feat(#756): add official Discord channel adapter

.env.example

@@ -1,16 +1,154 @@
-# Mosaic Stack standalone deployment (compose `stack` profile)
-# Copy to .env and adjust. Port overrides exist because the defaults
-# collide with common host services (and with the dev compose itself).
-PG_HOST_PORT=5433
-VALKEY_HOST_PORT=6380
-GATEWAY_HOST_PORT=14242
-# Registry image override (defaults to a local build of docker/gateway.Dockerfile):
-# GATEWAY_IMAGE=git.mosaicstack.dev/mosaicstack/stack/gateway:sha-acf640d
+# ─────────────────────────────────────────────────────────────────────────────
+# Mosaic — Environment Variables Reference
+# Copy this file to .env and fill in the values for your deployment.
+# Lines beginning with # are comments; optional vars are commented out.
+# ─────────────────────────────────────────────────────────────────────────────
 
-# Optional explicit dogfood overlay (docker-compose.dogfood.yml).
-# All three paths are required when that overlay is used. Use a dedicated
-# next-based worktree, its canonical clone's .git directory, and the external
-# home of the unprivileged code-dogfood-01 functional seat.
-# MOSAIC_DOGFOOD_WORKTREE=/home/example/src/mosaic-stack-worktrees/dogfood-1487
-# MOSAIC_DOGFOOD_COMMON_GIT_DIR=/home/example/src/mosaic-stack/.git
-# MOSAIC_DOGFOOD_SEAT_HOME=/home/example/.mosaic/fleet/agents/code-dogfood-01
+
+# ─── Database (PostgreSQL 17 + pgvector) ─────────────────────────────────────
+# Full connection string used by the gateway, ORM, and migration runner.
+# Port 5433 avoids conflict with a host-side PostgreSQL instance.
+DATABASE_URL=postgresql://mosaic:mosaic@localhost:5433/mosaic
+
+# Docker Compose host-port override for the PostgreSQL container (default: 5433)
+# PG_HOST_PORT=5433
+
+
+# ─── Queue (Valkey 8 / Redis-compatible) ─────────────────────────────────────
+# Port 6380 avoids conflict with a host-side Redis/Valkey instance.
+VALKEY_URL=redis://localhost:6380
+
+# Docker Compose host-port override for the Valkey container (default: 6380)
+# VALKEY_HOST_PORT=6380
+
+
+# ─── Gateway ─────────────────────────────────────────────────────────────────
+# TCP port the NestJS/Fastify gateway listens on (default: 14242)
+GATEWAY_PORT=14242
+
+# Comma-separated list of allowed CORS origins.
+# Must include the web app origin in production.
+GATEWAY_CORS_ORIGIN=http://localhost:3000
+
+
+# ─── Auth (BetterAuth) ───────────────────────────────────────────────────────
+# REQUIRED — random secret used to sign sessions and tokens.
+# Generate with: openssl rand -base64 32
+BETTER_AUTH_SECRET=change-me-to-a-random-32-char-string
+
+# Public base URL of the gateway (used by BetterAuth for callback URLs)
+BETTER_AUTH_URL=http://localhost:14242
+
+
+# ─── Web App (Next.js) ───────────────────────────────────────────────────────
+# Public gateway URL — accessible from the browser, not just the server.
+NEXT_PUBLIC_GATEWAY_URL=http://localhost:14242
+
+
+# ─── OpenTelemetry ───────────────────────────────────────────────────────────
+# OTLP HTTP endpoint (otel-collector or any OpenTelemetry-compatible backend)
+OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
+
+# Service name shown in traces
+OTEL_SERVICE_NAME=mosaic-gateway
+
+
+# ─── AI Providers ────────────────────────────────────────────────────────────
+
+# Ollama (local models — set OLLAMA_BASE_URL to enable)
+# OLLAMA_BASE_URL=http://localhost:11434
+# OLLAMA_HOST is a legacy alias for OLLAMA_BASE_URL
+# OLLAMA_HOST=http://localhost:11434
+# Comma-separated list of Ollama model IDs to register (default: llama3.2,codellama,mistral)
+# OLLAMA_MODELS=llama3.2,codellama,mistral
+
+# Anthropic (claude-sonnet-4-6, claude-opus-4-6, claude-haiku-4-5)
+# ANTHROPIC_API_KEY=sk-ant-...
+
+# OpenAI (gpt-4o, gpt-4o-mini, o3-mini)
+# OPENAI_API_KEY=sk-...
+
+# Z.ai / GLM (glm-4.5, glm-4.5-air, glm-4.5-flash)
+# ZAI_API_KEY=...
+
+# Custom providers — JSON array of provider configs
+# Format: [{"id":"<id>","baseUrl":"<url>","apiKey":"<key>","models":[{"id":"<model-id>","name":"<label>"}]}]
+# MOSAIC_CUSTOM_PROVIDERS=
+
+
+# ─── Embedding Service ───────────────────────────────────────────────────────
+# OpenAI-compatible embeddings endpoint (default: OpenAI)
+# EMBEDDING_API_URL=https://api.openai.com/v1
+# EMBEDDING_MODEL=text-embedding-3-small
+
+
+# ─── Log Summarization Service ───────────────────────────────────────────────
+# OpenAI-compatible chat completions endpoint for log summarization (default: OpenAI)
+# SUMMARIZATION_API_URL=https://api.openai.com/v1
+# SUMMARIZATION_MODEL=gpt-4o-mini
+
+# Cron schedule for summarization job (default: every 6 hours)
+# SUMMARIZATION_CRON=0 */6 * * *
+
+# Cron schedule for log tier management (default: daily at 03:00)
+# TIER_MANAGEMENT_CRON=0 3 * * *
+
+
+# ─── Agent ───────────────────────────────────────────────────────────────────
+# Filesystem sandbox root for agent file tools (default: process.cwd())
+# AGENT_FILE_SANDBOX_DIR=/var/lib/mosaic/sandbox
+
+# Comma-separated list of tool names available to non-admin users.
+# Leave unset to allow all tools for all authenticated users.
+# AGENT_USER_TOOLS=read_file,list_directory,search_files
+
+# System prompt injected into every agent session (optional)
+# AGENT_SYSTEM_PROMPT=You are a helpful assistant.
+
+
+# ─── MCP Servers ─────────────────────────────────────────────────────────────
+# JSON array of MCP server configs — set to enable MCP tool integration.
+# Each entry: {"name":"<id>","url":"<http-or-sse-url>"}
+# MCP_SERVERS=[{"name":"my-mcp","url":"http://localhost:3100/sse"}]
+
+
+# ─── Coordinator ─────────────────────────────────────────────────────────────
+# Root directory used to scope coordinator (worktree/repo) operations.
+# Defaults to the monorepo root auto-detected from process.cwd().
+# MOSAIC_WORKSPACE_ROOT=/home/user/projects/mosaic
+
+
+# ─── Discord Plugin (optional — set DISCORD_BOT_TOKEN to enable) ─────────────
+# DISCORD_BOT_TOKEN=
+# DISCORD_GUILD_ID=
+# DISCORD_GATEWAY_URL=http://localhost:14242
+
+
+# ─── Telegram Plugin (optional — set TELEGRAM_BOT_TOKEN to enable) ───────────
+# TELEGRAM_BOT_TOKEN=
+# TELEGRAM_GATEWAY_URL=http://localhost:14242
+
+
+# ─── SSO Providers (add credentials to enable) ───────────────────────────────
+
+# --- Authentik (optional — set AUTHENTIK_CLIENT_ID to enable) ---
+# AUTHENTIK_ISSUER=https://auth.example.com/application/o/mosaic/
+# AUTHENTIK_CLIENT_ID=
+# AUTHENTIK_CLIENT_SECRET=
+
+# --- WorkOS (optional — set WORKOS_CLIENT_ID to enable) ---
+# WORKOS_ISSUER=https://your-company.authkit.app
+# WORKOS_CLIENT_ID=client_...
+# WORKOS_CLIENT_SECRET=sk_live_...
+
+# --- Keycloak (optional — set KEYCLOAK_CLIENT_ID to enable) ---
+# KEYCLOAK_ISSUER=https://auth.example.com/realms/master
+# Legacy alternative if you prefer to compose the issuer from separate vars:
+# KEYCLOAK_URL=https://auth.example.com
+# KEYCLOAK_REALM=master
+# KEYCLOAK_CLIENT_ID=mosaic
+# KEYCLOAK_CLIENT_SECRET=
+
+# Feature flags — set to true alongside provider credentials to show SSO buttons in the UI
+# NEXT_PUBLIC_WORKOS_ENABLED=true
+# NEXT_PUBLIC_KEYCLOAK_ENABLED=true

.gitignore

@@ -8,8 +8,7 @@ coverage
 .env.local
 *.tsbuildinfo
 .pnpm-store
-__pycache__/
-docs/.obsidian
+docs/reports/
 
 # Step-CA dev password — real file is gitignored; commit only the .example
 infra/step-ca/dev-password
@@ -23,7 +22,3 @@ infra/step-ca/dev-password
 # traversal error: ... .timestamp-*.mjs: No such file or directory" when the
 # file vanished mid-scan. Ignoring them removes the race.
 *.timestamp-*.mjs
-
-# Playwright run artifacts (#1445, P6 E2E gate)
-apps/web/test-results/
-apps/web/playwright-report/

.husky/pre-push

@@ -1 +1 @@
-pnpm preflight && pnpm typecheck && pnpm lint && pnpm format:check
+pnpm typecheck && pnpm lint && pnpm format:check

.mosaic/repo.json

@@ -1,11 +0,0 @@
-{
-  "schema_version": 2,
-  "integration_trunk": "next",
-  "release_branch": "main",
-  "flow": "trunk-release",
-  "canonical_remote": "https://git.mosaicstack.dev/mosaicstack/stack",
-  "canonical_clone": "host:/src/mosaic-stack",
-  "worktree_root": "host:/src/mosaic-stack-worktrees",
-  "worktree_policy": "orchestrator-precreated",
-  "notes": "next=development/integration; main=production release. Never branch work off main. worktree_policy is TRANSITIONAL: the wrapper worktree consumer is BLOCKED on the J3/#1174 amendment (checked roots + capacity guard); pre-creation is the interim orchestration choice, not closed policy — it becomes a timing choice only after the wrapper can validate this root."
-}

.npmrc

@@ -1,5 +1,5 @@
 @mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
-# HOME resolves to /root in the ci-base image, preserving its warmed-store path.
-# Non-root checkouts use their own HOME. Override without editing this file via
-# NPM_CONFIG_STORE_DIR (pnpm's environment form of the store-dir setting).
-store-dir=${HOME}/.local/share/pnpm/store
+# Pin the pnpm store to the same path the ci-base image warms (Dockerfile.ci),
+# so the pipeline `pnpm install --prefer-offline` consumes the baked store
+# instead of repopulating a fresh one.
+store-dir=/root/.local/share/pnpm/store

.prettierignore

@@ -4,15 +4,6 @@ pnpm-lock.yaml
 **/node_modules
 **/drizzle
 **/.next
-# Python build/test artifacts — same category as node_modules/dist/.next above.
-# Prettier must never scan generated trees; without these a local venv poisons
-# `pnpm format:check` with thousands of third-party files.
-**/venv
-**/__pycache__
-**/.mypy_cache
-**/.pytest_cache
-**/htmlcov
 .claude/
 docs/tess/TASKS.md
 docs/scratchpads/
-packages/mosaic/src/fleet/testdata/documentation-publication-v1/inline-migration-v1.json

.woodpecker/ci-image.yml

@@ -22,9 +22,9 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}

.woodpecker/ci.yml

@@ -2,48 +2,24 @@
 # node:24-alpine + python3/make/g++/postgresql-client + pnpm + a warm pnpm
 # store. The install step resolves from the baked store (--prefer-offline)
 # instead of paying a ~731s cold fetch + native compile every run.
-#
-# PINNED to an immutable lock-tag (#1328, brain D27): ci-image.yml pushes
-# lock-<sha256(pnpm-lock.yaml)[:12]> atomically with :latest, so the two are
-# byte-identical at push time. A mutable :latest resolves per-pod at pull time
-# on the k8s backend, which made CI verdicts non-reproducible (same tree, same
-# config, different images across runs; see #1324 comment 23382/23386). The pin
-# changes ONLY through reviewed commits; a wrong tag fails loudly at image pull.
-#
-# Bump procedure: when a recipe change (pnpm-lock.yaml / Dockerfile.ci) lands on
-# main, ci-image.yml pushes lock-<new>; a follow-up PR updates this anchor.
-# Until then pipelines keep the old pin: reproducible, with the documented
-# network-fallback lag (frozen-lockfile resolves missing packages from network).
-# Known limitation: lock- addresses the lockfile only, so a Dockerfile-only
-# change re-pushes the same tag with new content (#1328 follow-up: recipe-hash).
 variables:
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:lock-9cb7ffcd8828'
+  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
   - &enable_pnpm 'corepack enable'
 
 when:
-  # PR + manual CI run on any branch: the pull_request pipeline is the merge
-  # gate (next is protected and the default branch since 2026-08-19).
-  # Push CI runs on main only. next deliberately runs NO push ci: post-merge
-  # verification on next is carried by publish.yml's `verify` step
-  # (pnpm verify:release), which mirrors this pipeline's complete mandatory
-  # set step-for-step, enforced by scripts/verify-release.test.mjs. PR CI
-  # tests the PR HEAD tree (refs/pull/N/head, measured 2026-08-19), not a
-  # merge ref, so if next advances before a merge the landed tree differs
-  # from the tested one; publish verify re-runs the full set on the landed
-  # tree (PGlite path). Measured 2026-08-19: the 21 most recent push events
-  # on next each ran exactly one pipeline (publish), zero ci.
-  # Keeping push ci off next also avoids a redundant second full-suite run
-  # per merge on the storage-constrained runner.
+  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
+  # push CI is restricted to protected branches (main) so a feature-branch push no
+  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
+  # CI load on the storage-constrained runner with zero loss of gating (branch
+  # protection requires no push/ci status context; main still gets full push CI).
   - event: [pull_request, manual]
   - event: push
     branch: main
 
-# Turbo remote cache (turbo.mosaicstack.dev) is wired in publish.yml via the
-# org-level Woodpecker secret `turbo_token` (events: push/tag/cron/manual/
-# deployment — never pull_request). This PR pipeline deliberately gets no
-# remote-cache credentials: an untrusted PR must not be able to write to (or
-# poison) the shared cache. Without TURBO_* env vars turbo falls back to
-# local cache only, which is the intended behavior here.
+# Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
+# repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).
+# This avoids from_secret which is blocked on pull_request events.
+# If the env vars aren't set, turbo falls back to local cache only.
 
 steps:
   install:
@@ -54,19 +30,6 @@ steps:
       # the baked pnpm store.
       - pnpm install --frozen-lockfile --prefer-offline
 
-  # ---------------------------------------------------------------------------
-  # The steps below (sanitization, upgrade-guard, typecheck, lint, format,
-  # test) are the COMPLETE mandatory verification set. SDLC-D-034 mirrors them
-  # one-for-one in the canonical terminal verification command — root
-  # `pnpm verify:release` (scripts/verify-release.mjs) — which the publish
-  # pipeline (.woodpecker/publish.yml `verify` step) runs before ANY publish
-  # effect. These lines stay direct (not routed through the runner) because the
-  # #1017 test-enumeration guard audits framework tool paths through THIS
-  # surface; scripts/verify-release.test.mjs enforces that the runner's stage
-  # table keeps matching these commands exactly, so the two cannot drift.
-  # ---------------------------------------------------------------------------
-
-  # Canonical verify:release stage `sanitization`.
   # Blocking gate: public framework package must contain no operator-specific
   # personal data or private $HOME defaults. Runs early (no node_modules needed).
   sanitization:
@@ -78,101 +41,7 @@ steps:
       # (Constitution + dispatcher + each RUNTIME.md slice). See DESIGN §7 / R9.
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test
       - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh
-      # Test-membership guard (#1017): also first link of test:framework-shell.
-      # Invoked from BOTH surfaces it audits (F2, PR #1018) — the guard is link
-      # [0] of the pnpm chain, so severing that chain would silence it together
-      # with everything it guards; this direct line keeps one instrument running.
-      - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
-      # Tool-index gate: a shipped wrapper that appears in no resident index doc
-      # is undiscoverable from inside a session, and an agent that cannot learn a
-      # wrapper exists reaches for raw curl instead — which is how a Gitea review
-      # got filed PENDING three times. Ships-and-documented is one commit, or red.
-      - bash packages/mosaic/framework/tools/quality/scripts/check-tools-index.sh --self-test
-      - bash packages/mosaic/framework/tools/quality/scripts/check-tools-index.sh
-      # Hermetic regression for issue-close.sh (#1081): mocks tea/curl onto PATH
-      # and sandboxes a throwaway git repo, so it resolves no real credentials and
-      # joins CI directly rather than the exclusions file.
-      - bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh
-      # Hermetic regression for the git identity ladder (#1356): mock tea on PATH,
-      # sandboxed repo, no real credentials (3/3 green under an empty HOME). Pins
-      # fail-closed: a seat whose login is missing gets a named error, never a
-      # borrowed identity. Joins CI directly; its #1007 exclusion is burned down.
-      - bash packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh
-      # Hermetic regression for issue-view.sh (#1357): mock tea/curl, sandboxed
-      # repo. Pins that comment BODIES render on both paths and that a tea
-      # failure is named as what it was (git-config vs credential).
-      - bash packages/mosaic/framework/tools/git/test-issue-view-comments.sh
-      # Hermetic behavioural regression for the PreToolUse wrapper guard: proves
-      # it still blocks the three mistakes AND still lets reads, unwrapped
-      # endpoints and ordinary commands through. Both directions are asserted —
-      # a guard that over-blocks gets routed around, which fails just as hard.
-      - bash packages/mosaic/framework/tools/git/test-wrapper-guard.sh
-      # Hermetic regression for mosaic-worktree.sh at fleet scale: stubs git onto
-      # PATH so `list` faces ~450 KB of porcelain. The defect it pins is invisible
-      # at small size — `git … | awk '…exit'` gives the producer SIGPIPE, which
-      # under `set -euo pipefail` aborts the caller silently with rc=141 and no
-      # output. A repo only reaches that once it has enough worktrees, so the
-      # stub supplies the scale instead of the host's own checkout.
-      - bash packages/mosaic/framework/tools/git/test-mosaic-worktree-large-repo.sh
 
-  # Canonical repo-structure declaration gate (T51 WP5c, spec §5.4 point 2):
-  # .mosaic/repo.json is the machine-readable structure SSOT consumed by git
-  # wrappers and the T32 gate seat; this is its repo-side CI enforcement.
-  # Path-conditional: runs when the declaration, the vendored validator, or this
-  # pipeline config changes (manual runs always include it). Fails the pipeline
-  # on any VALIDATION_ERROR and enforces the schema_version 2 authoring rule
-  # (--require-v2: edited/new declarations may not stay v1). The validator is
-  # vendored into the framework tree (spec §5.1 final home) — provenance in its
-  # header; the hostile-input suite (101 arms, hermetic) runs alongside so the
-  # gate's own instrument ships in the same commit as the gate.
-  structure-declaration:
-    image: *node_image
-    commands:
-      - apk add --no-cache bash git
-      # MOSAIC_HOST_ROOT is a runtime anchor (spec §1.2a: unset fails closed
-      # for managed validation). CI has no host, so the step provisions an
-      # EXPLICIT fixture root — honest configuration for the resolution path,
-      # never a guess about a real host; the per-host containment checks are
-      # runtime concerns and do not run against a fixture. Grammar, schema,
-      # refs, flow, remote normalization, and path grammar all prove here.
-      - mkdir -p /tmp/t51-ci-hostroot
-      - bash packages/mosaic/framework/tools/structure/validate-repo-json.sh .mosaic/repo.json --require-v2
-      - bash packages/mosaic/framework/tools/structure/test-validate-repo-json.sh
-    environment:
-      MOSAIC_HOST_ROOT: /tmp/t51-ci-hostroot
-    when:
-      - event: pull_request
-        path:
-          include:
-            - '.mosaic/repo.json'
-            - 'packages/mosaic/framework/tools/structure/**'
-            - '.woodpecker/ci.yml'
-      - event: manual
-
-  # Canonical verify:release stage `upgrade-guard`.
-  # Blocking gate (#791): a framework upgrade must never write or delete an
-  # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
-  # survives a keep-mode reseed byte-identical (with rsync present AND absent —
-  # keep mode is a single cp-based path that must not depend on rsync), and that a
-  # corrupt/empty/missing manifest aborts fail-closed leaving operator files
-  # untouched (B2/B3). The rollback gate proves a mid-sync failure is rolled back
-  # from the pre-update snapshot (B1). The durable-snapshot gate (#791 PR2) proves
-  # the retained, operator-scoped pre-update backup is taken before any mutation
-  # (0700/0600, secret never logged, retention-pruned) and that the post-sync
-  # verify net restores any operator file a manifest bug lets the sync touch. The
-  # migration matrix pins the v2→v3 contract-file semantics. Pure bash, no
-  # node_modules — runs early alongside sanitization.
-  upgrade-guard:
-    image: *node_image
-    commands:
-      - apk add --no-cache bash rsync
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-manifest-guard.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
-      - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
-
-  # Canonical verify:release stage `typecheck` — the same `pnpm typecheck`
-  # invocation (which runs the checkout preflight first, then turbo).
   typecheck:
     image: *node_image
     commands:
@@ -181,10 +50,8 @@ steps:
     depends_on:
       - install
       - sanitization
-      - upgrade-guard
 
-  # lint, format, and test are independent — run in parallel after typecheck.
-  # Each runs exactly its canonical verify:release stage command.
+  # lint, format, and test are independent — run in parallel after typecheck
   lint:
     image: *node_image
     commands:
@@ -201,12 +68,6 @@ steps:
     depends_on:
       - typecheck
 
-  # Canonical verify:release stage `test` — the `pnpm test` line below is the
-  # shared command; everything else in this step is PIPELINE-LEVEL
-  # prerequisite the canonical command expects its caller to provide (SDLC-D-034):
-  # the ci-postgres service + pg_isready wait + db:migrate (postgres path),
-  # `apk add openssl`, and the pinned pi install. None of those can move into
-  # the runner (it must also work locally on the PGlite path with no database).
   test:
     image: *node_image
     environment:
@@ -215,22 +76,6 @@ steps:
       DATABASE_URL: postgresql://mosaic:mosaic@ci-postgres:5432/mosaic
     commands:
       - *enable_pnpm
-      # openssl (#912) is the wake HMAC signer: the digest H1/H2, beacon B12,
-      # and install I8 legs hard-require it in CI. It is baked into ci-base via
-      # Dockerfile.ci, but ci-base only rebuilds on push-to-main/tag — this
-      # `apk add` guarantees openssl is present on PR pipelines too (and is a
-      # fast no-op once the rebuilt image already ships it).
-      - apk add --no-cache openssl
-      # Pi runtime (Invariant R): invariant_r_unittest.py hard-requires an
-      # installed `pi` binary at exactly this measured version — the test
-      # boots Pi's real tool registry to prove the read-only carve-out
-      # resolves to real, unshadowed builtins, and fails loud (by design)
-      # when the runtime is absent or drifts. The canonical Pi is
-      # @earendil-works/[email protected] exactly (@mariozechner/* is
-      # embedded-legacy). Step-level install because ci-base image publishes
-      # are currently blocked on registry auth; fold into Dockerfile.ci once
-      # that is fixed, keeping this as a fast no-op guard.
-      - npm install -g @earendil-works/[email protected]
       # postgresql-client (pg_isready) is baked into ci-base.
       # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
       - |
@@ -254,23 +99,6 @@ steps:
     depends_on:
       - typecheck
 
-  # Canonical verify:release stage `build` (#1445, P6): every PR proves the
-  # full workspace build — including the SPA `vite build` — before merge,
-  # instead of leaving build breakage to surface post-merge in publish.yml's
-  # verify step. Same canonical command the publish pipeline's build step runs.
-  build:
-    image: *node_image
-    commands:
-      - *enable_pnpm
-      - pnpm build
-    depends_on:
-      # after test, not typecheck: turbo gives `test` a ^build dependency, so
-      # running this step concurrently with test would put two independent
-      # turbo builds on the same shared-workspace dist/ and turbo cache with
-      # no cross-process locking — the same serialization invariant
-      # publish.yml documents for #1411.
-      - test
-
 services:
   ci-postgres:
     image: pgvector/pgvector:pg17

.woodpecker/publish.yml

@@ -1,29 +1,10 @@
 # Build, publish npm packages, and push Docker images
-# Runs on main for stable publishes and on next for integration-line prereleases/images
-#
-# SDLC-D-034 publish gate: every publish effect (publish-npm, publish-next-npm,
-# and every image build/push step) depends DIRECTLY on the `verify` step below.
-# `verify` (a) asserts the provider's commit identity matches the actual
-# checkout (CI_COMMIT_SHA == git rev-parse HEAD, fail closed on mismatch or
-# emptiness) and (b) runs the canonical terminal verification command
-# (`pnpm verify:release`), which mirrors the PR CI pipeline's complete
-# mandatory set (sanitization, upgrade-guard, preflight+typecheck, lint,
-# format:check, test, build) — see scripts/verify-release.mjs. A missing,
-# failed, skipped, cancelled, or inconclusive verification therefore skips the
-# dependent publish effects (fail closed). Path-filtered short-circuits may
-# skip publish EFFECTS (e.g. docs-only merges) but never bypass `verify` for a
-# publish that does run: `verify` itself carries no path filter.
-# scripts/verify-release.test.mjs enforces this DAG invariant at checkout time.
+# Runs only on main branch push/tag
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
   # toolchain + warm pnpm store. Kills the second cold install publish pays.
-  # PINNED to the immutable lock-tag, not :latest (#1328, brain D27): a mutable
-  # tag resolves per-pod at pull time on the k8s backend and made CI verdicts
-  # non-reproducible (#1324). Byte-identical to :latest at pin time (pushed
-  # atomically by the same kaniko run, main 712c770, 2026-07-26). Bump only via
-  # reviewed PR, per the procedure in .woodpecker/ci.yml's header comment.
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:lock-9cb7ffcd8828'
+  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
   - &enable_pnpm 'corepack enable'
   # Heavy kaniko image builds (~25 min) — gate them so a merge that only touches
   # the npm-only CLI (@mosaicstack/mosaic) or docs does NOT rebuild the platform
@@ -32,11 +13,6 @@ variables:
   # non-excluded change still builds, so no transitive dep can silently go stale.
   # (Woodpecker: `when` entries are OR'd; `path` applies to push/PR only — hence
   # the separate `event: tag` entry.)
-  # #1407: ONE shared anchor for all three image steps. A second main-only
-  # anchor previously gated build-web/build-appservice, so next-lane pushes
-  # published gateway sha images with no web/appservice counterpart — no
-  # sha-parity set existed for next-lane containerized deploys. Every image
-  # step now builds on next too (sha-only destinations, enforced per step).
   - &image_build_when
     - event: tag
     - event: [push, manual]
@@ -47,11 +23,9 @@ variables:
           - 'docs/**'
           - '**/*.md'
           - '.woodpecker/**'
-    - event: [push, manual]
-      branch: next
 
 when:
-  - branch: [main, next]
+  - branch: [main]
     event: [push, manual, tag]
 
 steps:
@@ -62,67 +36,13 @@ steps:
       # Resolve from the baked pnpm store instead of a cold network fetch.
       - pnpm install --frozen-lockfile --prefer-offline
 
-  # SDLC-D-034 exact-commit publish gate. No `when`/path filter on purpose: it
-  # runs for every event this pipeline serves so no publish effect can ever
-  # start without it. Fails closed on commit-identity mismatch (or either SHA
-  # being empty) and on any incomplete verification.
-  verify:
-    image: *node_image
-    environment:
-      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
-      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
-    commands:
-      - *enable_pnpm
-      # (a) Commit identity: the provider's claimed SHA must equal the actual
-      # checkout HEAD — verification of anything else must never authorize a
-      # publish of this commit.
-      - |
-        if [ -z "$CI_COMMIT_SHA" ]; then
-          echo "[verify] FATAL: CI_COMMIT_SHA is empty — cannot certify commit identity" >&2
-          exit 1
-        fi
-        CHECKOUT_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
-        if [ -z "$CHECKOUT_SHA" ]; then
-          echo "[verify] FATAL: git rev-parse HEAD returned nothing — cannot certify commit identity" >&2
-          exit 1
-        fi
-        if [ "$CI_COMMIT_SHA" != "$CHECKOUT_SHA" ]; then
-          echo "[verify] FATAL: provider commit ($CI_COMMIT_SHA) != checkout HEAD ($CHECKOUT_SHA)" >&2
-          exit 1
-        fi
-        echo "[verify] commit identity confirmed: $CHECKOUT_SHA"
-      # (b) Canonical terminal verification. Caller-provided prerequisites the
-      # runner expects (see .woodpecker/ci.yml comments): bash/rsync for the
-      # guard stages, openssl + the pinned pi binary for the test stage. git is
-      # baked into ci-base but re-asserted here so the identity check above can
-      # never silently depend on a stale baked image. DATABASE_URL is
-      # deliberately NOT set: the canonical command must hold on the PGlite
-      # path too and never sets or requires a database itself.
-      - apk add --no-cache bash rsync openssl git
-      - npm install -g @earendil-works/[email protected]
-      - pnpm verify:release
-    depends_on:
-      - install
-
   build:
     image: *node_image
-    environment:
-      # Turbo remote cache (see .woodpecker/ci.yml header comment): org-level
-      # secret, exposed only on trusted events (push/tag/cron/manual/deployment).
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build
     depends_on:
       - install
-      - verify
 
   publish-npm:
     image: *node_image
@@ -182,320 +102,6 @@ steps:
         exit 1
     depends_on:
       - build
-      - verify
-
-  publish-next-npm:
-    image: *node_image
-    # Durable @next integration-line publish. Runs only on next; never writes
-    # the latest dist-tag and never commits the computed prerelease versions.
-    when:
-      - event: [push, manual]
-        branch: next
-    environment:
-      NPM_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_PIPELINE_NUMBER: ${CI_PIPELINE_NUMBER}
-    commands:
-      - *enable_pnpm
-      - |
-        if [ "$CI_COMMIT_BRANCH" != "next" ]; then
-          echo "[publish-next] FATAL: publish-next-npm may only run on next (got '$CI_COMMIT_BRANCH')" >&2
-          exit 1
-        fi
-        if [ -z "$CI_PIPELINE_NUMBER" ]; then
-          echo "[publish-next] FATAL: CI_PIPELINE_NUMBER is required for prerelease versioning" >&2
-          exit 1
-        fi
-        echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
-        echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
-        DIST_TAGS_JSON="$(npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json)"
-        DIST_TAGS_JSON="$DIST_TAGS_JSON" node -e 'const tags = JSON.parse(process.env.DIST_TAGS_JSON || "{}"); if (!tags || typeof tags !== "object" || !Object.hasOwn(tags, "latest")) { throw new Error("Gitea npm registry did not return a usable dist-tags object"); } console.log("[publish-next] registry dist-tags OK: latest=" + tags.latest);'
-        # #1404: snapshot every publishable manifest BEFORE the transform so the
-        # workspace can be restored byte-exact after publish. The transform
-        # rewrites package.json in place (needed: pnpm publish reads the
-        # workspace manifests); without restore, later steps in this pipeline
-        # (build-gateway kaniko COPY + pnpm install --frozen-lockfile) see
-        # manifests that no longer match pnpm-lock.yaml and fail
-        # ERR_PNPM_OUTDATED_LOCKFILE. Snapshot dir is step-local tmp.
-        SNAPSHOT_DIR="$(mktemp -d /tmp/publish-next-manifests.XXXXXX)"
-        export SNAPSHOT_DIR
-        find apps packages plugins -name package.json -not -path "*/node_modules/*" -not -path "*/dist/*" | while read -r mf; do
-          mkdir -p "$SNAPSHOT_DIR/$(dirname "$mf")"
-          cp -p "$mf" "$SNAPSHOT_DIR/$mf"
-        done
-        echo "[publish-next] snapshotted $(find "$SNAPSHOT_DIR" -name package.json | wc -l) manifests to $SNAPSHOT_DIR"
-        node <<'NODE'
-        const fs = require('node:fs');
-        const path = require('node:path');
-
-        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
-        const roots = ['apps', 'packages', 'plugins'];
-        const updated = [];
-        const exactVersions = new Map(); // name -> bumped next version
-
-        function walk(dir, visit) {
-          if (!fs.existsSync(dir)) return;
-          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-              const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) {
-                const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-                if (manifest.name?.startsWith('@mosaicstack/') && !manifest.private) {
-                  visit(manifest, packagePath);
-                }
-              }
-              walk(fullPath, visit);
-            }
-          }
-        }
-
-        // #1389: two passes. Pass 1 bumps every publishable manifest to
-        // <stable+1>-next.<pipeline> exactly as before, recording name ->
-        // bumped version. Pass 2 rewrites every published manifest's
-        // @mosaicstack/* dependency entries (dependencies, devDependencies,
-        // peerDependencies, optionalDependencies) to the EXACT same-pipeline
-        // build. A caret range like ^0.0.3-next.2636 leaves the resolver free
-        // to pick any later build — and on a host with a stale cache, an
-        // installer-side scaffold pinned at stable, or a registry hiccup, that
-        // freedom is how a "next" install ends up executing stable-era code
-        // (web1 evidence: old tier validator, missing migrations). Exact pins
-        // make the defect class unrepresentable regardless of resolver path.
-        function bump(manifest, packagePath) {
-          const stableMatch = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(manifest.version);
-          if (!stableMatch) {
-            throw new Error(manifest.name + " has unsupported semver version '" + manifest.version + "'");
-          }
-          const [, major, minor, patch] = stableMatch;
-          const oldVersion = manifest.version;
-          manifest.version = major + '.' + minor + '.' + (Number(patch) + 1) + '-next.' + pipelineNumber;
-          fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
-          exactVersions.set(manifest.name, manifest.version);
-          updated.push(manifest.name + ' ' + oldVersion + ' -> ' + manifest.version);
-        }
-
-        const DEP_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
-        let pinnedEntries = 0;
-        function pin(manifest, packagePath) {
-          let changed = false;
-          for (const field of DEP_FIELDS) {
-            const deps = manifest[field];
-            if (!deps || typeof deps !== 'object') continue;
-            for (const [name, range] of Object.entries(deps)) {
-              if (!name.startsWith('@mosaicstack/')) continue;
-              const exact = exactVersions.get(name);
-              if (!exact) {
-                throw new Error(
-                  manifest.name + ' depends on ' + name +
-                  ' which has no bumped version in this publish set — cannot pin');
-              }
-              if (range === exact) continue;
-              deps[name] = exact;
-              pinnedEntries++;
-              changed = true;
-            }
-          }
-          if (changed) fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
-        }
-
-        for (const root of roots) walk(root, bump);
-        for (const root of roots) walk(root, pin);
-        if (updated.length === 0) throw new Error('No publishable @mosaicstack/* packages found');
-        console.log('[publish-next] computed prerelease versions for ' + updated.length + ' packages:');
-        for (const line of updated) console.log('[publish-next] ' + line);
-        console.log('[publish-next] pinned ' + pinnedEntries + ' @mosaicstack/* dep entries to exact same-pipeline versions across ' + updated.length + ' manifests');
-        NODE
-        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" --filter "!@mosaicstack/mosaic-as" publish --no-git-checks --access public --tag next
-        EXPECTED_VERSION="$(node -p "require('./packages/mosaic/package.json').version")"
-        RESOLVED_VERSION="$(npm view @mosaicstack/mosaic@next version --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/)"
-        if [ "$RESOLVED_VERSION" != "$EXPECTED_VERSION" ]; then
-          echo "[publish-next] FATAL: @mosaicstack/mosaic@next resolved '$RESOLVED_VERSION', expected '$EXPECTED_VERSION'" >&2
-          exit 1
-        fi
-        echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
-        # #1389 post-publish guard: every freshly published manifest must carry
-        # EXACT same-pipeline @mosaicstack/* dep pins (no ranges, no stable
-        # fallback). A leak here fails the pipeline instead of shipping.
-        node <<'GUARD'
-        const { execFileSync } = require('node:child_process');
-        const fs = require('node:fs');
-        const path = require('node:path');
-        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
-        const registry = 'https://git.mosaicstack.dev/api/packages/mosaicstack/npm/';
-        const roots = ['apps', 'packages', 'plugins'];
-        const published = [];
-        function walk(dir) {
-          if (!fs.existsSync(dir)) return;
-          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-              const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) {
-                const m = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-                if (m.name?.startsWith('@mosaicstack/') && !m.private) published.push(m.name);
-              }
-              walk(fullPath);
-            }
-          }
-        }
-        for (const root of roots) walk(root);
-        let failures = 0;
-        for (const name of published) {
-          let manifest;
-          try {
-            const out = execFileSync('npm', ['view', name + '@next', '--json', '--registry', registry],
-                                     { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-            const arr = JSON.parse(out);
-            manifest = Array.isArray(arr) ? arr[arr.length - 1] : arr;
-          } catch (e) {
-            console.error('[publish-next-guard] FAIL ' + name + ': npm view failed: ' + e.message);
-            failures++;
-            continue;
-          }
-          const fields = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
-          for (const field of fields) {
-            const deps = manifest[field];
-            if (!deps || typeof deps !== 'object') continue;
-            for (const [dep, range] of Object.entries(deps)) {
-              if (!dep.startsWith('@mosaicstack/')) continue;
-              const expected = dep === name ? manifest.version : null;
-              const isExactPin = /^\d+\.\d+\.\d+-next\./.test(range);
-              const samePipeline = range.endsWith('-next.' + pipelineNumber);
-              if (!isExactPin) {
-                console.error('[publish-next-guard] FAIL ' + name + ' -> ' + dep + ' range "' + range + '" is not an exact -next pin (stable-leak class, #1389)');
-                failures++;
-              } else if (!samePipeline) {
-                console.error('[publish-next-guard] FAIL ' + name + ' -> ' + dep + ' pinned "' + range + '" but this pipeline published -next.' + pipelineNumber + ' (cross-pipeline pin)');
-                failures++;
-              }
-            }
-          }
-        }
-        if (failures > 0) {
-          console.error('[publish-next-guard] FATAL: ' + failures + ' dep-pin violation(s) — stable-dep leak into next publish (#1389)');
-          process.exit(1);
-        }
-        console.log('[publish-next-guard] OK: all ' + published.length + ' published manifests carry exact same-pipeline @mosaicstack/* dep pins');
-        GUARD
-        # #1404 restore: put the workspace manifests back byte-exact so later
-        # steps (build-gateway frozen-lockfile install) see the committed tree.
-        RESTORE_FAIL=0
-        while read -r mf; do
-          if [ -f "$SNAPSHOT_DIR/$mf" ]; then
-            cp -p "$SNAPSHOT_DIR/$mf" "$mf"
-          else
-            echo "[publish-next] FATAL: no snapshot for $mf — cannot restore (snapshot incomplete?)" >&2
-            RESTORE_FAIL=1
-          fi
-        done < <(find apps packages plugins -name package.json -not -path "*/node_modules/*" -not -path "*/dist/*")
-        # Pristine guard (#1404 red-first control): the publish step must leave
-        # the workspace byte-identical to the checkout for every manifest.
-        # git diff is the arbiter — any residual mutation fails THIS step
-        # instead of surfacing as ERR_PNPM_OUTDATED_LOCKFILE in build-gateway.
-        if ! git diff --exit-code -- '**/package.json' >/dev/null 2>&1; then
-          echo "[publish-next] FATAL: workspace package.json files still differ from HEAD after restore (#1404 class)" >&2
-          git diff --stat -- '**/package.json' >&2 || true
-          RESTORE_FAIL=1
-        fi
-        rm -rf "$SNAPSHOT_DIR"
-        if [ "$RESTORE_FAIL" -ne 0 ]; then exit 1; fi
-        echo "[publish-next] workspace manifests restored byte-exact (git diff clean); later steps see the committed tree"
-    depends_on:
-      - build
-      - verify
-
-  # #1445 (P6): headless Playwright E2E gate on every trunk merge. Boots the
-  # real gateway on the embedded PGlite path (no DATABASE_URL, no services)
-  # serving the built SPA bundle via WEB_DIST_DIR — the exact serving path the
-  # gateway image ships (docker/gateway.Dockerfile sets WEB_DIST_DIR to the
-  # baked bundle), which keeps #1407's parity guarantee: the image build steps
-  # below depend on this gate, so a bundle that fails E2E never publishes.
-  #
-  # Image pinned to the @playwright/test version in pnpm-lock.yaml so the
-  # image's bundled browsers match the workspace driver exactly (bump the two
-  # together). The step installs no workspace packages (corepack does fetch
-  # the pinned pnpm itself): it reuses the workspace node_modules
-  # from `install` and the dist outputs from `build` — the gateway's runtime
-  # dependency path is pure JS/WASM (PGlite is WASM, postgres-js is pure JS),
-  # so the alpine-installed modules run unchanged under this glibc image.
-  # depends_on publish-next-npm per the #1411 serialization invariant: this
-  # step reads the workspace and must never run inside the manifest-transform
-  # window.
-  e2e:
-    image: mcr.microsoft.com/playwright:v1.58.2-noble
-    environment:
-      GATEWAY_PORT: '14242'
-      PLAYWRIGHT_BASE_URL: http://localhost:14242
-      # The database is seeded by Playwright's globalSetup in this step, so
-      # login failures are real failures: without this flag the suite's
-      # skip-when-login-fails guards (a live-environment affordance) could
-      # skip every authenticated spec and go green while proving nothing.
-      E2E_REQUIRE_SEEDED_AUTH: '1'
-    commands:
-      - corepack enable
-      - |
-        # Throwaway signing secret for this step's ephemeral embedded database
-        # (the gateway refuses to boot without one). Generated per run so no
-        # usable literal lives in the tree.
-        export BETTER_AUTH_SECRET="$(head -c 32 /dev/urandom | base64)"
-        export WEB_DIST_DIR="$(pwd)/apps/web/dist"
-        if [ ! -f "$WEB_DIST_DIR/index.html" ]; then
-          echo "[e2e] FATAL: $WEB_DIST_DIR/index.html missing — did the build step run?" >&2
-          exit 1
-        fi
-        # Boot the gateway from the built dist, cwd- AND HOME-isolated: the
-        # local-tier PGlite database lives under $HOME/.config/mosaic/gateway/
-        # (database.module.ts), not under cwd, so HOME must point at the
-        # throwaway dir too or the run would share a database with anything
-        # else in the container's home.
-        GATEWAY_RUN_DIR="$(mktemp -d /tmp/e2e-gateway.XXXXXX)"
-        (cd "$GATEWAY_RUN_DIR" && export HOME="$GATEWAY_RUN_DIR" && exec node "$OLDPWD/apps/gateway/dist/main.js") > /tmp/gateway.log 2>&1 &
-        GATEWAY_PID=$!
-        ready=0
-        for i in $(seq 1 90); do
-          if node -e "fetch('http://localhost:' + process.env.GATEWAY_PORT + '/health', { signal: AbortSignal.timeout(2000) }).then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"; then
-            ready=1
-            break
-          fi
-          if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then
-            echo "[e2e] FATAL: gateway process exited during startup" >&2
-            cat /tmp/gateway.log >&2
-            exit 1
-          fi
-          echo "[e2e] waiting for gateway ($i/90)..."
-          sleep 1
-        done
-        if [ "$ready" -ne 1 ]; then
-          echo "[e2e] FATAL: gateway did not become ready in 90s" >&2
-          cat /tmp/gateway.log >&2
-          exit 1
-        fi
-        echo "[e2e] gateway ready; running Playwright suite"
-        set +e
-        pnpm --filter @mosaicstack/web exec playwright test
-        E2E_EXIT=$?
-        set -e
-        kill "$GATEWAY_PID" 2>/dev/null || true
-        if [ "$E2E_EXIT" -ne 0 ]; then
-          echo "[e2e] FATAL: Playwright suite failed (exit $E2E_EXIT); gateway log follows" >&2
-          tail -100 /tmp/gateway.log >&2
-          echo "[e2e] browser-side traces/screenshots are under apps/web/test-results/ in the step workspace (not persisted past the pod)" >&2
-        fi
-        exit "$E2E_EXIT"
-    # Same filter as the image builds it gates: a merge that publishes no
-    # image (docs-only on main) pays no browser suite, and a skipped e2e does
-    # not block anything (skipped-dependency semantics, same as
-    # publish-next-npm on tag events).
-    when: *image_build_when
-    depends_on:
-      - build
-      - verify
-      # #1411: never read the workspace inside publish-next-npm's
-      # manifest-transform window.
-      - publish-next-npm
 
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
@@ -509,7 +115,6 @@ steps:
   #     - bash scripts/publish-npmjs.sh
   #   depends_on:
   #     - build
-  #     - verify
   #   when:
   #     - event: [tag]
 
@@ -518,9 +123,9 @@ steps:
     when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -529,17 +134,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next gateway publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next gateway publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: gateway image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:$CI_COMMIT_TAG"
@@ -547,26 +143,15 @@ steps:
         /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
     depends_on:
       - build
-      - verify
-      # #1411: publish-next-npm mutates workspace manifests in place during
-      # its transform window and restores them at step end. Any step that
-      # reads the pipeline workspace (kaniko COPY of manifests, later
-      # installs) must run AFTER publish-next-npm, never concurrently —
-      # pipeline 2648 raced a COPY inside the window and failed
-      # ERR_PNPM_OUTDATED_LOCKFILE despite a clean restore. This edge is the
-      # serialization invariant; add it to every new workspace consumer.
-      - publish-next-npm
-      # #1445 (P6): a bundle that fails the E2E gate never publishes an image.
-      - e2e
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
     when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: REGISTRY_USERNAME
+        from_secret: gitea_username
       REGISTRY_PASS:
-        from_secret: REGISTRY_PASSWORD
+        from_secret: gitea_password
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -575,17 +160,8 @@ steps:
       - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
       - |
         DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/appservice:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next appservice publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next appservice publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: appservice image publish may only run for main, next, or tag events" >&2
-          exit 1
         fi
         if [ -n "$CI_COMMIT_TAG" ]; then
           DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:$CI_COMMIT_TAG"
@@ -593,14 +169,29 @@ steps:
         /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
     depends_on:
       - build
-      - verify
-      # #1411: publish-next-npm mutates workspace manifests in place during
-      # its transform window and restores them at step end. Any step that
-      # reads the pipeline workspace (kaniko COPY of manifests, later
-      # installs) must run AFTER publish-next-npm, never concurrently —
-      # pipeline 2648 raced a COPY inside the window and failed
-      # ERR_PNPM_OUTDATED_LOCKFILE despite a clean restore. This edge is the
-      # serialization invariant; add it to every new workspace consumer.
-      - publish-next-npm
-      # #1445 (P6): a bundle that fails the E2E gate never publishes an image.
-      - e2e
+
+  build-web:
+    image: gcr.io/kaniko-project/executor:debug
+    when: *image_build_when
+    environment:
+      REGISTRY_USER:
+        from_secret: gitea_username
+      REGISTRY_PASS:
+        from_secret: gitea_password
+      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
+      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
+      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
+    commands:
+      - mkdir -p /kaniko/.docker
+      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
+      - |
+        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/web:sha-${CI_COMMIT_SHA:0:7}"
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:latest"
+        fi
+        if [ -n "$CI_COMMIT_TAG" ]; then
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:$CI_COMMIT_TAG"
+        fi
+        /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
+    depends_on:
+      - build

AGENTS.md

@@ -11,154 +11,48 @@
 
 ## Project Context
 
-Mosaic Stack is a self-hosted, multi-user AI agent platform. It is a TypeScript monorepo with a NestJS gateway, Next.js dashboard, Pi SDK agent runtime, and Discord/Telegram plugin architecture.
+Mosaic Stack is a self-hosted, multi-user AI agent platform. TypeScript monorepo with NestJS gateway, Next.js web dashboard, Pi SDK agent runtime, and plugin architecture for Discord/Telegram.
 
-### Stack
+## Package Map
 
-- **API:** NestJS with Fastify (`apps/gateway`)
-- **Web:** Next.js 16 with React 19 (`apps/web`)
-- **ORM and database:** Drizzle ORM, PostgreSQL 17, and pgvector (`packages/db`)
-- **Authentication:** BetterAuth (`packages/auth`)
-- **Agent runtime:** Pi SDK (`apps/gateway`, `packages/mosaic`)
-- **Queue:** Valkey 8 (`packages/queue`)
-- **Build:** pnpm workspaces and Turborepo
-- **CI:** Woodpecker CI
-- **Observability:** OpenTelemetry and Jaeger
+| Package            | Purpose                         | Key Dependencies                 |
+| ------------------ | ------------------------------- | -------------------------------- |
+| `apps/gateway`     | NestJS API + WebSocket hub      | Fastify, Socket.IO, Pi SDK, OTEL |
+| `apps/web`         | Next.js dashboard               | React 19, Tailwind               |
+| `packages/types`   | Shared TypeScript contracts     | class-validator                  |
+| `packages/db`      | Drizzle ORM schema + migrations | drizzle-orm, postgres            |
+| `packages/auth`    | BetterAuth configuration        | better-auth, @mosaicstack/db     |
+| `packages/brain`   | Data layer (PG-backed)          | @mosaicstack/db                  |
+| `packages/queue`   | Valkey task queue + MCP         | ioredis                          |
+| `packages/coord`   | Mission coordination            | @mosaicstack/queue               |
+| `packages/mosaic`  | Unified `mosaic` CLI + TUI      | Ink, Pi SDK, commander           |
+| `plugins/discord`  | Discord channel plugin          | discord.js                       |
+| `plugins/telegram` | Telegram channel plugin         | Telegraf                         |
 
-### Package Map
+## Architecture Rules
 
-| Package            | Purpose                       | Key Dependencies                 |
-| ------------------ | ----------------------------- | -------------------------------- |
-| `apps/gateway`     | NestJS API + WebSocket hub    | Fastify, Socket.IO, Pi SDK, OTEL |
-| `apps/web`         | Next.js dashboard             | React 19, Tailwind               |
-| `packages/types`   | Shared TypeScript contracts   | class-validator                  |
-| `packages/db`      | Drizzle schema and migrations | drizzle-orm, postgres            |
-| `packages/auth`    | BetterAuth configuration      | better-auth, @mosaicstack/db     |
-| `packages/brain`   | Structured data layer         | @mosaicstack/db                  |
-| `packages/queue`   | Valkey task queue and MCP     | ioredis                          |
-| `packages/coord`   | Mission coordination          | @mosaicstack/queue               |
-| `packages/mosaic`  | Unified `mosaic` CLI and TUI  | Ink, Pi SDK, commander           |
-| `plugins/discord`  | Discord channel plugin        | discord.js                       |
-| `plugins/telegram` | Telegram channel plugin       | Telegraf                         |
-
-## Architecture and Code Conventions
-
-1. Gateway is the single API surface; all clients connect through it.
-2. Pi SDK is ESM-only; gateway and CLI code must remain ESM.
-3. Use `"type": "module"`, NodeNext module resolution, and `.js` extensions in imports.
-4. Keep typed Socket.IO events in `@mosaicstack/types` to enforce client/server contracts.
-5. Import OTEL tracing before NestJS bootstrap (`import './tracing.js'`).
-6. Use explicit `@Inject()` decorators in NestJS because tsx/esbuild does not emit decorator metadata.
-7. Keep DTOs in `*.dto.ts` files at module boundaries.
-8. BetterAuth owns authentication tables; their schema is defined in `@mosaicstack/db`.
-9. Create a task-specific scratchpad for non-trivial work.
+1. Gateway is the single API surface — all clients connect through it
+2. Pi SDK is ESM-only — gateway and CLI must use ESM
+3. Socket.IO typed events defined in `@mosaicstack/types` enforce compile-time contracts
+4. OTEL auto-instrumentation loads before NestJS bootstrap
+5. BetterAuth manages auth tables; schema defined in `@mosaicstack/db`
+6. Docker Compose provides PG (5433), Valkey (6380), OTEL Collector (4317/4318), Jaeger (16686)
+7. Explicit `@Inject()` decorators required in NestJS (tsx/esbuild doesn't emit decorator metadata)
 
 ## Development Workflow
 
-Requirements: Node.js 20+, pnpm 10.6.2, and Docker Compose when optional local services are needed.
-
 ```bash
-pnpm install --frozen-lockfile
-pnpm preflight
-
-# Optional local queue service only; do not start the full Compose stack.
-docker compose up -d valkey
+docker compose up -d          # Infrastructure
+pnpm install                  # Dependencies
+pnpm typecheck && pnpm lint && pnpm format:check  # Quality gates
 ```
 
-The pre-push hook requires:
+## Repo-Specific Notes
 
-```bash
-pnpm preflight && pnpm typecheck && pnpm lint && pnpm format:check
-```
-
-Software delivery also requires the applicable tests. Common repository commands are:
-
-```bash
-pnpm typecheck     # TypeScript checks across the workspace
-pnpm lint          # ESLint across the workspace
-pnpm test          # Checkout tests and package Vitest suites
-pnpm format:check  # Prettier check
-pnpm build         # Build all packages and applications
-```
-
-## Branch Model and Merge Process — `main` and `next` (CANONICAL)
-
-**Every contribution targets `next` first. No exceptions.** Features, fixes, tests,
-docs, and policy changes all take the same route; urgency changes queue priority,
-never the route. Agents never commit to or merge into `main`.
-
-| Branch | Role                                                             | Who merges into it                                                          |
-| ------ | ---------------------------------------------------------------- | --------------------------------------------------------------------------- |
-| `next` | Integration trunk — the only PR target for contributions         | The designated merge-gate agent, after all gates pass. Never the PR author. |
-| `main` | Stable/release line — receives promotion merges from `next` only | Jason only (or an agent he explicitly delegates for a named promotion).     |
-
-### Contribution sequencing (in order, no skipping)
-
-1. **Issue first.** Work is tracked in a Gitea issue before a branch exists. The
-   issue number appears in the branch name and the PR body.
-2. **Branch from the current `origin/next` head.** Name it
-   `feat/…`, `fix/…`, `docs/…`, or `test/…` with the issue number
-   (e.g. `docs/1214-branch-process`). Record the base SHA in the PR body.
-3. **Develop with evidence.** Applicable tests accompany the change. Hooks are
-   never bypassed (`--no-verify` is prohibited). Stage explicit paths — never
-   `git add -A`.
-4. **Open the PR against `next`.** The body states: scope, base SHA,
-   verification commands with results, and any known pre-existing failures on
-   the base — documented, not retried to green and not absorbed silently.
-5. **CI must be terminal-green on the exact head.** All bounded Woodpecker
-   steps succeed (`verify-terminal-green` contract). Pipelines for fork PRs
-   start `blocked`; a maintainer approves the run — approving CI is not
-   approving the PR.
-6. **Independent review. Self-merge is prohibited** — for every agent, on every
-   PR, including trivial ones. Where the change touches protected or
-   contract-bearing content, the reviewer verifies the exact head
-   (exact-byte/exact-blob comparison), not a description of it. An `AMEND`
-   verdict returns the PR to its author; the reviewer's gate stays held until
-   a fresh exact head passes.
-7. **Merge into `next`** happens only after CI green + review pass, pinned to
-   the reviewed head SHA (a post-review push voids the review).
-8. **Promotion `next` → `main`** is a deliberate, Jason-owned reconciliation
-   merge — not part of any contribution's lifecycle. Contributors are done at
-   step 7.
-
-### Responsibilities
-
-- **Contributor** — base pinning, green CI, evidence in the PR body,
-  responding to AMEND verdicts, never merging own work.
-- **Reviewer / merge gate** — independent verification on the exact head;
-  holds and lifts gates; executes the merge into `next`.
-- **Orchestrator / adjudicator** — cross-PR sequencing, disposition when PRs
-  collide, conflict adjudication.
-- **Jason** — `next` → `main` promotions, merge-authority grants, collaborator
-  and token provisioning. Agents cannot grant themselves or each other any of
-  these.
-
-### Hotfixes and divergence
-
-- A hotfix follows the same path: branch from `next`, PR to `next`, gates,
-  merge, then an expedited Jason-owned promotion if `main` needs it urgently.
-  Committing the fix to `main` directly is prohibited even under pressure.
-- **Never land work on `main` that is not on `next`.** This has happened
-  (issue #1152's goal controller reached `main` without reaching `next`) and
-  every later PR paid for it. If it happens anyway: transplant the work onto
-  a `next`-based branch with provenance-preserving commits
-  (`git cherry-pick -x` or explicit SHA references in the messages), PR it
-  through the normal gates, and let promotion re-align `main`. Do not
-  hand-patch `main` to compensate.
-- Force-pushing a branch you do not own is prohibited; rebasing your own PR
-  branch is fine before review, and voids any review already given.
-
-## Database and Local Runtime Safety
-
-- Current local data-layer work uses in-process PGlite; leave `DATABASE_URL` unset.
-- PostgreSQL execution is held until KBN-101-00, KBN-101-03, and KBN-101-05 land.
-- Do not invoke a migration runner, initialization SQL, or the Compose PostgreSQL service from this checkout.
-- Do not start Gateway/Web or run root `pnpm dev` as a local PGlite route. The current dotenv loader can inherit a daemon PostgreSQL DSN; KBN-101-02 must make that path fail closed first.
-- Migration artifact generation is offline and does not authorize PostgreSQL access:
-
-```bash
-pnpm --filter @mosaicstack/db db:generate
-```
+- DTOs in `*.dto.ts` files at module boundaries
+- ESM everywhere (`"type": "module"`, `.js` extensions in imports)
+- NodeNext module resolution in all tsconfigs
+- Scratchpads are mandatory for non-trivial tasks
 
 ## docs/TASKS.md — Schema (CANONICAL)
 

CLAUDE.md

@@ -1,5 +1,45 @@
-# Claude Compatibility Pointer
+# CLAUDE.md — Mosaic Stack
 
-@AGENTS.md
+## Project
 
-Do not add project guidance here. Keep `AGENTS.md` authoritative so every agent runtime receives the same instructions.
+Self-hosted, multi-user AI agent platform. TypeScript monorepo.
+
+## Stack
+
+- **API**: NestJS + Fastify adapter (`apps/gateway`)
+- **Web**: Next.js 16 + React 19 (`apps/web`)
+- **ORM**: Drizzle ORM + PostgreSQL 17 + pgvector (`packages/db`)
+- **Auth**: BetterAuth (`packages/auth`)
+- **Agent**: Pi SDK (`packages/agent`, `packages/mosaic`)
+- **Queue**: Valkey 8 (`packages/queue`)
+- **Build**: pnpm workspaces + Turborepo
+- **CI**: Woodpecker CI
+- **Observability**: OpenTelemetry → Jaeger
+
+## Commands
+
+```bash
+pnpm typecheck        # TypeScript check (all packages)
+pnpm lint             # ESLint (all packages)
+pnpm format:check     # Prettier check
+pnpm test             # Vitest (all packages)
+pnpm build            # Build all packages
+
+# Database
+pnpm --filter @mosaicstack/db db:push      # Push schema to PG (dev)
+pnpm --filter @mosaicstack/db db:generate  # Generate migrations
+pnpm --filter @mosaicstack/db db:migrate   # Run migrations
+
+# Dev
+docker compose up -d                  # Start PG, Valkey, OTEL, Jaeger
+pnpm --filter @mosaicstack/gateway exec tsx src/main.ts  # Start gateway
+```
+
+## Conventions
+
+- ESM everywhere (`"type": "module"`, `.js` extensions in imports)
+- NodeNext module resolution
+- Explicit `@Inject()` decorators in NestJS (tsx/esbuild doesn't support emitDecoratorMetadata)
+- DTOs in `*.dto.ts` files at module boundaries
+- OTEL tracing imported before NestJS bootstrap (`import './tracing.js'`)
+- All three gates must pass before push: typecheck, lint, format:check

Dockerfile.ci

@@ -22,13 +22,10 @@
 FROM node:24-alpine
 
 # Native toolchain required to compile node-gyp deps on musl, plus the
-# postgresql-client used by the test step's pg_isready readiness probe. `bash`,
-# `git`, and `jq` are baked here too — framework shell tests and the shipped
-# Codex review wrappers require them without per-run installation in ci.yml.
-# `openssl` (#912) is the non-circular HMAC signer for the wake trust layer:
-# the digest H1/H2, beacon B12, and install I8 legs hard-require it in CI so the
-# §4 G6 evidence comes from an actually-run HMAC leg, not a skipped one.
-RUN apk add --no-cache python3 make g++ postgresql-client bash git jq openssl
+# postgresql-client used by the test step's pg_isready readiness probe. `bash`
+# is baked here too — the sanitization step in ci.yml otherwise does a per-run
+# `apk add bash`.
+RUN apk add --no-cache python3 make g++ postgresql-client bash
 
 # Pin pnpm to the repo's packageManager version via corepack.
 RUN corepack enable && corepack prepare [email protected] --activate

README.md

@@ -30,16 +30,6 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |
 
-### Install lanes
-
-| Lane                     | Command                               | Use when                                              | Source                                                                  |
-| ------------------------ | ------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main` |
-| Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Build-from-source at `next`                                             |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                  |
-
-`--next` is shorthand for the prerelease integration lane: it enables source-build mode and uses `next` unless an explicit `--ref` or `MOSAIC_REF` is provided.
-
 After install, the wizard runs automatically or you can invoke it manually:
 
 ```bash
@@ -48,13 +38,9 @@ mosaic wizard        # Full guided setup (gateway install → verify)
 
 ### Requirements
 
-- Node.js ≥ 22
+- Node.js ≥ 20
 - npm (for global @mosaicstack/mosaic install)
-- One or more runtimes:
-  - [Claude Code](https://docs.anthropic.com/en/docs/claude-code)
-  - [Codex](https://github.com/openai/codex)
-  - [OpenCode](https://opencode.ai)
-  - [Pi](https://pi.dev)
+- One or more runtimes: [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai), or [Pi](https://github.com/mariozechner/pi-coding-agent)
 
 ## Usage
 
@@ -74,14 +60,6 @@ The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md
 
 Pi launches default to a token-lean skill posture: `mosaic pi` passes `--no-skills` so Pi does not preload every global skill description into the system prompt. Use `MOSAIC_PI_SKILL_MODE=all mosaic pi` for the legacy all-skills catalog, or `MOSAIC_PI_SKILL_MODE=discover mosaic pi` to let Pi use its native settings/project skill discovery.
 
-Mosaic also loads its Pi extensions from `~/.config/mosaic/runtime/pi/`. Inside Pi,
-`/goal set <statement>` starts a bounded persistent loop that checks every turn and successful
-compaction, requires two evidence-bearing completion reports, and can be inspected or stopped with
-`/goal status`, `/goal pause`, `/goal resume`, and `/goal cancel`. Controller-owned goal-state
-entries redact common credential shapes, but Pi's model/tool-call history is separate, so goals and
-evidence must never contain secrets or raw sensitive output. Mosaic does not install this extension
-into `~/.pi/agent/extensions/`.
-
 ### TUI & Gateway
 
 ```bash
@@ -119,10 +97,7 @@ mosaic config path           # Print config file path
 ```bash
 mosaic doctor                # Health audit — detect drift and missing files
 mosaic sync                  # Sync skills from canonical source
-mosaic skill list            # Audit Claude skill registrations and conflicts
-mosaic skill register <name> # Register one canonical skill with Claude Code
-mosaic skill unregister <name> # Remove one Mosaic-owned Claude link
-mosaic update                # Update CLI/framework and auto-register canonical skills
+mosaic update                # Check for and install CLI updates
 mosaic wizard                # Full guided setup wizard
 mosaic bootstrap <path>      # Bootstrap a repo with Mosaic standards
 mosaic coord init            # Initialize a new orchestration mission
@@ -146,9 +121,9 @@ mosaic brain tasks
 mosaic brain conversations
 
 # Agent forge pipeline
-mosaic forge run [--simulate]        # fails closed (FORGE_NO_EXECUTOR) with no executor wired; --simulate for typed simulated runs
+mosaic forge run
 mosaic forge status
-mosaic forge resume [--simulate]     # same fail-closed rule as forge run
+mosaic forge resume
 mosaic forge personas
 
 # Structured logging
@@ -182,12 +157,7 @@ mosaic storage status
 mosaic storage tier
 mosaic storage export
 mosaic storage import
-# Schema migration is unavailable in this release. The current storage wrapper shells
-# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
-# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
-# --run → runner --verify → readiness. Tier copy uses only the separately held secure
-# migrate-tier route.
+mosaic storage migrate
 ```
 
 ### Telemetry
@@ -208,56 +178,11 @@ mosaic telemetry upload        # Dry-run unless opted in
 
 Consent state is persisted in config. Remote upload is a no-op until you run `mosaic telemetry opt-in`.
 
