, Ollama), build granular task-aware agent routing, harden agent sessions, replace cron with BullMQ, and design the channel protocol for future Matrix/remote integration.
-**Phase:** Execution (workstream W1 in planning-complete state)
+**Phase:** Complete
-**Current Workstream:** W1 — Federation v1
+**Current Milestone:** All milestones done
-**Progress:** 0 / 1 declared workstreams complete (more workstreams will be declared as scope is refined)
+**Progress:** 7 / 7 milestones
-**Status:** active (continuous since 2026-03-13)
+**Status:** complete
-**Last Updated:** 2026-04-19 (manifest authored at the rollup level; install-ux-v2 archived; W1 federation planning landed via PR #468)
+**Last Updated:** 2026-03-22 UTC
-**Source PRD:** [docs/PRD.md](./PRD.md) — Mosaic Stack v0.1.0
-**Scratchpad:** [docs/scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md) (active since 2026-03-13; 14 prior sessions of phase-based execution)
-
-## Context
-
-Jarvis (v0.2.0) was a single-host Python/Next.js assistant. The user runs sessions across 3–4 workstations split between home and USC. Today every session reaches back to a single jarvis-brain checkout, which is brittle (offline-hostile, no consolidation, no shared state beyond a single repo). A prior OpenBrain attempt punished offline use, introduced cache/latency/opacity pain, and tightly coupled every session to a remote service.
-
-The MVP solution: keep each user's home gateway as the source of truth, connect gateways gateway-to-gateway over mTLS with scoped read-only data exposure, and expose the unified experience through three coherent surfaces:
-
-- **webUI** — the primary visual control plane (Next.js + React 19, `apps/web`)
-- **TUI** — the terminal-native interface for agent work (`packages/mosaic` wizard + Pi TUI)
-- **CLI** — `mosaic` command for scripted/headless workflows
-
-Federation is required NOW because it unblocks cross-host consolidation; it is necessary but not sufficient for MVP. Additional workstreams will be declared as their scope solidifies.
-
-## Prior Execution (March 13 → April 5)
-
-This manifest was authored on 2026-04-19 to rollup work that began 2026-03-13. Before this date, MVP work was tracked via phase-based Gitea milestones and the scratchpad — there was no rollup manifest at the `docs/MISSION-MANIFEST.md` path (the slot was occupied by sub-mission manifests for `install-ux-hardening` and then `install-ux-v2`).
-
-Prior execution outline (full detail in [scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md)):
-
-- **Phases 0 → 7** (Gitea milestones `ms-157` → `ms-164`, issues #1–#59): foundation, core API, agent layer, web dashboard, memory, remote control, CLI/tools, polish/beta. Substantially shipped by Session 13.
-- **Phase 8** (Gitea milestone `ms-165`, issues #160–#172): platform architecture extension — teams, workspaces, `/provider` OAuth, preferences, etc. Wave-based execution plan defined at Session 14.
-- **Sub-missions** during the gap: `install-ux-hardening` (complete, `mosaic-v0.0.25`), `install-ux-v2` (complete on 2026-04-19, `0.0.27` → `0.0.29`). Both archived under `docs/archive/missions/`.
-
-Going forward, MVP execution is tracked through the **Workstreams** table below. Phase-based issue numbering is preserved on Gitea but is no longer the primary control plane.
-
-## Cross-Cutting MVP Requirements
-
-These apply to every workstream and every milestone. A workstream cannot ship if it breaks any of them.
-
-| #      | Requirement                                                                                                                                                                      |
-| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| MVP-X1 | Three-surface parity: every user-facing capability is reachable via webUI **and** TUI **and** CLI (read paths at minimum; mutating paths where applicable to the surface).       |
-| MVP-X2 | Multi-tenant isolation is enforced at every boundary; no cross-user leakage under any circumstance.                                                                              |
-| MVP-X3 | Auth via BetterAuth (existing); SSO adapters per PRD; admin bootstrap remains a one-shot.                                                                                        |
-| MVP-X4 | Three quality gates green before push: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`.                                                                                       |
-| MVP-X5 | Federated tier (PG + pgvector + Valkey) is the canonical MVP deployment topology; local/standalone tiers continue to work for non-federated installs but are not the MVP target. |
-| MVP-X6 | OTEL tracing on every request path; `traceparent` propagated across the federation boundary in both directions.                                                                  |
-| MVP-X7 | Trunk merge strategy: branch from `main`, squash-merge via PR, never push to `main` directly.                                                                                    |
 
