framework: port the credential-helper regression suite (byte-faithful from brain 15f6979a; verified green from the stack tree)

.env.example

@@ -6,3 +6,9 @@ VALKEY_HOST_PORT=6380
 GATEWAY_HOST_PORT=14242
 # Registry image override (defaults to a local build of docker/gateway.Dockerfile):
 # GATEWAY_IMAGE=git.mosaicstack.dev/mosaicstack/stack/gateway:sha-acf640d
+
+# Optional explicit dogfood overlay (docker-compose.dogfood.yml).
+# Both paths are required when that overlay is used. Use a dedicated next-based
+# worktree and the external home of the unprivileged stack-dogfood seat.
+# MOSAIC_DOGFOOD_WORKTREE=/home/example/src/mosaic-stack-worktrees/dogfood-1487
+# MOSAIC_DOGFOOD_SEAT_HOME=/home/example/.mosaic/fleet/agents/stack-dogfood

README.md

@@ -208,6 +208,46 @@ mosaic telemetry upload        # Dry-run unless opted in
 
 Consent state is persisted in config. Remote upload is a no-op until you run `mosaic telemetry opt-in`.
 
+## Standalone container deployment
+
+The `stack` profile runs PostgreSQL, Valkey, the gateway, and the bundled webUI. Copy
+`.env.example` to `.env`, generate `BETTER_AUTH_SECRET`, then start the profile:
+
+```bash
+cp .env.example .env
+printf 'BETTER_AUTH_SECRET=%s\n' "$(openssl rand -hex 32)" >> .env
+docker compose --profile stack up -d
+```
+
+The optional dogfood overlay gives one dedicated in-stack agent a writable stack
+worktree and its own read-only credential slot. It does not mount the fleet brain or
+any other seat. Prepare a `next`-based worktree and an unprivileged `stack-dogfood`
+seat outside the container, then set these paths in `.env`:
+
+```dotenv
+MOSAIC_DOGFOOD_WORKTREE=/path/to/mosaic-stack-worktrees/dogfood-1487
+MOSAIC_DOGFOOD_SEAT_HOME=/path/to/.mosaic/fleet/agents/stack-dogfood
+```
+
+The seat home must contain only that seat's credential at
+`secrets/gitea-mosaicstack-stack-dogfood.token`. Never place the token value in
+`.env`. Start the overlay with:
+
+```bash
+docker compose \
+  -f docker-compose.yml \
+  -f docker-compose.dogfood.yml \
+  --profile stack up -d
+```
+
+The overlay scopes regular-agent tools to the mounted checkout. For issue and PR
+operations, instruct the agent to use `/opt/mosaic/tools/git/`. The gateway image
+configures `git-credential-mosaic` as Git's system credential helper, so pushes and
+`pr-create.sh` resolve only the `stack-dogfood` slot and fail if it is absent.
+
+This deployment route is separate from the local source-development restrictions
+below.
+
 ## Development
 
 ### Prerequisites

docker-compose.dogfood.yml

@@ -0,0 +1,22 @@
+# Explicit, single-seat dogfood mode for stack-containerization B2.
+# Use with docker-compose.yml. The base stack remains credential-free.
+services:
+  gateway:
+    environment:
+      # Identity and credential layout match a fleet seat. This fixed name prevents
+      # an operator from mounting one seat while attributing actions to another.
+      MOSAIC_AGENT_NAME: stack-dogfood
+      MOSAIC_GIT_IDENTITY: stack-dogfood
+      MOSAIC_BRAIN_HOME: /opt/mosaic/brain
+      AGENT_FILE_SANDBOX_DIR: /workspace/stack
+      AGENT_USER_TOOLS: fs_read_file,fs_write_file,fs_list_directory,fs_edit_file,git_status,git_log,git_diff,shell_exec
+    volumes:
+      # Mount a dedicated worktree, never the canonical clone or divergent local main.
+      - type: bind
+        source: ${MOSAIC_DOGFOOD_WORKTREE:?set to a dedicated next-based stack worktree}
+        target: /workspace/stack
+      # Only this seat home enters the container. Other fleet credentials stay outside.
+      - type: bind
+        source: ${MOSAIC_DOGFOOD_SEAT_HOME:?set to the external stack-dogfood seat directory}
+        target: /opt/mosaic/brain/fleet/agents/stack-dogfood
+        read_only: true

docker/gateway.Dockerfile

@@ -29,11 +29,23 @@ ENV NODE_ENV=production
 # $MOSAIC_ROOT/.workspaces (apps/gateway/src/workspace/workspace.service.ts);
 # mount a volume over /opt/mosaic to persist workspaces across container restarts.
 # Intentionally unpinned: Alpine's signed repository is the trust anchor; pinning
-# git was declined so routine base-image security updates remain maintainable.
-RUN apk add --no-cache git \
+# packages was declined so routine base-image security updates remain maintainable.
+# bash/curl/python3 are runtime dependencies of the provider-neutral Mosaic git
+# wrappers. jq supports wrapper discovery for non-canonical Gitea hosts.
+RUN apk add --no-cache bash curl git jq python3 \
   && mkdir -p /opt/mosaic/.workspaces \
   && chown -R node:node /opt/mosaic /app
 ENV MOSAIC_ROOT=/opt/mosaic
+# Dogfood agents use the same fail-closed credential helper and PR-create wrapper
+# as fleet seats. Copy only that operation and its shared dependencies. Unrelated
+# fleet operations, including merge and infrastructure tools, stay out of the image.
+COPY --from=builder /app/packages/mosaic/framework/tools/git/pr-create.sh /opt/mosaic/tools/git/pr-create.sh
+COPY --from=builder /app/packages/mosaic/framework/tools/git/detect-platform.sh /opt/mosaic/tools/git/detect-platform.sh
+COPY --from=builder /app/packages/mosaic/framework/tools/git/repo-decl.sh /opt/mosaic/tools/git/repo-decl.sh
+COPY --from=builder /app/packages/mosaic/framework/tools/git/git-credential-mosaic /opt/mosaic/tools/git/git-credential-mosaic
+COPY --from=builder /app/packages/mosaic/framework/tools/_lib/credentials.sh /opt/mosaic/tools/_lib/credentials.sh
+COPY --from=builder /app/packages/mosaic/framework/tools/structure/validate-repo-json.sh /opt/mosaic/tools/structure/validate-repo-json.sh
+RUN git config --system credential.helper /opt/mosaic/tools/git/git-credential-mosaic
 # Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
 COPY --chown=node:node --from=builder /deploy/node_modules ./node_modules
 COPY --chown=node:node --from=builder /deploy/package.json ./package.json

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -1,220 +1,64 @@
-#!/bin/bash
-# git-credential-mosaic — git credential helper. Resolves a Gitea token from the
-# Mosaic credential store at runtime so remote URLs never embed secrets.
+#!/usr/bin/python3
+# git-credential-mosaic — production entrypoint (P0-SEC R4, rev-code-02 B1).
 #
-# Install (one-time, per clone or globally):
-#   git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+# WHY THIS IS NOT BASH: three review rounds falsified every in-bash startup
+# guard. A non-interactive bash sources $BASH_ENV and imports exported
+# functions BEFORE the first script line, so read(), unset(), exit(),
+# declare(), printf() — every callable — can be shadows that fake the
+# ancestry, defeat the scrub, or forge diagnostics (rev-code-02 probes 1 and
+# 2, artifacts fc49e9d9 lineage). No in-language dispatch survives that.
 #
-# Per-agent identity (Gate-16 author != reviewer separation):
-#   git config mosaic.gitIdentity <agent-id>   # per-worktree, persists on disk
-#   # or: export MOSAIC_GIT_IDENTITY=<agent-id>
+# This entrypoint is unshapable at the bash level: python does not read
+# BASH_ENV and imports no bash functions, and the interpreter is pinned by
+# absolute shebang (no PATH resolution). It builds the child environment BY
+# ALLOWLIST and execve's the bash implementation directly — the child bash
+# starts with no BASH_ENV, no BASH_FUNC_*, no SHELLOPTS/BASHOPTS, and exactly
+# the variables the credential protocol needs. stdin/stdout/stderr and argv
+# pass through untouched.
 #
-# ── WHY THIS FAILS CLOSED ──────────────────────────────────────────────────────
-# This helper used to end by emitting the shared account's token for any request
-# it could not resolve to an identity. A seat with no identity, or with an
-# identity whose token was never provisioned, therefore received the most
-# privileged credential configured on the host — silently, and indistinguishably
-# from correct operation. Every record it then created (commit, push, PR, review)
-# was attributed to that shared account, so author != reviewer separation was
-# unenforceable and the true actor was unrecoverable after the fact.
-#
-# Under-provisioning must fail loudly, not impersonate. A refused git operation
-# is recoverable in one command; a merged pull request attributed to the wrong
-# principal is not.
-#
-# ── CONTRACT ───────────────────────────────────────────────────────────────────
-#   identity : MOSAIC_GIT_IDENTITY  >  git config mosaic.gitIdentity  >  the
-#              username git supplies on stdin
-#   store    : chosen by what the identity IS, with no precedence and no
-#              cross-store fallback (see "Credential store selection" below)
-#   hit      : emit username + password, exit 0
-#   miss     : emit NOTHING, spool a durable escalation record, explain on
-#              stderr, exit 1 — git surfaces the failure and nothing is attributed
-#   unknown host : exit 0 with no output, no record (passthrough for non-Mosaic
-#              remotes handled by another helper)
-#
-# Backward compatibility is preserved for exactly one case: a host with no fleet
-# and no identity requested still gets the shared account, because on such a host
-# the shared account is the operator's own and there is no attribution to lose.
-# A host that HAS a fleet has agents whose records must be distinguishable, so
-# the shared fallback is refused there.
-#
-# A token is never written to stderr, to the escalation record, or to any log.
+# The implementation file (git-credential-mosaic.impl) refuses to run without
+# the clean-mode marker, so it cannot be invoked directly as a shaped-entry
+# bypass of this wrapper.
 
