fix: add vitest.config.ts to eslint allowDefaultProject, revert tsconfig include

vitest.config.ts is not under apps/gateway/src (rootDir), so including it in tsconfig.json broke the build. Instead, add it to the eslint allowDefaultProject list so the typescript-eslint parser can lint it without being covered by the project tsconfig. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: bootstrap DTO class erasure + wizard failure + port prefill + Pi SDK copy (IUV-M01, #436 )
2026-04-05 16:56:03 -05:00 · 2026-04-05 16:38:37 -05:00
511 changed files with 1419 additions and 69826 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -9,16 +9,3 @@ coverage
 *.tsbuildinfo
 .pnpm-store
 docs/reports/
-
-# Step-CA dev password — real file is gitignored; commit only the .example
-infra/step-ca/dev-password
-
-# Scratch dirs created by the framework git-wrapper shell test harnesses
-.mosaic-test-work/
-
-# Transient config files vite/vitest/esbuild write next to a *.config.ts while
-# loading it, then unlink. They are untracked but were not ignored, so turbo's
-# package traversal hashed them and intermittently failed CI with "Package
-# traversal error: ... .timestamp-*.mjs: No such file or directory" when the
-# file vanished mid-scan. Ignoring them removes the race.
-*.timestamp-*.mjs
--- a/.npmrc
+++ b/.npmrc
@@ -1,5 +1 @@
@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
-# Pin the pnpm store to the same path the ci-base image warms (Dockerfile.ci),
-# so the pipeline `pnpm install --prefer-offline` consumes the baked store
-# instead of repopulating a fresh one.
-store-dir=/root/.local/share/pnpm/store
--- a/.woodpecker/ci-image.yml
+++ b/.woodpecker/ci-image.yml
@@ -1,40 +0,0 @@
-# Build & push the pre-baked CI base image (Dockerfile.ci) to the Gitea
-# registry CI already publishes to. Reuses the exact kaniko + auth pattern
-# from publish.yml (REGISTRY_USER/REGISTRY_PASS from_secret, /kaniko/.docker
-# config.json). Other pipelines (ci.yml, publish.yml) pull `ci-base:latest`
-# for their install step.
-#
-# Rebuild ONLY when the dependency set or the image recipe changes — a normal
-# code push must not trigger a 25-min image build. `path` applies to push/PR
-# events; `event: tag` (releases) rebuilds unconditionally so a tagged release
-# always ships a fresh base.
-when:
-  - event: tag
-  - event: [push, manual]
-    branch: main
-    path:
-      include:
-        - 'pnpm-lock.yaml'
-        - 'Dockerfile.ci'
-
-steps:
-  build-ci-base:
-    image: gcr.io/kaniko-project/executor:debug
-    environment:
-      REGISTRY_USER:
-        from_secret: gitea_username
-      REGISTRY_PASS:
-        from_secret: gitea_password
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
-    commands:
-      - mkdir -p /kaniko/.docker
-      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
-      - |
-        # Lockfile-hash tag: an immutable identity for the exact dep set baked
-        # into this image. `:latest` is the mutable pointer pipelines consume.
-        LOCK_HASH=$(sha256sum pnpm-lock.yaml | cut -c1-12)
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/ci-base:latest"
-        DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/ci-base:lock-$LOCK_HASH"
-        /kaniko/executor --context . --dockerfile Dockerfile.ci $DESTINATIONS
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -1,9 +1,5 @@
-# &node_image is the pre-baked CI base built by .woodpecker/ci-image.yml:
-# node:24-alpine + python3/make/g++/postgresql-client + pnpm + a warm pnpm
-# store. The install step resolves from the baked store (--prefer-offline)
-# instead of paying a ~731s cold fetch + native compile every run.
 variables:
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
+  - &node_image 'node:22-alpine'
  - &enable_pnpm 'corepack enable'

 when:
@@ -19,21 +15,8 @@ steps:
    image: *node_image
    commands:
      - corepack enable
-      # python3/make/g++ are baked into ci-base; --prefer-offline resolves from
-      # the baked pnpm store.
-      - pnpm install --frozen-lockfile --prefer-offline
-
-  # Blocking gate: public framework package must contain no operator-specific
-  # personal data or private $HOME defaults. Runs early (no node_modules needed).
-  sanitization:
-    image: *node_image
-    commands:
-      - apk add --no-cache bash
-      - bash packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh
-      # Resident line-count ceiling over framework-owned resident files
-      # (Constitution + dispatcher + each RUNTIME.md slice). See DESIGN §7 / R9.
-      - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test
-      - bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh
+      - apk add --no-cache python3 make g++
+      - pnpm install --frozen-lockfile

  typecheck:
    image: *node_image
@@ -42,7 +25,6 @@ steps:
      - pnpm typecheck
    depends_on:
      - install
-      - sanitization

  # lint, format, and test are independent — run in parallel after typecheck
  lint:
@@ -64,27 +46,18 @@ steps:
  test:
    image: *node_image
    environment:
-      # Avoid the namespace-level Woodpecker DB service named "postgres".
-      # The Kubernetes backend exposes service containers by step name.
-      DATABASE_URL: postgresql://mosaic:mosaic@ci-postgres:5432/mosaic
+      DATABASE_URL: postgresql://mosaic:mosaic@postgres:5432/mosaic
    commands:
      - *enable_pnpm
-      # postgresql-client (pg_isready) is baked into ci-base.
-      # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
+      # Install postgresql-client for pg_isready
+      - apk add --no-cache postgresql-client
+      # Wait up to 30s for postgres to be ready
      - |
-        ready=0
-        for i in $(seq 1 60); do
-          if pg_isready -h ci-postgres -p 5432 -U mosaic; then
-            ready=1
-            break
-          fi
-          echo "Waiting for ci-postgres ($i/60)..."
+        for i in $(seq 1 30); do
+          pg_isready -h postgres -p 5432 -U mosaic && break
+          echo "Waiting for postgres ($i/30)..."
          sleep 1
        done
-        if [ "$ready" -ne 1 ]; then
-          echo "ci-postgres did not become ready" >&2
-          exit 1
-        fi
      # Run migrations (DATABASE_URL is set in environment above)
      - pnpm --filter @mosaicstack/db run db:migrate
      # Run all tests
@@ -93,7 +66,7 @@ steps:
      - typecheck

 services:
-  ci-postgres:
+  postgres:
    image: pgvector/pgvector:pg17
    environment:
      POSTGRES_USER: mosaic
--- a/.woodpecker/publish.yml
+++ b/.woodpecker/publish.yml
@@ -1,43 +1,12 @@
 # Build, publish npm packages, and push Docker images
-# Runs on main for stable publishes and on next for integration-line prereleases/images
+# Runs only on main branch push/tag

 variables:
-  # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
-  # toolchain + warm pnpm store. Kills the second cold install publish pays.
-  - &node_image 'git.mosaicstack.dev/mosaicstack/stack/ci-base:latest'
+  - &node_image 'node:22-alpine'
  - &enable_pnpm 'corepack enable'
-  # Heavy kaniko image builds (~25 min) — gate them so a merge that only touches
-  # the npm-only CLI (@mosaicstack/mosaic) or docs does NOT rebuild the platform
-  # images (gateway/appservice/web do not depend on @mosaicstack/mosaic). Releases
-  # (tags) always build everything. Exclude-list keeps the default SAFE: any
-  # non-excluded change still builds, so no transitive dep can silently go stale.
-  # (Woodpecker: `when` entries are OR'd; `path` applies to push/PR only — hence
-  # the separate `event: tag` entry.)
-  - &image_build_when
-    - event: tag
-    - event: [push, manual]
-      branch: main
-      path:
-        exclude:
-          - 'packages/mosaic/**'
-          - 'docs/**'
-          - '**/*.md'
-          - '.woodpecker/**'
-    - event: [push, manual]
-      branch: next
-  - &main_image_build_when
-    - event: tag
-    - event: [push, manual]
-      branch: main
-      path:
-        exclude:
-          - 'packages/mosaic/**'
-          - 'docs/**'
-          - '**/*.md'
-          - '.woodpecker/**'

 when:
-  - branch: [main, next]
+  - branch: [main]
    event: [push, manual, tag]

 steps:
@@ -45,8 +14,7 @@ steps:
    image: *node_image
    commands:
      - corepack enable
-      # Resolve from the baked pnpm store instead of a cold network fetch.
-      - pnpm install --frozen-lockfile --prefer-offline
+      - pnpm install --frozen-lockfile

  build:
    image: *node_image
@@ -58,15 +26,6 @@ steps:

  publish-npm:
    image: *node_image
-    # Publish only when a publishable package changed (or on a release tag); a
-    # pure-docs merge runs no publish. Cheap step, but gated for cleanliness.
-    when:
-      - event: tag
-      - event: [push, manual]
-        branch: main
-        path:
-          include:
-            - 'packages/**'
    environment:
      NPM_TOKEN:
        from_secret: gitea_token
@@ -115,84 +74,6 @@ steps:
    depends_on:
      - build

-  publish-next-npm:
-    image: *node_image
-    # Durable @next integration-line publish. Runs only on next; never writes
-    # the latest dist-tag and never commits the computed prerelease versions.
-    when:
-      - event: [push, manual]
-        branch: next
-    environment:
-      NPM_TOKEN:
-        from_secret: gitea_token
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_PIPELINE_NUMBER: ${CI_PIPELINE_NUMBER}
-    commands:
-      - *enable_pnpm
-      - |
-        if [ "$CI_COMMIT_BRANCH" != "next" ]; then
-          echo "[publish-next] FATAL: publish-next-npm may only run on next (got '$CI_COMMIT_BRANCH')" >&2
-          exit 1
-        fi
-        if [ -z "$CI_PIPELINE_NUMBER" ]; then
-          echo "[publish-next] FATAL: CI_PIPELINE_NUMBER is required for prerelease versioning" >&2
-          exit 1
-        fi
-        echo "//git.mosaicstack.dev/api/packages/mosaicstack/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
-        echo "@mosaicstack:registry=https://git.mosaicstack.dev/api/packages/mosaicstack/npm/" >> ~/.npmrc
-        DIST_TAGS_JSON="$(npm view @mosaicstack/mosaic dist-tags --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/ --json)"
-        DIST_TAGS_JSON="$DIST_TAGS_JSON" node -e 'const tags = JSON.parse(process.env.DIST_TAGS_JSON || "{}"); if (!tags || typeof tags !== "object" || !Object.hasOwn(tags, "latest")) { throw new Error("Gitea npm registry did not return a usable dist-tags object"); } console.log("[publish-next] registry dist-tags OK: latest=" + tags.latest);'
-        node <<'NODE'
-        const fs = require('node:fs');
-        const path = require('node:path');
-
-        const pipelineNumber = process.env.CI_PIPELINE_NUMBER;
-        const roots = ['apps', 'packages', 'plugins'];
-        const updated = [];
-
-        function walk(dir) {
-          if (!fs.existsSync(dir)) return;
-          for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-              const packagePath = path.join(fullPath, 'package.json');
-              if (fs.existsSync(packagePath)) updatePackage(packagePath);
-              walk(fullPath);
-            }
-          }
-        }
-
-        function updatePackage(packagePath) {
-          const manifest = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-          if (!manifest.name?.startsWith('@mosaicstack/') || manifest.private) return;
-          const stableMatch = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(manifest.version);
-          if (!stableMatch) {
-            throw new Error(manifest.name + " has unsupported semver version '" + manifest.version + "'");
-          }
-          const [, major, minor, patch] = stableMatch;
-          const oldVersion = manifest.version;
-          manifest.version = major + '.' + minor + '.' + (Number(patch) + 1) + '-next.' + pipelineNumber;
-          fs.writeFileSync(packagePath, JSON.stringify(manifest, null, 2) + '\n');
-          updated.push(manifest.name + ' ' + oldVersion + ' -> ' + manifest.version);
-        }
-
-        for (const root of roots) walk(root);
-        if (updated.length === 0) throw new Error('No publishable @mosaicstack/* packages found');
-        console.log('[publish-next] computed prerelease versions for ' + updated.length + ' packages:');
-        for (const line of updated) console.log('[publish-next] ' + line);
-        NODE
-        pnpm --filter "@mosaicstack/*" --filter "!@mosaicstack/web" --filter "!@mosaicstack/mosaic-as" publish --no-git-checks --access public --tag next
-        EXPECTED_VERSION="$(node -p "require('./packages/mosaic/package.json').version")"
-        RESOLVED_VERSION="$(npm view @mosaicstack/mosaic@next version --registry https://git.mosaicstack.dev/api/packages/mosaicstack/npm/)"
-        if [ "$RESOLVED_VERSION" != "$EXPECTED_VERSION" ]; then
-          echo "[publish-next] FATAL: @mosaicstack/mosaic@next resolved '$RESOLVED_VERSION', expected '$EXPECTED_VERSION'" >&2
-          exit 1
-        fi
-        echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
-    depends_on:
-      - build
-
  # TODO: Uncomment when ready to publish to npmjs.org
  # publish-npmjs:
  #   image: *node_image
@@ -210,7 +91,6 @@ steps:

  build-gateway:
    image: gcr.io/kaniko-project/executor:debug
-    when: *image_build_when
    environment:
      REGISTRY_USER:
        from_secret: gitea_username
@@ -223,55 +103,19 @@ steps:
      - mkdir -p /kaniko/.docker
      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
      - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "next" ]; then
-          if [ -n "$CI_COMMIT_TAG" ]; then
-            echo "[publish] FATAL: next gateway publish must be sha-only; refusing tag '$CI_COMMIT_TAG'" >&2
-            exit 1
-          fi
-          echo "[publish] next gateway publish is sha-only"
-        elif [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:latest"
-        elif [ -z "$CI_COMMIT_TAG" ]; then
-          echo "[publish] FATAL: gateway image publish may only run for main, next, or tag events" >&2
-          exit 1
+        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/mosaic-stack/gateway:sha-${CI_COMMIT_SHA:0:7}"
+        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/mosaic-stack/gateway:latest"
        fi
        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/gateway:$CI_COMMIT_TAG"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/mosaic-stack/gateway:$CI_COMMIT_TAG"
        fi
        /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
    depends_on:
      - build

-  build-appservice:
-    image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
-    environment:
-      REGISTRY_USER:
-        from_secret: gitea_username
-      REGISTRY_PASS:
-        from_secret: gitea_password
-      CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
-      CI_COMMIT_TAG: ${CI_COMMIT_TAG}
-      CI_COMMIT_SHA: ${CI_COMMIT_SHA}
-    commands:
-      - mkdir -p /kaniko/.docker
-      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
-      - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/appservice:sha-${CI_COMMIT_SHA:0:7}"
-        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:latest"
-        fi
-        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/appservice:$CI_COMMIT_TAG"
-        fi
-        /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
-    depends_on:
-      - build
-
  build-web:
    image: gcr.io/kaniko-project/executor:debug
-    when: *main_image_build_when
    environment:
      REGISTRY_USER:
        from_secret: gitea_username
@@ -284,12 +128,12 @@ steps:
      - mkdir -p /kaniko/.docker
      - echo "{\"auths\":{\"git.mosaicstack.dev\":{\"username\":\"$REGISTRY_USER\",\"password\":\"$REGISTRY_PASS\"}}}" > /kaniko/.docker/config.json
      - |
-        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/stack/web:sha-${CI_COMMIT_SHA:0:7}"
+        DESTINATIONS="--destination git.mosaicstack.dev/mosaicstack/mosaic-stack/web:sha-${CI_COMMIT_SHA:0:7}"
        if [ "$CI_COMMIT_BRANCH" = "main" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:latest"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/mosaic-stack/web:latest"
        fi
        if [ -n "$CI_COMMIT_TAG" ]; then
-          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/stack/web:$CI_COMMIT_TAG"
+          DESTINATIONS="$DESTINATIONS --destination git.mosaicstack.dev/mosaicstack/mosaic-stack/web:$CI_COMMIT_TAG"
        fi
        /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
    depends_on:
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,14 +58,14 @@ pnpm typecheck && pnpm lint && pnpm format:check  # Quality gates

 The `agent` column specifies the required model for each task. **This is set at task creation by the orchestrator and must not be changed by workers.**

-| Value     | When to use                                                 | Budget                     |
-| --------- | ----------------------------------------------------------- | -------------------------- |
-| `codex`   | All coding tasks (default for implementation)               | OpenAI credits — preferred |
-| `glm-5.1` | Cost-sensitive coding where Codex is unavailable            | Z.ai credits               |
-| `haiku`   | Review gates, verify tasks, status checks, docs-only        | Cheapest Claude tier       |
-| `sonnet`  | Complex planning, multi-file reasoning, architecture review | Claude quota               |
-| `opus`    | Major cross-cutting architecture decisions ONLY             | Most expensive — minimize  |
-| `—`       | No preference / auto-select cheapest capable                | Pipeline decides           |
+| Value    | When to use                                                 | Budget                     |
+| -------- | ----------------------------------------------------------- | -------------------------- |
+| `codex`  | All coding tasks (default for implementation)               | OpenAI credits — preferred |
+| `glm-5`  | Cost-sensitive coding where Codex is unavailable            | Z.ai credits               |
+| `haiku`  | Review gates, verify tasks, status checks, docs-only        | Cheapest Claude tier       |
+| `sonnet` | Complex planning, multi-file reasoning, architecture review | Claude quota               |
+| `opus`   | Major cross-cutting architecture decisions ONLY             | Most expensive — minimize  |
+| `—`      | No preference / auto-select cheapest capable                | Pipeline decides           |

 Pipeline crons read this column and spawn accordingly. Workers never modify `docs/TASKS.md` — only the orchestrator writes it.

--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -1,45 +0,0 @@
-# Pre-baked CI base image for Woodpecker pipelines.
-#
-# Purpose: eliminate the cold `pnpm install` that dominates every pipeline
-# (~731s median). This image ships the native toolchain (no per-run `apk add`)
-# AND a warm, content-addressable pnpm store with the dependency-tree tarballs
-# already fetched at build time. `pnpm fetch` only populates the store from the
-# lockfile — it does NOT run the native node-gyp builds (better-sqlite3,
-# node-pty, sqlite3, canvas, sharp); those still compile at `pnpm install`,
-# which is exactly why the musl toolchain stays baked into this image. A
-# pipeline `pnpm install --frozen-lockfile --prefer-offline` then resolves
-# tarballs from local hard-links (no network) and compiles natives against the
-# already-present toolchain, in tens of seconds instead of ~731s.
-#
-# Rebuilt only when `pnpm-lock.yaml` or this Dockerfile change
-# (see .woodpecker/ci-image.yml).
-#
-# Node version is pinned to 24 (Active LTS). This is the follow-up bump from
-# node:22 — sequenced AFTER the CI cache work landed so the runtime change
-# carries zero cache variables. node:26 stays held until it reaches LTS
-# (Oct 2026); the Current line risks native-module (node-gyp) breakage on a
-# runner that compiles better-sqlite3 / canvas / sharp / node-pty from source.
-FROM node:24-alpine
-
-# Native toolchain required to compile node-gyp deps on musl, plus the
-# postgresql-client used by the test step's pg_isready readiness probe. `bash`
-# is baked here too — the sanitization step in ci.yml otherwise does a per-run
-# `apk add bash`.
-RUN apk add --no-cache python3 make g++ postgresql-client bash
-
-# Pin pnpm to the repo's packageManager version via corepack.
-RUN corepack enable && corepack prepare pnpm@10.6.2 --activate
-
-WORKDIR /app
-
-# Pin the store location so the pipeline can point `store-dir` at the same path.
-ENV PNPM_HOME=/root/.local/share/pnpm
-RUN pnpm config set store-dir /root/.local/share/pnpm/store
-
-# Warm the store. `pnpm fetch` populates the content-addressable store with the
-# dependency tarballs directly from the lockfile (no package.json / workspace
-# needed), so a baked store stays valid until the lockfile changes. Note:
-# `fetch` does NOT compile native modules — that happens later at `pnpm install`
-# in the pipeline, against the toolchain baked above.
-COPY pnpm-lock.yaml ./
-RUN pnpm fetch --frozen-lockfile
--- a/21
+++ b/21
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Mosaic Stack
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/README.md
+++ b/README.md
@@ -7,13 +7,7 @@ Mosaic gives you a unified launcher for Claude Code, Codex, OpenCode, and Pi —
 ## Quick Install

 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
-```
-
-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
+bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/mosaic-stack/raw/branch/main/tools/install.sh)
 ```

 The installer auto-launches the setup wizard, which walks you through gateway install and verification. Flags for non-interactive use:
@@ -30,16 +24,6 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |

-### Install lanes
-
-| Lane                     | Command                               | Use when                                              | Source                                                                  |
-| ------------------------ | ------------------------------------- | ----------------------------------------------------- | ----------------------------------------------------------------------- |
-| Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main` |
-| Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Build-from-source at `next`                                             |
-| Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                  |
-
-`--next` is shorthand for the prerelease integration lane: it enables source-build mode and uses `next` unless an explicit `--ref` or `MOSAIC_REF` is provided.
-
 After install, the wizard runs automatically or you can invoke it manually:

 ```bash
@@ -68,8 +52,6 @@ mosaic yolo pi               # Pi in yolo mode

 The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md` standards into the runtime, and forwards all arguments.

-Pi launches default to a token-lean skill posture: `mosaic pi` passes `--no-skills` so Pi does not preload every global skill description into the system prompt. Use `MOSAIC_PI_SKILL_MODE=all mosaic pi` for the legacy all-skills catalog, or `MOSAIC_PI_SKILL_MODE=discover mosaic pi` to let Pi use its native settings/project skill discovery.
-
 ### TUI & Gateway

 ```bash
@@ -92,8 +74,6 @@ If you already have a gateway account but no token, use `mosaic gateway config r

 ### Configuration

-Mosaic supports three storage tiers: `local` (PGlite, single-host), `standalone` (PostgreSQL, single-host), and `federated` (PostgreSQL + pgvector + Valkey, multi-host). See [Federated Tier Setup](docs/federation/SETUP.md) for multi-user and production deployments, or [Migrating to Federated](docs/guides/migrate-tier.md) to upgrade from existing tiers.
-
 ```bash
 mosaic config show           # Print full config as JSON
 mosaic config get <key>      # Read a specific key
@@ -199,8 +179,8 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 ### Setup

 ```bash
-git clone git@git.mosaicstack.dev:mosaicstack/stack.git
-cd stack
+git clone git@git.mosaicstack.dev:mosaicstack/mosaic-stack.git
+cd mosaic-stack

 # Start infrastructure (Postgres, Valkey, Jaeger)
 docker compose up -d
@@ -249,7 +229,7 @@ npm packages are published to the Gitea package registry on main merges.
 ## Architecture

 ```
-stack/
+mosaic-stack/
 ├── apps/
 │   ├── gateway/             NestJS API + WebSocket hub (Fastify, Socket.IO, OTEL)
 │   └── web/                 Next.js dashboard (React 19, Tailwind)
@@ -322,13 +302,7 @@ Each stage has a dispatch mode (`exec` for research/review, `yolo` for coding),
 Run the installer again — it handles upgrades automatically:

 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
-```
-
-Or use the direct URL:
-
-```bash
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
+bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/mosaic-stack/raw/branch/main/tools/install.sh)
 ```

 Or use the CLI:
@@ -346,9 +320,7 @@ The CLI also performs a background update check on every invocation (cached for
 bash tools/install.sh --check           # Version check only
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --next            # Prerelease lane: source build from next
-bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
-bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
+bash tools/install.sh --ref v1.0        # Install from a specific git ref
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
--- a/apps/appservice/package.json
+++ b/apps/appservice/package.json
@@ -1,35 +0,0 @@
-{
-  "name": "@mosaicstack/mosaic-as",
-  "version": "0.0.1",
-  "type": "module",
-  "private": true,
-  "repository": {
-    "type": "git",
-    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
-    "directory": "apps/appservice"
-  },
-  "main": "dist/main.js",
-  "bin": {
-    "mosaic-as": "dist/main.js",
-    "mosaic-as-registration": "dist/registration-main.js"
-  },
-  "scripts": {
-    "build": "tsc",
-    "lint": "eslint src",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests",
-    "dev": "tsx watch src/main.ts"
-  },
-  "dependencies": {
-    "@mosaicstack/appservice": "workspace:*"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.8.0",
-    "vitest": "^2.0.0"
-  },
-  "files": [
-    "dist"
-  ]
-}
--- a/apps/appservice/src/tests/server.test.ts
+++ b/apps/appservice/src/tests/server.test.ts
@@ -1,388 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-
-import { AppserviceDaemon } from '../server.js';
-import type { DaemonConfig, DaemonRequest } from '../server.js';
-
-const AGENTS_TYPE = 'org.uscllc.mosaic_as.agents';
-
-const cfg: DaemonConfig = {
-  homeserverUrl: 'https://hs.example',
-  domain: 'hs.example',
-  asToken: 'as-secret',
-  hsToken: 'hs-secret',
-  bridgeTokens: ['bridge-secret'],
-};
-
-const jsonResponse = (status: number, body: unknown): Response =>
-  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
-
-const request = (overrides: Partial<DaemonRequest>): DaemonRequest => ({
-  method: 'GET',
-  path: '/',
-  searchParams: new URLSearchParams(),
-  body: undefined,
-  ...overrides,
-});
-
-const makeDaemon = () => {
-  const fetchMock = vi.fn(async (_input: URL | string) => jsonResponse(200, { event_id: '$sent' }));
-  const daemon = new AppserviceDaemon(cfg, fetchMock as unknown as typeof fetch, () => {});
-  return { daemon, fetchMock };
-};
-
-describe('AppserviceDaemon routing', () => {
-  it('serves health unauthenticated', async () => {
-    const { daemon } = makeDaemon();
-    expect((await daemon.handle(request({ path: '/health' }))).status).toBe(200);
-  });
-
-  it('404s unknown paths', async () => {
-    const { daemon } = makeDaemon();
-    expect((await daemon.handle(request({ path: '/nope' }))).status).toBe(404);
-  });
-
-  it('transactions require the hs_token', async () => {
-    const { daemon } = makeDaemon();
-    const bad = await daemon.handle(
-      request({
-        method: 'PUT',
-        path: '/_matrix/app/v1/transactions/t1',
-        authorizationHeader: 'Bearer wrong',
-        body: { events: [] },
-      }),
-    );
-    expect(bad.status).toBe(403);
-    const ok = await daemon.handle(
-      request({
-        method: 'PUT',
-        path: '/_matrix/app/v1/transactions/t1',
-        authorizationHeader: 'Bearer hs-secret',
-        body: { events: [{ type: 'm.room.message', event_id: '$e' }] },
-      }),
-    );
-    expect(ok.status).toBe(200);
-  });
-
-  it('bridge requires a bridge token (hs/as tokens do not work)', async () => {
-    const { daemon } = makeDaemon();
-    for (const token of [undefined, 'Bearer hs-secret', 'Bearer as-secret', 'Bearer nope']) {
-      const res = await daemon.handle(
-        request({
-          method: 'POST',
-          path: '/bridge/v1/messages',
-          authorizationHeader: token,
-          body: {},
-        }),
-      );
-      expect(res.status).toBe(403);
-    }
-  });
-
-  it('bridge message sends as the agent and returns the event id', async () => {
-    const { daemon, fetchMock } = makeDaemon();
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/messages',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { room_id: '!r:hs.example', agent: 'pi0-web1', body: 'hi', thread_root: '$req' },
-      }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.body.event_id).toBe('$sent');
-    const sendCall = fetchMock.mock.calls
-      .map((c) => new URL(String(c[0])))
-      .find((u) => u.pathname.includes('/send/m.room.message/'));
-    expect(sendCall).toBeDefined();
-    expect(sendCall!.searchParams.get('user_id')).toBe('@agent-pi0-web1:hs.example');
-  });
-
-  it('bridge rejects invalid payloads with 400', async () => {
-    const { daemon } = makeDaemon();
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/messages',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { room_id: 'bad', agent: 'pi0', body: 'x' },
-      }),
-    );
-    expect(res.status).toBe(400);
-  });
-
-  it('bridge typing endpoint works', async () => {
-    const { daemon, fetchMock } = makeDaemon();
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/typing',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { room_id: '!r:hs.example', agent: 'pi0-web1', typing: true },
-      }),
-    );
-    expect(res.status).toBe(200);
-    const typingCall = fetchMock.mock.calls
-      .map((c) => new URL(String(c[0])))
-      .find((u) => u.pathname.includes('/typing/'));
-    expect(typingCall).toBeDefined();
-  });
-
-  it('authenticated unknown bridge sub-paths return 405, never fall through', async () => {
-    const { daemon } = makeDaemon();
-    const res = await daemon.handle(
-      request({
-        method: 'GET',
-        path: '/bridge/v1/unknown',
-        authorizationHeader: 'Bearer bridge-secret',
-      }),
-    );
-    expect(res.status).toBe(405);
-  });
-
-  it('provisions a room as the AS sender with space linking', async () => {
-    const calls: Array<{ url: URL; body: unknown }> = [];
-    const fetchMock = vi.fn(async (input: URL | string, init?: RequestInit) => {
-      const url = new URL(String(input));
-      calls.push({ url, body: init?.body ? JSON.parse(String(init.body)) : undefined });
-      if (url.pathname.endsWith('/createRoom'))
-        return jsonResponse(200, { room_id: '!new:hs.example' });
-      return jsonResponse(200, {});
-    });
-    const daemon = new AppserviceDaemon(cfg, fetchMock as unknown as typeof fetch, () => {});
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/provision/rooms',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: {
-          name: 'proj-x',
-          alias: 'mosaic-proj-x',
-          invite: ['@jason.woltje:hs.example'],
-          space_id: '!space:hs.example',
-        },
-      }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.body.room_id).toBe('!new:hs.example');
-    expect(res.body.space_linked).toBe(true);
-    const create = calls.find((c) => c.url.pathname.endsWith('/createRoom'));
-    expect(create!.url.searchParams.get('user_id')).toBe('@mosaic-as:hs.example');
-    const body = create!.body as Record<string, unknown>;
-    expect(body.room_alias_name).toBe('mosaic-proj-x');
-    expect((body.power_level_content_override as Record<string, unknown>).users).toEqual({
-      '@mosaic-as:hs.example': 100,
-    });
-    expect(calls.some((c) => c.url.pathname.includes('/state/m.space.child/'))).toBe(true);
-    expect(calls.some((c) => c.url.pathname.includes('/state/m.space.parent/'))).toBe(true);
-  });
-
-  it('space-link failure still returns the room id (no orphan)', async () => {
-    const fetchMock = vi.fn(async (input: URL | string) => {
-      const url = new URL(String(input));
-      if (url.pathname.endsWith('/createRoom'))
-        return jsonResponse(200, { room_id: '!new:hs.example' });
-      if (url.pathname.includes('/state/m.space.child/'))
-        return jsonResponse(403, { errcode: 'M_FORBIDDEN', error: 'no PL in space' });
-      return jsonResponse(200, {});
-    });
-    const daemon = new AppserviceDaemon(cfg, fetchMock as unknown as typeof fetch, () => {});
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/provision/rooms',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { name: 'proj-x', space_id: '!space:hs.example' },
-      }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.body.room_id).toBe('!new:hs.example');
-    expect(res.body.space_linked).toBe(false);
-    expect(String(res.body.space_error)).toContain('403');
-  });
-
-  it('invite list cap enforced', async () => {
-    const { daemon } = makeDaemon();
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/provision/rooms',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { name: 'x', invite: Array.from({ length: 51 }, (_, i) => `@u${i}:hs`) },
-      }),
-    );
-    expect(res.status).toBe(400);
-  });
-
-  it('provision rejects bad payloads and requires auth', async () => {
-    const { daemon } = makeDaemon();
-    const noAuth = await daemon.handle(
-      request({ method: 'POST', path: '/bridge/v1/provision/rooms', body: { name: 'x' } }),
-    );
-    expect(noAuth.status).toBe(403);
-    const bad = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/provision/rooms',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { name: '', alias: 'BAD ALIAS' },
-      }),
-    );
-    expect(bad.status).toBe(400);
-  });
-
-  // A daemon whose fetch mock backs account_data with a mutable in-test object,
-  // so register/verify/revoke round-trip through the (faked) homeserver.
-  const makeAgentDaemon = () => {
-    const accountData: { value: Record<string, unknown> | null } = { value: null };
-    const fetchMock = vi.fn(async (input: URL | string, init?: RequestInit) => {
-      const url = new URL(String(input));
-      const path = url.pathname;
-      if (path.includes(`/account_data/${AGENTS_TYPE}`)) {
-        if (init?.method === 'PUT') {
-          accountData.value = JSON.parse(String(init.body)) as Record<string, unknown>;
-          return jsonResponse(200, {});
-        }
-        if (accountData.value === null) {
-          return jsonResponse(404, { errcode: 'M_NOT_FOUND', error: 'not found' });
-        }
-        return jsonResponse(200, accountData.value);
-      }
-      if (path.endsWith('/register')) return jsonResponse(200, { user_id: 'whatever' });
-      if (path.includes('/send/m.room.message/')) return jsonResponse(200, { event_id: '$sent' });
-      return jsonResponse(200, {});
-    });
-    const daemon = new AppserviceDaemon(cfg, fetchMock as unknown as typeof fetch, () => {});
-    return { daemon, fetchMock };
-  };
-
-  const registerAgent = async (
-    daemon: AppserviceDaemon,
-    body: Record<string, unknown> = { alias: 'pi0', host: 'web1' },
-  ) =>
-    daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/agents',
-        authorizationHeader: 'Bearer bridge-secret',
-        body,
-      }),
-    );
-
-  it('host token registers an agent and returns agent_user_id + bridge_token', async () => {
-    const { daemon, fetchMock } = makeAgentDaemon();
-    const res = await registerAgent(daemon, { alias: 'pi0', host: 'web1' });
-    expect(res.status).toBe(200);
-    expect(res.body.agent_user_id).toBe('@agent-pi0-web1:hs.example');
-    expect(String(res.body.bridge_token).startsWith('magt_')).toBe(true);
-    const registerCall = fetchMock.mock.calls
-      .map((c) => new URL(String(c[0])))
-      .find((u) => u.pathname.endsWith('/register'));
-    expect(registerCall).toBeDefined();
-  });
-
-  it('register requires a HOST token (agent token and no token are 403)', async () => {
-    const { daemon } = makeAgentDaemon();
-    const minted = await registerAgent(daemon);
-    const agentToken = String(minted.body.bridge_token);
-
-    const asAgent = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/agents',
-        authorizationHeader: `Bearer ${agentToken}`,
-        body: { alias: 'pi1', host: 'web2' },
-      }),
-    );
-    expect(asAgent.status).toBe(403);
-
-    const noAuth = await daemon.handle(
-      request({ method: 'POST', path: '/bridge/v1/agents', body: { alias: 'pi1', host: 'web2' } }),
-    );
-    expect(noAuth.status).toBe(403);
-  });
-
-  it('agent-scoped token may send as itself but not as another agent', async () => {
-    const { daemon } = makeAgentDaemon();
-    const minted = await registerAgent(daemon, { alias: 'pi0', host: 'web1' });
-    const agentToken = String(minted.body.bridge_token);
-
-    const self = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/messages',
-        authorizationHeader: `Bearer ${agentToken}`,
-        body: { room_id: '!r:hs.example', agent: 'pi0-web1', body: 'hi' },
-      }),
-    );
-    expect(self.status).toBe(200);
-
-    const other = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/messages',
-        authorizationHeader: `Bearer ${agentToken}`,
-        body: { room_id: '!r:hs.example', agent: 'pi9-web9', body: 'hi' },
-      }),
-    );
-    expect(other.status).toBe(403);
-    expect(other.body.error).toBe('token not scoped to this agent');
-  });
-
-  it('revoked agent token is rejected on messages', async () => {
-    const { daemon } = makeAgentDaemon();
-    const minted = await registerAgent(daemon, { alias: 'pi0', host: 'web1' });
-    const agentToken = String(minted.body.bridge_token);
-
-    const revoke = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/agents/revoke',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: { agent_user_id: '@agent-pi0-web1:hs.example' },
-      }),
-    );
-    expect(revoke.status).toBe(200);
-    expect(revoke.body.revoked).toBe(1);
-
-    const afterRevoke = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/messages',
-        authorizationHeader: `Bearer ${agentToken}`,
-        body: { room_id: '!r:hs.example', agent: 'pi0-web1', body: 'hi' },
-      }),
-    );
-    expect(afterRevoke.status).toBe(403);
-  });
-
-  it('GET /bridge/v1/agents lists registered agents (host only)', async () => {
-    const { daemon } = makeAgentDaemon();
-    await registerAgent(daemon, { alias: 'pi0', host: 'web1', display_name: 'Pi Zero' });
-
-    const res = await daemon.handle(
-      request({
-        method: 'GET',
-        path: '/bridge/v1/agents',
-        authorizationHeader: 'Bearer bridge-secret',
-      }),
-    );
-    expect(res.status).toBe(200);
-    const agents = res.body.agents as Array<Record<string, unknown>>;
-    expect(agents).toHaveLength(1);
-    expect(agents[0]?.agent_user_id).toBe('@agent-pi0-web1:hs.example');
-    expect(agents[0]?.display_name).toBe('Pi Zero');
-  });
-
-  it('empty bridge token list denies everything', async () => {
-    const daemon = new AppserviceDaemon({ ...cfg, bridgeTokens: [] }, undefined, () => {});
-    const res = await daemon.handle(
-      request({
-        method: 'POST',
-        path: '/bridge/v1/typing',
-        authorizationHeader: 'Bearer bridge-secret',
-        body: {},
-      }),
-    );
-    expect(res.status).toBe(403);
-  });
-});
--- a/apps/appservice/src/config.ts
+++ b/apps/appservice/src/config.ts
@@ -1,23 +0,0 @@
-import type { DaemonConfig } from './server.js';
-
-const required = (name: string): string => {
-  const value = process.env[name];
-  if (!value) throw new Error(`missing required env var ${name}`);
-  return value;
-};
-
-export function configFromEnv(): DaemonConfig & { port: number } {
-  return {
-    homeserverUrl: required('MOSAIC_AS_HOMESERVER_URL'),
-    domain: required('MOSAIC_AS_DOMAIN'),
-    asToken: required('MOSAIC_AS_TOKEN'),
-    hsToken: required('MOSAIC_HS_TOKEN'),
-    userPrefix: process.env.MOSAIC_AS_USER_PREFIX ?? 'agent-',
-    senderLocalpart: process.env.MOSAIC_AS_SENDER_LOCALPART ?? 'mosaic-as',
-    bridgeTokens: (process.env.MOSAIC_AS_BRIDGE_TOKENS ?? '')
-      .split(',')
-      .map((t) => t.trim())
-      .filter(Boolean),
-    port: Number(process.env.MOSAIC_AS_PORT ?? 8008),
-  };
-}
--- a/apps/appservice/src/main.ts
+++ b/apps/appservice/src/main.ts
@@ -1,67 +0,0 @@
-import http from 'node:http';
-
-import { configFromEnv } from './config.js';
-import { AppserviceDaemon } from './server.js';
-
-const cfg = configFromEnv();
-const daemon = new AppserviceDaemon(cfg);
-
-const MAX_BODY_BYTES = 1024 * 1024;
-
-const server = http.createServer((req, res) => {
-  const chunks: Buffer[] = [];
-  let received = 0;
-  let rejected = false;
-  req.on('data', (chunk: Buffer) => {
-    received += chunk.length;
-    if (received > MAX_BODY_BYTES) {
-      rejected = true;
-      res.writeHead(413, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ errcode: 'M_TOO_LARGE', error: 'request body too large' }));
-      req.destroy();
-      return;
-    }
-    chunks.push(chunk);
-  });
-  req.on('end', () => {
-    if (rejected) return;
-    void (async () => {
-      const url = new URL(req.url ?? '/', 'http://localhost');
-      let body: unknown;
-      try {
-        const raw = Buffer.concat(chunks).toString();
-        body = raw ? JSON.parse(raw) : undefined;
-      } catch {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ errcode: 'M_NOT_JSON', error: 'invalid json' }));
-        return;
-      }
-      const result = await daemon.handle({
-        method: req.method ?? 'GET',
-        path: url.pathname,
-        searchParams: url.searchParams,
-        authorizationHeader: req.headers.authorization,
-        body,
-      });
-      res.writeHead(result.status, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(result.body));
-    })().catch((error: unknown) => {
-      console.error('request failed:', error);
-      if (res.headersSent) {
-        res.destroy();
-        return;
-      }
-      res.writeHead(500, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ error: 'internal error' }));
-    });
-  });
-});
-
-server.listen(cfg.port, () => {
-  console.log(
-    `mosaic-as listening on :${cfg.port} (homeserver ${cfg.homeserverUrl}, domain ${cfg.domain})`,
-  );
-  if (cfg.bridgeTokens.length === 0) {
-    console.warn('WARNING: MOSAIC_AS_BRIDGE_TOKENS is empty — bridge API will deny all requests');
-  }
-});
--- a/apps/appservice/src/registration-main.ts
+++ b/apps/appservice/src/registration-main.ts
@@ -1,10 +0,0 @@
-import { buildRegistration, registrationToYaml } from '@mosaicstack/appservice';
-
-import { configFromEnv } from './config.js';
-
-// Prints the Synapse registration YAML (mosaic-as.yaml) for the current env.
-// Usage: MOSAIC_AS_URL=http://mosaic-as:8008 mosaic-as-registration > mosaic-as.yaml
-const cfg = configFromEnv();
-const url = process.env.MOSAIC_AS_URL;
-if (!url) throw new Error('missing required env var MOSAIC_AS_URL');
-process.stdout.write(registrationToYaml(buildRegistration(cfg, { url })));
--- a/apps/appservice/src/server.ts
+++ b/apps/appservice/src/server.ts
@@ -1,225 +0,0 @@
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-
-import {
-  AgentTokenStore,
-  AppserviceIntent,
-  TransactionHandler,
-  validateBridgeMessage,
-  validateBridgeTyping,
-  validateProvisionRoom,
-  validateRegisterAgent,
-  validateRevokeAgent,
-} from '@mosaicstack/appservice';
-import type { AppserviceConfig, MatrixEvent } from '@mosaicstack/appservice';
-
-export interface DaemonConfig extends AppserviceConfig {
-  /** Bearer tokens accepted on /bridge/v1/* (one per agent-comms host daemon). */
-  bridgeTokens: string[];
-}
-
-export interface DaemonRequest {
-  method: string;
-  /** URL path without query string. */
-  path: string;
-  searchParams: URLSearchParams;
-  authorizationHeader?: string;
-  body: unknown;
-}
-
-export interface DaemonResponse {
-  status: number;
-  body: Record<string, unknown>;
-}
-
-// Compare equal-length HMAC digests so neither content nor LENGTH of the
-// stored secret is observable through timing.
-const HMAC_KEY = randomBytes(32);
-const digest = (value: string): Buffer => createHmac('sha256', HMAC_KEY).update(value).digest();
-
-const safeEqual = (a: string, b: string): boolean => timingSafeEqual(digest(a), digest(b));
-
-const TXN_PATH = /^\/_matrix\/app\/v1\/transactions\/([^/]+)$/;
-
-/**
- * Resolved identity for an authenticated /bridge/v1/* caller. Host principals
- * (the agent-comms host daemons) are unrestricted; agent principals are scoped
- * to a single virtual user and may only act as themselves.
- */
-export type BridgePrincipal = { kind: 'host' } | { kind: 'agent'; agentUserId: string } | null;
-
-/**
- * HTTP-framework-agnostic request router for the mosaic-as daemon: the
- * Application Service transactions endpoint (Synapse-facing) plus the
- * internal bridge API v1 (agent-comms daemon-facing). main.ts binds this to
- * node:http; tests drive it directly.
- */
-export class AppserviceDaemon {
-  readonly intent: AppserviceIntent;
-  private readonly transactions: TransactionHandler;
-  private readonly agents: AgentTokenStore;
-
-  constructor(
-    private readonly cfg: DaemonConfig,
-    fetchImpl?: typeof fetch,
-    private readonly log: (line: string) => void = (line) => console.log(line),
-  ) {
-    this.intent = new AppserviceIntent(cfg, fetchImpl);
-    this.agents = new AgentTokenStore(this.intent);
-    this.transactions = new TransactionHandler({
-      hsToken: cfg.hsToken,
-      onEvent: (event) => this.onEvent(event),
-      onError: (error, txnId) => this.log(`txn ${txnId} handler error: ${String(error)}`),
-    });
-  }
-
-  /** v1: the daemon only observes; room logic lives in the agent-comms daemons. */
-  private onEvent(event: MatrixEvent): void {
-    if (event.type === 'm.room.message') {
-      this.log(
-        `event ${event.event_id ?? '?'} in ${event.room_id ?? '?'} from ${event.sender ?? '?'}`,
-      );
-    }
-  }
-
-  /** Resolve the calling principal, or null when unauthorized. Fail-closed:
-   * host tokens win (timing-safe compare); otherwise a magt_* bearer is looked
-   * up in the agent token store; anything else is rejected. */
-  private async bridgeAuthorized(
-    authorizationHeader: string | undefined,
-  ): Promise<BridgePrincipal> {
-    if (!authorizationHeader?.startsWith('Bearer ')) return null;
-    const presented = authorizationHeader.slice('Bearer '.length);
-    if (this.cfg.bridgeTokens.some((token) => safeEqual(presented, token))) {
-      return { kind: 'host' };
-    }
-    const agentUserId = await this.agents.verifyToken(presented);
-    if (agentUserId) return { kind: 'agent', agentUserId };
-    return null;
-  }
-
-  async handle(req: DaemonRequest): Promise<DaemonResponse> {
-    if (req.method === 'GET' && req.path === '/health') {
-      return { status: 200, body: { ok: true } };
-    }
-
-    const txnMatch = req.method === 'PUT' ? TXN_PATH.exec(req.path) : null;
-    if (txnMatch?.[1] !== undefined) {
-      return this.transactions.handle(txnMatch[1], req.body, {
-        authorizationHeader: req.authorizationHeader,
-        accessTokenParam: req.searchParams.get('access_token') ?? undefined,
-      });
-    }
-
-    if (req.path.startsWith('/bridge/v1/')) {
-      const principal = await this.bridgeAuthorized(req.authorizationHeader);
-      if (!principal) {
-        return { status: 403, body: { errcode: 'M_FORBIDDEN', error: 'bad bridge token' } };
-      }
-      try {
-        if (req.method === 'POST' && req.path === '/bridge/v1/agents') {
-          if (principal.kind !== 'host') {
-            return {
-              status: 403,
-              body: { errcode: 'M_FORBIDDEN', error: 'agents cannot register agents' },
-            };
-          }
-          validateRegisterAgent(req.body);
-          const { agentUserId, token } = await this.agents.register({
-            alias: req.body.alias,
-            host: req.body.host,
-            displayName: req.body.display_name,
-          });
-          this.log(`registered agent ${agentUserId}`);
-          return { status: 200, body: { agent_user_id: agentUserId, bridge_token: token } };
-        }
-        if (req.method === 'POST' && req.path === '/bridge/v1/agents/revoke') {
-          if (principal.kind !== 'host') {
-            return {
-              status: 403,
-              body: { errcode: 'M_FORBIDDEN', error: 'agents cannot revoke agents' },
-            };
-          }
-          validateRevokeAgent(req.body);
-          const revoked = await this.agents.revoke(req.body.agent_user_id);
-          this.log(`revoked ${revoked} token(s) for ${req.body.agent_user_id}`);
-          return { status: 200, body: { revoked } };
-        }
-        if (req.method === 'GET' && req.path === '/bridge/v1/agents') {
-          if (principal.kind !== 'host') {
-            return {
-              status: 403,
-              body: { errcode: 'M_FORBIDDEN', error: 'agents cannot list agents' },
-            };
-          }
-          const agents = await this.agents.list();
-          return { status: 200, body: { agents } };
-        }
-        if (req.method === 'POST' && req.path === '/bridge/v1/messages') {
-          validateBridgeMessage(req.body);
-          if (
-            principal.kind === 'agent' &&
-            this.intent.agentUserId(req.body.agent) !== principal.agentUserId
-          ) {
-            return {
-              status: 403,
-              body: { errcode: 'M_FORBIDDEN', error: 'token not scoped to this agent' },
-            };
-          }
-          const eventId = await this.intent.sendAsAgent({
-            roomId: req.body.room_id,
-            agent: req.body.agent,
-            body: req.body.body,
-            threadRoot: req.body.thread_root,
-            msgtype: req.body.msgtype,
-            extraContent: req.body.extra_content,
-          });
-          return { status: 200, body: { event_id: eventId ?? null } };
-        }
-        if (req.method === 'POST' && req.path === '/bridge/v1/typing') {
-          validateBridgeTyping(req.body);
-          if (
-            principal.kind === 'agent' &&
-            this.intent.agentUserId(req.body.agent) !== principal.agentUserId
-          ) {
-            return {
-              status: 403,
-              body: { errcode: 'M_FORBIDDEN', error: 'token not scoped to this agent' },
-            };
-          }
-          await this.intent.setTyping(req.body.room_id, req.body.agent, req.body.typing);
-          return { status: 200, body: {} };
-        }
-        if (req.method === 'POST' && req.path === '/bridge/v1/provision/rooms') {
-          validateProvisionRoom(req.body);
-          const result = await this.intent.createRoom({
-            name: req.body.name,
-            alias: req.body.alias,
-            topic: req.body.topic,
-            invite: req.body.invite,
-            spaceId: req.body.space_id,
-          });
-          this.log(
-            `provisioned room ${result.roomId} (${req.body.name}) space_linked=${result.spaceLinked}`,
-          );
-          return {
-            status: 200,
-            body: {
-              room_id: result.roomId,
-              space_linked: result.spaceLinked,
-              ...(result.spaceError ? { space_error: result.spaceError } : {}),
-            },
-          };
-        }
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        this.log(`bridge error ${req.method} ${req.path}: ${message}`);
-        return { status: 400, body: { error: message } };
-      }
-      // Explicit: never fall out of the authenticated bridge block, so future
-      // sub-paths cannot accidentally route around the auth guard above.
-      return { status: 405, body: { error: 'unsupported bridge method/path' } };
-    }
-
-    return { status: 404, body: { error: 'not found' } };
-  }
-}
--- a/apps/appservice/tsconfig.json
+++ b/apps/appservice/tsconfig.json
@@ -1,9 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}
--- a/apps/gateway/package.json
+++ b/apps/gateway/package.json
@@ -3,7 +3,7 @@
  "version": "0.0.6",
  "repository": {
    "type": "git",
-    "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
+    "url": "https://git.mosaicstack.dev/mosaicstack/mosaic-stack.git",
    "directory": "apps/gateway"
  },
  "type": "module",
@@ -56,7 +56,6 @@
    "@opentelemetry/sdk-metrics": "^2.6.0",
    "@opentelemetry/sdk-node": "^0.213.0",
    "@opentelemetry/semantic-conventions": "^1.40.0",
-    "@peculiar/x509": "^2.0.0",
    "@sinclair/typebox": "^0.34.48",
    "better-auth": "^1.5.5",
    "bullmq": "^5.71.0",
@@ -64,16 +63,12 @@
    "class-validator": "^0.15.1",
    "dotenv": "^17.3.1",
    "fastify": "^5.0.0",
-    "ioredis": "^5.10.0",
-    "jose": "^6.2.2",
    "node-cron": "^4.2.1",
    "openai": "^6.32.0",
-    "postgres": "^3.4.8",
    "reflect-metadata": "^0.2.0",
    "rxjs": "^7.8.0",
    "socket.io": "^4.8.0",
    "uuid": "^11.0.0",
-    "undici": "^7.24.6",
    "zod": "^4.3.6"
  },
  "devDependencies": {
--- a/apps/gateway/src/tests/integration/federated-boot.pg-unreachable.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federated-boot.pg-unreachable.integration.test.ts
@@ -1,64 +0,0 @@
-/**
- * Test B — Gateway boot refuses (fail-fast) when PG is unreachable.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- *         (Valkey must be running; only PG is intentionally misconfigured.)
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-boot.pg-unreachable.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import net from 'node:net';
-import { beforeAll, describe, expect, it } from 'vitest';
-import { TierDetectionError, detectAndAssertTier } from '@mosaicstack/storage';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const VALKEY_URL = 'redis://localhost:6380';
-
-/**
- * Reserves a guaranteed-closed port at runtime by binding to an ephemeral OS
- * port (port 0) and immediately releasing it. The OS will not reassign the
- * port during the TIME_WAIT window, so it remains closed for the duration of
- * this test.
- */
-async function reserveClosedPort(): Promise<number> {
-  return new Promise((resolve, reject) => {
-    const server = net.createServer();
-    server.listen(0, '127.0.0.1', () => {
-      const addr = server.address();
-      if (typeof addr !== 'object' || !addr) return reject(new Error('no addr'));
-      const port = addr.port;
-      server.close(() => resolve(port));
-    });
-    server.on('error', reject);
-  });
-}
-
-describe.skipIf(!run)('federated boot — PG unreachable', () => {
-  let badPgUrl: string;
-
-  beforeAll(async () => {
-    const closedPort = await reserveClosedPort();
-    badPgUrl = `postgresql://mosaic:mosaic@localhost:${closedPort}/mosaic`;
-  });
-
-  it('detectAndAssertTier throws TierDetectionError with service: postgres when PG is down', async () => {
-    const brokenConfig = {
-      tier: 'federated' as const,
-      storage: {
-        type: 'postgres' as const,
-        url: badPgUrl,
-        enableVector: true,
-      },
-      queue: {
-        type: 'bullmq',
-        url: VALKEY_URL,
-      },
-    };
-
-    await expect(detectAndAssertTier(brokenConfig)).rejects.toSatisfy(
-      (err: unknown) => err instanceof TierDetectionError && err.service === 'postgres',
-    );
-  }, 10_000);
-});
--- a/apps/gateway/src/tests/integration/federated-boot.success.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federated-boot.success.integration.test.ts
@@ -1,50 +0,0 @@
-/**
- * Test A — Gateway boot succeeds when federated services are up.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-boot.success.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import postgres from 'postgres';
-import { afterAll, describe, expect, it } from 'vitest';
-import { detectAndAssertTier } from '@mosaicstack/storage';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const VALKEY_URL = 'redis://localhost:6380';
-
-const federatedConfig = {
-  tier: 'federated' as const,
-  storage: {
-    type: 'postgres' as const,
-    url: PG_URL,
-    enableVector: true,
-  },
-  queue: {
-    type: 'bullmq',
-    url: VALKEY_URL,
-  },
-};
-
-describe.skipIf(!run)('federated boot — success path', () => {
-  let sql: ReturnType<typeof postgres> | undefined;
-
-  afterAll(async () => {
-    if (sql) {
-      await sql.end({ timeout: 2 }).catch(() => {});
-    }
-  });
-
-  it('detectAndAssertTier resolves without throwing when federated services are up', async () => {
-    await expect(detectAndAssertTier(federatedConfig)).resolves.toBeUndefined();
-  }, 10_000);
-
-  it('pgvector extension is registered (pg_extension row exists)', async () => {
-    sql = postgres(PG_URL, { max: 1, connect_timeout: 5, idle_timeout: 5 });
-    const rows = await sql`SELECT * FROM pg_extension WHERE extname = 'vector'`;
-    expect(rows).toHaveLength(1);
-  }, 10_000);
-});
--- a/apps/gateway/src/tests/integration/federated-pgvector.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federated-pgvector.integration.test.ts
@@ -1,43 +0,0 @@
-/**
- * Test C — pgvector extension is functional end-to-end.
- *
- * Creates a temp table with a vector(3) column, inserts a row, and queries it
- * back — confirming the extension is not just registered but operational.
- *
- * Prereq: docker compose -f docker-compose.federated.yml --profile federated up -d
- * Run:    FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test src/__tests__/integration/federated-pgvector.integration.test.ts
- *
- * Skipped when FEDERATED_INTEGRATION !== '1'.
- */
-
-import postgres from 'postgres';
-import { afterAll, describe, expect, it } from 'vitest';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-
-let sql: ReturnType<typeof postgres> | undefined;
-
-afterAll(async () => {
-  if (sql) {
-    await sql.end({ timeout: 2 }).catch(() => {});
-  }
-});
-
-describe.skipIf(!run)('federated pgvector — functional end-to-end', () => {
-  it('vector ops round-trip: INSERT [1,2,3] and SELECT returns [1,2,3]', async () => {
-    sql = postgres(PG_URL, { max: 1, connect_timeout: 5, idle_timeout: 5 });
-
-    await sql`CREATE TEMP TABLE t (id int, embedding vector(3))`;
-    await sql`INSERT INTO t VALUES (1, '[1,2,3]')`;
-    const rows = await sql`SELECT embedding FROM t`;
-
-    expect(rows).toHaveLength(1);
-    // The postgres driver returns vector columns as strings like '[1,2,3]'.
-    // Normalise by parsing the string representation.
-    const raw = rows[0]?.['embedding'] as string;
-    const parsed = JSON.parse(raw) as number[];
-    expect(parsed).toEqual([1, 2, 3]);
-  }, 10_000);
-});
--- a/apps/gateway/src/tests/integration/federation-m2-e2e.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federation-m2-e2e.integration.test.ts
@@ -1,243 +0,0 @@
-/**
- * Federation M2 E2E test — peer-add enrollment flow (FED-M2-10).
- *
- * Covers MILESTONES.md acceptance test #6:
- *   "`peer add <url>` on Server A yields an `active` peer record with a valid cert + key"
- *
- * This test simulates two gateways using a single bootstrapped NestJS app:
- *   - "Server A": the admin API that generates a keypair and stores the cert
- *   - "Server B": the enrollment endpoint that signs the CSR
- *   Both share the same DB + Step-CA in the test environment.
- *
- * Prerequisites:
- *   docker compose -f docker-compose.federated.yml --profile federated up -d
- *
- * Run:
- *   FEDERATED_INTEGRATION=1 STEP_CA_AVAILABLE=1 \
- *   STEP_CA_URL=https://localhost:9000 \
- *   STEP_CA_PROVISIONER_KEY_JSON="$(docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json)" \
- *   STEP_CA_ROOT_CERT_PATH=/tmp/step-ca-root.crt \
- *   pnpm --filter @mosaicstack/gateway test \
- *     src/__tests__/integration/federation-m2-e2e.integration.test.ts
- *
- * Obtaining Step-CA credentials:
- *   # Extract provisioner key from running container:
- *   #   docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json
- *   # Copy root cert from container:
- *   #   docker cp $(docker ps -qf name=step-ca):/home/step/certs/root_ca.crt /tmp/step-ca-root.crt
- *   # Then: export STEP_CA_ROOT_CERT_PATH=/tmp/step-ca-root.crt
- *
- * Skipped unless both FEDERATED_INTEGRATION=1 and STEP_CA_AVAILABLE=1 are set.