-## Standalone container deployment
-
-The `stack` profile runs PostgreSQL, Valkey, the gateway, and the bundled webUI. Copy
-`.env.example` to `.env`, generate `BETTER_AUTH_SECRET`, then start the profile:
-
-```bash
-cp .env.example .env
-printf 'BETTER_AUTH_SECRET=%s\n' "$(openssl rand -hex 32)" >> .env
-docker compose --profile stack up -d
-```
-
-The optional dogfood overlay gives one dedicated in-stack agent a writable stack
-worktree and its own read-only credential slot. It does not mount the fleet brain or
-any other seat. Prepare a `next`-based worktree and an unprivileged
-`code-dogfood-01` functional seat outside the container, then set these paths in
-`.env`:
-
-```dotenv
-MOSAIC_DOGFOOD_WORKTREE=/path/to/mosaic-stack-worktrees/dogfood-1487
-MOSAIC_DOGFOOD_COMMON_GIT_DIR=/path/to/mosaic-stack/.git
-MOSAIC_DOGFOOD_SEAT_HOME=/path/to/.mosaic/fleet/agents/code-dogfood-01
-```
-
-The common Git directory must match the worktree's `.git` pointer. The seat home
-must contain only that seat's credential at
-`secrets/gitea-mosaicstack-code-dogfood-01.token`. Never place the token value in
-`.env`. Start the overlay with:
-
-```bash
-docker compose \
-  -f docker-compose.yml \
-  -f docker-compose.dogfood.yml \
-  --profile stack up -d
-```
-
-The overlay removes the general shell tool for every session, including admins.
-File tools stay inside the mounted checkout. Two dedicated delivery tools stage
-explicit paths, run the CI queue guard, push through `git-credential-mosaic`, and
-open PRs through `pr-create.sh`. They resolve only the `code-dogfood-01` slot and fail
-if it is absent. The overlay enables Docker's init process so the R4 helper can
-establish the gateway's seat lineage below PID 1.
-
-This deployment route is separate from the local source-development restrictions
-below.
-
 ## Development
 
 ### Prerequisites
 
-- Node.js ≥ 22
+- Node.js ≥ 20
 - pnpm 10.6+
 - Docker & Docker Compose
 
@@ -267,50 +192,33 @@ below.
 git clone [email protected]:mosaicstack/stack.git
 cd stack
 
-# Install dependencies. The local tier uses in-process PGlite; leave DATABASE_URL unset.
-# The pnpm store defaults to $HOME/.local/share/pnpm/store. Override it without
-# editing the checkout with NPM_CONFIG_STORE_DIR=$HOME/another-store if needed.
+# Start infrastructure (Postgres, Valkey, Jaeger)
+docker compose up -d
+
+# Install dependencies
 pnpm install
 
-# Verify dependencies and generated state before running source-quality gates.
-# Missing dependencies exit 42; stale/foreign apps/web/.next state exits 43.
-# The web build certifies its exact standalone symlink manifest; added, removed,
-# retargeted, or manifest-only-tampered generated links also exit 43. This detects
-# accidental, independent, stale, and foreign-residue mutation—the class exposed by
-# a five-month-stale .next that produced 19 phantom TS2307 errors.
-# It does NOT defend against a same-UID actor that can rewrite both manifest and
-# marker consistently (CWE-345). RM-59 tracks the required executor/spine-side
-# trust anchor outside worktree authority.
-pnpm preflight
+# Run migrations
+pnpm --filter @mosaicstack/db run db:migrate
 
-# Optional local queue service only. This does not start PostgreSQL.
-docker compose up -d valkey
-
-# The current Gateway/Web local process is held; see docs/guides/dev-guide.md.
-# Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
+# Start all services in dev mode
+pnpm dev
 ```
 
-### Held future procedure
+### Infrastructure
 
-The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
-current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
-invoke initialization SQL, or treat the planned migrator as currently executable.
+Docker Compose provides:
 
-**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
-land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
-`mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
-this README—will provide the reviewed commands and secret-consumer interface.
-
-For local data-layer work, PGlite needs no PostgreSQL service. The optional Compose command above
-starts only Valkey; OTEL Collector and Jaeger may likewise be started individually if needed,
-without starting PostgreSQL. A Gateway/Web local process is not currently a safe PGlite route:
-its unguarded dotenv loader may inherit a daemon PostgreSQL DSN. Do not use root `pnpm dev` or a
-Gateway start command until KBN-101-02 makes that state fail closed.
+| Service               | Port      | Purpose                |
+| --------------------- | --------- | ---------------------- |
+| PostgreSQL (pgvector) | 5433      | Primary database       |
+| Valkey                | 6380      | Task queue + caching   |
+| Jaeger                | 16686     | Distributed tracing UI |
+| OTEL Collector        | 4317/4318 | Telemetry ingestion    |
 
 ### Quality Gates
 
 ```bash
-pnpm preflight               # Checkout/dependency/generated-state validation
 pnpm typecheck               # TypeScript type checking (all packages)
 pnpm lint                    # ESLint (all packages)
 pnpm test                    # Vitest (all packages)
@@ -323,7 +231,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
+- Database migration against a fresh Postgres
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.
@@ -384,7 +292,7 @@ The framework is the bash-based standards layer installed to every developer mac
 ├── bin/mosaic             ← Unified launcher (claude, codex, opencode, pi, yolo)
 ├── guides/                ← E2E delivery, orchestrator protocol, PRD, etc.
 ├── runtime/               ← Per-runtime configs (claude/, codex/, opencode/, pi/)
-├── skills/                ← Universal skills (shipped with the framework package)
+├── skills/                ← Universal skills (synced from agent-skills repo)
 ├── tools/                 ← Tool suites (orchestrator, git, quality, prdy, etc.)
 └── memory/                ← Persistent agent memory (preserved across upgrades)
 ```
@@ -428,15 +336,11 @@ The CLI also performs a background update check on every invocation (cached for
 bash tools/install.sh --check           # Version check only
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --next            # Prerelease lane: source build from next
-bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
-bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
+bash tools/install.sh --ref v1.0        # Install from a specific git ref
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
-
 ## Contributing
 
 ```bash

REPORT-A1207.md

@@ -1,71 +0,0 @@
-# REPORT A1207
-
-Date: 2026-08-13
-Branch: `fix/869-lease-probe-timeout`
-Starting head: `2373a5ad345fb316ad2460f6390baab1f45ba08f`
-Base: `216cd72226cd9ee17eea461cfe7cd0e010a22f02`
-
-## What changed
-
-- Added Python behavior tests using isolated temporary directories and marker-writing fake `mosaic` executables. They prove that the supplied `PATH` wins over ambient `os.environ["PATH"]`, and that absent or empty supplied `PATH` values do not search ambient paths, platform defaults, or the current directory.
-- Bound Python override behavior with executable fakes: a valid `MOSAIC_LEASE_VERSION_PROBE_COMMAND` wins over supplied and ambient `PATH`; an invalid override returns `None` without PATH fallback.
-- Added a Python runner binding test that captures kwargs and requires `timeout=10.0`. Existing timeout, transport-error, and nonzero-exit checks remain fail-closed with `None`.
-- Added the optional TypeScript dependency-injection seam `CapabilityProbeExecFile`, defaulting to the existing real `execFileSync` implementation. Production callers have no behavior change.
-- Added TypeScript tests that capture child-process options and require exactly `timeout: 10_000`. Injected timeout, spawn-error, nonzero-exit, unparseable JSON, and malformed-object cases all return `null`.
-- Removed the ambient no-dependency TypeScript smoke case that could execute a built checkout's real CLI. Default resolver and supervisor behavior retain their isolated tests, while capability transport tests now use an isolated artifact or the injected transport.
-
-No Python production code changed relative to `2373a5ad`. The only production delta is the optional TypeScript child-process injection seam.
-
-## Hermeticity incident and correction
-
-An initial ambient-lookup mutation run exposed that the pre-existing Python "not resolvable" test left ambient process PATH uncontrolled. On this host, that mutation resolved and executed the host `mosaic` capability probe. A post-build intermediate TypeScript run also let the pre-existing no-dependency smoke case execute the checkout's built `dist/cli.js` capability probe. No `claude` process was run. I then isolated the Python test's ambient PATH, removed the TypeScript ambient smoke case, repeated the PATH mutation using only marker-writing temporary fakes, and repeated the final suites without either real probe path.
-
-## Mutation evidence
-
-Each mutation was applied independently, its focused suite was run, and the production source was restored before the final run.
-
-| Mutation                                                                                   | Result              | Reddened test name(s)                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `shutil.which("mosaic", path=environ.get("PATH", ""))` to ambient `shutil.which("mosaic")` | RED, three failures | `ProbeActivationCapabilityTest.test_supplied_path_wins_over_ambient_process_path`; `ProbeActivationCapabilityTest.test_absent_or_empty_supplied_path_never_falls_back_or_executes` for both absent and empty PATH subtests |
-| Python `PROBE_TIMEOUT_SECONDS: 10.0` to `2.0`                                              | RED, one failure    | `ProbeActivationCapabilityTest.test_probe_passes_ten_second_timeout_to_runner`                                                                                                                                             |
-| TypeScript `LEASE_CAPABILITY_PROBE_TIMEOUT_MS: 10_000` to `2_000`                          | RED, one failure    | `defaultCapabilityProbe > passes the exact ten-second timeout to the injected child-process transport`                                                                                                                     |
-
-## Final test run
-
-Dependencies were installed first with `pnpm install --frozen-lockfile`. Workspace dependencies were then built with `pnpm --filter '@mosaicstack/mosaic...' run build` so package type declarations were available.
-
-```text
-$ cd packages/mosaic && python3 src/mutator-gate/version_coupling_unittest.py
-...................
-----------------------------------------------------------------------
-Ran 19 tests in 0.007s
-
-OK
-
-$ pnpm exec vitest run src/commands/lease-activation-probe.spec.ts
-✓ src/commands/lease-activation-probe.spec.ts (20 tests) 80ms
-Test Files  1 passed (1)
-Tests       20 passed (20)
-```
-
-```text
-$ pnpm exec prettier --check packages/mosaic/src/commands/lease-activation-probe.ts packages/mosaic/src/commands/lease-activation-probe.spec.ts
-Checking formatting...
-All matched files use Prettier code style!
-
-$ pnpm --filter @mosaicstack/mosaic lint
-> eslint src
-
-$ pnpm --filter @mosaicstack/mosaic typecheck
-> tsc --noEmit
-
-$ python3 -m py_compile packages/mosaic/src/mutator-gate/version_coupling_unittest.py packages/mosaic/framework/tools/lease-broker/activation_version_gate.py
-
-$ git diff --check
-```
-
-All commands above exited zero.
-
-## Ambiguities skipped
-
-None.

apps/gateway/package.json

@@ -28,7 +28,6 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.80.0",
     "@fastify/helmet": "^13.0.2",
-    "@fastify/static": "^8.3.0",
     "@mariozechner/pi-ai": "^0.65.0",
     "@mariozechner/pi-coding-agent": "^0.65.0",
     "@modelcontextprotocol/sdk": "^1.27.1",

apps/gateway/src/__tests__/conversation-persistence.test.ts

@@ -417,7 +417,7 @@ describe('ConversationsController — search endpoint', () => {
       },
     ];
     brain = createMockBrain({ searchResults });
-    controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
+    controller = new ConversationsController(brain as never);
   });
 
   it('returns matching messages for a valid search query', async () => {
@@ -479,7 +479,7 @@ describe('ConversationsController — search endpoint', () => {
 describe('ConversationsController — message CRUD', () => {
   it('listMessages returns 404 when conversation is not owned by user', async () => {
     const brain = createMockBrain({ conversation: undefined });
-    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
+    const controller = new ConversationsController(brain as never);
 
     await expect(controller.listMessages(CONV_ID, { id: USER_ID })).rejects.toBeInstanceOf(
       NotFoundException,
@@ -489,7 +489,7 @@ describe('ConversationsController — message CRUD', () => {
   it('listMessages returns the messages for an owned conversation', async () => {
     const msgs = [makeMessage('user', 'Test message'), makeMessage('assistant', 'Test reply')];
     const brain = createMockBrain({ conversation: makeConversation(), messages: msgs });
-    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
+    const controller = new ConversationsController(brain as never);
 
     const result = await controller.listMessages(CONV_ID, { id: USER_ID });
 
@@ -500,7 +500,7 @@ describe('ConversationsController — message CRUD', () => {
 
   it('addMessage returns the persisted message', async () => {
     const brain = createMockBrain({ conversation: makeConversation() });
-    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
+    const controller = new ConversationsController(brain as never);
 
     const result = await controller.addMessage(
       CONV_ID,

apps/gateway/src/__tests__/cross-user-isolation.test.ts

@@ -190,13 +190,7 @@ beforeEach((ctx) => {
 });
 
 afterAll(async () => {
-  // Cleanup only when the fixture actually installed rows. `handle` is set
-  // before the first query (createDb connects lazily), so on an unreachable
-  // database `handle` is truthy while nothing was inserted — cleanup must
-  // honor `dbAvailable` or the skip path fails the file with ECONNREFUSED in
-  // afterAll (caught live by the publish pipeline's no-DATABASE_URL verify
-  // step, pipeline 2486).
-  if (!handle || !dbAvailable) return;
+  if (!handle) return;
   const db = handle.db;
 
   // Delete in dependency order (FK constraints)

apps/gateway/src/__tests__/hierarchy-route-inventory.test.ts

@@ -1,133 +0,0 @@
-import { RequestMethod, type Type } from '@nestjs/common';
-import { describe, expect, it } from 'vitest';
-import { AppModule } from '../app.module.js';
-import { HierarchyModule } from '../hierarchy/hierarchy.module.js';
-
-/**
- * Hierarchy route inventory (contract 1 §6.3).
- *
- * The hierarchy command family is a CLOSED enumeration asserted here, not a
- * prose claim: every hierarchy-flavored route the AppModule graph declares
- * must appear in HIERARCHY_COMMAND_FAMILY, and vice versa. Adding or
- * removing a hierarchy route without updating this inventory (and its
- * witnesses) fails CI first. This replaces the M4-1b-i zero-routes
- * baseline.
- */
-
-interface RouteEntry {
-  method: string;
-  path: string;
-  controller: string;
-}
-
-/** Module-metadata entry: a module class or a DynamicModule-shaped object. */
-type ModuleEntry =
-  | Type<unknown>
-  | { module: Type<unknown>; imports?: unknown[]; controllers?: Type<unknown>[] };
-
-function collectControllers(root: ModuleEntry): Type<unknown>[] {
-  const visited = new Set<unknown>();
-  const controllers: Type<unknown>[] = [];
-  const walk = (entry: ModuleEntry | undefined | null): void => {
-    if (!entry || visited.has(entry)) return;
-    visited.add(entry);
-    const moduleClass = typeof entry === 'function' ? entry : entry.module;
-    // Entries with no resolvable class (forwardRef wrappers, async dynamic
-    // modules) carry no decorator metadata to read here.
-    if (typeof moduleClass !== 'function') return;
-    if (visited.has(moduleClass) && typeof entry !== 'function') return;
-    visited.add(moduleClass);
-    // 'controllers' / 'imports' are the metadata keys the @Module decorator writes.
-    const declared = (Reflect.getMetadata('controllers', moduleClass) ?? []) as Type<unknown>[];
-    controllers.push(...declared);
-    if (typeof entry !== 'function' && entry.controllers) controllers.push(...entry.controllers);
-    const imports = [
-      ...((Reflect.getMetadata('imports', moduleClass) ?? []) as ModuleEntry[]),
-      ...(typeof entry !== 'function' ? ((entry.imports ?? []) as ModuleEntry[]) : []),
-    ];
-    for (const imported of imports) walk(imported);
-  };
-  walk(root);
-  return controllers;
-}
-
-function routesOf(controller: Type<unknown>): RouteEntry[] {
-  // 'path' on the class is the @Controller prefix; 'path'/'method' on a
-  // handler are written by the @Get/@Post/... route decorators.
-  const base = (Reflect.getMetadata('path', controller) ?? '') as string | string[];
-  const bases = Array.isArray(base) ? base : [base];
-  const routes: RouteEntry[] = [];
-  const prototype = controller.prototype as Record<string, unknown>;
-  for (const name of Object.getOwnPropertyNames(prototype)) {
-    if (name === 'constructor') continue;
-    const handler = Object.getOwnPropertyDescriptor(prototype, name)?.value;
-    if (typeof handler !== 'function') continue;
-    const method = Reflect.getMetadata('method', handler) as number | undefined;
-    if (method === undefined) continue;
-    const sub = (Reflect.getMetadata('path', handler) ?? '/') as string;
-    for (const prefix of bases) {
-      const path = `/${prefix}/${sub}`.replace(/\/+/g, '/').replace(/(.)\/$/, '$1');
-      routes.push({
-        method: RequestMethod[method] ?? String(method),
-        path,
-        controller: controller.name,
-      });
-    }
-  }
-  return routes;
-}
-
-/**
- * The closed command family (contract 1 §5, M4-1b-ii). Every entry is a
- * mutation audited via the M4-1b-i path or one of the two ratified reads
- * (granted companies, the §2.8 directory carve-out).
- */
-const HIERARCHY_COMMAND_FAMILY = [
-  'POST /api/hierarchy/companies',
-  'GET /api/hierarchy/companies',
-  'GET /api/hierarchy/companies/directory',
-  'POST /api/hierarchy/companies/:id/rename',
-  'POST /api/hierarchy/companies/:id/visibility',
-  'DELETE /api/hierarchy/companies/:id',
-  'POST /api/hierarchy/estates',
-  'POST /api/hierarchy/estates/:id/rename',
-  'POST /api/hierarchy/estates/:id/transfer',
-  'DELETE /api/hierarchy/estates/:id',
-  'POST /api/hierarchy/platform-projects',
-  'POST /api/hierarchy/platform-projects/:id/rename',
-  'POST /api/hierarchy/platform-projects/:id/transfer',
-  'DELETE /api/hierarchy/platform-projects/:id',
-  'POST /api/hierarchy/grants',
-  'POST /api/hierarchy/grants/:id/change',
-  'DELETE /api/hierarchy/grants/:id',
-] as const;
-
-describe('hierarchy route inventory (§6.3)', () => {
-  const inventory = collectControllers(AppModule).flatMap(routesOf);
-
-  it('control: the enumeration sees the known route surface', () => {
-    const paths = inventory.map((r) => `${r.method} ${r.path}`);
-    expect(paths).toContain('GET /health');
-    expect(paths).toContain('POST /api/workspaces');
-    expect(paths).toContain('GET /api/teams');
-    expect(inventory.length).toBeGreaterThan(20);
-  });
-
-  it('the hierarchy surface is exactly the declared command family', () => {
-    const hierarchyRoutes = inventory
-      .filter((r) => /hierarch|compan|estate|platform[-_]?project/i.test(r.path))
-      .map((r) => `${r.method} ${r.path}`)
-      .sort();
-    expect(hierarchyRoutes).toEqual([...HIERARCHY_COMMAND_FAMILY].sort());
-  });
-
-  it('every command-family route lives on HierarchyController inside HierarchyModule', () => {
-    const controllers = collectControllers(HierarchyModule);
-    expect(controllers.map((c) => c.name)).toEqual(['HierarchyController']);
-    const declared = controllers
-      .flatMap(routesOf)
-      .map((r) => `${r.method} ${r.path}`)
-      .sort();
-    expect(declared).toEqual([...HIERARCHY_COMMAND_FAMILY].sort());
-  });
-});

apps/gateway/src/__tests__/integration/federation-m3-list.integration.test.ts

@@ -1,519 +0,0 @@
-/**
- * Federation M3 single-gateway integration tests (FED-M3-10).
- *
- * Covers MILESTONES.md M3 acceptance:
- *  - #6: malformed certificate OIDs fail with 401; valid cert + revoked grant fails with 403.
- *  - #7: max_rows_per_query caps list results.
- *
- * Strategy:
- *  - Real PostgreSQL via @mosaicstack/db.
- *  - Mocked TLS context/Fastify request shim for FederationAuthGuard.
- *  - Direct controller calls using the real POST /api/federation/v1/list/:resource contract.
- *
- * Run:
- *   FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- \
- *     src/__tests__/integration/federation-m3-list.integration.test.ts
- */
-
-import 'reflect-metadata';
-import * as crypto from 'node:crypto';
-import type { ExecutionContext } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import {
-  and,
-  createDb,
-  eq,
-  federationGrants,
-  federationPeers,
-  inArray,
-  missionTasks,
-  missions,
-  projects,
-  tasks,
-  teamMembers,
-  teams,
-  type Db,
-  type DbHandle,
-  users,
-} from '@mosaicstack/db';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { DB } from '../../database/database.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { FederationAuthGuard } from '../../federation/server/federation-auth.guard.js';
-import { FederationScopeService } from '../../federation/server/scope.service.js';
-import { FederationListQueryService } from '../../federation/server/verbs/list-query.service.js';
-import { ListController } from '../../federation/server/verbs/list.controller.js';
-import {
-  makeMosaicIssuedCert,
-  makeSelfSignedCert,
-} from '../../federation/__tests__/helpers/test-cert.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const PG_URL = process.env['DATABASE_URL'] ?? 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const RUN_ID = `fed-m3-10-${crypto.randomUUID()}`;
-const CERT_SERIAL_HEX = crypto.randomUUID().replace(/-/g, '').toUpperCase();
-
-interface TestIds {
-  readonly subjectUserId: string;
-  readonly otherUserId: string;
-  readonly peerId: string;
-  readonly revokedPeerId: string;
-  readonly activeGrantId: string;
-  readonly revokedGrantId: string;
-  readonly subjectProjectId: string;
-  readonly subjectMissionId: string;
-  readonly otherProjectId: string;
-  readonly teamId: string;
-  readonly unauthorizedTeamId: string;
-  readonly teamProjectId: string;
-  readonly taskIds: readonly string[];
-  readonly excludedTaskIds: readonly string[];
-  readonly subjectNoteId: string;
-  readonly otherUserNoteId: string;
-}
-
-function pemToDer(pem: string): Buffer {
-  return Buffer.from(
-    pem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, ''),
-    'base64',
-  );
-}
-
-function makeFederationRequest(certPem: string): FastifyRequest {
-  return {
-    raw: {
-      socket: {
-        getPeerCertificate: () => ({
-          raw: pemToDer(certPem),
-          serialNumber: CERT_SERIAL_HEX,
-        }),
-      },
-    },
-  } as unknown as FastifyRequest;
-}
-
-function makeGuardContext(request: FastifyRequest): {
-  readonly context: ExecutionContext;
-  readonly sent: { statusCode?: number; payload?: unknown };
-} {
-  const sent: { statusCode?: number; payload?: unknown } = {};
-  const reply = {
-    status: (statusCode: number) => {
-      sent.statusCode = statusCode;
-      return {
-        header: () => ({
-          send: (payload: unknown) => {
-            sent.payload = payload;
-          },
-        }),
-      };
-    },
-  } as unknown as FastifyReply;
-
-  const context = {
-    switchToHttp: () => ({
-      getRequest: () => request,
-      getResponse: () => reply,
-    }),
-  } as unknown as ExecutionContext;
-
-  return { context, sent };
-}
-
-async function insertUser(db: Db, id: string, label: string): Promise<void> {
-  await db.insert(users).values({
-    id,
-    name: `${RUN_ID}-${label}`,
-    email: `${RUN_ID}-${label}@federation-test.invalid`,
-    emailVerified: false,
-  });
-}
-
-async function seedFixtures(db: Db): Promise<TestIds> {
-  const subjectUserId = `${RUN_ID}-subject`;
-  const otherUserId = `${RUN_ID}-other`;
-  const peerId = crypto.randomUUID();
-  const revokedPeerId = crypto.randomUUID();
-  const activeGrantId = crypto.randomUUID();
-  const revokedGrantId = crypto.randomUUID();
-  const subjectProjectId = crypto.randomUUID();
-  const subjectMissionId = crypto.randomUUID();
-  const otherProjectId = crypto.randomUUID();
-  const teamId = crypto.randomUUID();
-  const unauthorizedTeamId = crypto.randomUUID();
-  const teamProjectId = crypto.randomUUID();
-  const taskIds = [crypto.randomUUID(), crypto.randomUUID(), crypto.randomUUID()] as const;
-  const excludedTaskIds = [crypto.randomUUID(), crypto.randomUUID()] as const;
-  const subjectNoteId = crypto.randomUUID();
-  const otherUserNoteId = crypto.randomUUID();
-
-  await insertUser(db, subjectUserId, 'subject');
-  await insertUser(db, otherUserId, 'other');
-
-  await db.insert(teams).values([
-    {
-      id: teamId,
-      name: `${RUN_ID} allowed team`,
-      slug: `${RUN_ID}-allowed-team`,
-      ownerId: subjectUserId,
-      managerId: subjectUserId,
-    },
-    {
-      id: unauthorizedTeamId,
-      name: `${RUN_ID} unauthorized team`,
-      slug: `${RUN_ID}-unauthorized-team`,
-      ownerId: otherUserId,
-      managerId: otherUserId,
-    },
-  ]);
-
-  await db.insert(teamMembers).values([
-    { teamId, userId: subjectUserId, role: 'member' },
-    { teamId: unauthorizedTeamId, userId: subjectUserId, role: 'member' },
-  ]);
-
-  await db.insert(projects).values([
-    {
-      id: subjectProjectId,
-      name: `${RUN_ID} subject personal project`,
-      ownerType: 'user',
-      ownerId: subjectUserId,
-    },
-    {
-      id: otherProjectId,
-      name: `${RUN_ID} other personal project`,
-      ownerType: 'user',
-      ownerId: otherUserId,
-    },
-    {
-      id: teamProjectId,
-      name: `${RUN_ID} unauthorized team project`,
-      ownerType: 'team',
-      teamId: unauthorizedTeamId,
-    },
-  ]);
-
-  await db.insert(missions).values({
-    id: subjectMissionId,
-    name: `${RUN_ID} subject mission`,
-    projectId: subjectProjectId,
-    userId: subjectUserId,
-  });
-
-  await db.insert(tasks).values([
-    {
-      id: taskIds[0],
-      title: `${RUN_ID} visible task 1`,
-      missionId: subjectMissionId,
-      createdAt: new Date('2026-06-25T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:00:00.000Z'),
-    },
-    {
-      id: taskIds[1],
-      title: `${RUN_ID} visible task 2`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T02:00:00.000Z'),
-    },
-    {
-      id: taskIds[2],
-      title: `${RUN_ID} visible task 3`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T01:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[0],
-      title: `${RUN_ID} other user task`,
-      projectId: otherProjectId,
-      createdAt: new Date('2026-06-25T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[1],
-      title: `${RUN_ID} unauthorized team task`,
-      projectId: teamProjectId,
-      createdAt: new Date('2026-06-25T05:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T05:00:00.000Z'),
-    },
-  ]);
-
-  await db.insert(missionTasks).values([
-    {
-      id: subjectNoteId,
-      missionId: subjectMissionId,
-      userId: subjectUserId,
-      notes: `${RUN_ID} subject visible note`,
-      createdAt: new Date('2026-06-25T03:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:30:00.000Z'),
-    },
-    {
-      id: otherUserNoteId,
-      missionId: subjectMissionId,
-      userId: otherUserId,
-      notes: `${RUN_ID} other user note on subject mission`,
-      createdAt: new Date('2026-06-25T04:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:30:00.000Z'),
-    },
-  ]);
-
-  await db.insert(federationPeers).values([
-    {
-      id: peerId,
-      commonName: `${RUN_ID}-active-peer`,
-      displayName: `${RUN_ID} Active Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: CERT_SERIAL_HEX,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-    {
-      id: revokedPeerId,
-      commonName: `${RUN_ID}-revoked-peer`,
-      displayName: `${RUN_ID} Revoked Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `${CERT_SERIAL_HEX}${RUN_ID.replace(/-/g, '').slice(0, 8).toUpperCase()}`,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-  ]);
-
-  await db.insert(federationGrants).values([
-    {
-      id: activeGrantId,
-      peerId,
-      subjectUserId,
-      status: 'active',
-      scope: {
-        resources: ['tasks', 'notes'],
-        excluded_resources: [],
-        filters: {
-          tasks: { include_personal: true, include_teams: [] },
-          notes: { include_personal: true, include_teams: [] },
-        },
-        max_rows_per_query: 2,
-      },
-    },
-    {
-      id: revokedGrantId,
-      peerId,
-      subjectUserId,
-      status: 'revoked',
-      revokedAt: new Date(),
-      revokedReason: `${RUN_ID} revoked grant fixture`,
-      scope: {
-        resources: ['tasks'],
-        excluded_resources: [],
-        max_rows_per_query: 2,
-      },
-    },
-  ]);
-
-  return {
-    subjectUserId,
-    otherUserId,
-    peerId,
-    revokedPeerId,
-    activeGrantId,
-    revokedGrantId,
-    subjectProjectId,
-    subjectMissionId,
-    otherProjectId,
-    teamId,
-    unauthorizedTeamId,
-    teamProjectId,
-    taskIds,
-    excludedTaskIds,
-    subjectNoteId,
-    otherUserNoteId,
-  };
-}
-
-async function cleanupFixtures(db: Db, ids: TestIds | undefined): Promise<void> {
-  if (!ids) {
-    return;
-  }
-
-  await db
-    .delete(missionTasks)
-    .where(inArray(missionTasks.id, [ids.subjectNoteId, ids.otherUserNoteId]))
-    .catch(() => {});
-  await db
-    .delete(tasks)
-    .where(inArray(tasks.id, [...ids.taskIds, ...ids.excludedTaskIds]))
-    .catch(() => {});
-  await db
-    .delete(missions)
-    .where(eq(missions.id, ids.subjectMissionId))
-    .catch(() => {});
-  await db
-    .delete(projects)
-    .where(inArray(projects.id, [ids.subjectProjectId, ids.otherProjectId, ids.teamProjectId]))
-    .catch(() => {});
-  await db
-    .delete(teamMembers)
-    .where(
-      and(
-        eq(teamMembers.userId, ids.subjectUserId),
-        inArray(teamMembers.teamId, [ids.teamId, ids.unauthorizedTeamId]),
-      ),
-    )
-    .catch(() => {});
-  await db
-    .delete(teams)
-    .where(inArray(teams.id, [ids.teamId, ids.unauthorizedTeamId]))
-    .catch(() => {});
-  await db
-    .delete(federationGrants)
-    .where(inArray(federationGrants.id, [ids.activeGrantId, ids.revokedGrantId]))
-    .catch(() => {});
-  await db
-    .delete(federationPeers)
-    .where(inArray(federationPeers.id, [ids.peerId, ids.revokedPeerId]))
-    .catch(() => {});
-  await db
-    .delete(users)
-    .where(inArray(users.id, [ids.subjectUserId, ids.otherUserId]))
-    .catch(() => {});
-}
-
-describe.skipIf(!run)('federation M3 list verb — single-gateway integration', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let moduleRef: TestingModule;
-  let guard: FederationAuthGuard;
-  let listController: ListController;
-  let ids: TestIds | undefined;
-
-  beforeAll(async () => {
-    handle = createDb(PG_URL);
-    db = handle.db;
-    ids = await seedFixtures(db);
-
-    moduleRef = await Test.createTestingModule({
-      controllers: [ListController],
-      providers: [
-        { provide: DB, useValue: db },
-        GrantsService,
-        FederationAuthGuard,
-        FederationScopeService,
-        FederationListQueryService,
-      ],
-    }).compile();
-
-    guard = moduleRef.get(FederationAuthGuard);
-    listController = moduleRef.get(ListController);
-  }, 30_000);
-
-  afterAll(async () => {
-    await moduleRef?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await cleanupFixtures(db, ids).catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await handle?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-  });
-
-  it('#6 — rejects a client cert with malformed/missing Mosaic OIDs with 401', async () => {
-    const malformedOidCert = await makeSelfSignedCert();
-    const request = makeFederationRequest(malformedOidCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(401);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'unauthorized',
-        message: expect.stringContaining('missing required OID'),
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#6 — rejects a valid client cert when its grant is revoked with 403', async () => {
-    expect(ids).toBeDefined();
-    const revokedCert = await makeMosaicIssuedCert({
-      grantId: ids!.revokedGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(revokedCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(403);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'forbidden',
-        message: 'Federation access denied',
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#7 — enforces max_rows_per_query on POST /api/federation/v1/list/:resource', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('tasks', request, { limit: 100 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(response.items).toHaveLength(2);
-    expect(response._truncated).toBe(true);
-    expect(response.nextCursor).toEqual(expect.any(String));
-    expect(returnedIds).toEqual([ids!.taskIds[0], ids!.taskIds[1]]);
-    expect(returnedIds).not.toContain(ids!.taskIds[2]);
-    for (const excludedId of ids!.excludedTaskIds) {
-      expect(returnedIds).not.toContain(excludedId);
-    }
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('excludes another user mission task notes on the same authorized mission', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('notes', request, { limit: 10 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(returnedIds).toEqual([ids!.subjectNoteId]);
-    expect(returnedIds).not.toContain(ids!.otherUserNoteId);
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('fails closed for unsupported list resources', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    await expect(listController.list('widgets', request, {})).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is not supported',
-        },
-      },
-      status: 403,
-    });
-  });
-});

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -35,25 +35,6 @@ function payload(content: string, messageId: string, correlationId: string): Dis
   };
 }
 
-/**
- * The chat runtime router must never be exercised on the Discord approval/stop control paths —
- * those paths run entirely through the command-authorization, runtime-provider and durable-session
- * dependencies. Placed in the gateway's chat-runtime-router slot (the former direct `AgentService`
- * slot) so any accidental chat-runtime dispatch throws loudly instead of silently passing. Because
- * approval/stop never resolve a chat runtime, this fixture is never triggered and the integration
- * stays a GREEN cross-surface control.
- */
-function failIfUsedChatRuntimeRouter() {
-  return {
-    onModuleInit: () => {
-      throw new Error('chat runtime router must not initialise on the Discord control path');
-    },
-    get active(): never {
-      throw new Error('chat runtime must not be resolved on the Discord approval/stop path');
-    },
-  };
-}
-
 function authorization(): CommandAuthorizationService {
   const entries = new Map<string, string>();
   return new CommandAuthorizationService(
@@ -132,7 +113,7 @@ describe('interaction Discord/CLI durable-session integration', () => {
       },
     );
     const gateway = new ChatGateway(
-      failIfUsedChatRuntimeRouter() as never,
+      {} as never,
       {} as never,
       {} as never,
       {} as never,

apps/gateway/src/__tests__/required-security-wiring.test.ts

@@ -1,332 +0,0 @@
-import { type Type } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { describe, expect, it, vi } from 'vitest';
-import { AgentService, type AgentSession } from '../agent/agent.service.js';
-import { ProviderService } from '../agent/provider.service.js';
-import { AppModule } from '../app.module.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
-import { CommandExecutorService } from '../commands/command-executor.service.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
-import { PreferencesModule } from '../preferences/preferences.module.js';
-import { SystemOverrideService } from '../preferences/system-override.service.js';
-
-const fakeDb = {
-  $client: { exec: async (): Promise<void> => {} },
-  execute: async (): Promise<{ rows: unknown[] }> => ({ rows: [] }),
-  select: () => ({
-    from: () => ({
-      where: async (): Promise<Array<{ count: number }>> => [{ count: 1 }],
-    }),
-  }),
-  insert: () => ({ values: async (): Promise<void> => {} }),
-};
-
-const fakeProviderService = {
-  onModuleInit: async (): Promise<void> => {},
-  onModuleDestroy: (): void => {},
-  getRegistry: () => ({ getAvailable: () => [], getAll: () => [], find: () => undefined }),
-  getDefaultModel: () => undefined,
-  listAvailableModels: () => [],
-  listProviders: () => [],
-  getAdapter: () => undefined,
-  getProvidersHealth: () => [],
-};
-
-function compileRealAppGraph(): Promise<TestingModule> {
-  return Test.createTestingModule({ imports: [AppModule] })
-    .overrideProvider('DB_HANDLE')
-    .useValue({ db: fakeDb, close: async (): Promise<void> => {} })
-    .overrideProvider('DB')
-    .useValue(fakeDb)
-    .overrideProvider('STORAGE_ADAPTER')
-    .useValue({
-      name: 'required-security-wiring-test',
-      migrate: async (): Promise<void> => {},
-      close: async (): Promise<void> => {},
-    })
-    .overrideProvider('AUTH')
-    .useValue({})
-    .overrideProvider('BRAIN')
-    .useValue({ conversations: {}, agents: {} })
-    .overrideProvider('LOG_SERVICE')
-    .useValue({})
-    .overrideProvider('MEMORY')
-    .useValue({})
-    .overrideProvider('MEMORY_ADAPTER')
-    .useValue({})
-    .overrideProvider(ProviderService)
-    .useValue(fakeProviderService)
-    .compile();
-}
-
-function providerToken(provider: unknown): unknown {
-  return typeof provider === 'function' ? provider : (provider as { provide?: unknown })?.provide;
-}
-
-interface MaskingConsumer {
-  moduleType: Type<unknown>;
-  token: Type<unknown>;
-  useValue: object;
-}
-
-async function compileWithoutProvider(
-  moduleType: Type<unknown>,
-  missingToken: Type<unknown>,
-  maskingConsumer: MaskingConsumer,
-): Promise<{ error: unknown; moduleRef: TestingModule | undefined }> {
-  const touchedModules = new Set([moduleType, maskingConsumer.moduleType]);
-  const originals = Array.from(touchedModules, (touchedModule: Type<unknown>) => ({
-    moduleType: touchedModule,
-    providers: (Reflect.getMetadata('providers', touchedModule) ?? []) as unknown[],
-    exports: (Reflect.getMetadata('exports', touchedModule) ?? []) as unknown[],
-  }));
-
-  for (const original of originals) {
-    const providers = original.providers.flatMap((provider: unknown): unknown[] => {
-      const token = providerToken(provider);
-      if (original.moduleType === moduleType && token === missingToken) return [];
-      if (original.moduleType === maskingConsumer.moduleType && token === maskingConsumer.token) {
-        return [{ provide: maskingConsumer.token, useValue: maskingConsumer.useValue }];
-      }
-      return [provider];
-    });
-    const exports = original.exports.filter(
-      (exported: unknown): boolean =>
-        original.moduleType !== moduleType || providerToken(exported) !== missingToken,
-    );
-    Reflect.defineMetadata('providers', providers, original.moduleType);
-    Reflect.defineMetadata('exports', exports, original.moduleType);
-  }
-
-  let moduleRef: TestingModule | undefined;
-  let error: unknown;
-  try {
-    moduleRef = await compileRealAppGraph();
-  } catch (caught: unknown) {
-    error = caught;
-  } finally {
-    for (const original of originals) {
-      Reflect.defineMetadata('providers', original.providers, original.moduleType);
-      Reflect.defineMetadata('exports', original.exports, original.moduleType);
-    }
-  }
-  return { error, moduleRef };
-}
-
-async function closeIfCompiled(moduleRef: TestingModule | undefined): Promise<void> {
-  if (moduleRef) await moduleRef.close();
-}
-
-describe('required security wiring — real AppModule startup refusal', () => {
-  it('FL-01 positive control: the real graph compiles when CommandAuthorizationService is bound', async () => {
-    const moduleRef = await compileRealAppGraph();
-    try {
-      expect(moduleRef.get(CommandAuthorizationService, { strict: false })).toBeInstanceOf(
-        CommandAuthorizationService,
-      );
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  it('FL-01 negative control: absence read as permission is refused at module compilation', async () => {
-    const { error, moduleRef } = await compileWithoutProvider(
-      CommandsModule,
-      CommandAuthorizationService,
-      {
-        moduleType: CommandsModule,
-        token: CommandRuntimeApprovalVerifier,
-        useValue: {},
-      },
-    );
-    await closeIfCompiled(moduleRef);
-
-    expect(
-      error,
-      'absence read as permission: AppModule compilation accepted a missing CommandAuthorizationService binding',
-    ).toBeInstanceOf(Error);
-    if (!(error instanceof Error)) return;
-    expect(error.message).toContain('CommandExecutorService');
-    expect(error.message).toContain('CommandAuthorizationService');
-  });
-
-  it('FL-11 positive control: the real graph compiles when SystemOverrideService is bound', async () => {
-    const moduleRef = await compileRealAppGraph();
-    try {
-      expect(moduleRef.get(SystemOverrideService, { strict: false })).toBeInstanceOf(
-        SystemOverrideService,
-      );
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  it('FL-11 negative control: absence read as permission is refused at module compilation', async () => {
-    const { error, moduleRef } = await compileWithoutProvider(
-      PreferencesModule,
-      SystemOverrideService,
-      {
-        moduleType: CommandsModule,
-        token: CommandExecutorService,
-        useValue: {},
-      },
-    );
-    await closeIfCompiled(moduleRef);
-
-    expect(
-      error,
-      'absence read as permission: AppModule compilation accepted a missing SystemOverrideService binding',
-    ).toBeInstanceOf(Error);
-    if (!(error instanceof Error)) return;
-    expect(error.message).toContain('AgentService');
-    expect(error.message).toContain('SystemOverrideService');
-  });
-});
-
-const actorScope = { userId: 'security-user', tenantId: 'security-tenant' };
-const conversationId = 'security-conversation';
-
-function directExecutorWithoutAuthorization(systemOverrideSet: ReturnType<typeof vi.fn>) {
-  const registry = {
-    getManifest: vi.fn(() => ({
-      version: 1,
-      commands: [
-        {
-          name: 'system',
-          aliases: [],
-          description: 'Set instruction authority',
-          scope: 'agent' as const,
-          execution: 'socket' as const,
-          available: true,
-        },
-      ],
-      skills: [],
-    })),
-  };
-  return new CommandExecutorService(
-    registry as never,
-    { getSession: vi.fn() } as never,
-    { set: systemOverrideSet, clear: vi.fn() } as never,
-    { collect: vi.fn() } as never,
-    null,
-    { agents: {} } as never,
-    null,
-    null,
-    { getServerStatuses: vi.fn(() => []), getToolDefinitions: vi.fn(() => []) } as never,
-    undefined as never,
-  );
-}
-
-function directAgentWithoutSystemOverride(piPrompt: ReturnType<typeof vi.fn>): {
-  service: AgentService;
-  session: AgentSession;
-} {
-  const service = new AgentService(
-    {
-      getDefaultModel: vi.fn(() => null),
-      getRegistry: vi.fn(() => ({})),
-      findModel: vi.fn(),
-      listAvailableModels: vi.fn(() => []),
-    } as never,
-    {} as never,
-    {} as never,
-    { available: false } as never,
-    {} as never,
-    { getToolDefinitions: vi.fn(() => []) } as never,
-    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
-    undefined as never,
-    null,
-    { collect: vi.fn().mockResolvedValue(undefined) } as never,
-    null,
-  );
-  const session = {
-    id: conversationId,
-    provider: 'test-provider',
-    modelId: 'test-model',
-    piSession: { prompt: piPrompt },
-    listeners: new Set(),
-    unsubscribe: vi.fn(),
-    createdAt: Date.now(),
-    promptCount: 0,
-    channels: new Set(),
-    skillPromptAdditions: [],
-    sandboxDir: process.cwd(),
-    allowedTools: null,
-    userId: actorScope.userId,
-    tenantId: actorScope.tenantId,
-    metrics: {
-      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
-      modelSwitches: 0,
-      messageCount: 0,
-      lastActivityAt: new Date(0).toISOString(),
-    },
-  } as unknown as AgentSession;
-  const internals = service as unknown as { sessions: Map<string, AgentSession> };
-  internals.sessions.set(conversationId, session);
-  return { service, session };
-}
-
-describe('required security wiring — malformed direct absence has zero effects', () => {
-  it('FL-01 refuses command execution before any command effect when authorization is absent', async () => {
-    const systemOverrideSet = vi.fn().mockResolvedValue(undefined);
-    const executor = directExecutorWithoutAuthorization(systemOverrideSet);
-    const payload: SlashCommandPayload = {
-      command: 'system',
-      args: 'authority that must not be stored',
-      conversationId,
-    };
-    let error: unknown;
-
-    try {
-      await executor.execute(payload, actorScope);
-    } catch (caught: unknown) {
-      error = caught;
-    }
-
-    expect
-      .soft(
-        error,
-        'absence read as permission: direct executor accepted missing command authorization',
-      )
-      .toBeInstanceOf(Error);
-    expect
-      .soft(
-        systemOverrideSet,
-        'absence read as permission: command effect occurred without command authorization',
-      )
-      .not.toHaveBeenCalled();
-  });
-
-  it('FL-11 refuses prompt execution before any provider or session effect when system override authority is absent', async () => {
-    const piPrompt = vi.fn().mockResolvedValue(undefined);
-    const { service, session } = directAgentWithoutSystemOverride(piPrompt);
-    let error: unknown;
-
-    try {
-      await service.prompt(conversationId, 'must not reach provider', actorScope);
-    } catch (caught: unknown) {
-      error = caught;
-    }
-
-    expect
-      .soft(
-        error,
-        'absence read as permission: direct session accepted missing system override authority',
-      )
-      .toBeInstanceOf(Error);
-    expect
-      .soft(
-        piPrompt,
-        'absence read as permission: provider prompt occurred without system override authority',
-      )
-      .not.toHaveBeenCalled();
-    expect
-      .soft(
-        session.promptCount,
-        'absence read as permission: session state changed without system override authority',
-      )
-      .toBe(0);
-  });
-});

apps/gateway/src/__tests__/resource-ownership.test.ts

@@ -60,7 +60,7 @@ describe('Resource ownership checks', () => {
     // The repo enforces ownership via the WHERE clause; it returns undefined when the
     // conversation does not belong to the requesting user.
     brain.conversations.findById.mockResolvedValue(undefined);
-    const controller = new ConversationsController(brain as never, { runtimeMode: 'legacy' });
+    const controller = new ConversationsController(brain as never);
 
     await expect(controller.findOne('conv-1', { id: 'user-1' })).rejects.toBeInstanceOf(
       NotFoundException,

apps/gateway/src/admin/admin-health.controller.ts

@@ -1,11 +1,9 @@
-import { Controller, Get, Inject, Optional, UseGuards } from '@nestjs/common';
+import { Controller, Get, Inject, UseGuards } from '@nestjs/common';
 import { sql, type Db } from '@mosaicstack/db';
 import { createQueue } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { DB } from '../database/database.module.js';
 import { AgentService } from '../agent/agent.service.js';
 import { ProviderService } from '../agent/provider.service.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { AdminGuard } from './admin.guard.js';
 import type { HealthStatusDto, ServiceStatusDto } from './admin.dto.js';
 
@@ -16,9 +14,6 @@ export class AdminHealthController {
     @Inject(DB) private readonly db: Db,
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(ProviderService) private readonly providerService: ProviderService,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
   ) {}
 
   @Get()
@@ -60,14 +55,6 @@ export class AdminHealthController {
   }
 
   private async checkCache(): Promise<ServiceStatusDto> {
-    // On Local tier there is no Redis. The cache is intentionally absent, which
-    // is a healthy state for this tier — report 'ok' rather than opening a new
-    // ioredis connection on every admin health check (which would spam
-    // ECONNREFUSED and create/destroy a connection per request). latencyMs 0
-    // signals "no cache backend to measure" for this tier.
-    if (this.mosaicConfig?.queue?.type === 'local') {
-      return { status: 'ok', latencyMs: 0 };
-    }
     const start = Date.now();
     const handle = createQueue();
     try {

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -26,7 +26,7 @@ function makeService(operatorMemory: unknown = null): AgentService {
     {} as never,
     { getToolDefinitions: vi.fn(() => []) } as never,
     { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
-    { get: vi.fn().mockResolvedValue(null), renew: vi.fn().mockResolvedValue(undefined) } as never,
+    null,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
     operatorMemory as never,

apps/gateway/src/agent/__tests__/session-ownership.test.ts

@@ -1,8 +1,6 @@
-import 'reflect-metadata';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { ForbiddenException, NotFoundException } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
 import { describe, expect, it, vi } from 'vitest';
 
 vi.mock('../agent.service.js', () => ({ AgentService: class AgentService {} }));
@@ -14,25 +12,10 @@ vi.mock('../routing/routing-engine.service.js', () => ({
 }));
 
 import { SessionsController } from '../sessions.controller.js';
-import { AgentService } from '../agent.service.js';
 import { ChatController } from '../../chat/chat.controller.js';
 import { ChatGateway } from '../../chat/chat.gateway.js';
 import type { AgentSession } from '../agent.service.js';
 import type { SessionInfoDto } from '../session.dto.js';
-import type { HarnessAdapter, HarnessConversationService } from '@mosaicstack/types';
-import { AuthGuard } from '../../auth/auth.guard.js';
-import { AUTH } from '../../auth/auth.tokens.js';
-import { BRAIN } from '../../brain/brain.tokens.js';
-import { CommandRegistryService } from '../../commands/command-registry.service.js';
-import { CommandExecutorService } from '../../commands/command-executor.service.js';
-import { RoutingEngineService } from '../routing/routing-engine.service.js';
-import { ChatRuntimeRouter } from '../../chat/chat-runtime-router.js';
-import { EmbeddedChatRuntime } from '../../chat/embedded-chat.runtime.js';
-import { ownConversation } from '../../chat/chat-runtime.js';
-import type { LegacyRuntimeStream } from '../../chat/chat-runtime.js';
-import { HarnessChatRuntime } from '../../chat/harness-chat.runtime.js';
-import { HarnessRegistry } from '../../harness/harness.registry.js';
-import { HARNESS_CONVERSATION_SERVICE_UNAVAILABLE } from '../../harness/harness.tokens.js';
 
 const USER_A = { id: 'user-a', tenantId: 'tenant-a' };
 const USER_B = { id: 'user-b', tenantId: 'tenant-b' };
@@ -91,12 +74,6 @@ function makeAgentSession(owner = USER_A): AgentSession {
   };
 }
 
-/**
- * A shape-complete, non-throwing AgentService fake scoped so that USER_B (a foreign owner guessing
- * USER_A's conversation id) is never granted the session. Because every method exists and no method
- * throws for a wrong shape, production runs to its real ownership decision — the RED never comes from
- * a `getSession is not a function` TypeError, only from a router-boundary/scope assertion mismatch.
- */
 function makeScopedAgentService() {
   const foreign = makeAgentSession(USER_A);
   return {
@@ -110,7 +87,7 @@ function makeScopedAgentService() {
     getSession: vi.fn((_id: string, scope?: { userId: string; tenantId?: string }) =>
       scope?.userId === USER_B.id ? undefined : foreign,
     ),
-    createSession: vi.fn().mockRejectedValue(new NotFoundException('Session scope mismatch')),
+    createSession: vi.fn().mockRejectedValue(new ForbiddenException('Session scope mismatch')),
     onEvent: vi.fn(() => vi.fn()),
     addChannel: vi.fn(),
     removeChannel: vi.fn(),
@@ -119,201 +96,6 @@ function makeScopedAgentService() {
   };
 }
 
-type ScopedAgentService = ReturnType<typeof makeScopedAgentService>;
-
-/**
- * A structurally-complete harness conversation service that throws if any method is invoked.
- * Fronted behind the legacy runtime's harness slot: the legacy path must never reach it.
- */
-const failIfUsedConversationService = {
-  attach: () => {
-    throw new Error('harness conversation service must not be reached on the legacy path');
-  },
-  detach: () => {
-    throw new Error('harness conversation service must not be reached on the legacy path');
-  },
-  send: () => {
-    throw new Error('harness conversation service must not be reached on the legacy path');
-  },
-
-  subscribeFrom: async function* () {
-    throw new Error('harness conversation service must not be reached on the legacy path');
-  },
-} as unknown as HarnessConversationService;
-
-/** A structurally-complete, non-sentinel conversation service used to satisfy the pi-rpc readiness gate. */
-const boundConversationService = {
-  attach: () => Promise.reject(new Error('unused')),
-  detach: () => Promise.reject(new Error('unused')),
-  send: () => Promise.reject(new Error('unused')),
-
-  subscribeFrom: async function* () {
-    throw new Error('unused');
-  },
-} as unknown as HarnessConversationService;
-
-function registryWith(adapterIds: readonly string[]): HarnessRegistry {
-  const registry = new HarnessRegistry();
-  for (const id of adapterIds) {
-    registry.register({
-      id,
-      describe: () => Promise.reject(new Error('unused')),
-      catalog: () => Promise.reject(new Error('unused')),
-      create: () => Promise.reject(new Error('unused')),
-      resume: () => Promise.reject(new Error('unused')),
-    } as HarnessAdapter);
-  }
-  return registry;
-}
-
-/**
- * Build the real legacy-mode {@link ChatRuntimeRouter} fronting a real {@link EmbeddedChatRuntime}
- * that holds the scoped AgentService fake. This is the ONLY path server-derived scope may travel to
- * reach an AgentService: controller/gateway → ChatRuntimeRouter → EmbeddedChatRuntime → AgentService.
- * The `embeddedAgentService` handed here is a SEPARATE instance from the directly-injected fake, so a
- * call landing on it proves the router-delegation redesign is live rather than the old direct path.
- */
-function legacyRouterFronting(agentService: unknown): ChatRuntimeRouter {
-  const embedded = new EmbeddedChatRuntime(agentService as never);
-  const harness = new HarnessChatRuntime(failIfUsedConversationService);
-  const router = new ChatRuntimeRouter(
-    new HarnessRegistry(),
-    HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    embedded,
-    harness,
-    'legacy',
-  );
-  router.onModuleInit();
-  return router;
-}
-
-/**
- * The AgentService method names the controller/gateway must NEVER drive on the runtime at the
- * delegation boundary. An AgentService-shaped router shim (a method-for-method mirror) would record
- * one of these instead of the frozen legacy op, so asserting their ABSENCE from the observed runtime
- * call set defeats the shim on INVOCATION evidence — never satisfiable by dead source text.
- */
-const FORBIDDEN_AGENT_OPS = [
-  'getSession',
-  'createSession',
-  'onEvent',
-  'addChannel',
-  'prompt',
-  'setThinking',
-  'abort',
-] as const;
-
-/**
- * Wrap a real {@link ChatRuntimeRouter} in a call-recording Proxy. Every property access that yields
- * an OWN/inherited callable is returned as a thin wrapper that appends the method name to `calls` at
- * INVOCATION time and forwards to the real method (bound to the real target, so the router's internal
- * delegation to the embedded runtime runs untouched below this boundary). Non-function and MISSING
- * properties are returned verbatim via Reflect.get — the observer NEVER fabricates a value, returns a
- * canned outcome, or delegates a not-yet-implemented named op, so it cannot itself become a shim.
- *
- * The result is a RUNTIME call set of exactly the methods the controller/gateway invoke ON the router
- * at the delegation seam. Only an actual call can enter it; a dead method, comment, or string in the
- * production source cannot. This replaces the earlier `source.toContain('<frozen op>')` proof — which
- * a dead declaration could satisfy while production still executed a shim — with invocation evidence.
- */
-function makeRecordingRouter(target: ChatRuntimeRouter, calls: string[]): ChatRuntimeRouter {
-  return new Proxy(target, {
-    get(t, prop) {
-      const value = Reflect.get(t, prop);
-      if (typeof value === 'function' && typeof prop === 'string') {
-        return (...args: unknown[]) => {
-          calls.push(prop);
-          return (value as (...a: unknown[]) => unknown).apply(t, args);
-        };
-      }
-      return value;
-    },
-  }) as ChatRuntimeRouter;
-}
-
-/**
- * Real Nest DI dual-provider fixture (mirrors the blessed group-3 pattern in chat-security.test.ts).
- *
- * BOTH an `AgentService` provider (the FORBIDDEN direct dependency) and a `ChatRuntimeRouter` provider
- * (fronting a real EmbeddedChatRuntime over a SEPARATE scoped AgentService) are registered. Production
- * resolves whichever its constructor declares:
- *   - RED today: the controller/gateway `@Inject(AgentService)` → the direct fake is consulted, the
- *     router (and its embedded fake) is never reached.
- *   - GREEN later: the controller/gateway inject `ChatRuntimeRouter` → the direct fake is never
- *     touched (stays at zero) and scope is observed inside the embedded fake behind the router.
- * The SAME test body reds today and greens later; a method-for-method AgentService shim on the router
- * records a FORBIDDEN op (and never the frozen legacy op) in the observed runtime call set, and
- * restoring the direct injection cannot satisfy the "direct fake at zero" / "embedded fake observed
- * scope" / "frozen op invoked on the router" anchors. The router is wrapped by {@link
- * makeRecordingRouter} so those anchors are runtime invocation evidence, not source substrings.
- */
-function buildRestModule(
-  directAgentService: ScopedAgentService,
-  embeddedAgentService: ScopedAgentService,
-  routerCalls: string[],
-): Promise<TestingModule> {
-  return (
-    Test.createTestingModule({
-      controllers: [ChatController],
-      providers: [
-        { provide: AgentService, useValue: directAgentService },
-        {
-          provide: ChatRuntimeRouter,
-          useFactory: () =>
-            makeRecordingRouter(legacyRouterFronting(embeddedAgentService), routerCalls),
-        },
-      ],
-    })
-      // ChatController's @UseGuards(AuthGuard) is resolved during instance loading; AuthGuard injects
-      // AUTH, an HTTP-only concern never exercised by a direct handler call. Stub it so the graph
-      // resolves and the test reds on BEHAVIOUR, not on a DI collection error.
-      .overrideGuard(AuthGuard)
-      .useValue({ canActivate: () => true })
-      .compile()
-  );
-}
-
-function buildGatewayModule(
-  directAgentService: ScopedAgentService,
-  embeddedAgentService: ScopedAgentService,
-  routerCalls: string[],
-): Promise<TestingModule> {
-  const brain = {
-    conversations: {
-      // The sender OWNS this durable conversation, so the browser-send admission gate lets the turn
-      // reach the router seam. Foreignness is asserted downstream at the in-memory agent session
-      // (getSession({USER_B}) -> undefined), not at durable admission — the admission-rejection
-      // property has its own dedicated coverage.
-      findById: vi.fn().mockResolvedValue({ id: CONVERSATION_ID, userId: USER_B.id }),
-      create: vi.fn().mockResolvedValue(undefined),
-      update: vi.fn().mockResolvedValue(undefined),
-      findMessages: vi.fn().mockResolvedValue([]),
-      addMessage: vi.fn().mockResolvedValue({ id: 'persisted-turn' }),
-    },
-  };
-  return Test.createTestingModule({
-    providers: [
-      ChatGateway,
-      { provide: AgentService, useValue: directAgentService },
-      { provide: AUTH, useValue: { api: { getSession: vi.fn().mockResolvedValue(null) } } },
-      { provide: BRAIN, useValue: brain },
-      { provide: CommandRegistryService, useValue: { getManifest: vi.fn().mockReturnValue([]) } },
-      { provide: CommandExecutorService, useValue: { execute: vi.fn() } },
-      {
-        provide: RoutingEngineService,
-        useValue: {
-          resolve: vi.fn().mockResolvedValue({ provider: 'test', model: 'test-model' }),
-        },
-      },
-      {
-        provide: ChatRuntimeRouter,
-        useFactory: () =>
-          makeRecordingRouter(legacyRouterFronting(embeddedAgentService), routerCalls),
-      },
-    ],
-  }).compile();
-}
-
 describe('TESS-M1-SEC-002 AgentService ownership boundary', () => {
   it('requires explicit owner+tenant scope on protected session operations', () => {
     const source = readFileSync(resolve('src/agent/agent.service.ts'), 'utf8');
@@ -370,66 +152,50 @@ describe('TESS-M1-SEC-002 REST session ownership and tenant binding', () => {
   });
 });
 