-[ "$1" = "get" ] || exit 0
+import os
+import sys
 
-host=""; username_in=""
-while IFS= read -r line; do
-  [ -z "$line" ] && break
-  case "$line" in
-    host=*)     host=${line#host=};;
-    username=*) username_in=${line#username=};;
-  esac
-done
+IMPL = os.path.join(os.path.dirname(os.path.realpath(__file__)), "git-credential-mosaic.impl")
+# Absolute-path candidates ONLY — never PATH resolution (an attacker-shaped
+# PATH must not choose the interpreter). /usr/bin/bash is the fleet-host
+# layout; /bin/bash is alpine and other FHS variants (found by the T125
+# gateway-image verification: the hardcoded /usr/bin/bash made every call
+# exit 127 inside node:22-alpine).
+BASH_CANDIDATES = ("/usr/bin/bash", "/bin/bash")
+BASH = next((p for p in BASH_CANDIDATES if os.access(p, os.X_OK)), None)
 
-# Recognized Gitea hosts carry the per-identity token scheme. Anything else is
-# declined quietly — another helper owns it, and refusing would break it.
-case "$host" in
-  git.uscllc.com)      idpfx=gitea-usc;;
-  git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
-  *) exit 0;;
-esac
+# Allowlist: everything else in the environment dies at this boundary. Adding
+# a variable here is a security decision — it crosses into a shell that no
+# longer has any startup shaping, but it also becomes the only context the
+# implementation can see.
+KEEP = (
+    "HOME",
+    "PATH",
+    "LANG",
+    "MOSAIC_GIT_IDENTITY",
+    "MOSAIC_AGENT_NAME",
+    "MOSAIC_BRAIN_HOME",
+    "MOSAIC_CREDENTIAL_SPOOL",
+    "MOSAIC_CREDENTIAL_LINEAGE_FENCE",
+)
 
-ident="$MOSAIC_GIT_IDENTITY"; ident_src="MOSAIC_GIT_IDENTITY"
-if [ -z "$ident" ]; then
-  ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
-  ident_src="git config mosaic.gitIdentity"
-fi
-if [ -z "$ident" ]; then
-  ident="$username_in"
-  ident_src="the username git supplied"
-fi
+env = {"_MOSAIC_HELPER_CLEAN": "1"}
+for name in KEEP:
+    value = os.environ.get(name)
+    if value is not None:
+        env[name] = value
 
-# ── Credential store selection ────────────────────────────────────────────────
-# An identity is a SEAT or it is a SERVICE, and which one it is determines where
-# its credential lives. There is no precedence rule between the two stores and no
-# fallback from one to the other: a seat whose slot is empty fails closed rather
-# than reading a service credential that happens to share its name.
-#
-#   seat     — <brain>/fleet/agents/<ident>/ exists
-#              credential at <brain>/fleet/agents/<ident>/secrets/<idpfx>-<ident>.token
-#   service  — it does not
-#              credential at ~/.config/mosaic/secrets/gitea-tokens/<idpfx>-<ident>.token
-#
-# One credential, one location. Two copies of one credential diverge, and the
-# stale copy fails in a way that reads as a revoked token rather than as drift.
-#
-# Brain-home resolution mirrors packages/mosaic/src/fleet/brain-home.ts and
-# tools/fleet/start-agent-session.sh: MOSAIC_BRAIN_HOME wins, else ~/.mosaic.
-brain_home="${MOSAIC_BRAIN_HOME:-$HOME/.mosaic}"
-svc_store="$HOME/.config/mosaic/secrets/gitea-tokens"
-
-idtok=""; ident_kind=""
-if [ -n "$ident" ]; then
-  if [ -d "$brain_home/fleet/agents/$ident" ]; then
-    ident_kind="seat"
-    idtok="$brain_home/fleet/agents/$ident/secrets/${idpfx}-${ident}.token"
-  else
-    ident_kind="service identity"
-    idtok="$svc_store/${idpfx}-${ident}.token"
-  fi
-  if [ -r "$idtok" ]; then
-    echo "username=${ident}"
-    echo "password=$(cat "$idtok")"
-    exit 0
-  fi
-fi
-
-# ── Shared-account fallback: ONLY on a host with no fleet and no identity ──────
-# `fleet/agents` existing is the same signal brain-home.ts uses to decide a brain
-# is active. Where there are seats, records must be attributable, so an
-# unresolvable request is refused instead of borrowing the shared account.
-fleet_present=0
-[ -d "$brain_home/fleet/agents" ] && fleet_present=1
-
-if [ -z "$ident" ] && [ "$fleet_present" -eq 0 ]; then
-  script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  # shellcheck source=../_lib/credentials.sh
-  source "$script_dir/../_lib/credentials.sh"
-  load_credentials "$idpfx" >/dev/null 2>&1 || exit 0
-  # GITEA_USER is not populated by load_credentials (it exports GITEA_URL and
-  # GITEA_TOKEN only). Gitea's git-over-HTTP auth authenticates from the token in
-  # the password field, not from the username string, so any non-empty
-  # placeholder works — deliberately NOT a real account name, since framework
-  # files stay operator-agnostic (tools/quality/scripts/verify-sanitized.sh).
-  echo "username=${GITEA_USER:-git}"
-  echo "password=$GITEA_TOKEN"
-  exit 0
-fi
-
-# ── FAIL CLOSED ───────────────────────────────────────────────────────────────
-if [ -z "$ident" ]; then
-  reason="no-identity"
-else
-  reason="no-token-for-identity"
-fi
-
-seat="${MOSAIC_AGENT_NAME:-unknown}"
-ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-# The escalation RECORD is durable and unconditional; any notification built on
-# top of it is best-effort. Record and alert are deduplicated separately — a cap
-# on the alert alone lets the spool grow without bound exactly while the operator
-# is being told nothing, so the louder the failure the quieter it gets.
-#
-# A record field is arbitrary operator-supplied text: an identity comes from git
-# config or the environment, and cwd is whatever directory git ran in. Either can
-# contain a quote or a backslash, which would make the line unparseable JSON --
-# and a spool that silently stops parsing is worse than no spool, because the
-# operator only discovers it while reading the record that explains an outage.
-json_escape() {
-  local s=$1
-  s=${s//\\/\\\\}
-  s=${s//\"/\\\"}
-  s=${s//$'\t'/\\t}
-  s=${s//$'\r'/\\r}
-  s=${s//$'\n'/\\n}
-  printf '%s' "$s"
-}
-
-spool="${MOSAIC_CREDENTIAL_SPOOL:-$HOME/.local/state/mosaic-credential-escalations}"
-spool_record=""
-if mkdir -p "$spool" 2>/dev/null; then
-  chmod 700 "$spool" 2>/dev/null
-  spoolfile="$spool/$(date -u +%Y%m%d).jsonl"
-  dedupe="$spool/.spooled-${seat}-${ident:-none}-${reason}-$(date -u +%Y%m%d%H%M)"
-  if [ ! -e "$dedupe" ]; then
-    : > "$dedupe" 2>/dev/null
-    printf '{"ts":"%s","reason":"%s","identity":"%s","identity_source":"%s","kind":"%s","seat":"%s","host":"%s","cwd":"%s"}\n' \
-      "$(json_escape "$ts")" "$(json_escape "$reason")" \
-      "$(json_escape "${ident:-<unset>}")" "$(json_escape "$ident_src")" \
-      "$(json_escape "${ident_kind:-none}")" "$(json_escape "$seat")" \
-      "$(json_escape "$host")" "$(json_escape "$PWD")" \
-      >> "$spoolfile" 2>/dev/null
-    chmod 600 "$spoolfile" 2>/dev/null
-  fi
-  # Name the record only if one is actually on disk. Printing the path
-  # unconditionally sends the operator to a file that does not exist on exactly
-  # the hosts where the spool could not be created.
-  [ -s "$spoolfile" ] && spool_record="$spoolfile"
-  find "$spool" -maxdepth 1 -name '.spooled-*' -mmin +120 -delete 2>/dev/null
-fi
-
-cat >&2 <<EOF
-git-credential-mosaic: REFUSED (fail-closed).
-  host     : ${host}
-  identity : ${ident:-<unset>}${ident:+  (from ${ident_src}; resolved as a ${ident_kind})}
-  reason   : ${reason}
-EOF
-
-if [ -n "$ident" ]; then
-  cat >&2 <<EOF
-  expected : ${idtok}
-EOF
-fi
-
-cat >&2 <<EOF
-
-No per-identity credential resolved. This helper does NOT fall back to the shared
-account: that fallback makes every record it creates attributable to one
-principal, which is unrecoverable once a pull request has merged under it.
-
-Fix (pick one):
-  export MOSAIC_GIT_IDENTITY=<agent-id>        # process-scoped
-  git config mosaic.gitIdentity <agent-id>     # per-repo/worktree, persists
-Then provision that identity's credential at the path named above. An identity
-with a directory under \${MOSAIC_BRAIN_HOME:-\$HOME/.mosaic}/fleet/agents/ is a
-seat and is read ONLY from its own secrets/ slot; any other identity is read from
-~/.config/mosaic/secrets/gitea-tokens/. There is no fallback between the two.
-
-If this identity legitimately needs git access and has none, ask the orchestrator
-to provision one.
-
-EOF
-
-if [ -n "$spool_record" ]; then
-  echo "  record: ${spool_record}" >&2
-else
-  echo "  record: NOT WRITTEN — spool unavailable at ${spool}" >&2
-fi
-exit 1
+argv = [BASH, IMPL] + sys.argv[1:]
+if BASH is None:
+    sys.stderr.write("git-credential-mosaic: no executable bash at " + " or ".join(BASH_CANDIDATES) + "\n")
+    sys.exit(127)
+try:
+    os.execve(BASH, argv, env)
+except OSError as exc:
+    sys.stderr.write(f"git-credential-mosaic: entrypoint exec failed: {exc}\n")
+    sys.exit(127)