- */
-
-import * as crypto from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { Test } from '@nestjs/testing';
-import { ValidationPipe } from '@nestjs/common';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import supertest from 'supertest';
-import {
-  createDb,
-  type Db,
-  type DbHandle,
-  federationPeers,
-  federationGrants,
-  federationEnrollmentTokens,
-  inArray,
-  eq,
-} from '@mosaicstack/db';
-import * as schema from '@mosaicstack/db';
-import { DB } from '../../database/database.module.js';
-import { AdminGuard } from '../../admin/admin.guard.js';
-import { FederationModule } from '../../federation/federation.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { EnrollmentService } from '../../federation/enrollment.service.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const stepCaRun =
-  run &&
-  process.env['STEP_CA_AVAILABLE'] === '1' &&
-  !!process.env['STEP_CA_URL'] &&
-  !!process.env['STEP_CA_PROVISIONER_KEY_JSON'] &&
-  !!process.env['STEP_CA_ROOT_CERT_PATH'];
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-
-const RUN_ID = crypto.randomUUID();
-
-describe.skipIf(!stepCaRun)('federation M2 E2E — peer add enrollment flow', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let app: NestFastifyApplication;
-  let agent: ReturnType<typeof supertest>;
-  let grantsService: GrantsService;
-  let enrollmentService: EnrollmentService;
-
-  const createdTokenGrantIds: string[] = [];
-  const createdGrantIds: string[] = [];
-  const createdPeerIds: string[] = [];
-  const createdUserIds: string[] = [];
-
-  beforeAll(async () => {
-    process.env['BETTER_AUTH_SECRET'] ??= 'test-e2e-sealing-key';
-
-    handle = createDb(PG_URL);
-    db = handle.db;
-
-    const moduleRef = await Test.createTestingModule({
-      imports: [FederationModule],
-      providers: [{ provide: DB, useValue: db }],
-    })
-      .overrideGuard(AdminGuard)
-      .useValue({ canActivate: () => true })
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-
-    agent = supertest(app.getHttpServer());
-
-    grantsService = moduleRef.get(GrantsService);
-    enrollmentService = moduleRef.get(EnrollmentService);
-  }, 30_000);
-
-  afterAll(async () => {
-    if (db && createdTokenGrantIds.length > 0) {
-      await db
-        .delete(federationEnrollmentTokens)
-        .where(inArray(federationEnrollmentTokens.grantId, createdTokenGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-    }
-    if (db && createdGrantIds.length > 0) {
-      await db
-        .delete(federationGrants)
-        .where(inArray(federationGrants.id, createdGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-    }
-    if (db && createdPeerIds.length > 0) {
-      await db
-        .delete(federationPeers)
-        .where(inArray(federationPeers.id, createdPeerIds))
-        .catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-    }
-    if (db && createdUserIds.length > 0) {
-      await db
-        .delete(schema.users)
-        .where(inArray(schema.users.id, createdUserIds))
-        .catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-    }
-    if (app)
-      await app.close().catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-    if (handle)
-      await handle.close().catch((e: unknown) => console.error('[federation-m2-e2e cleanup]', e));
-  });
-
-  // -------------------------------------------------------------------------
-  // #6 — peer add: keypair → enrollment → cert storage → active peer record
-  // -------------------------------------------------------------------------
-  it('#6 — peer add flow: keypair → enrollment → cert storage → active peer record', async () => {
-    // Create a subject user to satisfy FK on federation_grants.subject_user_id
-    const userId = crypto.randomUUID();
-    await db
-      .insert(schema.users)
-      .values({
-        id: userId,
-        name: `e2e-user-${RUN_ID}`,
-        email: `e2e-${RUN_ID}@federation-test.invalid`,
-        emailVerified: false,
-      })
-      .onConflictDoNothing();
-    createdUserIds.push(userId);
-
-    // ── Step A: "Server B" setup ─────────────────────────────────────────
-    // Server B admin creates a grant and generates an enrollment token to
-    // share out-of-band with Server A's operator.
-
-    // Insert a placeholder peer on "Server B" to satisfy the grant FK
-    const serverBPeerId = crypto.randomUUID();
-    await db
-      .insert(federationPeers)
-      .values({
-        id: serverBPeerId,
-        commonName: `server-b-peer-${RUN_ID}`,
-        displayName: 'Server B Placeholder',
-        certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-        certSerial: `serial-b-${serverBPeerId}`,
-        certNotAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
-        state: 'pending',
-      })
-      .onConflictDoNothing();
-    createdPeerIds.push(serverBPeerId);
-
-    const grant = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: { resources: ['tasks'], excluded_resources: [], max_rows_per_query: 100 },
-      peerId: serverBPeerId,
-    });
-    createdGrantIds.push(grant.id);
-    createdTokenGrantIds.push(grant.id);
-
-    const { token } = await enrollmentService.createToken({
-      grantId: grant.id,
-      peerId: serverBPeerId,
-      ttlSeconds: 900,
-    });
-
-    // ── Step B: "Server A" generates keypair ─────────────────────────────
-    const keypairRes = await agent
-      .post('/api/admin/federation/peers/keypair')
-      .send({
-        commonName: `e2e-peer-${RUN_ID.slice(0, 8)}`,
-        displayName: 'E2E Test Peer',
-        endpointUrl: 'https://test.invalid',
-      })
-      .set('Content-Type', 'application/json');
-
-    expect(keypairRes.status).toBe(201);
-    const { peerId, csrPem } = keypairRes.body as { peerId: string; csrPem: string };
-    expect(typeof peerId).toBe('string');
-    expect(csrPem).toContain('-----BEGIN CERTIFICATE REQUEST-----');
-    createdPeerIds.push(peerId);
-
-    // ── Step C: Enrollment (simulates Server A sending CSR to Server B) ──
-    const enrollRes = await agent
-      .post(`/api/federation/enrollment/${token}`)
-      .send({ csrPem })
-      .set('Content-Type', 'application/json');
-
-    expect(enrollRes.status).toBe(200);
-    const { certPem, certChainPem } = enrollRes.body as {
-      certPem: string;
-      certChainPem: string;
-    };
-    expect(certPem).toContain('-----BEGIN CERTIFICATE-----');
-    expect(certChainPem).toContain('-----BEGIN CERTIFICATE-----');
-
-    // ── Step D: "Server A" stores the cert ───────────────────────────────
-    const storeRes = await agent
-      .patch(`/api/admin/federation/peers/${peerId}/cert`)
-      .send({ certPem })
-      .set('Content-Type', 'application/json');
-
-    expect(storeRes.status).toBe(200);
-
-    // ── Step E: Verify peer record in DB ─────────────────────────────────
-    const [peer] = await db
-      .select()
-      .from(federationPeers)
-      .where(eq(federationPeers.id, peerId))
-      .limit(1);
-
-    expect(peer).toBeDefined();
-    expect(peer?.state).toBe('active');
-    expect(peer?.certPem).toContain('-----BEGIN CERTIFICATE-----');
-    expect(typeof peer?.certSerial).toBe('string');
-    expect((peer?.certSerial ?? '').length).toBeGreaterThan(0);
-    // clientKeyPem is a sealed ciphertext — must not be a raw PEM
-    expect(peer?.clientKeyPem?.startsWith('-----BEGIN')).toBe(false);
-    // certNotAfter must be in the future
-    expect(peer?.certNotAfter?.getTime()).toBeGreaterThan(Date.now());
-  }, 60_000);
-});
--- a/apps/gateway/src/tests/integration/federation-m2.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federation-m2.integration.test.ts
@@ -1,483 +0,0 @@
-/**
- * Federation M2 integration tests (FED-M2-09).
- *
- * Covers MILESTONES.md acceptance tests #1, #2, #3, #5, #7, #8.
- *
- * Prerequisites:
- *   docker compose -f docker-compose.federated.yml --profile federated up -d
- *
- * Run DB-only tests (no Step-CA):
- *   FEDERATED_INTEGRATION=1 BETTER_AUTH_SECRET=test-secret pnpm --filter @mosaicstack/gateway test \
- *     src/__tests__/integration/federation-m2.integration.test.ts
- *
- * Run all tests including Step-CA-dependent ones:
- *   FEDERATED_INTEGRATION=1 STEP_CA_AVAILABLE=1 \
- *   STEP_CA_URL=https://localhost:9000 \
- *   STEP_CA_PROVISIONER_KEY_JSON="$(docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json)" \
- *   STEP_CA_ROOT_CERT_PATH=/tmp/step-ca-root.crt \
- *   pnpm --filter @mosaicstack/gateway test \
- *     src/__tests__/integration/federation-m2.integration.test.ts
- *
- * Obtaining Step-CA credentials:
- *   # Extract provisioner key from running container:
- *   #   docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json
- *   # Copy root cert from container:
- *   #   docker cp $(docker ps -qf name=step-ca):/home/step/certs/root_ca.crt /tmp/step-ca-root.crt
- *   # Then: export STEP_CA_ROOT_CERT_PATH=/tmp/step-ca-root.crt
- */
-
-import * as crypto from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { Test } from '@nestjs/testing';
-import { GoneException } from '@nestjs/common';
-import { Pkcs10CertificateRequestGenerator, X509Certificate as PeculiarX509 } from '@peculiar/x509';
-import {
-  createDb,
-  type Db,
-  type DbHandle,
-  federationPeers,
-  federationGrants,
-  federationEnrollmentTokens,
-  inArray,
-  eq,
-} from '@mosaicstack/db';
-import * as schema from '@mosaicstack/db';
-import { seal } from '@mosaicstack/auth';
-import { DB } from '../../database/database.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { EnrollmentService } from '../../federation/enrollment.service.js';
-import { CaService } from '../../federation/ca.service.js';
-import { FederationScopeError } from '../../federation/scope-schema.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const stepCaRun = run && process.env['STEP_CA_AVAILABLE'] === '1';
-
-const PG_URL = 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-
-// ---------------------------------------------------------------------------
-// Helpers for test data isolation
-// ---------------------------------------------------------------------------
-
-/** Unique run prefix to identify rows created by this test run. */
-const RUN_ID = crypto.randomUUID();
-
-/** Insert a minimal user row to satisfy the FK on federation_grants.subject_user_id. */
-async function insertTestUser(db: Db, id: string): Promise<void> {
-  await db
-    .insert(schema.users)
-    .values({
-      id,
-      name: `test-user-${id}`,
-      email: `test-${id}@federation-test.invalid`,
-      emailVerified: false,
-    })
-    .onConflictDoNothing();
-}
-
-/** Insert a minimal peer row to satisfy the FK on federation_grants.peer_id. */
-async function insertTestPeer(db: Db, id: string, suffix: string = ''): Promise<void> {
-  await db
-    .insert(federationPeers)
-    .values({
-      id,
-      commonName: `test-peer-${RUN_ID}-${suffix}`,
-      displayName: `Test Peer ${suffix}`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `test-serial-${id}`,
-      certNotAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
-      state: 'pending',
-    })
-    .onConflictDoNothing();
-}
-
-// ---------------------------------------------------------------------------
-// DB-only test module (CaService mocked so env vars not required)
-// ---------------------------------------------------------------------------
-
-function buildDbModule(db: Db) {
-  return Test.createTestingModule({
-    providers: [
-      { provide: DB, useValue: db },
-      GrantsService,
-      {
-        provide: CaService,
-        useValue: {
-          issueCert: async () => {
-            throw new Error('CaService.issueCert should not be called in DB-only tests');
-          },
-        },
-      },
-      EnrollmentService,
-    ],
-  }).compile();
-}
-
-// ---------------------------------------------------------------------------
-// Test suite — DB-only (no Step-CA)
-// ---------------------------------------------------------------------------
-
-describe.skipIf(!run)('federation M2 — DB-only tests', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let grantsService: GrantsService;
-
-  /** IDs created during this run — cleaned up in afterAll. */
-  const createdGrantIds: string[] = [];
-  const createdPeerIds: string[] = [];
-  const createdUserIds: string[] = [];
-
-  beforeAll(async () => {
-    process.env['BETTER_AUTH_SECRET'] ??= 'test-integration-sealing-key-not-for-prod';
-
-    handle = createDb(PG_URL);
-    db = handle.db;
-
-    const moduleRef = await buildDbModule(db);
-    grantsService = moduleRef.get(GrantsService);
-  });
-
-  afterAll(async () => {
-    // Clean up in FK-safe order: tokens → grants → peers → users
-    if (db && createdGrantIds.length > 0) {
-      await db
-        .delete(federationEnrollmentTokens)
-        .where(inArray(federationEnrollmentTokens.grantId, createdGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-      await db
-        .delete(federationGrants)
-        .where(inArray(federationGrants.id, createdGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (db && createdPeerIds.length > 0) {
-      await db
-        .delete(federationPeers)
-        .where(inArray(federationPeers.id, createdPeerIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (db && createdUserIds.length > 0) {
-      await db
-        .delete(schema.users)
-        .where(inArray(schema.users.id, createdUserIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (handle)
-      await handle.close().catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-  });
-
-  // -------------------------------------------------------------------------
-  // #1 — grant create writes a pending row
-  // -------------------------------------------------------------------------
-  it('#1 — createGrant writes a pending row to DB', async () => {
-    const userId = crypto.randomUUID();
-    const peerId = crypto.randomUUID();
-    const validScope = {
-      resources: ['tasks'],
-      excluded_resources: [],
-      max_rows_per_query: 100,
-    };
-
-    await insertTestUser(db, userId);
-    await insertTestPeer(db, peerId, 'test1');
-    createdUserIds.push(userId);
-    createdPeerIds.push(peerId);
-
-    const grant = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: validScope,
-      peerId,
-    });
-
-    createdGrantIds.push(grant.id);
-
-    // Verify the row exists in DB with correct shape
-    const [row] = await db
-      .select()
-      .from(federationGrants)
-      .where(eq(federationGrants.id, grant.id))
-      .limit(1);
-
-    expect(row).toBeDefined();
-    expect(row?.status).toBe('pending');
-    expect(row?.peerId).toBe(peerId);
-    expect(row?.subjectUserId).toBe(userId);
-    const storedScope = row?.scope as Record<string, unknown>;
-    expect(storedScope['resources']).toEqual(['tasks']);
-    expect(storedScope['max_rows_per_query']).toBe(100);
-  }, 15_000);
-
-  // -------------------------------------------------------------------------
-  // #7 — scope with unknown resource type rejected
-  // -------------------------------------------------------------------------
-  it('#7 — createGrant rejects scope with unknown resource type', async () => {
-    const userId = crypto.randomUUID();
-    const peerId = crypto.randomUUID();
-    const invalidScope = {
-      resources: ['totally_unknown_resource'],
-      excluded_resources: [],
-      max_rows_per_query: 100,
-    };
-
-    await insertTestUser(db, userId);
-    await insertTestPeer(db, peerId, 'test7');
-    createdUserIds.push(userId);
-    createdPeerIds.push(peerId);
-
-    await expect(
-      grantsService.createGrant({
-        subjectUserId: userId,
-        scope: invalidScope,
-        peerId,
-      }),
-    ).rejects.toThrow(FederationScopeError);
-  }, 15_000);
-
-  // -------------------------------------------------------------------------
-  // #8 — listGrants returns accurate status for grants in various states
-  // -------------------------------------------------------------------------
-  it('#8 — listGrants returns accurate status for grants in various states', async () => {
-    const userId = crypto.randomUUID();
-    const peerId = crypto.randomUUID();
-    const validScope = {
-      resources: ['notes'],
-      excluded_resources: [],
-      max_rows_per_query: 50,
-    };
-
-    await insertTestUser(db, userId);
-    await insertTestPeer(db, peerId, 'test8');
-    createdUserIds.push(userId);
-    createdPeerIds.push(peerId);
-
-    // Create two pending grants via GrantsService
-    const grantA = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: validScope,
-      peerId,
-    });
-    const grantB = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: { resources: ['tasks'], excluded_resources: [], max_rows_per_query: 50 },
-      peerId,
-    });
-    createdGrantIds.push(grantA.id, grantB.id);
-
-    // Insert a third grant directly in 'revoked' state to test status variety
-    const [grantC] = await db
-      .insert(federationGrants)
-      .values({
-        id: crypto.randomUUID(),
-        subjectUserId: userId,
-        peerId,
-        scope: validScope,
-        status: 'revoked',
-        revokedAt: new Date(),
-      })
-      .returning();
-    createdGrantIds.push(grantC!.id);
-
-    // List all grants for this peer
-    const allForPeer = await grantsService.listGrants({ peerId });
-
-    const ourGrantIds = new Set([grantA.id, grantB.id, grantC!.id]);
-    const ourGrants = allForPeer.filter((g) => ourGrantIds.has(g.id));
-    expect(ourGrants).toHaveLength(3);
-
-    const pendingGrants = ourGrants.filter((g) => g.status === 'pending');
-    const revokedGrants = ourGrants.filter((g) => g.status === 'revoked');
-    expect(pendingGrants).toHaveLength(2);
-    expect(revokedGrants).toHaveLength(1);
-
-    // Status-filtered query
-    const pendingOnly = await grantsService.listGrants({ peerId, status: 'pending' });
-    const ourPending = pendingOnly.filter((g) => ourGrantIds.has(g.id));
-    expect(ourPending.every((g) => g.status === 'pending')).toBe(true);
-
-    // Verify peer list from DB also shows the peer rows with correct state
-    const peers = await db.select().from(federationPeers).where(eq(federationPeers.id, peerId));
-    expect(peers).toHaveLength(1);
-    expect(peers[0]?.state).toBe('pending');
-  }, 15_000);
-
-  // -------------------------------------------------------------------------
-  // #5 — client_key_pem encrypted at rest
-  // -------------------------------------------------------------------------
-  it('#5 — clientKeyPem stored in DB is a sealed ciphertext (not a valid PEM)', async () => {
-    const peerId = crypto.randomUUID();
-    const rawPem = '-----BEGIN PRIVATE KEY-----\nMOCK\n-----END PRIVATE KEY-----\n';
-    const sealed = seal(rawPem);
-
-    await db.insert(federationPeers).values({
-      id: peerId,
-      commonName: `test-peer-${RUN_ID}-sealed`,
-      displayName: 'Sealed Key Test Peer',
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `test-serial-sealed-${peerId}`,
-      certNotAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
-      state: 'pending',
-      clientKeyPem: sealed,
-    });
-    createdPeerIds.push(peerId);
-
-    const [row] = await db
-      .select()
-      .from(federationPeers)
-      .where(eq(federationPeers.id, peerId))
-      .limit(1);
-
-    expect(row).toBeDefined();
-    // The stored value must NOT be a valid PEM — it's a sealed ciphertext blob
-    expect(row?.clientKeyPem).toBeDefined();
-    expect(row?.clientKeyPem?.startsWith('-----BEGIN')).toBe(false);
-    // The sealed value should be non-trivial (at least 20 chars)
-    expect((row?.clientKeyPem ?? '').length).toBeGreaterThan(20);
-  }, 15_000);
-});
-
-// ---------------------------------------------------------------------------
-// Test suite — Step-CA gated
-// ---------------------------------------------------------------------------
-
-describe.skipIf(!stepCaRun)('federation M2 — Step-CA tests', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let grantsService: GrantsService;
-  let enrollmentService: EnrollmentService;
-
-  const createdGrantIds: string[] = [];
-  const createdPeerIds: string[] = [];
-  const createdUserIds: string[] = [];
-
-  beforeAll(async () => {
-    handle = createDb(PG_URL);
-    db = handle.db;
-
-    // Use real CaService — env vars (STEP_CA_URL, STEP_CA_PROVISIONER_KEY_JSON,
-    // STEP_CA_ROOT_CERT_PATH) must be set when STEP_CA_AVAILABLE=1
-    const moduleRef = await Test.createTestingModule({
-      providers: [{ provide: DB, useValue: db }, CaService, GrantsService, EnrollmentService],
-    }).compile();
-
-    grantsService = moduleRef.get(GrantsService);
-    enrollmentService = moduleRef.get(EnrollmentService);
-  });
-
-  afterAll(async () => {
-    if (db && createdGrantIds.length > 0) {
-      await db
-        .delete(federationEnrollmentTokens)
-        .where(inArray(federationEnrollmentTokens.grantId, createdGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-      await db
-        .delete(federationGrants)
-        .where(inArray(federationGrants.id, createdGrantIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (db && createdPeerIds.length > 0) {
-      await db
-        .delete(federationPeers)
-        .where(inArray(federationPeers.id, createdPeerIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (db && createdUserIds.length > 0) {
-      await db
-        .delete(schema.users)
-        .where(inArray(schema.users.id, createdUserIds))
-        .catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-    }
-    if (handle)
-      await handle.close().catch((e: unknown) => console.error('[federation-m2-test cleanup]', e));
-  });
-
-  /** Generate a P-256 key pair and PKCS#10 CSR, returning the CSR as PEM. */
-  async function generateCsrPem(cn: string): Promise<string> {
-    const alg = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' };
-    const keyPair = await crypto.subtle.generateKey(alg, true, ['sign', 'verify']);
-    const csr = await Pkcs10CertificateRequestGenerator.create({
-      name: `CN=${cn}`,
-      keys: keyPair,
-      signingAlgorithm: alg,
-    });
-    return csr.toString('pem');
-  }
-
-  // -------------------------------------------------------------------------
-  // #2 — enrollment signs CSR and returns cert
-  // -------------------------------------------------------------------------
-  it('#2 — redeem returns a certPem containing a valid PEM certificate', async () => {
-    const userId = crypto.randomUUID();
-    const peerId = crypto.randomUUID();
-    const validScope = {
-      resources: ['tasks'],
-      excluded_resources: [],
-      max_rows_per_query: 100,
-    };
-
-    await insertTestUser(db, userId);
-    await insertTestPeer(db, peerId, 'ca-test2');
-    createdUserIds.push(userId);
-    createdPeerIds.push(peerId);
-
-    const grant = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: validScope,
-      peerId,
-    });
-    createdGrantIds.push(grant.id);
-
-    const { token } = await enrollmentService.createToken({
-      grantId: grant.id,
-      peerId,
-      ttlSeconds: 900,
-    });
-
-    const csrPem = await generateCsrPem(`gateway-test-${RUN_ID.slice(0, 8)}`);
-    const result = await enrollmentService.redeem(token, csrPem);
-
-    expect(result.certPem).toContain('-----BEGIN CERTIFICATE-----');
-    expect(result.certChainPem).toContain('-----BEGIN CERTIFICATE-----');
-
-    // Verify the issued cert parses cleanly
-    const cert = new PeculiarX509(result.certPem);
-    expect(cert.serialNumber).toBeTruthy();
-  }, 30_000);
-
-  // -------------------------------------------------------------------------
-  // #3 — token single-use; second attempt returns GoneException
-  // -------------------------------------------------------------------------
-  it('#3 — second redeem of the same token throws GoneException', async () => {
-    const userId = crypto.randomUUID();
-    const peerId = crypto.randomUUID();
-    const validScope = {
-      resources: ['notes'],
-      excluded_resources: [],
-      max_rows_per_query: 50,
-    };
-
-    await insertTestUser(db, userId);
-    await insertTestPeer(db, peerId, 'ca-test3');
-    createdUserIds.push(userId);
-    createdPeerIds.push(peerId);
-
-    const grant = await grantsService.createGrant({
-      subjectUserId: userId,
-      scope: validScope,
-      peerId,
-    });
-    createdGrantIds.push(grant.id);
-
-    const { token } = await enrollmentService.createToken({
-      grantId: grant.id,
-      peerId,
-      ttlSeconds: 900,
-    });
-
-    const csrPem = await generateCsrPem(`gateway-test-replay-${RUN_ID.slice(0, 8)}`);
-
-    // First redeem must succeed
-    const result = await enrollmentService.redeem(token, csrPem);
-    expect(result.certPem).toContain('-----BEGIN CERTIFICATE-----');
-
-    // Second redeem with the same token must be rejected
-    await expect(enrollmentService.redeem(token, csrPem)).rejects.toThrow(GoneException);
-  }, 30_000);
-});
--- a/apps/gateway/src/tests/integration/federation-m3-list.integration.test.ts
+++ b/apps/gateway/src/tests/integration/federation-m3-list.integration.test.ts
@@ -1,519 +0,0 @@
-/**
- * Federation M3 single-gateway integration tests (FED-M3-10).
- *
- * Covers MILESTONES.md M3 acceptance:
- *  - #6: malformed certificate OIDs fail with 401; valid cert + revoked grant fails with 403.
- *  - #7: max_rows_per_query caps list results.
- *
- * Strategy:
- *  - Real PostgreSQL via @mosaicstack/db.
- *  - Mocked TLS context/Fastify request shim for FederationAuthGuard.
- *  - Direct controller calls using the real POST /api/federation/v1/list/:resource contract.
- *
- * Run:
- *   FEDERATED_INTEGRATION=1 pnpm --filter @mosaicstack/gateway test -- \
- *     src/__tests__/integration/federation-m3-list.integration.test.ts
- */
-
-import 'reflect-metadata';
-import * as crypto from 'node:crypto';
-import type { ExecutionContext } from '@nestjs/common';
-import { Test, type TestingModule } from '@nestjs/testing';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import {
-  and,
-  createDb,
-  eq,
-  federationGrants,
-  federationPeers,
-  inArray,
-  missionTasks,
-  missions,
-  projects,
-  tasks,
-  teamMembers,
-  teams,
-  type Db,
-  type DbHandle,
-  users,
-} from '@mosaicstack/db';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { DB } from '../../database/database.module.js';
-import { GrantsService } from '../../federation/grants.service.js';
-import { FederationAuthGuard } from '../../federation/server/federation-auth.guard.js';
-import { FederationScopeService } from '../../federation/server/scope.service.js';
-import { FederationListQueryService } from '../../federation/server/verbs/list-query.service.js';
-import { ListController } from '../../federation/server/verbs/list.controller.js';
-import {
-  makeMosaicIssuedCert,
-  makeSelfSignedCert,
-} from '../../federation/__tests__/helpers/test-cert.js';
-
-const run = process.env['FEDERATED_INTEGRATION'] === '1';
-const PG_URL = process.env['DATABASE_URL'] ?? 'postgresql://mosaic:mosaic@localhost:5433/mosaic';
-const RUN_ID = `fed-m3-10-${crypto.randomUUID()}`;
-const CERT_SERIAL_HEX = crypto.randomUUID().replace(/-/g, '').toUpperCase();
-
-interface TestIds {
-  readonly subjectUserId: string;
-  readonly otherUserId: string;
-  readonly peerId: string;
-  readonly revokedPeerId: string;
-  readonly activeGrantId: string;
-  readonly revokedGrantId: string;
-  readonly subjectProjectId: string;
-  readonly subjectMissionId: string;
-  readonly otherProjectId: string;
-  readonly teamId: string;
-  readonly unauthorizedTeamId: string;
-  readonly teamProjectId: string;
-  readonly taskIds: readonly string[];
-  readonly excludedTaskIds: readonly string[];
-  readonly subjectNoteId: string;
-  readonly otherUserNoteId: string;
-}
-
-function pemToDer(pem: string): Buffer {
-  return Buffer.from(
-    pem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, ''),
-    'base64',
-  );
-}
-
-function makeFederationRequest(certPem: string): FastifyRequest {
-  return {
-    raw: {
-      socket: {
-        getPeerCertificate: () => ({
-          raw: pemToDer(certPem),
-          serialNumber: CERT_SERIAL_HEX,
-        }),
-      },
-    },
-  } as unknown as FastifyRequest;
-}
-
-function makeGuardContext(request: FastifyRequest): {
-  readonly context: ExecutionContext;
-  readonly sent: { statusCode?: number; payload?: unknown };
-} {
-  const sent: { statusCode?: number; payload?: unknown } = {};
-  const reply = {
-    status: (statusCode: number) => {
-      sent.statusCode = statusCode;
-      return {
-        header: () => ({
-          send: (payload: unknown) => {
-            sent.payload = payload;
-          },
-        }),
-      };
-    },
-  } as unknown as FastifyReply;
-
-  const context = {
-    switchToHttp: () => ({
-      getRequest: () => request,
-      getResponse: () => reply,
-    }),
-  } as unknown as ExecutionContext;
-
-  return { context, sent };
-}
-
-async function insertUser(db: Db, id: string, label: string): Promise<void> {
-  await db.insert(users).values({
-    id,
-    name: `${RUN_ID}-${label}`,
-    email: `${RUN_ID}-${label}@federation-test.invalid`,
-    emailVerified: false,
-  });
-}
-
-async function seedFixtures(db: Db): Promise<TestIds> {
-  const subjectUserId = `${RUN_ID}-subject`;
-  const otherUserId = `${RUN_ID}-other`;
-  const peerId = crypto.randomUUID();
-  const revokedPeerId = crypto.randomUUID();
-  const activeGrantId = crypto.randomUUID();
-  const revokedGrantId = crypto.randomUUID();
-  const subjectProjectId = crypto.randomUUID();
-  const subjectMissionId = crypto.randomUUID();
-  const otherProjectId = crypto.randomUUID();
-  const teamId = crypto.randomUUID();
-  const unauthorizedTeamId = crypto.randomUUID();
-  const teamProjectId = crypto.randomUUID();
-  const taskIds = [crypto.randomUUID(), crypto.randomUUID(), crypto.randomUUID()] as const;
-  const excludedTaskIds = [crypto.randomUUID(), crypto.randomUUID()] as const;
-  const subjectNoteId = crypto.randomUUID();
-  const otherUserNoteId = crypto.randomUUID();
-
-  await insertUser(db, subjectUserId, 'subject');
-  await insertUser(db, otherUserId, 'other');
-
-  await db.insert(teams).values([
-    {
-      id: teamId,
-      name: `${RUN_ID} allowed team`,
-      slug: `${RUN_ID}-allowed-team`,
-      ownerId: subjectUserId,
-      managerId: subjectUserId,
-    },
-    {
-      id: unauthorizedTeamId,
-      name: `${RUN_ID} unauthorized team`,
-      slug: `${RUN_ID}-unauthorized-team`,
-      ownerId: otherUserId,
-      managerId: otherUserId,
-    },
-  ]);
-
-  await db.insert(teamMembers).values([
-    { teamId, userId: subjectUserId, role: 'member' },
-    { teamId: unauthorizedTeamId, userId: subjectUserId, role: 'member' },
-  ]);
-
-  await db.insert(projects).values([
-    {
-      id: subjectProjectId,
-      name: `${RUN_ID} subject personal project`,
-      ownerType: 'user',
-      ownerId: subjectUserId,
-    },
-    {
-      id: otherProjectId,
-      name: `${RUN_ID} other personal project`,
-      ownerType: 'user',
-      ownerId: otherUserId,
-    },
-    {
-      id: teamProjectId,
-      name: `${RUN_ID} unauthorized team project`,
-      ownerType: 'team',
-      teamId: unauthorizedTeamId,
-    },
-  ]);
-
-  await db.insert(missions).values({
-    id: subjectMissionId,
-    name: `${RUN_ID} subject mission`,
-    projectId: subjectProjectId,
-    userId: subjectUserId,
-  });
-
-  await db.insert(tasks).values([
-    {
-      id: taskIds[0],
-      title: `${RUN_ID} visible task 1`,
-      missionId: subjectMissionId,
-      createdAt: new Date('2026-06-25T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:00:00.000Z'),
-    },
-    {
-      id: taskIds[1],
-      title: `${RUN_ID} visible task 2`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T02:00:00.000Z'),
-    },
-    {
-      id: taskIds[2],
-      title: `${RUN_ID} visible task 3`,
-      projectId: subjectProjectId,
-      createdAt: new Date('2026-06-25T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T01:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[0],
-      title: `${RUN_ID} other user task`,
-      projectId: otherProjectId,
-      createdAt: new Date('2026-06-25T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:00:00.000Z'),
-    },
-    {
-      id: excludedTaskIds[1],
-      title: `${RUN_ID} unauthorized team task`,
-      projectId: teamProjectId,
-      createdAt: new Date('2026-06-25T05:00:00.000Z'),
-      updatedAt: new Date('2026-06-25T05:00:00.000Z'),
-    },
-  ]);
-
-  await db.insert(missionTasks).values([
-    {
-      id: subjectNoteId,
-      missionId: subjectMissionId,
-      userId: subjectUserId,
-      notes: `${RUN_ID} subject visible note`,
-      createdAt: new Date('2026-06-25T03:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T03:30:00.000Z'),
-    },
-    {
-      id: otherUserNoteId,
-      missionId: subjectMissionId,
-      userId: otherUserId,
-      notes: `${RUN_ID} other user note on subject mission`,
-      createdAt: new Date('2026-06-25T04:30:00.000Z'),
-      updatedAt: new Date('2026-06-25T04:30:00.000Z'),
-    },
-  ]);
-
-  await db.insert(federationPeers).values([
-    {
-      id: peerId,
-      commonName: `${RUN_ID}-active-peer`,
-      displayName: `${RUN_ID} Active Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: CERT_SERIAL_HEX,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-    {
-      id: revokedPeerId,
-      commonName: `${RUN_ID}-revoked-peer`,
-      displayName: `${RUN_ID} Revoked Peer`,
-      certPem: '-----BEGIN CERTIFICATE-----\nMOCK\n-----END CERTIFICATE-----\n',
-      certSerial: `${CERT_SERIAL_HEX}${RUN_ID.replace(/-/g, '').slice(0, 8).toUpperCase()}`,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      state: 'active',
-    },
-  ]);
-
-  await db.insert(federationGrants).values([
-    {
-      id: activeGrantId,
-      peerId,
-      subjectUserId,
-      status: 'active',
-      scope: {
-        resources: ['tasks', 'notes'],
-        excluded_resources: [],
-        filters: {
-          tasks: { include_personal: true, include_teams: [] },
-          notes: { include_personal: true, include_teams: [] },
-        },
-        max_rows_per_query: 2,
-      },
-    },
-    {
-      id: revokedGrantId,
-      peerId,
-      subjectUserId,
-      status: 'revoked',
-      revokedAt: new Date(),
-      revokedReason: `${RUN_ID} revoked grant fixture`,
-      scope: {
-        resources: ['tasks'],
-        excluded_resources: [],
-        max_rows_per_query: 2,
-      },
-    },
-  ]);
-
-  return {
-    subjectUserId,
-    otherUserId,
-    peerId,
-    revokedPeerId,
-    activeGrantId,
-    revokedGrantId,
-    subjectProjectId,
-    subjectMissionId,
-    otherProjectId,
-    teamId,
-    unauthorizedTeamId,
-    teamProjectId,
-    taskIds,
-    excludedTaskIds,
-    subjectNoteId,
-    otherUserNoteId,
-  };
-}
-
-async function cleanupFixtures(db: Db, ids: TestIds | undefined): Promise<void> {
-  if (!ids) {
-    return;
-  }
-
-  await db
-    .delete(missionTasks)
-    .where(inArray(missionTasks.id, [ids.subjectNoteId, ids.otherUserNoteId]))
-    .catch(() => {});
-  await db
-    .delete(tasks)
-    .where(inArray(tasks.id, [...ids.taskIds, ...ids.excludedTaskIds]))
-    .catch(() => {});
-  await db
-    .delete(missions)
-    .where(eq(missions.id, ids.subjectMissionId))
-    .catch(() => {});
-  await db
-    .delete(projects)
-    .where(inArray(projects.id, [ids.subjectProjectId, ids.otherProjectId, ids.teamProjectId]))
-    .catch(() => {});
-  await db
-    .delete(teamMembers)
-    .where(
-      and(
-        eq(teamMembers.userId, ids.subjectUserId),
-        inArray(teamMembers.teamId, [ids.teamId, ids.unauthorizedTeamId]),
-      ),
-    )
-    .catch(() => {});
-  await db
-    .delete(teams)
-    .where(inArray(teams.id, [ids.teamId, ids.unauthorizedTeamId]))
-    .catch(() => {});
-  await db
-    .delete(federationGrants)
-    .where(inArray(federationGrants.id, [ids.activeGrantId, ids.revokedGrantId]))
