scratchpads: 2026-08-17 fleet identity/comms/mosaic-tree continuation record

Anchors the sb-it-1-dt session's outputs in this repo so continuation
does not depend on jarvis-brain (P0, not retained): ~/.mosaic tree model
as-built (incl. fleet/agents store + *.env.generated overlays), decisions
register (MOSAIC-D-001/-02 pending ruling, tooling-migration direction,
watcher-provisioning-at-instantiation), #1295 pointers, sequenced open
work queue, and rules for tonight's homelab agents (lane next, #1280
attribution, evidence-file protection).

.woodpecker/ci-image.yml

@@ -22,9 +22,9 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}

.woodpecker/ci.yml

@@ -30,19 +30,6 @@ steps:
       # the baked pnpm store.
       - pnpm install --frozen-lockfile --prefer-offline
 
-  # ---------------------------------------------------------------------------
-  # The steps below (sanitization, upgrade-guard, typecheck, lint, format,
-  # test) are the COMPLETE mandatory verification set. SDLC-D-034 mirrors them
-  # one-for-one in the canonical terminal verification command — root
-  # `pnpm verify:release` (scripts/verify-release.mjs) — which the publish
-  # pipeline (.woodpecker/publish.yml `verify` step) runs before ANY publish
-  # effect. These lines stay direct (not routed through the runner) because the
-  # #1017 test-enumeration guard audits framework tool paths through THIS
-  # surface; scripts/verify-release.test.mjs enforces that the runner's stage
-  # table keeps matching these commands exactly, so the two cannot drift.
-  # ---------------------------------------------------------------------------
-
-  # Canonical verify:release stage `sanitization`.
   # Blocking gate: public framework package must contain no operator-specific
   # personal data or private $HOME defaults. Runs early (no node_modules needed).
   sanitization:
@@ -60,7 +47,6 @@ steps:
       # with everything it guards; this direct line keeps one instrument running.
       - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
 
-  # Canonical verify:release stage `upgrade-guard`.
   # Blocking gate (#791): a framework upgrade must never write or delete an
   # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
   # survives a keep-mode reseed byte-identical (with rsync present AND absent —
@@ -82,8 +68,6 @@ steps:
       - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
       - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
 
-  # Canonical verify:release stage `typecheck` — the same `pnpm typecheck`
-  # invocation (which runs the checkout preflight first, then turbo).
   typecheck:
     image: *node_image
     commands:
@@ -94,8 +78,7 @@ steps:
       - sanitization
       - upgrade-guard
 
-  # lint, format, and test are independent — run in parallel after typecheck.
-  # Each runs exactly its canonical verify:release stage command.
+  # lint, format, and test are independent — run in parallel after typecheck
   lint:
     image: *node_image
     commands:
@@ -112,12 +95,6 @@ steps:
     depends_on:
       - typecheck
 
-  # Canonical verify:release stage `test` — the `pnpm test` line below is the
-  # shared command; everything else in this step is PIPELINE-LEVEL
-  # prerequisite the canonical command expects its caller to provide (SDLC-D-034):
-  # the ci-postgres service + pg_isready wait + db:migrate (postgres path),
-  # `apk add openssl`, and the pinned pi install. None of those can move into
-  # the runner (it must also work locally on the PGlite path with no database).
   test:
     image: *node_image
     environment:

.woodpecker/publish.yml

@@ -1,19 +1,5 @@
 # Build, publish npm packages, and push Docker images
 # Runs on main for stable publishes and on next for integration-line prereleases/images
-#
-# SDLC-D-034 publish gate: every publish effect (publish-npm, publish-next-npm,
-# and every image build/push step) depends DIRECTLY on the `verify` step below.
-# `verify` (a) asserts the provider's commit identity matches the actual
-# checkout (CI_COMMIT_SHA == git rev-parse HEAD, fail closed on mismatch or
-# emptiness) and (b) runs the canonical terminal verification command
-# (`pnpm verify:release`), which mirrors the PR CI pipeline's complete
-# mandatory set (sanitization, upgrade-guard, preflight+typecheck, lint,
-# format:check, test, build) — see scripts/verify-release.mjs. A missing,
-# failed, skipped, cancelled, or inconclusive verification therefore skips the
-# dependent publish effects (fail closed). Path-filtered short-circuits may
-# skip publish EFFECTS (e.g. docs-only merges) but never bypass `verify` for a
-# publish that does run: `verify` itself carries no path filter.
-# scripts/verify-release.test.mjs enforces this DAG invariant at checkout time.
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
@@ -62,45 +48,6 @@ steps:
       # Resolve from the baked pnpm store instead of a cold network fetch.
       - pnpm install --frozen-lockfile --prefer-offline
 
-  # SDLC-D-034 exact-commit publish gate. No `when`/path filter on purpose: it
-  # runs for every event this pipeline serves so no publish effect can ever
-  # start without it. Fails closed on commit-identity mismatch (or either SHA
-  # being empty) and on any incomplete verification.
-  verify:
-    image: *node_image
-    commands:
-      - *enable_pnpm
-      # (a) Commit identity: the provider's claimed SHA must equal the actual
-      # checkout HEAD — verification of anything else must never authorize a
-      # publish of this commit.
-      - |
-        if [ -z "$CI_COMMIT_SHA" ]; then
-          echo "[verify] FATAL: CI_COMMIT_SHA is empty — cannot certify commit identity" >&2
-          exit 1
-        fi
-        CHECKOUT_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
-        if [ -z "$CHECKOUT_SHA" ]; then
-          echo "[verify] FATAL: git rev-parse HEAD returned nothing — cannot certify commit identity" >&2
-          exit 1
-        fi
-        if [ "$CI_COMMIT_SHA" != "$CHECKOUT_SHA" ]; then
-          echo "[verify] FATAL: provider commit ($CI_COMMIT_SHA) != checkout HEAD ($CHECKOUT_SHA)" >&2
-          exit 1
-        fi
-        echo "[verify] commit identity confirmed: $CHECKOUT_SHA"
-      # (b) Canonical terminal verification. Caller-provided prerequisites the
-      # runner expects (see .woodpecker/ci.yml comments): bash/rsync for the
-      # guard stages, openssl + the pinned pi binary for the test stage. git is
-      # baked into ci-base but re-asserted here so the identity check above can
-      # never silently depend on a stale baked image. DATABASE_URL is
-      # deliberately NOT set: the canonical command must hold on the PGlite
-      # path too and never sets or requires a database itself.
-      - apk add --no-cache bash rsync openssl git
-      - npm install -g @earendil-works/[email protected]
-      - pnpm verify:release
-    depends_on:
-      - install
-
   build:
     image: *node_image
     commands:
@@ -108,7 +55,6 @@ steps:
       - pnpm build
     depends_on:
       - install
-      - verify
 
   publish-npm:
     image: *node_image
@@ -168,7 +114,6 @@ steps:
         exit 1
     depends_on:
       - build
-      - verify
 
   publish-next-npm:
     image: *node_image
@@ -247,7 +192,6 @@ steps:
         echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
     depends_on:
       - build
-      - verify
 
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
@@ -261,7 +205,6 @@ steps:
   #     - bash scripts/publish-npmjs.sh
   #   depends_on:
   #     - build
-  #     - verify
   #   when:
   #     - event: [tag]
 
@@ -270,9 +213,9 @@ steps:
     when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -299,16 +242,15 @@ steps:
         /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
     depends_on:
       - build
-      - verify
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
     when: *main_image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -326,16 +268,15 @@ steps:
         /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
     depends_on:
       - build
-      - verify
 
   build-web:
     image: gcr.io/kaniko-project/executor:debug
     when: *main_image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -353,4 +294,3 @@ steps:
         /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
     depends_on:
       - build
-      - verify

README.md

@@ -138,9 +138,9 @@ mosaic brain tasks
 mosaic brain conversations
 
 # Agent forge pipeline
-mosaic forge run [--simulate]        # fails closed (FORGE_NO_EXECUTOR) with no executor wired; --simulate for typed simulated runs
+mosaic forge run
 mosaic forge status
-mosaic forge resume [--simulate]     # same fail-closed rule as forge run
+mosaic forge resume
 mosaic forge personas
 
 # Structured logging

apps/gateway/src/__tests__/cross-user-isolation.test.ts

@@ -190,13 +190,7 @@ beforeEach((ctx) => {
 });
 
 afterAll(async () => {
-  // Cleanup only when the fixture actually installed rows. `handle` is set
-  // before the first query (createDb connects lazily), so on an unreachable
-  // database `handle` is truthy while nothing was inserted — cleanup must
-  // honor `dbAvailable` or the skip path fails the file with ECONNREFUSED in
-  // afterAll (caught live by the publish pipeline's no-DATABASE_URL verify
-  // step, pipeline 2486).
-  if (!handle || !dbAvailable) return;
+  if (!handle) return;
   const db = handle.db;
 
   // Delete in dependency order (FK constraints)

apps/web/src/components/freshness/freshness-notices.tsx

@@ -1,110 +0,0 @@
-'use client';
-
-import type { ReactElement } from 'react';
-import { formatAge, type FreshnessLabel } from '@/lib/freshness/model';
-
-/**
- * Rendering rules for non-current freshness states (RI-5-001).
- *
- * - `unavailable` renders an explicit failure panel — never an empty
- *   healthy collection.
- * - `stale` may render last-known data, but only under a visible label
- *   carrying source identity, snapshot version, and age.
- * - `partial` renders the verified parts plus an explicit list of what is
- *   missing.
- */
-
-interface RetryableNoticeProps {
-  readonly onRetry?: () => void;
-  readonly retryLabel?: string;
-}
-
-function RetryButton({ onRetry, retryLabel }: RetryableNoticeProps): ReactElement | null {
-  if (!onRetry) return null;
-  return (
-    <button
-      type="button"
-      onClick={onRetry}
-      className="mt-2 rounded-lg border border-surface-border px-3 py-1.5 text-xs transition-colors hover:border-gray-500"
-    >
-      {retryLabel ?? 'Retry'}
-    </button>
-  );
-}
-
-export interface UnavailableDataNoticeProps extends RetryableNoticeProps {
-  /** What is unavailable, e.g. "Tasks". */
-  readonly title: string;
-  /** Optional underlying failure detail (network message, invalidation reason). */
-  readonly detail?: string | null;
-}
-
-/** Explicit `unavailable` state. Never renders as an empty healthy collection. */
-export function UnavailableDataNotice({
-  title,
-  detail,
-  onRetry,
-  retryLabel,
-}: UnavailableDataNoticeProps): ReactElement {
-  return (
-    <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
-      <p className="font-medium text-text-primary">{title} are unavailable</p>
-      <p className="mt-1 text-text-muted">
-        This is not an empty result — the data could not be verified from the gateway.
-        {detail ? ` ${detail}` : ''}
-      </p>
-      <RetryButton onRetry={onRetry} retryLabel={retryLabel} />
-    </div>
-  );
-}
-
-export interface StaleDataNoticeProps extends RetryableNoticeProps {
-  /** Provenance of the last-known snapshot being displayed. */
-  readonly label: FreshnessLabel;
-}
-
-/**
- * Situational-awareness banner for `stale` data: last-known data may render,
- * but visibly labeled with source identity, snapshot version, and age.
- */
-export function StaleDataNotice({
-  label,
-  onRetry,
-  retryLabel,
-}: StaleDataNoticeProps): ReactElement {
-  return (
-    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
-      <p className="font-medium text-warning">Showing last-known data — it may be out of date</p>
-      <p className="mt-1 text-xs text-text-muted">
-        Source {label.source} · snapshot v{label.version} · fetched{' '}
-        {formatAge(label.fetchedAt, Date.now())}. Verdicts derived from this data are unknown and
-        changes are disabled until it is revalidated.
-      </p>
-      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
-    </div>
-  );
-}
-
-export interface PartialDataNoticeProps extends RetryableNoticeProps {
-  /** Display names of the sections whose collections are unavailable. */
-  readonly missing: readonly string[];
-}
-
-/** `partial` surface banner: verified parts render, missing parts are explicit. */
-export function PartialDataNotice({
-  missing,
-  onRetry,
-  retryLabel,
-}: PartialDataNoticeProps): ReactElement {
-  return (
-    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
-      <p className="font-medium text-warning">Some data could not be loaded</p>
-      <p className="mt-1 text-xs text-text-muted">
-        {missing.join(', ')} {missing.length === 1 ? 'is' : 'are'} unavailable — sections below show
-        an explicit unavailable state instead of an empty list. Derived verdicts remain unknown
-        until every collection is revalidated.
-      </p>
-      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
-    </div>
-  );
-}

apps/web/src/lib/freshness/model.spec.ts

@@ -1,324 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { Task } from '@/lib/types';
-import {
-  acceptSnapshot,
-  assertMutable,
-  canMutate,
-  combineFreshness,
-  computeDigest,
-  computeFreshness,
-  DEFAULT_FRESHNESS_POLICY,
-  formatAge,
-  type FreshSnapshot,
-  invalidationReasonLabels,
-  StaleMutationError,
-  UNKNOWN_VERDICT,
-  verdictValue,
-} from './model';
-import { validateProjectCollection, validateTaskCollection } from './validators';
-
-const NOW = 1_800_000_000_000;
-
-const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
-
-const taskPayload: Task[] = [
-  {
-    id: 'task-1',
-    title: 'T1',
-    description: null,
-    status: 'not-started',
-    priority: 'high',
-    projectId: 'project-1',
-    missionId: null,
-    assignee: null,
-    tags: null,
-    dueDate: null,
-    metadata: null,
-    createdAt: '2026-08-01T00:00:00.000Z',
-    updatedAt: '2026-08-01T00:00:00.000Z',
-  },
-];
-
-function acceptedTaskSnapshot(
-  overrides: Partial<FreshSnapshot<typeof taskPayload>> = {},
-): FreshSnapshot<typeof taskPayload> {
-  const result = acceptSnapshot({
-    value: taskPayload,
-    validate: validateTaskCollection,
-    previous: null,
-    policy,
-    source: 'gateway:/api/tasks',
-    now: NOW,
-  });
-  if (result.outcome !== 'accepted') {
-    throw new Error(`fixture setup failed: ${result.reason}`);
-  }
-  return { ...result.snapshot, ...overrides };
-}
-
-describe('computeFreshness', () => {
-  it('treats a missing snapshot as unavailable, never as an empty healthy collection', () => {
-    expect(computeFreshness({ snapshot: null, policy, now: NOW })).toBe('unavailable');
-  });
-
-  it('returns current for a fresh verified snapshot regardless of data emptiness', () => {
-    const empty = acceptSnapshot({
-      value: [],
-      validate: validateTaskCollection,
-      previous: null,
-      policy,
-      source: 'gateway:/api/tasks',
-      now: NOW,
-    });
-    if (empty.outcome !== 'accepted') throw new Error('expected acceptance');
-    expect(computeFreshness({ snapshot: empty.snapshot, policy, now: NOW })).toBe('current');
-  });
-
-  it('degrades to stale once the snapshot ages past staleAfterMs', () => {
-    const snapshot = acceptedTaskSnapshot();
-    expect(computeFreshness({ snapshot, policy, now: NOW + 60_001 })).toBe('stale');
-    expect(computeFreshness({ snapshot, policy, now: NOW + 59_999 })).toBe('current');
-  });
-
-  it('degrades to stale when the latest revalidation failed', () => {
-    const snapshot = acceptedTaskSnapshot();
-    expect(computeFreshness({ snapshot, policy, now: NOW, degraded: true })).toBe('stale');
-  });
-});
-
-describe('mutation guard', () => {
-  it('permits mutations only on current data', () => {
-    expect(canMutate('current')).toBe(true);
-    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
-      expect(canMutate(state)).toBe(false);
-    }
-  });
-
-  it('refuses mutations on non-current data via assertMutable', () => {
-    expect(() => assertMutable('current')).not.toThrow();
-    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
-      let thrown: unknown;
-      try {
-        assertMutable(state);
-      } catch (caught) {
-        thrown = caught;
-      }
-      expect(thrown).toBeInstanceOf(StaleMutationError);
-      expect(thrown).toBeInstanceOf(Error);
-      if (thrown instanceof StaleMutationError) {
-        expect(thrown.name).toBe('StaleMutationError');
-        expect(thrown.freshness).toBe(state);
-        expect(thrown.message).toContain(state);
-        expect(thrown.message).toContain('revalidat');
-      }
-    }
-  });
-});
-
-describe('acceptSnapshot', () => {
-  it('accepts a valid payload with provenance', () => {
-    const result = acceptSnapshot({
-      value: taskPayload,
-      validate: validateTaskCollection,
-      previous: null,
-      policy,
-      source: 'gateway:/api/tasks',
-      now: NOW,
-    });
-    expect(result.outcome).toBe('accepted');
-    if (result.outcome !== 'accepted') return;
-    expect(result.snapshot.source).toBe('gateway:/api/tasks');
-    expect(result.snapshot.version).toBe(1);
-    expect(result.snapshot.fetchedAt).toBe(NOW);
-    expect(result.snapshot.data).toEqual(taskPayload);
-  });
-
-  it('invalidates a schema-mismatched payload instead of rendering it', () => {
-    const result = acceptSnapshot({
-      value: { not: 'an array' },
-      validate: validateTaskCollection,
-      previous: acceptedTaskSnapshot(),
-      policy,
-      source: 'gateway:/api/tasks',
-      now: NOW,
-    });
-    expect(result).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
-    expect(invalidationReasonLabels['schema-mismatch']).toContain('schema');
-  });
-
-  it('invalidates cross-workspace payloads', () => {
-    const userOne = acceptSnapshot({
-      value: [
-        {
-          id: 'p1',
-          name: 'P1',
-          description: null,
-          status: 'active',
-          userId: 'user-1',
-          metadata: null,
-          createdAt: '2026-08-01T00:00:00.000Z',
-          updatedAt: '2026-08-01T00:00:00.000Z',
-        },
-      ],
-      validate: validateProjectCollection,
-      previous: null,
-      policy,
-      source: 'gateway:/api/projects',
-      now: NOW,
-    });
-    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
-
-    const switched = acceptSnapshot({
-      value: [
-        {
-          id: 'p9',
-          name: 'P9',
-          description: null,
-          status: 'active',
-          userId: 'user-2',
-          metadata: null,
-          createdAt: '2026-08-01T00:00:00.000Z',
-          updatedAt: '2026-08-01T00:00:00.000Z',
-        },
-      ],
-      validate: validateProjectCollection,
-      previous: userOne.snapshot,
-      policy,
-      source: 'gateway:/api/projects',
-      now: NOW,
-    });
-    expect(switched).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
-  });
-
-  it('keeps the previous workspace for collections with no intrinsic identity', () => {
-    const userOne = acceptSnapshot({
-      value: [
-        {
-          id: 'p1',
-          name: 'P1',
-          description: null,
-          status: 'active',
-          userId: 'user-1',
-          metadata: null,
-          createdAt: '2026-08-01T00:00:00.000Z',
-          updatedAt: '2026-08-01T00:00:00.000Z',
-        },
-      ],
-      validate: validateProjectCollection,
-      previous: null,
-      policy,
-      source: 'gateway:/api/projects',
-      now: NOW,
-    });
-    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
-
-    // Empty list after the user deleted every project: no identity to check,
-    // so the verified scope is retained and the empty state stays healthy.
-    const emptied = acceptSnapshot({
-      value: [],
-      validate: validateProjectCollection,
-      previous: userOne.snapshot,
-      policy,
-      source: 'gateway:/api/projects',
-      now: NOW,
-    });
-    expect(emptied.outcome).toBe('accepted');
-    if (emptied.outcome === 'accepted') {
-      expect(emptied.snapshot.data).toEqual([]);
-      expect(emptied.snapshot.workspace).toBe('user-1');
-    }
-  });
-
-  it('invalidates version regressions', () => {
-    const previous = acceptedTaskSnapshot({ version: 7 });
-    const regressed = acceptSnapshot({
-      value: taskPayload,
-      validate: validateTaskCollection,
-      previous,
-      policy,
-      source: 'gateway:/api/tasks',
-      now: NOW,
-      incomingVersion: 3,
-    });
-    expect(regressed).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
-
-    const newerSchema = acceptedTaskSnapshot({ schemaVersion: 4 });
-    const downgradedClient = acceptSnapshot({
-      value: taskPayload,
-      validate: validateTaskCollection,
-      previous: newerSchema,
-      policy: { ...policy, schemaVersion: 2 },
-      source: 'gateway:/api/tasks',
-      now: NOW,
-    });
-    expect(downgradedClient).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
-  });
-
-  it('increments the version monotonically across accepted snapshots', () => {
-    const first = acceptedTaskSnapshot();
-    const second = acceptSnapshot({
-      value: taskPayload,
-      validate: validateTaskCollection,
-      previous: first,
-      policy,
-      source: 'gateway:/api/tasks',
-      now: NOW,
-    });
-    expect(second.outcome).toBe('accepted');
-    if (second.outcome === 'accepted') {
-      expect(second.snapshot.version).toBe(first.version + 1);
-    }
-  });
-});
-
-describe('combineFreshness', () => {
-  it('gates the surface on the primary collection', () => {
-    expect(combineFreshness('unavailable', ['current'])).toBe('unavailable');
-    expect(combineFreshness('unknown', ['current'])).toBe('unknown');
-    expect(combineFreshness('current', [])).toBe('current');
-  });
-
-  it('degrades to partial when a secondary is unavailable', () => {
-    expect(combineFreshness('current', ['current', 'unavailable'])).toBe('partial');
-  });
-
-  it('degrades to unknown while a secondary is still loading', () => {
-    expect(combineFreshness('current', ['unknown'])).toBe('unknown');
-  });
-
-  it('degrades to stale when any collection is stale', () => {
-    expect(combineFreshness('current', ['stale'])).toBe('stale');
-    expect(combineFreshness('stale', ['current'])).toBe('stale');
-  });
-
-  it('propagates partial secondaries', () => {
-    expect(combineFreshness('current', ['partial'])).toBe('partial');
-  });
-});
-
-describe('computeDigest', () => {
-  it('is stable across key order and changes with data', () => {
-    const a = computeDigest({ x: 1, y: [1, 2] });
-    const b = computeDigest({ y: [1, 2], x: 1 });
-    expect(a).toBe(b);
-    expect(computeDigest({ x: 1, y: [1, 3] })).not.toBe(a);
-  });
-});
-
-describe('verdictValue', () => {
-  it('returns the value only for verified inputs', () => {
-    expect(verdictValue(true, '5')).toBe('5');
-    expect(verdictValue(false, '5')).toBe(UNKNOWN_VERDICT);
-    expect(verdictValue(false, '5')).not.toBe('5');
-  });
-});
-
-describe('formatAge', () => {
-  it('labels age in human terms', () => {
-    expect(formatAge(NOW, NOW)).toBe('just now');
-    expect(formatAge(NOW, NOW + 15_000)).toBe('under a minute ago');
-    expect(formatAge(NOW, NOW + 120_000)).toBe('2m ago');
-    expect(formatAge(NOW, NOW + 3 * 3_600_000)).toBe('3h ago');
-    expect(formatAge(NOW, NOW + 2 * 86_400_000)).toBe('2d ago');
-  });
-});

apps/web/src/lib/freshness/model.ts

@@ -1,261 +0,0 @@
-/**
- * Typed freshness model for gateway-fetched collections (RI-5-001).
- *
- * A failed or stale fetch must never be indistinguishable from an empty
- * healthy collection. Every fetched surface carries an explicit freshness
- * state, a verified snapshot identity (source, workspace, version, age), and
- * a mutation guard that refuses state-changing operations unless the data is
- * verified current.
- */
-
-/** Freshness states for fetched data. Never inferred from emptiness. */
-export type FreshnessState = 'current' | 'stale' | 'partial' | 'unknown' | 'unavailable';
-
-/**
- * Reasons a snapshot is invalidated. An invalidated snapshot is treated as
- * unavailable and is never rendered as current.
- */
-export type InvalidationReason =
-  | 'cache-corruption'
-  | 'cross-workspace'
-  | 'schema-mismatch'
-  | 'version-regression';
-
-/** Human-readable labels for invalidation reasons (UI + error messages). */
-export const invalidationReasonLabels: Record<InvalidationReason, string> = {
-  'cache-corruption': 'cached snapshot failed integrity checks',
-  'cross-workspace': 'data belongs to a different workspace',
-  'schema-mismatch': 'response did not match the expected schema',
-  'version-regression': 'snapshot version regressed below the accepted version',
-};
-
-/** A verified snapshot of fetched data with full provenance. */
-export interface FreshSnapshot<T> {
-  readonly data: T;
-  /** Source identity of the fetch, e.g. `gateway:/api/tasks`. */
-  readonly source: string;
-  /** Workspace scope the data belongs to. */
-  readonly workspace: string;
-  /** Monotonic snapshot sequence number for this surface. */
-  readonly version: number;
-  /** Schema version of the validator that accepted this snapshot. */
-  readonly schemaVersion: number;
-  /** Epoch ms at which the data was verified. */
-  readonly fetchedAt: number;
-  /** Integrity digest of `data`, used to detect cache corruption. */
-  readonly digest: string;
-}
-
-/** Provenance label rendered next to last-known data. */
-export interface FreshnessLabel {
-  readonly source: string;
-  readonly version: number;
-  readonly fetchedAt: number;
-}
-
-/** Policy governing freshness for a surface. */
-export interface FreshnessPolicy {
-  /** Active workspace scope. Snapshots from other scopes are invalidated. */
-  readonly workspace: string;
-  /** Schema version of the current validator. */
-  readonly schemaVersion: number;
-  /** Age after which a verified snapshot degrades from current to stale. */
-  readonly staleAfterMs: number;
-}
-
-export const DEFAULT_FRESHNESS_POLICY: FreshnessPolicy = {
-  workspace: 'default',
-  schemaVersion: 1,
-  staleAfterMs: 60_000,
-};
-
-/** Payload returned by a successful schema validation. */
-export interface FreshPayload<T> {
-  readonly data: T;
-  /**
-   * Workspace identity extracted from the payload itself when the collection
-   * carries one (e.g. a uniform `userId` on projects). `null` when the
-   * collection has no intrinsic workspace identity.
-   */
-  readonly workspace: string | null;
-}
-
-/** Error thrown when a mutation is attempted on non-current data. */
-export class StaleMutationError extends Error {
-  readonly freshness: FreshnessState;
-
-  constructor(freshness: FreshnessState) {
-    super(`Refused mutation on ${freshness} data: revalidation is required before mutating.`);
-    this.name = 'StaleMutationError';
-    this.freshness = freshness;
-  }
-}
-
-/** Stable JSON digest used for snapshot integrity checks. */
-export function computeDigest(value: unknown): string {
-  // FNV-1a 32-bit over the stable JSON serialization. This is an integrity
-  // check against corruption, not a cryptographic guarantee.
-  let hash = 0x811c9dc5;
-  for (const byte of stableStringify(value)) {
-    hash ^= byte.charCodeAt(0);
-    hash = Math.imul(hash, 0x01000193) >>> 0;
-  }
-  return hash.toString(16).padStart(8, '0');
-}
-
-function stableStringify(value: unknown): string {
-  return serialize(value);
-}
-
-function serialize(value: unknown): string {
-  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? 'null';
-  if (Array.isArray(value)) return `[${value.map(serialize).join(',')}]`;
-  const entries = Object.entries(value as Record<string, unknown>)
-    .filter(([, item]) => item !== undefined)
-    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-    .map(([key, item]) => `${JSON.stringify(key)}:${serialize(item)}`);
-  return `{${entries.join(',')}}`;
-}
-
-export type AcceptSnapshotResult<T> =
-  | { readonly outcome: 'accepted'; readonly snapshot: FreshSnapshot<T> }
-  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
-
-export interface AcceptSnapshotOptions<T> {
-  /** Raw fetched value (untrusted JSON). */
-  readonly value: unknown;
-  /** Schema validator; returns `null` when the value does not match. */
-  readonly validate: (value: unknown) => FreshPayload<T> | null;
-  /** Previously accepted snapshot for this surface, if any. */
-  readonly previous: FreshSnapshot<T> | null;
-  readonly policy: FreshnessPolicy;
-  readonly source: string;
-  /**
-   * Version carried by the incoming payload when the transport exposes one.
-   * Must not regress below the accepted snapshot's version.
-   */
-  readonly incomingVersion?: number;
-  readonly now: number;
-}
-
-/**
- * Validate and accept a fetched value as a snapshot, or invalidate it.
- *
- * Invalidation rules (each treated as unavailable, never rendered current):
- * - schema mismatch: the payload fails validation
- * - cross-workspace: the payload's workspace differs from the verified one
- * - version regression: payload/schema version is below the accepted one
- */
-export function acceptSnapshot<T>(options: AcceptSnapshotOptions<T>): AcceptSnapshotResult<T> {
-  const payload = options.validate(options.value);
-  if (payload === null) {
-    return { outcome: 'invalidated', reason: 'schema-mismatch' };
-  }
-
-  // Workspace identity: the payload's own scope wins; a collection with no
-  // intrinsic identity (e.g. an empty list after every project was deleted)
-  // keeps the previously verified scope rather than resetting to the policy
-  // default, so a legitimately empty response is not mistaken for a scope
-  // change.
-  const workspace = payload.workspace ?? options.previous?.workspace ?? options.policy.workspace;
-  if (options.previous !== null && options.previous.workspace !== workspace) {
-    return { outcome: 'invalidated', reason: 'cross-workspace' };
-  }
-  if (options.previous !== null && options.policy.schemaVersion < options.previous.schemaVersion) {
-    return { outcome: 'invalidated', reason: 'version-regression' };
-  }
-  if (
-    options.incomingVersion !== undefined &&
-    options.previous !== null &&
-    options.incomingVersion < options.previous.version
-  ) {
-    return { outcome: 'invalidated', reason: 'version-regression' };
-  }
-
-  const snapshot: FreshSnapshot<T> = {
-    data: payload.data,
-    source: options.source,
-    workspace,
-    version: options.incomingVersion ?? (options.previous?.version ?? 0) + 1,
-    schemaVersion: options.policy.schemaVersion,
-    fetchedAt: options.now,
-    digest: computeDigest(payload.data),
-  };
-  return { outcome: 'accepted', snapshot };
-}
-
-export interface ComputeFreshnessOptions {
-  readonly snapshot: FreshSnapshot<unknown> | null;
-  readonly policy: FreshnessPolicy;
-  readonly now: number;
-  /**
-   * True when the snapshot cannot be trusted as current regardless of age:
-   * the latest revalidation failed, or the snapshot was restored from cache
-   * and has not been verified by a fetch in this session.
-   */
-  readonly degraded?: boolean;
-}
-
-/**
- * Compute the freshness state of a snapshot. A missing snapshot is
- * `unavailable` (never "empty and healthy"); a degraded or aged snapshot is
- * `stale` (situational awareness only).
- */
-export function computeFreshness(options: ComputeFreshnessOptions): FreshnessState {
-  const { snapshot, policy, now, degraded = false } = options;
-  if (snapshot === null) return 'unavailable';
-  if (degraded) return 'stale';
-  if (now - snapshot.fetchedAt > policy.staleAfterMs) return 'stale';
-  return 'current';
-}
-
-/** Only verified-current data may back a state-changing action. */
-export function canMutate(state: FreshnessState): boolean {
-  return state === 'current';
-}
-
-/** Defense in depth: reject the mutation call itself on non-current data. */
-export function assertMutable(state: FreshnessState): void {
-  if (!canMutate(state)) {
-    throw new StaleMutationError(state);
-  }
-}
-
-/**
- * Combine freshness across a multi-collection surface (primary + secondaries).
- * The primary collection gates the surface: unknown while it loads,
- * unavailable when it fails. Missing secondaries degrade the surface to
- * `partial`; aged collections degrade it to `stale`.
- */
-export function combineFreshness(
-  primary: FreshnessState,
-  secondaries: readonly FreshnessState[],
-): FreshnessState {
-  if (primary === 'unavailable') return 'unavailable';
-  if (primary === 'unknown') return 'unknown';
-  if (secondaries.includes('unavailable')) return 'partial';
-  if (secondaries.includes('unknown')) return 'unknown';
-  if (secondaries.includes('stale') || primary === 'stale') return 'stale';
-  if (secondaries.includes('partial')) return 'partial';
-  return 'current';
-}
-
-/** Render-safe age label for snapshot provenance. */
-export function formatAge(fetchedAt: number, now: number): string {
-  const ageMs = Math.max(0, now - fetchedAt);
-  if (ageMs < 10_000) return 'just now';
-  const minutes = Math.floor(ageMs / 60_000);
-  if (minutes < 1) return 'under a minute ago';
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  return `${days}d ago`;
-}
-
-/** Derived verdict placeholder for non-current inputs — never a green value. */
-export const UNKNOWN_VERDICT = '?';
-
-export function verdictValue(verified: boolean, value: string): string {
-  return verified ? value : UNKNOWN_VERDICT;
-}

apps/web/src/lib/freshness/snapshot-cache.spec.ts

@@ -1,197 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from './model';
-import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
-import { validateProjectCollection, validateTaskCollection } from './validators';
-import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
-import type { Project, Task } from '@/lib/types';
-
-const KEY = 'test:tasks';
-const NOW = 1_800_000_000_000;
-const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
-
-function storedTaskSnapshot() {
-  const result = acceptSnapshot({
-    value: taskFixtures,
-    validate: validateTaskCollection,
-    previous: null,
-    policy,
-    source: 'gateway:/api/tasks',
-    now: NOW,
-  });
-  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
-  return result.snapshot;
-}
-
-function storedProjectSnapshot() {
-  const result = acceptSnapshot({
-    value: projectFixtures,
-    validate: validateProjectCollection,
-    previous: null,
-    policy,
-    source: 'gateway:/api/projects',
-    now: NOW,
-  });
-  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
-  return result.snapshot;
-}
-
-function readTasks() {
-  return readSnapshotCache({
-    key: KEY,
-    workspace: policy.workspace,
-    policy,
-    validate: validateTaskCollection,
-  });
-}
-
-/** Write an arbitrary value directly at the raw cache slot. */
-function writeRaw(key: string, value: unknown): void {
-  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify(value));
-}
-
-/** Parse and re-write the stored entry (for tampering with internals). */
-function tamperStored<T>(key: string, mutate: (stored: T) => void): void {
-  const parsed = JSON.parse(sessionStorage.getItem(`mosaic:freshness:v1:${key}`) ?? '{}') as T;
-  mutate(parsed);
-  writeRaw(key, parsed);
-}
-
-beforeEach(() => {
-  sessionStorage.clear();
-});
-
-afterEach(() => {
-  sessionStorage.clear();
-});
-
-describe('readSnapshotCache', () => {
-  it('misses when nothing is stored', () => {
-    expect(readTasks()).toEqual({ outcome: 'miss' });
-  });
-
-  it('hits for a well-formed entry and preserves provenance', () => {
-    const snapshot = storedTaskSnapshot();
-    writeSnapshotCache(KEY, snapshot);
-
-    const result = readTasks();
-    expect(result.outcome).toBe('hit');
-    if (result.outcome === 'hit') {
-      expect(result.snapshot.data).toEqual(taskFixtures);
-      expect(result.snapshot.source).toBe('gateway:/api/tasks');
-      expect(result.snapshot.version).toBe(snapshot.version);
-      expect(result.snapshot.fetchedAt).toBe(snapshot.fetchedAt);
-      expect(result.snapshot.workspace).toBe(snapshot.workspace);
-    }
-  });
-
-  it('invalidates unparsable entries as cache corruption', () => {
-    sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, '{not json');
-    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
-  });
-
-  it('invalidates structurally wrong entries as cache corruption', () => {
-    const malformed: unknown[] = [
-      'nested but not a snapshot',
-      { data: taskFixtures }, // missing provenance fields
-      {
-        data: taskFixtures,
-        source: 1,
-        workspace: 'w',
-        version: 1,
-        schemaVersion: 1,
-        fetchedAt: 1,
-        digest: 'x',
-      },
-      null,
-      17,
-    ];
-    for (const entry of malformed) {
-      writeRaw(KEY, entry);
-      expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
-    }
-  });
-
-  it('invalidates digest mismatches as cache corruption (tampered data)', () => {
-    writeSnapshotCache(KEY, storedTaskSnapshot());
-    tamperStored<{ data: Task[] }>(KEY, (stored) => {
-      stored.data = [...stored.data, { ...stored.data[0]!, id: 'injected-task' }];
-    });
-    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
-  });
-
-  it('invalidates entries scoped to another workspace', () => {
-    const snapshot = storedTaskSnapshot();
-    writeSnapshotCache(KEY, { ...snapshot, workspace: 'someone-else' });
-    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
-  });
-
-  it('invalidates entries written by a newer schema as a version regression', () => {
-    const snapshot = storedTaskSnapshot();
-    writeSnapshotCache(KEY, { ...snapshot, schemaVersion: policy.schemaVersion + 1 });
-    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
-  });
-
-  it('invalidates entries whose data no longer validates (schema mismatch)', () => {
-    writeSnapshotCache(KEY, storedTaskSnapshot());
-    tamperStored<{ data: unknown }>(KEY, (stored) => {
-      stored.data = { malformed: true };
-    });
-    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
-  });
-
-  it('never reports a corrupted raw entry as a hit (negative control)', () => {
-    for (const raw of ['{oops', 'null', '"string"', '[]', '12']) {
-      sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, raw);
-      const result = readTasks();
-      expect(result.outcome).not.toBe('hit');
-      expect(result.outcome).toBe('invalidated');
-    }
-  });
-
-  it('scopes project collections by their workspace identity', () => {
-    const snapshot = storedProjectSnapshot();
-    writeSnapshotCache('test:projects', snapshot);
-
-    const sameScope = readSnapshotCache({
-      key: 'test:projects',
-      workspace: 'user-1',
-      policy,
-      validate: validateProjectCollection,
-    });
-    expect(sameScope.outcome).toBe('hit');
-
-    const foreignScope = readSnapshotCache({
-      key: 'test:projects',
-      workspace: 'user-2',
-      policy,
-      validate: validateProjectCollection,
-    });
-    expect(foreignScope).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
-  });
-});
-
-describe('writeSnapshotCache round-trip', () => {
-  it('round-trips an accepted project snapshot', () => {
-    const snapshot = storedProjectSnapshot();
-    writeSnapshotCache('test:projects', snapshot);
-    const result = readSnapshotCache({
-      key: 'test:projects',
-      workspace: snapshot.workspace,
-      policy,
-      validate: validateProjectCollection,
-    });
-    expect(result.outcome).toBe('hit');
-    if (result.outcome === 'hit') {
-      expect(result.snapshot.data).toEqual(projectFixtures as Project[]);
-    }
-  });
-});
-
-describe('clearSnapshotCache', () => {
-  it('drops the entry so the next read misses', () => {
-    writeSnapshotCache(KEY, storedTaskSnapshot());
-    expect(readTasks().outcome).toBe('hit');
-    clearSnapshotCache(KEY);
-    expect(readTasks()).toEqual({ outcome: 'miss' });
-  });
-});

apps/web/src/lib/freshness/snapshot-cache.ts

@@ -1,154 +0,0 @@
-import {
-  computeDigest,
-  type FreshPayload,
-  type FreshSnapshot,
-  type FreshnessPolicy,
-  type InvalidationReason,
-} from './model';
-
-/**
- * Session-scoped last-known snapshot cache (RI-5-001).
- *
- * Restored snapshots are situational awareness only: they surface as `stale`
- * until a fetch re-verifies them. A cache entry that is corrupted, belongs to
- * another workspace, was written by a newer schema, or no longer validates is
- * invalidated (treated as unavailable, never rendered as current).
- */
-
-const CACHE_PREFIX = 'mosaic:freshness:v1';
-
-interface StoredSnapshot {
-  data: unknown;
-  source: string;
-  workspace: string;
-  version: number;
-  schemaVersion: number;
-  fetchedAt: number;
-  digest: string;
-}
-
-export type SnapshotCacheRead<T> =
-  | { readonly outcome: 'hit'; readonly snapshot: FreshSnapshot<T> }
-  | { readonly outcome: 'miss' }
-  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
-
-export interface ReadSnapshotCacheOptions<T> {
-  readonly key: string;
-  readonly workspace: string;
-  readonly policy: FreshnessPolicy;
-  readonly validate: (value: unknown) => FreshPayload<T> | null;
-}
-
-function cacheKey(key: string): string {
-  return `${CACHE_PREFIX}:${key}`;
-}
-
-function isStoredSnapshot(value: unknown): value is StoredSnapshot {
-  if (typeof value !== 'object' || value === null) return false;
-  const candidate = value as Record<string, unknown>;
-  return (
-    typeof candidate['data'] === 'object' &&
-    candidate['data'] !== null &&
-    typeof candidate['source'] === 'string' &&
-    typeof candidate['workspace'] === 'string' &&
-    typeof candidate['version'] === 'number' &&
-    typeof candidate['schemaVersion'] === 'number' &&
-    typeof candidate['fetchedAt'] === 'number' &&
-    typeof candidate['digest'] === 'string'
-  );
-}
-
-function getStorage(): Storage | null {
-  try {
-    return globalThis.sessionStorage ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Restore a cached snapshot under the active workspace scope. Every failure
- * mode maps to an explicit invalidation reason or a miss — never to data
- * that renders as current.
- */
-export function readSnapshotCache<T>(options: ReadSnapshotCacheOptions<T>): SnapshotCacheRead<T> {
-  const storage = getStorage();
-  if (storage === null) return { outcome: 'miss' };
-
-  let raw: string | null;
-  try {
-    raw = storage.getItem(cacheKey(options.key));
-  } catch {
-    return { outcome: 'miss' };
-  }
-  if (raw === null) return { outcome: 'miss' };
-
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { outcome: 'invalidated', reason: 'cache-corruption' };
-  }
-  if (!isStoredSnapshot(parsed)) {
-    return { outcome: 'invalidated', reason: 'cache-corruption' };
-  }
-  if (parsed.workspace !== options.workspace) {
-    return { outcome: 'invalidated', reason: 'cross-workspace' };
-  }
-  if (parsed.schemaVersion > options.policy.schemaVersion) {
-    // Written by a newer build than the running client: version regression.
-    return { outcome: 'invalidated', reason: 'version-regression' };
-  }
-
-  const payload = options.validate(parsed.data);
-  if (payload === null) {
-    return { outcome: 'invalidated', reason: 'schema-mismatch' };
-  }
-  if (computeDigest(payload.data) !== parsed.digest) {
-    return { outcome: 'invalidated', reason: 'cache-corruption' };
-  }
-
-  return {
-    outcome: 'hit',
-    snapshot: {
-      data: payload.data,
-      source: parsed.source,
-      workspace: parsed.workspace,
-      version: parsed.version,
-      schemaVersion: parsed.schemaVersion,
-      fetchedAt: parsed.fetchedAt,
-      digest: parsed.digest,
-    },
-  };
-}
-
-/** Persist a verified snapshot. Failures are non-fatal (cache is best-effort). */
-export function writeSnapshotCache<T>(key: string, snapshot: FreshSnapshot<T>): void {
-  const storage = getStorage();
-  if (storage === null) return;
-  const stored: StoredSnapshot = {
-    data: snapshot.data,
-    source: snapshot.source,
-    workspace: snapshot.workspace,
-    version: snapshot.version,
-    schemaVersion: snapshot.schemaVersion,
-    fetchedAt: snapshot.fetchedAt,
-    digest: snapshot.digest,
-  };
-  try {
-    storage.setItem(cacheKey(key), JSON.stringify(stored));
-  } catch {
-    // Quota or serialization failures simply skip caching.
-  }
-}
-
-/** Drop a cached snapshot (used when a surface invalidates its cache entry). */
-export function clearSnapshotCache(key: string): void {
-  const storage = getStorage();
-  if (storage === null) return;
-  try {
-    storage.removeItem(cacheKey(key));
-  } catch {
-    // Ignorable: a wedged storage entry is detected as corruption on read.
-  }
-}

apps/web/src/lib/freshness/use-fresh-collection.spec.tsx

@@ -1,372 +0,0 @@
-import { act } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import type { Task } from '@/lib/types';
-import { acceptSnapshot, StaleMutationError, DEFAULT_FRESHNESS_POLICY } from './model';
-import type { FreshnessFailure } from './use-fresh-collection';
-import {
-  describeFailure,
-  useFreshCollection,
-  type FreshCollection,
-  type UseFreshCollectionOptions,
-} from './use-fresh-collection';
-import { validateProjectCollection, validateTaskCollection } from './validators';
-import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
-
-/**
- * Failure-matrix coverage for the freshness seam (RI-5-001): network failure,
- * auth failure, malformed response, cache corruption, stale age, schema
- * mismatch, cross-workspace, recovery, and stale-action rejection — with
- * negative controls proving no case yields current data or an enabled
- * mutation.
- */
-
-const NOW = 1_800_000_000_000;
-
-interface Deferred<T> {
-  promise: Promise<T>;
-  resolve: (value: T) => void;
-  reject: (reason?: unknown) => void;
-}
-
-function createDeferred<T>(): Deferred<T> {
-  let resolve!: (value: T) => void;
-  let reject!: (reason?: unknown) => void;
-  const promise = new Promise<T>((res, rej) => {
-    resolve = res;
-    reject = rej;
-  });
-  return { promise, resolve, reject };
-}
-
-let root: Root | null = null;
-let container: HTMLDivElement;
-let latest: FreshCollection<Task[]> | null = null;
-
-function Probe({
-  options,
-}: {
-  options: UseFreshCollectionOptions<Task[]>;
-}): React.ReactElement | null {
-  latest = useFreshCollection<Task[]>(options);
-  return null;
-}
-
-beforeAll(() => {
-  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
-    configurable: true,
-    value: true,
-  });
-});
-
-beforeEach(() => {
-  sessionStorage.clear();
-});
-
-afterEach(async () => {
-  await act(async () => {
-    root?.unmount();
-  });
-  document.body.replaceChildren();
-  root = null;
-  latest = null;
-  sessionStorage.clear();
-  vi.restoreAllMocks();
-});
-
-async function renderCollection(
-  options: UseFreshCollectionOptions<Task[]>,
-): Promise<FreshCollection<Task[]>> {
-  container = document.createElement('div');
-  document.body.append(container);
-  root = createRoot(container);
-  await act(async () => {
-    root?.render(<Probe options={options} />);
-  });
-  if (latest === null) throw new Error('hook did not run');
-  return latest;
-}
-
-function taskOptions(
-  overrides: Partial<UseFreshCollectionOptions<Task[]>> = {},
-): UseFreshCollectionOptions<Task[]> {
-  return {
-    source: 'gateway:/api/tasks',
-    fetcher: () => Promise.resolve(taskFixtures),
-    validate: validateTaskCollection,
-    cacheKey: 'tasks',
-    clock: () => NOW,
-    ...overrides,
-  };
-}
-
-function authError(statusCode: number): Error & { statusCode: number } {
-  return Object.assign(new Error(`Request failed with ${statusCode}`), { statusCode });
-}
-
-function seedCache(key: string): number {
-  const result = acceptSnapshot({
-    value: taskFixtures,
-    validate: validateTaskCollection,
-    previous: null,
-    policy: DEFAULT_FRESHNESS_POLICY,
-    source: 'gateway:/api/tasks',
-    now: NOW,
-  });
-  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
-  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify({ ...result.snapshot }));
-  return result.snapshot.version;
-}
-
-describe('useFreshCollection failure matrix', () => {
-  it('is unknown (not empty) while the first validation is in flight', async () => {
-    const deferred = createDeferred<Task[]>();
-    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
-
-    expect(collection.freshness).toBe('unknown');
-    expect(collection.validating).toBe(true);
-    expect(collection.data).toBeNull();
-    expect(collection.canMutate).toBe(false);
-
-    await act(async () => {
-      deferred.resolve(taskFixtures);
-      await deferred.promise;
-    });
-  });
-
-  it('becomes current with provenance after a verified fetch', async () => {
-    const collection = await renderCollection(taskOptions());
-
-    expect(collection.freshness).toBe('current');
-    expect(collection.data).toEqual(taskFixtures);
-    expect(collection.snapshot?.source).toBe('gateway:/api/tasks');
-    expect(collection.snapshot?.version).toBe(1);
-    expect(collection.failure).toBeNull();
-    expect(collection.canMutate).toBe(true);
-    // Verified snapshot is persisted for last-known restore.
-    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeTruthy();
-  });
-
-  it('treats a network failure as unavailable — never an empty healthy collection', async () => {
-    const collection = await renderCollection(
-      taskOptions({ fetcher: () => Promise.reject(new Error('network down')) }),
-    );
-
-    expect(collection.freshness).toBe('unavailable');
-    expect(collection.data).toBeNull();
-    expect(collection.failure).toEqual({ kind: 'fetch', message: 'network down' });
-    expect(collection.canMutate).toBe(false);
-    expect(describeFailure(collection.failure)).toBe('network down');
-  });
-
-  it('treats an auth failure as unavailable and drops the last-known snapshot', async () => {
-    let call = 0;
-    const collection = await renderCollection(
-      taskOptions({
-        fetcher: () => {
-          call += 1;
-          return call === 1 ? Promise.resolve(taskFixtures) : Promise.reject(authError(401));
-        },
-      }),
-    );
-    expect(collection.freshness).toBe('current');
-
-    await act(async () => {
-      await collection.revalidate();
-    });
-
-    expect(latest?.freshness).toBe('unavailable');
-    expect(latest?.data).toBeNull();
-    expect(latest?.failure?.kind).toBe('fetch');
-    // The previous user's data must not linger in the session cache.
-    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
-  });
-
-  it('invalidates a malformed response as a schema mismatch', async () => {
-    const collection = await renderCollection(
-      taskOptions({ fetcher: () => Promise.resolve({ malformed: true }) }),
-    );
-
-    expect(collection.freshness).toBe('unavailable');
-    expect(collection.data).toBeNull();
-    expect(collection.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
-    expect(collection.canMutate).toBe(false);
-  });
-
-  it('keeps the previous snapshot as labeled stale when a later payload mismatches', async () => {
-    let call = 0;
-    const collection = await renderCollection(
-      taskOptions({
-        fetcher: () => {
-          call += 1;
-          return call === 1 ? Promise.resolve(taskFixtures) : Promise.resolve('garbage');
-        },
-      }),
-    );
-    expect(collection.freshness).toBe('current');
-
-    await act(async () => {
-      await collection.revalidate();
-    });
-
-    expect(latest?.freshness).toBe('stale');
-    expect(latest?.data).toEqual(taskFixtures);
-    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
-    expect(latest?.canMutate).toBe(false);
-  });
-
-  it('drops the snapshot when the workspace changes under it (cross-workspace)', async () => {
-    let call = 0;
-    const collection = await renderCollection(
-      taskOptions({
-        fetcher: () => {
-          call += 1;
-          return Promise.resolve(
-            call === 1 ? projectFixtures : [{ ...projectFixtures[0], userId: 'user-2' }],
-          );
-        },
-        validate: validateProjectCollection as unknown as (value: unknown) => {
-          data: Task[];
-          workspace: string | null;
-        },
-        source: 'gateway:/api/projects',
-      }),
-    );
-    expect(collection.freshness).toBe('current');
-
-    await act(async () => {
-      await collection.revalidate();
-    });
-
-    expect(latest?.freshness).toBe('unavailable');
-    expect(latest?.data).toBeNull();
-    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'cross-workspace' });
-  });
-
-  it('ages from current to stale and refuses mutations on stale data', async () => {
-    let fakeNow = NOW;
-    const collection = await renderCollection(
-      taskOptions({
-        clock: () => fakeNow,
-        policy: { staleAfterMs: 40 },
-        tickMs: 10,
-      }),
-    );
-    expect(collection.freshness).toBe('current');
-
-    // Age the snapshot past the policy and let the tick recompute.
-    fakeNow = NOW + 60;
-    await act(async () => {
-      await new Promise((resolve) => setTimeout(resolve, 25));
-    });
-
-    expect(latest?.freshness).toBe('stale');
-    expect(latest?.data).toEqual(taskFixtures);
-    expect(latest?.canMutate).toBe(false);
-
-    const operation = vi.fn(async () => 'result');
-    await expect(latest?.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
-    expect(operation).not.toHaveBeenCalled();
-  });
-
-  it('recovers to current after a successful revalidation', async () => {
-    let call = 0;
-    const collection = await renderCollection(
-      taskOptions({
-        fetcher: () => {
-          call += 1;
-          return call === 1
-            ? Promise.reject(new Error('first attempt failed'))
-            : Promise.resolve(taskFixtures);
-        },
-      }),
-    );
-    expect(collection.freshness).toBe('unavailable');
-
-    await act(async () => {
-      await collection.revalidate();
-    });
-
-    expect(latest?.freshness).toBe('current');
-    expect(latest?.failure).toBeNull();
-
-    const operation = vi.fn(async (data: Task[]) => data.length);
-    await expect(latest?.mutate(operation)).resolves.toBe(taskFixtures.length);
-    expect(operation).toHaveBeenCalledOnce();
-  });
-
-  it('restores a cached snapshot as unverified stale data, then verifies it', async () => {
-    const seededVersion = seedCache('tasks');
-    const deferred = createDeferred<Task[]>();
-    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
-
-    // Restored data is situational awareness only: labeled stale, never
-    // current, and mutations are refused before verification.
-    expect(collection.freshness).toBe('stale');
-    expect(collection.data).toEqual(taskFixtures);
-    expect(collection.canMutate).toBe(false);
-    await expect(collection.mutate(vi.fn())).rejects.toBeInstanceOf(StaleMutationError);
-
-    await act(async () => {
-      deferred.resolve(taskFixtures);
-      await deferred.promise;
-    });
-
-    expect(latest?.freshness).toBe('current');
-    expect(latest?.snapshot?.version).toBe(seededVersion + 1);
-  });
-
-  it('never promotes corrupted cache data to current (cache corruption)', async () => {
-    sessionStorage.setItem('mosaic:freshness:v1:tasks', '{"data":');
-    const collection = await renderCollection(
-      taskOptions({ fetcher: () => Promise.reject(new Error('still down')) }),
-    );
-
-    expect(collection.freshness).toBe('unavailable');
-    expect(collection.data).toBeNull();
-    expect(collection.canMutate).toBe(false);
-    // The corrupted entry is dropped so it cannot come back.
-    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
-  });
-
-  it('refuses mutations while unknown or unavailable — the call itself, not just the button', async () => {
-    const deferred = createDeferred<Task[]>();
-    const unknown = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
-    const operation = vi.fn(async () => 'result');
-    await expect(unknown.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
-    expect(operation).not.toHaveBeenCalled();
-    await act(async () => {
-      deferred.reject(new Error('failed'));
-      await deferred.promise.catch(() => undefined);
-    });
-
-    const unavailable = latest!;
-    await expect(unavailable.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
-    expect(operation).not.toHaveBeenCalled();
-    expect(unavailable.canMutate).toBe(false);
-  });
-
-  it('degrades to stale with last-known data when a revalidation fails after success', async () => {
-    let call = 0;
-    const collection = await renderCollection(
-      taskOptions({
-        fetcher: () => {
-          call += 1;
-          return call === 1
-            ? Promise.resolve(taskFixtures)
-            : Promise.reject(new Error('connection lost'));
-        },
-      }),
-    );
-    expect(collection.freshness).toBe('current');
-
-    await act(async () => {
-      await collection.revalidate();
-    });
-
-    expect(latest?.freshness).toBe('stale');
-    expect(latest?.data).toEqual(taskFixtures);
-    const failure: FreshnessFailure | null = latest?.failure ?? null;
-    expect(failure).toEqual({ kind: 'fetch', message: 'connection lost' });
-  });
-});

apps/web/src/lib/freshness/use-fresh-collection.ts

@@ -1,281 +0,0 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import {
-  acceptSnapshot,
-  assertMutable,
-  computeFreshness,
-  DEFAULT_FRESHNESS_POLICY,
-  invalidationReasonLabels,
-  type FreshPayload,
-  type FreshSnapshot,
-  type FreshnessPolicy,
-  type FreshnessState,
-  type InvalidationReason,
-  StaleMutationError,
-} from './model';
-import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
-
-/**
- * Freshness-aware collection fetch hook (RI-5-001).
- *
- * One hook owns one gateway collection end to end: fetch, schema validation,
- * snapshot acceptance with provenance, session-scoped last-known caching,
- * aging, and the mutation guard. Pages consume `freshness` and never infer
- * health from emptiness.
- */
-
-/** Why the latest validation did not produce a current snapshot. */
-export type FreshnessFailure =
-  | { readonly kind: 'fetch'; readonly message: string }
-  | { readonly kind: 'invalidated'; readonly reason: InvalidationReason };
-
-export interface UseFreshCollectionOptions<T> {
-  /** Source identity for provenance labels, e.g. `gateway:/api/tasks`. */
-  readonly source: string;
-  /** Performs the unvalidated fetch. The hook owns abort and verification. */
-  readonly fetcher: (signal: AbortSignal) => Promise<unknown>;
-  /**
-   * Runtime schema validator. Returning `null` invalidates the payload
-   * (`schema-mismatch`) instead of letting malformed JSON flow into render.
-   */
-  readonly validate: (value: unknown) => FreshPayload<T> | null;
-  /** Overrides of the default freshness policy. */
-  readonly policy?: Partial<FreshnessPolicy>;
-  /**
-   * Session cache key for last-known snapshots. `null`/omitted disables
-   * restore. Restored snapshots are unverified: they render only as
-   * labeled `stale` data until a fetch re-verifies them.
-   */
-  readonly cacheKey?: string | null;
-  /** Injectable clock for deterministic age transitions in tests. */
-  readonly clock?: () => number;
-  /** Aging tick interval override (default derived from `staleAfterMs`). */
-  readonly tickMs?: number;
-  /** When false, no fetch runs (surfaces stay `unavailable`/`unknown`). */
-  readonly enabled?: boolean;
-}
-
-export interface FreshCollection<T> {
-  /** Last verified (or restored-unverified) snapshot, or `null`. */
-  readonly snapshot: FreshSnapshot<T> | null;
-  /** Snapshot data or `null` — never a fabricated empty collection. */
-  readonly data: T | null;
-  readonly freshness: FreshnessState;
-  /** True while a validation request is in flight. */
-  readonly validating: boolean;
-  /** Outcome of the latest failed validation, `null` when healthy. */
-  readonly failure: FreshnessFailure | null;
-  /** False unless freshness is `current`; drives disabled UI affordances. */
-  readonly canMutate: boolean;
-  /** Re-run the fetch and re-verify. Always allowed (it is a read). */
-  readonly revalidate: () => Promise<void>;
-  /**
-   * Run a state-changing operation against verified-current data only.
-   * Rejects with `StaleMutationError` on any other state — the guard fires
-   * even if a disabled button was bypassed (defense in depth).
-   */
-  readonly mutate: <R>(operation: (data: T) => Promise<R>) => Promise<R>;
-}
-
-const defaultClock = (): number => Date.now();
-
-function resolveTickMs(policy: FreshnessPolicy, override?: number): number {
-  if (override !== undefined && override > 0) return override;
-  return Math.min(5_000, Math.max(250, Math.floor(policy.staleAfterMs / 4)));
-}
-
-function isAuthFailure(caught: unknown): boolean {
-  return (
-    typeof caught === 'object' &&
-    caught !== null &&
-    'statusCode' in caught &&
-    ((caught as { statusCode?: unknown }).statusCode === 401 ||
-      (caught as { statusCode?: unknown }).statusCode === 403)
-  );
-}
-
-function fetchFailureMessage(caught: unknown): string {
-  if (caught instanceof Error && caught.message.trim().length > 0) return caught.message;
-  return 'The request failed.';
-}
-
-/** Human-readable summary of a failure for unavailable/stale notices. */
-export function describeFailure(failure: FreshnessFailure | null): string | null {
-  if (failure === null) return null;
-  if (failure.kind === 'fetch') return failure.message;
-  return `The snapshot was invalidated: ${invalidationReasonLabels[failure.reason]}.`;
-}
-
-export function useFreshCollection<T>(options: UseFreshCollectionOptions<T>): FreshCollection<T> {
-  const optionsRef = useRef(options);
-  optionsRef.current = options;
-
-  const policy = useMemo<FreshnessPolicy>(
-    () => ({ ...DEFAULT_FRESHNESS_POLICY, ...options.policy }),
-    [options.policy],
-  );
-  const policyRef = useRef(policy);
-  policyRef.current = policy;
-
-  const clockRef = useRef(options.clock ?? defaultClock);
-  clockRef.current = options.clock ?? defaultClock;
-
-  const [snapshot, setSnapshot] = useState<FreshSnapshot<T> | null>(null);
-  const [failure, setFailure] = useState<FreshnessFailure | null>(null);
-  const [unverified, setUnverified] = useState(false);
-  const [validating, setValidating] = useState(options.enabled !== false);
-  const [now, setNow] = useState(() => (options.clock ?? defaultClock)());
-
-  const snapshotRef = useRef(snapshot);
-  snapshotRef.current = snapshot;
-  const failureRef = useRef(failure);
-  failureRef.current = failure;
-  const unverifiedRef = useRef(unverified);
-  unverifiedRef.current = unverified;
-
-  const runRef = useRef(0);
-  const abortRef = useRef<AbortController | null>(null);
-
-  const revalidate = useCallback(async (): Promise<void> => {
-    const current = optionsRef.current;
-    if (current.enabled === false) {
-      setValidating(false);
-      return;
-    }
-
-    const runId = ++runRef.current;
-    abortRef.current?.abort();
-    const controller = new AbortController();
-    abortRef.current = controller;
-    setValidating(true);
-
-    let value: unknown;
-    try {
-      value = await current.fetcher(controller.signal);
-    } catch (caught) {
-      if (runRef.current !== runId || controller.signal.aborted) return;
-      if (isAuthFailure(caught)) {
-        // An unauthenticated viewer must not keep (or be served) the
-        // previous user's last-known data.
-        setSnapshot(null);
-        setUnverified(false);
-        if (current.cacheKey) clearSnapshotCache(current.cacheKey);
-      }
-      setFailure({ kind: 'fetch', message: fetchFailureMessage(caught) });
-      setValidating(false);
-      return;
-    }
-
-    if (runRef.current !== runId) return;
-
-    const result = acceptSnapshot({
-      value,
-      validate: current.validate,
-      previous: snapshotRef.current,
-      policy: policyRef.current,
-      source: current.source,
-      now: clockRef.current(),
-    });
-
-    if (result.outcome === 'accepted') {
-      setSnapshot(result.snapshot);
-      setUnverified(false);
-      setFailure(null);
-      if (current.cacheKey) writeSnapshotCache(current.cacheKey, result.snapshot);
-    } else {
-      if (result.reason === 'cross-workspace') {
-        // Data verified for a different workspace must not linger as
-        // last-known situational awareness either.
-        setSnapshot(null);
-        setUnverified(false);
-      }
-      if (current.cacheKey) clearSnapshotCache(current.cacheKey);
-      setFailure({ kind: 'invalidated', reason: result.reason });
-    }
-    setValidating(false);
-  }, []);
-
-  // Restore the last-known snapshot (unverified) and run the first fetch.
-  useEffect(() => {
-    if (optionsRef.current.enabled === false) {
-      setValidating(false);
-      return;
-    }
-
-    const cacheKey = optionsRef.current.cacheKey;
-    if (cacheKey) {
-      const restored = readSnapshotCache<T>({
-        key: cacheKey,
-        workspace: policyRef.current.workspace,
-        policy: policyRef.current,
-        validate: optionsRef.current.validate,
-      });
-      if (restored.outcome === 'hit') {
-        setSnapshot(restored.snapshot);
-        setUnverified(true);
-      } else if (restored.outcome === 'invalidated') {
-        // A corrupted/foreign/regressed entry is dropped immediately; it must
-        // never surface as data. The fetch decides the visible state.
-        clearSnapshotCache(cacheKey);
-      }
-    }
-
-    void revalidate();
-
-    return () => {
-      abortRef.current?.abort();
-    };
-    // Mount-once by design: `revalidate` is stable and reads live options
-    // through refs, so it never needs to re-run when options change.
-    // Route-param pages remount this hook via an identity `key` instead.
-  }, [revalidate]);
-
-  // Aging tick: recomputes freshness as the snapshot ages past the policy.
-  useEffect(() => {
-    const interval = setInterval(
-      () => {
-        setNow(clockRef.current());
-      },
-      resolveTickMs(policyRef.current, optionsRef.current.tickMs),
-    );
-    return () => clearInterval(interval);
-  }, []);
-
-  const freshness = useMemo<FreshnessState>(() => {
-    if (snapshot === null) return validating ? 'unknown' : 'unavailable';
-    return computeFreshness({
-      snapshot,
-      policy,
-      now,
-      degraded: failure !== null || unverified,
-    });
-    // `now` from state covers age; refs inside computeFreshness are pure.
-  }, [snapshot, validating, failure, unverified, now, policy]);
-
-  const canMutate = freshness === 'current';
-
-  const mutate = useCallback(async <R>(operation: (data: T) => Promise<R>): Promise<R> => {
-    const currentSnapshot = snapshotRef.current;
-    // No verified snapshot at all: with nothing verified there is nothing
-    // current to mutate, regardless of the recorded failure.
-    if (currentSnapshot === null) throw new StaleMutationError('unavailable');
-    const state = computeFreshness({
-      snapshot: currentSnapshot,
-      policy: policyRef.current,
-      now: clockRef.current(),
-      degraded: failureRef.current !== null || unverifiedRef.current,
-    });
-    assertMutable(state);
-    return operation(currentSnapshot.data);
-  }, []);
-
-  return {
-    snapshot,
-    data: snapshot === null ? null : snapshot.data,
-    freshness,
-    validating,
-    failure,
-    canMutate,
-    revalidate,
-    mutate,
-  };
-}

apps/web/src/lib/freshness/validators.spec.ts

@@ -1,103 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { Mission, Project, Task } from '@/lib/types';
-import {
-  validateMissionCollection,
-  validateProjectCollection,
-  validateProjectEntity,
-  validateTaskCollection,
-} from './validators';
-import { missionFixtures, projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
-
-describe('validateTaskCollection', () => {
-  it('accepts a well-formed task collection', () => {
-    expect(validateTaskCollection(taskFixtures)).toEqual({
-      data: taskFixtures,
-      workspace: null,
-    });
-  });
-
-  it('accepts an empty collection (a healthy empty state is a valid payload)', () => {
-    expect(validateTaskCollection([])).toEqual({ data: [], workspace: null });
-  });
-
-  it.each([
-    ['not an array', { items: [] }],
-    ['item is not an object', ['nope']],
-    ['missing id', [{ ...(taskFixtures[0] as Task), id: undefined }]],
-    ['missing title', [{ ...(taskFixtures[0] as Task), title: undefined }]],
-    ['unknown status enum', [{ ...(taskFixtures[0] as Task), status: 'finished' }]],
-    ['unknown priority enum', [{ ...(taskFixtures[0] as Task), priority: 'urgent' }]],
-    ['tags of the wrong type', [{ ...(taskFixtures[0] as Task), tags: 'spa' }]],
-    ['metadata of the wrong type', [{ ...(taskFixtures[0] as Task), metadata: 'notes' }]],
-    ['createdAt of the wrong type', [{ ...(taskFixtures[0] as Task), createdAt: 1234 }]],
-    ['null sneaks past a required string', [{ ...(taskFixtures[0] as Task), title: null }]],
-  ])('rejects a malformed payload: %s', (_label, value) => {
-    expect(validateTaskCollection(value)).toBeNull();
-  });
-});
-
-describe('validateMissionCollection', () => {
-  it('accepts a well-formed mission collection', () => {
-    expect(validateMissionCollection(missionFixtures)).toEqual({
-      data: missionFixtures,
-      workspace: null,
-    });
-  });
-
-  it.each([
-    ['not an array', null],
-    ['item missing name', [{ ...(missionFixtures[0] as Mission), name: 42 }]],
-    ['unknown status enum', [{ ...(missionFixtures[0] as Mission), status: 'canceled' }]],
-    ['projectId of the wrong type', [{ ...(missionFixtures[0] as Mission), projectId: 7 }]],
-  ])('rejects a malformed payload: %s', (_label, value) => {
-    expect(validateMissionCollection(value)).toBeNull();
-  });
-});
-
-describe('validateProjectCollection', () => {
-  it('accepts a uniform workspace-scoped collection and reports its workspace', () => {
-    expect(validateProjectCollection(projectFixtures)).toEqual({
-      data: projectFixtures,
-      workspace: 'user-1',
-    });
-  });
-
-  it('accepts an empty collection with no workspace identity', () => {
-    expect(validateProjectCollection([])).toEqual({ data: [], workspace: null });
-  });
-
-  it.each([
-    ['not an array', 42],
-    ['item missing userId', [{ ...(projectFixtures[0] as Project), userId: undefined }]],
-    ['unknown status enum', [{ ...(projectFixtures[0] as Project), status: 'live' }]],
-    ['description of the wrong type', [{ ...(projectFixtures[0] as Project), description: 1 }]],
-  ])('rejects a malformed payload: %s', (_label, value) => {
-    expect(validateProjectCollection(value)).toBeNull();
-  });
-
-  it('rejects a collection mixing workspace identities (cross-workspace leak)', () => {
-    const mixed = [
-      projectFixtures[0] as Project,
-      { ...(projectFixtures[1] as Project), userId: 'user-2' },
-    ];
-    expect(validateProjectCollection(mixed)).toBeNull();
-  });
-});
-
-describe('validateProjectEntity', () => {
-  it('accepts a well-formed project and reports its workspace', () => {
-    expect(validateProjectEntity(projectFixtures[0])).toEqual({
-      data: projectFixtures[0],
-      workspace: 'user-1',
-    });
-  });
-
-  it.each([
-    ['not an object', 'project-1'],
-    ['null', null],
-    ['array', [projectFixtures[0]]],
-    ['missing userId', [{ ...(projectFixtures[0] as Project), userId: null }]],
-  ])('rejects a malformed entity: %s', (_label, value) => {
-    expect(validateProjectEntity(value)).toBeNull();
-  });
-});

apps/web/src/lib/freshness/validators.ts

@@ -1,135 +0,0 @@
-import type { Mission, Project, Task, MissionStatus, TaskPriority, TaskStatus } from '@/lib/types';
-import type { FreshPayload } from './model';
-
-/**
- * Runtime schema validators for gateway collections (RI-5-001).
- *
- * `api<T>()` returns untrusted JSON cast to `T`; these validators are the
- * seam where a malformed response becomes an explicit schema mismatch
- * instead of flowing into the render path as if it were healthy data.
- */
-
-const taskStatuses: readonly TaskStatus[] = [
-  'not-started',
-  'in-progress',
-  'blocked',
-  'done',
-  'cancelled',
-];
-const taskPriorities: readonly TaskPriority[] = ['critical', 'high', 'medium', 'low'];
-const missionStatuses: readonly MissionStatus[] = [
-  'planning',
-  'active',
-  'paused',
-  'completed',
-  'failed',
-];
-const projectStatuses: readonly Project['status'][] = ['active', 'paused', 'completed', 'archived'];
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-function isString(value: unknown): value is string {
-  return typeof value === 'string';
-}
-
-function isNullableString(value: unknown): value is string | null {
-  return value === null || typeof value === 'string';
-}
-
-function isOneOf<T extends string>(value: unknown, allowed: readonly T[]): value is T {
-  return typeof value === 'string' && (allowed as readonly string[]).includes(value);
-}
-
-function isNullableRecord(value: unknown): value is Record<string, unknown> | null {
-  return value === null || isRecord(value);
-}
-
-function isNullableStringArray(value: unknown): value is string[] | null {
-  if (value === null) return true;
-  if (!Array.isArray(value)) return false;
-  return value.every((item) => typeof item === 'string');
-}
-
-function isIsoLike(value: unknown): value is string {
-  return typeof value === 'string' && value.length > 0;
-}
-
-function isTask(value: unknown): value is Task {
-  if (!isRecord(value)) return false;
-  return (
-    isString(value['id']) &&
-    isString(value['title']) &&
-    isOneOf(value['status'], taskStatuses) &&
-    isOneOf(value['priority'], taskPriorities) &&
-    isNullableString(value['projectId']) &&
-    isNullableString(value['missionId']) &&
-    isNullableString(value['assignee']) &&
-    isNullableStringArray(value['tags']) &&
-    isNullableRecord(value['metadata']) &&
-    isNullableString(value['dueDate']) &&
-    isIsoLike(value['createdAt']) &&
-    isIsoLike(value['updatedAt'])
-  );
-}
-
-/** Tasks carry no workspace identity; scope falls back to the policy. */
-export function validateTaskCollection(value: unknown): FreshPayload<Task[]> | null {
-  if (!Array.isArray(value) || !value.every(isTask)) return null;
-  return { data: value as Task[], workspace: null };
-}
-
-function isMission(value: unknown): value is Mission {
-  if (!isRecord(value)) return false;
-  return (
-    isString(value['id']) &&
-    isString(value['name']) &&
-    isOneOf(value['status'], missionStatuses) &&
-    isNullableString(value['projectId']) &&
-    isNullableString(value['description']) &&
-    isNullableRecord(value['metadata']) &&
-    isIsoLike(value['createdAt']) &&
-    isIsoLike(value['updatedAt'])
-  );
-}
-
-/** Missions carry no workspace identity; scope falls back to the policy. */
-export function validateMissionCollection(value: unknown): FreshPayload<Mission[]> | null {
-  if (!Array.isArray(value) || !value.every(isMission)) return null;
-  return { data: value as Mission[], workspace: null };
-}
-
-function isProject(value: unknown): value is Project {
-  if (!isRecord(value)) return false;
-  return (
-    isString(value['id']) &&
-    isString(value['name']) &&
-    isOneOf(value['status'], projectStatuses) &&
-    isString(value['userId']) &&
-    isNullableString(value['description']) &&
-    isNullableRecord(value['metadata']) &&
-    isIsoLike(value['createdAt']) &&
-    isIsoLike(value['updatedAt'])
-  );
-}
-
-/**
- * Projects are workspace-scoped: every item must carry the same `userId`.
- * A collection mixing identities (cross-workspace leak) is a schema
- * mismatch; the uniform `userId` becomes the snapshot workspace.
- */
-export function validateProjectCollection(value: unknown): FreshPayload<Project[]> | null {
-  if (!Array.isArray(value) || !value.every(isProject)) return null;
-  const projects = value as Project[];
-  const workspaces = new Set(projects.map((project) => project.userId));
-  if (workspaces.size > 1) return null;
-  return { data: projects, workspace: projects.length > 0 ? projects[0]!.userId : null };
-}
-
-/** Single project entity (project detail primary collection). */
-export function validateProjectEntity(value: unknown): FreshPayload<Project> | null {
-  if (!isProject(value)) return null;
-  const project = value as Project;
-  return { data: project, workspace: project.userId };
-}

apps/web/src/spa/pages/project-detail.spec.tsx

@@ -35,7 +35,6 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
-  sessionStorage.clear();
 });
 
 async function renderProjectDetailPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -65,49 +64,21 @@ function clickButtonByText(text: string): void {
   button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 
-async function flushAct(): Promise<void> {
-  await act(async () => {
-    await Promise.resolve();
-  });
-}
-
-interface Deferred<T> {
-  promise: Promise<T>;
-  resolve: (value: T) => void;
-}
-
-function createDeferred<T>(): Deferred<T> {
-  let resolve!: (value: T) => void;
-  const promise = new Promise<T>((res) => {
-    resolve = res;
-  });
-  return { promise, resolve };
-}
-
-const projectOneTasks = taskFixtures.filter((task) => task.projectId === 'project-1');
-
-function mockHealthyLoad(): void {
-  apiMock
-    .mockResolvedValueOnce(projectFixtures[0])
-    .mockResolvedValueOnce(missionFixtures)
-    .mockResolvedValueOnce(projectOneTasks);
-}
-
 describe('ProjectDetailPage', () => {
   it('loads the project, tasks, missions, and optional PRD content for the active project', async () => {
-    mockHealthyLoad();
+    apiMock
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockResolvedValueOnce(missionFixtures)
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
 
     await renderProjectDetailPage();
 