packages/mosaic/framework/tools/git/git-credential-mosaic.impl

@@ -0,0 +1,480 @@
+#!/bin/bash
+# git-credential-mosaic — git credential helper. Resolves a Gitea token from the
+# Mosaic credential store at runtime so remote URLs never embed secrets.
+#
+# Install (one-time, per clone or globally):
+#   git config credential.helper "$HOME/.config/mosaic/tools/git/git-credential-mosaic"
+#
+# Per-agent identity (Gate-16 author != reviewer separation):
+#   git config mosaic.gitIdentity <agent-id>   # per-worktree, persists on disk
+#   # or: export MOSAIC_GIT_IDENTITY=<agent-id>
+#
+# ── WHY THIS FAILS CLOSED ──────────────────────────────────────────────────────
+# This helper used to end by emitting the shared account's token for any request
+# it could not resolve to an identity. A seat with no identity, or with an
+# identity whose token was never provisioned, therefore received the most
+# privileged credential configured on the host — silently, and indistinguishably
+# from correct operation. Every record it then created (commit, push, PR, review)
+# was attributed to that shared account, so author != reviewer separation was
+# unenforceable and the true actor was unrecoverable after the fact.
+#
+# Under-provisioning must fail loudly, not impersonate. A refused git operation
+# is recoverable in one command; a merged pull request attributed to the wrong
+# principal is not.
+#
+# ── CONTRACT ───────────────────────────────────────────────────────────────────
+#   identity : MOSAIC_GIT_IDENTITY  >  git config mosaic.gitIdentity  >  the
+#              username git supplies on stdin
+#   ownership: a FLEET SEAT caller may resolve ONLY its own identity, where
+#              the CALLER is established by process ANCESTRY, not by the
+#              current environment: every ancestor's /proc/<pid>/environ is
+#              frozen at exec, so a child can rewrite its own MOSAIC_AGENT_NAME
+#              but can never make an ancestor disagree with what the launcher
+#              gave it (P5-RM-006; the dual-variable override was measured by
+#              rev-code-02 F1). An anonymous caller (no lineage, no consensus)
+#              may resolve NOTHING on a fleet host — seat or service
+#              (rev-code-02 F2). Non-fleet hosts keep the documented legacy
+#              paths below.
+#   perms    : a slot whose mode lets group or other read it (anything but
+#              ?00) is refused — a loose slot is provisioning drift, and
+#              serving from it silently widens every seat's exposure on a
+#              single-account host.
+#   store    : chosen by what the identity IS, with no precedence and no
+#              cross-store fallback (see "Credential store selection" below)
+#   hit      : emit username + password, exit 0
+#   miss     : emit NOTHING, spool a durable escalation record, explain on
+#              stderr, exit 1 — git surfaces the failure and nothing is attributed
+#   unknown host : exit 0 with no output, no record (passthrough for non-Mosaic
+#              remotes handled by another helper)
+#
+# Backward compatibility is preserved for exactly one case: a host with no fleet
+# and no identity requested still gets the shared account, because on such a host
+# the shared account is the operator's own and there is no attribution to lose.
+# A host that HAS a fleet has agents whose records must be distinguishable, so
+# the shared fallback is refused there.
+#
+# A token is never written to stderr, to the escalation record, or to any log.
+
+[ "$1" = "get" ] || exit 0
+
+
+# ── The shared refusal path ──────────────────────────────────────────────────
+# Every fail-closed exit funnels through refuse(): a durable escalation record
+# (deduped, JSON-escaped), a stderr diagnostic naming host/identity/reason,
+# caller-supplied guidance when the refusing site has specific advice, exit 1.
+# Defined here because the ownership gate below must be able to reach it.
+refuse() {
+  local guidance="${1:-}"
+  local seat ts spool spool_record spoolfile dedupe
+  seat="${MOSAIC_AGENT_NAME:-unknown}"
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+  # A record field is arbitrary operator-supplied text: an identity comes from git
+  # config or the environment, and cwd is whatever directory git ran in. Either can
+  # contain a quote or a backslash, which would make the line unparseable JSON --
+  # and a spool that silently stops parsing is worse than no spool, because the
+  # operator only discovers it while reading the record that explains an outage.
+  json_escape() {
+    local s=$1
+    s=${s//\\/\\\\}
+    s=${s//\"/\\\"}
+    s=${s//$'\t'/\\t}
+    s=${s//$'\r'/\\r}
+    s=${s//$'\n'/\\n}
+    printf '%s' "$s"
+  }
+
+  spool="${MOSAIC_CREDENTIAL_SPOOL:-$HOME/.local/state/mosaic-credential-escalations}"
+  spool_record=""
+  if mkdir -p "$spool" 2>/dev/null; then
+    chmod 700 "$spool" 2>/dev/null
+    spoolfile="$spool/$(date -u +%Y%m%d).jsonl"
+    dedupe="$spool/.spooled-${seat}-${ident:-none}-${reason}-$(date -u +%Y%m%d%H%M)"
+    if [ ! -e "$dedupe" ]; then
+      : > "$dedupe" 2>/dev/null
+      printf '{"ts":"%s","reason":"%s","identity":"%s","identity_source":"%s","kind":"%s","seat":"%s","host":"%s","cwd":"%s"}\n' \
+        "$(json_escape "$ts")" "$(json_escape "$reason")" \
+        "$(json_escape "${ident:-<unset>}")" "$(json_escape "$ident_src")" \
+        "$(json_escape "${ident_kind:-none}")" "$(json_escape "$seat")" \
+        "$(json_escape "$host")" "$(json_escape "$PWD")" \
+        >> "$spoolfile" 2>/dev/null
+      chmod 600 "$spoolfile" 2>/dev/null
+    fi
+    # Name the record only if one is actually on disk. Printing the path
+    # unconditionally sends the operator to a file that does not exist on exactly
+    # the hosts where the spool could not be created.
+    [ -s "$spoolfile" ] && spool_record="$spoolfile"
+    find "$spool" -maxdepth 1 -name '.spooled-*' -mmin +120 -delete 2>/dev/null
+  fi
+
+  while IFS= builtin read -r _diag_line; do builtin printf '%s\n' "$_diag_line" >&2; done <<EOF
+git-credential-mosaic: REFUSED (fail-closed).
+  host     : ${host}
+  identity : ${ident:-<unset>}${ident:+  (from ${ident_src}; resolved as a ${ident_kind})}
+  reason   : ${reason}
+EOF
+
+  if [ -n "$ident" ]; then
+    while IFS= builtin read -r _diag_line; do builtin printf '%s\n' "$_diag_line" >&2; done <<EOF
+  expected : ${idtok}
+EOF
+  fi
+
+  while IFS= builtin read -r _diag_line; do builtin printf '%s\n' "$_diag_line" >&2; done <<EOF
+
+${guidance}
+EOF
+
+  if [ -n "$spool_record" ]; then
+    echo "  record: ${spool_record}" >&2
+  else
+    echo "  record: NOT WRITTEN — spool unavailable at ${spool}" >&2
+  fi
+  exit 1
+}
+
+# ── Bash environment injection guard (rev-code-02 R3, B1) ───────────────────
+# Non-interactive bash sources $BASH_ENV at startup and imports exported
+# functions from BASH_FUNC_* environment entries; either can define a read()
+# or printf() that shadows the builtin the ancestry walker and diagnostics
+# rely on — measured live by the reviewer's fixture (BASH_ENV read() rewrote
+# every ancestry entry). A legitimate fleet seat environment carries neither
+# (verified: zero BASH_FUNC_* in seat envs), so their presence in a helper
+# request is an injection attempt: scrub the shadows first (so even the
+# refusal machinery cannot be subverted), then refuse fail-closed.
+# Imported functions are detected by ENUMERATION, not env-var names: bash
+# consumes BASH_FUNC_* variables while importing the functions, so the
+# environment no longer shows them (measured). At this point the script has
+# defined exactly one function of its own (refuse); anything else in the
+# function table arrived from the caller's environment. BASH_ENV is checked
+# directly (it remains visible after sourcing).
+_injected=0
+_inj_names=""
+while IFS=' ' builtin read -r _decl _kind _fn; do
+  [ -n "$_fn" ] || continue
+  case "$_fn" in
+    refuse) ;;
+    *) _injected=1; _inj_names="$_inj_names $_fn";;
+  esac
+done < <(declare -F)
+_inj_vars="${!BASH_FUNC_@}"
+if [ -n "$_inj_vars" ]; then
+  _injected=1
+  for _iv in $_inj_vars; do
+    case "$_iv" in
+      BASH_FUNC_*%%) _ifn="${_iv#BASH_FUNC_}"; _ifn="${_ifn%%%}";;
+      BASH_FUNC_*)   _ifn="${_iv#BASH_FUNC_}";;
+      *)             _ifn="";;
+    esac
+    [ -n "$_ifn" ] && { unset -f "$_ifn" 2>/dev/null; _inj_names="$_inj_names $_ifn"; }
+  done
+fi
+if [ "$_injected" = 1 ] || [ -n "${BASH_ENV:-}" ]; then
+  while IFS=' ' builtin read -r _decl _kind _fn; do
+    [ "$_fn" = refuse ] || unset -f "$_fn" 2>/dev/null
+  done < <(declare -F)
+  unset BASH_ENV 2>/dev/null
+  reason="bash-environment-injection-refused"
+  refuse "The helper's bash startup state was externally shaped: BASH_ENV is
+set and/or exported BASH_FUNC_* functions are present in the request
+environment. Non-interactive bash sources BASH_ENV and imports those
+functions BEFORE any script line runs, so builtins this helper's security
+decisions rely on could be shadowed. Nothing resolves from a shaped request
+environment. If this surprised a legitimate workflow, the caller environment
+must be cleaned (no BASH_ENV, no exported functions) before invoking git."
+fi
+
+
+host=""; username_in=""
+while IFS= builtin read -r line; do
+  [ -z "$line" ] && break
+  case "$line" in
+    host=*)     host=${line#host=};;
+    username=*) username_in=${line#username=};;
+  esac
+done
+
+# Recognized Gitea hosts carry the per-identity token scheme. Anything else is
+# declined quietly — another helper owns it, and refusing would break it.
+case "$host" in
+  git.uscllc.com)      idpfx=gitea-usc;;
+  git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+  *) exit 0;;
+esac
+
+# ── Clean-entrypoint assert (P0-SEC R4) ─────────────────────────────────────
+# This implementation only runs behind the python entrypoint
+# (git-credential-mosaic), which execve's it with an allowlist environment:
+# no BASH_ENV, no imported functions, nothing shapable at bash startup. A
+# direct invocation without the marker is a bypass attempt on that boundary
+# and refuses. Placed after refuse() and the host parse so the refusal path
+# exists when it fires (an earlier placement died on 'refuse: command not
+# found' — the failure mode is real, keep this after every definition it
+# calls).
+if [ "${_MOSAIC_HELPER_CLEAN:-}" != "1" ]; then
+  reason="direct-entrypoint-refused"
+  refuse "This implementation refuses to run outside the production
+entrypoint. git-credential-mosaic (the python wrapper in this directory)
+execve's it with a hand-built, unshapable environment; invoking the .impl
+directly bypasses that boundary. Credential requests go through git, which
+invokes the wrapper named in gitconfig."
+fi
+
+ident="$MOSAIC_GIT_IDENTITY"; ident_src="MOSAIC_GIT_IDENTITY"
+if [ -z "$ident" ]; then
+  ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
+  ident_src="git config mosaic.gitIdentity"
+fi
+if [ -z "$ident" ]; then
+  ident="$username_in"
+  ident_src="the username git supplied"
+fi
+
+# ── Credential store selection ────────────────────────────────────────────────
+# An identity is a SEAT or it is a SERVICE, and which one it is determines where
+# its credential lives. There is no precedence rule between the two stores and no
+# fallback from one to the other: a seat whose slot is empty fails closed rather
+# than reading a service credential that happens to share its name.
+#
+#   seat     — <brain>/fleet/agents/<ident>/ exists
+#              credential at <brain>/fleet/agents/<ident>/secrets/<idpfx>-<ident>.token
+#   service  — it does not