-    .catch(() => {});
-  await db
-    .delete(federationPeers)
-    .where(inArray(federationPeers.id, [ids.peerId, ids.revokedPeerId]))
-    .catch(() => {});
-  await db
-    .delete(users)
-    .where(inArray(users.id, [ids.subjectUserId, ids.otherUserId]))
-    .catch(() => {});
-}
-
-describe.skipIf(!run)('federation M3 list verb — single-gateway integration', () => {
-  let handle: DbHandle;
-  let db: Db;
-  let moduleRef: TestingModule;
-  let guard: FederationAuthGuard;
-  let listController: ListController;
-  let ids: TestIds | undefined;
-
-  beforeAll(async () => {
-    handle = createDb(PG_URL);
-    db = handle.db;
-    ids = await seedFixtures(db);
-
-    moduleRef = await Test.createTestingModule({
-      controllers: [ListController],
-      providers: [
-        { provide: DB, useValue: db },
-        GrantsService,
-        FederationAuthGuard,
-        FederationScopeService,
-        FederationListQueryService,
-      ],
-    }).compile();
-
-    guard = moduleRef.get(FederationAuthGuard);
-    listController = moduleRef.get(ListController);
-  }, 30_000);
-
-  afterAll(async () => {
-    await moduleRef?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await cleanupFixtures(db, ids).catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-    await handle?.close().catch((e: unknown) => console.error('[fed-m3-10 cleanup]', e));
-  });
-
-  it('#6 — rejects a client cert with malformed/missing Mosaic OIDs with 401', async () => {
-    const malformedOidCert = await makeSelfSignedCert();
-    const request = makeFederationRequest(malformedOidCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(401);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'unauthorized',
-        message: expect.stringContaining('missing required OID'),
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#6 — rejects a valid client cert when its grant is revoked with 403', async () => {
-    expect(ids).toBeDefined();
-    const revokedCert = await makeMosaicIssuedCert({
-      grantId: ids!.revokedGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(revokedCert);
-    const { context, sent } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(false);
-    expect(sent.statusCode).toBe(403);
-    expect(sent.payload).toMatchObject({
-      error: {
-        code: 'forbidden',
-        message: 'Federation access denied',
-      },
-    });
-    expect(request.federationContext).toBeUndefined();
-  });
-
-  it('#7 — enforces max_rows_per_query on POST /api/federation/v1/list/:resource', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('tasks', request, { limit: 100 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(response.items).toHaveLength(2);
-    expect(response._truncated).toBe(true);
-    expect(response.nextCursor).toEqual(expect.any(String));
-    expect(returnedIds).toEqual([ids!.taskIds[0], ids!.taskIds[1]]);
-    expect(returnedIds).not.toContain(ids!.taskIds[2]);
-    for (const excludedId of ids!.excludedTaskIds) {
-      expect(returnedIds).not.toContain(excludedId);
-    }
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('excludes another user mission task notes on the same authorized mission', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    const response = await listController.list('notes', request, { limit: 10 });
-    const returnedIds = response.items.map((item) => item['id']);
-
-    expect(returnedIds).toEqual([ids!.subjectNoteId]);
-    expect(returnedIds).not.toContain(ids!.otherUserNoteId);
-    expect(response.items.every((item) => item._source === 'local')).toBe(true);
-  });
-
-  it('fails closed for unsupported list resources', async () => {
-    expect(ids).toBeDefined();
-    const activeCert = await makeMosaicIssuedCert({
-      grantId: ids!.activeGrantId,
-      subjectUserId: ids!.subjectUserId,
-    });
-    const request = makeFederationRequest(activeCert);
-    const { context } = makeGuardContext(request);
-
-    await expect(guard.canActivate(context)).resolves.toBe(true);
-
-    await expect(listController.list('widgets', request, {})).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is not supported',
-        },
-      },
-      status: 403,
-    });
-  });
-});
--- a/apps/gateway/src/admin/admin-health.controller.ts
+++ b/apps/gateway/src/admin/admin-health.controller.ts
@@ -1,11 +1,9 @@
-import { Controller, Get, Inject, Optional, UseGuards } from '@nestjs/common';
+import { Controller, Get, Inject, UseGuards } from '@nestjs/common';
 import { sql, type Db } from '@mosaicstack/db';
 import { createQueue } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { DB } from '../database/database.module.js';
 import { AgentService } from '../agent/agent.service.js';
 import { ProviderService } from '../agent/provider.service.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { AdminGuard } from './admin.guard.js';
 import type { HealthStatusDto, ServiceStatusDto } from './admin.dto.js';

@@ -16,9 +14,6 @@ export class AdminHealthController {
    @Inject(DB) private readonly db: Db,
    @Inject(AgentService) private readonly agentService: AgentService,
    @Inject(ProviderService) private readonly providerService: ProviderService,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
  ) {}

  @Get()
@@ -60,14 +55,6 @@ export class AdminHealthController {
  }

  private async checkCache(): Promise<ServiceStatusDto> {
-    // On Local tier there is no Redis. The cache is intentionally absent, which
-    // is a healthy state for this tier — report 'ok' rather than opening a new
-    // ioredis connection on every admin health check (which would spam
-    // ECONNREFUSED and create/destroy a connection per request). latencyMs 0
-    // signals "no cache backend to measure" for this tier.
-    if (this.mosaicConfig?.queue?.type === 'local') {
-      return { status: 'ok', latencyMs: 0 };
-    }
    const start = Date.now();
    const handle = createQueue();
    try {
--- a/apps/gateway/src/agent/provider-credentials.service.ts
+++ b/apps/gateway/src/agent/provider-credentials.service.ts
@@ -1,10 +1,62 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
-import { seal, unseal } from '@mosaicstack/auth';
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
 import type { Db } from '@mosaicstack/db';
 import { providerCredentials, eq, and } from '@mosaicstack/db';
 import { DB } from '../database/database.module.js';
 import type { ProviderCredentialSummaryDto } from './provider-credentials.dto.js';

+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96-bit IV for GCM
+const TAG_LENGTH = 16; // 128-bit auth tag
+
+/**
+ * Derive a 32-byte AES-256 key from BETTER_AUTH_SECRET using SHA-256.
+ * The secret is assumed to be set in the environment.
+ */
+function deriveEncryptionKey(): Buffer {
+  const secret = process.env['BETTER_AUTH_SECRET'];
+  if (!secret) {
+    throw new Error('BETTER_AUTH_SECRET is not set — cannot derive encryption key');
+  }
+  return createHash('sha256').update(secret).digest();
+}
+
+/**
+ * Encrypt a plain-text value using AES-256-GCM.
+ * Output format: base64(iv + authTag + ciphertext)
+ */
+function encrypt(plaintext: string): string {
+  const key = deriveEncryptionKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  // Combine iv (12) + authTag (16) + ciphertext and base64-encode
+  const combined = Buffer.concat([iv, authTag, encrypted]);
+  return combined.toString('base64');
+}
+
+/**
+ * Decrypt a value encrypted by `encrypt()`.
+ * Throws on authentication failure (tampered data).
+ */
+function decrypt(encoded: string): string {
+  const key = deriveEncryptionKey();
+  const combined = Buffer.from(encoded, 'base64');
+
+  const iv = combined.subarray(0, IV_LENGTH);
+  const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+  const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH);
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
@Injectable()
 export class ProviderCredentialsService {
  private readonly logger = new Logger(ProviderCredentialsService.name);
@@ -22,7 +74,7 @@ export class ProviderCredentialsService {
    value: string,
    metadata?: Record<string, unknown>,
  ): Promise<void> {
-    const encryptedValue = seal(value);
+    const encryptedValue = encrypt(value);

    await this.db
      .insert(providerCredentials)
@@ -70,7 +122,7 @@ export class ProviderCredentialsService {
    }

    try {
-      return unseal(row.encryptedValue);
+      return decrypt(row.encryptedValue);
    } catch (err) {
      this.logger.error(
        `Failed to decrypt credential for user=${userId} provider=${provider}`,
--- a/apps/gateway/src/app.module.ts
+++ b/apps/gateway/src/app.module.ts
@@ -24,7 +24,6 @@ import { GCModule } from './gc/gc.module.js';
 import { ReloadModule } from './reload/reload.module.js';
 import { WorkspaceModule } from './workspace/workspace.module.js';
 import { QueueModule } from './queue/queue.module.js';
-import { FederationModule } from './federation/federation.module.js';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';

@Module({
@@ -53,7 +52,6 @@ import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
    QueueModule,
    ReloadModule,
    WorkspaceModule,
-    FederationModule,
  ],
  controllers: [HealthController],
  providers: [
--- a/apps/gateway/src/commands/command-executor.service.ts
+++ b/apps/gateway/src/commands/command-executor.service.ts
@@ -21,10 +21,7 @@ export class CommandExecutorService {
    @Inject(AgentService) private readonly agentService: AgentService,
    @Inject(SystemOverrideService) private readonly systemOverride: SystemOverrideService,
    @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
-    // On Local tier COMMANDS_REDIS is null — provider login caching is skipped.
-    @Optional()
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(COMMANDS_REDIS) private readonly redis: QueueHandle['redis'],
    @Inject(BRAIN) private readonly brain: Brain,
    @Optional()
    @Inject(forwardRef(() => ReloadService))
@@ -406,16 +403,14 @@ export class CommandExecutorService {
          };
        }
        const pollToken = crypto.randomUUID();
-        const pollKey = `mosaic:auth:poll:${pollToken}`;
-        if (this.redis) {
-          // Store pending state in Valkey (TTL 5 minutes)
-          await this.redis.set(
-            pollKey,
-            JSON.stringify({ status: 'pending', provider: providerName, userId }),
-            'EX',
-            300,
-          );
-        }
+        const key = `mosaic:auth:poll:${pollToken}`;
+        // Store pending state in Valkey (TTL 5 minutes)
+        await this.redis.set(
+          key,
+          JSON.stringify({ status: 'pending', provider: providerName, userId }),
+          'EX',
+          300,
+        );
        // In production this would construct an OAuth URL
        const loginUrl = `${process.env['MOSAIC_BASE_URL'] ?? 'http://localhost:3000'}/auth/provider/${providerName}?token=${pollToken}`;
        return {
--- a/apps/gateway/src/commands/commands.module.ts
+++ b/apps/gateway/src/commands/commands.module.ts
@@ -1,7 +1,5 @@
-import { forwardRef, Inject, Module, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { forwardRef, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
@@ -16,17 +14,13 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
  providers: [
    {
      provide: COMMANDS_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection.
-        // CommandExecutorService falls back to no-cache for /provider login on local.
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
        return createQueue();
      },
-      inject: [MOSAIC_CONFIG],
    },
    {
      provide: COMMANDS_REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
      inject: [COMMANDS_QUEUE_HANDLE],
    },
    CommandRegistryService,
@@ -35,13 +29,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
  exports: [CommandRegistryService, CommandExecutorService],
 })
 export class CommandsModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(COMMANDS_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}

  async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
  }
 }
--- a/apps/gateway/src/database/database.module.ts
+++ b/apps/gateway/src/database/database.module.ts
@@ -1,21 +1,8 @@
 import { mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import {
-  Global,
-  Inject,
-  Logger,
-  Module,
-  type OnApplicationShutdown,
-  type OnModuleInit,
-} from '@nestjs/common';
-import {
-  createDb,
-  createPgliteDb,
-  runPgliteMigrations,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
+import { Global, Inject, Module, type OnApplicationShutdown } from '@nestjs/common';
+import { createDb, createPgliteDb, type Db, type DbHandle } from '@mosaicstack/db';
 import { createStorageAdapter, type StorageAdapter } from '@mosaicstack/storage';
 import type { MosaicConfig } from '@mosaicstack/config';
 import { MOSAIC_CONFIG } from '../config/config.module.js';
@@ -52,37 +39,12 @@ export const STORAGE_ADAPTER = 'STORAGE_ADAPTER';
  ],
  exports: [DB, STORAGE_ADAPTER],
 })
-export class DatabaseModule implements OnApplicationShutdown, OnModuleInit {
-  private readonly logger = new Logger(DatabaseModule.name);
-
+export class DatabaseModule implements OnApplicationShutdown {
  constructor(
    @Inject(DB_HANDLE) private readonly handle: DbHandle,
    @Inject(STORAGE_ADAPTER) private readonly storageAdapter: StorageAdapter,
-    @Inject(MOSAIC_CONFIG) private readonly config: MosaicConfig,
  ) {}

-  // Migrations must complete before any module that injects DB starts serving
-  // requests. NestJS awaits onModuleInit before app.listen(), and modules that
-  // inject DB are initialized after this one — so all DB-dependent code sees a
-  // populated schema before the first HTTP request lands.
-  //
-  // Local (PGlite) tier: we run gateway-DB migrations explicitly here. The
-  // storage adapter writes to a separate PGlite directory and only manages its
-  // own KV tables, so we still call its migrate() afterwards.
-  //
-  // Postgres tier: PostgresAdapter.migrate() already calls runMigrations() on
-  // the same DATABASE_URL, so a single call covers both the gateway DB and
-  // the storage tables. We deliberately do NOT call runMigrations() here to
-  // avoid opening a second short-lived connection and doubling startup cost.
-  async onModuleInit(): Promise<void> {
-    if (this.config.tier === 'local') {
-      this.logger.log('Applying PGlite schema migrations...');
-      await runPgliteMigrations(this.handle);
-    }
-    this.logger.log(`Initializing storage adapter (${this.storageAdapter.name})...`);
-    await this.storageAdapter.migrate();
-  }
-
  async onApplicationShutdown(): Promise<void> {
    await Promise.all([this.handle.close(), this.storageAdapter.close()]);
  }
--- a/apps/gateway/src/federation/tests/enrollment.service.spec.ts
+++ b/apps/gateway/src/federation/tests/enrollment.service.spec.ts
@@ -1,401 +0,0 @@
-/**
- * Unit tests for EnrollmentService — federation enrollment token flow (FED-M2-07).
- *
- * Coverage:
- *  createToken:
- *   - inserts token row with correct grantId, peerId, and future expiresAt
- *   - returns { token, expiresAt } with a 64-char hex token
- *   - clamps ttlSeconds to 900
- *
- *  redeem — error paths:
- *   - NotFoundException when token row not found
- *   - GoneException when token already used (usedAt set)
- *   - GoneException when token expired (expiresAt < now)
- *   - GoneException when grant status is not pending
- *
- *  redeem — success path:
- *   - atomically claims token BEFORE cert issuance (claim → issueCert → tx)
- *   - calls CaService.issueCert with correct args
- *   - activates grant + updates peer + writes audit log inside a transaction
- *   - returns { certPem, certChainPem }
- *
- *  redeem — replay protection:
- *   - GoneException when claim UPDATE returns empty array (concurrent request won)
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach, beforeAll } from 'vitest';
-import { GoneException, NotFoundException } from '@nestjs/common';
-import type { Db } from '@mosaicstack/db';
-import { EnrollmentService } from '../enrollment.service.js';
-import { makeSelfSignedCert } from './helpers/test-cert.js';
-
-// ---------------------------------------------------------------------------
-// Test constants
-// ---------------------------------------------------------------------------
-
-const GRANT_ID = 'g1111111-1111-1111-1111-111111111111';
-const PEER_ID = 'p2222222-2222-2222-2222-222222222222';
-const USER_ID = 'u3333333-3333-3333-3333-333333333333';
-const TOKEN = 'a'.repeat(64); // 64-char hex
-
-// Real self-signed EC P-256 cert — populated once in beforeAll.
-// Required because EnrollmentService.extractCertNotAfter calls new X509Certificate(certPem)
-// with strict parsing (PR #501 HIGH-2: no silent fallback).
-let REAL_CERT_PEM: string;
-
-const MOCK_CHAIN_PEM = () => REAL_CERT_PEM + REAL_CERT_PEM;
-const MOCK_SERIAL = 'ABCD1234';
-
-beforeAll(async () => {
-  REAL_CERT_PEM = await makeSelfSignedCert();
-});
-
-// ---------------------------------------------------------------------------
-// Factory helpers
-// ---------------------------------------------------------------------------
-
-function makeTokenRow(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    token: TOKEN,
-    grantId: GRANT_ID,
-    peerId: PEER_ID,
-    expiresAt: new Date(Date.now() + 60_000), // 1 min from now
-    usedAt: null,
-    createdAt: new Date(),
-    ...overrides,
-  };
-}
-
-function makeGrant(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: GRANT_ID,
-    peerId: PEER_ID,
-    subjectUserId: USER_ID,
-    scope: { resources: ['tasks'], excluded_resources: [], max_rows_per_query: 100 },
-    status: 'pending',
-    expiresAt: null,
-    createdAt: new Date(),
-    revokedAt: null,
-    revokedReason: null,
-    ...overrides,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock DB builder
-// ---------------------------------------------------------------------------
-
-function makeDb({
-  tokenRows = [makeTokenRow()],
-  // claimedRows is returned by the .returning() on the token-claim UPDATE.
-  // Empty array = concurrent request won the race (GoneException).
-  claimedRows = [{ token: TOKEN }],
-}: {
-  tokenRows?: unknown[];
-  claimedRows?: unknown[];
-} = {}) {
-  // insert().values() — for createToken (outer db, not tx)
-  const insertValues = vi.fn().mockResolvedValue(undefined);
-  const insertMock = vi.fn().mockReturnValue({ values: insertValues });
-
-  // select().from().where().limit() — for fetching the token row
-  const limitSelect = vi.fn().mockResolvedValue(tokenRows);
-  const whereSelect = vi.fn().mockReturnValue({ limit: limitSelect });
-  const fromSelect = vi.fn().mockReturnValue({ where: whereSelect });
-  const selectMock = vi.fn().mockReturnValue({ from: fromSelect });
-
-  // update().set().where().returning() — for the atomic token claim (outer db)
-  const returningMock = vi.fn().mockResolvedValue(claimedRows);
-  const whereClaimUpdate = vi.fn().mockReturnValue({ returning: returningMock });
-  const setClaimMock = vi.fn().mockReturnValue({ where: whereClaimUpdate });
-  const claimUpdateMock = vi.fn().mockReturnValue({ set: setClaimMock });
-
-  // transaction(cb) — cb receives txMock; txMock has update + insert
-  //
-  // The tx mock must support two tx.update() call patterns (CRIT-2, PR #501):
-  //   1. Grant activation:  .update().set().where().returning() → resolves to [{ id }]
-  //   2. Peer update:       .update().set().where()             → resolves to undefined
-  //
-  // We achieve this by making txWhereUpdate return an object with BOTH a thenable
-  // interface (so `await tx.update().set().where()` works) AND a .returning() method.
-  const txGrantActivatedRow = { id: GRANT_ID };
-  const txReturningMock = vi.fn().mockResolvedValue([txGrantActivatedRow]);
-  const txWhereUpdate = vi.fn().mockReturnValue({
-    // .returning() for grant activation (first tx.update call)
-    returning: txReturningMock,
-    // thenables so `await tx.update().set().where()` also works for peer update
-    then: (resolve: (v: undefined) => void) => resolve(undefined),
-    catch: () => undefined,
-    finally: () => undefined,
-  });
-  const txSetMock = vi.fn().mockReturnValue({ where: txWhereUpdate });
-  const txUpdateMock = vi.fn().mockReturnValue({ set: txSetMock });
-  const txInsertValues = vi.fn().mockResolvedValue(undefined);
-  const txInsertMock = vi.fn().mockReturnValue({ values: txInsertValues });
-  const txMock = { update: txUpdateMock, insert: txInsertMock };
-  const transactionMock = vi
-    .fn()
-    .mockImplementation(async (cb: (tx: typeof txMock) => Promise<void>) => cb(txMock));
-
-  return {
-    insert: insertMock,
-    select: selectMock,
-    update: claimUpdateMock,
-    transaction: transactionMock,
-    _mocks: {
-      insertValues,
-      insertMock,
-      limitSelect,
-      whereSelect,
-      fromSelect,
-      selectMock,
-      returningMock,
-      whereClaimUpdate,
-      setClaimMock,
-      claimUpdateMock,
-      txInsertValues,
-      txInsertMock,
-      txWhereUpdate,
-      txReturningMock,
-      txSetMock,
-      txUpdateMock,
-      txMock,
-      transactionMock,
-    },
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock CaService
-// ---------------------------------------------------------------------------
-
-function makeCaService() {
-  return {
-    // REAL_CERT_PEM is populated by beforeAll — safe to reference via closure here
-    // because makeCaService() is only called after the suite's beforeAll runs.
-    issueCert: vi.fn().mockImplementation(async () => ({
-      certPem: REAL_CERT_PEM,
-      certChainPem: MOCK_CHAIN_PEM(),
-      serialNumber: MOCK_SERIAL,
-    })),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock GrantsService
-// ---------------------------------------------------------------------------
-
-function makeGrantsService(grantOverrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    getGrant: vi.fn().mockResolvedValue(makeGrant(grantOverrides)),
-    activateGrant: vi.fn().mockResolvedValue(makeGrant({ status: 'active' })),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Helper: build service under test
-// ---------------------------------------------------------------------------
-
-function buildService({
-  db = makeDb(),
-  caService = makeCaService(),
-  grantsService = makeGrantsService(),
-}: {
-  db?: ReturnType<typeof makeDb>;
-  caService?: ReturnType<typeof makeCaService>;
-  grantsService?: ReturnType<typeof makeGrantsService>;
-} = {}) {
-  return new EnrollmentService(db as unknown as Db, caService as never, grantsService as never);
-}
-
-// ---------------------------------------------------------------------------
-// Tests: createToken
-// ---------------------------------------------------------------------------
-
-describe('EnrollmentService.createToken', () => {
-  it('inserts a token row and returns { token, expiresAt }', async () => {
-    const db = makeDb();
-    const service = buildService({ db });
-
-    const result = await service.createToken({
-      grantId: GRANT_ID,
-      peerId: PEER_ID,
-      ttlSeconds: 900,
-    });
-
-    expect(result.token).toHaveLength(64); // 32 bytes hex
-    expect(result.expiresAt).toBeDefined();
-    expect(new Date(result.expiresAt).getTime()).toBeGreaterThan(Date.now());
-    expect(db._mocks.insertValues).toHaveBeenCalledWith(
-      expect.objectContaining({ grantId: GRANT_ID, peerId: PEER_ID }),
-    );
-  });
-
-  it('clamps ttlSeconds to 900', async () => {
-    const db = makeDb();
-    const service = buildService({ db });
-
-    const before = Date.now();
-    const result = await service.createToken({
-      grantId: GRANT_ID,
-      peerId: PEER_ID,
-      ttlSeconds: 9999,
-    });
-    const after = Date.now();
-
-    const expiresMs = new Date(result.expiresAt).getTime();
-    // Should be at most 900s from now
-    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100);
-    expect(expiresMs - after).toBeGreaterThanOrEqual(0);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Tests: redeem — error paths
-// ---------------------------------------------------------------------------
-
-describe('EnrollmentService.redeem — error paths', () => {
-  it('throws NotFoundException when token row not found', async () => {
-    const db = makeDb({ tokenRows: [] });
-    const service = buildService({ db });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(NotFoundException);
-  });
-
-  it('throws GoneException when usedAt is set (already redeemed)', async () => {
-    const db = makeDb({ tokenRows: [makeTokenRow({ usedAt: new Date(Date.now() - 1000) })] });
-    const service = buildService({ db });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(GoneException);
-  });
-
-  it('throws GoneException when token has expired', async () => {
-    const db = makeDb({ tokenRows: [makeTokenRow({ expiresAt: new Date(Date.now() - 1000) })] });
-    const service = buildService({ db });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(GoneException);
-  });
-
-  it('throws GoneException when grant status is not pending', async () => {
-    const db = makeDb();
-    const grantsService = makeGrantsService({ status: 'active' });
-    const service = buildService({ db, grantsService });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(GoneException);
-  });
-
-  it('throws GoneException when token claim UPDATE returns empty array (concurrent replay)', async () => {
-    const db = makeDb({ claimedRows: [] });
-    const caService = makeCaService();
-    const grantsService = makeGrantsService();
-    const service = buildService({ db, caService, grantsService });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(GoneException);
-  });
-
-  it('does NOT call issueCert when token claim fails (no double minting)', async () => {
-    const db = makeDb({ claimedRows: [] });
-    const caService = makeCaService();
-    const service = buildService({ db, caService });
-
-    await expect(service.redeem(TOKEN, '---CSR---')).rejects.toBeInstanceOf(GoneException);
-    expect(caService.issueCert).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Tests: redeem — success path
-// ---------------------------------------------------------------------------
-
-describe('EnrollmentService.redeem — success path', () => {
-  let db: ReturnType<typeof makeDb>;
-  let caService: ReturnType<typeof makeCaService>;
-  let grantsService: ReturnType<typeof makeGrantsService>;
-  let service: EnrollmentService;
-
-  beforeEach(() => {
-    db = makeDb();
-    caService = makeCaService();
-    grantsService = makeGrantsService();
-    service = buildService({ db, caService, grantsService });
-  });
-
-  it('claims token BEFORE calling issueCert (prevents double minting)', async () => {
-    const callOrder: string[] = [];
-    db._mocks.returningMock.mockImplementation(async () => {
-      callOrder.push('claim');
-      return [{ token: TOKEN }];
-    });
-    caService.issueCert.mockImplementation(async () => {
-      callOrder.push('issueCert');
-      return { certPem: REAL_CERT_PEM, certChainPem: MOCK_CHAIN_PEM(), serialNumber: MOCK_SERIAL };
-    });
-
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(callOrder).toEqual(['claim', 'issueCert']);
-  });
-
-  it('calls CaService.issueCert with grantId, subjectUserId, csrPem, ttlSeconds=300', async () => {
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(caService.issueCert).toHaveBeenCalledWith(
-      expect.objectContaining({
-        grantId: GRANT_ID,
-        subjectUserId: USER_ID,
-        csrPem: '---CSR---',
-        ttlSeconds: 300,
-      }),
-    );
-  });
-
-  it('runs activate grant + peer update + audit inside a transaction', async () => {
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(db._mocks.transactionMock).toHaveBeenCalledOnce();
-    // tx.update called twice: activate grant + update peer
-    expect(db._mocks.txUpdateMock).toHaveBeenCalledTimes(2);
-    // tx.insert called once: audit log
-    expect(db._mocks.txInsertMock).toHaveBeenCalledOnce();
-  });
-
-  it('activates grant (sets status=active) inside the transaction', async () => {
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(db._mocks.txSetMock).toHaveBeenCalledWith(expect.objectContaining({ status: 'active' }));
-  });
-
-  it('updates the federationPeers row with certPem, certSerial, state=active inside the transaction', async () => {
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(db._mocks.txSetMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        certPem: REAL_CERT_PEM,
-        certSerial: MOCK_SERIAL,
-        state: 'active',
-      }),
-    );
-  });
-
-  it('inserts an audit log row inside the transaction', async () => {
-    await service.redeem(TOKEN, '---CSR---');
-
-    expect(db._mocks.txInsertValues).toHaveBeenCalledWith(
-      expect.objectContaining({
-        peerId: PEER_ID,
-        grantId: GRANT_ID,
-        verb: 'enrollment',
-      }),
-    );
-  });
-
-  it('returns { certPem, certChainPem } from CaService', async () => {
-    const result = await service.redeem(TOKEN, '---CSR---');
-
-    expect(result).toEqual({
-      certPem: REAL_CERT_PEM,
-      certChainPem: MOCK_CHAIN_PEM(),
-    });
-  });
-});
--- a/apps/gateway/src/federation/tests/federation.controller.spec.ts
+++ b/apps/gateway/src/federation/tests/federation.controller.spec.ts
@@ -1,212 +0,0 @@
-/**
- * Unit tests for FederationController (FED-M2-08).
- *
- * Coverage:
- *  - listGrants: delegates to GrantsService with query params
- *  - createGrant: delegates to GrantsService, validates body
- *  - generateToken: returns enrollmentUrl containing the token
- *  - listPeers: returns DB rows
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { NotFoundException } from '@nestjs/common';
-import type { Db } from '@mosaicstack/db';
-import { FederationController } from '../federation.controller.js';
-import type { GrantsService } from '../grants.service.js';
-import type { EnrollmentService } from '../enrollment.service.js';
-
-// ---------------------------------------------------------------------------
-// Constants
-// ---------------------------------------------------------------------------
-
-const GRANT_ID = 'g1111111-1111-1111-1111-111111111111';
-const PEER_ID = 'p2222222-2222-2222-2222-222222222222';
-const USER_ID = 'u3333333-3333-3333-3333-333333333333';
-
-const MOCK_GRANT = {
-  id: GRANT_ID,
-  peerId: PEER_ID,
-  subjectUserId: USER_ID,
-  scope: { resources: ['tasks'], operations: ['list'] },
-  status: 'pending' as const,
-  expiresAt: null,
-  createdAt: new Date('2026-01-01T00:00:00Z'),
-  revokedAt: null,
-  revokedReason: null,
-};
-
-const MOCK_PEER = {
-  id: PEER_ID,
-  commonName: 'test-peer',
-  displayName: 'Test Peer',
-  certPem: '',
-  certSerial: 'pending',
-  certNotAfter: new Date(0),
-  clientKeyPem: null,
-  state: 'pending' as const,
-  endpointUrl: null,
-  createdAt: new Date('2026-01-01T00:00:00Z'),
-  updatedAt: new Date('2026-01-01T00:00:00Z'),
-};
-
-// ---------------------------------------------------------------------------
-// DB mock builder
-// ---------------------------------------------------------------------------
-
-function makeDbMock(rows: unknown[] = []) {
-  const orderBy = vi.fn().mockResolvedValue(rows);
-  const where = vi.fn().mockReturnValue({ orderBy });
-  const from = vi.fn().mockReturnValue({ where, orderBy });
-  const select = vi.fn().mockReturnValue({ from });
-
-  return {
-    select,
-    from,
-    where,
-    orderBy,
-    insert: vi.fn(),
-    update: vi.fn(),
-    delete: vi.fn(),
-  } as unknown as Db;
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('FederationController', () => {
-  let db: Db;
-  let grantsService: GrantsService;
-  let enrollmentService: EnrollmentService;
-  let controller: FederationController;
-
-  beforeEach(() => {
-    db = makeDbMock([MOCK_PEER]);
-
-    grantsService = {
-      createGrant: vi.fn().mockResolvedValue(MOCK_GRANT),
-      getGrant: vi.fn().mockResolvedValue(MOCK_GRANT),
-      listGrants: vi.fn().mockResolvedValue([MOCK_GRANT]),
-      revokeGrant: vi.fn().mockResolvedValue({ ...MOCK_GRANT, status: 'revoked' }),
-      activateGrant: vi.fn(),
-      expireGrant: vi.fn(),
-    } as unknown as GrantsService;
-
-    enrollmentService = {
-      createToken: vi.fn().mockResolvedValue({
-        token: 'abc123def456abc123def456abc123def456abc123def456abc123def456ab12',
-        expiresAt: '2026-01-01T00:15:00.000Z',
-      }),
-      redeem: vi.fn(),
-    } as unknown as EnrollmentService;
-
-    controller = new FederationController(db, grantsService, enrollmentService);
-  });
-
-  // ─── Grant management ──────────────────────────────────────────────────
-
-  describe('listGrants', () => {
-    it('delegates to GrantsService with provided query params', async () => {
-      const query = { peerId: PEER_ID, status: 'pending' as const };
-      const result = await controller.listGrants(query);
-
-      expect(grantsService.listGrants).toHaveBeenCalledWith(query);
-      expect(result).toEqual([MOCK_GRANT]);
-    });
-
-    it('delegates to GrantsService with empty filters', async () => {
-      const result = await controller.listGrants({});
-
-      expect(grantsService.listGrants).toHaveBeenCalledWith({});
-      expect(result).toEqual([MOCK_GRANT]);
-    });
-  });
-
-  describe('createGrant', () => {
-    it('delegates to GrantsService and returns created grant', async () => {
-      const body = {
-        peerId: PEER_ID,
-        subjectUserId: USER_ID,
-        scope: { resources: ['tasks'], operations: ['list'] },
-      };
-
-      const result = await controller.createGrant(body);
-
-      expect(grantsService.createGrant).toHaveBeenCalledWith(body);
-      expect(result).toEqual(MOCK_GRANT);
-    });
-  });
-
-  describe('getGrant', () => {
-    it('delegates to GrantsService with provided ID', async () => {
-      const result = await controller.getGrant(GRANT_ID);
-
-      expect(grantsService.getGrant).toHaveBeenCalledWith(GRANT_ID);
-      expect(result).toEqual(MOCK_GRANT);
-    });
-  });
-
-  describe('revokeGrant', () => {
-    it('delegates to GrantsService with id and reason', async () => {
-      const result = await controller.revokeGrant(GRANT_ID, { reason: 'test reason' });
-
-      expect(grantsService.revokeGrant).toHaveBeenCalledWith(GRANT_ID, 'test reason');
-      expect(result).toMatchObject({ status: 'revoked' });
-    });
-
-    it('delegates without reason when omitted', async () => {
-      await controller.revokeGrant(GRANT_ID, {});
-
-      expect(grantsService.revokeGrant).toHaveBeenCalledWith(GRANT_ID, undefined);
-    });
-  });
-
-  describe('generateToken', () => {
-    it('returns enrollmentUrl containing the token', async () => {
-      const token = 'abc123def456abc123def456abc123def456abc123def456abc123def456ab12';
-      vi.mocked(enrollmentService.createToken).mockResolvedValueOnce({
-        token,
-        expiresAt: '2026-01-01T00:15:00.000Z',
-      });
-
-      const result = await controller.generateToken(GRANT_ID, { ttlSeconds: 900 });
-
-      expect(result.token).toBe(token);
-      expect(result.enrollmentUrl).toContain(token);
-      expect(result.enrollmentUrl).toContain('/api/federation/enrollment/');
-    });
-
-    it('creates token via EnrollmentService with correct grantId and peerId', async () => {
-      await controller.generateToken(GRANT_ID, { ttlSeconds: 300 });
-
-      expect(enrollmentService.createToken).toHaveBeenCalledWith({
-        grantId: GRANT_ID,
-        peerId: PEER_ID,
-        ttlSeconds: 300,
-      });
-    });
-
-    it('throws NotFoundException when grant does not exist', async () => {
-      vi.mocked(grantsService.getGrant).mockRejectedValueOnce(
-        new NotFoundException(`Grant ${GRANT_ID} not found`),
-      );
-
-      await expect(controller.generateToken(GRANT_ID, { ttlSeconds: 900 })).rejects.toThrow(
-        NotFoundException,
-      );
-    });
-  });
-
-  // ─── Peer management ───────────────────────────────────────────────────
-
-  describe('listPeers', () => {