-describe('TESS-M1-SEC-002 REST chat send ownership and tenant binding (router-delegated legacy runtime)', () => {
-  // TESS test A — REST /api/chat send. The genuine RED is the router-delegation redesign, not a slot
-  // swap: the forbidden directly-injected AgentService must go UNtouched while the server-derived
-  // scope is observed inside the real ChatRuntimeRouter → EmbeddedChatRuntime → AgentService path.
-  it('routes a REST send through completeLegacyRestTurn and never the directly-injected AgentService', async () => {
-    const directAgentService = makeScopedAgentService(); // FORBIDDEN direct dependency
-    const embeddedAgentService = makeScopedAgentService(); // reached ONLY via router → embedded delegation
-    const routerCalls: string[] = []; // runtime call set observed AT the controller → router seam
-    const moduleRef = await buildRestModule(directAgentService, embeddedAgentService, routerCalls);
-    try {
-      const controller = moduleRef.get(ChatController, { strict: false });
+describe('TESS-M1-SEC-002 REST chat send ownership and tenant binding', () => {
+  it('does not send a prompt into another owner/tenant session by guessed conversationId', async () => {
+    const agentService = makeScopedAgentService();
+    const controller = new ChatController(agentService as never);
 
-      // Foreign ownership is denied (never resolves) — a control that holds today AND at GREEN.
-      await expect(
-        controller.chat({ conversationId: CONVERSATION_ID, content: 'take over' }, USER_B),
-      ).rejects.toBeDefined();
+    await expect(
+      controller.chat({ conversationId: CONVERSATION_ID, content: 'take over' }, USER_B),
+    ).rejects.toMatchObject({ status: 404 });
 
-      // Soft anchors so EVERY anchor is evaluated under each mutation, not just the first to fail.
-
-      // RUNTIME anchor A1 — delegation: the controller must INVOKE the frozen legacy op on the router.
-      // Only an actual call enters routerCalls; a dead method/comment/string cannot. RED today (the
-      // controller @Inject(AgentService) and never calls the router). GREEN once it drives the op.
-      expect
-        .soft(routerCalls, 'controller must invoke completeLegacyRestTurn on the router')
-        .toContain('completeLegacyRestTurn');
-      // RUNTIME anchor A2 — nondelegation: the controller must not drive any AgentService-shaped op on
-      // the router. An AgentService-shaped router shim records one of these → RED, defeating the shim
-      // on invocation evidence (not source text). A dead named method added alongside the shim does not
-      // help: it is never invoked, so it never enters routerCalls while a forbidden op still does.
-      for (const op of FORBIDDEN_AGENT_OPS) {
-        expect
-          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
-          .not.toContain(op);
-      }
-      // RUNTIME anchor A3 — the forbidden directly-injected AgentService stays at zero (fails today;
-      // restoring the direct injection keeps it failing).
-      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
-      // RUNTIME anchor A4 — server-derived scope observed INSIDE the separate embedded fake behind the
-      // router (fails today; the router path is never taken).
-      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-        userId: USER_B.id,
-        tenantId: USER_B.tenantId,
-      });
-
-      // Zero foreign mutation on either path (holds today and at GREEN).
-      expect.soft(directAgentService.prompt).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.prompt).not.toHaveBeenCalled();
-
-      // Defense-in-depth (NOT load-bearing; the runtime anchors above carry the anti-mask): the
-      // controller no longer declares the direct embedded AgentService dependency. A negative source
-      // check cannot be satisfied by dead text — it only fails when the injection is present.
-      const controllerSource = readFileSync(resolve('src/chat/chat.controller.ts'), 'utf8');
-      expect.soft(controllerSource).not.toContain('@Inject(AgentService)');
-    } finally {
-      await moduleRef.close();
-    }
+    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+      userId: USER_B.id,
+      tenantId: USER_B.tenantId,
+    });
+    expect(agentService.prompt).not.toHaveBeenCalled();
   });
 });
 
-describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding (router-delegated legacy runtime)', () => {
+describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding', () => {
+  function makeGateway(agentService = makeScopedAgentService()) {
+    const brain = {
+      conversations: {
+        findById: vi.fn().mockResolvedValue(undefined),
+        create: vi.fn().mockResolvedValue(undefined),
+        update: vi.fn().mockResolvedValue(undefined),
+        findMessages: vi.fn().mockResolvedValue([]),
+        addMessage: vi.fn().mockResolvedValue(undefined),
+      },
+    };
+    const commandRegistry = { getManifest: vi.fn().mockReturnValue([]) };
+    const commandExecutor = { execute: vi.fn() };
+    const routingEngine = {
+      resolve: vi.fn().mockResolvedValue({ provider: 'test', model: 'test-model' }),
+    };
+    const gateway = new ChatGateway(
+      agentService as never,
+      {} as never,
+      brain as never,
+      commandRegistry as never,
+      commandExecutor as never,
+      routingEngine as never,
+    );
+    return { gateway, agentService };
+  }
+
   function makeSocket() {
     return {
       id: 'socket-b',
@@ -440,519 +206,57 @@ describe('TESS-M1-SEC-002 WebSocket session ownership and tenant binding (router
     };
   }
 
-  // TESS test B — WebSocket send/attach.
-  it('routes a WebSocket send through prepareLegacySocketTurn and never the directly-injected AgentService', async () => {
-    const directAgentService = makeScopedAgentService();
-    const embeddedAgentService = makeScopedAgentService();
-    const routerCalls: string[] = [];
-    const moduleRef = await buildGatewayModule(
-      directAgentService,
-      embeddedAgentService,
-      routerCalls,
-    );
-    try {
-      const gateway = moduleRef.get(ChatGateway, { strict: false });
-      const socket = makeSocket();
+  it('does not attach or send to another owner/tenant session by guessed conversationId', async () => {
+    const { gateway, agentService } = makeGateway();
+    const socket = makeSocket();
 
-      await Promise.resolve(
-        gateway.handleMessage(socket as never, {
-          conversationId: CONVERSATION_ID,
-          content: 'attach to foreign session',
-        }),
-      ).catch(() => undefined);
-
-      // RUNTIME anchor B1 — delegation: the gateway must invoke the frozen socket op on the router.
-      expect
-        .soft(routerCalls, 'gateway must invoke prepareLegacySocketTurn on the router')
-        .toContain('prepareLegacySocketTurn');
-      // RUNTIME anchor B2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
-      for (const op of FORBIDDEN_AGENT_OPS) {
-        expect
-          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
-          .not.toContain(op);
-      }
-      // RED anchor B3 — forbidden direct AgentService untouched (fails today, gateway injects it).
-      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
-      // RED anchor B4 — scope observed inside router → embedded delegation (fails today, never reached).
-      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-        userId: USER_B.id,
-        tenantId: USER_B.tenantId,
-      });
-      // Foreign session gets zero lease/listener/channel/prompt on EITHER path (holds today and GREEN).
-      expect.soft(directAgentService.onEvent).not.toHaveBeenCalled();
-      expect.soft(directAgentService.addChannel).not.toHaveBeenCalled();
-      expect.soft(directAgentService.prompt).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.onEvent).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.addChannel).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.prompt).not.toHaveBeenCalled();
-      expect
-        .soft(socket.emit)
-        .toHaveBeenCalledWith(
-          'error',
-          expect.objectContaining({ conversationId: CONVERSATION_ID }),
-        );
-
-      // Defense-in-depth (NOT load-bearing): gateway no longer declares the direct dependency.
-      const gatewaySource = readFileSync(resolve('src/chat/chat.gateway.ts'), 'utf8');
-      expect.soft(gatewaySource).not.toContain('@Inject(AgentService)');
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  // TESS test C — WebSocket set:thinking.
-  it('routes set:thinking through setLegacyThinking and never the directly-injected AgentService', async () => {
-    const directAgentService = makeScopedAgentService();
-    const embeddedAgentService = makeScopedAgentService();
-    const routerCalls: string[] = [];
-    const moduleRef = await buildGatewayModule(
-      directAgentService,
-      embeddedAgentService,
-      routerCalls,
-    );
-    try {
-      const gateway = moduleRef.get(ChatGateway, { strict: false });
-      const socket = makeSocket();
-
-      await Promise.resolve(
-        gateway.handleSetThinking(socket as never, {
-          conversationId: CONVERSATION_ID,
-          level: 'high',
-        }),
-      ).catch(() => undefined);
-
-      // RUNTIME anchor C1 — delegation: the gateway must invoke the frozen thinking op on the router.
-      expect
-        .soft(routerCalls, 'gateway must invoke setLegacyThinking on the router')
-        .toContain('setLegacyThinking');
-      // RUNTIME anchor C2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
-      for (const op of FORBIDDEN_AGENT_OPS) {
-        expect
-          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
-          .not.toContain(op);
-      }
-      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-        userId: USER_B.id,
-        tenantId: USER_B.tenantId,
-      });
-      expect
-        .soft(socket.emit)
-        .toHaveBeenCalledWith(
-          'error',
-          expect.objectContaining({ conversationId: CONVERSATION_ID }),
-        );
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  // TESS test D — WebSocket abort.
-  it('routes abort through abortLegacyTurn and never the directly-injected AgentService', async () => {
-    const directAgentService = makeScopedAgentService();
-    const embeddedAgentService = makeScopedAgentService();
-    const routerCalls: string[] = [];
-    const moduleRef = await buildGatewayModule(
-      directAgentService,
-      embeddedAgentService,
-      routerCalls,
-    );
-    try {
-      const gateway = moduleRef.get(ChatGateway, { strict: false });
-      const socket = makeSocket();
-
-      await Promise.resolve(
-        gateway.handleAbort(socket as never, { conversationId: CONVERSATION_ID }),
-      ).catch(() => undefined);
-
-      // RUNTIME anchor D1 — delegation: the gateway must invoke the frozen abort op on the router.
-      expect
-        .soft(routerCalls, 'gateway must invoke abortLegacyTurn on the router')
-        .toContain('abortLegacyTurn');
-      // RUNTIME anchor D2 — nondelegation: no AgentService-shaped op on the router (defeats the shim).
-      for (const op of FORBIDDEN_AGENT_OPS) {
-        expect
-          .soft(routerCalls, `router seam must not invoke AgentService.${op}`)
-          .not.toContain(op);
-      }
-      expect.soft(directAgentService.getSession).not.toHaveBeenCalled();
-      expect.soft(embeddedAgentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
-        userId: USER_B.id,
-        tenantId: USER_B.tenantId,
-      });
-      expect
-        .soft(socket.emit)
-        .toHaveBeenCalledWith(
-          'error',
-          expect.objectContaining({ conversationId: CONVERSATION_ID }),
-        );
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  // TESS test E (genuine, unchanged) — pi-rpc browser-legacy refusal.
-  it('rejects a browser legacy raw message in pi-rpc mode with a fixed typed unsupported and executes nothing', async () => {
-    // pi-rpc: the harness runtime is live. The browser legacy `message` path is unsupported and
-    // must be refused with a fixed typed code, touching neither the embedded AgentService nor the
-    // harness conversation service.
-    const agentService = makeScopedAgentService();
-    const embedded = new EmbeddedChatRuntime(agentService as never);
-    const harnessConversation = {
-      attach: vi.fn(),
-      detach: vi.fn(),
-      send: vi.fn(),
-      subscribeFrom: vi.fn(),
-    };
-    const harness = new HarnessChatRuntime(harnessConversation as never);
-    const router = new ChatRuntimeRouter(
-      registryWith(['pi']),
-      boundConversationService,
-      embedded,
-      harness,
-      'pi-rpc',
-    );
-    router.onModuleInit();
-
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue(undefined),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        findMessages: vi.fn().mockResolvedValue([]),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const gateway = new ChatGateway(
-      router as never,
-      {} as never,
-      brain as never,
-      { getManifest: vi.fn().mockReturnValue([]) } as never,
-      { execute: vi.fn() } as never,
-      { resolve: vi.fn() } as never,
-    );
-    const socket = {
-      id: 'socket-b',
-      connected: true,
-      data: { user: USER_B, session: { id: 'auth-session-b', userId: USER_B.id } },
-      emit: vi.fn(),
-      disconnect: vi.fn(),
-    };
-
-    await Promise.resolve(
-      gateway.handleMessage(socket as never, {
-        conversationId: CONVERSATION_ID,
-        content: 'route me',
-      }),
-    ).catch(() => undefined);
+    await gateway.handleMessage(socket as never, {
+      conversationId: CONVERSATION_ID,
+      content: 'attach to foreign session',
+    });
 
+    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+      userId: USER_B.id,
+      tenantId: USER_B.tenantId,
+    });
+    expect(agentService.onEvent).not.toHaveBeenCalled();
+    expect(agentService.addChannel).not.toHaveBeenCalled();
+    expect(agentService.prompt).not.toHaveBeenCalled();
     expect(socket.emit).toHaveBeenCalledWith(
       'error',
-      expect.objectContaining({ code: 'runtime_unsupported' }),
+      expect.objectContaining({ conversationId: CONVERSATION_ID }),
     );
-    expect(agentService.getSession).not.toHaveBeenCalled();
-    expect(agentService.prompt).not.toHaveBeenCalled();
-    expect(harnessConversation.attach).not.toHaveBeenCalled();
-    expect(harnessConversation.send).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Task-5 AMEND — embedded runtime lease lifecycle (G1) + ownership collapse (G5).
-// These drive the real EmbeddedChatRuntime directly over a shape-complete AgentService
-// fake (every touched method exists, so a RED can only come from behavior, never a
-// `getSession is not a function` TypeError). Ownership context is minted through the
-// real `ownConversation` factory — the only sanctioned way to reach a port op.
-// ---------------------------------------------------------------------------
-
-const EMBEDDED_SCOPE = { userId: USER_A.id, tenantId: USER_A.tenantId };
-const CONVERSATION_UNAVAILABLE_RESULT = {
-  ok: false,
-  code: 'conversation_unavailable',
-  retryable: false,
-} as const;
-
-/** A stream sink; `channelId` is server-derived, `onEvent` records nothing here. */
-function makeStream(): LegacyRuntimeStream {
-  return { channelId: 'websocket:test-1', onEvent: vi.fn() };
-}
-
-/**
- * getSession → undefined (session missing), createSession → rejects with `err`. Exercises the
- * `resolveOrCreate` collapse branch. `prompt` exists so its ABSENCE from the call record proves
- * the turn short-circuited before any dispatch.
- */
-function makeCollapsingAgentService(err: Error) {
-  return {
-    getSession: vi.fn(() => undefined),
-    createSession: vi.fn().mockRejectedValue(err),
-    onEvent: vi.fn(() => vi.fn()),
-    addChannel: vi.fn(),
-    removeChannel: vi.fn(),
-    prompt: vi.fn().mockResolvedValue(undefined),
-    recordTokenUsage: vi.fn(),
-  };
-}
-
-/** getSession → a live owned session, so `resolveOrCreate` succeeds and a lease is built. */
-function makeLeaseAgentService() {
-  const session = makeAgentSession(USER_A);
-  const unsubscribe = vi.fn();
-  const svc = {
-    getSession: vi.fn(() => session),
-    createSession: vi.fn(),
-    onEvent: vi.fn(() => unsubscribe),
-    addChannel: vi.fn(),
-    removeChannel: vi.fn(),
-    prompt: vi.fn().mockResolvedValue(undefined),
-    recordTokenUsage: vi.fn(),
-  };
-  return { svc, unsubscribe, session };
-}
-
-/**
- * getSession → a live owned session (REST resolveOrCreate succeeds), onEvent returns a `detach`
- * spy, and `prompt` REJECTS with a non-timeout error. Drives the REST-turn catch path so the single
- * idempotent teardown must clear the 120s timeout and detach the listener exactly once.
- */
-function makeRejectingPromptAgentService() {
-  const session = makeAgentSession(USER_A);
-  const detach = vi.fn();
-  const svc = {
-    getSession: vi.fn(() => session),
-    createSession: vi.fn(),
-    onEvent: vi.fn(() => detach),
-    addChannel: vi.fn(),
-    removeChannel: vi.fn(),
-    prompt: vi.fn().mockRejectedValue(new Error('agent backend exploded')),
-    recordTokenUsage: vi.fn(),
-  };
-  return { svc, detach };
-}
-
-describe('TESS Task-5 embedded ownership collapse (missing and foreign are indistinguishable, never throw)', () => {
-  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
-
-  it('collapses a foreign (Forbidden) create to conversation_unavailable and never throws', async () => {
-    const svc = makeCollapsingAgentService(new ForbiddenException('foreign owner'));
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    const result = await runtime.completeLegacyRestTurn(ctx, { content: 'take over' });
-
-    expect(result).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
-    expect(svc.prompt).not.toHaveBeenCalled();
   });
 
-  it('collapses a missing (NotFound) create to conversation_unavailable and never throws', async () => {
-    const svc = makeCollapsingAgentService(new NotFoundException('no such conversation'));
-    const runtime = new EmbeddedChatRuntime(svc as never);
+  it('does not mutate thinking level on another owner/tenant session', () => {
+    const { gateway, agentService } = makeGateway();
+    const socket = makeSocket();
 
-    const result = await runtime.completeLegacyRestTurn(ctx, { content: 'hello' });
+    gateway.handleSetThinking(socket as never, { conversationId: CONVERSATION_ID, level: 'high' });
 
-    expect(result).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
-    expect(svc.prompt).not.toHaveBeenCalled();
-  });
-
-  it('returns the IDENTICAL collapse for foreign and missing so neither can be distinguished', async () => {
-    const foreign = new EmbeddedChatRuntime(
-      makeCollapsingAgentService(new ForbiddenException('foreign owner')) as never,
-    );
-    const missing = new EmbeddedChatRuntime(
-      makeCollapsingAgentService(new NotFoundException('no such conversation')) as never,
-    );
-
-    const foreignResult = await foreign.completeLegacyRestTurn(ctx, { content: 'x' });
-    const missingResult = await missing.completeLegacyRestTurn(ctx, { content: 'x' });
-
-    expect(foreignResult).toEqual(missingResult);
-    expect(foreignResult).toEqual(CONVERSATION_UNAVAILABLE_RESULT);
-  });
-});
-
-describe('TESS Task-5 embedded socket lease lifecycle (one-shot dispatch, idempotent dispose, partial-setup rollback)', () => {
-  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
-
-  it('dispatches the turn exactly once; a second dispatch is a no-op turn_already_dispatched', async () => {
-    const { svc } = makeLeaseAgentService();
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'first' }, makeStream());
-    expect(prepared.ok).toBe(true);
-    if (!prepared.ok) throw new Error('prepareLegacySocketTurn should succeed');
-    const lease = prepared.value;
-
-    const first = await lease.dispatch();
-    expect(first).toEqual({ ok: true, value: undefined });
-    expect(svc.prompt).toHaveBeenCalledTimes(1);
-
-    const second = await lease.dispatch();
-    expect(second).toEqual({ ok: false, code: 'turn_already_dispatched', retryable: false });
-    // Zero additional effect — the second dispatch must not prompt again.
-    expect(svc.prompt).toHaveBeenCalledTimes(1);
-  });
-
-  it('disposes once; a second dispose is a silent no-op that never re-detaches or destroys the session', async () => {
-    const { svc, unsubscribe, session } = makeLeaseAgentService();
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'x' }, makeStream());
-    expect(prepared.ok).toBe(true);
-    if (!prepared.ok) throw new Error('prepareLegacySocketTurn should succeed');
-    const lease = prepared.value;
-
-    await lease.dispose();
-    await lease.dispose();
-
-    // Listener + channel torn down exactly once across two dispose calls.
-    expect(unsubscribe).toHaveBeenCalledTimes(1);
-    expect(svc.removeChannel).toHaveBeenCalledTimes(1);
-    // Disposal never terminates the underlying session or process.
-    expect(session.piSession.abort).not.toHaveBeenCalled();
-    expect(session.piSession.dispose).not.toHaveBeenCalled();
-  });
-
-  it('rolls back the acquired listener and returns a total safe failure when channel attach fails mid-setup', async () => {
-    const { svc, unsubscribe } = makeLeaseAgentService();
-    svc.addChannel = vi.fn(() => {
-      throw new Error('channel attach failed');
+    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+      userId: USER_B.id,
+      tenantId: USER_B.tenantId,
     });
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    // Must NOT throw out of the port — a partial setup collapses to a total safe failure.
-    const prepared = await runtime.prepareLegacySocketTurn(ctx, { content: 'x' }, makeStream());
-    expect(prepared.ok).toBe(false);
-    // Exactly what was acquired (the event listener) is rolled back.
-    expect(unsubscribe).toHaveBeenCalledTimes(1);
-  });
-});
-
-describe('TESS Task-5 embedded REST turn teardown (a prompt rejection frees the timer + listener exactly once)', () => {
-  const ctx = ownConversation(CONVERSATION_ID, EMBEDDED_SCOPE);
-
-  it('clears the 120s timeout and detaches the listener exactly once when prompt() rejects, leaving no timer to reject the abandoned done-promise later (Task 5 finding 6)', async () => {
-    const { svc, detach } = makeRejectingPromptAgentService();
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    // A rejected `done` promise firing after completeLegacyRestTurn has already returned would
-    // surface as an unhandledRejection — the leak this test fences. Capture any that escape.
-    const unhandled: unknown[] = [];
-    const onUnhandled = (reason: unknown): void => {
-      unhandled.push(reason);
-    };
-    process.on('unhandledRejection', onUnhandled);
-    vi.useFakeTimers();
-    try {
-      const result = await runtime.completeLegacyRestTurn(ctx, {
-        content: 'trigger a backend failure',
-      });
-
-      // The rejection collapses to a total safe failure (not a timeout) — never throws out of the port.
-      expect(result).toEqual({ ok: false, code: 'operation_failed', retryable: false });
-      // The single idempotent dispose ran in the catch: listener detached exactly once.
-      expect(detach).toHaveBeenCalledTimes(1);
-
-      // dispose() cleared the REST timeout, so advancing far past it (120s) fires nothing: no second
-      // detach, and — the actual leak — no live timer left to reject the now-abandoned `done` promise.
-      vi.advanceTimersByTime(600_000);
-      expect(detach).toHaveBeenCalledTimes(1);
-    } finally {
-      vi.useRealTimers();
-    }
-    // Let any scheduled rejection surface on a real macrotask, then confirm none did.
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    process.off('unhandledRejection', onUnhandled);
-    expect(unhandled).toHaveLength(0);
+    expect(socket.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: CONVERSATION_ID }),
+    );
   });
 
-  it('bounds a hung prompt: when prompt() never settles and no agent_end arrives, the 120s timeout ends the turn with a timeout result and exactly one teardown, no unhandledRejection (Task 5 finding 6 — pending-prompt timeout)', async () => {
-    const session = makeAgentSession(USER_A);
-    const detach = vi.fn();
-    const svc = {
-      getSession: vi.fn(() => session),
-      createSession: vi.fn(),
-      onEvent: vi.fn(() => detach),
-      addChannel: vi.fn(),
-      removeChannel: vi.fn(),
-      // The prompt never resolves or rejects — a hung agent backend. Under the pre-fix sequential
-      // `await prompt()` the timer could never even be observed, so the turn hung forever.
-      prompt: vi.fn(() => new Promise<void>(() => undefined)),
-      recordTokenUsage: vi.fn(),
-    };
-    const runtime = new EmbeddedChatRuntime(svc as never);
+  it('does not terminate another owner/tenant session over WebSocket abort', async () => {
+    const { gateway, agentService } = makeGateway();
+    const socket = makeSocket();
 
-    const unhandled: unknown[] = [];
-    const onUnhandled = (reason: unknown): void => {
-      unhandled.push(reason);
-    };
-    process.on('unhandledRejection', onUnhandled);
-    vi.useFakeTimers();
-    try {
-      const resultPromise = runtime.completeLegacyRestTurn(ctx, {
-        content: 'a prompt that never returns',
-      });
-      // No agent_end, prompt still pending: only the 120s timeout can end the turn. Promise.all
-      // installed a handler on `done` synchronously, so the timer bounds the turn while prompt hangs.
-      await vi.advanceTimersByTimeAsync(200_000);
-      const result = await resultPromise;
+    await gateway.handleAbort(socket as never, { conversationId: CONVERSATION_ID });
 
-      expect(result).toEqual({ ok: false, code: 'timeout', retryable: true });
-      // The single idempotent dispose ran on the timeout path: listener detached exactly once.
-      expect(detach).toHaveBeenCalledTimes(1);
-      // Advancing far past the deadline fires nothing more: dispose cleared the timer.
-      vi.advanceTimersByTime(600_000);
-      expect(detach).toHaveBeenCalledTimes(1);
-    } finally {
-      vi.useRealTimers();
-    }
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    process.off('unhandledRejection', onUnhandled);
-    expect(unhandled).toHaveLength(0);
-  });
-
-  it('when the 120s timeout fires while prompt() is still pending, returns timeout with one teardown, and a later prompt rejection surfaces no unhandledRejection (Task 5 finding 6 — timeout/prompt race)', async () => {
-    const session = makeAgentSession(USER_A);
-    const detach = vi.fn();
-    let rejectPrompt: (reason: unknown) => void = () => undefined;
-    const prompting = new Promise<void>((_resolve, reject) => {
-      rejectPrompt = reject;
+    expect(agentService.getSession).toHaveBeenCalledWith(CONVERSATION_ID, {
+      userId: USER_B.id,
+      tenantId: USER_B.tenantId,
     });
-    const svc = {
-      getSession: vi.fn(() => session),
-      createSession: vi.fn(),
-      onEvent: vi.fn(() => detach),
-      addChannel: vi.fn(),
-      removeChannel: vi.fn(),
-      prompt: vi.fn(() => prompting),
-      recordTokenUsage: vi.fn(),
-    };
-    const runtime = new EmbeddedChatRuntime(svc as never);
-
-    const unhandled: unknown[] = [];
-    const onUnhandled = (reason: unknown): void => {
-      unhandled.push(reason);
-    };
-    process.on('unhandledRejection', onUnhandled);
-    vi.useFakeTimers();
-    try {
-      const resultPromise = runtime.completeLegacyRestTurn(ctx, {
-        content: 'prompt settles after the deadline',
-      });
-      // The timeout wins the race while prompt is still pending.
-      await vi.advanceTimersByTimeAsync(200_000);
-      const result = await resultPromise;
-
-      expect(result).toEqual({ ok: false, code: 'timeout', retryable: true });
-      expect(detach).toHaveBeenCalledTimes(1);
-
-      // The prompt now rejects LATE — after the turn already returned its timeout result. Because
-      // Promise.all installed a rejection handler on `prompting` synchronously (the fix), this late
-      // rejection is already observed and must not escape as an unhandledRejection.
-      rejectPrompt(new Error('late backend failure'));
-    } finally {
-      vi.useRealTimers();
-    }
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    process.off('unhandledRejection', onUnhandled);
-    expect(unhandled).toHaveLength(0);
+    expect(socket.emit).toHaveBeenCalledWith(
+      'error',
+      expect.objectContaining({ conversationId: CONVERSATION_ID }),
+    );
   });
 });

apps/gateway/src/agent/agent.module.ts

@@ -21,12 +21,6 @@ import { LogModule } from '../log/log.module.js';
 import { CommandsModule } from '../commands/commands.module.js';
 import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
 import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  DenyConnectorLeasePolicy,
-} from './connector-lease.service.js';
 import {
   AGENT_RUNTIME_PROVIDER_REGISTRY,
   RUNTIME_APPROVAL_VERIFIER,
@@ -52,13 +46,6 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     SkillLoaderService,
     DurableSessionRepository,
     DurableSessionService,
-    ConnectorLeaseRepository,
-    DenyConnectorLeasePolicy,
-    {
-      provide: CONNECTOR_LEASE_POLICY,
-      useExisting: DenyConnectorLeasePolicy,
-    },
-    ConnectorLeaseService,
     {
       provide: AGENT_RUNTIME_PROVIDER_REGISTRY,
       useFactory: createGatewayRuntimeProviderRegistry,
@@ -91,7 +78,6 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     SkillLoaderService,
     DurableSessionService,
     RuntimeProviderService,
-    ConnectorLeaseService,
     AGENT_RUNTIME_PROVIDER_REGISTRY,
   ],
 })

apps/gateway/src/agent/agent.service.ts

@@ -27,11 +27,10 @@ import { McpClientService } from '../mcp-client/mcp-client.service.js';
 import { SkillLoaderService } from './skill-loader.service.js';
 import { createBrainTools } from './tools/brain-tools.js';
 import { createCoordTools } from './tools/coord-tools.js';
-import { createDeliveryTools } from './tools/delivery-tools.js';
 import { createMemoryTools } from './tools/memory-tools.js';
 import { createFileTools } from './tools/file-tools.js';
 import { createGitTools } from './tools/git-tools.js';
-import { createShellToolsIfEnabled } from './tools/shell-tools.js';
+import { createShellTools } from './tools/shell-tools.js';
 import { createWebTools } from './tools/web-tools.js';
 import { createSearchTools } from './tools/search-tools.js';
 import type { SessionInfoDto, SessionMetrics } from './session.dto.js';
@@ -133,8 +132,9 @@ export class AgentService implements OnModuleDestroy {
     @Inject(CoordService) private readonly coordService: CoordService,
     @Inject(McpClientService) private readonly mcpClientService: McpClientService,
     @Inject(SkillLoaderService) private readonly skillLoaderService: SkillLoaderService,
+    @Optional()
     @Inject(SystemOverrideService)
-    private readonly systemOverride: SystemOverrideService,
+    private readonly systemOverride: SystemOverrideService | null,
     @Optional()
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
@@ -168,8 +168,7 @@ export class AgentService implements OnModuleDestroy {
       ),
       ...createFileTools(sandboxDir),
       ...createGitTools(sandboxDir),
-      ...createShellToolsIfEnabled(sandboxDir),
-      ...createDeliveryTools(sandboxDir),
+      ...createShellTools(sandboxDir),
       ...createWebTools(),
       ...createSearchTools(),
     ];
@@ -710,22 +709,23 @@ export class AgentService implements OnModuleDestroy {
       throw new Error(`No agent session found: ${sessionId}`);
     }
     this.assertSessionScope(session, scope);
+    session.promptCount += 1;
 
     // Channel attachments are untrusted URI references. Preserve exact,
     // authenticated metadata for the agent without treating it as authority.
     const attachmentContext = this.attachmentContext(attachments);
 
-    // Prepend session-scoped system override if present (renew TTL on each turn).
-    // Required instruction-authority wiring is consulted before session/provider effects.
+    // Prepend session-scoped system override if present (renew TTL on each turn)
     let effectiveMessage = `${message}${attachmentContext}`;
-    const override = await this.systemOverride.get(sessionId, scope);
-    if (override) {
-      effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
-      await this.systemOverride.renew(sessionId, scope);
-      this.logger.debug(`Applied system override for session ${sessionId}`);
+    if (this.systemOverride) {
+      const override = await this.systemOverride.get(sessionId, scope);
+      if (override) {
+        effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
+        await this.systemOverride.renew(sessionId, scope);
+        this.logger.debug(`Applied system override for session ${sessionId}`);
+      }
     }
 
-    session.promptCount += 1;
     try {
       await session.piSession.prompt(effectiveMessage);
     } catch (err) {

apps/gateway/src/agent/connector-lease.integration.test.ts

@@ -1,341 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Test, type TestingModule } from '@nestjs/testing';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { ConnectorExecutionContext, FencedConnectorAdapter } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  type ConnectorLeasePolicy,
-  type ConnectorLeasePolicySubject,
-} from './connector-lease.service.js';
-
-const authorize = vi.fn().mockResolvedValue(true);
-const policy: ConnectorLeasePolicy = { authorize };
-const context = {
-  actorScope: { userId: 'operator-a', tenantId: 'tenant-a' },
-  correlationId: 'correlation-acquire',
-};
-
-describe('gateway connector lease fencing integration', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let moduleRef: TestingModule;
-  let service: ConnectorLeaseService;
-  let repository: ConnectorLeaseRepository;
-
-  beforeAll(async (): Promise<void> => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-07-14T17:00:00.000Z'));
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    moduleRef = await Test.createTestingModule({
-      providers: [
-        ConnectorLeaseRepository,
-        ConnectorLeaseService,
-        { provide: DB, useValue: handle.db },
-        { provide: CONNECTOR_LEASE_POLICY, useValue: policy },
-      ],
-    }).compile();
-    service = moduleRef.get(ConnectorLeaseService);
-    repository = moduleRef.get(ConnectorLeaseRepository);
-  });
-
-  afterAll(async (): Promise<void> => {
-    vi.useRealTimers();
-    await moduleRef.close();
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('derives tenant authority at the gateway and validates a grant before side effects', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'Mos',
-        bindingId: 'operator-chat',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      context,
-    );
-    const grant = await service.issueGrant(
-      { lease, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-grant' },
-    );
-    const execute = vi.fn(async (_message: string, leaseContext: ConnectorExecutionContext) => {
-      return leaseContext.leaseEpoch;
-    });
-    const adapter: FencedConnectorAdapter<string, string> = { execute };
-
-    await expect(service.executeGrant(grant, 'runtime.send', 'hello', adapter)).resolves.toBe('1');
-    expect(execute).toHaveBeenCalledOnce();
-    expect(authorize).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        requestedScopes: ['runtime.send'],
-        requestedTtlMs: 30_000,
-      }),
-    );
-    expect(execute.mock.calls[0]?.[1]).toMatchObject({
-      identity: { tenantId: 'tenant-a', logicalAgentId: 'mos' },
-      bindingId: 'operator-chat',
-      connectorId: 'pi-worker-a',
-    });
-  });
-
-  it('normalizes lease-derived policy subjects before authorization', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-policy-setup' },
-    );
-    const aliasedLease = {
-      ...lease,
-      identity: { ...lease.identity, logicalAgentId: ' MOS ' },
-      bindingId: ' Operator-Chat-Policy ',
-      connectorId: ' PI-Worker-A ',
-      scopes: [' Runtime.Send '],
-      leaseEpoch: `00${lease.leaseEpoch}`,
-    };
-
-    await service.heartbeat(aliasedLease, 30_000, {
-      ...context,
-      correlationId: 'correlation-policy-heartbeat',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.heartbeat',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.issueGrant(
-      { lease: aliasedLease, scopes: [' Runtime.Send '], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-policy-grant' },
-    );
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.release(aliasedLease, {
-      ...context,
-      correlationId: 'correlation-policy-release',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.release',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-  });
-
-  it('denies stale, forged, expired, cross-tenant, and cross-binding grants before effects', async (): Promise<void> => {
-    const bindingId = 'operator-chat-denials';
-    const current = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-denial-setup' },
-    );
-    const stale = await service.issueGrant(
-      { lease: current, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-stale' },
-    );
-    await service.takeover(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-b',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-        expectedEpoch: current.leaseEpoch,
-      },
-      { ...context, correlationId: 'correlation-takeover' },
-    );
-    const adapter = { execute: vi.fn().mockResolvedValue(undefined) };
-
-    await expect(service.executeGrant(stale, 'runtime.send', undefined, adapter)).rejects.toThrow();
-
-    const active = await service.current('mos', bindingId, context);
-    if (!active) throw new Error('active lease fixture is unavailable');
-    const grant = await service.issueGrant(
-      { lease: active, scopes: ['runtime.send'], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-active' },
-    );
-    await expect(
-      service.executeGrant({ ...grant }, 'runtime.send', undefined, adapter),
-    ).rejects.toThrow();
-    await expect(
-      service.executeGrant(
-        { ...grant, bindingId: 'other-binding' },
-        'runtime.send',
-        undefined,
-        adapter,
-      ),
-    ).rejects.toThrow();
-    await expect(
-      service.issueGrant(
-        { lease: active, scopes: ['runtime.send'], ttlMs: 30_000 },
-        {
-          actorScope: { userId: 'operator-b', tenantId: 'tenant-b' },
-          correlationId: 'correlation-cross-tenant',
-        },
-      ),
-    ).rejects.toThrow();
-    const crossTenantAudit = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-cross-tenant'));
-    expect(crossTenantAudit).toHaveLength(1);
-    expect(crossTenantAudit[0]).toMatchObject({
-      tenantId: 'tenant-b',
-      logicalAgentId: 'untrusted',
-      bindingId: 'untrusted',
-      connectorId: 'untrusted',
-      reason: 'policy_denied',
-    });
-
-    vi.setSystemTime(new Date('2026-07-14T17:00:02.000Z'));
-    await expect(service.executeGrant(grant, 'runtime.send', undefined, adapter)).rejects.toThrow();
-    expect(adapter.execute).not.toHaveBeenCalled();
-  });
-
-  it('rejects submitted lifecycle scopes that differ from durable authority before policy or mutation', async (): Promise<void> => {
-    authorize.mockResolvedValue(true);
-    const heartbeatLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-heartbeat-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-heartbeat-scope-setup' },
-    );
-    const releaseLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-release-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-release-scope-setup' },
-    );
-    const forgedHeartbeat = { ...heartbeatLease, scopes: ['tool.execute'] };
-    const forgedRelease = { ...releaseLease, scopes: ['tool.execute'] };
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'tool.execute';
-    });
-    authorize.mockClear();
-
-    await expect(
-      service.heartbeat(forgedHeartbeat, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    await expect(
-      service.release(forgedRelease, {
-        ...context,
-        correlationId: 'correlation-release-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    expect(authorize).not.toHaveBeenCalled();
-
-    const currentHeartbeat = await repository.findCurrent({
-      identity: heartbeatLease.identity,
-      bindingId: heartbeatLease.bindingId,
-    });
-    const currentRelease = await repository.findCurrent({
-      identity: releaseLease.identity,
-      bindingId: releaseLease.bindingId,
-    });
-    expect(currentHeartbeat).toMatchObject({
-      leaseId: heartbeatLease.leaseId,
-      scopes: ['runtime.send'],
-      heartbeatAt: heartbeatLease.heartbeatAt,
-      expiresAt: heartbeatLease.expiresAt,
-    });
-    expect(currentRelease).toMatchObject({
-      leaseId: releaseLease.leaseId,
-      scopes: ['runtime.send'],
-    });
-    expect(currentRelease?.releasedAt).toBeUndefined();
-
-    const forgedAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-heartbeat-scope-forgery'));
-    expect(forgedAudits).toHaveLength(1);
-    expect(forgedAudits[0]).toMatchObject({
-      bindingId: heartbeatLease.bindingId,
-      connectorId: heartbeatLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-    const forgedReleaseAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-release-scope-forgery'));
-    expect(forgedReleaseAudits).toHaveLength(1);
-    expect(forgedReleaseAudits[0]).toMatchObject({
-      bindingId: releaseLease.bindingId,
-      connectorId: releaseLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'runtime.send';
-    });
-    await expect(
-      service.heartbeat(heartbeatLease, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-canonical',
-      }),
-    ).resolves.toMatchObject({ scopes: ['runtime.send'] });
-    await expect(
-      service.release(releaseLease, {
-        ...context,
-        correlationId: 'correlation-release-scope-canonical',
-      }),
-    ).resolves.toBeUndefined();
-  });
-});

apps/gateway/src/agent/connector-lease.postgres.integration.test.ts

@@ -1,76 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createDb,
-  eq,
-  logicalAgentConnectorLeases,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const hasPostgres = Boolean(process.env['DATABASE_URL']);
-const tenantId = `lease-test-${randomUUID()}`;
-const identity = { tenantId, logicalAgentId: 'mos' } as const;
-
-describe.skipIf(!hasPostgres)('ConnectorLeaseRepository real PostgreSQL integration', (): void => {
-  let handle: DbHandle;
-
-  beforeAll((): void => {
-    handle = createDb(process.env['DATABASE_URL']);
-  });
-
-  afterAll(async (): Promise<void> => {
-    if (!handle) return;
-    await handle.db
-      .delete(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, tenantId));
-    await handle.db
-      .delete(logicalAgentConnectorLeases)
-      .where(eq(logicalAgentConnectorLeases.tenantId, tenantId));
-    await handle.close();
-  });
-
-  it('preserves the exclusive CAS fence across a real pool close/reopen', async (): Promise<void> => {
-    const command = {
-      identity,
-      bindingId: 'operator-chat',
-      scopes: ['runtime.send'],
-      ttlMs: 60_000,
-    } as const;
-    const firstCoordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const contenders = await Promise.allSettled([
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-a',
-        correlationId: 'postgres-acquire-a',
-      }),
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-b',
-        correlationId: 'postgres-acquire-b',
-      }),
-    ]);
-    const acquired = contenders.find((result) => result.status === 'fulfilled');
-    if (!acquired || acquired.status !== 'fulfilled') throw new Error('no lease contender won');
-    expect(contenders.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-
-    await handle.close();
-    handle = createDb(process.env['DATABASE_URL']);
-    const reopened = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const persisted = await reopened.current({ identity, bindingId: 'operator-chat' });
-    expect(persisted).toMatchObject({
-      leaseId: acquired.value.leaseId,
-      leaseEpoch: '1',
-    });
-
-    const takeover = await reopened.takeover({
-      ...command,
-      connectorId: 'connector-c',
-      correlationId: 'postgres-takeover',
-      expectedEpoch: acquired.value.leaseEpoch,
-    });
-    expect(takeover).toMatchObject({ connectorId: 'connector-c', leaseEpoch: '2' });
-  });
-});

apps/gateway/src/agent/connector-lease.repository.test.ts

@@ -1,149 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator, ConnectorLeaseError } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const identity = { tenantId: 'tenant-a', logicalAgentId: 'mos' } as const;
-
-function acquireCommand(connectorId: string, correlationId: string) {
-  return {
-    identity,
-    bindingId: 'operator-chat',
-    connectorId,
-    scopes: ['runtime.send', 'tool.execute'],
-    ttlMs: 60_000,
-    correlationId,
-  };
-}
-
-describe('ConnectorLeaseRepository PostgreSQL semantics', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let now: Date;
-  let coordinator: ConnectorLeaseCoordinator;
-
-  beforeEach(async (): Promise<void> => {
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    now = new Date('2026-07-14T17:00:00.000Z');
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-  });
-
-  afterEach(async (): Promise<void> => {
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('allows only one concurrent contender to acquire a binding', async (): Promise<void> => {
-    const outcomes = await Promise.allSettled([
-      coordinator.acquire(acquireCommand('connector-a', 'correlation-a')),
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-b')),
-    ]);
-
-    expect(outcomes.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    const rejected = outcomes.find((result) => result.status === 'rejected');
-    expect(rejected).toMatchObject({
-      reason: { code: 'lease_held' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('uses compare-and-swap takeover and increments the fencing epoch monotonically', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    const results = await Promise.allSettled([
-      coordinator.takeover({
-        ...acquireCommand('connector-b', 'correlation-b'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-      coordinator.takeover({
-        ...acquireCommand('connector-c', 'correlation-c'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-    ]);
-    const winner = results.find((result) => result.status === 'fulfilled');
-
-    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    expect(winner?.status === 'fulfilled' ? winner.value.leaseEpoch : null).toBe('2');
-    expect(results.find((result) => result.status === 'rejected')).toMatchObject({
-      reason: { code: 'cas_mismatch' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('heartbeats and releases only the current connector epoch', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    now = new Date('2026-07-14T17:00:30.000Z');
-    const renewed = await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 120_000,
-      correlationId: 'correlation-renew',
-    });
-    expect(renewed.expiresAt).toBe('2026-07-14T17:02:30.000Z');
-
-    await coordinator.release({ lease: renewed, correlationId: 'correlation-release' });
-    await expect(
-      coordinator.heartbeat({
-        lease: renewed,
-        ttlMs: 120_000,
-        correlationId: 'correlation-stale',
-      }),
-    ).rejects.toMatchObject({ code: 'lease_released' } satisfies Partial<ConnectorLeaseError>);
-  });
-
-  it('survives close/reopen and requires CAS takeover to recover an expired lease', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await handle.close();
-
-    now = new Date('2026-07-14T17:02:00.000Z');
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-plain-acquire')),
-    ).rejects.toMatchObject({ code: 'takeover_required' } satisfies Partial<ConnectorLeaseError>);
-    const recovered = await coordinator.takeover({
-      ...acquireCommand('connector-b', 'correlation-takeover'),
-      expectedEpoch: acquired.leaseEpoch,
-    });
-    expect(recovered).toMatchObject({ connectorId: 'connector-b', leaseEpoch: '2' });
-  });
-
-  it('writes credential-safe lifecycle and rejection audit records', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 60_000,
-      correlationId: 'correlation-renew',
-    });
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-reject')),
-    ).rejects.toBeInstanceOf(ConnectorLeaseError);
-
-    const rows = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, identity.tenantId));
-    expect(rows.map((row) => row.event)).toEqual(
-      expect.arrayContaining(['acquire', 'renew', 'reject']),
-    );
-    const serialized = JSON.stringify(rows, (_key: string, value: unknown): unknown =>
-      typeof value === 'bigint' ? value.toString(10) : value,
-    );
-    expect(serialized).not.toContain('tool.execute');
-    expect(serialized).not.toContain('runtime.send');
-    expect(serialized).not.toMatch(/token|secret|credential/i);
-  });
-});

apps/gateway/src/agent/connector-lease.repository.ts

@@ -1,354 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  connectorLeaseAuditLog,
-  eq,
-  gt,
-  isNull,
-  logicalAgentConnectorLeases,
-  sql,
-  type Db,
-} from '@mosaicstack/db';
-import { ConnectorLeaseError } from '@mosaicstack/agent';
-import type {
-  ConnectorLease,
-  ConnectorLeaseAcquireMutation,
-  ConnectorLeaseAuditEvent,
-  ConnectorLeaseHeartbeatMutation,
-  ConnectorLeaseRejectReason,
-  ConnectorLeaseReleaseMutation,
-  ConnectorLeaseStore,
-  ConnectorLeaseTakeoverMutation,
-  LogicalAgentBinding,
-} from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-
-interface SuccessfulMutation {
-  readonly ok: true;
-  readonly lease: ConnectorLease;
-}
-
-interface FailedMutation {
-  readonly ok: false;
-  readonly reason: ConnectorLeaseRejectReason;
-}
-
-type MutationResult = SuccessfulMutation | FailedMutation;
-
-@Injectable()
-export class ConnectorLeaseRepository implements ConnectorLeaseStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async acquire(input: ConnectorLeaseAcquireMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const inserted = await tx
-          .insert(logicalAgentConnectorLeases)
-          .values({
-            leaseId: input.leaseId,
-            tenantId: input.identity.tenantId,
-            logicalAgentId: input.identity.logicalAgentId,
-            bindingId: input.bindingId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: 1n,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .onConflictDoNothing()
-          .returning();
-        const row = inserted[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'acquire'));
-          return { ok: true, lease };
-        }
-
-        const current = await findRow(tx, input);
-        if (current && current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const reason: ConnectorLeaseRejectReason =
-          current && (current.releasedAt || current.expiresAt <= new Date(input.now))
-            ? 'takeover_required'
-            : 'lease_held';
-        await insertAudit(tx, rejectionAudit(input, current ? toLease(current) : null, reason));
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async takeover(input: ConnectorLeaseTakeoverMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const current = await findRow(tx, input);
-        if (!current || current.leaseEpoch.toString(10) !== input.expectedEpoch) {
-          await insertAudit(
-            tx,
-            rejectionAudit(input, current ? toLease(current) : null, 'cas_mismatch'),
-          );
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        if (current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            leaseId: input.leaseId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: sql`${logicalAgentConnectorLeases.leaseEpoch} + 1`,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            releasedAt: null,
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input),
-              eq(logicalAgentConnectorLeases.leaseId, current.leaseId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.expectedEpoch)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (!row) {
-          await insertAudit(tx, rejectionAudit(input, toLease(current), 'cas_mismatch'));
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        const lease = toLease(row);
-        await insertAudit(tx, lifecycleAudit(input, lease, 'takeover'));
-        return { ok: true, lease };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async heartbeat(input: ConnectorLeaseHeartbeatMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'renew'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async release(input: ConnectorLeaseReleaseMutation): Promise<void> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            releasedAt: new Date(input.now),
-            expiresAt: new Date(input.now),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'release'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    unwrap(result);
-  }
-
-  async findCurrent(binding: LogicalAgentBinding): Promise<ConnectorLease | null> {
-    const row = await findRow(this.db, binding);
-    return row ? toLease(row) : null;
-  }
-
-  async recordAudit(event: ConnectorLeaseAuditEvent): Promise<void> {
-    await insertAudit(this.db, event);
-  }
-}
-
-function unwrap(result: MutationResult): ConnectorLease {
-  if (!result.ok) throw new ConnectorLeaseError(result.reason, safeErrorMessage(result.reason));
-  return result.lease;
-}
-
-function safeErrorMessage(reason: ConnectorLeaseRejectReason): string {
-  return `Connector lease mutation denied: ${reason}`;
-}
-
-function bindingPredicate(binding: LogicalAgentBinding) {
-  return and(
-    eq(logicalAgentConnectorLeases.tenantId, binding.identity.tenantId),
-    eq(logicalAgentConnectorLeases.logicalAgentId, binding.identity.logicalAgentId),
-    eq(logicalAgentConnectorLeases.bindingId, binding.bindingId),
-  );
-}
-
-async function findRow(
-  db: Pick<Db, 'select'>,
-  binding: LogicalAgentBinding,
-): Promise<typeof logicalAgentConnectorLeases.$inferSelect | null> {
-  const rows = await db
-    .select()
-    .from(logicalAgentConnectorLeases)
-    .where(bindingPredicate(binding))
-    .limit(1);
-  return rows[0] ?? null;
-}
-
-function toLease(row: typeof logicalAgentConnectorLeases.$inferSelect): ConnectorLease {
-  return Object.freeze({
-    identity: Object.freeze({ tenantId: row.tenantId, logicalAgentId: row.logicalAgentId }),
-    bindingId: row.bindingId,
-    leaseId: row.leaseId,
-    connectorId: row.connectorId,
-    scopes: Object.freeze([...row.scopes]),
-    leaseEpoch: row.leaseEpoch.toString(10),
-    acquiredAt: row.acquiredAt.toISOString(),
-    heartbeatAt: row.heartbeatAt.toISOString(),
-    expiresAt: row.expiresAt.toISOString(),
-    ...(row.releasedAt ? { releasedAt: row.releasedAt.toISOString() } : {}),
-  });
-}
-
-function classifyAuthorityFailure(
-  current: ConnectorLease | null,
-  claimed: ConnectorLease,
-  now: string,
-): ConnectorLeaseRejectReason {
-  if (!current) return 'lease_missing';
-  if (current.releasedAt) return 'lease_released';
-  if (new Date(current.expiresAt) <= new Date(now)) return 'lease_expired';
-  if (current.leaseEpoch !== claimed.leaseEpoch) return 'stale_epoch';
-  return 'connector_mismatch';
-}
-
-function lifecycleAudit(
-  input: { readonly correlationId: string; readonly now: string },
-  lease: ConnectorLease,
-  event: Exclude<ConnectorLeaseAuditEvent['event'], 'reject'>,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: lease.identity,
-    bindingId: lease.bindingId,
-    connectorId: lease.connectorId,
-    leaseId: lease.leaseId,
-    leaseEpoch: lease.leaseEpoch,
-    event,
-    outcome: 'succeeded',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-  };
-}
-
-function rejectionAudit(
-  input: {
-    readonly identity: ConnectorLease['identity'];
-    readonly bindingId: string;
-    readonly connectorId: string;
-    readonly correlationId: string;
-    readonly now: string;
-  },
-  current: ConnectorLease | null,
-  reason: ConnectorLeaseRejectReason,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: input.identity,
-    bindingId: input.bindingId,
-    connectorId: input.connectorId,
-    event: 'reject',
-    outcome: 'denied',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-    ...(current ? { leaseId: current.leaseId, leaseEpoch: current.leaseEpoch } : {}),
-    reason,
-  };
-}
-
-async function insertAudit(db: Pick<Db, 'insert'>, event: ConnectorLeaseAuditEvent): Promise<void> {
-  await db.insert(connectorLeaseAuditLog).values({
-    tenantId: event.identity.tenantId,
-    logicalAgentId: event.identity.logicalAgentId,
-    bindingId: event.bindingId,
-    connectorId: event.connectorId,
-    ...(event.leaseId ? { leaseId: event.leaseId } : {}),
-    ...(event.leaseEpoch ? { leaseEpoch: BigInt(event.leaseEpoch) } : {}),
-    event: event.event,
-    outcome: event.outcome,
-    ...(event.reason ? { reason: event.reason } : {}),
-    correlationId: event.correlationId,
-    occurredAt: new Date(event.occurredAt),
-  });
-}

apps/gateway/src/agent/connector-lease.service.ts

@@ -1,285 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { ConnectorLeaseCoordinator, normalizeConnectorLease } from '@mosaicstack/agent';
-import {
-  normalizeConnectorId,
-  normalizeConnectorScopes,
-  normalizeCorrelationId,
-  normalizeLogicalAgentIdentity,
-  normalizeLogicalBindingId,
-  type AcquireConnectorLeaseInput,
-  type ConnectorExecutionGrant,
-  type ConnectorLease,
-  type ConnectorLeaseAuditEvent,
-  type FencedConnectorAdapter,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-export const CONNECTOR_LEASE_POLICY = Symbol('CONNECTOR_LEASE_POLICY');
-
-export type ConnectorLeasePolicyAction =
-  | 'lease.acquire'
-  | 'lease.takeover'
-  | 'lease.heartbeat'
-  | 'lease.release'
-  | 'lease.read'
-  | 'grant.issue';
-
-export interface ConnectorLeaseRequestContext {
-  readonly actorScope: ActorTenantScope;
-  readonly correlationId: string;
-}
-
-export interface GatewayConnectorLeaseRequest {
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface GatewayConnectorLeaseTakeoverRequest extends GatewayConnectorLeaseRequest {
-  readonly expectedEpoch: string;
-}
-
-export interface GatewayConnectorGrantRequest {
-  readonly lease: ConnectorLease;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface ConnectorLeasePolicySubject {
-  readonly action: ConnectorLeasePolicyAction;
-  readonly actorId: string;
-  readonly tenantId: string;
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly requestedScopes: readonly string[];
-  readonly requestedTtlMs: number | null;
-}
-
-export interface ConnectorLeasePolicy {
-  authorize(subject: ConnectorLeasePolicySubject): Promise<boolean>;
-}
-
-/** M1 has no concrete cutover policy: unconfigured production use fails closed. */
-@Injectable()
-export class DenyConnectorLeasePolicy implements ConnectorLeasePolicy {
-  async authorize(_subject: ConnectorLeasePolicySubject): Promise<boolean> {
-    return false;
-  }
-}
-
-/** Gateway-owned policy surface for durable connector authority and fenced effects. */
-@Injectable()
-export class ConnectorLeaseService {
-  private readonly coordinator: ConnectorLeaseCoordinator;
-
-  constructor(
-    @Inject(ConnectorLeaseRepository) private readonly repository: ConnectorLeaseRepository,
-    @Inject(CONNECTOR_LEASE_POLICY) private readonly policy: ConnectorLeasePolicy,
-  ) {
-    this.coordinator = new ConnectorLeaseCoordinator(repository);
-  }
-
-  async acquire(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.acquire', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.acquire({ ...command, correlationId: this.correlation(context) });
-  }
-
-  async takeover(
-    request: GatewayConnectorLeaseTakeoverRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.takeover', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.takeover({
-      ...command,
-      expectedEpoch: request.expectedEpoch,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async heartbeat(
-    lease: ConnectorLease,
-    ttlMs: number,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.heartbeat', durableLease, context, durableLease.scopes, ttlMs);
-    return this.coordinator.heartbeat({
-      lease: durableLease,
-      ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async release(lease: ConnectorLease, context: ConnectorLeaseRequestContext): Promise<void> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.release', durableLease, context, durableLease.scopes, null);
-    await this.coordinator.release({
-      lease: durableLease,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async current(
-    logicalAgentId: string,
-    bindingId: string,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease | null> {
-    const binding = {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(bindingId),
-      connectorId: 'gateway',
-    };
-    await this.assertPolicy('lease.read', binding, context, [], null);
-    return this.coordinator.current(binding);
-  }
-
-  async issueGrant(
-    request: GatewayConnectorGrantRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorExecutionGrant> {
-    const lease = normalizeConnectorLease(request.lease);
-    await this.assertTenant(lease, context);
-    const scopes = normalizeConnectorScopes(request.scopes);
-    await this.assertPolicy('grant.issue', lease, context, scopes, request.ttlMs);
-    return this.coordinator.issueGrant({
-      lease,
-      scopes,
-      ttlMs: request.ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async executeGrant<TInput, TOutput>(
-    grant: ConnectorExecutionGrant,
-    requiredScope: string,
-    input: TInput,
-    adapter: FencedConnectorAdapter<TInput, TOutput>,
-  ): Promise<TOutput> {
-    return this.coordinator.executeGrant(grant, requiredScope, input, adapter);
-  }
-
-  private command(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Omit<AcquireConnectorLeaseInput, 'correlationId'> {
-    return {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId: request.logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(request.bindingId),
-      connectorId: normalizeConnectorId(request.connectorId),
-      scopes: normalizeConnectorScopes(request.scopes),
-      ttlMs: request.ttlMs,
-    };
-  }
-
-  private async assertTenant(
-    lease: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    if (lease.identity.tenantId !== context.actorScope.tenantId) {
-      await this.recordPolicyDenial(
-        {
-          identity: {
-            tenantId: context.actorScope.tenantId,
-            logicalAgentId: 'untrusted',
-          },
-          bindingId: 'untrusted',
-          connectorId: 'untrusted',
-        },
-        context,
-      );
-      throw new ForbiddenException('Connector authority tenant scope denied');
-    }
-  }
-
-  private async durableLifecycleLease(
-    submittedLease: ConnectorLease,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    await this.assertTenant(submittedLease, context);
-    const durableLease = await this.coordinator.current(submittedLease);
-    if (!durableLease || !hasSameLifecycleAuthority(submittedLease, durableLease)) {
-      await this.recordPolicyDenial(durableLease ?? submittedLease, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-    return durableLease;
-  }
-
-  private async assertPolicy(
-    action: ConnectorLeasePolicyAction,
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-    requestedScopes: readonly string[],
-    requestedTtlMs: number | null,
-  ): Promise<void> {
-    const allowed = await this.policy.authorize({
-      action,
-      actorId: context.actorScope.userId,
-      tenantId: subject.identity.tenantId,
-      logicalAgentId: subject.identity.logicalAgentId,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      requestedScopes: Object.freeze([...requestedScopes]),
-      requestedTtlMs,
-    });
-    if (!allowed) {
-      await this.recordPolicyDenial(subject, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-  }
-
-  private async recordPolicyDenial(
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    const event: ConnectorLeaseAuditEvent = {
-      identity: subject.identity,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-      correlationId: this.correlation(context),
-      occurredAt: new Date().toISOString(),
-    };
-    await this.repository.recordAudit(event);
-  }
-
-  private correlation(context: ConnectorLeaseRequestContext): string {
-    return normalizeCorrelationId(context.correlationId);
-  }
-}
-
-function hasSameLifecycleAuthority(
-  submittedLease: ConnectorLease,
-  durableLease: ConnectorLease,
-): boolean {
-  return (
-    submittedLease.identity.tenantId === durableLease.identity.tenantId &&
-    submittedLease.identity.logicalAgentId === durableLease.identity.logicalAgentId &&
-    submittedLease.bindingId === durableLease.bindingId &&
-    submittedLease.leaseId === durableLease.leaseId &&
-    submittedLease.connectorId === durableLease.connectorId &&
-    submittedLease.leaseEpoch === durableLease.leaseEpoch &&
-    submittedLease.scopes.length === durableLease.scopes.length &&
-    submittedLease.scopes.every((scope: string, index: number): boolean => {
-      return scope === durableLease.scopes[index];
-    })
-  );
-}

apps/gateway/src/agent/routing/routing-e2e.test.ts

@@ -8,7 +8,6 @@
  * to avoid real I/O — they verify the complete classify → match → decide path.
  */
 import { describe, it, expect, vi } from 'vitest';
-import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { RoutingEngineService } from './routing-engine.service.js';
 import { DEFAULT_ROUTING_RULES } from '../routing/default-rules.js';
 import type { RoutingRule } from './routing.types.js';
@@ -18,7 +17,7 @@ import type { RoutingRule } from './routing.types.js';
 /** Build a RoutingEngineService backed by the given rule set and health map. */
 function makeService(
   rules: RoutingRule[],
-  healthMap: Record<string, { status: ProviderHealthStatus }>,
+  healthMap: Record<string, { status: string }>,
 ): RoutingEngineService {
   const mockDb = {
     select: vi.fn().mockReturnValue({
@@ -68,11 +67,11 @@ function defaultRules(): RoutingRule[] {
 }
 
 /** A health map where anthropic, openai, and zai are all healthy. */
-const allHealthy: Record<string, { status: ProviderHealthStatus }> = {
-  anthropic: { status: 'healthy' },
-  openai: { status: 'healthy' },
-  zai: { status: 'healthy' },
-  ollama: { status: 'healthy' },
+const allHealthy: Record<string, { status: string }> = {
+  anthropic: { status: 'up' },
+  openai: { status: 'up' },
+  zai: { status: 'up' },
+  ollama: { status: 'up' },
 };
 
 // ─── M4-013 E2E tests ─────────────────────────────────────────────────────────
@@ -213,10 +212,10 @@ describe('M4-013: routing end-to-end pipeline', () => {
     // Let's use a simple coding message to target Simple coding → Codex (openai)
     const message = 'implement a sort function';
 
-    const unhealthyHealth: Record<string, { status: ProviderHealthStatus }> = {
+    const unhealthyHealth = {
       anthropic: { status: 'down' },
-      openai: { status: 'healthy' },
-      zai: { status: 'healthy' },
+      openai: { status: 'up' },
+      zai: { status: 'up' },
       ollama: { status: 'down' },
     };
 

apps/gateway/src/agent/routing/routing-engine.service.ts

@@ -1,6 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { routingRules, type Db, and, asc, eq, or } from '@mosaicstack/db';
-import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { DB } from '../../database/database.module.js';
 import { ProviderService } from '../provider.service.js';
 import { classifyTask } from './task-classifier.js';
@@ -50,7 +49,7 @@ export class RoutingEngineService {
   async resolve(
     message: string,
     userId?: string,
-    availableProviders?: Record<string, { status: ProviderHealthStatus }>,
+    availableProviders?: Record<string, { status: string }>,
   ): Promise<RoutingDecision> {
     const classification = classifyTask(message);
     this.logger.debug(
@@ -70,8 +69,9 @@ export class RoutingEngineService {
       if (!this.matchConditions(rule, classification)) continue;
 
       const providerStatus = health[rule.action.provider]?.status;
+      const isHealthy = providerStatus === 'up' || providerStatus === 'ok';
 
