fix(#1179): require security authority wiring

REPORT-A1207.md

@@ -1,71 +0,0 @@
-# REPORT A1207
-
-Date: 2026-08-13
-Branch: `fix/869-lease-probe-timeout`
-Starting head: `2373a5ad345fb316ad2460f6390baab1f45ba08f`
-Base: `216cd72226cd9ee17eea461cfe7cd0e010a22f02`
-
-## What changed
-
-- Added Python behavior tests using isolated temporary directories and marker-writing fake `mosaic` executables. They prove that the supplied `PATH` wins over ambient `os.environ["PATH"]`, and that absent or empty supplied `PATH` values do not search ambient paths, platform defaults, or the current directory.
-- Bound Python override behavior with executable fakes: a valid `MOSAIC_LEASE_VERSION_PROBE_COMMAND` wins over supplied and ambient `PATH`; an invalid override returns `None` without PATH fallback.
-- Added a Python runner binding test that captures kwargs and requires `timeout=10.0`. Existing timeout, transport-error, and nonzero-exit checks remain fail-closed with `None`.
-- Added the optional TypeScript dependency-injection seam `CapabilityProbeExecFile`, defaulting to the existing real `execFileSync` implementation. Production callers have no behavior change.
-- Added TypeScript tests that capture child-process options and require exactly `timeout: 10_000`. Injected timeout, spawn-error, nonzero-exit, unparseable JSON, and malformed-object cases all return `null`.
-- Removed the ambient no-dependency TypeScript smoke case that could execute a built checkout's real CLI. Default resolver and supervisor behavior retain their isolated tests, while capability transport tests now use an isolated artifact or the injected transport.
-
-No Python production code changed relative to `2373a5ad`. The only production delta is the optional TypeScript child-process injection seam.
-
-## Hermeticity incident and correction
-
-An initial ambient-lookup mutation run exposed that the pre-existing Python "not resolvable" test left ambient process PATH uncontrolled. On this host, that mutation resolved and executed the host `mosaic` capability probe. A post-build intermediate TypeScript run also let the pre-existing no-dependency smoke case execute the checkout's built `dist/cli.js` capability probe. No `claude` process was run. I then isolated the Python test's ambient PATH, removed the TypeScript ambient smoke case, repeated the PATH mutation using only marker-writing temporary fakes, and repeated the final suites without either real probe path.
-
-## Mutation evidence
-
-Each mutation was applied independently, its focused suite was run, and the production source was restored before the final run.
-
-| Mutation                                                                                   | Result              | Reddened test name(s)                                                                                                                                                                                                      |
-| ------------------------------------------------------------------------------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `shutil.which("mosaic", path=environ.get("PATH", ""))` to ambient `shutil.which("mosaic")` | RED, three failures | `ProbeActivationCapabilityTest.test_supplied_path_wins_over_ambient_process_path`; `ProbeActivationCapabilityTest.test_absent_or_empty_supplied_path_never_falls_back_or_executes` for both absent and empty PATH subtests |
-| Python `PROBE_TIMEOUT_SECONDS: 10.0` to `2.0`                                              | RED, one failure    | `ProbeActivationCapabilityTest.test_probe_passes_ten_second_timeout_to_runner`                                                                                                                                             |
-| TypeScript `LEASE_CAPABILITY_PROBE_TIMEOUT_MS: 10_000` to `2_000`                          | RED, one failure    | `defaultCapabilityProbe > passes the exact ten-second timeout to the injected child-process transport`                                                                                                                     |
-
-## Final test run
-
-Dependencies were installed first with `pnpm install --frozen-lockfile`. Workspace dependencies were then built with `pnpm --filter '@mosaicstack/mosaic...' run build` so package type declarations were available.
-
-```text
-$ cd packages/mosaic && python3 src/mutator-gate/version_coupling_unittest.py
-...................
-----------------------------------------------------------------------
-Ran 19 tests in 0.007s
-
-OK
-
-$ pnpm exec vitest run src/commands/lease-activation-probe.spec.ts
-✓ src/commands/lease-activation-probe.spec.ts (20 tests) 80ms
-Test Files  1 passed (1)
-Tests       20 passed (20)
-```
-
-```text
-$ pnpm exec prettier --check packages/mosaic/src/commands/lease-activation-probe.ts packages/mosaic/src/commands/lease-activation-probe.spec.ts
-Checking formatting...
-All matched files use Prettier code style!
-
-$ pnpm --filter @mosaicstack/mosaic lint
-> eslint src
-
-$ pnpm --filter @mosaicstack/mosaic typecheck
-> tsc --noEmit
-
-$ python3 -m py_compile packages/mosaic/src/mutator-gate/version_coupling_unittest.py packages/mosaic/framework/tools/lease-broker/activation_version_gate.py
-
-$ git diff --check
-```
-
-All commands above exited zero.
-
-## Ambiguities skipped
-
-None.

