fix(#812): resolve subpath-mounted gitea repo slug

docs/TASKS.md

@@ -64,7 +64,7 @@ Active workstream is **W1 — Federation v1**. Workers should:
 | FCM-M3-002 | in-progress | Add isolated systemd/tmux lifecycle, drift, socket, unmanaged-session, crash, and rollback acceptance coverage                                                         | #758  | sonnet        | mosaicstack/stack | `test/758-reconciler-lifecycle-gates`   | FCM-M3-001                                     | 25K      | Canonical v2 named-socket + legacy-v1 default-server boundaries; fake adapters/temp fixtures only                                                                                                                  |
 | FCM-M4-001 | done        | Implement field-complete v1-to-v2 inventory/preview/migrator with alias, lifecycle, env-quarantine, and remote/connector disposition evidence                          | #758  | codex         | mosaicstack/stack | `feat/758-v1-v2-migrator`               | FCM-M1-003, FCM-M3-001                         | 35K      | PR #788; final head `d63bb0206a1d312ab8352ec1d3ca3631146b0baa`; tree `4da210da9a71b035130d4160a4a2e691bdfde2da`; squash `9745bc3f29c26b021a478b7ad03cfb494f6c9de3`; descendant-main pipeline 1855 terminal success |
 | FCM-M4-002 | not-started | Add reversible canary migration, rollback, stale-projection/orphan classification, and current-host 9-managed/3-unmanaged fixture coverage                             | #758  | sonnet        | mosaicstack/stack | `test/758-migration-rollback-gates`     | FCM-M4-001, FCM-M3-002                         | 25K      | HOLD: never starts a previously stopped agent or kills an unproven unmanaged session; not authorized by FCM-M5-001                                                                                                 |
-| FCM-M5-001 | done        | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | #789 content squash 627cf2bb; de-flake repair PR#851/#849 squash 77c9a826; completion proof wp1937 @aa999daf push/ci step 49632 recovery_runtime_unittest.py 3/3 OK (closes wp1932 step 49576 Errno111)            |
+| FCM-M5-001 | in-progress | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | Sole owner: this FCM-M5-001 delivery on the recorded branch; must close every checklist item or record an approved deferral                                                                                        |
 | FCM-M5-002 | not-started | Package/update asset-drift checks, rolling local canary, independent validation certificate, and release evidence                                                      | #758  | sonnet        | mosaicstack/stack | `feat/758-fleet-config-release-gate`    | FCM-M3-002, FCM-M4-002, FCM-M5-001             | 30K      | HOLD: final #758 gate; quality, independent code/security review, validator certificate, merge-gate approval, and green CI remain out of M5-001                                                                    |
 
 ## Thin-core prompt diet (#528) — feat/contract-thin-core

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -91,19 +91,13 @@ remote = urlparse(f"//{remote_host}")
 if configured.scheme not in {"http", "https"} or configured.hostname != remote.hostname:
     raise SystemExit(1)
 
-# Normalize by scheme: an implicit (portless) HTTP(S) URL and its explicit
-# default-port form (":80" for http, ":443" for https) name the same
-# provider endpoint. Apply that equivalence symmetrically -- whichever side
-# omits the port is treated as carrying the scheme's default port -- so
-# "configured implicit vs. remote explicit" and "configured explicit vs.
-# remote implicit" both match. (The remote side here is always an HTTP(S)
-# authority; an SSH remote's transport port is stripped by get_remote_host
-# before reaching this comparison, since it identifies an unrelated
-# service on the same host, not the HTTP(S) provider port.)
+configured_port = configured.port
+remote_port = remote.port
+if remote_port is None:
     default_port = 80 if configured.scheme == "http" else 443
-normalized_configured = configured.port if configured.port is not None else default_port
-normalized_remote = remote.port if remote.port is not None else default_port
-if normalized_configured != normalized_remote:
+    if configured_port not in {None, default_port}:
+        raise SystemExit(1)
+elif configured_port != remote_port:
     raise SystemExit(1)
 raise SystemExit(0)
 PY
@@ -438,11 +432,7 @@ get_remote_host() {
     fi
     if [[ "$remote_url" =~ ^ssh://([^/]+)/ ]]; then
         local host="${BASH_REMATCH[1]}"
-        host="${host##*@}"
-        # Strip an SSH transport port (e.g. "git.example:2222"): it names the
-        # SSH daemon port, not the HTTP(S) provider API port, and must not
-        # feed gitea_url_matches_host's port comparison (#850).
-        echo "${host%%:*}"
+        echo "${host##*@}"
         return 0
     fi
     if [[ "$remote_url" =~ ^git@([^:]+): ]]; then