-    it('returns DB rows ordered by commonName', async () => {
-      const result = await controller.listPeers();
-
-      expect(db.select).toHaveBeenCalled();
-      // The DB mock resolves with [MOCK_PEER]
-      expect(result).toEqual([MOCK_PEER]);
-    });
-  });
-});
--- a/apps/gateway/src/federation/tests/grants.service.spec.ts
+++ b/apps/gateway/src/federation/tests/grants.service.spec.ts
@@ -1,351 +0,0 @@
-/**
- * Unit tests for GrantsService — federation grants CRUD + status transitions (FED-M2-06).
- *
- * Coverage:
- *  - createGrant: validates scope via parseFederationScope
- *  - createGrant: inserts with status 'pending'
- *  - getGrant: returns grant when found
- *  - getGrant: throws NotFoundException when not found
- *  - listGrants: no filters returns all grants
- *  - listGrants: filters by peerId
- *  - listGrants: filters by subjectUserId
- *  - listGrants: filters by status
- *  - listGrants: multiple filters combined
- *  - activateGrant: pending → active works
- *  - activateGrant: non-pending throws ConflictException
- *  - revokeGrant: active → revoked works, sets revokedAt
- *  - revokeGrant: non-active throws ConflictException
- *  - expireGrant: active → expired works
- *  - expireGrant: non-active throws ConflictException
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { ConflictException, NotFoundException } from '@nestjs/common';
-import type { Db } from '@mosaicstack/db';
-import { GrantsService } from '../grants.service.js';
-import { FederationScopeError } from '../scope-schema.js';
-
-// ---------------------------------------------------------------------------
-// Minimal valid federation scope for testing
-// ---------------------------------------------------------------------------
-const VALID_SCOPE = {
-  resources: ['tasks'] as const,
-  excluded_resources: [],
-  max_rows_per_query: 100,
-};
-
-const PEER_ID = 'a1111111-1111-1111-1111-111111111111';
-const USER_ID = 'u2222222-2222-2222-2222-222222222222';
-const GRANT_ID = 'g3333333-3333-3333-3333-333333333333';
-
-// ---------------------------------------------------------------------------
-// Build a mock DB that mimics chained Drizzle query builder calls
-// ---------------------------------------------------------------------------
-
-function makeMockGrant(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: GRANT_ID,
-    peerId: PEER_ID,
-    subjectUserId: USER_ID,
-    scope: VALID_SCOPE,
-    status: 'pending',
-    expiresAt: null,
-    createdAt: new Date('2026-01-01T00:00:00Z'),
-    revokedAt: null,
-    revokedReason: null,
-    ...overrides,
-  };
-}
-
-function makeDb(
-  overrides: {
-    insertReturning?: unknown[];
-    selectRows?: unknown[];
-    updateReturning?: unknown[];
-  } = {},
-) {
-  const insertReturning = overrides.insertReturning ?? [makeMockGrant()];
-  const selectRows = overrides.selectRows ?? [makeMockGrant()];
-  const updateReturning = overrides.updateReturning ?? [makeMockGrant({ status: 'active' })];
-
-  // Drizzle returns a chainable builder; we need to mock the full chain.
-  const returningInsert = vi.fn().mockResolvedValue(insertReturning);
-  const valuesInsert = vi.fn().mockReturnValue({ returning: returningInsert });
-  const insertMock = vi.fn().mockReturnValue({ values: valuesInsert });
-
-  // select().from().where().limit()
-  const limitSelect = vi.fn().mockResolvedValue(selectRows);
-  const whereSelect = vi.fn().mockReturnValue({ limit: limitSelect });
-  // from returns something that is both thenable (for full-table select) and has .where()
-  const fromSelect = vi.fn().mockReturnValue({
-    where: whereSelect,
-    limit: limitSelect,
-    // Make it thenable for listGrants with no filters (await db.select().from(federationGrants))
-    then: (resolve: (v: unknown) => unknown) => resolve(selectRows),
-  });
-  const selectMock = vi.fn().mockReturnValue({ from: fromSelect });
-
-  const returningUpdate = vi.fn().mockResolvedValue(updateReturning);
-  const whereUpdate = vi.fn().mockReturnValue({ returning: returningUpdate });
-  const setMock = vi.fn().mockReturnValue({ where: whereUpdate });
-  const updateMock = vi.fn().mockReturnValue({ set: setMock });
-
-  return {
-    insert: insertMock,
-    select: selectMock,
-    update: updateMock,
-    // Expose internals for assertions
-    _mocks: {
-      insertReturning,
-      valuesInsert,
-      insertMock,
-      limitSelect,
-      whereSelect,
-      fromSelect,
-      selectMock,
-      returningUpdate,
-      whereUpdate,
-      setMock,
-      updateMock,
-    },
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('GrantsService', () => {
-  let db: ReturnType<typeof makeDb>;
-  let service: GrantsService;
-
-  beforeEach(() => {
-    db = makeDb();
-    service = new GrantsService(db as unknown as Db);
-  });
-
-  // ─── createGrant ──────────────────────────────────────────────────────────
-
-  describe('createGrant', () => {
-    it('calls parseFederationScope — rejects an invalid scope', async () => {
-      const invalidScope = { resources: [], max_rows_per_query: 0 };
-      await expect(
-        service.createGrant({ peerId: PEER_ID, subjectUserId: USER_ID, scope: invalidScope }),
-      ).rejects.toBeInstanceOf(FederationScopeError);
-    });
-
-    it('inserts a grant with status pending and returns it', async () => {
-      const result = await service.createGrant({
-        peerId: PEER_ID,
-        subjectUserId: USER_ID,
-        scope: VALID_SCOPE,
-      });
-
-      expect(db._mocks.valuesInsert).toHaveBeenCalledWith(
-        expect.objectContaining({ status: 'pending', peerId: PEER_ID, subjectUserId: USER_ID }),
-      );
-      expect(result.status).toBe('pending');
-    });
-
-    it('passes expiresAt as a Date when provided', async () => {
-      await service.createGrant({
-        peerId: PEER_ID,
-        subjectUserId: USER_ID,
-        scope: VALID_SCOPE,
-        expiresAt: '2027-01-01T00:00:00Z',
-      });
-
-      expect(db._mocks.valuesInsert).toHaveBeenCalledWith(
-        expect.objectContaining({ expiresAt: expect.any(Date) }),
-      );
-    });
-
-    it('sets expiresAt to null when not provided', async () => {
-      await service.createGrant({ peerId: PEER_ID, subjectUserId: USER_ID, scope: VALID_SCOPE });
-
-      expect(db._mocks.valuesInsert).toHaveBeenCalledWith(
-        expect.objectContaining({ expiresAt: null }),
-      );
-    });
-  });
-
-  // ─── getGrant ─────────────────────────────────────────────────────────────
-
-  describe('getGrant', () => {
-    it('returns the grant when found', async () => {
-      const result = await service.getGrant(GRANT_ID);
-      expect(result.id).toBe(GRANT_ID);
-    });
-
-    it('throws NotFoundException when no rows returned', async () => {
-      db = makeDb({ selectRows: [] });
-      service = new GrantsService(db as unknown as Db);
-      await expect(service.getGrant(GRANT_ID)).rejects.toBeInstanceOf(NotFoundException);
-    });
-  });
-
-  // ─── listGrants ───────────────────────────────────────────────────────────
-
-  describe('listGrants', () => {
-    it('queries without where clause when no filters provided', async () => {
-      const result = await service.listGrants({});
-      expect(Array.isArray(result)).toBe(true);
-    });
-
-    it('applies peerId filter', async () => {
-      await service.listGrants({ peerId: PEER_ID });
-      expect(db._mocks.whereSelect).toHaveBeenCalled();
-    });
-
-    it('applies subjectUserId filter', async () => {
-      await service.listGrants({ subjectUserId: USER_ID });
-      expect(db._mocks.whereSelect).toHaveBeenCalled();
-    });
-
-    it('applies status filter', async () => {
-      await service.listGrants({ status: 'active' });
-      expect(db._mocks.whereSelect).toHaveBeenCalled();
-    });
-
-    it('applies multiple filters combined', async () => {
-      await service.listGrants({ peerId: PEER_ID, status: 'pending' });
-      expect(db._mocks.whereSelect).toHaveBeenCalled();
-    });
-  });
-
-  // ─── activateGrant ────────────────────────────────────────────────────────
-
-  describe('activateGrant', () => {
-    it('transitions pending → active and returns updated grant', async () => {
-      db = makeDb({
-        selectRows: [makeMockGrant({ status: 'pending' })],
-        updateReturning: [makeMockGrant({ status: 'active' })],
-      });
-      service = new GrantsService(db as unknown as Db);
-
-      const result = await service.activateGrant(GRANT_ID);
-
-      expect(db._mocks.setMock).toHaveBeenCalledWith({ status: 'active' });
-      expect(result.status).toBe('active');
-    });
-
-    it('throws ConflictException when grant is already active', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'active' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.activateGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is revoked', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'revoked' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.activateGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is expired', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'expired' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.activateGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-  });
-
-  // ─── revokeGrant ──────────────────────────────────────────────────────────
-
-  describe('revokeGrant', () => {
-    it('transitions active → revoked and sets revokedAt', async () => {
-      const revokedAt = new Date();
-      db = makeDb({
-        selectRows: [makeMockGrant({ status: 'active' })],
-        updateReturning: [makeMockGrant({ status: 'revoked', revokedAt })],
-      });
-      service = new GrantsService(db as unknown as Db);
-
-      const result = await service.revokeGrant(GRANT_ID, 'test reason');
-
-      expect(db._mocks.setMock).toHaveBeenCalledWith(
-        expect.objectContaining({
-          status: 'revoked',
-          revokedAt: expect.any(Date),
-          revokedReason: 'test reason',
-        }),
-      );
-      expect(result.status).toBe('revoked');
-    });
-
-    it('sets revokedReason to null when not provided', async () => {
-      db = makeDb({
-        selectRows: [makeMockGrant({ status: 'active' })],
-        updateReturning: [makeMockGrant({ status: 'revoked', revokedAt: new Date() })],
-      });
-      service = new GrantsService(db as unknown as Db);
-
-      await service.revokeGrant(GRANT_ID);
-
-      expect(db._mocks.setMock).toHaveBeenCalledWith(
-        expect.objectContaining({ revokedReason: null }),
-      );
-    });
-
-    it('throws ConflictException when grant is pending', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'pending' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.revokeGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is already revoked', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'revoked' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.revokeGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is expired', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'expired' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.revokeGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-  });
-
-  // ─── expireGrant ──────────────────────────────────────────────────────────
-
-  describe('expireGrant', () => {
-    it('transitions active → expired and returns updated grant', async () => {
-      db = makeDb({
-        selectRows: [makeMockGrant({ status: 'active' })],
-        updateReturning: [makeMockGrant({ status: 'expired' })],
-      });
-      service = new GrantsService(db as unknown as Db);
-
-      const result = await service.expireGrant(GRANT_ID);
-
-      expect(db._mocks.setMock).toHaveBeenCalledWith({ status: 'expired' });
-      expect(result.status).toBe('expired');
-    });
-
-    it('throws ConflictException when grant is pending', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'pending' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.expireGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is already expired', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'expired' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.expireGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-
-    it('throws ConflictException when grant is revoked', async () => {
-      db = makeDb({ selectRows: [makeMockGrant({ status: 'revoked' })] });
-      service = new GrantsService(db as unknown as Db);
-
-      await expect(service.expireGrant(GRANT_ID)).rejects.toBeInstanceOf(ConflictException);
-    });
-  });
-});
--- a/apps/gateway/src/federation/tests/helpers/test-cert.ts
+++ b/apps/gateway/src/federation/tests/helpers/test-cert.ts
@@ -1,138 +0,0 @@
-/**
- * Test helpers for generating real X.509 PEM certificates in unit tests.
- *
- * PR #501 (FED-M2-11) introduced strict `new X509Certificate(certPem)` parsing
- * in both EnrollmentService.extractCertNotAfter and CaService.issueCert — dummy
- * cert strings now throw `error:0680007B:asn1 encoding routines::header too long`.
- *
- * These helpers produce minimal but cryptographically valid self-signed EC P-256
- * certificates via @peculiar/x509 + Node.js webcrypto, suitable for test mocks.
- *
- * Two variants:
- *  - makeSelfSignedCert()          Plain cert — satisfies node:crypto X509Certificate parse.
- *  - makeMosaicIssuedCert(opts)    Cert with custom Mosaic OID extensions — satisfies the
- *                                  CRIT-1 OID presence + value checks in CaService.issueCert.
- */
-
-import { webcrypto } from 'node:crypto';
-import {
-  X509CertificateGenerator,
-  Extension,
-  KeyUsagesExtension,
-  KeyUsageFlags,
-  BasicConstraintsExtension,
-  cryptoProvider,
-} from '@peculiar/x509';
-
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Encode a string as an ASN.1 UTF8String TLV:
- *   0x0C (tag) + 1-byte length (for strings ≤ 127 bytes) + UTF-8 bytes.
- *
- * CaService.issueCert reads the extension value as:
- *   decoder.decode(grantIdExt.value.slice(2))
- * i.e. it skips the tag + length byte and decodes the remainder as UTF-8.
- * So we must produce exactly this encoding as the OCTET STRING content.
- */
-function encodeUtf8String(value: string): Uint8Array {
-  const utf8 = new TextEncoder().encode(value);
-  if (utf8.length > 127) {
-    throw new Error('encodeUtf8String: value too long for single-byte length encoding');
-  }
-  const buf = new Uint8Array(2 + utf8.length);
-  buf[0] = 0x0c; // ASN.1 UTF8String tag
-  buf[1] = utf8.length;
-  buf.set(utf8, 2);
-  return buf;
-}
-
-// ---------------------------------------------------------------------------
-// Mosaic OID constants (must match production CaService)
-// ---------------------------------------------------------------------------
-
-const OID_MOSAIC_GRANT_ID = '1.3.6.1.4.1.99999.1';
-const OID_MOSAIC_SUBJECT_USER_ID = '1.3.6.1.4.1.99999.2';
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-/**
- * Generate a minimal self-signed EC P-256 certificate valid for 1 day.
- * CN=harness-test, no custom extensions.
- *
- * Suitable for:
- *  - EnrollmentService.extractCertNotAfter (just needs parseable PEM)
- *  - Any mock that returns certPem / certChainPem without OID checks
- */
-export async function makeSelfSignedCert(): Promise<string> {
-  // Ensure @peculiar/x509 uses Node.js webcrypto (available as globalThis.crypto in Node 19+,
-  // but we set it explicitly here to be safe on all Node 18+ versions).
-  cryptoProvider.set(webcrypto as unknown as Parameters<typeof cryptoProvider.set>[0]);
-
-  const alg = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' } as const;
-  const keys = await webcrypto.subtle.generateKey(alg, false, ['sign', 'verify']);
-
-  const now = new Date();
-  const tomorrow = new Date(now.getTime() + 86_400_000);
-
-  const cert = await X509CertificateGenerator.createSelfSigned({
-    serialNumber: '01',
-    name: 'CN=harness-test',
-    notBefore: now,
-    notAfter: tomorrow,
-    signingAlgorithm: alg,
-    keys,
-    extensions: [
-      new BasicConstraintsExtension(false),
-      new KeyUsagesExtension(KeyUsageFlags.digitalSignature),
-    ],
-  });
-
-  return cert.toString('pem');
-}
-
-/**
- * Generate a self-signed EC P-256 certificate that contains the two custom
- * Mosaic OID extensions required by CaService.issueCert's CRIT-1 check:
- *   OID 1.3.6.1.4.1.99999.1  → mosaic_grant_id   (value = grantId)
- *   OID 1.3.6.1.4.1.99999.2  → mosaic_subject_user_id (value = subjectUserId)
- *
- * The extension value encoding matches the production parser's `.slice(2)` assumption:
- * each extension value is an OCTET STRING wrapping an ASN.1 UTF8String TLV.
- */
-export async function makeMosaicIssuedCert(opts: {
-  grantId: string;
-  subjectUserId: string;
-}): Promise<string> {
-  // Ensure @peculiar/x509 uses Node.js webcrypto.
-  cryptoProvider.set(webcrypto as unknown as Parameters<typeof cryptoProvider.set>[0]);
-
-  const alg = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' } as const;
-  const keys = await webcrypto.subtle.generateKey(alg, false, ['sign', 'verify']);
-
-  const now = new Date();
-  const tomorrow = new Date(now.getTime() + 86_400_000);
-
-  const cert = await X509CertificateGenerator.createSelfSigned({
-    serialNumber: '01',
-    name: 'CN=mosaic-issued-test',
-    notBefore: now,
-    notAfter: tomorrow,
-    signingAlgorithm: alg,
-    keys,
-    extensions: [
-      new BasicConstraintsExtension(false),
-      new KeyUsagesExtension(KeyUsageFlags.digitalSignature),
-      // mosaic_grant_id — OID 1.3.6.1.4.1.99999.1
-      new Extension(OID_MOSAIC_GRANT_ID, false, encodeUtf8String(opts.grantId)),
-      // mosaic_subject_user_id — OID 1.3.6.1.4.1.99999.2
-      new Extension(OID_MOSAIC_SUBJECT_USER_ID, false, encodeUtf8String(opts.subjectUserId)),
-    ],
-  });
-
-  return cert.toString('pem');
-}
--- a/apps/gateway/src/federation/tests/peer-key.spec.ts
+++ b/apps/gateway/src/federation/tests/peer-key.spec.ts
@@ -1,63 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { sealClientKey, unsealClientKey } from '../peer-key.util.js';
-
-const TEST_SECRET = 'test-secret-for-peer-key-unit-tests-only';
-
-const TEST_PEM = `-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7o4qne60TB3wo
-pCOW8QqstpxEBpnFo37JxLYEJbpE3gUlJajsHv9UWRQ7m5B7n+MBXwTCQqMEY8Wl
-kHv9tGgz1YGwzBjNKxPJXE6pPTXQ1Oa0VB9l3qHdqF5HtZoJzE0c6dO8HJ5YUVL
-----END PRIVATE KEY-----`;
-
-let savedSecret: string | undefined;
-
-beforeEach(() => {
-  savedSecret = process.env['BETTER_AUTH_SECRET'];
-  process.env['BETTER_AUTH_SECRET'] = TEST_SECRET;
-});
-
-afterEach(() => {
-  if (savedSecret === undefined) {
-    delete process.env['BETTER_AUTH_SECRET'];
-  } else {
-    process.env['BETTER_AUTH_SECRET'] = savedSecret;
-  }
-});
-
-describe('peer-key seal/unseal', () => {
-  it('round-trip: unsealClientKey(sealClientKey(pem)) returns original pem', () => {
-    const sealed = sealClientKey(TEST_PEM);
-    const roundTripped = unsealClientKey(sealed);
-    expect(roundTripped).toBe(TEST_PEM);
-  });
-
-  it('non-determinism: sealClientKey produces different ciphertext each call', () => {
-    const sealed1 = sealClientKey(TEST_PEM);
-    const sealed2 = sealClientKey(TEST_PEM);
-    expect(sealed1).not.toBe(sealed2);
-  });
-
-  it('at-rest: sealed output does not contain plaintext PEM content', () => {
-    const sealed = sealClientKey(TEST_PEM);
-    expect(sealed).not.toContain('PRIVATE KEY');
-    expect(sealed).not.toContain(
-      'MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7o4qne60TB3wo',
-    );
-  });
-
-  it('tamper: flipping a byte in the sealed payload causes unseal to throw', () => {
-    const sealed = sealClientKey(TEST_PEM);
-    const buf = Buffer.from(sealed, 'base64');
-    // Flip a byte in the middle of the buffer (past IV and authTag)
-    const midpoint = Math.floor(buf.length / 2);
-    buf[midpoint] = buf[midpoint]! ^ 0xff;
-    const tampered = buf.toString('base64');
-    expect(() => unsealClientKey(tampered)).toThrow();
-  });
-
-  it('missing secret: unsealClientKey throws when BETTER_AUTH_SECRET is unset', () => {
-    const sealed = sealClientKey(TEST_PEM);
-    delete process.env['BETTER_AUTH_SECRET'];
-    expect(() => unsealClientKey(sealed)).toThrow('BETTER_AUTH_SECRET is not set');
-  });
-});
--- a/apps/gateway/src/federation/ca.dto.ts
+++ b/apps/gateway/src/federation/ca.dto.ts
@@ -1,57 +0,0 @@
-/**
- * DTOs for the Step-CA client service (FED-M2-04).
- *
- * IssueCertRequestDto  — input to CaService.issueCert()
- * IssuedCertDto        — output from CaService.issueCert()
- */
-
-import { IsInt, IsNotEmpty, IsOptional, IsString, IsUUID, Max, Min } from 'class-validator';
-
-export class IssueCertRequestDto {
-  /**
-   * PEM-encoded PKCS#10 Certificate Signing Request.
-   * The CSR must already include the desired SANs.
-   */
-  @IsString()
-  @IsNotEmpty()
-  csrPem!: string;
-
-  /**
-   * UUID of the federation_grants row this certificate is being issued for.
-   * Embedded as the `mosaic_grant_id` custom OID extension.
-   */
-  @IsUUID()
-  grantId!: string;
-
-  /**
-   * UUID of the local user on whose behalf the cert is being issued.
-   * Embedded as the `mosaic_subject_user_id` custom OID extension.
-   */
-  @IsUUID()
-  subjectUserId!: string;
-
-  /**
-   * Requested certificate validity in seconds.
-   * Hard cap: 900 s (15 minutes). Default: 300 s (5 minutes).
-   * The service will always clamp to 900 s regardless of this value.
-   */
-  @IsOptional()
-  @IsInt()
-  @Min(60)
-  @Max(15 * 60)
-  ttlSeconds: number = 300;
-}
-
-export class IssuedCertDto {
-  /** PEM-encoded leaf certificate returned by step-ca. */
-  certPem!: string;
-
-  /**
-   * PEM-encoded full certificate chain (leaf + intermediates + root).
-   * Falls back to `certPem` when step-ca returns no `certChain` field.
-   */
-  certChainPem!: string;
-
-  /** Decimal serial number string of the issued certificate. */
-  serialNumber!: string;
-}
--- a/apps/gateway/src/federation/ca.service.spec.ts
+++ b/apps/gateway/src/federation/ca.service.spec.ts
@@ -1,592 +0,0 @@
-/**
- * Unit tests for CaService — Step-CA client (FED-M2-04).
- *
- * Coverage:
- *  - Happy path: returns IssuedCertDto with certPem, certChainPem, serialNumber
- *  - certChainPem fallback: falls back to certPem when certChain absent
- *  - certChainPem from ca field: uses crt+ca when certChain absent but ca present
- *  - HTTP 401: throws CaServiceError with cause + remediation
- *  - HTTP non-401 error: throws CaServiceError
- *  - Malformed CSR: throws before HTTP call (INVALID_CSR)
- *  - Non-JSON response: throws CaServiceError
- *  - HTTPS connection error: throws CaServiceError
- *  - JWT custom claims: mosaic_grant_id and mosaic_subject_user_id present in OTT payload
- *    verified with jose.jwtVerify (real signature check)
- *  - CaServiceError: has cause + remediation properties
- *  - Missing crt in response: throws CaServiceError
- *  - Real CSR validation: valid P-256 CSR passes; malformed CSR fails with INVALID_CSR
- *  - provisionerPassword never appears in CaServiceError messages
- *  - HTTPS-only enforcement: http:// URL throws in constructor
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach, beforeAll, type Mock } from 'vitest';
-import { jwtVerify, exportJWK, generateKeyPair } from 'jose';
-import { Pkcs10CertificateRequestGenerator } from '@peculiar/x509';
-import { makeMosaicIssuedCert } from './__tests__/helpers/test-cert.js';
-
-// ---------------------------------------------------------------------------
-// Mock node:https BEFORE importing CaService so the mock is in place when
-// the module is loaded. Vitest/ESM require vi.mock at the top level.
-// ---------------------------------------------------------------------------
-
-vi.mock('node:https', () => {
-  const mockRequest = vi.fn();
-  const mockAgent = vi.fn().mockImplementation(() => ({}));
-  return {
-    default: { request: mockRequest, Agent: mockAgent },
-    request: mockRequest,
-    Agent: mockAgent,
-  };
-});
-
-vi.mock('node:fs', () => {
-  const mockReadFileSync = vi
-    .fn()
-    .mockReturnValue('-----BEGIN CERTIFICATE-----\nFAKEROOT\n-----END CERTIFICATE-----\n');
-  return {
-    default: { readFileSync: mockReadFileSync },
-    readFileSync: mockReadFileSync,
-  };
-});
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-// Real self-signed EC P-256 certificate generated with openssl for testing.
-// openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout /dev/null \
-//   -out /dev/stdout -subj "/CN=test" -days 1
-const FAKE_CERT_PEM = `-----BEGIN CERTIFICATE-----
-MIIBdDCCARmgAwIBAgIUM+iUJSayN+PwXkyVN6qwSY7sr6gwCgYIKoZIzj0EAwIw
-DzENMAsGA1UEAwwEdGVzdDAeFw0yNjA0MjIwMzE5MTlaFw0yNjA0MjMwMzE5MTla
-MA8xDTALBgNVBAMMBHRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR21kHL
-n1GmFQ4TEBw3EA53pD+2McIBf5WcoHE+x0eMz5DpRKJe0ksHwOVN5Yev5d57kb+4
-MvG1LhbHCB/uQo8So1MwUTAdBgNVHQ4EFgQUPq0pdIGiQ7pLBRXICS8GTliCrLsw
-HwYDVR0jBBgwFoAUPq0pdIGiQ7pLBRXICS8GTliCrLswDwYDVR0TAQH/BAUwAwEB
-/zAKBggqhkjOPQQDAgNJADBGAiEAypJqyC6S77aQ3eEXokM6sgAsD7Oa3tJbCbVm
-zG3uJb0CIQC1w+GE+Ad0OTR5Quja46R1RjOo8ydpzZ7Fh4rouAiwEw==
-----END CERTIFICATE-----
-`;
-
-// Use a second copy of the same cert for the CA field in tests.
-const FAKE_CA_PEM = FAKE_CERT_PEM;
-
-const GRANT_ID = 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11';
-const SUBJECT_USER_ID = 'b1ffcd00-0d1c-5f09-cc7e-7cc0ce491b22';
-
-// Real self-signed cert containing both Mosaic OID extensions — populated in beforeAll.
-// Required because CaService.issueCert performs CRIT-1 OID presence/value checks on the
-// response cert (PR #501 — strict parsing, no silent fallback).
-let realIssuedCertPem: string;
-
-// ---------------------------------------------------------------------------
-// Generate a real EC P-256 key pair and CSR for integration-style tests
-// ---------------------------------------------------------------------------
-
-// We generate this once at module level so it's available to all tests.
-// The key pair and CSR PEM are populated asynchronously in the test that needs them.
-
-let realCsrPem: string;
-
-async function generateRealCsr(): Promise<string> {
-  const { privateKey, publicKey } = await generateKeyPair('ES256');
-  // Export public key JWK for potential verification (not used here but confirms key is exportable)
-  await exportJWK(publicKey);
-
-  // Use @peculiar/x509 to build a proper CSR
-  const csr = await Pkcs10CertificateRequestGenerator.create({
-    name: 'CN=test.federation.local',
-    signingAlgorithm: { name: 'ECDSA', hash: 'SHA-256' },
-    keys: { privateKey, publicKey },
-  });
-
-  return csr.toString('pem');
-}
-
-// ---------------------------------------------------------------------------
-// Setup env before importing service
-// We use an EC P-256 key pair here so the JWK-based signing works.
-// The key pair is generated once and stored in module-level vars.
-// ---------------------------------------------------------------------------
-
-// Real EC P-256 test JWK (test-only, never used in production).
-// Generated with node webcrypto for use in unit tests.
-const TEST_EC_PRIVATE_JWK = {
-  key_ops: ['sign'],
-  ext: true,
-  kty: 'EC',
-  x: 'Xq2RjZctcPcUMU14qfjs3MtZTmFk8z1lFGQyypgXZOU',
-  y: 't8w9Cbt4RVmR47Wnb_i5cLwefEnMcvwse049zu9Rl_E',
-  crv: 'P-256',
-  d: 'TM6N79w1HE-PiML5Td4mbXfJaLHEaZrVyVrrwlJv7q8',
-  kid: 'test-ec-kid',
-};
-
-const TEST_EC_PUBLIC_JWK = {
-  key_ops: ['verify'],
-  ext: true,
-  kty: 'EC',
-  x: 'Xq2RjZctcPcUMU14qfjs3MtZTmFk8z1lFGQyypgXZOU',
-  y: 't8w9Cbt4RVmR47Wnb_i5cLwefEnMcvwse049zu9Rl_E',
-  crv: 'P-256',
-  kid: 'test-ec-kid',
-};
-
-process.env['STEP_CA_URL'] = 'https://step-ca:9000';
-process.env['STEP_CA_PROVISIONER_KEY_JSON'] = JSON.stringify(TEST_EC_PRIVATE_JWK);
-process.env['STEP_CA_ROOT_CERT_PATH'] = '/fake/root.pem';
-
-// Import AFTER env is set and mocks are registered
-import * as httpsModule from 'node:https';
-import { CaService, CaServiceError } from './ca.service.js';
-import type { IssueCertRequestDto } from './ca.dto.js';
-
-// ---------------------------------------------------------------------------
-// Helper to build a mock https.request that simulates step-ca
-// ---------------------------------------------------------------------------
-
-function makeHttpsMock(statusCode: number, body: unknown, errorMsg?: string): void {
-  const mockReq = {
-    write: vi.fn(),
-    end: vi.fn(),
-    on: vi.fn(),
-    setTimeout: vi.fn(),
-  };
-
-  (httpsModule.request as unknown as Mock).mockImplementation(
-    (
-      _options: unknown,
-      callback: (res: {
-        statusCode: number;
-        on: (event: string, cb: (chunk?: Buffer) => void) => void;
-      }) => void,
-    ) => {
-      const mockRes = {
-        statusCode,
-        on: (event: string, cb: (chunk?: Buffer) => void) => {
-          if (event === 'data') {
-            if (body !== undefined) {
-              cb(Buffer.from(typeof body === 'string' ? body : JSON.stringify(body)));
-            }
-          }
-          if (event === 'end') {
-            cb();
-          }
-        },
-      };
-
-      if (errorMsg) {
-        // Simulate a connection error via the req.on('error') handler
-        mockReq.on.mockImplementation((event: string, cb: (err: Error) => void) => {
-          if (event === 'error') {
-            setImmediate(() => cb(new Error(errorMsg)));
-          }
-        });
-      } else {
-        // Normal flow: call the response callback
-        setImmediate(() => callback(mockRes));
-      }
-
-      return mockReq;
-    },
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('CaService', () => {
-  let service: CaService;
-
-  beforeAll(async () => {
-    // Generate a cert with the two Mosaic OIDs so that CaService.issueCert's
-    // CRIT-1 OID checks pass when mock step-ca returns it as `crt`.
-    realIssuedCertPem = await makeMosaicIssuedCert({
-      grantId: GRANT_ID,
-      subjectUserId: SUBJECT_USER_ID,
-    });
-  });
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    service = new CaService();
-  });
-
-  function makeReq(overrides: Partial<IssueCertRequestDto> = {}): IssueCertRequestDto {
-    // Use a real CSR if available; fall back to a minimal placeholder
-    const defaultCsr = realCsrPem ?? makeFakeCsr();
-    return {
-      csrPem: defaultCsr,
-      grantId: GRANT_ID,
-      subjectUserId: SUBJECT_USER_ID,
-      ttlSeconds: 300,
-      ...overrides,
-    };
-  }
-
-  function makeFakeCsr(): string {
-    // A structurally valid-looking CSR header/footer (body will fail crypto verify)
-    return `-----BEGIN CERTIFICATE REQUEST-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0000000000000000AAAA\n-----END CERTIFICATE REQUEST-----\n`;
-  }
-
-  // -------------------------------------------------------------------------
-  // Real CSR generation — runs once and populates realCsrPem
-  // -------------------------------------------------------------------------
-
-  it('generates a real P-256 CSR that passes validateCsr', async () => {
-    realCsrPem = await generateRealCsr();
-    expect(realCsrPem).toMatch(/BEGIN CERTIFICATE REQUEST/);
-
-    // Now test that the service's validateCsr accepts it.
-    // We call it indirectly via issueCert with a successful mock.
-    makeHttpsMock(200, { crt: realIssuedCertPem, certChain: [realIssuedCertPem, FAKE_CA_PEM] });
-    const result = await service.issueCert(makeReq({ csrPem: realCsrPem }));
-    expect(result.certPem).toBe(realIssuedCertPem);
-  });
-
-  it('throws INVALID_CSR for a malformed PEM-shaped CSR', async () => {
-    const malformedCsr =
-      '-----BEGIN CERTIFICATE REQUEST-----\nTm90QVJlYWxDU1I=\n-----END CERTIFICATE REQUEST-----\n';
-
-    await expect(service.issueCert(makeReq({ csrPem: malformedCsr }))).rejects.toSatisfy(
-      (err: unknown) => {
-        if (!(err instanceof CaServiceError)) return false;
-        expect(err.code).toBe('INVALID_CSR');
-        return true;
-      },
-    );
-  });
-
-  // -------------------------------------------------------------------------
-  // Happy path
-  // -------------------------------------------------------------------------
-
-  it('returns IssuedCertDto on success (certChain present)', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(200, {
-      crt: realIssuedCertPem,
-      certChain: [realIssuedCertPem, FAKE_CA_PEM],
-    });
-
-    const result = await service.issueCert(makeReq());
-
-    expect(result.certPem).toBe(realIssuedCertPem);
-    expect(result.certChainPem).toContain(realIssuedCertPem);
-    expect(result.certChainPem).toContain(FAKE_CA_PEM);
-    expect(typeof result.serialNumber).toBe('string');
-  });
-
-  // -------------------------------------------------------------------------
-  // certChainPem fallback — certChain absent, ca field present
-  // -------------------------------------------------------------------------
-
-  it('builds certChainPem from crt+ca when certChain is absent', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(200, {
-      crt: realIssuedCertPem,
-      ca: FAKE_CA_PEM,
-    });
-
-    const result = await service.issueCert(makeReq());
-
-    expect(result.certPem).toBe(realIssuedCertPem);
-    expect(result.certChainPem).toContain(realIssuedCertPem);
-    expect(result.certChainPem).toContain(FAKE_CA_PEM);
-  });
-
-  // -------------------------------------------------------------------------
-  // certChainPem fallback — no certChain, no ca field
-  // -------------------------------------------------------------------------
-
-  it('falls back to certPem alone when certChain and ca are absent', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(200, { crt: realIssuedCertPem });
-
-    const result = await service.issueCert(makeReq());
-
-    expect(result.certPem).toBe(realIssuedCertPem);
-    expect(result.certChainPem).toBe(realIssuedCertPem);
-  });
-
-  // -------------------------------------------------------------------------
-  // HTTP 401
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError on HTTP 401', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(401, { message: 'Unauthorized' });
-
-    await expect(service.issueCert(makeReq())).rejects.toSatisfy((err: unknown) => {
-      if (!(err instanceof CaServiceError)) return false;
-      expect(err.message).toMatch(/401/);
-      expect(err.remediation).toBeTruthy();
-      return true;
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // HTTP non-401 error (e.g. 422)
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError on HTTP 422', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(422, { message: 'Unprocessable Entity' });
-
-    await expect(service.issueCert(makeReq())).rejects.toBeInstanceOf(CaServiceError);
-  });
-
-  // -------------------------------------------------------------------------
-  // Malformed CSR — throws before HTTP call
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError for malformed CSR without making HTTP call', async () => {
-    const requestSpy = vi.spyOn(httpsModule, 'request');
-
-    await expect(service.issueCert(makeReq({ csrPem: 'not-a-valid-csr' }))).rejects.toBeInstanceOf(
-      CaServiceError,
-    );
-
-    expect(requestSpy).not.toHaveBeenCalled();
-  });
-
-  // -------------------------------------------------------------------------
-  // Non-JSON response
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError when step-ca returns non-JSON', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(200, 'this is not json');
-
-    await expect(service.issueCert(makeReq())).rejects.toSatisfy((err: unknown) => {
-      if (!(err instanceof CaServiceError)) return false;
-      expect(err.message).toMatch(/non-JSON/);
-      return true;
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // HTTPS connection error
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError on HTTPS connection error', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(0, undefined, 'connect ECONNREFUSED 127.0.0.1:9000');
-
-    await expect(service.issueCert(makeReq())).rejects.toSatisfy((err: unknown) => {
-      if (!(err instanceof CaServiceError)) return false;
-      expect(err.message).toMatch(/HTTPS connection/);