apps/gateway/src/__tests__/required-security-wiring.test.ts

@@ -0,0 +1,332 @@
+import { type Type } from '@nestjs/common';
+import { Test, type TestingModule } from '@nestjs/testing';
+import type { SlashCommandPayload } from '@mosaicstack/types';
+import { describe, expect, it, vi } from 'vitest';
+import { AgentService, type AgentSession } from '../agent/agent.service.js';
+import { ProviderService } from '../agent/provider.service.js';
+import { AppModule } from '../app.module.js';
+import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
+import { CommandExecutorService } from '../commands/command-executor.service.js';
+import { CommandsModule } from '../commands/commands.module.js';
+import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
+import { PreferencesModule } from '../preferences/preferences.module.js';
+import { SystemOverrideService } from '../preferences/system-override.service.js';
+
+const fakeDb = {
+  $client: { exec: async (): Promise<void> => {} },
+  execute: async (): Promise<{ rows: unknown[] }> => ({ rows: [] }),
+  select: () => ({
+    from: () => ({
+      where: async (): Promise<Array<{ count: number }>> => [{ count: 1 }],
+    }),
+  }),
+  insert: () => ({ values: async (): Promise<void> => {} }),
+};
+
+const fakeProviderService = {
+  onModuleInit: async (): Promise<void> => {},
+  onModuleDestroy: (): void => {},
+  getRegistry: () => ({ getAvailable: () => [], getAll: () => [], find: () => undefined }),
+  getDefaultModel: () => undefined,
+  listAvailableModels: () => [],
+  listProviders: () => [],
+  getAdapter: () => undefined,
+  getProvidersHealth: () => [],
+};
+
+function compileRealAppGraph(): Promise<TestingModule> {
+  return Test.createTestingModule({ imports: [AppModule] })
+    .overrideProvider('DB_HANDLE')
+    .useValue({ db: fakeDb, close: async (): Promise<void> => {} })
+    .overrideProvider('DB')
+    .useValue(fakeDb)
+    .overrideProvider('STORAGE_ADAPTER')
+    .useValue({
+      name: 'required-security-wiring-test',
+      migrate: async (): Promise<void> => {},
+      close: async (): Promise<void> => {},
+    })
+    .overrideProvider('AUTH')
+    .useValue({})
+    .overrideProvider('BRAIN')
+    .useValue({ conversations: {}, agents: {} })
+    .overrideProvider('LOG_SERVICE')
+    .useValue({})
+    .overrideProvider('MEMORY')
+    .useValue({})
+    .overrideProvider('MEMORY_ADAPTER')
+    .useValue({})
+    .overrideProvider(ProviderService)
+    .useValue(fakeProviderService)
+    .compile();
+}
+
+function providerToken(provider: unknown): unknown {
+  return typeof provider === 'function' ? provider : (provider as { provide?: unknown })?.provide;
+}
+
+interface MaskingConsumer {
+  moduleType: Type<unknown>;
+  token: Type<unknown>;
+  useValue: object;
+}
+
+async function compileWithoutProvider(
+  moduleType: Type<unknown>,
+  missingToken: Type<unknown>,
+  maskingConsumer: MaskingConsumer,
+): Promise<{ error: unknown; moduleRef: TestingModule | undefined }> {
+  const touchedModules = new Set([moduleType, maskingConsumer.moduleType]);
+  const originals = Array.from(touchedModules, (touchedModule: Type<unknown>) => ({
+    moduleType: touchedModule,
+    providers: (Reflect.getMetadata('providers', touchedModule) ?? []) as unknown[],
+    exports: (Reflect.getMetadata('exports', touchedModule) ?? []) as unknown[],
+  }));
+
+  for (const original of originals) {
+    const providers = original.providers.flatMap((provider: unknown): unknown[] => {
+      const token = providerToken(provider);
+      if (original.moduleType === moduleType && token === missingToken) return [];
+      if (original.moduleType === maskingConsumer.moduleType && token === maskingConsumer.token) {
+        return [{ provide: maskingConsumer.token, useValue: maskingConsumer.useValue }];
+      }
+      return [provider];
+    });
+    const exports = original.exports.filter(
+      (exported: unknown): boolean =>
+        original.moduleType !== moduleType || providerToken(exported) !== missingToken,
+    );
+    Reflect.defineMetadata('providers', providers, original.moduleType);
+    Reflect.defineMetadata('exports', exports, original.moduleType);
+  }
+
+  let moduleRef: TestingModule | undefined;
+  let error: unknown;
+  try {
+    moduleRef = await compileRealAppGraph();
+  } catch (caught: unknown) {
+    error = caught;
+  } finally {
+    for (const original of originals) {
+      Reflect.defineMetadata('providers', original.providers, original.moduleType);
+      Reflect.defineMetadata('exports', original.exports, original.moduleType);
+    }
+  }
+  return { error, moduleRef };
+}
+
+async function closeIfCompiled(moduleRef: TestingModule | undefined): Promise<void> {
+  if (moduleRef) await moduleRef.close();
+}
+
+describe('required security wiring — real AppModule startup refusal', () => {
+  it('FL-01 positive control: the real graph compiles when CommandAuthorizationService is bound', async () => {
+    const moduleRef = await compileRealAppGraph();
+    try {
+      expect(moduleRef.get(CommandAuthorizationService, { strict: false })).toBeInstanceOf(
+        CommandAuthorizationService,
+      );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('FL-01 negative control: absence read as permission is refused at module compilation', async () => {
+    const { error, moduleRef } = await compileWithoutProvider(
+      CommandsModule,
+      CommandAuthorizationService,
+      {
+        moduleType: CommandsModule,
+        token: CommandRuntimeApprovalVerifier,
+        useValue: {},
+      },
+    );
+    await closeIfCompiled(moduleRef);
+
+    expect(
+      error,
+      'absence read as permission: AppModule compilation accepted a missing CommandAuthorizationService binding',
+    ).toBeInstanceOf(Error);