packages/mosaic/framework/tools/git/pr-review.sh

@@ -56,125 +56,6 @@ fi
 
 detect_platform >/dev/null
 
-# Post a review comment body to a Gitea PR via the supported comments REST API
-# and verify it durably via provider read-back (see docs on durable review
-# provenance in README.md). Used by the `comment` action and, since `tea`
-# v0.11.1 defines no `--comment`/`-comment` flag on `pr approve`/`pr reject`,
-# also by the `approve` and `request-changes` actions to carry an optional
-# review body that `tea` itself cannot attach.
-#
-# Args: $1 = PR number, $2 = comment body
-# On success: prints only the created comment ID to stdout, returns 0.
-# On failure: prints an error to stderr, returns 1.
-gitea_post_verified_comment() {
-    local pr_number="$1" comment_body="$2"
-    local host token configured_url repo api_base payload
-    local write_response_file readback_response_file comment_id
-
-    host=$(get_remote_host)
-    token=$(get_gitea_token "$host") || {
-        echo "Error: Gitea token not found for comment persistence" >&2
-        return 1
-    }
-    configured_url=$(get_gitea_url_for_host "$host") || {
-        echo "Error: Configured Gitea URL not found for comment persistence" >&2
-        return 1
-    }
-    repo=$(get_gitea_repo_slug_for_url "$configured_url") || {
-        echo "Error: Could not resolve Gitea owner/repository relative to configured URL" >&2
-        return 1
-    }
-    api_base="${configured_url%/}/api/v1/repos/$repo"
-    payload=$(COMMENT_BODY="$comment_body" python3 -c '
-import json
-import os
-
-print(json.dumps({"body": os.environ["COMMENT_BODY"]}))
-')
-    write_response_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-write.XXXXXX")
-    readback_response_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-readback.XXXXXX")
-    trap 'rm -f "$write_response_file" "$readback_response_file"' RETURN
-
-    if ! write_status=$(curl -sS -o "$write_response_file" -w '%{http_code}' \
-        -X POST \
-        -H "Authorization: token $token" \
-        -H 'Content-Type: application/json' \
-        -d "$payload" \
-        "$api_base/issues/$pr_number/comments"); then
-        echo "Error: Gitea comment write transport failed" >&2
-        return 1
-    fi
-    if [[ "$write_status" != "201" ]]; then
-        echo "Error: Gitea comment write failed with HTTP $write_status" >&2
-        return 1
-    fi
-
-    comment_id=$(python3 - "$write_response_file" <<'PY'
-import json
-import sys
-
-try:
-    with open(sys.argv[1], encoding="utf-8") as response:
-        comment = json.load(response)
-    comment_id = comment.get("id") if isinstance(comment, dict) else None
-    if not isinstance(comment_id, int) or comment_id <= 0:
-        raise ValueError("missing positive comment id")
-except (OSError, json.JSONDecodeError, ValueError) as error:
-    print(f"Error: could not identify created Gitea comment: {error}", file=sys.stderr)
-    raise SystemExit(1)
-print(comment_id)
-PY
-) || return 1
-
-    if ! readback_status=$(curl -sS -o "$readback_response_file" -w '%{http_code}' \
-        -H "Authorization: token $token" \
-        "$api_base/issues/comments/$comment_id"); then
-        echo "Error: Gitea comment read-back transport failed" >&2
-        return 1
-    fi
-    if [[ "$readback_status" != "200" ]]; then
-        echo "Error: Gitea comment read-back failed with HTTP $readback_status" >&2
-        return 1