+#              credential at ~/.config/mosaic/secrets/gitea-tokens/<idpfx>-<ident>.token
+#
+# One credential, one location. Two copies of one credential diverge, and the
+# stale copy fails in a way that reads as a revoked token rather than as drift.
+#
+# Brain-home resolution mirrors packages/mosaic/src/fleet/brain-home.ts and
+# tools/fleet/start-agent-session.sh: MOSAIC_BRAIN_HOME wins, else ~/.mosaic.
+brain_home="${MOSAIC_BRAIN_HOME:-$HOME/.mosaic}"
+svc_store="$HOME/.config/mosaic/secrets/gitea-tokens"
+
+# ── Caller-identity ownership (P5-RM-006) ──────────────────────────────────────
+# A credential request is honourable only when the CALLER owns the identity it
+# asks for. On a fleet host every seat shares one unix account, so the
+# launcher-established MOSAIC_AGENT_NAME is the only attribution signal the
+# helper has. Two measured paths made the old contract unsafe:
+#
+#   - a seat exporting MOSAIC_GIT_IDENTITY=<another-seat> resolved that seat's
+#     token through the normal precedence chain (T97 G2, jarvis V2 probe), and
+#   - an anonymous caller (no seat name) inherited the host gitconfig's
+#     username=jarvis line and resolved jarvis's slot (T94: five watcher units
+#     flapping on exactly this class).
+#
+# Ownership rules, fail-closed on fleet hosts only; a host with no fleet keeps
+# the legacy contract unchanged:
+#   1. a SEAT caller may resolve only its own identity;
+#   2. an anonymous caller may not resolve any SEAT identity (service
+#      identities remain available to non-seat automation such as CI).
+# [P5-RM-006r1 ancestry binding begin]
+# ── Caller identity from exec-frozen ancestry (rev-code-02 F1/F2) ───────────
+# Walk /proc self->root collecting MOSAIC_AGENT_NAME from each ancestor's
+# frozen environ. Rules:
+#   - any DISAGREEMENT (an ancestor value != the current value, or ancestors
+#     disagreeing among themselves) is a rewrite -> spoof-refused, nothing
+#     resolves. A child can inject variables downward but cannot alter an
+#     ancestor's exec-frozen environ, so the launcher-established value always
+#     participates in the comparison.
+#   - consensus (all ancestors that carry the var agree with the current env,
+#     or with each other when the current env is empty) -> caller = that value.
+#   - no ancestor carries it -> the current claim is unlineaged: caller is
+#     anonymous regardless of what the environment says. A name with no
+#     lineage is a claim, not an identity.
+# The walk stops at PID 1, at a missing /proc entry, or INCLUSIVE at an
+# ancestor that carries MOSAIC_CREDENTIAL_LINEAGE_FENCE with an EMPTY agent
+# name — the test-suite lineage root. A fence beside a non-empty name is
+# IGNORED and the walk continues, so an attacker cannot fence off the true
+# ancestry by planting the marker next to a victim name.
+trusted_caller() {
+  # PATH-HARDENED (rev-code-02 R1 F1): every /proc read below uses ONLY bash
+  # builtins (read/case/parameter expansion). The first implementation piped
+  # through PATH-resolved tr/sed/head/grep, and a caller that prepends hostile
+  # utilities to PATH in the same invocation that overrides the identity
+  # variables could forge the ancestry itself. Builtins cannot be shadowed.
+  local pid ppid v entry line fence
+  local -a vals=()
+  pid=$$
+  while :; do
+    v=""
+    fence=0
+    if [ -r "/proc/$pid/environ" ]; then
+      # Read inside a captured subshell whose stderr is closed: opening
+      # /proc/<pid>/environ can fail with EACCES on ancestors that are
+      # readable-by-mode but not openable (session managers), and that open
+      # failure prints from the SHELL, immune to loop-level 2>/dev/null
+      # (measured). The subshell makes the skip silent; NUL separators are
+      # converted to newlines for the parent's builtin parse.
+      _env_text=$( { while IFS= builtin read -r -d '' _e; do builtin printf '%s\n' "$_e"; done < "/proc/$pid/environ"; } 2>/dev/null )
+      while IFS= builtin read -r entry; do
+        [ -n "$entry" ] || continue
+        case "$entry" in
+          MOSAIC_AGENT_NAME=*) v="${entry#MOSAIC_AGENT_NAME=}";;
+          MOSAIC_CREDENTIAL_LINEAGE_FENCE=*) fence=1;;
+        esac
+      done <<EOF_ENV
+$_env_text
+EOF_ENV
+    fi
+    if [ "$pid" != "$$" ]; then
+      [ -n "$v" ] && vals+=("$v")
+      if [ "$fence" = 1 ] && [ -z "$v" ]; then
+        break
+      fi
+    fi
+    ppid=""
+    if [ -r "/proc/$pid/status" ]; then
+      while IFS= builtin read -r line; do
+        case "$line" in
+          PPid:*) ppid="${line#PPid:}"; ppid="${ppid//[[:space:]]/}";;
+        esac
+      done < "/proc/$pid/status"
+    fi
+    case "$ppid" in ''|0|1) break;; esac
+    pid=$ppid
+  done
+  local self="${MOSAIC_AGENT_NAME:-}" i consensus=""
+  if [ "${#vals[@]}" -gt 0 ]; then
+    consensus="${vals[0]}"
+    for i in "${vals[@]}"; do
+      if [ "$i" != "$consensus" ]; then
+        printf 'SPOOF'
+        return
+      fi
+    done
+    if [ -n "$self" ] && [ "$self" != "$consensus" ]; then
+      printf 'SPOOF'
+      return
+    fi
+  fi
+  printf '%s' "$consensus"
+}
+
+if [ -d "$brain_home/fleet/agents" ]; then
+  caller="$(trusted_caller)"
+  if [ "$caller" = "SPOOF" ]; then
+    reason="caller-identity-spoof-refused"
+    refuse "The MOSAIC_AGENT_NAME lineage disagrees within this process tree:
+an ancestor established by exec carries a different value than the request.
+A child process can rewrite its own environment but never an ancestor's
+frozen environ, so disagreement is a rewrite, not a race. Nothing resolves
+under a rewritten caller identity. If this surprised a legitimate workflow,
+run git from the seat's own session, not from a rewritten environment."
+  fi
+  if [ -n "$caller" ] && [ -d "$brain_home/fleet/agents/$caller" ]; then
+    if [ -n "$ident" ] && [ "$ident" != "$caller" ]; then
+      reason="cross-seat-identity-refused"
+      refuse "A seat may resolve only its own credential slot. Caller seat is
+'$caller' (ancestry-established); the request names '$ident'. Overriding
+MOSAIC_GIT_IDENTITY (or a git config / URL username) to another seat's name is
+exactly the path this refusal exists to close. If '$ident' auth is genuinely
+required, that seat runs the operation itself or the orchestrator provisions
+an explicit grant."
+    fi
+  else
+    # Anonymous caller on a fleet host (no lineage, or the lineage root is not
+    # a seat): NOTHING resolves — seat slots (T94 jarvis@ class) or legacy
+    # service credentials (rev-code-02 F2: credentialed services are seats;
+    # the legacy store is vestigial and not anonymously reachable).
+    if [ -n "$ident" ]; then
+      ident_kind="${ident_kind:-}"
+      [ -d "$brain_home/fleet/agents/$ident" ] && ident_kind="seat" || ident_kind="service identity"
+      reason="anonymous-credential-refused"
+      refuse "This caller has no seat lineage on a fleet host and asked for
+'$ident' (a ${ident_kind}). Anonymous callers resolve nothing on fleet hosts:
+seat credentials must never serve an unattributable caller, and credentialed
+services are seats with their own sessions (the legacy service store is
+vestigial). Run from the owning seat's session."
+    fi
+  fi
+fi
+# [P5-RM-006r1 ancestry binding end]
+
+idtok=""; ident_kind=""
+if [ -n "$ident" ]; then
+  if [ -d "$brain_home/fleet/agents/$ident" ]; then
+    ident_kind="seat"
+    idtok="$brain_home/fleet/agents/$ident/secrets/${idpfx}-${ident}.token"
+  else
+    ident_kind="service identity"
+    idtok="$svc_store/${idpfx}-${ident}.token"
+  fi
+  if [ -r "$idtok" ]; then
+    # P5-RM-006 seat permissions: a SEAT slot readable by group or other is
+    # provisioning drift, and on a single-account fleet host it widens every
+    # seat's exposure at once. Refuse rather than serve from a loose slot; the
+    # record names the path so the provisioning fix is one chmod away.
+    # Scoped to seat slots: the framework service store is operator-managed
+    # and outside this work unit's permission surface.
+    if [ "${ident_kind:-}" = "seat" ]; then
+      # command -p resolves stat from the POSIX default PATH (system
+      # directories), never the caller's PATH (rev-code-02 R3 B2: a shadowed
+      # stat reported a 0644 slot as 600 and the helper served it). Output is
+      # shape-validated: anything that is not 3-4 octal digits refuses.
+      slot_mode="$(command -p stat -c '%a' "$idtok" 2>/dev/null || true)"
+      case "$slot_mode" in
+        [0-7][0-7][0-7]|[0-7][0-7][0-7][0-7]) ;;
+        *) slot_mode="unverifiable";;
+      esac
+      if [ "${slot_mode:1:2}" != "00" ]; then
+        reason="slot-permission-violation"
+        refuse "Slot $idtok has mode ${slot_mode:-unknown}; expected owner-only
+(0600 or stricter). Tighten it: chmod 600 '$idtok'. This refusal is the seat
+permissions half of P5-RM-006: a loose slot on a shared-account host is every
+seat's exposure, so the helper declines to serve from it. Mode inspection uses
+command -p (trusted PATH) and fails closed on unverifiable output."
+      fi
+    fi
+    echo "username=${ident}"
+    echo "password=$(<"$idtok")"
+    exit 0
+  fi
+fi
+
+# ── Shared-account fallback: ONLY on a host with no fleet and no identity ──────
+# `fleet/agents` existing is the same signal brain-home.ts uses to decide a brain
+# is active. Where there are seats, records must be attributable, so an
+# unresolvable request is refused instead of borrowing the shared account.
+fleet_present=0
+[ -d "$brain_home/fleet/agents" ] && fleet_present=1
+
+if [ -z "$ident" ] && [ "$fleet_present" -eq 0 ]; then
+  script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  # shellcheck source=../_lib/credentials.sh
+  source "$script_dir/../_lib/credentials.sh"
+  load_credentials "$idpfx" >/dev/null 2>&1 || exit 0
+  # GITEA_USER is not populated by load_credentials (it exports GITEA_URL and
+  # GITEA_TOKEN only). Gitea's git-over-HTTP auth authenticates from the token in
+  # the password field, not from the username string, so any non-empty
+  # placeholder works — deliberately NOT a real account name, since framework
+  # files stay operator-agnostic (tools/quality/scripts/verify-sanitized.sh).
+  echo "username=${GITEA_USER:-git}"
+  echo "password=$GITEA_TOKEN"
+  exit 0
+fi
+
+# ── FAIL CLOSED ───────────────────────────────────────────────────────────────
+# The escalation RECORD is durable and unconditional; any notification built on
+# top of it is best-effort (see refuse()). Record and alert are deduplicated
+# separately — a cap on the alert alone lets the spool grow without bound
+# exactly while the operator is being told nothing, so the louder the failure
+# the quieter it gets.
+if [ -z "$ident" ]; then
+  reason="no-identity"
+else
+  reason="no-token-for-identity"
+fi
+refuse "No per-identity credential resolved. This helper does NOT fall back to the shared
+account: that fallback makes every record it creates attributable to one
+principal, which is unrecoverable once a pull request has merged under it.
+
+Fix (pick one):
+  export MOSAIC_GIT_IDENTITY=<agent-id>        # process-scoped
+  git config mosaic.gitIdentity <agent-id>     # per-repo/worktree, persists
+Then provision that identity's credential at the path named above. An identity
+with a directory under \${MOSAIC_BRAIN_HOME:-\$HOME/.mosaic}/fleet/agents/ is a
+seat and is read ONLY from its own secrets/ slot; any other identity is read from
+~/.config/mosaic/secrets/gitea-tokens/. There is no fallback between the two.
+
+If this identity legitimately needs git access and has none, ask the orchestrator
+to provision one."
+