-      expect(err.cause).toBeInstanceOf(Error);
-      return true;
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // JWT custom claims: mosaic_grant_id and mosaic_subject_user_id
-  // Verified with jose.jwtVerify for real signature verification (M6)
-  // -------------------------------------------------------------------------
-
-  it('OTT contains mosaic_grant_id, mosaic_subject_user_id, and jti; signature verifies with jose', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-
-    let capturedBody: Record<string, unknown> | undefined;
-
-    const mockReq = {
-      write: vi.fn((data: string) => {
-        capturedBody = JSON.parse(data) as Record<string, unknown>;
-      }),
-      end: vi.fn(),
-      on: vi.fn(),
-      setTimeout: vi.fn(),
-    };
-
-    (httpsModule.request as unknown as Mock).mockImplementation(
-      (
-        _options: unknown,
-        callback: (res: {
-          statusCode: number;
-          on: (event: string, cb: (chunk?: Buffer) => void) => void;
-        }) => void,
-      ) => {
-        const mockRes = {
-          statusCode: 200,
-          on: (event: string, cb: (chunk?: Buffer) => void) => {
-            if (event === 'data') {
-              cb(Buffer.from(JSON.stringify({ crt: realIssuedCertPem })));
-            }
-            if (event === 'end') {
-              cb();
-            }
-          },
-        };
-        setImmediate(() => callback(mockRes));
-        return mockReq;
-      },
-    );
-
-    await service.issueCert(makeReq({ csrPem: realCsrPem }));
-
-    expect(capturedBody).toBeDefined();
-    const ott = capturedBody!['ott'] as string;
-    expect(typeof ott).toBe('string');
-
-    // Verify JWT structure
-    const parts = ott.split('.');
-    expect(parts).toHaveLength(3);
-
-    // Decode payload without signature check first
-    const payloadJson = Buffer.from(parts[1]!, 'base64url').toString('utf8');
-    const payload = JSON.parse(payloadJson) as Record<string, unknown>;
-
-    expect(payload['mosaic_grant_id']).toBe(GRANT_ID);
-    expect(payload['mosaic_subject_user_id']).toBe(SUBJECT_USER_ID);
-    expect(typeof payload['jti']).toBe('string'); // M2: jti present
-    expect(payload['jti']).toMatch(/^[0-9a-f-]{36}$/); // UUID format
-
-    // M3: top-level sha should NOT be present; step.sha should be present
-    expect(payload['sha']).toBeUndefined();
-    const step = payload['step'] as Record<string, unknown> | undefined;
-    expect(step?.['sha']).toBeDefined();
-
-    // M6: Verify signature with jose.jwtVerify using the public key
-    const { importJWK: importJose } = await import('jose');
-    const publicKey = await importJose(TEST_EC_PUBLIC_JWK, 'ES256');
-    const verified = await jwtVerify(ott, publicKey);
-    expect(verified.payload['mosaic_grant_id']).toBe(GRANT_ID);
-  });
-
-  // -------------------------------------------------------------------------
-  // CaServiceError has cause + remediation
-  // -------------------------------------------------------------------------
-
-  it('CaServiceError carries cause and remediation', () => {
-    const cause = new Error('original error');
-    const err = new CaServiceError('something went wrong', 'fix it like this', cause);
-
-    expect(err).toBeInstanceOf(Error);
-    expect(err).toBeInstanceOf(CaServiceError);
-    expect(err.message).toBe('something went wrong');
-    expect(err.remediation).toBe('fix it like this');
-    expect(err.cause).toBe(cause);
-    expect(err.name).toBe('CaServiceError');
-  });
-
-  // -------------------------------------------------------------------------
-  // Missing crt in response
-  // -------------------------------------------------------------------------
-
-  it('throws CaServiceError when response is missing the crt field', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(200, { ca: FAKE_CA_PEM });
-
-    await expect(service.issueCert(makeReq())).rejects.toSatisfy((err: unknown) => {
-      if (!(err instanceof CaServiceError)) return false;
-      expect(err.message).toMatch(/missing the "crt" field/);
-      return true;
-    });
-  });
-
-  // -------------------------------------------------------------------------
-  // M6: provisionerPassword must never appear in CaServiceError messages
-  // -------------------------------------------------------------------------
-
-  it('provisionerPassword does not appear in any CaServiceError message', async () => {
-    // Temporarily set a recognizable password to test against
-    const originalPassword = process.env['STEP_CA_PROVISIONER_PASSWORD'];
-    process.env['STEP_CA_PROVISIONER_PASSWORD'] = 'super-secret-password-12345';
-
-    // Generate a bad CSR to trigger an error path
-    const caughtErrors: CaServiceError[] = [];
-    try {
-      await service.issueCert(makeReq({ csrPem: 'not-a-csr' }));
-    } catch (err) {
-      if (err instanceof CaServiceError) {
-        caughtErrors.push(err);
-      }
-    }
-
-    // Also try HTTP 401 path
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-    makeHttpsMock(401, { message: 'Unauthorized' });
-    try {
-      await service.issueCert(makeReq({ csrPem: realCsrPem }));
-    } catch (err) {
-      if (err instanceof CaServiceError) {
-        caughtErrors.push(err);
-      }
-    }
-
-    for (const err of caughtErrors) {
-      expect(err.message).not.toContain('super-secret-password-12345');
-      if (err.remediation) {
-        expect(err.remediation).not.toContain('super-secret-password-12345');
-      }
-    }
-
-    process.env['STEP_CA_PROVISIONER_PASSWORD'] = originalPassword;
-  });
-
-  // -------------------------------------------------------------------------
-  // M7: HTTPS-only enforcement in constructor
-  // -------------------------------------------------------------------------
-
-  it('throws in constructor if STEP_CA_URL uses http://', () => {
-    const originalUrl = process.env['STEP_CA_URL'];
-    process.env['STEP_CA_URL'] = 'http://step-ca:9000';
-
-    expect(() => new CaService()).toThrow(CaServiceError);
-
-    process.env['STEP_CA_URL'] = originalUrl;
-  });
-
-  // -------------------------------------------------------------------------
-  // TTL clamp: ttlSeconds is clamped to 900 s (15 min) maximum
-  // -------------------------------------------------------------------------
-
-  it('clamps ttlSeconds to 900 s regardless of input', async () => {
-    if (!realCsrPem) realCsrPem = await generateRealCsr();
-
-    let capturedBody: Record<string, unknown> | undefined;
-
-    const mockReq = {
-      write: vi.fn((data: string) => {
-        capturedBody = JSON.parse(data) as Record<string, unknown>;
-      }),
-      end: vi.fn(),
-      on: vi.fn(),
-      setTimeout: vi.fn(),
-    };
-
-    (httpsModule.request as unknown as Mock).mockImplementation(
-      (
-        _options: unknown,
-        callback: (res: {
-          statusCode: number;
-          on: (event: string, cb: (chunk?: Buffer) => void) => void;
-        }) => void,
-      ) => {
-        const mockRes = {
-          statusCode: 200,
-          on: (event: string, cb: (chunk?: Buffer) => void) => {
-            if (event === 'data') {
-              cb(Buffer.from(JSON.stringify({ crt: realIssuedCertPem })));
-            }
-            if (event === 'end') {
-              cb();
-            }
-          },
-        };
-        setImmediate(() => callback(mockRes));
-        return mockReq;
-      },
-    );
-
-    // Request 86400 s — should be clamped to 900
-    await service.issueCert(makeReq({ ttlSeconds: 86400 }));
-
-    expect(capturedBody).toBeDefined();
-    const validity = capturedBody!['validity'] as Record<string, unknown>;
-    expect(validity['duration']).toBe('900s');
-  });
-});
--- a/apps/gateway/src/federation/ca.service.ts
+++ b/apps/gateway/src/federation/ca.service.ts
@@ -1,680 +0,0 @@
-/**
- * CaService — Step-CA client for federation grant certificate issuance.
- *
- * Responsibilities:
- *  1. Build a JWK-provisioner One-Time Token (OTT) signed with the provisioner
- *     private key (ES256/ES384/RS256 per JWK kty/crv) carrying Mosaic-specific
- *     claims (`mosaic_grant_id`, `mosaic_subject_user_id`, `step.sha`) per the
- *     step-ca JWK provisioner protocol.
- *  2. POST the CSR + OTT to the step-ca `/1.0/sign` endpoint over HTTPS,
- *     pinning the trust to the CA root cert supplied via env.
- *  3. Return an IssuedCertDto containing the leaf cert, full chain, and
- *     serial number.
- *
- * Environment variables (all required at runtime — validated in constructor):
- *   STEP_CA_URL                   https://step-ca:9000
- *   STEP_CA_PROVISIONER_KEY_JSON  JWK provisioner private key (JSON)
- *   STEP_CA_ROOT_CERT_PATH        Absolute path to the CA root PEM
- *
- * Optional (only used for JWK PBES2 decrypt at startup if key is encrypted):
- *   STEP_CA_PROVISIONER_PASSWORD  JWK provisioner password (raw string)
- *
- * Custom OID registry (PRD §6, docs/federation/SETUP.md):
- *   1.3.6.1.4.1.99999.1  — mosaic_grant_id
- *   1.3.6.1.4.1.99999.2  — mosaic_subject_user_id
- *
- * Fail-loud contract:
- *   Every error path throws CaServiceError with a human-readable `remediation`
- *   field. Silent OID-stripping is NEVER allowed — if the sign response does
- *   not include the cert, we throw rather than return a cert that may be
- *   missing the custom extensions.
- */
-
-import { Injectable, Logger } from '@nestjs/common';
-import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import * as https from 'node:https';
-import { SignJWT, importJWK } from 'jose';
-import { Pkcs10CertificateRequest, X509Certificate } from '@peculiar/x509';
-import type { IssueCertRequestDto } from './ca.dto.js';
-import { IssuedCertDto } from './ca.dto.js';
-
-// ---------------------------------------------------------------------------
-// Custom error class
-// ---------------------------------------------------------------------------
-
-export class CaServiceError extends Error {
-  readonly cause: unknown;
-  readonly remediation: string;
-  readonly code?: string;
-
-  constructor(message: string, remediation: string, cause?: unknown, code?: string) {
-    super(message);
-    this.name = 'CaServiceError';
-    this.cause = cause;
-    this.remediation = remediation;
-    this.code = code;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Internal types
-// ---------------------------------------------------------------------------
-
-interface StepSignResponse {
-  crt: string;
-  ca?: string;
-  certChain?: string[];
-}
-
-interface JwkKey {
-  kty: string;
-  kid?: string;
-  use?: string;
-  alg?: string;
-  k?: string; // symmetric
-  n?: string; // RSA
-  e?: string;
-  d?: string;
-  x?: string; // EC
-  y?: string;
-  crv?: string;
-  [key: string]: unknown;
-}
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/** UUID regex for validation */
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-/**
- * Derive the JWT algorithm string from a JWK's kty/crv fields.
- * EC P-256 → ES256, EC P-384 → ES384, RSA → RS256.
- */
-function algFromJwk(jwk: JwkKey): string {
-  if (jwk.alg) return jwk.alg;
-  if (jwk.kty === 'EC') {
-    if (jwk.crv === 'P-384') return 'ES384';
-    return 'ES256'; // default for P-256 and Ed25519-style EC keys
-  }
-  if (jwk.kty === 'RSA') return 'RS256';
-  throw new CaServiceError(
-    `Unsupported JWK kty: ${jwk.kty}`,
-    'STEP_CA_PROVISIONER_KEY_JSON must be an EC (P-256/P-384) or RSA JWK private key.',
-  );
-}
-
-/**
- * Compute SHA-256 fingerprint of the DER-encoded CSR body.
- * step-ca uses this as the `step.sha` claim to bind the OTT to a specific CSR.
- */
-function csrFingerprint(csrPem: string): string {
-  // Strip PEM headers and decode base64 body
-  const b64 = csrPem
-    .replace(/-----BEGIN CERTIFICATE REQUEST-----/, '')
-    .replace(/-----END CERTIFICATE REQUEST-----/, '')
-    .replace(/\s+/g, '');
-
-  let derBuf: Buffer;
-  try {
-    derBuf = Buffer.from(b64, 'base64');
-  } catch (err) {
-    throw new CaServiceError(
-      'Failed to base64-decode the CSR PEM body',
-      'Verify that csrPem is a valid PKCS#10 PEM-encoded certificate request.',
-      err,
-    );
-  }
-
-  if (derBuf.length === 0) {
-    throw new CaServiceError(
-      'CSR PEM decoded to empty buffer — malformed input',
-      'Provide a valid non-empty PKCS#10 PEM-encoded certificate request.',
-    );
-  }
-
-  return crypto.createHash('sha256').update(derBuf).digest('hex');
-}
-
-/**
- * Send a JSON POST to the step-ca sign endpoint.
- * Returns the parsed response body or throws CaServiceError.
- */
-function httpsPost(url: string, body: unknown, agent: https.Agent): Promise<StepSignResponse> {
-  return new Promise((resolve, reject) => {
-    const bodyStr = JSON.stringify(body);
-    const parsed = new URL(url);
-
-    const options: https.RequestOptions = {
-      hostname: parsed.hostname,
-      port: parsed.port ? parseInt(parsed.port, 10) : 443,
-      path: parsed.pathname,
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(bodyStr),
-      },
-      agent,
-      timeout: 5000,
-    };
-
-    const req = https.request(options, (res) => {
-      const chunks: Buffer[] = [];
-      res.on('data', (chunk: Buffer) => chunks.push(chunk));
-      res.on('end', () => {
-        const raw = Buffer.concat(chunks).toString('utf8');
-
-        if (res.statusCode === 401) {
-          reject(
-            new CaServiceError(
-              `step-ca returned HTTP 401 — invalid or expired OTT`,
-              'Check STEP_CA_PROVISIONER_KEY_JSON. Ensure the mosaic-fed provisioner is configured in the CA.',
-            ),
-          );
-          return;
-        }
-
-        if (res.statusCode && res.statusCode >= 400) {
-          reject(
-            new CaServiceError(
-              `step-ca returned HTTP ${res.statusCode}: ${raw.slice(0, 256)}`,
-              `Review the step-ca logs. Status ${res.statusCode} may indicate a CSR policy violation or misconfigured provisioner.`,
-            ),
-          );
-          return;
-        }
-
-        let parsed: unknown;
-        try {
-          parsed = JSON.parse(raw) as unknown;
-        } catch (err) {
-          reject(
-            new CaServiceError(
-              'step-ca returned a non-JSON response',
-              'Verify STEP_CA_URL points to a running step-ca instance and that TLS is properly configured.',
-              err,
-            ),
-          );
-          return;
-        }
-
-        resolve(parsed as StepSignResponse);
-      });
-    });
-
-    req.setTimeout(5000, () => {
-      req.destroy(new Error('Request timed out after 5000ms'));
-    });
-
-    req.on('error', (err: Error) => {
-      reject(
-        new CaServiceError(
-          `HTTPS connection to step-ca failed: ${err.message}`,
-          'Ensure STEP_CA_URL is reachable and STEP_CA_ROOT_CERT_PATH points to the correct CA root certificate.',
-          err,
-        ),
-      );
-    });
-
-    req.write(bodyStr);
-    req.end();
-  });
-}
-
-/**
- * Extract a decimal serial number from a PEM certificate.
- * Throws CaServiceError on failure — never silently returns 'unknown'.
- */
-function extractSerial(certPem: string): string {
-  let cert: crypto.X509Certificate;
-  try {
-    cert = new crypto.X509Certificate(certPem);
-  } catch (err) {
-    throw new CaServiceError(
-      'Failed to parse the issued certificate PEM',
-      'The certificate returned by step-ca could not be parsed. Check that step-ca is returning a valid PEM certificate.',
-      err,
-      'CERT_PARSE',
-    );
-  }
-  return cert.serialNumber;
-}
-
-// ---------------------------------------------------------------------------
-// Service
-// ---------------------------------------------------------------------------
-
-@Injectable()
-export class CaService {
-  private readonly logger = new Logger(CaService.name);
-
-  private readonly caUrl: string;
-  private readonly rootCertPath: string;
-  private readonly httpsAgent: https.Agent;
-  private readonly jwk: JwkKey;
-  private cachedPrivateKey: crypto.KeyObject | null = null;
-  private readonly jwtAlg: string;
-  private readonly kid: string;
-
-  constructor() {
-    const caUrl = process.env['STEP_CA_URL'];
-    const provisionerKeyJson = process.env['STEP_CA_PROVISIONER_KEY_JSON'];
-    const rootCertPath = process.env['STEP_CA_ROOT_CERT_PATH'];
-
-    if (!caUrl) {
-      throw new CaServiceError(
-        'STEP_CA_URL is not set',
-        'Set STEP_CA_URL to the base URL of the step-ca instance, e.g. https://step-ca:9000',
-      );
-    }
-
-    // Enforce HTTPS-only URL
-    let parsedUrl: URL;
-    try {
-      parsedUrl = new URL(caUrl);
-    } catch (err) {
-      throw new CaServiceError(
-        `STEP_CA_URL is not a valid URL: ${caUrl}`,
-        'Set STEP_CA_URL to a valid HTTPS URL, e.g. https://step-ca:9000',
-        err,
-      );
-    }
-    if (parsedUrl.protocol !== 'https:') {
-      throw new CaServiceError(
-        `STEP_CA_URL must use HTTPS — got: ${parsedUrl.protocol}`,
-        'Set STEP_CA_URL to an https:// URL. Unencrypted connections to the CA are not permitted.',
-      );
-    }
-
-    if (!provisionerKeyJson) {
-      throw new CaServiceError(
-        'STEP_CA_PROVISIONER_KEY_JSON is not set',
-        'Set STEP_CA_PROVISIONER_KEY_JSON to the JSON-encoded JWK for the mosaic-fed provisioner.',
-      );
-    }
-    if (!rootCertPath) {
-      throw new CaServiceError(
-        'STEP_CA_ROOT_CERT_PATH is not set',
-        'Set STEP_CA_ROOT_CERT_PATH to the absolute path of the step-ca root CA certificate PEM file.',
-      );
-    }
-
-    // Parse JWK once — do NOT store the raw JSON string as a class field
-    let jwk: JwkKey;
-    try {
-      jwk = JSON.parse(provisionerKeyJson) as JwkKey;
-    } catch (err) {
-      throw new CaServiceError(
-        'STEP_CA_PROVISIONER_KEY_JSON is not valid JSON',
-        'Set STEP_CA_PROVISIONER_KEY_JSON to the JSON-serialised JWK object for the mosaic-fed provisioner.',
-        err,
-      );
-    }
-
-    // Derive algorithm from JWK metadata
-    const jwtAlg = algFromJwk(jwk);
-    const kid = jwk.kid ?? 'mosaic-fed';
-
-    // Import the JWK into a native KeyObject — fail loudly if it cannot be loaded.
-    // We do this synchronously here by calling the async importJWK via a blocking workaround.
-    // Actually importJWK is async, so we store it for use during token building.
-    // We keep the raw jwk object for later async import inside buildOtt.
-    // NOTE: We do NOT store provisionerKeyJson string as a class field.
-    this.jwk = jwk;
-    this.jwtAlg = jwtAlg;
-    this.kid = kid;
-
-    this.caUrl = caUrl;
-    this.rootCertPath = rootCertPath;
-
-    // Read the root cert and pin it for all HTTPS connections.
-    let rootCert: string;
-    try {
-      rootCert = fs.readFileSync(this.rootCertPath, 'utf8');
-    } catch (err) {
-      throw new CaServiceError(
-        `Cannot read STEP_CA_ROOT_CERT_PATH: ${rootCertPath}`,
-        'Ensure the file exists and is readable by the gateway process.',
-        err,
-      );
-    }
-
-    this.httpsAgent = new https.Agent({
-      ca: rootCert,
-      rejectUnauthorized: true,
-    });
-
-    this.logger.log(`CaService initialised — CA URL: ${this.caUrl}`);
-  }
-
-  /**
-   * Lazily import the private key from JWK on first use.
-   * The key is cached in cachedPrivateKey after first import.
-   */
-  private async getPrivateKey(): Promise<crypto.KeyObject> {
-    if (this.cachedPrivateKey !== null) return this.cachedPrivateKey;
-    try {
-      const key = await importJWK(this.jwk, this.jwtAlg);
-      // importJWK returns KeyLike (crypto.KeyObject | Uint8Array) — in Node.js it's KeyObject
-      this.cachedPrivateKey = key as unknown as crypto.KeyObject;
-      return this.cachedPrivateKey;
-    } catch (err) {
-      throw new CaServiceError(
-        'Failed to import STEP_CA_PROVISIONER_KEY_JSON as a cryptographic key',
-        'Ensure STEP_CA_PROVISIONER_KEY_JSON contains a valid JWK private key (EC P-256/P-384 or RSA).',
-        err,
-      );
-    }
-  }
-
-  /**
-   * Build the JWK-provisioner OTT signed with the provisioner private key.
-   * Algorithm is derived from the JWK kty/crv fields.
-   */
-  private async buildOtt(params: {
-    csrPem: string;
-    grantId: string;
-    subjectUserId: string;
-    ttlSeconds: number;
-    csrCn: string;
-  }): Promise<string> {
-    const { csrPem, grantId, subjectUserId, ttlSeconds, csrCn } = params;
-
-    // Validate UUID shape for grant id and subject user id
-    if (!UUID_RE.test(grantId)) {
-      throw new CaServiceError(
-        `grantId is not a valid UUID: ${grantId}`,
-        'Provide a valid UUID (RFC 4122) for grantId.',
-        undefined,
-        'INVALID_GRANT_ID',
-      );
-    }
-    if (!UUID_RE.test(subjectUserId)) {
-      throw new CaServiceError(
-        `subjectUserId is not a valid UUID: ${subjectUserId}`,
-        'Provide a valid UUID (RFC 4122) for subjectUserId.',
-        undefined,
-        'INVALID_GRANT_ID',
-      );
-    }
-
-    const sha = csrFingerprint(csrPem);
-    const now = Math.floor(Date.now() / 1000);
-    const privateKey = await this.getPrivateKey();
-
-    const ott = await new SignJWT({
-      iss: this.kid,
-      sub: csrCn, // M1: set sub to identity from CSR CN
-      aud: [`${this.caUrl}/1.0/sign`],
-      iat: now,
-      nbf: now - 30, // 30 s clock-skew tolerance
-      exp: now + Math.min(ttlSeconds, 3600), // OTT validity ≤ 1 h
-      jti: crypto.randomUUID(), // M2: unique token ID
-      // step.sha is the canonical field name used in the template — M3: keep only step.sha
-      step: { sha },
-      // Mosaic custom claims consumed by federation.tpl
-      mosaic_grant_id: grantId,
-      mosaic_subject_user_id: subjectUserId,
-    })
-      .setProtectedHeader({ alg: this.jwtAlg, typ: 'JWT', kid: this.kid })
-      .sign(privateKey);
-
-    return ott;
-  }
-
-  /**
-   * Validate a PEM-encoded CSR using @peculiar/x509.
-   * Verifies the self-signature, key type/size, and signature algorithm.
-   * Optionally verifies that the CSR's SANs match the expected set.
-   *
-   * Throws CaServiceError with code 'INVALID_CSR' on failure.
-   */
-  private async validateCsr(pem: string, expectedSans?: string[]): Promise<string> {
-    let csr: Pkcs10CertificateRequest;
-    try {
-      csr = new Pkcs10CertificateRequest(pem);
-    } catch (err) {
-      throw new CaServiceError(
-        'Failed to parse CSR PEM as a valid PKCS#10 certificate request',
-        'Provide a valid PEM-encoded PKCS#10 CSR.',
-        err,
-        'INVALID_CSR',
-      );
-    }
-
-    // Verify self-signature
-    let valid: boolean;
-    try {
-      valid = await csr.verify();
-    } catch (err) {
-      throw new CaServiceError(
-        'CSR signature verification threw an error',
-        'The CSR self-signature could not be verified. Ensure the CSR is properly formed.',
-        err,
-        'INVALID_CSR',
-      );
-    }
-    if (!valid) {
-      throw new CaServiceError(
-        'CSR self-signature is invalid',
-        'The CSR must be self-signed with the corresponding private key.',
-        undefined,
-        'INVALID_CSR',
-      );
-    }
-
-    // Validate signature algorithm — reject MD5 and SHA-1
-    // signatureAlgorithm is HashedAlgorithm which extends Algorithm.
-    // Cast through unknown to access .name and .hash.name without DOM lib globals.
-    const sigAlgAny = csr.signatureAlgorithm as unknown as {
-      name?: string;
-      hash?: { name?: string };
-    };
-    const sigAlgName = (sigAlgAny.name ?? '').toLowerCase();
-    const hashName = (sigAlgAny.hash?.name ?? '').toLowerCase();
-    if (
-      sigAlgName.includes('md5') ||
-      sigAlgName.includes('sha1') ||
-      hashName === 'sha-1' ||
-      hashName === 'sha1'
-    ) {
-      throw new CaServiceError(
-        `CSR uses a forbidden signature algorithm: ${sigAlgAny.name ?? 'unknown'}`,
-        'Use SHA-256 or stronger. MD5 and SHA-1 are not permitted.',
-        undefined,
-        'INVALID_CSR',
-      );
-    }
-
-    // Validate public key algorithm and strength via the algorithm descriptor on the key.
-    // csr.publicKey.algorithm is type Algorithm (WebCrypto) — use name-based checks.
-    // We cast to an extended interface to access curve/modulus info without DOM globals.
-    const pubKeyAlgo = csr.publicKey.algorithm as {
-      name: string;
-      namedCurve?: string;
-      modulusLength?: number;
-    };
-    const keyAlgoName = pubKeyAlgo.name;
-
-    if (keyAlgoName === 'RSASSA-PKCS1-v1_5' || keyAlgoName === 'RSA-PSS') {
-      const modulusLength = pubKeyAlgo.modulusLength ?? 0;
-      if (modulusLength < 2048) {
-        throw new CaServiceError(
-          `CSR RSA key is too short: ${modulusLength} bits (minimum 2048)`,
-          'Use an RSA key of at least 2048 bits.',
-          undefined,
-          'INVALID_CSR',
-        );
-      }
-    } else if (keyAlgoName === 'ECDSA') {
-      const namedCurve = pubKeyAlgo.namedCurve ?? '';
-      const allowedCurves = new Set(['P-256', 'P-384']);
-      if (!allowedCurves.has(namedCurve)) {
-        throw new CaServiceError(
-          `CSR EC key uses disallowed curve: ${namedCurve}`,
-          'Use EC P-256 or P-384. Other curves are not permitted.',
-          undefined,
-          'INVALID_CSR',
-        );
-      }
-    } else if (keyAlgoName === 'Ed25519') {
-      // Ed25519 is explicitly allowed
-    } else {
-      throw new CaServiceError(
-        `CSR uses unsupported key algorithm: ${keyAlgoName}`,
-        'Use EC (P-256/P-384), Ed25519, or RSA (≥2048 bit) keys.',
-        undefined,
-        'INVALID_CSR',
-      );
-    }
-
-    // Extract SANs if expectedSans provided
-    if (expectedSans && expectedSans.length > 0) {
-      // Get SANs from CSR extensions
-      const sanExtension = csr.extensions?.find(
-        (ext) => ext.type === '2.5.29.17', // Subject Alternative Name OID
-      );
-      const csrSans: string[] = [];
-      if (sanExtension) {
-        // Parse the raw SAN extension — store as stringified for comparison
-        // @peculiar/x509 exposes SANs through the parsed extension
-        const sanExt = sanExtension as { names?: Array<{ type: string; value: string }> };
-        if (sanExt.names) {
-          for (const name of sanExt.names) {
-            csrSans.push(name.value);
-          }
-        }
-      }
-
-      const csrSanSet = new Set(csrSans);
-      const expectedSanSet = new Set(expectedSans);
-      const missing = expectedSans.filter((s) => !csrSanSet.has(s));
-      const extra = csrSans.filter((s) => !expectedSanSet.has(s));
-
-      if (missing.length > 0 || extra.length > 0) {
-        throw new CaServiceError(
-          `CSR SANs do not match expected set. Missing: [${missing.join(', ')}], Extra: [${extra.join(', ')}]`,
-          'The CSR must include exactly the SANs specified in the issuance request.',
-          undefined,
-          'INVALID_CSR',
-        );
-      }
-    }
-
-    // Return the CN from the CSR subject for use as JWT sub
-    const cn = csr.subjectName.getField('CN')?.[0] ?? '';
-    return cn;
-  }
-
-  /**
-   * Submit a CSR to step-ca and return the issued certificate.
-   *
-   * Throws `CaServiceError` on any failure (network, auth, malformed input).
-   * Never silently swallows errors — fail-loud is a hard contract per M2-02 review.
-   */
-  async issueCert(req: IssueCertRequestDto): Promise<IssuedCertDto> {
-    // Clamp TTL to 15-minute maximum (H2)
-    const ttl = Math.min(req.ttlSeconds ?? 300, 900);
-
-    this.logger.debug(
-      `issueCert — grantId=${req.grantId} subjectUserId=${req.subjectUserId} ttl=${ttl}s`,
-    );
-
-    // Validate CSR — real cryptographic validation (H3)
-    const csrCn = await this.validateCsr(req.csrPem);
-
-    const ott = await this.buildOtt({
-      csrPem: req.csrPem,
-      grantId: req.grantId,
-      subjectUserId: req.subjectUserId,
-      ttlSeconds: ttl,
-      csrCn,
-    });
-
-    const signUrl = `${this.caUrl}/1.0/sign`;
-    const requestBody = {
-      csr: req.csrPem,
-      ott,
-      validity: {
-        duration: `${ttl}s`,
-      },
-    };
-
-    this.logger.debug(`Posting CSR to ${signUrl}`);
-    const response = await httpsPost(signUrl, requestBody, this.httpsAgent);
-
-    if (!response.crt) {
-      throw new CaServiceError(
-        'step-ca sign response missing the "crt" field',
-        'This is unexpected — the step-ca instance may be misconfigured or running an incompatible version.',
-      );
-    }
-
-    // Build certChainPem: prefer certChain array, fall back to ca field, fall back to crt alone.
-    let certChainPem: string;
-    if (response.certChain && response.certChain.length > 0) {
-      certChainPem = response.certChain.join('\n');
-    } else if (response.ca) {
-      certChainPem = response.crt + '\n' + response.ca;
-    } else {
-      certChainPem = response.crt;
-    }
-
-    const serialNumber = extractSerial(response.crt);
-
-    // CRIT-1: Verify the issued certificate contains both Mosaic OID extensions
-    // with the correct values. Step-CA's federation.tpl encodes each as an ASN.1
-    // UTF8String TLV: tag 0x0C + 1-byte length + UUID bytes. We skip 2 bytes
-    // (tag + length) to extract the raw UUID string.
-    const issuedCert = new X509Certificate(response.crt);
-    const decoder = new TextDecoder();
-
-    const grantIdExt = issuedCert.getExtension('1.3.6.1.4.1.99999.1');
-    if (!grantIdExt) {
-      throw new CaServiceError(
-        'Issued certificate is missing required Mosaic OID: mosaic_grant_id',
-        'The Step-CA federation.tpl template did not embed OID 1.3.6.1.4.1.99999.1. Check the provisioner template configuration.',
-        undefined,
-        'OID_MISSING',
-      );
-    }
-    const grantIdInCert = decoder.decode(grantIdExt.value.slice(2));
-    if (grantIdInCert !== req.grantId) {
-      throw new CaServiceError(
-        `Issued certificate mosaic_grant_id mismatch: expected ${req.grantId}, got ${grantIdInCert}`,
-        'The Step-CA issued a certificate with a different grant ID than requested. This may indicate a provisioner misconfiguration or a MITM.',
-        undefined,
-        'OID_MISMATCH',
-      );
-    }
-
-    const subjectUserIdExt = issuedCert.getExtension('1.3.6.1.4.1.99999.2');
-    if (!subjectUserIdExt) {
-      throw new CaServiceError(
-        'Issued certificate is missing required Mosaic OID: mosaic_subject_user_id',
-        'The Step-CA federation.tpl template did not embed OID 1.3.6.1.4.1.99999.2. Check the provisioner template configuration.',
-        undefined,
-        'OID_MISSING',
-      );
-    }
-    const subjectUserIdInCert = decoder.decode(subjectUserIdExt.value.slice(2));
-    if (subjectUserIdInCert !== req.subjectUserId) {
-      throw new CaServiceError(
-        `Issued certificate mosaic_subject_user_id mismatch: expected ${req.subjectUserId}, got ${subjectUserIdInCert}`,
-        'The Step-CA issued a certificate with a different subject user ID than requested. This may indicate a provisioner misconfiguration or a MITM.',
-        undefined,
-        'OID_MISMATCH',
-      );
-    }
-
-    this.logger.log(`Certificate issued — serial=${serialNumber} grantId=${req.grantId}`);
-
-    const result = new IssuedCertDto();
-    result.certPem = response.crt;
-    result.certChainPem = certChainPem;
-    result.serialNumber = serialNumber;
-    return result;
-  }
-}
--- a/apps/gateway/src/federation/client/tests/federation-client.service.spec.ts
+++ b/apps/gateway/src/federation/client/tests/federation-client.service.spec.ts
@@ -1,553 +0,0 @@
-/**
- * Unit tests for FederationClientService (FED-M3-08).
- *
- * HTTP mocking strategy:
- *   undici MockAgent is used to intercept outbound HTTP requests.  The service
- *   uses `undici.fetch` with a `dispatcher` option, so MockAgent is set as the
- *   global dispatcher and all requests flow through it.
- *
- *   Because the service builds one `undici.Agent` per peer and passes it as
- *   the dispatcher on every fetch call, we cannot intercept at the Agent level
- *   in unit tests without significant refactoring.  Instead, we set the global
- *   dispatcher to a MockAgent and override the service's `doRequest` indirection
- *   by spying on the internal fetch call.
- *
- *   For the cert/key wiring, we use the real `sealClientKey` function from
- *   peer-key.util.ts with a test secret — no stubs.
- *
- * Sealed-key setup:
- *   Each test (or beforeAll) calls `sealClientKey(TEST_PRIVATE_KEY_PEM)` with
- *   BETTER_AUTH_SECRET set to a deterministic test value so that
- *   `unsealClientKey` in the service recovers the original PEM.
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach, afterEach, beforeAll, afterAll } from 'vitest';
-import { MockAgent, setGlobalDispatcher, getGlobalDispatcher } from 'undici';
-import type { Dispatcher } from 'undici';
-import { writeFileSync, unlinkSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { Db } from '@mosaicstack/db';
-import { FederationClientService, FederationClientError } from '../federation-client.service.js';
-import { sealClientKey } from '../../peer-key.util.js';
-
-// ---------------------------------------------------------------------------
-// Test constants
-// ---------------------------------------------------------------------------
-
-const TEST_SECRET = 'test-secret-for-federation-client-spec-only';
-const PEER_ID = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
-const ENDPOINT = 'https://peer.example.com';
-
-// Minimal valid RSA/EC private key PEM — does NOT need to be a real key for
-// unit tests because we only verify it round-trips through seal/unseal, not
-// that it actually negotiates TLS (MockAgent handles that).
-const TEST_PRIVATE_KEY_PEM = `-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDummyKeyForTests
-----END PRIVATE KEY-----`;
-
-// Minimal self-signed cert PEM (dummy — only used for mTLS Agent construction)
-const TEST_CERT_PEM = `-----BEGIN CERTIFICATE-----
-MIIBdummyCertForFederationClientTests==
-----END CERTIFICATE-----`;
-
-const TEST_CERT_SERIAL = 'ABCDEF1234567890';
-
-// ---------------------------------------------------------------------------
-// Sealed key (computed once in beforeAll)
-// ---------------------------------------------------------------------------
-
-let SEALED_KEY: string;
-
-// Path to a stub Step-CA root cert file written in beforeAll. The cert is never
-// actually used to negotiate TLS in unit tests (MockAgent + spy on resolveEntry
-// short-circuit the network), but loadStepCaRoot() requires the file to exist.
-const STUB_CA_PEM_PATH = join(tmpdir(), 'federation-client-spec-ca.pem');
-const STUB_CA_PEM = `-----BEGIN CERTIFICATE-----
-MIIBdummyCAforFederationClientSpecOnly==
-----END CERTIFICATE-----
-`;
-
-// ---------------------------------------------------------------------------
-// Peer row factory
-// ---------------------------------------------------------------------------
-
-function makePeerRow(overrides: Partial<Record<string, unknown>> = {}) {
-  return {
-    id: PEER_ID,
-    commonName: 'peer-example-com',
-    displayName: 'Test Peer',
-    certPem: TEST_CERT_PEM,
-    certSerial: TEST_CERT_SERIAL,
-    certNotAfter: new Date('2030-01-01T00:00:00Z'),
-    clientKeyPem: SEALED_KEY,
-    state: 'active' as const,
-    endpointUrl: ENDPOINT,
-    lastSeenAt: null,
-    createdAt: new Date('2026-01-01T00:00:00Z'),
-    revokedAt: null,
-    ...overrides,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock DB builder
-// ---------------------------------------------------------------------------
-
-function makeDb(selectRows: unknown[] = [makePeerRow()]): Db {
-  const limitSelect = vi.fn().mockResolvedValue(selectRows);
-  const whereSelect = vi.fn().mockReturnValue({ limit: limitSelect });
-  const fromSelect = vi.fn().mockReturnValue({ where: whereSelect });
-  const selectMock = vi.fn().mockReturnValue({ from: fromSelect });
-
-  return {
-    select: selectMock,
-    insert: vi.fn(),
-    update: vi.fn(),
-    delete: vi.fn(),
-    transaction: vi.fn(),
-  } as unknown as Db;