-    fi
-
-    if EXPECTED_COMMENT_ID="$comment_id" EXPECTED_COMMENT_BODY="$comment_body" EXPECTED_REPO="$repo" EXPECTED_PR_NUMBER="$pr_number" \
-        python3 - "$readback_response_file" <<'PY'
-import json
-import os
-import sys
-from urllib.parse import urlparse
-
-try:
-    with open(sys.argv[1], encoding="utf-8") as response:
-        comment = json.load(response)
-    if not isinstance(comment, dict):
-        raise ValueError("response is not a comment object")
-    expected_id = int(os.environ["EXPECTED_COMMENT_ID"])
-    expected_body = os.environ["EXPECTED_COMMENT_BODY"]
-    expected_repo = os.environ["EXPECTED_REPO"]
-    expected_pr = os.environ["EXPECTED_PR_NUMBER"]
-    issue_path = urlparse(comment.get("issue_url", "")).path.rstrip("/")
-    expected_suffix = f"/repos/{expected_repo}/issues/{expected_pr}"
-    if comment.get("id") != expected_id:
-        raise ValueError("comment id mismatch")
-    if comment.get("body") != expected_body:
-        raise ValueError("comment body mismatch")
-    if not issue_path.endswith(expected_suffix):
-        raise ValueError("repository or PR mismatch")
-except (OSError, json.JSONDecodeError, KeyError, TypeError, ValueError) as error:
-    print(f"Error: Gitea comment persistence verification failed: {error}", file=sys.stderr)
-    raise SystemExit(1)
-PY
-    then
-        true
-    else
-        return 1
-    fi
-
-    echo "$comment_id"
-    return 0
-}
-
 if [[ "$PLATFORM" == "github" ]]; then
     case $ACTION in
         approve)
@@ -208,14 +89,8 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
             repo=$(get_repo_slug)
             host=$(get_remote_host)
             login=$(get_gitea_login_for_host "$host")
-            # tea v0.11.1 defines no --comment/-comment flag on `pr approve`;
-            # route any review body via the durable comment API instead (#835).
-            tea pr approve "$PR_NUMBER" --repo "$repo" --login "$login"
+            tea pr approve "$PR_NUMBER" --repo "$repo" --login "$login" ${COMMENT:+--comment "$COMMENT"}
             echo "Approved Gitea PR #$PR_NUMBER"
-            if [[ -n "$COMMENT" ]]; then
-                comment_id=$(gitea_post_verified_comment "$PR_NUMBER" "$COMMENT") || exit 1
-                echo "Added and verified review comment on Gitea PR #$PR_NUMBER (comment ID $comment_id)"
-            fi
             ;;
         request-changes)
             if [[ -z "$COMMENT" ]]; then
@@ -225,12 +100,8 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
             repo=$(get_repo_slug)
             host=$(get_remote_host)
             login=$(get_gitea_login_for_host "$host")
-            # tea v0.11.1 defines no --comment/-comment flag on `pr reject`;
-            # route the review body via the durable comment API instead (#835).
-            tea pr reject "$PR_NUMBER" --repo "$repo" --login "$login"
+            tea pr reject "$PR_NUMBER" --repo "$repo" --login "$login" --comment "$COMMENT"
             echo "Requested changes on Gitea PR #$PR_NUMBER"
-            comment_id=$(gitea_post_verified_comment "$PR_NUMBER" "$COMMENT") || exit 1
-            echo "Added and verified review comment on Gitea PR #$PR_NUMBER (comment ID $comment_id)"
             ;;
         comment)
             if [[ -z "$COMMENT" ]]; then
@@ -238,7 +109,101 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
                 exit 1
             fi
 