-    expect(apiMock.mock.calls.map((call) => call[0])).toEqual([
-      '/api/projects/project-1',
-      '/api/missions',
-      '/api/tasks?projectId=project-1',
+    expect(apiMock.mock.calls).toEqual([
+      ['/api/projects/project-1'],
+      ['/api/missions'],
+      ['/api/tasks?projectId=project-1'],
     ]);
 
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
     expect(container.textContent).toContain('Mosaic Stack');
     expect(container.textContent).toContain('Route /projects/:id');
     expect(container.textContent).toContain('Tasks');
@@ -130,7 +101,10 @@ describe('ProjectDetailPage', () => {
   });
 
   it('opens and closes the existing read-only task modal from the tasks tab', async () => {
-    mockHealthyLoad();
+    apiMock
+      .mockResolvedValueOnce(projectFixtures[0])
+      .mockResolvedValueOnce(missionFixtures)
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
 
     await renderProjectDetailPage();
 
@@ -160,153 +134,35 @@ describe('ProjectDetailPage', () => {
     expect(container.querySelector('[role="dialog"]')).toBeNull();
   });
 
-  it('shows verified completion verdicts when the task collection is current', async () => {
-    mockHealthyLoad();
-
-    await renderProjectDetailPage();
-
-    const doneCard = [...container.querySelectorAll('div')].find(
-      (candidate) => candidate.textContent === 'Done1',
-    );
-    expect(doneCard).toBeTruthy();
-    const inProgressCard = [...container.querySelectorAll('div')].find(
-      (candidate) => candidate.textContent === 'In Progress1',
-    );
-    expect(inProgressCard).toBeTruthy();
-  });
-
-  it('renders an explicit unavailable missions tab when the missions request fails (partial, not empty)', async () => {
+  it('renders the project with an empty missions tab when the missions request fails', async () => {
     apiMock
       .mockResolvedValueOnce(projectFixtures[0])
       .mockRejectedValueOnce(new Error('Missions request failed'))
-      .mockResolvedValueOnce(projectOneTasks);
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
 
     await renderProjectDetailPage();
 
-    // Secondary failure degrades the surface to partial; the project itself
-    // still renders.
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'partial',
-    );
     expect(container.textContent).toContain('Mosaic Stack');
-    const partial = container.querySelector('[role="status"]');
-    expect(partial?.textContent).toContain('Missions');
-    expect(partial?.textContent).toContain('unavailable');
+    expect(container.querySelector('[role="alert"]')).toBeNull();
 
     await act(async () => {
-      clickButtonByText('Missions (?)');
+      clickButtonByText('Missions (0)');
     });
 
-    const alert = container.querySelector('[role="alert"]');
-    expect(alert?.textContent).toContain('Missions request failed');
-    // Negative control: a failed fetch must not look like an empty list.
-    expect(container.textContent).not.toContain('No missions for this project');
+    expect(container.textContent).toContain('No missions for this project');
   });
 
-  it('marks derived verdicts unknown when the tasks collection is unavailable', async () => {
-    apiMock
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockResolvedValueOnce(missionFixtures)
-      .mockRejectedValueOnce(new Error('Tasks request failed'));
-
-    await renderProjectDetailPage();
-
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'partial',
-    );
-
-    // Completion verdicts become unknown ('?') — never green counts.
-    for (const label of ['Done', 'In Progress', 'Blocked', 'Tasks']) {
-      const unknownCard = [...container.querySelectorAll('div')].find(
-        (candidate) => candidate.textContent === `${label}?`,
-      );
-      expect(unknownCard, `expected ${label} card to render ?`).toBeTruthy();
-    }
-    // Negative control: no green "Done 1" verdict anywhere.
-    expect(
-      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
-    ).toBe(false);
-
-    await act(async () => {
-      clickButtonByText('Tasks (?)');
-    });
-
-    const alert = container.querySelector('[role="alert"]');
-    expect(alert?.textContent).toContain('Tasks request failed');
-    // Negative control: no healthy empty task list from a failed fetch.
-    expect(container.textContent).not.toContain('No tasks found');
-    expect(container.querySelector('table')).toBeNull();
-  });
-
-  it('recovers a partial surface to current after revalidation', async () => {
-    apiMock
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockResolvedValueOnce(missionFixtures)
-      .mockRejectedValueOnce(new Error('Tasks request failed'))
-      .mockResolvedValueOnce(projectFixtures[0])
-      .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(projectOneTasks);
-
-    await renderProjectDetailPage();
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'partial',
-    );
-
-    await act(async () => {
-      clickButtonByText('Revalidate');
-    });
-    await flushAct();
-
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
-    expect(
-      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
-    ).toBe(true);
-  });
-
-  it("never shows one project's data on another project's route after navigation", async () => {
-    mockHealthyLoad();
-
-    const router = await renderProjectDetailPage();
-    expect(container.textContent).toContain('Mosaic Stack');
-
-    const deferred = createDeferred<(typeof projectFixtures)[number]>();
-    apiMock
-      .mockResolvedValueOnce(deferred.promise)
-      .mockResolvedValueOnce([])
-      .mockResolvedValueOnce([]);
-
-    await act(async () => {
-      await router.navigate('/projects/project-2');
-    });
-
-    // While project-2 loads, nothing from project-1 may render on its route.
-    expect(container.textContent).toContain('Loading project...');
-    expect(container.textContent).not.toContain('Mosaic Stack');
-    expect(container.textContent).not.toContain('Route /projects/:id');
-
-    await act(async () => {
-      deferred.resolve(projectFixtures[1]!);
-      await deferred.promise;
-    });
-
-    expect(container.textContent).toContain('Agent Runtime');
-    expect(apiMock.mock.calls[3]?.[0]).toBe('/api/projects/project-2');
-  });
-
-  it('renders a visible unavailable state when the project request fails and lets the user navigate back', async () => {
+  it('renders a visible alert when the project request fails and lets the user navigate back', async () => {
     apiMock
       .mockRejectedValueOnce(new Error('Project request failed'))
       .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(projectOneTasks);
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
 
     const router = await renderProjectDetailPage();
 
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Project request failed');
-    expect(alert?.textContent).toContain('not an empty result');
     expect(container.textContent).not.toContain('Mosaic Stack');
 
     await act(async () => {

apps/web/src/spa/pages/project-detail.tsx

@@ -1,30 +1,14 @@
-import { useState, type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { useNavigate, useParams } from 'react-router-dom';
 import { MissionTimeline } from '@/components/projects/mission-timeline';
 import { PrdViewer } from '@/components/projects/prd-viewer';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
 import { TaskStatusSummary } from '@/components/tasks/task-status-summary';
-import {
-  PartialDataNotice,
-  StaleDataNotice,
-  UnavailableDataNotice,
-} from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Mission, Project, Task, TaskStatus } from '@/lib/types';
-import {
-  combineFreshness,
-  UNKNOWN_VERDICT,
-  verdictValue,
-  type FreshSnapshot,
-} from '@/lib/freshness/model';
-import { describeFailure, useFreshCollection } from '@/lib/freshness/use-fresh-collection';
-import {
-  validateMissionCollection,
-  validateProjectEntity,
-  validateTaskCollection,
-} from '@/lib/freshness/validators';
+import { getErrorMessage } from './page-errors';
 
 type Tab = 'overview' | 'tasks' | 'missions' | 'prd';
 
@@ -67,75 +51,55 @@ function TabButton({ id, label, activeTab, onClick }: TabButtonProps): ReactElem
   );
 }
 
-/** Remounts per project id so no state from one project renders for another. */
 export function ProjectDetailPage(): ReactElement {
   const { id = '' } = useParams();
-  return <ProjectDetail id={id} key={id} />;
-}
-
-function ProjectDetail({ id }: { id: string }): ReactElement {
   const navigate = useNavigate();
-  const enabled = id.length > 0;
-
-  // Primary collection gates the surface; missions and tasks are secondaries
-  // whose failures degrade the surface to `partial` instead of rendering
-  // empty healthy lists.
-  const project = useFreshCollection<Project>({
-    source: `gateway:/api/projects/${id}`,
-    fetcher: (signal) => api<unknown>(`/api/projects/${id}`, { signal }),
-    validate: validateProjectEntity,
-    // No last-known restore: the entity carries workspace identity that
-    // cannot be scope-checked before display (see ProjectsPage note).
-    enabled,
-  });
-  const missions = useFreshCollection<Mission[]>({
-    source: 'gateway:/api/missions',
-    fetcher: (signal) => api<unknown>('/api/missions', { signal }),
-    validate: validateMissionCollection,
-    cacheKey: enabled ? 'missions' : null,
-    enabled,
-  });
-  const tasks = useFreshCollection<Task[]>({
-    source: `gateway:/api/tasks?projectId=${id}`,
-    fetcher: (signal) => api<unknown>(`/api/tasks?projectId=${id}`, { signal }),
-    validate: validateTaskCollection,
-    cacheKey: enabled ? `project-tasks:${id}` : null,
-    enabled,
-  });
-
+  const [project, setProject] = useState<Project | null>(null);
+  const [missions, setMissions] = useState<Mission[]>([]);
+  const [tasks, setTasks] = useState<Task[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
   const [activeTab, setActiveTab] = useState<Tab>('overview');
   const [taskFilter, setTaskFilter] = useState<TaskStatus | 'all'>('all');
   const [selectedTask, setSelectedTask] = useState<Task | null>(null);
 
-  const surface = combineFreshness(project.freshness, [missions.freshness, tasks.freshness]);
-  const tasksVerified = tasks.freshness === 'current';
-  const projectMissions = missions.data?.filter((mission) => mission.projectId === id) ?? null;
+  useEffect(() => {
+    if (!id) {
+      setError('Project id is missing.');
+      setLoading(false);
+      return;
+    }
 
-  const retryAll = (): void => {
-    void Promise.all([project.revalidate(), missions.revalidate(), tasks.revalidate()]);
-  };
+    let cancelled = false;
+    setLoading(true);
+    setError(null);
 
-  if (!enabled) {
-    return (
-      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
-        <header className="mb-6 border-b px-1 pb-3">
-          <h1 className="text-2xl font-semibold">Project</h1>
-        </header>
-        <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
-          Project id is missing.
-        </div>
-        <button
-          type="button"
-          onClick={() => navigate('/projects')}
-          className="mt-4 w-fit text-sm underline"
-        >
-          Back to projects
-        </button>
-      </div>
-    );
-  }
+    void Promise.all([
+      api<Project>('/api/projects/' + id),
+      api<Mission[]>('/api/missions').catch(() => [] as Mission[]),
+      api<Task[]>('/api/tasks?projectId=' + id).catch(() => [] as Task[]),
+    ])
+      .then(([loadedProject, allMissions, loadedTasks]) => {
+        if (cancelled) return;
+        setProject(loadedProject);
+        setMissions(allMissions.filter((mission) => mission.projectId === id));
+        setTasks(loadedTasks);
+      })
+      .catch((caught: unknown) => {
+        if (cancelled) return;
+        setError(getErrorMessage(caught, 'Failed to load project.'));
+      })
+      .finally(() => {
+        if (cancelled) return;
+        setLoading(false);
+      });
 
-  if (project.freshness === 'unknown') {
+    return () => {
+      cancelled = true;
+    };
+  }, [id]);
+
+  if (loading) {
     return (
       <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
         <header className="mb-6 border-b px-1 pb-3">
@@ -146,17 +110,15 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
     );
   }
 
-  if (project.freshness === 'unavailable' || project.data === null) {
+  if (error || !project) {
     return (
       <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
         <header className="mb-6 border-b px-1 pb-3">
           <h1 className="text-2xl font-semibold">Project</h1>
         </header>
-        <UnavailableDataNotice
-          title="This project"
-          detail={describeFailure(project.failure)}
-          onRetry={retryAll}
-        />
+        <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
+          {error ?? 'Project not found.'}
+        </div>
         <button
           type="button"
           onClick={() => navigate('/projects')}
@@ -168,48 +130,18 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
     );
   }
 
-  const projectTasks = tasks.data ?? null;
   const filteredTasks =
-    projectTasks === null
-      ? []
-      : taskFilter === 'all'
-        ? projectTasks
-        : projectTasks.filter((task) => task.status === taskFilter);
-
-  // Derived completion verdicts: unknown (never green) unless the task
-  // collection is verified current.
-  const doneCount = projectTasks?.filter((task) => task.status === 'done').length ?? 0;
-  const inProgressCount = projectTasks?.filter((task) => task.status === 'in-progress').length ?? 0;
-  const blockedCount = projectTasks?.filter((task) => task.status === 'blocked').length ?? 0;
-
-  const prdContent = getPrdContent(project.data);
+    taskFilter === 'all' ? tasks : tasks.filter((task) => task.status === taskFilter);
+  const prdContent = getPrdContent(project);
   const tabs: Array<{ id: Tab; label: string }> = [
     { id: 'overview', label: 'Overview' },
-    {
-      id: 'tasks',
-      label: `Tasks (${projectTasks === null ? UNKNOWN_VERDICT : projectTasks.length})`,
-    },
-    {
-      id: 'missions',
-      label: `Missions (${projectMissions === null ? UNKNOWN_VERDICT : projectMissions.length})`,
-    },
+    { id: 'tasks', label: `Tasks (${tasks.length})` },
+    { id: 'missions', label: `Missions (${missions.length})` },
     ...(prdContent ? [{ id: 'prd' as const, label: 'PRD' }] : []),
   ];
 
-  const staleSnapshot: FreshSnapshot<unknown> | null =
-    project.freshness === 'stale'
-      ? project.snapshot
-      : missions.freshness === 'stale'
-        ? missions.snapshot
-        : tasks.freshness === 'stale'
-          ? tasks.snapshot
-          : null;
-  const missingSections: string[] = [];
-  if (missions.freshness === 'unavailable') missingSections.push('Missions');
-  if (tasks.freshness === 'unavailable') missingSections.push('Tasks');
-
   return (
-    <div data-freshness={surface} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
       <header className="mb-6 border-b px-1 pb-3">
         <nav className="mb-4 flex items-center gap-2 text-sm text-text-muted">
           <button
@@ -220,64 +152,49 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
             Projects
           </button>
           <span>/</span>
-          <span className="text-text-primary">{project.data.name}</span>
+          <span className="text-text-primary">{project.name}</span>
         </nav>
 
         <div className="flex items-start justify-between gap-4">
           <div>
             <div className="flex items-center gap-3">
-              <h1 className="text-2xl font-semibold text-text-primary">{project.data.name}</h1>
+              <h1 className="text-2xl font-semibold text-text-primary">{project.name}</h1>
               <span
                 className={cn(
                   'rounded-full px-2 py-0.5 text-xs',
-                  projectStatusColors[project.data.status] ?? 'bg-gray-600/20 text-gray-400',
+                  projectStatusColors[project.status] ?? 'bg-gray-600/20 text-gray-400',
                 )}
               >
-                {project.data.status}
+                {project.status}
               </span>
             </div>
-            {project.data.description ? (
-              <p className="mt-1 text-sm text-text-muted">{project.data.description}</p>
+            {project.description ? (
+              <p className="mt-1 text-sm text-text-muted">{project.description}</p>
             ) : null}
             <p className="mt-2 text-xs text-text-muted">
-              Created {new Date(project.data.createdAt).toLocaleDateString()} · Updated{' '}
-              {new Date(project.data.updatedAt).toLocaleDateString()}
+              Created {new Date(project.createdAt).toLocaleDateString()} · Updated{' '}
+              {new Date(project.updatedAt).toLocaleDateString()}
             </p>
           </div>
         </div>
       </header>
 
-      {staleSnapshot !== null ? (
-        <div className="mb-6">
-          <StaleDataNotice label={staleSnapshot} onRetry={retryAll} />
-        </div>
-      ) : null}
-
-      {missingSections.length > 0 ? (
-        <div className="mb-6">
-          <PartialDataNotice missing={missingSections} onRetry={retryAll} />
-        </div>
-      ) : null}
-
       <div className="mb-6 grid grid-cols-2 gap-3 sm:grid-cols-4">
-        <StatCard
-          label="Tasks"
-          value={projectTasks === null ? UNKNOWN_VERDICT : String(projectTasks.length)}
-        />
+        <StatCard label="Tasks" value={String(tasks.length)} />
         <StatCard
           label="Done"
-          value={verdictValue(tasksVerified, String(doneCount))}
-          valueClass={tasksVerified ? 'text-success' : undefined}
+          value={String(tasks.filter((task) => task.status === 'done').length)}
+          valueClass="text-success"
         />
         <StatCard
           label="In Progress"
-          value={verdictValue(tasksVerified, String(inProgressCount))}
-          valueClass={tasksVerified ? 'text-blue-400' : undefined}
+          value={String(tasks.filter((task) => task.status === 'in-progress').length)}
+          valueClass="text-blue-400"
         />
         <StatCard
           label="Blocked"
-          value={verdictValue(tasksVerified, String(blockedCount))}
-          valueClass={tasksVerified && blockedCount > 0 ? 'text-error' : undefined}
+          value={String(tasks.filter((task) => task.status === 'blocked').length)}
+          valueClass={tasks.some((task) => task.status === 'blocked') ? 'text-error' : undefined}
         />
       </div>
 
@@ -294,43 +211,23 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
       </div>
 
       {activeTab === 'overview' ? (
-        <OverviewTab project={project.data} missions={projectMissions} tasks={projectTasks} />
+        <OverviewTab project={project} missions={missions} tasks={tasks} />
       ) : null}
 
       {activeTab === 'tasks' ? (
         <div>
-          {projectTasks === null ? (
-            <UnavailableDataNotice
-              title="Tasks"
-              detail={describeFailure(tasks.failure)}
-              onRetry={retryAll}
+          <div className="mb-4">
+            <TaskStatusSummary
+              tasks={tasks}
+              activeFilter={taskFilter}
+              onFilterChange={setTaskFilter}
             />
-          ) : (
-            <>
-              <div className="mb-4">
-                <TaskStatusSummary
-                  tasks={projectTasks}
-                  activeFilter={taskFilter}
-                  onFilterChange={setTaskFilter}
-                />
-              </div>
-              <TaskListView tasks={filteredTasks} onTaskClick={setSelectedTask} />
-            </>
-          )}
+          </div>
+          <TaskListView tasks={filteredTasks} onTaskClick={setSelectedTask} />
         </div>
       ) : null}
 
-      {activeTab === 'missions' ? (
-        projectMissions === null ? (
-          <UnavailableDataNotice
-            title="Missions"
-            detail={describeFailure(missions.failure)}
-            onRetry={retryAll}
-          />
-        ) : (
-          <MissionTimeline missions={projectMissions} />
-        )
-      ) : null}
+      {activeTab === 'missions' ? <MissionTimeline missions={missions} /> : null}
 
       {activeTab === 'prd' && prdContent ? (
         <div className="rounded-lg border border-surface-border bg-surface-card p-6">
@@ -351,26 +248,18 @@ function OverviewTab({
   tasks,
 }: {
   project: Project;
-  missions: Mission[] | null;
-  tasks: Task[] | null;
+  missions: Mission[];
+  tasks: Task[];
 }): ReactElement {
-  const recentTasks =
-    tasks === null
-      ? null
-      : [...tasks]
-          .sort(
-            (left, right) =>
-              new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime(),
-          )
-          .slice(0, 5);
+  const recentTasks = [...tasks]
+    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())
+    .slice(0, 5);
 
   return (
     <div className="grid gap-6 lg:grid-cols-2">
       <section>
         <h2 className="mb-3 text-sm font-semibold text-text-secondary">Recent Tasks</h2>
-        {recentTasks === null ? (
-          <UnavailableDataNotice title="Tasks" />
-        ) : recentTasks.length === 0 ? (
+        {recentTasks.length === 0 ? (
           <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
             <p className="text-sm text-text-muted">No tasks yet</p>
           </div>
@@ -398,9 +287,7 @@ function OverviewTab({
 
       <section>
         <h2 className="mb-3 text-sm font-semibold text-text-secondary">Missions</h2>
-        {missions === null ? (
-          <UnavailableDataNotice title="Missions" />
-        ) : missions.length === 0 ? (
+        {missions.length === 0 ? (
           <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
             <p className="text-sm text-text-muted">No missions yet</p>
           </div>

apps/web/src/spa/pages/projects.spec.tsx

@@ -51,7 +51,6 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
-  sessionStorage.clear();
 });
 
 async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -72,22 +71,6 @@ async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRoute
   return router;
 }
 
-function clickButtonByText(text: string): void {
-  const button = [...container.querySelectorAll('button')].find((candidate) =>
-    candidate.textContent?.includes(text),
-  );
-  if (!button) {
-    throw new Error(`Button containing "${text}" not found`);
-  }
-  button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
-}
-
-async function flushAct(): Promise<void> {
-  await act(async () => {
-    await Promise.resolve();
-  });
-}
-
 describe('ProjectsPage', () => {
   it('shows a visible loading state while the project request is in flight', async () => {
     const deferred = createDeferred<typeof projectFixtures>();
@@ -108,7 +91,7 @@ describe('ProjectsPage', () => {
 
     const router = await renderProjectsPage();
 
-    expect(apiMock.mock.calls[0]?.[0]).toBe('/api/projects');
+    expect(apiMock).toHaveBeenCalledWith('/api/projects');
     expect(container.textContent).toContain('Mosaic Stack');
     expect(container.textContent).toContain('Agent Runtime');
 
@@ -125,7 +108,7 @@ describe('ProjectsPage', () => {
     expect(container.textContent).toContain('Project detail target');
   });
 
-  it('renders the empty state only for a verified empty collection', async () => {
+  it('renders the empty state when the API returns no projects', async () => {
     apiMock.mockResolvedValueOnce([]);
 
     await renderProjectsPage();
@@ -134,12 +117,9 @@ describe('ProjectsPage', () => {
     expect(container.textContent).toContain(
       'Projects will appear here when created via the gateway API',
     );
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
   });
 
-  it('renders a failed fetch as an explicit unavailable state, never an empty collection', async () => {
+  it('renders a visible alert when the projects request fails', async () => {
     apiMock.mockRejectedValueOnce(new Error('Projects are unavailable'));
 
     await renderProjectsPage();
@@ -147,51 +127,5 @@ describe('ProjectsPage', () => {
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Projects are unavailable');
-    expect(alert?.textContent).toContain('not an empty result');
-
-    // Negative controls: no healthy empty state and no project cards render
-    // from a failed fetch.
-    expect(container.textContent).not.toContain('No projects yet');
-    expect(container.textContent).not.toContain('Mosaic Stack');
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'unavailable',
-    );
-  });
-
-  it('renders an auth failure as unavailable and recovers after retry', async () => {
-    apiMock
-      .mockRejectedValueOnce(Object.assign(new Error('Unauthorized'), { statusCode: 401 }))
-      .mockResolvedValueOnce(projectFixtures);
-
-    await renderProjectsPage();
-
-    const alert = container.querySelector('[role="alert"]');
-    expect(alert?.textContent).toContain('Unauthorized');
-    expect(container.textContent).not.toContain('No projects yet');
-
-    await act(async () => {
-      clickButtonByText('Retry');
-    });
-    await flushAct();
-
-    expect(container.querySelector('[role="alert"]')).toBeNull();
-    expect(container.textContent).toContain('Mosaic Stack');
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
-  });
-
-  it('renders a schema-mismatched response as unavailable, never as data', async () => {
-    apiMock.mockResolvedValueOnce({ results: projectFixtures });
-
-    await renderProjectsPage();
-
-    const alert = container.querySelector('[role="alert"]');
-    expect(alert?.textContent).toContain('not an empty result');
-    expect(container.textContent).not.toContain('Mosaic Stack');
-    expect(container.textContent).not.toContain('No projects yet');
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'unavailable',
-    );
   });
 });

apps/web/src/spa/pages/projects.tsx

@@ -1,51 +1,53 @@
-import { type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { ProjectCard } from '@/components/projects/project-card';
-import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import type { Project } from '@/lib/types';
-import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
-import { validateProjectCollection } from '@/lib/freshness/validators';
+import { getErrorMessage } from './page-errors';
 
 export function ProjectsPage(): ReactElement {
   const navigate = useNavigate();
-  const projects = useFreshCollection<Project[]>({
-    source: 'gateway:/api/projects',
-    fetcher: (signal) => api<unknown>('/api/projects', { signal }),
-    validate: validateProjectCollection,
-    // Projects carry workspace identity (userId) that is only knowable from
-    // the payload itself, so a restored entry cannot be scope-checked before
-    // display. Conservative choice: no last-known restore for this surface;
-    // cross-workspace switching is still invalidated at verification time.
-  });
-  const retry = (): void => {
-    void projects.revalidate();
-  };
+  const [projects, setProjects] = useState<Project[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let cancelled = false;
+
+    void api<Project[]>('/api/projects')
+      .then((response) => {
+        if (cancelled) return;
+        setProjects(response);
+      })
+      .catch((caught: unknown) => {
+        if (cancelled) return;
+        setError(getErrorMessage(caught, 'Failed to load projects.'));
+      })
+      .finally(() => {
+        if (cancelled) return;
+        setLoading(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
 
   return (
-    <div
-      data-freshness={projects.freshness}
-      className="flex min-h-screen flex-col px-4 py-6 sm:px-6"
-    >
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
       <header className="mb-6 border-b px-1 pb-3">
         <h1 className="text-2xl font-semibold">Projects</h1>
       </header>
 
-      {projects.freshness === 'stale' && projects.snapshot ? (
-        <div className="mb-6">
-          <StaleDataNotice label={projects.snapshot} onRetry={retry} />
+      {error ? (
+        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
+          {error}
         </div>
       ) : null}
 
-      {projects.freshness === 'unknown' ? (
+      {loading ? (
         <p className="py-8 text-center text-sm text-text-muted">Loading projects...</p>
-      ) : projects.freshness === 'unavailable' ? (
-        <UnavailableDataNotice
-          title="Projects"
-          detail={describeFailure(projects.failure)}
-          onRetry={retry}
-        />
-      ) : projects.data !== null && projects.data.length === 0 ? (
+      ) : projects.length === 0 ? (
         <div className="py-12 text-center">
           <h2 className="text-lg font-medium text-text-secondary">No projects yet</h2>
           <p className="mt-1 text-sm text-text-muted">
@@ -54,7 +56,7 @@ export function ProjectsPage(): ReactElement {
         </div>
       ) : (
         <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-          {(projects.data ?? []).map((project) => (
+          {projects.map((project) => (
             <ProjectCard
               key={project.id}
               project={project}

apps/web/src/spa/pages/tasks.spec.tsx

@@ -3,9 +3,6 @@ import { createRoot, type Root } from 'react-dom/client';
 import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 import { taskFixtures } from './page-fixtures';
-import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from '@/lib/freshness/model';
-import { writeSnapshotCache } from '@/lib/freshness/snapshot-cache';
-import { validateTaskCollection } from '@/lib/freshness/validators';
 
 const { apiMock } = vi.hoisted(() => ({
   apiMock: vi.fn(),
@@ -51,7 +48,6 @@ afterEach(async () => {
   document.body.replaceChildren();
   root = null;
   apiMock.mockReset();
-  sessionStorage.clear();
 });
 
 async function renderTasksPage(): Promise<void> {
@@ -76,13 +72,6 @@ function clickButtonByText(text: string): void {
   button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 
-/** Flush pending promise callbacks inside the act environment. */
-async function flushAct(): Promise<void> {
-  await act(async () => {
-    await Promise.resolve();
-  });
-}
-
 describe('TasksPage', () => {
   it('shows a visible loading state before the tasks request settles', async () => {
     const deferred = createDeferred<typeof taskFixtures>();
@@ -143,7 +132,7 @@ describe('TasksPage', () => {
     expect(container.textContent).toContain('Wire list and kanban modal interactions');
   });
 
-  it('renders a failed fetch as an explicit unavailable state, never an empty healthy board', async () => {
+  it('renders a visible alert when the tasks request fails', async () => {
     apiMock.mockRejectedValueOnce(new Error('Tasks request failed'));
 
     await renderTasksPage();
@@ -151,80 +140,5 @@ describe('TasksPage', () => {
     const alert = container.querySelector('[role="alert"]');
     expect(alert).toBeTruthy();
     expect(alert?.textContent).toContain('Tasks request failed');
-    expect(alert?.textContent).toContain('not an empty result');
-
-    // Negative controls: no board, no healthy empty-state markers, and the
-    // surface is marked unavailable rather than current.
-    expect(container.textContent).not.toContain('Not Started');
-    expect(container.textContent).not.toContain('No tasks');
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'unavailable',
-    );
-  });
-
-  it('recovers to a current board after retrying a failed fetch', async () => {
-    apiMock
-      .mockRejectedValueOnce(new Error('Tasks request failed'))
-      .mockResolvedValueOnce(taskFixtures);
-
-    await renderTasksPage();
-    expect(container.querySelector('[role="alert"]')).toBeTruthy();
-
-    await act(async () => {
-      clickButtonByText('Retry');
-    });
-    await flushAct();
-
-    expect(container.querySelector('[role="alert"]')).toBeNull();
-    expect(container.textContent).toContain('Not Started');
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
-  });
-
-  it('labels restored last-known data as stale with source, version, and age until verified', async () => {
-    // Seed a last-known snapshot fetched five minutes ago; the page must
-    // render it only under an explicit staleness label while the fetch is
-    // still in flight.
-    const restored = acceptSnapshot({
-      value: taskFixtures,
-      validate: validateTaskCollection,
-      previous: null,
-      policy: DEFAULT_FRESHNESS_POLICY,
-      source: 'gateway:/api/tasks',
-      now: Date.now() - 5 * 60_000,
-    });
-    if (restored.outcome !== 'accepted') throw new Error('fixture setup failed');
-    writeSnapshotCache('tasks', restored.snapshot);
-
-    const deferred = createDeferred<typeof taskFixtures>();
-    apiMock.mockReturnValueOnce(deferred.promise);
-
-    await renderTasksPage();
-
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'stale',
-    );
-    const banner = container.querySelector('[role="status"]');
-    expect(banner?.textContent).toContain('last-known');
-    expect(banner?.textContent).toContain('may be out of date');
-    expect(banner?.textContent).toContain('gateway:/api/tasks');
-    expect(banner?.textContent).toContain('snapshot v1');
-    expect(banner?.textContent).toContain('5m ago');
-
-    // Last-known data still renders as situational awareness under the label.
-    expect(container.textContent).toContain('Route /tasks');
-    expect(container.textContent).not.toContain('Loading tasks...');
-
-    // Verification lands: the banner clears and the surface becomes current.
-    await act(async () => {
-      deferred.resolve(taskFixtures);
-      await deferred.promise;
-    });
-
-    expect(container.querySelector('[role="status"]')).toBeNull();
-    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
-      'current',
-    );
   });
 });

apps/web/src/spa/pages/tasks.tsx

@@ -1,32 +1,45 @@
-import { useState, type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { KanbanBoard } from '@/components/tasks/kanban-board';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
-import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Task } from '@/lib/types';
-import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
-import { validateTaskCollection } from '@/lib/freshness/validators';
+import { getErrorMessage } from './page-errors';
 
 type ViewMode = 'list' | 'kanban';
 
 export function TasksPage(): ReactElement {
-  const tasks = useFreshCollection<Task[]>({
-    source: 'gateway:/api/tasks',
-    fetcher: (signal) => api<unknown>('/api/tasks', { signal }),
-    validate: validateTaskCollection,
-    cacheKey: 'tasks',
-  });
+  const [tasks, setTasks] = useState<Task[]>([]);
   const [view, setView] = useState<ViewMode>('kanban');
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
   const [selectedTask, setSelectedTask] = useState<Task | null>(null);
 
-  const retry = (): void => {
-    void tasks.revalidate();
-  };
+  useEffect(() => {
+    let cancelled = false;
+
+    void api<Task[]>('/api/tasks')
+      .then((response) => {
+        if (cancelled) return;
+        setTasks(response);
+      })
+      .catch((caught: unknown) => {
+        if (cancelled) return;
+        setError(getErrorMessage(caught, 'Failed to load tasks.'));
+      })
+      .finally(() => {
+        if (cancelled) return;
+        setLoading(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
 
   return (
-    <div data-freshness={tasks.freshness} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
       <header className="mb-6 flex items-center justify-between gap-4 border-b px-1 pb-3">
         <h1 className="text-2xl font-semibold">Tasks</h1>
         <div className="flex rounded-lg border border-surface-border">
@@ -57,24 +70,18 @@ export function TasksPage(): ReactElement {
         </div>
       </header>
 
-      {tasks.freshness === 'stale' && tasks.snapshot ? (
-        <div className="mb-6">
-          <StaleDataNotice label={tasks.snapshot} onRetry={retry} />
+      {error ? (
+        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
+          {error}
         </div>
       ) : null}
 
-      {tasks.freshness === 'unknown' ? (
+      {loading ? (
         <p className="py-8 text-center text-sm text-text-muted">Loading tasks...</p>
-      ) : tasks.freshness === 'unavailable' ? (
-        <UnavailableDataNotice
-          title="Tasks"
-          detail={describeFailure(tasks.failure)}
-          onRetry={retry}
-        />
       ) : view === 'kanban' ? (
-        <KanbanBoard tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
+        <KanbanBoard tasks={tasks} onTaskClick={setSelectedTask} />
       ) : (
-        <TaskListView tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
+        <TaskListView tasks={tasks} onTaskClick={setSelectedTask} />
       )}
 
       {selectedTask ? (

docs/PRD.md

@@ -1368,38 +1368,3 @@ All work is **alpha** (< 0.1.0) until Jason approves 0.1.0 beta release.
 10. ASSUMPTION: **Conversations and messages get their own PG tables** (not stored in brain's entity model). They follow a chat-specific schema with proper foreign keys to users and projects. Rationale: Chat has different access patterns (streaming, pagination, search) than brain entities.
 
 11. RESOLVED: **Pi handles all target LLM providers natively.** Anthropic, OpenAI/Codex, Z.ai, Ollama, LM Studio, and llama.cpp are all supported via Pi's built-in providers or `models.json` configuration with `openai-completions` API type. No custom provider adapters needed in @mosaicstack/agent — only configuration management.
-
----
-
-## Release Integrity Workstream (RI, #1275)
-
-### Problem and objective
-
-At `next` 476db12b (review of 2026-08-17), publication from `next` is not bound to the full verification pipeline for the same commit: the publish pipeline's publish steps depend on `build` only, while ordinary push CI excludes `next`. Public Forge/MACP paths contain false-success placeholders: a stub executor that reports `completed` with exit zero, planning/remediation gates that execute literal `true`, a review gate that echoes an approving verdict, and a gate runner that treats empty commands and unimplemented CI-provider gates as passing. Shipping UI surfaces can render a failed fetch as an empty, healthy collection.
-
-Objective: for alpha 0.0.50, the release cannot publish, report, or display work state that the repository has not actually verified. Decisions SDLC-D-033 through SDLC-D-038 (Jason, 2026-08-17) scope this floor; full decision text and required-behavior lists live in jarvis-brain `docs/plans/2026-08-16_mosaic-stack-sdlc-protocol.md` and `data/decisions/mosaic-stack-sdlc-protocol.json`. This section restates only the normative requirements.
-
-### Normative requirements
-
-1. **RI-N1 Exact-commit publication verification (SDLC-D-034).** One canonical terminal verification command performs self-contained re-verification in the publish pipeline against the job's checked-out commit before any external publication effect. The command contains or invokes the complete mandatory verification set (semantic parity with the PR merge gate, including sanitization, upgrade-guard, typecheck, lint, format check, tests, and build); CI and publication do not maintain separate semantic checklists. Every publish step depends on the verification step in the executable pipeline DAG. Provider commit identity and `git rev-parse HEAD` must identify the same commit. Missing, skipped, cancelled, stale, or inconclusive checks fail closed. Documentation-only runs may skip publication but cannot bypass verification when a publication effect will occur. A negative control must prove that a broken check blocks every publish step.
-
-2. **RI-N2 Fail-closed Forge/MACP with explicit simulation (SDLC-D-035).** Simulation requires explicit caller intent (e.g. `--simulate`) and produces a distinct typed `simulated` state that can never satisfy dependencies, acceptance criteria, gates, merge, or release. Normal execution exits nonzero with a typed capability failure when a required executor, reviewer, command, or CI provider is absent — no stub completion, no literal-`true` gates, no synthetic approvals, no empty-command passes. A manual gate with no automation enters a waiting state; it does not pass. Positive tests prove explicit simulation still works; negative controls prove simulation and every missing-provider case cannot advance lifecycle state.
-
-3. **RI-N3 One transitional PRD authority (SDLC-D-036).** `@mosaicstack/prdy` structured storage under `docs/prdy/`, driven by `mosaic mission --plan`, is the authoritative PRD representation for the alpha. `mosaic prdy` either routes through the same application service or operates only as an explicit, named Markdown import/export adapter; `docs/PRD.md` is not a peer authority. `mission --plan` must persist the mission↔PRD linkage (mission id/version, PRD id/version, selected requirements). Markdown output is a generated view carrying source identity; editing it cannot mutate authority silently. Import is explicit, validated, and conflict-aware (proposed successor, never overwrite). Structural validity is separate from approval.
-
-4. **RI-N4 One quality-rails evaluator (SDLC-D-037).** The TypeScript quality-rails package is the sole authoritative evaluator. A complete probe inventory maps every current TypeScript and shell check to one canonical check with disposition (preserve/strengthen/retire, each named). Effective shell enforcement probes are absorbed before their independent paths retire; expected-file presence alone is not parity. The evaluator returns typed results (`passed`/`failed`/`blocked`/`error`/`not-applicable`) with check version, subject, and reason; missing implementation, missing input, unknown check, process error, timeout, or malformed output can never become `passed` or an unqualified skip. Check definitions and policy are versioned and digested. Shell commands become thin adapters with no separate verdict logic. The canonical terminal verification command (RI-N1) invokes this evaluator rather than duplicating its logic. Contract, parity, and negative-control tests are required, plus independent review of probe equivalence.
-
-5. **RI-N5 Consequence-aware stale UI (SDLC-D-038).** Mission Control distinguishes typed freshness states (`current`, `stale`, `partial`, `unknown`, `unavailable`) rather than inferring from empty arrays or null. A failed fetch never renders as an empty healthy collection. Last-known data may display for situational awareness only with source identity, version, and age visibly labeled; any derived completion/assurance/release verdict whose inputs are stale becomes `unknown`; all state-changing actions are disabled until fresh state loads and is revalidated. With no verified snapshot, surfaces show an explicit unavailable state. Cache corruption, cross-workspace data, schema mismatch, and version regression invalidate the snapshot. Tests cover the failure matrix (network, auth, malformed, partial, corruption, stale age, schema mismatch, recovery, stale-action rejection) with negative controls proving no case yields a current green verdict or enabled mutation.
-
-### Acceptance criteria
-
-- AC-RI-1: A push to `next` that fails any mandatory verification step publishes nothing (no npm package, no image), demonstrated by a checked-in negative control and by pipeline evidence on a real `next` publish run where the verification step is green and every publish step depends on it.
-- AC-RI-2: With no executor/reviewer/CI provider wired, Forge and MACP normal runs exit nonzero with typed capability failures; with `--simulate`, runs complete but every result is typed `simulated` and cannot satisfy any gate, dependency, or completion state — proven by unit tests including negative controls.
-- AC-RI-3: A PRD created or revised through either `mosaic mission --plan` or `mosaic prdy` resolves to one authority under `docs/prdy/` with stable identities and versions; the mission↔PRD linkage survives restart; a Markdown export is labeled as generated and cannot silently become a second writer; divergent legacy content blocks baseline claims until explicitly resolved — proven by contract tests.
-- AC-RI-4: `quality-rails check` through any entry point (TS CLI, framework shell adapter) returns the same typed verdict for the same subject; the probe inventory names every legacy check's disposition; a deliberately broken probe fails closed — proven by contract/parity/negative-control tests and independent review of probe equivalence.
-- AC-RI-5: No shipping surface renders a failed fetch as an empty healthy state; stale/partial/unavailable states are typed, labeled, and mutation-disabled — proven by the failure-matrix tests.
-- AC-RI-6: All cards merged to `next` via squash PR with terminal-green CI; release evidence for 0.0.50 records commit, verification run, and published artifacts.
-
-### Out of scope
-
-The canonical dispatcher/control-plane vertical slice (work graph, execution attempts, fenced leases, typed check-in, independent verifier dispatch) is decided post-alpha (SDLC-D-033, option B). Multi-pipeline verification certificates (SDLC-D-034 option B) are post-alpha. Full AF-1..AF-4 objective matrices and Mission Control portfolio surfaces are post-alpha.

docs/release-integrity/TASKS.md

@@ -1,42 +0,0 @@
-# Tasks — Release Integrity Workstream (RI-050, #1275)
-
-> Single-writer: the RI-050 orchestrator (jarvis, dragon-lin) only. Workers read but never modify.
->
-> **Mission:** alpha 0.0.50 release-integrity floor (decisions SDLC-D-033..038).
-> **PRD:** [docs/PRD.md § Release Integrity Workstream](../PRD.md#release-integrity-workstream-ri-1275)
-> **Issue:** #1275 (remains open until RI-V-001 closes)
-> **Base branch:** `next` (all cards branch from `origin/next`, squash-merge via PR)
->
-> **Execution note:** the `agent` column uses `pi-glm-5.3` — outside the pipeline-cron model
-> table on purpose. This workstream is executed by jarvis on dragon-lin with local pi workers
-> (`pi --model zai/glm-5.3:high`); pipeline crons must not auto-claim these rows.
->
-> **Status values:** `not-started` | `in-progress` | `done` | `blocked` | `failed` | `needs-qa`
-> `done` requires: repo quality gates green, independent review recorded, terminal-green CI on
-> the PR head, squash merge to `next`, and acceptance evidence in notes.
-
-| id       | status      | description                                                                                                                                                                                                                                                                      | issue | agent      | repo              | branch                            | depends_on                                                 | estimate | notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| -------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ---------- | ----------------- | --------------------------------- | ---------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| RI-0-001 | done        | Bootstrap: issue #1275, PRD section, this DAG, scratchpad (docs only)                                                                                                                                                                                                            | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-mission-bootstrap     | —                                                          | 6K       | PR #1276 (head 758659dd): docs-only, CI green (2475). Review requested from fargo. Merges first (no publish run).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| RI-1-001 | done        | RI-N1: canonical terminal verification command + publish-pipeline exact-commit gate (every publish step depends on verify; commit identity check; fail closed)                                                                                                                   | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-publish-gate          | RI-0-001                                                   | 25K      | PR #1277 (head 46784c8d): CI GREEN at head after serialized retry (pipeline 2476, 2026-08-18) - earlier red was CI-agent contention (web SPA timeouts under concurrent pipelines), not code. Review requested from fargo at pinned head (comms 20260818T021025Z).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| RI-1-002 | done        | RI-N1 negative control: checked-in tests proving a broken mandatory check blocks every publish step and that DAG edges cannot be bypassed                                                                                                                                        | #1275 | pi-glm-5.3 | mosaicstack/stack | test/ri-050-publish-gate-negative | RI-1-001                                                   | 12K      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| RI-2-001 | done        | RI-N2 (Forge): remove stub-executor false success; `--simulate` typed `simulated` results that satisfy nothing; literal-`true` gates and echo-review replaced with real gates or typed waiting-for-authority                                                                     | #1275 | pi-glm-5.3 | mosaicstack/stack | fix/ri-050-forge-fail-closed      | RI-0-001                                                   | 20K      | Independent review APPROVED 2026-08-17 (Gitea review 172 on PR #1278, head 99b8f6ea; reviewing seat fargo — recorded under shared host principal mos-dt-0, provenance correction posted by fred; wrapper gap filed by fred). Executed at head: forge tests 116/116, lint green, typecheck green after building macp dist (minimal-install artifact, not a defect), workspace typecheck 45/45, no external type consumers of the changed interfaces. CI red = known lane-wide fleet-test failure only, carries no information about this change (fred, log-content analysis, pipelines 2456-2458). Non-blocking finding: README L141-143 + skills/mosaic-forge/SKILL.md document bare forge run/resume, which now fails closed — fast-follow docs touch. Merge queued behind #1270. UPDATE 2026-08-18: #1270 merged; CI GREEN at head 4917df1f via serialized retry (pipeline 2477) - root cause of prior reds was CI-agent contention (web SPA timeouts under concurrent pipelines), superseding the fleet-test-failure theory. |
-| RI-2-002 | done        | RI-N2 (MACP): gate runner fails closed on empty commands, stub executors, and unimplemented CI-provider gates unless explicit simulate; typed capability failures                                                                                                                | #1275 | pi-glm-5.3 | mosaicstack/stack | fix/ri-050-macp-fail-closed       | RI-0-001                                                   | 15K      | PR #1293 (head 2097379e): CI green (pipeline 2465), independent review APPROVED (Gitea review 173, jarvis seat, 2026-08-17) - macp 109/109 verified at head. Merge queued behind #1276/#1277/#1278.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| RI-3-001 | done        | RI-N4: complete probe inventory mapping every TS and shell quality-rail check to one canonical check with disposition (preserve/strengthen/retire, each named)                                                                                                                   | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-qr-probe-inventory    | RI-0-001                                                   | 12K      | PR #1302 (head e06a47fac591): CI green (2484), independent review APPROVED (Gitea review 187, fargo seat, 2026-08-18) — 54 rows / 21 canonical checks / dispositions 43-2-9-0 verified by row-count and code spot-checks. Merged by fargo at pinned head.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| RI-3-002 | not-started | RI-N4: TS evaluator absorbs effective shell probes; typed results (passed/failed/blocked/error/not-applicable) with versioned digested check definitions; shell commands become thin adapters; contract/parity/negative-control tests                                            | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-qr-evaluator          | RI-3-001                                                   | 30K      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| RI-4-001 | in-progress | RI-N3: one PRD application service — `mission --plan` persists mission↔PRD linkage (ids/versions/selected requirements); `mosaic prdy` routes through the service or becomes a named import/export adapter; Markdown is a labeled generated view; explicit conflict-aware import | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-prd-authority         | RI-0-001                                                   | 35K      | PR #1294 (head 8d258e1d): CI green (pipeline 2466), independent review APPROVED (Gitea review 174, jarvis seat, 2026-08-17) - prdy 20/20 + command specs 9/9 at head. Merge queued behind #1276/#1277/#1278.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| RI-5-001 | done        | RI-N5: typed freshness states (current/stale/partial/unknown/unavailable); no failed-fetch-renders-empty; stale derived verdicts → unknown; mutations disabled when stale; failure-matrix tests                                                                                  | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-web-stale-safety      | RI-0-001                                                   | 25K      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| RI-V-001 | not-started | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded                                                                                                          | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence      | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-
-## Dispatch waves (max 2 parallel workers)
-
-1. RI-1-001 + RI-2-001
-2. RI-2-002 + RI-4-001
-3. RI-3-001 + RI-5-001
-4. RI-1-002 + RI-3-002
-5. RI-V-001
-
-## Budget
-
-Derived soft cap: 250K tokens (no explicit cap given). Projected total: 190K.
-Conservative mode (1 worker) above 70% projected; freeze above 90%.