packages/mosaic/framework/tools/git/test-git-credential-mosaic.sh

@@ -34,20 +34,23 @@ REPO_DIR="$WORK_DIR/repo"
 BRAIN_DIR="$WORK_DIR/brain"
 SPOOL_DIR="$WORK_DIR/spool"
 SVC_STORE="$FAKE_HOME/.config/mosaic/secrets/gitea-tokens"
-# Mirror the real deployed layout (~/.config/mosaic/tools/{git,_lib}/) under the
+# Mirror the real deployed layout (~/.mosaic/tools/{git,_lib}/) under the
 # fake HOME: git-credential-mosaic resolves its credentials.sh sibling via a
 # script-relative path (BASH_SOURCE), so the copy must live next to a stubbed
 # _lib/credentials.sh, not the real one, to keep this test hermetic.
-HELPER="$FAKE_HOME/.config/mosaic/tools/git/git-credential-mosaic"
+HELPER="$FAKE_HOME/.mosaic/tools/git/git-credential-mosaic"
+IMPL="$FAKE_HOME/.mosaic/tools/git/git-credential-mosaic.impl"
 
 rm -rf "$WORK_DIR"
 mkdir -p "$SVC_STORE" \
-         "$FAKE_HOME/.config/mosaic/tools/git" \
-         "$FAKE_HOME/.config/mosaic/tools/_lib" \
+         "$FAKE_HOME/.mosaic/tools/git" \
+         "$FAKE_HOME/.mosaic/tools/_lib" \
          "$REPO_DIR" "$BRAIN_DIR"
 
 cp "$SCRIPT_DIR/git-credential-mosaic" "$HELPER"
 chmod +x "$HELPER"
+cp "$SCRIPT_DIR/git-credential-mosaic.impl" "$IMPL"
+chmod +x "$IMPL"
 
 git -C "$REPO_DIR" init -q
 git -C "$REPO_DIR" config user.email "[email protected]"
@@ -55,7 +58,7 @@ git -C "$REPO_DIR" config user.name "Test"
 