-            comment_id=$(gitea_post_verified_comment "$PR_NUMBER" "$COMMENT") || exit 1
+            host=$(get_remote_host)
+            token=$(get_gitea_token "$host") || {
+                echo "Error: Gitea token not found for comment persistence" >&2
+                exit 1
+            }
+            configured_url=$(get_gitea_url_for_host "$host") || {
+                echo "Error: Configured Gitea URL not found for comment persistence" >&2
+                exit 1
+            }
+            repo=$(get_gitea_repo_slug_for_url "$configured_url") || {
+                echo "Error: Could not resolve Gitea owner/repository relative to configured URL" >&2
+                exit 1
+            }
+            api_base="${configured_url%/}/api/v1/repos/$repo"
+            payload=$(COMMENT_BODY="$COMMENT" python3 -c '
+import json
+import os
+
+print(json.dumps({"body": os.environ["COMMENT_BODY"]}))
+')
+            write_response_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-write.XXXXXX")
+            readback_response_file=$(mktemp "${TMPDIR:-/tmp}/mosaic-pr-review-readback.XXXXXX")
+            trap 'rm -f "$write_response_file" "$readback_response_file"' EXIT
+
+            if ! write_status=$(curl -sS -o "$write_response_file" -w '%{http_code}' \
+                -X POST \
+                -H "Authorization: token $token" \
+                -H 'Content-Type: application/json' \
+                -d "$payload" \
+                "$api_base/issues/$PR_NUMBER/comments"); then
+                echo "Error: Gitea comment write transport failed" >&2
+                exit 1
+            fi
+            if [[ "$write_status" != "201" ]]; then
+                echo "Error: Gitea comment write failed with HTTP $write_status" >&2
+                exit 1
+            fi
+
+            comment_id=$(python3 - "$write_response_file" <<'PY'
+import json
+import sys
+
+try:
+    with open(sys.argv[1], encoding="utf-8") as response:
+        comment = json.load(response)
+    comment_id = comment.get("id") if isinstance(comment, dict) else None
+    if not isinstance(comment_id, int) or comment_id <= 0:
+        raise ValueError("missing positive comment id")
+except (OSError, json.JSONDecodeError, ValueError) as error:
+    print(f"Error: could not identify created Gitea comment: {error}", file=sys.stderr)
+    raise SystemExit(1)
+print(comment_id)
+PY
+)
+
+            if ! readback_status=$(curl -sS -o "$readback_response_file" -w '%{http_code}' \
+                -H "Authorization: token $token" \
+                "$api_base/issues/comments/$comment_id"); then
+                echo "Error: Gitea comment read-back transport failed" >&2
+                exit 1
+            fi
+            if [[ "$readback_status" != "200" ]]; then
+                echo "Error: Gitea comment read-back failed with HTTP $readback_status" >&2
+                exit 1
+            fi
+
+            EXPECTED_COMMENT_ID="$comment_id" EXPECTED_COMMENT_BODY="$COMMENT" EXPECTED_REPO="$repo" EXPECTED_PR_NUMBER="$PR_NUMBER" \
+                python3 - "$readback_response_file" <<'PY'
+import json
+import os
+import sys
+from urllib.parse import urlparse
+
+try:
+    with open(sys.argv[1], encoding="utf-8") as response:
+        comment = json.load(response)
+    if not isinstance(comment, dict):
+        raise ValueError("response is not a comment object")
+    expected_id = int(os.environ["EXPECTED_COMMENT_ID"])
+    expected_body = os.environ["EXPECTED_COMMENT_BODY"]
+    expected_repo = os.environ["EXPECTED_REPO"]
+    expected_pr = os.environ["EXPECTED_PR_NUMBER"]
+    issue_path = urlparse(comment.get("issue_url", "")).path.rstrip("/")
+    expected_suffix = f"/repos/{expected_repo}/issues/{expected_pr}"
+    if comment.get("id") != expected_id:
+        raise ValueError("comment id mismatch")
+    if comment.get("body") != expected_body:
+        raise ValueError("comment body mismatch")
+    if not issue_path.endswith(expected_suffix):
+        raise ValueError("repository or PR mismatch")
+except (OSError, json.JSONDecodeError, KeyError, TypeError, ValueError) as error:
+    print(f"Error: Gitea comment persistence verification failed: {error}", file=sys.stderr)
+    raise SystemExit(1)
+PY
+
             echo "Added and verified comment on Gitea PR #$PR_NUMBER (comment ID $comment_id)"
             ;;
         *)