docs/release-integrity/probe-inventory.md

@@ -1,186 +0,0 @@
-# Quality-Rails Probe Inventory — RI-3-001
-
-- **Task:** RI-3-001 (SDLC-D-037 first half; PRD § Release Integrity Workstream, RI-N4)
-- **Date:** 2026-08-18
-- **Base:** `origin/next` @ `8199261c` (branch `docs/ri-050-qr-probe-inventory`)
-- **Follow-up:** RI-3-002 consumes the dispositions here when building the single TS evaluator.
-
-## 0. Scope and method
-
-Every mechanism in this repository that verifies a quality, integrity, safety, or release
-property — TypeScript checks, shell probes, pipeline steps, git hooks, and installer-side
-assertions — gets one row. Each row's "what it actually verifies" was written from the
-probe's **code**, not its name or docs. Framework tool unit/regression suites (git wrappers,
-wake, tmux, orchestrator, …) are treated as one enforcement surface (`test:framework-shell`)
-because they test tool behavior rather than repo quality; their wiring integrity is itself
-guarded by `check-test-enumeration.sh`, and the quality-relevant members are rowed
-individually.
-
-**Kinds:** `ts` (TypeScript/Node check), `shell` (bash/python probe), `pipeline-step`
-(exists only inside a Woodpecker pipeline).
-
-**Enforcement points:** `local` (operator-invoked), `pre-commit`, `pre-push`,
-`CI ci.yml#<step>`, `publish.yml#<step>` (CI on push to main/next), `turbo <task>`,
-`agent-runtime` (framework hooks on an agent host), `installer` (host install path),
-`unwired`.
-
-**Dispositions** (recommendations for RI-3-002): `preserve` (keep as-is; already the
-canonical or a correct guard-of-the-guard), `strengthen` (keep, but a concrete gap must
-close — usually absorption into the TS evaluator), `strengthen (review)` (viable retirement
-candidate once the evaluator absorbs it; do not retire yet). Note: RI-N4 requires that
-effective shell probes be **absorbed before** their independent paths retire — no row here
-is marked `retire` because no absorption exists yet.
-
-## 1. Inventory
-
-### 1.1 Repo-level gate tasks (pnpm / turbo)
-
-| check                                 | location                                                                             | kind | what it actually verifies                                                                                                                                                                                                                                                                                                                                                                                                     | enforcement point                                                                                      | canonical check           | disposition | rationale                                                                                                                                                 |
-| ------------------------------------- | ------------------------------------------------------------------------------------ | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pnpm preflight` (checkout preflight) | `scripts/preflight.mjs`                                                              | ts   | Six gate binaries (eslint, husky, prettier, tsc, turbo, vitest) exist and are executable in `node_modules/.bin` (exit 42 if not); no stale `.mosaic-test-work/web-build.lock` (exit 43); `apps/web/.next` is a real directory (not a symlink), every entry owned by the current uid, and its `.mosaic-source-hash` fingerprint + `.mosaic-symlink-manifest` hash match the certified build written by `scripts/build-web.mjs` | `pre-push`; inside `pnpm typecheck` (→ `CI ci.yml#typecheck`, verify-release `typecheck` stage)        | QC-1 Checkout integrity   | preserve    | Blocks a poisoned/stale generated `.next` from faking a green typecheck (the five-month-stale-`.next` class); trust chain is self-contained per-checkout. |
-| `pnpm typecheck`                      | root `package.json` → `turbo run typecheck`                                          | ts   | Per-package `tsc --noEmit` (all 20 packages); turbo `typecheck` depends on `^build`, so package builds must succeed first; prefixed by checkout preflight                                                                                                                                                                                                                                                                     | `CI ci.yml#typecheck`; `pre-push`; verify-release `typecheck` stage; `turbo typecheck`                 | QC-2 Workspace typecheck  | preserve    | The single workspace-wide type gate; CI and hooks invoke the same task, no divergent checklist.                                                           |
-| `pnpm lint`                           | root `package.json` → `turbo run lint`                                               | ts   | Per-package `eslint src` under root `eslint.config.mjs` (ignores `dist`, `.next`, `framework/**`, etc.)                                                                                                                                                                                                                                                                                                                       | `CI ci.yml#lint`; `pre-push`; verify-release `lint` stage; `turbo lint`                                | QC-3 Workspace lint       | preserve    | Same-task invocation from every surface; no second lint definition.                                                                                       |
-| `pnpm format:check`                   | root `package.json` → `prettier --check`                                             | ts   | Prettier parse/format equality over `**/*.{ts,tsx,js,jsx,json,md}` minus `.prettierignore` (generated trees, `docs/scratchpads/`, venvs, …)                                                                                                                                                                                                                                                                                   | `CI ci.yml#format`; `pre-push`; verify-release `format` stage                                          | QC-4 Format check         | preserve    | Single formatter, single ignore list, enforced identically everywhere.                                                                                    |
-| `pnpm test`                           | root `package.json` `test` = `test:checkout` && `turbo run test` && `test:installer` | ts   | (a) `node --test scripts/*.test.mjs` — checkout-tool units; (b) per-package `vitest run` (mosaic appends the 47-command `test:framework-shell` chain); (c) `tools/install-next-lane.test.sh`; turbo `test` declares DB env vars and depends on `^build`                                                                                                                                                                       | `CI ci.yml#test` (with `DATABASE_URL` + `db:migrate` first); verify-release `test` stage; `turbo test` | QC-5 Test suite execution | preserve    | One composed test command; the chain property (any link red ⇒ step red) is the gate.                                                                      |
-| `pnpm build`                          | root `package.json` → `turbo run build`                                              | ts   | Per-package build (`tsc`/Next) with `^build` dependency and `dist/**` outputs                                                                                                                                                                                                                                                                                                                                                 | `publish.yml#build`; verify-release `build` stage; `turbo build`                                       | QC-6 Workspace build      | preserve    | Publish artifacts derive from the same build task CI verifies.                                                                                            |
-
-### 1.2 Framework quality shell probes (`packages/mosaic/framework/tools/quality/`)
-
-| check                                       | location                                                                | kind  | what it actually verifies                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | enforcement point                                                                                                                                                                                                                                                                                                                                                           | canonical check                                                                                                                         | disposition                      | rationale                                                                                                                                                                                                                                                         |
-| ------------------------------------------- | ----------------------------------------------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| Sanitization gate                           | `scripts/verify-sanitized.sh`                                           | shell | Built-in self-test first (planted identity/structural/YAML+service fixtures; exit 2 if the regexes or extension coverage break), then: (1) identity denylist grep (`jarvis\|jason\|woltje\|brain.woltje.com\|/home/jwoltje\|\bPDA\b`) over all shipped text files **including** `examples/`; (2) structural grep for private `$HOME/src` defaults in shipped scripts **excluding** `examples/`. Any hit ⇒ exit 1                                                                                 | `CI ci.yml#sanitization`; verify-release `sanitization` stage                                                                                                                                                                                                                                                                                                               | QC-7 Framework sanitization                                                                                                             | preserve                         | Labeled one-time regression guard with a self-test that prevents silent no-op; correctly scoped (identity vs structural) and documented as not a general PII detector.                                                                                            |
-| Resident-context budget                     | `scripts/check-resident-budget.sh` (+ `--self-test`)                    | shell | Self-test of the comparator, then `wc -l` vs per-file ceilings (CONSTITUTION 120, AGENTS 120, each RUNTIME.md 90); missing file ⇒ fail; over ceiling ⇒ exit 1                                                                                                                                                                                                                                                                                                                                    | `CI ci.yml#sanitization` (both modes); verify-release `sanitization` stage                                                                                                                                                                                                                                                                                                  | QC-8 Resident-context budget                                                                                                            | preserve                         | Caps the container (lines), never the wording — the deliberate anti-drift design (DESIGN §7); CI-enforceable half only, by design.                                                                                                                                |
-| Test-membership enumeration guard (#1017)   | `scripts/check-test-enumeration.sh` + `test-enumeration-exclusions.txt` | shell | Parses surface S1 (`packages/mosaic` `test:framework-shell` via JSON+shlex) and S2 (every `framework/tools/\*.sh                                                                                                                                                                                                                                                                                                                                                                                 | .py`token in`ci.yml`, comment lines stripped); population = `_test_.sh`under`framework/tools`; FAILS on: suite-shaped file on disk neither enumerated nor signed-excluded; surface naming a path missing on disk (both directions); exclusion without reason / stale / outside population / contradicting enumeration. Proves **naming, not reachability** (stated in-file) | `CI ci.yml#sanitization` (direct line); link [0] of `test:framework-shell` (thus `CI ci.yml#test`); verify-release `sanitization` stage | QC-9 Test-membership enumeration | preserve                                                                                                                                                                                                                                                          | Makes silent under-run impossible; invoked from both surfaces it audits so severing the chain cannot silence it. |
-| Enumeration-guard needles                   | `scripts/test-check-test-enumeration.sh`                                | shell | Needle/control fixtures driven through `--root`: every promised failure mode must trip the guard **on its own words**, plus controls that must pass (null-case defense); covers commented-out ci.yml lines (F1) and line-range parsing (n2b)                                                                                                                                                                                                                                                     | `test:framework-shell` → `CI ci.yml#test`; verify-release `test` stage                                                                                                                                                                                                                                                                                                      | QC-9 Test-membership enumeration                                                                                                        | preserve                         | Guard-of-the-guard with both polarities; same canonical check by design.                                                                                                                                                                                          |
-| Upgrade manifest guard (#791 HARD GATE)     | `scripts/test-upgrade-manifest-guard.sh`                                | shell | Keep-mode `install.sh` upgrade against seeded throwaway `MOSAIC_HOME`: every operator sentinel — including an **unanticipated** one — survives byte-identical with unchanged mtime; framework files still update; retired framework files pruned; matrix run with rsync present AND absent (keep path must be rsync-independent); fail-closed matrix (empty/operator-only/malformed/missing manifest aborts loudly, operator files untouched); operator secret never appears in installer output | `CI ci.yml#upgrade-guard`; verify-release `upgrade-guard` stage                                                                                                                                                                                                                                                                                                             | QC-10 Upgrade/install safety                                                                                                            | preserve                         | The operator-data hard gate for the `mosaic update` path; negative controls are load-bearing and documented.                                                                                                                                                      |
-| Upgrade rollback gate (#791 B1)             | `scripts/test-upgrade-rollback.sh`                                      | shell | Mid-sync failure (PATH-shadowing `cp` shim) must trigger snapshot restore: restore message fires, corrupted file restored, target byte-identical to pre-upgrade; control installer with `set -E` stripped must NOT roll back (proves errtrace is load-bearing); plus signal/exit-guard controls                                                                                                                                                                                                  | `CI ci.yml#upgrade-guard`; verify-release `upgrade-guard` stage                                                                                                                                                                                                                                                                                                             | QC-10 Upgrade/install safety                                                                                                            | preserve                         | Proves the rollback trap actually fires; the `-E`-stripped control keeps Part A honest.                                                                                                                                                                           |
-| Durable-snapshot gate (#791 PR2)            | `scripts/test-upgrade-durable-snapshot.sh`                              | shell | Pre-update snapshot taken before any mutation (0700/0600 perms, secret never logged, retention-pruned); post-sync verify net restores operator files a manifest bug lets the sync touch; CWE-59 symlink-leaf guard proven with a portable cp shim in both polarities (write-through-link must not happen); v1→v2 migration semantics (intended `bin/` removal not healed)                                                                                                                        | `CI ci.yml#upgrade-guard`; verify-release `upgrade-guard` stage                                                                                                                                                                                                                                                                                                             | QC-10 Upgrade/install safety                                                                                                            | preserve                         | Covers tampering and leak vectors the manifest guard cannot see; the shim rationale (busybox vs GNU cp) is documented in-file.                                                                                                                                    |
-| Install migration matrix (v2→v3)            | `scripts/test-install-migration.sh`                                     | shell | Fixture matrix running the real installer with `MOSAIC_SYNC_ONLY=1`: fresh install seeds + stamps version 3; legacy user-edited AGENTS overwritten with `.pre-constitution.bak` preserved (and idempotent); tuned STANDARDS overwritten; operator files (SOUL, credentials) preserved. Mirrors the TS suite `packages/mosaic/src/config/file-adapter.test.ts` — both installers must behave identically                                                                                          | `CI ci.yml#upgrade-guard`; verify-release `upgrade-guard` stage                                                                                                                                                                                                                                                                                                             | QC-10 Upgrade/install safety                                                                                                            | preserve                         | Pins the shell/TS installer parity contract; removal would orphan that parity requirement.                                                                                                                                                                        |
-| Enforcement verification probe (bash)       | `scripts/verify.sh`                                                     | shell | Attempts **real commits** in the target repo: planted type error must produce a commit blocked with `error`; planted `any` must trip `no-explicit-any`; planted lint error must trip `prettier`; gitleaks binary must exist (3a) and detect a planted AWS key via `gitleaks git --pre-commit --staged --redact` (3b). Verdicts are output-grep matches on hook stderr                                                                                                                            | `local` via installed `mosaic-quality-verify` on scaffolded target projects; **not run in this repo's CI**                                                                                                                                                                                                                                                                  | QC-20 Downstream enforcement verification                                                                                               | strengthen (review)              | Mechanism is genuinely behavioral (stronger than file presence) but verdict logic is grep-on-output and it is unwired here; absorb as the evaluator's enforcement-probe check (the RI-N4 evaluator invokes it or reimplements it) before retiring the shell path. |
-| Enforcement verification probe (PowerShell) | `scripts/verify.ps1`                                                    | shell | Windows port of `verify.sh`: same planted-commit tests with `$output -match` matching; no gitleaks self-test parity beyond the same checks                                                                                                                                                                                                                                                                                                                                                       | `local` (Windows operator); no Windows CI runner exists                                                                                                                                                                                                                                                                                                                     | QC-20 Downstream enforcement verification                                                                                               | strengthen (review)              | A hand-maintained twin of `verify.sh` with no CI coverage — exactly the drift shape the single evaluator removes; retire after the TS evaluator owns the probe.                                                                                                   |
-| Quality template installer (bash)           | `scripts/install.sh`                                                    | shell | Copies template files (`.husky/pre-commit` incl. mandatory gitleaks, `.lintstagedrc.js`, `.eslintrc.js`, `tsconfig.json`, `.woodpecker.yml`, `.gitleaks.toml`) into a target project; **warns** (does not verify) about `package.json` snippet merge; no post-condition check                                                                                                                                                                                                                    | `local` / via `mosaic-quality-apply`                                                                                                                                                                                                                                                                                                                                        | QC-21 Downstream rails scaffolding                                                                                                      | strengthen (review)              | Duplicates the TS `quality-rails init` scaffolder for a different template set; converging on one scaffolder (with post-scaffold verification) is prerequisite to retiring this path.                                                                             |
-| Quality template installer (PowerShell)     | `scripts/install.ps1`                                                   | shell | Windows twin of the template copy above                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `local` (Windows operator)                                                                                                                                                                                                                                                                                                                                                  | QC-21 Downstream rails scaffolding                                                                                                      | strengthen (review)              | Same twin-drift risk as `verify.ps1`; no runner exercises it.                                                                                                                                                                                                     |
-| `mosaic-quality-verify` adapter             | `framework/tools/_scripts/mosaic-quality-verify`                        | shell | Thin adapter: validates target dir exists, asserts `verify.sh` present+executable, `cd` target, exec it. No verdict logic of its own                                                                                                                                                                                                                                                                                                                                                             | `local` (installed framework bin)                                                                                                                                                                                                                                                                                                                                           | QC-20 Downstream enforcement verification                                                                                               | preserve                         | Already the thin-adapter shape RI-N4 prescribes for shell surfaces.                                                                                                                                                                                               |
-| `mosaic-quality-apply` adapter              | `framework/tools/_scripts/mosaic-quality-apply`                         | shell | Thin adapter: arg validation then exec of quality `install.sh --template … --target …`                                                                                                                                                                                                                                                                                                                                                                                                           | `local` (installed framework bin)                                                                                                                                                                                                                                                                                                                                           | QC-21 Downstream rails scaffolding                                                                                                      | preserve                         | Thin adapter, no separate verdict; disposition follows its target script's convergence.                                                                                                                                                                           |
-| Roster schema regression                    | `scripts/test-roster-schema.py`                                         | shell | jsonschema `Draft202012Validator` over `fleet/roster.schema.json` with valid/invalid connector-kind fixtures (tmux/discord/matrix conditional fields)                                                                                                                                                                                                                                                                                                                                            | **unwired** — not on S1 or S2, not signed-excluded; also outside the enumeration guard's `*.sh` population, so the guard cannot see it                                                                                                                                                                                                                                      | QC-5 Test suite execution                                                                                                               | strengthen (review)              | A real regression suite that currently runs nowhere; wire it into a CI surface or sign an exclusion — leaving it invisible re-arms the exact gap #1017 closed.                                                                                                    |
-| Framework shell chain (S1)                  | `packages/mosaic/package.json` `test:framework-shell`                   | shell | 47-command `&&` chain: enumeration guard + needles, 14 lease-broker/mutator-gate python unitests, `check-runtime-launches.py`, and ~30 framework-tool shell suites (git wrappers, wake, woodpecker, tmux, glpi, orchestrator, `_scripts`). Quality-relevant members rowed separately below                                                                                                                                                                                                       | `turbo test` → `CI ci.yml#test`; verify-release `test` stage                                                                                                                                                                                                                                                                                                                | QC-5 Test suite execution                                                                                                               | preserve                         | The chain is the execution surface the enumeration guard audits; known residuals: a failing link stops later suites (measured in #1270 — suites after position 44 had not run), and the guard proves naming, not reachability.                                    |
-
-### 1.3 Framework runtime hooks and their harnesses (agent-host enforcement)
-
-| check                                 | location                                                                                  | kind  | what it actually verifies                                                                                                                                                                                                                                                                                                                                                            | enforcement point                                                                | canonical check                         | disposition         | rationale                                                                                                                                                                                                  |
-| ------------------------------------- | ----------------------------------------------------------------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | --------------------------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| QA edit hook seam                     | `framework/tools/qa/qa-hook-stdin.sh` (+ `qa-hook-handler.sh`)                            | shell | PostToolUse stdin hook: extracts edited file from the tool JSON (jq or grep fallback), skips non-JS/TS, then the deps-preflight gate — exits 1 with the legible sentinel `deps not installed — run pnpm install` when `node_modules/.bin` is missing/empty (the #856 false-red class); the downstream handler only files QA remediation **report templates** (no verification logic) | `agent-runtime` (framework `runtime/claude/settings.json` PostToolUse); never CI | QC-16 Agent-runtime edit-time checks    | strengthen (review) | The sentinel gate is real enforcement; the handler's report-filing adds no verdict and its name promises more than the code does — evaluator absorption should keep the sentinel, drop the report theater. |
-| Typecheck-on-edit hook                | `framework/tools/qa/typecheck-hook.sh`                                                    | shell | PostToolUse: for edited `.ts/.tsx`, finds nearest `tsconfig.json` and runs `tsc --noEmit`, surfacing errors nonzero to the agent immediately                                                                                                                                                                                                                                         | `agent-runtime` (framework `runtime/claude/settings.json` PostToolUse)           | QC-16 Agent-runtime edit-time checks    | strengthen (review) | Edit-time duplicate of QC-2 with independent invocation logic; keep behavior, converge invocation through the evaluator adapter.                                                                           |
-| Deps-preflight harness                | `framework/tools/qa/test-deps-preflight.sh`                                               | shell | Five assertions against the seam incl. a documented RED control (raw `not found`), sentinel behavior for missing and empty `.bin`, and no-false-positive once populated                                                                                                                                                                                                              | `test:framework-shell` → `CI ci.yml#test`                                        | QC-16 Agent-runtime edit-time checks    | preserve            | Guard-of-the-check with a red control; keeps the sentinel from regressing.                                                                                                                                 |
-| Prompt-helper RCE regression          | `framework/tools/_scripts/test-mosaic-init-rce.sh`                                        | shell | Sources the prompt helpers and proves a literal `$(touch /tmp/pwned)` answer round-trips verbatim and never executes (no `/tmp/pwned` created)                                                                                                                                                                                                                                       | `test:framework-shell` → `CI ci.yml#test`                                        | QC-5 Test suite execution               | preserve            | Cheap, load-bearing security regression on the installer's input path.                                                                                                                                     |
-| Install-ordering harness (#869 C2)    | `framework/tools/_scripts/test-install-ordering-guard.sh`                                 | shell | Drives `mosaic-link-runtime-assets` with a fake `mosaic` on PATH: probe ok ⇒ settings copied + exit 0; probe fail ⇒ exit 1 with degraded outcome but all other runtime files still copied; `--allow-inactive-enforcement` forwarded; no-mosaic-on-PATH ⇒ python3 fallback strips enforcement hooks and exits 1; fallback + flag ⇒ wires as-is, exit 0                                | `test:framework-shell` → `CI ci.yml#test`                                        | QC-17 Lease-enforcement wiring safety   | preserve            | Exercises the shell wiring seam independently of the TS guard's own spec suite (complementary coverage, by design).                                                                                        |
-| Fleet-transport harness (#1240)       | `framework/tools/_scripts/test-fleet-transport-check.sh`                                  | shell | Extracts the shipped `check_fleet_transport`/`fleet_declared_transport` functions **from the shipped scripts** (fails loud if extraction yields nothing) and drives both implementations (mosaic-doctor + `tools/install.sh`) from one case table                                                                                                                                    | `test:framework-shell` → `CI ci.yml#test`                                        | QC-18 Operator-host drift audit         | preserve            | The anti-drift harness for the one rule shipped twice; extraction-from-source keeps it from testing a stale copy.                                                                                          |
-| Terminal-green contract (RM-61/#1000) | `framework/tools/woodpecker/test-terminal-green-contract.sh` + `verify-terminal-green.py` | shell | Red-first fixtures: pipeline JSON variants (service failure, step failure, cancelled, etc.) must produce the correct terminal-green verdict; controls must pass                                                                                                                                                                                                                      | `test:framework-shell` → `CI ci.yml#test`                                        | QC-5 Test suite execution               | preserve            | Keeps the CI-wait wrapper's green-detection honest; a false green here would poison every merge gate that trusts `pr-ci-wait.sh`.                                                                          |
-| Lease-gate launch invariant           | `framework/tools/lease-broker/check-runtime-launches.py`                                  | shell | Scans production roots (`packages/`, `apps/`, `plugins/`, `tools/`) across sh/py/ts/yaml suffixes for Claude/Pi process launches **outside** the lease gate; allowlist-based; fails CI on violation                                                                                                                                                                                  | `test:framework-shell` → `CI ci.yml#test`                                        | QC-15 Lease-gate architecture invariant | preserve            | The only architectural "no ungated launches" rail; grep+allowlist is the right cost/benefit for this invariant.                                                                                            |
-
-### 1.4 TypeScript quality logic (`@mosaicstack/quality-rails` + mosaic CLI)
-
-| check                                    | location                                                                                       | kind     | what it actually verifies                                                                                                                                                                                                                                                                                                                                                                                                            | enforcement point                                                                                              | canonical check                       | disposition         | rationale                                                                                                                                                                                                                                                                           |
-| ---------------------------------------- | ---------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | ------------------------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `quality-rails check`                    | `packages/quality-rails/src/cli.ts` (`mosaic quality-rails check --project`)                   | ts       | **Expected-file presence only**: loops `expectedFilesForKind` (node: `.eslintrc`, `biome.json`, `.githooks/pre-commit`, `PR-CHECKLIST.md`; python: `pyproject.toml`+hooks+checklist; rust: `rustfmt.toml`+…) and exits 1 listing missing paths. Does not execute any linter, formatter, hook, or scanner                                                                                                                             | `local` (operator CLI); **no CI wiring in this repo**                                                          | QC-19 Downstream rails presence check | strengthen          | This is the RI-N4 evaluator seed. Today presence ≠ parity (explicitly called out by RI-N4): it must grow typed verdicts (`passed/failed/blocked/error/not-applicable`), check versioning/subject/reason, digested definitions, and absorb the effective shell probes (QC-20 first). |
-| `quality-rails doctor`                   | `packages/quality-rails/src/cli.ts`                                                            | ts       | Same presence data as `check`, printed with ok/missing lines; **cannot fail** (no nonzero exit on missing files)                                                                                                                                                                                                                                                                                                                     | `local` (operator CLI)                                                                                         | QC-19 Downstream rails presence check | strengthen          | A doctor that cannot fail is advisory; fold into `check` (or return typed states) when the evaluator lands.                                                                                                                                                                         |
-| `quality-rails init`                     | `packages/quality-rails/src/cli.ts` + `scaffolder.ts`/`templates.ts`                           | ts       | Scaffolds rails files per detected kind/profile (linters/formatters lists are advisory strings; hooks flag always true); writes files, prints follow-ups — no post-condition verification                                                                                                                                                                                                                                            | `local` (operator CLI)                                                                                         | QC-21 Downstream rails scaffolding    | strengthen (review) | Second scaffolding path alongside quality `install.sh` (§1.2); converge on one with post-scaffold verification before retiring either.                                                                                                                                              |
-| Lease activation probe (#869 C1, hidden) | `packages/mosaic/src/commands/lease-activation-probe.ts`                                       | ts       | Real capability probe, not file presence: resolves the installed mosaic CLI and requires it to advertise the exact `{name, version}` activation contract; all deps injectable; registered as hidden CLI command and consumed by C2/C5                                                                                                                                                                                                | `local` (hidden CLI + consumed by C2/C5); spec-tested via `lease-activation-probe.spec.ts` in `turbo test`     | QC-17 Lease-enforcement wiring safety | preserve            | The versioned-contract probe is precisely the fail-closed capability check RI-N2 generalizes; already typed and injectable.                                                                                                                                                         |
-| Install-ordering guard (#869 C2, hidden) | `packages/mosaic/src/commands/install-ordering-guard.ts`                                       | ts       | Decides whether enforcement hook entries are written into the `~/.claude/settings.json` the framework reseed ships: not activatable ⇒ strip hooks + nonzero loud outcome (default); explicit per-invocation `--allow-inactive-enforcement` opt-out wires-with-warning. Never touches the runtime gate's own fail-closed behavior                                                                                                     | `installer` (framework reseed via `mosaic-link-runtime-assets`); spec + shell harness coverage in `turbo test` | QC-17 Lease-enforcement wiring safety | preserve            | Correct default-deny with an explicit, non-env opt-out; test-locked from both the TS and shell sides.                                                                                                                                                                               |
-| Lease doctor check (#869 C5)             | `packages/mosaic/src/commands/lease-doctor-check.ts`                                           | ts       | Combines hook-wiring detection in `~/.claude/settings.json` with C1 activatable and C3 broker-supervisor health: wired ∧ (¬activatable ∨ ¬healthy) ⇒ loud `[ERROR]` that forces `mosaic doctor` exit 1 regardless of the bash audit's own exit                                                                                                                                                                                       | `local` (inside `mosaic doctor`); spec coverage in `turbo test`                                                | QC-17 Lease-enforcement wiring safety | preserve            | Closes the "bricked host looks green" hole; cannot be masked by the bash script — that composition is the point.                                                                                                                                                                    |
-| `mosaic doctor` (framework drift audit)  | `packages/mosaic/src/commands/launch.ts` (`doctor`) + `framework/tools/_scripts/mosaic-doctor` | shell+ts | Bash audit of the installed framework home: ~40 expected files/dirs present; runtime files are copies (not symlinks) matching source (`cmp`) or composed runtime-contract markers; hard-gates block present in AGENTS.md; sequential-thinking MCP configured; fleet transport binary present per roster (warn); legacy symlink trees gone; skills synced — **warn-based, exit 1 only with `--fail-on-warn`**, plus C5's forced error | `local` (operator audit)                                                                                       | QC-18 Operator-host drift audit       | preserve            | Host-state audit CI cannot see (user files by design, DESIGN §7); advisory exit is the documented contract — do not silently change it.                                                                                                                                             |
-| `mosaic gateway doctor`                  | `packages/mosaic/src/commands/gateway-doctor.ts`                                               | ts       | Probes per-service health (PostgreSQL, Valkey, pgvector) via `@mosaicstack/storage`, reports tier and JSON; exit 1 only when at least one **required** service fails (yellow stays 0)                                                                                                                                                                                                                                                | `local` (operator)                                                                                             | QC-18 Operator-host drift audit       | preserve            | Service health with correct red/yellow exit semantics; JSON mode exists for scripting.                                                                                                                                                                                              |
-| `mosaic gateway verify`                  | `packages/mosaic/src/commands/gateway/verify.ts`                                               | ts       | Post-install liveness: daemon meta via HTTP with retries, admin token on file, bootstrap endpoint reachable; aggregated pass/fail                                                                                                                                                                                                                                                                                                    | `local`; consumed by `tools/e2e-install-test.sh`                                                               | QC-18 Operator-host drift audit       | preserve            | The first-run proof the installer E2E relies on; retry-aware so startup races don't false-red.                                                                                                                                                                                      |
-| `mosaic fleet doctor`                    | `packages/mosaic/src/commands/fleet-reconciler-command.ts`                                     | ts       | Classifies local roster-owned drift (no mutation) from the parsed v2 roster                                                                                                                                                                                                                                                                                                                                                          | `local` (operator)                                                                                             | QC-18 Operator-host drift audit       | preserve            | Dry-run classification is the correct non-mutating audit shape.                                                                                                                                                                                                                     |
-
-### 1.5 Git hooks (developer machine)
-
-| check                     | location                                                  | kind  | what it actually verifies                                                                                                                                                                                                                                | enforcement point                                                                                       | canonical check             | disposition | rationale                                                                                                         |
-| ------------------------- | --------------------------------------------------------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------- |
-| Pre-commit staged hygiene | `.husky/pre-commit` → `npx lint-staged` (`.lintstagedrc`) | shell | On staged files only: `prettier --write` + `eslint --fix` for ts/tsx/js/jsx; `prettier --write` for json/md/yaml/yml. **Mutating** (fixes and re-stages); commit blocks only if a fixer itself fails                                                     | `pre-commit` (every local commit; hooks activated by `install-hooks.mjs` via `core.hooksPath .husky/_`) | QC-13 Staged-change hygiene | preserve    | Correct scoped fast gate; note it auto-fixes rather than rejects (deliberate). Gap: no secret scan here — see §3. |
-| Pre-push gate             | `.husky/pre-push`                                         | shell | `pnpm preflight && pnpm typecheck && pnpm lint && pnpm format:check` (no test run — documented in AGENTS.md)                                                                                                                                             | `pre-push`                                                                                              | QC-14 Pre-push gate         | preserve    | Composes QC-1..4 exactly as specified in AGENTS.md; tests intentionally left to CI.                               |
-| Hook installer            | `scripts/install-hooks.mjs` (`pnpm prepare`)              | ts    | Stages husky hooks into a scratch repo first, asserts husky produced its `h` shim, quarantines incomplete previous sets, verifies idempotence via full directory snapshot comparison, then sets `core.hooksPath`; skips cleanly with `HUSKY=0` or no git | `installer` (runs on `pnpm install`)                                                                    | QC-13 Staged-change hygiene | preserve    | Self-verifying wiring for the hook gates — a corrupted half-install cannot silently disable them.                 |
-
-### 1.6 CI pipeline steps (`.woodpecker/`)
-
-Step-to-probe mapping for container steps: `ci.yml#sanitization` = QC-7+QC-8+QC-9 (rows §1.2, plus `apk add bash` env prep); `ci.yml#upgrade-guard` = QC-10 (rows §1.2, plus `apk add rsync`); `ci.yml#typecheck`/`#lint`/`#format`/`#test` = QC-2/3/4/5 (rows §1.1). Rows below are mechanisms that exist only in a pipeline.
-
-| check                                  | location                                                                               | kind          | what it actually verifies                                                                                                                                                                                                                                                                                                            | enforcement point                                    | canonical check                     | disposition                                                           | rationale                                                                                                     |
-| -------------------------------------- | -------------------------------------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- | ----------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------- |
-| Frozen install                         | `ci.yml#install`                                                                       | pipeline-step | `pnpm install --frozen-lockfile --prefer-offline` against the baked ci-base store — lockfile supply integrity; a drifted lockfile fails the build before any gate runs                                                                                                                                                               | `CI ci.yml#install`                                  | QC-1 Checkout integrity             | preserve                                                              | Lockfile-pinned dep resolution is the supply-chain floor under every later gate.                              |
-| Test-step readiness prelude            | `ci.yml#test` prologue                                                                 | pipeline-step | Installs pinned `@earendil-works/[email protected]` (Invariant R suite requires the real binary) + openssl; waits up to 60×1s on `pg_isready` for the `ci-postgres` service and fails fast if it never comes up; runs `db:migrate` before tests                                                                                 | `CI ci.yml#test`                                     | QC-5 Test suite execution           | preserve                                                              | Fail-fast environment preconditions — a missing service produces a legible failure, not a wall of red tests.  |
-| Publish verify step (pending RI-1-001) | `publish.yml#verify` (branch `feat/ri-050-publish-gate` @ `46784c8d`, not yet on next) | pipeline-step | (a) Commit identity: fails closed if `CI_COMMIT_SHA` empty, `git rev-parse HEAD` empty, or the two differ; (b) runs the canonical `pnpm verify:release`. **Every publish effect depends on this step; it carries no path filter**                                                                                                    | `publish.yml#verify`                                 | QC-11 Terminal release verification | preserve                                                              | The RI-N1 exact-commit binding; until it merges, publish steps on next depend on `build` only (see §3 gap 1). |
-| Publish error classification           | `publish.yml#publish-npm`                                                              | pipeline-step | Publishes `@mosaicstack/*` (minus web) and classifies outcome: success, or the **only tolerated failure** = already-published (EPUBLISHCONFLICT / "cannot publish over" / "previously published"); explicit fatal on npm `E404/E401/ENEEDAUTH/ECONNREFUSED/ETIMEDOUT/ENOTFOUND` and on any unrecognized failure (replacing the old ` |                                                      | echo` that hid a registry 404)      | `publish.yml#publish-npm` (main/tags, path-filtered on `packages/**`) | QC-12 Publish-effect integrity                                                                                | preserve | Converts silent publish fall-on-floor into loud failure; allowlist-of-one error tolerance is the right shape. |
-| Next-lane publish assertions           | `publish.yml#publish-next-npm`                                                         | pipeline-step | Guards: branch must be `next`, `CI_PIPELINE_NUMBER` required; registry dist-tags JSON must be usable; walks all manifests, strictly parses stable semver, rewrites `X.Y.(Z+1)-next.<N>`; publishes with `--tag next` (never latest); post-publish asserts `npm view @mosaicstack/mosaic@next` resolves to the exact expected version | `publish.yml#publish-next-npm` (push/manual on next) | QC-12 Publish-effect integrity      | preserve                                                              | Durable prerelease lane with end-to-end resolution proof — the published artifact is verified, not assumed.   |
-| Image destination policy               | `publish.yml#build-gateway` / `#build-appservice` / `#build-web`                       | pipeline-step | Kaniko builds with destination policy: `next` ⇒ sha-tag only (fatal if a tag event sneaks in); `main` ⇒ sha + `latest`; tag events ⇒ sha + `<tag>`; anything else fatal. Path filters only skip **effects**, never the verify step                                                                                                   | `publish.yml#build-*`                                | QC-12 Publish-effect integrity      | preserve                                                              | Fail-closed tagging matrix; the exclude-list default-safe design keeps stale images impossible.               |
-
-Adjacent pipeline surface (not a probe): `.woodpecker/ci-image.yml` rebuilds the ci-base image on `pnpm-lock.yaml`/`Dockerfile.ci` change with an immutable `lock-<hash>` tag; pipelines consume `:latest`. Recorded for completeness — no code-quality property is checked.
-
-### 1.7 Root installer tooling (`tools/`)
-
-| check                       | location                                                  | kind  | what it actually verifies                                                                                                                                                                                                                                                              | enforcement point                                       | canonical check                 | disposition         | rationale                                                                                                                                                       |
-| --------------------------- | --------------------------------------------------------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | ------------------------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Next-lane installer test    | `tools/install-next-lane.test.sh` (`pnpm test:installer`) | shell | Drives `tools/install.sh --next` with faked `node`/`npm` binaries (no network): Node 20 must be rejected; installs must pin **exact** versions (mutable `@next` forbidden); fast path must not unexpectedly fall back to source; gateway-install failure takes the documented fallback | `turbo`-external tail of `pnpm test` → `CI ci.yml#test` | QC-5 Test suite execution       | preserve            | Hermetic (shimmed) regression net for the installer lane; runs as part of the standard test command.                                                            |
-| Clean-container install E2E | `tools/e2e-install-test.sh`                               | shell | Full first-run flow in a node:22-alpine container: `install.sh --yes` → `mosaic wizard` (non-interactive) → `mosaic gateway install` → `mosaic gateway verify` exit check (with EXPECTED-SKIP if the installed CLI predates `gateway verify`); skips gracefully without Docker         | `local` (manual; requires Docker); **not wired in CI**  | QC-5 Test suite execution       | strengthen (review) | The only end-to-end proof of the install→verify path; currently operator-initiated only — wire into a periodic/manual CI lane or sign its exclusion explicitly. |
-| Host installer advisories   | `tools/install.sh` (`--check`; `check_fleet_transport`)   | shell | `--check` = version comparison only, no install; `check_fleet_transport` warns (non-blocking, by design — tmux is the fleet's dependency, not mosaic's) when the roster-declared transport binary is absent, naming exactly what it blocks; PATH-persistence warnings                  | `installer` (operator-run)                              | QC-18 Operator-host drift audit | preserve            | Advisory-by-design warnings; the parallel doctor check is drift-tested by §1.3's harness.                                                                       |
-
-### 1.8 Pending workstream additions (branch `feat/ri-050-publish-gate` @ `46784c8d`)
-
-| check                           | location                                             | kind | what it actually verifies                                                                                                                                                                                                                                                                          | enforcement point                                               | canonical check                     | disposition | rationale                                                                                      |
-| ------------------------------- | ---------------------------------------------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ----------------------------------- | ----------- | ---------------------------------------------------------------------------------------------- |
-| Canonical terminal verification | `scripts/verify-release.mjs` (`pnpm verify:release`) | ts   | One command replaying the full mandatory set as stages — sanitization, upgrade-guard, typecheck (incl. preflight), lint, format, test, build — mirroring `ci.yml` step-for-step; fail-fast on first failing command; requires `bash`+`rsync` on PATH; `--stage <name>` for wiring smoke-tests only | `publish.yml#verify` (pending); `local` (`pnpm verify:release`) | QC-11 Terminal release verification | preserve    | The RI-N1 canonical command — CI and publication share one semantic checklist by construction. |
-| Verify-parity contract test     | `scripts/verify-release.test.mjs`                    | ts   | Parses the real `ci.yml`/`publish.yml`: stage table must match ci.yml step-for-step; every publish-effect step (name `publish*` or image-pushing) must transitively depend on `verify`; commit-identity assertion must be present; `verify` must carry no path filter                              | `test:checkout` → `CI ci.yml#test` (once merged)                | QC-11 Terminal release verification | preserve    | Guard-of-the-guard at checkout time — the two surfaces cannot drift apart silently.            |
-
-## 2. Canonical check set
-
-The deduplicated checks every row above maps onto. IDs are stable for RI-3-002 to consume.
-
-- **QC-1 Checkout integrity.** Owns: the checkout can run its gates — frozen-lockfile dependency resolution, required gate binaries present, no stale build lock, and the `apps/web/.next` generated-state trust chain (real directory, uid ownership, certified source fingerprint, certified symlink manifest). Implemented by `scripts/preflight.mjs` + frozen install steps.
-- **QC-2 Workspace typecheck.** Owns workspace-wide TypeScript soundness: per-package `tsc --noEmit` over built dependencies (`turbo typecheck`). The single definition invoked by CI, pre-push, and terminal verification.
-- **QC-3 Workspace lint.** Owns static-analysis policy: per-package ESLint under the root config. One config, one task, every surface.
-- **QC-4 Format check.** Owns formatting uniformity: Prettier check with the repo ignore list. (The pre-commit variant additionally fixes; the verdict form is this check.)
-- **QC-5 Test suite execution.** Owns execution of all test surfaces: checkout script units (`node --test`), per-package Vitest suites (including the framework shell chain and its python unitests), the installer-lane shim test, and — once wired — `test-roster-schema.py` and container E2E. Also owns guards-of-the-gate that live inside the chain (terminal-green contract, RCE regression).
-- **QC-6 Workspace build.** Owns artifact buildability: `turbo build` producing the artifacts publication consumes.
-- **QC-7 Framework sanitization.** Owns the open-source guarantee for the shipped framework package: no operator-identity tokens anywhere (examples included), no private `$HOME` defaults in shipped scripts, with a self-test that keeps the regexes honest.
-- **QC-8 Resident-context budget.** Owns the line-count ceilings on framework files injected into every agent's context (Constitution, dispatcher, RUNTIME.md slices) — the CI-enforceable half of the resident-prompt budget.
-- **QC-9 Test-membership enumeration.** Owns the property that no test suite can silently fall out of CI: disk population vs parsed enumeration surfaces, both-directions staleness, and signed exclusions with reasons. Includes its needle/control harness.
-- **QC-10 Upgrade/install safety.** Owns the #791 family: operator-path byte-identity across keep-mode upgrades (manifest guard), mid-failure rollback (errtrace-proven), durable pre-update snapshot + verify net + CWE-59 leaf guard, and the v2→v3 migration matrix with shell/TS parity.
-- **QC-11 Terminal release verification.** Owns the RI-N1 exact-commit binding: commit-identity assertion plus one canonical command (`pnpm verify:release`) replaying the complete mandatory set, with every publish effect depending on it; plus the checkout-time parity/DAG contract test that keeps pipeline and command in sync.
-- **QC-12 Publish-effect integrity.** Owns publication correctness: npm publish error classification (only already-published tolerated), next-lane versioning and post-publish resolution proof, and image destination/tag policy.
-- **QC-13 Staged-change hygiene.** Owns commit-time hygiene on staged files (prettier/eslint fix-and-restage) and the self-verifying hook wiring that guarantees the gates are actually installed.
-- **QC-14 Pre-push gate.** Owns the local push composition: preflight + typecheck + lint + format:check (tests deliberately deferred to CI).
-- **QC-15 Lease-gate architecture invariant.** Owns "no ungated runtime launches in production code": the scan + allowlist over `packages/`, `apps/`, `plugins/`, `tools/`.
-- **QC-16 Agent-runtime edit-time checks.** Owns edit-time feedback on agent hosts: the deps-preflight legibility sentinel and typecheck-on-edit, plus their regression harnesses.
-- **QC-17 Lease-enforcement wiring safety.** Owns the #869 C1/C2/C5 trio: activation capability probe (versioned contract), enforcement-hook wiring gate (default-deny with explicit opt-out), and the doctor check that surfaces a bricked host — with their shell/TS harnesses.
-- **QC-18 Operator-host drift audit.** Owns host-state health CI cannot see: `mosaic doctor` drift audit (+ fleet transport, both implementations), `fleet doctor` roster classification, `gateway doctor`/`gateway verify` service health, and installer advisories. Advisory exits are part of the contract.
-- **QC-19 Downstream rails presence check.** Owns "does a scaffolded project still carry its rails files" — today the TS `quality-rails check/doctor` presence loop; per RI-N4 this is the seed that must become the typed evaluator (presence alone is explicitly not parity).
-- **QC-20 Downstream enforcement verification.** Owns "do the rails actually block" on scaffolded projects: the behavioral planted-commit probe (type error, `any`, lint, gitleaks secret) currently in `verify.sh`/`verify.ps1` behind the `mosaic-quality-verify` adapter.
-- **QC-21 Downstream rails scaffolding.** Owns putting rails files into a target project: the shell template installer (+ PowerShell twin) and the TS `quality-rails init` scaffolder — currently two paths that must converge.
-
-## 3. Coverage gaps
-
-Enforced nowhere but implied, or named in docs/tooling but not wired:
-
-1. **Publication not yet bound to verification on `next`.** At this base (`8199261c`), `publish.yml` publish steps depend on `build` only; the `verify` step and `scripts/verify-release.mjs` exist on `feat/ri-050-publish-gate` (`46784c8d`) but are not merged. Until RI-1-001 lands, AC-RI-1's negative control cannot hold on the real pipeline.
-2. **Playwright E2E unwired.** `apps/web` ships `test:e2e` (`playwright test`) with real suites (`admin/auth/chat/navigation.spec.ts`); neither `pnpm test` nor any CI step invokes it. The web UI's user flows are verified only when an operator runs them manually.
-3. **No secret scanning on this repo.** The framework's own template pre-commit makes gitleaks **required**, and `verify.sh` proves detection with a planted key — but this repository's `.husky/pre-commit` (lint-staged only) and CI run no secret scan. The repo ships the control it does not use.
-4. **No dependency audit.** The quality `.woodpecker.yml` templates and `docs/CI-SETUP.md` specify `npm audit --audit-level=high` as a pipeline stage; nothing equivalent runs for this repo.
-5. **No coverage thresholds.** Templates enforce 80% Jest coverage thresholds; this repo's Vitest configs collect coverage with no thresholds — coverage is measured nowhere and enforced nowhere.
-6. **`test-roster-schema.py` invisible.** A real jsonschema regression suite wired to no surface and invisible to the enumeration guard (its population is `*.sh`; the suite is `.py`). Either enumerate it or sign an exclusion — silence here is the #1017 defect shape.
-7. **Presence-checker expectations ≠ this repo.** `quality-rails check` expects `.eslintrc`, `biome.json`, `.githooks/pre-commit`, `PR-CHECKLIST.md` for node projects — none describe this monorepo (husky, flat eslint config, no biome, no PR-CHECKLIST.md). The evaluator's check set must be per-subject (versioned, digested), not one global file list.
-8. **Chain-ordering residual (documented).** `test:framework-shell` is one `&&` chain: a failing link skips every later suite while the step still fails (measured in #1270 — four suites after position 44 had not run since a prior merge). The enumeration guard proves naming, not reachability; both residuals are in-file documented but structurally unfixed.
-9. **Signed-exclusion burndown open.** 16 signed exclusions remain in `test-enumeration-exclusions.txt`; several are "unmeasured in CI image" or blocked on missing CI tooling (tmux, setsid) — tracked under #1017/#1271. Each is an enforcement promise deferred, not delivered.
-10. **Windows twins unexercised.** `verify.ps1`, `install.ps1`, `mosaic-doctor.ps1` have no runner anywhere (no Windows CI); behavioral drift from their bash twins is undetectable by construction.
-11. **QA hook name vs behavior.** `qa-hook-handler.sh` files remediation report templates but performs no verification; the seam's actual gate value is only the deps-preflight sentinel. Anything relying on "QA automation hook" as a check is relying on report-filing.
-12. **Two test paths, one gated.** CI runs tests against ci-postgres (`DATABASE_URL` set); the local PGlite path is the documented default (AGENTS.md) until KBN-101-02/101-05. Only the CI path is enforced by pipeline.
-
-## 4. Disposition summary
-
-| disposition         | rows | checks                                                                                                                                                                                                                                                                                    |
-| ------------------- | ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| preserve            | 43   | Every canonical owner (QC-1..QC-18) plus correct guards-of-the-guard and thin adapters: all of §1.1, the CI-invoked framework probes and adapters in §1.2, all of §1.3, the C1/C2/C5 trio and doctors in §1.4, all of §1.5, all pipeline-only steps in §1.6, §1.7 rows 1 and 3, and §1.8. |
-| strengthen          | 2    | `quality-rails check` and `quality-rails doctor` (QC-19) — the RI-N4 evaluator seed: typed verdicts, versioned/digested check definitions, per-subject check sets.                                                                                                                        |
-| strengthen (review) | 9    | `verify.sh` + `verify.ps1` (QC-20), quality `install.sh`/`install.ps1` + `quality-rails init` (QC-21 — scaffold-path convergence), `test-roster-schema.py` (QC-5 — wire or sign), `qa-hook-stdin.sh` seam + `typecheck-hook.sh` (QC-16), `tools/e2e-install-test.sh` (QC-5 — CI lane).    |
-| retire              | 0    | None meet the bar: RI-N4 requires effective shell probes be **absorbed before** their paths retire, and no absorption exists yet. The `strengthen (review)` rows are the retirement candidates for RI-3-002 once the evaluator owns their behavior.                                       |
-
-Row total: 54. Canonical checks: 21 (QC-1..QC-21).

docs/scratchpads/ri-050.md

@@ -1,242 +0,0 @@
-# Scratchpad — RI-050 orchestrator (jarvis, dragon-lin)
-
-Mission: alpha 0.0.50 release-integrity floor. Issue #1275. Base `next` @ 476db12b.
-Design SSOT: jarvis-brain `docs/plans/2026-08-16_mosaic-stack-sdlc-protocol.md` (SDLC-D-033..038).
-
-## Mode (Jason's directives)
-
-- Orchestrator: jarvis (this session, dragon-lin). NOT mos-claude; work stays on this host.
-- Workers: local pi headless — `pi --model zai/glm-5.3:high -p` in the card's worktree, tools read,bash,edit,write.
-- Delegation override of stack AGENTS.md `agent` column: rows carry `pi-glm-5.3` (outside cron table so no auto-claim).
-- Target branch: `next`. Cards branch from `origin/next`, squash-merge via PR.
-
-## Operational constraints (measured this session)
-
-- Main checkout at `/home/jwoltje/src/mosaic-stack` is a dirty diverged `main` (ahead 1139/behind 711) — NEVER touched. All work in `/home/jwoltje/src/mosaic-stack-worktrees/<branch>`.
-- Disk: /home 187G free. /tmp only 8.7G — keep pnpm stores/node_modules under /home.
-- `main` and `next` have DIVERGED; PRs target `next`.
-- Identity: pin `GITEA_LOGIN=mosaicstack-jarvis` for all wrapper ops. Issue #1275 verified authored by @jarvis.
-- `ci-queue-wait.sh` on this host is fail-open (board: fix #1032 not installed) — substitute SHA-status checks via `/commits/{sha}/status` and diff failing step names.
-- CI on PRs runs `pull_request` pipelines (any branch) incl. ci-postgres service. Push CI runs on main only; publish runs on push/tag to next + manual.
-- Wrapper gaps on this host per board (7 gaps; e.g. no pr-review-list, issue-assign broken, pr-merge makes no trailers): verify outcomes by reading back provider state, never trust rc alone.
-- Publish pipeline currently: install → build → publish-npm/publish-next-npm (+image). No verify. CI steps: install, sanitization, upgrade-guard, typecheck, lint, format, test, ci-postgres.
-
-## Budget
-
-Soft cap 250K. Projected 190K across 10 cards. Track per-card used vs estimate in TASKS.md notes.
-
-## Progress log
-
-- 2026-08-16 23:52 — Issue #1275 created (@jarvis verified).
-- 2026-08-16 23:5x — Bootstrap branch `docs/ri-050-mission-bootstrap` from origin/next@476db12b; PRD section + TASKS.md + this scratchpad written. RI-0-001 in-progress.
-
-## Wave 1 dispatched (2026-08-17 00:35)
-
-- RI-1-001 worker: pi glm-5.3:high, pid 2322125, worktree ri-1-001, log /var/tmp/ri-050/ri-1-001-run.log
-- RI-2-001 worker: pi glm-5.3:high, pid 2322126, worktree ri-2-001, log /var/tmp/ri-050/ri-2-001-run.log
-- Gotcha recorded: pi has no -f flag (that's pi-do.sh); pass brief as positional message. First launch died "Unknown option: -f" — relaunched.
-- CI lane: PR #1276 (bootstrap) fails `test` at base like every next PR — fred's green #1270 unblocks (comms sent 2026-08-17T05:21Z, `comms/20260817T052148Z__from-jarvis__650fe8.md`). Merge gate for all RI PRs queues behind #1270.
-- Live RI-N1 evidence posted to #1275 (comment 22915): pipeline 2439 publish-next-npm SUCCESS beside build-gateway FAILURE.
-
----
-
-# HANDOFF — RI-050 continuation (written 2026-08-17 ~08:45 UTC, jarvis/dragon-lin)
-
-You are taking over the alpha 0.0.50 release-integrity workstream in place. Everything you
-need is on the remote. Read this whole file, then `docs/release-integrity/TASKS.md` (same
-branch), then the PRD section (`docs/PRD.md` § Release Integrity Workstream, same branch).
-
-## Identity / mode
-
-- Orchestrator identity: `jarvis` (dragon-lin). You continue as the RI-050 orchestrator under
-  whatever identity Jason gives you — if you are NOT jarvis, say so in comms and PR bodies.
-- Jason's standing directives for this mission: work happens on THIS repo (mosaicstack/stack),
-  PRs target `next` (NOT main), workers are local pi headless sessions on
-  `zai/glm-5.3:high`. Do not hand this to mos-claude. Do not borrow other seats' lanes.
-- All wrapper ops: pin `GITEA_LOGIN=mosaicstack-jarvis` (issue #1275 was verified authored by
-  @jarvis; keep identity consistent or verify yours with issue-view and READ BACK user.login).
-- CI substitution rule (this host's ci-queue-wait.sh is fail-open; fix #1032 not installed):
-  judge CI by SHA-status via `/api/v1/repos/mosaicstack/stack/commits/{sha}/status` or the
-  woodpecker API (`pipeline-status.sh -r mosaicstack/stack -n N -f json`), and DIFF THE
-  FAILING STEP NAMES rather than trusting rc.
-
-## Mission state at handoff
-
-Mission: alpha 0.0.50 release-integrity floor. Issue #1275 (open, has live-evidence comment).
-Decisions SDLC-D-033..038 live in jarvis-brain
-`docs/plans/2026-08-16_mosaic-stack-sdlc-protocol.md` (normative text also mirrored in the
-PRD section on this branch, so this repo is self-sufficient).
-
-Base: `origin/next` @ 476db12b. NOTE: `main` and `next` have DIVERGED — never base on main.
-
-Branches (all pushed, all clean trees):
-
-- `docs/ri-050-mission-bootstrap` @ 5114faa2 → PR #1276 (open, mergeable) — bootstrap docs +
-  this scratchpad + TASKS.md DAG. STATUS: CI red on `test` only, which is the known lane-wide
-  failure (see blocker below); own prettier issue already fixed.
-- `feat/ri-050-publish-gate` @ 0aa5ed35 → PR #1277 (open, mergeable) — RI-1-001 COMPLETE
-  (worker reported success, orchestrator review PASSED: verify step asserts CI_COMMIT_SHA ==
-  git rev-parse HEAD then runs canonical `pnpm verify:release`; every publish/image step
-  depends_on verify directly, confirmed by parsing the DAG: publish-npm, publish-next-npm,
-  build-gateway/appservice/web all -> [build, verify]; invariant test
-  scripts/verify-release.test.mjs passes 7/7 locally with negative fixtures). CI: same known
-  lane-red `test` step only.
-- `fix/ri-050-forge-fail-closed` @ 99b8f6ea → PR #1278 (open, mergeable) — RI-2-001 worker
-  reported success (typed `FORGE_*` capability errors, --simulate typed simulated everywhere,
-  vacuous true/echo gates replaced, closed ForgeOutcome set, 116 tests green incl. 16 new).
-  ORCHESTRATOR REVIEW NOT YET DONE — your first job. Review the diff
-  (1391 insertions across forge src), check the fail-closed paths and that simulated
-  results cannot satisfy any consumer, run `pnpm --filter @mosaicstack/forge test`.
-
-## The one blocker
-
-Every `next` PR pipeline is red on ONE assertion:
-`packages/mosaic/framework/tools/fleet/test-start-agent-session.sh:103` ("host provides 'pi'
-in the system path"). Pre-existing at base; affects PRs #1276/#1277/#1278 identically.
-fred's PR #1270 ("unblocks every PR on next") is green and open — it is HIS to merge; do not
-merge it yourself. jarvis sent comms (`comms/20260817T052148Z__from-jarvis__650fe8.md` in
-jarvis-brain) asking merge timing; no reply yet as of handoff. Merge gates for ALL RI PRs
-queue behind #1270 landing. Until then: review/develop freely, merge nothing that needs the
-green gate (docs-only #1276 arguably could merge red-lane with Jason's explicit call — ask,
-don't assume).
-
-## Remaining DAG (docs/release-integrity/TASKS.md is canonical)
-
-Wave 2 (next): RI-2-002 MACP fail-closed (brief pattern: mirror RI-2-001 for
-packages/macp/src/gate-runner.ts — empty commands, stub executors, unimplemented CI-provider
-gates fail closed; explicit simulate) and RI-4-001 PRD authority (one PRD service;
-@mosaicstack/prdy docs/prdy authoritative via `mosaic mission --plan`; `mosaic prdy` routes
-or becomes named Markdown adapter; mission<->PRD linkage persists — see PRD RI-N3).
-Wave 3: RI-3-001 probe inventory (docs), RI-5-001 web stale-safety.
-Wave 4: RI-1-002 negative-control tests, RI-3-002 TS evaluator absorbs shell probes.
-Final: RI-V-001 evidence pack (real green next publish run post-gate + all cards verified).
-
-## Worker mechanics (measured, reuse)
-
-- Dispatch: create worktree `git -C /home/jwoltje/src/mosaic-stack worktree add
-/home/jwoltje/src/mosaic-stack-worktrees/<id> -b <branch> origin/next`, write a brief to
-  /var/tmp/ri-050/, then run from INSIDE the worktree:
-  `pi -p --no-session --model zai/glm-5.3:high --tools read,bash,edit,write "$(cat brief.md)"`
-  (pi has NO -f flag — pass the brief as a positional message; first dispatch died on that).
-- Briefs for 1-001/2-001 are at /var/tmp/ri-050/ on dragon-lin (may not survive; the
-  pattern is fully described above and in TASKS.md).
-- Briefs must carry: worktree path, branch, base, requirements, known base-red list (so the
-  worker doesn't chase it), gates to run, PR creation command with GITEA_LOGIN pin, "do NOT
-  merge, do NOT touch docs/TASKS.md", and the JSON report format.
-- Verify worker claims: read the PR, run their tests yourself, parse pipeline step names.
-
-## Do-not-touch
-
-- Main checkout at /home/jwoltje/src/mosaic-stack (dirty diverged main) — never touch.
-- fred's open PRs (#1270 and others) — review evidence welcome, merging his is not yours.
-- Other RI PRs' authors' lanes: #1277/#1278 are yours to gate and merge ONCE lane is green
-  and review is recorded.
-- Never `--no-verify`; never bypass the wrapper-fails-closed rule (wrapper failure ⇒
-  `blocked + report exact command + stop`).
-
-## Session-restore command sequence
-
-1. `git -C /home/jwoltje/src/mosaic-stack-worktrees/ri-050 fetch origin --prune`
-2. Read this file + `docs/release-integrity/TASKS.md` + PRD section.
-3. Check PR states (#1270, #1276, #1277, #1278) and lane CI (SHA-status per above).
-4. Review RI-2-001 (PR #1278) if not yet done; then dispatch wave 2.
-
-— jarvis, 2026-08-17
-
----
-
-# CONTINUATION — fargo (sb-it-1-dt)
-
-Orchestrator seat is now **fargo** on sb-it-1-dt (Jason, 2026-08-17): Claude seat, worktree discipline
-per fred's ruling (`~/agent-work/<slug>`, create → work → commit → push → remove as one act; the
-helper's `/src` refusal is a web1 convention, does not bind here). fred supports; lane rulings are
-his. Workers remain local pi `zai/glm-5.3:high` + limited Claude per Jason.
-
-## 2026-08-17 — RI-2-001 independent review DONE
-
-- **PR #1278 APPROVED** (Gitea review 172, pinned to head 99b8f6ea). Executed evidence, not read-only:
-  forge suite 116/116 at head (matches PR claim), forge lint green, forge typecheck green after
-  building `@mosaicstack/macp` dist (TS2307 on bare `pnpm install --frozen-lockfile` is a
-  minimal-install build-order artifact — the macp import is type-only, vitest passes unbuilt; CI
-  installs build workspace deps, hence green there), **workspace typecheck 45/45 at head**,
-  consumer sweep: no external type consumers of RunManifest/StageStatus/ForgeTaskResult/
-  TaskExecutor; only importer of the package is packages/mosaic via registerForgeCommand
-  (smoke test asserts registration/help only — cannot break). Digest gate (shaggy's) before==after
-  with both-arm reactivity controls.
-- CI red on #1276/#1277/#1278: lane-wide `test` failure only
-  (test-start-agent-session.sh:103, fred's guard mis-wired; #1270 unwires it). Fred measured log
-  content: one real byte-identical failure per pipeline (2456/2457/2458); 13 of ~14 `FAIL` grep
-  hits are passing fail-loud test NAMES. **The red carries no information about the RI changes.**
-- Non-blocking finding: README L141-143 + skills/mosaic-forge/SKILL.md document bare
-  `mosaic forge run`/`resume`, which now exits 1 FORGE_NO_EXECUTOR — fast-follow docs touch.
-- **Identity incident, ruled on by fred:** review 172 recorded under shared host principal
-  mos-dt-0, not fargo. Mechanism (measured, wrapper source): pr-review.sh resolves its acting login
-  from the tea login list only; no fargo tea login on this host → silent host-default fallback;
-  MOSAIC_GIT_IDENTITY is only read in detect-platform.sh get_gitea_token's fallback arm, never
-  reached. Exact-id read-back verifies against the writing token, so it passed while attribution
-  was wrong — durable-provenance machinery proves the write, not the seat. Fred's ruling: review
-  172 stands (substance/verdict/pin correct; label wrong); NO re-approval (one approval,
-  annotated, is the stronger record); fred posts the provenance correction under @fred with
-  --login fred-ms (hard-fail path); no fargo tea login ever (freeze + Jason's to authorize);
-  tooling gap filed by fred. Also explains (does not reopen) #1228's mos-dt-0 attribution.
-- Merge gate: all RI PRs queue behind fred's green #1270 (Jason's call).
-
-## Next
-
-1. Wave 2 dispatch: RI-2-002 (MACP fail-closed, mirror RI-2-001 pattern for
-   packages/macp/src/gate-runner.ts) + RI-4-001 (PRD authority). Two parallel workers max.
-2. Docs fast-follow (README + mosaic-forge skill) — fold into #1276 or a tiny docs card.
-3. RI-V-001 evidence at the end.
-
-— fargo, 2026-08-17
-
----
-
-# RESUMPTION + DAILY-HANDOFF PROTOCOL (Jason, 2026-08-17)
-
-Orchestrator seat is back with **jarvis** (dragon-lin). Expect daily handoff between jarvis
-and fargo. Protocol (both seats, every handoff):
-
-1. **This file is the shared mission log.** Append a dated section per session: state
-   measured, actions taken, PR/review states, next actions. Never rewrite prior sections.
-2. **TASKS.md stays current within one session** — status, PR number in notes, review
-   evidence. Stale rows are handoff debt.
-3. **Cross-review rule (SDLC-D-011 in practice):** the reviewing seat must differ from the
-   producing seat. jarvis reviews fargo-dispatched PRs, fargo reviews jarvis-dispatched
-   PRs. Producers are always pi workers; dispatching seats verify before push; the other
-   seat records the Gitea review.
-4. Handoff = append here + push + (optional) issue #1275 comment if a decision changed.
-
-## RESUMED — jarvis/dragon-lin, 2026-08-17 (afternoon)
-
-- Measured: next = 8199261c (#1270 merged — lane unblocked for new PRs). #1293/#1294
-  (fargo, wave 2) CI-green, mergeable, no recorded reviews. #1276/#1277/#1278 still based
-  on 476db12b with stale red CI → need rebase onto 8199261c. #1278 review pinned to old
-  head 99b8f6ea by @mos-dt-0 (fargo's, mis-attributed per his note) — rebase will dismiss
-  it; re-approval must come from fargo/fred (author is @jarvis, cannot self-approve).
-- Live evidence #2: push pipeline 2462 (the #1270 merge itself) ran publish-next-npm
-  SUCCESS beside build-gateway FAILURE again.
-- Plan: rebase the three original branches; independently review #1293/#1294; merge order
-  once green+reviewed: #1276 (docs) → #1277 (publish gate) → #1278/#1293/#1294 (code).
-  After #1277 merges, watch the next push pipeline prove the verify gate live.
-- fargo's non-RI PRs (#1291/#1296/#1297/#1281) stay strictly his lane.
-
-## jarvis session 2026-08-17 (evening) — reviews, rebases, merge plan
-
-- Rebased #1276/#1277/#1278 onto 8199261c (heads 59e2c460 / 46784c8d / 4917df1f);
-  invariant tests 7/7 and forge 116/116 re-run green at new heads. #1270 touched
-  test-enumeration-exclusions.txt + package.json, NOT ci.yml — no semantic overlap with
-  #1277's ci.yml changes (checked, was a real concern).
-- Independent reviews recorded: #1293 APPROVED (review 173; macp 109/109; fail-closed paths
-  + aggregate state machine verified), #1294 APPROVED (review 174; prdy 20/20 + command
-  specs 9/9; single-writer + linkage persistence + labeled export + conflict-aware import
-  verified). Note: 19 unrelated mosaic suites fail on bare minimal install (known workspace
-  build-order artifact, documented by fargo) — not this change.
-- Measured: `next` has NO branch protection (API: only main listed). Cross-seat review
-  discipline is protocol-enforced, not Gitea-enforced. Flagged to fargo for Jason: direct
-  pushes to next trigger ungated publishes; protection is Jason's call (#1231 adjacent).
-- Merge order planned: #1276 (docs-only — no publish run) -> #1277 (first gated publish)
-  -> #1278 -> #1293 -> #1294. Sent fargo review requests with pinned head SHAs
-  (comms/20260818T011932Z__from-jarvis__a9c02b.md). Not merging #1293/#1294 before my three
-  clear fargo's review — order optimality beats speed; every pre-#1277 merge publishes ungated.
-- CI on the three rebased heads: pending at time of this entry.

eslint.config.mjs

@@ -34,7 +34,6 @@ export default tseslint.config(
             'packages/storage/vitest.config.ts',
             'packages/mosaic/vitest.config.ts',
             'packages/mosaic/__tests__/*.ts',
-            'packages/forge/__tests__/*.ts',
             'tools/federation-harness/*.ts',
           ],
         },

package.json

@@ -9,7 +9,6 @@
     "preflight": "node scripts/preflight.mjs",
     "clean:generated": "node scripts/clean-generated.mjs",
     "typecheck": "pnpm preflight && turbo run typecheck",
-    "verify:release": "node scripts/verify-release.mjs",
     "test:checkout": "node --test scripts/*.test.mjs",
     "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
     "test:installer": "bash tools/install-next-lane.test.sh",

packages/forge/PLAN.md

@@ -539,43 +539,3 @@ Not every brief needs full Board of Directors review. The classification system
 ### Backward compatibility
 
 Existing briefs without a `class` field are auto-classified. The default (no matching keywords) is `strategic`, so all existing runs get the full pipeline unless keywords trigger `technical`.
-
----
-
-## Fail-Closed Execution & Explicit Simulation (SDLC-D-035)
-
-**Added:** 2026-08-17
-
-Forge fails closed when a required capability is missing. It never runs a
-pipeline with a stub executor and reports success.
-
-### Normal mode (default)
-
-- No task executor wired → the CLI exits nonzero with the typed capability
-  error `FORGE_NO_EXECUTOR`. No run is created.
-- A stage whose gate is approval-based (board approval, planning approvals,
-  remediation re-review, discovery/analysis attestations) records a typed
-  `waiting-for-authority` stage result and raises `FORGE_AUTHORITY_REQUIRED`.
-  It never passes vacuously.
-- A stage whose gate requires an unwired provider (AI reviewer, CI pipeline)
-  records a typed `blocked` stage result and raises `FORGE_NO_REVIEWER` /
-  `FORGE_NO_CI_PIPELINE`. The synthetic echo-review approval in `06-review`
-  and all vacuous `true` gates were removed.
-
-### Explicit simulation (`--simulate`)
-
-Opts into stub/synthetic execution. Every stage result, every gate result, and
-the run manifest carry the distinct typed status `simulated` (manifest also
-records `mode: "simulated"`). `simulated` is a non-satisfying outcome:
-`isSatisfyingOutcome()` and all completion/gate consumers treat only `passed`
-as satisfying. The CLI exits 0 for a simulated run only because the caller
-explicitly passed `--simulate`, and prints a loud SIMULATED banner.
-
-### Typed outcome model
-
-Every gate/task outcome is one of the closed set
-`passed | failed | blocked | error | waiting-for-authority | simulated |
-not-applicable`, with the reason recorded on the stage status and each gate
-result in `manifest.json`. Missing implementations, missing gate evidence,
-unknown stages, process errors, and timeouts map to fail-closed members —
-never to `passed`.

packages/forge/__tests__/fail-closed.test.ts

@@ -1,319 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-
-import { generateBoardTasks } from '../src/board-tasks.js';
-import { STAGE_SPECS } from '../src/constants.js';
-import { ForgeCapabilityError } from '../src/errors.js';
-import {
-  evaluateStageGates,
-  gateLabel,
-  isCommandGate,
-  isSatisfyingOutcome,
-} from '../src/outcomes.js';
-import { loadManifest, runPipeline } from '../src/pipeline-runner.js';
-import type { ForgeTask, ForgeTaskResult, TaskExecutor } from '../src/types.js';
-
-/**
- * Mock real executor that returns typed results.
- *
- * Command gates are "verified" by the mock so normal-mode runs can pass
- * mechanically gated stages; authority/provider gates are never reported
- * because they have no mechanical implementation.
- */
-function createTypedExecutor(options?: {
-  failStage?: string;
-  gateOutcomes?: Record<string, 'passed' | 'failed' | 'simulated' | 'error' | 'blocked'>;
-}): TaskExecutor & { submittedTasks: ForgeTask[] } {
-  const submittedTasks: ForgeTask[] = [];
-  return {
-    submittedTasks,
-    async submitTask(task: ForgeTask) {
-      submittedTasks.push(task);
-    },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
-      const task = submittedTasks.find((t) => t.id === taskId);
-      const stageName = task?.metadata?.['stageName'] as string | undefined;
-
-      if (options?.failStage && stageName === options.failStage) {
-        return {
-          task_id: taskId,
-          outcome: 'failed',
-          reason: 'mock task failure',
-          completed_at: new Date().toISOString(),
-          exit_code: 1,
-          gate_results: [],
-        };
-      }
-
-      const gateResults = (task?.qualityGates ?? [])
-        .filter((gate) => isCommandGate(gate))
-        .map((gate) => {
-          const label = gateLabel(gate);
-          const outcome = options?.gateOutcomes?.[label] ?? 'passed';
-          return {
-            gate: label,
-            outcome,
-            reason: outcome === 'passed' ? 'mock verified' : `mock gate outcome: ${outcome}`,
-          };
-        });
-
-      return {
-        task_id: taskId,
-        outcome: 'passed',
-        reason: 'mock verified',
-        completed_at: new Date().toISOString(),
-        exit_code: 0,
-        gate_results: gateResults,
-      };
-    },
-    async getTaskStatus() {
-      return 'completed' as const;
-    },
-  };
-}
-
-describe('fail-closed: no executor wired', () => {
-  let tmpDir: string;
-  let briefPath: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-failclosed-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('throws a typed FORGE_NO_EXECUTOR capability error without --simulate', async () => {
-    await expect(
-      runPipeline(briefPath, tmpDir, {
-        // no executor, no simulate — must fail closed, never run with a stub
-        stages: ['00-intake'],
-      }),
-    ).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_EXECUTOR',
-      capability: 'task-executor',
-    });
-  });
-
-  it('does not create a run directory when failing closed on a missing executor', async () => {
-    try {
-      await runPipeline(briefPath, tmpDir, { stages: ['00-intake'] });
-    } catch {
-      // expected
-    }
-    expect(fs.existsSync(path.join(tmpDir, '.forge', 'runs'))).toBe(false);
-  });
-
-  it('completes with every result typed simulated when simulate is set', async () => {
-    const result = await runPipeline(briefPath, tmpDir, {
-      simulate: true,
-      stages: ['00-intake', '00b-discovery', '02-planning-1', '06-review'],
-    });
-
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.manifest.status).toBe('simulated');
-
-    for (const stage of result.stages) {
-      const stageStatus = result.manifest.stages[stage];
-      expect(stageStatus?.status, `stage ${stage}`).toBe('simulated');
-      expect(stageStatus?.status, `stage ${stage}`).not.toBe('passed');
-      expect(stageStatus?.reason, `stage ${stage}`).toBeTruthy();
-      for (const gateResult of stageStatus?.gateResults ?? []) {
-        expect(gateResult.outcome, `gate ${gateResult.gate} of ${stage}`).toBe('simulated');
-        expect(gateResult.outcome, `gate ${gateResult.gate} of ${stage}`).not.toBe('passed');
-      }
-    }
-
-    // The persisted manifest agrees.
-    const persisted = loadManifest(result.runDir);
-    expect(persisted.mode).toBe('simulated');
-    expect(persisted.status).toBe('simulated');
-    expect(persisted.stages['02-planning-1']?.status).toBe('simulated');
-  });
-});
-
-describe('fail-closed: typed outcome model', () => {
-  it('only passed satisfies the gate/dependency predicate', () => {
-    expect(isSatisfyingOutcome('passed')).toBe(true);
-    expect(isSatisfyingOutcome('failed')).toBe(false);
-    expect(isSatisfyingOutcome('blocked')).toBe(false);
-    expect(isSatisfyingOutcome('error')).toBe(false);
-    expect(isSatisfyingOutcome('waiting-for-authority')).toBe(false);
-    expect(isSatisfyingOutcome('simulated')).toBe(false);
-    expect(isSatisfyingOutcome('not-applicable')).toBe(false);
-  });
-
-  it('a simulated gate result cannot satisfy the stage gate evaluation', () => {
-    const evaluation = evaluateStageGates('05-coding', STAGE_SPECS['05-coding']!.qualityGates, {
-      task_id: 'FORGE-x-05',
-      outcome: 'passed',
-      reason: 'executor claims success',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [{ gate: 'pnpm lint', outcome: 'simulated', reason: 'simulated gate' }],
-    });
-    expect(isSatisfyingOutcome(evaluation.outcome)).toBe(false);
-    expect(evaluation.outcome).toBe('error');
-  });
-
-  it('a simulated task outcome cannot satisfy evaluation in normal mode', () => {
-    const evaluation = evaluateStageGates('00-intake', [], {
-      task_id: 'FORGE-x-00',
-      outcome: 'simulated',
-      reason: 'executor reported simulated',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [],
-    });
-    expect(isSatisfyingOutcome(evaluation.outcome)).toBe(false);
-  });
-
-  it('a missing gate result blocks the stage instead of passing vacuously', () => {
-    const evaluation = evaluateStageGates('05-coding', STAGE_SPECS['05-coding']!.qualityGates, {
-      task_id: 'FORGE-x-05',
-      outcome: 'passed',
-      reason: 'executor claims success',
-      completed_at: new Date().toISOString(),
-      exit_code: 0,
-      gate_results: [],
-    });
-    expect(evaluation.outcome).toBe('blocked');
-  });
-});
-
-describe('fail-closed: authority and provider gates', () => {
-  let tmpDir: string;
-  let briefPath: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-authority-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it.each(['02-planning-1', '03-planning-2', '04-planning-3', '07-remediate'])(
-    'planning/remediation stage %s yields waiting-for-authority (not passed) in normal mode',
-    async (stage) => {
-      const executor = createTypedExecutor();
-      let runDir: string | undefined;
-
-      try {
-        await runPipeline(briefPath, tmpDir, {
-          executor,
-          stages: [stage as string],
-        });
-        expect.unreachable('runPipeline should have failed closed');
-      } catch (err) {
-        expect(err).toBeInstanceOf(ForgeCapabilityError);
-        expect((err as ForgeCapabilityError).code).toBe('FORGE_AUTHORITY_REQUIRED');
-        runDir = path.join(tmpDir, '.forge', 'runs');
-      }
-
-      const runIds = fs.readdirSync(runDir!);
-      expect(runIds).toHaveLength(1);
-      const manifest = loadManifest(path.join(runDir!, runIds[0]!));
-      expect(manifest.stages[stage]?.status).toBe('waiting-for-authority');
-      expect(manifest.stages[stage]?.status).not.toBe('passed');
-      expect(manifest.status).toBe('waiting-for-authority');
-    },
-  );
-
-  it('review stage fails closed with a typed FORGE_NO_REVIEWER error in normal mode', async () => {
-    const executor = createTypedExecutor();
-
-    try {
-      await runPipeline(briefPath, tmpDir, {
-        executor,
-        stages: ['06-review'],
-      });
-      expect.unreachable('runPipeline should have failed closed');
-    } catch (err) {
-      expect(err).toBeInstanceOf(ForgeCapabilityError);
-      expect((err as ForgeCapabilityError).code).toBe('FORGE_NO_REVIEWER');
-      expect((err as ForgeCapabilityError).capability).toBe('reviewer');
-    }
-
-    const runsDir = path.join(tmpDir, '.forge', 'runs');
-    const runIds = fs.readdirSync(runsDir);
-    const manifest = loadManifest(path.join(runsDir, runIds[0]!));
-    expect(manifest.stages['06-review']?.status).toBe('blocked');
-    expect(manifest.stages['06-review']?.status).not.toBe('passed');
-    expect(manifest.status).toBe('failed');
-  });
-
-  it('review stage produces simulated results under --simulate', async () => {
-    const result = await runPipeline(briefPath, tmpDir, {
-      simulate: true,
-      stages: ['06-review'],
-    });
-
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.manifest.stages['06-review']?.status).toBe('simulated');
-    for (const gateResult of result.manifest.stages['06-review']?.gateResults ?? []) {
-      expect(gateResult.outcome).toBe('simulated');
-    }
-  });
-
-  it('deploy stage fails closed without a wired ci-pipeline provider in normal mode', async () => {
-    const executor = createTypedExecutor();
-
-    await expect(
-      runPipeline(briefPath, tmpDir, {
-        executor,
-        stages: ['09-deploy'],
-      }),
-    ).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_CI_PIPELINE',
-    });
-  });
-});
-
-describe('fail-closed: no vacuous gate commands remain', () => {
-  it('stage constants contain no echo/synthetic-approval, vacuous true, or empty gate commands', () => {
-    for (const [stageName, spec] of Object.entries(STAGE_SPECS)) {
-      for (const gate of spec.qualityGates) {
-        const serialized = JSON.stringify(gate);
-        // The echo-review synthetic approval must be gone.
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toContain('echo');
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toMatch(/"verdict"\s*:/);
-        expect(serialized, `stage ${stageName} gate ${serialized}`).not.toMatch(
-          /"summary"\s*:\s*"review-pass"/,
-        );
-        // No vacuous literal `true` gate.
-        expect(gate, `stage ${stageName}`).not.toBe('true');
-        // Command gates must carry a real, non-empty command.
-        if (isCommandGate(gate)) {
-          const command = typeof gate === 'string' ? gate : gate.command;
-          expect(command.trim().length, `stage ${stageName} gate ${serialized}`).toBeGreaterThan(0);
-        }
-      }
-    }
-  });
-
-  it('board tasks contain no vacuous true gates', () => {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-board-gates-'));
-    try {
-      const tasks = generateBoardTasks('# Brief', [], tmpDir, 'BOARD-TEST');
-      for (const task of tasks) {
-        for (const gate of task.qualityGates) {
-          expect(gate, `task ${task.id}`).not.toBe('true');
-          const serialized = JSON.stringify(gate);
-          expect(serialized, `task ${task.id} gate ${serialized}`).not.toContain('echo');
-        }
-      }
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  });
-});

packages/forge/__tests__/pipeline-runner.test.ts

@@ -12,10 +12,10 @@ import {
   resumePipeline,
   getPipelineStatus,
 } from '../src/pipeline-runner.js';
-import type { ForgeTask, ForgeTaskResult, RunManifest, TaskExecutor } from '../src/types.js';
-import { gateLabel, isCommandGate } from '../src/outcomes.js';
+import type { ForgeTask, RunManifest, TaskExecutor } from '../src/types.js';
+import type { TaskResult } from '@mosaicstack/macp';
 
-/** Mock TaskExecutor that records submitted tasks and returns typed results. */
+/** Mock TaskExecutor that records submitted tasks and returns success. */
 function createMockExecutor(options?: {
   failStage?: string;
 }): TaskExecutor & { submittedTasks: ForgeTask[] } {
@@ -25,7 +25,7 @@ function createMockExecutor(options?: {
     async submitTask(task: ForgeTask) {
       submittedTasks.push(task);
     },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
+    async waitForCompletion(taskId: string): Promise<TaskResult> {
       const failStage = options?.failStage;
       const task = submittedTasks.find((t) => t.id === taskId);
       const stageName = task?.metadata?.['stageName'] as string | undefined;
@@ -33,8 +33,7 @@ function createMockExecutor(options?: {
       if (failStage && stageName === failStage) {
         return {
           task_id: taskId,
-          outcome: 'failed',
-          reason: 'mock task failure',
+          status: 'failed',
           completed_at: new Date().toISOString(),
           exit_code: 1,
           gate_results: [],
@@ -42,17 +41,10 @@ function createMockExecutor(options?: {
       }
       return {
         task_id: taskId,
-        outcome: 'passed',
-        reason: 'mock verified',
+        status: 'completed',
         completed_at: new Date().toISOString(),
         exit_code: 0,
-        gate_results: (task?.qualityGates ?? [])
-          .filter((gate) => isCommandGate(gate))
-          .map((gate) => ({
-            gate: gateLabel(gate),
-            outcome: 'passed' as const,
-            reason: 'mock verified',
-          })),
+        gate_results: [],
       };
     },
     async getTaskStatus() {
@@ -164,13 +156,12 @@ describe('runPipeline', () => {
     const executor = createMockExecutor();
     const result = await runPipeline(briefPath, tmpDir, {
       executor,
-      stages: ['00-intake', '05-coding'],
+      stages: ['00-intake', '00b-discovery'],
     });
 
     expect(result.runId).toMatch(/^\d{8}-\d{6}$/);
-    expect(result.stages).toEqual(['00-intake', '05-coding']);
+    expect(result.stages).toEqual(['00-intake', '00b-discovery']);
     expect(result.manifest.status).toBe('completed');
-    expect(result.manifest.mode).toBe('normal');
     expect(executor.submittedTasks).toHaveLength(2);
   });
 