-      if (!this.isRoutable(providerStatus)) {
+      if (!isHealthy) {
         this.logger.debug(
           `Rule "${rule.name}" matched but provider "${rule.action.provider}" is unhealthy (status: ${providerStatus ?? 'unknown'})`,
         );
@@ -111,10 +111,6 @@ export class RoutingEngineService {
 
   // ─── Private helpers ───────────────────────────────────────────────────────
 
-  private isRoutable(status: ProviderHealthStatus | undefined): boolean {
-    return status === 'healthy' || status === 'degraded';
-  }
-
   private evaluateCondition(
     condition: RoutingCondition,
     classification: TaskClassification,
@@ -190,12 +186,11 @@ export class RoutingEngineService {
    * Walk the fallback chain and return the first healthy provider/model pair.
    * If none are healthy, return the first entry unconditionally (last resort).
    */
-  private applyFallbackChain(
-    health: Record<string, { status: ProviderHealthStatus }>,
-  ): RoutingDecision {
+  private applyFallbackChain(health: Record<string, { status: string }>): RoutingDecision {
     for (const candidate of FALLBACK_CHAIN) {
       const providerStatus = health[candidate.provider]?.status;
-      if (this.isRoutable(providerStatus)) {
+      const isHealthy = providerStatus === 'up' || providerStatus === 'ok';
+      if (isHealthy) {
         this.logger.debug(`Fallback resolved: ${candidate.provider}/${candidate.model}`);
         return {
           provider: candidate.provider,

apps/gateway/src/agent/routing/routing-engine.test.ts

@@ -1,5 +1,4 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ProviderHealthStatus } from '@mosaicstack/types';
 import { RoutingEngineService } from './routing-engine.service.js';
 import type { RoutingRule, TaskClassification } from './routing.types.js';
 
@@ -30,7 +29,7 @@ function makeClassification(overrides: Partial<TaskClassification> = {}): TaskCl
 /** Build a minimal RoutingEngineService with mocked DB and ProviderService. */
 function makeService(
   rules: RoutingRule[] = [],
-  healthMap: Record<string, { status: ProviderHealthStatus }> = {},
+  healthMap: Record<string, { status: string }> = {},
 ): RoutingEngineService {
   const mockDb = {
     select: vi.fn().mockReturnValue({
@@ -218,10 +217,7 @@ describe('RoutingEngineService.resolve — priority ordering', () => {
       }),
     ];
 
-    const service = makeService(rules, {
-      anthropic: { status: 'healthy' },
-      openai: { status: 'healthy' },
-    });
+    const service = makeService(rules, { anthropic: { status: 'up' }, openai: { status: 'up' } });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('high priority');
@@ -245,10 +241,7 @@ describe('RoutingEngineService.resolve — priority ordering', () => {
       }),
     ];
 
-    const service = makeService(rules, {
-      anthropic: { status: 'healthy' },
-      openai: { status: 'healthy' },
-    });
+    const service = makeService(rules, { anthropic: { status: 'up' }, openai: { status: 'up' } });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('coding rule');
@@ -277,7 +270,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
 
     const service = makeService(rules, {
       anthropic: { status: 'down' }, // primary is unhealthy
-      openai: { status: 'healthy' },
+      openai: { status: 'up' },
     });
 
     const decision = await service.resolve('implement a function');
@@ -297,7 +290,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
     ];
 
     const service2 = makeService(unhealthyRules, {
-      anthropic: { status: 'healthy' },
+      anthropic: { status: 'up' },
       openai: { status: 'down' },
     });
 
@@ -313,7 +306,7 @@ describe('RoutingEngineService.resolve — unhealthy provider handling', () => {
 
     const service = makeService(rules, {
       anthropic: { status: 'down' }, // Sonnet is on anthropic — down
-      ollama: { status: 'healthy' }, // Haiku is also on anthropic — use Ollama as next
+      ollama: { status: 'up' }, // Haiku is also on anthropic — use Ollama as next
     });
 
     const decision = await service.resolve('hello there');
@@ -352,7 +345,7 @@ describe('RoutingEngineService.resolve — empty conditions (fallback rule)', ()
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'healthy' } });
+    const service = makeService(rules, { anthropic: { status: 'up' } });
 
     const decision = await service.resolve('completely unrelated message xyz');
     expect(decision.ruleName).toBe('catch-all');
@@ -376,7 +369,7 @@ describe('RoutingEngineService.resolve — empty conditions (fallback rule)', ()
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'healthy' } });
+    const service = makeService(rules, { anthropic: { status: 'up' } });
 
     const codingDecision = await service.resolve('implement a function');
     expect(codingDecision.ruleName).toBe('specific coding rule');
@@ -408,7 +401,7 @@ describe('RoutingEngineService.resolve — disabled rules', () => {
       }),
     ];
 
-    const service = makeService(rules, { anthropic: { status: 'healthy' } });
+    const service = makeService(rules, { anthropic: { status: 'up' } });
 
     const decision = await service.resolve('implement a function');
     expect(decision.ruleName).toBe('enabled fallback');
@@ -459,45 +452,9 @@ describe('RoutingEngineService.resolve — availableProviders override', () => {
       ps: unknown,
     ) => RoutingEngineService)(mockDb, mockProviderService);
 
-    const preSupplied: Record<string, { status: ProviderHealthStatus }> = {
-      anthropic: { status: 'healthy' },
-    };
+    const preSupplied = { anthropic: { status: 'up' } };
     await service.resolve('implement a function', undefined, preSupplied);
 
     expect(mockHealthCheckAll).not.toHaveBeenCalled();
   });
 });
-
-// ─── resolve — canonical ProviderHealthStatus values ──────────────────────────
-
-describe('RoutingEngineService.resolve — canonical health status routing', () => {
-  it('routes healthy and degraded providers by rule, and falls through to fallback when down', async () => {
-    const codingRule = makeRule({
-      name: 'coding rule',
-      priority: 1,
-      conditions: [{ field: 'taskType', operator: 'eq', value: 'coding' }],
-      action: { provider: 'openai', model: 'gpt-4o' },
-    });
-
-    // healthy → selected by its own rule, not the fallback chain
-    const healthyService = makeService([codingRule], { openai: { status: 'healthy' } });
-    const healthyDecision = await healthyService.resolve('implement a function');
-    expect(healthyDecision.ruleName).toBe('coding rule');
-    expect(healthyDecision.provider).toBe('openai');
-
-    // down → rule is skipped as unroutable, falls through to the fallback chain
-    const downService = makeService([codingRule], {
-      openai: { status: 'down' },
-      anthropic: { status: 'healthy' },
-    });
-    const downDecision = await downService.resolve('implement a function');
-    expect(downDecision.ruleName).toBe('fallback');
-    expect(downDecision.provider).toBe('anthropic');
-
-    // degraded → still routable, selected by its own rule, not the fallback chain
-    const degradedService = makeService([codingRule], { openai: { status: 'degraded' } });
-    const degradedDecision = await degradedService.resolve('implement a function');
-    expect(degradedDecision.ruleName).toBe('coding rule');
-    expect(degradedDecision.provider).toBe('openai');
-  });
-});

apps/gateway/src/agent/tools/delivery-tools.test.ts

@@ -1,210 +0,0 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import { createFileTools } from './file-tools.js';
-import { createShellTools, createShellToolsIfEnabled } from './shell-tools.js';
-import {
-  createDeliveryTools,
-  type DeliveryToolEnvironment,
-  type ProcessResult,
-  type ProcessRunner,
-} from './delivery-tools.js';
-
-const tempDirs: string[] = [];
-
-function tempDir(prefix: string): string {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-  tempDirs.push(dir);
-  return dir;
-}
-
-function textOf(result: unknown): string {
-  const typed = result as { content: Array<{ text: string }> };
-  return typed.content.map((item) => item.text).join('\n');
-}
-
-async function execute(tool: ToolDefinition, params: Record<string, unknown>): Promise<unknown> {
-  return (
-    tool.execute as unknown as (id: string, input: Record<string, unknown>) => Promise<unknown>
-  )('test-call', params);
-}
-
-function ok(stdout = ''): ProcessResult {
-  return { exitCode: 0, stdout, stderr: '', timedOut: false };
-}
-
-function deliveryEnv(extra: Partial<DeliveryToolEnvironment> = {}): DeliveryToolEnvironment {
-  return {
-    AGENT_DELIVERY_ENABLED: 'true',
-    MOSAIC_GIT_TOOLS_DIR: '/opt/mosaic/tools/git',
-    MOSAIC_GIT_IDENTITY: 'code-dogfood-01',
-    MOSAIC_AGENT_NAME: 'code-dogfood-01',
-    MOSAIC_BRAIN_HOME: '/opt/mosaic/brain',
-    MOSAIC_INTEGRATION_TRUNK: 'next',
-    HOME: '/home/node',
-    PATH: '/usr/bin:/bin',
-    ...extra,
-  };
-}
-
-afterEach(() => {
-  for (const dir of tempDirs.splice(0)) {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-describe('dogfood execution boundary', () => {
-  it('removes shell_exec mechanically while its first-token bypass red control stays live', async () => {
-    const sandbox = tempDir('mosaic-shell-boundary-');
-    expect(createShellToolsIfEnabled(sandbox, { AGENT_SHELL_ENABLED: 'false' })).toEqual([]);
-
-    const redControl = createShellTools(sandbox)[0]!;
-    const result = await execute(redControl, { command: 'env printf FIRST_TOKEN_BYPASS' });
-    expect(textOf(result)).toContain('FIRST_TOKEN_BYPASS');
-  });
-
-  it('refuses an outside-sandbox token-shaped read and proves the path guard is the enforcement', async () => {
-    const root = tempDir('mosaic-file-boundary-');
-    const sandbox = path.join(root, 'workspace', 'stack');
-    const token = path.join(
-      root,
-      'brain',
-      'fleet',
-      'agents',
-      'code-dogfood-01',
-      'secrets',
-      'gitea-mosaicstack-code-dogfood-01.token',
-    );
-    fs.mkdirSync(sandbox, { recursive: true });
-    fs.mkdirSync(path.dirname(token), { recursive: true });
-    fs.writeFileSync(token, 'OUTSIDE_SANDBOX_SENTINEL');
-
-    const read = createFileTools(sandbox).find((tool) => tool.name === 'fs_read_file')!;
-    const refused = await execute(read, { path: token });
-    expect(textOf(refused)).toContain('Path escape attempt blocked');
-    expect(textOf(refused)).not.toContain('OUTSIDE_SANDBOX_SENTINEL');
-
-    fs.symlinkSync(token, path.join(sandbox, 'credential.token'));
-    const symlinkRefused = await execute(read, { path: 'credential.token' });
-    expect(textOf(symlinkRefused)).toContain('Path escape attempt blocked');
-    expect(textOf(symlinkRefused)).not.toContain('OUTSIDE_SANDBOX_SENTINEL');
-
-    const redRead = createFileTools(root).find((tool) => tool.name === 'fs_read_file')!;
-    const redControl = await execute(redRead, { path: token });
-    expect(textOf(redControl)).toContain('OUTSIDE_SANDBOX_SENTINEL');
-  });
-});
-
-describe('delivery tools', () => {
-  it('stay absent unless explicitly enabled and reject identity mismatch', () => {
-    const sandbox = tempDir('mosaic-delivery-disabled-');
-    expect(createDeliveryTools(sandbox, {})).toEqual([]);
-    expect(() =>
-      createDeliveryTools(sandbox, deliveryEnv({ MOSAIC_AGENT_NAME: 'another-seat' })),
-    ).toThrow('matching safe MOSAIC agent and git identities');
-  });
-
-  it('publishes through execFile-only git and queue operations with a scrubbed environment', async () => {
-    const sandbox = tempDir('mosaic-delivery-publish-');
-    fs.writeFileSync(path.join(sandbox, 'change.md'), 'change');
-    const calls: Array<{ file: string; args: readonly string[]; env: NodeJS.ProcessEnv }> = [];
-    const runner: ProcessRunner = async (file, args, options) => {
-      calls.push({ file, args, env: options.env });
-      if (args[0] === 'branch') return ok('feat/1487-dogfood-proof\n');
-      return ok();
-    };
-    const hostile = {
-      ...deliveryEnv(),
-      BASH_ENV: '/tmp/injected',
-      'BASH_FUNC_read%%': '() { :; }',
-      GITEA_TOKEN: 'must-not-cross',
-    } as DeliveryToolEnvironment;
-    const publish = createDeliveryTools(sandbox, hostile, runner).find(
-      (tool) => tool.name === 'git_publish_branch',
-    )!;
-
-    const result = await execute(publish, {
-      issue: 1487,
-      paths: ['change.md'],
-      commitMessage: 'docs: dogfood proof (#1487)',
-    });
-    expect(textOf(result)).toBe('Published branch feat/1487-dogfood-proof as code-dogfood-01.');
-
-    expect(calls.map((call) => call.file)).toEqual([
-      '/usr/bin/git',
-      '/usr/bin/git',
-      '/usr/bin/git',
-      '/opt/mosaic/tools/git/ci-queue-wait.sh',
-      '/usr/bin/git',
-    ]);
-    expect(calls[3]!.args).toEqual(['--purpose', 'push', '-B', 'feat/1487-dogfood-proof']);
-    expect(calls[4]!.args).toEqual(['push', '--set-upstream', 'origin', 'feat/1487-dogfood-proof']);
-    for (const call of calls) {
-      expect(call.file).not.toMatch(/(?:^|\/)sh$/);
-      expect(call.env).not.toHaveProperty('BASH_ENV');
-      expect(Object.keys(call.env).some((key) => key.startsWith('BASH_FUNC_'))).toBe(false);
-      expect(call.env).not.toHaveProperty('GITEA_TOKEN');
-      expect(call.env.MOSAIC_GIT_IDENTITY).toBe('code-dogfood-01');
-    }
-  });
-
-  it('opens PRs only through pr-create.sh against next', async () => {
-    const sandbox = tempDir('mosaic-delivery-pr-');
-    const calls: Array<{ file: string; args: readonly string[] }> = [];
-    const runner: ProcessRunner = async (file, args) => {
-      calls.push({ file, args });
-      if (args[0] === 'branch') return ok('feat/1487-dogfood-proof\n');
-      return ok('https://git.mosaicstack.dev/mosaicstack/stack/pulls/999\n');
-    };
-    const openPr = createDeliveryTools(sandbox, deliveryEnv(), runner).find(
-      (tool) => tool.name === 'git_open_pull_request',
-    )!;
-
-    const result = await execute(openPr, {
-      issue: 1487,
-      title: 'docs: dogfood proof',
-      body: 'Measured from the in-stack agent.',
-    });
-    expect(textOf(result)).toContain('/pulls/999');
-    expect(calls[1]!.file).toBe('/opt/mosaic/tools/git/pr-create.sh');
-    expect(calls[1]!.args).toEqual([
-      '-t',
-      'docs: dogfood proof',
-      '-b',
-      'Measured from the in-stack agent.',
-      '-B',
-      'next',
-      '-H',
-      'feat/1487-dogfood-proof',
-      '-i',
-      '1487',
-    ]);
-  });
-
-  it('blocks publish paths outside the sandbox before staging', async () => {
-    const root = tempDir('mosaic-delivery-path-');
-    const sandbox = path.join(root, 'sandbox');
-    const outside = path.join(root, 'outside.md');
-    fs.mkdirSync(sandbox);
-    fs.writeFileSync(outside, 'OUTSIDE_DELIVERY_SENTINEL');
-    const calls: Array<{ file: string; args: readonly string[] }> = [];
-    const runner: ProcessRunner = async (file, args) => {
-      calls.push({ file, args });
-      return args[0] === 'branch' ? ok('feat/1487-dogfood-proof\n') : ok();
-    };
-    const publish = createDeliveryTools(sandbox, deliveryEnv(), runner).find(
-      (tool) => tool.name === 'git_publish_branch',
-    )!;
-
-    const result = await execute(publish, {
-      issue: 1487,
-      paths: [outside],
-      commitMessage: 'docs: must not publish',
-    });
-    expect(textOf(result)).toContain('Path escape attempt blocked');
-    expect(textOf(result)).not.toContain('OUTSIDE_DELIVERY_SENTINEL');
-    expect(calls).toHaveLength(1);
-  });
-});

apps/gateway/src/agent/tools/delivery-tools.ts

@@ -1,282 +0,0 @@
-import { Type } from '@sinclair/typebox';
-import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-import { guardPath, SandboxEscapeError } from './path-guard.js';
-
-const PROCESS_TIMEOUT_MS = 120_000;
-const MAX_OUTPUT_BYTES = 100 * 1024;
-const SAFE_IDENTITY = /^[a-z0-9][a-z0-9-]{0,62}$/;
-const SAFE_BRANCH = /^(?:feat|fix|docs|test)\/[a-z0-9][a-z0-9._/-]*$/i;
-
-export interface ProcessResult {
-  exitCode: number | null;
-  stdout: string;
-  stderr: string;
-  timedOut: boolean;
-}
-
-export type ProcessRunner = (
-  file: string,
-  args: readonly string[],
-  options: { cwd: string; env: NodeJS.ProcessEnv; timeoutMs: number },
-) => Promise<ProcessResult>;
-
-export interface DeliveryToolEnvironment {
-  AGENT_DELIVERY_ENABLED?: string;
-  MOSAIC_GIT_TOOLS_DIR?: string;
-  MOSAIC_GIT_IDENTITY?: string;
-  MOSAIC_AGENT_NAME?: string;
-  MOSAIC_BRAIN_HOME?: string;
-  MOSAIC_CREDENTIAL_SPOOL?: string;
-  MOSAIC_CREDENTIAL_LINEAGE_FENCE?: string;
-  MOSAIC_INTEGRATION_TRUNK?: string;
-  HOME?: string;
-  PATH?: string;
-  LANG?: string;
-  LC_ALL?: string;
-}
-
-function runProcess(
-  file: string,
-  args: readonly string[],
-  options: { cwd: string; env: NodeJS.ProcessEnv; timeoutMs: number },
-): Promise<ProcessResult> {
-  return new Promise((resolve) => {
-    const child = spawn(file, [...args], {
-      cwd: options.cwd,
-      env: options.env,
-      shell: false,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    let stderr = '';
-    let timedOut = false;
-    let outputBytes = 0;
-
-    const append = (current: string, chunk: Buffer): string => {
-      const remaining = MAX_OUTPUT_BYTES - outputBytes;
-      if (remaining <= 0) return current;
-      outputBytes += chunk.length;
-      return current + chunk.subarray(0, remaining).toString();
-    };
-    child.stdout.on('data', (chunk: Buffer) => {
-      stdout = append(stdout, chunk);
-    });
-    child.stderr.on('data', (chunk: Buffer) => {
-      stderr = append(stderr, chunk);
-    });
-
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGTERM');
-    }, options.timeoutMs);
-
-    child.on('error', (error) => {
-      clearTimeout(timer);
-      resolve({ exitCode: null, stdout, stderr: `${stderr}${String(error)}`, timedOut });
-    });
-    child.on('close', (exitCode) => {
-      clearTimeout(timer);
-      resolve({ exitCode, stdout, stderr, timedOut });
-    });
-  });
-}
-
-function cleanEnvironment(env: DeliveryToolEnvironment): NodeJS.ProcessEnv {
-  const clean: NodeJS.ProcessEnv = {
-    GIT_TERMINAL_PROMPT: '0',
-  };
-  for (const key of [
-    'HOME',
-    'PATH',
-    'LANG',
-    'LC_ALL',
-    'MOSAIC_GIT_IDENTITY',
-    'MOSAIC_AGENT_NAME',
-    'MOSAIC_BRAIN_HOME',
-    'MOSAIC_CREDENTIAL_SPOOL',
-    'MOSAIC_CREDENTIAL_LINEAGE_FENCE',
-  ] as const) {
-    const value = env[key];
-    if (value !== undefined) clean[key] = value;
-  }
-  return clean;
-}
-
-function textResult(text: string): {
-  content: Array<{ type: 'text'; text: string }>;
-  details: undefined;
-} {
-  return { content: [{ type: 'text', text }], details: undefined };
-}
-
-function describeFailure(label: string, result: ProcessResult): string {
-  if (result.timedOut) return `${label} timed out`;
-  const diagnostic = result.stderr.trim() || result.stdout.trim() || 'no diagnostic output';
-  return `${label} failed (exit ${result.exitCode ?? 'null'}): ${diagnostic}`;
-}
-
-function currentBranchPattern(issue: number): RegExp {
-  return new RegExp(`^(?:feat|fix|docs|test)/${issue}(?:[-/].+)$`, 'i');
-}
-
-export function createDeliveryTools(
-  sandboxDir: string,
-  sourceEnv: DeliveryToolEnvironment = process.env,
-  runner: ProcessRunner = runProcess,
-): ToolDefinition[] {
-  if (sourceEnv.AGENT_DELIVERY_ENABLED !== 'true') return [];
-
-  const identity = sourceEnv.MOSAIC_GIT_IDENTITY ?? '';
-  const agentName = sourceEnv.MOSAIC_AGENT_NAME ?? '';
-  const toolsDir = sourceEnv.MOSAIC_GIT_TOOLS_DIR ?? '';
-  const baseBranch = sourceEnv.MOSAIC_INTEGRATION_TRUNK ?? 'next';
-  if (!SAFE_IDENTITY.test(identity) || identity !== agentName) {
-    throw new Error('Delivery tools require matching safe MOSAIC agent and git identities');
-  }
-  if (!path.isAbsolute(toolsDir)) {
-    throw new Error('Delivery tools require an absolute MOSAIC_GIT_TOOLS_DIR');
-  }
-  if (!SAFE_BRANCH.test(`feat/${baseBranch}`) || baseBranch.includes('/')) {
-    throw new Error('Delivery tools require a safe integration branch name');
-  }
-
-  const env = cleanEnvironment(sourceEnv);
-  const queueGuard = path.join(toolsDir, 'ci-queue-wait.sh');
-  const prCreate = path.join(toolsDir, 'pr-create.sh');
-
-  const run = (file: string, args: readonly string[], timeoutMs = PROCESS_TIMEOUT_MS) =>
-    runner(file, args, { cwd: sandboxDir, env, timeoutMs });
-
-  const readBranch = async (): Promise<{ branch?: string; error?: string }> => {
-    const result = await run('/usr/bin/git', ['branch', '--show-current'], 15_000);
-    if (result.exitCode !== 0) return { error: describeFailure('git branch', result) };
-    const branch = result.stdout.trim();
-    if (!SAFE_BRANCH.test(branch))
-      return { error: `Unsafe delivery branch: ${branch || '<empty>'}` };
-    if (branch === baseBranch || branch === 'main') {
-      return { error: `Refusing delivery from protected branch ${branch}` };
-    }
-    return { branch };
-  };
-
-  const publish: ToolDefinition = {
-    name: 'git_publish_branch',
-    label: 'Publish Git Branch',
-    description:
-      'Stage explicit files in the current sandbox branch, commit them as the dedicated dogfood identity, run the CI queue guard, and push the branch. No shell or raw provider API is used.',
-    parameters: Type.Object({
-      issue: Type.Integer({ minimum: 1, description: 'Tracking issue number' }),
-      paths: Type.Array(Type.String(), {
-        minItems: 1,
-        maxItems: 100,
-        description: 'Files to stage, relative to the sandbox root',
-      }),
-      commitMessage: Type.String({ minLength: 1, maxLength: 4000 }),
-    }),
-    async execute(_toolCallId, params) {
-      const { issue, paths, commitMessage } = params as {
-        issue: number;
-        paths: string[];
-        commitMessage: string;
-      };
-      const branchResult = await readBranch();
-      if (!branchResult.branch) return textResult(`Error: ${branchResult.error}`);
-      const branch = branchResult.branch;
-      if (!currentBranchPattern(issue).test(branch)) {
-        return textResult(`Error: branch ${branch} does not carry issue ${issue}`);
-      }
-
-      const relativePaths: string[] = [];
-      try {
-        const sandboxRoot = guardPath('.', sandboxDir);
-        for (const candidate of paths) {
-          const resolved = guardPath(candidate, sandboxDir);
-          const relative = path.relative(sandboxRoot, resolved);
-          if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
-            throw new SandboxEscapeError(candidate, sandboxDir, resolved);
-          }
-          relativePaths.push(relative);
-        }
-      } catch (error) {
-        return textResult(`Error: ${error instanceof Error ? error.message : String(error)}`);
-      }
-
-      const add = await run('/usr/bin/git', ['add', '--', ...relativePaths], 30_000);
-      if (add.exitCode !== 0) return textResult(`Error: ${describeFailure('git add', add)}`);
-
-      const commit = await run(
-        '/usr/bin/git',
-        [
-          '-c',
-          `user.name=${identity}`,
-          '-c',
-          `user.email=${identity}@mosaic.invalid`,
-          'commit',
-          '-m',
-          commitMessage,
-          '--',
-          ...relativePaths,
-        ],
-        60_000,
-      );
-      if (commit.exitCode !== 0)
-        return textResult(`Error: ${describeFailure('git commit', commit)}`);
-
-      const queue = await run(queueGuard, ['--purpose', 'push', '-B', branch]);
-      if (queue.exitCode !== 0) {
-        return textResult(`Error: ${describeFailure('CI queue guard', queue)}`);
-      }
-
-      const push = await run(
-        '/usr/bin/git',
-        ['push', '--set-upstream', 'origin', branch],
-        PROCESS_TIMEOUT_MS,
-      );
-      if (push.exitCode !== 0) return textResult(`Error: ${describeFailure('git push', push)}`);
-
-      return textResult(`Published branch ${branch} as ${identity}.`);
-    },
-  };
-
-  const openPr: ToolDefinition = {
-    name: 'git_open_pull_request',
-    label: 'Open Pull Request',
-    description:
-      'Open a pull request from the current sandbox branch through the Mosaic pr-create wrapper. The wrapper targets the configured integration branch and links the tracking issue.',
-    parameters: Type.Object({
-      issue: Type.Integer({ minimum: 1, description: 'Tracking issue number' }),
-      title: Type.String({ minLength: 1, maxLength: 240 }),
-      body: Type.String({ maxLength: 20_000 }),
-    }),
-    async execute(_toolCallId, params) {
-      const { issue, title, body } = params as { issue: number; title: string; body: string };
-      const branchResult = await readBranch();
-      if (!branchResult.branch) return textResult(`Error: ${branchResult.error}`);
-      const branch = branchResult.branch;
-      if (!currentBranchPattern(issue).test(branch)) {
-        return textResult(`Error: branch ${branch} does not carry issue ${issue}`);
-      }
-
-      const result = await run(prCreate, [
-        '-t',
-        title,
-        '-b',
-        body,
-        '-B',
-        baseBranch,
-        '-H',
-        branch,
-        '-i',
-        String(issue),
-      ]);
-      if (result.exitCode !== 0) {
-        return textResult(`Error: ${describeFailure('pr-create wrapper', result)}`);
-      }
-      return textResult(result.stdout.trim() || `Pull request opened from ${branch}.`);
-    },
-  };
-
-  return [publish, openPr];
-}

apps/gateway/src/agent/tools/file-tools.ts

@@ -1,7 +1,7 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
 import { readFile, writeFile, readdir, stat } from 'node:fs/promises';
-import { guardPath, guardWritePath, SandboxEscapeError } from './path-guard.js';
+import { guardPath, guardPathUnsafe, SandboxEscapeError } from './path-guard.js';
 
 const MAX_READ_BYTES = 512 * 1024; // 512 KB read limit
 const MAX_WRITE_BYTES = 1024 * 1024; // 1 MB write limit
@@ -92,7 +92,7 @@ export function createFileTools(baseDir: string): ToolDefinition[] {
       };
       let safePath: string;
       try {
-        safePath = guardWritePath(path, baseDir);
+        safePath = guardPathUnsafe(path, baseDir);
       } catch (err) {
         if (err instanceof SandboxEscapeError) {
           return {

apps/gateway/src/agent/tools/index.ts

@@ -1,9 +1,8 @@
 export { createBrainTools } from './brain-tools.js';
 export { createCoordTools } from './coord-tools.js';
-export { createDeliveryTools } from './delivery-tools.js';
 export { createFileTools } from './file-tools.js';
 export { createGitTools } from './git-tools.js';
 export { createSearchTools } from './search-tools.js';
-export { createShellTools, createShellToolsIfEnabled } from './shell-tools.js';
+export { createShellTools } from './shell-tools.js';
 export { createWebTools } from './web-tools.js';
 export { createSkillTools } from './skill-tools.js';

apps/gateway/src/agent/tools/path-guard.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { guardPath, guardPathUnsafe, guardWritePath, SandboxEscapeError } from './path-guard.js';
+import { guardPath, guardPathUnsafe, SandboxEscapeError } from './path-guard.js';
 import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs';
@@ -101,55 +101,4 @@ describe('guardPath', () => {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }
   });
-
-  it('rejects a symlink inside the sandbox that resolves outside it', () => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'path-guard-test-'));
-    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'path-guard-outside-'));
-    try {
-      const target = path.join(outside, 'credential.token');
-      fs.writeFileSync(target, 'OUTSIDE_SYMLINK_SENTINEL');
-      fs.symlinkSync(target, path.join(tmpDir, 'credential.token'));
-      expect(() => guardPath('credential.token', tmpDir)).toThrow(SandboxEscapeError);
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-      fs.rmSync(outside, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('guardWritePath', () => {
-  it('allows a new file under an existing real sandbox directory', () => {
-    const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'path-write-test-'));
-    try {
-      expect(guardWritePath('new.txt', sandbox)).toBe(path.join(sandbox, 'new.txt'));
-    } finally {
-      fs.rmSync(sandbox, { recursive: true, force: true });
-    }
-  });
-
-  it('rejects writes through a file symlink that resolves outside the sandbox', () => {
-    const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'path-write-test-'));
-    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'path-write-outside-'));
-    try {
-      const target = path.join(outside, 'credential.token');
-      fs.writeFileSync(target, 'OUTSIDE_WRITE_SENTINEL');
-      fs.symlinkSync(target, path.join(sandbox, 'credential.token'));
-      expect(() => guardWritePath('credential.token', sandbox)).toThrow(SandboxEscapeError);
-    } finally {
-      fs.rmSync(sandbox, { recursive: true, force: true });
-      fs.rmSync(outside, { recursive: true, force: true });
-    }
-  });
-
-  it('rejects new files under a directory symlink that leaves the sandbox', () => {
-    const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'path-write-test-'));
-    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'path-write-outside-'));
-    try {
-      fs.symlinkSync(outside, path.join(sandbox, 'outside'));
-      expect(() => guardWritePath('outside/new.txt', sandbox)).toThrow(SandboxEscapeError);
-    } finally {
-      fs.rmSync(sandbox, { recursive: true, force: true });
-      fs.rmSync(outside, { recursive: true, force: true });
-    }
-  });
 });

apps/gateway/src/agent/tools/path-guard.ts

@@ -1,63 +1,47 @@
 import path from 'node:path';
 import fs from 'node:fs';
 
-function isContained(candidate: string, root: string): boolean {
-  return candidate === root || candidate.startsWith(root + path.sep);
-}
-
-function assertLexicalContainment(userPath: string, sandboxDir: string): string {
+/**
+ * Resolves a user-provided path and verifies it is inside the allowed sandbox directory.
+ * Throws SandboxEscapeError if the resolved path is outside the sandbox.
+ *
+ * Uses realpathSync to resolve symlinks in the sandbox root. The user-supplied path
+ * is checked for containment AFTER lexical resolution but BEFORE resolving any symlinks
+ * within the user path — so symlink escape attempts are caught too.
+ *
+ * @param userPath - The path provided by the agent (may be relative or absolute)
+ * @param sandboxDir - The allowed root directory (already validated on session creation)
+ * @returns The resolved absolute path, guaranteed to be within sandboxDir
+ */
+export function guardPath(userPath: string, sandboxDir: string): string {
   const resolved = path.resolve(sandboxDir, userPath);
-  const sandboxAbsolute = path.resolve(sandboxDir);
-  if (!isContained(resolved, sandboxAbsolute)) {
+  const sandboxResolved = fs.realpathSync.native(sandboxDir);
+
+  // Normalize both paths to resolve any symlinks in the sandbox root itself.
+  // For the user path, we check containment BEFORE resolving symlinks in the path
+  // (so we catch symlink escape attempts too — the resolved path must still be under sandbox)
+  if (!resolved.startsWith(sandboxResolved + path.sep) && resolved !== sandboxResolved) {
     throw new SandboxEscapeError(userPath, sandboxDir, resolved);
   }
+
   return resolved;
 }
 
 /**
- * Resolve an existing path and verify both its lexical path and real symlink
- * target remain inside the sandbox.
- */
-export function guardPath(userPath: string, sandboxDir: string): string {
-  const resolved = assertLexicalContainment(userPath, sandboxDir);
-  const sandboxReal = fs.realpathSync.native(sandboxDir);
-  const resolvedReal = fs.realpathSync.native(resolved);
-  if (!isContained(resolvedReal, sandboxReal)) {
-    throw new SandboxEscapeError(userPath, sandboxDir, resolvedReal);
-  }
-  return resolvedReal;
-}
-
-/**
- * Resolve a writable file path whose parent already exists. Existing targets
- * are resolved fully. New targets use the real parent directory, which blocks
- * writes through a parent symlink that leaves the sandbox.
- */
-export function guardWritePath(userPath: string, sandboxDir: string): string {
-  const resolved = assertLexicalContainment(userPath, sandboxDir);
-  const sandboxReal = fs.realpathSync.native(sandboxDir);
-  let writableReal: string;
-  try {
-    writableReal = fs.realpathSync.native(resolved);
-  } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code;
-    if (code !== 'ENOENT') throw error;
-    const parentReal = fs.realpathSync.native(path.dirname(resolved));
-    writableReal = path.join(parentReal, path.basename(resolved));
-  }
-  if (!isContained(writableReal, sandboxReal)) {
-    throw new SandboxEscapeError(userPath, sandboxDir, writableReal);
-  }
-  return writableReal;
-}
-
-/**
- * Lexical-only validation for non-filesystem pathspecs such as `git diff --`
- * targets, where the path may name a deleted file and Git does not dereference
- * a tracked symlink.
+ * Validates a path without resolving symlinks in the user-provided portion.
+ * Use for paths that may not exist yet (creates, writes).
+ *
+ * Performs a lexical containment check only using path.resolve.
  */
 export function guardPathUnsafe(userPath: string, sandboxDir: string): string {
-  return assertLexicalContainment(userPath, sandboxDir);
+  const resolved = path.resolve(sandboxDir, userPath);
+  const sandboxAbs = path.resolve(sandboxDir);
+
+  if (!resolved.startsWith(sandboxAbs + path.sep) && resolved !== sandboxAbs) {
+    throw new SandboxEscapeError(userPath, sandboxDir, resolved);
+  }
+
+  return resolved;
 }
 
 export class SandboxEscapeError extends Error {

apps/gateway/src/agent/tools/shell-tools.ts

@@ -128,14 +128,6 @@ function runCommand(
   });
 }
 
-export function createShellToolsIfEnabled(
-  sandboxDir: string | undefined,
-  env: NodeJS.ProcessEnv = process.env,
-): ToolDefinition[] {
-  if (env['AGENT_SHELL_ENABLED'] === 'false') return [];
-  return createShellTools(sandboxDir);
-}
-
 export function createShellTools(sandboxDir?: string): ToolDefinition[] {
   const defaultCwd = sandboxDir ?? process.cwd();
 

apps/gateway/src/app.module.spec.ts

@@ -1,624 +0,0 @@
-import 'reflect-metadata';
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
-import * as nodeOs from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import * as nodeUrl from 'node:url';
-import { MODULE_METADATA } from '@nestjs/common/constants.js';
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-
-interface ComposedModuleGraph {
-  imports: readonly unknown[];
-  federationModule: unknown;
-  bootLogLines: readonly string[];
-  mosaicConfig: MosaicConfig;
-  resolvedConfigPath: string;
-}
-
-type StorageTier = 'local' | 'standalone' | 'federated';
-
-interface ModuleGraphFixture {
-  tempRoot: string;
-  anchor: string;
-  homePath: string;
-  cwdPath: string;
-  monorepoRootEnvPath: string;
-  gatewayLocalEnvPath: string;
-  daemonEnvPath: string;
-  monorepoRootConfigPath: string;
-  gatewayLocalConfigPath: string;
-}
-
-interface ModuleGraphFixtureOptions {
-  rootEnvMode?: 'present' | 'absent';
-  rootTier?: StorageTier;
-  rootEnvContents?: string;
-  redactionMarker?: string;
-  gatewayLocalTier?: StorageTier;
-  gatewayLocalEnvContents?: string;
-  daemonEnvContents?: string;
-  inheritedTier?: StorageTier;
-  expectedProcessTier?: string;
-  setup?: (fixture: ModuleGraphFixture) => Promise<void>;
-}
-
-// Each case uses vi.resetModules() and re-imports the full gateway graph for distinct ambient FS/env; CI needs headroom, while this still guards genuine hangs.
-const MODULE_IMPORT_TIMEOUT_MS = 120_000;
-const MONOREPO_ROOT_DOTENV_LABEL = 'monorepo-root .env';
-const DAEMON_DOTENV_LABEL = 'daemon .env';
-
-function configJson(tier: StorageTier): string {
-  if (tier === 'local') {
-    return JSON.stringify({
-      tier,
-      storage: { type: 'pglite', dataDir: '.mosaic/storage-pglite' },
-      queue: { type: 'local', dataDir: '.mosaic/queue' },
-      memory: { type: 'keyword' },
-    });
-  }
-
-  return JSON.stringify({
-    tier,
-    storage: { type: 'postgres', url: 'postgresql://fixture.invalid/mosaic' },
-    queue: { type: 'bullmq' },
-    memory: { type: tier === 'federated' ? 'pgvector' : 'keyword' },
-  });
-}
-
-function snapshotProcessEnv(): Record<string, string | undefined> {
-  return { ...process.env };
-}
-
-function restoreProcessEnv(snapshot: Record<string, string | undefined>): void {
-  for (const key of Object.keys(process.env)) {
-    if (!(key in snapshot)) {
-      delete process.env[key];
-    }
-  }
-
-  for (const [key, value] of Object.entries(snapshot)) {
-    if (value === undefined) {
-      delete process.env[key];
-      continue;
-    }
-
-    process.env[key] = value;
-  }
-}
-
-function expectPathUnderTempRoot(path: string, tempRoot: string): void {
-  const relativePath = relative(tempRoot, path);
-  expect(relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))).toBe(
-    true,
-  );
-}
-
-async function writeFixture(path: string, contents: string, tempRoot: string): Promise<void> {
-  expectPathUnderTempRoot(path, tempRoot);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, contents, 'utf8');
-}
-
-interface ConfigModuleProvider {
-  provide: string;
-  useFactory: () => MosaicConfig;
-}
-
-function isConfigModuleProvider(value: unknown): value is ConfigModuleProvider {
-  if (typeof value !== 'object' || value === null) {
-    return false;
-  }
-
-  if (!('provide' in value) || typeof value.provide !== 'string') {
-    return false;
-  }
-
-  return 'useFactory' in value && typeof value.useFactory === 'function';
-}
-
-function singleBootLogLine(bootLogLines: readonly string[]): string {
-  expect(bootLogLines).toHaveLength(1);
-  const [bootLogLine] = bootLogLines;
-  if (bootLogLine === undefined) {
-    throw new Error('Expected a single boot log line');
-  }
-
-  return bootLogLine;
-}
-
-function expectBootLogLine(
-  bootLogLines: readonly string[],
-  tier: StorageTier,
-  source: string,
-): void {
-  const bootLogLine = singleBootLogLine(bootLogLines);
-
-  expect(bootLogLine).toContain(`storage tier=${tier}`);
-  expect(bootLogLine).toContain(`source=${source}`);
-}
-
-async function loadModuleGraphFromDotenv(
-  options: ModuleGraphFixtureOptions,
-): Promise<ComposedModuleGraph> {
-  const originalEnv = snapshotProcessEnv();
-  const tempRoot = await mkdtemp(join(nodeOs.tmpdir(), 'mosaic-gateway-module-'));
-  let consoleInfoSpy: ReturnType<typeof vi.spyOn> | undefined;
-  let cwdSpy: ReturnType<typeof vi.spyOn> | undefined;
-
-  try {
-    const anchor = join(tempRoot, 'anchored', 'apps', 'gateway', 'src');
-    const homePath = join(tempRoot, 'home');
-    const cwdPath = join(tempRoot, 'ambient', 'parent', 'cwd');
-    const fixture: ModuleGraphFixture = {
-      tempRoot,
-      anchor,
-      homePath,
-      cwdPath,
-      monorepoRootEnvPath: resolve(anchor, '../../..', '.env'),
-      gatewayLocalEnvPath: resolve(anchor, '..', '.env'),
-      daemonEnvPath: join(homePath, '.config', 'mosaic', 'gateway', '.env'),
-      monorepoRootConfigPath: resolve(anchor, '../../..', 'mosaic.config.json'),
-      gatewayLocalConfigPath: resolve(anchor, '..', 'mosaic.config.json'),
-    };
-    consoleInfoSpy = vi.spyOn(console, 'info').mockImplementation((): void => undefined);
-
-    for (const path of Object.values(fixture)) {
-      expectPathUnderTempRoot(path, tempRoot);
-    }
-
-    await mkdir(anchor, { recursive: true });
-    await mkdir(cwdPath, { recursive: true });
-
-    if ((options.rootEnvMode ?? 'present') === 'absent') {
-      if (
-        options.rootEnvContents !== undefined ||
-        options.rootTier !== undefined ||
-        options.redactionMarker !== undefined
-      ) {
-        throw new Error('Expected no root env fixture values when rootEnvMode is absent');
-      }
-    } else {
-      if (options.rootEnvContents === undefined && options.rootTier === undefined) {
-        throw new Error('Expected rootTier or rootEnvContents');
-      }
-
-      const rootFixture = options.rootEnvContents ?? `MOSAIC_STORAGE_TIER=${options.rootTier}\n`;
-      const rootFixtureWithMarker = options.redactionMarker
-        ? `${rootFixture}BETTER_AUTH_SECRET=${options.redactionMarker}\n`
-        : rootFixture;
-      await writeFixture(fixture.monorepoRootEnvPath, rootFixtureWithMarker, tempRoot);
-    }
-
-    if (options.daemonEnvContents !== undefined) {
-      await writeFixture(fixture.daemonEnvPath, options.daemonEnvContents, tempRoot);
-    }
-
-    if (options.gatewayLocalEnvContents !== undefined) {
-      await writeFixture(fixture.gatewayLocalEnvPath, options.gatewayLocalEnvContents, tempRoot);
-    } else if (options.gatewayLocalTier !== undefined) {
-      await writeFixture(
-        fixture.gatewayLocalEnvPath,
-        `MOSAIC_STORAGE_TIER=${options.gatewayLocalTier}\n`,
-        tempRoot,
-      );
-    }
-
-    process.env['HOME'] = homePath;
-    delete process.env['MOSAIC_STORAGE_TIER'];
-    delete process.env['DATABASE_URL'];
-    delete process.env['VALKEY_URL'];
-    delete process.env['MOSAIC_GATEWAY_HOME'];
-
-    await options.setup?.(fixture);
-
-    if (options.inheritedTier !== undefined) {
-      process.env['MOSAIC_STORAGE_TIER'] = options.inheritedTier;
-    }
-
-    vi.resetModules();
-    vi.doMock('node:os', () => ({ ...nodeOs, homedir: (): string => homePath }));
-    vi.doMock('node:url', () => ({
-      ...nodeUrl,
-      fileURLToPath: (url: string | URL): string => {
-        const actualPath = nodeUrl.fileURLToPath(url);
-        if (
-          actualPath.endsWith('/apps/gateway/src/env.ts') ||
-          actualPath.endsWith('/apps/gateway/src/env.js')
-        ) {
-          return join(anchor, 'env.ts');
-        }
-        return actualPath;
-      },
-    }));
-    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(cwdPath);
-
-    if (options.inheritedTier === undefined) {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBeUndefined();
-    } else {
-      expect(process.env['MOSAIC_STORAGE_TIER']).toBe(options.inheritedTier);
-    }
-
-    const envModule = await import('./env.js');
-    expect(process.env['MOSAIC_STORAGE_TIER']).toBe(
-      options.expectedProcessTier ?? options.rootTier,
-    );
-
-    const { AppModule } = await import('./app.module.js');
-    const { FederationModule } = await import('./federation/federation.module.js');
-    const imports: unknown = Reflect.getMetadata(MODULE_METADATA.IMPORTS, AppModule);
-
-    if (!Array.isArray(imports)) {
-      throw new Error('AppModule imports metadata is not an array');
-    }
-
-    const { ConfigModule, MOSAIC_CONFIG } = await import('./config/config.module.js');
-    const providers: unknown = Reflect.getMetadata(MODULE_METADATA.PROVIDERS, ConfigModule);
-
-    if (!Array.isArray(providers)) {
-      throw new Error('ConfigModule providers metadata is not an array');
-    }
-
-    const configProvider = providers
-      .filter(isConfigModuleProvider)
-      .find((provider: ConfigModuleProvider): boolean => provider.provide === MOSAIC_CONFIG);
-
-    if (!configProvider) {
-      throw new Error('MOSAIC_CONFIG provider factory not found');
-    }
-
-    return {
-      imports,
-      federationModule: FederationModule,
-      bootLogLines: consoleInfoSpy.mock.calls.map((args: readonly unknown[]): string =>
-        args.map((value: unknown): string => String(value)).join(' '),
-      ),
-      mosaicConfig: configProvider.useFactory(),
-      resolvedConfigPath: envModule.resolveGatewayConfigPath(),
-    };
-  } finally {
-    cwdSpy?.mockRestore();
-    vi.doUnmock('node:url');
-    vi.doUnmock('node:os');
-    vi.resetModules();
-    consoleInfoSpy?.mockRestore();
-    restoreProcessEnv(originalEnv);
-    await rm(tempRoot, { recursive: true, force: true });
-  }
-}
-
-describe('AppModule federation gating', (): void => {
-  it('loads dotenv before tracing and AppModule evaluation', async (): Promise<void> => {
-    const mainSource = await readFile(new URL('./main.ts', import.meta.url), 'utf8');
-    const envImportIndex = mainSource.indexOf("import './env.js';");
-    const tracingImportIndex = mainSource.indexOf("import './tracing.js';");
-    const appModuleImportIndex = mainSource.indexOf("import { AppModule } from './app.module.js';");
-
-    expect(envImportIndex).toBeGreaterThan(-1);
-    expect(envImportIndex).toBeLessThan(tracingImportIndex);
-    expect(envImportIndex).toBeLessThan(appModuleImportIndex);
-  });
-
-  it(
-    'ignores ambient cwd/.env and cwd/../.env files',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-          await writeFixture(
-            resolve(fixture.cwdPath, '..', '.env'),
-            'MOSAIC_STORAGE_TIER=federated\n',
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'ignores an ambient cwd/../../mosaic.config.json federated config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            resolve(fixture.cwdPath, '../..', 'mosaic.config.json'),
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'anchored gateway-local config wins monorepo-root config and registers FederationModule',
-    async (): Promise<void> => {
-      let gatewayLocalConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          gatewayLocalConfigPath = fixture.gatewayLocalConfigPath;
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(gatewayLocalConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'resolves the daemon-installed GATEWAY_HOME/mosaic.config.json ahead of gateway-local and monorepo-root configs',
-    async (): Promise<void> => {
-      let daemonConfigPath = '';
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          const externalGatewayHome = join(fixture.tempRoot, 'external-gateway-home');
-          daemonConfigPath = join(externalGatewayHome, 'mosaic.config.json');
-          await writeFixture(daemonConfigPath, configJson('federated'), fixture.tempRoot);
-          await writeFixture(
-            fixture.gatewayLocalConfigPath,
-            configJson('standalone'),
-            fixture.tempRoot,
-          );
-          await writeFixture(fixture.monorepoRootConfigPath, configJson('local'), fixture.tempRoot);
-          process.env['MOSAIC_GATEWAY_HOME'] = externalGatewayHome;
-          process.env['DATABASE_URL'] = 'postgresql://fixture.invalid/mosaic';
-        },
-      });
-
-      expect(graph.resolvedConfigPath).toBe(daemonConfigPath);
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs mosaic.config.json when anchored config and env tiers are both federated',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'mosaic.config.json');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'logs standalone from a monorepo-root .env DATABASE_URL fallback',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'DATABASE_URL=fixture-database-url\n',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes an invalid monorepo-root dotenv tier to the default',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvContents: 'MOSAIC_STORAGE_TIER=invalid\n',
-        expectedProcessTier: 'invalid',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'local', 'default');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'attributes DATABASE_URL fallback to daemon .env ahead of inherited local tier',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        daemonEnvContents: 'DATABASE_URL=fixture-database-url\n',
-        inheritedTier: 'local',
-        expectedProcessTier: 'local',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'daemon .env wins over monorepo-root and gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=standalone\n',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', DAEMON_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'inherits process.env.MOSAIC_STORAGE_TIER over daemon, monorepo-root, and gateway-local dotenv values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        gatewayLocalTier: 'federated',
-        daemonEnvContents: 'MOSAIC_STORAGE_TIER=federated\n',
-        inheritedTier: 'standalone',
-        expectedProcessTier: 'standalone',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', 'process environment');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'gateway-local .env configures the tier and source when the monorepo-root .env is absent',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootEnvMode: 'absent',
-        gatewayLocalTier: 'federated',
-        expectedProcessTier: 'federated',
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', 'gateway-local .env');
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'monorepo-root .env wins over gateway-local tier values',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'standalone',
-        gatewayLocalTier: 'federated',
-      });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'standalone', MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it.each(['local', 'standalone'] as const)(
-    'does not register FederationModule for the %s tier',
-    async (tier): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({ rootTier: tier });
-
-      expect(graph.imports).not.toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, tier, MONOREPO_ROOT_DOTENV_LABEL);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'registers FederationModule when federated tier is supplied by the anchored monorepo root .env',
-    async (): Promise<void> => {
-      const redactionMarker = 'redaction-fixture-marker';
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'federated',
-        redactionMarker,
-      });
-
-      expect(graph.imports).toContain(graph.federationModule);
-      expectBootLogLine(graph.bootLogLines, 'federated', MONOREPO_ROOT_DOTENV_LABEL);
-      expect(singleBootLogLine(graph.bootLogLines)).not.toContain(redactionMarker);
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider ignores an ambient cwd/mosaic.config.json config',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            join(fixture.cwdPath, 'mosaic.config.json'),
-            JSON.stringify({
-              tier: 'federated',
-              storage: {
-                type: 'postgres',
-                url: 'postgresql://ambient-attacker.invalid/mosaic',
-                enableVector: true,
-              },
-              queue: { type: 'bullmq' },
-              memory: { type: 'pgvector' },
-            }),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('local');
-      expect(graph.mosaicConfig.storage).not.toEqual(
-        expect.objectContaining({ url: 'postgresql://ambient-attacker.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-
-  it(
-    'MOSAIC_CONFIG provider resolves from the anchored monorepo-root mosaic.config.json',
-    async (): Promise<void> => {
-      const graph = await loadModuleGraphFromDotenv({
-        rootTier: 'local',
-        setup: async (fixture: ModuleGraphFixture): Promise<void> => {
-          await writeFixture(
-            fixture.monorepoRootConfigPath,
-            configJson('federated'),
-            fixture.tempRoot,
-          );
-        },
-      });
-
-      expect(graph.mosaicConfig.tier).toBe('federated');
-      expect(graph.mosaicConfig.storage).toEqual(
-        expect.objectContaining({ url: 'postgresql://fixture.invalid/mosaic' }),
-      );
-    },
-    MODULE_IMPORT_TIMEOUT_MS,
-  );
-});

apps/gateway/src/app.module.ts

@@ -21,24 +21,11 @@ import { AdminModule } from './admin/admin.module.js';
 import { CommandsModule } from './commands/commands.module.js';
 import { PreferencesModule } from './preferences/preferences.module.js';
 import { GCModule } from './gc/gc.module.js';
-import { HarnessModule } from './harness/harness.module.js';
 import { ReloadModule } from './reload/reload.module.js';
 import { WorkspaceModule } from './workspace/workspace.module.js';
-import { HierarchyModule } from './hierarchy/hierarchy.module.js';
-import { EnrollmentModule } from './enrollment/enrollment.module.js';
 import { QueueModule } from './queue/queue.module.js';
 import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
-import { loadConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from './env.js';
-
-// Federation (step-ca client, enrollment, federation verbs) is only wired for
-// tier 'federated' — CaService hard-requires STEP_CA_* at construction, which
-// must not gate standalone/local boots (docker-compose.federated.yml: the
-// federation profile "must not start in non-federated dev"). The gateway
-// entrypoint loads env.ts before evaluating this module so dotenv-backed tier
-// configuration is visible here.
-const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'federated';
 
 @Module({
   imports: [
@@ -63,13 +50,10 @@ const federationEnabled = loadConfig(resolveGatewayConfigPath()).tier === 'feder
     PreferencesModule,
     CommandsModule,
     GCModule,
-    HarnessModule,
     QueueModule,
     ReloadModule,
     WorkspaceModule,
-    HierarchyModule,
-    EnrollmentModule,
-    ...(federationEnabled ? [FederationModule] : []),
+    FederationModule,
   ],
   controllers: [HealthController],
   providers: [