 ## Success Criteria
 
-The MVP is complete when ALL declared workstreams are complete AND every cross-cutting requirement is verifiable on a live two-host deployment (woltje.com ↔ uscllc.com).
+- [x] AC-1: Send messages in TUI → restart TUI → resume conversation → agent has full history and context
+- [x] AC-2: Route a coding task to Claude Opus 4.6, a simple question to Haiku, a summarization to GLM-5 — all via granular routing rules
+- [x] AC-3: Two users exist, User A's memory searches never return User B's data
+- [x] AC-4: `/model claude-sonnet-4-6` in TUI switches the active model for subsequent messages
+- [x] AC-5: `/agent coding-agent` in TUI switches to a different agent with different system prompt and tools
+- [x] AC-6: BullMQ jobs execute on schedule, failures retry with backoff, admin can inspect via `/api/admin/jobs`
+- [x] AC-7: Channel protocol document exists with Matrix integration points defined, reviewed, and approved
+- [x] AC-8: Embeddings run on Ollama local models (no external API dependency for vector operations)
+- [x] AC-9: All five providers (Anthropic, OpenAI, OpenRouter, Z.ai, Ollama) connect, list models, and complete chat requests
+- [x] AC-10: Routing transparency — TUI displays which model was selected and the routing reason for each response
 
-- [ ] AC-MVP-1: All declared workstreams reach `complete` status with merged PRs and green CI
+## Milestones
-- [ ] AC-MVP-2: A user session on the home gateway can transparently query work-gateway data subject to scope, with no data persisted across the boundary
-- [ ] AC-MVP-3: The same user-facing capability is reachable from webUI, TUI, and CLI (per MVP-X1)
-- [ ] AC-MVP-4: Two-gateway production deployment (woltje.com ↔ uscllc.com) operational ≥7 days without incident
-- [ ] AC-MVP-5: All cross-cutting requirements (MVP-X1 → MVP-X7) verified with evidence
-- [ ] AC-MVP-6: PRD `docs/PRD.md` "In Scope (v0.1.0 Beta)" list mapped to evidence (each item: shipped / explicitly deferred with rationale)
 
-## Workstreams
+| #   | ID     | Name                               | Status | Branch | Issue     | Started    | Completed  |
+| --- | ------ | ---------------------------------- | ------ | ------ | --------- | ---------- | ---------- |
+| 1   | ms-166 | Conversation Persistence & Context | done   | —      | #224–#231 | 2026-03-21 | 2026-03-21 |
+| 2   | ms-167 | Security & Isolation               | done   | —      | #232–#239 | 2026-03-21 | 2026-03-21 |
+| 3   | ms-168 | Provider Integration               | done   | —      | #240–#251 | 2026-03-21 | 2026-03-22 |
+| 4   | ms-169 | Agent Routing Engine               | done   | —      | #252–#264 | 2026-03-22 | 2026-03-22 |
+| 5   | ms-170 | Agent Session Hardening            | done   | —      | #265–#272 | 2026-03-22 | 2026-03-22 |
+| 6   | ms-171 | Job Queue Foundation               | done   | —      | #273–#280 | 2026-03-22 | 2026-03-22 |
+| 7   | ms-172 | Channel Protocol Design            | done   | —      | #281–#288 | 2026-03-22 | 2026-03-22 |
 
-| #   | ID  | Name                                        | Status            | Manifest                                                                | Notes                                               |
+## Deployment
-| --- | --- | ------------------------------------------- | ----------------- | ----------------------------------------------------------------------- | --------------------------------------------------- |
-| W1  | FED | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md) | 7 milestones, ~175K tokens, issues #460–#466 filed  |
-| W2+ | TBD | (additional workstreams declared as scoped) | —                 | —                                                                       | Scope creep is expected and explicitly accommodated |
 
-### Likely Additional Workstreams (Not Yet Declared)
+| Target               | URL       | Method                     |
+| -------------------- | --------- | -------------------------- |
+| Docker Compose (dev) | localhost | docker compose up          |
+| Production           | TBD       | Docker Swarm via Portainer |
 
-These are anticipated based on the PRD `In Scope` list but are NOT counted toward MVP completion until they have their own manifest, milestones, and tracking issues. Listed here so the orchestrator knows what's likely coming.
+## Coordination
 