@@ -189,17 +180,12 @@ describe('runPipeline', () => {
     const executor = createMockExecutor();
     const result = await runPipeline(briefPath, tmpDir, {
       executor,
-      stages: ['00-intake', '05-coding'],
+      stages: ['00-intake', '00b-discovery'],
     });
 
     const manifest = loadManifest(result.runDir);
     expect(manifest.stages['00-intake']?.status).toBe('passed');
-    expect(manifest.stages['05-coding']?.status).toBe('passed');
-    expect(manifest.stages['05-coding']?.gateResults?.map((g) => g.outcome)).toEqual([
-      'passed',
-      'passed',
-      'passed',
-    ]);
+    expect(manifest.stages['00b-discovery']?.status).toBe('passed');
   });
 
   it('respects CLI class override', async () => {
@@ -229,7 +215,7 @@ describe('runPipeline', () => {
     const executor = createMockExecutor();
     await runPipeline(briefPath, tmpDir, {
       executor,
-      stages: ['00-intake', '05-coding', '08-test'],
+      stages: ['00-intake', '00b-discovery', '02-planning-1'],
     });
 
     expect(executor.submittedTasks[0]!.dependsOn).toBeUndefined();
@@ -238,14 +224,14 @@ describe('runPipeline', () => {
   });
 
   it('handles stage failure', async () => {
-    const executor = createMockExecutor({ failStage: '05-coding' });
+    const executor = createMockExecutor({ failStage: '00b-discovery' });
 
     await expect(
       runPipeline(briefPath, tmpDir, {
         executor,
-        stages: ['00-intake', '05-coding'],
+        stages: ['00-intake', '00b-discovery'],
       }),
-    ).rejects.toThrow('Stage 05-coding failed');
+    ).rejects.toThrow('Stage 00b-discovery failed');
   });
 
   it('marks manifest as failed on stage failure', async () => {
@@ -284,143 +270,30 @@ describe('resumePipeline', () => {
     fs.rmSync(tmpDir, { recursive: true, force: true });
   });
 
-  it('resumes from first incomplete stage and fails closed at the next provider gate', async () => {
-    // Simulate a run whose authority stages were approved out-of-band
-    // (recorded as passed) and whose coding stage failed mechanically.
-    const runId = '20260101-000000';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    const passed = { status: 'passed' as const, startedAt: '2026-01-01T00:00:00Z' };
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '05-coding',
-      status: 'failed',
-      stages: {
-        '00-intake': passed,
-        '00b-discovery': passed,
-        '02-planning-1': passed,
-        '03-planning-2': passed,
-        '04-planning-3': passed,
-        '05-coding': { status: 'failed', reason: 'gate failed' },
-      },
-    });
+  it('resumes from first incomplete stage', async () => {
+    // First run fails on discovery
+    const executor1 = createMockExecutor({ failStage: '00b-discovery' });
+    let runDir: string;
 
-    // Resume re-runs 05-coding (the first non-passed stage), then fails
-    // closed at 06-review because no reviewer provider is wired.
-    const executor = createMockExecutor();
-    await expect(resumePipeline(runDir, executor)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_REVIEWER',
-    });
-
-    const manifest = loadManifest(runDir);
-    expect(manifest.stages['05-coding']?.status).toBe('passed');
-    expect(manifest.stages['06-review']?.status).toBe('blocked');
-    expect(manifest.status).toBe('failed');
-  });
-
-  it('resumes to completion as simulated under explicit simulate', async () => {
-    const runId = '20260101-000003';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    const passed = { status: 'passed' as const, startedAt: '2026-01-01T00:00:00Z' };
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '05-coding',
-      status: 'failed',
-      stages: {
-        '00-intake': passed,
-        '00b-discovery': passed,
-        '02-planning-1': passed,
-        '03-planning-2': passed,
-        '04-planning-3': passed,
-        '05-coding': { status: 'failed', reason: 'gate failed' },
-      },
-    });
-
-    const result = await resumePipeline(runDir, undefined, { simulate: true });
-
-    expect(result.manifest.status).toBe('simulated');
-    expect(result.manifest.mode).toBe('simulated');
-    expect(result.stages[0]).toBe('05-coding');
-    for (const stage of result.stages) {
-      expect(result.manifest.stages[stage]?.status).toBe('simulated');
+    try {
+      await runPipeline(briefPath, tmpDir, {
+        executor: executor1,
+        stages: ['00-intake', '00b-discovery', '02-planning-1'],
+      });
+    } catch {
+      // expected
     }
-  });
 
-  it('fails closed on resume when the next stage needs authority sign-off', async () => {
-    const runId = '20260101-000001';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '00-intake',
-      status: 'in_progress',
-      stages: {
-        '00-intake': { status: 'passed' },
-      },
-    });
+    const runsDir = path.join(tmpDir, '.forge', 'runs');
+    runDir = path.join(runsDir, fs.readdirSync(runsDir)[0]!);
 
-    const executor = createMockExecutor();
-    await expect(resumePipeline(runDir, executor)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_AUTHORITY_REQUIRED',
-    });
+    // Resume should pick up from 00b-discovery
+    const executor2 = createMockExecutor();
+    const result = await resumePipeline(runDir, executor2);
 
-    const manifest = loadManifest(runDir);
-    expect(manifest.stages['00b-discovery']?.status).toBe('waiting-for-authority');
-    expect(manifest.status).toBe('waiting-for-authority');
-  });
-
-  it('fails closed on resume without an executor or --simulate', async () => {
-    const runId = '20260101-000002';
-    const runDir = path.join(tmpDir, '.forge', 'runs', runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    saveManifest(runDir, {
-      runId,
-      brief: briefPath,
-      codebase: tmpDir,
-      briefClass: 'hotfix',
-      classSource: 'frontmatter',
-      forceBoard: false,
-      mode: 'normal',
-      createdAt: '2026-01-01T00:00:00Z',
-      updatedAt: '2026-01-01T00:00:00Z',
-      currentStage: '00-intake',
-      status: 'in_progress',
-      stages: {
-        '00-intake': { status: 'passed' },
-      },
-    });
-
-    await expect(resumePipeline(runDir)).rejects.toMatchObject({
-      name: 'ForgeCapabilityError',
-      code: 'FORGE_NO_EXECUTOR',
-    });
+    expect(result.manifest.status).toBe('completed');
+    // Should have re-run from 00b-discovery onward
+    expect(result.stages[0]).toBe('00b-discovery');
   });
 });
 

packages/forge/src/board-tasks.ts

@@ -95,14 +95,7 @@ export function generateBoardTasks(
       briefPath,
       resultPath: resultRelPath,
       timeoutSeconds: 120,
-      qualityGates: [
-        {
-          kind: 'authority',
-          capability: 'board-approval',
-          reason:
-            'persona evaluation is judged by board synthesis (authority review); no mechanical gate exists',
-        },
-      ],
+      qualityGates: ['true'],
       metadata: {
         personaName: persona.name,
         personaSlug: persona.slug,
@@ -128,13 +121,7 @@ export function generateBoardTasks(
     timeoutSeconds: 120,
     dependsOn: personaTaskIds,
     dependsOnPolicy: 'all_terminal',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'board-approval',
-        reason: 'board synthesis is an authority decision; no mechanical gate exists',
-      },
-    ],
+    qualityGates: ['true'],
     metadata: {
       resultOutputPath: synthesisResult,
       inputResultPaths: personaResultPaths,

packages/forge/src/cli.spec.ts

@@ -1,11 +1,7 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
 import { Command } from 'commander';
-import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { describe, expect, it } from 'vitest';
 
 import { registerForgeCommand } from './cli.js';
-import { loadManifest } from './pipeline-runner.js';
 
 describe('registerForgeCommand', () => {
   it('registers a "forge" command on the parent program', () => {
@@ -59,94 +55,3 @@ describe('registerForgeCommand', () => {
     }).not.toThrow();
   });
 });
-
-describe('forge run fail-closed behavior (SDLC-D-035)', () => {
-  let tmpDir: string;
-  let briefPath: string;
-  let errSpy: ReturnType<typeof vi.spyOn>;
-  let logSpy: ReturnType<typeof vi.spyOn>;
-  let prevExitCode: string | number | null | undefined;
-
-  const parse = (args: string[]) => {
-    const program = new Command();
-    registerForgeCommand(program);
-    return program.parseAsync(['forge', ...args], { from: 'user' });
-  };
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-cli-failclosed-'));
-    briefPath = path.join(tmpDir, 'brief.md');
-    fs.writeFileSync(briefPath, '# Fix bug\n\nA bugfix for lint cleanup.');
-    errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    prevExitCode = process.exitCode;
-  });
-
-  afterEach(() => {
-    errSpy.mockRestore();
-    logSpy.mockRestore();
-    process.exitCode = prevExitCode;
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('exits nonzero with a typed FORGE_NO_EXECUTOR error when no executor is wired and --simulate is absent', async () => {
-    await parse(['run', '--brief', briefPath, '--codebase', tmpDir]);
-
-    expect(process.exitCode).toBe(1);
-    const errText = errSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(errText).toContain('FORGE_NO_EXECUTOR');
-    // It must never run the pipeline with a stub and report success.
-    expect(fs.existsSync(path.join(tmpDir, '.forge', 'runs'))).toBe(false);
-  });
-
-  it('completes with typed simulated results and exit 0 under explicit --simulate', async () => {
-    await parse(['run', '--brief', briefPath, '--codebase', tmpDir, '--simulate']);
-
-    expect(process.exitCode).toBeUndefined();
-
-    // Loud simulated-mode summary.
-    const logText = logSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(logText).toContain('SIMULATED');
-
-    // Manifest records the mode and simulated per-result statuses.
-    const runsDir = path.join(tmpDir, '.forge', 'runs');
-    const runIds = fs.readdirSync(runsDir);
-    expect(runIds).toHaveLength(1);
-    const manifest = loadManifest(path.join(runsDir, runIds[0]!));
-    expect(manifest.mode).toBe('simulated');
-    expect(manifest.status).toBe('simulated');
-    for (const stageStatus of Object.values(manifest.stages)) {
-      expect(stageStatus?.status).toBe('simulated');
-      for (const gateResult of stageStatus?.gateResults ?? []) {
-        expect(gateResult.outcome).toBe('simulated');
-      }
-    }
-  });
-
-  it('resume exits nonzero with a typed FORGE_NO_EXECUTOR error without --simulate', async () => {
-    const runDir = path.join(tmpDir, '.forge', 'runs', '20260101-000000');
-    fs.mkdirSync(runDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(runDir, 'manifest.json'),
-      JSON.stringify({
-        runId: '20260101-000000',
-        brief: briefPath,
-        codebase: tmpDir,
-        briefClass: 'hotfix',
-        classSource: 'frontmatter',
-        forceBoard: false,
-        createdAt: '2026-01-01T00:00:00Z',
-        updatedAt: '2026-01-01T00:00:00Z',
-        currentStage: '00-intake',
-        status: 'in_progress',
-        stages: { '00-intake': { status: 'passed' } },
-      }),
-    );
-
-    await parse(['resume', '20260101-000000', '--project', tmpDir]);
-
-    expect(process.exitCode).toBe(1);
-    const errText = errSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-    expect(errText).toContain('FORGE_NO_EXECUTOR');
-  });
-});

packages/forge/src/cli.ts

@@ -5,47 +5,37 @@ import type { Command } from 'commander';
 
 import { classifyBrief } from './brief-classifier.js';
 import { STAGE_LABELS, STAGE_SEQUENCE } from './constants.js';
-import { ForgeCapabilityError } from './errors.js';
 import { getEffectivePersonas, loadBoardPersonas } from './persona-loader.js';
 import { generateRunId, getPipelineStatus, loadManifest, runPipeline } from './pipeline-runner.js';
-import { createSimulatedExecutor } from './simulated-executor.js';
-import type { PipelineOptions, RunManifest, RunMode } from './types.js';
+import type { PipelineOptions, RunManifest, TaskExecutor } from './types.js';
+
+// ---------------------------------------------------------------------------
+// Stub executor — used when no real executor is wired at CLI invocation time.
+// ---------------------------------------------------------------------------
+
+const stubExecutor: TaskExecutor = {
+  async submitTask(task) {
+    console.log(`  [forge] stage submitted: ${task.id} (${task.title})`);
+  },
+  async waitForCompletion(taskId, _timeoutMs) {
+    console.log(`  [forge] stage complete:  ${taskId}`);
+    return {
+      task_id: taskId,
+      status: 'completed' as const,
+      completed_at: new Date().toISOString(),
+      exit_code: 0,
+      gate_results: [],
+    };
+  },
+  async getTaskStatus(_taskId) {
+    return 'completed' as const;
+  },
+};
 
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
-/** Resolve a run's effective mode, defaulting legacy manifests to normal. */
-function runModeOf(manifest: RunManifest): RunMode {
-  return manifest.mode ?? 'normal';
-}
-
-/** Print a loud banner so a simulated run can never be misread as verified. */
-function printSimulatedBanner(): void {
-  console.log('');
-  console.log('[forge] ===============================================================');
-  console.log('[forge] MODE: SIMULATED — no stage or gate was really executed.');
-  console.log('[forge] All results are synthetic and MUST NOT be read as verified');
-  console.log('[forge] success. Wire a real executor/providers and re-run to verify.');
-  console.log('[forge] ===============================================================');
-}
-
-/** Print a typed error line for fail-closed capability errors. */
-function printCapabilityError(err: ForgeCapabilityError): void {
-  console.error(`[forge] error ${err.code}: ${err.message}`);
-  console.error(`[forge] missing capability: ${err.capability}`);
-}
-
-/** Handle a pipeline error uniformly: typed capability errors get their code. */
-function handlePipelineError(err: unknown): void {
-  if (err instanceof ForgeCapabilityError) {
-    printCapabilityError(err);
-  } else {
-    console.error(`[forge] pipeline failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  process.exitCode = 1;
-}
-
 function formatDuration(startedAt?: string, completedAt?: string): string {
   if (!startedAt || !completedAt) return '-';
   const ms = new Date(completedAt).getTime() - new Date(startedAt).getTime();
@@ -54,24 +44,19 @@ function formatDuration(startedAt?: string, completedAt?: string): string {
 }
 
 function printManifestTable(manifest: RunManifest): void {
-  const mode = runModeOf(manifest);
   console.log(`\nRun ID : ${manifest.runId}`);
   console.log(`Status : ${manifest.status}`);
-  console.log(`Mode   : ${mode}`);
-  if (mode === 'simulated') {
-    console.log('WARNING: SIMULATED RUN — results are synthetic, not verified success.');
-  }
   console.log(`Brief  : ${manifest.brief}`);
   console.log(`Class  : ${manifest.briefClass} (${manifest.classSource})`);
   console.log(`Updated: ${manifest.updatedAt}`);
   console.log('');
-  console.log('Stage'.padEnd(22) + 'Status'.padEnd(24) + 'Duration');
-  console.log('-'.repeat(60));
+  console.log('Stage'.padEnd(22) + 'Status'.padEnd(14) + 'Duration');
+  console.log('-'.repeat(50));
   for (const stage of STAGE_SEQUENCE) {
     const s = manifest.stages[stage];
     if (!s) continue;
     const label = (STAGE_LABELS[stage] ?? stage).padEnd(22);
-    const status = s.status.padEnd(24);
+    const status = s.status.padEnd(14);
     const dur = formatDuration(s.startedAt, s.completedAt);
     console.log(`${label}${status}${dur}`);
   }
@@ -105,58 +90,23 @@ function listRecentRuns(projectRoot?: string): void {
   }
 
   console.log('\nRecent runs:');
-  console.log('Run ID'.padEnd(22) + 'Status'.padEnd(24) + 'Mode'.padEnd(12) + 'Brief');
-  console.log('-'.repeat(80));
+  console.log('Run ID'.padEnd(22) + 'Status'.padEnd(14) + 'Brief');
+  console.log('-'.repeat(70));
 
   for (const runId of entries) {
     const runDir = path.join(runsDir, runId);
     try {
       const manifest = loadManifest(runDir);
-      const status = manifest.status.padEnd(24);
-      const mode = runModeOf(manifest).padEnd(12);
+      const status = manifest.status.padEnd(14);
       const brief = path.basename(manifest.brief);
-      console.log(`${runId.padEnd(22)}${status}${mode}${brief}`);
+      console.log(`${runId.padEnd(22)}${status}${brief}`);
     } catch {
-      console.log(`${runId.padEnd(22)}${'(unreadable)'.padEnd(24)}`);
+      console.log(`${runId.padEnd(22)}${'(unreadable)'.padEnd(14)}`);
     }
   }
   console.log('');
 }
 
-/**
- * Apply the exit-code policy for a finished pipeline run (SDLC-D-035):
- *
- * - exit 0 only for a verified `completed` normal run, or for an overall
- *   `simulated` run when the caller explicitly passed --simulate;
- * - anything else exits nonzero so it can never be read as success.
- */
-function applyRunExitPolicy(result: { manifest: RunManifest; runDir: string }, simulate: boolean) {
-  const { manifest } = result;
-
-  if (runModeOf(manifest) === 'simulated') {
-    if (!simulate || manifest.status !== 'simulated') {
-      console.error(
-        '[forge] error FORGE_MODE_MISMATCH: run reports simulated results without an explicit, ' +
-          'consistent --simulate request; refusing to report success.',
-      );
-      process.exitCode = 1;
-      return;
-    }
-    printSimulatedBanner();
-    console.log(`[forge] run directory: ${result.runDir}`);
-    return; // exit 0 — the caller explicitly opted into simulation
-  }
-
-  if (manifest.status !== 'completed') {
-    console.error(`[forge] run did not complete: terminal status '${manifest.status}'`);
-    process.exitCode = 1;
-    return;
-  }
-
-  console.log(`[forge] pipeline complete (mode: normal): ${manifest.runId}`);
-  console.log(`[forge] run directory: ${result.runDir}`);
-}
-
 // ---------------------------------------------------------------------------
 // Register function
 // ---------------------------------------------------------------------------
@@ -179,11 +129,6 @@ export function registerForgeCommand(parent: Command): void {
     .option('--config <path>', 'Path to forge config file (.forge/config.yaml)')
     .option('--codebase <path>', 'Codebase root to pass to the pipeline', process.cwd())
     .option('--dry-run', 'Print planned stages without executing', false)
-    .option(
-      '--simulate',
-      'Simulate execution without real providers (every result is typed simulated, never verified)',
-      false,
-    )
     .action(
       async (opts: {
         brief: string;
@@ -192,7 +137,6 @@ export function registerForgeCommand(parent: Command): void {
         config?: string;
         codebase: string;
         dryRun: boolean;
-        simulate: boolean;
       }) => {
         const briefPath = path.resolve(opts.brief);
 
@@ -205,22 +149,14 @@ export function registerForgeCommand(parent: Command): void {
         const briefContent = fs.readFileSync(briefPath, 'utf-8');
         const briefClass = classifyBrief(briefContent);
         const projectRoot = opts.codebase;
-        // A real executor is never wired at CLI invocation time today, so the
-        // only executor we may construct is the explicitly-requested simulated
-        // one. Normal mode fails closed with FORGE_NO_EXECUTOR.
-        const executor = opts.simulate ? createSimulatedExecutor() : undefined;
 
         if (opts.resume) {
           const runId = opts.runId ?? generateRunId();
           const runDir = resolveRunDir(runId, projectRoot);
           console.log(`[forge] resuming run: ${runId}`);
-          try {
-            const { resumePipeline } = await import('./pipeline-runner.js');
-            const result = await resumePipeline(runDir, executor, { simulate: opts.simulate });
-            applyRunExitPolicy(result, opts.simulate);
-          } catch (err) {
-            handlePipelineError(err);
-          }
+          const { resumePipeline } = await import('./pipeline-runner.js');
+          const result = await resumePipeline(runDir, stubExecutor);
+          console.log(`[forge] pipeline complete: ${result.runId}`);
           return;
         }
 
@@ -228,8 +164,7 @@ export function registerForgeCommand(parent: Command): void {
           briefClass,
           codebase: projectRoot,
           dryRun: opts.dryRun,
-          executor,
-          simulate: opts.simulate,
+          executor: stubExecutor,
         };
 
         if (opts.dryRun) {
@@ -245,15 +180,16 @@ export function registerForgeCommand(parent: Command): void {
 
         console.log(`[forge] starting pipeline for brief: ${briefPath}`);
         console.log(`[forge] classified as: ${briefClass}`);
-        if (opts.simulate) {
-          console.log('[forge] mode: SIMULATED (explicit --simulate)');
-        }
 
         try {
           const result = await runPipeline(briefPath, projectRoot, pipelineOptions);
-          applyRunExitPolicy(result, opts.simulate);
+          console.log(`[forge] pipeline complete: ${result.runId}`);
+          console.log(`[forge] run directory: ${result.runDir}`);
         } catch (err) {
-          handlePipelineError(err);
+          console.error(
+            `[forge] pipeline failed: ${err instanceof Error ? err.message : String(err)}`,
+          );
+          process.exitCode = 1;
         }
       },
     );
@@ -288,12 +224,7 @@ export function registerForgeCommand(parent: Command): void {
     .command('resume <runId>')
     .description('Resume a stopped or failed pipeline run')
     .option('--project <path>', 'Project root (defaults to cwd)', process.cwd())
-    .option(
-      '--simulate',
-      'Simulate execution without real providers (every result is typed simulated, never verified)',
-      false,
-    )
-    .action(async (runId: string, opts: { project: string; simulate: boolean }) => {
+    .action(async (runId: string, opts: { project: string }) => {
       const runDir = resolveRunDir(runId, opts.project);
 
       if (!fs.existsSync(runDir)) {
@@ -303,20 +234,15 @@ export function registerForgeCommand(parent: Command): void {
       }
 
       console.log(`[forge] resuming run: ${runId}`);
-      if (opts.simulate) {
-        console.log('[forge] mode: SIMULATED (explicit --simulate)');
-      }
-
-      // No real executor is wired at CLI invocation time; only the explicitly
-      // requested simulated executor may be constructed (fail closed otherwise).
-      const executor = opts.simulate ? createSimulatedExecutor() : undefined;
 
       try {
         const { resumePipeline } = await import('./pipeline-runner.js');
-        const result = await resumePipeline(runDir, executor, { simulate: opts.simulate });
-        applyRunExitPolicy(result, opts.simulate);
+        const result = await resumePipeline(runDir, stubExecutor);
+        console.log(`[forge] pipeline complete: ${result.runId}`);
+        console.log(`[forge] run directory: ${result.runDir}`);
       } catch (err) {
-        handlePipelineError(err);
+        console.error(`[forge] resume failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
       }
     });
 

packages/forge/src/constants.ts

@@ -9,16 +9,7 @@ export const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.
 /** Pipeline asset directory (stages, agents, rails, gates, templates). */
 export const PIPELINE_DIR = path.join(PACKAGE_ROOT, 'pipeline');
 
-/** Stage specifications — defines every pipeline stage.
- *\n * Gate semantics (SDLC-D-035): every gate is one of
- * - a real command string / GateEntry a mechanical runner can execute,
- * - an `authority` gate (human/board sign-off; produces waiting-for-authority),
- * - a `provider` gate (requires a wired provider such as a reviewer or CI pipeline).
- *
- * Vacuous gates (`true`, echo'd synthetic approvals, placeholder ci-pipeline
- * commands) are forbidden: a stage whose gate has no real implementation
- * fails closed instead of passing.
- */
+/** Stage specifications — defines every pipeline stage. */
 export const STAGE_SPECS: Record<string, StageSpec> = {
   '00-intake': {
     number: '00',
@@ -36,13 +27,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'research',
     gate: 'discovery-complete',
     promptFile: '00b-discovery.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'discovery-complete',
-        reason: 'discovery completion is attested by an authority; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '01-board': {
     number: '01',
@@ -51,13 +36,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'review',
     gate: 'board-approval',
     promptFile: '01-board.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'board-approval',
-        reason: 'board approval is a board/human decision; no mechanical gate exists',
-      },
-    ],
+    qualityGates: [{ type: 'ci-pipeline', command: 'board-approval (via board-tasks)' }],
   },
   '01b-brief-analyzer': {
     number: '01b',
@@ -66,13 +45,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'research',
     gate: 'brief-analysis-complete',
     promptFile: '01-board.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'brief-analysis-complete',
-        reason: 'brief analysis completion is attested by an authority; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '02-planning-1': {
     number: '02',
@@ -81,13 +54,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'research',
     gate: 'architecture-approval',
     promptFile: '02-planning-1-architecture.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'architecture-approval',
-        reason: 'ADR approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '03-planning-2': {
     number: '03',
@@ -96,14 +63,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'research',
     gate: 'implementation-approval',
     promptFile: '03-planning-2-implementation.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'implementation-approval',
-        reason:
-          'implementation spec approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '04-planning-3': {
     number: '04',
@@ -112,14 +72,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'research',
     gate: 'decomposition-approval',
     promptFile: '04-planning-3-decomposition.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 'decomposition-approval',
-        reason:
-          'task decomposition approval requires authority sign-off; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '05-coding': {
     number: '05',
@@ -139,10 +92,9 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     promptFile: '06-review.md',
     qualityGates: [
       {
-        kind: 'provider',
-        capability: 'reviewer',
-        reason:
-          'review verdicts require a wired reviewer provider; synthetic approvals are not permitted',
+        type: 'ai-review',
+        command:
+          'echo \'{"summary":"review-pass","verdict":"approve","findings":[],"stats":{"blockers":0,"should_fix":0,"suggestions":0}}\'',
       },
     ],
   },
@@ -153,13 +105,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'coding',
     gate: 're-review',
     promptFile: '07-remediate.md',
-    qualityGates: [
-      {
-        kind: 'authority',
-        capability: 're-review',
-        reason: 'remediation re-review is an approval-based gate; no mechanical check exists',
-      },
-    ],
+    qualityGates: ['true'],
   },
   '08-test': {
     number: '08',
@@ -177,13 +123,7 @@ export const STAGE_SPECS: Record<string, StageSpec> = {
     type: 'deploy',
     gate: 'deploy-verification',
     promptFile: '09-deploy.md',
-    qualityGates: [
-      {
-        kind: 'provider',
-        capability: 'ci-pipeline',
-        reason: 'deploy verification requires a wired CI pipeline provider',
-      },
-    ],
+    qualityGates: [{ type: 'ci-pipeline', command: 'deploy-verification' }],
   },
 };
 

packages/forge/src/errors.ts

@@ -1,46 +0,0 @@
-/**
- * Typed fail-closed capability errors (SDLC-D-035).
- *
- * A Forge run must fail closed when a required capability (executor, reviewer
- * provider, CI pipeline, authority sign-off) is missing. These typed errors
- * name the missing capability so callers can distinguish "not wired" from
- * ordinary execution failures.
- */
-
-/** Closed set of typed Forge capability error codes. */
-export const FORGE_ERROR_CODES = [
-  'FORGE_NO_EXECUTOR',
-  'FORGE_NO_REVIEWER',
-  'FORGE_NO_CI_PIPELINE',
-  'FORGE_NO_PROVIDER',
-  'FORGE_AUTHORITY_REQUIRED',
-] as const;
-
-export type ForgeErrorCode = (typeof FORGE_ERROR_CODES)[number];
-
-/** Raised when a required capability is missing and the pipeline must fail closed. */
-export class ForgeCapabilityError extends Error {
-  /** Typed error code from the closed FORGE_ERROR_CODES set. */
-  readonly code: ForgeErrorCode;
-  /** The missing capability, e.g. `task-executor`, `reviewer`, `board-approval`. */
-  readonly capability: string;
-
-  constructor(code: ForgeErrorCode, capability: string, message: string) {
-    super(message);
-    this.name = 'ForgeCapabilityError';
-    this.code = code;
-    this.capability = capability;
-  }
-}
-
-/** Map a provider gate capability to its typed error code. */
-export function providerErrorCode(capability: string): ForgeErrorCode {
-  switch (capability) {
-    case 'reviewer':
-      return 'FORGE_NO_REVIEWER';
-    case 'ci-pipeline':
-      return 'FORGE_NO_CI_PIPELINE';
-    default:
-      return 'FORGE_NO_PROVIDER';
-  }
-}

packages/forge/src/index.ts

@@ -5,13 +5,6 @@ export type {
   StageSpec,
   BriefClass,
   ClassSource,
-  ForgeOutcome,
-  AuthorityGate,
-  ProviderGate,
-  ForgeGate,
-  ForgeGateResult,
-  ForgeTaskResult,
-  RunMode,
   StageStatus,
   RunManifest,
   ForgeTaskStatus,
@@ -88,24 +81,5 @@ export {
   getPipelineStatus,
 } from './pipeline-runner.js';
 
-// Fail-closed errors and typed outcome model (SDLC-D-035)
-export { FORGE_ERROR_CODES, ForgeCapabilityError, providerErrorCode } from './errors.js';
-export type { ForgeErrorCode } from './errors.js';
-export {
-  isSatisfyingOutcome,
-  isCapabilityGate,
-  isCommandGate,
-  gateLabel,
-  uniformGateResults,
-  simulatedGateResults,
-  waitingGateResults,
-  blockedGateResults,
-  evaluateStageGates,
-} from './outcomes.js';
-export type { StageEvaluation } from './outcomes.js';
-
-// Simulated executor (explicit --simulate only)
-export { createSimulatedExecutor } from './simulated-executor.js';
-
 // CLI
 export { registerForgeCommand } from './cli.js';

packages/forge/src/outcomes.ts

@@ -1,147 +0,0 @@
-import type { GateEntry } from '@mosaicstack/macp';
-
-import type {
-  AuthorityGate,
-  ForgeGate,
-  ForgeGateResult,
-  ForgeOutcome,
-  ForgeTaskResult,
-  ProviderGate,
-} from './types.js';
-
-/**
- * Gate and dependency satisfaction predicate (SDLC-D-035).
- *
- * ONLY a verified `passed` outcome satisfies. Every other member of the closed
- * outcome set — including `simulated` — is non-satisfying, so a simulated or
- * authority-blocked result can never be read as success-by-verification.
- */
-export function isSatisfyingOutcome(outcome: ForgeOutcome): boolean {
-  return outcome === 'passed';
-}
-
-/** Whether a gate is an authority or provider gate (capability-based, command-less). */
-export function isCapabilityGate(gate: ForgeGate): gate is AuthorityGate | ProviderGate {
-  if (typeof gate !== 'object' || gate === null) return false;
-  const kind = (gate as Record<string, unknown>)['kind'];
-  return kind === 'authority' || kind === 'provider';
-}
-
-/** Whether a gate definition carries a real command a mechanical runner can execute. */
-export function isCommandGate(gate: ForgeGate): gate is string | GateEntry {
-  if (typeof gate === 'string') {
-    return gate.trim().length > 0;
-  }
-  if (isCapabilityGate(gate)) {
-    // Authority and provider gates are satisfied by a capability, not a command.
-    return false;
-  }
-  return typeof gate.command === 'string' && gate.command.trim().length > 0;
-}
-
-/** Typed label identifying a gate in results and logs. */
-export function gateLabel(gate: ForgeGate): string {
-  if (typeof gate === 'string') return gate;
-  if (isCapabilityGate(gate)) return `${gate.kind}:${gate.capability}`;
-  return gate.command || gate.type || 'unnamed-gate';
-}
-
-/** Reason string stamped on every simulated gate result. */
-export const SIMULATED_GATE_REASON =
-  'simulated execution (--simulate): gate was not evaluated by a real implementation';
-
-/** Build typed gate results with a uniform outcome for a stage's declared gates. */
-export function uniformGateResults(
-  gates: ForgeGate[],
-  outcome: ForgeOutcome,
-  reason: string,
-): ForgeGateResult[] {
-  return gates.map((gate) => ({ gate: gateLabel(gate), outcome, reason }));
-}
-
-/** Typed simulated gate results — used exclusively in `--simulate` runs. */
-export function simulatedGateResults(gates: ForgeGate[]): ForgeGateResult[] {
-  return uniformGateResults(gates, 'simulated', SIMULATED_GATE_REASON);
-}
-
-/** Typed waiting-for-authority gate results for approval-based stages. */
-export function waitingGateResults(gates: ForgeGate[], reason: string): ForgeGateResult[] {
-  return uniformGateResults(gates, 'waiting-for-authority', reason);
-}
-
-/** Typed blocked gate results for stages whose provider capability is not wired. */
-export function blockedGateResults(gates: ForgeGate[], reason: string): ForgeGateResult[] {
-  return uniformGateResults(gates, 'blocked', reason);
-}
-
-/** Outcome of evaluating a completed stage in normal mode. */
-export interface StageEvaluation {
-  outcome: ForgeOutcome;
-  reason: string;
-  gateResults: ForgeGateResult[];
-}
-
-/**
- * Evaluate a stage's declared gates against the executor's typed result.
- *
- * Fail-closed mapping:
- * - a `simulated` task or gate outcome in normal mode maps to `error`
- * - a missing gate result for a required command gate maps to `blocked`
- * - a non-passing task outcome propagates as the stage outcome
- * - only verified `passed` task and gate outcomes yield a `passed` stage
- */
-export function evaluateStageGates(
-  stageName: string,
-  gates: ForgeGate[],
-  result: ForgeTaskResult,
-): StageEvaluation {
-  const gateResults = result.gate_results ?? [];
-
-  if (result.outcome === 'simulated') {
-    return {
-      outcome: 'error',
-      reason: `executor reported a simulated outcome for stage '${stageName}' in normal mode — refusing to treat simulated results as verified`,
-      gateResults,
-    };
-  }
-
-  if (!isSatisfyingOutcome(result.outcome)) {
-    return {
-      outcome: result.outcome,
-      reason: `task outcome is '${result.outcome}': ${result.reason}`,
-      gateResults,
-    };
-  }
-
-  for (const gate of gates) {
-    // Authority and provider gates are pre-flighted before execution; they have
-    // no mechanical result to verify here.
-    if (!isCommandGate(gate)) continue;
-
-    const label = gateLabel(gate);
-    const gateResult = gateResults.find((r) => r.gate === label);
-    if (!gateResult) {
-      return {
-        outcome: 'blocked',
-        reason: `no gate result was reported for required gate '${label}' (stage '${stageName}')`,
-        gateResults,
-      };
-    }
-    if (!isSatisfyingOutcome(gateResult.outcome)) {
-      return {
-        outcome: gateResult.outcome === 'simulated' ? 'error' : gateResult.outcome,
-        reason: `gate '${label}' outcome is '${gateResult.outcome}': ${gateResult.reason}`,
-        gateResults,
-      };
-    }
-  }
-
-  return {
-    outcome: 'passed',
-    reason:
-      gates.length === 0
-        ? "stage declares no gates; task outcome 'passed' accepted"
-        : 'all declared gates verified passed',
-    gateResults,
-  };
-}

packages/forge/src/pipeline-runner.ts

@@ -1,33 +1,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { STAGE_SEQUENCE, STAGE_SPECS } from './constants.js';
+import { STAGE_SEQUENCE } from './constants.js';
 import { determineBriefClass, stagesForClass } from './brief-classifier.js';
-import { ForgeCapabilityError, providerErrorCode } from './errors.js';
-import {
-  blockedGateResults,
-  evaluateStageGates,
-  isCapabilityGate,
-  simulatedGateResults,
-  waitingGateResults,
-} from './outcomes.js';
 import { mapStageToTask } from './stage-adapter.js';
-import { createSimulatedExecutor } from './simulated-executor.js';
 import type {
   ForgeTask,
-  ForgeTaskResult,
   PipelineOptions,
   PipelineResult,
   RunManifest,
-  RunMode,
   StageStatus,
   TaskExecutor,
 } from './types.js';
 
-/** Reason stamped on stages that complete under explicit simulation. */
-const SIMULATED_STAGE_REASON =
-  'simulated execution (--simulate): stage was not executed by a real executor';
-
 /**
  * Generate a timestamp-based run ID.
  */
@@ -62,7 +47,6 @@ function createManifest(opts: {
   briefClass: RunManifest['briefClass'];
   classSource: RunManifest['classSource'];
   forceBoard: boolean;
-  mode: RunMode;
   runDir: string;
 }): RunManifest {
   const ts = nowISO();
@@ -73,7 +57,6 @@ function createManifest(opts: {
     briefClass: opts.briefClass,
     classSource: opts.classSource,
     forceBoard: opts.forceBoard,
-    mode: opts.mode,
     createdAt: ts,
     updatedAt: ts,
     currentStage: '',
@@ -125,199 +108,20 @@ export function selectStages(stages?: string[], skipTo?: string): string[] {
   return selected.slice(skipIndex);
 }
 
-/**
- * Fail closed when the required executor capability is missing (SDLC-D-035).
- */
-function requireExecutor(executor: TaskExecutor | undefined, simulate: boolean): TaskExecutor {
-  if (executor) return executor;
-  if (simulate) return createSimulatedExecutor({ log: false });
-  throw new ForgeCapabilityError(
-    'FORGE_NO_EXECUTOR',
-    'task-executor',
-    'no task executor is wired; refusing to run the pipeline with a stub executor (fail closed). ' +
-      'Pass --simulate to opt into explicitly simulated execution.',
-  );
-}
-
-/**
- * Pre-flight a stage's gates in normal mode (fail closed, SDLC-D-035).
- *
- * - authority gates: record a typed `waiting-for-authority` stage result and
- *   raise FORGE_AUTHORITY_REQUIRED — approval-based gates never pass vacuously.
- * - provider gates: record a typed `blocked` stage result and raise the typed
- *   capability error for the missing provider.
- *
- * Returns the stage status to record when the pre-flight blocks, or undefined
- * when the stage may proceed.
- */
-function preflightStageGates(
-  stageName: string,
-  manifest: RunManifest,
-): { status: StageStatus; error: ForgeCapabilityError } | undefined {
-  const spec = STAGE_SPECS[stageName];
-  if (!spec) throw new Error(`Unknown Forge stage: ${stageName}`);
-
-  for (const gate of spec.qualityGates) {
-    if (!isCapabilityGate(gate)) continue;
-
-    const startedAt = manifest.stages[stageName]?.startedAt;
-    const completedAt = nowISO();
-
-    if (gate.kind === 'authority') {
-      const reason = `gate '${gate.capability}' requires authority sign-off; no mechanical implementation exists (${gate.reason})`;
-      return {
-        status: {
-          status: 'waiting-for-authority',
-          reason,
-          startedAt,
-          completedAt,
-          gateResults: waitingGateResults(spec.qualityGates, reason),
-        },
-        error: new ForgeCapabilityError(
-          'FORGE_AUTHORITY_REQUIRED',
-          gate.capability,
-          `stage '${stageName}' is blocked on authority gate '${gate.capability}': ${gate.reason}. ` +
-            'The pipeline fails closed instead of passing vacuously. Record the approval out-of-band ' +
-            'or run with --simulate for explicitly simulated execution.',
-        ),
-      };
-    }
-
-    const reason = `gate '${gate.capability}' requires provider '${gate.capability}' and none is wired (${gate.reason})`;
-    return {
-      status: {
-        status: 'blocked',
-        reason,
-        startedAt,
-        completedAt,
-        gateResults: blockedGateResults(spec.qualityGates, reason),
-      },
-      error: new ForgeCapabilityError(
-        providerErrorCode(gate.capability),
-        gate.capability,
-        `stage '${stageName}' requires provider '${gate.capability}' which is not wired: ${gate.reason}. ` +
-          'The pipeline fails closed instead of passing vacuously.',
-      ),
-    };
-  }
-
-  return undefined;
-}
-
-/**
- * Execute the given stage tasks sequentially, updating the manifest.
- *
- * Normal mode requires a real executor and evaluates every declared command
- * gate through the typed outcome model; any non-verified result fails closed.
- * Simulate mode types every stage and gate result as `simulated`.
- */
-async function executeStages(opts: {
-  manifest: RunManifest;
-  runDir: string;
-  tasks: ForgeTask[];
-  stageNames: string[];
-  executor: TaskExecutor;
-  simulate: boolean;
-}): Promise<void> {
-  const { manifest, runDir, tasks, stageNames, executor, simulate } = opts;
-
-  for (let i = 0; i < tasks.length; i++) {
-    const task = tasks[i]!;
-    const stageName = stageNames[i]!;
-    const spec = STAGE_SPECS[stageName];
-    if (!spec) throw new Error(`Unknown Forge stage: ${stageName}`);
-
-    // Update manifest: stage in progress
-    manifest.currentStage = stageName;
-    manifest.stages[stageName] = {
-      status: 'in_progress',
-      startedAt: nowISO(),
-    };
-    saveManifest(runDir, manifest);
-
-    // Fail-closed pre-flight (normal mode only): authority/provider gates have
-    // no mechanical implementation and must never pass vacuously.
-    if (!simulate) {
-      const blocked = preflightStageGates(stageName, manifest);
-      if (blocked) {
-        manifest.stages[stageName] = blocked.status;
-        manifest.status =
-          blocked.status.status === 'waiting-for-authority' ? 'waiting-for-authority' : 'failed';
-        saveManifest(runDir, manifest);
-        throw blocked.error;
-      }
-    }
-
-    let result: ForgeTaskResult;
-    try {
-      await executor.submitTask(task);
-      result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
-    } catch (error) {
-      // Process errors (including timeouts) map to the fail-closed `error` outcome.
-      const reason = error instanceof Error ? error.message : String(error);
-      manifest.stages[stageName] = {
-        status: 'error',
-        reason: `executor error: ${reason}`,
-        startedAt: manifest.stages[stageName]?.startedAt,
-        completedAt: nowISO(),
-        gateResults: [],
-      };
-      manifest.status = 'failed';
-      saveManifest(runDir, manifest);
-      throw error instanceof Error ? error : new Error(reason);
-    }
-
-    if (simulate) {
-      manifest.stages[stageName] = {
-        status: 'simulated',
-        reason: SIMULATED_STAGE_REASON,
-        startedAt: manifest.stages[stageName]?.startedAt,
-        completedAt: nowISO(),
-        gateResults: simulatedGateResults(spec.qualityGates),
-      };
-      saveManifest(runDir, manifest);
-      continue;
-    }
-
-    const evaluation = evaluateStageGates(stageName, spec.qualityGates, result);
-    manifest.stages[stageName] = {
-      status: evaluation.outcome,
-      reason: evaluation.reason,
-      startedAt: manifest.stages[stageName]?.startedAt,
-      completedAt: nowISO(),
-      gateResults: evaluation.gateResults,
-    };
-
-    if (evaluation.outcome !== 'passed') {
-      manifest.status =
-        evaluation.outcome === 'waiting-for-authority' ? 'waiting-for-authority' : 'failed';
-      saveManifest(runDir, manifest);
-      throw new Error(`Stage ${stageName} ${evaluation.outcome}: ${evaluation.reason}`);
-    }
-
-    saveManifest(runDir, manifest);
-  }
-}
-
 /**
  * Run the Forge pipeline.
  *
- * 1. Fail closed unless a real executor is wired or simulation is explicit
- * 2. Classify the brief
- * 3. Generate a run ID and create run directory
- * 4. Map stages to tasks and submit to TaskExecutor
- * 5. Track manifest with typed stage outcomes
- * 6. Return pipeline result
+ * 1. Classify the brief
+ * 2. Generate a run ID and create run directory
+ * 3. Map stages to tasks and submit to TaskExecutor
+ * 4. Track manifest with stage statuses
+ * 5. Return pipeline result
  */
 export async function runPipeline(
   briefPath: string,
   projectRoot: string,
   options: PipelineOptions,
 ): Promise<PipelineResult> {
-  const simulate = options.simulate ?? false;
-  const executor = requireExecutor(options.executor, simulate);
-  const mode: RunMode = simulate ? 'simulated' : 'normal';
-
   const resolvedRoot = path.resolve(projectRoot);
   const resolvedBrief = path.resolve(briefPath);
   const briefContent = fs.readFileSync(resolvedBrief, 'utf-8');
@@ -342,7 +146,6 @@ export async function runPipeline(
     briefClass,
     classSource,
     forceBoard: options.forceBoard ?? false,
-    mode,
     runDir,
   });
 
@@ -369,10 +172,54 @@ export async function runPipeline(
   }
 
   // Execute stages
-  await executeStages({ manifest, runDir, tasks, stageNames: selectedStages, executor, simulate });
+  const { executor } = options;
+  for (let i = 0; i < tasks.length; i++) {
+    const task = tasks[i]!;
+    const stageName = selectedStages[i]!;
 
-  // All stages reached a terminal state for this mode
-  manifest.status = simulate ? 'simulated' : 'completed';
+    // Update manifest: stage in progress
+    manifest.currentStage = stageName;
+    manifest.stages[stageName] = {
+      status: 'in_progress',
+      startedAt: nowISO(),
+    };
+    saveManifest(runDir, manifest);
+
+    try {
+      await executor.submitTask(task);
+      const result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
+
+      // Update manifest: stage completed or failed
+      const stageStatus: StageStatus = {
+        status: result.status === 'completed' ? 'passed' : 'failed',
+        startedAt: manifest.stages[stageName]!.startedAt,
+        completedAt: nowISO(),
+      };
+      manifest.stages[stageName] = stageStatus;
+
+      if (result.status !== 'completed') {
+        manifest.status = 'failed';
+        saveManifest(runDir, manifest);
+        throw new Error(`Stage ${stageName} failed with status: ${result.status}`);
+      }
+
+      saveManifest(runDir, manifest);
+    } catch (error) {
+      if (!manifest.stages[stageName]?.completedAt) {
+        manifest.stages[stageName] = {
+          status: 'failed',
+          startedAt: manifest.stages[stageName]?.startedAt,
+          completedAt: nowISO(),
+        };
+      }
+      manifest.status = 'failed';
+      saveManifest(runDir, manifest);
+      throw error;
+    }
+  }
+
+  // All stages passed
+  manifest.status = 'completed';
   saveManifest(runDir, manifest);
 
   return {
@@ -387,30 +234,22 @@ export async function runPipeline(
 }
 
 /**
- * Resume a pipeline from the last non-passed stage.
+ * Resume a pipeline from the last incomplete stage.
  */
 export async function resumePipeline(
   runDir: string,
-  executor?: TaskExecutor,
-  options?: { simulate?: boolean },
+  executor: TaskExecutor,
 ): Promise<PipelineResult> {
-  const simulate = options?.simulate ?? false;
-  const wiredExecutor = requireExecutor(executor, simulate);
-  const mode: RunMode = simulate ? 'simulated' : 'normal';
-
   const manifest = loadManifest(runDir);
   const resolvedRoot = path.dirname(path.dirname(path.dirname(runDir))); // .forge/runs/{id} → project root
 
   const briefContent = fs.readFileSync(manifest.brief, 'utf-8');
   const allStages = stagesForClass(manifest.briefClass, manifest.forceBoard);
 
-  manifest.mode = mode;
-
-  // Find first non-satisfying stage (only a verified `passed` counts as done;
-  // simulated and waiting-for-authority stages are re-run).
+  // Find first non-passed stage
   const resumeFrom = allStages.find((s) => manifest.stages[s]?.status !== 'passed');
   if (!resumeFrom) {
-    manifest.status = mode === 'simulated' ? 'simulated' : 'completed';
+    manifest.status = 'completed';
     saveManifest(runDir, manifest);
     return {
       runId: manifest.runId,
@@ -445,16 +284,49 @@ export async function resumePipeline(
     tasks.push(task);
   }
 
-  await executeStages({
-    manifest,
-    runDir,
-    tasks,
-    stageNames: remainingStages,
-    executor: wiredExecutor,
-    simulate,
-  });
+  for (let i = 0; i < tasks.length; i++) {
+    const task = tasks[i]!;
+    const stageName = remainingStages[i]!;
 
-  manifest.status = simulate ? 'simulated' : 'completed';
+    manifest.currentStage = stageName;
+    manifest.stages[stageName] = {
+      status: 'in_progress',
+      startedAt: nowISO(),
+    };
+    saveManifest(runDir, manifest);
+
+    try {
+      await executor.submitTask(task);
+      const result = await executor.waitForCompletion(task.id, task.timeoutSeconds * 1000);
+
+      manifest.stages[stageName] = {
+        status: result.status === 'completed' ? 'passed' : 'failed',
+        startedAt: manifest.stages[stageName]!.startedAt,
+        completedAt: nowISO(),
+      };
+
+      if (result.status !== 'completed') {
+        manifest.status = 'failed';
+        saveManifest(runDir, manifest);
+        throw new Error(`Stage ${stageName} failed with status: ${result.status}`);
+      }
+
+      saveManifest(runDir, manifest);
+    } catch (error) {
+      if (!manifest.stages[stageName]?.completedAt) {
+        manifest.stages[stageName] = {
+          status: 'failed',
+          startedAt: manifest.stages[stageName]?.startedAt,
+          completedAt: nowISO(),
+        };
+      }
+      manifest.status = 'failed';
+      saveManifest(runDir, manifest);
+      throw error;
+    }
+  }
+
+  manifest.status = 'completed';
   saveManifest(runDir, manifest);
 
   return {

packages/forge/src/simulated-executor.ts

@@ -1,32 +0,0 @@
-import type { ForgeTask, ForgeTaskResult, TaskExecutor } from './types.js';
-
-/**
- * Simulated executor — used ONLY when the caller explicitly passes --simulate.
- *
- * It submits no real work and returns typed `simulated` results so a simulated
- * run can never be confused with a verified one. In normal mode (no --simulate)
- * the CLI refuses to run at all with FORGE_NO_EXECUTOR instead of wiring this
- * stub (fail closed, SDLC-D-035).
- */
-export function createSimulatedExecutor(options?: { log?: boolean }): TaskExecutor {
-  const log = options?.log ?? true;
-  return {
-    async submitTask(task: ForgeTask) {
-      if (log) console.log(`  [forge:simulated] stage submitted: ${task.id} (${task.title})`);
-    },
-    async waitForCompletion(taskId: string): Promise<ForgeTaskResult> {
-      if (log) console.log(`  [forge:simulated] stage complete:  ${taskId}`);
-      return {
-        task_id: taskId,
-        outcome: 'simulated',
-        reason: 'no executor wired; simulated execution requested via --simulate',
-        completed_at: new Date().toISOString(),
-        exit_code: 0,
-        gate_results: [],
-      };
-    },
-    async getTaskStatus() {
-      return 'completed' as const;
-    },
-  };
-}

packages/forge/src/types.ts

@@ -1,4 +1,4 @@
-import type { GateEntry } from '@mosaicstack/macp';
+import type { GateEntry, TaskResult } from '@mosaicstack/macp';
 
 /** Stage dispatch mode. */
 export type StageDispatch = 'exec' | 'yolo' | 'pi';
@@ -6,58 +6,6 @@ export type StageDispatch = 'exec' | 'yolo' | 'pi';
 /** Stage type — determines agent selection and gate requirements. */
 export type StageType = 'research' | 'review' | 'coding' | 'deploy';
 
-/**
- * Typed outcome for every gate and stage evaluation — closed set (SDLC-D-035).
- *
- * Only `passed` means "verified by a real implementation". `simulated` is
- * produced exclusively in explicit `--simulate` runs and is never satisfying.
- */
-export type ForgeOutcome =
-  | 'passed'
-  | 'failed'
-  | 'blocked'
-  | 'error'
-  | 'waiting-for-authority'
-  | 'simulated'
-  | 'not-applicable';
-
-/** A gate that requires authority (human/board) sign-off; no mechanical command can satisfy it. */
-export interface AuthorityGate {
-  kind: 'authority';
-  capability: string;
-  reason: string;
-}
-
-/** A gate that requires a wired provider (e.g. an AI reviewer, CI pipeline) to evaluate. */
-export interface ProviderGate {
-  kind: 'provider';
-  capability: string;
-  reason: string;
-}
-
-/** Forge quality gate: a real command, an authority sign-off, or a provider-backed check. */
-export type ForgeGate = string | GateEntry | AuthorityGate | ProviderGate;
-
-/** Typed result of evaluating a single quality gate. */
-export interface ForgeGateResult {
-  gate: string;
-  outcome: ForgeOutcome;
-  reason: string;
-  exitCode?: number;
-  output?: string;
-  timedOut?: boolean;
-}
-
-/** Typed result of a task/stage execution returned by a TaskExecutor. */
-export interface ForgeTaskResult {
-  task_id: string;
-  outcome: ForgeOutcome;
-  reason: string;
-  completed_at: string;
-  exit_code: number;
-  gate_results: ForgeGateResult[];
-}
-
 /** Stage specification — defines a single pipeline stage. */
 export interface StageSpec {
   number: string;
@@ -66,7 +14,7 @@ export interface StageSpec {
   type: StageType;
   gate: string;
   promptFile: string;
-  qualityGates: ForgeGate[];
+  qualityGates: (string | GateEntry)[];
 }
 
 /** Brief classification. */
@@ -77,18 +25,11 @@ export type ClassSource = 'cli' | 'frontmatter' | 'auto';
 
 /** Per-stage status within a run manifest. */
 export interface StageStatus {
-  status: 'pending' | 'in_progress' | ForgeOutcome;
-  /** Why the stage reached its current (terminal) outcome, when applicable. */
-  reason?: string;
+  status: 'pending' | 'in_progress' | 'passed' | 'failed';
   startedAt?: string;
   completedAt?: string;
-  /** Typed per-gate results recorded alongside the stage outcome. */
-  gateResults?: ForgeGateResult[];
 }
 
-/** Execution mode of a run. */
-export type RunMode = 'normal' | 'simulated';
-
 /** Run manifest — persisted to disk as manifest.json. */
 export interface RunManifest {
   runId: string;
@@ -97,23 +38,10 @@ export interface RunManifest {
   briefClass: BriefClass;
   classSource: ClassSource;
   forceBoard: boolean;
-  /**
-   * Execution mode. `simulated` runs stub execution; their results are typed
-   * `simulated` and must never be read as verified success. Optional because
-   * manifests written before this field existed default to `normal`.
-   */
-  mode?: RunMode;
   createdAt: string;
   updatedAt: string;
   currentStage: string;
-  status:
-    | 'in_progress'
-    | 'completed'
-    | 'failed'
-    | 'interrupted'
-    | 'rejected'
-    | 'simulated'
-    | 'waiting-for-authority';
+  status: 'in_progress' | 'completed' | 'failed' | 'interrupted' | 'rejected';
   stages: Record<string, StageStatus>;
 }
 
@@ -137,7 +65,7 @@ export interface ForgeTask {
   briefPath: string;
   resultPath: string;
   timeoutSeconds: number;
-  qualityGates: ForgeGate[];
+  qualityGates: (string | GateEntry)[];
   worktree?: string;
   command?: string;
   dependsOn?: string[];
@@ -148,7 +76,7 @@ export interface ForgeTask {
 /** Abstract task executor — decouples from packages/coord. */
 export interface TaskExecutor {
   submitTask(task: ForgeTask): Promise<void>;
-  waitForCompletion(taskId: string, timeoutMs: number): Promise<ForgeTaskResult>;
+  waitForCompletion(taskId: string, timeoutMs: number): Promise<TaskResult>;
   getTaskStatus(taskId: string): Promise<ForgeTaskStatus>;
 }
 
@@ -194,16 +122,7 @@ export interface PipelineOptions {
   stages?: string[];
   skipTo?: string;
   dryRun?: boolean;
-  /**
-   * Real task executor. Required in normal mode: the pipeline fails closed
-   * with FORGE_NO_EXECUTOR when it is absent.
-   */
-  executor?: TaskExecutor;
-  /**
-   * Explicit opt-in to simulated execution. Every stage and gate result is
-   * typed `simulated` and is never satisfying.
-   */
-  simulate?: boolean;
+  executor: TaskExecutor;
 }
 
 /** Pipeline run result. */

packages/macp/__tests__/gate-runner.test.ts

@@ -0,0 +1,253 @@
+import { mkdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { normalizeGate, countAIFindings, runGate, runGates } from '../src/gate-runner.js';
+
+function makeTmpDir(): string {
+  const dir = join(tmpdir(), `macp-gate-${randomUUID()}`);
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+describe('normalizeGate', () => {
+  it('normalizes a string to mechanical gate', () => {
+    expect(normalizeGate('echo test')).toEqual({
+      command: 'echo test',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('normalizes an object gate with defaults', () => {
+    expect(normalizeGate({ command: 'lint' })).toEqual({
+      command: 'lint',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('preserves explicit type and fail_on', () => {
+    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
+      command: 'review',
+      type: 'ai-review',
+      fail_on: 'any',
+    });
+  });
+
+  it('handles non-string/non-object input', () => {
+    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+  });
+});
+
+describe('countAIFindings', () => {
+  it('returns zeros for non-object', () => {
+    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
+  });
+
+  it('counts from stats block', () => {
+    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
+  });
+
+  it('counts from findings array when stats has no blockers', () => {
+    const output = {
+      stats: { blockers: 0 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
+  });
+
+  it('uses stats blockers over findings array when stats has blockers', () => {
+    const output = {
+      stats: { blockers: 5 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
+    };
+    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
+    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
+  });
+
+  it('counts findings length as total when stats has zero total', () => {
+    const output = {
+      findings: [{ severity: 'warning' }, { severity: 'info' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
+  });
+});
+
+describe('runGate', () => {
+  let tmp: string;
+  let logPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = join(tmp, 'gate.log');
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('passes mechanical gate on exit 0', () => {
+    const result = runGate('echo hello', tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.exit_code).toBe(0);
+    expect(result.type).toBe('mechanical');
+    expect(result.output).toContain('hello');
+  });
+
+  it('fails mechanical gate on non-zero exit', () => {
+    const result = runGate('exit 1', tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.exit_code).toBe(1);
+  });
+
+  it('ci-pipeline always passes', () => {
+    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.type).toBe('ci-pipeline');
+    expect(result.output).toBe('CI pipeline gate placeholder');
+  });
+
+  it('empty command passes', () => {
+    const result = runGate({ command: '' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+  });
+
+  it('ai-review gate parses JSON output', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.blockers).toBe(0);
+    expect(result.findings).toBe(1);
+  });
+
+  it('ai-review gate fails on blockers', () => {
+    const json = JSON.stringify({ stats: { blockers: 2 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.blockers).toBe(2);
+  });
+
+  it('ai-review gate with fail_on=any fails on any findings', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate(
+      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
+      tmp,
+      logPath,
+      30,
+    );
+    expect(result.passed).toBe(false);
+    expect(result.fail_on).toBe('any');
+  });
+
+  it('ai-review gate fails on invalid JSON output', () => {
+    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.parse_error).toBeDefined();
+  });
+
+  it('writes to log file', () => {
+    runGate('echo logged', tmp, logPath, 30);
+    const log = readFileSync(logPath, 'utf-8');
+    expect(log).toContain('COMMAND: echo logged');
+    expect(log).toContain('logged');
+    expect(log).toContain('EXIT:');
+  });
+});
+
+describe('runGates', () => {
+  let tmp: string;
+  let logPath: string;
+  let eventsPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = join(tmp, 'gates.log');
+    eventsPath = join(tmp, 'events.ndjson');
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('runs multiple gates and returns results', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo one', 'echo two'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-1',
+    );
+    expect(allPassed).toBe(true);
+    expect(gateResults).toHaveLength(2);
+  });
+
+  it('reports failure when any gate fails', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo ok', 'exit 1'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-2',
+    );
+    expect(allPassed).toBe(false);
+    expect(gateResults[0]!.passed).toBe(true);
+    expect(gateResults[1]!.passed).toBe(false);
+  });
+
+  it('emits events for each gate', () => {
+    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
+    const events = readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    expect(events).toHaveLength(2); // started + passed
+    expect(events[0].event_type).toBe('rail.check.started');
+    expect(events[1].event_type).toBe('rail.check.passed');
+  });
+
+  it('skips gates with empty command (non ci-pipeline)', () => {
+    const { gateResults } = runGates(
+      [{ command: '', type: 'mechanical' }, 'echo real'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-4',
+    );
+    expect(gateResults).toHaveLength(1);
+  });
+
+  it('does not skip ci-pipeline even with empty command', () => {
+    const { gateResults } = runGates(
+      [{ command: '', type: 'ci-pipeline' }],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-5',
+    );
+    expect(gateResults).toHaveLength(1);
+    expect(gateResults[0]!.passed).toBe(true);
+  });
+
+  it('emits failed event with correct message', () => {
+    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
+    const events = readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    const failEvent = events.find(
+      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
+    );
+    expect(failEvent).toBeDefined();
+    expect(failEvent.message).toContain('Gate failed (');
+  });
+});

packages/macp/src/cli.spec.ts

@@ -1,8 +1,5 @@
-import { describe, it, expect, afterEach, beforeEach, vi } from 'vitest';
+import { describe, it, expect } from 'vitest';
 import { Command } from 'commander';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
 import { registerMacpCommand } from './cli.js';
 
 describe('registerMacpCommand', () => {
@@ -78,162 +75,3 @@ describe('registerMacpCommand', () => {
     expect(topLevel).toContain('events');
   });
 });
-
-/**
- * RI-N2 fail-closed CLI behavior: an unimplemented capability is a failure,
- * never a success. Every stub exits nonzero with a typed message, and the
- * implemented `macp gate` mirrors the typed gate-runner states.
- */
-describe('registerMacpCommand fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-
-  function buildProgram(): Command {
-    const program = new Command();
-    program.exitOverride();
-    program.configureOutput({ writeErr: () => {} });
-    registerMacpCommand(program);
-    return program;
-  }
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'macp-cli-failclosed-'));
-    process.exitCode = 0;
-  });
-
-  afterEach(() => {
-    process.exitCode = 0;
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('macp tasks list exits nonzero (unimplemented capability)', async () => {
-    const program = buildProgram();
-    await program.parseAsync(['macp', 'tasks', 'list'], { from: 'user' });
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp submit exits nonzero with a typed MACP_NOT_IMPLEMENTED message', async () => {
-    const program = buildProgram();
-    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-    try {
-      await program.parseAsync(['macp', 'submit', 'spec.json'], { from: 'user' });
-      expect(process.exitCode).not.toBe(0);
-      const errText = errSpy.mock.calls.map((c) => String(c[0])).join('\n');
-      expect(errText).toContain('MACP_NOT_IMPLEMENTED');
-    } finally {
-      errSpy.mockRestore();
-    }
-  });
-
-  it('macp events tail exits nonzero (unimplemented capability)', async () => {
-    const program = buildProgram();
-    await program.parseAsync(['macp', 'events', 'tail'], { from: 'user' });
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate runs a green inline command and exits 0', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        'exit 0',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).toBe(0);
-  });
-
-  it('macp gate exits nonzero on a failing command', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        'exit 9',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate with an unimplemented ci-pipeline capability exits nonzero', async () => {
-    const program = buildProgram();
-    const specPath = path.join(tmpDir, 'gates.json');
-    fs.writeFileSync(specPath, JSON.stringify([{ type: 'ci-pipeline' }]));
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        specPath,
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate --simulate completes (exit 0) but reports simulated results', async () => {
-    const program = buildProgram();
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    try {
-      await program.parseAsync(
-        [
-          'macp',
-          'gate',
-          'exit 0',
-          '--simulate',
-          '--cwd',
-          tmpDir,
-          '--log',
-          path.join(tmpDir, 'g.log'),
-          '--timeout',
-          '10',
-        ],
-        { from: 'user' },
-      );
-      // completes only because the caller explicitly asked to simulate
-      expect(process.exitCode).toBe(0);
-      const outText = logSpy.mock.calls.map((c) => String(c[0])).join('\n');
-      expect(outText).toContain('simulated');
-      expect(outText).toContain('SIMULATED');
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('macp gate with an empty spec exits nonzero with a typed error', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        '   ',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-});

packages/macp/src/cli.ts

@@ -1,73 +1,5 @@
-import { existsSync, readFileSync } from 'node:fs';
-
 import type { Command } from 'commander';
 
-import { runGates } from './gate-runner.js';
-import { MACPCapabilityError, type MacpErrorCode } from './errors.js';
-
-/**
- * Load gates from a spec: an existing file (JSON gates array, a JSON object
- * with `quality_gates`, a JSON gate object, or one command per line) or an
- * inline command string. Fails closed with a typed capability error when the
- * spec contains no executable gate definition.
- */
-function loadGateSpec(spec: string): unknown[] {
-  if (existsSync(spec)) {
-    const raw = readFileSync(spec, 'utf-8');
-    try {
-      const parsed = JSON.parse(raw) as unknown;
-      if (Array.isArray(parsed)) {
-        if (parsed.length === 0) {
-          throw new MACPCapabilityError(
-            'MACP_NO_COMMAND',
-            'gate-spec',
-            `gate spec file '${spec}' contains an empty gates array`,
-          );
-        }
-        return parsed;
-      }
-      if (typeof parsed === 'object' && parsed !== null) {
-        const obj = parsed as Record<string, unknown>;
-        if (Array.isArray(obj['quality_gates'])) {
-          return obj['quality_gates'];
-        }
-        return [parsed];
-      }
-      throw new MACPCapabilityError(
-        'MACP_NO_COMMAND',
-        'gate-spec',
-        `gate spec file '${spec}' parsed to ${typeof parsed} — expected a gates array, a task with quality_gates, or a gate object`,
-      );
-    } catch (exc) {
-      if (exc instanceof MACPCapabilityError) throw exc;
-      // Not JSON — treat each non-empty line as a command gate.
-      const lines = raw
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l.length > 0);
-      if (lines.length > 0) return lines;
-      throw new MACPCapabilityError(
-        'MACP_NO_COMMAND',
-        'gate-spec',
-        `gate spec file '${spec}' contains no gates`,
-      );
-    }
-  }
-  if (spec.trim().length > 0) return [spec];
-  throw new MACPCapabilityError('MACP_NO_COMMAND', 'gate-spec', 'gate spec is empty');
-}
-
-/** Print a typed not-implemented failure and exit nonzero (RI-N2 fail-closed). */
-function notImplemented(subcommand: string, capability: string, hint: string): void {
-  const err = new MACPCapabilityError(
-    'MACP_NOT_IMPLEMENTED',
-    capability,
-    `${subcommand} is not implemented in @mosaicstack/macp yet (${capability} capability absent) — ${hint}`,
-  );
-  console.error(`[macp] ${subcommand}: ${err.message} [${err.code}]`);
-  process.exitCode = 1;
-}
-
 /**
  * Register macp subcommands on an existing Commander program.
  * This avoids cross-package Commander version mismatches by using the
@@ -92,14 +24,15 @@ export function registerMacpCommand(parent: Command): void {
       'Filter by task type (coding|deploy|research|review|documentation|infrastructure)',
     )
     .action((opts: { status?: string; type?: string }) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — task persistence layer is not present in @mosaicstack/macp
+      console.log('[macp] tasks list: not yet wired — use macp package programmatically');
       if (opts.status) {
         console.log(`  status filter: ${opts.status}`);
       }
       if (opts.type) {
         console.log(`  type filter: ${opts.type}`);
       }
-      notImplemented('tasks list', 'task-persistence', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 
   // ─── submit ──────────────────────────────────────────────────────────────
@@ -108,11 +41,12 @@ export function registerMacpCommand(parent: Command): void {
     .command('submit <path>')
     .description('Submit a task from a JSON/YAML spec file')
     .action((specPath: string) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — task submission requires a running MACP server
+      console.log('[macp] submit: not yet wired — use macp package programmatically');
       console.log(`  spec path: ${specPath}`);
       console.log('  task id:   (unavailable — no MACP server connected)');
       console.log('  status:    (unavailable — no MACP server connected)');
-      notImplemented('submit', 'macp-server', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 
   // ─── gate ────────────────────────────────────────────────────────────────
@@ -124,58 +58,16 @@ export function registerMacpCommand(parent: Command): void {
     .option('--cwd <path>', 'Working directory for gate execution', process.cwd())
     .option('--log <path>', 'Path to write gate log output', '/tmp/macp-gate.log')
     .option('--timeout <seconds>', 'Gate timeout in seconds', '60')
-    .option(
-      '--simulate',
-      'Simulate gates instead of executing them; results are typed simulated and never satisfy a check',
-    )
-    .action(
-      (
-        spec: string,
-        opts: { failOn: string; cwd: string; log: string; timeout: string; simulate?: boolean },
-      ) => {
-        let gates: unknown[];
-        try {
-          gates = loadGateSpec(spec);
-        } catch (exc) {
-          if (exc instanceof MACPCapabilityError) {
-            console.error(`[macp] gate: ${exc.message} [${exc.code}]`);
-          } else {
-            console.error(`[macp] gate: ${String(exc)}`);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const timeoutSec = Number.parseInt(opts.timeout, 10) || 60;
-        const eventsPath = `${opts.log}.events.ndjson`;
-        const { state, gateResults } = runGates(
-          gates,
-          opts.cwd,
-          opts.log,
-          timeoutSec,
-          eventsPath,
-          'macp-cli-gate',
-          {
-            simulate: opts.simulate,
-          },
-        );
-
-        for (const r of gateResults) {
-          const label = r.command || r.type;
-          const reason = r.reason ? ` — ${r.reason}` : '';
-          console.log(`[macp] gate ${r.status}: ${label}${reason}`);
-        }
-        if (opts.simulate) {
-          console.log(
-            '[macp] SIMULATED run — every result is typed simulated and can never satisfy a gate, dependency, or release check',
-          );
-        }
-
-        // Simulated runs may complete (exit 0) only because the caller
-        // explicitly passed --simulate; the typed state stays 'simulated'.
-        process.exitCode = state === 'passed' || state === 'simulated' ? 0 : 1;
-      },
-    );
+    .action((spec: string, opts: { failOn: string; cwd: string; log: string; timeout: string }) => {
+      // not yet wired — gate execution requires a task context and event sink
+      console.log('[macp] gate: not yet wired — use macp package programmatically');
+      console.log(`  spec:     ${spec}`);
+      console.log(`  fail-on:  ${opts.failOn}`);
+      console.log(`  cwd:      ${opts.cwd}`);
+      console.log(`  log:      ${opts.log}`);
+      console.log(`  timeout:  ${opts.timeout}s`);
+      process.exitCode = 0;
+    });
 