+    if (!(error instanceof Error)) return;
+    expect(error.message).toContain('CommandExecutorService');
+    expect(error.message).toContain('CommandAuthorizationService');
+  });
+
+  it('FL-11 positive control: the real graph compiles when SystemOverrideService is bound', async () => {
+    const moduleRef = await compileRealAppGraph();
+    try {
+      expect(moduleRef.get(SystemOverrideService, { strict: false })).toBeInstanceOf(
+        SystemOverrideService,
+      );
+    } finally {
+      await moduleRef.close();
+    }
+  });
+
+  it('FL-11 negative control: absence read as permission is refused at module compilation', async () => {
+    const { error, moduleRef } = await compileWithoutProvider(
+      PreferencesModule,
+      SystemOverrideService,
+      {
+        moduleType: CommandsModule,
+        token: CommandExecutorService,
+        useValue: {},
+      },
+    );
+    await closeIfCompiled(moduleRef);
+
+    expect(
+      error,
+      'absence read as permission: AppModule compilation accepted a missing SystemOverrideService binding',
+    ).toBeInstanceOf(Error);
+    if (!(error instanceof Error)) return;
+    expect(error.message).toContain('AgentService');
+    expect(error.message).toContain('SystemOverrideService');
+  });
+});
+
+const actorScope = { userId: 'security-user', tenantId: 'security-tenant' };
+const conversationId = 'security-conversation';
+
+function directExecutorWithoutAuthorization(systemOverrideSet: ReturnType<typeof vi.fn>) {
+  const registry = {
+    getManifest: vi.fn(() => ({
+      version: 1,
+      commands: [
+        {
+          name: 'system',
+          aliases: [],
+          description: 'Set instruction authority',
+          scope: 'agent' as const,
+          execution: 'socket' as const,
+          available: true,
+        },
+      ],
+      skills: [],
+    })),
+  };
+  return new CommandExecutorService(
+    registry as never,
+    { getSession: vi.fn() } as never,
+    { set: systemOverrideSet, clear: vi.fn() } as never,
+    { collect: vi.fn() } as never,
+    null,
+    { agents: {} } as never,
+    null,
+    null,
+    { getServerStatuses: vi.fn(() => []), getToolDefinitions: vi.fn(() => []) } as never,
+    undefined as never,
+  );
+}
+
+function directAgentWithoutSystemOverride(piPrompt: ReturnType<typeof vi.fn>): {
+  service: AgentService;
+  session: AgentSession;
+} {
+  const service = new AgentService(
+    {
+      getDefaultModel: vi.fn(() => null),
+      getRegistry: vi.fn(() => ({})),
+      findModel: vi.fn(),
+      listAvailableModels: vi.fn(() => []),
+    } as never,
+    {} as never,
+    {} as never,
+    { available: false } as never,
+    {} as never,
+    { getToolDefinitions: vi.fn(() => []) } as never,
+    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
+    undefined as never,
+    null,
+    { collect: vi.fn().mockResolvedValue(undefined) } as never,
+    null,
+  );
+  const session = {
+    id: conversationId,
+    provider: 'test-provider',
+    modelId: 'test-model',
+    piSession: { prompt: piPrompt },
+    listeners: new Set(),
+    unsubscribe: vi.fn(),
+    createdAt: Date.now(),
+    promptCount: 0,
+    channels: new Set(),
+    skillPromptAdditions: [],
+    sandboxDir: process.cwd(),
+    allowedTools: null,
+    userId: actorScope.userId,
+    tenantId: actorScope.tenantId,
+    metrics: {
+      tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+      modelSwitches: 0,
+      messageCount: 0,
+      lastActivityAt: new Date(0).toISOString(),
+    },
+  } as unknown as AgentSession;
+  const internals = service as unknown as { sessions: Map<string, AgentSession> };
+  internals.sessions.set(conversationId, session);
+  return { service, session };
+}
+
+describe('required security wiring — malformed direct absence has zero effects', () => {
+  it('FL-01 refuses command execution before any command effect when authorization is absent', async () => {
+    const systemOverrideSet = vi.fn().mockResolvedValue(undefined);
+    const executor = directExecutorWithoutAuthorization(systemOverrideSet);
+    const payload: SlashCommandPayload = {
+      command: 'system',
+      args: 'authority that must not be stored',
+      conversationId,
+    };
+    let error: unknown;
+
+    try {
+      await executor.execute(payload, actorScope);
+    } catch (caught: unknown) {
+      error = caught;
+    }
+
+    expect
+      .soft(
+        error,
+        'absence read as permission: direct executor accepted missing command authorization',
+      )
+      .toBeInstanceOf(Error);
+    expect
+      .soft(
+        systemOverrideSet,
+        'absence read as permission: command effect occurred without command authorization',
+      )
+      .not.toHaveBeenCalled();
+  });
+
+  it('FL-11 refuses prompt execution before any provider or session effect when system override authority is absent', async () => {
+    const piPrompt = vi.fn().mockResolvedValue(undefined);
+    const { service, session } = directAgentWithoutSystemOverride(piPrompt);
+    let error: unknown;
+
+    try {
+      await service.prompt(conversationId, 'must not reach provider', actorScope);
+    } catch (caught: unknown) {
+      error = caught;
+    }
+
+    expect
+      .soft(
+        error,
+        'absence read as permission: direct session accepted missing system override authority',
+      )
+      .toBeInstanceOf(Error);
+    expect
+      .soft(
+        piPrompt,
+        'absence read as permission: provider prompt occurred without system override authority',
+      )
+      .not.toHaveBeenCalled();
+    expect
+      .soft(
+        session.promptCount,
+        'absence read as permission: session state changed without system override authority',
+      )
+      .toBe(0);
+  });
+});