-- Web dashboard parity with PRD scope (chat, tasks, projects, missions, agent status surfaces)
+- **Primary Agent:** claude-opus-4-6
-- Pi TUI integration for terminal-native agent work
+- **Sibling Agents:** sonnet (workers), haiku (verification)
-- CLI completeness for headless / scripted workflows that mirror webUI capability
+- **Shared Contracts:** docs/PRD-Harness_Foundation.md, docs/TASKS.md
-- Remote control plugins (Discord priority, then Telegram)
-- Multi-user / SSO finishing (BetterAuth + Authentik/WorkOS/Keycloak adapters per PRD)
-- LLM provider expansion (Anthropic, Codex, Z.ai, Ollama, LM Studio, llama.cpp) + routing matrix
-- MCP server/client capability + skill import interface
-- Brain (`@mosaicstack/brain`) as the structured data layer on PG + vector
 
-When any of these solidify into a real workstream, add a row to the Workstreams table, create a workstream-level manifest under `docs/{workstream}/MISSION-MANIFEST.md`, and file tracking issues.
+## Token Budget
 
-## Risks
+| Metric | Value  |
-
+| ------ | ------ |
-- **Scope creep is the named risk.** Workstreams will be added; the rule is that each must have its own manifest + milestones + acceptance criteria before it consumes execution capacity.
+| Budget | —      |
-- **Federation urgency vs. surface parity** — federation is being built first because it unblocks the user, but webUI/TUI/CLI parity (MVP-X1) cannot slip indefinitely. Track surface coverage explicitly when each workstream lands.
+| Used   | ~2.5M  |
-- **Three-surface fan-out** — the same capability exposed three ways multiplies test surface and design effort. Default to a shared API/contract layer, then thin surface adapters; resist surface-specific business logic.
+| Mode   | normal |
-- **Federated-tier dependency** — MVP requires PG + pgvector + Valkey; users on local/standalone tier cannot federate. This is intentional but must be communicated clearly in the wizard.
-
-## Out of Scope (MVP)
-
-- SaaS / multi-tenant revenue model — personal/family/team tool only
-- Mobile native apps — responsive web only
-- Public npm registry publishing — Gitea registry only
-- Voice / video agent interaction
-- Full OpenClaw feature parity — inspiration only
-- Calendar / GLPI / Woodpecker tooling integrations (deferred to post-MVP)
 
 ## Session History
 
-For sessions 1–14 (phase-based execution, 2026-03-13 → 2026-03-15), see [scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md). Sessions below are tracked at the rollup level.
+| Session | Runtime         | Started    | Duration | Ended Reason | Last Task         |
+| ------- | --------------- | ---------- | -------- | ------------ | ----------------- |
+| 1       | claude-opus-4-6 | 2026-03-21 | ~6h      | complete     | M7-008 — all done |
 
-| Session | Date       | Runtime | Outcome                                                                                                                                                                                                                                                                |
+## Scratchpad
-| ------- | ---------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| S15     | 2026-04-19 | claude  | MVP rollup manifest authored. Install-ux-v2 archived (IUV-M03 retroactively closed — shipped via PR #446 + releases 0.0.27 → 0.0.29). Federation v1 planning landed via PR #468. W1 manifest reachable at `docs/federation/MISSION-MANIFEST.md`. Next: kickoff FED-M1. |
 
-## Next Step
+Path: `docs/scratchpads/harness-20260321.md`
-
-Begin W1 / FED-M1 — federated tier infrastructure. Task breakdown lives at [docs/federation/TASKS.md](./federation/TASKS.md).

docs/PERFORMANCE.md

@@ -153,7 +153,7 @@ for any `<Image>` components added in the future.
 
 ```bash
 # Run the DB migration (requires a live DB)
-pnpm --filter @mosaicstack/db exec drizzle-kit migrate
+pnpm --filter @mosaic/db exec drizzle-kit migrate
 
 # Or, in Docker/Swarm — migrations run automatically on gateway startup
 # via runMigrations() in packages/db/src/migrate.ts

docs/PRD-TUI_Improvements.md

@@ -57,7 +57,7 @@ Multi-panel layout with keyboard navigation.
 
 - **Ink 5** (React for CLI) — already in deps
 - **Component architecture** — break monolithic `app.tsx` into composable components
-- **Typed Socket.IO events** — leverage `@mosaicstack/types` `ServerToClientEvents` / `ClientToServerEvents`
+- **Typed Socket.IO events** — leverage `@mosaic/types` `ServerToClientEvents` / `ClientToServerEvents`
 - **Local state only** (Wave 1) — cwd/branch read from `process.cwd()` and `git` at startup
 - **Gateway metadata** (future) — extend socket handshake or add REST endpoint for model info, token usage