   // ─── events ──────────────────────────────────────────────────────────────
 
@@ -187,16 +79,14 @@ export function registerMacpCommand(parent: Command): void {
     .option('--file <path>', 'Path to the MACP events NDJSON file')
     .option('--follow', 'Follow the file for new events (like tail -f)')
     .action((opts: { file?: string; follow?: boolean }) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — event streaming requires a live event source
+      console.log('[macp] events tail: not yet wired — use macp package programmatically');
       if (opts.file) {
         console.log(`  file:   ${opts.file}`);
       }
       if (opts.follow) {
         console.log('  mode:   follow');
       }
-      notImplemented('events tail', 'event-source', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 }
-
-// Re-export so CLI consumers can surface typed capability codes.
-export type { MacpErrorCode };

packages/macp/src/errors.ts

@@ -1,35 +0,0 @@
-/** Typed error code from the closed MACP_ERROR_CODES set. */
-export type MacpErrorCode = (typeof MACP_ERROR_CODES)[number];
-/**
- * Typed fail-closed capability errors (RI-N2, SDLC-D-035).
- *
- * MACP must fail closed when a required capability (executor, reviewer,
- * command, CI provider, human authority) is absent. These typed codes mirror
- * the Forge failure vocabulary (FORGE_NO_*) so both packages speak the same
- * language: an unimplemented capability is a failure, never a stub success.
- */
-
-/** Closed set of typed MACP capability error codes. */
-export const MACP_ERROR_CODES = [
-  'MACP_NOT_IMPLEMENTED',
-  'MACP_NO_COMMAND',
-  'MACP_NO_REVIEWER',
-  'MACP_NO_CI_PIPELINE',
-  'MACP_NO_PROVIDER',
-  'MACP_AUTHORITY_REQUIRED',
-] as const;
-
-/** Raised when a required capability is missing and execution must fail closed. */
-export class MACPCapabilityError extends Error {
-  /** Typed error code from the closed MACP_ERROR_CODES set. */
-  readonly code: MacpErrorCode;
-  /** The missing capability, e.g. `ci-provider`, `task-persistence`, `command`. */
-  readonly capability: string;
-
-  constructor(code: MacpErrorCode, capability: string, message: string) {
-    super(message);
-    this.name = 'MACPCapabilityError';
-    this.code = code;
-    this.capability = capability;
-  }
-}

packages/macp/src/gate-runner.spec.ts

@@ -1,429 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import { countAIFindings, normalizeGate, runGate, runGates } from './gate-runner.js';
-
-function makeTmpDir(): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'macp-gate-'));
-}
-
-describe('normalizeGate', () => {
-  it('normalizes a string to mechanical gate', () => {
-    expect(normalizeGate('echo test')).toEqual({
-      command: 'echo test',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('normalizes an object gate with defaults', () => {
-    expect(normalizeGate({ command: 'lint' })).toEqual({
-      command: 'lint',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('preserves explicit type and fail_on', () => {
-    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
-      command: 'review',
-      type: 'ai-review',
-      fail_on: 'any',
-    });
-  });
-
-  it('handles non-string/non-object input', () => {
-    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-  });
-});
-
-describe('countAIFindings', () => {
-  it('returns zeros for non-object', () => {
-    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
-  });
-
-  it('counts from stats block', () => {
-    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
-  });
-
-  it('counts from findings array when stats has no blockers', () => {
-    const output = {
-      stats: { blockers: 0 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
-  });
-
-  it('uses stats blockers over findings array when stats has blockers', () => {
-    const output = {
-      stats: { blockers: 5 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
-    };
-    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
-    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
-  });
-
-  it('counts findings length as total when stats has zero total', () => {
-    const output = {
-      findings: [{ severity: 'warning' }, { severity: 'info' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
-  });
-});
-
-describe('runGate', () => {
-  let tmp: string;
-  let logPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = path.join(tmp, 'gate.log');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('passes mechanical gate on exit 0', () => {
-    const result = runGate('echo hello', tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.exit_code).toBe(0);
-    expect(result.type).toBe('mechanical');
-    expect(result.output).toContain('hello');
-  });
-
-  it('fails mechanical gate on non-zero exit', () => {
-    const result = runGate('exit 1', tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.exit_code).toBe(1);
-  });
-
-  it('ci-pipeline fails closed without a CI provider (no placeholder pass)', () => {
-    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.status).toBe('capability_failure');
-    expect(result.capability_code).toBe('MACP_NO_CI_PIPELINE');
-    expect(result.type).toBe('ci-pipeline');
-    expect(result.output).not.toBe('CI pipeline gate placeholder');
-  });
-
-  it('empty command is a typed capability failure, never a pass', () => {
-    const result = runGate({ command: '' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.status).toBe('capability_failure');
-    expect(result.capability_code).toBe('MACP_NO_COMMAND');
-  });
-
-  it('ai-review gate parses JSON output', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.blockers).toBe(0);
-    expect(result.findings).toBe(1);
-  });
-
-  it('ai-review gate fails on blockers', () => {
-    const json = JSON.stringify({ stats: { blockers: 2 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.blockers).toBe(2);
-  });
-
-  it('ai-review gate with fail_on=any fails on any findings', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate(
-      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
-      tmp,
-      logPath,
-      30,
-    );
-    expect(result.passed).toBe(false);
-    expect(result.fail_on).toBe('any');
-  });
-
-  it('ai-review gate fails on invalid JSON output', () => {
-    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.parse_error).toBeDefined();
-  });
-
-  it('writes to log file', () => {
-    runGate('echo logged', tmp, logPath, 30);
-    const log = fs.readFileSync(logPath, 'utf-8');
-    expect(log).toContain('COMMAND: echo logged');
-    expect(log).toContain('logged');
-    expect(log).toContain('EXIT:');
-  });
-});
-
-describe('runGates', () => {
-  let tmp: string;
-  let logPath: string;
-  let eventsPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = path.join(tmp, 'gates.log');
-    eventsPath = path.join(tmp, 'events.ndjson');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('runs multiple gates and returns results', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo one', 'echo two'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-1',
-    );
-    expect(allPassed).toBe(true);
-    expect(gateResults).toHaveLength(2);
-  });
-
-  it('reports failure when any gate fails', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo ok', 'exit 1'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-2',
-    );
-    expect(allPassed).toBe(false);
-    expect(gateResults[0]!.passed).toBe(true);
-    expect(gateResults[1]!.passed).toBe(false);
-  });
-
-  it('emits events for each gate', () => {
-    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
-    const events = fs
-      .readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    expect(events).toHaveLength(2); // started + passed
-    expect(events[0].event_type).toBe('rail.check.started');
-    expect(events[1].event_type).toBe('rail.check.passed');
-  });
-
-  it('does not silently skip gates with empty command — they become capability failures', () => {
-    const { gateResults, allPassed, state } = runGates(
-      [{ command: '', type: 'mechanical' }, 'echo real'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-4',
-    );
-    expect(gateResults).toHaveLength(2);
-    expect(gateResults[0]!.status).toBe('capability_failure');
-    expect(gateResults[1]!.status).toBe('passed');
-    expect(allPassed).toBe(false);
-    expect(state).toBe('capability_failure');
-  });
-
-  it('does not skip ci-pipeline even with empty command — typed capability failure', () => {
-    const { gateResults, allPassed, state } = runGates(
-      [{ command: '', type: 'ci-pipeline' }],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-5',
-    );
-    expect(gateResults).toHaveLength(1);
-    expect(gateResults[0]!.passed).toBe(false);
-    expect(gateResults[0]!.status).toBe('capability_failure');
-    expect(allPassed).toBe(false);
-    expect(state).toBe('capability_failure');
-  });
-
-  it('emits failed event with correct message', () => {
-    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
-    const events = fs
-      .readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    const failEvent = events.find(
-      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
-    );
-    expect(failEvent).toBeDefined();
-    expect(failEvent.message).toContain('Gate failed (');
-  });
-});
-
-/**
- * RI-N2 / SDLC-D-035 fail-closed controls for the MACP gate runner.
- *
- * Invariant under test: `passed: true` occurs ONLY when a gate really executed
- * and really exited green (`status === 'passed'`). Absent capabilities,
- * manual sign-offs, and simulated runs are typed distinctly and can never
- * make the aggregate `passed`.
- */
-describe('gate-runner fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-  let logPath: string;
-  let eventsPath: string;
-
-  beforeEach(() => {
-    tmpDir = makeTmpDir();
-    logPath = path.join(tmpDir, 'gate.log');
-    eventsPath = path.join(tmpDir, 'events.ndjson');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  function run(gates: unknown[], options?: { simulate?: boolean }) {
-    return runGates(gates, tmpDir, logPath, 10, eventsPath, 'spec-task', options);
-  }
-
-  // ─── positive controls ───────────────────────────────────────────────────
-
-  it('a really-executed green command gate still passes', () => {
-    const result = run([{ command: 'exit 0', type: 'mechanical' }]);
-    expect(result.gateResults[0]!.status).toBe('passed');
-    expect(result.gateResults[0]!.passed).toBe(true);
-    expect(result.allPassed).toBe(true);
-    expect(result.state).toBe('passed');
-  });
-
-  it('explicit simulate completes and types every result simulated', () => {
-    const result = run([{ command: 'exit 0', type: 'mechanical' }, 'echo hello'], {
-      simulate: true,
-    });
-    expect(result.gateResults).toHaveLength(2);
-    for (const gate of result.gateResults) {
-      expect(gate.status).toBe('simulated');
-      expect(gate.passed).toBe(false);
-    }
-    expect(result.state).toBe('simulated');
-  });
-
-  it('a really-executed red command gate fails with typed status failed', () => {
-    const result = run([{ command: 'exit 3', type: 'mechanical' }]);
-    expect(result.gateResults[0]!.status).toBe('failed');
-    expect(result.gateResults[0]!.passed).toBe(false);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('failed');
-  });
-
-  // ─── negative controls — each asserts typed status AND aggregate not passed ──
-
-  it('an empty-command gate is a capability_failure, not skipped and not passed', () => {
-    const result = run([{ command: '', type: 'mechanical' }]);
-    // runGates must not silently skip it — it produces a typed result
-    expect(result.gateResults).toHaveLength(1);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('capability_failure');
-    expect(gate.capability_code).toBe('MACP_NO_COMMAND');
-    expect(gate.passed).toBe(false);
-    // aggregate is not passed
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('capability_failure');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a commandless ai-review gate is a typed MACP_NO_REVIEWER capability_failure', () => {
-    const result = run([{ command: '', type: 'ai-review' }]);
-    expect(result.gateResults[0]!.status).toBe('capability_failure');
-    expect(result.gateResults[0]!.capability_code).toBe('MACP_NO_REVIEWER');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a ci-pipeline gate without a provider implementation is a capability_failure, never a placeholder pass', () => {
-    const result = run([{ command: '', type: 'ci-pipeline' }]);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('capability_failure');
-    expect(gate.capability_code).toBe('MACP_NO_CI_PIPELINE');
-    expect(gate.passed).toBe(false);
-    // the old false-success placeholder must be gone
-    expect(gate.output).not.toBe('CI pipeline gate placeholder');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a ci-pipeline gate fails closed even alongside an otherwise green run', () => {
-    const result = run(['exit 0', { type: 'ci-pipeline', command: 'fake-ci' }]);
-    expect(result.gateResults[1]!.status).toBe('capability_failure');
-    expect(result.gateResults[0]!.status).toBe('passed');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('capability_failure');
-  });
-
-  it('a manual gate with no automation enters typed waiting — neither pass nor fail', () => {
-    const result = run([{ type: 'manual' }]);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('waiting');
-    expect(gate.passed).toBe(false);
-    expect(gate.exit_code).toBe(0);
-    // aggregate is not passed while any gate is waiting
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('waiting');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a simulated result can never make the aggregate passed', () => {
-    const result = run(['exit 0', 'exit 0'], { simulate: true });
-    expect(result.gateResults.every((g) => g.status === 'simulated')).toBe(true);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('simulated');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('waiting dominates an otherwise green aggregate', () => {
-    const result = run(['exit 0', { type: 'manual' }]);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('waiting');
-  });
-});
-
-describe('runGate fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-  let logPath: string;
-
-  beforeEach(() => {
-    tmpDir = makeTmpDir();
-    logPath = path.join(tmpDir, 'gate.log');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('simulate: true returns a typed simulated result without executing', () => {
-    const result = runGate('this-command-does-not-exist-xyz', tmpDir, logPath, 10, {
-      simulate: true,
-    });
-    expect(result.status).toBe('simulated');
-    expect(result.passed).toBe(false);
-    expect(result.exit_code).toBe(0);
-  });
-
-  it('normal mode executes for real and types a green gate passed', () => {
-    const result = runGate('echo ok', tmpDir, logPath, 10);
-    expect(result.status).toBe('passed');
-    expect(result.passed).toBe(true);
-    expect(result.output).toContain('ok');
-  });
-
-  it('a bare string gate normalizes to mechanical and executes', () => {
-    const result = runGate('exit 7', tmpDir, logPath, 10);
-    expect(result.type).toBe('mechanical');
-    expect(result.status).toBe('failed');
-    expect(result.passed).toBe(false);
-  });
-});

packages/macp/src/gate-runner.ts

@@ -4,20 +4,7 @@ import { dirname } from 'node:path';
 
 import { emitEvent } from './event-emitter.js';
 import { nowISO } from './event-emitter.js';
-import type { GateResult, GateStatus, RunGatesResult } from './types.js';
-
-/** Typed reason stamped on every simulated gate result. */
-export const SIMULATED_GATE_REASON =
-  'simulated execution (explicit simulate opt-in): gate was not evaluated by a real implementation';
-
-/** Options for gate execution (RI-N2 fail-closed / explicit simulation). */
-export interface RunGateOptions {
-  /**
-   * Explicit caller opt-in to simulation. Simulated gates are NOT executed;
-   * every result is typed `simulated` and never satisfies anything.
-   */
-  simulate?: boolean;
-}
+import type { GateResult } from './types.js';
 
 export interface NormalizedGate {
   command: string;
@@ -116,91 +103,36 @@ export function countAIFindings(parsedOutput: unknown): { blockers: number; tota
   return { blockers, total };
 }
 
-function simulatedResult(gateEntry: NormalizedGate): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 0,
-    type: gateEntry.type,
-    output: SIMULATED_GATE_REASON,
-    timed_out: false,
-    passed: false,
-    status: 'simulated',
-    reason: SIMULATED_GATE_REASON,
-  };
-}
-
-function capabilityFailureResult(
-  gateEntry: NormalizedGate,
-  code: GateResult['capability_code'],
-  reason: string,
-): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 1,
-    type: gateEntry.type,
-    output: '',
-    timed_out: false,
-    passed: false,
-    status: 'capability_failure',
-    capability_code: code,
-    reason,
-  };
-}
-
-function waitingResult(gateEntry: NormalizedGate, reason: string): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 0,
-    type: gateEntry.type,
-    output: '',
-    timed_out: false,
-    passed: false,
-    status: 'waiting',
-    capability_code: 'MACP_AUTHORITY_REQUIRED',
-    reason,
-  };
-}
-
 export function runGate(
   gate: unknown,
   cwd: string,
   logPath: string,
   timeoutSec: number,
-  options: RunGateOptions = {},
 ): GateResult {
   const gateEntry = normalizeGate(gate);
   const gateType = gateEntry.type;
   const command = gateEntry.command;
 
-  // Explicit simulation only: never executes, typed simulated, never satisfying.
-  if (options.simulate) {
-    return simulatedResult(gateEntry);
-  }
-
-  // Fail closed: no CI provider implementation exists in @mosaicstack/macp,
-  // so a ci-pipeline gate is an absent capability — never a placeholder pass.
   if (gateType === 'ci-pipeline') {
-    return capabilityFailureResult(
-      gateEntry,
-      'MACP_NO_CI_PIPELINE',
-      `ci-pipeline gate '${gateEntry.command || gateType}' has no CI provider implementation wired — refusing placeholder pass`,
-    );
+    return {
+      command,
+      exit_code: 0,
+      type: gateType,
+      output: 'CI pipeline gate placeholder',
+      timed_out: false,
+      passed: true,
+    };
   }
 
   if (!command) {
-    // A manual gate with no automation waits for human sign-off: not pass, not fail.
-    if (gateType === 'manual') {
-      return waitingResult(
-        gateEntry,
-        `manual gate has no automation — waiting for human sign-off (type: ${gateType})`,
-      );
-    }
-    // Any other commandless gate is an absent capability — never a vacuous pass.
-    return capabilityFailureResult(
-      gateEntry,
-      gateType === 'ai-review' ? 'MACP_NO_REVIEWER' : 'MACP_NO_COMMAND',
-      `gate of type '${gateType}' has no command to execute — refusing empty-command pass`,
-    );
+    return {
+      command: '',
+      exit_code: 0,
+      type: gateType,
+      output: '',
+      timed_out: false,
+      passed: true,
+    };
   }
 
   const { exitCode, output, timedOut } = runShell(command, cwd, logPath, timeoutSec);
@@ -211,12 +143,10 @@ export function runGate(
     output,
     timed_out: timedOut,
     passed: false,
-    status: 'failed',
   };
 
   if (gateType !== 'ai-review') {
     result.passed = exitCode === 0;
-    result.status = result.passed ? 'passed' : 'failed';
     return result;
   }
 
@@ -240,7 +170,6 @@ export function runGate(
   } else {
     result.passed = exitCode === 0 && blockers === 0 && !timedOut && parseError === undefined;
   }
-  result.status = result.passed ? 'passed' : 'failed';
 
   result.fail_on = failOn;
   result.blockers = blockers;
@@ -262,19 +191,16 @@ export function runGates(
   timeoutSec: number,
   eventsPath: string,
   taskId: string,
-  options: RunGateOptions = {},
-): RunGatesResult {
+): { allPassed: boolean; gateResults: GateResult[] } {
+  let allPassed = true;
   const gateResults: GateResult[] = [];
-  let hasCapabilityFailure = false;
-  let hasSimulated = false;
-  let hasFailed = false;
-  let hasWaiting = false;
 
   for (const gate of gates) {
     const gateEntry = normalizeGate(gate);
     const gateCmd = gateEntry.command;
+    if (!gateCmd && gateEntry.type !== 'ci-pipeline') continue;
+
     const label = gateCmd || gateEntry.type;
-    // NOTE: no silent skip — every gate produces a typed result (RI-N2).
     emitEvent(
       eventsPath,
       'rail.check.started',
@@ -283,10 +209,10 @@ export function runGates(
       'quality-gate',
       `Running gate: ${label}`,
     );
-    const result = runGate(gate, cwd, logPath, timeoutSec, options);
+    const result = runGate(gate, cwd, logPath, timeoutSec);
     gateResults.push(result);
 
-    if (result.status === 'passed') {
+    if (result.passed) {
       emitEvent(
         eventsPath,
         'rail.check.passed',
@@ -298,46 +224,7 @@ export function runGates(
       continue;
     }
 
-    if (result.status === 'waiting') {
-      hasWaiting = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.waiting',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate waiting: ${label} — ${result.reason ?? 'manual gate awaits sign-off'}`,
-      );
-      continue;
-    }
-
-    if (result.status === 'simulated') {
-      hasSimulated = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.simulated',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate simulated (non-satisfying): ${label}`,
-      );
-      continue;
-    }
-
-    if (result.status === 'capability_failure') {
-      hasCapabilityFailure = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.failed',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate capability failure (${result.capability_code ?? 'MACP_NO_PROVIDER'}): ${label} — ${result.reason ?? 'required capability is absent'}`,
-      );
-      continue;
-    }
-
-    hasFailed = true;
+    allPassed = false;
     let message: string;
     if (result.timed_out) {
       message = `Gate timed out after ${timeoutSec}s: ${label}`;
@@ -349,15 +236,5 @@ export function runGates(
     emitEvent(eventsPath, 'rail.check.failed', taskId, 'gated', 'quality-gate', message);
   }
 
-  const state: GateStatus = hasCapabilityFailure
-    ? 'capability_failure'
-    : hasSimulated
-      ? 'simulated'
-      : hasFailed
-        ? 'failed'
-        : hasWaiting
-          ? 'waiting'
-          : 'passed';
-
-  return { allPassed: state === 'passed', gateResults, state };
+  return { allPassed, gateResults };
 }

packages/macp/src/index.ts

@@ -6,13 +6,11 @@ export type {
   DependsOnPolicy,
   GateType,
   GateFailOn,
-  GateStatus,
   GateEntry,
   Task,
   EventType,
   MACPEvent,
   GateResult,
-  RunGatesResult,
   TaskResult,
   ProviderMeta,
   ProviderRegistry,
@@ -20,11 +18,6 @@ export type {
 
 export { CredentialError } from './types.js';
 
-// Typed fail-closed capability errors (RI-N2, SDLC-D-035)
-export { MACP_ERROR_CODES, MACPCapabilityError } from './errors.js';
-
-export type { MacpErrorCode } from './errors.js';
-
 // Credential resolver
 export {
   DEFAULT_CREDENTIALS_DIR,
@@ -42,16 +35,9 @@ export {
 export type { ResolveCredentialsOptions } from './credential-resolver.js';
 
 // Gate runner
-export {
-  normalizeGate,
-  runShell,
-  countAIFindings,
-  runGate,
-  runGates,
-  SIMULATED_GATE_REASON,
-} from './gate-runner.js';
+export { normalizeGate, runShell, countAIFindings, runGate, runGates } from './gate-runner.js';
 
-export type { NormalizedGate, RunGateOptions } from './gate-runner.js';
+export type { NormalizedGate } from './gate-runner.js';
 
 // Risk-floor (agent reflection loop — diff review classifier)
 export { evaluateRiskFloor, DEFAULT_RISK_THRESHOLD } from './risk-floor.js';

packages/macp/src/types.ts

@@ -1,5 +1,3 @@
-import type { MacpErrorCode } from './errors.js';
-
 /** Task status values. */
 export type TaskStatus = 'pending' | 'running' | 'gated' | 'completed' | 'failed' | 'escalated';
 
@@ -19,17 +17,7 @@ export type DispatchMode = 'yolo' | 'acp' | 'exec';
 export type DependsOnPolicy = 'all' | 'any' | 'all_terminal';
 
 /** Quality gate type. */
-export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline' | 'manual';
-
-/**
- * Typed execution state of a gate — closed set (RI-N2, SDLC-D-035).
- *
- * Only `passed` means "really executed and green". `simulated` is produced
- * exclusively under an explicit simulate opt-in and never satisfies anything.
- * `capability_failure` means a required executor/provider/command was absent.
- * `waiting` means a manual gate awaits human sign-off (neither pass nor fail).
- */
-export type GateStatus = 'passed' | 'failed' | 'simulated' | 'waiting' | 'capability_failure';
+export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline';
 
 /** Gate fail_on mode. */
 export type GateFailOn = 'blocker' | 'any';
@@ -79,9 +67,7 @@ export type EventType =
   | 'task.retry.scheduled'
   | 'rail.check.started'
   | 'rail.check.passed'
-  | 'rail.check.failed'
-  | 'rail.check.waiting'
-  | 'rail.check.simulated';
+  | 'rail.check.failed';
 
 /** Structured event record. */
 export interface MACPEvent {
@@ -102,14 +88,7 @@ export interface GateResult {
   type: string;
   output: string;
   timed_out: boolean;
-  /** Back-compat boolean view — true ONLY when `status === 'passed'`. */
   passed: boolean;
-  /** Typed discriminator — the authoritative gate outcome (RI-N2). */
-  status: GateStatus;
-  /** Typed capability error code, set when `status === 'capability_failure'`. */
-  capability_code?: MacpErrorCode;
-  /** Why a non-executed state (simulated/waiting/capability_failure) was reached. */
-  reason?: string;
   fail_on?: string;
   blockers?: number;
   findings?: number;
@@ -117,22 +96,6 @@ export interface GateResult {
   parse_error?: string;
 }
 
-/**
- * Aggregate outcome of `runGates` (RI-N2).
- *
- * `state` is the typed aggregate: it is `passed` only when every gate really
- * executed green. A `simulated` result makes the aggregate `simulated` (never
- * `passed`); a `waiting` manual gate keeps the aggregate `waiting`; a missing
- * capability makes it `capability_failure`. `allPassed` is exactly
- * `state === 'passed'`, so a simulated or waiting result can never satisfy a
- * dependency, acceptance criterion, gate, merge, or release check.
- */
-export interface RunGatesResult {
-  allPassed: boolean;
-  gateResults: GateResult[];
-  state: GateStatus;
-}
-
 /** Result from a completed task. */
 export interface TaskResult {
   task_id: string;

packages/mosaic/framework/fleet/README.md

@@ -12,33 +12,6 @@ The default tmux socket is `mosaic-fleet` so fleet commands do not touch the
 default tmux server. The roster is the desired-state authority; generated environment files are
 rebuildable projections, never a second source of configuration.
 
-## Brain-home split (fleet state vs framework templates)
-
-When a mosaic-brain clone is present, fleet **state** resolves from the brain
-home while framework templates and dispatch state stay in the config home
-(three-tree model, canon `docs/STRUCTURE-CANON.md` §2):
-
-| Path                                                                            | Without brain (legacy)                | With brain                     |
-| ------------------------------------------------------------------------------- | ------------------------------------- | ------------------------------ |
-| `fleet/agents/<seat>.env.*`                                                     | `~/.config/mosaic/fleet/agents/`      | `~/.mosaic/fleet/agents/`      |
-| `fleet/roles.local/` (overrides)                                                | `~/.config/mosaic/fleet/roles.local/` | `~/.mosaic/fleet/roles.local/` |
-| `fleet/profiles/` (working copies)                                              | `~/.config/mosaic/fleet/profiles/`    | `~/.mosaic/fleet/profiles/`    |
-| `fleet/roster.yaml`, `fleet/roles/` (baseline), `fleet/run/`, `fleet/services/` | `~/.config/mosaic/fleet/…`            | unchanged (config home)        |
-
-Activation (`packages/mosaic/src/fleet/brain-home.ts`, mirrored in
-`tools/fleet/start-agent-session.sh`):
-
-1. `MOSAIC_BRAIN_HOME` env var — explicit, always wins.
-2. Canonical `~/.mosaic` — adopted only when `MOSAIC_HOME` is the default
-   `~/.config/mosaic` AND `~/.mosaic/fleet/agents` exists. Custom
-   `--mosaic-home` values (tests, sandboxes, canaries) never adopt, keeping
-   them hermetic.
-3. Otherwise the config home (legacy single-tree behavior).
-
-Seat env dirs under a brain are subject to the same privacy boundary (0700
-dirs, 0600 files); `.env.generated` files are structure-valuable and tracked
-in the brain repo, hand-maintained `.env`/`.env.local` stay ignored and private.
-
 ## Examples
 
 - `examples/minimal.yaml` starts one local canary slot.

packages/mosaic/framework/tools/_scripts/mosaic-doctor

@@ -51,8 +51,6 @@ fix() { fix_count=$((fix_count + 1)); echo "[FIX] $*"; }
 
 warn_count=0
 warn() { warn_count=$((warn_count + 1)); echo "[WARN] $*"; }
-note() { echo "[NOTE] $*"; return 0; }
-
 pass() {
   if [[ $VERBOSE -eq 1 ]]; then
     echo "[OK] $*"
@@ -257,80 +255,6 @@ fleet_declared_transport() {
   printf '%s\n' "${declared:-tmux}"
 }
 
-# Brain-home fleet-state resolution (#1298; canon STRUCTURE-CANON §2).
-#
-# Seat launch envs, roles.local overrides, and profile working copies resolve
-# from the brain home when one is active; roster, baseline roles, run/, and
-# services stay under MOSAIC_HOME. This check surfaces which tree fleet state
-# resolves from and the drift a launch would otherwise hit at runtime:
-#
-# - a stale MOSAIC_BRAIN_HOME pointing at a directory with no fleet/agents is a
-#   misconfiguration the resolver honors (explicit wins) — warn, don't pass;
-# - a symlinked brain or agents dir defeats the managed-directory boundary;
-# - a group/world-readable agents dir violates the 0700 projection boundary;
-# - env files left in the config-home tree while a brain is active are split
-#   state — the write path rejects NEW split writes, but nothing would ever
-#   tell the operator the old files are stranded.
-resolve_brain_home() {
-  local explicit="${MOSAIC_BRAIN_HOME:-}"
-  if [[ -n "$(printf '%s' "$explicit" | tr -d '[:space:]')" ]]; then
-    printf '%s' "$explicit"
-    return
-  fi
-  if [[ "$(cd "$MOSAIC_HOME" 2>/dev/null && pwd -P)" == "$HOME/.config/mosaic" \
-     && -d "$HOME/.mosaic/fleet/agents" ]]; then
-    printf '%s' "$HOME/.mosaic"
-    return
-  fi
-  printf '%s' "$MOSAIC_HOME"
-}
-
-check_brain_home() {
-  local brain agents mode
-  brain="$(resolve_brain_home)"
-
-  if [[ "$brain" == "$MOSAIC_HOME" ]]; then
-    # Implicit-path greenfield case (#1288 comment 23133, fred's trace): nothing
-    # in product code creates ~/.mosaic/fleet/agents — the first fleet write
-    # resolves legacy (generated-env-boundary resolves before creating) and
-    # then manufactures the evidence that keeps the host legacy. On a host with
-    # ~/.mosaic but no fleet/agents, the three operator checks all agree and all
-    # point the wrong way; this doctor is the only one that can disagree, so it
-    # must say it — as a note, not a warn: nothing is broken yet.
-    if [[ "$(cd "$MOSAIC_HOME" 2>/dev/null && pwd -P)" == "$HOME/.config/mosaic" \
-       && -d "$HOME/.mosaic" && ! -d "$HOME/.mosaic/fleet/agents" ]]; then
-      note "Fleet state home: $MOSAIC_HOME (legacy). NOTE: ~/.mosaic exists but carries no fleet/agents — the first 'mosaic fleet regen' on this host locks in the legacy tree. Create ~/.mosaic/fleet/agents first to adopt the brain."
-      return
-    fi
-    pass "Fleet state home: $MOSAIC_HOME (legacy single-tree; no brain adopted)"
-    return
-  fi
-
-  agents="$brain/fleet/agents"
-  if [[ ! -d "$agents" ]]; then
-    warn "Brain home '$brain' has no fleet/agents — seat envs will not resolve from it. Point MOSAIC_BRAIN_HOME at a brain carrying fleet/agents, or unset it."
-    return
-  fi
-  if [[ -L "$brain" || -L "$agents" ]]; then
-    warn "Brain fleet-state path resolves through a symlink ($brain) — the managed-directory boundary requires regular directories."
-    return
-  fi
-
-  mode="$(stat -c '%a' -- "$agents" 2>/dev/null)" || mode=""
-  if [[ -n "$mode" ]] && (( (8#$mode & 8#077) != 0 )); then
-    warn "Brain agents dir '$agents' is group/world-accessible (mode $mode) — the projection boundary requires 0700."
-    return
-  fi
-
-  if [[ -d "$MOSAIC_HOME/fleet/agents" ]] \
-     && ls "$MOSAIC_HOME/fleet/agents/"*.env* >/dev/null 2>&1; then
-    warn "Fleet env files exist in BOTH trees — brain '$brain' is active but '$MOSAIC_HOME/fleet/agents' still carries env files (split state). Migrate them (mosaic fleet regen) and remove the config-home copies."
-    return
-  fi
-
-  pass "Fleet state home: $brain (brain active); roster + templates: $MOSAIC_HOME"
-}
-
 check_fleet_transport() {
   local transport
   transport="$(fleet_declared_transport)"
@@ -349,8 +273,6 @@ check_fleet_transport() {
 
 check_fleet_transport
 
-check_brain_home
-
 # Legacy migration surfaces should no longer contain symlink trees.
 legacy_paths=(
   "$HOME/.claude/agent-guides"

packages/mosaic/framework/tools/_scripts/test-brain-home-check.sh

@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-# Covers the brain-home fleet-state check in `mosaic-doctor` (#1298 follow-up).
-#
-# The functions are extracted from the shipped script rather than copied here
-# (same discipline as test-fleet-transport-check.sh): a test that carries its
-# own copy of the logic keeps passing after the shipped copy changes.
-# Extraction is by exact function header and a closing brace in column one.
-set -euo pipefail
-
-SCRIPT_DIR=$(cd -- "$(dirname "$0")" && pwd)
-DOCTOR="$SCRIPT_DIR/mosaic-doctor"
-
-fail() {
-  echo "FAIL: $*" >&2
-  exit 1
-}
-
-[ -f "$DOCTOR" ] || fail "missing mosaic-doctor at $DOCTOR"
-
-extract_function() {
-  local name="$1"
-  local extracted
-  extracted=$(sed -n "/^${name}() {/,/^}/p" "$DOCTOR")
-  [ -n "$extracted" ] || fail "could not extract ${name}() from mosaic-doctor — script reshaped?"
-  printf '%s\n' "$extracted"
-}
-
-for fn in resolve_brain_home check_brain_home; do
-  extract_function "$fn" >/dev/null
-done
-
-warn_count=0
-warn() { warn_count=$((warn_count + 1)); echo "[WARN] $*"; }
-pass() { echo "[OK] $*"; return 0; }
-
-eval "$(extract_function resolve_brain_home)"
-eval "$(extract_function check_brain_home)"
-
-ROOT=$(mktemp -d)
-trap 'rm -rf "$ROOT"' EXIT
-
-# note output is neither [OK] nor [WARN] — assert it directly in the case below.
-run_case() {
-  # label, expect (ok|warn|note), then env assignments as arguments.
-  # The check runs under `env` in a subshell, so its warn() also prints a
-  # sentinel the parent counts — a subshell counter would never be visible.
-  local label="$1" expect="$2"
-  shift 2
-  local out warns notes
-  out=$(env "$@" bash -c "warn() { echo \"[WARN] \$*\"; }; note() { echo \"[NOTE] \$*\"; return 0; }; pass() { echo \"[OK] \$*\"; return 0; }; $(extract_function resolve_brain_home); $(extract_function check_brain_home); check_brain_home" 2>&1)
-  warns=$(printf '%s\n' "$out" | grep -c '^\[WARN\]' || true)
-  notes=$(printf '%s\n' "$out" | grep -c '^\[NOTE\]' || true)
-  if [[ "$expect" == ok && "$warns" -eq 0 && "$notes" -eq 0 ]]; then
-    echo "ok - $label"
-  elif [[ "$expect" == warn && "$warns" -gt 0 ]]; then
-    echo "ok - $label (warned)"
-  elif [[ "$expect" == note && "$notes" -gt 0 ]]; then
-    echo "ok - $label (noted)"
-  else
-    echo "output: $out" >&2
-    fail "$label: expected $expect (warns=$warns notes=$notes)"
-  fi
-}
-
-# ── legacy: no brain, custom home never adopts ─────────────────────────────
-mkdir -p "$ROOT/legacy-mosaic/fleet/agents"
-run_case "custom home without brain stays legacy" ok \
-  MOSAIC_HOME="$ROOT/legacy-mosaic" HOME="$ROOT"
-
-# ── healthy brain at the default config home ───────────────────────────────
-mkdir -p "$ROOT/home/.config/mosaic" "$ROOT/home/.mosaic/fleet/agents"
-chmod 700 "$ROOT/home/.mosaic/fleet/agents"
-run_case "default home adopts healthy brain" ok \
-  MOSAIC_HOME="$ROOT/home/.config/mosaic" HOME="$ROOT/home"
-
-# ── explicit MOSAIC_BRAIN_HOME to a brain without fleet/agents → warn ──────
-mkdir -p "$ROOT/brain-noagents/fleet" "$ROOT/config"
-run_case "explicit brain without agents warns" warn \
-  MOSAIC_HOME="$ROOT/config" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-noagents"
-
-# ── explicit MOSAIC_BRAIN_HOME to a healthy brain → ok ─────────────────────
-mkdir -p "$ROOT/brain-ok/fleet/agents" "$ROOT/config2"
-chmod 700 "$ROOT/brain-ok/fleet/agents"
-run_case "explicit healthy brain passes" ok \
-  MOSAIC_HOME="$ROOT/config2" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-ok"
-
-# ── group-readable agents dir → warn (0700 boundary) ───────────────────────
-mkdir -p "$ROOT/brain-loose/fleet/agents" "$ROOT/config3"
-chmod 750 "$ROOT/brain-loose/fleet/agents"
-run_case "group-readable brain agents warns" warn \
-  MOSAIC_HOME="$ROOT/config3" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-loose"
-
-# ── symlinked agents dir → warn (managed-directory boundary) ───────────────
-mkdir -p "$ROOT/brain-link/real-agents" "$ROOT/brain-link/fleet" "$ROOT/config4"
-ln -s "$ROOT/brain-link/real-agents" "$ROOT/brain-link/fleet/agents"
-run_case "symlinked brain agents warns" warn \
-  MOSAIC_HOME="$ROOT/config4" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-link"
-
-# ── split state: envs in BOTH trees → warn ─────────────────────────────────
-mkdir -p "$ROOT/brain-split/fleet/agents" "$ROOT/config5/fleet/agents"
-chmod 700 "$ROOT/brain-split/fleet/agents" "$ROOT/config5/fleet/agents"
-touch "$ROOT/config5/fleet/agents/coder0.env.generated"
-run_case "env files in both trees warns (split state)" warn \
-  MOSAIC_HOME="$ROOT/config5" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-split"
-
-# ── config-home agents dir WITHOUT env files alongside a brain → ok ────────
-mkdir -p "$ROOT/brain-clean/fleet/agents" "$ROOT/config6/fleet/agents"
-chmod 700 "$ROOT/brain-clean/fleet/agents" "$ROOT/config6/fleet/agents"
-run_case "empty config-home agents dir alongside brain passes" ok \
-  MOSAIC_HOME="$ROOT/config6" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-clean"
-
-# ── greenfield brain-without-agents at the default home → note (#1288) ─────
-mkdir -p "$ROOT/gf-home/.config/mosaic/fleet" "$ROOT/gf-home/.mosaic"
-run_case "~/.mosaic without fleet/agents at default home notes the lock-in" note \
-  MOSAIC_HOME="$ROOT/gf-home/.config/mosaic" HOME="$ROOT/gf-home"
-
-# ── no ~/.mosaic at all at the default home → clean pass ─────────────────
-mkdir -p "$ROOT/plain-home/.config/mosaic/fleet"
-run_case "no ~/.mosaic at default home passes silently" ok \
-  MOSAIC_HOME="$ROOT/plain-home/.config/mosaic" HOME="$ROOT/plain-home"
-
-# ── custom (non-default) home with a stray ~/.mosaic → still silent ──────
-mkdir -p "$ROOT/custom-home/fleet/agents" "$ROOT/custom-home/.mosaic"
-run_case "custom home with stray ~/.mosaic stays silent" ok \
-  MOSAIC_HOME="$ROOT/custom-home" HOME="$ROOT/custom-home"
-
-echo "ok - mosaic-doctor brain-home check"

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -80,26 +80,6 @@ safe_path "$MOSAIC_HOME" || fail_env unsafe-path MOSAIC_HOME "$MOSAIC_HOME"
 
 FLEET_DIR="$MOSAIC_HOME/fleet"
 AGENT_ENV_DIR="$FLEET_DIR/agents"
-
-# Brain-home split (canon docs/STRUCTURE-CANON.md §2): seat launch envs live
-# under the brain home's fleet/agents when a brain is active; roster, roles
-# baseline, and runtime state (fleet/run) stay under MOSAIC_HOME.
-# Resolution mirrors packages/mosaic/src/fleet/brain-home.ts:
-#   1. MOSAIC_BRAIN_HOME env (explicit, always wins)
-#   2. ~/.mosaic — adopted only when MOSAIC_HOME is the default config home AND
-#      ~/.mosaic/fleet/agents exists
-#   3. MOSAIC_HOME (legacy single-tree)
-BRAIN_HOME="${MOSAIC_BRAIN_HOME:-}"
-if [ -z "$BRAIN_HOME" ]; then
-  BRAIN_HOME="$MOSAIC_HOME"
-  if [ "$(cd "$MOSAIC_HOME" 2>/dev/null && pwd -P)" = "$HOME/.config/mosaic" ] \
-     && [ -d "$HOME/.mosaic/fleet/agents" ]; then
-    BRAIN_HOME="$HOME/.mosaic"
-  fi
-fi
-if [ "$BRAIN_HOME" != "$MOSAIC_HOME" ]; then
-  AGENT_ENV_DIR="$BRAIN_HOME/fleet/agents"
-fi
 assert_managed_directory "$MOSAIC_HOME"
 assert_managed_directory "$FLEET_DIR"
 assert_private_directory "$AGENT_ENV_DIR"

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -167,54 +167,6 @@ if echo "$valid_args" | grep -qF 'bash -c'; then
   fail "launcher constructed a shell command payload"
 fi
 
-# ── Brain-home split (canon §2) ─────────────────────────────────────────
-# When MOSAIC_HOME is the default config home under $HOME and the host carries
-# $HOME/.mosaic/fleet/agents, seat envs resolve from the brain tree; the config
-# home still owns fleet/run (holder-owner) and remains a managed boundary.
-: > "$TMUX_CALLS"
-HOME_BRAIN="$ROOT/brain-home"
-CONFIG_HOME="$HOME_BRAIN/.config/mosaic"
-BRAIN="$HOME_BRAIN/.mosaic"
-mkdir -p "$CONFIG_HOME/fleet/run" "$BRAIN/fleet/agents" "$HOME_BRAIN/work"
-chmod 700 "$CONFIG_HOME" "$CONFIG_HOME/fleet" "$CONFIG_HOME/fleet/run" \
-  "$BRAIN/fleet/agents" "$HOME_BRAIN/work"
-printf '123e4567-e89b-12d3-a456-426614174000\n' > "$CONFIG_HOME/fleet/run/holder-owner"
-chmod 600 "$CONFIG_HOME/fleet/run/holder-owner"
-cat > "$BRAIN/fleet/agents/coder-brain.env.generated" <<EOF
-MOSAIC_AGENT_NAME=coder-brain
-MOSAIC_AGENT_CLASS=code
-MOSAIC_AGENT_RUNTIME=pi
-MOSAIC_AGENT_MODEL=openai-codex/gpt-5.6-sol
-MOSAIC_AGENT_REASONING=high
-MOSAIC_AGENT_TOOL_POLICY=code
-MOSAIC_AGENT_WORKDIR=$HOME_BRAIN/work
-MOSAIC_TMUX_SOCKET=mosaic-test
-EOF
-chmod 600 "$BRAIN/fleet/agents/coder-brain.env.generated"
-install_pane_binaries "$HOME_BRAIN"
-HOME="$HOME_BRAIN" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
-  MOSAIC_TEST_PANE_PID=$$ MOSAIC_TEST_HOME="$HOME_BRAIN" \
-  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
-  MOSAIC_HOME="$CONFIG_HOME" "$START" coder-brain
-brain_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-echo "$brain_args" | grep -qF new-session || fail "brain-home generated projection did not reach tmux"
-echo "$brain_args" | grep -qF 'coder-brain' || fail "brain-home agent env was not the launch source"
-[ -f "$BRAIN/fleet/agents/coder-brain.env.generated" ] || fail "brain generated env vanished"
-
-# Negative control: the SAME default-config-home shape but without
-# ~/.mosaic/fleet/agents — the config-home env tree is used directly (legacy).
-: > "$TMUX_CALLS"
-HOME_NOBRAIN="$ROOT/brainless-home"
-CONFIG_HOME_NOBRAIN="$HOME_NOBRAIN/.config/mosaic"
-write_generated "$CONFIG_HOME_NOBRAIN" "coder-legacy"
-install_pane_binaries "$HOME_NOBRAIN"
-HOME="$HOME_NOBRAIN" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
-  MOSAIC_TEST_PANE_PID=$$ MOSAIC_TEST_HOME="$HOME_NOBRAIN" \
-  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
-  MOSAIC_HOME="$CONFIG_HOME_NOBRAIN" "$START" coder-legacy
-legacy_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-echo "$legacy_args" | grep -qF new-session || fail "legacy single-tree launch regressed"
-
 # The pane must start through an absolute clean-environment boundary. Its
 # runtime command remains an argv vector, but no holder/session environment
 # control variable can pass through the pane command.

packages/mosaic/framework/tools/git/README.md

@@ -43,7 +43,7 @@ fleet commits, pushes, and opens PRs under one identity — with no cryptographi
 separation between an author and a reviewer.
 
 Both `git-credential-mosaic` and `get_gitea_token()` resolve an optional **per-agent
-identity**:
+identity** before falling back to the shared account:
 
 1. `MOSAIC_GIT_IDENTITY` environment variable, or
 2. `git config --get mosaic.gitIdentity` (set per-worktree; persists on disk across
@@ -51,54 +51,12 @@ identity**:
 3. (git-credential-mosaic only) the username git itself supplies for the credential
    request.
 
-### Which store a credential is read from
-
-The store is chosen by what the identity **is**, not by which file happens to exist first:
-
-| The identity                                                       | Its credential is read from                                                |
-| ------------------------------------------------------------------ | -------------------------------------------------------------------------- |
-| has a directory at `<brain>/fleet/agents/<id>/` — it is a **seat** | `<brain>/fleet/agents/<id>/secrets/gitea-{usc,mosaicstack}-<id>.token`     |
-| does not — it is a **service identity**                            | `~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token` |
-
-`<brain>` is `MOSAIC_BRAIN_HOME` if set, else `~/.mosaic` — the same resolution
-`packages/mosaic/src/fleet/brain-home.ts` performs.
-
-**There is no precedence between the two stores and no fallback from one to the other.**
-A seat whose slot is empty is refused even when a same-named token sits in the framework
-store. One credential lives in exactly one location: a second copy is drift rather than
-redundancy, and the way drift surfaces is a stale copy returning 401, which reads as a
-revoked token and sends whoever debugs it to the wrong place.
-
-### What happens when nothing resolves
-
-| identity resolves | token in its store | host runs a fleet | result                    |
-| ----------------- | ------------------ | ----------------- | ------------------------- |
-| yes               | yes                | —                 | that identity + token     |
-| yes               | no                 | —                 | **fail closed**           |
-| no                | —                  | yes               | **fail closed**           |
-| no                | —                  | no                | shared account, unchanged |
-
-A host "runs a fleet" when `<brain>/fleet/agents` exists — the same signal `brain-home.ts`
-uses to decide a brain is active.
-
-Failing closed means: nothing is emitted, the exit status is nonzero, a stderr diagnostic
-names the identity, its source, the store it resolved to and the path that was expected,
-and `git-credential-mosaic` additionally appends a record (identity, host, reason, cwd —
-never a token value) to `${MOSAIC_CREDENTIAL_SPOOL:-~/.local/state/mosaic-credential-escalations}`.
-The git operation fails; nothing is attributed to anyone.
-
-The shared-account fallback that used to cover these two cases is why a PR could be
-authored, commented and merged under an account whose owner did not open it — every seat
-shared one identity, so the record could not be traced back afterwards. An
-under-provisioned agent is refused rather than handed the most privileged account
-available.
-
-**On a host with no fleet, nothing changes**: no `fleet/agents` directory means the shared
-account still answers, so this is a no-op for an operator who has not provisioned per-slot
-tokens. On a host that does run a fleet, a human doing manual git work needs an identity
-of their own — `MOSAIC_GIT_IDENTITY=<id>` with a provisioned slot. There is deliberately no
-environment variable that restores the fallback; one would reintroduce exactly the
-substitution this removes.
+If the resolved identity has a token file at
+`~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<agent-id>.token`, that
+identity + token is used. **Nothing configured → nothing changes**: with no per-slot
+token file present, both tools fall through to the existing shared-account path
+unchanged, so this feature is a no-op on any host that hasn't provisioned per-slot
+tokens.
 
 ### Enabling it for a clone
 

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -507,69 +507,37 @@ get_gitea_token() {
 
     # 0. Per-agent identity (Gate-16 author≠reviewer). If MOSAIC_GIT_IDENTITY, or the
     #    per-worktree `git config mosaic.gitIdentity`, resolves to an agent that has a
-    #    stored credential for this host, act AS that agent so API tooling
+    #    stored per-slot token for this host, act AS that agent so API tooling
     #    (pr-create, issue-create, …) authors under the right identity — matching the
-    #    git credential helper, which this block deliberately mirrors.
+    #    git credential helper. Backward-compatible: nothing resolvable → shared logic below.
     local _ident="${MOSAIC_GIT_IDENTITY:-}"
     local _ident_src="MOSAIC_GIT_IDENTITY"
     if [[ -z "$_ident" ]]; then
         _ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
         _ident_src="git config mosaic.gitIdentity"
     fi
-
-    # Recognized Gitea hosts are the ones carrying the per-identity token scheme.
-    local _idpfx=""
-    case "$host" in
-        git.uscllc.com)      _idpfx=gitea-usc ;;
-        git.mosaicstack.dev) _idpfx=gitea-mosaicstack ;;
-    esac
-
-    # Brain-home resolution mirrors packages/mosaic/src/fleet/brain-home.ts and
-    # tools/fleet/start-agent-session.sh: MOSAIC_BRAIN_HOME wins, else ~/.mosaic.
-    local _brain_home="${MOSAIC_BRAIN_HOME:-$HOME/.mosaic}"
-
-    if [[ -n "$_ident" && -n "$_idpfx" ]]; then
-        # Credential store selection: an identity is a SEAT or a SERVICE, and which
-        # one it is decides where its credential lives. No precedence between the
-        # two stores and no fallback from one to the other — a seat with an empty
-        # slot fails loud rather than reading a service credential of the same name.
-        # One credential, one location: two copies diverge, and the stale copy fails
-        # in a way that reads as a revoked token rather than as drift.
-        local _idtok _ident_kind
-        if [[ -d "$_brain_home/fleet/agents/$_ident" ]]; then
-            _ident_kind="seat"
-            _idtok="$_brain_home/fleet/agents/$_ident/secrets/${_idpfx}-${_ident}.token"
-        else
-            _ident_kind="service identity"
-            _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
+    if [[ -n "$_ident" ]]; then
+        local _idpfx=""
+        case "$host" in
+            git.uscllc.com)      _idpfx=gitea-usc ;;
+            git.mosaicstack.dev) _idpfx=gitea-mosaicstack ;;
+        esac
+        if [[ -n "$_idpfx" ]]; then
+            local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
+            if [[ -r "$_idtok" ]]; then
+                cat "$_idtok"
+                return 0
+            fi
+            # FAIL LOUD: an explicit git identity was requested for a recognized Gitea host,
+            # but no per-slot token exists for THAT identity. Refuse to fall through to the
+            # shared/default credential loader below — silently borrowing another slot's token
+            # would post PRs/issues/reviews under the WRONG agent (e.g. rev2's review attributed
+            # to coder3), corrupting Gate-16 author≠reviewer separation. Hard-stop instead so the
+            # caller aborts loudly rather than acting as the wrong identity.
+            echo "Error: git identity '$_ident' requested (via $_ident_src) for host '$host', but no per-slot token at $_idtok." >&2
+            echo "       Refusing to borrow another slot's token. Provision the per-slot token, or unset the identity to use shared credentials." >&2
+            return 1
         fi
-        if [[ -r "$_idtok" ]]; then
-            cat "$_idtok"
-            return 0
-        fi
-        # FAIL LOUD: an explicit git identity was requested for a recognized Gitea host,
-        # but no credential exists for THAT identity. Refuse to fall through to the
-        # shared/default credential loader below — silently borrowing another identity's
-        # token would post PRs/issues/reviews under the WRONG agent (e.g. rev2's review
-        # attributed to coder3), corrupting Gate-16 author≠reviewer separation. Hard-stop
-        # instead so the caller aborts loudly rather than acting as the wrong identity.
-        echo "Error: git identity '$_ident' requested (via $_ident_src) for host '$host', but no per-slot token at $_idtok." >&2
-        echo "       Resolved as a ${_ident_kind}; there is no fallback between the seat and service stores." >&2
-        echo "       Refusing to borrow another slot's token. Provision the credential at that path, or unset the identity to use shared credentials." >&2
-        return 1
-    fi
-
-    # FAIL LOUD: no identity resolved, on a host that HAS a fleet. Where seats exist,
-    # every record must name the agent that made it, so an unattributable request is
-    # refused rather than handed the shared account. `fleet/agents` existing is the
-    # same signal brain-home.ts uses to decide a brain is active. A host with no fleet
-    # keeps the shared path below unchanged: there the shared account is the operator's
-    # own and there is no attribution to lose.
-    if [[ -z "$_ident" && -n "$_idpfx" && -d "$_brain_home/fleet/agents" ]]; then
-        echo "Error: no git identity resolved for host '$host', but this host runs a fleet ($_brain_home/fleet/agents)." >&2
-        echo "       Refusing to fall back to the shared account: records it creates cannot be attributed to the agent that made them." >&2
-        echo "       Set MOSAIC_GIT_IDENTITY=<agent-id> or 'git config mosaic.gitIdentity <agent-id>'." >&2
-        return 1
     fi
 
     # 1. Mosaic credential loader (host → service mapping, run in subshell to avoid polluting env)

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -1,48 +1,21 @@
 #!/bin/bash
-# git-credential-mosaic — git credential helper. Resolves a Gitea token from the
-# Mosaic credential store at runtime so remote URLs never embed secrets.
+# git-credential-mosaic — git credential helper — resolves Gitea tokens from
+# the Mosaic credential store at runtime so remote URLs never embed secrets.
 #
 # Install (one-time, per clone or globally):
 #   git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+#   # or, fleet-wide: git config --global credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
 #
-# Per-agent identity (Gate-16 author != reviewer separation):
+# Per-agent Gate-16 identity (author != reviewer separation):
 #   git config mosaic.gitIdentity <agent-id>   # per-worktree, persists on disk
 #   # or: export MOSAIC_GIT_IDENTITY=<agent-id>
 #
-# ── WHY THIS FAILS CLOSED ──────────────────────────────────────────────────────
-# This helper used to end by emitting the shared account's token for any request
-# it could not resolve to an identity. A seat with no identity, or with an
-# identity whose token was never provisioned, therefore received the most
-# privileged credential configured on the host — silently, and indistinguishably
-# from correct operation. Every record it then created (commit, push, PR, review)
-# was attributed to that shared account, so author != reviewer separation was
-# unenforceable and the true actor was unrecoverable after the fact.
-#
-# Under-provisioning must fail loudly, not impersonate. A refused git operation
-# is recoverable in one command; a merged pull request attributed to the wrong
-# principal is not.
-#
-# ── CONTRACT ───────────────────────────────────────────────────────────────────
-#   identity : MOSAIC_GIT_IDENTITY  >  git config mosaic.gitIdentity  >  the
-#              username git supplies on stdin
-#   store    : chosen by what the identity IS, with no precedence and no
-#              cross-store fallback (see "Credential store selection" below)
-#   hit      : emit username + password, exit 0
-#   miss     : emit NOTHING, spool a durable escalation record, explain on
-#              stderr, exit 1 — git surfaces the failure and nothing is attributed
-#   unknown host : exit 0 with no output, no record (passthrough for non-Mosaic
-#              remotes handled by another helper)
-#
-# Backward compatibility is preserved for exactly one case: a host with no fleet
-# and no identity requested still gets the shared account, because on such a host
-# the shared account is the operator's own and there is no attribution to lose.
-# A host that HAS a fleet has agents whose records must be distinguishable, so
-# the shared fallback is refused there.
-#
-# A token is never written to stderr, to the escalation record, or to any log.
-
+# Resolution priority: MOSAIC_GIT_IDENTITY env > git config mosaic.gitIdentity
+# (per-worktree, survives across non-persistent shells) > git-supplied username
+# (credential.username / URL). When the resolved identity has a matching
+# per-agent token file, use it instead of the shared account. Backward
+# compatible: nothing resolvable -> shared token (unchanged behavior).
 [ "$1" = "get" ] || exit 0
-
 host=""; username_in=""
 while IFS= read -r line; do
   [ -z "$line" ] && break
@@ -51,170 +24,46 @@ while IFS= read -r line; do
     username=*) username_in=${line#username=};;
   esac
 done
-
-# Recognized Gitea hosts carry the per-identity token scheme. Anything else is
-# declined quietly — another helper owns it, and refusing would break it.
+# Per-agent identity resolution (Gate-16 author≠reviewer separation).
+# Priority: MOSAIC_GIT_IDENTITY env  >  git config mosaic.gitIdentity (per-worktree,
+# survives across non-persistent shells)  >  git-supplied username (credential.username
+# / URL). When the resolved identity has a matching per-agent token, use it instead of
+# the shared account. Backward-compatible: nothing resolvable → shared token.
+ident="$MOSAIC_GIT_IDENTITY"
+[ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
+[ -z "$ident" ] && ident="$username_in"
+if [ -n "$ident" ]; then
+  case "$host" in
+    git.uscllc.com)      idpfx=gitea-usc;;
+    git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+    *) idpfx="";;
+  esac
+  if [ -n "$idpfx" ]; then
+    idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
+    if [ -r "$idtok" ]; then
+      echo "username=${ident}"
+      echo "password=$(cat "$idtok")"
+      exit 0
+    fi
+  fi
+fi
 case "$host" in
-  git.uscllc.com)      idpfx=gitea-usc;;
-  git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+  git.uscllc.com)      svc=gitea-usc;;
+  git.mosaicstack.dev) svc=gitea-mosaicstack;;
   *) exit 0;;
 esac
-
-ident="$MOSAIC_GIT_IDENTITY"; ident_src="MOSAIC_GIT_IDENTITY"
-if [ -z "$ident" ]; then
-  ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
-  ident_src="git config mosaic.gitIdentity"
-fi
-if [ -z "$ident" ]; then
-  ident="$username_in"
-  ident_src="the username git supplied"
-fi
-
-# ── Credential store selection ────────────────────────────────────────────────
-# An identity is a SEAT or it is a SERVICE, and which one it is determines where
-# its credential lives. There is no precedence rule between the two stores and no
-# fallback from one to the other: a seat whose slot is empty fails closed rather
-# than reading a service credential that happens to share its name.
-#
-#   seat     — <brain>/fleet/agents/<ident>/ exists
-#              credential at <brain>/fleet/agents/<ident>/secrets/<idpfx>-<ident>.token
-#   service  — it does not
-#              credential at ~/.config/mosaic/secrets/gitea-tokens/<idpfx>-<ident>.token
-#
-# One credential, one location. Two copies of one credential diverge, and the
-# stale copy fails in a way that reads as a revoked token rather than as drift.
-#
-# Brain-home resolution mirrors packages/mosaic/src/fleet/brain-home.ts and
-# tools/fleet/start-agent-session.sh: MOSAIC_BRAIN_HOME wins, else ~/.mosaic.
-brain_home="${MOSAIC_BRAIN_HOME:-$HOME/.mosaic}"
-svc_store="$HOME/.config/mosaic/secrets/gitea-tokens"
-
-idtok=""; ident_kind=""
-if [ -n "$ident" ]; then
-  if [ -d "$brain_home/fleet/agents/$ident" ]; then
-    ident_kind="seat"
-    idtok="$brain_home/fleet/agents/$ident/secrets/${idpfx}-${ident}.token"
-  else
-    ident_kind="service identity"
-    idtok="$svc_store/${idpfx}-${ident}.token"
-  fi
-  if [ -r "$idtok" ]; then
-    echo "username=${ident}"
-    echo "password=$(cat "$idtok")"
-    exit 0
-  fi
-fi
-
-# ── Shared-account fallback: ONLY on a host with no fleet and no identity ──────
-# `fleet/agents` existing is the same signal brain-home.ts uses to decide a brain
-# is active. Where there are seats, records must be attributable, so an
-# unresolvable request is refused instead of borrowing the shared account.
-fleet_present=0
-[ -d "$brain_home/fleet/agents" ] && fleet_present=1
-
-if [ -z "$ident" ] && [ "$fleet_present" -eq 0 ]; then
-  script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  # shellcheck source=../_lib/credentials.sh
-  source "$script_dir/../_lib/credentials.sh"
-  load_credentials "$idpfx" >/dev/null 2>&1 || exit 0
-  # GITEA_USER is not populated by load_credentials (it exports GITEA_URL and
-  # GITEA_TOKEN only). Gitea's git-over-HTTP auth authenticates from the token in
-  # the password field, not from the username string, so any non-empty
-  # placeholder works — deliberately NOT a real account name, since framework
-  # files stay operator-agnostic (tools/quality/scripts/verify-sanitized.sh).
-  echo "username=${GITEA_USER:-git}"
-  echo "password=$GITEA_TOKEN"
-  exit 0
-fi
-
-# ── FAIL CLOSED ───────────────────────────────────────────────────────────────
-if [ -z "$ident" ]; then
-  reason="no-identity"
-else
-  reason="no-token-for-identity"
-fi
-
-seat="${MOSAIC_AGENT_NAME:-unknown}"
-ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-# The escalation RECORD is durable and unconditional; any notification built on
-# top of it is best-effort. Record and alert are deduplicated separately — a cap
-# on the alert alone lets the spool grow without bound exactly while the operator
-# is being told nothing, so the louder the failure the quieter it gets.
-#
-# A record field is arbitrary operator-supplied text: an identity comes from git
-# config or the environment, and cwd is whatever directory git ran in. Either can
-# contain a quote or a backslash, which would make the line unparseable JSON --
-# and a spool that silently stops parsing is worse than no spool, because the
-# operator only discovers it while reading the record that explains an outage.
-json_escape() {
-  local s=$1
-  s=${s//\\/\\\\}
-  s=${s//\"/\\\"}
-  s=${s//$'\t'/\\t}
-  s=${s//$'\r'/\\r}
-  s=${s//$'\n'/\\n}
-  printf '%s' "$s"
-}
-
-spool="${MOSAIC_CREDENTIAL_SPOOL:-$HOME/.local/state/mosaic-credential-escalations}"
-spool_record=""
-if mkdir -p "$spool" 2>/dev/null; then
-  chmod 700 "$spool" 2>/dev/null
-  spoolfile="$spool/$(date -u +%Y%m%d).jsonl"
-  dedupe="$spool/.spooled-${seat}-${ident:-none}-${reason}-$(date -u +%Y%m%d%H%M)"
-  if [ ! -e "$dedupe" ]; then
-    : > "$dedupe" 2>/dev/null
-    printf '{"ts":"%s","reason":"%s","identity":"%s","identity_source":"%s","kind":"%s","seat":"%s","host":"%s","cwd":"%s"}\n' \
-      "$(json_escape "$ts")" "$(json_escape "$reason")" \
-      "$(json_escape "${ident:-<unset>}")" "$(json_escape "$ident_src")" \
-      "$(json_escape "${ident_kind:-none}")" "$(json_escape "$seat")" \
-      "$(json_escape "$host")" "$(json_escape "$PWD")" \
-      >> "$spoolfile" 2>/dev/null
-    chmod 600 "$spoolfile" 2>/dev/null
-  fi
-  # Name the record only if one is actually on disk. Printing the path
-  # unconditionally sends the operator to a file that does not exist on exactly
-  # the hosts where the spool could not be created.
-  [ -s "$spoolfile" ] && spool_record="$spoolfile"
-  find "$spool" -maxdepth 1 -name '.spooled-*' -mmin +120 -delete 2>/dev/null
-fi
-
-cat >&2 <<EOF
-git-credential-mosaic: REFUSED (fail-closed).
-  host     : ${host}
-  identity : ${ident:-<unset>}${ident:+  (from ${ident_src}; resolved as a ${ident_kind})}
-  reason   : ${reason}
-EOF
-
-if [ -n "$ident" ]; then
-  cat >&2 <<EOF
-  expected : ${idtok}
-EOF
-fi
-
-cat >&2 <<EOF
-
-No per-identity credential resolved. This helper does NOT fall back to the shared
-account: that fallback makes every record it creates attributable to one
-principal, which is unrecoverable once a pull request has merged under it.
-
-Fix (pick one):
-  export MOSAIC_GIT_IDENTITY=<agent-id>        # process-scoped
-  git config mosaic.gitIdentity <agent-id>     # per-repo/worktree, persists
-Then provision that identity's credential at the path named above. An identity
-with a directory under \${MOSAIC_BRAIN_HOME:-\$HOME/.mosaic}/fleet/agents/ is a
-seat and is read ONLY from its own secrets/ slot; any other identity is read from
-~/.config/mosaic/secrets/gitea-tokens/. There is no fallback between the two.
-
-If this identity legitimately needs git access and has none, ask the orchestrator
-to provision one.
-
-EOF
-
-if [ -n "$spool_record" ]; then
-  echo "  record: ${spool_record}" >&2
-else
-  echo "  record: NOT WRITTEN — spool unavailable at ${spool}" >&2
-fi
-exit 1
+# Script-relative (not $HOME-absolute) so this resolves correctly regardless
+# of where the framework installer places tools/ under $HOME — mirrors
+# detect-platform.sh's own cred_loader resolution in this same directory.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../_lib/credentials.sh
+source "$script_dir/../_lib/credentials.sh"
+load_credentials "$svc" >/dev/null 2>&1 || exit 0
+# GITEA_USER is not populated by load_credentials (it only exports
+# GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
+# git-over-HTTP auth authenticates from the token itself (the password field),
+# not from the username string, so any non-empty placeholder works here — this
+# is deliberately NOT a real account name (framework files must stay
+# operator-agnostic; see tools/quality/scripts/verify-sanitized.sh).
+echo "username=${GITEA_USER:-git}"
+echo "password=$GITEA_TOKEN"

packages/mosaic/framework/tools/git/test-git-credential-mosaic.sh

@@ -1,26 +1,16 @@
 #!/usr/bin/env bash
 # Regression harness for `git-credential-mosaic` — per-agent Gitea identity
-# resolution (Gate-16 author≠reviewer separation) and fail-closed refusal.
+# resolution (Gate-16 author≠reviewer separation).
 #
 # Covers:
 #   1. Identity resolution priority: MOSAIC_GIT_IDENTITY env > git config
 #      mosaic.gitIdentity (per-worktree) > git-supplied username.
-#   2. Correct token file path chosen per host
+#   2. Correct per-slot token file path chosen per host
 #      (gitea-usc-<id>.token vs gitea-mosaicstack-<id>.token).
-#   3. Credential store selection: an identity with a directory under
-#      <brain>/fleet/agents/ is a SEAT and is read ONLY from its own secrets/
-#      slot; any other identity is a SERVICE and is read from the framework
-#      store. No precedence between them and NO fallback from one to the other.
-#   4. Fail-closed: an identity that resolves but has no credential is REFUSED —
-#      no output, nonzero exit, a stderr diagnostic, and a durable spool record.
-#      The shared account is never emitted in its place.
-#   5. Fail-closed: no identity resolvable on a host that runs a fleet is also
-#      REFUSED, because records made there must name the agent that made them.
-#   6. Backward compatibility, the one surviving fallback: no identity AND no
-#      fleet -> shared account, unchanged. On such a host the shared account is
-#      the operator's own and there is no attribution to lose.
-#   7. Unknown/unrelated host -> exits 0 with no output (passthrough).
-#   8. Non-"get" verb -> exits 0 with no output.
+#   3. Per-slot token present -> emits that identity + token.
+#   4. Per-slot token absent -> falls back to the shared account
+#      (backward-compat / no-op for hosts without per-slot tokens).
+#   5. Unknown/unrelated host -> exits 0 with no output (passthrough).
 #
 # Uses stubbed token files under a fake HOME + a real (throwaway) git repo.
 # NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
@@ -31,9 +21,6 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/git-credential-mosaic}"
 FAKE_HOME="$WORK_DIR/home"
 REPO_DIR="$WORK_DIR/repo"
-BRAIN_DIR="$WORK_DIR/brain"
-SPOOL_DIR="$WORK_DIR/spool"
-SVC_STORE="$FAKE_HOME/.config/mosaic/secrets/gitea-tokens"
 # Mirror the real deployed layout (~/.config/mosaic/tools/{git,_lib}/) under the
 # fake HOME: git-credential-mosaic resolves its credentials.sh sibling via a
 # script-relative path (BASH_SOURCE), so the copy must live next to a stubbed
@@ -41,10 +28,10 @@ SVC_STORE="$FAKE_HOME/.config/mosaic/secrets/gitea-tokens"
 HELPER="$FAKE_HOME/.config/mosaic/tools/git/git-credential-mosaic"
 
 rm -rf "$WORK_DIR"
-mkdir -p "$SVC_STORE" \
+mkdir -p "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens" \
          "$FAKE_HOME/.config/mosaic/tools/git" \
          "$FAKE_HOME/.config/mosaic/tools/_lib" \
-         "$REPO_DIR" "$BRAIN_DIR"
+         "$REPO_DIR"
 
 cp "$SCRIPT_DIR/git-credential-mosaic" "$HELPER"
 chmod +x "$HELPER"
@@ -81,8 +68,7 @@ run_helper() {
   local host="$1" username_in="$2"; shift 2
   (
     cd "$REPO_DIR"
-    env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$SPOOL_DIR" "$@" \
-      bash "$HELPER" get <<EOF
+    env -i HOME="$FAKE_HOME" PATH="$PATH" "$@" bash "$HELPER" get <<EOF
 host=$host
 username=$username_in
 