 # Fake shared-account credential loader — stands in for
 # tools/_lib/credentials.sh's load_credentials(), scoped to this test only.
-cat > "$FAKE_HOME/.config/mosaic/tools/_lib/credentials.sh" <<'SH'
+cat > "$FAKE_HOME/.mosaic/tools/_lib/credentials.sh" <<'SH'
 load_credentials() {
   case "$1" in
     gitea-mosaicstack) GITEA_URL="https://git.mosaicstack.dev"; GITEA_TOKEN="shared-mosaicstack-token"; export GITEA_URL GITEA_TOKEN; return 0 ;;
@@ -82,7 +85,7 @@ run_helper() {
   (
     cd "$REPO_DIR"
     env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$SPOOL_DIR" "$@" \
-      bash "$HELPER" get <<EOF
+      "$HELPER" get <<EOF
 host=$host
 username=$username_in
 
@@ -90,6 +93,80 @@ EOF
   )
 }
 
+# ── Lineage harness (rev-code-02 F1/F2 rework) ─────────────────────────────
+# Establishes a seat CALLER the way production does — frozen into an
+# ancestor's exec environment — instead of injecting MOSAIC_AGENT_NAME into
+# the helper's own env. Two scripts are generated into WORK_DIR:
+#
+#   lineage-root.sh  (pid A): invoked with a fence marker and NO agent name.
+#       With a non-empty caller arg it forks the carrier (pid C); with an
+#       empty caller it forks the helper directly (deterministic anonymous
+#       lineage even when the suite itself runs inside a seat).
+#   lineage-carrier.sh (pid C): MOSAIC_AGENT_NAME=<caller> frozen at exec;
+#       forks the helper (pid D) with a fully controlled env.
+#
+# The helper's walk then sees exactly: self -> C(caller) or D-direct ->
+# A(fence, empty name -> stop). EXTRA assignments ride pid D's environment
+# (that is where a rewrite would live — which is the point of the F1 arms).
+cat > "$WORK_DIR/lineage-root.sh" <<'LINROOT'
+#!/usr/bin/env bash
+# pid A — lineage root. Args: <caller> <carrier-script> <helper> <spool>
+# <brain> <repo> [extra KEY=VALUE...]
+set -u
+caller="$1"; carrier="$2"; helper="$3"; spool="$4"; brain="$5"; repo="$6"; shift 6
+if [ -n "$caller" ]; then
+  env MOSAIC_AGENT_NAME="$caller" PATH="$PATH" HOME="$HOME" \
+    bash "$carrier" "$helper" "$spool" "$brain" "$repo" "$@"
+else
+  env -i HOME="$HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$spool" \
+       MOSAIC_BRAIN_HOME="$brain" "$@" "$helper" get
+fi
+LINROOT
+cat > "$WORK_DIR/lineage-carrier.sh" <<'LINCARR'
+#!/usr/bin/env bash
+# pid C — the caller's frozen environment. Forks the helper (pid D).
+set -u
+helper="$1"; spool="$2"; brain="$3"; repo="$4"; shift 4
+cd "$repo"
+env -i HOME="$HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$spool" \
+     MOSAIC_BRAIN_HOME="$brain" "$@" "$helper" get
+LINCARR
+chmod +x "$WORK_DIR/lineage-root.sh" "$WORK_DIR/lineage-carrier.sh"
+
+run_lineage() {
+  # run_lineage <caller|empty-for-anonymous> [helper-env KEY=VALUE...]
+  local caller="$1"; shift
+  printf 'host=git.mosaicstack.dev\nusername=probe\n\n' | \
+    env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_LINEAGE_FENCE=1 \
+      bash "$WORK_DIR/lineage-root.sh" "$caller" "$WORK_DIR/lineage-carrier.sh" \
+      "$HELPER" "$SPOOL_DIR" "$BRAIN_DIR" "$REPO_DIR" "$@"
+}
+
+assert_refused_lineage() {
+  # assert_refused_lineage <desc> <caller> <want-reason> [helper-env...]
+  local desc="$1" caller="$2" want="$3"; shift 3
+  local stderr_file="$WORK_DIR/stderr-lin.tmp" rc stdout
+  : > "$stderr_file"
+  set +e
+  stdout=$(run_lineage "$caller" "$@" 2>"$stderr_file")
+  rc=$?
+  set -e
+  local stderr; stderr=$(cat "$stderr_file")
+  if [[ "$rc" -eq 0 ]]; then
+    echo "FAIL: $desc — expected nonzero exit, got 0 (stdout='$stdout')" >&2; fail=1
+  fi
+  if [[ -n "$stdout" ]]; then
+    echo "FAIL: $desc — expected empty stdout, got '$stdout'" >&2; fail=1
+  fi
+  if [[ -n "$want" && "$stderr" != *"$want"* ]]; then
+    echo "FAIL: $desc — stderr lacks '$want':" >&2; echo "$stderr" >&2; fail=1
+  fi
+  if [[ "$stdout$stderr" == *"seatG-slot-token"* || "$stdout$stderr" == *"seatE-slot-token"* \
+     || "$stdout$stderr" == *"shared-mosaicstack-token"* || "$stdout$stderr" == *"shared-usc-token"* ]]; then
+    echo "FAIL: $desc — a slot or shared token VALUE appeared in output" >&2; fail=1
+  fi
+}
+
 # A refusal must be observable in four independent ways: nonzero exit, EMPTY
 # stdout, a stderr diagnostic naming the identity and host, and — the assertion
 # that actually catches a regression to the old behavior — NO shared token value
@@ -222,7 +299,10 @@ fi
 # ---------------------------------------------------------------------------
 mkdir -p "$BRAIN_DIR/fleet/agents/seatE/secrets"
 echo -n "seatE-slot-token" > "$BRAIN_DIR/fleet/agents/seatE/secrets/gitea-mosaicstack-seatE.token"
-out=$(run_helper "git.mosaicstack.dev" "seatE" MOSAIC_BRAIN_HOME="$BRAIN_DIR")
+chmod 600 "$BRAIN_DIR/fleet/agents/seatE/secrets/gitea-mosaicstack-seatE.token"
+# Seat arms run through the lineage harness below (rev-code-02 F1/F2 rework):
+# a seat caller must be established by ancestry, not by the helper's own env.
+out=$(run_lineage seatE MOSAIC_AGENT_NAME=seatE MOSAIC_GIT_IDENTITY=seatE)
 assert_eq "seat reads its own slot: username" "username=seatE" "$(echo "$out" | grep '^username=')"
 assert_eq "seat reads its own slot: password" "password=seatE-slot-token" "$(echo "$out" | grep '^password=')"
 
@@ -236,8 +316,8 @@ assert_eq "seat reads its own slot: password" "password=seatE-slot-token" "$(ech
 # ---------------------------------------------------------------------------
 mkdir -p "$BRAIN_DIR/fleet/agents/seatF/secrets"
 echo -n "seatF-SERVICE-STORE-token" > "$SVC_STORE/gitea-mosaicstack-seatF.token"
-assert_fail_closed "seat with empty slot does NOT fall back to the framework store" \
-  "git.mosaicstack.dev" "seatF" "fleet/agents/seatF/secrets" MOSAIC_BRAIN_HOME="$BRAIN_DIR"
+assert_refused_lineage "seat with empty slot does NOT fall back to the framework store" \
+  seatF no-token-for-identity MOSAIC_AGENT_NAME=seatF MOSAIC_GIT_IDENTITY=seatF
 : > "$WORK_DIR/stderr.tmp"
 set +e
 xstore_out=$(run_helper "git.mosaicstack.dev" "seatF" MOSAIC_BRAIN_HOME="$BRAIN_DIR" 2>"$WORK_DIR/stderr.tmp")
@@ -288,7 +368,7 @@ assert_eq "unknown host on a fleet host: still passthrough, not a refusal" "" "$
 # 13. Non-"get" verb (store/erase) -> exit 0, no output (git-credential
 #     protocol: this helper only implements get).
 # ---------------------------------------------------------------------------
-store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" bash "$HELPER" store <<EOF
+store_out=$(cd "$REPO_DIR" && env -i HOME="$FAKE_HOME" PATH="$PATH" "$HELPER" store <<EOF
 host=git.mosaicstack.dev
 username=no-such-agent
 password=whatever
@@ -310,7 +390,7 @@ hostile_spool="$WORK_DIR/spool-hostile"
   cd "$hostile_dir"
   env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$hostile_spool" \
     MOSAIC_GIT_IDENTITY=no-such-agent \
-    bash "$HELPER" get <<EOF >/dev/null 2>&1
+    "$HELPER" get <<EOF >/dev/null 2>&1
 host=git.mosaicstack.dev
 username=no-such-agent
 
@@ -349,7 +429,7 @@ nospool_err=$(
   cd "$REPO_DIR"
   env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$unwritable_spool" \
     MOSAIC_GIT_IDENTITY=no-such-agent \
-    bash "$HELPER" get <<EOF 2>&1 >/dev/null
+    "$HELPER" get <<EOF 2>&1 >/dev/null
 host=git.mosaicstack.dev
 username=no-such-agent
 
@@ -365,6 +445,193 @@ if [[ "$nospool_err" != *"NOT WRITTEN"* ]]; then
   fail=1
 fi
 