packages/mosaic/framework/tools/git/test-pr-review-gitea-comment.sh

@@ -1,11 +1,5 @@
 #!/usr/bin/env bash
-# Regression harness for durable Gitea PR review comments (#812) and for the
-# approve/reject `--comment` flag removal (#835). The `tea` stub below rejects
-# any `-comment`/`--comment` flag on `pr approve`/`pr reject` exactly like real
-# `tea` v0.11.1 does ("flag provided but not defined: -comment"), so this
-# harness fails RED against the pre-#835 wrapper (which passed that flag) and
-# only passes once the wrapper routes the review body through the durable
-# comment REST API instead.
+# Regression harness for durable Gitea PR review comments (#812).
 
 set -euo pipefail
 
@@ -57,23 +51,14 @@ if [[ "$*" == "login list --output json" ]]; then
     exit 0
 fi
 
-# tea v0.11.1 defines no --comment/-comment flag on `pr approve` or `pr
-# reject`; it fails closed with this exact message and a nonzero exit. Any
-# regression that reintroduces the flag on those subcommands must hit this
-# branch and fail RED (#835).
-if [[ "$*" == *" -comment "* || "$*" == *" --comment "* || "$*" == *" -comment" || "$*" == *" --comment" ]]; then
-    echo "flag provided but not defined: -comment" >&2
-    exit 1
-fi
-
 case "${PR_REVIEW_TEST_MODE:-}" in
     approve)
         [[ "$*" == "pr approve 123 --repo mosaicstack/stack --login mosaicstack" ]] || exit 90
         ;;
     request-changes)
-        [[ "$*" == "pr reject 123 --repo mosaicstack/stack --login mosaicstack" ]] || exit 91
+        [[ "$*" == "pr reject 123 --repo mosaicstack/stack --login mosaicstack --comment changes-required" ]] || exit 91
         ;;
-    legacy-fallback|comment-success|http-success|prefix-success|subpath-success|port-success|scp-ssh-success|url-ssh-success|ssh-transport-port-success|explicit-default-port-success|write-transport-failure|write-http-failure|readback-failure)
+    legacy-fallback|comment-success|http-success|prefix-success|subpath-success|port-success|scp-ssh-success|url-ssh-success|write-transport-failure|write-http-failure|readback-failure)
         if [[ "$*" == pr\ comment* ]]; then
             # tea v0.11.1 treats the nonexistent subcommand as `tea pr list` and exits 0.
             printf '%s\n' 'INDEX TITLE STATE'
@@ -144,7 +129,7 @@ case "${PR_REVIEW_TEST_MODE:-}" in
     write-http-failure)
         write_response 500 '{"message":"simulated rejection"}'
         ;;
-    approve|request-changes|comment-success|http-success|prefix-success|subpath-success|port-success|scp-ssh-success|url-ssh-success|ssh-transport-port-success|explicit-default-port-success|readback-failure)
+    comment-success|http-success|prefix-success|subpath-success|port-success|scp-ssh-success|url-ssh-success|readback-failure)
         if [[ "$method" == "POST" && "$url" == "$PR_REVIEW_EXPECTED_API_BASE/issues/123/comments" ]]; then
             PR_REVIEW_PAYLOAD="$payload" python3 - <<'PY'
 import json
@@ -217,28 +202,10 @@ run_review() {
 run_review approve approve
 grep -q '^pr approve 123 --repo mosaicstack/stack --login mosaicstack$' "$TEA_LOG"
 grep -q 'Approved Gitea PR #123' "$OUTPUT_FILE"
-if grep -q 'comment' "$TEA_LOG"; then
-    echo "Plain approve (no review body) unexpectedly touched comment persistence" >&2
-    exit 1
-fi
 
-# #835: tea v0.11.1 defines no --comment/-comment flag on `pr approve`. A
-# review body supplied alongside approve must be routed through the durable
-# comment REST API instead of being passed to `tea` directly.
-run_review approve approve approve-note
-grep -q '^pr approve 123 --repo mosaicstack/stack --login mosaicstack$' "$TEA_LOG"
-grep -q 'Approved Gitea PR #123' "$OUTPUT_FILE"
-grep -q '^POST https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/issues/123/comments$' "$CURL_LOG"
-grep -q '^GET https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/issues/comments/456$' "$CURL_LOG"
-grep -q 'Added and verified review comment on Gitea PR #123 (comment ID 456)' "$OUTPUT_FILE"
-
-# #835: same for `pr reject` (request-changes), where a comment is required.
 run_review request-changes request-changes changes-required
-grep -q '^pr reject 123 --repo mosaicstack/stack --login mosaicstack$' "$TEA_LOG"
+grep -q '^pr reject 123 --repo mosaicstack/stack --login mosaicstack --comment changes-required$' "$TEA_LOG"
 grep -q 'Requested changes on Gitea PR #123' "$OUTPUT_FILE"
-grep -q '^POST https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/issues/123/comments$' "$CURL_LOG"
-grep -q '^GET https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/issues/comments/456$' "$CURL_LOG"
-grep -q 'Added and verified review comment on Gitea PR #123 (comment ID 456)' "$OUTPUT_FILE"
 
 if run_review legacy-fallback comment durable-body; then
     echo "The old nonexistent tea pr comment fallback returned success" >&2
@@ -291,23 +258,6 @@ grep -q '^POST https://git.example/api/v1/repos/owner/repo/issues/123/comments$'
 run_review url-ssh-success comment durable-body https://git.example ssh://git@git.example/owner/repo.git owner/repo
 grep -q '^POST https://git.example/api/v1/repos/owner/repo/issues/123/comments$' "$CURL_LOG"
 
-# #850 (follow-up to #812): an SSH remote's transport port (e.g. `ssh://
-# git@host:2222/...`) must NOT be compared against the configured HTTP(S) API
-# URL's port -- they identify unrelated properties (SSH daemon port vs. HTTP(S)
-# provider port) of the same Gitea host. Before the fix, host-match required
-# the configured URL to carry the identical port, so this failed closed even
-# though both remote and configured URL name the same host.
-run_review ssh-transport-port-success comment durable-body https://git.example ssh://git@git.example:2222/owner/repo.git owner/repo
-grep -q '^POST https://git.example/api/v1/repos/owner/repo/issues/123/comments$' "$CURL_LOG"
-
-# #850 (follow-up to #812): an explicit default HTTP(S) port on the remote
-# (`https://host:443/...`) must be treated as equal to an implicit
-# (portless) configured URL on BOTH sides -- the pre-fix comparison only
-# normalized the default port when the REMOTE side was portless, so the
-# inverse (explicit remote, implicit configured) form failed closed.
-run_review explicit-default-port-success comment durable-body https://git.example https://git.example:443/owner/repo.git owner/repo
-grep -q '^POST https://git.example/api/v1/repos/owner/repo/issues/123/comments$' "$CURL_LOG"
-
 if run_review write-transport-failure comment durable-body; then
     echo "Expected provider transport failure to return nonzero" >&2
     exit 1