@@ -90,61 +76,20 @@ EOF
   )
 }
 
-# A refusal must be observable in four independent ways: nonzero exit, EMPTY
-# stdout, a stderr diagnostic naming the identity and host, and — the assertion
-# that actually catches a regression to the old behavior — NO shared token value
-# anywhere in the output. Checking only the exit code would pass against a helper
-# that emitted the shared credential and then exited 1.
-assert_fail_closed() {
-  local desc="$1" host="$2" username_in="$3" want_in_stderr="$4"; shift 4
-  local stderr_file="$WORK_DIR/stderr.tmp"
-  : > "$stderr_file"
-  set +e
-  local stdout
-  stdout=$(run_helper "$host" "$username_in" "$@" 2>"$stderr_file")
-  local rc=$?
-  set -e
-  local stderr
-  stderr=$(cat "$stderr_file")
-  if [[ "$rc" -eq 0 ]]; then
-    echo "FAIL: $desc — expected nonzero exit, got 0 (stdout='$stdout')" >&2
-    fail=1
-  fi
-  if [[ -n "$stdout" ]]; then
-    echo "FAIL: $desc — expected empty stdout (nothing emitted), got '$stdout'" >&2
-    fail=1
-  fi
-  if [[ "$stdout$stderr" == *"shared-mosaicstack-token"* || "$stdout$stderr" == *"shared-usc-token"* ]]; then
-    echo "FAIL: $desc — a SHARED token value appeared in the output. The shared-account fallback must be gone:" >&2
-    echo "$stdout$stderr" >&2
-    fail=1
-  fi
-  if [[ -n "$want_in_stderr" && "$stderr" != *"$want_in_stderr"* ]]; then
-    echo "FAIL: $desc — stderr does not contain '$want_in_stderr':" >&2
-    echo "$stderr" >&2
-    fail=1
-  fi
-  if [[ "$stderr" != *"$host"* ]]; then
-    echo "FAIL: $desc — stderr does not name the host '$host':" >&2
-    echo "$stderr" >&2
-    fail=1
-  fi
-}
-
 # ---------------------------------------------------------------------------
-# 1. Backward compatibility: nothing resolvable, and NO fleet on this host ->
-#    shared account, unchanged. This is the only surviving fallback.
+# 1. No identity resolvable anywhere, no per-slot token -> shared fallback
+#    (backward-compat: unchanged behavior when nothing is configured).
 # ---------------------------------------------------------------------------
 git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
 out=$(run_helper "git.mosaicstack.dev" "")
-assert_eq "no identity + no fleet: username" "username=git" "$(echo "$out" | grep '^username=')"
-assert_eq "no identity + no fleet: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+assert_eq "shared fallback: username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "shared fallback: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
 
 # ---------------------------------------------------------------------------
-# 2. git-supplied username resolves to a SERVICE identity WITH a token in the
-#    framework store -> that identity + token wins over the shared account.
+# 2. git-supplied username resolves to an identity WITH a per-slot token ->
+#    that identity + token wins over the shared account.
 # ---------------------------------------------------------------------------
-echo -n "agentA-mosaicstack-token" > "$SVC_STORE/gitea-mosaicstack-agentA.token"
+echo -n "agentA-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentA.token"
 out=$(run_helper "git.mosaicstack.dev" "agentA")
 assert_eq "username-resolved identity: username" "username=agentA" "$(echo "$out" | grep '^username=')"
 assert_eq "username-resolved identity: password" "password=agentA-mosaicstack-token" "$(echo "$out" | grep '^password=')"
@@ -152,7 +97,7 @@ assert_eq "username-resolved identity: password" "password=agentA-mosaicstack-to
 # ---------------------------------------------------------------------------
 # 3. git config mosaic.gitIdentity (per-worktree) beats git-supplied username.
 # ---------------------------------------------------------------------------
-echo -n "agentB-mosaicstack-token" > "$SVC_STORE/gitea-mosaicstack-agentB.token"
+echo -n "agentB-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentB.token"
 git -C "$REPO_DIR" config mosaic.gitIdentity agentB
 out=$(run_helper "git.mosaicstack.dev" "agentA")
 assert_eq "git-config beats username: username" "username=agentB" "$(echo "$out" | grep '^username=')"
@@ -161,210 +106,54 @@ assert_eq "git-config beats username: password" "password=agentB-mosaicstack-tok
 # ---------------------------------------------------------------------------
 # 4. MOSAIC_GIT_IDENTITY env beats git config mosaic.gitIdentity.
 # ---------------------------------------------------------------------------
-echo -n "agentC-mosaicstack-token" > "$SVC_STORE/gitea-mosaicstack-agentC.token"
+echo -n "agentC-mosaicstack-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-agentC.token"
 out=$(run_helper "git.mosaicstack.dev" "agentA" MOSAIC_GIT_IDENTITY=agentC)
 assert_eq "env beats git-config: username" "username=agentC" "$(echo "$out" | grep '^username=')"
 assert_eq "env beats git-config: password" "password=agentC-mosaicstack-token" "$(echo "$out" | grep '^password=')"
 git -C "$REPO_DIR" config --unset mosaic.gitIdentity
 
 # ---------------------------------------------------------------------------
-# 5. Correct token PATH is chosen per host: same agent id, different host
-#    prefix (gitea-usc- vs gitea-mosaicstack-).
+# 5. Identity resolves, but no matching per-slot token file -> falls back to
+#    the shared account (per-agent identity is opt-in, not a hard requirement).
 # ---------------------------------------------------------------------------
-echo -n "agentD-usc-token" > "$SVC_STORE/gitea-usc-agentD.token"
+out=$(run_helper "git.mosaicstack.dev" "no-such-agent")
+assert_eq "no per-slot token: username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "no per-slot token: password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
+
+# ---------------------------------------------------------------------------
+# 6. Correct per-slot token PATH is chosen per host: same agent id, different
+#    host prefix (gitea-usc- vs gitea-mosaicstack-).
+# ---------------------------------------------------------------------------
+echo -n "agentD-usc-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-usc-agentD.token"
 out=$(run_helper "git.uscllc.com" "agentD")
 assert_eq "host-scoped token path (usc): username" "username=agentD" "$(echo "$out" | grep '^username=')"
 assert_eq "host-scoped token path (usc): password" "password=agentD-usc-token" "$(echo "$out" | grep '^password=')"
+# agentD has NO mosaicstack token -> must fall back to shared mosaicstack, not
+# leak the usc token across hosts.
+out=$(run_helper "git.mosaicstack.dev" "agentD")
+assert_eq "host-scoped token path (cross-host must not leak): username" "username=git" "$(echo "$out" | grep '^username=')"
+assert_eq "host-scoped token path (cross-host must not leak): password" "password=shared-mosaicstack-token" "$(echo "$out" | grep '^password=')"
 
 # ---------------------------------------------------------------------------
-# 6. FAIL CLOSED — identity resolves, no credential for it on this host. Must
-#    NOT borrow the shared account, and must NOT leak the same agent's token
-#    for a DIFFERENT host (agentD holds a usc token and no mosaicstack one).
-# ---------------------------------------------------------------------------
-assert_fail_closed "cross-host absence refuses (no shared fallback, no cross-host leak)" \
-  "git.mosaicstack.dev" "agentD" "gitea-mosaicstack-agentD.token"
-# The agent's own usc token must not appear either.
-: > "$WORK_DIR/stderr.tmp"
-set +e
-leak_out=$(run_helper "git.mosaicstack.dev" "agentD" 2>"$WORK_DIR/stderr.tmp")
-set -e
-if [[ "$leak_out$(cat "$WORK_DIR/stderr.tmp")" == *"agentD-usc-token"* ]]; then
-  echo "FAIL: cross-host leak — the usc token value appeared on a mosaicstack request" >&2
-  fail=1
-fi
-
-assert_fail_closed "unknown identity refuses (shared account never substituted)" \
-  "git.mosaicstack.dev" "no-such-agent" "no-token-for-identity"
-
-# ---------------------------------------------------------------------------
-# 7. A refusal leaves a durable spool record, and that record contains no token.
-#    The stderr diagnostic is transient; the record is what an operator reads
-#    afterwards, so it must exist independently of anyone watching the terminal.
-# ---------------------------------------------------------------------------
-spool_file=$(find "$SPOOL_DIR" -maxdepth 1 -name '*.jsonl' | head -n 1)
-if [[ -z "$spool_file" ]]; then
-  echo "FAIL: fail-closed left no spool record under $SPOOL_DIR" >&2
-  fail=1
-else
-  spool_body=$(cat "$spool_file")
-  assert_eq "spool record names the refused identity" "1" \
-    "$(grep -c '"identity":"no-such-agent"' "$spool_file" | head -n 1)"
-  if [[ "$spool_body" == *"shared-"*"-token"* || "$spool_body" == *"agentD-usc-token"* ]]; then
-    echo "FAIL: spool record contains a token value:" >&2
-    echo "$spool_body" >&2
-    fail=1
-  fi
-fi
-
-# ---------------------------------------------------------------------------
-# 8. SEAT identity: an id with a directory under <brain>/fleet/agents/ is read
-#    from its OWN secrets/ slot, not from the framework store.
-# ---------------------------------------------------------------------------
-mkdir -p "$BRAIN_DIR/fleet/agents/seatE/secrets"
-echo -n "seatE-slot-token" > "$BRAIN_DIR/fleet/agents/seatE/secrets/gitea-mosaicstack-seatE.token"
-out=$(run_helper "git.mosaicstack.dev" "seatE" MOSAIC_BRAIN_HOME="$BRAIN_DIR")
-assert_eq "seat reads its own slot: username" "username=seatE" "$(echo "$out" | grep '^username=')"
-assert_eq "seat reads its own slot: password" "password=seatE-slot-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 9. NO CROSS-STORE FALLBACK — the assertion this whole store-selection design
-#    exists for. seatF is a seat (it has a directory) with an EMPTY slot, while
-#    a framework-store token of the identical name is present and readable.
-#    The helper must refuse rather than read it: one credential, one location,
-#    and a seat that reads a same-named service credential is exactly the
-#    silent-substitution failure the fail-closed rule removes.
-# ---------------------------------------------------------------------------
-mkdir -p "$BRAIN_DIR/fleet/agents/seatF/secrets"
-echo -n "seatF-SERVICE-STORE-token" > "$SVC_STORE/gitea-mosaicstack-seatF.token"
-assert_fail_closed "seat with empty slot does NOT fall back to the framework store" \
-  "git.mosaicstack.dev" "seatF" "fleet/agents/seatF/secrets" MOSAIC_BRAIN_HOME="$BRAIN_DIR"
-: > "$WORK_DIR/stderr.tmp"
-set +e
-xstore_out=$(run_helper "git.mosaicstack.dev" "seatF" MOSAIC_BRAIN_HOME="$BRAIN_DIR" 2>"$WORK_DIR/stderr.tmp")
-set -e
-if [[ "$xstore_out$(cat "$WORK_DIR/stderr.tmp")" == *"seatF-SERVICE-STORE-token"* ]]; then
-  echo "FAIL: cross-store fallback — a seat read the framework store's same-named token" >&2
-  fail=1
-fi
-# Control: that framework-store token IS readable, so the refusal above is the
-# store rule firing and not an unreadable file. A non-seat identity pointed at
-# the same file gets it.
-out=$(run_helper "git.mosaicstack.dev" "seatF" MOSAIC_BRAIN_HOME="$WORK_DIR/no-such-brain")
-assert_eq "control — same file IS readable for a non-seat identity" \
-  "password=seatF-SERVICE-STORE-token" "$(echo "$out" | grep '^password=')"
-
-# ---------------------------------------------------------------------------
-# 10. FAIL CLOSED — no identity resolvable, but this host runs a fleet. Where
-#     seats exist, an unattributable request is refused instead of receiving
-#     the shared account. Contrast with case 1, which is the same request on a
-#     host with no fleet and still returns the shared account.
-# ---------------------------------------------------------------------------
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
-assert_fail_closed "no identity on a fleet host refuses" \
-  "git.mosaicstack.dev" "" "no-identity" MOSAIC_BRAIN_HOME="$BRAIN_DIR"
-
-# ---------------------------------------------------------------------------
-# 11. The brain home defaults to ~/.mosaic when MOSAIC_BRAIN_HOME is unset —
-#     the fleet gate must fire on the default path too, not only on an
-#     explicitly injected one. Case 1 ran before this directory existed; the
-#     same call now refuses, which also proves case 1 was measuring the
-#     no-fleet branch rather than passing for an unrelated reason.
-# ---------------------------------------------------------------------------
-mkdir -p "$FAKE_HOME/.mosaic/fleet/agents"
-assert_fail_closed "fleet gate fires on the default ~/.mosaic brain home" \
-  "git.mosaicstack.dev" "" "no-identity"
-
-# ---------------------------------------------------------------------------
-# 12. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
-#     remotes, e.g. github.com via a different credential helper). A fleet host
-#     must not refuse a host this helper does not own.
+# 7. Unrelated/unknown host -> exit 0, no output (passthrough for non-Gitea
+#    remotes, e.g. github.com via a different credential helper).
 # ---------------------------------------------------------------------------
 out=$(run_helper "github.com" "agentA")
 assert_eq "unknown host: no output" "" "$out"
-out=$(run_helper "github.com" "" MOSAIC_BRAIN_HOME="$BRAIN_DIR")
-assert_eq "unknown host on a fleet host: still passthrough, not a refusal" "" "$out"
 
 # ---------------------------------------------------------------------------
-# 13. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
-#     protocol: this helper only implements get).
+# 8. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
+#    protocol: this helper only implements get).
 # ---------------------------------------------------------------------------
 store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" bash "$HELPER" store <<EOF
 host=git.mosaicstack.dev
-username=no-such-agent
+username=agentA
 password=whatever
 
 EOF
 )
 assert_eq "store verb: no output" "" "$store_out"
 
-# ---------------------------------------------------------------------------
-# 14. The escalation record is machine-readable even when a field carries a
-#     quote or a backslash. A cwd is arbitrary operator text; an unescaped one
-#     silently turns the spool into unparseable JSONL, and the operator only
-#     finds out while reading the record that explains an outage.
-# ---------------------------------------------------------------------------
-hostile_dir="$WORK_DIR/we\"ird\\dir"
-mkdir -p "$hostile_dir"
-hostile_spool="$WORK_DIR/spool-hostile"
-(
-  cd "$hostile_dir"
-  env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$hostile_spool" \
-    MOSAIC_GIT_IDENTITY=no-such-agent \
-    bash "$HELPER" get <<EOF >/dev/null 2>&1
-host=git.mosaicstack.dev
-username=no-such-agent
-
-EOF
-) || true
-# Deliberately not `ls ... | head -1`: under `set -o pipefail` a missed glob
-# makes ls exit 2, the pipeline inherits it, and `set -e` kills this suite with
-# zero output — the same silent-nonzero failure this file exists to catch.
-record_file=""
-for candidate in "$hostile_spool"/*.jsonl; do
-  if [[ -e "$candidate" ]]; then
-    record_file="$candidate"
-    break
-  fi
-done
-if [[ -z "$record_file" ]]; then
-  echo "FAIL: hostile cwd — no escalation record was written at all" >&2
-  fail=1
-elif ! python3 -c 'import json,sys
-for line in open(sys.argv[1]):
-    line = line.strip()
-    if line:
-        json.loads(line)' "$record_file" 2>/dev/null; then
-  echo "FAIL: hostile cwd — escalation record is not parseable JSONL:" >&2
-  cat "$record_file" >&2
-  fail=1
-fi
-
-# ---------------------------------------------------------------------------
-# 15. When the spool cannot be created, the diagnostic must NOT name a record
-#     path. Naming a file that was never written sends the operator to an
-#     empty path on exactly the hosts where the escalation was lost.
-# ---------------------------------------------------------------------------
-unwritable_spool="/proc/mosaic-credential-spool-cannot-exist"
-nospool_err=$(
-  cd "$REPO_DIR"
-  env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$unwritable_spool" \
-    MOSAIC_GIT_IDENTITY=no-such-agent \
-    bash "$HELPER" get <<EOF 2>&1 >/dev/null
-host=git.mosaicstack.dev
-username=no-such-agent
-
-EOF
-) || true
-if [[ "$nospool_err" == *"record: $unwritable_spool/"* ]]; then
-  echo "FAIL: unwritable spool — diagnostic names a record file that was never written" >&2
-  fail=1
-fi
-if [[ "$nospool_err" != *"NOT WRITTEN"* ]]; then
-  echo "FAIL: unwritable spool — diagnostic does not say the record was not written" >&2
-  echo "$nospool_err" >&2
-  fail=1
-fi
-
 if [[ "$fail" -eq 0 ]]; then
   echo "git-credential-mosaic identity resolution regression passed"
 fi

packages/mosaic/framework/tools/git/test-gitea-token-identity.sh

@@ -23,17 +23,6 @@
 #   6. Scope containment: identity requested + an UNRECOGNIZED Gitea host (no
 #      per-slot token scheme) -> Patch 2b does not apply; existing
 #      fall-through behavior is unchanged.
-#   7. Credential store selection: an identity with a directory under
-#      <brain>/fleet/agents/ is a SEAT and is read ONLY from its own secrets/
-#      slot; any other identity is a SERVICE and is read from the framework
-#      store. No precedence between them and NO fallback from one to the
-#      other — a seat with an empty slot is REFUSED even when a same-named
-#      token sits in the framework store.
-#   8. Fail loud when NO identity resolves on a host that runs a fleet: where
-#      seats exist, an unattributable API call is refused rather than made
-#      under the shared account. On a host with no fleet the same call still
-#      returns the shared token (case 1), which is what keeps this change a
-#      no-op for non-fleet operators of the framework.
 #
 # Uses a stubbed credentials.json + stubbed per-slot token files under a fake
 # HOME. NEVER reads real secrets or touches the real ~/.config/mosaic/secrets.
@@ -221,94 +210,6 @@ if [[ "$err" == *"no per-slot token at"* ]]; then
 fi
 git -C "$REPO_DIR" config --unset mosaic.gitIdentity
 
-# ---------------------------------------------------------------------------
-# 7. SEAT identity: an id with a directory under <brain>/fleet/agents/ is read
-#    from its OWN secrets/ slot, not from the framework store. The brain home
-#    is resolved exactly as packages/mosaic/src/fleet/brain-home.ts does it:
-#    MOSAIC_BRAIN_HOME, else ~/.mosaic.
-# ---------------------------------------------------------------------------
-BRAIN_DIR="$WORK_DIR/brain"
-mkdir -p "$BRAIN_DIR/fleet/agents/seatE/secrets"
-echo -n "seatE-slot-token" > "$BRAIN_DIR/fleet/agents/seatE/secrets/gitea-mosaicstack-seatE.token"
-out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=seatE MOSAIC_BRAIN_HOME="$BRAIN_DIR")
-assert_eq "seat reads its own slot" "seatE-slot-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 8. NO CROSS-STORE FALLBACK. seatF is a seat (it has a directory) with an
-#    EMPTY slot, while a framework-store token of the identical name is
-#    present and readable. It must be REFUSED rather than served that token:
-#    one credential, one location. A seat that silently reads a same-named
-#    service credential is the same substitution failure as the shared-account
-#    fallback, one store further down.
-# ---------------------------------------------------------------------------
-mkdir -p "$BRAIN_DIR/fleet/agents/seatF/secrets"
-echo -n "seatF-SERVICE-STORE-token" > "$FAKE_HOME/.config/mosaic/secrets/gitea-tokens/gitea-mosaicstack-seatF.token"
-assert_failloud "seat with empty slot does NOT fall back to the framework store" \
-  "git.mosaicstack.dev" "seatF" \
-  "$BRAIN_DIR/fleet/agents/seatF/secrets/gitea-mosaicstack-seatF.token" \
-  MOSAIC_GIT_IDENTITY=seatF MOSAIC_BRAIN_HOME="$BRAIN_DIR"
-# assert_failloud only screens stderr for the word "shared"; this store's token
-# is not named that, so check for its value explicitly.
-set +e
-xstore_out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=seatF MOSAIC_BRAIN_HOME="$BRAIN_DIR" 2>"$WORK_DIR/stderr-xstore.tmp")
-set -e
-if [[ "$xstore_out$(cat "$WORK_DIR/stderr-xstore.tmp")" == *"seatF-SERVICE-STORE-token"* ]]; then
-  echo "FAIL: cross-store fallback — a seat was served the framework store's same-named token" >&2
-  fail=1
-fi
-# Control: that framework-store token IS readable, so the refusal above is the
-# store rule firing and not an unreadable file. The same id, resolved against a
-# brain home where it is not a seat, gets it.
-out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_GIT_IDENTITY=seatF MOSAIC_BRAIN_HOME="$WORK_DIR/no-such-brain")
-assert_eq "control — same file IS readable for a non-seat identity" "seatF-SERVICE-STORE-token" "$out"
-
-# ---------------------------------------------------------------------------
-# 9. FAIL LOUD — no identity resolvable, but this host runs a fleet. Contrast
-#    with case 1: the identical call on a host with no fleet still returns the
-#    shared token.
-# ---------------------------------------------------------------------------
-git -C "$REPO_DIR" config --unset mosaic.gitIdentity 2>/dev/null || true
-set +e
-noid_out=$(call_get_gitea_token "git.mosaicstack.dev" MOSAIC_BRAIN_HOME="$BRAIN_DIR" 2>"$WORK_DIR/stderr-noid.tmp")
-noid_rc=$?
-set -e
-noid_err=$(cat "$WORK_DIR/stderr-noid.tmp")
-if [[ "$noid_rc" -eq 0 ]]; then
-  echo "FAIL: no identity on a fleet host — expected nonzero return, got 0 (stdout='$noid_out')" >&2
-  fail=1
-fi
-if [[ -n "$noid_out" ]]; then
-  echo "FAIL: no identity on a fleet host — expected empty stdout, got '$noid_out'" >&2
-  fail=1
-fi
-if [[ "$noid_out" == *"shared-mosaicstack-token"* || "$noid_err" == *"shared-mosaicstack-token"* ]]; then
-  echo "FAIL: no identity on a fleet host — the shared token was served anyway:" >&2
-  echo "$noid_out$noid_err" >&2
-  fail=1
-fi
-if [[ "$noid_err" != *"MOSAIC_GIT_IDENTITY"* ]]; then
-  echo "FAIL: no identity on a fleet host — stderr does not say how to set an identity:" >&2
-  echo "$noid_err" >&2
-  fail=1
-fi
-
-# ---------------------------------------------------------------------------
-# 10. The brain home defaults to ~/.mosaic when MOSAIC_BRAIN_HOME is unset —
-#     the fleet gate must fire on the default path too, not only on an
-#     explicitly injected one. Case 1 ran before this directory existed; the
-#     same call now refuses, which also proves case 1 was measuring the
-#     no-fleet branch rather than passing for an unrelated reason.
-# ---------------------------------------------------------------------------
-mkdir -p "$FAKE_HOME/.mosaic/fleet/agents"
-set +e
-dflt_out=$(call_get_gitea_token "git.mosaicstack.dev" 2>"$WORK_DIR/stderr-dflt.tmp")
-dflt_rc=$?
-set -e
-if [[ "$dflt_rc" -eq 0 || -n "$dflt_out" ]]; then
-  echo "FAIL: fleet gate did not fire on the default ~/.mosaic brain home (rc=$dflt_rc stdout='$dflt_out')" >&2
-  fail=1
-fi
-
 if [[ "$fail" -eq 0 ]]; then
   echo "get_gitea_token identity resolution regression passed"
 fi

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh && bash framework/tools/_scripts/test-brain-home-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/commands/fleet-agent-crud-command.ts

@@ -1,6 +1,5 @@
 import { readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
-import { fleetAgentEnvDir, fleetRolesLocalDir } from '../fleet/brain-home.js';
 import type { Command } from 'commander';
 import {
   executeFleetAgentMutation,
@@ -150,9 +149,9 @@ async function executeCommand(
     request,
     mosaicHome,
     rosterPath,
-    agentEnvDir: fleetAgentEnvDir(mosaicHome),
+    agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
     rolesDir: join(mosaicHome, 'fleet', 'roles'),
-    overrideDir: fleetRolesLocalDir(mosaicHome),
+    overrideDir: join(mosaicHome, 'fleet', 'roles.local'),
     dryRun: forceDryRun || opts.dryRun === true,
     ...(deps.projectionApplier === undefined ? {} : { projectionApplier: deps.projectionApplier }),
   });

packages/mosaic/src/commands/fleet-migration-command.ts

@@ -1,6 +1,5 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { fleetAgentEnvDir, fleetRolesLocalDir } from '../fleet/brain-home.js';
 import type { Command } from 'commander';
 import {
   parseV1MigrationObservations,
@@ -121,11 +120,11 @@ export function registerFleetMigrationCommand(
           observations,
           personaDirs: {
             rolesDir: deps.rolesDir ?? join(mosaicHome, 'fleet', 'roles'),
-            overrideDir: deps.overrideDir ?? fleetRolesLocalDir(mosaicHome),
+            overrideDir: deps.overrideDir ?? join(mosaicHome, 'fleet', 'roles.local'),
           },
           environment: {
             mosaicHome,
-            agentEnvDir: fleetAgentEnvDir(mosaicHome),
+            agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
           },
         });
         printJson(preview);

packages/mosaic/src/commands/fleet-personas.ts

@@ -30,21 +30,19 @@ import { lstat, readFile, readdir, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, sep } from 'node:path';
 import type { Command } from 'commander';
-import { fleetRolesLocalDir } from '../fleet/brain-home.js';
 
 function defaultMosaicHome(): string {
   return process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
 }
 
-/** Baseline persona role contracts (reseeded on update; config home — framework). */
+/** Baseline persona role contracts (reseeded on update). */
 export function defaultRolesDir(mosaicHome = defaultMosaicHome()): string {
   return join(mosaicHome, 'fleet', 'roles');
 }
 
-/** PRESERVE-protected override layer (survives update; wins on merge).
- * Brain home (`~/.mosaic/fleet/roles.local`) when a brain is active. */
+/** PRESERVE-protected override layer (survives update; wins on merge). */
 export function defaultOverrideDir(mosaicHome = defaultMosaicHome()): string {
-  return fleetRolesLocalDir(mosaicHome);
+  return join(mosaicHome, 'fleet', 'roles.local');
 }
 
 /**

packages/mosaic/src/commands/fleet-profiles.ts

@@ -25,7 +25,6 @@ import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import type { Command } from 'commander';
 import YAML from 'yaml';
-import { fleetProfilesDir } from '../fleet/brain-home.js';
 import {
   defaultOverrideDir,
   extractClassesFromDir,
@@ -37,10 +36,9 @@ function defaultMosaicHome(): string {
   return process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
 }
 
-/** Directory holding the seeded profile yaml files — brain home when active
- * (user working copies, committed), else the config home seed. */
+/** Directory holding the seeded profile yaml files. */
 export function defaultProfilesDir(mosaicHome = defaultMosaicHome()): string {
-  return fleetProfilesDir(mosaicHome);
+  return join(mosaicHome, 'fleet', 'profiles');
 }
 
 /** Directory holding the persona role contracts. */

packages/mosaic/src/commands/fleet-regen-command.ts

@@ -3,7 +3,6 @@ import { homedir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
 import type { Command } from 'commander';
 import type { CommandRunner } from './fleet.js';
-import { fleetAgentEnvDir } from '../fleet/brain-home.js';
 import {
   applyPreparedGeneratedAgentEnvironmentProjection,
   prepareGeneratedAgentEnvironmentProjection,
@@ -154,7 +153,7 @@ export async function executeFleetRegen(
   options: FleetRegenOptions,
 ): Promise<FleetRegenResult> {
   const mosaicHome = defaultMosaicHome(deps);
-  const agentEnvDir = fleetAgentEnvDir(mosaicHome);
+  const agentEnvDir = join(mosaicHome, 'fleet', 'agents');
   const rosterPath = join(mosaicHome, 'fleet', 'roster.yaml');
   const readRoster = deps.readRoster ?? defaultReadRoster(deps, mosaicHome);
   const prepare = deps.prepareProjection ?? prepareGeneratedAgentEnvironmentProjection;

packages/mosaic/src/commands/fleet.ts

@@ -13,7 +13,6 @@ import {
 import { randomUUID } from 'node:crypto';
 import { homedir, hostname, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { fleetAgentEnvDir } from '../fleet/brain-home.js';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import * as readline from 'node:readline';
@@ -159,7 +158,7 @@ export function resolveFleetPaths(mosaicHome = defaultMosaicHome()): FleetPaths
     fleetToolsDir: join(mosaicHome, 'tools', 'fleet'),
     tmuxToolsDir: join(mosaicHome, 'tools', 'tmux'),
     systemdUserDir: join(homedir(), '.config', 'systemd', 'user'),
-    agentEnvDir: fleetAgentEnvDir(mosaicHome),
+    agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
   };
 }
 

packages/mosaic/src/commands/launch.spec.ts

@@ -349,90 +349,3 @@ describe('registerRuntimeLaunchers — claudex (EXPERIMENTAL overlay)', () => {
     expect(mockExit).not.toHaveBeenCalled();
   });
 });
-
-// ─── Seat harness homes (MOSAIC-D-002, brain-home split) ────────────────────
-
-import { activeSeatDir, seatPersonaOverlay } from './launch.js';
-
-describe('activeSeatDir — per-agent harness home resolution', () => {
-  let root: string;
-  const savedAgentName = process.env['MOSAIC_AGENT_NAME'];
-  const savedBrainHome = process.env['MOSAIC_BRAIN_HOME'];
-
-  beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), 'mosaic-seat-home-'));
-    delete process.env['MOSAIC_BRAIN_HOME'];
-  });
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-    if (savedAgentName === undefined) {
-      delete process.env['MOSAIC_AGENT_NAME'];
-    } else {
-      process.env['MOSAIC_AGENT_NAME'] = savedAgentName;
-    }
-    if (savedBrainHome !== undefined) {
-      process.env['MOSAIC_BRAIN_HOME'] = savedBrainHome;
-    } else {
-      delete process.env['MOSAIC_BRAIN_HOME'];
-    }
-  });
-
-  it('resolves the seat dir when MOSAIC_BRAIN_HOME carries the seat', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBe(seat);
-  });
-
-  it('returns undefined without an agent name (bare launches stay shared)', () => {
-    delete process.env['MOSAIC_AGENT_NAME'];
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-  });
-
-  it('returns undefined when the seat dir does not exist in the brain', () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'ghost';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-    mkdirSync(join(root, 'brain', 'fleet', 'agents'), { recursive: true });
-
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-  });
-
-  it.each(['../escape', 'a/b', '.hidden-start', '', 'spaced name'])(
-    'rejects unsafe agent name %j (path traversal cannot leave the seat store)',
-    (name: string) => {
-      process.env['MOSAIC_AGENT_NAME'] = name;
-      process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-      expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-    },
-  );
-
-  it('seatPersonaOverlay renders the seat SOUL.md as an overlay block', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    writeFileSync(join(seat, 'SOUL.md'), '# coder0 — code seat persona\n\nShips tested code.\n');
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    const overlay = seatPersonaOverlay(join(root, 'config', 'mosaic'));
-    expect(overlay).toContain('## Seat Persona');
-    expect(overlay).toContain('coder0 — code seat persona');
-  });
-
-  it('seatPersonaOverlay is empty when the seat carries no SOUL.md', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    expect(seatPersonaOverlay(join(root, 'config', 'mosaic'))).toBe('');
-  });
-
-  it('seatPersonaOverlay is empty when no agent name is set', () => {
-    delete process.env['MOSAIC_AGENT_NAME'];
-    expect(seatPersonaOverlay(join(root, 'config', 'mosaic'))).toBe('');
-  });
-});

packages/mosaic/src/commands/launch.ts

@@ -19,7 +19,7 @@ import {
 import { createHash, randomBytes } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { homedir, hostname } from 'node:os';
-import { join, dirname, resolve } from 'node:path';
+import { join, dirname } from 'node:path';
 import type { Command } from 'commander';
 import {
   buildResolvedFleetCommsBlock,
@@ -29,7 +29,6 @@ import {
 import { readRegularFileSecure } from '../fleet/secure-file.js';
 import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 import { canonicalizeRoleClass } from './fleet-personas.js';
-import { resolveBrainHome } from '../fleet/brain-home.js';
 import { launchClaudex, type ClaudexHarnessAdapter } from './claudex.js';
 import { runLeaseEnforcementDoctorCheck } from './lease-doctor-check.js';
 
@@ -65,46 +64,9 @@ const HARNESS_HOME_ENV: Record<RuntimeName, string> = {
   opencode: 'XDG_CONFIG_HOME',
 };
 
-/** Dedicated mosaic-owned home for a runtime: ~/.config/mosaic/.<runtime>.
- * With an active brain seat (MOSAIC_AGENT_NAME + seat dir in the brain home)
- * the home is per-agent instead: <brainHome>/fleet/agents/<seat>/.<runtime> —
- * per-agent sessions, settings, and auth inside the seat dir (canon §2,
- * MOSAIC-D-002). Seat runtime dirs are dot-named so the brain's ignore policy
- * (per-seat .pi/.claude/.codex dirs) keeps credential material untracked. */
-const SEAT_AGENT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
-
-export function activeSeatDir(mosaicHome: string = MOSAIC_HOME): string | undefined {
-  const agent = process.env['MOSAIC_AGENT_NAME']?.trim();
-  if (
-    agent === undefined ||
-    agent === '' ||
-    !SEAT_AGENT_NAME_RE.test(agent) ||
-    agent.includes('..')
-  ) {
-    return undefined;
-  }
-  const brain = resolveBrainHome(mosaicHome);
-  if (resolve(brain) === resolve(mosaicHome)) return undefined; // no brain
-  const seat = join(brain, 'fleet', 'agents', agent);
-  return existsSync(seat) ? seat : undefined;
-}
-
-function harnessHome(runtime: RuntimeName, mosaicHome: string = MOSAIC_HOME): string {
-  const seat = activeSeatDir(mosaicHome);
-  if (seat !== undefined) return join(seat, `.${runtime}`);
-  return join(mosaicHome, `.${runtime}`);
-}
-
-/** Seat persona block: with an active brain seat, <seat>/SOUL.md layers
- * persona on the root generic base (canon invariant; MOSAIC-D-002). The base
- * SOUL stays load-on-demand — only the seat delta is injected by value.
- * Empty string when no seat is active or the seat carries no SOUL.md. */
-export function seatPersonaOverlay(mosaicHome: string = MOSAIC_HOME): string {
-  const seatDir = activeSeatDir(mosaicHome);
-  if (seatDir === undefined) return '';
-  const seatSoul = readOptional(join(seatDir, 'SOUL.md'));
-  if (!seatSoul.trim()) return '';
-  return '## Seat Persona\n\n' + seatSoul.trim();
+/** Dedicated mosaic-owned home for a runtime: ~/.config/mosaic/.<runtime> */
+function harnessHome(runtime: RuntimeName): string {
+  return join(MOSAIC_HOME, `.${runtime}`);
 }
 
 /**
@@ -220,8 +182,6 @@ function recordLaunch(runtime: RuntimeName, cliArgs: string[], yolo: boolean): v
       cli_version: CLI_VERSION,
       config_home: harnessHome(runtime),
       config_home_isolated: true,
-      config_home_kind: activeSeatDir() !== undefined ? 'seat' : 'runtime-shared',
-      agent_name: process.env['MOSAIC_AGENT_NAME']?.trim() || null,
       config_home_env: HARNESS_HOME_ENV[runtime] ?? null,
       argv: redactArgv(cliArgs),
       normative_fragments: normativeFragmentDigests(runtime),
@@ -609,11 +569,6 @@ For required push/merge/issue-close/release actions, execute without routine con
   if (soulLocal.trim()) {
     overlayBlocks.push('## Persona Overlay (SOUL.local.md)\n\n' + soulLocal.trim());
   }
-  // Seat persona (MOSAIC-D-002): per-seat SOUL.md layers on the generic base.
-  const seatPersona = seatPersonaOverlay(mosaicHome);
-  if (seatPersona !== '') {
-    overlayBlocks.push(seatPersona);
-  }
   const standardsLocal = readOptional(join(mosaicHome, 'STANDARDS.local.md'));
   if (standardsLocal.trim()) {
     overlayBlocks.push('## Standards Overlay (STANDARDS.local.md)\n\n' + standardsLocal.trim());

packages/mosaic/src/commands/mission-prd.spec.ts

@@ -1,149 +0,0 @@
-import { mkdtemp, readFile, readdir } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { parse as parseYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerMissionCommand } from './mission.js';
-import { PrdService } from '@mosaicstack/prdy';
-import type { MissionInfo } from '../tui/gateway-api.js';
-
-// ── Mocks: the gateway is not available in adapter tests ──────────────────────
-
-// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
-// be initialized there too.
-const MISSION = vi.hoisted(
-  (): MissionInfo => ({
-    id: 'mission-plan-1',
-    name: 'Plan Mission Alpha',
-    description: null,
-    status: 'planning',
-    projectId: null,
-    userId: null,
-    phase: null,
-    milestones: null,
-    config: null,
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-03-04T05:06:07.000Z',
-  }),
-);
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
-  fetchMission: vi.fn(),
-  createMission: vi.fn(),
-  updateMission: vi.fn(),
-  fetchMissionTasks: vi.fn().mockResolvedValue([]),
-  createMissionTask: vi.fn(),
-  updateMissionTask: vi.fn(),
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerMissionCommand(program);
-  return program;
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
-  process.chdir(projectDir);
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-  consoleStub.push(logSpy);
-});
-
-afterEach(() => {
-  // Restore only the per-test spies; module factory mocks keep their
-  // implementations across tests.
-  for (const stub of consoleStub) stub.mockRestore();
-  consoleStub = [];
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic mission --plan (thin adapter over PrdService)', () => {
-  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // PRD landed in the same store `mosaic prdy` uses.
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    // Fresh service instance (new-process equivalent) reads the linkage back.
-    const service = new PrdService({ projectPath: projectDir });
-    const docs = await service.list();
-    expect(docs).toHaveLength(1);
-
-    const prd = docs[0]!;
-    expect(prd.title).toBe('Plan Mission Alpha');
-    expect(prd.version).toBe(1);
-
-    const links = await service.listMissionLinks(prd.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: MISSION.id,
-      missionVersion: MISSION.updatedAt, // mission version marker
-      prdVersion: 1,
-    });
-
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
-  });
-
-  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
-    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
-
-    expect(persisted.missions).toHaveLength(1);
-    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
-  });
-
-  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
-    // Mission path.
-    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
-      from: 'user',
-    });
-
-    // prdy path (service, non-interactive entry).
-    const service = new PrdService({ projectPath: projectDir });
-    const direct = await service.create({ name: 'Directly Created' });
-
-    const all = await service.list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
-    expect(all).toHaveLength(2);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toContain(`${direct.id}.yaml`);
-
-    // Both are v1 in the same store with distinct stable ids.
-    for (const doc of all) {
-      expect(doc.version).toBe(1);
-      expect(files).toContain(`${doc.id}.yaml`);
-    }
-  });
-});

packages/mosaic/src/commands/mission.ts

@@ -256,41 +256,14 @@ async function planMission(
   console.log(`Planning mission: ${mission.name}\n`);
 
   try {
-    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
-    // PrdService — no second writer path. The mission's updatedAt serves as
-    // its version marker (the gateway exposes no numeric mission version).
-    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-    const service = new PrdService({ projectPath: process.cwd() });
-
-    if (process.stdout.isTTY) {
-      const created = await runPrdWizard({
-        name: mission.name,
-        projectPath: process.cwd(),
-        interactive: true,
-      });
-      const linked = await service.linkMission({
-        prdId: created.id,
-        missionId: mission.id,
-        missionVersion: mission.updatedAt,
-        requirementIds: [],
-      });
-      console.log(
-        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
-      );
-      return;
-    }
-
-    const doc = await service.planForMission({
+    const { runPrdWizard } = await import('@mosaicstack/prdy');
+    await runPrdWizard({
       name: mission.name,
-      missionId: mission.id,
-      missionVersion: mission.updatedAt,
-      requirementIds: [],
+      projectPath: process.cwd(),
+      interactive: true,
     });
-    console.log(
-      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
-    );
   } catch (err) {
-    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
 }

packages/mosaic/src/commands/prdy.spec.ts

@@ -1,204 +0,0 @@
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import { stringify as stringifyYaml } from 'yaml';
-import { Command } from 'commander';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { registerPrdyCommand } from './prdy.js';
-import { PrdService } from '@mosaicstack/prdy';
-
-// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
-//    outside the tmp project dir) ──────────────────────────────────────────────
-
-vi.mock('./with-auth.js', () => ({
-  withAuth: vi.fn().mockResolvedValue({
-    gateway: 'http://localhost:14242',
-    cookie: 'better-auth.session_token=test',
-    session: {},
-  }),
-}));
-
-vi.mock('../tui/gateway-api.js', () => ({
-  fetchProjects: vi.fn().mockResolvedValue([]),
-}));
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-class ProcessExitError extends Error {
-  constructor(readonly code: number) {
-    super(`process.exit(${code})`);
-  }
-}
-
-function stubProcessExit() {
-  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
-    throw new ProcessExitError(code ?? 0);
-  }) as never);
-}
-
-const originalCwd = process.cwd();
-let projectDir: string;
-let errorSpy: ReturnType<typeof vi.spyOn>;
-let logSpy: ReturnType<typeof vi.spyOn>;
-let exitStub: ReturnType<typeof stubProcessExit>;
-
-function buildTestProgram(): Command {
-  const program = new Command('mosaic').exitOverride();
-  registerPrdyCommand(program);
-  return program;
-}
-
-function runPrdy(args: string[]): Promise<unknown> {
-  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
-}
-
-function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
-  return {
-    id: 'cmd-import-prd',
-    title: 'Command Import PRD',
-    status: 'approved', // must be forced to draft: validity is not approval
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-beforeEach(async () => {
-  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
-  process.chdir(projectDir);
-  exitStub = stubProcessExit();
-  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-});
-
-afterEach(() => {
-  // Restore only the per-test spies: module factory mocks must keep their
-  // implementations for the next test.
-  exitStub.mockRestore();
-  errorSpy.mockRestore();
-  logSpy.mockRestore();
-  process.chdir(originalCwd);
-});
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe('mosaic prdy (thin adapter over PrdService)', () => {
-  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
-    await runPrdy(['--init', 'Adapter Created']);
-
-    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
-    expect(files).toHaveLength(1);
-    expect(files[0]).toMatch(/\.yaml$/);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.title).toBe('Adapter Created');
-    expect(docs[0]?.version).toBe(1);
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
-  });
-
-  it('--import <file> creates a valid import through the service', async () => {
-    const filePath = path.join(projectDir, 'incoming.yaml');
-    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
-
-    await runPrdy(['--import', filePath]);
-
-    const docs = await new PrdService({ projectPath: projectDir }).list();
-    expect(docs).toHaveLength(1);
-    expect(docs[0]?.id).toBe('cmd-import-prd');
-    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
-  });
-
-  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
-    const filePath = path.join(projectDir, 'broken.yaml');
-    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    // Typed refusal surfaced to the user, nothing created.
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
-    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Conflict Target' });
-    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
-    const beforeBytes = await readFile(storeFile, 'utf8');
-
-    const filePath = path.join(projectDir, 'divergent.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Divergent Command Import',
-        }),
-      ),
-      'utf8',
-    );
-
-    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
-
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
-    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
-
-    // Original authority document is byte-identical on disk.
-    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
-  });
-
-  it('--import --accept-successor persists the successor version explicitly', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const existing = await service.create({ name: 'Successor Target' });
-
-    const filePath = path.join(projectDir, 'divergent2.yaml');
-    await writeFile(
-      filePath,
-      stringifyYaml(
-        importableDocument({
-          ...existing,
-          title: 'Accepted Via CLI',
-        }),
-      ),
-      'utf8',
-    );
-
-    await runPrdy(['--import', filePath, '--accept-successor']);
-
-    const doc = await service.get(existing.id);
-    expect(doc.version).toBe(2);
-    expect(doc.title).toBe('Accepted Via CLI');
-    expect(doc.status).toBe('draft');
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
-  });
-
-  it('--export writes a labeled generated view and never touches authority', async () => {
-    const service = new PrdService({ projectPath: projectDir });
-    const created = await service.create({ name: 'Export Via CLI' });
-    const before = await service.get(created.id);
-
-    await runPrdy(['--export', created.id]);
-
-    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
-    const md = await readFile(mdPath, 'utf8');
-    expect(md).toContain('generated view — do not edit');
-    expect(md).toContain(`prd-id: ${created.id}`);
-    expect(md).toContain('prd-version: 1');
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining(`Generated view written: ${mdPath}`),
-    );
-
-    // Authority unchanged by the export.
-    expect(await service.get(created.id)).toEqual(before);
-  });
-});

packages/mosaic/src/commands/prdy.ts

@@ -2,10 +2,6 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';
 
-/**
- * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
- * All reads/writes go through the service; there is no local writer path.
- */
 export function registerPrdyCommand(program: Command) {
   const cmd = program
     .command('prdy')
@@ -13,18 +9,12 @@ export function registerPrdyCommand(program: Command) {
     .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
     .option('--init [name]', 'Create a new PRD')
     .option('--update [name]', 'Update an existing PRD')
-    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
-    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
-    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
     .option('--project <idOrName>', 'Scope to project')
     .action(
       async (opts: {
         gateway: string;
         init?: string | boolean;
         update?: string | boolean;
-        import?: string;
-        acceptSuccessor?: boolean;
-        export?: string | boolean;
         project?: string;
       }) => {
         // Detect project context when --project flag is provided
@@ -41,69 +31,20 @@ export function registerPrdyCommand(program: Command) {
           }
         }
 
-        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
-        const service = new PrdService({ projectPath: process.cwd() });
-
         try {
-          if (opts.import !== undefined) {
-            const input = { filePath: opts.import };
-
-            if (opts.acceptSuccessor) {
-              const successor = await service.acceptSuccessor(input);
-              console.log(
-                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
-              );
-              return;
-            }
-
-            const result = await service.importDocument(input);
-            console.log(
-              result.kind === 'created'
-                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
-                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
-            );
-            return;
-          }
-
-          if (opts.export !== undefined) {
-            const id =
-              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
-            const result = await service.exportMarkdown({ id });
-            console.log(
-              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
-            );
-            return;
-          }
-
+          const { runPrdWizard } = await import('@mosaicstack/prdy');
           const name =
             typeof opts.init === 'string'
               ? opts.init
               : typeof opts.update === 'string'
                 ? opts.update
                 : 'untitled';
-
-          if (process.stdout.isTTY) {
-            await runPrdWizard({
-              name,
-              projectPath: process.cwd(),
-              interactive: true,
-            });
-            return;
-          }
-
-          // Non-interactive fallback routes through the service directly.
-          const doc = await service.create({ name });
-          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
+          await runPrdWizard({
+            name,
+            projectPath: process.cwd(),
+            interactive: true,
+          });
         } catch (err) {
-          if (err instanceof Error && err.name === 'PrdImportConflictError') {
-            const conflict = err as { proposal?: { version?: number } };
-            console.error(`${err.message}`);
-            console.error(
-              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
-            );
-            process.exit(1);
-          }
-
           console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
           process.exit(1);
         }

packages/mosaic/src/fleet/brain-home.spec.ts

@@ -1,114 +0,0 @@
-import { mkdir, mkdtemp, rm } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  brainHomeIsActive,
-  fleetAgentEnvDir,
-  fleetProfilesDir,
-  fleetRolesLocalDir,
-  fleetStateDir,
-  resolveBrainHome,
-  type BrainHomeOptions,
-} from './brain-home.js';
-
-describe('fleet brain-home resolution', (): void => {
-  let cleanup: string | undefined;
-
-  const savedBrainEnv = process.env['MOSAIC_BRAIN_HOME'];
-
-  beforeEach((): void => {
-    delete process.env['MOSAIC_BRAIN_HOME'];
-  });
-
-  afterEach(async (): Promise<void> => {
-    if (savedBrainEnv === undefined) {
-      delete process.env['MOSAIC_BRAIN_HOME'];
-    } else {
-      process.env['MOSAIC_BRAIN_HOME'] = savedBrainEnv;
-    }
-    if (cleanup !== undefined) {
-      await rm(cleanup, { recursive: true, force: true });
-      cleanup = undefined;
-    }
-  });
-
-  async function makeTmp(): Promise<string> {
-    const root = await mkdtemp(join(tmpdir(), 'mosaic-brain-home-'));
-    cleanup = root;
-    return root;
-  }
-
-  it('MOSAIC_BRAIN_HOME env wins over every other signal', (): void => {
-    process.env['MOSAIC_BRAIN_HOME'] = '/explicit/brain';
-    expect(resolveBrainHome('/any/mosaic-home')).toBe('/explicit/brain');
-    expect(fleetAgentEnvDir('/any/mosaic-home')).toBe('/explicit/brain/fleet/agents');
-    expect(brainHomeIsActive('/any/mosaic-home')).toBe(true);
-  });
-
-  it('injected envBrainHome wins identically (test seam)', (): void => {
-    const opts: BrainHomeOptions = { envBrainHome: '/injected/brain' };
-    expect(resolveBrainHome('/any/mosaic-home', opts)).toBe('/injected/brain');
-    expect(fleetAgentEnvDir('/any/mosaic-home', opts)).toBe('/injected/brain/fleet/agents');
-  });
-
-  it('a non-default mosaicHome never adopts the canonical brain (hermetic legacy)', (): void => {
-    const mosaicHome = '/tmp/not-the-default-config-home';
-    expect(resolveBrainHome(mosaicHome)).toBe(mosaicHome);
-    expect(brainHomeIsActive(mosaicHome)).toBe(false);
-    expect(fleetAgentEnvDir(mosaicHome)).toBe(join(mosaicHome, 'fleet', 'agents'));
-  });
-
-  it('the default config home adopts the brain when it carries fleet/agents', async (): Promise<void> => {
-    const root = await makeTmp();
-    const brain = join(root, 'brain');
-    await mkdir(join(brain, 'fleet', 'agents'), { recursive: true });
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = { homes: { brain, configDefault: configHome } };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(brain);
-    expect(fleetAgentEnvDir(configHome, opts)).toBe(join(brain, 'fleet', 'agents'));
-    expect(fleetRolesLocalDir(configHome, opts)).toBe(join(brain, 'fleet', 'roles.local'));
-    expect(fleetProfilesDir(configHome, opts)).toBe(join(brain, 'fleet', 'profiles'));
-    expect(fleetStateDir(configHome, opts)).toBe(join(brain, 'fleet'));
-    expect(brainHomeIsActive(configHome, opts)).toBe(true);
-  });
-
-  it('the default config home stays legacy when no brain exists', async (): Promise<void> => {
-    const root = await makeTmp();
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = {
-      homes: { brain: join(root, 'brain'), configDefault: configHome },
-    };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(configHome);
-    expect(brainHomeIsActive(configHome, opts)).toBe(false);
-  });
-
-  it('an empty MOSAIC_BRAIN_HOME is ignored, not treated as set', (): void => {
-    process.env['MOSAIC_BRAIN_HOME'] = '   ';
-    expect(resolveBrainHome('/tmp/legacy-home')).toBe('/tmp/legacy-home');
-  });
-
-  it('adoption requires fleet/agents specifically, not any brain content', async (): Promise<void> => {
-    const root = await makeTmp();
-    const brain = join(root, 'brain');
-    await mkdir(join(brain, 'fleet'), { recursive: true }); // fleet without agents
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = { homes: { brain, configDefault: configHome } };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(configHome);
-  });
-
-  it('real-home control: a host brain is adopted only through the default home', (): void => {
-    // Control on the un-injected path: this host carries ~/.mosaic/fleet/agents,
-    // so the default config home resolves to the brain or legacy — both valid
-    // canonical endpoints — while a non-default home never adopts.
-    const defaultHome = join(homedir(), '.config', 'mosaic');
-    const resolved = resolveBrainHome(defaultHome);
-    expect([defaultHome, join(homedir(), '.mosaic')]).toContain(resolved);
-    expect(resolveBrainHome(join(homedir(), 'elsewhere', 'mosaic'))).toBe(
-      join(homedir(), 'elsewhere', 'mosaic'),
-    );
-  });
-});

packages/mosaic/src/fleet/brain-home.ts

@@ -1,76 +0,0 @@
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-
-/**
- * Overridable resolution inputs (tests inject tmp homes; production reads
- * the environment and the real home directory).
- */
-export interface BrainHomeOptions {
-  /** Explicit brain home; defaults to `MOSAIC_BRAIN_HOME`. */
-  readonly envBrainHome?: string;
-  /**
-   * Canonical homes used for adoption. Defaults derive from the real
-   * `homedir()`: `{ brain: ~/.mosaic, configDefault: ~/.config/mosaic }`.
-   */
-  readonly homes?: { readonly brain: string; readonly configDefault: string };
-}
-
-/**
- * Brain-home resolution — the three-tree fleet split (stack canon
- * `docs/STRUCTURE-CANON.md` §2, first carried by the USC estate brain):
- *
- *   config home (~/.config/mosaic)  framework templates + dispatch state:
- *                                   fleet/roles (baseline), fleet/roster.yaml,
- *                                   fleet/run (heartbeats), fleet/services
- *   brain home  (~/.mosaic)         user-owned fleet state, committed:
- *                                   fleet/agents/<seat>.env.*, fleet/roles.local,
- *                                   fleet/profiles working copies
- *
- * Resolution order:
- *   1. `MOSAIC_BRAIN_HOME` env (explicit, always wins)
- *   2. canonical `~/.mosaic` — adopted ONLY when mosaicHome is the real
- *      default config home AND `~/.mosaic/fleet/agents` exists. Custom
- *      `--mosaic-home` values (tests, sandboxes, canaries) never trigger
- *      adoption, keeping them hermetic and deterministic.
- *   3. mosaicHome itself (legacy single-tree behavior).
- */
-export function resolveBrainHome(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  const explicit = options.envBrainHome ?? process.env['MOSAIC_BRAIN_HOME'];
-  if (explicit !== undefined && explicit.trim() !== '') {
-    return explicit;
-  }
-  const homes = options.homes ?? {
-    brain: join(homedir(), '.mosaic'),
-    configDefault: join(homedir(), '.config', 'mosaic'),
-  };
-  if (resolve(mosaicHome) !== resolve(homes.configDefault)) {
-    return mosaicHome;
-  }
-  return existsSync(join(homes.brain, 'fleet', 'agents')) ? homes.brain : mosaicHome;
-}
-
-/** True when fleet state resolves somewhere other than the config home. */
-export function brainHomeIsActive(mosaicHome: string, options: BrainHomeOptions = {}): boolean {
-  return resolve(resolveBrainHome(mosaicHome, options)) !== resolve(mosaicHome);
-}
-
-/** Fleet state root (brain home when active, else the config home). */
-export function fleetStateDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(resolveBrainHome(mosaicHome, options), 'fleet');
-}
-
-/** Seat launch envs — `<brainHome>/fleet/agents` when a brain is active. */
-export function fleetAgentEnvDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'agents');
-}
-
-/** PRESERVE-protected persona override layer — `<brainHome>/fleet/roles.local`. */
-export function fleetRolesLocalDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'roles.local');
-}
-
-/** System-type profiles (user working copies) — `<brainHome>/fleet/profiles`. */
-export function fleetProfilesDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'profiles');
-}

packages/mosaic/src/fleet/fleet-reconciler.ts

@@ -3,7 +3,6 @@ import { lstat, open, readFile, unlink, type FileHandle } from 'node:fs/promises
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { fleetAgentEnvDir } from './brain-home.js';
 import {
   applyPreparedAgentEnvironmentProjection,
   prepareAgentEnvironmentProjection,
@@ -618,7 +617,7 @@ function defaultPrepareProjections(
         (agent: FleetRosterV2Agent): Promise<PreparedAgentEnvironmentProjection> =>
           prepareAgentEnvironmentProjection({
             mosaicHome,
-            agentEnvDir: fleetAgentEnvDir(mosaicHome),
+            agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
             agentName: agent.name,
             generated: projectRosterV2AgentGeneratedEnv(roster, agent),
           }),

packages/mosaic/src/fleet/generated-env-boundary.spec.ts

@@ -176,52 +176,6 @@ describe('generated fleet agent environment boundary', (): void => {
     expect((await stat(result.generatedPath)).mode & 0o777).toBe(0o600);
   });
 
-  it('brain home: accepts and writes projections under MOSAIC_BRAIN_HOME/fleet/agents', async (): Promise<void> => {
-    const savedBrainHome = process.env['MOSAIC_BRAIN_HOME'];
-    try {
-      cleanup = await mkdtemp(join(tmpdir(), 'mosaic-generated-env-'));
-      const mosaicHome = join(cleanup, 'config-home');
-      const brainHome = join(cleanup, 'brain');
-      const agentEnvDir = join(brainHome, 'fleet', 'agents');
-      process.env['MOSAIC_BRAIN_HOME'] = brainHome;
-
-      const result = await writeAgentEnvironmentProjection({
-        mosaicHome,
-        agentEnvDir,
-        agentName: 'coder0',
-        generated: generatedValues,
-      });
-
-      // Projection landed in the brain tree, not under the config home.
-      expect(result.generatedPath).toBe(join(agentEnvDir, 'coder0.env.generated'));
-      expect((await stat(join(brainHome, 'fleet'))).mode & 0o777).toBe(0o700);
-      expect((await stat(agentEnvDir)).mode & 0o777).toBe(0o700);
-      expect((await stat(result.generatedPath)).mode & 0o777).toBe(0o600);
-      await expect(stat(join(mosaicHome, 'fleet'))).rejects.toThrow();
-
-      // A config-home agentEnvDir is now REJECTED while the brain is active —
-      // the boundary must not silently split state across two trees.
-      let rejected: unknown;
-      try {
-        await writeAgentEnvironmentProjection({
-          mosaicHome,
-          agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
-          agentName: 'coder1',
-          generated: { ...generatedValues, MOSAIC_AGENT_NAME: 'coder1' },
-        });
-      } catch (caught: unknown) {
-        rejected = caught;
-      }
-      expect(rejected).toBeInstanceOf(AgentEnvBoundaryError);
-    } finally {
-      if (savedBrainHome === undefined) {
-        delete process.env['MOSAIC_BRAIN_HOME'];
-      } else {
-        process.env['MOSAIC_BRAIN_HOME'] = savedBrainHome;
-      }
-    }
-  });
-
   it('regenerates desired keys, relocates safe legacy local data, and quarantines forbidden legacy input', async (): Promise<void> => {
     cleanup = await mkdtemp(join(tmpdir(), 'mosaic-generated-env-'));
     const mosaicHome = join(cleanup, 'mosaic');

packages/mosaic/src/fleet/generated-env-boundary.ts

@@ -2,7 +2,6 @@ import { createHash, randomUUID } from 'node:crypto';
 import { chmod, lstat, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { fleetAgentEnvDir, resolveBrainHome } from './brain-home.js';
 import { compareCodePoints } from './deterministic-order.js';
 
 export type AgentEnvironmentKind = 'generated' | 'local';
@@ -529,15 +528,12 @@ async function validatePrivateProjectionDirectory(
   mosaicHome: string,
   agentEnvDir: string,
 ): Promise<void> {
-  // Brain-home split (canon §2): seat envs live under the brain home's
-  // fleet/agents when a brain is active; roster + templates stay config-home.
-  const expectedAgentEnvDir = fleetAgentEnvDir(mosaicHome);
+  const fleetDir = join(mosaicHome, 'fleet');
+  const expectedAgentEnvDir = join(fleetDir, 'agents');
   if (resolve(agentEnvDir) !== resolve(expectedAgentEnvDir)) {
     throw new AgentEnvBoundaryError('unsafe-directory', '(directory)', agentEnvDir);
   }
-  const stateHome = resolveBrainHome(mosaicHome);
-  const fleetDir = join(stateHome, 'fleet');
-  await assertManagedDirectoryIfPresent(stateHome, false);
+  await assertManagedDirectoryIfPresent(mosaicHome, false);
   await assertManagedDirectoryIfPresent(fleetDir, false);
   await assertManagedDirectoryIfPresent(agentEnvDir, true);
 }
@@ -547,9 +543,8 @@ async function ensurePrivateProjectionDirectory(
   agentEnvDir: string,
 ): Promise<void> {
   await validatePrivateProjectionDirectory(mosaicHome, agentEnvDir);
-  const stateHome = resolveBrainHome(mosaicHome);
-  const fleetDir = join(stateHome, 'fleet');
-  await ensureManagedDirectory(stateHome, false);
+  const fleetDir = join(mosaicHome, 'fleet');
+  await ensureManagedDirectory(mosaicHome, false);
   await ensureManagedDirectory(fleetDir, false);
   await ensureManagedDirectory(agentEnvDir, true);
 }

packages/prdy/src/cli.ts

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 
-import { PrdService } from './service.js';
+import { createPrd, listPrds, loadPrd } from './prd.js';
 import { runPrdWizard } from './wizard.js';
 
 interface InitCommandOptions {
@@ -18,22 +18,6 @@ interface ShowCommandOptions {
   readonly id?: string;
 }
 
-interface ImportCommandOptions {
-  readonly project: string;
-  readonly file: string;
-  readonly acceptSuccessor?: boolean;
-}
-
-interface ExportCommandOptions {
-  readonly project: string;
-  readonly id?: string;
-  readonly out?: string;
-}
-
-function serviceFor(project: string): PrdService {
-  return new PrdService({ projectPath: project });
-}
-
 export function buildPrdyCli(): Command {
   const program = new Command();
   program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -54,9 +38,11 @@ export function buildPrdyCli(): Command {
             template: options.template,
             interactive: true,
           })
-        : await serviceFor(options.project).create({
+        : await createPrd({
             name: options.name,
+            projectPath: options.project,
             template: options.template,
+            interactive: false,
           });
 
       console.log(
@@ -66,7 +52,6 @@ export function buildPrdyCli(): Command {
             id: doc.id,
             title: doc.title,
             status: doc.status,
-            version: doc.version,
             projectPath: doc.projectPath,
           },
           null,
@@ -80,7 +65,7 @@ export function buildPrdyCli(): Command {
     .description('List PRD documents for a project')
     .requiredOption('--project <path>', 'Project path')
     .action(async (options: ListCommandOptions) => {
-      const docs = await serviceFor(options.project).list();
+      const docs = await listPrds(options.project);
       console.log(JSON.stringify(docs, null, 2));
     });
 
@@ -90,65 +75,20 @@ export function buildPrdyCli(): Command {
     .requiredOption('--project <path>', 'Project path')
     .option('--id <id>', 'PRD document id')
     .action(async (options: ShowCommandOptions) => {
-      const doc = await serviceFor(options.project).get(options.id);
-      console.log(JSON.stringify(doc, null, 2));
-    });
+      if (options.id !== undefined) {
+        const docs = await listPrds(options.project);
+        const match = docs.find((doc) => doc.id === options.id);
 
-  prdy
-    .command('import')
-    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
-    .requiredOption('--project <path>', 'Project path')
-    .requiredOption('--file <file>', 'Path to YAML PRD document')
-    .option('--accept-successor', 'Accept a conflicted import as the next version')
-    .action(async (options: ImportCommandOptions) => {
-      const service = serviceFor(options.project);
-      const input = { filePath: options.file };
+        if (match === undefined) {
+          throw new Error(`PRD id not found: ${options.id}`);
+        }
 
-      if (options.acceptSuccessor) {
-        const successor = await service.acceptSuccessor(input);
-        console.log(
-          JSON.stringify(
-            {
-              ok: true,
-              outcome: 'successor-accepted',
-              id: successor.id,
-              version: successor.version,
-            },
-            null,
-            2,
-          ),
-        );
+        console.log(JSON.stringify(match, null, 2));
         return;
       }
 