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -26,7 +26,7 @@ function makeService(operatorMemory: unknown = null): AgentService {
     {} as never,
     { getToolDefinitions: vi.fn(() => []) } as never,
     { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
-    null,
+    { get: vi.fn().mockResolvedValue(null), renew: vi.fn().mockResolvedValue(undefined) } as never,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
     operatorMemory as never,

apps/gateway/src/agent/agent.service.ts

@@ -132,9 +132,8 @@ export class AgentService implements OnModuleDestroy {
     @Inject(CoordService) private readonly coordService: CoordService,
     @Inject(McpClientService) private readonly mcpClientService: McpClientService,
     @Inject(SkillLoaderService) private readonly skillLoaderService: SkillLoaderService,
-    @Optional()
     @Inject(SystemOverrideService)
-    private readonly systemOverride: SystemOverrideService | null,
+    private readonly systemOverride: SystemOverrideService,
     @Optional()
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
@@ -709,23 +708,22 @@ export class AgentService implements OnModuleDestroy {
       throw new Error(`No agent session found: ${sessionId}`);
     }
     this.assertSessionScope(session, scope);
-    session.promptCount += 1;
 
     // Channel attachments are untrusted URI references. Preserve exact,
     // authenticated metadata for the agent without treating it as authority.
     const attachmentContext = this.attachmentContext(attachments);
 
-    // Prepend session-scoped system override if present (renew TTL on each turn)
+    // Prepend session-scoped system override if present (renew TTL on each turn).
+    // Required instruction-authority wiring is consulted before session/provider effects.
     let effectiveMessage = `${message}${attachmentContext}`;
-    if (this.systemOverride) {
     const override = await this.systemOverride.get(sessionId, scope);
     if (override) {
       effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
       await this.systemOverride.renew(sessionId, scope);
       this.logger.debug(`Applied system override for session ${sessionId}`);
     }
-    }
 
+    session.promptCount += 1;
     try {
       await session.piSession.prompt(effectiveMessage);
     } catch (err) {

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -80,6 +80,10 @@ const mockMcpClient = {
   getToolDefinitions: vi.fn(() => []),
 };
 
+const allowAuthorization = {
+  authorize: vi.fn().mockResolvedValue({ allowed: true }),
+};
+
 function buildService(
   redis: typeof mockRedis | null = mockRedis,
   mcpClient: {
@@ -98,6 +102,7 @@ function buildService(
     null,
     mockChatGateway as never,
     mcpClient as never,
+    allowAuthorization as never,
   );
 }
 

apps/gateway/src/commands/command-executor.service.ts

@@ -35,9 +35,8 @@ export class CommandExecutorService {
     @Inject(forwardRef(() => ChatGateway))
     private readonly chatGateway: ChatGateway | null,
     @Inject(McpClientService) private readonly mcpClient: McpClientService,
-    @Optional()
     @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService | null = null,
+    private readonly authorization: CommandAuthorizationService,
   ) {}
 
   async execute(
@@ -57,13 +56,13 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization?.authorize(
+    const authorization = await this.authorization.authorize(
       def,
       payload,
       userId,
       payload.approvalId,
     );
-    if (authorization && !authorization.allowed) {
+    if (!authorization.allowed) {
       return { command, conversationId, success: false, message: authorization.reason };
     }
 
@@ -171,7 +170,7 @@ export class CommandExecutorService {
     const def = this.registry
       .getManifest()
       .commands.find((command) => command.name === payload.command);
-    if (!def || !this.authorization) return null;
+    if (!def) return null;
     return this.authorization.createApproval(def, payload, scope.userId);
   }
 

apps/gateway/src/commands/commands.integration.spec.ts

@@ -55,6 +55,10 @@ const mockMcpClient = {
   reconnectServer: vi.fn().mockResolvedValue(undefined),
 };
 