-}
-
-// ---------------------------------------------------------------------------
-// Helpers for MockAgent HTTP interception
-// ---------------------------------------------------------------------------
-
-/**
- * Create a MockAgent + MockPool for the peer endpoint, set it as the global
- * dispatcher, and return both for per-test configuration.
- */
-function makeMockAgent() {
-  const mockAgent = new MockAgent({ connections: 1 });
-  mockAgent.disableNetConnect();
-  setGlobalDispatcher(mockAgent);
-  const pool = mockAgent.get(ENDPOINT);
-  return { mockAgent, pool };
-}
-
-/**
- * Build a FederationClientService with a mock DB and a spy on the internal
- * fetch so we can intercept at the HTTP layer via MockAgent.
- *
- * The service calls `fetch(url, { dispatcher: agent })` where `agent` is the
- * mTLS undici.Agent built from the peer's cert+key.  To make MockAgent work,
- * we need the fetch dispatcher to be the MockAgent, not the per-peer Agent.
- *
- * Strategy: we replace the private `resolveEntry` result's `agent` field with
- * the MockAgent's pool, so fetch uses our interceptor.  We do this by spying
- * on `resolveEntry` and returning a controlled entry.
- */
-function makeService(db: Db, mockPool: Dispatcher): FederationClientService {
-  const svc = new FederationClientService(db);
-
-  // Override resolveEntry to inject MockAgent pool as the dispatcher
-  vi.spyOn(
-    svc as unknown as { resolveEntry: (peerId: string) => Promise<unknown> },
-    'resolveEntry',
-  ).mockImplementation(async (_peerId: string) => {
-    // Still call DB (via the real logic) to exercise peer validation,
-    // but return mock pool as the agent.
-    // For simplicity in unit tests, directly return a controlled entry.
-    return {
-      agent: mockPool,
-      endpointUrl: ENDPOINT,
-      certPem: TEST_CERT_PEM,
-      certSerial: TEST_CERT_SERIAL,
-    };
-  });
-
-  return svc;
-}
-
-// ---------------------------------------------------------------------------
-// Test setup
-// ---------------------------------------------------------------------------
-
-let originalDispatcher: Dispatcher;
-
-beforeAll(() => {
-  // Seal the test key once — requires BETTER_AUTH_SECRET
-  const saved = process.env['BETTER_AUTH_SECRET'];
-  process.env['BETTER_AUTH_SECRET'] = TEST_SECRET;
-  try {
-    SEALED_KEY = sealClientKey(TEST_PRIVATE_KEY_PEM);
-  } finally {
-    if (saved === undefined) {
-      delete process.env['BETTER_AUTH_SECRET'];
-    } else {
-      process.env['BETTER_AUTH_SECRET'] = saved;
-    }
-  }
-  writeFileSync(STUB_CA_PEM_PATH, STUB_CA_PEM, 'utf8');
-});
-
-afterAll(() => {
-  try {
-    unlinkSync(STUB_CA_PEM_PATH);
-  } catch {
-    // best-effort cleanup
-  }
-});
-
-beforeEach(() => {
-  originalDispatcher = getGlobalDispatcher();
-  process.env['BETTER_AUTH_SECRET'] = TEST_SECRET;
-  process.env['STEP_CA_ROOT_CERT_PATH'] = STUB_CA_PEM_PATH;
-});
-
-afterEach(() => {
-  setGlobalDispatcher(originalDispatcher);
-  vi.restoreAllMocks();
-  delete process.env['BETTER_AUTH_SECRET'];
-  delete process.env['STEP_CA_ROOT_CERT_PATH'];
-});
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/** Successful list response body */
-const LIST_BODY = {
-  items: [{ id: '1', title: 'Task One' }],
-  nextCursor: undefined,
-  _partial: false,
-};
-
-/** Successful get response body */
-const GET_BODY = {
-  item: { id: '1', title: 'Task One' },
-  _partial: false,
-};
-
-/** Successful capabilities response body */
-const CAP_BODY = {
-  resources: ['tasks'],
-  excluded_resources: [],
-  max_rows_per_query: 100,
-  supported_verbs: ['list', 'get', 'capabilities'] as const,
-};
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('FederationClientService', () => {
-  // ─── Successful verb calls ─────────────────────────────────────────────────
-
-  describe('list()', () => {
-    it('returns parsed typed response on success', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool
-        .intercept({
-          path: '/api/federation/v1/list/tasks',
-          method: 'POST',
-        })
-        .reply(200, LIST_BODY, { headers: { 'content-type': 'application/json' } });
-
-      const result = await svc.list(PEER_ID, 'tasks', {});
-
-      expect(result.items).toHaveLength(1);
-      expect(result.items[0]).toMatchObject({ id: '1', title: 'Task One' });
-
-      await mockAgent.close();
-    });
-  });
-
-  describe('get()', () => {
-    it('returns parsed typed response on success', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool
-        .intercept({
-          path: '/api/federation/v1/get/tasks/1',
-          method: 'POST',
-        })
-        .reply(200, GET_BODY, { headers: { 'content-type': 'application/json' } });
-
-      const result = await svc.get(PEER_ID, 'tasks', '1', {});
-
-      expect(result.item).toMatchObject({ id: '1', title: 'Task One' });
-
-      await mockAgent.close();
-    });
-  });
-
-  describe('capabilities()', () => {
-    it('returns parsed capabilities response on success', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool
-        .intercept({
-          path: '/api/federation/v1/capabilities',
-          method: 'GET',
-        })
-        .reply(200, CAP_BODY, { headers: { 'content-type': 'application/json' } });
-
-      const result = await svc.capabilities(PEER_ID);
-
-      expect(result.resources).toContain('tasks');
-      expect(result.max_rows_per_query).toBe(100);
-
-      await mockAgent.close();
-    });
-  });
-
-  // ─── HTTP error surfaces ──────────────────────────────────────────────────
-
-  describe('non-2xx responses', () => {
-    it('surfaces 403 as FederationClientError({ status: 403, code: "FORBIDDEN" })', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool.intercept({ path: '/api/federation/v1/list/tasks', method: 'POST' }).reply(
-        403,
-        { error: { code: 'forbidden', message: 'Access denied' } },
-        {
-          headers: { 'content-type': 'application/json' },
-        },
-      );
-
-      await expect(svc.list(PEER_ID, 'tasks', {})).rejects.toMatchObject({
-        status: 403,
-        code: 'FORBIDDEN',
-        peerId: PEER_ID,
-      });
-
-      await mockAgent.close();
-    });
-
-    it('surfaces 404 as FederationClientError({ status: 404, code: "HTTP_404" })', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool.intercept({ path: '/api/federation/v1/get/tasks/999', method: 'POST' }).reply(
-        404,
-        { error: { code: 'not_found', message: 'Not found' } },
-        {
-          headers: { 'content-type': 'application/json' },
-        },
-      );
-
-      await expect(svc.get(PEER_ID, 'tasks', '999', {})).rejects.toMatchObject({
-        status: 404,
-        code: 'HTTP_404',
-        peerId: PEER_ID,
-      });
-
-      await mockAgent.close();
-    });
-  });
-
-  // ─── Network error ─────────────────────────────────────────────────────────
-
-  describe('network errors', () => {
-    it('surfaces network error as FederationClientError({ code: "NETWORK" })', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool
-        .intercept({ path: '/api/federation/v1/capabilities', method: 'GET' })
-        .replyWithError(new Error('ECONNREFUSED'));
-
-      await expect(svc.capabilities(PEER_ID)).rejects.toMatchObject({
-        code: 'NETWORK',
-        peerId: PEER_ID,
-      });
-
-      await mockAgent.close();
-    });
-  });
-
-  // ─── Invalid response body ─────────────────────────────────────────────────
-
-  describe('invalid response body', () => {
-    it('surfaces as FederationClientError({ code: "INVALID_RESPONSE" }) when body shape is wrong', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      // capabilities returns wrong shape (missing required fields)
-      pool
-        .intercept({ path: '/api/federation/v1/capabilities', method: 'GET' })
-        .reply(200, { totally: 'wrong' }, { headers: { 'content-type': 'application/json' } });
-
-      await expect(svc.capabilities(PEER_ID)).rejects.toMatchObject({
-        code: 'INVALID_RESPONSE',
-        peerId: PEER_ID,
-      });
-
-      await mockAgent.close();
-    });
-  });
-
-  // ─── Peer DB validation ────────────────────────────────────────────────────
-
-  describe('peer validation (without resolveEntry spy)', () => {
-    /**
-     * These tests exercise the real `resolveEntry` path — no spy on resolveEntry.
-     */
-
-    it('throws PEER_NOT_FOUND when peer is not in DB', async () => {
-      // DB returns empty array (peer not found)
-      const db = makeDb([]);
-      const svc = new FederationClientService(db);
-
-      await expect(svc.capabilities(PEER_ID)).rejects.toMatchObject({
-        code: 'PEER_NOT_FOUND',
-        peerId: PEER_ID,
-      });
-    });
-
-    it('throws PEER_INACTIVE when peer state is not "active"', async () => {
-      const db = makeDb([makePeerRow({ state: 'suspended' })]);
-      const svc = new FederationClientService(db);
-
-      await expect(svc.capabilities(PEER_ID)).rejects.toMatchObject({
-        code: 'PEER_INACTIVE',
-        peerId: PEER_ID,
-      });
-    });
-  });
-
-  // ─── Cache behaviour ───────────────────────────────────────────────────────
-
-  describe('cache behaviour', () => {
-    it('hits cache on second call — only one DB lookup happens', async () => {
-      // Verify cache by calling the private resolveEntry directly twice and
-      // asserting the DB was queried only once. This avoids the HTTP layer,
-      // which would require either a real network or per-peer Agent rewiring
-      // that the cache invariant doesn't depend on.
-      const db = makeDb();
-      const selectSpy = vi.spyOn(db, 'select');
-      const svc = new FederationClientService(db);
-      const resolveEntry = (
-        svc as unknown as { resolveEntry: (peerId: string) => Promise<unknown> }
-      ).resolveEntry.bind(svc);
-
-      const first = await resolveEntry(PEER_ID);
-      const second = await resolveEntry(PEER_ID);
-
-      expect(first).toBe(second);
-      expect(selectSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('serializes concurrent resolveEntry calls — only one DB lookup', async () => {
-      const db = makeDb();
-      const selectSpy = vi.spyOn(db, 'select');
-      const svc = new FederationClientService(db);
-      const resolveEntry = (
-        svc as unknown as {
-          resolveEntry: (peerId: string) => Promise<unknown>;
-        }
-      ).resolveEntry.bind(svc);
-
-      const [a, b] = await Promise.all([resolveEntry(PEER_ID), resolveEntry(PEER_ID)]);
-      expect(a).toBe(b);
-      expect(selectSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('flushPeer destroys the evicted Agent so old TLS connections close', async () => {
-      const db = makeDb();
-      const svc = new FederationClientService(db);
-      const resolveEntry = (
-        svc as unknown as {
-          resolveEntry: (peerId: string) => Promise<{ agent: { destroy: () => Promise<void> } }>;
-        }
-      ).resolveEntry.bind(svc);
-
-      const entry = await resolveEntry(PEER_ID);
-      const destroySpy = vi.spyOn(entry.agent, 'destroy').mockResolvedValue();
-
-      svc.flushPeer(PEER_ID);
-      expect(destroySpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('flushPeer() invalidates cache — next call re-reads DB', async () => {
-      const db = makeDb();
-      const { mockAgent, pool } = makeMockAgent();
-      const svc = makeService(db, pool);
-
-      pool
-        .intercept({ path: '/api/federation/v1/capabilities', method: 'GET' })
-        .reply(200, CAP_BODY, { headers: { 'content-type': 'application/json' } })
-        .times(2);
-
-      // First call — populates cache (via mock resolveEntry)
-      await svc.capabilities(PEER_ID);
-
-      // Flush the cache
-      svc.flushPeer(PEER_ID);
-
-      // The spy on resolveEntry is still active — check it's called again after flush
-      const resolveEntrySpy = vi.spyOn(
-        svc as unknown as { resolveEntry: (peerId: string) => Promise<unknown> },
-        'resolveEntry',
-      );
-
-      // Second call after flush — should call resolveEntry again
-      await svc.capabilities(PEER_ID);
-
-      // resolveEntry should have been called once after we started spying (post-flush)
-      expect(resolveEntrySpy).toHaveBeenCalledTimes(1);
-
-      await mockAgent.close();
-    });
-  });
-
-  // ─── loadStepCaRoot env-var guard ─────────────────────────────────────────
-
-  describe('loadStepCaRoot() env-var guard', () => {
-    it('throws PEER_MISCONFIGURED when STEP_CA_ROOT_CERT_PATH is not set', async () => {
-      delete process.env['STEP_CA_ROOT_CERT_PATH'];
-      const db = makeDb();
-      const svc = new FederationClientService(db);
-      const resolveEntry = (
-        svc as unknown as {
-          resolveEntry: (peerId: string) => Promise<unknown>;
-        }
-      ).resolveEntry.bind(svc);
-
-      await expect(resolveEntry(PEER_ID)).rejects.toMatchObject({
-        code: 'PEER_MISCONFIGURED',
-      });
-    });
-  });
-
-  // ─── FederationClientError class ──────────────────────────────────────────
-
-  describe('FederationClientError', () => {
-    it('is instanceof Error and FederationClientError', () => {
-      const err = new FederationClientError({
-        code: 'PEER_NOT_FOUND',
-        message: 'test',
-        peerId: PEER_ID,
-      });
-      expect(err).toBeInstanceOf(Error);
-      expect(err).toBeInstanceOf(FederationClientError);
-      expect(err.name).toBe('FederationClientError');
-    });
-
-    it('carries status, code, and peerId', () => {
-      const err = new FederationClientError({
-        status: 403,
-        code: 'FORBIDDEN',
-        message: 'forbidden',
-        peerId: PEER_ID,
-      });
-      expect(err.status).toBe(403);
-      expect(err.code).toBe('FORBIDDEN');
-      expect(err.peerId).toBe(PEER_ID);
-    });
-  });
-});
--- a/apps/gateway/src/federation/client/tests/query-source.service.spec.ts
+++ b/apps/gateway/src/federation/client/tests/query-source.service.spec.ts
@@ -1,255 +0,0 @@
-import 'reflect-metadata';
-import { describe, expect, it, vi } from 'vitest';
-import type { Db } from '@mosaicstack/db';
-import type { FederationListResponse } from '@mosaicstack/types';
-import {
-  FederationClientError,
-  type FederationClientService,
-} from '../federation-client.service.js';
-import { type QuerySourceError, QuerySourceService } from '../query-source.service.js';
-
-interface TestRow {
-  id: string;
-  title: string;
-}
-
-interface PeerRow {
-  id: string;
-  commonName: string;
-  endpointUrl: string | null;
-  clientKeyPem: string | null;
-  state: 'active' | 'pending' | 'suspended' | 'revoked';
-}
-
-const LOCAL_ROWS: TestRow[] = [
-  { id: 'local-1', title: 'Local One' },
-  { id: 'local-2', title: 'Local Two' },
-];
-
-const PEER_A: PeerRow = {
-  id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
-  commonName: 'peer-a',
-  endpointUrl: 'https://peer-a.example.com',
-  clientKeyPem: 'sealed-key-a',
-  state: 'active',
-};
-
-const PEER_B: PeerRow = {
-  id: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
-  commonName: 'peer-b',
-  endpointUrl: 'https://peer-b.example.com',
-  clientKeyPem: 'sealed-key-b',
-  state: 'active',
-};
-
-const PEER_LOCALHOST: PeerRow = {
-  id: 'cccccccc-cccc-cccc-cccc-cccccccccccc',
-  commonName: 'peer-localhost',
-  endpointUrl: 'https://localhost:3001',
-  clientKeyPem: 'sealed-key-c',
-  state: 'active',
-};
-
-function makeDb(activePeers: PeerRow[]): Db {
-  const orderBy = vi.fn().mockResolvedValue(activePeers);
-  const where = vi.fn().mockReturnValue({ orderBy });
-  const from = vi.fn().mockReturnValue({ where });
-  const select = vi.fn().mockReturnValue({ from });
-
-  return {
-    select,
-    insert: vi.fn(),
-    update: vi.fn(),
-    delete: vi.fn(),
-    transaction: vi.fn(),
-  } as unknown as Db;
-}
-
-function makeFederationClient(
-  list: (
-    peerId: string,
-    resource: string,
-    request: Record<string, unknown>,
-  ) => Promise<FederationListResponse<TestRow>>,
-): FederationClientService {
-  return {
-    list: list as unknown as FederationClientService['list'],
-  } as FederationClientService;
-}
-
-function makeLocalResponse(rows: TestRow[] = LOCAL_ROWS): Promise<FederationListResponse<TestRow>> {
-  return Promise.resolve({ items: rows });
-}
-
-describe('QuerySourceService', () => {
-  it('routes source="local" to the local executor and tags rows as local', async () => {
-    const list = vi.fn(async (): Promise<FederationListResponse<TestRow>> => ({ items: [] }));
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'local',
-      resource: 'tasks',
-      request: { cursor: 'ignored-for-local-test' },
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'local-2', title: 'Local Two', _source: 'local' },
-      ],
-    });
-    expect(list).not.toHaveBeenCalled();
-  });
-
-  it('routes source="federated:<host>" to the matching active peer and tags rows with peer commonName', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-1', title: 'Remote One' }],
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'federated:peer-b.example.com',
-      resource: 'tasks',
-      request: { status: 'open' },
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [{ id: 'remote-1', title: 'Remote One', _source: 'peer-b' }],
-    });
-    expect(list).toHaveBeenCalledWith(PEER_B.id, 'tasks', { status: 'open' });
-  });
-
-  it('matches federated hosts by endpoint host including non-default port', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-port', title: 'Remote Port' }],
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_LOCALHOST]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'federated:localhost:3001',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse(),
-    });
-
-    expect(result).toEqual({
-      items: [{ id: 'remote-port', title: 'Remote Port', _source: 'peer-localhost' }],
-    });
-    expect(list).toHaveBeenCalledWith(PEER_LOCALHOST.id, 'tasks', {});
-  });
-
-  it('fans out source="all" to local plus every active outbound peer in parallel and merges tagged rows', async () => {
-    const callOrder: string[] = [];
-    const list = vi.fn(async (peerId: string): Promise<FederationListResponse<TestRow>> => {
-      callOrder.push(`remote-start:${peerId}`);
-      await Promise.resolve();
-      return {
-        items: [{ id: `remote-${peerId.slice(0, 1)}`, title: `Remote ${peerId.slice(0, 1)}` }],
-      };
-    });
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: { limit: 25 },
-      local: async () => {
-        callOrder.push('local-start');
-        await Promise.resolve();
-        return { items: [{ id: 'local-1', title: 'Local One' }] };
-      },
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote a', _source: 'peer-a' },
-        { id: 'remote-b', title: 'Remote b', _source: 'peer-b' },
-      ],
-    });
-    expect(list).toHaveBeenCalledTimes(2);
-    expect(callOrder).toEqual([
-      'local-start',
-      `remote-start:${PEER_A.id}`,
-      `remote-start:${PEER_B.id}`,
-    ]);
-  });
-
-  it('marks source="all" as partial and truncated when any subquery returns a cursor', async () => {
-    const list = vi.fn(
-      async (): Promise<FederationListResponse<TestRow>> => ({
-        items: [{ id: 'remote-a', title: 'Remote A' }],
-        nextCursor: 'remote-next',
-      }),
-    );
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse([{ id: 'local-1', title: 'Local One' }]),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote A', _source: 'peer-a' },
-      ],
-      _partial: true,
-      _truncated: true,
-    });
-  });
-
-  it('returns _partial=true for source="all" when one peer fails without dropping successful sources', async () => {
-    const list = vi.fn(async (peerId: string): Promise<FederationListResponse<TestRow>> => {
-      if (peerId === PEER_B.id) {
-        throw new FederationClientError({
-          code: 'NETWORK',
-          message: 'peer unavailable',
-          peerId,
-        });
-      }
-      return { items: [{ id: 'remote-a', title: 'Remote A' }] };
-    });
-    const service = new QuerySourceService(makeDb([PEER_A, PEER_B]), makeFederationClient(list));
-
-    const result = await service.list<TestRow>({
-      source: 'all',
-      resource: 'tasks',
-      request: {},
-      local: () => makeLocalResponse([{ id: 'local-1', title: 'Local One' }]),
-    });
-
-    expect(result).toEqual({
-      items: [
-        { id: 'local-1', title: 'Local One', _source: 'local' },
-        { id: 'remote-a', title: 'Remote A', _source: 'peer-a' },
-      ],
-      _partial: true,
-    });
-  });
-
-  it('throws QuerySourceError when a federated host does not match an active outbound peer', async () => {
-    const list = vi.fn(async (): Promise<FederationListResponse<TestRow>> => ({ items: [] }));
-    const service = new QuerySourceService(makeDb([PEER_A]), makeFederationClient(list));
-
-    await expect(
-      service.list<TestRow>({
-        source: 'federated:missing.example.com',
-        resource: 'tasks',
-        request: {},
-        local: () => makeLocalResponse(),
-      }),
-    ).rejects.toMatchObject({
-      name: 'QuerySourceError',
-      code: 'PEER_NOT_FOUND',
-    } satisfies Partial<QuerySourceError>);
-  });
-});
--- a/apps/gateway/src/federation/client/federation-client.service.ts
+++ b/apps/gateway/src/federation/client/federation-client.service.ts
@@ -1,500 +0,0 @@
-/**
- * FederationClientService — outbound mTLS client for federation requests (FED-M3-08).
- *
- * Dials peer gateways over mTLS using the cert+sealed-key stored in `federation_peers`,
- * invokes federation verbs (list / get / capabilities), and surfaces all failure modes
- * as typed `FederationClientError` instances.
- *
- * ## Error code taxonomy
- *
- * | Code               | When                                                          |
- * | ------------------ | ------------------------------------------------------------- |
- * | PEER_NOT_FOUND     | No row in federation_peers for the given peerId               |
- * | PEER_INACTIVE      | Peer row exists but state !== 'active'                        |
- * | PEER_MISCONFIGURED | Peer row is active but missing endpointUrl or clientKeyPem    |
- * | NETWORK            | undici threw a connection / TLS / timeout error               |
- * | HTTP_{status}      | Peer returned a non-2xx response (e.g. HTTP_403, HTTP_404)    |
- * | FORBIDDEN          | Peer returned 403 (convenience alias alongside HTTP_403)      |
- * | INVALID_RESPONSE   | Response body failed Zod schema validation                    |
- *
- * ## Cache strategy
- *
- * Per-peer `undici.Agent` instances are cached in a `Map<peerId, AgentCacheEntry>` for
- * the lifetime of the service instance.  The cache is keyed on peerId (UUID).
- *
- * Cache invalidation:
- *  - `flushPeer(peerId)` — removes the entry immediately.  M5/M6 MUST call this on
- *    cert rotation or peer revocation events so the next request re-reads the DB and
- *    builds a fresh TLS Agent with the new cert material.
- *  - On cache miss: re-reads the DB, checks state === 'active', rebuilds Agent.
- *
- * Cache does NOT auto-expire.  The service is expected to be a singleton scoped to the
- * NestJS application lifecycle; flushing on revocation/rotation is the only invalidation
- * path by design (avoids redundant DB round-trips on the hot path).
- */
-
-import { Injectable, Inject, Logger } from '@nestjs/common';
-import { readFileSync } from 'node:fs';
-import { Agent, fetch as undiciFetch } from 'undici';
-import type { Dispatcher } from 'undici';
-import { z } from 'zod';
-import { type Db, eq, federationPeers } from '@mosaicstack/db';
-import {
-  FederationListResponseSchema,
-  FederationGetResponseSchema,
-  FederationCapabilitiesResponseSchema,
-  FederationErrorEnvelopeSchema,
-  type FederationListResponse,
-  type FederationGetResponse,
-  type FederationCapabilitiesResponse,
-} from '@mosaicstack/types';
-import { DB } from '../../database/database.module.js';
-import { unsealClientKey } from '../peer-key.util.js';
-
-// ---------------------------------------------------------------------------
-// Error taxonomy
-// ---------------------------------------------------------------------------
-
-/**
- * Client-side error code set.  Distinct from the server-side `FederationErrorCode`
- * (which lives in `@mosaicstack/types`) because the client has additional failure
- * modes (PEER_NOT_FOUND, PEER_INACTIVE, PEER_MISCONFIGURED, NETWORK) that the
- * server never emits.
- */
-export type FederationClientErrorCode =
-  | 'PEER_NOT_FOUND'
-  | 'PEER_INACTIVE'
-  | 'PEER_MISCONFIGURED'
-  | 'NETWORK'
-  | 'FORBIDDEN'
-  | 'INVALID_RESPONSE'
-  | `HTTP_${number}`;
-
-export interface FederationClientErrorOptions {
-  status?: number;
-  code: FederationClientErrorCode;
-  message: string;
-  peerId: string;
-  cause?: unknown;
-}
-
-/**
- * Thrown by FederationClientService on every failure path.
- * Callers can dispatch on `error.code` for programmatic handling.
- */
-export class FederationClientError extends Error {
-  readonly status?: number;
-  readonly code: FederationClientErrorCode;
-  readonly peerId: string;
-  readonly cause?: unknown;
-
-  constructor(opts: FederationClientErrorOptions) {
-    super(opts.message);
-    this.name = 'FederationClientError';
-    this.status = opts.status;
-    this.code = opts.code;
-    this.peerId = opts.peerId;
-    this.cause = opts.cause;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Internal cache types
-// ---------------------------------------------------------------------------
-
-interface AgentCacheEntry {
-  agent: Agent;
-  endpointUrl: string;
-  certPem: string;
-  certSerial: string;
-}
-
-// ---------------------------------------------------------------------------
-// Service
-// ---------------------------------------------------------------------------
-
-@Injectable()
-export class FederationClientService {
-  private readonly logger = new Logger(FederationClientService.name);
-
-  /**
-   * Per-peer undici Agent cache.
-   * Key = peerId (UUID string).
-   *
-   * Values are either a resolved `AgentCacheEntry` or an in-flight
-   * `Promise<AgentCacheEntry>` (promise-cache pattern).  Storing the promise
-   * prevents duplicate DB lookups and duplicate key-unseal operations when two
-   * requests for the same peer arrive before the first build completes.
-   *
-   * Flush via `flushPeer(peerId)` on cert rotation / peer revocation (M5/M6).
-   */
-  private readonly cache = new Map<string, AgentCacheEntry | Promise<AgentCacheEntry>>();
-
-  /**
-   * Step-CA root cert PEM, loaded once from `STEP_CA_ROOT_CERT_PATH`.
-   * Used as the trust anchor for peer server certificates so federation TLS is
-   * pinned to our PKI, not the public trust store. Lazily loaded on first use
-   * so unit tests that don't exercise the agent path can run without the env var.
-   */
-  private cachedCaPem: string | null = null;
-
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  // -------------------------------------------------------------------------
-  // Public verb API
-  // -------------------------------------------------------------------------
-
-  /**
-   * Invoke the `list` verb on a remote peer.
-   *
-   * @param peerId   UUID of the peer row in `federation_peers`.
-   * @param resource Resource path, e.g. "tasks".
-   * @param request  Free-form body sent as JSON in the POST body.
-   * @returns Parsed `FederationListResponse<T>`.
-   */
-  async list<T>(
-    peerId: string,
-    resource: string,
-    request: Record<string, unknown>,
-  ): Promise<FederationListResponse<T>> {
-    const { endpointUrl, agent } = await this.resolveEntry(peerId);
-    const url = `${endpointUrl}/api/federation/v1/list/${encodeURIComponent(resource)}`;
-    const body = await this.doPost(peerId, url, agent, request);
-    return this.parseWith<FederationListResponse<T>>(
-      peerId,
-      body,
-      FederationListResponseSchema(z.unknown()),
-    );
-  }
-
-  /**
-   * Invoke the `get` verb on a remote peer.
-   *
-   * @param peerId   UUID of the peer row in `federation_peers`.
-   * @param resource Resource path, e.g. "tasks".
-   * @param id       Resource identifier.
-   * @param request  Free-form body sent as JSON in the POST body.
-   * @returns Parsed `FederationGetResponse<T>`.
-   */
-  async get<T>(
-    peerId: string,
-    resource: string,
-    id: string,
-    request: Record<string, unknown>,
-  ): Promise<FederationGetResponse<T>> {
-    const { endpointUrl, agent } = await this.resolveEntry(peerId);
-    const url = `${endpointUrl}/api/federation/v1/get/${encodeURIComponent(resource)}/${encodeURIComponent(id)}`;
-    const body = await this.doPost(peerId, url, agent, request);
-    return this.parseWith<FederationGetResponse<T>>(
-      peerId,
-      body,
-      FederationGetResponseSchema(z.unknown()),
-    );
-  }
-
-  /**
-   * Invoke the `capabilities` verb on a remote peer.
-   *
-   * @param peerId UUID of the peer row in `federation_peers`.
-   * @returns Parsed `FederationCapabilitiesResponse`.
-   */
-  async capabilities(peerId: string): Promise<FederationCapabilitiesResponse> {
-    const { endpointUrl, agent } = await this.resolveEntry(peerId);
-    const url = `${endpointUrl}/api/federation/v1/capabilities`;
-    const body = await this.doGet(peerId, url, agent);
-    return this.parseWith<FederationCapabilitiesResponse>(
-      peerId,
-      body,
-      FederationCapabilitiesResponseSchema,
-    );
-  }
-
-  // -------------------------------------------------------------------------
-  // Cache management
-  // -------------------------------------------------------------------------
-
-  /**
-   * Flush the cached Agent for a specific peer.
-   *
-   * M5/M6 MUST call this on:
-   *  - cert rotation events (so new cert material is picked up)
-   *  - peer revocation events (so future requests fail at PEER_INACTIVE)
-   *
-   * After flushing, the next call to `list`, `get`, or `capabilities` for
-   * this peer will re-read the DB and rebuild the Agent.
-   */
-  flushPeer(peerId: string): void {
-    const entry = this.cache.get(peerId);
-    if (entry === undefined) {
-      return;
-    }
-    this.cache.delete(peerId);
-    if (!(entry instanceof Promise)) {
-      // best-effort destroy; promise-cached entries skip destroy because
-      // the in-flight build owns its own Agent which will be GC'd when the
-      // owning request handles the rejection from the cache miss
-      entry.agent.destroy().catch(() => {
-        // intentionally ignored — destroy errors are not actionable
-      });
-    }
-    this.logger.log(`Cache flushed for peer ${peerId}`);
-  }
-
-  // -------------------------------------------------------------------------
-  // Internal helpers
-  // -------------------------------------------------------------------------
-
-  /**
-   * Load and cache the Step-CA root cert PEM from `STEP_CA_ROOT_CERT_PATH`.
-   * Throws `FederationClientError` if the env var is unset or the file cannot
-   * be read — mTLS to a peer without a pinned trust anchor would silently
-   * fall back to the public trust store.
-   */
-  private loadStepCaRoot(): string {
-    if (this.cachedCaPem !== null) {
-      return this.cachedCaPem;
-    }
-    const path = process.env['STEP_CA_ROOT_CERT_PATH'];
-    if (!path) {
-      throw new FederationClientError({
-        code: 'PEER_MISCONFIGURED',
-        message: 'STEP_CA_ROOT_CERT_PATH is not set; refusing to dial peer without pinned CA trust',
-        peerId: '',
-      });
-    }
-    try {
-      const pem = readFileSync(path, 'utf8');
-      this.cachedCaPem = pem;
-      return pem;
-    } catch (err) {
-      throw new FederationClientError({
-        code: 'PEER_MISCONFIGURED',
-        message: `Failed to read STEP_CA_ROOT_CERT_PATH (${path})`,
-        peerId: '',
-        cause: err,
-      });
-    }
-  }
-
-  /**
-   * Resolve the cache entry for a peer, reading DB on miss.
-   *
-   * Uses a promise-cache pattern: concurrent callers for the same uncached
-   * `peerId` all `await` the same in-flight `Promise<AgentCacheEntry>` so
-   * only one DB lookup and one key-unseal ever runs per peer per cache miss.
-   * The promise is replaced with the concrete entry on success, or deleted on
-   * rejection so a transient error does not poison the cache permanently.
-   *
-   * Throws `FederationClientError` with appropriate code if the peer is not
-   * found, is inactive, or is missing required fields.
-   */
-  private async resolveEntry(peerId: string): Promise<AgentCacheEntry> {
-    const cached = this.cache.get(peerId);
-    if (cached) {
-      return cached; // Promise or concrete entry — both are awaitable
-    }
-
-    const inflight = this.buildEntry(peerId).then(
-      (entry) => {
-        this.cache.set(peerId, entry); // replace promise with concrete value
-        return entry;
-      },
-      (err: unknown) => {
-        this.cache.delete(peerId); // don't poison the cache with a rejected promise
-        throw err;
-      },
-    );
-
-    this.cache.set(peerId, inflight);
-    return inflight;
-  }
-
-  /**
-   * Build the `AgentCacheEntry` for a peer by reading the DB, validating the
-   * peer's state, unsealing the private key, and constructing the mTLS Agent.
-   *
-   * Throws `FederationClientError` with appropriate code if the peer is not
-   * found, is inactive, or is missing required fields.
-   */
-  private async buildEntry(peerId: string): Promise<AgentCacheEntry> {
-    // DB lookup
-    const [peer] = await this.db
-      .select()
-      .from(federationPeers)
-      .where(eq(federationPeers.id, peerId))
-      .limit(1);
-
-    if (!peer) {
-      throw new FederationClientError({
-        code: 'PEER_NOT_FOUND',
-        message: `Federation peer ${peerId} not found`,
-        peerId,
-      });
-    }
-
-    if (peer.state !== 'active') {
-      throw new FederationClientError({
-        code: 'PEER_INACTIVE',
-        message: `Federation peer ${peerId} is not active (state: ${peer.state})`,
-        peerId,
-      });
-    }
-
-    if (!peer.endpointUrl || !peer.clientKeyPem) {
-      throw new FederationClientError({
-        code: 'PEER_MISCONFIGURED',
-        message: `Federation peer ${peerId} is missing endpointUrl or clientKeyPem`,
-        peerId,
-      });
-    }
-
-    // Unseal the private key
-    let privateKeyPem: string;
-    try {
-      privateKeyPem = unsealClientKey(peer.clientKeyPem);
-    } catch (err) {
-      throw new FederationClientError({
-        code: 'PEER_MISCONFIGURED',
-        message: `Failed to unseal client key for peer ${peerId}`,
-        peerId,
-        cause: err,
-      });
-    }
-
-    // Build mTLS agent — pin trust to Step-CA root so we never accept
-    // a peer cert signed by a public CA (defense against MITM with a
-    // publicly-trusted DV cert for the peer's hostname).
-    const agent = new Agent({
-      connect: {
-        cert: peer.certPem,
-        key: privateKeyPem,
-        ca: this.loadStepCaRoot(),
-        // rejectUnauthorized: true is the undici default for HTTPS
-      },
-    });
-
-    const entry: AgentCacheEntry = {
-      agent,
-      endpointUrl: peer.endpointUrl,
-      certPem: peer.certPem,
-      certSerial: peer.certSerial,
-    };
-
-    this.logger.log(`Agent cached for peer ${peerId} (serial: ${peer.certSerial})`);
-
-    return entry;
-  }
-
-  /**
-   * Execute a POST request with a JSON body.
-   * Returns the parsed response body as an unknown value.
-   * Throws `FederationClientError` on network errors and non-2xx responses.
-   */
-  private async doPost(
-    peerId: string,
-    url: string,
-    agent: Dispatcher,
-    body: Record<string, unknown>,
-  ): Promise<unknown> {
-    return this.doRequest(peerId, url, agent, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-    });
-  }
-
-  /**
-   * Execute a GET request.
-   * Returns the parsed response body as an unknown value.
-   * Throws `FederationClientError` on network errors and non-2xx responses.
-   */