-      const result = await service.importDocument(input);
-      console.log(
-        JSON.stringify(
-          {
-            ok: true,
-            outcome: result.kind,
-            id: result.document.id,
-            version: result.document.version,
-            status: result.document.status,
-          },
-          null,
-          2,
-        ),
-      );
-    });
-
-  prdy
-    .command('export')
-    .description('Render a PRD to a labeled generated-view Markdown file')
-    .requiredOption('--project <path>', 'Project path')
-    .option('--id <id>', 'PRD document id')
-    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
-    .action(async (options: ExportCommandOptions) => {
-      const result = await serviceFor(options.project).exportMarkdown({
-        id: options.id,
-        outPath: options.out,
-      });
-      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
+      const doc = await loadPrd(options.project);
+      console.log(JSON.stringify(doc, null, 2));
     });
 
   return program;

packages/prdy/src/index.ts

@@ -1,35 +1,12 @@
-// PrdService is the single authority surface for PRD documents. The raw store
-// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
-// goes through the service so there is no second writer path.
-export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
+export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
-export {
-  PrdService,
-  PRD_GENERATED_VIEW_LABEL,
-  PrdError,
-  PrdNotFoundError,
-  PrdUpdateError,
-  PrdImportInvalidError,
-  PrdImportConflictError,
-} from './service.js';
 export type {
   PrdStatus,
   PrdTemplate,
   PrdTemplateSection,
   PrdSection,
-  PrdMissionLinkage,
   PrdDocument,
   CreatePrdOptions,
-  PrdServiceOptions,
-  PrdCreateInput,
-  PrdSectionPatch,
-  PrdUpdateInput,
-  PrdLinkMissionInput,
-  PrdPlanForMissionInput,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
 } from './types.js';

packages/prdy/src/prd.ts

@@ -17,49 +17,17 @@ const prdSectionSchema = z.object({
   fields: z.record(z.string(), z.string()),
 });
 
-const prdMissionLinkageSchema = z.object({
-  missionId: z.string().min(1),
-  missionVersion: z.string().min(1),
-  prdVersion: z.number().int().min(1),
-  requirementIds: z.array(z.string()),
-  linkedAt: z.string().datetime(),
-});
-
 const prdDocumentSchema = z.object({
   id: z.string().min(1),
   title: z.string().min(1),
   status: z.enum(['draft', 'review', 'approved', 'archived']),
   projectPath: z.string().min(1),
   template: z.string().min(1),
-  // Defaults keep documents written by older prdy versions loadable.
-  version: z.number().int().min(1).default(1),
   sections: z.array(prdSectionSchema),
-  missions: z.array(prdMissionLinkageSchema).default([]),
   createdAt: z.string().datetime(),
   updatedAt: z.string().datetime(),
 });
 
-/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
-function coerceTimestamps(value: unknown): unknown {
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  if (Array.isArray(value)) {
-    return value.map(coerceTimestamps);
-  }
-  if (typeof value === 'object' && value !== null) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
-    );
-  }
-  return value;
-}
-
-/** Validate an unknown value as a PRD document (throws zod errors on failure). */
-export function parsePrdDocument(value: unknown): PrdDocument {
-  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
-}
-
 function expandHome(projectPath: string): string {
   if (!projectPath.startsWith('~')) {
     return projectPath;
@@ -106,8 +74,6 @@ function prdDirectory(projectPath: string): string {
   return path.join(projectPath, PRD_DIRECTORY);
 }
 
-export { prdDirectory };
-
 function prdFilePath(projectPath: string, id: string): string {
   return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -147,13 +113,11 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
     status: 'draft',
     projectPath: resolvedProjectPath,
     template: template.id,
-    version: 1,
     sections: template.sections.map((section) => ({
       id: section.id,
       title: section.title,
       fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
     })),
-    missions: [],
     createdAt: now,
     updatedAt: now,
   };
@@ -226,7 +190,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
       throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
     }
 
-    const document = parsePrdDocument(parsed);
+    const document = prdDocumentSchema.parse(parsed);
     documents.push(document);
   }
 

packages/prdy/src/service.spec.ts

@@ -1,433 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-import { beforeEach, describe, expect, it } from 'vitest';
-
-import {
-  PRD_GENERATED_VIEW_LABEL,
-  PrdImportConflictError,
-  PrdImportInvalidError,
-  PrdNotFoundError,
-  PrdService,
-  PrdUpdateError,
-} from './index.js';
-import type { PrdDocument } from './index.js';
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-let projectDir: string;
-
-async function makeProject(): Promise<string> {
-  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
-}
-
-function service(): PrdService {
-  return new PrdService({ projectPath: projectDir });
-}
-
-function storeDir(): string {
-  return path.join(projectDir, 'docs', 'prdy');
-}
-
-/** Handcraft a full, schema-valid PRD document for import scenarios. */
-function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
-  return {
-    id: 'imported-prd-20260101-000000',
-    title: 'Imported PRD',
-    status: 'draft',
-    projectPath: '/tmp/elsewhere',
-    template: 'software',
-    version: 1,
-    sections: [
-      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
-      {
-        id: 'scope-non-goals',
-        title: 'Scope / Non-Goals',
-        fields: { inScope: '', outOfScope: '' },
-      },
-    ],
-    missions: [],
-    createdAt: '2026-01-01T00:00:00.000Z',
-    updatedAt: '2026-01-01T00:00:00.000Z',
-    ...overrides,
-  };
-}
-
-async function writeImportFile(doc: PrdDocument): Promise<string> {
-  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
-  await writeFile(filePath, yaml.dump(doc), 'utf8');
-  return filePath;
-}
-
-beforeEach(async () => {
-  projectDir = await makeProject();
-});
-
-// ── Single authority store (AC: prdy path and mission path resolve to the
-//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
-
-describe('PrdService single authority store', () => {
-  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
-    const direct = await service().create({ name: 'Direct PRD' });
-    const viaMission = await service().planForMission({
-      name: 'Mission PRD',
-      missionId: 'mission-1',
-      missionVersion: '2026-01-01T00:00:00.000Z',
-    });
-
-    const files = await readdir(storeDir());
-    expect(files).toContain(`${direct.id}.yaml`);
-    expect(files).toContain(`${viaMission.id}.yaml`);
-
-    // A fresh service instance (new process equivalent) resolves both.
-    const all = await service().list();
-    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
-
-    // Stable versions: creation is v1; linkage writes do not bump content version.
-    expect((await service().get(direct.id)).version).toBe(1);
-    expect((await service().get(viaMission.id)).version).toBe(1);
-  });
-
-  it('round-trips documents through the store with identity intact', async () => {
-    const created = await service().create({ name: 'Round Trip', template: 'feature' });
-    const fresh = await service().get(created.id);
-
-    expect(fresh).toEqual(created);
-    expect(fresh.id).toBe(created.id);
-    expect(fresh.template).toBe('feature');
-    expect(fresh.status).toBe('draft');
-  });
-
-  it('throws a typed error for unknown ids and empty stores', async () => {
-    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
-    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── Mission linkage persistence (AC: linkage survives restart via fresh
-//    service instances) ────────────────────────────────────────────────────────
-
-describe('PrdService mission linkage', () => {
-  it('persists linkage and reads it back from a fresh service instance', async () => {
-    const created = await service().planForMission({
-      name: 'Linked PRD',
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Fresh instance — nothing in memory from the creating call.
-    const links = await service().listMissionLinks(created.id);
-    expect(links).toHaveLength(1);
-    expect(links[0]).toMatchObject({
-      missionId: 'mission-42',
-      missionVersion: '2026-02-03T04:05:06.000Z',
-      prdVersion: 1,
-      requirementIds: ['FR-1', 'FR-2'],
-    });
-
-    // Linkage is carried in the YAML authority file itself.
-    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    const persisted = yaml.load(raw) as PrdDocument;
-    expect(persisted.missions[0]?.missionId).toBe('mission-42');
-    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
-  });
-
-  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
-    const created = await service().planForMission({
-      name: 'Relink PRD',
-      missionId: 'mission-7',
-      missionVersion: 'v1',
-    });
-
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
-    });
-
-    const relinked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'mission-7',
-      missionVersion: 'v2',
-      requirementIds: ['NFR-1'],
-    });
-
-    expect(relinked.missions).toHaveLength(1);
-    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
-  });
-
-  it('does not bump the content version when writing linkage', async () => {
-    const created = await service().create({ name: 'Stable Version' });
-    const linked = await service().linkMission({
-      prdId: created.id,
-      missionId: 'm',
-      missionVersion: 'v1',
-    });
-    expect(linked.version).toBe(1);
-  });
-});
-
-// ── Update semantics ──────────────────────────────────────────────────────────
-
-describe('PrdService update', () => {
-  it('applies section patches and bumps the content version', async () => {
-    const created = await service().create({ name: 'Updatable' });
-    const updated = await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
-    });
-
-    expect(updated.version).toBe(2);
-    expect(updated.sections[0]?.fields).toMatchObject({
-      context: 'Some context',
-      objective: 'Goal',
-    });
-    expect((await service().get(created.id)).version).toBe(2);
-  });
-
-  it('refuses unknown section ids with a typed error', async () => {
-    const created = await service().create({ name: 'Strict' });
-    await expect(
-      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
-    ).rejects.toBeInstanceOf(PrdUpdateError);
-  });
-});
-
-// ── Markdown export is a labeled generated view, never authority ──────────────
-
-describe('PrdService exportMarkdown', () => {
-  it('writes a generated view carrying the label and source identity', async () => {
-    const created = await service().create({ name: 'Exported PRD' });
-    const result = await service().exportMarkdown({ id: created.id });
-
-    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
-    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
-    expect(result.content).toContain(`prd-id: ${created.id}`);
-    expect(result.content).toContain('prd-version: 1');
-    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
-  });
-
-  it('reflects the current version after updates', async () => {
-    const created = await service().create({ name: 'Versioned Export' });
-    await service().update({
-      id: created.id,
-      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
-    });
-    const result = await service().exportMarkdown({ id: created.id });
-    expect(result.content).toContain('prd-version: 2');
-  });
-
-  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
-    const created = await service().create({ name: 'Guarded PRD' });
-    const before = structuredClone(await service().get(created.id));
-
-    const result = await service().exportMarkdown({ id: created.id });
-    await writeFile(
-      result.filePath,
-      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
-      'utf8',
-    );
-
-    const after = await service().get(created.id);
-    expect(after).toEqual(before);
-    expect(after.version).toBe(1);
-    expect(after.title).toBe(before.title);
-  });
-
-  it('never parses Markdown files that sit in the store directory', async () => {
-    const created = await service().create({ name: 'Decoy Guard' });
-
-    // A decoy .md file with invalid YAML must be invisible to the store.
-    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
-    // And a decoy .yaml-named Markdown body must not silently validate either.
-    await service().exportMarkdown({ id: created.id });
-
-    const listed = await service().list();
-    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
-    await expect(service().get(created.id)).resolves.toBeTruthy();
-  });
-});
-
-// ── Import: validated, conflict-aware, never silently merging ─────────────────
-
-describe('PrdService importDocument', () => {
-  it('creates a valid import through the service, as draft — validity is not approval', async () => {
-    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
-
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('created');
-    expect(result.document.id).toBe('imported-prd-20260101-000000');
-    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
-    expect(result.document.version).toBe(1);
-
-    const persisted = await service().get('imported-prd-20260101-000000');
-    expect(persisted.status).toBe('draft');
-
-    const files = await readdir(storeDir());
-    expect(files).toContain('imported-prd-20260101-000000.yaml');
-  });
-
-  it('reports identical content as a no-op without writing', async () => {
-    const created = await service().create({ name: 'Existing PRD' });
-    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-
-    const filePath = await writeImportFile(importFixture({ ...created }));
-    const result = await service().importDocument({ filePath });
-
-    expect(result.kind).toBe('identical');
-    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
-    expect(after).toBe(before);
-  });
-
-  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
-    const existing = await service().create({ name: 'Authority PRD' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-      requirementIds: ['FR-0'],
-    });
-    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Divergent Title',
-      sections: [
-        {
-          id: 'introduction',
-          title: 'Introduction',
-          fields: { context: 'changed', objective: '' },
-        },
-      ],
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const attempt = service().importDocument({ filePath });
-    let caught: unknown;
-    try {
-      await attempt;
-    } catch (error) {
-      caught = error;
-    }
-    expect(caught).toBeInstanceOf(PrdImportConflictError);
-
-    const error = caught as PrdImportConflictError;
-    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
-    expect(error.existing.id).toBe(existing.id);
-    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
-    expect(error.proposal.status).toBe('draft');
-
-    // Original authority content untouched on disk.
-    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
-    expect(afterBytes).toBe(beforeBytes);
-  });
-
-  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
-    const existing = await service().create({ name: 'Successor Base' });
-    await service().linkMission({
-      prdId: existing.id,
-      missionId: 'mission-keep',
-      missionVersion: 'v1',
-    });
-
-    const divergent = importFixture({
-      ...existing,
-      title: 'Accepted Successor Title',
-    });
-    const filePath = await writeImportFile(divergent);
-
-    const successor = await service().acceptSuccessor({ filePath });
-    expect(successor.id).toBe(existing.id);
-    expect(successor.version).toBe(existing.version + 1);
-    expect(successor.title).toBe('Accepted Successor Title');
-    expect(successor.status).toBe('draft');
-    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
-
-    // Persisted for a fresh reader.
-    const fresh = await service().get(existing.id);
-    expect(fresh.version).toBe(2);
-    expect(fresh.title).toBe('Accepted Successor Title');
-  });
-
-  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
-    const cases: Array<{ name: string; body: string }> = [
-      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
-      {
-        name: 'bad-status.yaml',
-        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
-      },
-      {
-        name: 'bad-version.yaml',
-        body: yaml.dump(importFixture({ version: 0 })),
-      },
-      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
-    ];
-
-    for (const fixture of cases) {
-      const filePath = path.join(projectDir, fixture.name);
-      await writeFile(filePath, fixture.body, 'utf8');
-
-      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
-        PrdImportInvalidError,
-      );
-    }
-
-    // Nothing was created: the authority store does not even exist yet.
-    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
-  });
-
-  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
-    const filePath = await writeImportFile(importFixture());
-    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
-  });
-});
-
-// ── No second writer: no code path reads exported Markdown back into authority ─
-
-describe('no-second-writer invariant (source-level)', () => {
-  // Resolve the package source dir whether vitest runs from the package root
-  // (turbo/pnpm test) or from the worktree root.
-  function resolveSrcDir(): string {
-    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
-    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
-  }
-
-  const srcDir = resolveSrcDir();
-  const sourceFiles = [
-    'cli.ts',
-    'index.ts',
-    'prd.ts',
-    'service.ts',
-    'templates.ts',
-    'types.ts',
-    'wizard.ts',
-  ];
-
-  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
-    for (const file of sourceFiles) {
-      const text = await readFile(path.join(srcDir, file), 'utf8');
-      const readLines = text
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
-
-      for (const line of readLines) {
-        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
-      }
-    }
-  });
-
-  it('the mosaic prdy/mission adapters never read a .md file', async () => {
-    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
-    for (const file of ['prdy.ts', 'mission.ts']) {
-      const text = await readFile(path.join(adapterDir, file), 'utf8');
-      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
-        false,
-      );
-    }
-  });
-});

packages/prdy/src/service.ts

@@ -1,379 +0,0 @@
-import { promises as fs } from 'node:fs';
-import path from 'node:path';
-
-import yaml from 'js-yaml';
-
-import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
-import type {
-  PrdCreateInput,
-  PrdDocument,
-  PrdExportInput,
-  PrdExportResult,
-  PrdImportInput,
-  PrdImportResult,
-  PrdLinkMissionInput,
-  PrdMissionLinkage,
-  PrdPlanForMissionInput,
-  PrdServiceOptions,
-  PrdUpdateInput,
-} from './types.js';
-
-/**
- * PrdService is the SINGLE authority surface for PRD documents.
- *
- * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
- * through this service; the YAML store under `docs/prdy/` is the authority and
- * exported Markdown is a generated view that no code path reads back.
- */
-
-// ── Typed errors ───────────────────────────────────────────────────────────────
-
-export class PrdError extends Error {
-  constructor(
-    message: string,
-    readonly code: string,
-  ) {
-    super(message);
-    this.name = 'PrdError';
-  }
-}
-
-export class PrdNotFoundError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_NOT_FOUND');
-    this.name = 'PrdNotFoundError';
-  }
-}
-
-export class PrdUpdateError extends PrdError {
-  constructor(message: string) {
-    super(message, 'PRD_UPDATE_INVALID');
-    this.name = 'PrdUpdateError';
-  }
-}
-
-/** Structural refusal: the import payload failed schema validation. Nothing is written. */
-export class PrdImportInvalidError extends PrdError {
-  constructor(
-    message: string,
-    readonly issues?: string,
-  ) {
-    super(message, 'PRD_IMPORT_INVALID');
-    this.name = 'PrdImportInvalidError';
-  }
-}
-
-/**
- * Conflict refusal: an existing PRD shares the imported id but the content
- * diverges. Carries a PROPOSED successor (existing version + 1) that is only
- * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
- * never overwrites and never merges.
- */
-export class PrdImportConflictError extends PrdError {
-  constructor(
-    message: string,
-    readonly existing: PrdDocument,
-    readonly proposal: PrdDocument,
-  ) {
-    super(message, 'PRD_IMPORT_CONFLICT');
-    this.name = 'PrdImportConflictError';
-  }
-}
-
-// ── Service ────────────────────────────────────────────────────────────────────
-
-/** The generated-view label carried by every Markdown export. */
-export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
-
-export class PrdService {
-  private readonly projectPath: string;
-
-  constructor(options: PrdServiceOptions) {
-    this.projectPath = options.projectPath;
-  }
-
-  /** Create a new PRD (version 1, draft) in the authority store. */
-  async create(input: PrdCreateInput): Promise<PrdDocument> {
-    return createPrd({
-      name: input.name,
-      projectPath: this.projectPath,
-      template: input.template,
-      interactive: false,
-    });
-  }
-
-  /** Read a PRD by id, or the most recently updated one. */
-  async get(id?: string): Promise<PrdDocument> {
-    const documents = await listPrds(this.projectPath);
-
-    if (id === undefined) {
-      const latest = documents[0];
-      if (latest === undefined) {
-        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
-      }
-      return latest;
-    }
-
-    const match = documents.find((doc) => doc.id === id);
-    if (match === undefined) {
-      throw new PrdNotFoundError(`PRD id not found: ${id}`);
-    }
-    return match;
-  }
-
-  /** List all PRDs in the authority store (most recently updated first). */
-  async list(): Promise<PrdDocument[]> {
-    return listPrds(this.projectPath);
-  }
-
-  /**
-   * Apply section field patches and bump the content version.
-   * Linkage entries are preserved; linkage writes do NOT bump the version.
-   */
-  async update(input: PrdUpdateInput): Promise<PrdDocument> {
-    const doc = await this.get(input.id);
-
-    for (const patch of input.sections) {
-      const section = doc.sections.find((candidate) => candidate.id === patch.id);
-      if (section === undefined) {
-        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
-      }
-      for (const [field, value] of Object.entries(patch.fields)) {
-        if (!(field in section.fields)) {
-          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
-        }
-        section.fields[field] = value;
-      }
-    }
-
-    doc.version += 1;
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  /**
-   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
-   * Persisted in the YAML authority, so it survives restarts.
-   */
-  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const doc = await this.get(input.prdId);
-    return this.applyLinkage(doc, input);
-  }
-
-  /** Read back the mission linkages recorded on a PRD. */
-  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
-    const doc = await this.get(prdId);
-    return doc.missions;
-  }
-
-  /**
-   * Mission planning path: create a PRD for a mission AND persist the
-   * mission↔PRD linkage in a single authority write.
-   */
-  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
-    const doc = await this.create({ name: input.name, template: input.template });
-    return this.applyLinkage(doc, {
-      prdId: doc.id,
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      requirementIds: input.requirementIds,
-    });
-  }
-
-  /**
-   * Render the PRD to a Markdown GENERATED VIEW.
-   *
-   * The output carries source identity (PRD id + version + generated-view
-   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
-   * the authority store only loads `.yaml`/`.yml` files, and no code path in
-   * this package parses the exported Markdown.
-   */
-  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
-    const doc = await this.get(input?.id);
-    const content = renderMarkdown(doc);
-    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
-
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, content, 'utf8');
-    return { filePath, content };
-  }
-
-  /**
-   * Import a YAML PRD document.
-   *
-   * Structural validation (zod) happens BEFORE anything is proposed or
-   * written. A structurally-valid import is persisted as `draft` — validity is
-   * NOT approval. If an existing PRD shares the id with divergent content, a
-   * typed {@link PrdImportConflictError} is thrown carrying a proposed
-   * successor; the original authority document is left byte-identical on disk.
-   */
-  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      const document = this.buildImportedDocument(incoming);
-      await savePrd(document);
-      return { kind: 'created', document };
-    }
-
-    if (canonicalCore(existing) === canonicalCore(incoming)) {
-      return { kind: 'identical', document: existing };
-    }
-
-    throw new PrdImportConflictError(
-      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
-        `Proposed successor: version ${existing.version + 1} (draft). ` +
-        `Accept explicitly with acceptSuccessor().`,
-      existing,
-      this.buildSuccessor(existing, incoming),
-    );
-  }
-
-  /**
-   * Explicitly accept a conflicted import as a successor version of the
-   * existing PRD. Re-validates the source file before writing; the successor
-   * is persisted with status `draft` (acceptance of the import is not approval
-   * of the PRD) and the existing mission linkages are carried forward.
-   */
-  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
-    const incoming = await this.readImportFile(input.filePath);
-
-    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
-    if (existing === undefined) {
-      throw new PrdNotFoundError(
-        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
-      );
-    }
-
-    const successor = this.buildSuccessor(existing, incoming);
-    await savePrd(successor);
-    return successor;
-  }
-
-  // ── internals ──────────────────────────────────────────────────────────────
-
-  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
-    const entry: PrdMissionLinkage = {
-      missionId: input.missionId,
-      missionVersion: input.missionVersion,
-      prdVersion: doc.version,
-      requirementIds: input.requirementIds ?? [],
-      linkedAt: new Date().toISOString(),
-    };
-
-    // One entry per mission: refresh in place if the mission is already linked.
-    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
-    if (index === -1) {
-      doc.missions.push(entry);
-    } else {
-      doc.missions[index] = entry;
-    }
-
-    // Linkage is mission-side metadata, not a content revision: bump the
-    // timestamp only so ids/versions stay stable for consumers.
-    doc.updatedAt = new Date().toISOString();
-    await savePrd(doc);
-    return doc;
-  }
-
-  private async readImportFile(filePath: string): Promise<PrdDocument> {
-    let raw: string;
-    try {
-      raw = await fs.readFile(filePath, 'utf8');
-    } catch (error) {
-      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
-    }
-
-    let parsed: unknown;
-    try {
-      parsed = yaml.load(raw);
-    } catch (error) {
-      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
-    }
-
-    try {
-      return parsePrdDocument(parsed);
-    } catch (error) {
-      throw new PrdImportInvalidError(
-        `Import file failed PRD schema validation: ${filePath}`,
-        error instanceof Error ? error.message : String(error),
-      );
-    }
-  }
-
-  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
-    const now = new Date().toISOString();
-    return {
-      ...incoming,
-      // The import lands in THIS project's authority store.
-      projectPath: this.projectPath,
-      // A structurally-valid import is not thereby approved.
-      status: 'draft',
-      version: 1,
-      missions: [],
-      createdAt: now,
-      updatedAt: now,
-    };
-  }
-
-  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
-    return {
-      ...incoming,
-      id: existing.id,
-      projectPath: existing.projectPath,
-      status: 'draft',
-      version: existing.version + 1,
-      missions: existing.missions,
-      createdAt: existing.createdAt,
-      updatedAt: new Date().toISOString(),
-    };
-  }
-}
-
-// ── Markdown rendering (generated view) ───────────────────────────────────────
-
-function canonicalCore(doc: PrdDocument): string {
-  return JSON.stringify([doc.title, doc.template, doc.sections]);
-}
-
-function renderMarkdown(doc: PrdDocument): string {
-  const lines: string[] = [
-    '<!--',
-    `${PRD_GENERATED_VIEW_LABEL}`,
-    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
-    `prd-id: ${doc.id}`,
-    `prd-version: ${doc.version}`,
-    `generated-at: ${new Date().toISOString()}`,
-    '-->',
-    '',
-    `# ${doc.title}`,
-    '',
-    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
-    '',
-  ];
-
-  if (doc.missions.length > 0) {
-    lines.push('## Mission Linkage', '');
-    for (const mission of doc.missions) {
-      const requirements =
-        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
-      lines.push(
-        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
-          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
-      );
-    }
-    lines.push('');
-  }
-
-  for (const section of doc.sections) {
-    lines.push(`## ${section.title}`, '');
-    for (const [field, value] of Object.entries(section.fields)) {
-      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
-    }
-  }
-
-  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
-  return lines.join('\n');
-}

packages/prdy/src/types.ts

@@ -19,31 +19,13 @@ export interface PrdSection {
   fields: Record<string, string>;
 }
 
-/**
- * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
- *
- * `missionVersion` is the mission-side revision marker available to the CLI
- * (the gateway exposes `updatedAt` for missions — there is no numeric mission
- * version yet). `prdVersion` snapshots the PRD content version at link time.
- */
-export interface PrdMissionLinkage {
-  missionId: string;
-  missionVersion: string;
-  prdVersion: number;
-  requirementIds: string[];
-  linkedAt: string;
-}
-
 export interface PrdDocument {
   id: string;
   title: string;
   status: PrdStatus;
   projectPath: string;
   template: string;
-  /** Content revision counter. Bumped by updates and accepted imports. */
-  version: number;
   sections: PrdSection[];
-  missions: PrdMissionLinkage[];
   createdAt: string;
   updatedAt: string;
 }
@@ -54,60 +36,3 @@ export interface CreatePrdOptions {
   template?: string;
   interactive?: boolean;
 }
-
-// ── PrdService surface (single authority entry point) ─────────────────────────
-
-export interface PrdServiceOptions {
-  projectPath: string;
-}
-
-export interface PrdCreateInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdSectionPatch {
-  id: string;
-  fields: Record<string, string>;
-}
-
-export interface PrdUpdateInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  sections: PrdSectionPatch[];
-}
-
-export interface PrdLinkMissionInput {
-  /** Defaults to the most recently updated PRD. */
-  prdId?: string;
-  missionId: string;
-  missionVersion: string;
-  requirementIds?: string[];
-}
-
-export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
-  name: string;
-  template?: string;
-}
-
-export interface PrdExportInput {
-  /** Defaults to the most recently updated PRD. */
-  id?: string;
-  /** Override the generated-view output path. */
-  outPath?: string;
-}
-
-export interface PrdExportResult {
-  filePath: string;
-  content: string;
-}
-
-/** Discriminated result of a non-conflicting import. */
-export type PrdImportResult =
-  | { kind: 'created'; document: PrdDocument }
-  | { kind: 'identical'; document: PrdDocument };
-
-export interface PrdImportInput {
-  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
-  filePath: string;
-}

packages/prdy/src/wizard.ts

@@ -2,8 +2,8 @@ import path from 'node:path';
 
 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';
 
-import { PrdService } from './service.js';
-import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';
+import { createPrd, savePrd } from './prd.js';
+import type { CreatePrdOptions, PrdDocument } from './types.js';
 
 interface WizardAnswers {
   goals: string;
@@ -11,41 +11,20 @@ interface WizardAnswers {
   milestones: string;
 }
 
-/**
- * Translate wizard answers into section patches using the same keyword
- * matching the wizard always used (first section whose id contains the
- * keyword, then first field whose name contains it, else first field).
- */
-function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
-  const bySection = new Map<string, PrdSectionPatch>();
+function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
+  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));
 
-  const add = (keyword: string, value: string): void => {
-    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
-    if (section === undefined) {
-      return;
-    }
+  if (section === undefined) {
+    return;
+  }
 
-    const fieldName =
-      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
-      Object.keys(section.fields)[0];
+  const fieldName =
+    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
+    Object.keys(section.fields)[0];
 
-    if (fieldName === undefined || section.fields[fieldName] === value) {
-      return;
-    }
-
-    const existing = bySection.get(section.id);
-    if (existing === undefined) {
-      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
-    } else {
-      existing.fields[fieldName] = value;
-    }
-  };
-
-  add('goal', answers.goals);
-  add('constraint', answers.constraints);
-  add('milestone', answers.milestones);
-
-  return [...bySection.values()];
+  if (fieldName !== undefined) {
+    section.fields[fieldName] = value;
+  }
 }
 
 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -84,10 +63,15 @@ async function promptTemplate(template?: string): Promise<string> {
   return choice;
 }
 
-/**
- * Interactive PRD wizard. All writes go through PrdService — the wizard is a
- * prompt layer, never a second writer path.
- */
+function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
+  updateSectionField(doc, 'goal', answers.goals);
+  updateSectionField(doc, 'constraint', answers.constraints);
+  updateSectionField(doc, 'milestone', answers.milestones);
+
+  doc.updatedAt = new Date().toISOString();
+  return doc;
+}
+
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
   intro('Mosaic PRD wizard');
 
@@ -98,15 +82,20 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
   const constraints = await promptText('Key constraints');
   const milestones = await promptText('Planned milestones');
 
-  const service = new PrdService({ projectPath: options.projectPath });
-  const doc = await service.create({
+  const doc = await createPrd({
+    ...options,
     name,
     template,
+    interactive: true,
   });
 
-  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
-  const updated =
-    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;
+  const updated = applyWizardAnswers(doc, {
+    goals,
+    constraints,
+    milestones,
+  });
+
+  await savePrd(updated);
 
   outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);
 

packages/quality-rails/README.md

@@ -1,63 +0,0 @@
-# @mosaicstack/quality-rails
-
-Quality-rails scaffolding and — since RI-3-002 (RI-N4) — the **typed
-quality-rails evaluator**: the single authoritative producer of check verdicts
-for the checks it owns.
-
-## Evaluator (RI-N4)
-
-Every verdict is typed and fail-closed:
-
-```
-{ status: 'passed' | 'failed' | 'blocked' | 'error' | 'not-applicable',
-  checkId, checkVersion, subject, reason }
-```
-
-Missing implementations, missing inputs, unknown check ids, process errors,
-timeouts, and malformed probe output can never become `passed` or an
-unqualified skip — they surface as `blocked`/`error` with a reason (vocabulary
-mirrors MACP's `GateStatus` discipline).
-
-- Check definitions live as **data** with a version and a sha256 content
-  digest (`definitionDigest`); every recorded verdict names the definition
-  version that produced it.
-- Check sets are selected **per subject kind** (`node`, `python`, `rust`,
-  `monorepo`, `unknown`) via the versioned, digested check-set policy — this
-  repository (a `monorepo` subject) does not share the node template's file
-  list.
-- Shell probes stay **thin adapters**: the TS evaluator invokes them and owns
-  the verdict parsing (e.g. QC-20's planted-commit probe).
-
-### Owned checks
-
-| check id                    | canonical check | mechanism                                                              |
-| --------------------------- | --------------- | ---------------------------------------------------------------------- |
-| `qc-19-rails-files-present` | QC-19           | typed absorption of the former presence-only `check`/`doctor` loop     |
-| `qc-20-enforcement-verify`  | QC-20           | thin shell adapter (framework `verify.sh`); verdict parsing owned here |
-
-The canonical check ids QC-1..QC-21 and their dispositions are defined in
-`docs/release-integrity/probe-inventory.md` (the RI-3-001 inventory — the
-evaluator's input, not its output).
-
-### Usage
-
-```sh
-# CLI (same typed report as the programmatic API)
-node dist/cli.js quality-rails evaluate --project <path> [--probe-path <verify.sh>] [--json]
-node dist/cli.js quality-rails check --project <path> [--json]   # QC-19 only, fail-closed exit
-```
-
-```ts
-import { evaluateSubject } from '@mosaicstack/quality-rails';
-
-const report = await evaluateSubject({ subjectPath: '/path/to/project' });
-// report.state: 'passed' | 'failed' | 'blocked' | 'error'
-```
-
-`pnpm verify:release` invokes this evaluator as its `quality-rails` stage
-(canonical-only stage, QC-19 on the monorepo subject).
-
-## Scaffolding (pre-existing)
-
-`init` scaffolds rails files per detected kind/profile; `doctor` is advisory
-and reports typed states.

packages/quality-rails/src/cli-evaluate.spec.ts

@@ -1,194 +0,0 @@
-import { mkdir, mkdtemp, writeFile, chmod } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { createQualityRailsCli } from './cli.js';
-import { QC_19_RAILS_FILES_PRESENT } from './evaluator/definitions.js';
-import { evaluateSubject } from './evaluator/runner.js';
-import type { EvaluationReport } from './evaluator/types.js';
-
-// CLI ↔ programmatic contract (RI-3-002): the same subject must produce the
-// same typed verdicts through every entry point the card adds — the
-// `evaluate`/`check` CLI surfaces and the `evaluateSubject` API.
-
-async function makeTempDir(): Promise<string> {
-  return mkdtemp(join(tmpdir(), 'qr-cli-'));
-}
-
-async function scaffoldNodeFixture(skip: string[] = []): Promise<string> {
-  const dir = await makeTempDir();
-  await writeFile(join(dir, 'package.json'), '{}\n', 'utf8');
-  for (const relativePath of [
-    '.eslintrc',
-    'biome.json',
-    '.githooks/pre-commit',
-    'PR-CHECKLIST.md',
-  ]) {
-    if (skip.includes(relativePath)) continue;
-    await mkdir(join(dir, relativePath, '..'), { recursive: true });
-    await writeFile(join(dir, relativePath), 'fixture\n', 'utf8');
-  }
-  return dir;
-}
-
-async function makePassingProbe(dir: string): Promise<string> {
-  const scriptPath = join(dir, 'probe-pass.sh');
-  await writeFile(
-    scriptPath,
-    [
-      '#!/bin/bash',
-      'echo "✅ PASS: Type errors blocked"',
-      'echo "✅ PASS: Lint errors blocked"',
-      'echo "Verification Summary"',
-      'exit 0',
-    ].join('\n') + '\n',
-    'utf8',
-  );
-  await chmod(scriptPath, 0o755);
-  return scriptPath;
-}
-
-describe('CLI entry points vs the programmatic evaluator', () => {
-  let logSpy: ReturnType<typeof vi.spyOn>;
-  let previousExitCode: string | number | undefined;
-
-  beforeEach(() => {
-    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    previousExitCode = process.exitCode ?? undefined;
-  });
-
-  afterEach(() => {
-    logSpy.mockRestore();
-    process.exitCode = previousExitCode;
-  });
-
-  it('evaluate --json produces the SAME typed report as evaluateSubject (full check set + probe)', async () => {
-    const dir = await scaffoldNodeFixture();
-    const probePath = await makePassingProbe(dir);
-
-    const programmatic = await evaluateSubject({
-      subjectPath: dir,
-      inputs: { 'qc-20-enforcement-verify': { probePath } },
-    });
-
-    const program = createQualityRailsCli();
-    await program.parseAsync([
-      'node',
-      'cli.js',
-      'quality-rails',
-      'evaluate',
-      '--project',
-      dir,
-      '--probe-path',
-      probePath,
-      '--json',
-    ]);
-
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    const cliReport = JSON.parse(printed) as EvaluationReport;
-    expect(cliReport).toEqual(programmatic);
-    expect(cliReport.state).toBe('passed');
-    expect(process.exitCode).toBe(0);
-  });
-
-  it('check --json produces the SAME QC-19 verdict as evaluateSubject (absorbed loop)', async () => {
-    const dir = await scaffoldNodeFixture(['biome.json', '.githooks/pre-commit']);
-
-    const programmatic = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_19_RAILS_FILES_PRESENT.id],
-    });
-    expect(programmatic.state).toBe('failed');
-
-    const program = createQualityRailsCli();
-    await program.parseAsync([
-      'node',
-      'cli.js',
-      'quality-rails',
-      'check',
-      '--project',
-      dir,
-      '--json',
-    ]);
-
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    const cliReport = JSON.parse(printed) as EvaluationReport;
-    expect(cliReport).toEqual(programmatic);
-    expect(process.exitCode).toBe(1);
-  });
-
-  it('check on a complete subject exits 0 with a passed verdict', async () => {
-    const dir = await scaffoldNodeFixture();
-    const program = createQualityRailsCli();
-    await program.parseAsync([
-      'node',
-      'cli.js',
-      'quality-rails',
-      'check',
-      '--project',
-      dir,
-      '--json',
-    ]);
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    const cliReport = JSON.parse(printed) as EvaluationReport;
-    expect(cliReport.state).toBe('passed');
-    expect(process.exitCode).toBe(0);
-  });
-
-  it('evaluate with an unknown check id exits 1 and reports error, never passed', async () => {
-    const dir = await scaffoldNodeFixture();
-    const program = createQualityRailsCli();
-    await program.parseAsync([
-      'node',
-      'cli.js',
-      'quality-rails',
-      'evaluate',
-      '--project',
-      dir,
-      '--check',
-      'qc-99-bogus',
-      '--json',
-    ]);
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    const cliReport = JSON.parse(printed) as EvaluationReport;
-    expect(cliReport.results).toHaveLength(1);
-    const first = cliReport.results[0];
-    expect(first?.status).toBe('error');
-    expect(first?.reason).toContain('unknown check id');
-    expect(process.exitCode).toBe(1);
-  });
-
-  it('evaluate on a scaffold subject without --probe-path stays fail-closed (blocked, exit 1)', async () => {
-    const dir = await scaffoldNodeFixture();
-    const program = createQualityRailsCli();
-    await program.parseAsync([
-      'node',
-      'cli.js',
-      'quality-rails',
-      'evaluate',
-      '--project',
-      dir,
-      '--json',
-    ]);
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    const cliReport = JSON.parse(printed) as EvaluationReport;
-    const qc20 = cliReport.results.find((r) => r.checkId === 'qc-20-enforcement-verify');
-    expect(qc20).toBeDefined();
-    expect(qc20?.status).toBe('blocked');
-    expect(qc20?.reason).toContain('probePath');
-    expect(cliReport.state).toBe('blocked');
-    expect(process.exitCode).toBe(1);
-  });
-
-  it('doctor stays advisory (no nonzero exit) but reports TYPED states, including blocked', async () => {
-    const dir = await scaffoldNodeFixture();
-    const program = createQualityRailsCli();
-    await program.parseAsync(['node', 'cli.js', 'quality-rails', 'doctor', '--project', dir]);
-
-    const printed = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
-    expect(printed).toContain('blocked: qc-20-enforcement-verify');
-    expect(process.exitCode ?? 0).toBe(0);
-  });
-});

packages/quality-rails/src/cli.ts

@@ -1,3 +1,5 @@
+import { constants } from 'node:fs';
+import { access } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -6,12 +8,18 @@ import { Command } from 'commander';
 import { detectProjectKind } from './detect.js';
 import { scaffoldQualityRails } from './scaffolder.js';
 import type { ProjectKind, QualityProfile, RailsConfig } from './types.js';
-import { QC_19_RAILS_FILES_PRESENT } from './evaluator/definitions.js';
-import { evaluateSubject } from './evaluator/runner.js';
-import type { EvaluationReport } from './evaluator/types.js';
 
 const VALID_PROFILES: readonly QualityProfile[] = ['strict', 'standard', 'minimal'];
 
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    await access(filePath, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function parseProfile(rawProfile: string): QualityProfile {
   if (VALID_PROFILES.includes(rawProfile as QualityProfile)) {
     return rawProfile as QualityProfile;
@@ -51,6 +59,22 @@ function defaultFormatters(kind: ProjectKind): string[] {
   return [];
 }
 
+function expectedFilesForKind(kind: ProjectKind): string[] {
+  if (kind === 'node') {
+    return ['.eslintrc', 'biome.json', '.githooks/pre-commit', 'PR-CHECKLIST.md'];
+  }
+
+  if (kind === 'python') {
+    return ['pyproject.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'];
+  }
+
+  if (kind === 'rust') {
+    return ['rustfmt.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'];
+  }
+
+  return ['.githooks/pre-commit', 'PR-CHECKLIST.md'];
+}
+
 function printScaffoldResult(
   config: RailsConfig,
   filesWritten: string[],
@@ -82,20 +106,6 @@ function printScaffoldResult(
   }
 }
 
-function printEvaluationReport(report: EvaluationReport): void {
-  console.log(
-    `[quality-rails] evaluation for ${report.subject.path} (kind=${report.subject.kind}, check-set v${report.checkSetVersion})`,
-  );
-  for (const result of report.results) {
-    const reason = result.reason === undefined ? '' : ` — ${result.reason}`;
-    const digest = report.definitionDigests[result.checkId] ?? 'no digest';
-    console.log(
-      `  - ${result.status}: ${result.checkId} (v${result.checkVersion} [${digest}])${reason}`,
-    );
-  }
-  console.log(`[quality-rails] aggregate: ${report.state}`);
-}
-
 /**
  * Register quality-rails subcommands on an existing Commander program.
  * This avoids cross-package Commander version mismatches by using the
@@ -138,93 +148,56 @@ function buildQualityRailsCommand(qualityRails: Command): void {
       printScaffoldResult(config, result.filesWritten, result.warnings, result.commandsToRun);
     });
 
-  // `check` (QC-19) is ABSORBED by the RI-N4 evaluator: the presence loop
-  // that lived here is now the versioned, digested, typed check definition
-  // `qc-19-rails-files-present`. The CLI keeps its human surface (missing
-  // files listed, exit 1) and gains `--json` for the typed verdicts. Exit
-  // code is fail-closed: any non-green aggregate (failed/blocked/error) is 1.
   qualityRails
     .command('check')
     .requiredOption('--project <path>', 'Project path')
-    .option('--json', 'print the typed evaluation report as JSON')
-    .action(async (options: { project: string; json?: boolean }) => {
+    .action(async (options: { project: string }) => {
       const projectPath = resolve(options.project);
-      const report = await evaluateSubject({
-        subjectPath: projectPath,
-        checkIds: [QC_19_RAILS_FILES_PRESENT.id],
-      });
+      const kind = await detectProjectKind(projectPath);
+      const expected = expectedFilesForKind(kind);
+      const missing: string[] = [];
 
-      if (options.json) {
-        console.log(JSON.stringify(report));
-      } else {
-        printEvaluationReport(report);
+      for (const relativePath of expected) {
+        const exists = await fileExists(resolve(projectPath, relativePath));
+        if (!exists) {
+          missing.push(relativePath);
+        }
       }
 
-      process.exitCode = report.state === 'passed' ? 0 : 1;
+      if (missing.length > 0) {
+        console.error('[quality-rails] missing files:');
+        for (const relativePath of missing) {
+          console.error(`  - ${relativePath}`);
+        }
+        process.exitCode = 1;
+        return;
+      }
+
+      console.log(`[quality-rails] all expected files present for ${kind} project`);
     });
 
-  // `doctor` (QC-19) stays advisory (documented contract: a doctor that
-  // cannot fail), but now reports TYPED states — a blocked or failing rail is
-  // visible instead of silently printed as `ok`/`missing`.
   qualityRails
     .command('doctor')
     .requiredOption('--project <path>', 'Project path')
     .action(async (options: { project: string }) => {
       const projectPath = resolve(options.project);
-      const report = await evaluateSubject({ subjectPath: projectPath });
+      const kind = await detectProjectKind(projectPath);
+      const expected = expectedFilesForKind(kind);
 
       console.log(`[quality-rails] doctor for ${projectPath}`);
-      console.log(`detected project kind: ${report.subject.kind}`);
-      for (const result of report.results) {
-        const reason = result.reason === undefined ? '' : ` — ${result.reason}`;
-        console.log(`  - ${result.status}: ${result.checkId}${reason}`);
+      console.log(`detected project kind: ${kind}`);
+
+      for (const relativePath of expected) {
+        const exists = await fileExists(resolve(projectPath, relativePath));
+        console.log(`  - ${exists ? 'ok' : 'missing'}: ${relativePath}`);
       }
 
-      if (report.subject.kind === 'unknown') {
+      if (kind === 'unknown') {
         console.log(
           'recommendation: add package.json, pyproject.toml, or Cargo.toml for better defaults.',
         );
       }
     });
-
-  // `evaluate` is the canonical RI-N4 evaluator entry point: typed verdicts
-  // for the subject's full per-kind check set, same results as the
-  // programmatic API (evaluateSubject).
-  qualityRails
-    .command('evaluate')
-    .description('Run the typed quality-rails evaluator against a subject project')
-    .requiredOption('--project <path>', 'Project path')
-    .option('--check <id...>', 'restrict evaluation to these check ids')
-    .option(
-      '--probe-path <path>',
-      'path to the QC-20 behavioral probe script (framework verify.sh)',
-    )
-    .option('--json', 'print the typed evaluation report as JSON')
-    .action(
-      async (options: {
-        project: string;
-        check?: string[];
-        probePath?: string;
-        json?: boolean;
-      }) => {
-        const projectPath = resolve(options.project);
-        const report = await evaluateSubject({
-          subjectPath: projectPath,
-          checkIds: options.check,
-          inputs: options.probePath
-            ? { 'qc-20-enforcement-verify': { probePath: options.probePath } }
-            : undefined,
-        });
-
-        if (options.json) {
-          console.log(JSON.stringify(report));
-        } else {
-          printEvaluationReport(report);
-        }
-
-        process.exitCode = report.state === 'passed' ? 0 : 1;
-      },
-    );
 }
 
 export async function runQualityRailsCli(argv: string[] = process.argv): Promise<void> {

packages/quality-rails/src/evaluator/adapter.ts

@@ -1,67 +0,0 @@
-import { spawn } from 'node:child_process';
-import type { ChildProcess } from 'node:child_process';
-
-import type { AdapterOutcome, AdapterRequest, ProcessAdapter } from './types.js';
-
-/**
- * Default thin process adapter (spawn-based). Runs a command to completion with
- * a hard timeout and reports exit code + captured output — it owns NO verdict
- * logic. Interpreting the outcome is always the check implementation's job.
- */
-export function createSpawnProcessAdapter(): ProcessAdapter {
-  return {
-    run(request: AdapterRequest): Promise<AdapterOutcome> {
-      return new Promise((resolve) => {
-        let child: ChildProcess;
-        try {
-          child = spawn(request.file, request.args, {
-            cwd: request.cwd,
-            stdio: ['ignore', 'pipe', 'pipe'],
-          });
-        } catch (error) {
-          resolve({
-            ok: false,
-            kind: 'spawn-error',
-            message: error instanceof Error ? error.message : String(error),
-          });
-          return;
-        }
-
-        let stdout = '';
-        let stderr = '';
-        let settled = false;
-
-        const timer = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          child.kill('SIGKILL');
-          resolve({
-            ok: false,
-            kind: 'timeout',
-            message: `process timed out after ${request.timeoutMs}ms: ${request.file}`,
-          });
-        }, request.timeoutMs);
-
-        const settle = (outcome: AdapterOutcome): void => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(timer);
-          resolve(outcome);
-        };
-
-        child.stdout?.on('data', (chunk: Buffer) => {
-          stdout += chunk.toString('utf8');
-        });
-        child.stderr?.on('data', (chunk: Buffer) => {
-          stderr += chunk.toString('utf8');
-        });
-        child.on('error', (error: Error) => {
-          settle({ ok: false, kind: 'spawn-error', message: error.message });
-        });
-        child.on('close', (code: number | null) => {
-          settle({ ok: true, exitCode: code, stdout, stderr });
-        });
-      });
-    },
-  };
-}

packages/quality-rails/src/evaluator/definitions.ts

@@ -1,258 +0,0 @@
-import { constants } from 'node:fs';
-import { access } from 'node:fs/promises';
-import { isAbsolute, resolve } from 'node:path';
-
-import { digestOfPolicy, digestOfSpec } from './digest.js';
-import type {
-  CheckContext,
-  CheckDefinition,
-  CheckDefinitionSpec,
-  CheckOutcome,
-  CheckSetPolicy,
-  CheckSetPolicySpec,
-  SubjectKind,
-} from './types.js';
-
-// Check definitions for the RI-N4 evaluator (card RI-3-002). Each definition is
-// DATA with a version and a content digest (see digest.ts); the executable
-// half is attached via defineCheck. Check-set SELECTION is per subject kind
-// (probe-inventory gap 7): this monorepo does not match the node template's
-// file list, so the QC-19 definition carries a distinct file set for the
-// `monorepo` subject kind and the policy selects checks per kind.
-
-export function defineCheck(
-  spec: CheckDefinitionSpec,
-  evaluate: (ctx: CheckContext) => Promise<CheckOutcome>,
-): CheckDefinition {
-  return { ...spec, definitionDigest: digestOfSpec(spec), evaluate };
-}
-
-async function fileExists(filePath: string): Promise<boolean> {
-  try {
-    await access(filePath, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// ─── QC-19: downstream rails presence ────────────────────────────────────────
-//
-// Typed absorption of the former presence-only `quality-rails check` loop in
-// cli.ts. The scaffold-kind file lists below are carried over VERBATIM so the
-// evaluator's typed verdicts are parity-equivalent with the presence loop on
-// the same fixture; the `monorepo` list is new (per-subject check sets).
-
-const qc19Spec: CheckDefinitionSpec = {
-  id: 'qc-19-rails-files-present',
-  version: '1.0.0',
-  canonicalCheck: 'QC-19',
-  description:
-    'The subject still carries its quality-rails files. Typed absorption of the former presence-only check loop; presence is necessary, not sufficient (RI-N4).',
-  appliesTo: ['node', 'python', 'rust', 'monorepo', 'unknown'],
-  params: {
-    expectedFilesByKind: {
-      node: ['.eslintrc', 'biome.json', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-      python: ['pyproject.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-      rust: ['rustfmt.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-      monorepo: [
-        '.husky/pre-commit',
-        '.husky/pre-push',
-        'eslint.config.mjs',
-        '.prettierrc',
-        '.lintstagedrc',
-      ],
-      unknown: ['.githooks/pre-commit', 'PR-CHECKLIST.md'],
-    },
-  },
-};
-
-async function evaluateQc19(ctx: CheckContext): Promise<CheckOutcome> {
-  const byKind = ctx.params['expectedFilesByKind'] as Record<string, readonly string[]> | undefined;
-  if (byKind === undefined) {
-    return { status: 'error', reason: 'definition params missing expectedFilesByKind' };
-  }
-  const expected = byKind[ctx.subject.kind];
-  if (expected === undefined) {
-    // Fail-closed: an undefined file set for a declared subject kind is a
-    // definition gap, never a green outcome.
-    return {
-      status: 'blocked',
-      reason: `no expected-file set defined for subject kind '${ctx.subject.kind}'`,
-    };
-  }
-
-  const missing: string[] = [];
-  for (const relativePath of expected) {
-    if (!(await fileExists(resolve(ctx.subject.path, relativePath)))) {
-      missing.push(relativePath);
-    }
-  }
-  if (missing.length > 0) {
-    return {
-      status: 'failed',
-      reason: `missing rails files (${ctx.subject.kind}): ${missing.join(', ')}`,
-    };
-  }
-  return { status: 'passed' };
-}
-
-// ─── QC-20: downstream enforcement verification (behavioral probe) ──────────
-//
-// The planted-commit behavioral probe (framework tools/quality/scripts/verify.sh)
-// stays a THIN SHELL ADAPTER: the TS evaluator invokes it and OWNS the verdict
-// parsing (RI-N4: grep-on-output verdict logic moves into the typed evaluator).
-// Probe contract (verify.sh): exit 0 ⇔ every sub-probe passed, exit 1 ⇔ at
-// least one sub-probe failed; sub-probe verdicts appear as `PASS:` / `FAIL:`
-// marker lines and the script always prints a `Verification Summary` section.
-// Any deviation from that contract (other exit codes, unparseable output,
-// missing probe, process failure, timeout) is `error`/`blocked` — never
-// `passed`.
-
-const qc20Spec: CheckDefinitionSpec = {
-  id: 'qc-20-enforcement-verify',
-  version: '1.0.0',
-  canonicalCheck: 'QC-20',
-  description:
-    'The behavioral planted-commit probe runs against the subject and every sub-probe blocks as intended. The shell probe is a thin adapter; verdict parsing is owned by this evaluator.',
-  appliesTo: ['node', 'python', 'rust', 'unknown'],
-  params: {
-    command: 'bash',
-    timeoutMs: 120_000,
-    passMarker: 'PASS:',
-    failMarker: 'FAIL:',
-    summaryMarker: 'Verification Summary',
-  },
-};
-
-function linesWith(text: string, marker: string): string[] {
-  return text
-    .split('\n')
-    .map((line) => line.trim())
-    .filter((line) => line.includes(marker));
-}
-
-async function evaluateQc20(ctx: CheckContext): Promise<CheckOutcome> {
-  const rawProbePath = ctx.inputs['probePath'];
-  if (typeof rawProbePath !== 'string' || rawProbePath.trim().length === 0) {
-    return {
-      status: 'blocked',
-      reason:
-        'missing input: probePath — the behavioral probe script must be provided (e.g. the framework verify.sh)',
-    };
-  }
-  const probePath = isAbsolute(rawProbePath)
-    ? rawProbePath
-    : resolve(ctx.subject.path, rawProbePath);
-  if (!(await fileExists(probePath))) {
-    return { status: 'blocked', reason: `probe script not found: ${probePath}` };
-  }
-
-  const command = typeof ctx.params['command'] === 'string' ? ctx.params['command'] : 'bash';
-  const timeoutMs = typeof ctx.params['timeoutMs'] === 'number' ? ctx.params['timeoutMs'] : 120_000;
-  const passMarker =
-    typeof ctx.params['passMarker'] === 'string' ? ctx.params['passMarker'] : 'PASS:';
-  const failMarker =
-    typeof ctx.params['failMarker'] === 'string' ? ctx.params['failMarker'] : 'FAIL:';
-  const summaryMarker =
-    typeof ctx.params['summaryMarker'] === 'string'
-      ? ctx.params['summaryMarker']
-      : 'Verification Summary';
-
-  const outcome = await ctx.adapter.run({
-    file: command,
-    args: [probePath],
-    cwd: ctx.subject.path,
-    timeoutMs,
-  });
-
-  if (!outcome.ok) {
-    // Process error or timeout: the probe never produced a trustworthy result.
-    return {
-      status: 'error',
-      reason: `probe process ${outcome.kind}: ${outcome.message}`,
-    };
-  }
-
-  const output = `${outcome.stdout}\n${outcome.stderr}`;
-  const failLines = linesWith(output, failMarker);
-  const passLines = linesWith(output, passMarker);
-
-  if (outcome.exitCode === 0) {
-    // A green exit must be corroborated by a parseable green transcript:
-    // at least one pass marker, no fail markers, and the summary section.
-    if (passLines.length > 0 && failLines.length === 0 && output.includes(summaryMarker)) {
-      return { status: 'passed' };
-    }
-    return {
-      status: 'error',
-      reason: `malformed probe output: exit 0 without a parseable pass transcript (${passLines.length} pass markers, ${failLines.length} fail markers, summary ${output.includes(summaryMarker) ? 'present' : 'absent'})`,
-    };
-  }
-
-  if (outcome.exitCode === 1) {
-    if (failLines.length === 0) {
-      return {
-        status: 'error',
-        reason: 'malformed probe output: exit 1 without parseable FAIL markers',
-      };
-    }
-    return {
-      status: 'failed',
-      reason: `enforcement probe reported ${failLines.length} failing sub-probe(s): ${failLines.join(' | ')}`,
-    };
-  }
-
-  return {
-    status: 'error',
-    reason: `probe exited with unexpected code ${String(outcome.exitCode)} — outcome not interpretable`,
-  };
-}
-
-// ─── Per-subject check-set policy ───────────────────────────────────────────
-//
-// Gap 7 of the probe inventory: check sets must be selected per subject, not
-// one global list. Downstream scaffold kinds get the presence check plus the
-// behavioral probe (QC-20 blocks until a probePath input is provided — an
-// unverified subject can never evaluate green). The monorepo subject is this
-// repository itself: its rails are the husky hooks + shared lint/format
-// configs, covered by QC-19; the downstream planted-commit probe does not
-// apply to it (this repo's own commit gates are QC-13/QC-14, outside this
-// evaluator's owned checks).
-
-const checkSetPolicySpec: CheckSetPolicySpec = {
-  version: '1.0.0',
-  byKind: {
-    node: ['qc-19-rails-files-present', 'qc-20-enforcement-verify'],
-    python: ['qc-19-rails-files-present', 'qc-20-enforcement-verify'],
-    rust: ['qc-19-rails-files-present', 'qc-20-enforcement-verify'],
-    unknown: ['qc-19-rails-files-present', 'qc-20-enforcement-verify'],
-    monorepo: ['qc-19-rails-files-present'],
-  },
-};
-
-export const CHECK_SET_POLICY: CheckSetPolicy = {
-  ...checkSetPolicySpec,
-  policyDigest: digestOfPolicy(checkSetPolicySpec),
-};
-
-export const QC_19_RAILS_FILES_PRESENT = defineCheck(qc19Spec, evaluateQc19);
-export const QC_20_ENFORCEMENT_VERIFY = defineCheck(qc20Spec, evaluateQc20);
-
-/** Built-in check definitions, keyed by id. */
-export function builtInDefinitions(): CheckDefinition[] {
-  return [QC_19_RAILS_FILES_PRESENT, QC_20_ENFORCEMENT_VERIFY];
-}
-
-export function checkSetForKind(
-  kind: SubjectKind,
-  policy: CheckSetPolicy = CHECK_SET_POLICY,
-): readonly string[] {
-  const selected = policy.byKind[kind];
-  if (selected === undefined) {
-    // Fail-closed selection: an unknown kind yields an EMPTY set only to the
-    // caller; the runner treats an empty result list as `blocked`, never green.
-    return [];
-  }
-  return selected;
-}

packages/quality-rails/src/evaluator/digest.ts

@@ -1,45 +0,0 @@
-import { createHash } from 'node:crypto';
-
-import type { CheckDefinitionSpec, CheckSetPolicySpec } from './types.js';
-
-// Deterministic JSON: object keys sorted at every level so two specs with the
-// same content always produce the same bytes (and thus the same digest).
-export function canonicalJson(value: unknown): string {
-  if (value === null || typeof value !== 'object') {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((entry) => canonicalJson(entry)).join(',')}]`;
-  }
-  const record = value as Record<string, unknown>;
-  const keys = Object.keys(record).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
-}
-
-/** sha256 over the canonical JSON of `value`. */
-export function digestContent(value: unknown): string {
-  return createHash('sha256').update(canonicalJson(value), 'utf8').digest('hex');
-}
-
-/**
- * Content digest of a check definition: covers the declarative spec (id,
- * version, canonical check, description, applicability, params) — everything a
- * reviewer reasons about — while excluding the executable function object.
- * Changing any covered field changes the digest, so a recorded digest always
- * identifies exactly which definition content produced a verdict.
- */
-export function digestOfSpec(spec: CheckDefinitionSpec): string {
-  return digestContent({
-    id: spec.id,
-    version: spec.version,
-    canonicalCheck: spec.canonicalCheck,
-    description: spec.description,
-    appliesTo: spec.appliesTo,
-    params: spec.params,
-  });
-}
-
-/** Content digest of the per-subject check-set policy. */
-export function digestOfPolicy(spec: CheckSetPolicySpec): string {
-  return digestContent(spec);
-}

packages/quality-rails/src/evaluator/evaluator.spec.ts

@@ -1,525 +0,0 @@
-import { mkdtemp, mkdir, writeFile, chmod } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { describe, expect, it } from 'vitest';
-
-import { createSpawnProcessAdapter } from './adapter.js';
-import {
-  builtInDefinitions,
-  CHECK_SET_POLICY,
-  checkSetForKind,
-  defineCheck,
-  QC_19_RAILS_FILES_PRESENT,
-  QC_20_ENFORCEMENT_VERIFY,
-} from './definitions.js';
-import { digestOfSpec } from './digest.js';
-import { aggregateState, evaluateSubject } from './runner.js';
-import type {
-  AdapterOutcome,
-  CheckDefinitionSpec,
-  CheckResult,
-  EvaluationReport,
-  ProcessAdapter,
-} from './types.js';
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-function firstResult(report: EvaluationReport): CheckResult {
-  const result = report.results[0];
-  if (result === undefined) {
-    throw new Error('expected the report to contain at least one result');
-  }
-  return result;
-}
-
-async function makeTempDir(): Promise<string> {
-  return mkdtemp(join(tmpdir(), 'qr-evaluator-'));
-}
-
-async function writeProbeScript(dir: string, name: string, body: string): Promise<string> {
-  const scriptPath = join(dir, name);
-  await writeFile(scriptPath, `${body}\n`, 'utf8');
-  await chmod(scriptPath, 0o755);
-  return scriptPath;
-}
-
-/** Adapter stub that always returns the given outcome (no real process). */
-function stubAdapter(outcome: AdapterOutcome): ProcessAdapter {
-  return {
-    run: async () => outcome,
-  };
-}
-
-// VERBATIM copy of the pre-absorption presence loop (former cli.ts
-// expectedFilesForKind + fileExists loop). This is the PARITY ORACLE: the
-// evaluator's typed QC-19 verdict must agree with what the absorbed check
-// concluded on the same fixture.
-const LEGACY_EXPECTED: Record<'node' | 'python' | 'rust' | 'unknown', string[]> = {
-  node: ['.eslintrc', 'biome.json', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-  python: ['pyproject.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-  rust: ['rustfmt.toml', '.githooks/pre-commit', 'PR-CHECKLIST.md'],
-  unknown: ['.githooks/pre-commit', 'PR-CHECKLIST.md'],
-};
-
-async function legacyPresenceLoop(projectPath: string, kind: keyof typeof LEGACY_EXPECTED) {
-  const missing: string[] = [];
-  for (const relativePath of LEGACY_EXPECTED[kind]) {
-    const fs = await import('node:fs/promises');
-    try {
-      await fs.access(join(projectPath, relativePath));
-    } catch {
-      missing.push(relativePath);
-    }
-  }
-  return missing;
-}
-
-async function scaffoldFixture(kind: keyof typeof LEGACY_EXPECTED, skip: string[] = []) {
-  const dir = await makeTempDir();
-  if (kind === 'node') {
-    await writeFile(join(dir, 'package.json'), '{}\n', 'utf8');
-  }
-  if (kind === 'python') {
-    await writeFile(join(dir, 'pyproject.toml'), '[project]\n', 'utf8');
-  }
-  if (kind === 'rust') {
-    await writeFile(join(dir, 'Cargo.toml'), '[package]\n', 'utf8');
-  }
-  for (const relativePath of LEGACY_EXPECTED[kind]) {
-    if (skip.includes(relativePath)) continue;
-    await mkdir(join(dir, relativePath, '..'), { recursive: true });
-    await writeFile(join(dir, relativePath), 'fixture\n', 'utf8');
-  }
-  return dir;
-}
-
-// ─── QC-19 parity: typed verdict == absorbed presence loop ──────────────────
-
-describe('QC-19 parity with the absorbed presence loop', () => {
-  const kinds: Array<keyof typeof LEGACY_EXPECTED> = ['node', 'python', 'rust', 'unknown'];
-
-  it.each(kinds)('positive fixture (%s): loop said ok ⇒ evaluator passed', async (kind) => {
-    const dir = await scaffoldFixture(kind);
-    const oracleMissing = await legacyPresenceLoop(dir, kind);
-    expect(oracleMissing).toEqual([]);
-
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_19_RAILS_FILES_PRESENT.id],
-    });
-    const result = report.results.find((r) => r.checkId === QC_19_RAILS_FILES_PRESENT.id);
-    expect(result?.status).toBe('passed');
-    expect(result?.reason).toBeUndefined();
-    expect(report.state).toBe('passed');
-  });
-
-  it.each(kinds)(
-    'negative fixture (%s): loop listed missing ⇒ evaluator failed with them',
-    async (kind) => {
-      const all = LEGACY_EXPECTED[kind];
-      const skip = all.slice(0, Math.max(1, all.length - 1)); // leave exactly 1 present
-      const dir = await scaffoldFixture(kind, skip);
-      const oracleMissing = await legacyPresenceLoop(dir, kind);
-      expect(oracleMissing.length).toBeGreaterThan(0);
-
-      const report = await evaluateSubject({
-        subjectPath: dir,
-        checkIds: [QC_19_RAILS_FILES_PRESENT.id],
-      });
-      const result = report.results.find((r) => r.checkId === QC_19_RAILS_FILES_PRESENT.id);
-      expect(result?.status).toBe('failed');
-      expect(report.state).toBe('failed');
-      for (const missingFile of oracleMissing) {
-        expect(result?.reason).toContain(missingFile);
-      }
-      // No false attribution: a present file must not be named in the reason.
-      const presentFile = all.find((file) => !skip.includes(file));
-      if (presentFile !== undefined) {
-        expect(result?.reason).not.toContain(` ${presentFile},`);
-      }
-    },
-  );
-});
-
-// ─── per-subject check sets (inventory gap 7) ────────────────────────────────
-
-describe('per-subject check sets', () => {
-  it('monorepo subject selects only QC-19 with the monorepo file set', async () => {
-    const dir = await makeTempDir();
-    await writeFile(join(dir, 'pnpm-workspace.yaml'), 'packages:\n  - packages/*\n', 'utf8');
-    for (const file of [
-      '.husky/pre-commit',
-      '.husky/pre-push',
-      'eslint.config.mjs',
-      '.prettierrc',
-      '.lintstagedrc',
-    ]) {
-      await mkdir(join(dir, file, '..'), { recursive: true });
-      await writeFile(join(dir, file), 'fixture\n', 'utf8');
-    }
-
-    const report = await evaluateSubject({ subjectPath: dir });
-    expect(report.subject.kind).toBe('monorepo');
-    expect(report.results.map((r) => r.checkId)).toEqual(['qc-19-rails-files-present']);
-    expect(report.state).toBe('passed');
-  });
-
-  it('a monorepo missing one of its rails files fails QC-19 (not the node list)', async () => {
-    const dir = await makeTempDir();
-    await writeFile(join(dir, 'pnpm-workspace.yaml'), 'packages:\n', 'utf8');
-    const report = await evaluateSubject({ subjectPath: dir });
-    const result = report.results.find((r) => r.checkId === QC_19_RAILS_FILES_PRESENT.id);
-    expect(result?.status).toBe('failed');
-    expect(result?.reason).toContain('.husky/pre-commit');
-    // The node-template list must NOT be applied to a monorepo subject.
-    expect(result?.reason).not.toContain('biome.json');
-  });
-
-  it('the policy selects the behavioral probe for scaffold kinds but not monorepo', () => {
-    expect(checkSetForKind('node')).toContain(QC_20_ENFORCEMENT_VERIFY.id);
-    expect(checkSetForKind('unknown')).toContain(QC_20_ENFORCEMENT_VERIFY.id);
-    expect(checkSetForKind('monorepo')).not.toContain(QC_20_ENFORCEMENT_VERIFY.id);
-    expect(CHECK_SET_POLICY.version).toBe('1.0.0');
-  });
-});
-
-// ─── negative controls (the point of the card) ───────────────────────────────
-
-describe('negative controls', () => {
-  it('unknown check id ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: ['qc-99-does-not-exist'],
-    });
-    expect(report.results).toHaveLength(1);
-    const result = firstResult(report);
-    expect(result.status).toBe('error');
-    expect(result.reason).toContain("unknown check id 'qc-99-does-not-exist'");
-    expect(result.status === 'passed').toBe(false);
-    expect(report.state).toBe('error');
-  });
-
-  it('missing subject (directory absent) ⇒ blocked for every check, never passed', async () => {
-    const report = await evaluateSubject({
-      subjectPath: join(tmpdir(), `qr-evaluator-absent-${Date.now()}`),
-    });
-    expect(report.results.length).toBeGreaterThan(0);
-    for (const result of report.results) {
-      expect(result.status).toBe('blocked');
-      expect(result.reason).toContain('subject directory does not exist');
-    }
-    expect(report.state).toBe('blocked');
-  });
-
-  it('QC-20 without probePath input ⇒ blocked, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-    });
-    const result = firstResult(report);
-    expect(result.status).toBe('blocked');
-    expect(result.reason).toContain('missing input: probePath');
-  });
-
-  it('QC-20 with a nonexistent probe script ⇒ blocked, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: join(dir, 'no-such-probe.sh') } },
-    });
-    expect(firstResult(report).status).toBe('blocked');
-    expect(firstResult(report).reason).toContain('probe script not found');
-  });
-
-  it('adapter process error (spawn failure) ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: join(dir, 'PR-CHECKLIST.md') } },
-      adapter: stubAdapter({ ok: false, kind: 'spawn-error', message: 'ENOENT bash' }),
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('probe process spawn-error');
-    expect(firstResult(report).status === 'passed').toBe(false);
-  });
-
-  it('adapter timeout ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: join(dir, 'PR-CHECKLIST.md') } },
-      adapter: stubAdapter({ ok: false, kind: 'timeout', message: 'timed out after 120000ms' }),
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('probe process timeout');
-  });
-
-  it('probe exit 1 with parseable FAIL markers ⇒ failed (interpretably red), never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(
-      dir,
-      'probe-fail.sh',
-      `echo "Test 1: ..."\necho "❌ FAIL: Type errors NOT blocked"\necho "Verification Summary"\nexit 1`,
-    );
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('failed');
-    expect(firstResult(report).reason).toContain('FAIL: Type errors NOT blocked');
-    expect(report.state).toBe('failed');
-  });
-
-  it('probe exit 1 WITHOUT parseable FAIL markers ⇒ malformed ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(dir, 'probe-mute.sh', `echo "nothing to see"\nexit 1`);
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('malformed probe output');
-  });
-
-  it('probe exit 0 without a parseable pass transcript ⇒ malformed ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(dir, 'probe-lie.sh', `echo "all good"\nexit 0`);
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('malformed probe output');
-    expect(firstResult(report).reason).toContain('exit 0');
-  });
-
-  it('probe exit 0 WITH fail markers ⇒ contradictory transcript ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(
-      dir,
-      'probe-contradict.sh',
-      `echo "✅ PASS: one"\necho "❌ FAIL: two"\necho "Verification Summary"\nexit 0`,
-    );
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('error');
-  });
-
-  it('probe unexpected exit code (7) ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(dir, 'probe-crash.sh', `echo "boom"\nexit 7`);
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('unexpected code 7');
-  });
-
-  it('check implementation throwing ⇒ error, never passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const spec: CheckDefinitionSpec = {
-      id: 'test-throws',
-      version: '1.0.0',
-      canonicalCheck: 'QC-TEST',
-      description: 'sabotage-shaped definition that always throws',
-      appliesTo: ['node'],
-      params: {},
-    };
-    const throwing = defineCheck(spec, async () => {
-      throw new Error('kaboom');
-    });
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: ['test-throws'],
-      definitions: [throwing],
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('kaboom');
-  });
-
-  it('non-passed verdict without a reason ⇒ upgraded to error, never an unqualified skip', async () => {
-    const dir = await scaffoldFixture('node');
-    const spec: CheckDefinitionSpec = {
-      id: 'test-silent-fail',
-      version: '1.0.0',
-      canonicalCheck: 'QC-TEST',
-      description: 'returns failed without a reason',
-      appliesTo: ['node'],
-      params: {},
-    };
-    const silent = defineCheck(spec, async () => ({ status: 'failed' }));
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: ['test-silent-fail'],
-      definitions: [silent],
-    });
-    expect(firstResult(report).status).toBe('error');
-    expect(firstResult(report).reason).toContain('without a reason');
-  });
-
-  it('empty result list aggregates to blocked, never passed', () => {
-    expect(aggregateState([])).toBe('blocked');
-  });
-});
-
-// ─── QC-20 parity: typed verdict == shell probe's own conclusion ────────────
-
-describe('QC-20 parity with the shell probe contract', () => {
-  it('green transcript (exit 0) ⇒ evaluator passed', async () => {
-    const dir = await scaffoldFixture('node');
-    const probe = await writeProbeScript(
-      dir,
-      'probe-pass.sh',
-      [
-        'echo "✅ PASS: Type errors blocked"',
-        'echo "✅ PASS: any types blocked"',
-        'echo "✅ PASS: Lint errors blocked"',
-        'echo "Verification Summary"',
-        'echo "✅ Passed: 3"',
-        'exit 0',
-      ].join('\n'),
-    );
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: probe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    expect(firstResult(report).status).toBe('passed');
-    expect(report.state).toBe('passed');
-  });
-
-  it('the REAL framework verify.sh on a non-git subject concludes failed (exit 1) ⇒ evaluator failed', async () => {
-    // Real-probe parity: verify.sh without a git repo cannot block planted
-    // commits, exits 1 with FAIL markers — the evaluator must record exactly
-    // `failed` with those markers, matching the probe's own conclusion.
-    const realProbe = fileURLToPath(
-      new URL('../../../mosaic/framework/tools/quality/scripts/verify.sh', import.meta.url),
-    );
-    const dir = await makeTempDir(); // not a git repository, no hooks
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_20_ENFORCEMENT_VERIFY.id],
-      inputs: { 'qc-20-enforcement-verify': { probePath: realProbe } },
-      adapter: createSpawnProcessAdapter(),
-    });
-    const result = firstResult(report);
-    expect(result.status).toBe('failed');
-    expect(result.reason).toMatch(/FAIL:/);
-    expect(report.state).toBe('failed');
-  });
-});
-
-// ─── version / digest discipline ─────────────────────────────────────────────
-
-describe('versioned, digested check definitions', () => {
-  it('every verdict records the definition version that produced it', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({ subjectPath: dir });
-    for (const result of report.results) {
-      expect(result.checkVersion).toBe('1.0.0');
-    }
-    expect(report.checkSetVersion).toBe(CHECK_SET_POLICY.version);
-  });
-
-  it('the report records each definition’s content digest', async () => {
-    const dir = await scaffoldFixture('node');
-    const report = await evaluateSubject({ subjectPath: dir });
-    expect(report.definitionDigests[QC_19_RAILS_FILES_PRESENT.id]).toBe(
-      QC_19_RAILS_FILES_PRESENT.definitionDigest,
-    );
-    expect(report.definitionDigests[QC_20_ENFORCEMENT_VERIFY.id]).toBe(
-      QC_20_ENFORCEMENT_VERIFY.definitionDigest,
-    );
-  });
-
-  it('digests are stable for identical content', () => {
-    const spec = QC_19_RAILS_FILES_PRESENT;
-    expect(digestOfSpec(spec)).toBe(digestOfSpec(spec));
-  });
-
-  it('changing a definition’s content changes its digest', () => {
-    const base = { ...QC_19_RAILS_FILES_PRESENT } as CheckDefinitionSpec;
-    const baseDigest = digestOfSpec(base);
-
-    const changedParams: CheckDefinitionSpec = {
-      ...base,
-      params: {
-        expectedFilesByKind: {
-          ...(base.params['expectedFilesByKind'] as Record<string, string[]>),
-          node: ['.eslintrc', 'biome.json', '.githooks/pre-commit', 'PR-CHECKLIST.md', 'NEW.md'],
-        },
-      },
-    };
-    expect(digestOfSpec(changedParams)).not.toBe(baseDigest);
-
-    const changedVersion: CheckDefinitionSpec = { ...base, version: '1.1.0' };
-    expect(digestOfSpec(changedVersion)).not.toBe(baseDigest);
-  });
-
-  it('a definition with changed content produces a different recorded digest and version', async () => {
-    const dir = await scaffoldFixture('node');
-    const modified = defineCheck(
-      { ...QC_19_RAILS_FILES_PRESENT, version: '2.0.0' } as unknown as CheckDefinitionSpec,
-      async () => ({ status: 'passed' }),
-    );
-    const report = await evaluateSubject({
-      subjectPath: dir,
-      checkIds: [QC_19_RAILS_FILES_PRESENT.id],
-      definitions: [
-        modified,
-        ...builtInDefinitions().filter((d) => d.id !== QC_19_RAILS_FILES_PRESENT.id),
-      ],
-    });
-    const result = firstResult(report);
-    expect(result.checkVersion).toBe('2.0.0');
-    expect(report.definitionDigests[QC_19_RAILS_FILES_PRESENT.id]).toBe(modified.definitionDigest);
-    expect(modified.definitionDigest).not.toBe(QC_19_RAILS_FILES_PRESENT.definitionDigest);
-  });
-});
-
-// ─── aggregate state ordering (MACP-style discipline) ───────────────────────
-
-describe('aggregate state precedence', () => {
-  const result = (status: 'passed' | 'failed' | 'blocked' | 'error') => ({
-    status,
-    checkId: 'x',
-    checkVersion: '1.0.0',
-    subject: '/tmp/x',
-  });
-
-  it('all passed (with not-applicable) ⇒ passed', () => {
-    expect(
-      aggregateState([
-        result('passed'),
-        { ...result('passed'), status: 'not-applicable' as const },
-      ]),
-    ).toBe('passed');
-  });
-
-  it('error outranks blocked and failed; blocked outranks failed', () => {
-    expect(aggregateState([result('blocked'), result('error')])).toBe('error');
-    expect(aggregateState([result('failed'), result('blocked')])).toBe('blocked');
-    expect(aggregateState([result('passed'), result('failed')])).toBe('failed');
-  });
-});