+const allowAuthorization = {
+  authorize: vi.fn().mockResolvedValue({ allowed: true }),
+};
+
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
 function buildRegistry(): CommandRegistryService {
@@ -74,6 +78,7 @@ function buildExecutor(registry: CommandRegistryService): CommandExecutorService
     null, // reloadService (optional)
     null, // chatGateway (optional)
     mockMcpClient as never,
+    allowAuthorization as never,
   );
 }
 

apps/gateway/src/reload/reload.service.spec.ts

@@ -159,6 +159,7 @@ describe('ReloadService — /reload command sanitizes plugin errors', () => {
       reloadService,
       mockChatGateway as never,
       mockMcpClient as never,
+      { authorize: vi.fn().mockResolvedValue({ allowed: true }) } as never,
     );
 
     const payload: SlashCommandPayload = { command: 'reload', conversationId: 'conv-1' };

docs/scratchpads/1179-required-security-di.md

@@ -0,0 +1,77 @@
+# #1179 — Required security DI wiring
+
+## Objective
+
+Eliminate the shared fail-open defect class **absence read as permission**:
+
+- FL-01: missing `CommandAuthorizationService` must refuse Nest startup and must not permit command effects.
+- FL-11: missing `SystemOverrideService` must refuse Nest startup and must not omit stored instruction authority while allowing provider/session effects.
+
+## Tracking
+
+- Issue: #1179, child of #1156
+- Branch: `fix/1179-required-security-di`
+- Base: `origin/next` at `216cd72226cd9ee17eea461cfe7cd0e010a22f02`
+
+## Plan
+
+1. RED: compile the real `AppModule` graph with each required provider independently removed, with a positive control for each intact binding.
+2. RED: directly exercise each malformed absence path and assert zero command/provider/session effects.
+3. Stop and report RED to the coordinator before production implementation.
+4. After authorization, make both constructor injections required, remove absence-as-permission branches, and update explicit legitimate optional test seams.
+5. Run focused Gateway tests, typecheck, lint, format, build, independent exact-head verification, and focused security review.
+
+## Immutable path fence
+
+Production changes are confined to:
+
+- `apps/gateway/src/commands/command-executor.service.ts`
+- `apps/gateway/src/agent/agent.service.ts`
+
+Tests and task evidence are confined to:
+
+- `apps/gateway/src/__tests__/required-security-wiring.test.ts`
+- existing direct-constructor specs that require explicit required arguments
+- `docs/scratchpads/1179-required-security-di.md`
+
+No files in #1178, #1072, #1080, or #1054 lanes are in scope. `docs/TASKS.md` is orchestrator-owned and will not be modified.
+
+## Budget
+
+No explicit token ceiling was provided. Working assumption: one narrow Gateway security packet; split and stop if either arm requires unrelated module rewiring.
+
+## Progress
+
+- Intake read from #1179 and parent #1156.
+- Base independently resolved from the issue's pre-native-stage ordering and repository `origin/next` ref; branch HEAD verified byte-for-byte against the remote ref.
+- Real consumers and direct constructors inventoried.
+
+## Tests
+
+### RED
+
+- `required-security-wiring.test.ts`: 4 failed, 2 passed before implementation.
+- Both real-graph negative controls showed module compilation accepted the missing target binding.
+- Direct FL-01 showed one unauthorized command effect; direct FL-11 showed one provider prompt and one session counter mutation.
+
+### GREEN
+
+- `required-security-wiring.test.ts`: 6/6 passed.
+- FL-01-only production revert: exactly the two FL-01 test cases failed; all four other cases, including FL-11, passed.
+- FL-11-only production revert: exactly the two FL-11 test cases failed; all four other cases, including FL-01, passed.
+- Full Gateway suite: 74 files passed, 7 skipped; 831 tests passed, 17 skipped.
+- Gateway typecheck: passed.
+- Gateway lint: passed.
+- Gateway build: passed.
+- Changed-file Prettier check: passed.
+
+### Review
+
+- Codex code review: APPROVE, 0 findings.
+- Codex focused security review: risk `none`, 0 findings.
+- Independent exact-head review remains assigned to Scrappy through the coordinator.
+
+## Risks / blockers
+
+- `AgentModule` / `CommandsModule` / `ChatModule` contain a production cycle; the module test therefore uses the real top-level `AppModule` and replaces only storage/network leaves, preserving the target service in each arm while isolating the separate required consumer that would otherwise mask that arm's defect.
+- No broad module rewrite was required.

packages/mosaic/framework/tools/lease-broker/activation_version_gate.py

@@ -62,14 +62,7 @@ EXPECTED_ACTIVATION_CAPABILITY: Final[ActivationCapability] = {
 # capability as compact JSON.
 LEASE_CAPABILITY_PROBE_COMMAND: Final = "__lease-capability"
 
-# Budget for the out-of-process `mosaic __lease-capability` probe. The CLI
-# is a Node program whose cold start alone measures 2.2-2.3s on a mid-range
-# workstation (sb-it-1-dt, 2026-08-13), so a 2s budget made every launch on
-# such hosts fail closed with the #869 skew message even though the
-# capability matched. The timeout only bounds the pathological hang case —
-# the happy path returns as soon as the probe exits — so a generous budget
-# costs nothing on healthy hosts.
-PROBE_TIMEOUT_SECONDS: Final = 10.0
+PROBE_TIMEOUT_SECONDS: Final = 2.0
 