apps/gateway/src/chat/chat-runtime-router.spec.ts

@@ -1,920 +0,0 @@
-import 'reflect-metadata';
-import { Global, Module } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
-import type { HarnessAdapter, HarnessConversationService } from '@mosaicstack/types';
-import { AgentService } from '../agent/agent.service.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import { HarnessModule } from '../harness/harness.module.js';
-import { ChatModule } from './chat.module.js';
-import { ChatGateway } from './chat.gateway.js';
-import { HarnessRegistry } from '../harness/harness.registry.js';
-import {
-  HARNESS_CONVERSATION_SERVICE,
-  HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-  HARNESS_REGISTRY,
-  type HarnessConversationServiceBinding,
-} from '../harness/harness.tokens.js';
-import { ChatRuntimeRouter } from './chat-runtime-router.js';
-import {
-  ChatRuntimeUnavailableError,
-  ownConversation,
-  type ChatRuntime,
-  type ChatRuntimeMode,
-  type LegacyEmbeddedChatPort,
-  type LegacyRuntimeStream,
-  type LegacySessionPresentation,
-  type LegacySocketTurnLease,
-  type OwnedConversationContext,
-} from './chat-runtime.js';
-import { AppModule } from '../app.module.js';
-import { ProviderService } from '../agent/provider.service.js';
-
-/**
- * Task Five, Step One (router). Proves the `ChatRuntimeRouter` resolves exactly one
- * runtime by mode, fails closed at init when `pi-rpc` preconditions are unmet, and
- * never downgrades `pi-rpc` to embedded execution. Red-first: the router is an
- * unimplemented stub, so every behavioural assertion below fails until Step Three.
- */
-
-const embedded: ChatRuntime = { kind: 'embedded' };
-const harness: ChatRuntime = { kind: 'harness' };
-
-/** A structurally-complete, non-sentinel conversation service. Its methods are never invoked here. */
-const boundConversationService = {
-  attach: () => Promise.reject(new Error('unused')),
-  detach: () => Promise.reject(new Error('unused')),
-  send: () => Promise.reject(new Error('unused')),
-
-  subscribeFrom: async function* () {
-    throw new Error('unused');
-  },
-} as unknown as HarnessConversationService;
-
-function registryWith(adapterIds: readonly string[]): HarnessRegistry {
-  const registry = new HarnessRegistry();
-  for (const id of adapterIds) {
-    registry.register({
-      id,
-      describe: () => Promise.reject(new Error('unused')),
-      catalog: () => Promise.reject(new Error('unused')),
-      create: () => Promise.reject(new Error('unused')),
-      resume: () => Promise.reject(new Error('unused')),
-    } as HarnessAdapter);
-  }
-  return registry;
-}
-
-function buildRouter(
-  mode: ChatRuntimeMode,
-  opts: { adapters: readonly string[]; service: HarnessConversationServiceBinding },
-): ChatRuntimeRouter {
-  return new ChatRuntimeRouter(registryWith(opts.adapters), opts.service, embedded, harness, mode);
-}
-
-/**
- * Tear down a module that was deliberately driven to a fail-closed init.
- * `NestApplicationContext.close()` re-awaits the module's `initializationPromise` before disposing
- * (nest-application-context.js:127); when `init()` rejected, that await re-throws the SAME typed
- * startup error, this time into teardown. Each caller here has already captured and asserted that
- * exact `ChatRuntimeUnavailableError` via `initError`, so the re-throw is expected teardown noise —
- * swallow ONLY that error, and surface anything else so a genuine teardown fault still fails loudly.
- */
-async function closeIgnoringFailedInit(moduleRef: TestingModule): Promise<void> {
-  await moduleRef.close().catch((err: unknown) => {
-    if (err instanceof ChatRuntimeUnavailableError) return;
-    throw err;
-  });
-}
-
-describe('ChatRuntimeRouter', () => {
-  it('resolves only the harness runtime in pi-rpc mode when pi adapter and conversation service are present', () => {
-    const router = buildRouter('pi-rpc', {
-      adapters: ['pi'],
-      service: boundConversationService,
-    });
-
-    expect(() => router.onModuleInit()).not.toThrow();
-    expect(router.active).toBe(harness);
-    expect(router.active.kind).toBe('harness');
-  });
-
-  it('resolves only the embedded runtime in legacy mode and skips the pi preconditions', () => {
-    // Empty registry + unavailable service: legacy must ignore both and still start.
-    const router = buildRouter('legacy', {
-      adapters: [],
-      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-
-    expect(() => router.onModuleInit()).not.toThrow();
-    expect(router.active).toBe(embedded);
-    expect(router.active.kind).toBe('embedded');
-  });
-
-  it('fails closed at init when pi-rpc mode has no registered pi adapter', () => {
-    const router = buildRouter('pi-rpc', {
-      adapters: [],
-      service: boundConversationService,
-    });
-
-    expect(() => router.onModuleInit()).toThrow(ChatRuntimeUnavailableError);
-    try {
-      router.onModuleInit();
-      expect.unreachable('onModuleInit must throw when the pi adapter is absent');
-    } catch (err) {
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    }
-  });
-
-  it('fails closed at init when pi-rpc mode has the unavailable conversation-service sentinel', () => {
-    const router = buildRouter('pi-rpc', {
-      adapters: ['pi'],
-      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-
-    try {
-      router.onModuleInit();
-      expect.unreachable('onModuleInit must throw when the conversation service is unbound');
-    } catch (err) {
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    }
-  });
-
-  it('never falls back to embedded execution when pi-rpc preconditions are unmet', () => {
-    const router = buildRouter('pi-rpc', {
-      adapters: [],
-      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-
-    expect(() => router.onModuleInit()).toThrow(ChatRuntimeUnavailableError);
-    // A failed pi-rpc init must not silently expose the embedded runtime.
-    expect(() => router.active).toThrow();
-    let leaked: ChatRuntime | undefined;
-    try {
-      leaked = router.active;
-    } catch {
-      leaked = undefined;
-    }
-    expect(leaked).not.toBe(embedded);
-  });
-
-  it('exposes only fixed, browser-safe failure text (no raw provider or exception detail)', () => {
-    const router = buildRouter('pi-rpc', {
-      adapters: [],
-      service: boundConversationService,
-    });
-
-    try {
-      router.onModuleInit();
-      expect.unreachable('onModuleInit must throw');
-    } catch (err) {
-      const message = (err as ChatRuntimeUnavailableError).message;
-      expect(message).toBe(
-        'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.',
-      );
-      expect(message).not.toMatch(/Error:|\bat \b|node_modules|Symbol\(/);
-    }
-  });
-});
-
-/**
- * Task Five, Step Three — legacy port operations fail closed under pi-rpc (direct valid-input).
- *
- * The unit suite above constructs the router but never invokes a legacy port operation, so the
- * six per-operation inner `if (this.mode === 'pi-rpc')` guards are unexercised — a mutation that
- * deletes one of them SURVIVES for lack of a test that drives that operation. This group closes
- * that gap the right way: it drives each of the six operations DIRECTLY, in pi-rpc mode, with a
- * valid branded {@link OwnedConversationContext} and valid input, against a recording embedded
- * stub whose method returns a distinguishable `ok:true` success and increments a per-op counter.
- *
- * For each operation:
- *  - pi-rpc test asserts the exact frozen `{ ok:false, code:'runtime_unsupported', retryable:false }`
- *    result AND that the embedded stub was touched zero times (no effects);
- *  - the paired legacy test proves that same stub method IS reached and returns its distinguishable
- *    success when the mode does not refuse — so the pi-rpc zero-invocation assertion is meaningful,
- *    not vacuously true because the stub could never be called.
- *
- * Deleting ONLY one operation's inner guard makes THAT operation's pi-rpc test behaviorally RED
- * (the router returns the embedded `ok:true` value and records the call), with every outer guard
- * and the other five inner guards intact. `next` is untouched; nothing here changes production.
- */
-describe('ChatRuntimeRouter — legacy port ops fail closed under pi-rpc (Task Five, Step Three)', () => {
-  const RUNTIME_UNSUPPORTED = {
-    ok: false,
-    code: 'runtime_unsupported',
-    retryable: false,
-  } as const;
-
-  const PRESENTATION: LegacySessionPresentation = {
-    provider: 'embedded-provider',
-    modelId: 'embedded-model',
-    thinkingLevel: 'low',
-    availableThinkingLevels: ['low', 'high'],
-  };
-
-  const stream: LegacyRuntimeStream = {
-    channelId: 'websocket:test-socket',
-    onEvent: () => {},
-  };
-
-  const ctx = (): OwnedConversationContext =>
-    ownConversation('conversation-1', { userId: 'user-1', tenantId: 'tenant-1' });
-
-  /**
-   * Per-operation invocation counters with declared keys (not an index signature) so each
-   * `calls.<op>` is definitely `number` under `noUncheckedIndexedAccess`.
-   */
-  type LegacyPortCallCounts = {
-    completeLegacyRestTurn: number;
-    prepareLegacySocketTurn: number;
-    setLegacyThinking: number;
-    abortLegacyTurn: number;
-    applyLegacyModelOverride: number;
-    readLegacySessionPresentation: number;
-    dispatchVerifiedDiscordIngress: number;
-  };
-
-  /**
-   * An embedded port that records every invocation and returns a distinguishable `ok:true`
-   * value per operation. If a router op reaches it (its guard removed), both the recorded call
-   * count and the returned `ok:true` value diverge from the frozen `runtime_unsupported` result.
-   */
-  function recordingEmbeddedPort(): {
-    port: ChatRuntime & LegacyEmbeddedChatPort;
-    calls: LegacyPortCallCounts;
-  } {
-    const calls: LegacyPortCallCounts = {
-      completeLegacyRestTurn: 0,
-      prepareLegacySocketTurn: 0,
-      setLegacyThinking: 0,
-      abortLegacyTurn: 0,
-      applyLegacyModelOverride: 0,
-      readLegacySessionPresentation: 0,
-      dispatchVerifiedDiscordIngress: 0,
-    };
-    const lease: LegacySocketTurnLease = {
-      presentation: PRESENTATION,
-      dispatch: () => Promise.resolve({ ok: true, value: undefined }),
-      dispose: () => Promise.resolve(),
-    };
-    const port: ChatRuntime & LegacyEmbeddedChatPort = {
-      kind: 'embedded',
-      completeLegacyRestTurn: () => {
-        calls.completeLegacyRestTurn += 1;
-        return Promise.resolve({
-          ok: true,
-          value: { text: 'EMBEDDED-REST', presentation: PRESENTATION },
-        });
-      },
-      prepareLegacySocketTurn: () => {
-        calls.prepareLegacySocketTurn += 1;
-        return Promise.resolve({ ok: true, value: lease });
-      },
-      setLegacyThinking: () => {
-        calls.setLegacyThinking += 1;
-        return { ok: true, value: PRESENTATION };
-      },
-      abortLegacyTurn: () => {
-        calls.abortLegacyTurn += 1;
-        return Promise.resolve({ ok: true, value: undefined });
-      },
-      applyLegacyModelOverride: () => {
-        calls.applyLegacyModelOverride += 1;
-        return { ok: true, value: PRESENTATION };
-      },
-      readLegacySessionPresentation: () => {
-        calls.readLegacySessionPresentation += 1;
-        return { ok: true, value: PRESENTATION };
-      },
-      dispatchVerifiedDiscordIngress: () => {
-        calls.dispatchVerifiedDiscordIngress += 1;
-        return Promise.resolve({
-          ok: true,
-          value: {
-            presentation: PRESENTATION,
-            dispatch: () => Promise.resolve({ ok: true, value: undefined }),
-            dispose: () => Promise.resolve(),
-          },
-        });
-      },
-    };
-    return { port, calls };
-  }
-
-  function piRouter(port: ChatRuntime & LegacyEmbeddedChatPort): ChatRuntimeRouter {
-    return new ChatRuntimeRouter(
-      registryWith(['pi']),
-      boundConversationService,
-      port,
-      harness,
-      'pi-rpc',
-    );
-  }
-  function legacyRouter(port: ChatRuntime & LegacyEmbeddedChatPort): ChatRuntimeRouter {
-    return new ChatRuntimeRouter(
-      registryWith([]),
-      boundConversationService,
-      port,
-      harness,
-      'legacy',
-    );
-  }
-
-  // completeLegacyRestTurn ---------------------------------------------------
-  it('completeLegacyRestTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await piRouter(port).completeLegacyRestTurn(ctx(), { content: 'hello' });
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.completeLegacyRestTurn).toBe(0);
-  });
-  it('completeLegacyRestTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await legacyRouter(port).completeLegacyRestTurn(ctx(), { content: 'hello' });
-    expect(result.ok).toBe(true);
-    expect(calls.completeLegacyRestTurn).toBe(1);
-  });
-
-  // prepareLegacySocketTurn --------------------------------------------------
-  it('prepareLegacySocketTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await piRouter(port).prepareLegacySocketTurn(
-      ctx(),
-      { content: 'hello' },
-      stream,
-    );
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.prepareLegacySocketTurn).toBe(0);
-  });
-  it('prepareLegacySocketTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await legacyRouter(port).prepareLegacySocketTurn(
-      ctx(),
-      { content: 'hello' },
-      stream,
-    );
-    expect(result.ok).toBe(true);
-    expect(calls.prepareLegacySocketTurn).toBe(1);
-  });
-
-  // setLegacyThinking (sync) -------------------------------------------------
-  it('setLegacyThinking refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = piRouter(port).setLegacyThinking(ctx(), 'high');
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.setLegacyThinking).toBe(0);
-  });
-  it('setLegacyThinking delegates to embedded under legacy (guard is the sole gate)', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = legacyRouter(port).setLegacyThinking(ctx(), 'high');
-    expect(result.ok).toBe(true);
-    expect(calls.setLegacyThinking).toBe(1);
-  });
-
-  // abortLegacyTurn ----------------------------------------------------------
-  it('abortLegacyTurn refuses with runtime_unsupported and never touches embedded under pi-rpc', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await piRouter(port).abortLegacyTurn(ctx());
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.abortLegacyTurn).toBe(0);
-  });
-  it('abortLegacyTurn delegates to embedded under legacy (guard is the sole gate)', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = await legacyRouter(port).abortLegacyTurn(ctx());
-    expect(result.ok).toBe(true);
-    expect(calls.abortLegacyTurn).toBe(1);
-  });
-
-  // applyLegacyModelOverride (sync) ------------------------------------------
-  it('applyLegacyModelOverride refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = piRouter(port).applyLegacyModelOverride(ctx(), 'model-x');
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.applyLegacyModelOverride).toBe(0);
-  });
-  it('applyLegacyModelOverride delegates to embedded under legacy (guard is the sole gate)', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = legacyRouter(port).applyLegacyModelOverride(ctx(), 'model-x');
-    expect(result.ok).toBe(true);
-    expect(calls.applyLegacyModelOverride).toBe(1);
-  });
-
-  // readLegacySessionPresentation (sync) -------------------------------------
-  it('readLegacySessionPresentation refuses with runtime_unsupported and never touches embedded under pi-rpc', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = piRouter(port).readLegacySessionPresentation(ctx());
-    expect(result).toEqual(RUNTIME_UNSUPPORTED);
-    expect(calls.readLegacySessionPresentation).toBe(0);
-  });
-  it('readLegacySessionPresentation delegates to embedded under legacy (guard is the sole gate)', () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const result = legacyRouter(port).readLegacySessionPresentation(ctx());
-    expect(result.ok).toBe(true);
-    expect(calls.readLegacySessionPresentation).toBe(1);
-  });
-
-  // dispatchVerifiedDiscordIngress delegates in BOTH modes (embedded-only, no guard) ---------
-  it('dispatchVerifiedDiscordIngress delegates to embedded under pi-rpc (embedded-only, no mode guard)', async () => {
-    const { port, calls } = recordingEmbeddedPort();
-    const discordCtx = ctx() as unknown as Parameters<
-      ChatRuntimeRouter['dispatchVerifiedDiscordIngress']
-    >[0];
-    const result = await piRouter(port).dispatchVerifiedDiscordIngress(discordCtx, stream);
-    expect(result.ok).toBe(true);
-    expect(calls.dispatchVerifiedDiscordIngress).toBe(1);
-  });
-});
-
-/**
- * Task Five, Step Two — group 1 (real Nest module-graph readiness).
- *
- * The unit suite above constructs the router directly. This group drives the SAME contract
- * through a real NestJS graph: it imports the production `HarnessModule` (the proven-booting
- * idiom from harness.controller.spec.ts) so the router resolves the REAL, empty `HarnessRegistry`
- * via the real `HARNESS_REGISTRY` token, then runs the router's `OnModuleInit` through the Nest
- * lifecycle (`moduleRef.init()`). Red-first: the router is an unimplemented stub whose
- * `onModuleInit` throws a generic Error, so:
- *   - readiness cases fail because the graph never comes up (init rejects), and
- *   - fail-closed cases fail because a generic stub throw is NOT the SPECIFIC typed
- *     `ChatRuntimeUnavailableError` (reason/code) the contract demands — a stub that
- *     "throws anything" cannot mask these greens.
- * The router is NOT wired into a production module yet, so it is provided here via a factory
- * over the real registry token. Importing the real `ChatModule` bare is deliberately avoided:
- * it injects `AgentService` without importing `AgentModule`, so its graph fails to RESOLVE — a
- * collection/DI error, not a behavioural red. `next` is untouched; nothing here implements the router.
- */
-describe('ChatRuntimeRouter — real Nest module-graph readiness (Task Five, Step Two group 1)', () => {
-  async function bootRouterGraph(
-    mode: ChatRuntimeMode,
-    opts: { adapters: readonly string[]; service: HarnessConversationServiceBinding },
-  ) {
-    const moduleRef = await Test.createTestingModule({
-      imports: [HarnessModule],
-      providers: [
-        {
-          provide: ChatRuntimeRouter,
-          useFactory: (registry: HarnessRegistry) =>
-            new ChatRuntimeRouter(registry, opts.service, embedded, harness, mode),
-          inject: [HARNESS_REGISTRY],
-        },
-      ],
-    })
-      // The imported HarnessModule's controllers reference AuthGuard (an HTTP-only concern,
-      // never exercised here); stub it so the graph resolves. The registry is NOT overridden —
-      // group 1 asserts against the genuine production HarnessRegistry.
-      .overrideGuard(AuthGuard)
-      .useValue({ canActivate: () => true })
-      .compile();
-
-    // Resolve the production registry singleton and register the requested adapters ON IT, so
-    // the router (which injects the same singleton) sees them when its lifecycle hook runs.
-    const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
-    for (const id of opts.adapters) {
-      registry.register({
-        id,
-        describe: () => Promise.reject(new Error('unused')),
-        catalog: () => Promise.reject(new Error('unused')),
-        create: () => Promise.reject(new Error('unused')),
-        resume: () => Promise.reject(new Error('unused')),
-      } as HarnessAdapter);
-    }
-    return moduleRef;
-  }
-
-  // Capture an init rejection without letting a resolved init masquerade as success.
-  const initError = (moduleRef: { init(): Promise<unknown> }): Promise<unknown> =>
-    moduleRef.init().then(
-      () => new Error('module init resolved but the contract requires it to reject'),
-      (err: unknown) => err,
-    );
-
-  it('brings the graph up and resolves only the harness runtime in pi-rpc mode (pi adapter + bound service)', async () => {
-    const moduleRef = await bootRouterGraph('pi-rpc', {
-      adapters: ['pi'],
-      service: boundConversationService,
-    });
-    try {
-      await moduleRef.init();
-      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
-      expect(router.active).toBe(harness);
-      expect(router.active.kind).toBe('harness');
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  it('brings the graph up in legacy mode over the REAL empty HarnessRegistry and resolves only the embedded runtime', async () => {
-    const moduleRef = await bootRouterGraph('legacy', {
-      adapters: [],
-      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-    try {
-      // Defense-in-depth: the production module wires the genuine registry, empty by default —
-      // guards against a test-double registry silently satisfying the readiness check.
-      const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
-      expect(registry).toBeInstanceOf(HarnessRegistry);
-      expect(registry.list()).toHaveLength(0);
-
-      await moduleRef.init();
-      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
-      expect(router.active).toBe(embedded);
-      expect(router.active.kind).toBe('embedded');
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  it('fails closed at module init when pi-rpc mode has no registered pi adapter (specific typed error, not a stub throw)', async () => {
-    const moduleRef = await bootRouterGraph('pi-rpc', {
-      adapters: [],
-      service: boundConversationService,
-    });
-    try {
-      const err = await initError(moduleRef);
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    } finally {
-      await closeIgnoringFailedInit(moduleRef);
-    }
-  });
-
-  it('fails closed at module init when pi-rpc mode has the unavailable conversation-service sentinel', async () => {
-    const moduleRef = await bootRouterGraph('pi-rpc', {
-      adapters: ['pi'],
-      service: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-    try {
-      const err = await initError(moduleRef);
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    } finally {
-      await closeIgnoringFailedInit(moduleRef);
-    }
-  });
-
-  it('surfaces only fixed, browser-safe failure text when the graph fails closed (no stub/exception detail)', async () => {
-    const moduleRef = await bootRouterGraph('pi-rpc', {
-      adapters: [],
-      service: boundConversationService,
-    });
-    try {
-      const err = await initError(moduleRef);
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      const message = (err as ChatRuntimeUnavailableError).message;
-      expect(message).toBe(
-        'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.',
-      );
-      expect(message).not.toMatch(/Error:|\bat \b|node_modules|Symbol\(|not implemented/);
-    } finally {
-      await closeIgnoringFailedInit(moduleRef);
-    }
-  });
-});
-
-/**
- * Task Five, Step Two — group 1b (production ChatModule wiring, declaration proof).
- *
- * Correction #1 (Scrappy fe3e02) asked for a red that imports the real `ChatModule` and calls
- * `module.init()`. Investigated and found impractical/masking-prone: `ChatModule` provides
- * `ChatGateway`, whose 10-argument constructor injects app-global providers (AgentService, AUTH,
- * BRAIN, RoutingEngineService) plus the Commands/GC/Mcp/Reload subsystems across a forwardRef
- * cycle. Booting it in isolation is a full-app integration boot — "override only unrelated
- * dependencies" balloons into faking ~4 subsystems, and `overrideProvider` cannot even grant the
- * cross-module export-scope visibility ChatGateway needs (probe: `ChatGateway` unresolved at
- * `CommandExecutorService`). That is exactly the STOP-and-return branch of the directive.
- *
- * The faithful, unmaskable cover instead of a fragile boot: read the PRODUCTION `ChatModule`'s own
- * Nest `@Module` metadata to prove it DECLARES the exclusive router provider and imports the real
- * `HarnessModule` (the genuine registry source). This inspects the actual module object — not
- * source text, not a test factory — so nothing can mask it. Group 1 above separately proves the
- * router RESOLVES against the real, empty `HarnessRegistry` through the Nest lifecycle; the union
- * of the two covers "the router is wired through ChatModule to the real registry" without the
- * impractical single-graph boot. RED today (ChatModule provides only ChatGateway and imports only
- * CommandsModule); GREEN once Step Three registers the router and imports HarnessModule.
- */
-describe('ChatModule production wiring (Task Five, Step Two group 1b — declaration proof)', () => {
-  // Unwrap a forwardRef(() => Module) import to the module it references; pass others through.
-  const resolveImport = (imp: unknown): unknown =>
-    imp &&
-    typeof imp === 'object' &&
-    typeof (imp as { forwardRef?: unknown }).forwardRef === 'function'
-      ? (imp as { forwardRef: () => unknown }).forwardRef()
-      : imp;
-
-  // A provider entry is either a class (shorthand) or a { provide, ... } object; take its token.
-  const providerToken = (provider: unknown): unknown =>
-    typeof provider === 'function' ? provider : (provider as { provide?: unknown })?.provide;
-
-  it('declares the exclusive ChatRuntimeRouter as a provider on the production ChatModule', () => {
-    const providers: unknown[] = Reflect.getMetadata('providers', ChatModule) ?? [];
-    expect(providers.map(providerToken)).toContain(ChatRuntimeRouter);
-  });
-
-  it('imports the real HarnessModule into the production ChatModule (registry source, not a test double)', () => {
-    const imports: unknown[] = Reflect.getMetadata('imports', ChatModule) ?? [];
-    expect(imports.map(resolveImport)).toContain(HarnessModule);
-  });
-});
-
-/**
- * Task Five, Step Two — group 1c (bounded real-`ChatModule` boot).
- *
- * Scrappy adjudication d67d2b (option c): boot the ACTUAL production `ChatModule` as the SUT and
- * assert the exclusive router resolves THROUGH it — the single-graph proof group 1 (router over the
- * real registry) and group 1b (production-module metadata) each cover only a half of. The heavy,
- * UNRELATED cycle is the only thing bounded away, per the established isolation pattern in
- * `apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts`:
- *   - `CommandsModule` (drags the Commands <-> Reload <-> Chat forwardRef cycle plus GC/Mcp/queue)
- *     is replaced wholesale with an empty module via `.overrideModule(...).useModule(...)`;
- *   - `ChatGateway` (10-arg constructor, an HTTP/socket concern never exercised here) is replaced
- *     with an inert value;
- *   - the sole legacy-controller dependency, `AgentService`, is supplied by a tiny `@Global()` stub;
- *   - the HTTP-only `AuthGuard` is stubbed.
- * Nothing about the router, `HarnessModule`, the registry, or the conversation-service binding is
- * faked in the production-legacy case — those are retrieved from the REAL `ChatModule` graph. Mode
- * is driven only through the production `CHAT_HARNESS_RUNTIME` env contract (`resolveChatRuntimeMode`).
- *
- * Red-first: today `ChatModule` neither imports `HarnessModule` nor provides `ChatRuntimeRouter`, so
- * the booted graph contains no router/registry/conversation-service tokens. `init()` may resolve
- * (there is no router lifecycle hook yet to reject), so every case fails on the MISSING actual
- * router/registry/service wiring — not on unrelated DI, which is bounded away. GREEN at Step Three
- * once `ChatModule` imports `HarnessModule`, provides the exclusive router, and binds the
- * conversation-service token (defaulting to the unavailable sentinel).
- */
-describe('ChatModule bounded real boot (Task Five, Step Two group 1c)', () => {
-  // The unrelated heavy cycle, replaced wholesale — not stubbed provider-by-provider.
-  @Module({})
-  class EmptyCommandsModule {}
-
-  // The ONLY genuine legacy dependency of the real ChatController, supplied inertly and globally so
-  // the pre-refactor controller instantiates without dragging AgentModule into the graph.
-  @Global()
-  @Module({
-    providers: [{ provide: AgentService, useValue: {} }],
-    exports: [AgentService],
-  })
-  class LegacyControllerDepsModule {}
-
-  const ORIGINAL_RUNTIME_ENV = process.env['CHAT_HARNESS_RUNTIME'];
-  afterEach(() => {
-    if (ORIGINAL_RUNTIME_ENV === undefined) delete process.env['CHAT_HARNESS_RUNTIME'];
-    else process.env['CHAT_HARNESS_RUNTIME'] = ORIGINAL_RUNTIME_ENV;
-  });
-
-  /**
-   * Boot the real ChatModule with only the unrelated cycle bounded away. `mode` is set through the
-   * genuine production env contract before providers instantiate. The optional overrides replace
-   * the registry / conversation-service the router injects, exercising the pi-rpc precondition
-   * branches through the ACTUAL module (they are no-ops today because those tokens are not yet in
-   * the graph — which is exactly why the router-retrieval assertions go red).
-   */
-  async function bootChatModule(
-    mode: ChatRuntimeMode,
-    overrides: {
-      registryAdapters?: readonly string[];
-      conversationService?: HarnessConversationServiceBinding;
-    } = {},
-  ): Promise<TestingModule> {
-    if (mode === 'pi-rpc') process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
-    else delete process.env['CHAT_HARNESS_RUNTIME'];
-
-    let builder = Test.createTestingModule({
-      imports: [LegacyControllerDepsModule, ChatModule],
-    })
-      .overrideModule(CommandsModule)
-      .useModule(EmptyCommandsModule)
-      .overrideProvider(ChatGateway)
-      .useValue({})
-      .overrideGuard(AuthGuard)
-      .useValue({ canActivate: () => true });
-
-    if (overrides.registryAdapters) {
-      builder = builder
-        .overrideProvider(HARNESS_REGISTRY)
-        .useValue(registryWith(overrides.registryAdapters));
-    }
-    if (overrides.conversationService !== undefined) {
-      builder = builder
-        .overrideProvider(HARNESS_CONVERSATION_SERVICE)
-        .useValue(overrides.conversationService);
-    }
-    return builder.compile();
-  }
-
-  // Capture an init rejection without letting a resolved init masquerade as success.
-  const initError = (moduleRef: TestingModule): Promise<unknown> =>
-    moduleRef.init().then(
-      () => new Error('module init resolved but the contract requires it to reject'),
-      (err: unknown) => err,
-    );
-
-  it('legacy mode: the actual router resolves the embedded runtime, the actual registry is empty, and the conversation-service token is the unavailable sentinel', async () => {
-    const moduleRef = await bootChatModule('legacy');
-    try {
-      await moduleRef.init();
-      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
-      expect(router.active.kind).toBe('embedded');
-
-      const registry = moduleRef.get<HarnessRegistry>(HARNESS_REGISTRY, { strict: false });
-      expect(registry).toBeInstanceOf(HarnessRegistry);
-      expect(registry.list()).toHaveLength(0);
-
-      const service = moduleRef.get<HarnessConversationServiceBinding>(
-        HARNESS_CONVERSATION_SERVICE,
-        {
-          strict: false,
-        },
-      );
-      expect(service).toBe(HARNESS_CONVERSATION_SERVICE_UNAVAILABLE);
-    } finally {
-      await moduleRef.close();
-    }
-  });
-
-  it('pi-rpc mode over the REAL empty registry fails closed at init with the typed adapter-unavailable error', async () => {
-    const moduleRef = await bootChatModule('pi-rpc');
-    try {
-      const err = await initError(moduleRef);
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('adapter_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    } finally {
-      await closeIgnoringFailedInit(moduleRef);
-    }
-  });
-
-  it('pi-rpc mode with a pi adapter present but the sentinel conversation service fails closed with the typed conversation-service-unavailable error', async () => {
-    const moduleRef = await bootChatModule('pi-rpc', {
-      registryAdapters: ['pi'],
-      conversationService: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-    });
-    try {
-      const err = await initError(moduleRef);
-      expect(err).toBeInstanceOf(ChatRuntimeUnavailableError);
-      expect((err as ChatRuntimeUnavailableError).reason).toBe('conversation_service_unavailable');
-      expect((err as ChatRuntimeUnavailableError).code).toBe('runtime_unsupported');
-    } finally {
-      await closeIgnoringFailedInit(moduleRef);
-    }
-  });
-
-  it('pi-rpc mode with a pi adapter and a bound conversation service: the actual router selects the harness runtime', async () => {
-    const moduleRef = await bootChatModule('pi-rpc', {
-      registryAdapters: ['pi'],
-      conversationService: boundConversationService,
-    });
-    try {
-      await moduleRef.init();
-      const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
-      expect(router.active.kind).toBe('harness');
-    } finally {
-      await moduleRef.close();
-    }
-  });
-});
-
-/**
- * Task Five, Step Two — group 2 (WHOLE production `AppModule` boot, legacy end-to-end wiring).
- *
- * The groups above bound away the heavy cycle to isolate the router. This group instead boots the
- * ACTUAL production `AppModule` (the exact graph `main.ts` runs) in the default LEGACY chat-runtime
- * mode, overriding ONLY the storage/network side-effect adapters so the boot is bounded and offline
- * — never the chat/router/harness/reload/commands surface under test. The bounded fakes are exactly
- * the disk/network leaves:
- *   - `ProviderService` (the #1 hang risk: its real `onModuleInit` starts an unref'd health-check
- *     `setInterval` and fetches Ollama over HTTP) → inert no-op instance;
- *   - `DB_HANDLE`/`DB` → a fake Drizzle-shaped handle that satisfies `runPgliteMigrations` (the local
- *     tier's `DatabaseModule.onModuleInit`) AND `DefaultRoutingRulesSeed.onModuleInit` (which reads a
- *     system-rule count — the fake reports rules already present so the seed insert is skipped),
- *     opening no real database;
- *   - `STORAGE_ADAPTER`/`MEMORY`/`MEMORY_ADAPTER`/`AUTH`/`BRAIN`/`LOG_SERVICE` → inert fakes so no
- *     storage/auth/log backend is contacted.
- * Local tier (the repo's `mosaic.config.json`) already disables BullMQ/Redis and the queue handles;
- * Discord/Telegram/MCP plugins are env-gated and disarmed by deleting their tokens. Nothing about the
- * router, `ChatModule`, `HarnessModule`, or `ChatGateway` is faked — those come from the REAL graph.
- *
- * The boot+init MUST SUCCEED cleanly (proven by `beforeAll` completing and the ChatGateway test
- * passing). Red-first: on this branch `ChatRuntimeRouter` is registered in NO module (ChatModule
- * provides only ChatGateway), so `moduleRef.get(ChatRuntimeRouter)` throws `UnknownElementException`
- * — a WIRING gap, NOT an init failure. That single retrieval is the intended behavioural red; it
- * flips green once Step Three registers the exclusive router. The ChatGateway retrieval and its
- * browser-facing method surface are asserted alongside and pass today, pinning that the boot itself
- * is healthy so the router failure cannot be mistaken for a mis-shaped fake or an unbounded side
- * effect.
- */
-describe('AppModule production boot — legacy ChatRuntimeRouter wiring (Task Five, Step Two group 2)', () => {
-  // A Drizzle-shaped fake that satisfies both DB consumers reached during a local-tier init:
-  //   • runPgliteMigrations(): reads handle.db.$client.exec + handle.db.execute(SELECT hashes);
-  //     exec is a no-op and execute yields an empty ledger, so migration statements no-op through.
-  //   • DefaultRoutingRulesSeed.seedDefaultRules(): db.select().from().where() must resolve to a
-  //     row set — we report a non-zero system-rule count so the seeding INSERT branch is skipped.
-  const fakeDb = {
-    $client: { exec: async (): Promise<void> => {} },
-    execute: async (): Promise<{ rows: unknown[] }> => ({ rows: [] }),
-    select: () => ({
-      from: () => ({
-        where: async (): Promise<Array<{ count: number }>> => [{ count: 1 }],
-      }),
-    }),
-    insert: () => ({ values: async (): Promise<void> => {} }),
-  };
-  const fakeDbHandle = { db: fakeDb, close: async (): Promise<void> => {} };
-  const fakeStorageAdapter = {
-    name: 'fake',
-    migrate: async (): Promise<void> => {},
-    close: async (): Promise<void> => {},
-  };
-  // Inert stand-in for the real ProviderService: no health-check interval, no Ollama fetch.
-  const fakeProviderService = {
-    onModuleInit: async (): Promise<void> => {},
-    onModuleDestroy: (): void => {},
-    getRegistry: () => ({
-      getAvailable: () => [],
-      getAll: () => [],
-      find: () => undefined,
-    }),
-    getDefaultModel: () => undefined,
-    listAvailableModels: () => [],
-    listProviders: () => [],
-    getAdapter: () => undefined,
-    getProvidersHealth: () => [],
-  };
-  const fakeBrain = { conversations: {}, agents: {} };
-
-  const BOOT_TIMEOUT_MS = 120_000;
-
-  let moduleRef: TestingModule;
-  let envSnapshot: Record<string, string | undefined>;
-
-  beforeAll(async () => {
-    envSnapshot = { ...process.env };
-    // Env hygiene: disarm the network-facing plugins/adapters and pin the legacy runtime mode.
-    delete process.env['DATABASE_URL'];
-    delete process.env['DISCORD_BOT_TOKEN'];
-    delete process.env['TELEGRAM_BOT_TOKEN'];
-    delete process.env['MCP_SERVERS'];
-    delete process.env['CHAT_HARNESS_RUNTIME']; // resolveChatRuntimeMode → 'legacy'
-    process.env['MOSAIC_STORAGE_TIER'] = 'local';
-
-    moduleRef = await Test.createTestingModule({ imports: [AppModule] })
-      // Storage/network side-effect adapters ONLY — never the router/chat/harness surface under test.
-      .overrideProvider('DB_HANDLE')
-      .useValue(fakeDbHandle)
-      .overrideProvider('DB')
-      .useValue(fakeDb)
-      .overrideProvider('STORAGE_ADAPTER')
-      .useValue(fakeStorageAdapter)
-      .overrideProvider('AUTH')
-      .useValue({})
-      .overrideProvider('BRAIN')
-      .useValue(fakeBrain)
-      .overrideProvider('LOG_SERVICE')
-      .useValue({})
-      .overrideProvider('MEMORY')
-      .useValue({})
-      .overrideProvider('MEMORY_ADAPTER')
-      .useValue({})
-      .overrideProvider(ProviderService)
-      .useValue(fakeProviderService)
-      .compile();
-
-    // The boot itself MUST succeed cleanly — a rejection here is a bounding failure, not the red.
-    await moduleRef.init();
-  }, BOOT_TIMEOUT_MS);
-
-  afterAll(async () => {
-    if (moduleRef) await moduleRef.close();
-    for (const key of Object.keys(process.env)) {
-      if (!(key in envSnapshot)) delete process.env[key];
-    }
-    for (const [key, value] of Object.entries(envSnapshot)) {
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-  });
-
-  // Passes TODAY: the real ChatGateway is provided by the real ChatModule and its browser-facing
-  // surface exists. This pins that the whole-AppModule boot came up healthy, so the router failure
-  // below is unambiguously a wiring gap and not a mis-shaped fake or an unbounded side effect.
-  it('boots the whole AppModule and exposes the real ChatGateway with its browser-facing methods', () => {
-    const gateway = moduleRef.get(ChatGateway, { strict: false });
-    expect(typeof gateway.broadcastReload).toBe('function');
-    expect(typeof gateway.getModelOverride).toBe('function');
-    expect(typeof gateway.setModelOverride).toBe('function');
-    expect(typeof gateway.broadcastSessionInfo).toBe('function');
-  });
-
-  // RED TODAY: ChatRuntimeRouter is registered in no module on this branch, so this retrieval throws
-  // UnknownElementException — the intended red-first wiring failure. GREEN once Step Three registers
-  // the exclusive router in the production graph, where legacy mode resolves the embedded runtime.
-  it('resolves the exclusive ChatRuntimeRouter to the embedded runtime in legacy mode', () => {
-    const router = moduleRef.get(ChatRuntimeRouter, { strict: false });
-    expect(router.active.kind).toBe('embedded');
-  });
-});

apps/gateway/src/chat/chat-runtime-router.ts

@@ -1,173 +0,0 @@
-import { Injectable, type OnModuleInit } from '@nestjs/common';
-import { HarnessRegistry } from '../harness/harness.registry.js';
-import {
-  isHarnessConversationServiceAvailable,
-  type HarnessConversationServiceBinding,
-} from '../harness/harness.tokens.js';
-import type {
-  ChatRuntime,
-  ChatRuntimeMode,
-  LegacyBrowserMessagePayload,
-  LegacyEmbeddedChatPort,
-  LegacyRuntimeResult,
-  LegacyRuntimeStream,
-  LegacySessionPresentation,
-  LegacySocketTurnLease,
-  OwnedConversationContext,
-  VerifiedDiscordIngressContext,
-  VerifiedDiscordTurnLease,
-} from './chat-runtime.js';
-import { ChatRuntimeUnavailableError, resolveChatRuntimeMode } from './chat-runtime.js';
-
-/** The fixed fail-closed result for a legacy browser operation issued under `pi-rpc`. */
-const RUNTIME_UNSUPPORTED = {
-  ok: false as const,
-  code: 'runtime_unsupported' as const,
-  retryable: false as const,
-};
-
-/**
- * Resolves the one live {@link ChatRuntime} for this process and enforces the
- * `pi-rpc` readiness preconditions at module init — before the gateway accepts
- * traffic. It never falls back from `pi-rpc` to embedded execution: an unmet
- * `pi-rpc` precondition is a typed startup failure ({@link ChatRuntimeUnavailableError}),
- * and until `onModuleInit` selects a runtime, {@link active} throws rather than
- * exposing any runtime — a failed `pi-rpc` init can never leak the embedded one.
- */
-@Injectable()
-export class ChatRuntimeRouter implements OnModuleInit, LegacyEmbeddedChatPort {
-  private readonly mode: ChatRuntimeMode;
-
-  /** The single resolved runtime. Undefined until a successful `onModuleInit`. */
-  private resolved: ChatRuntime | undefined;
-
-  constructor(
-    private readonly harnessRegistry: HarnessRegistry,
-    private readonly conversationService: HarnessConversationServiceBinding,
-    private readonly embedded: ChatRuntime,
-    private readonly harness: ChatRuntime,
-    mode: ChatRuntimeMode = resolveChatRuntimeMode(),
-  ) {
-    this.mode = mode;
-  }
-
-  onModuleInit(): void {
-    if (this.mode === 'legacy') {
-      // Legacy ignores the pi-rpc preconditions entirely and always runs embedded.
-      this.resolved = this.embedded;
-      return;
-    }
-
-    // pi-rpc: both preconditions are hard startup failures, checked in a fixed order.
-    if (!this.harnessRegistry.has('pi')) {
-      this.resolved = undefined;
-      throw new ChatRuntimeUnavailableError('adapter_unavailable');
-    }
-    if (!isHarnessConversationServiceAvailable(this.conversationService)) {
-      this.resolved = undefined;
-      throw new ChatRuntimeUnavailableError('conversation_service_unavailable');
-    }
-
-    this.resolved = this.harness;
-  }
-
-  get active(): ChatRuntime {
-    if (this.resolved === undefined) {
-      // Reached only if init has not run or failed closed; never expose a runtime here.
-      throw new Error('The chat runtime is not available: startup did not resolve a runtime.');
-    }
-    return this.resolved;
-  }
-
-  /**
-   * The process-wide mode, available before {@link onModuleInit}. Production handlers read
-   * this to fail a legacy browser turn closed under `pi-rpc` *before* parsing the payload as
-   * either browser-legacy input or a Discord envelope — never to branch into a fallback.
-   */
-  get runtimeMode(): ChatRuntimeMode {
-    return this.mode;
-  }
-
-  /**
-   * The embedded runtime narrowed to its port. Only reached on the legacy path (and for the
-   * verified-Discord op in both modes), where the injected runtime is always a real
-   * `EmbeddedChatRuntime`. The router spec constructs the router with a bare `{ kind }` stub
-   * but never invokes a port op, so this narrowing is never exercised against the stub.
-   */
-  private get embeddedPort(): LegacyEmbeddedChatPort {
-    return this.embedded as unknown as LegacyEmbeddedChatPort;
-  }
-
-  // --- LegacyEmbeddedChatPort: legacy browser operations fail closed under pi-rpc ---
-
-  completeLegacyRestTurn(
-    context: OwnedConversationContext,
-    input: Readonly<{ content: string }>,
-  ): Promise<
-    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
-  > {
-    if (this.mode === 'pi-rpc') {
-      return Promise.resolve(RUNTIME_UNSUPPORTED);
-    }
-    return this.embeddedPort.completeLegacyRestTurn(context, input);
-  }
-
-  prepareLegacySocketTurn(
-    context: OwnedConversationContext,
-    input: LegacyBrowserMessagePayload,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>> {
-    if (this.mode === 'pi-rpc') {
-      return Promise.resolve(RUNTIME_UNSUPPORTED);
-    }
-    return this.embeddedPort.prepareLegacySocketTurn(context, input, stream);
-  }
-
-  setLegacyThinking(
-    context: OwnedConversationContext,
-    level: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    if (this.mode === 'pi-rpc') {
-      return RUNTIME_UNSUPPORTED;
-    }
-    return this.embeddedPort.setLegacyThinking(context, level);
-  }
-
-  abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>> {
-    if (this.mode === 'pi-rpc') {
-      return Promise.resolve(RUNTIME_UNSUPPORTED);
-    }
-    return this.embeddedPort.abortLegacyTurn(context);
-  }
-
-  applyLegacyModelOverride(
-    context: OwnedConversationContext,
-    modelId: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    if (this.mode === 'pi-rpc') {
-      return RUNTIME_UNSUPPORTED;
-    }
-    return this.embeddedPort.applyLegacyModelOverride(context, modelId);
-  }
-
-  readLegacySessionPresentation(
-    context: OwnedConversationContext,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    if (this.mode === 'pi-rpc') {
-      return RUNTIME_UNSUPPORTED;
-    }
-    return this.embeddedPort.readLegacySessionPresentation(context);
-  }
-
-  /**
-   * Verified Discord ingress bypasses browser mode: it is embedded-only in BOTH modes and
-   * never reaches the harness or routing-engine selection. It is reached only through a
-   * {@link VerifiedDiscordIngressContext}, which exists only after every ingress check.
-   */
-  dispatchVerifiedDiscordIngress(
-    context: VerifiedDiscordIngressContext,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>> {
-    return this.embeddedPort.dispatchVerifiedDiscordIngress(context, stream);
-  }
-}

apps/gateway/src/chat/chat-runtime.ts

@@ -1,273 +0,0 @@
-import type { ChannelAttachmentDto, RoutingDecisionInfo } from '@mosaicstack/types';
-
-/**
- * The single chat execution strategy resolved by {@link ChatRuntimeRouter}.
- *
- * Exactly one runtime is live per process. There is no union that lets a
- * `pi-rpc` deployment silently fall back to embedded execution: an unmet
- * `pi-rpc` precondition is a typed startup failure, never a downgrade.
- */
-export type ChatRuntimeMode = 'legacy' | 'pi-rpc';
-
-export type ChatRuntimeKind = 'embedded' | 'harness';
-
-/** The resolved runtime. Slice Zero exposes only its immutable {@link ChatRuntimeKind}. */
-export interface ChatRuntime {
-  readonly kind: ChatRuntimeKind;
-}
-
-/** Why the `pi-rpc` runtime could not be made ready. Both are hard startup failures. */
-export type ChatRuntimeUnavailableReason =
-  | 'adapter_unavailable'
-  | 'conversation_service_unavailable';
-
-/**
- * Raised at module init when `pi-rpc` mode is selected but its preconditions are
- * unmet. Carries only fixed, browser-safe text — never a raw exception message,
- * stack, or provider detail — and reports the frozen ack code `runtime_unsupported`.
- */
-export class ChatRuntimeUnavailableError extends Error {
-  readonly code = 'runtime_unsupported' as const;
-  readonly reason: ChatRuntimeUnavailableReason;
-
-  constructor(reason: ChatRuntimeUnavailableReason) {
-    super(
-      reason === 'adapter_unavailable'
-        ? 'The pi-rpc chat runtime is unavailable: no "pi" harness adapter is registered.'
-        : 'The pi-rpc chat runtime is unavailable: the harness conversation service is not bound.',
-    );
-    this.name = 'ChatRuntimeUnavailableError';
-    this.reason = reason;
-  }
-}
-
-/**
- * Resolves the process-wide chat runtime mode from the environment. Anything other
- * than the exact opt-in token `pi-rpc` keeps the legacy embedded runtime.
- */
-export function resolveChatRuntimeMode(
-  env: Record<string, string | undefined> = process.env,
-): ChatRuntimeMode {
-  return env['CHAT_HARNESS_RUNTIME'] === 'pi-rpc' ? 'pi-rpc' : 'legacy';
-}
-
-// ---------------------------------------------------------------------------
-// Transitional embedded chat port (Task Five).
-//
-// The legacy embedded browser behaviour is moved behind this exact interface so
-// neither the controller nor the gateway retains AgentService, RoutingEngine,
-// session, `piSession`, metric, listener, or channel access. `EmbeddedChatRuntime`
-// implements the port; `ChatRuntimeRouter` exposes the same narrowly named
-// operations and returns `runtime_unsupported` before touching Embedded for legacy
-// browser operations when the mode is `pi-rpc`.
-//
-// The names are frozen (spec jarvis-brain@1c629b06). Legacy REST completion,
-// legacy Socket streaming, P3 harness turns, and verified Discord are distinct
-// transport/trust capabilities — there is deliberately no generic
-// `sendConversationTurn` nor an AgentService-shaped mirror on the router.
-// ---------------------------------------------------------------------------
-
-/**
- * Phantom brand keeping {@link OwnedConversationContext} nominally distinct so browser
- * DTOs are never structurally assignable to it. The factory that mints one may be called
- * only after authentication with `scopeFromUser(...)`, never with payload authority fields.
- */
-declare const ownedConversationContextBrand: unique symbol;
-
-/** Gateway-only ownership context. Embedded rechecks owner+tenant on every operation. */
-export interface OwnedConversationContext {
-  readonly [ownedConversationContextBrand]: true;
-  readonly conversationId: string;
-  readonly scope: Readonly<{ userId: string; tenantId: string }>;
-}
-
-/**
- * Every non-`ok` legacy runtime outcome. Missing, foreign, and no-longer-owned
- * conversations all collapse to `conversation_unavailable`. Ownership/mode/validation
- * failures are total results and never throw.
- */
-export type LegacyRuntimeFailure =
-  | { readonly ok: false; readonly code: 'runtime_unsupported'; readonly retryable: false }
-  | { readonly ok: false; readonly code: 'conversation_unavailable'; readonly retryable: false }
-  | { readonly ok: false; readonly code: 'request_invalid'; readonly retryable: false }
-  | {
-      readonly ok: false;
-      readonly code: 'thinking_level_invalid';
-      readonly retryable: false;
-      readonly availableThinkingLevels: readonly string[];
-    }
-  | { readonly ok: false; readonly code: 'runtime_unavailable'; readonly retryable: true }
-  | { readonly ok: false; readonly code: 'turn_already_dispatched'; readonly retryable: false }
-  | { readonly ok: false; readonly code: 'operation_failed'; readonly retryable: boolean }
-  | { readonly ok: false; readonly code: 'timeout'; readonly retryable: true };
-
-/** Total result: an `ok` value or one of the fixed {@link LegacyRuntimeFailure} codes. */
-export type LegacyRuntimeResult<T> =
-  | { readonly ok: true; readonly value: T }
-  | LegacyRuntimeFailure;
-
-/** User-facing session projection. Carries no session object, handle, or credential path. */
-export interface LegacySessionPresentation {
-  readonly provider: string;
-  readonly modelId: string;
-  readonly thinkingLevel: string;
-  readonly availableThinkingLevels: readonly string[];
-  readonly agentName?: string;
-  readonly routingDecision?: RoutingDecisionInfo;
-}
-
-/** Terminal usage stats, normalized by Embedded from AgentService metrics. */
-export interface LegacyUsage {
-  readonly provider: string;
-  readonly modelId: string;
-  readonly thinkingLevel: string;
-  readonly tokens: Readonly<{
-    input: number;
-    output: number;
-    cacheRead: number;
-    cacheWrite: number;
-    total: number;
-  }>;
-  readonly cost: number;
-  readonly context: Readonly<{ percent: number | null; window: number }>;
-}
-
-/**
- * Normalized stream event. Exposes no `AgentSession`, `piSession`, native handle, raw
- * exception, tool arguments, or credential-bearing path — the gateway sees only these.
- */
-export type LegacyRuntimeEvent =
-  | { readonly type: 'started' }
-  | { readonly type: 'text_delta'; readonly text: string }
-  | { readonly type: 'thinking_delta'; readonly text: string }
-  | {
-      readonly type: 'tool_started';
-      readonly toolCallId: string;
-      readonly toolName: string;
-    }
-  | {
-      readonly type: 'tool_finished';
-      readonly toolCallId: string;
-      readonly toolName: string;
-      readonly isError: boolean;
-    }
-  | { readonly type: 'settled'; readonly usage?: LegacyUsage };
-
-/** Legacy browser message input. Authority fields are advisory only; scope comes from the context. */
-export interface LegacyBrowserMessagePayload {
-  readonly content: string;
-  readonly provider?: string;
-  readonly modelId?: string;
-  readonly agentId?: string;
-  readonly attachments?: readonly ChannelAttachmentDto[];
-}
-
-/** A prepared-but-not-yet-dispatched legacy socket turn. */
-export interface LegacySocketTurnLease {
-  readonly presentation: LegacySessionPresentation;
-  /**
-   * Atomically one-shot and scope-rechecking. A second call returns
-   * `turn_already_dispatched` and performs zero prompt/tool effects.
-   */
-  dispatch(): Promise<LegacyRuntimeResult<void>>;
-  /** Idempotent, non-throwing. Removes listener and channel, including partial setup. */
-  dispose(): Promise<void>;
-}
-
-/**
- * Phantom brand for {@link VerifiedDiscordIngressContext}. Minted only after service-token
- * auth plus signature, allowlist, binding, expected-route, replay, configured-agent,
- * forced-scope, and attachment-normalization checks.
- */
-declare const verifiedDiscordIngressContextBrand: unique symbol;
-
-/** Fully-verified Discord ingress. Contains no socket, envelope, signature, token, or escape hatch. */
-export interface VerifiedDiscordIngressContext {
-  readonly [verifiedDiscordIngressContextBrand]: true;
-  readonly conversationId: string;
-  readonly scope: Readonly<{ userId: string; tenantId: string }>;
-  readonly configuredAgent: Readonly<{ agentConfigId: string; instanceId: string }>;
-  readonly content: string;
-  readonly attachments?: readonly ChannelAttachmentDto[];
-  readonly correlationId: string;
-  readonly discordMessageId: string;
-  readonly discordUserId: string;
-}
-
-/** Verified-Discord turn lease. Same atomic one-shot dispatch and idempotent dispose rules. */
-export interface VerifiedDiscordTurnLease {
-  readonly presentation: LegacySessionPresentation;
-  dispatch(): Promise<LegacyRuntimeResult<void>>;
-  dispose(): Promise<void>;
-}
-
-/** Server-owned egress projection the runtime pushes normalized events into. */
-export interface LegacyRuntimeStream {
-  /** Server-derived, e.g. `websocket:<socket-id>`. Never client-supplied. */
-  readonly channelId: string;
-  onEvent(event: LegacyRuntimeEvent): void;
-}
-
-/**
- * The exact transitional port. `EmbeddedChatRuntime` implements it; `ChatRuntimeRouter`
- * mirrors the operation names and fails closed with `runtime_unsupported` for legacy
- * browser operations under `pi-rpc`.
- */
-export interface LegacyEmbeddedChatPort {
-  completeLegacyRestTurn(
-    context: OwnedConversationContext,
-    input: Readonly<{ content: string }>,
-  ): Promise<
-    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
-  >;
-
-  prepareLegacySocketTurn(
-    context: OwnedConversationContext,
-    input: LegacyBrowserMessagePayload,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>>;
-
-  setLegacyThinking(
-    context: OwnedConversationContext,
-    level: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation>;
-
-  abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>>;
-
-  applyLegacyModelOverride(
-    context: OwnedConversationContext,
-    modelId: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation>;
-
-  readLegacySessionPresentation(
-    context: OwnedConversationContext,
-  ): LegacyRuntimeResult<LegacySessionPresentation>;
-
-  dispatchVerifiedDiscordIngress(
-    context: VerifiedDiscordIngressContext,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>>;
-}
-
-/**
- * Mints an {@link OwnedConversationContext} from a server-derived scope. Callers must pass
- * a scope produced by `scopeFromUser(...)` after authentication — never a client-supplied
- * authority field. The brand is phantom, so this is the only way to obtain the branded type.
- */
-export function ownConversation(
-  conversationId: string,
-  scope: Readonly<{ userId: string; tenantId: string }>,
-): OwnedConversationContext {
-  return { conversationId, scope } as unknown as OwnedConversationContext;
-}
-
-/**
- * Mints a {@link VerifiedDiscordIngressContext}. Callers must have already completed every
- * ingress check (service-token auth, signature, allowlist, binding, expected-route, replay,
- * configured-agent, forced-scope, attachment normalization) before calling this.
- */
-export function verifyDiscordIngress(
-  fields: Omit<VerifiedDiscordIngressContext, typeof verifiedDiscordIngressContextBrand>,
-): VerifiedDiscordIngressContext {
-  return { ...fields } as unknown as VerifiedDiscordIngressContext;
-}

apps/gateway/src/chat/chat.controller.ts

@@ -3,20 +3,21 @@ import {
   Post,
   Body,
   Logger,
+  ForbiddenException,
   HttpException,
   HttpStatus,
   NotFoundException,
+  Inject,
   UseGuards,
 } from '@nestjs/common';
+import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
 import { Throttle } from '@nestjs/throttler';
+import { AgentService } from '../agent/agent.service.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
 import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
 import { v4 as uuid } from 'uuid';
 import { ChatRequestDto } from './chat.dto.js';
-import { ChatRuntimeRouter } from './chat-runtime-router.js';
-import { ownConversation } from './chat-runtime.js';
-import type { LegacyRuntimeFailure } from './chat-runtime.js';
 
 interface ChatResponse {
   conversationId: string;
@@ -28,7 +29,7 @@ interface ChatResponse {
 export class ChatController {
   private readonly logger = new Logger(ChatController.name);
 
-  constructor(private readonly runtime: ChatRuntimeRouter) {}
+  constructor(@Inject(AgentService) private readonly agentService: AgentService) {}
 
   @Post()
   @Throttle({ default: { limit: 10, ttl: 60_000 } })
@@ -39,38 +40,68 @@ export class ChatController {
     const conversationId = body.conversationId ?? uuid();
     const scope = scopeFromUser(user);
 
+    try {
+      let agentSession = this.agentService.getSession(conversationId, scope);
+      if (!agentSession) {
+        agentSession = await this.agentService.createSession(conversationId, {
+          userId: scope.userId,
+          tenantId: scope.tenantId,
+        });
+      }
+    } catch (err) {
+      if (err instanceof ForbiddenException) {
+        throw new NotFoundException('Session not found');
+      }
+      this.logger.error(
+        `Session creation failed for conversation=${conversationId}`,
+        err instanceof Error ? err.stack : String(err),
+      );
+      throw new HttpException('Agent session unavailable', HttpStatus.SERVICE_UNAVAILABLE);
+    }
+
     this.logger.debug(`Handling chat request for user=${user.id}, conversation=${conversationId}`);
 
-    // The one exclusive runtime owns execution. In legacy mode this reaches the embedded runtime;
-    // in pi-rpc it fails closed with `runtime_unsupported` before ever touching embedded execution.
-    const result = await this.runtime.completeLegacyRestTurn(
-      ownConversation(conversationId, scope),
-      { content: body.content },
-    );
+    let responseText = '';
 
-    if (result.ok) {
-      return { conversationId, text: result.value.text };
+    const done = new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        cleanup();
+        this.logger.error(`Agent response timed out after 120s for conversation=${conversationId}`);
+        reject(new Error('Agent response timed out'));
+      }, 120_000);
+
+      const cleanup = this.agentService.onEvent(
+        conversationId,
+        (event: AgentSessionEvent) => {
+          if (
+            event.type === 'message_update' &&
+            event.assistantMessageEvent.type === 'text_delta'
+          ) {
+            responseText += event.assistantMessageEvent.delta;
+          }
+          if (event.type === 'agent_end') {
+            clearTimeout(timer);
+            cleanup();
+            resolve();
+          }
+        },
+        scope,
+      );
+    });
+
+    try {
+      await this.agentService.prompt(conversationId, body.content, scope);
+      await done;
+    } catch (err) {
+      if (err instanceof HttpException) throw err;
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes('timed out')) {
+        throw new HttpException('Agent response timed out', HttpStatus.GATEWAY_TIMEOUT);
+      }
+      this.logger.error(`Chat prompt failed for conversation=${conversationId}`, String(err));
+      throw new HttpException('Agent processing failed', HttpStatus.INTERNAL_SERVER_ERROR);
     }
 
-    throw this.toHttpException(result, conversationId);
-  }
-
-  /** Maps a total {@link LegacyRuntimeFailure} to the fixed browser-safe HTTP surface. */
-  private toHttpException(failure: LegacyRuntimeFailure, conversationId: string): HttpException {
-    switch (failure.code) {
-      case 'conversation_unavailable':
-        return new NotFoundException('Session not found');
-      case 'request_invalid':
-      case 'thinking_level_invalid':
-        return new HttpException('Invalid chat request', HttpStatus.BAD_REQUEST);
-      case 'timeout':
-        return new HttpException('Agent response timed out', HttpStatus.GATEWAY_TIMEOUT);
-      case 'runtime_unsupported':
-      case 'runtime_unavailable':
-        return new HttpException('Agent runtime unavailable', HttpStatus.SERVICE_UNAVAILABLE);
-      default:
-        this.logger.error(`Chat turn failed for conversation=${conversationId}: ${failure.code}`);
-        return new HttpException('Agent processing failed', HttpStatus.INTERNAL_SERVER_ERROR);
-    }
+    return { conversationId, text: responseText };
   }
 }

apps/gateway/src/chat/chat.dto.ts

@@ -1,14 +1,5 @@
 import type { ChannelAttachmentDto } from '@mosaicstack/types';
-import { Transform, Type } from 'class-transformer';
-import {
-  IsNotEmpty,
-  IsObject,
-  IsOptional,
-  IsString,
-  IsUUID,
-  MaxLength,
-  ValidateNested,
-} from 'class-validator';
+import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
 
 export class ChatRequestDto {
   @IsOptional()
@@ -46,56 +37,3 @@ export class ChatSocketMessageDto {
   /** Validated channel attachment references; binary content is not embedded. */
   attachments?: readonly ChannelAttachmentDto[];
 }
-
-/**
- * Task Five, group 2 — the frozen pi-rpc `turn:send` selection triple.
- *
- * Each id is a required, non-empty, bounded string. There is no `@IsOptional` and no extra
- * field: under `forbidNonWhitelisted` an unknown selection key is rejected, and a missing id
- * fails `@IsString` (undefined is not a string) rather than silently passing.
- */
-export class HarnessTurnSelectionDto {
-  @IsString()
-  @IsNotEmpty()
-  @MaxLength(255)
-  harnessId!: string;
-
-  @IsString()
-  @IsNotEmpty()
-  @MaxLength(255)
-  providerId!: string;
-
-  @IsString()
-  @IsNotEmpty()
-  @MaxLength(255)
-  modelId!: string;
-}
-
-/**
- * Task Five, group 2 — the frozen wire contract for a pi-rpc `turn:send`.
- *
- * Validated through the production `ValidationPipe({ whitelist, forbidNonWhitelisted, transform })`:
- * a UUID conversation id; `content` trimmed then bounded to 1..10_000 characters (whitespace-only
- * collapses to empty and fails `@IsNotEmpty`); a nested `selection` object recursed with an
- * explicit `@Type` (a bare `@ValidateNested` is masked green by class-validator's empty-metadata
- * `unknownValue`); and a UUID-v4 idempotency key. No `provider`/`modelId`/`attachments` or other
- * authority field is declared, so `forbidNonWhitelisted` rejects every unknown top-level key.
- */
-export class HarnessTurnSendDto {
-  @IsUUID()
-  conversationId!: string;
-
-  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
-  @IsString()
-  @IsNotEmpty()
-  @MaxLength(10_000)
-  content!: string;
-
-  @IsObject()
-  @ValidateNested()
-  @Type(() => HarnessTurnSelectionDto)
-  selection!: HarnessTurnSelectionDto;
-
-  @IsUUID('4')
-  idempotencyKey!: string;
-}

apps/gateway/src/chat/chat.gateway-command-approval.spec.ts

@@ -8,31 +8,12 @@ const payload: SlashCommandPayload = {
   approvalId: 'approval-1',
 };
 
-/**
- * Task 5 fence (F, existing control): gateway-owned command authorization/approval must
- * cause ZERO chat-runtime dispatch. Placed in the gateway's chat-runtime-router slot (the
- * former direct `AgentService` slot) so any accidental chat-runtime resolution throws
- * loudly instead of silently passing. Because execute/approval run entirely through the
- * command executor dependency and never resolve a chat runtime, this fixture is never
- * triggered and the ingress stays a GREEN control.
- */
-function failIfUsedChatRuntimeRouter() {
-  return {
-    onModuleInit: () => {
-      throw new Error('chat runtime router must not initialise on the command approval path');
-    },
-    get active(): never {
-      throw new Error('chat runtime must not be resolved on the command approval path');
-    },
-  };
-}
-
 function buildGateway(commandExecutor: {
   execute: ReturnType<typeof vi.fn>;
   createApproval: ReturnType<typeof vi.fn>;
 }): ChatGateway {
   return new ChatGateway(
-    failIfUsedChatRuntimeRouter() as never,
+    {} as never,
     {} as never,
     {} as never,
     {} as never,
@@ -91,114 +72,3 @@ describe('ChatGateway command approval ingress', () => {
     });
   });
 });
-
-/**
- * Task 5 (G3) command runtime fence. Under pi-rpc there is no embedded chat session, so
- * embedded slash-commands (/model, /agent, and every other non-audited command) are fixed
- * "unsupported" and MUST fail closed BEFORE reaching the command executor — never a silent
- * fall-through to embedded execution. Only runtime-independent audited system commands
- * (/reload) pass through as a positive control, and the approval path stays runtime-independent.
- * The router stub here carries `runtimeMode: 'pi-rpc'` and throws if any runtime is resolved, so
- * a fence bypass surfaces as a thrown error rather than a silent embedded dispatch.
- */
-function buildPiRpcGateway(commandExecutor: {
-  execute: ReturnType<typeof vi.fn>;
-  createApproval: ReturnType<typeof vi.fn>;
-}): ChatGateway {
-  const piRpcRouter = {
-    runtimeMode: 'pi-rpc' as const,
-    onModuleInit: () => {
-      throw new Error('chat runtime router must not initialise on the pi-rpc command path');
-    },
-    get active(): never {
-      throw new Error('chat runtime must not be resolved on the pi-rpc command path');
-    },
-  };
-  return new ChatGateway(
-    piRpcRouter as never,
-    {} as never,
-    {} as never,
-    {} as never,
-    commandExecutor as never,
-    {} as never,
-  );
-}
-
-describe('ChatGateway command runtime fence (Task 5 G3, pi-rpc)', () => {
-  const UNSUPPORTED = 'Slash commands are not available on this deployment.';
-
-  it.each(['model', 'agent', 'gc'])(
-    'fails /%s closed before the executor under pi-rpc (execute never called)',
-    async (command): Promise<void> => {
-      const commandExecutor = {
-        execute: vi
-          .fn()
-          .mockResolvedValue({ command, conversationId: 'conversation-1', success: true }),
-        createApproval: vi.fn(),
-      };
-      const gateway = buildPiRpcGateway(commandExecutor);
-      const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-      await gateway.handleCommandExecute(client as never, {
-        command,
-        conversationId: 'conversation-1',
-      });
-
-      expect(commandExecutor.execute).toHaveBeenCalledTimes(0);
-      expect(client.emit).toHaveBeenCalledWith('command:result', {
-        command,
-        conversationId: 'conversation-1',
-        success: false,
-        message: UNSUPPORTED,
-      });
-    },
-  );
-
-  it('passes the audited /reload system command through as a positive control under pi-rpc', async (): Promise<void> => {
-    const reloadResult = { command: 'reload', conversationId: 'conversation-1', success: true };
-    const commandExecutor = {
-      execute: vi.fn().mockResolvedValue(reloadResult),
-      createApproval: vi.fn(),
-    };
-    const gateway = buildPiRpcGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandExecute(client as never, {
-      command: 'reload',
-      conversationId: 'conversation-1',
-    });
-
-    expect(commandExecutor.execute).toHaveBeenCalledTimes(1);
-    expect(commandExecutor.execute).toHaveBeenCalledWith(
-      { command: 'reload', conversationId: 'conversation-1' },
-      { userId: 'admin-1', tenantId: 'admin-1' },
-    );
-    expect(client.emit).toHaveBeenCalledWith('command:result', reloadResult);
-  });
-
-  it('keeps command approval runtime-independent under pi-rpc (createApproval still runs)', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn(),
-      createApproval: vi.fn().mockResolvedValue({
-        approvalId: 'approval-1',
-        expiresAt: '2026-07-12T00:05:00.000Z',
-      }),
-    };
-    const gateway = buildPiRpcGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandApproval(client as never, {
-      command: 'gc',
-      conversationId: 'conversation-1',
-    });
-
-    expect(commandExecutor.createApproval).toHaveBeenCalledWith(
-      { command: 'gc', conversationId: 'conversation-1' },
-      { userId: 'admin-1', tenantId: 'admin-1' },
-    );
-    expect(client.emit).toHaveBeenCalledWith(
-      'command:approval',
-      expect.objectContaining({ success: true, approvalId: 'approval-1' }),
-    );
-  });
-});

apps/gateway/src/chat/chat.module.ts

@@ -1,59 +1,12 @@
 import { forwardRef, Module } from '@nestjs/common';
 import { CommandsModule } from '../commands/commands.module.js';
-import { HarnessModule } from '../harness/harness.module.js';
-import { HarnessRegistry } from '../harness/harness.registry.js';
-import {
-  HARNESS_CONVERSATION_SERVICE,
-  HARNESS_REGISTRY,
-  type HarnessConversationServiceBinding,
-} from '../harness/harness.tokens.js';
-import type { HarnessConversationService } from '@mosaicstack/types';
 import { ChatGateway } from './chat.gateway.js';
 import { ChatController } from './chat.controller.js';
-import { ChatRuntimeRouter } from './chat-runtime-router.js';
-import { EmbeddedChatRuntime } from './embedded-chat.runtime.js';
-import { HarnessChatRuntime } from './harness-chat.runtime.js';
 