+# ---------------------------------------------------------------------------
+# 11. P5-RM-006 (+r1 rework) — caller identity from exec-frozen ancestry.
+#    A seat caller is established by lineage, not by the helper's own env;
+#    disagreement anywhere in the lineage is a rewrite and refuses; an
+#    anonymous caller resolves NOTHING on a fleet host (seat or service);
+#    a loose seat-slot mode refuses. Enforcement-removal red control at 11h.
+# ---------------------------------------------------------------------------
+mkdir -p "$BRAIN_DIR/fleet/agents/seatG/secrets"
+echo -n "seatG-slot-token" > "$BRAIN_DIR/fleet/agents/seatG/secrets/gitea-mosaicstack-seatG.token"
+chmod 600 "$BRAIN_DIR/fleet/agents/seatG/secrets/gitea-mosaicstack-seatG.token"
+
+# 11a. Cross-seat negative (lineage seatE, env ident=seatG): still refused.
+assert_refused_lineage "seat cannot override identity to another seat's slot" \
+  seatE cross-seat-identity-refused MOSAIC_GIT_IDENTITY=seatG
+
+# 11b. Seat asking for a SERVICE identity: cross-seat territory.
+assert_refused_lineage "seat cannot resolve a service identity either" \
+  seatE cross-seat-identity-refused MOSAIC_GIT_IDENTITY=agentA
+
+# 11c. Anonymous caller asking for a SEAT slot: refused (T94 jarvis@ class).
+assert_refused_lineage "anonymous caller cannot resolve a seat slot on a fleet host" \
+  "" anonymous-credential-refused MOSAIC_GIT_IDENTITY=seatG
+
+# 11d. Anonymous caller asking for a SERVICE identity: ALSO refused
+#     (rev-code-02 F2 — credentialed services are seats; the legacy store is
+#     not anonymously reachable on fleet hosts).
+assert_refused_lineage "anonymous caller cannot resolve a legacy service credential either" \
+  "" anonymous-credential-refused MOSAIC_GIT_IDENTITY=agentA
+
+# 11e. Slot permissions: a group-readable slot is refused; mode restored -> serves.
+chmod 644 "$BRAIN_DIR/fleet/agents/seatG/secrets/gitea-mosaicstack-seatG.token"
+assert_refused_lineage "loose slot mode is refused" \
+  seatG slot-permission-violation MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG
+chmod 600 "$BRAIN_DIR/fleet/agents/seatG/secrets/gitea-mosaicstack-seatG.token"
+out=$(run_lineage seatG MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG)
+assert_eq "mode restored to 600: seatG serves again" "password=seatG-slot-token" "$(echo "$out" | grep '^password=')"
+
+# 11f. rev-code-02 F1 repro: dual-variable override (caller lineage seatE,
+#     helper env carrying MOSAIC_AGENT_NAME=seatG AND MOSAIC_GIT_IDENTITY=seatG).
+assert_refused_lineage "F1: dual MOSAIC_AGENT_NAME+MOSAIC_GIT_IDENTITY override refused" \
+  seatE caller-identity-spoof-refused MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG
+
+# 11g. Stripped lineage still serves the rightful seat: caller frozen at the
+#     ancestor, helper env clean (self empty), own ident.
+out=$(run_lineage seatE MOSAIC_GIT_IDENTITY=seatE)
+assert_eq "lineage consensus with stripped self still serves the owning seat" \
+  "password=seatE-slot-token" "$(echo "$out" | grep '^password=')"
+
+# 11h. RED CONTROL: delete the ancestry binding between markers from a copy
+#     of the IMPLEMENTATION (run directly with the clean marker — a red control
+#     measures the binding itself, deliberately not through the wrapper);
+#     the F1 dual-override request must then RESOLVE seatG's token — the
+#     exact measured failure — proving the binding is the enforcement.
+RED_HELPER="$WORK_DIR/red/git-credential-mosaic.impl"
+mkdir -p "$WORK_DIR/red"
+sed '/P5-RM-006r1 ancestry binding begin/,/P5-RM-006r1 ancestry binding end/d' "$IMPL" > "$RED_HELPER"
+chmod +x "$RED_HELPER"
+if cmp -s "$IMPL" "$RED_HELPER"; then
+  echo "FAIL: red control is vacuous — marker deletion removed nothing" >&2
+  fail=1
+fi
+set +e
+red_out=$(printf 'host=git.mosaicstack.dev\nusername=probe\n\n' | \
+  env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_LINEAGE_FENCE=1 \
+    bash "$WORK_DIR/lineage-root.sh" seatE "$WORK_DIR/lineage-carrier.sh" \
+      "$RED_HELPER" "$SPOOL_DIR" "$BRAIN_DIR" "$REPO_DIR" \
+      _MOSAIC_HELPER_CLEAN=1 MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG 2>/dev/null)
+set -e
+if [[ "$(echo "$red_out" | grep '^password=')" != "password=seatG-slot-token" ]]; then
+  echo "FAIL: red control — with the binding removed, the F1 dual-override should have resolved seatG's token, got: $red_out" >&2
+  fail=1
+else
+  echo "ok: red control — binding removed -> F1 dual-override resolves the victim token (the binding is the enforcement)"
+fi
+
+# 11h2. rev-code-02 R1 F1: PATH-shadowed tr/sed/head/grep must not forge the
+#      ancestry. The dual-override request runs with a hostile PATH whose
+#      utilities claim the victim name for every /proc read; the walker uses
+#      only bash builtins, so the shadows never execute and the refusal holds.
+HOSTILE_BIN="$WORK_DIR/hostile-bin"
+mkdir -p "$HOSTILE_BIN"
+for tool in tr sed head grep cat stat; do
+  printf '#!/usr/bin/env bash\ncat >/dev/null\necho "MOSAIC_AGENT_NAME=seatG"\nexit 0\n' > "$HOSTILE_BIN/$tool"
+  chmod +x "$HOSTILE_BIN/$tool"
+done
+assert_refused_lineage "F1-R1: hostile PATH utilities cannot forge ancestry (dual override still refused)" \
+  seatE caller-identity-spoof-refused \
+  MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG PATH="$HOSTILE_BIN:$PATH"
+
+# 11i. Service automation integration arm (rev-code-02 R2 bar): a SERVICE
+#      seat bound by lineage resolves its own slot — the brain-git-sync shape.
+mkdir -p "$BRAIN_DIR/fleet/agents/svc-fixture/secrets"
+echo -n "svc-fixture-slot-token" > "$BRAIN_DIR/fleet/agents/svc-fixture/secrets/gitea-mosaicstack-svc-fixture.token"
+chmod 600 "$BRAIN_DIR/fleet/agents/svc-fixture/secrets/gitea-mosaicstack-svc-fixture.token"
+out=$(run_lineage svc-fixture MOSAIC_AGENT_NAME=svc-fixture MOSAIC_GIT_IDENTITY=svc-fixture)
+assert_eq "service automation with bound seat lineage resolves its own slot" \
+  "password=svc-fixture-slot-token" "$(echo "$out" | grep '^password=')"
+
+# 11j. rev-code-02 R3 B1: BASH_ENV shaping. A read() shadow defined through
+#      BASH_ENV must be refused before any resolution — the guard scrubs and
+#      refuses with bash-environment-injection-refused.
+INJ_SH="$WORK_DIR/inj-read.sh"
+printf 'read() { builtin read -r _x || return 0; printf "MOSAIC_AGENT_NAME=seatG\\n"; return 0; }\n' > "$INJ_SH"
+assert_refused_lineage "F1-R3: BASH_ENV read() shadow is dropped at the wrapper boundary (identity gate governs)" \
+  seatE caller-identity-spoof-refused \
+  MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG BASH_ENV="$INJ_SH"
+
+# 11k. rev-code-02 R3 B1: exported functions (BASH_FUNC_* import) refused too.
+assert_refused_lineage "F1-R3: exported BASH_FUNC_* import never crosses the wrapper boundary (identity gate governs)" \
+  seatE caller-identity-spoof-refused \
+  MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG \
+  'BASH_FUNC_read%%=() { builtin read -r _x || return 0; printf "MOSAIC_AGENT_NAME=seatG\\n"; return 0; }'
+
+# 11l. rev-code-02 R3 B2: hostile stat cannot launder a loose slot. Own-slot
+#      lineage (legit caller), 0644 slot, PATH-shadowed stat reporting 600 —
+#      mode inspection must come from the trusted PATH and still refuse.
+chmod 644 "$BRAIN_DIR/fleet/agents/svc-fixture/secrets/gitea-mosaicstack-svc-fixture.token"
+printf '#!/usr/bin/env bash\necho 600\n' > "$HOSTILE_BIN/stat"
+assert_refused_lineage "F2-R3: hostile stat cannot make a 0644 slot pass as 600 (own-slot path)" \
+  svc-fixture slot-permission-violation \
+  MOSAIC_AGENT_NAME=svc-fixture MOSAIC_GIT_IDENTITY=svc-fixture PATH="$HOSTILE_BIN:$PATH"
+chmod 600 "$BRAIN_DIR/fleet/agents/svc-fixture/secrets/gitea-mosaicstack-svc-fixture.token"
+
+# 11m. rev-code-02 R3 probe 1 through the PRODUCTION ENTRYPOINT: BASH_ENV
+#      defines unset()/exit() no-ops (defeating in-bash scrub/termination).
+#      The python wrapper never passes BASH_ENV across the boundary, so the
+#      implementation cannot be shaped and the dual override still refuses.
+INJ_P1="$WORK_DIR/inj-probe1.sh"
+cat > "$INJ_P1" <<'P1'
+unset() { return 0; }
+exit() { return 0; }
+read() { builtin read -r _x || return 0; printf 'MOSAIC_AGENT_NAME=seatG\n'; return 0; }
+P1
+assert_refused_lineage "F1-R4 probe1: BASH_ENV unset/exit no-ops cannot shape the helper (wrapper boundary)" \
+  seatE caller-identity-spoof-refused \
+  MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG BASH_ENV="$INJ_P1"
+
+# 11n. rev-code-02 R3 probe 2 through the PRODUCTION ENTRYPOINT: declare()
+#      hides imported functions, unsets the marker, printf() forges the
+#      ancestry. Dropped at the wrapper boundary; refusal holds.
+INJ_P2="$WORK_DIR/inj-probe2.sh"
+cat > "$INJ_P2" <<'P2'
+declare() { return 0; }
+printf() { builtin printf '%s' "MOSAIC_AGENT_NAME=seatG"; return 0; }
+read() { builtin read -r _x || return 0; printf 'MOSAIC_AGENT_NAME=seatG\n'; return 0; }
+P2
+assert_refused_lineage "F1-R4 probe2: declare-hide + printf-forge cannot shape the helper (wrapper boundary)" \
+  seatE caller-identity-spoof-refused \
+  MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG BASH_ENV="$INJ_P2"
+
+# 11o. RED CONTROL for the wrapper boundary (enforcement-removal): invoke the
+#      IMPLEMENTATION directly, bypassing the wrapper, with the PROBE-1 shape
+#      (unset/exit no-ops) and a forged clean marker — exactly the falsified
+#      in-bash world the reviewer measured: the refusal prints, exit is
+#      no-oped, execution continues, and the forged ancestry SERVES seatG.
+#      The wrapper boundary is the enforcement; this arm proves it bites.
+set +e
+bypass_out=$(cd "$REPO_DIR" && printf 'host=git.mosaicstack.dev\nusername=probe\n\n' | \
+  env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$SPOOL_DIR" \
+    MOSAIC_BRAIN_HOME="$BRAIN_DIR" _MOSAIC_HELPER_CLEAN=1 BASH_ENV="$INJ_P1" \
+    MOSAIC_AGENT_NAME=seatG MOSAIC_GIT_IDENTITY=seatG \
+    bash "$IMPL" get 2>/dev/null)
+set -e
+if [[ "$(echo "$bypass_out" | grep -c '^password=')" -lt 1 ]]; then
+  echo "FAIL: wrapper red control — direct shaped .impl should have served (wrapper is the enforcement), got: $bypass_out" >&2
+  fail=1
+else
+  echo "ok: red control — wrapper bypassed + probe1 shape serves (the wrapper boundary is the enforcement)"
+fi
+
+# 11p. Direct .impl invocation WITHOUT the clean marker: refused by the
+#      implementation's own entrypoint assert.
+set +e
+direct_out=$(cd "$REPO_DIR" && printf 'host=git.mosaicstack.dev\nusername=probe\n\n' | \
+  env -i HOME="$FAKE_HOME" PATH="$PATH" MOSAIC_CREDENTIAL_SPOOL="$SPOOL_DIR" \
+    MOSAIC_BRAIN_HOME="$BRAIN_DIR" MOSAIC_GIT_IDENTITY=seatE \
+    bash "$IMPL" get 2>"$WORK_DIR/stderr-direct.tmp")
+direct_rc=$?
+set -e
+if [[ "$direct_rc" -eq 0 || -n "$direct_out" ]]; then
+  echo "FAIL: direct .impl without marker must refuse (got rc=$direct_rc out='$direct_out')" >&2
+  fail=1
+elif ! grep -q 'direct-entrypoint-refused' "$WORK_DIR/stderr-direct.tmp"; then
+  echo "FAIL: direct .impl refusal lacks direct-entrypoint-refused" >&2
+  fail=1
+fi
+
 if [[ "$fail" -eq 0 ]]; then
   echo "git-credential-mosaic identity resolution regression passed"
 fi