 # Override hook: a full shell-style command line (parsed with `shlex.split`)
 # to run INSTEAD of resolving `mosaic` on PATH and appending the probe
@@ -95,13 +88,7 @@ def _resolve_probe_command(environ: Mapping[str, str]) -> list[str] | None:
     if override:
         parsed = shlex.split(override)
         return parsed or None
-    # Resolve against the PROVIDED environment's PATH, not the ambient
-    # os.environ. Before this, a test passing a hermetic environ still
-    # resolved (and spawned) the host's real `mosaic` — masked only on hosts
-    # where the real probe happened to exceed the old 2s timeout. No PATH in
-    # the provided environment means nothing is resolvable (fail-closed),
-    # matching the probe's overall contract.
-    resolved = shutil.which("mosaic", path=environ.get("PATH", ""))
+    resolved = shutil.which("mosaic")
     if resolved is None:
         return None
     return [resolved, LEASE_CAPABILITY_PROBE_COMMAND]

packages/mosaic/src/commands/lease-activation-probe.spec.ts

@@ -7,13 +7,11 @@ import { fileURLToPath } from 'node:url';
 import {
   LEASE_ACTIVATION_CAPABILITY,
   LEASE_CAPABILITY_PROBE_COMMAND,
-  LEASE_CAPABILITY_PROBE_TIMEOUT_MS,
   defaultCapabilityProbe,
   defaultResolveCliEntry,
   defaultSupervisorProbe,
   leaseEnforcementActivatable,
   registerLeaseCapabilityProbe,
-  type CapabilityProbeExecFile,
   type LeaseActivationCapability,
   type SupervisorProbeResult,
 } from './lease-activation-probe.js';
@@ -37,17 +35,6 @@ const presentSupervisor: SupervisorProbeResult = {
   socketPath: '/run/user/1000/mosaic-lease/broker.sock',
 };
 
-function withScratchCli<T>(run: (cliPath: string) => T): T {
-  const scratchDir = mkdtempSync(join(tmpdir(), 'mosaic-lease-capability-probe-'));
-  try {
-    const cliPath = join(scratchDir, 'cli.js');
-    writeFileSync(cliPath, '// isolated fake; injected execFile means this is never executed\n');
-    return run(cliPath);
-  } finally {
-    rmSync(scratchDir, { recursive: true, force: true });
-  }
-}
-
 describe('leaseEnforcementActivatable', () => {
   it('is false when the activation capability is absent (null)', () => {
     const result = leaseEnforcementActivatable({
@@ -113,6 +100,15 @@ describe('leaseEnforcementActivatable', () => {
     });
     expect(result).toBe(true);
   });
+
+  it('uses the real default probes when no deps are injected (does not throw)', () => {
+    // No live broker / built CLI is guaranteed in a test environment, so this
+    // only asserts the predicate degrades to a safe boolean rather than
+    // throwing — the fail-closed behavior itself is covered by the injected
+    // cases above.
+    expect(() => leaseEnforcementActivatable()).not.toThrow();
+    expect(typeof leaseEnforcementActivatable()).toBe('boolean');
+  });
 });
 
 describe('defaultCapabilityProbe', () => {
@@ -131,61 +127,6 @@ describe('defaultCapabilityProbe', () => {
     expect(result).toBeNull();
   });
 
-  it('passes the exact ten-second timeout to the injected child-process transport', () => {
-    withScratchCli((cliPath) => {
-      let captured:
-        | {
-            file: string;
-            args: string[];
-            options: Parameters<CapabilityProbeExecFile>[2];
-          }
-        | undefined;
-      const execFile: CapabilityProbeExecFile = (file, args, options) => {
-        captured = { file, args, options };
-        return JSON.stringify(LEASE_ACTIVATION_CAPABILITY);
-      };
-
-      const result = defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile });
-
-      expect(result).toEqual(LEASE_ACTIVATION_CAPABILITY);
-      expect(captured).toEqual({
-        file: process.execPath,
-        args: [cliPath, LEASE_CAPABILITY_PROBE_COMMAND],
-        options: {
-          encoding: 'utf-8',
-          timeout: 10_000,
-          stdio: ['ignore', 'pipe', 'ignore'],
-        },
-      });
-      expect(captured?.options.timeout).toBe(LEASE_CAPABILITY_PROBE_TIMEOUT_MS);
-    });
-  });
-
-  it.each([
-    ['timeout', Object.assign(new Error('timed out'), { code: 'ETIMEDOUT' })],
-    ['spawn error', Object.assign(new Error('spawn failed'), { code: 'ENOENT' })],
-    ['nonzero exit', Object.assign(new Error('child exited 1'), { status: 1 })],
-  ])('returns null (fail-closed) on child-process %s', (_failure, error) => {
-    withScratchCli((cliPath) => {
-      const execFile: CapabilityProbeExecFile = () => {
-        throw error;
-      };
-
-      expect(defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile })).toBeNull();
-    });
-  });
-
-  it.each([
-    ['unparseable JSON', 'not-json'],
-    ['malformed object', JSON.stringify({ name: LEASE_ACTIVATION_CAPABILITY.name })],
-  ])('returns null (fail-closed) on %s output', (_failure, output) => {
-    withScratchCli((cliPath) => {
-      const execFile: CapabilityProbeExecFile = () => output;
-
-      expect(defaultCapabilityProbe({ resolveCliEntry: () => cliPath, execFile })).toBeNull();
-    });
-  });
-
   describe('positive path — injected resolver, isolated scratch dir (never the real dist/)', () => {
     // A prior version of this test staged the stub cli.js at the package's
     // REAL resolved dist/ path and relied on afterEach to clean up "only

packages/mosaic/src/commands/lease-activation-probe.ts

@@ -55,19 +55,6 @@ export const LEASE_ACTIVATION_CAPABILITY: LeaseActivationCapability = {
 /** Hidden CLI probe subcommand name — wired via {@link registerLeaseCapabilityProbe}. */
 export const LEASE_CAPABILITY_PROBE_COMMAND = '__lease-capability';
 