packages/mosaic/framework/tools/qa/qa-hook-stdin.sh

@@ -50,21 +50,6 @@ if ! [[ "$FILE_PATH" =~ \.(ts|tsx|js|jsx|mjs|cjs)$ ]]; then
     exit 0
 fi
 
-# Deps preflight (#856): this hook is the common gate-entry seam the delivery
-# cycle invokes on every Edit/Write/MultiEdit — it fires before any pnpm-based
-# gate (test/lint/typecheck/format:check) runs against the edited file. In a
-# freshly created git worktree (pnpm workspaces do NOT share node_modules
-# across worktrees), node_modules/.bin is empty until `pnpm install` has run,
-# so gate binaries (tsc/eslint/prettier/vitest) fail with a raw, illegible
-# `sh: 1: <tool>: not found` that is indistinguishable from a real failure.
-# Fail legibly here instead, before that raw error has a chance to surface.
-BIN_DIR="$PROJECT_ROOT/node_modules/.bin"
-if [ ! -d "$BIN_DIR" ] || [ -z "$(ls -A "$BIN_DIR" 2>/dev/null)" ]; then
-    echo "deps not installed — run pnpm install" >&2
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] deps not installed — run pnpm install ($BIN_DIR is missing or empty)" >> "$LOG_FILE"
-    exit 1
-fi
-
 # Call the main QA handler with extracted parameters
 if [ -f ~/.config/mosaic/tools/qa/qa-hook-handler.sh ]; then
     echo "[$(date '+%Y-%m-%d %H:%M:%S')] Calling QA handler for $FILE_PATH" >> "$LOG_FILE"