-/**
- * Task Five wiring. The exclusive {@link ChatRuntimeRouter} is the single chat-execution
- * authority: the controller and gateway inject only the router, never `AgentService`,
- * `RoutingEngineService`, or a session/`piSession` handle. The router resolves exactly one
- * runtime at module init — {@link EmbeddedChatRuntime} in legacy mode, {@link HarnessChatRuntime}
- * in `pi-rpc` — over the REAL {@link HarnessModule} registry and conversation-service binding.
- *
- * The router and the harness runtime are constructed through factories because their
- * dependencies are interface/union types with no runtime injection token (the registry and
- * conversation-service arrive via the string tokens exported by `HarnessModule`); the embedded
- * runtime injects the class-typed `AgentService` and is provided directly.
- */
 @Module({
-  imports: [forwardRef(() => CommandsModule), HarnessModule],
+  imports: [forwardRef(() => CommandsModule)],
   controllers: [ChatController],
-  providers: [
-    ChatGateway,
-    EmbeddedChatRuntime,
-    {
-      provide: HarnessChatRuntime,
-      useFactory: (conversationService: HarnessConversationServiceBinding) =>
-        new HarnessChatRuntime(conversationService as HarnessConversationService),
-      inject: [HARNESS_CONVERSATION_SERVICE],
-    },
-    {
-      provide: ChatRuntimeRouter,
-      useFactory: (
-        registry: HarnessRegistry,
-        conversationService: HarnessConversationServiceBinding,
-        embedded: EmbeddedChatRuntime,
-        harness: HarnessChatRuntime,
-      ) => new ChatRuntimeRouter(registry, conversationService, embedded, harness),
-      inject: [
-        HARNESS_REGISTRY,
-        HARNESS_CONVERSATION_SERVICE,
-        EmbeddedChatRuntime,
-        HarnessChatRuntime,
-      ],
-    },
-  ],
-  exports: [ChatGateway, ChatRuntimeRouter],
+  providers: [ChatGateway],
+  exports: [ChatGateway],
 })
 export class ChatModule {}

apps/gateway/src/chat/embedded-chat.runtime.ts

@@ -1,532 +0,0 @@
-import { ForbiddenException, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
-import { AgentService, type AgentSession } from '../agent/agent.service.js';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import type {
-  ChatRuntime,
-  LegacyBrowserMessagePayload,
-  LegacyEmbeddedChatPort,
-  LegacyRuntimeEvent,
-  LegacyRuntimeResult,
-  LegacySessionPresentation,
-  LegacySocketTurnLease,
-  LegacyUsage,
-  OwnedConversationContext,
-  VerifiedDiscordIngressContext,
-  VerifiedDiscordTurnLease,
-  LegacyRuntimeStream,
-} from './chat-runtime.js';
-
-/** Fixed timeout for a synchronous REST turn, matching the historical controller budget. */
-const REST_TURN_TIMEOUT_MS = 120_000;
-
-/**
- * The `legacy` chat runtime and the sole implementation of {@link LegacyEmbeddedChatPort}.
- *
- * It owns the embedded in-process execution path — the `AgentService` stack that the
- * `ChatController` and `ChatGateway` drove directly before Task Five. Once the
- * {@link import('./chat-runtime-router.js').ChatRuntimeRouter} fronts it, the browser
- * HTTP/WebSocket legacy path and verified-Discord ingress route through THIS runtime, so
- * neither the controller nor the gateway retains `AgentService`, `piSession`, session,
- * listener, channel, or metric access. Ownership (`userId`/`tenantId`) is re-checked by
- * `AgentService` on every operation; a missing, foreign, or no-longer-owned conversation
- * collapses to `conversation_unavailable` and never throws out of the port.
- */
-@Injectable()
-export class EmbeddedChatRuntime implements ChatRuntime, LegacyEmbeddedChatPort {
-  readonly kind = 'embedded' as const;
-  private readonly logger = new Logger(EmbeddedChatRuntime.name);
-
-  constructor(readonly agentService: AgentService) {}
-
-  // -------------------------------------------------------------------------
-  // Legacy REST completion (op A)
-  // -------------------------------------------------------------------------
-
-  async completeLegacyRestTurn(
-    context: OwnedConversationContext,
-    input: Readonly<{ content: string }>,
-  ): Promise<
-    LegacyRuntimeResult<Readonly<{ text: string; presentation: LegacySessionPresentation }>>
-  > {
-    const scope = toScope(context.scope);
-    const { conversationId } = context;
-
-    const resolved = await this.resolveOrCreate(conversationId, scope, {});
-    if (!resolved.ok) return resolved;
-
-    let responseText = '';
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    let detach: (() => void) | undefined;
-    let disposed = false;
-    // One idempotent teardown owned OUTSIDE the completion promise: it clears the timeout and
-    // detaches the event listener exactly once, whichever of agent_end, timeout, or a prompt
-    // rejection fires first. Without this, a prompt() rejection surfaced through the catch below
-    // would return while leaving the listener attached (free to consume a later turn's events) and
-    // the 120s timer live (its rejection later going unobserved).
-    const dispose = (): void => {
-      if (disposed) return;
-      disposed = true;
-      if (timer !== undefined) clearTimeout(timer);
-      detach?.();
-    };
-    const done = new Promise<void>((resolve, reject) => {
-      timer = setTimeout(() => {
-        dispose();
-        reject(new Error('Agent response timed out'));
-      }, REST_TURN_TIMEOUT_MS);
-
-      detach = this.agentService.onEvent(
-        conversationId,
-        (event: AgentSessionEvent) => {
-          if (
-            event.type === 'message_update' &&
-            event.assistantMessageEvent.type === 'text_delta'
-          ) {
-            responseText += event.assistantMessageEvent.delta;
-          }
-          if (event.type === 'agent_end') {
-            dispose();
-            resolve();
-          }
-        },
-        scope,
-      );
-    });
-
-    // Attach the prompt and the completion promise CONCURRENTLY. Awaiting prompt() first left the
-    // timeout unobservable until prompt settled (a hung prompt could never time out) and, worse,
-    // let the 120s timer reject `done` while nothing yet awaited it — a transient unhandledRejection
-    // window. Promise.all installs handlers on BOTH synchronously, so the timeout bounds the whole
-    // turn even while prompt is pending, and neither promise can reject unobserved. Success still
-    // requires both prompt() to resolve AND agent_end to arrive (identical to the prior sequential
-    // await). The idempotent dispose() clears the timer + detaches on whichever settles first.
-    const prompting = this.agentService.prompt(conversationId, input.content, scope);
-    try {
-      await Promise.all([prompting, done]);
-    } catch (err) {
-      dispose();
-      const message = err instanceof Error ? err.message : String(err);
-      if (message.includes('timed out')) {
-        return { ok: false, code: 'timeout', retryable: true };
-      }
-      this.logger.error(`Legacy REST turn failed for conversation=${conversationId}`, message);
-      return { ok: false, code: 'operation_failed', retryable: false };
-    }
-
-    const presentation = this.presentationFor(conversationId, scope) ?? resolved.presentation;
-    return { ok: true, value: { text: responseText, presentation } };
-  }
-
-  // -------------------------------------------------------------------------
-  // Legacy Socket streaming (op B)
-  // -------------------------------------------------------------------------
-
-  async prepareLegacySocketTurn(
-    context: OwnedConversationContext,
-    input: LegacyBrowserMessagePayload,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<LegacySocketTurnLease>> {
-    const scope = toScope(context.scope);
-    const { conversationId } = context;
-
-    const resolved = await this.resolveOrCreate(conversationId, scope, {
-      ...(input.provider ? { provider: input.provider } : {}),
-      ...(input.modelId ? { modelId: input.modelId } : {}),
-      ...(input.agentId ? { agentConfigId: input.agentId } : {}),
-    });
-    if (!resolved.ok) return resolved;
-
-    let detach: () => void;
-    try {
-      detach = this.subscribe(conversationId, scope, stream);
-    } catch (err) {
-      // A partial listener/channel setup rolled itself back inside subscribe(); surface a total
-      // safe failure instead of throwing out of the port. Retryable — the attach is transient.
-      this.logger.error(
-        `Embedded socket subscription failed for conversation=${conversationId}`,
-        err instanceof Error ? err.message : String(err),
-      );
-      return { ok: false, code: 'runtime_unavailable', retryable: true };
-    }
-
-    return {
-      ok: true,
-      value: this.buildLease(
-        conversationId,
-        scope,
-        input.content,
-        input.attachments,
-        detach,
-        resolved.presentation,
-      ),
-    };
-  }
-
-  // -------------------------------------------------------------------------
-  // Thinking level (op C) — synchronous, total
-  // -------------------------------------------------------------------------
-
-  setLegacyThinking(
-    context: OwnedConversationContext,
-    level: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    const scope = toScope(context.scope);
-    const session = this.agentService.getSession(context.conversationId, scope);
-    if (!session) return CONVERSATION_UNAVAILABLE;
-
-    const availableThinkingLevels = session.piSession.getAvailableThinkingLevels();
-    if (!(availableThinkingLevels as readonly string[]).includes(level)) {
-      return {
-        ok: false,
-        code: 'thinking_level_invalid',
-        retryable: false,
-        availableThinkingLevels,
-      };
-    }
-
-    session.piSession.setThinkingLevel(level as never);
-    return { ok: true, value: this.presentationForSession(session) };
-  }
-
-  // -------------------------------------------------------------------------
-  // Abort (op D)
-  // -------------------------------------------------------------------------
-
-  async abortLegacyTurn(context: OwnedConversationContext): Promise<LegacyRuntimeResult<void>> {
-    const scope = toScope(context.scope);
-    const session = this.agentService.getSession(context.conversationId, scope);
-    if (!session) return CONVERSATION_UNAVAILABLE;
-
-    try {
-      await session.piSession.abort();
-    } catch (err) {
-      this.logger.error(
-        `Legacy abort failed for conversation=${context.conversationId}`,
-        err instanceof Error ? err.message : String(err),
-      );
-      return { ok: false, code: 'operation_failed', retryable: false };
-    }
-    return { ok: true, value: undefined };
-  }
-
-  // -------------------------------------------------------------------------
-  // Model override (synchronous, total)
-  // -------------------------------------------------------------------------
-
-  applyLegacyModelOverride(
-    context: OwnedConversationContext,
-    modelId: string,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    const scope = toScope(context.scope);
-    const session = this.agentService.getSession(context.conversationId, scope);
-    if (!session) return CONVERSATION_UNAVAILABLE;
-
-    this.agentService.updateSessionModel(context.conversationId, modelId, scope);
-    const refreshed = this.agentService.getSession(context.conversationId, scope) ?? session;
-    return { ok: true, value: this.presentationForSession(refreshed) };
-  }
-
-  // -------------------------------------------------------------------------
-  // Presentation read (synchronous, total)
-  // -------------------------------------------------------------------------
-
-  readLegacySessionPresentation(
-    context: OwnedConversationContext,
-  ): LegacyRuntimeResult<LegacySessionPresentation> {
-    const scope = toScope(context.scope);
-    const session = this.agentService.getSession(context.conversationId, scope);
-    if (!session) return CONVERSATION_UNAVAILABLE;
-    return { ok: true, value: this.presentationForSession(session) };
-  }
-
-  // -------------------------------------------------------------------------
-  // Verified Discord ingress (embedded-only in both modes)
-  // -------------------------------------------------------------------------
-
-  async dispatchVerifiedDiscordIngress(
-    context: VerifiedDiscordIngressContext,
-    stream: LegacyRuntimeStream,
-  ): Promise<LegacyRuntimeResult<VerifiedDiscordTurnLease>> {
-    const scope = toScope(context.scope);
-    const { conversationId } = context;
-
-    const resolved = await this.resolveOrCreate(
-      conversationId,
-      scope,
-      { agentConfigId: context.configuredAgent.agentConfigId },
-      {
-        agentConfigId: context.configuredAgent.agentConfigId,
-        instanceId: context.configuredAgent.instanceId,
-      },
-    );
-    if (!resolved.ok) return resolved;
-
-    let detach: () => void;
-    try {
-      detach = this.subscribe(conversationId, scope, stream);
-    } catch (err) {
-      // A partial listener/channel setup rolled itself back inside subscribe(); surface a total
-      // safe failure instead of throwing out of the port. Retryable — the attach is transient.
-      this.logger.error(
-        `Embedded Discord subscription failed for conversation=${conversationId}`,
-        err instanceof Error ? err.message : String(err),
-      );
-      return { ok: false, code: 'runtime_unavailable', retryable: true };
-    }
-
-    return {
-      ok: true,
-      value: this.buildLease(
-        conversationId,
-        scope,
-        context.content,
-        context.attachments,
-        detach,
-        resolved.presentation,
-      ),
-    };
-  }
-
-  // -------------------------------------------------------------------------
-  // Shared helpers
-  // -------------------------------------------------------------------------
-
-  /**
-   * Resolves the owned session, creating it on first use. Ownership/scope rejections
-   * (`Forbidden`/`NotFound`) collapse to `conversation_unavailable`; any other creation
-   * failure surfaces as the retryable `runtime_unavailable`. On success returns the
-   * session presentation so callers avoid a redundant `getSession`.
-   */
-  private async resolveOrCreate(
-    conversationId: string,
-    scope: ActorTenantScope,
-    extraOptions: Readonly<{ provider?: string; modelId?: string; agentConfigId?: string }>,
-    expectedAgent?: Readonly<{ agentConfigId: string; instanceId: string }>,
-  ): Promise<
-    | { readonly ok: true; readonly presentation: LegacySessionPresentation }
-    | Exclude<LegacyRuntimeResult<never>, { ok: true }>
-  > {
-    // A verified-Discord turn may only run under a session whose configured identity matches the
-    // reconciled agent record EXACTLY (config id + resolved name). This holds for BOTH a reused
-    // pre-existing session AND a freshly created one: a session carrying a different configured
-    // agent — however it arose — is rejected rather than executed under the verified label, so we
-    // never silently run a different prompt/model/tool policy. A plain (non-verified) turn passes
-    // no expectedAgent and skips the check.
-    const identityMatches = (candidate: AgentSession): boolean =>
-      expectedAgent === undefined ||
-      (candidate.agentConfigId === expectedAgent.agentConfigId &&
-        candidate.agentName === expectedAgent.instanceId);
-
-    let session = this.agentService.getSession(conversationId, scope);
-    if (session && !identityMatches(session)) {
-      // Reused same-scope session minted under a different configured identity — reject with zero
-      // effects rather than dispatch a verified turn onto a foreign agent's session.
-      return CONVERSATION_UNAVAILABLE;
-    }
-    if (!session) {
-      try {
-        session = await this.agentService.createSession(conversationId, {
-          userId: scope.userId,
-          tenantId: scope.tenantId,
-          ...extraOptions,
-        });
-      } catch (err) {
-        if (err instanceof ForbiddenException || err instanceof NotFoundException) {
-          return CONVERSATION_UNAVAILABLE;
-        }
-        this.logger.error(
-          `Embedded session creation failed for conversation=${conversationId}`,
-          err instanceof Error ? err.stack : String(err),
-        );
-        return { ok: false, code: 'runtime_unavailable', retryable: true };
-      }
-      // The just-created session must ALSO carry the reconciled identity before any effect. A
-      // createSession that returns a session under a different configured agent (misconfiguration
-      // or a substituted factory) is rejected here, before subscribe/persist/ack/prompt.
-      if (!identityMatches(session)) {
-        return CONVERSATION_UNAVAILABLE;
-      }
-    }
-    return { ok: true, presentation: this.presentationForSession(session) };
-  }
-
-  /** Installs a normalizing event listener that forwards to the server-owned stream. */
-  private subscribe(
-    conversationId: string,
-    scope: ActorTenantScope,
-    stream: LegacyRuntimeStream,
-  ): () => void {
-    const unsubscribe = this.agentService.onEvent(
-      conversationId,
-      (event: AgentSessionEvent) => {
-        const normalized = this.normalizeEvent(conversationId, scope, event);
-        if (normalized) stream.onEvent(normalized);
-      },
-      scope,
-    );
-    try {
-      this.agentService.addChannel(conversationId, stream.channelId, scope);
-    } catch (err) {
-      // Partial setup: the listener was acquired but the channel attach failed. Roll back
-      // exactly what was acquired (the listener) before the failure escapes, so no leaked
-      // subscription survives; the caller converts the rethrow into a total safe failure.
-      try {
-        unsubscribe();
-      } catch {
-        /* idempotent teardown */
-      }
-      throw err;
-    }
-    return () => {
-      try {
-        unsubscribe();
-      } catch {
-        /* idempotent teardown */
-      }
-      try {
-        this.agentService.removeChannel(conversationId, stream.channelId, scope);
-      } catch {
-        /* idempotent teardown */
-      }
-    };
-  }
-
-  /** Builds an atomically one-shot, scope-rechecking dispatch lease. */
-  private buildLease(
-    conversationId: string,
-    scope: ActorTenantScope,
-    content: string,
-    attachments: VerifiedDiscordIngressContext['attachments'],
-    detach: () => void,
-    presentation: LegacySessionPresentation,
-  ): LegacySocketTurnLease & VerifiedDiscordTurnLease {
-    let dispatched = false;
-    let disposed = false;
-    return {
-      presentation,
-      dispatch: async (): Promise<LegacyRuntimeResult<void>> => {
-        if (dispatched) {
-          return { ok: false, code: 'turn_already_dispatched', retryable: false };
-        }
-        dispatched = true;
-        try {
-          await this.agentService.prompt(conversationId, content, scope, attachments);
-        } catch (err) {
-          this.logger.error(
-            `Legacy dispatch failed for conversation=${conversationId}`,
-            err instanceof Error ? err.message : String(err),
-          );
-          return { ok: false, code: 'operation_failed', retryable: false };
-        }
-        return { ok: true, value: undefined };
-      },
-      dispose: async (): Promise<void> => {
-        if (disposed) return;
-        disposed = true;
-        detach();
-      },
-    };
-  }
-
-  /** Normalizes a raw agent event into the redaction-agnostic transport event, or drops it. */
-  private normalizeEvent(
-    conversationId: string,
-    scope: ActorTenantScope,
-    event: AgentSessionEvent,
-  ): LegacyRuntimeEvent | undefined {
-    switch (event.type) {
-      case 'agent_start':
-        return { type: 'started' };
-      case 'agent_end':
-        return { type: 'settled', ...this.usageFor(conversationId, scope) };
-      case 'message_update': {
-        const assistant = event.assistantMessageEvent;
-        if (assistant.type === 'text_delta') return { type: 'text_delta', text: assistant.delta };
-        if (assistant.type === 'thinking_delta') {
-          return { type: 'thinking_delta', text: assistant.delta };
-        }
-        return undefined;
-      }
-      case 'tool_execution_start':
-        return { type: 'tool_started', toolCallId: event.toolCallId, toolName: event.toolName };
-      case 'tool_execution_end':
-        return {
-          type: 'tool_finished',
-          toolCallId: event.toolCallId,
-          toolName: event.toolName,
-          isError: event.isError,
-        };
-      default:
-        return undefined;
-    }
-  }
-
-  /**
-   * Gathers terminal usage from the Pi session and records it into session metrics.
-   * Embedded owns AgentService metrics; the gateway never touches `piSession` stats.
-   */
-  private usageFor(conversationId: string, scope: ActorTenantScope): { usage?: LegacyUsage } {
-    const session = this.agentService.getSession(conversationId, scope);
-    const piSession = session?.piSession;
-    const stats = piSession?.getSessionStats();
-    if (!session || !stats) return {};
-    const contextUsage = piSession?.getContextUsage();
-
-    const tokens = {
-      input: stats.tokens?.input ?? 0,
-      output: stats.tokens?.output ?? 0,
-      cacheRead: stats.tokens?.cacheRead ?? 0,
-      cacheWrite: stats.tokens?.cacheWrite ?? 0,
-      total: stats.tokens?.total ?? 0,
-    };
-
-    this.agentService.recordTokenUsage(conversationId, { ...tokens });
-
-    return {
-      usage: {
-        provider: session.provider,
-        modelId: session.modelId,
-        thinkingLevel: piSession?.thinkingLevel ?? 'off',
-        tokens,
-        cost: stats.cost ?? 0,
-        context: {
-          percent: contextUsage?.percent ?? null,
-          window: contextUsage?.contextWindow ?? 0,
-        },
-      },
-    };
-  }
-
-  /** Presentation from a live session id, or undefined when no owned session exists. */
-  private presentationFor(
-    conversationId: string,
-    scope: ActorTenantScope,
-  ): LegacySessionPresentation | undefined {
-    const session = this.agentService.getSession(conversationId, scope);
-    return session ? this.presentationForSession(session) : undefined;
-  }
-
-  /** User-facing projection carrying no session handle, credential, or raw stats. */
-  private presentationForSession(session: AgentSession): LegacySessionPresentation {
-    return {
-      provider: session.provider,
-      modelId: session.modelId,
-      thinkingLevel: session.piSession.thinkingLevel,
-      availableThinkingLevels: session.piSession.getAvailableThinkingLevels(),
-      ...(session.agentName ? { agentName: session.agentName } : {}),
-    };
-  }
-}
-
-/** The shared terminal `conversation_unavailable` failure (missing/foreign/lost ownership). */
-const CONVERSATION_UNAVAILABLE = {
-  ok: false as const,
-  code: 'conversation_unavailable' as const,
-  retryable: false as const,
-};
-
-/** Narrows a branded context scope to the `AgentService` actor/tenant scope (identical shape). */
-function toScope(scope: Readonly<{ userId: string; tenantId: string }>): ActorTenantScope {
-  return { userId: scope.userId, tenantId: scope.tenantId };
-}

apps/gateway/src/chat/harness-chat.runtime.spec.ts

@@ -1,170 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type {
-  AttachConversation,
-  ConversationSnapshot,
-  DetachConversation,
-  HarnessActorContext,
-  HarnessConversationService,
-  HarnessEventEnvelope,
-  HarnessSelection,
-  SendHarnessTurn,
-  TurnReceipt,
-} from '@mosaicstack/types';
-import { HarnessChatRuntime } from './harness-chat.runtime.js';
-
-/**
- * Task Five, Step One (harness runtime). Proves the `pi-rpc` runtime executes
- * exclusively through the {@link HarnessConversationService} RPC boundary and
- * forwards the caller's exact selection tuple and idempotency key without
- * substitution. Red-first: the runtime is an unimplemented stub, so every
- * delegation assertion fails until Step Three.
- */
-
-const context: HarnessActorContext = {
-  actorId: 'actor-1',
-  tenantId: 'tenant-1',
-  seatId: 'seat-1',
-  correlationId: 'corr-1',
-};
-
-const selection: HarnessSelection = {
-  harnessId: 'pi',
-  providerId: 'anthropic',
-  modelId: 'claude-opus-4-8',
-};
-
-const conversationId = '11111111-1111-4111-8111-111111111111';
-const idempotencyKey = '22222222-2222-4222-8222-222222222222';
-
-const sendInput: SendHarnessTurn & { idempotencyKey: string } = {
-  context,
-  conversationId,
-  selection,
-  turnId: 'turn-abc',
-  correlationId: 'corr-1',
-  content: 'hello',
-  idempotencyKey,
-};
-
-const attachInput: AttachConversation & { afterSequence?: number } = {
-  context,
-  conversationId,
-  clientId: 'client-1',
-  selection,
-  afterSequence: 0,
-};
-
-const detachInput: DetachConversation = {
-  context,
-  conversationId,
-  clientId: 'client-1',
-};
-
-interface RecordedCalls {
-  attach: (AttachConversation & { afterSequence?: number })[];
-  detach: DetachConversation[];
-  send: (SendHarnessTurn & { idempotencyKey: string })[];
-  subscribeFrom: { conversationId: string; afterSequence: number }[];
-}
-
-const snapshot: ConversationSnapshot = {
-  session: {
-    conversationId,
-    nativeSessionId: 'native-1',
-    seatId: 'seat-1',
-    selection,
-    state: 'idle',
-    attachedClientIds: ['client-1'],
-  },
-  lastSequence: 0,
-  replay: [],
-};
-
-function build(): { runtime: HarnessChatRuntime; calls: RecordedCalls } {
-  const calls: RecordedCalls = { attach: [], detach: [], send: [], subscribeFrom: [] };
-  const service: HarnessConversationService = {
-    attach: (input) => {
-      calls.attach.push(input);
-      return Promise.resolve(snapshot);
-    },
-    detach: (input) => {
-      calls.detach.push(input);
-      return Promise.resolve();
-    },
-    send: (input) => {
-      calls.send.push(input);
-      // The service echoes only the requested tuple; there is no representable substitute.
-      const receipt: TurnReceipt = {
-        conversationId: input.conversationId,
-        turnId: 'turn-server',
-        correlationId: input.correlationId,
-        state: 'accepted',
-        selection: input.selection,
-      };
-      return Promise.resolve(receipt);
-    },
-    subscribeFrom: (id, afterSequence) => {
-      calls.subscribeFrom.push({ conversationId: id, afterSequence });
-
-      return (async function* (): AsyncIterable<HarnessEventEnvelope> {
-        return;
-      })();
-    },
-  };
-  return { runtime: new HarnessChatRuntime(service), calls };
-}
-
-describe('HarnessChatRuntime', () => {
-  it('is the harness runtime kind and needs only a HarnessConversationService', () => {
-    const { runtime } = build();
-    expect(runtime.kind).toBe('harness');
-  });
-
-  it('delegates send to the conversation service with the exact tuple and idempotency key', async () => {
-    const { runtime, calls } = build();
-
-    const receipt = await runtime.send(sendInput);
-
-    expect(calls.send).toHaveLength(1);
-    const firstSend = calls.send[0]!;
-    expect(firstSend).toEqual(sendInput);
-    expect(firstSend.idempotencyKey).toBe(idempotencyKey);
-    expect(firstSend.selection).toEqual(selection);
-    // The runtime must not substitute an effective tuple onto the receipt.
-    expect(receipt.selection).toEqual(selection);
-  });
-
-  it('delegates attach to the conversation service and returns its snapshot', async () => {
-    const { runtime, calls } = build();
-
-    const result = await runtime.attach(attachInput);
-
-    expect(calls.attach).toHaveLength(1);
-    expect(calls.attach[0]).toEqual(attachInput);
-    expect(result).toBe(snapshot);
-  });
-
-  it('delegates detach to the conversation service', async () => {
-    const { runtime, calls } = build();
-
-    await runtime.detach(detachInput);
-
-    expect(calls.detach).toHaveLength(1);
-    expect(calls.detach[0]).toEqual(detachInput);
-  });
-
-  it('delegates subscribeFrom to the conversation service journal replay', async () => {
-    const { runtime, calls } = build();
-
-    const iterable = runtime.subscribeFrom(conversationId, 7);
-    // Drain to prove it is the service-backed async iterable, not a fabricated one.
-    const drained: unknown[] = [];
-    for await (const event of iterable) {
-      drained.push(event);
-    }
-    expect(drained).toHaveLength(0);
-
-    expect(calls.subscribeFrom).toHaveLength(1);
-    expect(calls.subscribeFrom[0]).toEqual({ conversationId, afterSequence: 7 });
-  });
-});

apps/gateway/src/chat/harness-chat.runtime.ts

@@ -1,47 +0,0 @@
-import type {
-  AttachConversation,
-  ConversationSnapshot,
-  DetachConversation,
-  HarnessConversationService,
-  HarnessEventEnvelope,
-  SendHarnessTurn,
-  TurnReceipt,
-} from '@mosaicstack/types';
-import type { ChatRuntime } from './chat-runtime.js';
-
-/**
- * The `pi-rpc` chat runtime. It executes browser chat exclusively through the
- * harness-neutral {@link HarnessConversationService} RPC boundary — it never
- * touches the embedded `AgentService`/`ProviderService`/`RoutingEngineService`
- * stack, and it forwards the caller's exact selection tuple and idempotency key
- * without substitution.
- *
- * It owns no state and adds no policy: every method forwards the caller's exact
- * argument to the injected {@link HarnessConversationService} and returns its
- * result unchanged, so the requested selection tuple and idempotency key can
- * never be substituted on the way through.
- */
-export class HarnessChatRuntime implements ChatRuntime {
-  readonly kind = 'harness' as const;
-
-  constructor(private readonly conversations: HarnessConversationService) {}
-
-  attach(input: AttachConversation & { afterSequence?: number }): Promise<ConversationSnapshot> {
-    return this.conversations.attach(input);
-  }
-
-  detach(input: DetachConversation): Promise<void> {
-    return this.conversations.detach(input);
-  }
-
-  send(input: SendHarnessTurn & { idempotencyKey: string }): Promise<TurnReceipt> {
-    return this.conversations.send(input);
-  }
-
-  subscribeFrom(
-    conversationId: string,
-    afterSequence: number,
-  ): AsyncIterable<HarnessEventEnvelope> {
-    return this.conversations.subscribeFrom(conversationId, afterSequence);
-  }
-}

apps/gateway/src/commands/command-authorization.service.spec.ts

@@ -61,33 +61,6 @@ describe('CommandAuthorizationService', () => {
     ).toBe(false);
   });
 
-  it('denies non-admin scopes to a platform admin (contract 2 §1.1 bypass retirement)', async (): Promise<void> => {
-    const service = createService('admin');
-    for (const scope of ['core', 'agent', 'skill', 'plugin'] as const) {
-      const command: CommandDef = { ...adminCommand, name: `probe-${scope}`, scope };
-      expect(
-        (await service.authorize(command, { ...payload, command: command.name }, 'admin-1'))
-          .allowed,
-      ).toBe(false);
-    }
-  });
-
-  it('allows member core/agent scopes and denies skill/plugin (deny-by-default)', async (): Promise<void> => {
-    const service = createService('member');
-    for (const [scope, allowed] of [
-      ['core', true],
-      ['agent', true],
-      ['skill', false],
-      ['plugin', false],
-    ] as const) {
-      const command: CommandDef = { ...adminCommand, name: `probe-${scope}`, scope };
-      expect(
-        (await service.authorize(command, { ...payload, command: command.name }, 'member-1'))
-          .allowed,
-      ).toBe(allowed);
-    }
-  });
-
   it('denies a malformed durable approval expiry instead of treating it as unexpired', async (): Promise<void> => {
     const entries = new Map<string, string>();
     const action = {

apps/gateway/src/commands/command-authorization.service.ts

@@ -154,15 +154,8 @@ export class CommandAuthorizationService {
     return role === 'admin' || role === 'member' || role === 'viewer' ? role : null;
   }
 
-  /**
-   * Contract 2 §1.1: platform admin confers instance administration only —
-   * the former admin-passes-every-scope short-circuit is retired. Admin
-   * reaches exactly the admin scope; core/agent scopes belong to the member
-   * role; skill/plugin scopes stay deny-for-all until a grant mapping names
-   * them (§3.1 deny-by-default).
-   */
   private hasScope(role: CommandRole, scope: CommandDef['scope']): boolean {
-    if (scope === 'admin') return role === 'admin';
+    if (role === 'admin') return true;
     return role === 'member' && (scope === 'core' || scope === 'agent');
   }
 

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -1,4 +1,3 @@
-import { Logger } from '@nestjs/common';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { CommandExecutorService } from './command-executor.service.js';
 import type { SlashCommandPayload } from '@mosaicstack/types';
@@ -13,7 +12,6 @@ const mockRegistry = {
       { name: 'agent', aliases: ['a'], scope: 'agent', execution: 'socket', available: true },
       { name: 'prdy', aliases: [], scope: 'agent', execution: 'socket', available: true },
       { name: 'tools', aliases: [], scope: 'agent', execution: 'socket', available: true },
-      { name: 'mcp', aliases: [], scope: 'agent', execution: 'socket', available: true },
     ],
     skills: [],
   })),
@@ -74,35 +72,17 @@ const mockChatGateway = {
   broadcastSessionInfo: vi.fn(),
 };
 
-const mockMcpClient = {
-  reconnectServer: vi.fn().mockResolvedValue(undefined),
-  getServerStatuses: vi.fn(() => []),
-  getToolDefinitions: vi.fn(() => []),
-};
-
-const allowAuthorization = {
-  authorize: vi.fn().mockResolvedValue({ allowed: true }),
-};
-
-function buildService(
-  redis: typeof mockRedis | null = mockRedis,
-  mcpClient: {
-    reconnectServer: ReturnType<typeof vi.fn>;
-    getServerStatuses: ReturnType<typeof vi.fn>;
-    getToolDefinitions: ReturnType<typeof vi.fn>;
-  } = mockMcpClient,
-): CommandExecutorService {
+function buildService(): CommandExecutorService {
   return new CommandExecutorService(
     mockRegistry as never,
     mockAgentService as never,
     mockSystemOverride as never,
     mockSessionGC as never,
-    redis as never,
+    mockRedis as never,
     mockBrain as never,
     null,
     mockChatGateway as never,
-    mcpClient as never,
-    allowAuthorization as never,
+    null,
   );
 }
 
@@ -151,22 +131,6 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(ttl).toBe(300);
   });
 
-  it('/provider login remains available without Redis on the local tier', async () => {
-    const localService = buildService(null);
-    const payload: SlashCommandPayload = {
-      command: 'provider',
-      args: 'login anthropic',
-      conversationId,
-    };
-
-    const result = await localService.execute(payload, userScope);
-
-    expect(result.success).toBe(true);
-    expect(result.message).not.toContain('token=');
-    expect(result.data).toEqual({ provider: 'anthropic' });
-    expect(mockRedis.set).not.toHaveBeenCalled();
-  });
-
   // /provider with no args — returns usage
   it('/provider with no args returns usage message', async () => {
     const payload: SlashCommandPayload = { command: 'provider', conversationId };
@@ -278,124 +242,4 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(result.command).toBe('tools');
     expect(result.message).toContain('tools');
   });
-
-  // Top-level catch sanitization (P3-4 re-review finding #1): a rejected
-  // Redis `set` inside /provider login is the only reachable path into the
-  // top-level catch in `execute()`. The raw exception must be logged
-  // server-side but never handed back to the socket client.
-  it('sanitizes the top-level command catch, logging the raw exception but never returning it to the client', async () => {
-    const distinctiveRawFailure = 'ECONNREFUSED distinctive-raw-redis-failure-token-9f31';
-    const rawError = new Error(distinctiveRawFailure);
-    const failingRedis = {
-      set: vi.fn().mockRejectedValue(rawError),
-      get: vi.fn(),
-      del: vi.fn(),
-    };
-    const failingService = buildService(failingRedis as unknown as typeof mockRedis);
-    const loggerErrorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-
-    const payload: SlashCommandPayload = {
-      command: 'provider',
-      args: 'login anthropic',
-      conversationId,
-    };
-    const result = await failingService.execute(payload, userScope);
-
-    expect(result.success).toBe(false);
-    expect(result.command).toBe('provider');
-    expect(result.message).toBe('Command failed due to an internal error.');
-    expect(result.message).not.toContain(distinctiveRawFailure);
-    expect(result.message).not.toContain('ECONNREFUSED');
-
-    // The real exception is still logged server-side, as the raw Error
-    // object itself (not stringified/interpolated into the log message).
-    expect(loggerErrorSpy).toHaveBeenCalled();
-    const loggedRawError = loggerErrorSpy.mock.calls.some((call) => call.includes(rawError));
-    expect(loggedRawError).toBe(true);
-
-    loggerErrorSpy.mockRestore();
-  });
-
-  // Inner catch sanitization (P3-5 operator ruling): every catch in
-  // command-executor.service.ts that returns a SlashCommandResultPayload
-  // must sanitize the client-facing message the same way the top-level
-  // catch does, while still logging the raw exception server-side.
-  it('/agent new sanitizes agent-creation failures, logging the raw exception but never returning it to the client', async () => {
-    const marker = new Error('distinctive-agent-create-failure-token-A17f');
-    mockBrain.agents.create.mockRejectedValueOnce(marker);
-    const loggerErrorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-
-    const payload: SlashCommandPayload = {
-      command: 'agent',
-      args: 'new my-new-agent',
-      conversationId,
-    };
-    const result = await service.execute(payload, userScope);
-
-    expect(result.success).toBe(false);
-    expect(result.command).toBe('agent');
-    expect(result.message).toBe('Failed to create agent due to an internal error.');
-    expect(result.message).not.toContain('distinctive-agent-create-failure-token-A17f');
-
-    expect(loggerErrorSpy).toHaveBeenCalled();
-    const loggedRawError = loggerErrorSpy.mock.calls.some((call) => call.includes(marker));
-    expect(loggedRawError).toBe(true);
-
-    loggerErrorSpy.mockRestore();
-  });
-
-  it('/agent <name> switch sanitizes agent-lookup failures, logging the raw exception but never returning it to the client', async () => {
-    const marker = new Error('distinctive-agent-switch-failure-token-B29c');
-    mockBrain.agents.findByName.mockRejectedValueOnce(marker);
-    const loggerErrorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-
-    const payload: SlashCommandPayload = {
-      command: 'agent',
-      args: 'some-other-agent',
-      conversationId,
-    };
-    const result = await service.execute(payload, userScope);
-
-    expect(result.success).toBe(false);
-    expect(result.command).toBe('agent');
-    expect(result.message).toBe('Failed to switch agent due to an internal error.');
-    expect(result.message).not.toContain('distinctive-agent-switch-failure-token-B29c');
-
-    expect(loggerErrorSpy).toHaveBeenCalled();
-    const loggedRawError = loggerErrorSpy.mock.calls.some((call) => call.includes(marker));
-    expect(loggedRawError).toBe(true);
-
-    loggerErrorSpy.mockRestore();
-  });
-
-  it('/mcp reconnect sanitizes MCP client failures, logging the raw exception but never returning it to the client', async () => {
-    const marker = new Error('distinctive-mcp-reconnect-failure-token-C33e');
-    const mockMcpClient = {
-      reconnectServer: vi.fn().mockRejectedValue(marker),
-      getServerStatuses: vi.fn(() => []),
-      getToolDefinitions: vi.fn(() => []),
-    };
-    const mcpService = buildService(mockRedis, mockMcpClient);
-    const loggerErrorSpy = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-
-    const payload: SlashCommandPayload = {
-      command: 'mcp',
-      args: 'reconnect my-server',
-      conversationId,
-    };
-    const result = await mcpService.execute(payload, userScope);
-
-    expect(result.success).toBe(false);
-    expect(result.command).toBe('mcp');
-    expect(result.message).toBe(
-      'Failed to reconnect MCP server "my-server" due to an internal error.',
-    );
-    expect(result.message).not.toContain('distinctive-mcp-reconnect-failure-token-C33e');
-
-    expect(loggerErrorSpy).toHaveBeenCalled();
-    const loggedRawError = loggerErrorSpy.mock.calls.some((call) => call.includes(marker));
-    expect(loggedRawError).toBe(true);
-
-    loggerErrorSpy.mockRestore();
-  });
 });

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -36,12 +36,6 @@ const authorization = {
   ),
 };
 
-const mockMcpClient = {
-  getServerStatuses: vi.fn(() => []),
-  getToolDefinitions: vi.fn(() => []),
-  reconnectServer: vi.fn().mockResolvedValue(undefined),
-};
-
 function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
   return new CommandExecutorService(
     registry as never,
@@ -52,7 +46,7 @@ function buildExecutor(authorizationService: unknown = authorization): CommandEx
     { agents: {} } as never,
     null,
     null,
-    mockMcpClient as never,
+    null,
     authorizationService as never,
   );
 }

apps/gateway/src/commands/command-executor.service.ts

@@ -23,10 +23,7 @@ export class CommandExecutorService {
     @Inject(AgentService) private readonly agentService: AgentService,
     @Inject(SystemOverrideService) private readonly systemOverride: SystemOverrideService,
     @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
-    // On Local tier COMMANDS_REDIS is null — provider login caching is skipped.
-    @Optional()
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(COMMANDS_REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(BRAIN) private readonly brain: Brain,
     @Optional()
     @Inject(forwardRef(() => ReloadService))
@@ -34,9 +31,12 @@ export class CommandExecutorService {
     @Optional()
     @Inject(forwardRef(() => ChatGateway))
     private readonly chatGateway: ChatGateway | null,
-    @Inject(McpClientService) private readonly mcpClient: McpClientService,
+    @Optional()
+    @Inject(McpClientService)
+    private readonly mcpClient: McpClientService | null,
+    @Optional()
     @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService,
+    private readonly authorization: CommandAuthorizationService | null = null,
   ) {}
 
   async execute(
@@ -56,13 +56,13 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization.authorize(
+    const authorization = await this.authorization?.authorize(
       def,
       payload,
       userId,
       payload.approvalId,
     );
-    if (!authorization.allowed) {
+    if (authorization && !authorization.allowed) {
       return { command, conversationId, success: false, message: authorization.reason };
     }
 
@@ -156,13 +156,8 @@ export class CommandExecutorService {
           };
       }
     } catch (err) {
-      this.logger.error(`Command /${command} failed`, err);
-      return {
-        command,
-        conversationId,
-        success: false,
-        message: 'Command failed due to an internal error.',
-      };
+      this.logger.error(`Command /${command} failed: ${err}`);
+      return { command, conversationId, success: false, message: String(err) };
     }
   }
 
@@ -170,7 +165,7 @@ export class CommandExecutorService {
     const def = this.registry
       .getManifest()
       .commands.find((command) => command.name === payload.command);
-    if (!def) return null;
+    if (!def || !this.authorization) return null;
     return this.authorization.createApproval(def, payload, scope.userId);
   }
 
@@ -338,11 +333,11 @@ export class CommandExecutorService {
           data: { agentId: newAgent.id, agentName: newAgent.name },
         };
       } catch (err) {
-        this.logger.error(`Failed to create agent "${namePart}" for user ${userId}`, err);
+        this.logger.error(`Failed to create agent: ${err}`);
         return {
           command: 'agent',
           success: false,
-          message: 'Failed to create agent due to an internal error.',
+          message: `Failed to create agent: ${String(err)}`,
           conversationId,
         };
       }
@@ -393,11 +388,11 @@ export class CommandExecutorService {
         data: { agentId: agentConfig.id, agentName: agentConfig.name, model: agentConfig.model },
       };
     } catch (err) {
-      this.logger.error(`Failed to switch agent "${agentName}"`, err);
+      this.logger.error(`Failed to switch agent "${agentName}": ${err}`);
       return {
         command: 'agent',
         success: false,
-        message: 'Failed to switch agent due to an internal error.',
+        message: `Failed to switch agent: ${String(err)}`,
         conversationId,
       };
     }
@@ -448,16 +443,14 @@ export class CommandExecutorService {
           byte.toString(16).padStart(2, '0'),
         ).join('');
         const key = `mosaic:auth:poll:${tokenHash}`;
-        if (this.redis) {
-          // Persist only a short-lived token digest. The raw token is delivered only by
-          // the authenticated dashboard flow, never in chat output or command metadata.
-          await this.redis.set(
-            key,
-            JSON.stringify({ status: 'pending', provider: providerName, userId }),
-            'EX',
-            300,
-          );
-        }
+        // Persist only a short-lived token digest. The raw token is delivered only by
+        // the authenticated dashboard flow, never in chat output or command metadata.
+        await this.redis.set(
+          key,
+          JSON.stringify({ status: 'pending', provider: providerName, userId }),
+          'EX',
+          300,
+        );
         return {
           command: 'provider',
           success: true,
@@ -545,6 +538,15 @@ export class CommandExecutorService {
     args: string | null,
     conversationId: string,
   ): Promise<SlashCommandResultPayload> {
+    if (!this.mcpClient) {
+      return {
+        command: 'mcp',
+        conversationId,
+        success: false,
+        message: 'MCP client service is not available.',
+      };
+    }
+
     const action = args?.trim().split(/\s+/)[0] ?? 'status';
 
     switch (action) {
@@ -601,12 +603,11 @@ export class CommandExecutorService {
             message: `MCP server "${serverName}" reconnected successfully.`,
           };
         } catch (err) {
-          this.logger.error(`Failed to reconnect MCP server "${serverName}"`, err);
           return {
             command: 'mcp',
             conversationId,
             success: false,
-            message: `Failed to reconnect MCP server "${serverName}" due to an internal error.`,
+            message: `Failed to reconnect MCP server "${serverName}": ${err instanceof Error ? err.message : String(err)}`,
           };
         }
       }

apps/gateway/src/commands/commands.integration.spec.ts

@@ -11,8 +11,6 @@
  * - Unknown command returns descriptive error
  */
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { CommandsModule } from './commands.module.js';
-import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { CommandRegistryService } from './command-registry.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 import type { SlashCommandPayload } from '@mosaicstack/types';
@@ -49,16 +47,6 @@ const mockBrain = {
   },
 };
 
-const mockMcpClient = {
-  getServerStatuses: vi.fn(() => []),
-  getToolDefinitions: vi.fn(() => []),
-  reconnectServer: vi.fn().mockResolvedValue(undefined),
-};
-
-const allowAuthorization = {
-  authorize: vi.fn().mockResolvedValue({ allowed: true }),
-};
-
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
 function buildRegistry(): CommandRegistryService {
@@ -77,8 +65,7 @@ function buildExecutor(registry: CommandRegistryService): CommandExecutorService
     mockBrain as never,
     null, // reloadService (optional)
     null, // chatGateway (optional)
-    mockMcpClient as never,
-    allowAuthorization as never,
+    null, // mcpClient (optional)
   );
 }
 
@@ -166,15 +153,6 @@ describe('CommandRegistryService — integration', () => {
   }
 });
 
-// ─── Module Wiring Tests ──────────────────────────────────────────────────────
-
-describe('CommandsModule — Nest wiring', () => {
-  it('CommandsModule imports McpClientModule in its Nest metadata', () => {
-    const imports = Reflect.getMetadata('imports', CommandsModule) ?? [];
-    expect(imports).toContain(McpClientModule);
-  });
-});
-
 // ─── Executor Tests ───────────────────────────────────────────────────────────
 
 describe('CommandExecutorService — integration', () => {
@@ -281,14 +259,4 @@ describe('CommandExecutorService — integration', () => {
       expect(result.command).toBe(cmd);
     });
   }
-
-  // /mcp status reaches the required McpClientService and never reports it unavailable
-  it('/mcp status calls the wired McpClientService and reports the no-servers message', async () => {
-    const payload: SlashCommandPayload = { command: 'mcp', conversationId };
-    const result = await executor.execute(payload, userScope);
-    expect(mockMcpClient.getServerStatuses).toHaveBeenCalledOnce();
-    expect(result.success).toBe(true);
-    expect(result.message).toContain('No MCP servers configured.');
-    expect(result.message).not.toBe('MCP client service is not available.');
-  });
 });

apps/gateway/src/commands/commands.module.ts

@@ -1,10 +1,7 @@
-import { forwardRef, Inject, Module, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { forwardRef, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
-import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
 import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
@@ -15,26 +12,17 @@ import { COMMANDS_REDIS } from './commands.tokens.js';
 const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
 
 @Module({
-  imports: [
-    GCModule,
-    McpClientModule,
-    forwardRef(() => ReloadModule),
-    forwardRef(() => ChatModule),
-  ],
+  imports: [GCModule, forwardRef(() => ReloadModule), forwardRef(() => ChatModule)],
   providers: [
     {
       provide: COMMANDS_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection.
-        // CommandExecutorService falls back to no-cache for /provider login on local.
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: COMMANDS_REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
@@ -50,13 +38,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
   ],
 })
 export class CommandsModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(COMMANDS_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/config/config.module.ts

@@ -1,6 +1,5 @@
 import { Global, Module } from '@nestjs/common';
 import { loadConfig, type MosaicConfig } from '@mosaicstack/config';
-import { resolveGatewayConfigPath } from '../env.js';
 
 export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
 
@@ -9,7 +8,7 @@ export const MOSAIC_CONFIG = 'MOSAIC_CONFIG';
   providers: [
     {
       provide: MOSAIC_CONFIG,
-      useFactory: (): MosaicConfig => loadConfig(resolveGatewayConfigPath()),
+      useFactory: (): MosaicConfig => loadConfig(),
     },
   ],
   exports: [MOSAIC_CONFIG],

apps/gateway/src/conversations/conversations-harness-fence.spec.ts

@@ -1,116 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import type { ChatRuntimeMode } from '../chat/chat-runtime.js';
-import { ConversationsController } from './conversations.controller.js';
-
-/**
- * Task 5 harness fence for the conversations REST write path.
- *
- * Under `pi-rpc` the durable/harness conversation path (Task 15) owns message persistence, so the
- * legacy direct-repository write via `POST /api/conversations/:id/messages` must be refused with a
- * fixed typed `runtime_unsupported` BEFORE the repository is touched — never a duplicate write.
- * Under `legacy` the endpoint keeps its current behaviour and writes through `brain.conversations`.
- *
- * Item 3 (single runtime-mode source of truth): the mode is the router's ONE init-time resolution,
- * injected into the controller and read as `router.runtimeMode`. It is NOT re-derived from
- * `process.env` at request time. The two "env is flipped after construction" tests below are the
- * load-bearing guard: they pass only because the controller reads the fixed injected mode, and turn
- * RED the instant the fence is reverted to `resolveChatRuntimeMode(process.env)`.
- */
-const CONVERSATION_ID = '22222222-2222-4222-8222-222222222222';
-const USER = { id: 'user-1' };
-
-function sendMessageDto() {
-  return {
-    role: 'user' as const,
-    content: 'hello from the legacy REST write path',
-    metadata: undefined,
-  };
-}
-
-function brainWithMessageSpy() {
-  const addMessage = vi.fn().mockResolvedValue({
-    id: 'message-1',
-    conversationId: CONVERSATION_ID,
-    role: 'user',
-    content: 'hello from the legacy REST write path',
-  });
-  return {
-    brain: { conversations: { addMessage } } as never,
-    addMessage,
-  };
-}
-
-/** The controller only needs the router's immutable `runtimeMode`; supply exactly that. */
-function routerFixedTo(mode: ChatRuntimeMode) {
-  return { runtimeMode: mode };
-}
-
-let priorMode: string | undefined;
-
-describe('conversations REST write path — Task 5 harness fence', () => {
-  beforeEach(() => {
-    priorMode = process.env['CHAT_HARNESS_RUNTIME'];
-  });
-
-  afterEach(() => {
-    if (priorMode === undefined) delete process.env['CHAT_HARNESS_RUNTIME'];
-    else process.env['CHAT_HARNESS_RUNTIME'] = priorMode;
-  });
-
-  it('refuses the legacy repository write when the router resolved pi-rpc, before any write', async () => {
-    const { brain, addMessage } = brainWithMessageSpy();
-    const controller = new ConversationsController(brain, routerFixedTo('pi-rpc'));
-
-    await expect(
-      controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER),
-    ).rejects.toMatchObject({ code: 'runtime_unsupported' });
-
-    // Load-bearing: the durable/harness path owns pi-rpc persistence — the legacy repo must not be
-    // written, so no duplicate message can be produced.
-    expect(addMessage).not.toHaveBeenCalled();
-  });
-
-  it('writes through the repository when the router resolved legacy (GREEN control)', async () => {
-    const { brain, addMessage } = brainWithMessageSpy();
-    const controller = new ConversationsController(brain, routerFixedTo('legacy'));
-
-    const result = await controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER);
-
-    expect(addMessage).toHaveBeenCalledWith(
-      {
-        conversationId: CONVERSATION_ID,
-        role: 'user',
-        content: 'hello from the legacy REST write path',
-        metadata: undefined,
-      },
-      USER.id,
-    );
-    expect(result).toMatchObject({ id: 'message-1', conversationId: CONVERSATION_ID });
-  });
-
-  it('keeps refusing under a pi-rpc router even when CHAT_HARNESS_RUNTIME is flipped to legacy after startup', async () => {
-    // The runtime mode is fixed at module init. A later env mutation must not reopen the fence:
-    // a request-time `resolveChatRuntimeMode(process.env)` read would see `legacy` and wrongly write.
-    process.env['CHAT_HARNESS_RUNTIME'] = 'legacy';
-    const { brain, addMessage } = brainWithMessageSpy();
-    const controller = new ConversationsController(brain, routerFixedTo('pi-rpc'));
-
-    await expect(
-      controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER),
-    ).rejects.toMatchObject({ code: 'runtime_unsupported' });
-
-    expect(addMessage).not.toHaveBeenCalled();
-  });
-
-  it('keeps writing under a legacy router even when CHAT_HARNESS_RUNTIME is flipped to pi-rpc after startup', async () => {
-    // Symmetric guard: a legacy-resolved router must keep writing regardless of the live env, so a
-    // request-time env read of `pi-rpc` cannot spuriously refuse a legitimate legacy write.
-    process.env['CHAT_HARNESS_RUNTIME'] = 'pi-rpc';
-    const { brain, addMessage } = brainWithMessageSpy();
-    const controller = new ConversationsController(brain, routerFixedTo('legacy'));
-
-    await controller.addMessage(CONVERSATION_ID, sendMessageDto(), USER);
-
-    expect(addMessage).toHaveBeenCalledTimes(1);
-  });
-});

apps/gateway/src/conversations/conversations.controller.ts

@@ -6,7 +6,6 @@ import {
   ForbiddenException,
   Get,
   HttpCode,
-  HttpException,
   HttpStatus,
   Inject,
   NotFoundException,
@@ -20,7 +19,6 @@ import type { Brain } from '@mosaicstack/brain';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
-import { ChatRuntimeRouter } from '../chat/chat-runtime-router.js';
 import {
   CreateConversationDto,
   UpdateConversationDto,
@@ -28,41 +26,10 @@ import {
   SearchMessagesDto,
 } from './conversations.dto.js';
 
-/**
- * Under `pi-rpc` the durable/harness conversation path (Task 15) owns message persistence, so the
- * legacy direct-repository write must fail closed with a fixed typed `runtime_unsupported` before
- * the repository is touched — never a duplicate write. The `code` field is exposed at the top level
- * so callers can discriminate the refusal while the 503 status carries the browser-safe surface.
- */
-class HarnessRuntimeWriteUnsupportedException extends HttpException {
-  readonly code = 'runtime_unsupported' as const;
-
-  constructor() {
-    super(
-      {
-        code: 'runtime_unsupported',
-        message:
-          'Conversation message writes are handled by the harness runtime on this deployment.',
-      },
-      HttpStatus.SERVICE_UNAVAILABLE,
-    );
-  }
-}
-
 @Controller('api/conversations')
 @UseGuards(AuthGuard)
 export class ConversationsController {
-  /**
-   * `router` supplies the ONE immutable runtime mode resolved at module init (Task 5, item 3).
-   * The pre-write fence reads `router.runtimeMode`, never `resolveChatRuntimeMode(process.env)` at
-   * request time — a single source of truth, so the controller cannot disagree with the router
-   * about the live runtime if the environment is mutated after startup. Narrowed to `runtimeMode`
-   * so this class depends on nothing else the router exposes.
-   */
-  constructor(
-    @Inject(BRAIN) private readonly brain: Brain,
-    @Inject(ChatRuntimeRouter) private readonly router: Pick<ChatRuntimeRouter, 'runtimeMode'>,
-  ) {}
+  constructor(@Inject(BRAIN) private readonly brain: Brain) {}
 
   @Get()
   async list(@CurrentUser() user: { id: string }) {
@@ -127,13 +94,6 @@ export class ConversationsController {
     @Body() dto: SendMessageDto,
     @CurrentUser() user: { id: string },
   ) {
-    // Fail the legacy repository write closed under pi-rpc BEFORE touching the repository — the
-    // harness path owns persistence there, so a direct write would duplicate the message. The mode
-    // comes from the router's init-time resolution, not a request-time env read.
-    if (this.router.runtimeMode === 'pi-rpc') {
-      throw new HarnessRuntimeWriteUnsupportedException();
-    }
-
     const message = await this.brain.conversations.addMessage(
       {
         conversationId: id,

apps/gateway/src/conversations/conversations.module.ts

@@ -1,14 +1,7 @@
 import { Module } from '@nestjs/common';
-import { ChatModule } from '../chat/chat.module.js';
 import { ConversationsController } from './conversations.controller.js';
 
-/**
- * Imports {@link ChatModule} solely to inject its exported {@link ChatRuntimeRouter} into
- * {@link ConversationsController}, so the REST write fence reads the same init-time runtime mode the
- * router resolved — one source of truth, no duplicate provider, no global token, no AppModule edit.
- */
 @Module({
-  imports: [ChatModule],
   controllers: [ConversationsController],
 })
 export class ConversationsModule {}

apps/gateway/src/coord/interaction-coordination.di.test.ts

@@ -1,19 +0,0 @@
-import 'reflect-metadata';
-import { Test } from '@nestjs/testing';
-import { describe, expect, it } from 'vitest';
-import { CoordModule } from './coord.module.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-
-describe('CoordModule DI (compiled-metadata boot)', () => {
-  it('resolves InteractionCoordinationService through Nest DI', async () => {
-    const moduleRef = await Test.createTestingModule({ imports: [CoordModule] })
-      .overrideGuard(AuthGuard)
-      .useValue({ canActivate: (): boolean => true })
-      .compile();
-    expect(moduleRef.get(InteractionCoordinationService)).toBeInstanceOf(
-      InteractionCoordinationService,
-    );
-    await moduleRef.close();
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
 import {
   InteractionCoordinationClient,
   type CoordinationObservation,
@@ -13,7 +13,6 @@ import type { CreateHandoffDto } from './interaction-coordination.dto.js';
 
 export const COORDINATION_PORT = Symbol('COORDINATION_PORT');
 export const COORDINATION_CONFIG = Symbol('COORDINATION_CONFIG');
-export const HANDOFF_ID_FACTORY = Symbol('HANDOFF_ID_FACTORY');
 
 const HANDOFF_TRACKING_TTL_MS = 60 * 60 * 1_000;
 const MAX_TRACKED_HANDOFFS = 1_000;
@@ -61,8 +60,6 @@ export class InteractionCoordinationService {
   constructor(
     @Inject(COORDINATION_PORT) private readonly port: InteractionCoordinationPort,
     @Inject(COORDINATION_CONFIG) private readonly config: InteractionCoordinationConfig,
-    @Optional()
-    @Inject(HANDOFF_ID_FACTORY)
     private readonly handoffIdFactory: () => string = (): string => crypto.randomUUID(),
   ) {}
 

apps/gateway/src/database/database.module.1392.spec.ts

@@ -1,71 +0,0 @@
-import { describe, it, expect, vi } from 'vitest';
-
-// The module under test imports @mosaicstack/db at module scope; we replace only the
-// pieces DatabaseModule uses (partial mock — the real module also exports the
-// schema the storage adapter's import chain needs) so the test pins the #1392
-// contract (refuse to start on an incomplete schema) without a live database.
-vi.mock('@mosaicstack/db', async (importOriginal) => {
-  const actual: object = await importOriginal();
-  return {
-    ...actual,
-    createDb: vi.fn(),
-    createPgliteDb: vi.fn(),
-    getMigrationStatus: vi.fn(),
-    runPgliteMigrations: vi.fn(),
-  };
-});
-
-import { DatabaseModule } from './database.module.js';
-import { getMigrationStatus } from '@mosaicstack/db';
-import type { DbHandle } from '@mosaicstack/db';
-import type { StorageAdapter } from '@mosaicstack/storage';
-import type { MosaicConfig } from '@mosaicstack/config';
-
-function makeModule(storageType: 'postgres' | 'pglite', tier: string) {
-  const storageAdapter = {
-    name: storageType,
-    migrate: vi.fn(),
-    close: vi.fn(),
-  } as unknown as StorageAdapter;
-  const handle = { close: vi.fn() } as unknown as DbHandle;
-  const config = {
-    tier,
-    storage: { type: storageType, url: 'postgresql://x' },
-  } as unknown as MosaicConfig;
-  return {
-    mod: new DatabaseModule(handle, storageAdapter, config),
-    storageAdapter,
-  };
-}
-
-describe('DatabaseModule.onModuleInit — #1392 schema verification', () => {
-  it('refuses to start when the postgres schema is incomplete', async () => {
-    const { mod, storageAdapter } = makeModule('postgres', 'standalone');
-    vi.mocked(getMigrationStatus).mockResolvedValue({
-      appliedCount: 15,
-      expectedCount: 17,
-      expectedLastTag: '0016_salty_morlocks',
-      complete: false,
-    });
-    await expect(mod.onModuleInit()).rejects.toThrow('Database schema incomplete: 15/17');
-    expect(storageAdapter.migrate).toHaveBeenCalled(); // migrations attempted first
-  });
-
-  it('starts normally when the schema is complete', async () => {
-    const { mod } = makeModule('postgres', 'standalone');
-    vi.mocked(getMigrationStatus).mockResolvedValue({
-      appliedCount: 17,
-      expectedCount: 17,
-      expectedLastTag: '0016_salty_morlocks',
-      complete: true,
-    });
-    await expect(mod.onModuleInit()).resolves.toBeUndefined();
-  });
-
-  it('does not verify postgres status for the local tier (PGlite migrates itself)', async () => {
-    const { mod } = makeModule('pglite', 'local');
-    vi.mocked(getMigrationStatus).mockClear();
-    await expect(mod.onModuleInit()).resolves.toBeUndefined();
-    expect(getMigrationStatus).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/database/database.module.ts