-/**
- * Budget for the out-of-process capability probe. The probe launches a fresh
- * Node process on the built CLI entrypoint, whose cold start alone measures
- * 2.2-2.3s on a mid-range workstation (sb-it-1-dt, 2026-08-13) — so the
- * previous 2s budget made the probe time out and report NO capability on
- * such hosts, failing every launch with the #869 skew message even though
- * the capability matched. The timeout only bounds the pathological hang
- * case; the happy path returns as soon as the probe exits. Mirrors
- * PROBE_TIMEOUT_SECONDS in the enforcement half
- * (framework/tools/lease-broker/activation_version_gate.py).
- */
-export const LEASE_CAPABILITY_PROBE_TIMEOUT_MS = 10_000;
-
 function capabilityMatches(candidate: LeaseActivationCapability | null): boolean {
   return (
     candidate !== null &&
@@ -123,28 +110,12 @@ export function defaultResolveCliEntry(
   return join(dirname(mainEntry), 'cli.js');
 }
 
-/** Narrow injectable seam for the synchronous child process used by the
- * capability probe. */
-export type CapabilityProbeExecFile = (
-  file: string,
-  args: string[],
-  options: {
-    encoding: BufferEncoding;
-    timeout: number;
-    stdio: ['ignore', 'pipe', 'ignore'];
-  },
-) => string;
-
 /** Injectable inputs for {@link defaultCapabilityProbe}. */
 export interface CapabilityProbeDeps {
   /** Resolve the CLI entrypoint (`cli.js`) to probe. Defaults to
    * {@link defaultResolveCliEntry}. Inject to point at an isolated scratch
    * location in tests — never at the real package's `dist/`. */
   resolveCliEntry?: () => string;
-  /** Execute the resolved CLI entrypoint. Defaults to the real
-   * `execFileSync`. Inject so transport behavior and options can be tested
-   * without spawning a process. */
-  execFile?: CapabilityProbeExecFile;
 }
 
 /**
@@ -168,10 +139,9 @@ export function defaultCapabilityProbe(
     const cliEntry = resolveCliEntry();
     if (!existsSync(cliEntry)) return null;
 
-    const execFile: CapabilityProbeExecFile = deps.execFile ?? execFileSync;
-    const output = execFile(process.execPath, [cliEntry, LEASE_CAPABILITY_PROBE_COMMAND], {
+    const output = execFileSync(process.execPath, [cliEntry, LEASE_CAPABILITY_PROBE_COMMAND], {
       encoding: 'utf-8',
-      timeout: LEASE_CAPABILITY_PROBE_TIMEOUT_MS,
+      timeout: 2000,
       stdio: ['ignore', 'pipe', 'ignore'],
     });
 

packages/mosaic/src/mutator-gate/version_coupling_unittest.py

@@ -24,15 +24,11 @@ from __future__ import annotations
 
 import importlib.util
 import io
-import os
-import shlex
 import subprocess
 import sys
-import tempfile
 import unittest
 from contextlib import redirect_stderr
 from pathlib import Path
-from unittest import mock
 
 
 TOOLS_DIR = Path(__file__).parents[2] / "framework/tools/lease-broker"
@@ -61,20 +57,6 @@ def matching_capability() -> dict[str, object]:
     return dict(VERSION_GATE.EXPECTED_ACTIVATION_CAPABILITY)
 
 
-def write_fake_mosaic(directory: Path, marker: Path) -> Path:
-    directory.mkdir(parents=True, exist_ok=True)
-    executable = directory / "mosaic"
-    executable.write_text(
-        "#!/bin/sh\n"
-        f"printf '%s\\n' executed >> {shlex.quote(str(marker))}\n"
-        "printf '%s\\n' "
-        "'{\"name\":\"lease-runtime-activation\",\"version\":1}'\n",
-        encoding="utf-8",
-    )
-    executable.chmod(0o755)
-    return executable
-
-
 class AssertActivationCapabilityMatchesTest(unittest.TestCase):
     """Unit-level coverage of `activation_version_gate.py`'s own assertion,
     isolated from the launch-runtime.py seam it is wired into below."""
@@ -128,102 +110,11 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
     handling — never spawns a real `mosaic` process."""
 
     def test_returns_none_when_mosaic_is_not_resolvable_on_path(self) -> None:
-        # Keep even a deliberate ambient-lookup mutation away from any host
-        # installation. The dedicated hermeticity tests below provide fake
-        # ambient executables and markers.
-        with mock.patch.dict(
-            os.environ, {"PATH": "/nonexistent-ambient-bin-dir-for-869-c4-test"}
-        ):
         result = VERSION_GATE.default_probe_activation_capability(
             {"PATH": "/nonexistent-bin-dir-for-869-c4-test"}
         )
         self.assertIsNone(result)
 