packages/mosaic/framework/tools/qa/test-deps-preflight.sh

@@ -1,116 +0,0 @@
-#!/usr/bin/env bash
-# Regression harness for #856: worker git-worktrees under a fresh `git worktree
-# add` have no node_modules until `pnpm install` runs (pnpm workspaces do NOT
-# share node_modules across worktrees). Before the fix, the gate-entry seam
-# (qa-hook-stdin.sh, registered as the PostToolUse hook for every Edit/Write/
-# MultiEdit in runtime/claude/settings.json) silently let a raw
-# `sh: 1: <tool>: not found` surface from any downstream gate invocation —
-# indistinguishable from a real test/lint failure (false-red).
-#
-# Asserts:
-#   1. RED (documented): a completely fresh worktree with no node_modules/.bin
-#      at all produces the raw "not found" for a gate binary — this is the
-#      defect the fix prevents from reaching the operator un-annotated.
-#   2. With node_modules/.bin missing entirely, the seam exits nonzero with
-#      the legible sentinel "deps not installed — run pnpm install" instead
-#      of silently proceeding (exit 0) into a would-be raw not-found.
-#   3. With node_modules/.bin present but empty, same legible-sentinel
-#      behavior (covers `git worktree add` immediately followed by an
-#      as-yet-incomplete/interrupted install).
-#   4. Once node_modules/.bin is populated (post `pnpm install`), the seam
-#      proceeds normally (exit 0) — the preflight does not false-positive.
-#   5. Non-JS/TS files are unaffected (existing skip behavior preserved).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HOOK="$SCRIPT_DIR/qa-hook-stdin.sh"
-
-TMP_DIR=$(mktemp -d)
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-fail=0
-
-fail_msg() {
-    echo "FAIL: $*" >&2
-    fail=1
-}
-
-run_hook() {
-    local file_path="$1"
-    printf '{"tool_name":"Edit","tool_input":{"file_path":"%s"}}' "$file_path" | "$HOOK"
-}
-
-make_fixture_repo() {
-    local dir="$1"
-    mkdir -p "$dir"
-    git -C "$dir" init -q .
-    git -C "$dir" -c user.email=fixture@test -c user.name=fixture commit -q --allow-empty -m init
-}
-
-# --- Scenario 1: RED — document the pre-fix raw not-found a gate hits when
-#     node_modules/.bin is entirely absent (this is what the preflight now
-#     intercepts before any gate command runs).
-RED_DIR="$TMP_DIR/red-fixture"
-make_fixture_repo "$RED_DIR"
-RED_OUTPUT=$(PATH="/usr/bin:/bin" sh -c 'tsc --noEmit' 2>&1) && RED_STATUS=0 || RED_STATUS=$?
-case "$RED_OUTPUT" in
-    *"not found"*) ;;
-    *) fail_msg "expected the raw un-preflighted invocation to demonstrate 'not found'; got: $RED_OUTPUT" ;;
-esac
-[[ "$RED_STATUS" -ne 0 ]] || fail_msg "expected raw invocation without deps installed to fail"
-
-# --- Scenario 2: node_modules/.bin missing entirely -> legible sentinel, nonzero.
-MISSING_DIR="$TMP_DIR/missing-bin"
-make_fixture_repo "$MISSING_DIR"
-echo "console.log(1)" > "$MISSING_DIR/x.ts"
-OUTPUT=$(cd "$MISSING_DIR" && run_hook "$MISSING_DIR/x.ts" 2>&1) && STATUS=0 || STATUS=$?
-[[ "$STATUS" -ne 0 ]] || fail_msg "missing node_modules/.bin: expected nonzero exit, got 0"
-case "$OUTPUT" in
-    *"deps not installed"*"pnpm install"*) ;;
-    *) fail_msg "missing node_modules/.bin: expected legible sentinel, got: $OUTPUT" ;;
-esac
-
-# --- Scenario 3: node_modules/.bin present but empty -> legible sentinel, nonzero.
-EMPTY_DIR="$TMP_DIR/empty-bin"
-make_fixture_repo "$EMPTY_DIR"
-mkdir -p "$EMPTY_DIR/node_modules/.bin"
-echo "console.log(1)" > "$EMPTY_DIR/x.ts"
-OUTPUT=$(cd "$EMPTY_DIR" && run_hook "$EMPTY_DIR/x.ts" 2>&1) && STATUS=0 || STATUS=$?
-[[ "$STATUS" -ne 0 ]] || fail_msg "empty node_modules/.bin: expected nonzero exit, got 0"
-case "$OUTPUT" in
-    *"deps not installed"*"pnpm install"*) ;;
-    *) fail_msg "empty node_modules/.bin: expected legible sentinel, got: $OUTPUT" ;;
-esac
-
-# --- Scenario 4: node_modules/.bin populated (post `pnpm install`) -> proceeds normally.
-OK_DIR="$TMP_DIR/installed-bin"
-make_fixture_repo "$OK_DIR"
-mkdir -p "$OK_DIR/node_modules/.bin"
-printf '#!/bin/sh\necho ok\n' > "$OK_DIR/node_modules/.bin/tsc"
-chmod +x "$OK_DIR/node_modules/.bin/tsc"
-echo "console.log(1)" > "$OK_DIR/x.ts"
-OUTPUT=$(cd "$OK_DIR" && run_hook "$OK_DIR/x.ts" 2>&1) && STATUS=0 || STATUS=$?
-[[ "$STATUS" -eq 0 ]] || fail_msg "populated node_modules/.bin: expected exit 0, got $STATUS ($OUTPUT)"
-case "$OUTPUT" in
-    *"deps not installed"*) fail_msg "populated node_modules/.bin: unexpected sentinel fired: $OUTPUT" ;;
-    *) ;;
-esac
-
-# --- Scenario 5: non-JS/TS files are unaffected by the preflight (still
-#     skipped before the deps check, regardless of node_modules state).
-NONJS_DIR="$TMP_DIR/nonjs"
-make_fixture_repo "$NONJS_DIR"
-echo "# doc" > "$NONJS_DIR/README.md"
-OUTPUT=$(cd "$NONJS_DIR" && run_hook "$NONJS_DIR/README.md" 2>&1) && STATUS=0 || STATUS=$?
-[[ "$STATUS" -eq 0 ]] || fail_msg "non-JS/TS file: expected exit 0 (skip), got $STATUS ($OUTPUT)"
-case "$OUTPUT" in
-    *"deps not installed"*) fail_msg "non-JS/TS file: preflight incorrectly fired: $OUTPUT" ;;
-    *) ;;
-esac
-
-if [[ "$fail" -eq 0 ]]; then
-    echo "deps-preflight regression passed (5/5 scenarios)"
-fi
-
-exit "$fail"

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/lease-broker/recovery_runtime_unittest.py