packages/quality-rails/src/evaluator/runner.ts

@@ -1,183 +0,0 @@
-import { constants } from 'node:fs';
-import { access, stat } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
-
-import { createSpawnProcessAdapter } from './adapter.js';
-import { builtInDefinitions, CHECK_SET_POLICY, checkSetForKind } from './definitions.js';
-import type {
-  AggregateState,
-  CheckResult,
-  CheckStatus,
-  EvaluateOptions,
-  EvaluationReport,
-  ProcessAdapter,
-  Subject,
-  SubjectKind,
-} from './types.js';
-import { detectProjectKind } from '../detect.js';
-
-async function pathExists(targetPath: string): Promise<boolean> {
-  try {
-    await access(targetPath, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function isDirectory(targetPath: string): Promise<boolean> {
-  try {
-    return (await stat(targetPath)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Subject-kind detection for the evaluator. Extends the scaffold detection
- * (detect.ts) with the `monorepo` kind: a pnpm workspace is this repository's
- * own subject shape and carries a different rails file set (probe-inventory
- * gap 7 — check sets are per subject, not one global file list).
- */
-export async function detectSubjectKind(subjectPath: string): Promise<SubjectKind> {
-  if (await pathExists(join(subjectPath, 'pnpm-workspace.yaml'))) {
-    return 'monorepo';
-  }
-  const kind = await detectProjectKind(subjectPath);
-  return kind;
-}
-
-/**
- * Aggregate state, MACP-style discipline: `passed` only when at least one
- * check produced a verdict AND every verdict is `passed` or an explicitly
- * qualified `not-applicable`. Precedence is fail-closed: error > blocked >
- * failed > passed; an empty result list aggregates to `blocked`.
- */
-export function aggregateState(results: readonly CheckResult[]): AggregateState {
-  if (results.length === 0) {
-    return 'blocked';
-  }
-  const has = (status: CheckStatus): boolean => results.some((result) => result.status === status);
-  if (has('error')) {
-    return 'error';
-  }
-  if (has('blocked')) {
-    return 'blocked';
-  }
-  if (has('failed')) {
-    return 'failed';
-  }
-  return 'passed';
-}
-
-function reasonFrom(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
-}
-
-/**
- * Evaluate one subject against a set of checks, producing typed verdicts.
- *
- * Fail-closed invariants (RI-N4):
- * - unknown check id            → `error` (never passed)
- * - subject directory absent    → every verdict `blocked`
- * - check implementation threw  → `error`
- * - non-passed without a reason → `error` (no unqualified skips)
- * - check not applicable        → `not-applicable` WITH a reason
- */
-export async function evaluateSubject(options: EvaluateOptions): Promise<EvaluationReport> {
-  const subjectPath = resolve(options.subjectPath);
-  const subject: Subject = {
-    path: subjectPath,
-    kind: await detectSubjectKind(subjectPath),
-  };
-
-  const definitions = options.definitions ?? builtInDefinitions();
-  const byId = new Map(definitions.map((definition) => [definition.id, definition]));
-  const requested = options.checkIds ?? checkSetForKind(subject.kind);
-  const adapter: ProcessAdapter = options.adapter ?? createSpawnProcessAdapter();
-
-  const results: CheckResult[] = [];
-  const definitionDigests: Record<string, string> = {};
-
-  for (const checkId of requested) {
-    const definition = byId.get(checkId);
-    if (definition === undefined) {
-      const known = definitions.map((entry) => entry.id).join(', ');
-      results.push({
-        status: 'error',
-        checkId,
-        checkVersion: 'unknown',
-        subject: subjectPath,
-        reason: `unknown check id '${checkId}' — no registered definition (known: ${known})`,
-      });
-      continue;
-    }
-
-    definitionDigests[checkId] = definition.definitionDigest;
-
-    if (!(await isDirectory(subjectPath))) {
-      results.push({
-        status: 'blocked',
-        checkId,
-        checkVersion: definition.version,
-        subject: subjectPath,
-        reason: `subject directory does not exist: ${subjectPath}`,
-      });
-      continue;
-    }
-
-    if (!definition.appliesTo.includes(subject.kind)) {
-      results.push({
-        status: 'not-applicable',
-        checkId,
-        checkVersion: definition.version,
-        subject: subjectPath,
-        reason: `check '${checkId}' does not apply to subject kind '${subject.kind}'`,
-      });
-      continue;
-    }
-
-    try {
-      const inputs = options.inputs?.[checkId] ?? {};
-      const outcome = await definition.evaluate({
-        subject,
-        params: definition.params,
-        inputs,
-        adapter,
-      });
-      if (outcome.status !== 'passed' && (outcome.reason === undefined || outcome.reason === '')) {
-        results.push({
-          status: 'error',
-          checkId,
-          checkVersion: definition.version,
-          subject: subjectPath,
-          reason: `check returned status '${outcome.status}' without a reason — treated as error`,
-        });
-        continue;
-      }
-      results.push({
-        status: outcome.status,
-        checkId,
-        checkVersion: definition.version,
-        subject: subjectPath,
-        reason: outcome.reason,
-      });
-    } catch (error) {
-      results.push({
-        status: 'error',
-        checkId,
-        checkVersion: definition.version,
-        subject: subjectPath,
-        reason: `check implementation threw: ${reasonFrom(error)}`,
-      });
-    }
-  }
-
-  return {
-    subject,
-    results,
-    definitionDigests,
-    checkSetVersion: CHECK_SET_POLICY.version,
-    state: aggregateState(results),
-  };
-}

packages/quality-rails/src/evaluator/types.ts

@@ -1,148 +0,0 @@
-// Evaluator core types — RI-N4 (card RI-3-002, SDLC-D-037 second half).
-//
-// The quality-rails evaluator is the SOLE authoritative producer of check
-// verdicts for the checks it owns. Every verdict is typed and fail-closed:
-// missing implementations, missing inputs, unknown check ids, process errors,
-// timeouts, and malformed adapter output can never become `passed` or an
-// unqualified skip — they surface as `blocked` or `error` with a reason.
-// (Vocabulary mirrors MACP's GateStatus discipline from packages/macp.)
-
-/**
- * Typed verdict for a single check execution.
- *
- * - `passed` — the check really ran and its condition held.
- * - `failed` — the check really ran and its condition did NOT hold.
- * - `blocked` — the check could not run at all (missing subject, missing
- *   input). Never a green outcome.
- * - `error` — the check attempted to run but its outcome cannot be trusted
- *   (unknown check id, implementation threw, process error, timeout, malformed
- *   adapter output). Never a green outcome.
- * - `not-applicable` — the check definition explicitly declares it does not
- *   apply to this subject (a qualified skip, always with a reason).
- */
-export type CheckStatus = 'passed' | 'failed' | 'blocked' | 'error' | 'not-applicable';
-
-/** Aggregate outcome, MACP-style: `passed` only when every result is green. */
-export type AggregateState = 'passed' | 'failed' | 'blocked' | 'error';
-
-/** Kinds of subjects the evaluator can assess. */
-export type SubjectKind = 'node' | 'python' | 'rust' | 'monorepo' | 'unknown';
-
-/**
- * A single check verdict. This is the canonical result shape: `status`,
- * `checkId`, `checkVersion`, `subject`, `reason`. `reason` is REQUIRED
- * (enforced by the runner) for every status other than `passed`.
- */
-export interface CheckResult {
-  status: CheckStatus;
-  checkId: string;
-  checkVersion: string;
-  subject: string;
-  reason?: string;
-}
-
-/** The project being evaluated. */
-export interface Subject {
-  /** Absolute path. */
-  path: string;
-  kind: SubjectKind;
-}
-
-/**
- * The data half of a check definition. Definitions live as DATA with a version
- * and a content digest (see `digestOfSpec`); the executable half is attached
- * separately so the digest covers only reviewable, declarative content.
- */
-export interface CheckDefinitionSpec {
-  /** Stable id, e.g. `qc-19-rails-files-present`. */
-  id: string;
-  /** Semver of this definition's data+semantics. */
-  version: string;
-  /** Canonical check id from docs/release-integrity/probe-inventory.md (QC-n). */
-  canonicalCheck: string;
-  description: string;
-  /** Subject kinds this check can assess (others yield `not-applicable`). */
-  appliesTo: readonly SubjectKind[];
-  /** Declarative parameters (file lists, markers, timeouts) — digest-covered. */
-  params: Record<string, unknown>;
-}
-
-/** A fully assembled check definition: spec + digest + implementation. */
-export interface CheckDefinition extends CheckDefinitionSpec {
-  /** sha256 content digest of the spec (canonical JSON projection). */
-  definitionDigest: string;
-  evaluate(ctx: CheckContext): Promise<CheckOutcome>;
-}
-
-/** What a check implementation returns; the runner stamps id/version/subject. */
-export interface CheckOutcome {
-  status: CheckStatus;
-  reason?: string;
-}
-
-/** Caller-provided inputs for one check invocation (e.g. the QC-20 probe path). */
-export type CheckInputs = Record<string, unknown>;
-
-/** Everything a check implementation may use. */
-export interface CheckContext {
-  subject: Subject;
-  params: Record<string, unknown>;
-  inputs: CheckInputs;
-  adapter: ProcessAdapter;
-}
-
-/** Outcome of running a shell probe through the thin process adapter. */
-export type AdapterOutcome =
-  | { ok: true; exitCode: number | null; stdout: string; stderr: string }
-  | { ok: false; kind: 'spawn-error' | 'timeout'; message: string };
-
-/** Request for the process adapter. */
-export interface AdapterRequest {
-  file: string;
-  args: string[];
-  cwd: string;
-  timeoutMs: number;
-}
-
-/**
- * Thin process adapter: runs a command, owns NO verdict logic. Verdict parsing
- * always lives in the check implementation (TS), never in the shell probe.
- */
-export interface ProcessAdapter {
-  run(request: AdapterRequest): Promise<AdapterOutcome>;
-}
-
-/** Per-subject-kind check-set selection policy (versioned and digested). */
-export interface CheckSetPolicySpec {
-  version: string;
-  byKind: Record<SubjectKind, readonly string[]>;
-}
-
-export interface CheckSetPolicy extends CheckSetPolicySpec {
-  /** sha256 content digest of the policy spec. */
-  policyDigest: string;
-}
-
-/** Full typed evaluation report for one subject. */
-export interface EvaluationReport {
-  subject: Subject;
-  results: CheckResult[];
-  /** checkId → content digest of the definition that produced the verdicts. */
-  definitionDigests: Record<string, string>;
-  /** Version of the check-set policy used for subject selection. */
-  checkSetVersion: string;
-  state: AggregateState;
-}
-
-/** Options for `evaluateSubject`. */
-export interface EvaluateOptions {
-  subjectPath: string;
-  /** Restrict to these check ids; defaults to the subject kind's check set. */
-  checkIds?: string[];
-  /** Per-check inputs, keyed by check id (e.g. `{ 'qc-20-enforcement-verify': { probePath } }`). */
-  inputs?: Record<string, CheckInputs>;
-  /** Replace the built-in definitions (tests / future batches). */
-  definitions?: CheckDefinition[];
-  /** Inject a process adapter (tests / instrumentation). */
-  adapter?: ProcessAdapter;
-}

packages/quality-rails/src/index.ts

@@ -3,35 +3,3 @@ export * from './detect.js';
 export * from './scaffolder.js';
 export * from './templates.js';
 export * from './types.js';
-
-// RI-N4 evaluator (card RI-3-002): the public, programmatic entry points.
-export {
-  builtInDefinitions,
-  CHECK_SET_POLICY,
-  checkSetForKind,
-  defineCheck,
-  QC_19_RAILS_FILES_PRESENT,
-  QC_20_ENFORCEMENT_VERIFY,
-} from './evaluator/definitions.js';
-export { canonicalJson, digestContent, digestOfPolicy, digestOfSpec } from './evaluator/digest.js';
-export { createSpawnProcessAdapter } from './evaluator/adapter.js';
-export { aggregateState, detectSubjectKind, evaluateSubject } from './evaluator/runner.js';
-export type {
-  AdapterOutcome,
-  AdapterRequest,
-  AggregateState,
-  CheckContext,
-  CheckDefinition,
-  CheckDefinitionSpec,
-  CheckInputs,
-  CheckOutcome,
-  CheckResult,
-  CheckSetPolicy,
-  CheckSetPolicySpec,
-  CheckStatus,
-  EvaluateOptions,
-  EvaluationReport,
-  ProcessAdapter,
-  Subject,
-  SubjectKind,
-} from './evaluator/types.js';

scratchpads/2026-08-17-fleet-identity-comms-mosaic-tree.md

@@ -0,0 +1,73 @@
+# 2026-08-17 — Fleet identity, comms delivery, and the ~/.mosaic tree (continuation record)
+
+> **Status:** active continuation record | **Owner:** Jason (rulings) / fleet (delivery) | **Created:** 2026-08-17, sb-it-1-dt session with Jarvis (jarvis-brain)
+> **Audience:** the homelab agents continuing this effort tonight. Read this whole file before acting; it supersedes nothing but preserves structure and decisions that must not be lost.
+
+---
+
+## Why this exists
+
+A session on sb-it-1-dt (2026-08-17) produced three architecture decisions (two awaiting Jason's ruling), one incident postmortem (#1295), interim guardrail edits in the user-owned `~/.mosaic/` contract tree, and one new tool (`ensure-watcher.sh`). The work spans jarvis-brain (P0, not retained) and this repo (the product). **This file is the stack-side anchor so continuation does not depend on jarvis-brain surviving.**
+
+## 1. The `~/.mosaic` tree model — as-built, preserve this structure
+
+Three-tree split (this is design intent, not accident; keep it through all framework work):
+
+| Tree                | Owner     | Rule                                                                                                          |
+| ------------------- | --------- | ------------------------------------------------------------------------------------------------------------- |
+| `~/.config/mosaic/` | framework | upgrade-managed templates; NEVER user-edited; `mosaic upgrade` may overwrite                                  |
+| `~/.mosaic/`        | user      | working contracts, guides, fleet agents; upgrades reconcile with **deny-wins** (user edits never overwritten) |
+| repo satellites     | repos     | bootstrapped per-repo `.mosaic/` state                                                                        |
+
+As-built inventory of `~/.mosaic` on sb-it-1-dt (2026-08-17):
+
+- **Contract core:** `CONSTITUTION.md` (L0 law), `AGENTS.md` (dispatcher + guide router + Fleet Comms Watcher requirement), `SOUL.md` (generic base for ALL fleet agents, zero persona — includes the new **Fleet Boundaries** section), `STANDARDS.md` (universal standards — includes new **session identity** + **comms watcher hygiene** sections), `SYSTEM.md` (pure communication contract, byte-identical to jarvis-brain's prompt-testing `sr_opus_5_system_prompt.md`), `USER.md`, `TOOLS.md`.
+- **`guides/`** — user-owned working copies (E2E-DELIVERY, ORCHESTRATOR(+PROTOCOL,+LEARNINGS), WAKE-DOCTRINE, VAULT-SECRETS, etc.).
+- **`fleet/agents/`** — the per-agent store (this is MOSAIC-D-002's substrate, already in use):
+  - real agent dirs: `fargo/`, `orchestrator/`, `probe/`, `vision/`, `weekly-update/` — shape: `profile.json` (harness/account/overlay pointer) + `overlay.json` + `SOUL.md` (persona) + `scratch/` `work/` `notes/` subdirs (hygiene rules in root SOUL.md)
+  - `*.env.generated` launch overlays: `luna` `sol` `terra` (carry `MOSAIC_AGENT_NAME`, `_CLASS`, `_RUNTIME`, `_MODEL`, `_REASONING`, `_TOOL_POLICY`) — these are the mosaic-fleet seat launch envs; `inbox.env`, `itops.env` also present
+  - `probe/` is the validated layout proof: auth-bundle symlink chain, per-agent sessions, plugin-store symlink (from 2026-08-07)
+- **`auth/`, `config/`, `memory/`, `plugins/`, `skills/`, `skills-local/`** — per-tree copies/links for runtime isolation.
+- Related but outside the tree: watcher units at `~/.config/systemd/user/<agent>-comms-watcher.service`; watcher seen-state at `~/.local/state/comms-watcher-<agent>/`.
+
+## 2. Decisions register (2026-08-17 session)
+
+Full strict records live in jarvis-brain `docs/decisions/mosaic-stack/` (render on its dashboard); both are **Pending Jason's ruling**. Summaries so the content survives P0:
+
+- **MOSAIC-D-001 — SYSTEM.md as canonical harness system prompt.** Static core (Constitution+AGENTS+USER+overlays) in one tracked file; launcher renders dynamic tail (mission/PRD/fleet/persona). Delivery: `--append-system-prompt` (repeatable) for pi/claude; symlinked core file for codex (`$CODEX_HOME/instructions.md`) and opencode (`AGENTS.md`); their dynamic tail via initial prompt (needs live verification). Static-first order is the cache win. `SYSTEM.md` in `~/.mosaic` today is the communication-contract file — D-001's SYSTEM.md is the broader composition; naming to reconcile at implementation.
+- **MOSAIC-D-002 — per-agent harness homes + mechanical profiles.** Launch with targeted config-dir env vars (e.g. `PI_CODING_AGENT_DIR=~/.mosaic/fleet/agents/<name>/pi`), NOT literal HOME. SOUL.md identity mechanically generated from roster (single writer; kills the hand-copy drift measured in `agents/vision/SOUL.md` on jarvis-brain: declared Jarvis, answered Vision). Composes: SYSTEM core → per-agent SOUL → dynamic tail. `MOSAIC_AGENT_NAME` stays load-bearing for comms.
+- **Comms delivery tooling belongs in the STACK framework, not jarvis-brain** (decided in discussion; supersedes the interim placement). jarvis-brain keeps only the transport _data_ (`comms/` tree) while it lives. Agents launch from their own repos (terra from `~/src/stack` etc.) — delivery is transport-repo-relative, so this works; but every installed watcher unit's ExecStart currently points into `~/src/jarvis-brain/scripts/` — that dependency is the P0 trap to remove. Migration = move tools + regenerate units, in one step.
+- **Watcher provisioning is instantiation duty, never running-agent duty.** Interim landed as jarvis-brain `scripts/comms/ensure-watcher.sh` (idempotent ensure + `--status` boot check + interim identity warnings: missing target session, pane `MOSAIC_AGENT_NAME` mismatch via `/proc/<child>/environ`, bare-runtime NOTE). Framework move: fold into `mosaic agent --new` + fleet launch + `mosaic doctor` drift check.
+- **Prose guardrails landed (interim fences until mechanical fixes):** `~/.mosaic/SOUL.md` Fleet Boundaries (wrong-session tripwire; comms ownership; cross-agent investigation requires tasking) · `STANDARDS.md` session identity + watcher hygiene · `AGENTS.md` Fleet Comms Watcher requirement (P0-interim script path marked transitional).
+
+## 3. Incident → #1295 (already tracked here)
+
+`https://git.mosaicstack.dev/mosaicstack/stack/issues/1295` — docs-seat incident: cwd-keyed session files served three lives (dev chat → goals seat → 22 watcher injections into a wedged process); name-based watcher delivery with no identity verification; wedge after pi 0.84.1→0.84.2 update passes every liveness instrument. Proposed fixes enumerated there; provisioning follow-up in comment ID 23027.
+
+## 4. Open work queue (suggested sequence)
+
+1. **Comms tooling migration PR** (lane `next`): move `comms-watcher.sh`, `install-watcher.sh`, `ensure-watcher.sh` into the framework tree → deploy `~/.config/mosaic/tools/comms/`; regenerate existing units' ExecStart to framework paths (one-command sweep); keep `COMMS_WATCH_REPO` per-host config (points at a brain checkout until the queue transport lands). Reference: jarvis-brain commit `701c353b1`.
+2. **Ensure-on-instantiation**: `mosaic agent --new` / fleet launch call ensure semantics; `mosaic doctor` gains the drift check (`--status --all` semantics + `fred`'s hand-written unit as the known drift case; also note daphne/docs/happy/pepper/sanity/tiny/fargo currently have no watcher — cover or consciously exempt).
+3. **MOSAIC-D-002 implementation** (after ruling): per-agent homes via targeted env vars; roster-generated SOUL.md single-writer; extend the existing `*.env.generated` pattern; launch ledger keeps `config_home` audit.
+4. **MOSAIC-D-001 implementation** (after ruling): SYSTEM.md sourcing + per-harness delivery + `compose-contract` becomes render-core+tail with drift check; bench cache-ordering before/after (jarvis-brain `domains/software-dev/mosaic-stack/prompt-testing` has the bench).
+5. **Queue transport + forced separation** (longer term): supersedes watcher path; identity-verification and wedge-detection remain valid regardless of transport.
+6. **Docs inheritance**: jarvis-brain AGENTS.md's durable comms guidance (E7 pi-glyph delivery gotchas, capture-pane rules, comms protocol) must be inherited into stack docs before P0 retirement.
+
+## 5. Rules for tonight's agents
+
+- Lane: **`next`** only; nothing to `main` without Jason (standing ruling).
+- Attribution caveat #1280: Gitea/git identity from this host may misattribute (issue #1295 showed as created by `@mos-dt-0`); prefer per-invocation `git -c user.name=<seat>` and verify what the remote recorded.
+- Do not delete `sb-it-1-dt:docs]` (untracked file at repo root) — it is cited fleet-wide as incident evidence.
+- Edit user contracts in `~/.mosaic/`, never the templates in `~/.config/mosaic/`.
+- Do not restart other fleet seats unilaterally (goals/scrappy/sanity restart decisions are fred's/Jason's per the docs-seat report).
+
+## 6. Artifact map
+
+| Artifact                                                           | Where                                                                                                                    |
+| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ |
+| Decision records D-001/D-002 (strict, pending ruling)              | jarvis-brain `docs/decisions/mosaic-stack/2026-08-17_mosaic-d-00{1,2}_*.md`                                              |
+| Incident issue + provisioning comment                              | stack #1295 + comment 23027                                                                                              |
+| ensure-watcher.sh (reference implementation)                       | jarvis-brain `scripts/comms/ensure-watcher.sh` (commit `701c353b1`)                                                      |
+| Bench for prompt A/B (pi, thinking levels, footer-token semantics) | jarvis-brain `domains/software-dev/mosaic-stack/prompt-testing/` + `docs/reports/2026-08-17-prompt-testing-glm-bench.md` |
+| Launcher inspection basis                                          | `@mosaicstack/mosaic` 0.0.49 `dist/commands/launch.js` (composeContract / ensureRuntimeConfig / harness-home isolation)  |
+| Guardrail edits                                                    | `~/.mosaic/{SOUL,AGENTS,STANDARDS}.md` on sb-it-1-dt (2026-08-17 16:53–17:04)                                            |

scratchpads/ri-1-002-publish-gate-negative-controls.md

@@ -1,45 +0,0 @@
-# RI-1-002 — Publish-gate negative controls (SDLC-D-034 second half)
-
-- Task: RI-1-002 (docs/release-integrity workstream, PRD item RI-N1), issue ref #1275
-- Branch: `test/ri-050-publish-gate-negative` (base `origin/next` @ d8e0aec9 = PR #1277, RI-1-001)
-- Budget: worker estimate ~45K tokens; keep scoped to the two test files + scratchpad.
-
-## Objective
-
-Checked-in negative-control tests that PROVE the publish gate fails when it must:
-
-1. Broken mandatory check blocks every publish step (structural DAG proof from `.woodpecker/publish.yml`).
-2. Bypass shapes fail the checker: missing edge, hidden effect (non-`publish` name), detached verify, always-pass verify (`failure: ignore` / `success` override), conditional verify (`when`).
-3. Exact-commit identity: no HEAD-moving step between verify and publish effects; legitimate re-checkout requires verify to re-run after it.
-4. `verify-release.mjs` composition control: a SUBSET stage list fails the composition check.
-
-## Plan
-
-- NEW `scripts/publish-gate-structure.test.mjs` — self-contained structural checker (`assertPublishGateBlocksOnVerify`) + positive control on the real pipeline + one negative-control test per bypass shape (S1–S6, documented in file header) + positive control for the legitimate re-checkout shape.
-- EXTEND `scripts/verify-release.test.mjs` — refactor the stage-mirror test body into `assertStagesMirrorCi(stages, ci)`; add negative control dropping each stage one at a time (subset must throw).
-
-## Conventions confirmed
-
-- Root `test:checkout` = `node --test scripts/*.test.mjs` → new file auto-joins `pnpm test`.
-- Test-enumeration guard population is `*test*.sh` under `packages/mosaic/framework/tools/` only → unaffected.
-- Root eslint covers only `**/*.{ts,tsx}` → .mjs files need Prettier style only (printWidth 100, singleQuote, semi, trailingComma all).
-- Do NOT touch docs/TASKS.md, docs/release-integrity/TASKS.md, docs/scratchpads/.
-
-## Progress log
-
-- [x] Base verified: publish.yml `verify` step + verify-release.mjs present; HEAD contains origin/next.
-- [x] Wrote scripts/publish-gate-structure.test.mjs
-- [x] Extended scripts/verify-release.test.mjs (mirror fn + subset negative control)
-- [x] Gates: node --test scripts (31 tests pass), prettier clean on touched files, pnpm typecheck PASS, pnpm lint PASS, pnpm format:check PASS
-- [x] Committed ff585b88 + pushed, PR #1305 → next (no conflicts). Stopped before merge per task instruction.
-
-## Evidence
-
-- `node --test scripts/verify-release.test.mjs scripts/publish-gate-structure.test.mjs` → 31 tests, 0 fail.
-- Mutation sanity: temporarily removing the `verify` edge from build-gateway in publish.yml → structure test goes red (verified manually during dev, then reverted).
-- Gates run from repo root on this worktree; results in Progress log.
-
-## Risks / notes
-
-- Effect detection (`isPublishCommand`) is deliberately over-broad (any npm/pnpm/yarn command mentioning `publish`, any kaniko/docker-push/`--destination`) — fail-closed: a false positive forces justification, a false negative is the actual hazard.
-- `git fetch` flagged as HEAD-moving even though fetch alone doesn't move HEAD — fail-closed on the classic `fetch && reset` pair.

scratchpads/ri-4-001-prd-authority.md

@@ -1,37 +0,0 @@
-# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
-
-- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
-  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
-  Markdown export is a labeled generated view (never read back); import is
-  validated/conflict-aware with typed refusals.
-- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
-  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
-  root build rc=0.
-- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
-  typed errors (3) wizard/cli route through service (4) mosaic adapters
-  (5) contract specs both packages (6) gates (7) sabotage control (8) report
-  to /var/tmp/ri-050/ri-4-001-report.md.
-- Decisions:
-  - Linkage lives ON the PRD document (`missions` array) — one authority file,
-    survives restart, no sidecar sync problems.
-  - `version` = content revision of sections/status (bumped by update/import
-    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
-    for the card's "stable ids/versions" contract.
-  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
-    numeric version field).
-  - Import reads YAML documents only — never the exported Markdown (keeps the
-    "no code path reads exported Markdown" invariant).
-  - Import of an existing id with identical core content → `identical` no-op;
-    divergent → typed `PrdImportConflictError` carrying proposed successor
-    (existing.version + 1, status draft, linkages preserved). Original bytes
-    untouched until explicit `acceptSuccessor`.
-  - `requirementIds` default `[]` at the mission command (no requirement
-    selection UI yet) — service accepts ids when a caller has them.
-- Progress log:
-  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
-  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
-  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
-  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
-  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
-  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
-  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete

scripts/publish-gate-structure.test.mjs

@@ -1,310 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import test from 'node:test';
-
-// RI-1-002 / RI-N1 publish-gate NEGATIVE CONTROLS (SDLC-D-034).
-//
-// scripts/verify-release.test.mjs pins the POSITIVE structure of the publish
-// gate: every publish effect declares a direct `depends_on: verify` edge and
-// the verify step asserts commit identity + runs the canonical command. This
-// suite is the negative-control set: each test feeds a structural gate
-// checker a pipeline in which the gate is bypassed by ONE specific shape and
-// asserts the checker goes RED. The controls prove from the pipeline FILE —
-// never by executing Woodpecker — that a verify step that FAILS (nonzero
-// exit) blocks every publish effect.
-//
-// Woodpecker semantics these controls rely on:
-//   - A step that exits nonzero FAILS, and every step that transitively
-//     depends on a failed step is SKIPPED — never run. That skip is the only
-//     thing standing between a failed mandatory check and a publish effect.
-//   - `detach: true` removes the step from the wait graph: the pipeline does
-//     not wait for detached steps, so their failure can never block anything.
-//   - `failure: ignore` reports a failed step as success to the DAG.
-//   - `success: [codes...]` overrides which exit codes count as success;
-//     admitting any nonzero code launders a failed verification into green.
-//   - `when` on the verify step would skip verification entirely on some
-//     event/path classes while publish effects still run.
-//
-// Bypass shapes covered (one negative-control test each):
-//   S1  Missing edge — a publish effect whose dependency closure does not
-//       contain `verify` (a refactor drops the depends_on entry).
-//   S2  Hidden effect — a step whose NAME does not start with `publish` but
-//       whose COMMANDS publish npm packages or push images. Effects are
-//       classified by commands, so renaming a step cannot un-gate it.
-//   S3  Detached verify — `verify: { detach: true }`: publish steps no longer
-//       wait for verify, so the depends_on edge is decorative.
-//   S4  Always-pass verify — `failure: ignore`, or a `success` override
-//       admitting nonzero exit codes: verify fails, the DAG sees success.
-//   S5  Conditional verify — a `when`/path filter on verify itself.
-//   S6  Exact-commit drift — a HEAD-moving step (git checkout/switch/reset/
-//       clean/pull/clone/fetch) ordered between `verify` and a publish
-//       effect: the verified commit would not be the published commit. A
-//       LEGITIMATE re-checkout is allowed only when `verify` itself runs
-//       after it — positive control included.
-//   S7  Gate removal — the verify step deleted or renamed away entirely.
-
-// Reuse the monorepo's existing YAML parser (@mosaicstack/mosaic's direct
-// dependency) instead of adding a root dependency or vendoring a parser.
-const mosaicRequire = createRequire(
-  path.resolve(process.cwd(), 'packages', 'mosaic', 'package.json'),
-);
-const { parse: parseYaml } = mosaicRequire('yaml');
-
-const publishYmlPath = path.join(process.cwd(), '.woodpecker', 'publish.yml');
-
-async function readPublishPipeline() {
-  return parseYaml(await readFile(publishYmlPath, 'utf8'));
-}
-
-// A command has a publish EFFECT when it publishes npm packages (`publish`
-// anywhere after a package-manager token — `pnpm --filter "@x/*" publish`
-// puts flags and quoted filters between the binary and the subcommand) or
-// pushes an image (kaniko, docker push, or a registry --destination).
-// Deliberately over-broad: a false positive forces justification, a false
-// negative is the actual hazard.
-function isPublishCommand(command) {
-  return (
-    /(^|\s)\/kaniko\/executor\b/.test(command) ||
-    /(^|\s)docker\s+push\b/.test(command) ||
-    /(^|\s)--destination(\s|=)/.test(command) ||
-    (/\bpublish\b/.test(command) && /(^|\s)(npm|pnpm|yarn)(\s|$)/.test(command))
-  );
-}
-
-function hasPublishEffect(step) {
-  return (step.commands ?? []).some(isPublishCommand);
-}
-
-// A step is a publish effect when its name says so OR (S2) when any of its
-// commands does — classification must not depend on the name alone.
-function publishEffectSteps(pipeline) {
-  return Object.entries(pipeline.steps ?? {})
-    .filter(([name, step]) => name.startsWith('publish') || hasPublishEffect(step))
-    .map(([name]) => name);
-}
-
-// Transitive closure of a step's depends_on graph.
-function dependencyClosure(pipeline, stepName, seen = new Set()) {
-  const dependencies = pipeline.steps?.[stepName]?.depends_on ?? [];
-  for (const dependency of dependencies) {
-    if (seen.has(dependency)) continue;
-    seen.add(dependency);
-    dependencyClosure(pipeline, dependency, seen);
-  }
-  return seen;
-}
-
-// Deliberately over-broad: `git fetch` alone does not move HEAD, but the
-// classic re-checkout pair is `git fetch && git reset --hard <remote>`; a
-// fetch step sitting between verify and a publish effect deserves scrutiny,
-// so the gate fails closed on it.
-function movesHead(step) {
-  return (step.commands ?? []).some((command) =>
-    /(^|\s)git\s+(checkout|switch|reset|clean|pull|clone|fetch)\b/.test(command),
-  );
-}
-
-// The structural gate checker: green only when a failed (nonzero-exit)
-// verify provably blocks every publish effect on the same commit.
-function assertPublishGateBlocksOnVerify(pipeline) {
-  assert.ok(pipeline.steps, 'publish pipeline must define steps');
-  const verify = pipeline.steps.verify;
-  assert.ok(verify, 'publish pipeline must define a `verify` step (S7)');
-
-  // S5: a skipped verification authorizes publishes exactly as much as a
-  // failed one — verify must be unconditional.
-  assert.equal(verify.when, undefined, '`verify` must not carry a when/path filter (S5)');
-
-  // S3/S4: the depends_on edges are only meaningful if verify's own failure
-  // is both awaited and terminal for the DAG.
-  assert.equal(verify.detach, undefined, '`verify` must not be detached (S3)');
-  assert.equal(
-    verify.failure,
-    undefined,
-    '`verify` must not tolerate its own failure (S4: failure: ignore launders a failed gate into success)',
-  );
-  assert.equal(
-    verify.success,
-    undefined,
-    '`verify` must not override success exit codes (S4: nonzero codes would make failed verification pass)',
-  );
-
-  const effects = publishEffectSteps(pipeline);
-  assert.ok(effects.length > 0, 'publish pipeline must contain publish effect steps to guard');
-
-  const verifyClosure = dependencyClosure(pipeline, 'verify');
-  for (const stepName of effects) {
-    // S1: only the failure-skip semantics of the DAG stand between a failed
-    // verify and this effect — the verify edge in its closure is the proof.
-    const closure = dependencyClosure(pipeline, stepName);
-    assert.ok(
-      closure.has('verify'),
-      `publish effect '${stepName}' must transitively depend on verify (S1) — a failed verify must skip it`,
-    );
-
-    // S6: any step ordered after verify (outside its closure) but inside the
-    // effect's chain must not be able to move HEAD. If the pipeline
-    // legitimately re-checks-out, verify must run after the re-checkout.
-    for (const chainStep of closure) {
-      if (chainStep === 'verify' || verifyClosure.has(chainStep)) continue;
-      assert.ok(
-        !movesHead(pipeline.steps[chainStep]),
-        `step '${chainStep}' sits between verify and publish effect '${stepName}' and can move HEAD (S6)` +
-          ' — verify must re-run after any re-checkout',
-      );
-    }
-  }
-  return effects;
-}
-
-// A minimal but healthy gate used as the base for every negative-control
-// mutation: verify (identity + canonical command) → build → publish-npm,
-// with the publish effect blocked by verify both directly and through build.
-const HEALTHY_GATE_YAML = `
-steps:
-  verify:
-    image: node:24-alpine
-    commands:
-      - |
-        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
-          echo "identity mismatch" >&2
-          exit 1
-        fi
-      - pnpm verify:release
-  build:
-    image: node:24-alpine
-    commands:
-      - pnpm build
-    depends_on:
-      - verify
-  publish-npm:
-    image: node:24-alpine
-    commands:
-      - npm publish
-    depends_on:
-      - build
-      - verify
-`;
-
-// Fresh parse per call so every negative control mutates its own object.
-function healthyPipeline() {
-  return parseYaml(HEALTHY_GATE_YAML);
-}
-
-test('the real publish pipeline: a failed verify provably blocks every publish effect', async () => {
-  const pipeline = await readPublishPipeline();
-  const effects = assertPublishGateBlocksOnVerify(pipeline);
-  assert.deepEqual(effects.sort(), [
-    'build-appservice',
-    'build-gateway',
-    'build-web',
-    'publish-next-npm',
-    'publish-npm',
-  ]);
-});
-
-test('fixture sanity: the healthy gate base passes the checker unmutated', () => {
-  assertPublishGateBlocksOnVerify(healthyPipeline());
-});
-
-test('S1 negative control: a publish effect with no verify edge fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps['publish-npm'].depends_on = ['build'];
-  pipeline.steps.build.depends_on = [];
-  assert.throws(
-    () => assertPublishGateBlocksOnVerify(pipeline),
-    /publish-npm.*must transitively depend on verify/s,
-  );
-});
-
-test('S2 negative control: an npm publish hidden behind a non-publish step name fails the checker', () => {
-  const pipeline = healthyPipeline();
-  delete pipeline.steps['publish-npm'];
-  pipeline.steps.build.depends_on = [];
-  pipeline.steps.deploy = {
-    image: 'node:24-alpine',
-    commands: ['npm publish'],
-    depends_on: ['build'],
-  };
-  // Detection must be by COMMAND: the name says "deploy", the commands say
-  // publish — an un-gated effect under either reading.
-  assert.throws(
-    () => assertPublishGateBlocksOnVerify(pipeline),
-    /deploy.*must transitively depend on verify/s,
-  );
-});
-
-test('S2 negative control: a kaniko image push under a build-* name fails the checker when ungated', () => {
-  const pipeline = healthyPipeline();
-  delete pipeline.steps['publish-npm'];
-  pipeline.steps.build.depends_on = [];
-  pipeline.steps['push-platform-image'] = {
-    image: 'gcr.io/kaniko-project/executor:debug',
-    commands: ['/kaniko/executor --context . --destination reg.example/img:latest'],
-    depends_on: ['build'],
-  };
-  assert.throws(
-    () => assertPublishGateBlocksOnVerify(pipeline),
-    /push-platform-image.*must transitively depend on verify/s,
-  );
-});
-
-test('S3 negative control: a detached verify fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.verify.detach = true;
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /detached \(S3\)/);
-});
-
-test('S4 negative control: failure: ignore on verify fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.verify.failure = 'ignore';
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /tolerate its own failure/);
-});
-
-test('S4 negative control: a success override admitting nonzero exit codes fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.verify.success = [0, 1];
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /success exit codes/);
-});
-
-test('S5 negative control: a when filter on verify fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.verify.when = [{ event: 'push' }];
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /when\/path filter \(S5\)/);
-});
-
-test('S6 negative control: a HEAD-moving step between verify and publish fails the checker', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.resync = {
-    image: 'node:24-alpine',
-    commands: ['git fetch origin', 'git reset --hard origin/main'],
-    depends_on: [],
-  };
-  pipeline.steps.build.depends_on = ['verify', 'resync'];
-  // resync sits AFTER verify in the publish chain (verify does not depend on
-  // it), so the verified commit could be replaced before publishing.
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /resync.*can move HEAD/s);
-});
-
-test('S6 positive control: a legitimate re-checkout passes when verify re-runs after it', () => {
-  const pipeline = healthyPipeline();
-  pipeline.steps.resync = {
-    image: 'node:24-alpine',
-    commands: ['git fetch origin', 'git reset --hard origin/main'],
-    depends_on: [],
-  };
-  pipeline.steps.verify.depends_on = ['resync'];
-  pipeline.steps.build.depends_on = ['verify'];
-  // resync precedes verify in the chain, so verification covers the
-  // re-checked-out HEAD — the exact-commit contract holds.
-  assertPublishGateBlocksOnVerify(pipeline);
-});
-
-test('S7 negative control: deleting the verify step entirely fails the checker', () => {
-  const pipeline = healthyPipeline();
-  delete pipeline.steps.verify;
-  pipeline.steps['publish-npm'].depends_on = ['build'];
-  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /`verify` step/);
-});

scripts/verify-release.mjs

@@ -1,181 +0,0 @@
-#!/usr/bin/env node
-// verify-release.mjs — the ONE canonical terminal verification command
-// (SDLC-D-034, `pnpm verify:release`).
-//
-// Publication (.woodpecker/publish.yml `verify` step) is bound to terminal
-// verification of the exact commit through this command, which is composed
-// from the SAME commands the PR CI pipeline (.woodpecker/ci.yml) runs — CI and
-// publish share one semantic checklist:
-//
-//   stage         | mirrors ci.yml step | commands
-//   --------------|---------------------|------------------------------------------
-//   sanitization  | sanitization        | verify-sanitized.sh, check-resident-
-//                |                     | budget.sh (--self-test + run),
-//                |                     | check-test-enumeration.sh
-//   upgrade-guard | upgrade-guard       | test-upgrade-manifest-guard.sh,
-//                |                     | test-upgrade-rollback.sh,
-//                |                     | test-upgrade-durable-snapshot.sh,
-//                |                     | test-install-migration.sh
-//   typecheck     | typecheck           | pnpm typecheck (runs the checkout
-//                |                     | preflight, then turbo typecheck)
-//   lint          | lint                | pnpm lint
-//   format        | format              | pnpm format:check
-//   test          | test                | pnpm test
-//   build         | publish.yml build   | pnpm build
-//   quality-rails | (canonical-only)    | the TS quality-rails evaluator
-//                |                     | (RI-N4, QC-19 monorepo subject). Like
-//                |                     | `build`, this stage has no ci.yml
-//                |                     | mirror; it is implemented by
-//                |                     | importing the evaluator CLI rather
-//                |                     | than duplicating its presence logic.
-//
-// Caller-provided prerequisites (kept at the pipeline level — see the comments
-// in .woodpecker/ci.yml): `bash` + `rsync` for the guard stages, `openssl` and
-// the pinned @earendil-works/pi-coding-agent for the test stage, and — on the
-// postgres path only — the ci-postgres service plus
-// `pnpm --filter @mosaicstack/db run db:migrate` before the test stage.
-//
-// This command works with DATABASE_URL set (CI postgres path) or unset (local
-// PGlite path); it never sets, exports, or requires a database itself.
-//
-// scripts/verify-release.test.mjs enforces that this stage table keeps
-// matching .woodpecker/ci.yml step-for-step, so the two surfaces cannot drift
-// apart silently.
-
-import { spawnSync } from 'node:child_process';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export const STAGES = [
-  {
-    name: 'sanitization',
-    // Mirror of the .woodpecker/ci.yml `sanitization` step (minus its
-    // `apk add` environment prep). Kept as direct command strings here: the
-    // #1017 test-enumeration guard audits these paths through the ci.yml
-    // surface, so indirection from ci.yml into this file is not possible.
-    commands: [
-      'bash packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh',
-      'bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test',
-      'bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh',
-      'bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh',
-    ],
-  },
-  {
-    name: 'upgrade-guard',
-    // Mirror of the .woodpecker/ci.yml `upgrade-guard` step (minus its
-    // `apk add` environment prep).
-    commands: [
-      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-manifest-guard.sh',
-      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh',
-      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh',
-      'bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh',
-    ],
-  },
-  {
-    // `pnpm typecheck` is `pnpm preflight && turbo run typecheck`, so the
-    // checkout preflight (scripts/preflight.mjs) is part of this stage exactly
-    // as it is part of the ci.yml `typecheck` step.
-    name: 'typecheck',
-    commands: ['pnpm typecheck'],
-  },
-  {
-    name: 'lint',
-    commands: ['pnpm lint'],
-  },
-  {
-    name: 'format',
-    commands: ['pnpm format:check'],
-  },
-  {
-    // Requires `openssl` and the pinned `pi` binary on the pipeline path; see
-    // the caller-provided prerequisites above.
-    name: 'test',
-    commands: ['pnpm test'],
-  },
-  {
-    name: 'build',
-    commands: ['pnpm build'],
-  },
-  {
-    // RI-N4 (QC-19, card RI-3-002): the typed quality-rails evaluator, invoked
-    // as the implementation of the check it owns instead of a duplicated
-    // presence loop here. Canonical-only stage (no ci.yml mirror — same shape
-    // as `build`); runs AFTER build so the evaluator's dist/ exists. Subject
-    // is this repository (`.` → monorepo subject kind, per-subject check set).
-    name: 'quality-rails',
-    commands: ['node packages/quality-rails/dist/cli.js quality-rails evaluate --project .'],
-  },
-];
-
-export function stageByName(name) {
-  return STAGES.find((stage) => stage.name === name);
-}
-
-function missingBinaries(bins) {
-  return bins.filter(
-    (bin) => spawnSync('sh', ['-c', `command -v ${bin} >/dev/null 2>&1`]).status !== 0,
-  );
-}
-
-function runCommand(command) {
-  const result = spawnSync(command, { shell: true, stdio: 'inherit' });
-  if (result.error) {
-    console.error(`[verify:release] failed to launch '${command}': ${result.error.message}`);
-    return false;
-  }
-  if (result.status !== 0) {
-    const reason = result.signal ? `terminated by ${result.signal}` : `exited ${result.status}`;
-    console.error(`[verify:release] command '${command}' ${reason}`);
-    return false;
-  }
-  return true;
-}
-
-// Runs the complete mandatory verification set (or, with --stage <name>, the
-// single named stage — used for wiring/smoke-testing, not for gating: only a
-// run of every stage is a terminal verification). Fails fast: the first
-// failing command aborts with a non-zero exit code. Returns the exit code.
-export function verifyRelease({ stages = STAGES } = {}) {
-  const missing = missingBinaries(['bash', 'rsync']);
-  if (missing.length > 0) {
-    console.error(
-      `[verify:release] FATAL: required binaries missing from PATH: ${missing.join(', ')}. ` +
-        'The caller provides them (ci-base bakes bash; pipelines apk add rsync).',
-    );
-    return 1;
-  }
-  for (const stage of stages) {
-    console.log(`\n[verify:release] === stage: ${stage.name} ===`);
-    for (const command of stage.commands) {
-      console.log(`[verify:release] $ ${command}`);
-      if (!runCommand(command)) {
-        console.error(
-          `[verify:release] FATAL: stage '${stage.name}' failed — verification inconclusive`,
-        );
-        return 1;
-      }
-    }
-  }
-  console.log(`\n[verify:release] all ${stages.length} stage(s) passed`);
-  return 0;
-}
-
-function main(argv) {
-  const stageFlagIndex = argv.indexOf('--stage');
-  if (stageFlagIndex !== -1) {
-    const name = argv[stageFlagIndex + 1];
-    const stage = stageByName(name);
-    if (!stage) {
-      console.error(
-        `[verify:release] unknown stage '${name ?? ''}' — expected one of: ${STAGES.map((entry) => entry.name).join(', ')}`,
-      );
-      process.exit(2);
-    }
-    process.exit(verifyRelease({ stages: [stage] }));
-  }
-  process.exit(verifyRelease());
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2));
-}

scripts/verify-release.test.mjs

@@ -1,349 +0,0 @@
-import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import test from 'node:test';
-
-import { STAGES, stageByName } from './verify-release.mjs';
-
-// SDLC-D-034 checkout invariant: publication in .woodpecker/publish.yml is
-// bound to exact-commit terminal verification. This suite parses the real
-// pipeline files and fails red when the gate is bypassed, weakened, or drifts
-// out of sync with the canonical `pnpm verify:release` command. The negative
-// controls for pipeline DAG/bypass shapes live in
-// scripts/publish-gate-structure.test.mjs (RI-1-002); this file owns the
-// canonical-command composition controls.
-
-// Reuse the monorepo's existing YAML parser (@mosaicstack/mosaic's direct
-// dependency) instead of adding a root dependency or vendoring a parser.
-const mosaicRequire = createRequire(
-  path.resolve(process.cwd(), 'packages', 'mosaic', 'package.json'),
-);
-const { parse: parseYaml } = mosaicRequire('yaml');
-
-const publishYmlPath = path.join(process.cwd(), '.woodpecker', 'publish.yml');
-const ciYmlPath = path.join(process.cwd(), '.woodpecker', 'ci.yml');
-
-async function readPublishPipeline() {
-  return parseYaml(await readFile(publishYmlPath, 'utf8'));
-}
-
-// A step has an external publication effect when its name starts with
-// `publish` or when any command pushes an image to a registry.
-function pushesImage(step) {
-  return (step.commands ?? []).some((command) =>
-    /(^|\s)(\/kaniko\/executor|docker push)\b|--destination/.test(command),
-  );
-}
-
-function publishEffectSteps(pipeline) {
-  return Object.entries(pipeline.steps ?? {})
-    .filter(([name, step]) => name.startsWith('publish') || pushesImage(step))
-    .map(([name]) => name);
-}
-
-// Transitive closure of a step's depends_on graph.
-function dependencyClosure(pipeline, stepName, seen = new Set()) {
-  const dependencies = pipeline.steps?.[stepName]?.depends_on ?? [];
-  for (const dependency of dependencies) {
-    if (seen.has(dependency)) continue;
-    seen.add(dependency);
-    dependencyClosure(pipeline, dependency, seen);
-  }
-  return seen;
-}
-
-function verifyCommands(pipeline) {
-  const verify = pipeline.steps?.verify;
-  assert.ok(verify, 'publish pipeline must define a `verify` step');
-  assert.ok(Array.isArray(verify.commands), '`verify` step must have commands');
-  return verify.commands;
-}
-
-function assertCommitIdentityAssertion(commands) {
-  const text = commands.join('\n');
-  assert.match(
-    text,
-    /CI_COMMIT_SHA/,
-    '`verify` must compare the provider commit identity (CI_COMMIT_SHA)',
-  );
-  assert.match(text, /git rev-parse HEAD/, '`verify` must compare against git rev-parse HEAD');
-  assert.match(
-    text,
-    /exit 1/,
-    '`verify` must fail closed (exit 1) on identity mismatch or emptiness',
-  );
-}
-
-function assertCanonicalCommand(commands) {
-  assert.ok(
-    commands.some((command) => /^pnpm verify:release\b/.test(command.trim())),
-    '`verify` must run the canonical terminal verification command `pnpm verify:release`',
-  );
-}
-
-function assertPublishGate(pipeline) {
-  assert.ok(pipeline.steps, 'publish pipeline must define steps');
-
-  const commands = verifyCommands(pipeline);
-  assertCommitIdentityAssertion(commands);
-  assertCanonicalCommand(commands);
-
-  const effects = publishEffectSteps(pipeline);
-  assert.ok(effects.length > 0, 'publish pipeline must contain publish effect steps to guard');
-
-  for (const stepName of effects) {
-    const step = pipeline.steps[stepName];
-    assert.ok(
-      Array.isArray(step.depends_on) && step.depends_on.includes('verify'),
-      `publish effect '${stepName}' must depend DIRECTLY on the verify step (SDLC-D-034: transitively through build is not enough)`,
-    );
-    assert.ok(
-      dependencyClosure(pipeline, stepName).has('verify'),
-      `publish effect '${stepName}' must depend on a chain that includes verify`,
-    );
-  }
-  return effects;
-}
-
-test('the publish pipeline gates every publish effect behind exact-commit verification', async () => {
-  const pipeline = await readPublishPipeline();
-  const effects = assertPublishGate(pipeline);
-  assert.deepEqual(effects.sort(), [
-    'build-appservice',
-    'build-gateway',
-    'build-web',
-    'publish-next-npm',
-    'publish-npm',
-  ]);
-});
-
-test('the verify step carries no path/event short-circuit of its own', async () => {
-  const pipeline = await readPublishPipeline();
-  // A `when` filter on `verify` would let a publish effect fire on an event
-  // class that skipped verification — the gate must be unconditional.
-  assert.equal(pipeline.steps.verify.when, undefined);
-});
-
-test('a publish step that bypasses verify fails the gate checker', () => {
-  // Negative fixture: a plausible publish pipeline where `publish-npm` hangs
-  // off `build` only and `build` never chains to `verify` — the exact bypass
-  // class SDLC-D-034 closes. The checker must go red on it.
-  const bypassingPipeline = `
-steps:
-  install:
-    image: node:24-alpine
-    commands:
-      - pnpm install --frozen-lockfile
-  verify:
-    image: node:24-alpine
-    commands:
-      - |
-        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
-          echo "identity mismatch" >&2
-          exit 1
-        fi
-      - pnpm verify:release
-    depends_on:
-      - install
-  build:
-    image: node:24-alpine
-    commands:
-      - pnpm build
-    depends_on:
-      - install
-  publish-npm:
-    image: node:24-alpine
-    commands:
-      - pnpm publish
-    depends_on:
-      - build
-`;
-  assert.throws(
-    () => assertPublishGate(parseYaml(bypassingPipeline)),
-    /publish-npm.*DIRECTLY.*verify/s,
-  );
-});
-
-test('a publish step chained to verify only transitively fails the gate checker', () => {
-  // Negative fixture: `build` depends on verify but `publish-npm` does not
-  // carry the direct edge — weaker than SDLC-D-034 requires of the real DAG.
-  const transitiveOnlyPipeline = `
-steps:
-  install:
-    image: node:24-alpine
-    commands:
-      - pnpm install --frozen-lockfile
-  verify:
-    image: node:24-alpine
-    commands:
-      - |
-        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
-          echo "identity mismatch" >&2
-          exit 1
-        fi
-      - pnpm verify:release
-    depends_on:
-      - install
-  build:
-    image: node:24-alpine
-    commands:
-      - pnpm build
-    depends_on:
-      - install
-      - verify
-  publish-npm:
-    image: node:24-alpine
-    commands:
-      - pnpm publish
-    depends_on:
-      - build
-`;
-  assert.throws(
-    () => assertPublishGate(parseYaml(transitiveOnlyPipeline)),
-    /publish-npm.*DIRECTLY.*verify/s,
-  );
-});
-
-test('a verify step without the commit-identity assertion fails the gate checker', () => {
-  const noIdentityPipeline = `
-steps:
-  verify:
-    image: node:24-alpine
-    commands:
-      - pnpm verify:release
-  publish-npm:
-    image: node:24-alpine
-    commands:
-      - pnpm publish
-    depends_on:
-      - verify
-`;
-  assert.throws(() => assertPublishGate(parseYaml(noIdentityPipeline)), /CI_COMMIT_SHA/);
-});
-
-// The composition check: the canonical stage table must mirror the PR CI
-// pipeline's complete mandatory set. Parameterized by the stage list so the
-// subset negative control below can prove a dropped stage goes red (RI-1-002:
-// the canonical command cannot silently lose a check).
-function assertStagesMirrorCi(stages, ci) {
-  const canonical = Object.fromEntries(stages.map((stage) => [stage.name, stage.commands]));
-
-  // The complete mandatory set, in gate order. `quality-rails` is a
-  // canonical-only stage (RI-N4, QC-19): like `build`, it has no ci.yml
-  // mirror to match — its contract is asserted separately below.
-  assert.deepEqual(
-    stages.map((stage) => stage.name),
-    [
-      'sanitization',
-      'upgrade-guard',
-      'typecheck',
-      'lint',
-      'format',
-      'test',
-      'build',
-      'quality-rails',
-    ],
-  );
-
-  // Guard stages: ci.yml commands minus its `apk add` environment prep must be
-  // exactly the canonical stage commands (order included).
-  for (const stageName of ['sanitization', 'upgrade-guard']) {
-    assert.deepEqual(
-      ci.steps[stageName].commands.filter((command) => !command.startsWith('apk add')),
-      canonical[stageName],
-      `canonical '${stageName}' stage must match the ci.yml step`,
-    );
-  }
-
-  // pnpm stages: ci.yml commands minus `corepack enable` must be exactly the
-  // canonical stage commands.
-  for (const stepName of ['typecheck', 'lint', 'format']) {
-    assert.deepEqual(
-      ci.steps[stepName].commands.filter((command) => command !== 'corepack enable'),
-      canonical[stepName],
-      `canonical '${stepName}' stage must match the ci.yml step`,
-    );
-  }
-
-  // The test stage is shared, but ci.yml wraps it in pipeline-level
-  // prerequisites the canonical command expects its caller to provide
-  // (SDLC-D-034): the postgres service + readiness wait + db:migrate, openssl,
-  // and the pinned pi runtime. None of those may be dropped silently.
-  for (const command of canonical.test) {
-    assert.ok(
-      ci.steps.test.commands.includes(command),
-      `ci.yml test step must run the canonical test stage command '${command}'`,
-    );
-  }
-  for (const fragment of [
-    'pg_isready -h ci-postgres',
-    'pnpm --filter @mosaicstack/db run db:migrate',
-    'npm install -g @earendil-works/[email protected]',
-  ]) {
-    assert.ok(
-      ci.steps.test.commands.some((command) => command.includes(fragment)),
-      `ci.yml test step must keep its pipeline-level prerequisite '${fragment}'`,
-    );
-  }
-}
-
-test('the canonical verify:release stages mirror the PR CI pipeline one-for-one', async () => {
-  const ci = parseYaml(await readFile(ciYmlPath, 'utf8'));
-  assertStagesMirrorCi(STAGES, ci);
-});
-
-test('a subset stage list fails the composition check — a dropped stage cannot pass silently', async () => {
-  const ci = parseYaml(await readFile(ciYmlPath, 'utf8'));
-  // Drop each stage one at a time: every stage is load-bearing, so every drop
-  // must go red. If any drop went green, a refactor could silently delete a
-  // mandatory check from the canonical command.
-  for (const stage of STAGES) {
-    const subset = STAGES.filter((entry) => entry.name !== stage.name);
-    assert.throws(
-      () => assertStagesMirrorCi(subset, ci),
-      Error,
-      `composition check must fail when the '${stage.name}' stage is dropped from the table`,
-    );
-  }
-});
-
-test('the root package.json exposes verify:release as the canonical command', async () => {
-  const packageJson = JSON.parse(await readFile(path.join(process.cwd(), 'package.json'), 'utf8'));
-  assert.match(packageJson.scripts['verify:release'], /scripts\/verify-release\.mjs/);
-});
-
-// RI-N4 (card RI-3-002): the `quality-rails` stage must route through the TS
-// evaluator instead of duplicating its presence logic inline. The evaluator
-// owns QC-19; this file keeps that delegation honest.
-function assertEvaluatorStage(stage) {
-  assert.ok(stage, 'canonical stages must include a quality-rails stage');
-  assert.ok(Array.isArray(stage.commands) && stage.commands.length > 0);
-  for (const command of stage.commands) {
-    assert.match(
-      command,
-      /packages\/quality-rails\/dist\/cli\.js.*quality-rails evaluate/,
-      `quality-rails stage command must invoke the evaluator CLI, got: '${command}'`,
-    );
-  }
-}
-
-test('the quality-rails stage invokes the evaluator rather than duplicating its logic', () => {
-  assertEvaluatorStage(stageByName('quality-rails'));
-});
-
-test('a quality-rails stage that re-implements presence logic inline fails the checker', () => {
-  // Negative control: replacing the evaluator invocation with an inline
-  // `test -f` presence loop is exactly the duplication RI-N4 forbids — the
-  // checker must go red on it.
-  const duplicated = {
-    name: 'quality-rails',
-    commands: ['test -f .husky/pre-commit && test -f .husky/pre-push'],
-  };
-  assert.throws(() => assertEvaluatorStage(duplicated), /must invoke the evaluator CLI/);
-});
-
-test('a quality-rails stage that silently drops the evaluator command fails the checker', () => {
-  const empty = { name: 'quality-rails', commands: [] };
-  assert.throws(() => assertEvaluatorStage(empty), /commands/);
-});

skills/mosaic-forge/SKILL.md

@@ -133,13 +133,10 @@ When the full `@mosaicstack/forge` package is available, Forge uses MACP task ex
 
 ```bash
 # Run from CLI
-# Fails closed with a typed FORGE_NO_EXECUTOR capability error when no real
-# executor is wired — pass --simulate to opt into explicit typed simulation
-# (every result carries status `simulated`, which satisfies nothing).
-mosaic forge run path/to/brief.md [--simulate]
+mosaic forge run path/to/brief.md
 
-# Resume interrupted run (same fail-closed rule as forge run)
-mosaic forge resume .forge/runs/20260401-143022/ [--simulate]
+# Resume interrupted run
+mosaic forge resume .forge/runs/20260401-143022/
 
 # Check status
 mosaic forge status .forge/runs/20260401-143022/