@@ -12,7 +12,6 @@ import {
 import {
   createDb,
   createPgliteDb,
-  getMigrationStatus,
   runPgliteMigrations,
   type Db,
   type DbHandle,
@@ -75,11 +74,6 @@ export class DatabaseModule implements OnApplicationShutdown, OnModuleInit {
   // the same DATABASE_URL, so a single call covers both the gateway DB and
   // the storage tables. We deliberately do NOT call runMigrations() here to
   // avoid opening a second short-lived connection and doubling startup cost.
-  //
-  // #1392: we DO verify afterwards (getMigrationStatus opens one short-lived
-  // connection) and refuse to start on an incomplete schema. A gateway that
-  // boots "healthy" on an empty or partial database is precisely the failure
-  // that shipped in the T63 batch: silent at startup, catastrophic later.
   async onModuleInit(): Promise<void> {
     if (this.config.tier === 'local') {
       this.logger.log('Applying PGlite schema migrations...');
@@ -87,24 +81,6 @@ export class DatabaseModule implements OnApplicationShutdown, OnModuleInit {
     }
     this.logger.log(`Initializing storage adapter (${this.storageAdapter.name})...`);
     await this.storageAdapter.migrate();
-
-    if (this.config.storage.type === 'postgres') {
-      const status = await getMigrationStatus(this.config.storage.url);
-      if (!status.complete) {
-        this.logger.error(
-          `Database schema incomplete: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied ` +
-            `(last expected: ${status.expectedLastTag}). ` +
-            'Refusing to start on a partial schema — see issues #1392/#1402. ' +
-            "Remediation: re-run 'mosaic gateway install' (it now verifies), or apply migrations manually.",
-        );
-        throw new Error(
-          `Database schema incomplete: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied`,
-        );
-      }
-      this.logger.log(
-        `Database schema verified: ${status.appliedCount.toString()}/${status.expectedCount.toString()} migrations applied.`,
-      );
-    }
   }
 
   async onApplicationShutdown(): Promise<void> {

apps/gateway/src/enrollment/enrollment-commands.integration.test.ts

@@ -1,508 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Test, type TestingModule } from '@nestjs/testing';
-import { Logger, ValidationPipe, type ExecutionContext } from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import supertest from 'supertest';
-import { unseal } from '@mosaicstack/auth';
-import {
-  agentAuditEvents,
-  agentIdempotencyFence,
-  agentOutbox,
-  agents,
-  and,
-  createPgliteDb,
-  eq,
-  providerCredentials,
-  runPgliteMigrations,
-  sql,
-  users,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { DB } from '../database/database.module.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { HarnessRegistry } from '../harness/harness.registry.js';
-import { HARNESS_REGISTRY } from '../harness/harness.tokens.js';
-import { FakeHarnessAdapter } from '../harness/testing/fake-harness.adapter.js';
-import { EnrollmentController } from './enrollment.controller.js';
-import {
-  EnrollmentRepository,
-  type EnrollAgentInput,
-  type EnrollmentResult,
-  type EnrolledAgentView,
-} from './enrollment.repository.js';
-import { EnrollmentService } from './enrollment.service.js';
-
-/**
- * Command-level witnesses for the agent enrollment family (M4-4b) — design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md §5 items 1–9 and
- * 11 (item 10, CLI parity, lives in packages/mosaic). Schema-level
- * constraints are witnessed in packages/db/src/agent-enrollment.witness.test.ts.
- *
- * The suite runs the REAL repository/service/controller graph over PGlite,
- * with only AuthGuard overridden (a session store is out of scope; the
- * override binds request.user exactly as the real guard does). The §6.3
- * static companions — no `any`-typed boundary pass-through, a single audit
- * emitter (EnrollmentRepository.appendEvent) — are code-surface properties
- * reviewed on the PR, not runtime probes.
- */
-describe('enrollment commands integration', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let moduleRef: TestingModule;
-  let app: NestFastifyApplication;
-  let http: ReturnType<typeof supertest>;
-  let repo: EnrollmentRepository;
-  let previousAuthSecret: string | undefined;
-
-  const OWNER = 'enr-owner';
-  const ADMIN = 'enr-admin';
-  const STRANGER = 'enr-stranger';
-  const HARNESS = 'fake-harness';
-  /** Never-echo probe value (§5.1). Unique enough that any leak is unambiguous. */
-  const SECRET = `enr-secret-value-${randomUUID()}`;
-
-  /** The HTTP-leg acting user; the overridden guard binds it per request. */
-  let currentUserId = OWNER;
-
-  const enrollInput = (overrides: Partial<EnrollAgentInput> = {}): EnrollAgentInput => ({
-    actorId: OWNER,
-    harness: HARNESS,
-    name: `Agent ${randomUUID().slice(0, 8)}`,
-    persona: null,
-    model: 'anthropic/claude-test',
-    provider: `prov-${randomUUID().slice(0, 8)}`,
-    credential: { mode: 'intake', type: 'api_key', value: SECRET },
-    idempotencyKey: randomUUID(),
-    ...overrides,
-  });
-
-  function expectOk<T>(result: EnrollmentResult<T>): { ok: true; correlationId: string } & T {
-    if (!result.ok) throw new Error(`expected ok, got ${JSON.stringify(result)}`);
-    return result;
-  }
-
-  function expectFail<T>(
-    result: EnrollmentResult<T>,
-    error: string,
-  ): { ok: false; error: string; message: string; correlationId: string } {
-    if (result.ok) throw new Error(`expected ${error}, got ok`);
-    expect(result.error).toBe(error);
-    return result;
-  }
-
-  const fenceForKey = (key: string) =>
-    handle.db
-      .select()
-      .from(agentIdempotencyFence)
-      .where(eq(agentIdempotencyFence.idempotencyKey, key));
-
-  const eventsForAgent = (agentId: string) =>
-    handle.db.select().from(agentAuditEvents).where(eq(agentAuditEvents.agentId, agentId));
-
-  const agentsNamed = (name: string) =>
-    handle.db.select().from(agents).where(eq(agents.name, name));
-
-  const credentialsFor = (userId: string, provider: string) =>
-    handle.db
-      .select()
-      .from(providerCredentials)
-      .where(
-        and(eq(providerCredentials.userId, userId), eq(providerCredentials.provider, provider)),
-      );
-
-  const allOutbox = () => handle.db.select().from(agentOutbox);
-
-  beforeAll(async (): Promise<void> => {
-    previousAuthSecret = process.env['BETTER_AUTH_SECRET'];
-    process.env['BETTER_AUTH_SECRET'] = 'enrollment-witness-sealing-key';
-
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-enrollment-commands-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-
-    const registry = new HarnessRegistry();
-    registry.register(new FakeHarnessAdapter({ id: HARNESS }));
-
-    moduleRef = await Test.createTestingModule({
-      controllers: [EnrollmentController],
-      providers: [
-        EnrollmentRepository,
-        EnrollmentService,
-        { provide: DB, useValue: handle.db },
-        { provide: HARNESS_REGISTRY, useValue: registry },
-      ],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue({
-        canActivate: (ctx: ExecutionContext): boolean => {
-          const request = ctx.switchToHttp().getRequest<{ user?: unknown }>();
-          request.user = { id: currentUserId };
-          return true;
-        },
-      })
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    // Mirror main.ts exactly — the closure witnesses depend on these options.
-    app.useGlobalPipes(
-      new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
-    );
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-    http = supertest(app.getHttpServer());
-    repo = moduleRef.get(EnrollmentRepository);
-
-    await handle.db.insert(users).values([
-      { id: OWNER, name: 'Owner', email: `${OWNER}@example.com` },
-      { id: ADMIN, name: 'Admin', email: `${ADMIN}@example.com`, role: 'admin' },
-      { id: STRANGER, name: 'Stranger', email: `${STRANGER}@example.com` },
-    ]);
-  });
-
-  afterAll(async (): Promise<void> => {
-    await app?.close();
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-    if (previousAuthSecret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-    else process.env['BETTER_AUTH_SECRET'] = previousAuthSecret;
-  });
-
-  // ── §5.7 wizard-facing zero-mutation (runs FIRST: no call → zero rows) ────
-
-  it('zero-mutation: with no enrollment invocation the family tables hold zero rows', async () => {
-    expect(await handle.db.select().from(agents)).toHaveLength(0);
-    expect(await handle.db.select().from(agentAuditEvents)).toHaveLength(0);
-    expect(await handle.db.select().from(agentOutbox)).toHaveLength(0);
-    expect(await handle.db.select().from(agentIdempotencyFence)).toHaveLength(0);
-  });
-
-  // ── §5.1 never-echo + §5.2 sealed single-copy ─────────────────────────────
-
-  it('never echoes the intake credential value: HTTP result, audit, outbox, fence, and logs are clean', async () => {
-    const logSink: string[] = [];
-    const logSpies = (['log', 'error', 'warn', 'debug', 'verbose'] as const).map((method) =>
-      vi.spyOn(Logger.prototype, method).mockImplementation((...args: unknown[]) => {
-        logSink.push(args.map(String).join(' '));
-      }),
-    );
-    try {
-      currentUserId = OWNER;
-      const provider = `prov-echo-${randomUUID().slice(0, 8)}`;
-      const res = await http.post('/api/enrollment/agents').send({
-        harness: HARNESS,
-        name: 'Echo Probe',
-        persona: 'a persona',
-        model: 'anthropic/claude-test',
-        provider,
-        credential: { mode: 'intake', type: 'api_key', value: SECRET },
-        idempotencyKey: randomUUID(),
-      });
-      expect(res.status).toBe(201);
-      expect(res.text).not.toContain(SECRET);
-      const agentId = (res.body as { agent: EnrolledAgentView }).agent.id;
-
-      const events = await eventsForAgent(agentId);
-      expect(events).toHaveLength(1);
-      expect(JSON.stringify(events)).not.toContain(SECRET);
-      expect(JSON.stringify(await allOutbox())).not.toContain(SECRET);
-      const fences = await handle.db
-        .select()
-        .from(agentIdempotencyFence)
-        .where(eq(agentIdempotencyFence.outcomeAgentId, agentId));
-      expect(fences).toHaveLength(1);
-      expect(JSON.stringify(fences)).not.toContain(SECRET);
-      expect(logSink.join('\n')).not.toContain(SECRET);
-
-      // §5.2 sealed single-copy: exactly one provider_credentials row, sealed
-      // at rest, and it round-trips through unseal — no plaintext column.
-      const creds = await credentialsFor(OWNER, provider);
-      expect(creds).toHaveLength(1);
-      expect(creds[0]?.encryptedValue).not.toBe(SECRET);
-      expect(creds[0]?.encryptedValue).not.toContain(SECRET);
-      expect(unseal(creds[0]?.encryptedValue as string)).toBe(SECRET);
-    } finally {
-      logSpies.forEach((spy) => spy.mockRestore());
-    }
-  });
-
-  it('the agents table itself has no credential-bearing column (§5.2)', async () => {
-    const result = (await handle.db.execute(
-      sql`select column_name from information_schema.columns where table_name = 'agents'`,
-    )) as unknown as { rows?: Array<{ column_name: string }> } & Array<{ column_name: string }>;
-    const names = (result.rows ?? result).map((row) => row.column_name);
-    expect(names.length).toBeGreaterThan(0);
-    for (const name of names) {
-      expect(name).not.toMatch(/credential|secret|token|api_key/i);
-    }
-  });
-
-  // ── §5.3 reference resolution ─────────────────────────────────────────────
-
-  it('refuses an unresolvable credential reference with precondition_failed and creates nothing', async () => {
-    const input = enrollInput({ credential: { mode: 'reference' } });
-    const result = await repo.enroll(input);
-    expectFail(result, 'precondition_failed');
-    expect(await agentsNamed(input.name)).toHaveLength(0);
-    expect(await fenceForKey(input.idempotencyKey)).toHaveLength(0);
-  });
-
-  it('resolves a reference credential stored earlier for (actor, provider)', async () => {
-    const provider = `prov-ref-${randomUUID().slice(0, 8)}`;
-    const seeded = expectOk(await repo.enroll(enrollInput({ provider })));
-    const result = expectOk(
-      await repo.enroll(enrollInput({ provider, credential: { mode: 'reference' } })),
-    );
-    expect(result.agent.id).not.toBe(seeded.agent.id);
-    expect(await credentialsFor(OWNER, provider)).toHaveLength(1);
-  });
-
-  // ── §5.4 harness refusals, both codes ────────────────────────────────────
-
-  it('refuses a syntactically invalid harness as validation_failed and a registry miss as precondition_failed', async () => {
-    const blank = await repo.enroll(enrollInput({ harness: '   ' }));
-    expectFail(blank, 'validation_failed');
-    const miss = await repo.enroll(enrollInput({ harness: 'well-formed-but-unregistered' }));
-    expectFail(miss, 'precondition_failed');
-
-    currentUserId = OWNER;
-    const httpBlank = await http.post('/api/enrollment/agents').send({
-      harness: '',
-      name: 'H',
-      model: 'm',
-      provider: 'p',
-      credential: { mode: 'reference' },
-      idempotencyKey: randomUUID(),
-    });
-    expect(httpBlank.status).toBe(400);
-  });
-
-  // ── §5.5 idempotency set (contract 3 §4.3) ───────────────────────────────
-
-  it('actor-bound replay returns the recorded outcome and executes nothing new', async () => {
-    const input = enrollInput();
-    const first = expectOk(await repo.enroll(input));
-    const replay = expectOk(await repo.enroll({ ...input, correlationId: randomUUID() }));
-    expect(replay.agent.id).toBe(first.agent.id);
-
-    expect(await agentsNamed(input.name)).toHaveLength(1);
-    expect(await fenceForKey(input.idempotencyKey)).toHaveLength(1);
-    const events = await eventsForAgent(first.agent.id);
-    expect(events.filter((e) => e.eventType === 'agent.enrolled')).toHaveLength(1);
-    // A passing replay appends exactly the non-mutation access event.
-    const replayed = events.filter((e) => e.eventType === 'agent.enrollment.replayed');
-    expect(replayed).toHaveLength(1);
-    expect((replayed[0]?.payload as { fenceId?: string }).fenceId).toBeDefined();
-  });
-
-  it('payload-digest mismatch on a recorded key refuses with the single bounded conflict shape', async () => {
-    const input = enrollInput();
-    expectOk(await repo.enroll(input));
-    const mismatch = await repo.enroll({ ...input, name: `${input.name} CHANGED` });
-    const failure = expectFail(mismatch, 'conflict');
-    expect(failure.message).toBe('idempotency conflict');
-  });
-
-  it('replay-mode and scope mismatches on the recorded fence each refuse as the same constant conflict', async () => {
-    const modeInput = enrollInput();
-    expectOk(await repo.enroll(modeInput));
-    await handle.db
-      .update(agentIdempotencyFence)
-      .set({ replayMode: 'shared' })
-      .where(eq(agentIdempotencyFence.idempotencyKey, modeInput.idempotencyKey));
-    const modeFailure = expectFail(await repo.enroll(modeInput), 'conflict');
-
-    const scopeInput = enrollInput();
-    expectOk(await repo.enroll(scopeInput));
-    await handle.db
-      .update(agentIdempotencyFence)
-      .set({ authorizationScope: 'some-other-scope' })
-      .where(eq(agentIdempotencyFence.idempotencyKey, scopeInput.idempotencyKey));
-    const scopeFailure = expectFail(await repo.enroll(scopeInput), 'conflict');
-
-    expect(modeFailure.message).toBe(scopeFailure.message);
-  });
-
-  it('a different actor replaying an actor-bound key is refused conflict, learning nothing', async () => {
-    const input = enrollInput();
-    expectOk(await repo.enroll(input));
-    const failure = expectFail(await repo.enroll({ ...input, actorId: STRANGER }), 'conflict');
-    expect(failure.message).toBe('idempotency conflict');
-  });
-
-  it('a replay is re-authorized fresh: revoked target authority refuses instead of replaying', async () => {
-    const input = enrollInput();
-    const first = expectOk(await repo.enroll(input));
-    // Simulate the legacy CRUD DELETE path removing the outcome agent: the
-    // submitter no longer holds read authority on the referenced row.
-    await handle.db.delete(agents).where(eq(agents.id, first.agent.id));
-    expectFail(await repo.enroll(input), 'conflict');
-  });
-
-  it('a shared replay-mode declaration is refused validation_failed with nothing executed and no fence row', async () => {
-    const input = enrollInput({ replayMode: 'shared' });
-    expectFail(await repo.enroll(input), 'validation_failed');
-    expect(await agentsNamed(input.name)).toHaveLength(0);
-    expect(await fenceForKey(input.idempotencyKey)).toHaveLength(0);
-
-    currentUserId = OWNER;
-    const key = randomUUID();
-    const res = await http.post('/api/enrollment/agents').send({
-      harness: HARNESS,
-      name: 'Shared Probe',
-      model: 'm',
-      provider: 'p',
-      credential: { mode: 'reference' },
-      idempotencyKey: key,
-      replayMode: 'shared',
-    });
-    expect(res.status).toBe(400);
-    expect(await fenceForKey(key)).toHaveLength(0);
-  });
-
-  it('two concurrent same-key submissions produce exactly one mutation, the loser resolving as a replay', async () => {
-    const input = enrollInput();
-    const [a, b] = await Promise.all([
-      repo.enroll(input),
-      repo.enroll({ ...input, correlationId: randomUUID() }),
-    ]);
-    const okA = expectOk(a);
-    const okB = expectOk(b);
-    expect(okA.agent.id).toBe(okB.agent.id);
-    expect(await agentsNamed(input.name)).toHaveLength(1);
-    expect(await fenceForKey(input.idempotencyKey)).toHaveLength(1);
-    const events = await eventsForAgent(okA.agent.id);
-    expect(events.filter((e) => e.eventType === 'agent.enrolled')).toHaveLength(1);
-    expect(events.filter((e) => e.eventType === 'agent.enrollment.replayed')).toHaveLength(1);
-  });
-
-  // ── §5.6 same-tx atomicity fault injection ───────────────────────────────
-
-  it('rolls everything back on failure at each write point — no orphan credential survives', async () => {
-    const injectionPoints = [
-      'writeSealedCredential',
-      'insertAgentRow',
-      'insertFenceRow',
-      'appendEvent',
-      'insertOutboxRow',
-    ] as const;
-
-    for (const point of injectionPoints) {
-      const input = enrollInput();
-      const spy = vi.spyOn(repo, point).mockImplementationOnce(() => {
-        throw new Error(`injected ${point} fault`);
-      });
-      try {
-        const result = await repo.enroll(input);
-        expectFail(result, 'internal_fault');
-        expect(await agentsNamed(input.name)).toHaveLength(0);
-        expect(await fenceForKey(input.idempotencyKey)).toHaveLength(0);
-        // Injection at fence/audit/outbox fires AFTER the sealed credential
-        // write's statement ran — the rollback must leave no orphan row.
-        expect(await credentialsFor(OWNER, input.provider)).toHaveLength(0);
-      } finally {
-        spy.mockRestore();
-      }
-    }
-  });
-
-  // ── §5.8 is_system closure ───────────────────────────────────────────────
-
-  it('rejects an is_system injection attempt at the DTO boundary', async () => {
-    currentUserId = OWNER;
-    const key = randomUUID();
-    const res = await http.post('/api/enrollment/agents').send({
-      harness: HARNESS,
-      name: 'System Probe',
-      model: 'm',
-      provider: 'p',
-      credential: { mode: 'reference' },
-      idempotencyKey: key,
-      isSystem: true,
-    });
-    expect(res.status).toBe(400);
-    expect(await fenceForKey(key)).toHaveLength(0);
-  });
-
-  // ── §5.9 correlation + no-existence-oracle ───────────────────────────────
-
-  it('carries a submitted correlation id into the result, the audit event, and the outbox record', async () => {
-    const correlationId = randomUUID();
-    const input = enrollInput({ correlationId });
-    const result = expectOk(await repo.enroll(input));
-    expect(result.correlationId).toBe(correlationId);
-    const events = await eventsForAgent(result.agent.id);
-    expect(events).toHaveLength(1);
-    expect(events[0]?.correlationId).toBe(correlationId);
-    const outboxRows = await handle.db
-      .select()
-      .from(agentOutbox)
-      .where(eq(agentOutbox.eventId, events[0]?.id as string));
-    expect(outboxRows).toHaveLength(1);
-    expect(outboxRows[0]?.correlationId).toBe(correlationId);
-
-    // Refusals carry the correlation envelope too (contract 5 §4.3).
-    const refusal = expectFail(
-      await repo.enroll({ ...input, name: 'changed name', correlationId }),
-      'conflict',
-    );
-    expect(refusal.correlationId).toBe(correlationId);
-  });
-
-  it('agent.enrollment.get returns owner and admin reads with the correlation envelope, no idempotency key', async () => {
-    const enrolled = expectOk(await repo.enroll(enrollInput()));
-    const correlationId = randomUUID();
-    const asOwner = expectOk(await repo.getEnrollment(OWNER, enrolled.agent.id, correlationId));
-    expect(asOwner.correlationId).toBe(correlationId);
-    expect(asOwner.agent.id).toBe(enrolled.agent.id);
-    const asAdmin = expectOk(await repo.getEnrollment(ADMIN, enrolled.agent.id));
-    expect(asAdmin.correlationId).toMatch(/^[0-9a-f-]{36}$/);
-
-    currentUserId = OWNER;
-    const wire = randomUUID();
-    const res = await http.get(`/api/enrollment/agents/${enrolled.agent.id}?correlationId=${wire}`);
-    expect(res.status).toBe(200);
-    expect((res.body as { correlationId: string }).correlationId).toBe(wire);
-  });
-
-  it('no existence oracle: unauthorized get of a real agent and get of a missing id are indistinguishable', async () => {
-    const enrolled = expectOk(await repo.enroll(enrollInput()));
-
-    currentUserId = STRANGER;
-    const unauthorized = await http.get(`/api/enrollment/agents/${enrolled.agent.id}`);
-    const missing = await http.get(`/api/enrollment/agents/${randomUUID()}`);
-    expect(unauthorized.status).toBe(404);
-    expect(missing.status).toBe(404);
-    const strip = (body: Record<string, unknown>): Record<string, unknown> =>
-      Object.fromEntries(Object.entries(body).filter(([key]) => key !== 'correlationId'));
-    expect(strip(unauthorized.body as Record<string, unknown>)).toEqual(
-      strip(missing.body as Record<string, unknown>),
-    );
-  });
-
-  // ── §5.11 fail-closed ────────────────────────────────────────────────────
-
-  it('fails closed as internal_fault when the store is unreachable, with no fallback write', async () => {
-    const before = (await handle.db.select().from(agents)).length;
-    const txSpy = vi.spyOn(handle.db, 'transaction').mockImplementationOnce(() => {
-      throw new Error('injected store outage');
-    });
-    try {
-      expectFail(await repo.enroll(enrollInput()), 'internal_fault');
-    } finally {
-      txSpy.mockRestore();
-    }
-    const selectSpy = vi.spyOn(handle.db, 'select').mockImplementationOnce(() => {
-      throw new Error('injected store outage');
-    });
-    try {
-      expectFail(await repo.getEnrollment(OWNER, randomUUID()), 'internal_fault');
-    } finally {
-      selectSpy.mockRestore();
-    }
-    expect((await handle.db.select().from(agents)).length).toBe(before);
-  });
-});

apps/gateway/src/enrollment/enrollment.controller.ts

@@ -1,61 +0,0 @@
-import {
-  Body,
-  Controller,
-  Get,
-  Param,
-  ParseUUIDPipe,
-  Post,
-  Query,
-  UseGuards,
-} from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { EnrollAgentDto, GetEnrollmentQueryDto } from './enrollment.dto.js';
-import { EnrollmentRepository } from './enrollment.repository.js';
-import { EnrollmentService } from './enrollment.service.js';
-
-/**
- * The agent enrollment command family's closed HTTP surface (design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md §3): one command,
- * one query. Authentication failures are the guard's (401); everything else
- * is the repository's closed enum mapped by EnrollmentService.
- */
-@Controller('api/enrollment')
-@UseGuards(AuthGuard)
-export class EnrollmentController {
-  constructor(
-    private readonly repository: EnrollmentRepository,
-    private readonly service: EnrollmentService,
-  ) {}
-
-  /** agent.enroll (§3.1). */
-  @Post('agents')
-  async enroll(@CurrentUser() user: { id: string }, @Body() dto: EnrollAgentDto) {
-    return this.service.unwrap(
-      await this.repository.enroll({
-        actorId: user.id,
-        harness: dto.harness,
-        name: dto.name,
-        persona: dto.persona ?? null,
-        model: dto.model,
-        provider: dto.provider,
-        credential: dto.credential,
-        idempotencyKey: dto.idempotencyKey,
-        correlationId: dto.correlationId,
-        replayMode: dto.replayMode,
-      }),
-    );
-  }
-
-  /** agent.enrollment.get (§3.2): owner-or-admin; unauthorized and missing fold to one not_found. */
-  @Get('agents/:id')
-  async getEnrollment(
-    @CurrentUser() user: { id: string },
-    @Param('id', ParseUUIDPipe) id: string,
-    @Query() query: GetEnrollmentQueryDto,
-  ) {
-    return this.service.unwrap(
-      await this.repository.getEnrollment(user.id, id, query.correlationId),
-    );
-  }
-}

apps/gateway/src/enrollment/enrollment.dto.ts

@@ -1,107 +0,0 @@
-import { Type } from 'class-transformer';
-import {
-  IsIn,
-  IsOptional,
-  IsString,
-  IsUUID,
-  MaxLength,
-  MinLength,
-  ValidateIf,
-  ValidateNested,
-} from 'class-validator';
-
-/**
- * Agent enrollment command DTOs (design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md §3.1/§3.2,
- * contract 5 §4.1 typed boundary).
- *
- * The global ValidationPipe runs with whitelist + forbidNonWhitelisted, so
- * closure is contract surface here exactly as in the hierarchy DTOs:
- *  - EnrollAgentDto declares NO isSystem field — `is_system` is never
- *    settable through this command (design §3.1 rule 4); the pipe refuses it.
- *  - replayMode admits ONLY 'actor-bound': `shared` is seed-only (contract 3
- *    §4.3), so a shared declaration is refused `validation_failed` at the
- *    boundary, executes nothing, and records no fence row (design §3.1).
- * Every class here must be registered in PIPE_GUARDED_DTOS so the boot-time
- * assertion proves the pipe sees the decorators.
- */
-
-/**
- * Credential input, discriminated on `mode` (design §3.1):
- *  - `{ mode: 'reference' }` — a stored credential for (actor, provider)
- *    must already exist; `type`/`value` must be ABSENT (the repository
- *    refuses a reference that smuggles a value).
- *  - `{ mode: 'intake', type: 'api_key', value }` — the value is sealed
- *    into the credential store inside the enrollment transaction and is
- *    never echoed anywhere (§3.1 rule 1).
- */
-export class EnrollCredentialDto {
-  @IsIn(['reference', 'intake'])
-  mode!: 'reference' | 'intake';
-
-  @ValidateIf((o: EnrollCredentialDto) => o.mode === 'intake')
-  @IsIn(['api_key'])
-  type?: 'api_key';
-
-  @ValidateIf((o: EnrollCredentialDto) => o.mode === 'intake')
-  @IsString()
-  @MinLength(1)
-  @MaxLength(4096)
-  value?: string;
-}
-
-export class EnrollAgentDto {
-  /** Registered harness name; a well-formed name missing from the registry is `precondition_failed`. */
-  @IsString()
-  @MinLength(1)
-  @MaxLength(200)
-  harness!: string;
-
-  @IsString()
-  @MinLength(1)
-  @MaxLength(200)
-  name!: string;
-
-  /** Stored as the agent's system prompt; null/absent leaves it unset. */
-  @IsOptional()
-  @IsString()
-  @MaxLength(20000)
-  persona?: string | null;
-
-  /** Provider-qualified model id. */
-  @IsString()
-  @MinLength(1)
-  @MaxLength(200)
-  model!: string;
-
-  /** Names the credential's provider. */
-  @IsString()
-  @MinLength(1)
-  @MaxLength(200)
-  provider!: string;
-
-  @ValidateNested()
-  @Type(() => EnrollCredentialDto)
-  credential!: EnrollCredentialDto;
-
-  /** REQUIRED — contract 3 §4.3, ratified into contract 5 §4 via §7 item 4. */
-  @IsUUID()
-  idempotencyKey!: string;
-
-  /** Optional; generated when absent (contract 5 §4.3). */
-  @IsOptional()
-  @IsUUID()
-  correlationId?: string;
-
-  /** Only 'actor-bound' is admissible on this family — see module doc. */
-  @IsOptional()
-  @IsIn(['actor-bound'])
-  replayMode?: 'actor-bound';
-}
-
-/** Query envelope for agent.enrollment.get (design §3.2): correlation only, no idempotency key. */
-export class GetEnrollmentQueryDto {
-  @IsOptional()
-  @IsUUID()
-  correlationId?: string;
-}

apps/gateway/src/enrollment/enrollment.module.ts

@@ -1,22 +0,0 @@
-import { Module } from '@nestjs/common';
-import { HarnessModule } from '../harness/harness.module.js';
-import { EnrollmentController } from './enrollment.controller.js';
-import { EnrollmentRepository } from './enrollment.repository.js';
-import { EnrollmentService } from './enrollment.service.js';
-
-/**
- * Agent enrollment command family (M4-4b; design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md). Imports
- * HarnessModule for the live harness registry — the validation source for
- * the `harness` field (a well-formed name the registry does not know is a
- * precondition failure). EnrollmentRepository is the family's sole writer;
- * every mutation runs fence-check → mutate → audit + outbox in one
- * transaction.
- */
-@Module({
-  imports: [HarnessModule],
-  controllers: [EnrollmentController],
-  providers: [EnrollmentRepository, EnrollmentService],
-  exports: [EnrollmentRepository],
-})
-export class EnrollmentModule {}

apps/gateway/src/enrollment/enrollment.repository.ts

@@ -1,538 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { Inject, Injectable, Logger } from '@nestjs/common';
-import { seal } from '@mosaicstack/auth';
-import {
-  agentAuditEvents,
-  agentIdempotencyFence,
-  agentOutbox,
-  agents,
-  and,
-  eq,
-  providerCredentials,
-  users,
-  type Db,
-} from '@mosaicstack/db';
-import { DB } from '../database/database.module.js';
-import type { HarnessRegistry } from '../harness/harness.registry.js';
-import { HARNESS_REGISTRY } from '../harness/harness.tokens.js';
-
-/**
- * Agent enrollment command repository (design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md §3; contract 5 §4
- * envelope; contract 3 §4.3 idempotency fence, ratified via §7 item 4).
- *
- * The ONLY writer of the enrollment family's tables (`agent_audit_events`,
- * `agent_outbox`, `agent_idempotency_fence`) and the only path that sets
- * `agents.harness`/`agents.enrolled_at`. Every enroll runs one transaction:
- * fence check → (replay | credential handling → agent insert → fence insert →
- * audit event + outbox), so state, fence, event, and outbox commit or roll
- * back together (§3.1 rule 6).
- *
- * Authorization (v1, §3.1 rule 4) is the AuthGuard-authenticated actor — no
- * hierarchy grant is consulted because v1 enrollment binds no hierarchy node.
- * The recorded fence authorization scope is therefore the constant
- * platform-user identity domain (§3.1 rule 5).
- *
- * Never-echo (§3.1 rule 1): the credential value reaches exactly one sink —
- * the sealed store write — and appears in no result, audit payload, outbox
- * row, or log line. Log lines here carry correlation ids and error names
- * only, never request fields.
- *
- * The single-write helper methods (writeSealedCredential, insertAgentRow,
- * insertFenceRow, appendEvent, insertOutboxRow) are ordinary decomposition;
- * the atomicity witnesses (§5.6) spy on them to inject faults at each write
- * point without any test-only production switch.
- */
-
-export const ENROLLMENT_OPERATION = 'agent.enroll';
-/** §3.1 rule 5: v1 authorization is grant-free, so the scope is the authenticated-user identity domain. */
-const AUTHORIZATION_SCOPE = 'platform-user';
-/** The single bounded collision shape (§3.1 rule 5): constant, identifying no record. */
-const CONFLICT_MESSAGE = 'idempotency conflict';
-/** One fixed message for every not_found cause — missing and unauthorized are indistinguishable (§3.2). */
-const NOT_FOUND_MESSAGE = 'agent not found';
-
-/** Closed per-family error enum (§3.3). 401 is produced by AuthGuard; 403 folds to not_found (§3.2). */
-export type EnrollmentErrorCode =
-  | 'validation_failed'
-  | 'authentication_failed'
-  | 'authorization_refused'
-  | 'not_found'
-  | 'conflict'
-  | 'precondition_failed'
-  | 'internal_fault';
-
-export interface EnrollmentFailure {
-  readonly ok: false;
-  readonly error: EnrollmentErrorCode;
-  readonly message: string;
-  /** Refusals carry the correlation id too (contract 5 §4.3 end-to-end traceability). */
-  readonly correlationId: string;
-}
-
-export type EnrollmentResult<T> =
-  | ({ readonly ok: true; readonly correlationId: string } & T)
-  | EnrollmentFailure;
-
-/** The persisted agent row; the table stores no credential material (§3.1 rule 1). */
-export interface EnrolledAgentView {
-  readonly id: string;
-  readonly name: string;
-  readonly provider: string;
-  readonly model: string;
-  readonly status: string;
-  readonly harness: string | null;
-  readonly persona: string | null;
-  readonly ownerId: string | null;
-  readonly enrolledAt: string | null;
-  readonly createdAt: string;
-}
-
-export interface EnrollCredentialInput {
-  readonly mode: 'reference' | 'intake';
-  readonly type?: 'api_key';
-  readonly value?: string;
-}
-
-export interface EnrollAgentInput {
-  readonly actorId: string;
-  readonly harness: string;
-  readonly name: string;
-  readonly persona?: string | null;
-  readonly model: string;
-  readonly provider: string;
-  readonly credential: EnrollCredentialInput;
-  readonly idempotencyKey: string;
-  readonly correlationId?: string;
-  /** Defense in depth below the DTO: anything but 'actor-bound' is refused (seed-only rule). */
-  readonly replayMode?: string;
-}
-
-type Tx = Pick<Db, 'insert' | 'select' | 'update' | 'delete'>;
-type AgentRow = typeof agents.$inferSelect;
-type FenceRow = typeof agentIdempotencyFence.$inferSelect;
-
-/** Raised inside the transaction when the fence insert lost a same-key race (§3.1 rule 5 concurrency). */
-class ConcurrentEnrollmentError extends Error {
-  constructor() {
-    super('concurrent enrollment lost the fence race');
-    this.name = 'ConcurrentEnrollmentError';
-  }
-}
-
-function agentView(row: AgentRow): EnrolledAgentView {
-  return {
-    id: row.id,
-    name: row.name,
-    provider: row.provider,
-    model: row.model,
-    status: row.status,
-    harness: row.harness,
-    persona: row.systemPrompt,
-    ownerId: row.ownerId,
-    enrolledAt: row.enrolledAt?.toISOString() ?? null,
-    createdAt: row.createdAt.toISOString(),
-  };
-}
-
-/** Key-order-independent serialization (jsonb precedent in hierarchy-audit). */
-function canonicalJson(value: unknown): string {
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
-  if (value !== null && typeof value === 'object') {
-    const record = value as Record<string, unknown>;
-    const body = Object.keys(record)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`)
-      .join(',');
-    return `{${body}}`;
-  }
-  return JSON.stringify(value);
-}
-
-interface NormalizedEnrollment {
-  readonly actorId: string;
-  readonly harness: string;
-  readonly name: string;
-  readonly persona: string | null;
-  readonly model: string;
-  readonly provider: string;
-  readonly credential: EnrollCredentialInput;
-  readonly idempotencyKey: string;
-  readonly correlationId: string;
-  readonly digest: string;
-}
-
-/**
- * Canonicalized-payload digest (§3.1 rule 5). The input EXCLUDES the
- * credential value by construction: it covers mode and declared type only —
- * plaintext never reaches the hash.
- */
-function digestOf(
-  input: Omit<NormalizedEnrollment, 'actorId' | 'idempotencyKey' | 'correlationId' | 'digest'>,
-): string {
-  const canonical = canonicalJson({
-    harness: input.harness,
-    name: input.name,
-    persona: input.persona,
-    model: input.model,
-    provider: input.provider,
-    credential: { mode: input.credential.mode, type: input.credential.type ?? null },
-  });
-  return createHash('sha256').update(canonical).digest('hex');
-}
-
-@Injectable()
-export class EnrollmentRepository {
-  private readonly logger = new Logger(EnrollmentRepository.name);
-
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry,
-  ) {}
-
-  async enroll(input: EnrollAgentInput): Promise<EnrollmentResult<{ agent: EnrolledAgentView }>> {
-    const correlationId = input.correlationId ?? randomUUID();
-    const fail = (error: EnrollmentErrorCode, message: string): EnrollmentFailure => ({
-      ok: false,
-      error,
-      message,
-      correlationId,
-    });
-
-    const harness = input.harness.trim();
-    const name = input.name.trim();
-    if (harness.length === 0) return fail('validation_failed', 'harness must be non-empty');
-    if (name.length === 0 || name.length > 200) {
-      return fail('validation_failed', 'name must be non-empty and at most 200 characters');
-    }
-    if (input.replayMode !== undefined && input.replayMode !== 'actor-bound') {
-      // Seed-only rule (contract 3 §4.3): refused with nothing executed and no fence row.
-      return fail('validation_failed', 'replayMode must be actor-bound');
-    }
-    if (input.credential.mode === 'reference') {
-      if (input.credential.type !== undefined || input.credential.value !== undefined) {
-        return fail('validation_failed', 'a reference credential carries no type or value');
-      }
-    } else if (
-      input.credential.type !== 'api_key' ||
-      typeof input.credential.value !== 'string' ||
-      input.credential.value.length === 0
-    ) {
-      return fail('validation_failed', 'an intake credential requires type api_key and a value');
-    }
-    // Syntactic validity ends above; a well-formed name the live registry
-    // does not know is a precondition failure (§3.1 table).
-    if (!this.registry.has(harness)) {
-      return fail('precondition_failed', 'harness is not registered');
-    }
-
-    const normalized: NormalizedEnrollment = {
-      actorId: input.actorId,
-      harness,
-      name,
-      persona: input.persona ?? null,
-      model: input.model,
-      provider: input.provider,
-      credential: input.credential,
-      idempotencyKey: input.idempotencyKey,
-      correlationId,
-      digest: digestOf({
-        harness,
-        name,
-        persona: input.persona ?? null,
-        model: input.model,
-        provider: input.provider,
-        credential: input.credential,
-      }),
-    };
-
-    // Two attempts: a fence-race loser's transaction rolls back and the retry
-    // resolves through the replay path against the winner's committed row —
-    // or executes afresh if the winner aborted (§3.1 rule 5 concurrency). A
-    // unique-violation race never surfaces as an unhandled internal fault.
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-      try {
-        return await this.db.transaction(async (tx) => this.enrollTx(tx, normalized));
-      } catch (error) {
-        if (error instanceof ConcurrentEnrollmentError && attempt === 0) continue;
-        if (error instanceof ConcurrentEnrollmentError) {
-          return fail('conflict', CONFLICT_MESSAGE);
-        }
-        // §4.4 fail-closed: whatever broke, the transaction rolled back and
-        // the refusal is the internal-fault class — no fallback write or read.
-        this.logger.error(
-          `agent.enroll failed closed (correlation=${correlationId}): ${
-            error instanceof Error ? error.name : 'unknown error'
-          }`,
-        );
-        return fail('internal_fault', 'internal fault');
-      }
-    }
-    return fail('internal_fault', 'internal fault');
-  }
-
-  private async enrollTx(
-    tx: Tx,
-    input: NormalizedEnrollment,
-  ): Promise<EnrollmentResult<{ agent: EnrolledAgentView }>> {
-    const fence = await this.fenceFor(tx, input.idempotencyKey);
-    if (fence) return this.replay(tx, fence, input);
-
-    if (input.credential.mode === 'reference') {
-      // §3.1 rule 3: the reference must resolve for (actor, provider).
-      const existing = await tx
-        .select({ id: providerCredentials.id })
-        .from(providerCredentials)
-        .where(
-          and(
-            eq(providerCredentials.userId, input.actorId),
-            eq(providerCredentials.provider, input.provider),
-          ),
-        )
-        .limit(1);
-      if (existing.length === 0) {
-        return {
-          ok: false,
-          error: 'precondition_failed',
-          message: 'credential reference does not resolve',
-          correlationId: input.correlationId,
-        };
-      }
-    } else {
-      // §3.1 rule 2: sealed-store write inside THIS transaction — a later
-      // failure rolls it back, leaving no orphan credential.
-      await this.writeSealedCredential(
-        tx,
-        input.actorId,
-        input.provider,
-        input.credential.value as string,
-      );
-    }
-
-    const agentRow = await this.insertAgentRow(tx, input);
-    const fenceRow = await this.insertFenceRow(tx, input, agentRow.id);
-    if (!fenceRow) {
-      // A same-(operation, key) winner committed first; abandon our writes.
-      throw new ConcurrentEnrollmentError();
-    }
-    await this.appendEvent(tx, {
-      eventType: 'agent.enrolled',
-      actorId: input.actorId,
-      agentId: agentRow.id,
-      correlationId: input.correlationId,
-      // §3.1 rule 6 payload: harness, provider, name, credentialMode — no credential material.
-      payload: {
-        harness: input.harness,
-        provider: input.provider,
-        name: input.name,
-        credentialMode: input.credential.mode,
-      },
-    });
-    return { ok: true, correlationId: input.correlationId, agent: agentView(agentRow) };
-  }
-
-  /**
-   * Replay path (§3.1 rule 5): a fresh submission of a recorded
-   * (operation, key). The actor is re-authorized exactly as a fresh
-   * submission (v1: authenticated actor — the guard already ran); then mode,
-   * scope, digest, and recorded-actor equality; then target-result read
-   * authority (owner or admin) on the referenced agent. ANY failure refuses
-   * with the single bounded conflict shape — constant, identifying no record.
-   * A passing replay executes nothing and appends only the non-mutation
-   * access event (with its outbox record — one outbox row per event).
-   */
-  private async replay(
-    tx: Tx,
-    fence: FenceRow,
-    input: NormalizedEnrollment,
-  ): Promise<EnrollmentResult<{ agent: EnrolledAgentView }>> {
-    const collision: EnrollmentFailure = {
-      ok: false,
-      error: 'conflict',
-      message: CONFLICT_MESSAGE,
-      correlationId: input.correlationId,
-    };
-    if (fence.replayMode !== 'actor-bound') return collision;
-    if (fence.authorizationScope !== AUTHORIZATION_SCOPE) return collision;
-    if (fence.payloadDigest !== input.digest) return collision;
-    if (fence.actorId !== input.actorId) return collision;
-
-    const rows = await tx.select().from(agents).where(eq(agents.id, fence.outcomeAgentId)).limit(1);
-    const agentRow = rows[0];
-    if (!agentRow) return collision;
-    const authorized =
-      agentRow.ownerId === input.actorId || (await this.isPlatformAdmin(tx, input.actorId));
-    if (!authorized) return collision;
-
-    await this.appendEvent(tx, {
-      eventType: 'agent.enrollment.replayed',
-      actorId: input.actorId,
-      agentId: agentRow.id,
-      correlationId: input.correlationId,
-      payload: { fenceId: fence.id },
-    });
-    return { ok: true, correlationId: input.correlationId, agent: agentView(agentRow) };
-  }
-
-  /**
-   * agent.enrollment.get (§3.2): owner-or-admin read. Unauthorized and
-   * missing fold to the same not_found wire shape (no existence oracle).
-   */
-  async getEnrollment(
-    actorId: string,
-    agentId: string,
-    correlationId?: string,
-  ): Promise<EnrollmentResult<{ agent: EnrolledAgentView }>> {
-    const resolvedCorrelation = correlationId ?? randomUUID();
-    try {
-      const rows = await this.db.select().from(agents).where(eq(agents.id, agentId)).limit(1);
-      const row = rows[0];
-      if (row) {
-        const authorized =
-          row.ownerId === actorId || (await this.isPlatformAdmin(this.db, actorId));
-        if (authorized) {
-          return { ok: true, correlationId: resolvedCorrelation, agent: agentView(row) };
-        }
-      }
-      return {
-        ok: false,
-        error: 'not_found',
-        message: NOT_FOUND_MESSAGE,
-        correlationId: resolvedCorrelation,
-      };
-    } catch (error) {
-      this.logger.error(
-        `agent.enrollment.get failed closed (correlation=${resolvedCorrelation}): ${
-          error instanceof Error ? error.name : 'unknown error'
-        }`,
-      );
-      return {
-        ok: false,
-        error: 'internal_fault',
-        message: 'internal fault',
-        correlationId: resolvedCorrelation,
-      };
-    }
-  }
-
-  private async fenceFor(tx: Tx, idempotencyKey: string): Promise<FenceRow | null> {
-    const rows = await tx
-      .select()
-      .from(agentIdempotencyFence)
-      .where(
-        and(
-          eq(agentIdempotencyFence.operation, ENROLLMENT_OPERATION),
-          eq(agentIdempotencyFence.idempotencyKey, idempotencyKey),
-        ),
-      )
-      .limit(1);
-    return rows[0] ?? null;
-  }
-
-  private async isPlatformAdmin(tx: Tx, actorId: string): Promise<boolean> {
-    const rows = await tx
-      .select({ role: users.role })
-      .from(users)
-      .where(eq(users.id, actorId))
-      .limit(1);
-    return rows[0]?.role === 'admin';
-  }
-
-  /**
-   * Sealed intake write, mirroring ProviderCredentialsService.store semantics
-   * (seal-at-rest, one row per (userId, provider)) but on the enrollment
-   * transaction (§3.1 rule 2). The plaintext exists only in this frame.
-   */
-  async writeSealedCredential(
-    tx: Tx,
-    userId: string,
-    provider: string,
-    value: string,
-  ): Promise<void> {
-    const encryptedValue = seal(value);
-    await tx
-      .insert(providerCredentials)
-      .values({ userId, provider, credentialType: 'api_key', encryptedValue, metadata: null })
-      .onConflictDoUpdate({
-        target: [providerCredentials.userId, providerCredentials.provider],
-        set: {
-          credentialType: 'api_key',
-          encryptedValue,
-          metadata: null,
-          updatedAt: new Date(),
-        },
-      });
-  }
-
-  async insertAgentRow(tx: Tx, input: NormalizedEnrollment): Promise<AgentRow> {
-    const rows = await tx
-      .insert(agents)
-      .values({
-        name: input.name,
-        provider: input.provider,
-        model: input.model,
-        harness: input.harness,
-        systemPrompt: input.persona,
-        // §3.1 rule 4: owner is the authenticated actor; is_system stays default false.
-        ownerId: input.actorId,
-        enrolledAt: new Date(),
-      })
-      .returning();
-    const row = rows[0];
-    if (!row) throw new Error('agent insert returned no row');
-    return row;
-  }
-
-  async insertFenceRow(
-    tx: Tx,
-    input: NormalizedEnrollment,
-    outcomeAgentId: string,
-  ): Promise<FenceRow | null> {
-    const rows = await tx
-      .insert(agentIdempotencyFence)
-      .values({
-        operation: ENROLLMENT_OPERATION,
-        idempotencyKey: input.idempotencyKey,
-        actorId: input.actorId,
-        authorizationScope: AUTHORIZATION_SCOPE,
-        payloadDigest: input.digest,
-        replayMode: 'actor-bound',
-        outcomeAgentId,
-      })
-      .onConflictDoNothing()
-      .returning();
-    return rows[0] ?? null;
-  }
-
-  /** Append one audit event and its outbox record on the caller's transaction (one outbox row per event). */
-  async appendEvent(
-    tx: Tx,
-    input: {
-      eventType: 'agent.enrolled' | 'agent.enrollment.replayed';
-      actorId: string;
-      agentId: string;
-      correlationId: string;
-      payload: Record<string, unknown>;
-      causationId?: string;
-    },
-  ): Promise<void> {
-    const inserted = await tx
-      .insert(agentAuditEvents)
-      .values({
-        eventType: input.eventType,
-        actorId: input.actorId,
-        agentId: input.agentId,
-        correlationId: input.correlationId,
-        causationId: input.causationId ?? null,
-        payload: input.payload,
-      })
-      .returning();
-    const event = inserted[0];
-    if (!event) throw new Error('agent audit event insert returned no row');
-    await this.insertOutboxRow(tx, event.id, input.correlationId);
-  }
-
-  async insertOutboxRow(tx: Tx, eventId: string, correlationId: string): Promise<void> {
-    await tx.insert(agentOutbox).values({ eventId, correlationId });
-  }
-}

apps/gateway/src/enrollment/enrollment.service.ts

@@ -1,45 +0,0 @@
-import { HttpException, HttpStatus, Injectable } from '@nestjs/common';
-import type {
-  EnrollmentErrorCode,
-  EnrollmentFailure,
-  EnrollmentResult,
-} from './enrollment.repository.js';
-
-/**
- * Maps enrollment result unions onto the closed HTTP status set (design
- * docs/plans/2026-08-29-agent-enrollment-command-design.md §3.3, contract 5
- * §4.2). Every refusal body carries the correlation id (contract 5 §4.3
- * end-to-end traceability) alongside the enum code. `not_found` carries one
- * fixed message for every cause — missing agent and unauthorized caller are
- * indistinguishable on the wire (§3.2).
- */
-const HTTP_STATUS: Record<EnrollmentErrorCode, HttpStatus> = {
-  validation_failed: HttpStatus.BAD_REQUEST,
-  authentication_failed: HttpStatus.UNAUTHORIZED,
-  authorization_refused: HttpStatus.FORBIDDEN,
-  not_found: HttpStatus.NOT_FOUND,
-  conflict: HttpStatus.CONFLICT,
-  precondition_failed: HttpStatus.UNPROCESSABLE_ENTITY,
-  internal_fault: HttpStatus.INTERNAL_SERVER_ERROR,
-};
-
-@Injectable()
-export class EnrollmentService {
-  unwrap<T>(result: EnrollmentResult<T>): { ok: true; correlationId: string } & T {
-    if (result.ok) return result;
-    throw this.toException(result);
-  }
-
-  private toException(failure: EnrollmentFailure): HttpException {
-    const status = HTTP_STATUS[failure.error];
-    return new HttpException(
-      {
-        statusCode: status,
-        error: failure.error,
-        message: failure.message,
-        correlationId: failure.correlationId,
-      },
-      status,
-    );
-  }
-}

apps/gateway/src/env.ts

@@ -1,133 +0,0 @@
-import { config } from 'dotenv';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { detectFromEnv, loadConfig } from '@mosaicstack/config';
-
-type TierSource =
-  | 'process environment'
-  | 'daemon .env'
-  | 'monorepo-root .env'
-  | 'gateway-local .env'
-  | 'default';
-
-type BootSource = TierSource | 'mosaic.config.json';
-
-export interface GatewayDotenvPaths {
-  daemonEnv: string;
-  monorepoRootEnv: string;
-  gatewayLocalEnv: string;
-}
-
-const here = dirname(fileURLToPath(import.meta.url));
-
-export function resolveGatewayDotenvPaths(
-  anchor: string = here,
-  homeBase: string = homedir(),
-): GatewayDotenvPaths {
-  return {
-    daemonEnv: join(homeBase, '.config', 'mosaic', 'gateway', '.env'),
-    monorepoRootEnv: resolve(anchor, '../../..', '.env'),
-    gatewayLocalEnv: resolve(anchor, '..', '.env'),
-  };
-}
-
-export function resolveGatewayConfigPath(anchor: string = here): string {
-  // GATEWAY_HOME is daemon-created 0700; its env override adds no authority because env can set MOSAIC_STORAGE_TIER.
-  const gatewayHome = resolve(
-    process.env['MOSAIC_GATEWAY_HOME'] ?? join(homedir(), '.config', 'mosaic', 'gateway'),
-  );
-  const daemonConfig = join(gatewayHome, 'mosaic.config.json');
-  const gatewayLocalConfig = resolve(anchor, '..', 'mosaic.config.json');
-  const monorepoRootConfig = resolve(anchor, '../../..', 'mosaic.config.json');
-
-  if (existsSync(daemonConfig)) {
-    return daemonConfig;
-  }
-  if (existsSync(gatewayLocalConfig)) {
-    return gatewayLocalConfig;
-  }
-  if (existsSync(monorepoRootConfig)) {
-    return monorepoRootConfig;
-  }
-
-  return monorepoRootConfig;
-}
-
-export function loadGatewayEnv(anchor: string = here, homeBase: string = homedir()): void {
-  const { daemonEnv, monorepoRootEnv, gatewayLocalEnv } = resolveGatewayDotenvPaths(
-    anchor,
-    homeBase,
-  );
-  const inheritedTier = process.env['MOSAIC_STORAGE_TIER'];
-  let tierSource: TierSource = inheritedTier === undefined ? 'default' : 'process environment';
-  const inheritedDatabaseUrl = process.env['DATABASE_URL'];
-  let databaseUrlSource: TierSource =
-    inheritedDatabaseUrl === undefined ? 'default' : 'process environment';
-
-  function loadAnchoredDotenv(
-    path: string,
-    sourceLabel: Exclude<TierSource, 'process environment' | 'default'>,
-  ): void {
-    if (!existsSync(path)) {
-      return;
-    }
-
-    const beforeTier = process.env['MOSAIC_STORAGE_TIER'];
-    const beforeDatabaseUrl = process.env['DATABASE_URL'];
-    config({ path, quiet: true });
-
-    if (
-      beforeTier === undefined &&
-      process.env['MOSAIC_STORAGE_TIER'] !== undefined &&
-      tierSource === 'default'
-    ) {
-      tierSource = sourceLabel;
-    }
-
-    if (
-      beforeDatabaseUrl === undefined &&
-      process.env['DATABASE_URL'] !== undefined &&
-      databaseUrlSource === 'default'
-    ) {
-      databaseUrlSource = sourceLabel;
-    }
-  }
-
-  // Load .env from daemon config dir (global install / daemon mode) first.
-  // It takes precedence over file-based local-dev configuration.
-  loadAnchoredDotenv(daemonEnv, 'daemon .env');
-
-  // Load .env from the anchored monorepo root, then fill any remaining values
-  // from apps/gateway/.env when present.
-  loadAnchoredDotenv(monorepoRootEnv, 'monorepo-root .env');
-  loadAnchoredDotenv(gatewayLocalEnv, 'gateway-local .env');
-
-  const envOnlyTier = detectFromEnv().tier;
-  const configPath = resolveGatewayConfigPath(anchor);
-  const anchoredConfigExists = existsSync(configPath);
-  const resolvedTier = loadConfig(configPath).tier;
-  const configuredTier = process.env['MOSAIC_STORAGE_TIER'];
-  const databaseUrlDeterminesTier = envOnlyTier === 'standalone' && configuredTier !== 'standalone';
-  const recognizedTierDeterminesTier =
-    (configuredTier === 'federated' ||
-      configuredTier === 'standalone' ||
-      configuredTier === 'local') &&
-    configuredTier === envOnlyTier;
-
-  let source: BootSource;
-  if (anchoredConfigExists) {
-    source = 'mosaic.config.json';
-  } else if (databaseUrlDeterminesTier && databaseUrlSource !== 'default') {
-    source = databaseUrlSource;
-  } else if (recognizedTierDeterminesTier && tierSource !== 'default') {
-    source = tierSource;
-  } else {
-    source = 'default';
-  }
-
-  console.info(`[gateway env] storage tier=${resolvedTier} source=${source}`);
-}
-
-loadGatewayEnv();

apps/gateway/src/federation/__tests__/enrollment.service.spec.ts

@@ -245,21 +245,9 @@ describe('EnrollmentService.createToken', () => {
     const after = Date.now();
 
     const expiresMs = new Date(result.expiresAt).getTime();
-
-    // The property under test is CLAMPING: a 9999s request must come back as 900s.
-    // The gap between clamped and unclamped is 9_099_000 ms, so the tolerance below
-    // only has to exceed CI scheduling jitter — it does not need to be tight to keep
-    // the assertion discriminating. A 5s allowance consumes 0.05% of that margin and
-    // an unclamped result still misses by three orders of magnitude.
-    //
-    // It was 100ms and failed on a loaded agent at 900_106 — 6ms over (#1090). A
-    // wall-clock budget sized to a fast machine is a flake, not a tighter test.
-    const CI_JITTER_MS = 5_000;
-    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + CI_JITTER_MS);
+    // Should be at most 900s from now
+    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100);
     expect(expiresMs - after).toBeGreaterThanOrEqual(0);
-    // Explicitly pin the clamp itself, independent of any timing allowance:
-    // unclamped (9999s) would exceed this by ~9_099_000 ms.
-    expect(expiresMs - before).toBeLessThan(1_000_000);
   });
 });
 

apps/gateway/src/federation/federation.module.ts

@@ -5,8 +5,6 @@ import { EnrollmentController } from './enrollment.controller.js';
 import { EnrollmentService } from './enrollment.service.js';
 import { FederationController } from './federation.controller.js';
 import { CapabilitiesController } from './server/verbs/capabilities.controller.js';
-import { GetController } from './server/verbs/get.controller.js';
-import { FederationGetQueryService } from './server/verbs/get-query.service.js';
 import { GrantsService } from './grants.service.js';
 import { FederationClientService, QuerySourceService } from './client/index.js';
 import { FederationAuthGuard, FederationScopeService } from './server/index.js';
@@ -14,13 +12,7 @@ import { ListController } from './server/verbs/list.controller.js';
 import { FederationListQueryService } from './server/verbs/list-query.service.js';
 
 @Module({
-  controllers: [
-    EnrollmentController,
-    FederationController,
-    CapabilitiesController,
-    ListController,
-    GetController,
-  ],
+  controllers: [EnrollmentController, FederationController, CapabilitiesController, ListController],
   providers: [
     AdminGuard,
     CaService,
@@ -31,7 +23,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
   exports: [
     CaService,
@@ -42,7 +33,6 @@ import { FederationListQueryService } from './server/verbs/list-query.service.js
     FederationAuthGuard,
     FederationScopeService,
     FederationListQueryService,
-    FederationGetQueryService,
   ],
 })
 export class FederationModule {}

apps/gateway/src/federation/server/verbs/__tests__/get-query.service.spec.ts

@@ -1,348 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-  createPgliteDb,
-  missionTasks,
-  missions,
-  projects,
-  runPgliteMigrations,
-  teams,
-  users,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { FederationScopeQueryFilter } from '../../scope.service.js';
-import { FederationGetQueryService } from '../get-query.service.js';
-
-const CREDENTIAL_FILTER: FederationScopeQueryFilter = {
-  resource: 'credentials',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: [],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-const SUBJECT_USER_ID = 'fed-m3-06-subject';
-const OTHER_USER_ID = 'fed-m3-06-other';
-const TEAM_ID = '06000000-0000-4000-8000-000000000001';
-const UNAUTHORIZED_TEAM_ID = '06000000-0000-4000-8000-000000000002';
-const PERSONAL_PROJECT_ID = '06000000-0000-4000-8000-000000000101';
-const TEAM_PROJECT_ID = '06000000-0000-4000-8000-000000000102';
-const UNAUTHORIZED_PROJECT_ID = '06000000-0000-4000-8000-000000000103';
-const PERSONAL_MISSION_ID = '06000000-0000-4000-8000-000000000201';
-const TEAM_MISSION_ID = '06000000-0000-4000-8000-000000000202';
-const UNAUTHORIZED_MISSION_ID = '06000000-0000-4000-8000-000000000203';
-const SUBJECT_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000301';
-const OTHER_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000302';
-const SUBJECT_PERSONAL_NOTE_ID = '06000000-0000-4000-8000-000000000303';
-const SUBJECT_UNAUTHORIZED_NOTE_ID = '06000000-0000-4000-8000-000000000304';
-
-let dbHandle: DbHandle | undefined;
-
-function makeService() {
-  return new FederationGetQueryService({} as Db);
-}
-
-function makeDbService() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-  return new FederationGetQueryService(dbHandle.db);
-}
-
-async function seedNotesFixture() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-
-  await dbHandle.db.insert(users).values([
-    {
-      id: SUBJECT_USER_ID,
-      name: 'Federation Subject',
-      email: `${SUBJECT_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-    {
-      id: OTHER_USER_ID,
-      name: 'Federation Other',
-      email: `${OTHER_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-  ]);
-
-  await dbHandle.db.insert(teams).values([
-    {
-      id: TEAM_ID,
-      name: 'FED-M3-06 Team',
-      slug: 'fed-m3-06-team',
-      ownerId: SUBJECT_USER_ID,
-      managerId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_TEAM_ID,
-      name: 'FED-M3-06 Unauthorized Team',
-      slug: 'fed-m3-06-unauthorized-team',
-      ownerId: OTHER_USER_ID,
-      managerId: OTHER_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(projects).values([
-    {
-      id: PERSONAL_PROJECT_ID,
-      name: 'FED-M3-06 Personal Project',
-      ownerId: SUBJECT_USER_ID,
-      ownerType: 'user',
-    },
-    {
-      id: TEAM_PROJECT_ID,
-      name: 'FED-M3-06 Team Project',
-      teamId: TEAM_ID,
-      ownerType: 'team',
-    },
-    {
-      id: UNAUTHORIZED_PROJECT_ID,
-      name: 'FED-M3-06 Unauthorized Project',
-      teamId: UNAUTHORIZED_TEAM_ID,
-      ownerType: 'team',
-    },
-  ]);
-
-  await dbHandle.db.insert(missions).values([
-    {
-      id: PERSONAL_MISSION_ID,
-      name: 'FED-M3-06 Personal Mission',
-      projectId: PERSONAL_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: TEAM_MISSION_ID,
-      name: 'FED-M3-06 Team Mission',
-      projectId: TEAM_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_MISSION_ID,
-      name: 'FED-M3-06 Unauthorized Mission',
-      projectId: UNAUTHORIZED_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(missionTasks).values([
-    {
-      id: SUBJECT_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on team mission',
-      createdAt: new Date('2026-06-24T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T03:00:00.000Z'),
-    },
-    {
-      id: OTHER_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: OTHER_USER_ID,
-      notes: 'other user note on team mission',
-      createdAt: new Date('2026-06-24T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T02:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_PERSONAL_NOTE_ID,
-      missionId: PERSONAL_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on personal mission',
-      createdAt: new Date('2026-06-24T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T01:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      missionId: UNAUTHORIZED_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note outside grant-visible missions',
-      createdAt: new Date('2026-06-24T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T04:00:00.000Z'),
-    },
-  ]);
-}
-
-describe('FederationGetQueryService', () => {
-  beforeAll(async () => {
-    dbHandle = createPgliteDb(`memory://fed-m3-06-get-${Date.now()}`);
-    await runPgliteMigrations(dbHandle);
-    await seedNotesFixture();
-  });
-
-  afterAll(async () => {
-    await dbHandle?.close();
-    dbHandle = undefined;
-  });
-
-  it('denies sensitive resources in native RBAC for M3 get reads', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'credentials',
-      }),
-    ).resolves.toMatchObject({
-      allowed: false,
-      reason: 'credentials federation get access is not implemented in M3',
-    });
-  });
-
-  it('allows personal memory reads without requiring team lookup', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'memory',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-  });
-
-  it('uses subject team membership as the native RBAC upper bound for task and note reads', async () => {
-    const service = makeService();
-    const listSubjectTeamIds = vi.fn().mockResolvedValue(['team-1', 'team-2']);
-    (
-      service as unknown as {
-        listSubjectTeamIds: (subjectUserId: string) => Promise<string[]>;
-      }
-    ).listSubjectTeamIds = listSubjectTeamIds;
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'tasks',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-    });
-    expect(listSubjectTeamIds).toHaveBeenCalledWith('user-1');
-  });
-
-  it('does not query storage for sensitive get resources even if scope allowed them', async () => {
-    const service = makeService();
-
-    await expect(service.get({ filter: CREDENTIAL_FILTER, id: 'cred-1' })).resolves.toEqual({
-      status: 'denied',
-      reason: 'credentials federation get is not implemented',
-    });
-  });
-
-  it('fails closed for unsupported resources instead of returning undefined', async () => {
-    const service = makeService();
-
-    await expect(
-      service.get({
-        filter: {
-          ...CREDENTIAL_FILTER,
-          resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-        },
-        id: 'row-1',
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Unsupported federation get resource: unknown-resource',
-    });
-  });
-
-  it('does not leak another user mission task note through team-scoped get reads', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: OTHER_TEAM_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('does not return subject notes from missions outside the grant-visible project set', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: true,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('returns a subject note only when subject ownership and authorized mission intersect', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_TEAM_NOTE_ID,
-      }),
-    ).resolves.toMatchObject({
-      status: 'found',
-      item: {
-        id: SUBJECT_TEAM_NOTE_ID,
-        missionId: TEAM_MISSION_ID,
-        content: 'subject note on team mission',
-      },
-    });
-  });
-
-  it('does not return subject personal notes when includePersonal is false', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_PERSONAL_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-});

apps/gateway/src/federation/server/verbs/__tests__/get.controller.spec.ts

@@ -1,207 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import type {
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from '../../scope.service.js';
-import { GetController } from '../get.controller.js';
-import type { FederationGetQueryResult } from '../get-query.service.js';
-
-const FEDERATION_CONTEXT = {
-  grantId: 'grant-1',
-  peerId: 'peer-1',
-  subjectUserId: 'user-1',
-  scope: { resources: ['tasks'], max_rows_per_query: 25 },
-};
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: ['team-1'],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-function makeRequest(): FastifyRequest {
-  return { federationContext: FEDERATION_CONTEXT } as unknown as FastifyRequest;
-}
-
-function allowedScope(
-  filter: FederationScopeQueryFilter = TASK_FILTER,
-): FederationScopeEvaluationResult {
-  return { allowed: true, filter };
-}
-
-function makeController(opts?: {
-  scopeResult?: FederationScopeEvaluationResult;
-  queryResult?: FederationGetQueryResult;
-}) {
-  const scope = {
-    evaluateAccess: vi.fn().mockResolvedValue(opts?.scopeResult ?? allowedScope()),
-  };
-  const query = {
-    evaluateReadAccess: vi.fn(),
-    get: vi.fn().mockResolvedValue(
-      opts?.queryResult ?? {
-        status: 'found',
-        item: {
-          id: 'task-1',
-          title: 'Federated task',
-          createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        },
-      },
-    ),
-  };
-
-  return {
-    controller: new GetController(scope as never, query as never),
-    scope,
-    query,
-  };
-}
-
-describe('GetController', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('declares POST /api/federation/v1/get/:resource/:id protected only by FederationAuthGuard', () => {
-    expect(Reflect.getMetadata('path', GetController)).toBe('api/federation/v1/get');
-    expect(Reflect.getMetadata('path', GetController.prototype.get)).toBe(':resource/:id');
-    expect(Reflect.getMetadata('method', GetController.prototype.get)).toBe(RequestMethod.POST);
-    expect(Reflect.getMetadata('__guards__', GetController)).toEqual([FederationAuthGuard]);
-  });
-
-  it('runs AuthGuard context through ScopeService and returns one local-source tagged row', async () => {
-    const { controller, scope, query } = makeController();
-
-    const response = await controller.get('tasks', 'task-1', makeRequest());
-
-    expect(scope.evaluateAccess).toHaveBeenCalledWith({
-      context: FEDERATION_CONTEXT,
-      resource: 'tasks',
-      requestedLimit: 1,
-      nativeRbac: query,
-    });
-    expect(query.get).toHaveBeenCalledWith({ filter: TASK_FILTER, id: 'task-1' });
-    expect(response).toEqual({
-      item: {
-        id: 'task-1',
-        title: 'Federated task',
-        createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        _source: 'local',
-      },
-    });
-  });
-
-  it('returns a federation error envelope when auth guard context is missing', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(
-      controller.get('tasks', 'task-1', {} as unknown as FastifyRequest),
-    ).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'unauthorized',
-          message: 'Federation context missing',
-        },
-      },
-      status: 401,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns a federation error envelope when scope evaluation denies access', async () => {
-    const { controller, query } = makeController({
-      scopeResult: {
-        allowed: false,
-        deny: {
-          code: 'resource_excluded',
-          stage: 'resource_exclusion',
-          statusCode: 403,
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-          grantId: 'grant-1',
-          peerId: 'peer-1',
-          subjectUserId: 'user-1',
-          resource: 'credentials',
-        },
-      },
-    });
-
-    await expect(controller.get('credentials', 'cred-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-        },
-      },
-      status: 403,
-    });
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns 404 when the scoped query layer cannot find the resource id', async () => {
-    const { controller } = makeController({ queryResult: { status: 'not_found' } });
-
-    await expect(controller.get('tasks', 'missing-task', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'not_found' } },
-      status: 404,
-    });
-  });
-
-  it('returns 403 when the resource exists outside the RBAC/scope intersection', async () => {
-    const { controller } = makeController({
-      queryResult: { status: 'denied', reason: 'Task is outside the federated scope' },
-    });
-
-    await expect(controller.get('tasks', 'task-2', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Task is outside the federated scope',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('fails closed when the query layer denies an unsupported resource', async () => {
-    const unsupportedFilter: FederationScopeQueryFilter = {
-      ...TASK_FILTER,
-      resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-    };
-    const { controller } = makeController({
-      scopeResult: allowedScope(unsupportedFilter),
-      queryResult: {
-        status: 'denied',
-        reason: 'Unsupported federation get resource: unknown-resource',
-      },
-    });
-
-    await expect(controller.get('unknown-resource', 'row-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Unsupported federation get resource: unknown-resource',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('rejects empty ids before evaluating scope', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(controller.get('tasks', '   ', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/federation/server/verbs/get-query.service.ts