scripts/verify-dogfood-compose.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# Hermetic structural check for the explicit dogfood Compose overlay.
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/worktree" "$tmp/seat/secrets"
+
+base_config_json=$(
+  cd "$repo_root"
+  BETTER_AUTH_SECRET=test-only-not-a-credential \
+    docker compose --profile stack config --format json
+)
+
+BASE_CONFIG_JSON="$base_config_json" python3 <<'PY'
+import json
+import os
+
+config = json.loads(os.environ["BASE_CONFIG_JSON"])
+gateway = config["services"]["gateway"]
+env = gateway["environment"]
+for key in (
+    "MOSAIC_AGENT_NAME",
+    "MOSAIC_GIT_IDENTITY",
+    "MOSAIC_BRAIN_HOME",
+    "AGENT_FILE_SANDBOX_DIR",
+    "AGENT_USER_TOOLS",
+):
+    assert key not in env, f"base compose unexpectedly sets dogfood variable {key}"
+
+targets = {mount["target"] for mount in gateway["volumes"]}
+assert "/workspace/stack" not in targets
+assert not any(target.startswith("/opt/mosaic/brain/") for target in targets)
+PY
+
+config_json=$(
+  cd "$repo_root"
+  BETTER_AUTH_SECRET=test-only-not-a-credential \
+  MOSAIC_DOGFOOD_WORKTREE="$tmp/worktree" \
+  MOSAIC_DOGFOOD_SEAT_HOME="$tmp/seat" \
+    docker compose \
+      -f docker-compose.yml \
+      -f docker-compose.dogfood.yml \
+      --profile stack \
+      config --format json
+)
+
+CONFIG_JSON="$config_json" EXPECT_WORKTREE="$tmp/worktree" EXPECT_SEAT="$tmp/seat" python3 <<'PY'
+import json
+import os
+
+config = json.loads(os.environ["CONFIG_JSON"])
+gateway = config["services"]["gateway"]
+env = gateway["environment"]
+
+expected_env = {
+    "MOSAIC_AGENT_NAME": "stack-dogfood",
+    "MOSAIC_GIT_IDENTITY": "stack-dogfood",
+    "MOSAIC_BRAIN_HOME": "/opt/mosaic/brain",
+    "AGENT_FILE_SANDBOX_DIR": "/workspace/stack",
+}
+for key, value in expected_env.items():
+    assert env.get(key) == value, f"{key}: expected {value!r}, got {env.get(key)!r}"
+
+allowed = set(env["AGENT_USER_TOOLS"].split(","))
+assert allowed == {
+    "fs_read_file",
+    "fs_write_file",
+    "fs_list_directory",
+    "fs_edit_file",
+    "git_status",
+    "git_log",
+    "git_diff",
+    "shell_exec",
+}, f"unexpected dogfood tool set: {sorted(allowed)}"
+
+mounts = {mount["target"]: mount for mount in gateway["volumes"]}
+worktree = mounts["/workspace/stack"]
+assert worktree["type"] == "bind"
+assert worktree["source"] == os.environ["EXPECT_WORKTREE"]
+assert not worktree.get("read_only", False), "dogfood worktree must be writable"
+
+seat = mounts["/opt/mosaic/brain/fleet/agents/stack-dogfood"]
+assert seat["type"] == "bind"
+assert seat["source"] == os.environ["EXPECT_SEAT"]
+assert seat.get("read_only") is True, "seat credential slot must be read-only"
+
+other_seat_mounts = [
+    target
+    for target in mounts
+    if target.startswith("/opt/mosaic/brain/fleet/agents/")
+    and target != "/opt/mosaic/brain/fleet/agents/stack-dogfood"
+]
+assert other_seat_mounts == [], f"other seat mounts leaked: {other_seat_mounts}"
+PY
+
+# Each required path must fail closed rather than falling back to the current checkout.
+expect_missing_path() {
+  local missing=$1 output rc
+  set +e
+  case "$missing" in
+    MOSAIC_DOGFOOD_WORKTREE)
+      output=$(
+        cd "$repo_root"
+        env -u MOSAIC_DOGFOOD_WORKTREE \
+          BETTER_AUTH_SECRET=test-only-not-a-credential \
+          MOSAIC_DOGFOOD_SEAT_HOME="$tmp/seat" \
+          docker compose -f docker-compose.yml -f docker-compose.dogfood.yml \
+            --profile stack config 2>&1
+      )
+      rc=$?
+      ;;
+    MOSAIC_DOGFOOD_SEAT_HOME)
+      output=$(
+        cd "$repo_root"
+        env -u MOSAIC_DOGFOOD_SEAT_HOME \
+          BETTER_AUTH_SECRET=test-only-not-a-credential \
+          MOSAIC_DOGFOOD_WORKTREE="$tmp/worktree" \
+          docker compose -f docker-compose.yml -f docker-compose.dogfood.yml \
+            --profile stack config 2>&1
+      )
+      rc=$?
+      ;;
+    *)
+      echo "FAIL: test requested unknown path variable $missing" >&2
+      exit 1
+      ;;
+  esac
+  set -e
+  if [[ $rc -eq 0 ]]; then
+    echo "FAIL: dogfood compose accepted missing $missing" >&2
+    exit 1
+  fi
+  if [[ "$output" != *"$missing"* ]]; then
+    echo "FAIL: missing-path failure did not name $missing" >&2
+    exit 1
+  fi
+}
+
+expect_missing_path MOSAIC_DOGFOOD_WORKTREE
+expect_missing_path MOSAIC_DOGFOOD_SEAT_HOME
+
+printf 'dogfood compose verification passed\n'