@@ -31,17 +31,9 @@ PI_EXTENSION = FRAMEWORK / "runtime/pi/mosaic-extension.ts"
 
 
 def request(socket_path: Path, value: dict[str, object]) -> dict[str, object]:
-    deadline = time.monotonic() + 5.0
-    while True:
     with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
         connection.settimeout(3.0)
-            try:
         connection.connect(str(socket_path))
-            except ConnectionRefusedError:
-                if time.monotonic() >= deadline:
-                    raise
-                time.sleep(0.02)
-                continue
         connection.sendall((json.dumps(value, separators=(",", ":")) + "\n").encode())
         connection.shutdown(socket.SHUT_WR)
         response = bytearray()
@@ -50,7 +42,6 @@ def request(socket_path: Path, value: dict[str, object]) -> dict[str, object]:
             if not chunk:
                 break
             response.extend(chunk)
-        break
     if not response.endswith(b"\n") or response.count(b"\n") != 1:
         raise AssertionError(f"unframed broker response: {bytes(response)!r}")
     reply = json.loads(response[:-1])

packages/mosaic/src/mutator-gate/mutator-gate.acceptance.spec.ts

@@ -661,27 +661,13 @@ describe('whole mutator-class lease gate', () => {
   test('observer revocation and monotonic TTL expiry deny the next mutator', async () => {
     const { socket } = await startBroker();
     const sessionId = await register(socket);
-
-    // Establish the lease with a normal (non-racing) TTL first and prove it
-    // authorizes. This "still valid" check is setup, not a TTL-expiry
-    // assertion, so it must not share a lease with a 1-second TTL: on a
-    // contended push-CI host, scheduling delay alone between promote() and
-    // this authorize() call can consume that entire 1-second margin and
-    // spuriously deny it (CI#1945). Using a generous TTL here removes that
-    // real-time race without touching lease-gate security semantics.
-    const pending = await beginVerification(socket, sessionId, 'claude');
+    const pending = await beginVerification(socket, sessionId, 'claude', 1, 1);
     await promote(socket, sessionId, pending.receipt_challenge!);
+
     expect(await authorize(socket, sessionId, 'claude', 'Bash')).toMatchObject({
       ok: true,
       decision: 'allow',
     });
-
-    // A dedicated, isolated short-TTL lease drives the deliberate monotonic
-    // expiry demonstration below. It is never used for anything but the
-    // wait-then-expire assertion, so there is no setup work racing its
-    // 1-second window.
-    const shortLived = await beginVerification(socket, sessionId, 'claude', 1, 1, 2);
-    await promote(socket, sessionId, shortLived.receipt_challenge!);
     await new Promise((resolve) => setTimeout(resolve, 1_100));
     expect(await authorize(socket, sessionId, 'claude', 'Bash')).toMatchObject({
       ok: false,
@@ -689,7 +675,7 @@ describe('whole mutator-class lease gate', () => {
       decision: 'deny',
     });
 
-    const refreshed = await beginVerification(socket, sessionId, 'claude', 1, 300, 3);
+    const refreshed = await beginVerification(socket, sessionId, 'claude', 1, 300, 2);
     await promote(socket, sessionId, refreshed.receipt_challenge!);
     expect(
       await request(socket, {

plugins/mosaic-framework/src/index.ts

@@ -217,22 +217,12 @@ git fetch origin
 mkdir -p ~/src/${projectName}-worktrees
 git worktree add ~/src/${projectName}-worktrees/<task-slug> -b <branch-name> origin/main
 cd ~/src/${projectName}-worktrees/<task-slug>
-pnpm install --frozen-lockfile --prefer-offline
 # ... all work happens here ...
 git push origin <branch-name>
 cd ~/src/${projectName} && git worktree remove ~/src/${projectName}-worktrees/<task-slug>
 \`\`\`
 
-Worktrees path: \`~/src/<repo>-worktrees/<task-slug>\` — NEVER use /tmp.
-
-\`pnpm install --frozen-lockfile --prefer-offline\` MUST run immediately after
-\`git worktree add\`/\`cd\`, BEFORE any gate (\`pnpm test\`/\`lint\`/\`typecheck\`/\`format:check\`)
-is invoked. pnpm workspaces do NOT share \`node_modules\` across separate git
-worktrees — a fresh worktree has an empty \`node_modules/.bin\`, so every gate
-binary (\`tsc\`/\`eslint\`/\`prettier\`/\`vitest\`) fails \`sh: 1: <tool>: not found\`
-until deps are installed. That failure is indistinguishable from a real
-test/lint failure — a false-red gate. Never skip this step and never reorder
-it after the first gate invocation.`);
+Worktrees path: \`~/src/<repo>-worktrees/<task-slug>\` — NEVER use /tmp.`);
 
   // 6. Completion gates
   sections.push(`# Completion Gates — ENFORCED