-    def test_supplied_path_wins_over_ambient_process_path(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            supplied_marker = root / "supplied.marker"
-            ambient_marker = root / "ambient.marker"
-            supplied_bin = root / "supplied-bin"
-            ambient_bin = root / "ambient-bin"
-            write_fake_mosaic(supplied_bin, supplied_marker)
-            write_fake_mosaic(ambient_bin, ambient_marker)
-
-            with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {"PATH": str(supplied_bin)}
-                )
-
-            self.assertEqual(result, matching_capability())
-            self.assertTrue(supplied_marker.exists())
-            self.assertFalse(ambient_marker.exists())
-
-    def test_absent_or_empty_supplied_path_never_falls_back_or_executes(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            ambient_marker = root / "ambient.marker"
-            current_directory_marker = root / "current-directory.marker"
-            ambient_bin = root / "ambient-bin"
-            current_directory = root / "current-directory"
-            write_fake_mosaic(ambient_bin, ambient_marker)
-            write_fake_mosaic(current_directory, current_directory_marker)
-            original_directory = Path.cwd()
-
-            try:
-                os.chdir(current_directory)
-                with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                    for supplied_environment in ({}, {"PATH": ""}):
-                        with self.subTest(environ=supplied_environment):
-                            result = VERSION_GATE.default_probe_activation_capability(
-                                supplied_environment
-                            )
-                            self.assertIsNone(result)
-                            self.assertFalse(ambient_marker.exists())
-                            self.assertFalse(current_directory_marker.exists())
-            finally:
-                os.chdir(original_directory)
-
-    def test_valid_override_wins_and_invalid_override_does_not_fall_back_to_path(
-        self,
-    ) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            root = Path(temporary)
-            supplied_marker = root / "supplied.marker"
-            ambient_marker = root / "ambient.marker"
-            override_marker = root / "override.marker"
-            supplied_bin = root / "supplied-bin"
-            ambient_bin = root / "ambient-bin"
-            override_bin = root / "override-bin"
-            write_fake_mosaic(supplied_bin, supplied_marker)
-            write_fake_mosaic(ambient_bin, ambient_marker)
-            override_executable = write_fake_mosaic(override_bin, override_marker)
-
-            with mock.patch.dict(os.environ, {"PATH": str(ambient_bin)}):
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {
-                        "PATH": str(supplied_bin),
-                        VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: str(override_executable),
-                    }
-                )
-                self.assertEqual(result, matching_capability())
-                self.assertTrue(override_marker.exists())
-                self.assertFalse(supplied_marker.exists())
-                self.assertFalse(ambient_marker.exists())
-
-                override_marker.unlink()
-                result = VERSION_GATE.default_probe_activation_capability(
-                    {
-                        "PATH": str(supplied_bin),
-                        VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: str(
-                            root / "invalid-override" / "mosaic"
-                        ),
-                    }
-                )
-                self.assertIsNone(result)
-                self.assertFalse(override_marker.exists())
-                self.assertFalse(supplied_marker.exists())
-                self.assertFalse(ambient_marker.exists())
-
     def test_override_command_is_parsed_and_the_probe_subcommand_is_not_double_appended(
         self,
     ) -> None:
@@ -244,29 +135,6 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
         self.assertEqual(result, {"name": "lease-runtime-activation", "version": 1})
         self.assertEqual(captured, [["/fake/mosaic", "__lease-capability"]])
 
-    def test_probe_passes_ten_second_timeout_to_runner(self) -> None:
-        captured_argv: list[str] = []
-        captured_kwargs: dict[str, object] = {}
-
-        class FakeCompleted:
-            returncode = 0
-            stdout = '{"name": "lease-runtime-activation", "version": 1}'
-
-        def fake_run(argv: list[str], **kwargs: object) -> FakeCompleted:
-            captured_argv.extend(argv)
-            captured_kwargs.update(kwargs)
-            return FakeCompleted()
-
-        result = VERSION_GATE.default_probe_activation_capability(
-            {VERSION_GATE.MOSAIC_COMMAND_OVERRIDE_VAR: "/fake/mosaic"},
-            run=fake_run,
-        )
-
-        self.assertEqual(result, matching_capability())
-        self.assertEqual(captured_argv, ["/fake/mosaic"])
-        self.assertEqual(captured_kwargs["timeout"], 10.0)
-        self.assertEqual(captured_kwargs["check"], False)
-
     def test_fails_closed_on_nonzero_exit_malformed_json_and_missing_fields(self) -> None:
         class NonZeroExit:
             returncode = 1
@@ -306,7 +174,7 @@ class ProbeActivationCapabilityTest(unittest.TestCase):
 
     def test_fails_closed_on_timeout_and_transport_error(self) -> None:
         def timeout_run(*_args: object, **_kwargs: object) -> None:
-            raise subprocess.TimeoutExpired(cmd="mosaic", timeout=10.0)
+            raise subprocess.TimeoutExpired(cmd="mosaic", timeout=2.0)
 
         def oserror_run(*_args: object, **_kwargs: object) -> None:
             raise OSError("no such file or directory")