@@ -1,311 +0,0 @@
-/**
- * Federation get query layer (FED-M3-06).
- *
- * Read-only DB adapter used by GetController after FederationAuthGuard and
- * FederationScopeService have established the subject user, allowed resource,
- * native-RBAC intersection, and row cap. Audit writes are intentionally
- * deferred to M4.
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  eq,
-  inArray,
-  insights,
-  or,
-  missionTasks,
-  missions,
-  preferences,
-  projects,
-  tasks,
-  teamMembers,
-  type Db,
-} from '@mosaicstack/db';
-import { DB } from '../../../database/database.module.js';
-import type {
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeQueryFilter,
-} from '../scope.service.js';
-
-export interface FederationGetQueryRequest {
-  readonly filter: FederationScopeQueryFilter;
-  readonly id: string;
-}
-
-export interface FederationGetQueryFoundResult<T extends object = Record<string, unknown>> {
-  readonly status: 'found';
-  readonly item: T;
-}
-
-export interface FederationGetQueryNotFoundResult {
-  readonly status: 'not_found';
-}
-
-export interface FederationGetQueryDeniedResult {
-  readonly status: 'denied';
-  readonly reason: string;
-}
-
-export type FederationGetQueryResult<T extends object = Record<string, unknown>> =
-  | FederationGetQueryFoundResult<T>
-  | FederationGetQueryNotFoundResult
-  | FederationGetQueryDeniedResult;
-
-type RowObject = Record<string, unknown>;
-
-function firstRow<T>(rows: T[]): T | undefined {
-  return rows[0];
-}
-
-function rowBelongsToAccessibleProjectOrMission(
-  row: { projectId?: string | null; missionId?: string | null },
-  projectIds: readonly string[],
-  missionIds: readonly string[],
-): boolean {
-  return (
-    (typeof row.projectId === 'string' && projectIds.includes(row.projectId)) ||
-    (typeof row.missionId === 'string' && missionIds.includes(row.missionId))
-  );
-}
-
-@Injectable()
-export class FederationGetQueryService implements FederationNativeRbacEvaluator {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async evaluateReadAccess(
-    request: FederationNativeRbacRequest,
-  ): Promise<FederationNativeRbacResult> {
-    if (request.resource === 'credentials' || request.resource === 'api_keys') {
-      return {
-        allowed: false,
-        reason: `${request.resource} federation get access is not implemented in M3`,
-        details: { resource: request.resource },
-      };
-    }
-
-    if (request.resource === 'memory') {
-      return { allowed: true, access: { includePersonal: true, teamIds: [] } };
-    }
-
-    const teamIds = await this.listSubjectTeamIds(request.subjectUserId);
-    return { allowed: true, access: { includePersonal: true, teamIds } };
-  }
-
-  async get<T extends RowObject = RowObject>(
-    request: FederationGetQueryRequest,
-  ): Promise<FederationGetQueryResult<T>> {
-    return this.getByResource(request.filter, request.id) as Promise<FederationGetQueryResult<T>>;
-  }
-
-  private async getByResource(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    switch (filter.resource) {
-      case 'tasks':
-        return this.getTask(filter, id);
-      case 'notes':
-        return this.getNote(filter, id);
-      case 'memory':
-        return this.getMemory(filter, id);
-      case 'credentials':
-      case 'api_keys':
-        return { status: 'denied', reason: `${filter.resource} federation get is not implemented` };
-      default:
-        return {
-          status: 'denied',
-          reason: `Unsupported federation get resource: ${String(filter.resource)}`,
-        };
-    }
-  }
-
-  private async listSubjectTeamIds(subjectUserId: string): Promise<string[]> {
-    const rows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, subjectUserId));
-
-    return rows.map((row) => row.teamId);
-  }
-
-  private async listAccessibleProjectIds(filter: FederationScopeQueryFilter): Promise<string[]> {
-    const clauses = [];
-    if (filter.includePersonal) {
-      clauses.push(and(eq(projects.ownerType, 'user'), eq(projects.ownerId, filter.subjectUserId)));
-    }
-    if (filter.teamIds.length > 0) {
-      // Project team ownership follows TeamsService.canAccessProject: team-owned
-      // rows are authorized through projects.teamId, while ownerId remains the
-      // user who created/bootstrapped the project.
-      clauses.push(
-        and(eq(projects.ownerType, 'team'), inArray(projects.teamId, [...filter.teamIds])),
-      );
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: projects.id })
-      .from(projects)
-      .where(clauses.length === 1 ? clauses[0] : or(...clauses));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listMissionIds(projectIds: readonly string[]): Promise<string[]> {
-    if (projectIds.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: missions.id })
-      .from(missions)
-      .where(inArray(missions.projectId, [...projectIds]));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async getTask(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: tasks.id,
-          title: tasks.title,
-          description: tasks.description,
-          status: tasks.status,
-          priority: tasks.priority,
-          projectId: tasks.projectId,
-          missionId: tasks.missionId,
-          assignee: tasks.assignee,
-          tags: tasks.tags,
-          dueDate: tasks.dueDate,
-          metadata: tasks.metadata,
-          createdAt: tasks.createdAt,
-          updatedAt: tasks.updatedAt,
-        })
-        .from(tasks)
-        .where(eq(tasks.id, id))
-        .limit(1),
-    );
-
-    if (!row) {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-    if (!rowBelongsToAccessibleProjectOrMission(row, projectIds, missionIds)) {
-      return { status: 'denied', reason: 'Task is outside the federated scope' };
-    }
-
-    return { status: 'found', item: row as RowObject };
-  }
-
-  private async getNote(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: missionTasks.id,
-          missionId: missionTasks.missionId,
-          taskId: missionTasks.taskId,
-          userId: missionTasks.userId,
-          status: missionTasks.status,
-          content: missionTasks.notes,
-          createdAt: missionTasks.createdAt,
-          updatedAt: missionTasks.updatedAt,
-        })
-        .from(missionTasks)
-        .where(eq(missionTasks.id, id))
-        .limit(1),
-    );
-
-    if (!row || row.content === null || row.content === '') {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-
-    // mission_tasks rows are user-scoped even when the mission belongs to a team.
-    // Scope-visible missions must intersect with subject ownership; team scope
-    // narrows mission IDs but never widens note reads to another user's rows.
-    if (row.userId !== filter.subjectUserId || !missionIds.includes(row.missionId)) {
-      return { status: 'denied', reason: 'Note is outside the federated scope' };
-    }
-
-    const item = { ...row } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-
-  private async getMemory(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const [insightRow, preferenceRow] = await Promise.all([
-      this.db
-        .select({
-          id: insights.id,
-          userId: insights.userId,
-          kind: insights.source,
-          content: insights.content,
-          category: insights.category,
-          relevanceScore: insights.relevanceScore,
-          metadata: insights.metadata,
-          createdAt: insights.createdAt,
-          updatedAt: insights.updatedAt,
-        })
-        .from(insights)
-        .where(eq(insights.id, id))
-        .limit(1)
-        .then(firstRow),
-      this.db
-        .select({
-          id: preferences.id,
-          userId: preferences.userId,
-          kind: preferences.category,
-          key: preferences.key,
-          value: preferences.value,
-          source: preferences.source,
-          mutable: preferences.mutable,
-          createdAt: preferences.createdAt,
-          updatedAt: preferences.updatedAt,
-        })
-        .from(preferences)
-        .where(eq(preferences.id, id))
-        .limit(1)
-        .then(firstRow),
-    ]);
-
-    const candidates = [insightRow, preferenceRow].filter(
-      (row): row is NonNullable<typeof row> => row !== undefined,
-    );
-    if (candidates.length === 0) {
-      return { status: 'not_found' };
-    }
-
-    if (!filter.includePersonal) {
-      return { status: 'denied', reason: 'Memory personal rows are outside the federated scope' };
-    }
-
-    const accessible = candidates.find((row) => row.userId === filter.subjectUserId);
-    if (!accessible) {
-      return { status: 'denied', reason: 'Memory row belongs to another subject user' };
-    }
-
-    const item = { ...accessible } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-}

apps/gateway/src/federation/server/verbs/get.controller.ts

@@ -1,100 +0,0 @@
-/**
- * Federation get verb (FED-M3-06).
- *
- * POST /api/federation/v1/get/:resource/:id
- *
- * Pipeline: FederationAuthGuard attaches the active grant context, then
- * FederationScopeService enforces grant scope + native RBAC intersection, then
- * the read-only query layer fetches one local row and tags it with `_source`.
- * Read audit-log writes are deferred to M4; this controller does not persist
- * request or response bodies.
- */
-
-import { Controller, HttpException, Inject, Param, Post, Req, UseGuards } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FederationInvalidRequestError,
-  FederationNotFoundError,
-  FederationScopeViolationError,
-  FederationUnauthorizedError,
-  SOURCE_LOCAL,
-  type FederationGetResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-import { FederationScopeService } from '../scope.service.js';
-import { FederationGetQueryService } from './get-query.service.js';
-
-type FederatedRow = Record<string, unknown> & SourceTag;
-
-function scopeDenyToHttpException(deny: {
-  readonly statusCode: 400 | 403;
-  readonly message: string;
-}): HttpException {
-  const ErrorClass =
-    deny.statusCode === 400 ? FederationInvalidRequestError : FederationScopeViolationError;
-  return new HttpException(new ErrorClass(deny.message, deny).toEnvelope(), deny.statusCode);
-}
-
-@Controller('api/federation/v1/get')
-@UseGuards(FederationAuthGuard)
-export class GetController {
-  constructor(
-    @Inject(FederationScopeService) private readonly scope: FederationScopeService,
-    @Inject(FederationGetQueryService) private readonly query: FederationGetQueryService,
-  ) {}
-
-  @Post(':resource/:id')
-  async get(
-    @Param('resource') resource: string,
-    @Param('id') id: string,
-    @Req() request: FastifyRequest,
-  ): Promise<FederationGetResponse<FederatedRow>> {
-    if (!request.federationContext) {
-      throw new HttpException(
-        new FederationUnauthorizedError('Federation context missing').toEnvelope(),
-        401,
-      );
-    }
-    if (id.trim().length === 0) {
-      throw new HttpException(
-        new FederationInvalidRequestError('Federation get id must not be empty').toEnvelope(),
-        400,
-      );
-    }
-
-    const scopeResult = await this.scope.evaluateAccess({
-      context: request.federationContext,
-      resource,
-      requestedLimit: 1,
-      nativeRbac: this.query,
-    });
-
-    if (!scopeResult.allowed) {
-      throw scopeDenyToHttpException(scopeResult.deny);
-    }
-
-    const result = await this.query.get({ filter: scopeResult.filter, id });
-    if (result.status === 'not_found') {
-      throw new HttpException(
-        new FederationNotFoundError('Requested federation resource was not found').toEnvelope(),
-        404,
-      );
-    }
-    if (result.status === 'denied') {
-      throw new HttpException(
-        new FederationScopeViolationError(result.reason, {
-          resource,
-          id,
-          grantId: request.federationContext.grantId,
-          peerId: request.federationContext.peerId,
-          subjectUserId: request.federationContext.subjectUserId,
-        }).toEnvelope(),
-        403,
-      );
-    }
-
-    return { item: { ...result.item, _source: SOURCE_LOCAL } };
-  }
-}

apps/gateway/src/gc/gc.module.ts

@@ -1,7 +1,5 @@
-import { Module, type OnApplicationShutdown, Inject, Optional } from '@nestjs/common';
+import { Module, type OnApplicationShutdown, Inject } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { SessionGCService } from './session-gc.service.js';
 import { REDIS } from './gc.tokens.js';
 
@@ -11,17 +9,13 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   providers: [
     {
       provide: GC_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection entirely.
-        // The Valkey GC sweep is a no-op on Local (no session keys stored there).
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
         return createQueue();
       },
-      inject: [MOSAIC_CONFIG],
     },
     {
       provide: REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
       inject: [GC_QUEUE_HANDLE],
     },
     SessionGCService,
@@ -29,13 +23,9 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
   exports: [SessionGCService],
 })
 export class GCModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(GC_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(GC_QUEUE_HANDLE) private readonly handle: QueueHandle) {}
 
   async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
   }
 }

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -119,19 +119,6 @@ describe('SessionGCService', () => {
     ).resolves.toEqual({ allowed: true });
   });
 
-  it('collect() skips Valkey but still demotes only the requested session on local tier', async () => {
-    const localService = new SessionGCService(null, mockLogService as unknown as LogService);
-
-    const result = await localService.collect('local-session');
-
-    expect(result.sessionId).toBe('local-session');
-    expect(result.cleaned.valkeyKeys).toBeUndefined();
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
-      'local-session',
-      expect.any(Date),
-    );
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -21,10 +21,7 @@ function escapeRedisGlobLiteral(value: string): string {
 @Injectable()
 export class SessionGCService {
   constructor(
-    // Local tier has no Redis; lifecycle cleanup still demotes this session's logs.
-    @Optional()
-    @Inject(REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
@@ -32,10 +29,8 @@ export class SessionGCService {
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
    * duration, which can cause latency spikes under production key volumes.
-   * Returns an empty population on the Local tier where Redis is disabled.
    */
   private async scanKeys(pattern: string): Promise<string[]> {
-    if (!this.redis) return [];
     const collected: string[] = [];
     let cursor = '0';
     do {
@@ -52,14 +47,12 @@ export class SessionGCService {
   async collect(sessionId: string): Promise<GCResult> {
     const result: GCResult = { sessionId, cleaned: {} };
 
-    // 1. Valkey: delete all session-scoped keys (skipped on Local tier).
-    if (this.redis) {
-      const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
-      const valkeyKeys = await this.scanKeys(pattern);
-      if (valkeyKeys.length > 0) {
-        await this.redis.del(...valkeyKeys);
-        result.cleaned.valkeyKeys = valkeyKeys.length;
-      }
+    // 1. Valkey: delete all session-scoped keys
+    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
+    const valkeyKeys = await this.scanKeys(pattern);
+    if (valkeyKeys.length > 0) {
+      await this.redis.del(...valkeyKeys);
+      result.cleaned.valkeyKeys = valkeyKeys.length;
     }
 
     // 2. PG: demote hot-tier agent logs for this session only.

apps/gateway/src/harness/harness-selection.controller.spec.ts

@@ -1,164 +0,0 @@
-import 'reflect-metadata';
-import {
-  type CanActivate,
-  type ExecutionContext,
-  type INestApplication,
-  ValidationPipe,
-} from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { Test } from '@nestjs/testing';
-import request from 'supertest';
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { HarnessRegistry } from './harness.registry.js';
-import { HARNESS_REGISTRY } from './harness.tokens.js';
-import { HarnessSelectionRepository } from './harness-selection.repository.js';
-import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
-// Import the REAL module (not a hand-listed controllers+mocks list) so an
-// unresolved provider fails at app.init() — the #1145-class DI-boot guard.
-import { HarnessModule } from './harness.module.js';
-
-// A known-available tuple from the fake adapter's default catalog.
-const VALID = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-mini' };
-// A tuple whose provider/model are not in any catalog.
-const UNKNOWN = { harnessId: 'fake', providerId: 'ghost-provider', modelId: 'ghost-model' };
-// A tuple that is known in the catalog but flagged unavailable.
-const UNAVAILABLE = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-legacy' };
-
-const authGuard: CanActivate = {
-  canActivate(context: ExecutionContext): boolean {
-    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
-    requestContext.user = { id: 'user-1' };
-    return true;
-  },
-};
-
-function registryWithFake(): HarnessRegistry {
-  const registry = new HarnessRegistry();
-  registry.register(new FakeHarnessAdapter({ id: 'fake' }));
-  return registry;
-}
-
-describe('Harness selection HTTP surface', () => {
-  let app: INestApplication;
-  let repository: HarnessSelectionRepository;
-
-  beforeAll(async () => {
-    const moduleRef = await Test.createTestingModule({
-      imports: [HarnessModule],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue(authGuard)
-      .overrideProvider(HARNESS_REGISTRY)
-      .useValue(registryWithFake())
-      .compile();
-
-    // Real in-memory repository from the module graph — proves the module wired it.
-    repository = moduleRef.get(HarnessSelectionRepository);
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    app.useGlobalPipes(
-      new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
-    );
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  beforeEach(() => {
-    // Reset owner-scoped state between tests via the public API surface.
-    repository.set({ userId: 'user-1', tenantId: 'user-1' }, VALID);
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it('GET selection is server-scoped and ignores caller-supplied scope in the query', async () => {
-    const response = await request(app.getHttpServer())
-      .get('/api/chat/preferences/selection')
-      .query({ userId: 'attacker', tenantId: 'attacker-tenant', seatId: 'attacker-seat' });
-
-    expect(response.status).toBe(200);
-    // The returned selection is user-1's (guard-derived scope), not the query's.
-    expect(response.body.selection).toEqual(VALID);
-  });
-
-  it('PUT with a valid structured tuple persists and round-trips via GET', async () => {
-    const next = { harnessId: 'fake', providerId: 'fake-openai', modelId: 'fake-pro' };
-
-    const put = await request(app.getHttpServer())
-      .put('/api/chat/preferences/selection')
-      .send(next)
-      .set('Content-Type', 'application/json');
-    expect(put.status).toBe(200);
-    expect(put.body.selection).toEqual(next);
-
-    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
-    expect(get.status).toBe(200);
-    expect(get.body.selection).toEqual(next);
-  });
-
-  it('PUT with FREE TEXT is rejected 400 and does not mutate the stored selection', async () => {
-    const response = await request(app.getHttpServer())
-      .put('/api/chat/preferences/selection')
-      .send({ selection: 'gpt-4o' })
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(400);
-
-    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
-    expect(get.body.selection).toEqual(VALID);
-  });
-
-  it.each([
-    ['seatId', { ...VALID, seatId: 'attacker-seat' }],
-    ['tenantId', { ...VALID, tenantId: 'attacker-tenant' }],
-    ['userId', { ...VALID, userId: 'attacker' }],
-    ['nativeSessionPath', { ...VALID, nativeSessionPath: '/var/native/x.jsonl' }],
-    ['executable', { ...VALID, executable: '/usr/bin/evil' }],
-    ['home', { ...VALID, home: '/home/attacker' }],
-    ['cwd', { ...VALID, cwd: '/tmp/attacker' }],
-  ])(
-    'PUT with an extra authority-bearing field (%s) is rejected 400 and does not mutate stored selection',
-    async (_name, body) => {
-      const response = await request(app.getHttpServer())
-        .put('/api/chat/preferences/selection')
-        .send(body)
-        .set('Content-Type', 'application/json');
-
-      expect(response.status).toBe(400);
-
-      const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
-      expect(get.body.selection).toEqual(VALID);
-    },
-  );
-
-  it('PUT with an UNKNOWN tuple returns selection_invalid, unchanged and echoed unchanged (no fallback)', async () => {
-    const response = await request(app.getHttpServer())
-      .put('/api/chat/preferences/selection')
-      .send(UNKNOWN)
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(422);
-    expect(response.body.code).toBe('selection_invalid');
-    // Echoed back unchanged: no first-row / first-provider substitution.
-    expect(response.body.selection).toEqual(UNKNOWN);
-
-    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
-    expect(get.body.selection).toEqual(VALID);
-  });
-
-  it('PUT with a KNOWN-but-UNAVAILABLE tuple returns model_unavailable, unchanged (distinct from selection_invalid)', async () => {
-    const response = await request(app.getHttpServer())
-      .put('/api/chat/preferences/selection')
-      .send(UNAVAILABLE)
-      .set('Content-Type', 'application/json');
-
-    expect(response.status).toBe(422);
-    expect(response.body.code).toBe('model_unavailable');
-    expect(response.body.selection).toEqual(UNAVAILABLE);
-
-    const get = await request(app.getHttpServer()).get('/api/chat/preferences/selection');
-    expect(get.body.selection).toEqual(VALID);
-  });
-});

apps/gateway/src/harness/harness-selection.controller.ts

@@ -1,46 +0,0 @@
-import { Body, Controller, Get, HttpException, HttpStatus, Put, UseGuards } from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { HarnessOperationError } from './harness.registry.js';
-import { HarnessSelectionService } from './harness-selection.service.js';
-import { HarnessSelectionInputDto, type SelectionResponseDto } from './harness.dto.js';
-
-/**
- * Chat-preferences selection surface. The scope is ALWAYS derived on the server
- * from the authenticated user (`scopeFromUser(CurrentUser)`); the request body and
- * query string can never name another user, tenant, or seat. A typed selection
- * failure (unknown tuple → `selection_invalid`, known-but-unavailable →
- * `model_unavailable`) is returned as 422 with the requested tuple echoed back
- * unchanged, and never mutates the stored selection.
- */
-@Controller('api/chat/preferences/selection')
-@UseGuards(AuthGuard)
-export class HarnessSelectionController {
-  constructor(private readonly selection: HarnessSelectionService) {}
-
-  @Get()
-  get(@CurrentUser() user: AuthenticatedUserLike): SelectionResponseDto {
-    return { selection: this.selection.getSelection(scopeFromUser(user)) };
-  }
-
-  @Put()
-  async put(
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Body() dto: HarnessSelectionInputDto,
-  ): Promise<SelectionResponseDto> {
-    try {
-      const stored = await this.selection.setSelection(scopeFromUser(user), {
-        harnessId: dto.harnessId,
-        providerId: dto.providerId,
-        modelId: dto.modelId,
-      });
-      return { selection: stored };
-    } catch (error) {
-      if (error instanceof HarnessOperationError) {
-        throw new HttpException(error.dto, HttpStatus.UNPROCESSABLE_ENTITY);
-      }
-      throw error;
-    }
-  }
-}

apps/gateway/src/harness/harness-selection.service.ts

@@ -1,90 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import type { HarnessSelection } from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import {
-  HarnessAdapterUnavailableError,
-  HarnessRegistry,
-  operationError,
-} from './harness.registry.js';
-import { HARNESS_REGISTRY } from './harness.tokens.js';
-import { readContextFromScope } from './harness.dto.js';
-import { HarnessSelectionRepository } from './harness-selection.repository.js';
-
-/**
- * Selection logic for the Slice-Zero chat-preferences surface. It validates the
- * requested harness/provider/model tuple against the live catalog with NO
- * fallback substitution, then persists it owner-scoped. The stored selection is
- * only ever mutated when the tuple is valid AND available.
- */
-@Injectable()
-export class HarnessSelectionService {
-  constructor(
-    @Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry,
-    private readonly repository: HarnessSelectionRepository,
-  ) {}
-
-  getSelection(scope: ActorTenantScope): HarnessSelection | null {
-    return this.repository.get(scope);
-  }
-
-  async setSelection(
-    scope: ActorTenantScope,
-    selection: HarnessSelection,
-  ): Promise<HarnessSelection> {
-    // Throws HarnessOperationError (selection_invalid / model_unavailable) with the
-    // requested tuple echoed back unchanged. The store is untouched on any throw.
-    await this.assertSelectionAvailable(scope, selection);
-    return this.repository.set(scope, selection);
-  }
-
-  private async assertSelectionAvailable(
-    scope: ActorTenantScope,
-    selection: HarnessSelection,
-  ): Promise<void> {
-    const correlationId = randomUUID();
-
-    let adapter;
-    try {
-      adapter = this.registry.get(selection.harnessId);
-    } catch (error) {
-      if (error instanceof HarnessAdapterUnavailableError) {
-        // An unknown harness makes the whole tuple invalid — no fallback adapter.
-        throw operationError(
-          'selection_invalid',
-          'The requested harness/provider/model tuple is not in the catalog.',
-          selection,
-          correlationId,
-        );
-      }
-      throw error;
-    }
-
-    const catalog = await adapter.catalog(readContextFromScope(scope));
-    const entry = catalog.models.find(
-      (candidate) =>
-        candidate.harnessId === selection.harnessId &&
-        candidate.providerId === selection.providerId &&
-        candidate.modelId === selection.modelId,
-    );
-
-    if (!entry) {
-      // No first-row / first-provider fallback: reject the requested tuple unchanged.
-      throw operationError(
-        'selection_invalid',
-        'The requested harness/provider/model tuple is not in the catalog.',
-        selection,
-        correlationId,
-      );
-    }
-    if (entry.availability === 'unavailable') {
-      throw operationError(
-        'model_unavailable',
-        'The requested model is currently unavailable.',
-        selection,
-        correlationId,
-        true,
-      );
-    }
-  }
-}

apps/gateway/src/harness/harness.controller.spec.ts

@@ -1,138 +0,0 @@
-import 'reflect-metadata';
-import {
-  type CanActivate,
-  type ExecutionContext,
-  type INestApplication,
-  ValidationPipe,
-} from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { Test } from '@nestjs/testing';
-import request from 'supertest';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { HarnessRegistry } from './harness.registry.js';
-import { HARNESS_REGISTRY } from './harness.tokens.js';
-import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
-// The real module under test — importing it (not a hand-listed controllers/mocks
-// list) is what makes an unresolved provider fail loudly at app.init() (#1145 guard).
-import { HarnessModule } from './harness.module.js';
-
-// Fields that must NEVER surface on a browser-facing catalog/list response.
-const FORBIDDEN_KEYS = [
-  'executable',
-  'executablePath',
-  'home',
-  'homeDir',
-  'cwd',
-  'workingDir',
-  'workingDirectory',
-  'nativeSessionPath',
-  'sessionPath',
-  'env',
-  'secret',
-  'secrets',
-  'token',
-  'apiKey',
-];
-
-function assertNoForbiddenLeak(payload: unknown): void {
-  const serialized = JSON.stringify(payload).toLowerCase();
-  for (const key of FORBIDDEN_KEYS) {
-    expect(serialized).not.toContain(key.toLowerCase());
-  }
-}
-
-const authGuard: CanActivate = {
-  canActivate(context: ExecutionContext): boolean {
-    const requestContext = context.switchToHttp().getRequest<{ user?: { id: string } }>();
-    requestContext.user = { id: 'user-1' };
-    return true;
-  },
-};
-
-function registryWithFake(): HarnessRegistry {
-  const registry = new HarnessRegistry();
-  registry.register(new FakeHarnessAdapter({ id: 'fake' }));
-  return registry;
-}
-
-describe('Harness catalog HTTP surface', () => {
-  let app: INestApplication;
-
-  beforeAll(async () => {
-    const moduleRef = await Test.createTestingModule({
-      imports: [HarnessModule],
-    })
-      .overrideGuard(AuthGuard)
-      .useValue(authGuard)
-      .overrideProvider(HARNESS_REGISTRY)
-      .useValue(registryWithFake())
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    app.useGlobalPipes(
-      new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
-    );
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it('boots the real HarnessModule so all providers resolve at app.init()', () => {
-    // If HarnessModule failed to resolve a provider, beforeAll's app.init() would
-    // have thrown and this suite would never reach here.
-    expect(app).toBeDefined();
-  });
-
-  it('GET /api/harnesses returns 200 with safe fields only', async () => {
-    const response = await request(app.getHttpServer()).get('/api/harnesses');
-
-    expect(response.status).toBe(200);
-    expect(Array.isArray(response.body)).toBe(true);
-    expect(response.body.length).toBeGreaterThan(0);
-    const summary = response.body[0];
-    expect(Object.keys(summary).sort()).toEqual(['capabilities', 'displayName', 'id']);
-    expect(summary.id).toBe('fake');
-    expect(typeof summary.displayName).toBe('string');
-    expect(Array.isArray(summary.capabilities)).toBe(true);
-    assertNoForbiddenLeak(response.body);
-  });
-
-  it('GET /api/harnesses/:harnessId/catalog returns 200 with safe catalog fields only', async () => {
-    const response = await request(app.getHttpServer()).get('/api/harnesses/fake/catalog');
-
-    expect(response.status).toBe(200);
-    expect(response.body.harnessId).toBe('fake');
-    expect(typeof response.body.version).toBe('string');
-    expect(typeof response.body.fingerprint).toBe('string');
-    expect(Array.isArray(response.body.models)).toBe(true);
-    expect(response.body.models.length).toBeGreaterThan(0);
-    const entry = response.body.models[0];
-    // Whitelisted catalog-entry fields only (no executables/paths/secrets).
-    expect(Object.keys(entry).sort()).toEqual(
-      [
-        'authState',
-        'availability',
-        'displayName',
-        'harnessId',
-        'inputTypes',
-        'modelId',
-        'providerId',
-        'reasoningCapability',
-      ].sort(),
-    );
-    assertNoForbiddenLeak(response.body);
-  });
-
-  it('GET catalog for an unknown harnessId returns a typed adapter_unavailable error, never a fallback catalog', async () => {
-    const response = await request(app.getHttpServer()).get('/api/harnesses/ghost-harness/catalog');
-
-    expect(response.status).toBe(404);
-    expect(response.body.code).toBe('adapter_unavailable');
-    // A fallback catalog would carry a models array; a typed error must not.
-    expect(response.body.models).toBeUndefined();
-  });
-});

apps/gateway/src/harness/harness.controller.ts

@@ -1,65 +0,0 @@
-import {
-  Controller,
-  Get,
-  HttpException,
-  HttpStatus,
-  Inject,
-  Param,
-  UseGuards,
-} from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { HarnessAdapterUnavailableError, HarnessRegistry } from './harness.registry.js';
-import { HARNESS_REGISTRY } from './harness.tokens.js';
-import {
-  readContextFromScope,
-  toHarnessSummary,
-  toSafeCatalog,
-  type HarnessCatalogDto,
-  type HarnessSummaryDto,
-} from './harness.dto.js';
-
-/**
- * Generic harness catalog surface. It exposes only harness-neutral, browser-safe
- * fields (identity, capabilities, provider/model catalog) — never executables,
- * native paths, home/cwd, env, or secrets. There is NO provider-probe route here;
- * `/api/providers` and `POST /api/providers/test` are intentionally out of scope.
- */
-@Controller('api/harnesses')
-@UseGuards(AuthGuard)
-export class HarnessController {
-  constructor(@Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry) {}
-
-  @Get()
-  async list(@CurrentUser() user: AuthenticatedUserLike): Promise<HarnessSummaryDto[]> {
-    const context = readContextFromScope(scopeFromUser(user));
-    const summaries: HarnessSummaryDto[] = [];
-    for (const adapter of this.registry.list()) {
-      summaries.push(toHarnessSummary(await adapter.describe(context)));
-    }
-    return summaries;
-  }
-
-  @Get(':harnessId/catalog')
-  async catalog(
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Param('harnessId') harnessId: string,
-  ): Promise<HarnessCatalogDto> {
-    const context = readContextFromScope(scopeFromUser(user));
-    let adapter;
-    try {
-      adapter = this.registry.get(harnessId);
-    } catch (error) {
-      if (error instanceof HarnessAdapterUnavailableError) {
-        // Typed failure — NEVER a fallback catalog for an unknown harness id.
-        throw new HttpException(
-          { code: error.code, message: error.message, harnessId },
-          HttpStatus.NOT_FOUND,
-        );
-      }
-      throw error;
-    }
-    return toSafeCatalog(await adapter.catalog(context));
-  }
-}

apps/gateway/src/harness/harness.dto.ts

@@ -1,116 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { IsNotEmpty, IsString } from 'class-validator';
-import type {
-  HarnessActorContext,
-  HarnessAuthState,
-  HarnessCapability,
-  HarnessCatalog,
-  HarnessCatalogEntry,
-  HarnessDescriptor,
-  HarnessInputType,
-  HarnessModelAvailability,
-  HarnessSelection,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-
-/**
- * Structured selection tuple accepted on `PUT /api/chat/preferences/selection`.
- *
- * The body is a STRUCTURED tuple (harness + provider + model), never a free-text
- * model string. With `ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })`
- * any extra property — including smuggled server-authority fields such as
- * `seatId`, `tenantId`, `userId`, `nativeSessionPath`, `executable`, `home`, `cwd` —
- * is rejected with 400. There is deliberately no field through which a caller can
- * name a scope; scope is derived on the server from the authenticated session.
- */
-export class HarnessSelectionInputDto {
-  @IsString()
-  @IsNotEmpty()
-  harnessId!: string;
-
-  @IsString()
-  @IsNotEmpty()
-  providerId!: string;
-
-  @IsString()
-  @IsNotEmpty()
-  modelId!: string;
-}
-
-/** Browser-safe harness summary — identity and capabilities only. */
-export interface HarnessSummaryDto {
-  readonly id: string;
-  readonly displayName: string;
-  readonly capabilities: readonly HarnessCapability[];
-}
-
-/** Browser-safe catalog entry — no executables, paths, secrets, or env. */
-export interface HarnessCatalogEntryDto {
-  readonly harnessId: string;
-  readonly providerId: string;
-  readonly modelId: string;
-  readonly displayName: string;
-  readonly reasoningCapability: boolean;
-  readonly inputTypes: readonly HarnessInputType[];
-  readonly authState: HarnessAuthState;
-  readonly availability: HarnessModelAvailability;
-}
-
-/** Browser-safe catalog envelope. */
-export interface HarnessCatalogDto {
-  readonly harnessId: string;
-  readonly version: string;
-  readonly fingerprint: string;
-  readonly models: readonly HarnessCatalogEntryDto[];
-}
-
-/** Response envelope for the caller's current selection (null when unset). */
-export interface SelectionResponseDto {
-  readonly selection: HarnessSelection | null;
-}
-
-/**
- * Derive a server-trusted {@link HarnessActorContext} for read operations from the
- * session-derived {@link ActorTenantScope}. All authority originates on the server;
- * nothing here is caller-supplied. A fresh correlation id is minted per call.
- */
-export function readContextFromScope(scope: ActorTenantScope): HarnessActorContext {
-  return {
-    actorId: scope.userId,
-    tenantId: scope.tenantId,
-    seatId: scope.userId,
-    correlationId: randomUUID(),
-  };
-}
-
-/** Project a descriptor onto the browser-safe summary shape (whitelist by construction). */
-export function toHarnessSummary(descriptor: HarnessDescriptor): HarnessSummaryDto {
-  return {
-    id: descriptor.id,
-    displayName: descriptor.displayName,
-    capabilities: [...descriptor.capabilities],
-  };
-}
-
-/** Project a catalog onto the browser-safe shape (whitelist by construction). */
-export function toSafeCatalog(catalog: HarnessCatalog): HarnessCatalogDto {
-  return {
-    harnessId: catalog.harnessId,
-    version: catalog.version,
-    fingerprint: catalog.fingerprint,
-    models: catalog.models.map(toSafeCatalogEntry),
-  };
-}
-
-function toSafeCatalogEntry(entry: HarnessCatalogEntry): HarnessCatalogEntryDto {
-  return {
-    harnessId: entry.harnessId,
-    providerId: entry.providerId,
-    modelId: entry.modelId,
-    displayName: entry.displayName,
-    reasoningCapability: entry.reasoningCapability,
-    inputTypes: [...entry.inputTypes],
-    authState: entry.authState,
-    availability: entry.availability,
-  };
-}

apps/gateway/src/harness/harness.module.ts

@@ -1,37 +0,0 @@
-import { Module } from '@nestjs/common';
-import { HarnessRegistry } from './harness.registry.js';
-import { HarnessService } from './harness.service.js';
-import {
-  HARNESS_CONVERSATION_SERVICE,
-  HARNESS_CONVERSATION_SERVICE_UNAVAILABLE,
-  HARNESS_REGISTRY,
-  HARNESS_SERVICE,
-} from './harness.tokens.js';
-import { HarnessController } from './harness.controller.js';
-import { HarnessSelectionController } from './harness-selection.controller.js';
-import { HarnessSelectionService } from './harness-selection.service.js';
-import { HarnessSelectionRepository } from './harness-selection.repository.js';
-
-/**
- * Wires the harness-neutral registry/service (Task Two) together with the
- * Slice-Zero catalog and selection HTTP surfaces (Task Three).
- *
- * The registry is provided empty here; real harness adapters are registered in a
- * later task. Because the controllers/services resolve their collaborators through
- * this real module graph, an unresolved provider fails loudly at `app.init()`.
- */
-@Module({
-  controllers: [HarnessController, HarnessSelectionController],
-  providers: [
-    { provide: HARNESS_REGISTRY, useFactory: () => new HarnessRegistry() },
-    { provide: HARNESS_SERVICE, useClass: HarnessService },
-    // Task Five: bind the conversation-service token to its explicit "not yet bound"
-    // sentinel. The pi-rpc router treats this as a hard, typed startup failure; Task 14
-    // replaces it with a real service. Exported so ChatModule's router can inject it.
-    { provide: HARNESS_CONVERSATION_SERVICE, useValue: HARNESS_CONVERSATION_SERVICE_UNAVAILABLE },
-    HarnessSelectionRepository,
-    HarnessSelectionService,
-  ],
-  exports: [HARNESS_REGISTRY, HARNESS_SERVICE, HARNESS_CONVERSATION_SERVICE],
-})
-export class HarnessModule {}

apps/gateway/src/harness/harness.registry.spec.ts

@@ -1,69 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import {
-  HarnessAdapterUnavailableError,
-  HarnessRegistrationError,
-  HarnessRegistry,
-} from './harness.registry.js';
-import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
-
-describe('HarnessRegistry', () => {
-  it('registers and looks up an adapter by harness id', () => {
-    const registry = new HarnessRegistry();
-    const adapter = new FakeHarnessAdapter({ id: 'fake' });
-
-    registry.register(adapter);
-
-    expect(registry.get('fake')).toBe(adapter);
-    expect(registry.has('fake')).toBe(true);
-    expect(registry.list().map((entry) => entry.id)).toEqual(['fake']);
-  });
-
-  it('rejects a blank adapter id', () => {
-    const registry = new HarnessRegistry();
-
-    let error: unknown;
-    try {
-      registry.register(new FakeHarnessAdapter({ id: '   ' }));
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessRegistrationError);
-    expect((error as HarnessRegistrationError).reason).toBe('blank_id');
-    expect(registry.list()).toEqual([]);
-  });
-
-  it('rejects a duplicate adapter id', () => {
-    const registry = new HarnessRegistry();
-    registry.register(new FakeHarnessAdapter({ id: 'fake' }));
-
-    let error: unknown;
-    try {
-      registry.register(new FakeHarnessAdapter({ id: 'fake' }));
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessRegistrationError);
-    expect((error as HarnessRegistrationError).reason).toBe('duplicate_id');
-    expect((error as HarnessRegistrationError).harnessId).toBe('fake');
-    // The original registration is untouched.
-    expect(registry.list()).toHaveLength(1);
-  });
-
-  it('returns adapter_unavailable for an unknown harness id', () => {
-    const registry = new HarnessRegistry();
-
-    let error: unknown;
-    try {
-      registry.get('missing');
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessAdapterUnavailableError);
-    expect((error as HarnessAdapterUnavailableError).code).toBe('adapter_unavailable');
-    expect((error as HarnessAdapterUnavailableError).harnessId).toBe('missing');
-    expect(registry.has('missing')).toBe(false);
-  });
-});

apps/gateway/src/harness/harness.registry.ts

@@ -1,100 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import type {
-  HarnessAdapter,
-  HarnessErrorCode,
-  HarnessErrorDto,
-  HarnessSelection,
-} from '@mosaicstack/types';
-
-/**
- * A typed harness operation failure that carries a fully-formed, browser-safe
- * {@link HarnessErrorDto}. The DTO's `selection` is always the exact requested
- * tuple — there is no field through which a substituted "effective" selection
- * could ever be reported.
- */
-export class HarnessOperationError extends Error {
-  readonly code: HarnessErrorCode;
-  readonly dto: HarnessErrorDto;
-
-  constructor(dto: HarnessErrorDto) {
-    super(dto.message);
-    this.name = 'HarnessOperationError';
-    this.code = dto.code;
-    this.dto = dto;
-  }
-}
-
-/** Build a {@link HarnessOperationError} that echoes the requested selection unchanged. */
-export function operationError(
-  code: HarnessErrorCode,
-  message: string,
-  selection: HarnessSelection,
-  correlationId: string,
-  retryable = false,
-): HarnessOperationError {
-  return new HarnessOperationError({ code, message, retryable, correlationId, selection });
-}
-
-/** Raised when an unknown harness id is looked up. Discriminated by `code`. */
-export class HarnessAdapterUnavailableError extends Error {
-  readonly code = 'adapter_unavailable' as const satisfies HarnessErrorCode;
-
-  constructor(readonly harnessId: string) {
-    super(`No harness adapter is registered for id "${harnessId}".`);
-    this.name = 'HarnessAdapterUnavailableError';
-  }
-}
-
-export type HarnessRegistrationFailure = 'blank_id' | 'duplicate_id';
-
-/** Raised when an adapter cannot be registered (blank or duplicate id). */
-export class HarnessRegistrationError extends Error {
-  constructor(
-    readonly reason: HarnessRegistrationFailure,
-    readonly harnessId: string,
-  ) {
-    super(
-      reason === 'blank_id'
-        ? 'A harness adapter id must be a non-empty string.'
-        : `A harness adapter is already registered for id "${harnessId}".`,
-    );
-    this.name = 'HarnessRegistrationError';
-  }
-}
-
-/**
- * Harness-neutral adapter registry. Adapters are keyed by their harness id.
- * Registration rejects blank and duplicate ids; lookup of an unknown id fails
- * with {@link HarnessAdapterUnavailableError} (`adapter_unavailable`).
- */
-@Injectable()
-export class HarnessRegistry {
-  private readonly adapters = new Map<string, HarnessAdapter>();
-
-  register(adapter: HarnessAdapter): void {
-    const id = adapter.id;
-    if (typeof id !== 'string' || id.trim().length === 0) {
-      throw new HarnessRegistrationError('blank_id', id ?? '');
-    }
-    if (this.adapters.has(id)) {
-      throw new HarnessRegistrationError('duplicate_id', id);
-    }
-    this.adapters.set(id, adapter);
-  }
-
-  get(harnessId: string): HarnessAdapter {
-    const adapter = this.adapters.get(harnessId);
-    if (!adapter) {
-      throw new HarnessAdapterUnavailableError(harnessId);
-    }
-    return adapter;
-  }
-
-  has(harnessId: string): boolean {
-    return this.adapters.has(harnessId);
-  }
-
-  list(): readonly HarnessAdapter[] {
-    return [...this.adapters.values()];
-  }
-}

apps/gateway/src/harness/harness.service.spec.ts

@@ -1,227 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { HarnessActorContext, HarnessCapability, HarnessSelection } from '@mosaicstack/types';
-import { HARNESS_CAPABILITIES } from '@mosaicstack/types';
-import { HarnessOperationError, HarnessRegistry } from './harness.registry.js';
-import {
-  HarnessScopeViolationError,
-  HarnessService,
-  type TrustedGatewayScope,
-} from './harness.service.js';
-import { FakeHarnessAdapter } from './testing/fake-harness.adapter.js';
-
-const SCOPE: TrustedGatewayScope = {
-  actorId: 'actor-trusted',
-  tenantId: 'tenant-trusted',
-  seatId: 'seat-trusted',
-  correlationId: 'correlation-trusted',
-};
-
-const READ_CONTEXT: HarnessActorContext = {
-  actorId: SCOPE.actorId,
-  tenantId: SCOPE.tenantId,
-  seatId: SCOPE.seatId,
-  correlationId: SCOPE.correlationId,
-};
-
-function setup(capabilities?: readonly HarnessCapability[]) {
-  const registry = new HarnessRegistry();
-  const adapter = new FakeHarnessAdapter({ id: 'fake', capabilities });
-  registry.register(adapter);
-  const service = new HarnessService(registry);
-  return { registry, adapter, service };
-}
-
-async function availableSelection(adapter: FakeHarnessAdapter): Promise<HarnessSelection> {
-  const catalog = await adapter.catalog(READ_CONTEXT);
-  const entry = catalog.models.find((model) => model.availability === 'available');
-  if (!entry) {
-    throw new Error('fixture requires an available model');
-  }
-  return { harnessId: entry.harnessId, providerId: entry.providerId, modelId: entry.modelId };
-}
-
-describe('HarnessService', () => {
-  it('derives the actor context from trusted scope on create', async () => {
-    const { service, adapter } = setup();
-    const selection = await availableSelection(adapter);
-
-    const snapshot = await service.createSession(SCOPE, {
-      conversationId: 'conversation-1',
-      selection,
-    });
-
-    expect(snapshot.seatId).toBe(SCOPE.seatId);
-    expect(snapshot.state).toBe('idle');
-    expect(snapshot.selection).toEqual(selection);
-    expect(snapshot.nativeSessionId).toBeTruthy();
-  });
-
-  it('rejects server-authority fields supplied by an external caller', async () => {
-    const { service, adapter } = setup();
-    const selection = await availableSelection(adapter);
-
-    const hostile = {
-      conversationId: 'conversation-1',
-      selection,
-      seatId: 'attacker-seat',
-      executablePath: '/usr/bin/evil',
-      home: '/home/attacker',
-      cwd: '/tmp/attacker',
-      nativeSessionPath: '/var/native/attacker.jsonl',
-    } as unknown as Parameters<HarnessService['createSession']>[1];
-
-    let error: unknown;
-    try {
-      await service.createSession(SCOPE, hostile);
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessScopeViolationError);
-    expect((error as HarnessScopeViolationError).field).toBe('seatId');
-  });
-
-  it('returns adapter_unavailable for an unknown harness id, echoing the requested tuple', async () => {
-    const { service } = setup();
-    const selection: HarnessSelection = {
-      harnessId: 'ghost-harness',
-      providerId: 'p',
-      modelId: 'm',
-    };
-
-    let error: unknown;
-    try {
-      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessOperationError);
-    const dto = (error as HarnessOperationError).dto;
-    expect(dto.code).toBe('adapter_unavailable');
-    expect(dto.selection).toEqual(selection);
-    expect(dto.correlationId).toBe(SCOPE.correlationId);
-  });
-
-  it('returns selection_invalid for an unknown provider/model tuple, unchanged', async () => {
-    const { service } = setup();
-    const selection: HarnessSelection = {
-      harnessId: 'fake',
-      providerId: 'ghost-provider',
-      modelId: 'ghost-model',
-    };
-
-    let error: unknown;
-    try {
-      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessOperationError);
-    const dto = (error as HarnessOperationError).dto;
-    expect(dto.code).toBe('selection_invalid');
-    expect(dto.selection).toEqual(selection);
-  });
-
-  it('returns model_unavailable without falling back for a known unavailable model', async () => {
-    const { service, adapter } = setup();
-    const catalog = await adapter.catalog(READ_CONTEXT);
-    const unavailable = catalog.models.find((entry) => entry.availability === 'unavailable');
-    expect(unavailable).toBeDefined();
-    const selection: HarnessSelection = {
-      harnessId: unavailable!.harnessId,
-      providerId: unavailable!.providerId,
-      modelId: unavailable!.modelId,
-    };
-
-    let error: unknown;
-    try {
-      await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessOperationError);
-    const dto = (error as HarnessOperationError).dto;
-    expect(dto.code).toBe('model_unavailable');
-    // No substitution: the DTO tuple is exactly what was requested.
-    expect(dto.selection).toEqual(selection);
-  });
-
-  it('gives create, resume, detach, evict, and end distinct observable effects', async () => {
-    const { service, adapter } = setup();
-    const selection = await availableSelection(adapter);
-
-    const created = await service.createSession(SCOPE, {
-      conversationId: 'conversation-create',
-      selection,
-    });
-    expect(created.state).toBe('idle');
-    expect(created.processId).toBeTruthy();
-    expect(created.attachedClientIds).toEqual([]);
-
-    const resumed = await service.resumeSession(SCOPE, {
-      conversationId: 'conversation-resume',
-      nativeSessionId: 'native-preexisting-123',
-      selection,
-    });
-    // Resume binds the supplied native session; create mints a fresh one.
-    expect(resumed.nativeSessionId).toBe('native-preexisting-123');
-    expect(resumed.nativeSessionId).not.toBe(created.nativeSessionId);
-
-    await service.attach(SCOPE, {
-      conversationId: 'conversation-create',
-      clientId: 'browser-1',
-    });
-    const afterAttach = await service.snapshot(SCOPE, 'conversation-create');
-    expect(afterAttach.attachedClientIds).toEqual(['browser-1']);
-
-    const afterDetach = await service.detach(SCOPE, {
-      conversationId: 'conversation-create',
-      clientId: 'browser-1',
-    });
-    // Detach removes the browser attachment only; the process stays alive.
-    expect(afterDetach.attachedClientIds).toEqual([]);
-    expect(afterDetach.state).toBe('idle');
-    expect(afterDetach.processId).toBeTruthy();
-
-    const afterEvict = await service.evict(SCOPE, {
-      conversationId: 'conversation-create',
-      reason: 'idle_timeout',
-    });
-    // Evict stops the process but retains the resumable native session.
-    expect(afterEvict.state).toBe('evicted');
-    expect(afterEvict.processId).toBeUndefined();
-    expect(afterEvict.nativeSessionId).toBe(created.nativeSessionId);
-
-    const afterEnd = await service.end(SCOPE, {
-      conversationId: 'conversation-create',
-      reason: 'session_ended',
-    });
-    // End destructively terminates the native session.
-    expect(afterEnd.state).toBe('ended');
-  });
-
-  it('fails typed when an unsupported capability is exercised', async () => {
-    const withoutExtensionUi = HARNESS_CAPABILITIES.filter(
-      (capability) => capability !== 'extensionUi',
-    );
-    const { service, adapter } = setup(withoutExtensionUi);
-    const selection = await availableSelection(adapter);
-    await service.createSession(SCOPE, { conversationId: 'conversation-1', selection });
-
-    let error: unknown;
-    try {
-      await service.respondInteraction(SCOPE, {
-        conversationId: 'conversation-1',
-        response: { requestId: 'interaction-1', type: 'confirm', accepted: true },
-      });
-    } catch (caught) {
-      error = caught;
-    }
-
-    expect(error).toBeInstanceOf(HarnessOperationError);
-    expect((error as HarnessOperationError).dto.code).toBe('interaction_unsupported');
-  });
-});

apps/gateway/src/harness/harness.service.ts

@@ -1,285 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import type {
-  HarnessActorContext,
-  HarnessAdapter,
-  HarnessCatalog,
-  HarnessCloseReason,
-  HarnessInteractionResponse,
-  HarnessSelection,
-  HarnessSessionHandle,
-  HarnessSessionSnapshot,
-} from '@mosaicstack/types';
-import {
-  HarnessAdapterUnavailableError,
-  HarnessRegistry,
-  operationError,
-} from './harness.registry.js';
-import { HARNESS_REGISTRY } from './harness.tokens.js';
-
-/**
- * Trusted, server-derived authority. In production this is produced by the
- * Gateway from the authenticated session — never from a browser/caller DTO.
- */
-export interface TrustedGatewayScope {
-  readonly actorId: string;
-  readonly tenantId: string;
-  readonly seatId: string;
-  readonly correlationId: string;
-}
-
-/** Server-authority fields that must never arrive from an external request DTO. */
-const FORBIDDEN_REQUEST_FIELDS = [
-  'actorId',
-  'tenantId',
-  'correlationId',
-  'seatId',
-  'seat',
-  'executable',
-  'executablePath',
-  'home',
-  'homeDir',
-  'cwd',
-  'workingDir',
-  'workingDirectory',
-  'nativeSessionPath',
-  'sessionPath',
-] as const;
-
-/** Raised when an external request DTO smuggles a server-authority field. */
-export class HarnessScopeViolationError extends Error {
-  constructor(readonly field: string) {
-    super(`External request supplied server-authority field "${field}".`);
-    this.name = 'HarnessScopeViolationError';
-  }
-}
-
-export interface CreateHarnessSessionRequest {
-  readonly conversationId: string;
-  readonly selection: HarnessSelection;
-}
-
-export interface ResumeHarnessSessionRequest {
-  readonly conversationId: string;
-  readonly nativeSessionId: string;
-  readonly selection: HarnessSelection;
-}
-
-export interface AttachClientRequest {
-  readonly conversationId: string;
-  readonly clientId: string;
-}
-
-export interface DetachClientRequest {
-  readonly conversationId: string;
-  readonly clientId: string;
-}
-
-export interface EvictSessionRequest {
-  readonly conversationId: string;
-  readonly reason: HarnessCloseReason;
-}
-
-export interface EndSessionRequest {
-  readonly conversationId: string;
-  readonly reason: HarnessCloseReason;
-}
-
-export interface RespondInteractionRequest {
-  readonly conversationId: string;
-  readonly response: HarnessInteractionResponse;
-}
-
-interface ActiveSession {
-  readonly harnessId: string;
-  readonly handle: HarnessSessionHandle;
-  readonly correlationId: string;
-}
-
-/**
- * Harness-neutral service. It derives the {@link HarnessActorContext} strictly
- * from trusted Gateway scope, validates the selected provider/model tuple with
- * NO fallback substitution, and exposes distinct create/resume/detach/evict/end
- * lifecycle operations.
- */
-@Injectable()
-export class HarnessService {
-  private readonly sessions = new Map<string, ActiveSession>();
-
-  constructor(@Inject(HARNESS_REGISTRY) private readonly registry: HarnessRegistry) {}
-
-  async createSession(
-    scope: TrustedGatewayScope,
-    request: CreateHarnessSessionRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const { conversationId, selection } = request;
-    const adapter = this.resolveAdapter(scope, selection);
-    const context = deriveActorContext(scope);
-    await this.assertSelectionAvailable(scope, adapter.catalog(context), selection);
-
-    const handle = await adapter.create({ context, conversationId, selection });
-    this.sessions.set(conversationId, {
-      harnessId: selection.harnessId,
-      handle,
-      correlationId: scope.correlationId,
-    });
-    return handle.snapshot();
-  }
-
-  async resumeSession(
-    scope: TrustedGatewayScope,
-    request: ResumeHarnessSessionRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const { conversationId, nativeSessionId, selection } = request;
-    const adapter = this.resolveAdapter(scope, selection);
-    const context = deriveActorContext(scope);
-    await this.assertSelectionAvailable(scope, adapter.catalog(context), selection);
-
-    const handle = await adapter.resume({ context, conversationId, nativeSessionId, selection });
-    this.sessions.set(conversationId, {
-      harnessId: selection.harnessId,
-      handle,
-      correlationId: scope.correlationId,
-    });
-    return handle.snapshot();
-  }
-
-  async attach(
-    scope: TrustedGatewayScope,
-    request: AttachClientRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const handle = this.requireHandle(scope, request.conversationId);
-    await handle.attach({ clientId: request.clientId });
-    return handle.snapshot();
-  }
-
-  async detach(
-    scope: TrustedGatewayScope,
-    request: DetachClientRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const handle = this.requireHandle(scope, request.conversationId);
-    await handle.detach(request.clientId);
-    return handle.snapshot();
-  }
-
-  async evict(
-    scope: TrustedGatewayScope,
-    request: EvictSessionRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const handle = this.requireHandle(scope, request.conversationId);
-    await handle.evictProcess(request.reason);
-    return handle.snapshot();
-  }
-
-  async end(
-    scope: TrustedGatewayScope,
-    request: EndSessionRequest,
-  ): Promise<HarnessSessionSnapshot> {
-    assertTrustedRequest(request);
-    const handle = this.requireHandle(scope, request.conversationId);
-    await handle.endSession(request.reason);
-    const snapshot = await handle.snapshot();
-    this.sessions.delete(request.conversationId);
-    return snapshot;
-  }
-
-  async respondInteraction(
-    scope: TrustedGatewayScope,
-    request: RespondInteractionRequest,
-  ): Promise<void> {
-    assertTrustedRequest(request);
-    const handle = this.requireHandle(scope, request.conversationId);
-    await handle.respondInteraction(request.response);
-  }
-
-  async snapshot(
-    scope: TrustedGatewayScope,
-    conversationId: string,
-  ): Promise<HarnessSessionSnapshot> {
-    const handle = this.requireHandle(scope, conversationId);
-    return handle.snapshot();
-  }
-
-  private resolveAdapter(scope: TrustedGatewayScope, selection: HarnessSelection): HarnessAdapter {
-    try {
-      return this.registry.get(selection.harnessId);
-    } catch (error) {
-      if (error instanceof HarnessAdapterUnavailableError) {
-        throw operationError('adapter_unavailable', error.message, selection, scope.correlationId);
-      }
-      throw error;
-    }
-  }
-
-  private async assertSelectionAvailable(
-    scope: TrustedGatewayScope,
-    catalogPromise: Promise<HarnessCatalog>,
-    selection: HarnessSelection,
-  ): Promise<void> {
-    const catalog = await catalogPromise;
-    const entry = catalog.models.find(
-      (candidate) =>
-        candidate.harnessId === selection.harnessId &&
-        candidate.providerId === selection.providerId &&
-        candidate.modelId === selection.modelId,
-    );
-    if (!entry) {
-      // No first-row fallback: reject the requested tuple unchanged.
-      throw operationError(
-        'selection_invalid',
-        'The requested harness/provider/model tuple is not in the catalog.',
-        selection,
-        scope.correlationId,
-      );
-    }
-    if (entry.availability === 'unavailable') {
-      throw operationError(
-        'model_unavailable',
-        'The requested model is currently unavailable.',
-        selection,
-        scope.correlationId,
-        true,
-      );
-    }
-  }
-
-  private requireHandle(scope: TrustedGatewayScope, conversationId: string): HarnessSessionHandle {
-    const active = this.sessions.get(conversationId);
-    if (!active) {
-      throw operationError(
-        'session_not_found',
-        `No active harness session for conversation "${conversationId}".`,
-        { harnessId: '', providerId: '', modelId: '' },
-        scope.correlationId,
-      );
-    }
-    return active.handle;
-  }
-}
-
-/** Build the actor context strictly from trusted scope. No caller data leaks in. */
-export function deriveActorContext(scope: TrustedGatewayScope): HarnessActorContext {
-  return {
-    actorId: scope.actorId,
-    tenantId: scope.tenantId,
-    seatId: scope.seatId,
-    correlationId: scope.correlationId,
-  };
-}
-
-/** Reject any request object that carries a server-authority field. */
-function assertTrustedRequest(request: object): void {
-  for (const field of FORBIDDEN_REQUEST_FIELDS) {
-    if (Object.prototype.hasOwnProperty.call(request, field)) {
-      throw new HarnessScopeViolationError(field);
-    }
-  }
-}
-
-// Re-export the typed operation error so callers importing from the service
-// have the discriminated failure type without reaching into the registry.
-export { HarnessOperationError } from './harness.registry.js';