-  private async doGet(peerId: string, url: string, agent: Dispatcher): Promise<unknown> {
-    return this.doRequest(peerId, url, agent, { method: 'GET' });
-  }
-
-  private async doRequest(
-    peerId: string,
-    url: string,
-    agent: Dispatcher,
-    init: { method: string; headers?: Record<string, string>; body?: string },
-  ): Promise<unknown> {
-    let response: Awaited<ReturnType<typeof undiciFetch>>;
-
-    try {
-      response = await undiciFetch(url, {
-        ...init,
-        dispatcher: agent,
-      });
-    } catch (err) {
-      throw new FederationClientError({
-        code: 'NETWORK',
-        message: `Network error calling peer ${peerId} at ${url}: ${err instanceof Error ? err.message : String(err)}`,
-        peerId,
-        cause: err,
-      });
-    }
-
-    const rawBody = await response.text().catch(() => '');
-
-    if (!response.ok) {
-      const status = response.status;
-
-      // Attempt to parse as federation error envelope
-      let serverMessage = `HTTP ${status}`;
-      try {
-        const json: unknown = JSON.parse(rawBody);
-        const result = FederationErrorEnvelopeSchema.safeParse(json);
-        if (result.success) {
-          serverMessage = result.data.error.message;
-        }
-      } catch {
-        // Not valid JSON or not a federation envelope — use generic message
-      }
-
-      // Specific code for 403 (most actionable for callers); generic HTTP_{n} for others
-      const code: FederationClientErrorCode = status === 403 ? 'FORBIDDEN' : `HTTP_${status}`;
-
-      throw new FederationClientError({
-        status,
-        code,
-        message: `Peer ${peerId} returned ${status}: ${serverMessage}`,
-        peerId,
-      });
-    }
-
-    try {
-      return JSON.parse(rawBody) as unknown;
-    } catch (err) {
-      throw new FederationClientError({
-        code: 'INVALID_RESPONSE',
-        message: `Peer ${peerId} returned non-JSON body`,
-        peerId,
-        cause: err,
-      });
-    }
-  }
-
-  /**
-   * Parse and validate a response body against a Zod schema.
-   *
-   * For list/get, callers pass the result of `FederationListResponseSchema(z.unknown())`
-   * so that the envelope structure is validated without requiring a concrete item schema
-   * at the client level.  The generic `T` provides compile-time typing.
-   *
-   * Throws `FederationClientError({ code: 'INVALID_RESPONSE' })` on parse failure.
-   */
-  private parseWith<T>(peerId: string, body: unknown, schema: z.ZodTypeAny): T {
-    const result = schema.safeParse(body);
-    if (!result.success) {
-      const issues = result.error.issues
-        .map((e: z.ZodIssue) => `[${e.path.join('.') || 'root'}] ${e.message}`)
-        .join('; ');
-      throw new FederationClientError({
-        code: 'INVALID_RESPONSE',
-        message: `Peer ${peerId} returned invalid response shape: ${issues}`,
-        peerId,
-      });
-    }
-    return result.data as T;
-  }
-}
--- a/apps/gateway/src/federation/client/index.ts
+++ b/apps/gateway/src/federation/client/index.ts
@@ -1,23 +0,0 @@
-/**
- * Federation client barrel — re-exports for FederationModule consumers.
- *
- * M3-09 (QuerySourceService) and future milestones should import from here,
- * not directly from the implementation file.
- */
-
-export {
-  FederationClientService,
-  FederationClientError,
-  type FederationClientErrorCode,
-  type FederationClientErrorOptions,
-} from './federation-client.service.js';
-export {
-  QuerySourceService,
-  QuerySourceError,
-  type QuerySource,
-  type QuerySourceErrorCode,
-  type QuerySourceErrorOptions,
-  type QuerySourceListOptions,
-  type QuerySourceListResponse,
-  type LocalListExecutor,
-} from './query-source.service.js';
--- a/apps/gateway/src/federation/client/query-source.service.ts
+++ b/apps/gateway/src/federation/client/query-source.service.ts
@@ -1,261 +0,0 @@
-/**
- * QuerySourceService — gateway query source router (FED-M3-09).
- *
- * Accepts the federation query-layer `source` selector and routes list-style
- * reads to local storage, one federated peer, or all active outbound peers.
- *
- * `source: "all"` is intentionally tolerant of per-peer failures: local data
- * and successful peer responses are returned, and the envelope is marked
- * `_partial: true`.  Local failures still reject because there is no safe local
- * fallback and the gateway's own storage is expected to be authoritative.
- */
-
-import { Inject, Injectable, Logger } from '@nestjs/common';
-import { and, eq, federationPeers, isNotNull, type Db } from '@mosaicstack/db';
-import {
-  SOURCE_LOCAL,
-  tagWithSource,
-  type FederationListResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { DB } from '../../database/database.module.js';
-import { FederationClientService } from './federation-client.service.js';
-
-export type QuerySource = 'local' | 'all' | `federated:${string}`;
-
-export type QuerySourceErrorCode = 'INVALID_SOURCE' | 'PEER_NOT_FOUND';
-
-export interface QuerySourceErrorOptions {
-  code: QuerySourceErrorCode;
-  message: string;
-  source: string;
-}
-
-export class QuerySourceError extends Error {
-  readonly code: QuerySourceErrorCode;
-  readonly source: string;
-
-  constructor(opts: QuerySourceErrorOptions) {
-    super(opts.message);
-    this.name = 'QuerySourceError';
-    this.code = opts.code;
-    this.source = opts.source;
-  }
-}
-
-export type LocalListExecutor<T extends object> = () => Promise<FederationListResponse<T> | T[]>;
-
-export interface QuerySourceListOptions<T extends object> {
-  source: QuerySource;
-  resource: string;
-  request?: Record<string, unknown>;
-  local: LocalListExecutor<T>;
-}
-
-export type QuerySourceListResponse<T extends object> = FederationListResponse<T & SourceTag>;
-
-interface OutboundPeer {
-  id: string;
-  commonName: string;
-  endpointUrl: string;
-}
-
-interface TaggedList<T extends object> {
-  items: Array<T & SourceTag>;
-  partial: boolean;
-  truncated: boolean;
-  nextCursor?: string;
-}
-
-@Injectable()
-export class QuerySourceService {
-  private readonly logger = new Logger(QuerySourceService.name);
-
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(FederationClientService) private readonly federationClient: FederationClientService,
-  ) {}
-
-  async list<T extends object>(
-    options: QuerySourceListOptions<T>,
-  ): Promise<QuerySourceListResponse<T>> {
-    const request = options.request ?? {};
-
-    if (options.source === 'local') {
-      const local = await this.runLocal(options.local);
-      return this.toResponse(this.tagList(local, SOURCE_LOCAL));
-    }
-
-    if (options.source === 'all') {
-      return this.listAll(options.resource, request, options.local);
-    }
-
-    if (options.source.startsWith('federated:')) {
-      const host = options.source.slice('federated:'.length).trim();
-      if (!host) {
-        throw new QuerySourceError({
-          code: 'INVALID_SOURCE',
-          message: 'Federated source must include a host after federated:',
-          source: options.source,
-        });
-      }
-
-      const peer = await this.findPeerByHost(host, options.source);
-      const remote = await this.federationClient.list<T>(peer.id, options.resource, request);
-      return this.toResponse(this.tagList(remote, peer.commonName));
-    }
-
-    throw new QuerySourceError({
-      code: 'INVALID_SOURCE',
-      message: `Unsupported query source: ${options.source}`,
-      source: options.source,
-    });
-  }
-
-  private async listAll<T extends object>(
-    resource: string,
-    request: Record<string, unknown>,
-    local: LocalListExecutor<T>,
-  ): Promise<QuerySourceListResponse<T>> {
-    const peers = await this.listActiveOutboundPeers();
-
-    const localPromise = this.runLocal(local).then((response) =>
-      this.tagList(response, SOURCE_LOCAL),
-    );
-    const remotePromises = peers.map(async (peer: OutboundPeer): Promise<TaggedList<T> | null> => {
-      try {
-        const response = await this.federationClient.list<T>(peer.id, resource, request);
-        return this.tagList(response, peer.commonName);
-      } catch (error: unknown) {
-        this.logger.warn(
-          `Federated query to peer ${peer.commonName} (${peer.id}) failed; returning partial all-source response: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
-        );
-        return null;
-      }
-    });
-
-    const [localResult, ...remoteResults] = await Promise.all([localPromise, ...remotePromises]);
-    const successfulRemoteResults = remoteResults.filter(
-      (result: TaggedList<T> | null): result is TaggedList<T> => result !== null,
-    );
-    const allResults = [localResult, ...successfulRemoteResults];
-    const peerFailure = successfulRemoteResults.length !== peers.length;
-
-    return this.mergeTaggedLists(allResults, peerFailure);
-  }
-
-  private async runLocal<T extends object>(
-    local: LocalListExecutor<T>,
-  ): Promise<FederationListResponse<T>> {
-    const response = await local();
-    if (Array.isArray(response)) {
-      return { items: response };
-    }
-    return response;
-  }
-
-  private tagList<T extends object>(
-    response: FederationListResponse<T>,
-    source: string,
-  ): TaggedList<T> {
-    return {
-      items: tagWithSource(response.items, source),
-      partial: response._partial === true,
-      truncated: response._truncated === true || response.nextCursor !== undefined,
-      nextCursor: response.nextCursor,
-    };
-  }
-
-  private mergeTaggedLists<T extends object>(
-    lists: Array<TaggedList<T>>,
-    peerFailure: boolean,
-  ): QuerySourceListResponse<T> {
-    const items = lists.flatMap((list: TaggedList<T>) => list.items);
-    const partial =
-      peerFailure ||
-      lists.some((list: TaggedList<T>) => list.partial || list.nextCursor !== undefined);
-    const truncated = lists.some((list: TaggedList<T>) => list.truncated);
-
-    const response: QuerySourceListResponse<T> = { items };
-    if (partial) {
-      response._partial = true;
-    }
-    if (truncated) {
-      response._truncated = true;
-    }
-    return response;
-  }
-
-  private toResponse<T extends object>(tagged: TaggedList<T>): QuerySourceListResponse<T> {
-    const response: QuerySourceListResponse<T> = {
-      items: tagged.items,
-    };
-    if (tagged.nextCursor !== undefined) {
-      response.nextCursor = tagged.nextCursor;
-    }
-    if (tagged.partial) {
-      response._partial = true;
-    }
-    if (tagged.truncated) {
-      response._truncated = true;
-    }
-    return response;
-  }
-
-  private async findPeerByHost(sourceHost: string, source: string): Promise<OutboundPeer> {
-    const host = normalizeHost(sourceHost);
-    const peers = await this.listActiveOutboundPeers();
-    const peer = peers.find((candidate: OutboundPeer) => {
-      const commonName = normalizeHost(candidate.commonName);
-      const endpointHosts = endpointHostKeys(candidate.endpointUrl).map((endpointHost: string) =>
-        normalizeHost(endpointHost),
-      );
-      return commonName === host || endpointHosts.includes(host);
-    });
-
-    if (!peer) {
-      throw new QuerySourceError({
-        code: 'PEER_NOT_FOUND',
-        message: `No active outbound federation peer matches source ${source}`,
-        source,
-      });
-    }
-
-    return peer;
-  }
-
-  private async listActiveOutboundPeers(): Promise<OutboundPeer[]> {
-    const rows = await this.db
-      .select({
-        id: federationPeers.id,
-        commonName: federationPeers.commonName,
-        endpointUrl: federationPeers.endpointUrl,
-      })
-      .from(federationPeers)
-      .where(
-        and(
-          eq(federationPeers.state, 'active'),
-          isNotNull(federationPeers.endpointUrl),
-          isNotNull(federationPeers.clientKeyPem),
-        ),
-      )
-      .orderBy(federationPeers.commonName);
-
-    return rows.filter((row): row is OutboundPeer => typeof row.endpointUrl === 'string');
-  }
-}
-
-function normalizeHost(host: string): string {
-  return host.trim().toLowerCase();
-}
-
-function endpointHostKeys(endpointUrl: string): string[] {
-  try {
-    const url = new URL(endpointUrl);
-    return Array.from(new Set([url.host, url.hostname].filter((host: string) => host.length > 0)));
-  } catch {
-    return [];
-  }
-}
--- a/apps/gateway/src/federation/enrollment.controller.ts
+++ b/apps/gateway/src/federation/enrollment.controller.ts
@@ -1,54 +0,0 @@
-/**
- * EnrollmentController — federation enrollment HTTP layer (FED-M2-07).
- *
- * Routes:
- *   POST /api/federation/enrollment/tokens   — admin creates a single-use token
- *   POST /api/federation/enrollment/:token   — unauthenticated; token IS the auth
- */
-
-import {
-  Body,
-  Controller,
-  HttpCode,
-  HttpStatus,
-  Inject,
-  Param,
-  Post,
-  UseGuards,
-} from '@nestjs/common';
-import { AdminGuard } from '../admin/admin.guard.js';
-import { EnrollmentService } from './enrollment.service.js';
-import { CreateEnrollmentTokenDto, RedeemEnrollmentTokenDto } from './enrollment.dto.js';
-
-@Controller('api/federation/enrollment')
-export class EnrollmentController {
-  constructor(@Inject(EnrollmentService) private readonly enrollmentService: EnrollmentService) {}
-
-  /**
-   * Admin-only: generate a single-use enrollment token for a pending grant.
-   * The token should be distributed out-of-band to the remote peer operator.
-   *
-   * POST /api/federation/enrollment/tokens
-   */
-  @Post('tokens')
-  @UseGuards(AdminGuard)
-  @HttpCode(HttpStatus.CREATED)
-  async createToken(@Body() dto: CreateEnrollmentTokenDto) {
-    return this.enrollmentService.createToken(dto);
-  }
-
-  /**
-   * Unauthenticated: remote peer redeems a token by submitting its CSR.
-   * The token itself is the credential — no session or bearer token required.
-   *
-   * POST /api/federation/enrollment/:token
-   *
-   * Returns the signed leaf cert and full chain PEM on success.
-   * Returns 410 Gone if the token was already used or has expired.
-   */
-  @Post(':token')
-  @HttpCode(HttpStatus.OK)
-  async redeem(@Param('token') token: string, @Body() dto: RedeemEnrollmentTokenDto) {
-    return this.enrollmentService.redeem(token, dto.csrPem);
-  }
-}
--- a/apps/gateway/src/federation/enrollment.dto.ts
+++ b/apps/gateway/src/federation/enrollment.dto.ts
@@ -1,35 +0,0 @@
-/**
- * DTOs for the federation enrollment flow (FED-M2-07).
- *
- * CreateEnrollmentTokenDto  — admin generates a single-use enrollment token
- * RedeemEnrollmentTokenDto  — remote peer submits CSR to redeem the token
- */
-
-import { IsInt, IsNotEmpty, IsOptional, IsString, IsUUID, Max, Min } from 'class-validator';
-
-export class CreateEnrollmentTokenDto {
-  /** UUID of the federation grant this token will activate on redemption. */
-  @IsUUID()
-  grantId!: string;
-
-  /** UUID of the peer record that will receive the issued cert on redemption. */
-  @IsUUID()
-  peerId!: string;
-
-  /**
-   * Token lifetime in seconds. Default 900 (15 min). Min 60. Max 900.
-   * After this time the token is rejected even if unused.
-   */
-  @IsOptional()
-  @IsInt()
-  @Min(60)
-  @Max(900)
-  ttlSeconds: number = 900;
-}
-
-export class RedeemEnrollmentTokenDto {
-  /** PEM-encoded PKCS#10 Certificate Signing Request from the remote peer. */
-  @IsString()
-  @IsNotEmpty()
-  csrPem!: string;
-}
--- a/apps/gateway/src/federation/enrollment.service.ts
+++ b/apps/gateway/src/federation/enrollment.service.ts
@@ -1,281 +0,0 @@
-/**
- * EnrollmentService — single-use enrollment token lifecycle (FED-M2-07).
- *
- * Responsibilities:
- *  1. Generate time-limited single-use enrollment tokens (admin action).
- *  2. Redeem a token: validate → atomically claim token → issue cert via
- *     CaService → transactionally activate grant + update peer + write audit.
- *
- * Replay protection: the token is claimed (UPDATE WHERE used_at IS NULL) BEFORE
- * cert issuance. This prevents double cert minting on concurrent requests.
- * If cert issuance fails after claim, the token is consumed and the grant
- * stays pending — admin must create a new grant.
- */
-
-import {
-  BadRequestException,
-  ConflictException,
-  GoneException,
-  Inject,
-  Injectable,
-  Logger,
-  NotFoundException,
-} from '@nestjs/common';
-import * as crypto from 'node:crypto';
-// X509Certificate is available as a named export in Node.js ≥ 15.6
-const { X509Certificate } = crypto;
-import {
-  type Db,
-  and,
-  eq,
-  isNull,
-  sql,
-  federationEnrollmentTokens,
-  federationGrants,
-  federationPeers,
-  federationAuditLog,
-} from '@mosaicstack/db';
-import { DB } from '../database/database.module.js';
-import { CaService } from './ca.service.js';
-import { GrantsService } from './grants.service.js';
-import { FederationScopeError } from './scope-schema.js';
-import type { CreateEnrollmentTokenDto } from './enrollment.dto.js';
-
-export interface EnrollmentTokenResult {
-  token: string;
-  expiresAt: string;
-}
-
-export interface RedeemResult {
-  certPem: string;
-  certChainPem: string;
-}
-
-@Injectable()
-export class EnrollmentService {
-  private readonly logger = new Logger(EnrollmentService.name);
-
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    private readonly caService: CaService,
-    private readonly grantsService: GrantsService,
-  ) {}
-
-  /**
-   * Generate a single-use enrollment token for an admin to distribute
-   * out-of-band to the remote peer operator.
-   */
-  async createToken(dto: CreateEnrollmentTokenDto): Promise<EnrollmentTokenResult> {
-    const ttl = Math.min(dto.ttlSeconds, 900);
-
-    // MED-3: Verify the grantId ↔ peerId binding — prevents attacker from
-    // cross-wiring grants to attacker-controlled peers.
-    const [grant] = await this.db
-      .select({ peerId: federationGrants.peerId })
-      .from(federationGrants)
-      .where(eq(federationGrants.id, dto.grantId))
-      .limit(1);
-    if (!grant) {
-      throw new NotFoundException(`Grant ${dto.grantId} not found`);
-    }
-    if (grant.peerId !== dto.peerId) {
-      throw new BadRequestException(`peerId does not match the grant's registered peer`);
-    }
-
-    const token = crypto.randomBytes(32).toString('hex');
-    const expiresAt = new Date(Date.now() + ttl * 1000);
-
-    await this.db.insert(federationEnrollmentTokens).values({
-      token,
-      grantId: dto.grantId,
-      peerId: dto.peerId,
-      expiresAt,
-    });
-
-    this.logger.log(
-      `Enrollment token created — grantId=${dto.grantId} peerId=${dto.peerId} expiresAt=${expiresAt.toISOString()}`,
-    );
-
-    return { token, expiresAt: expiresAt.toISOString() };
-  }
-
-  /**
-   * Redeem an enrollment token.
-   *
-   * Full flow:
-   *  1. Fetch token row — NotFoundException if not found
-   *  2. usedAt set → GoneException (already used)
-   *  3. expiresAt < now → GoneException (expired)
-   *  4. Load grant — verify status is 'pending'
-   *  5. Atomically claim token (UPDATE WHERE used_at IS NULL RETURNING token)
-   *     — if no rows returned, concurrent request won → GoneException
-   *  6. Issue cert via CaService (network call, outside transaction)
-   *     — if this fails, token is consumed; grant stays pending; admin must recreate
-   *  7. Transaction: activate grant + update peer record + write audit log
-   *  8. Return { certPem, certChainPem }
-   */
-  async redeem(token: string, csrPem: string): Promise<RedeemResult> {
-    // HIGH-5: Track outcome so we can write a failure audit row on any error.
-    let outcome: 'allowed' | 'denied' = 'denied';
-    // row may be undefined if the token is not found — used defensively in catch.
-    let row: typeof federationEnrollmentTokens.$inferSelect | undefined;
-
-    try {
-      // 1. Fetch token row
-      const [fetchedRow] = await this.db
-        .select()
-        .from(federationEnrollmentTokens)
-        .where(eq(federationEnrollmentTokens.token, token))
-        .limit(1);
-
-      if (!fetchedRow) {
-        throw new NotFoundException('Enrollment token not found');
-      }
-      row = fetchedRow;
-
-      // 2. Already used?
-      if (row.usedAt !== null) {
-        throw new GoneException('Enrollment token has already been used');
-      }
-
-      // 3. Expired?
-      if (row.expiresAt < new Date()) {
-        throw new GoneException('Enrollment token has expired');
-      }
-
-      // 4. Load grant and verify it is still pending
-      let grant;
-      try {
-        grant = await this.grantsService.getGrant(row.grantId);
-      } catch (err) {
-        if (err instanceof FederationScopeError) {
-          throw new BadRequestException(err.message);
-        }
-        throw err;
-      }
-
-      if (grant.status !== 'pending') {
-        throw new GoneException(
-          `Grant ${row.grantId} is no longer pending (status: ${grant.status})`,
-        );
-      }
-
-      // 5. Atomically claim the token BEFORE cert issuance to prevent double-minting.
-      // WHERE used_at IS NULL ensures only one concurrent request wins.
-      // Using .returning() works on both node-postgres and PGlite without rowCount inspection.
-      const claimed = await this.db
-        .update(federationEnrollmentTokens)
-        .set({ usedAt: sql`NOW()` })
-        .where(
-          and(
-            eq(federationEnrollmentTokens.token, token),
-            isNull(federationEnrollmentTokens.usedAt),
-          ),
-        )
-        .returning({ token: federationEnrollmentTokens.token });
-
-      if (claimed.length === 0) {
-        throw new GoneException('Enrollment token has already been used (concurrent request)');
-      }
-
-      // 6. Issue certificate via CaService (network call — outside any transaction).
-      // If this throws, the token is already consumed. The grant stays pending.
-      // Admin must revoke the grant and create a new one.
-      let issued;
-      try {
-        issued = await this.caService.issueCert({
-          csrPem,
-          grantId: row.grantId,
-          subjectUserId: grant.subjectUserId,
-          ttlSeconds: 300,
-        });
-      } catch (err) {
-        // HIGH-4: Log only the first 8 hex chars of the token for correlation — never log the full token.
-        this.logger.error(
-          `issueCert failed after token ${token.slice(0, 8)}... was claimed — grant ${row.grantId} is stranded pending`,
-          err instanceof Error ? err.stack : String(err),
-        );
-        if (err instanceof FederationScopeError) {
-          throw new BadRequestException((err as Error).message);
-        }
-        throw err;
-      }
-
-      // 7. Atomically activate grant, update peer record, and write audit log.
-      const certNotAfter = this.extractCertNotAfter(issued.certPem);
-      await this.db.transaction(async (tx) => {
-        // CRIT-2: Guard activation with WHERE status='pending' to prevent double-activation.
-        const [activated] = await tx
-          .update(federationGrants)
-          .set({ status: 'active' })
-          .where(and(eq(federationGrants.id, row!.grantId), eq(federationGrants.status, 'pending')))
-          .returning({ id: federationGrants.id });
-        if (!activated) {
-          throw new ConflictException(
-            `Grant ${row!.grantId} is no longer pending — cannot activate`,
-          );
-        }
-
-        // CRIT-2: Guard peer update with WHERE state='pending'.
-        await tx
-          .update(federationPeers)
-          .set({
-            certPem: issued.certPem,
-            certSerial: issued.serialNumber,
-            certNotAfter,
-            state: 'active',
-          })
-          .where(and(eq(federationPeers.id, row!.peerId), eq(federationPeers.state, 'pending')));
-
-        await tx.insert(federationAuditLog).values({
-          requestId: crypto.randomUUID(),
-          peerId: row!.peerId,
-          grantId: row!.grantId,
-          verb: 'enrollment',
-          resource: 'federation_grant',
-          statusCode: 200,
-          outcome: 'allowed',
-        });
-      });
-
-      this.logger.log(
-        `Enrollment complete — peerId=${row.peerId} grantId=${row.grantId} serial=${issued.serialNumber}`,
-      );
-
-      outcome = 'allowed';
-
-      // 8. Return cert material
-      return {
-        certPem: issued.certPem,
-        certChainPem: issued.certChainPem,
-      };
-    } catch (err) {
-      // HIGH-5: Best-effort audit write on failure — do not let this throw.
-      if (outcome === 'denied') {
-        await this.db
-          .insert(federationAuditLog)
-          .values({
-            requestId: crypto.randomUUID(),
-            peerId: row?.peerId ?? null,
-            grantId: row?.grantId ?? null,
-            verb: 'enrollment',
-            resource: 'federation_grant',
-            statusCode:
-              err instanceof GoneException ? 410 : err instanceof NotFoundException ? 404 : 500,
-            outcome: 'denied',
-          })
-          .catch(() => {});
-      }
-      throw err;
-    }
-  }
-
-  /**
-   * Extract the notAfter date from a PEM certificate.
-   * HIGH-2: No silent fallback — a cert that cannot be parsed should fail loud.
-   */
-  private extractCertNotAfter(certPem: string): Date {
-    const cert = new X509Certificate(certPem);
-    return new Date(cert.validTo);
-  }
-}
--- a/apps/gateway/src/federation/federation-admin.dto.ts
+++ b/apps/gateway/src/federation/federation-admin.dto.ts
@@ -1,39 +0,0 @@
-/**
- * DTOs for the federation admin controller (FED-M2-08).
- */
-
-import { IsInt, IsNotEmpty, IsOptional, IsString, IsUrl, Max, Min } from 'class-validator';
-
-export class CreatePeerKeypairDto {
-  @IsString()
-  @IsNotEmpty()
-  commonName!: string;
-
-  @IsString()
-  @IsNotEmpty()
-  displayName!: string;
-
-  @IsOptional()
-  @IsUrl()
-  endpointUrl?: string;
-}
-
-export class StorePeerCertDto {
-  @IsString()
-  @IsNotEmpty()
-  certPem!: string;
-}
-
-export class GenerateEnrollmentTokenDto {
-  @IsOptional()
-  @IsInt()
-  @Min(60)
-  @Max(900)
-  ttlSeconds: number = 900;
-}
-
-export class RevokeGrantBodyDto {
-  @IsOptional()
-  @IsString()
-  reason?: string;
-}
--- a/apps/gateway/src/federation/federation.controller.ts
+++ b/apps/gateway/src/federation/federation.controller.ts
@@ -1,266 +0,0 @@
-/**
- * FederationController — admin REST API for federation management (FED-M2-08).
- *
- * Routes (all under /api/admin/federation, all require AdminGuard):
- *
- *   Grant management:
- *     POST   /api/admin/federation/grants
- *     GET    /api/admin/federation/grants
- *     GET    /api/admin/federation/grants/:id
- *     PATCH  /api/admin/federation/grants/:id/revoke
- *     POST   /api/admin/federation/grants/:id/tokens
- *
- *   Peer management:
- *     GET    /api/admin/federation/peers
- *     POST   /api/admin/federation/peers/keypair
- *     PATCH  /api/admin/federation/peers/:id/cert
- *
- * NOTE: The enrollment REDEMPTION endpoint (POST /api/federation/enrollment/:token)
- * is handled by EnrollmentController — not duplicated here.
- */
-
-import {
-  Body,
-  Controller,
-  Get,
-  HttpCode,
-  HttpStatus,
-  Inject,
-  NotFoundException,
-  Param,
-  Patch,
-  Post,
-  Query,
-  UseGuards,
-} from '@nestjs/common';
-import { webcrypto } from 'node:crypto';
-import { X509Certificate } from 'node:crypto';
-import { Pkcs10CertificateRequestGenerator } from '@peculiar/x509';
-import { type Db, eq, federationPeers } from '@mosaicstack/db';
-import { DB } from '../database/database.module.js';
-import { AdminGuard } from '../admin/admin.guard.js';
-import { GrantsService } from './grants.service.js';
-import { EnrollmentService } from './enrollment.service.js';
-import { sealClientKey } from './peer-key.util.js';
-import { CreateGrantDto, ListGrantsDto } from './grants.dto.js';
-import {
-  CreatePeerKeypairDto,
-  GenerateEnrollmentTokenDto,
-  RevokeGrantBodyDto,
-  StorePeerCertDto,
-} from './federation-admin.dto.js';
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Convert an ArrayBuffer to a Base64 string (for PEM encoding).
- */
-function arrayBufferToBase64(buf: ArrayBuffer): string {
-  const bytes = new Uint8Array(buf);
-  let binary = '';
-  for (const b of bytes) {
-    binary += String.fromCharCode(b);
-  }
-  return Buffer.from(binary, 'binary').toString('base64');
-}
-
-/**
- * Wrap a Base64 string in PEM armour.
- */
-function toPem(label: string, b64: string): string {
-  const lines = b64.match(/.{1,64}/g) ?? [];
-  return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----\n`;
-}
-
-// ---------------------------------------------------------------------------
-// Controller
-// ---------------------------------------------------------------------------
-
-@Controller('api/admin/federation')
-@UseGuards(AdminGuard)
-export class FederationController {
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(GrantsService) private readonly grantsService: GrantsService,
-    @Inject(EnrollmentService) private readonly enrollmentService: EnrollmentService,
-  ) {}
-
-  // ─── Grant management ────────────────────────────────────────────────────
-
-  /**
-   * POST /api/admin/federation/grants
-   * Create a new grant in pending state.
-   */
-  @Post('grants')
-  @HttpCode(HttpStatus.CREATED)
-  async createGrant(@Body() body: CreateGrantDto) {
-    return this.grantsService.createGrant(body);
-  }
-
-  /**
-   * GET /api/admin/federation/grants
-   * List grants with optional filters.
-   */
-  @Get('grants')
-  async listGrants(@Query() query: ListGrantsDto) {
-    return this.grantsService.listGrants(query);
-  }
-
-  /**
-   * GET /api/admin/federation/grants/:id
-   * Get a single grant by ID.
-   */
-  @Get('grants/:id')
-  async getGrant(@Param('id') id: string) {
-    return this.grantsService.getGrant(id);
-  }
-
-  /**
-   * PATCH /api/admin/federation/grants/:id/revoke
-   * Revoke an active grant.
-   */
-  @Patch('grants/:id/revoke')
-  async revokeGrant(@Param('id') id: string, @Body() body: RevokeGrantBodyDto) {
-    return this.grantsService.revokeGrant(id, body.reason);
-  }
-
-  /**
-   * POST /api/admin/federation/grants/:id/tokens
-   * Generate a single-use enrollment token for a pending grant.
-   * Returns the token plus an enrollmentUrl the operator shares out-of-band.
-   */
-  @Post('grants/:id/tokens')
-  @HttpCode(HttpStatus.CREATED)
-  async generateToken(@Param('id') id: string, @Body() body: GenerateEnrollmentTokenDto) {
-    const grant = await this.grantsService.getGrant(id);
-
-    const result = await this.enrollmentService.createToken({
-      grantId: id,
-      peerId: grant.peerId,
-      ttlSeconds: body.ttlSeconds ?? 900,
-    });
-
-    const baseUrl = process.env['BETTER_AUTH_URL'] ?? 'http://localhost:14242';
-    const enrollmentUrl = `${baseUrl}/api/federation/enrollment/${result.token}`;
-
-    return {
-      token: result.token,
-      expiresAt: result.expiresAt,
-      enrollmentUrl,
-    };
-  }
-
-  // ─── Peer management ─────────────────────────────────────────────────────
-
-  /**
-   * GET /api/admin/federation/peers
-   * List all federation peer rows.
-   */
-  @Get('peers')
-  async listPeers() {
-    return this.db.select().from(federationPeers).orderBy(federationPeers.commonName);
-  }
-
-  /**
-   * POST /api/admin/federation/peers/keypair
-   * Generate a new peer entry with EC P-256 key pair and a PKCS#10 CSR.
-   *
-   * Flow:
-   *  1. Generate EC P-256 key pair via webcrypto
-   *  2. Generate a self-signed CSR via @peculiar/x509
-   *  3. Export private key as PEM
-   *  4. sealClientKey(privatePem) → sealed blob
-   *  5. Insert pending peer row
-   *  6. Return { peerId, csrPem }
-   */
-  @Post('peers/keypair')
-  @HttpCode(HttpStatus.CREATED)
-  async createPeerKeypair(@Body() body: CreatePeerKeypairDto) {
-    // 1. Generate EC P-256 key pair via Web Crypto
-    const keyPair = await webcrypto.subtle.generateKey(
-      { name: 'ECDSA', namedCurve: 'P-256' },
-      true, // extractable
-      ['sign', 'verify'],
-    );
-
-    // 2. Generate PKCS#10 CSR
-    const csr = await Pkcs10CertificateRequestGenerator.create({
-      name: `CN=${body.commonName}`,
-      keys: keyPair,
-      signingAlgorithm: { name: 'ECDSA', hash: 'SHA-256' },
-    });
-
-    const csrPem = csr.toString('pem');
-
-    // 3. Export private key as PKCS#8 PEM
-    const pkcs8Der = await webcrypto.subtle.exportKey('pkcs8', keyPair.privateKey);
-    const privatePem = toPem('PRIVATE KEY', arrayBufferToBase64(pkcs8Der));
-
-    // 4. Seal the private key
-    const sealed = sealClientKey(privatePem);
-
-    // 5. Insert pending peer row
-    const [peer] = await this.db
-      .insert(federationPeers)
-      .values({
-        commonName: body.commonName,
-        displayName: body.displayName,
-        certPem: '',
-        certSerial: 'pending',
-        certNotAfter: new Date(0),
-        clientKeyPem: sealed,
-        state: 'pending',
-        endpointUrl: body.endpointUrl,
-      })
-      .returning();
-
-    return {
-      peerId: peer!.id,
-      csrPem,
-    };
-  }
-
-  /**
-   * PATCH /api/admin/federation/peers/:id/cert
-   * Store a signed certificate after enrollment completes.
-   *
-   * Flow:
-   *  1. Parse the cert to extract serial and notAfter
-   *  2. Update the peer row with cert data + state='active'
-   *  3. Return the updated peer row
-   */
-  @Patch('peers/:id/cert')
-  async storePeerCert(@Param('id') id: string, @Body() body: StorePeerCertDto) {
-    // Ensure peer exists
-    const [existing] = await this.db
-      .select({ id: federationPeers.id })
-      .from(federationPeers)
-      .where(eq(federationPeers.id, id))
-      .limit(1);
-
-    if (!existing) {
-      throw new NotFoundException(`Peer ${id} not found`);
-    }
-
-    // 1. Parse cert
-    const x509 = new X509Certificate(body.certPem);
-    const certSerial = x509.serialNumber;
-    const certNotAfter = new Date(x509.validTo);
-
-    // 2. Update peer
-    const [updated] = await this.db
-      .update(federationPeers)
-      .set({
-        certPem: body.certPem,
-        certSerial,
-        certNotAfter,
-        state: 'active',
-      })
-      .where(eq(federationPeers.id, id))
-      .returning();
-
-    return updated;
-  }
-}
--- a/apps/gateway/src/federation/federation.module.ts
+++ b/apps/gateway/src/federation/federation.module.ts
@@ -1,48 +0,0 @@
-import { Module } from '@nestjs/common';
-import { AdminGuard } from '../admin/admin.guard.js';
-import { CaService } from './ca.service.js';
-import { EnrollmentController } from './enrollment.controller.js';
-import { EnrollmentService } from './enrollment.service.js';
-import { FederationController } from './federation.controller.js';
-import { CapabilitiesController } from './server/verbs/capabilities.controller.js';
-import { GetController } from './server/verbs/get.controller.js';
-import { FederationGetQueryService } from './server/verbs/get-query.service.js';
-import { GrantsService } from './grants.service.js';
-import { FederationClientService, QuerySourceService } from './client/index.js';
-import { FederationAuthGuard, FederationScopeService } from './server/index.js';
-import { ListController } from './server/verbs/list.controller.js';
-import { FederationListQueryService } from './server/verbs/list-query.service.js';
-
-@Module({
-  controllers: [
-    EnrollmentController,
-    FederationController,
-    CapabilitiesController,
-    ListController,
-    GetController,
-  ],
-  providers: [
-    AdminGuard,
-    CaService,
-    EnrollmentService,
-    GrantsService,
-    FederationClientService,
-    QuerySourceService,
-    FederationAuthGuard,
-    FederationScopeService,
-    FederationListQueryService,
-    FederationGetQueryService,
-  ],
-  exports: [
-    CaService,
-    EnrollmentService,
-    GrantsService,
-    FederationClientService,
-    QuerySourceService,
-    FederationAuthGuard,
-    FederationScopeService,
-    FederationListQueryService,
-    FederationGetQueryService,
-  ],
-})
-export class FederationModule {}
--- a/apps/gateway/src/federation/grants.dto.ts
+++ b/apps/gateway/src/federation/grants.dto.ts
@@ -1,36 +0,0 @@
-import { IsDateString, IsIn, IsObject, IsOptional, IsString, IsUUID } from 'class-validator';
-
-export class CreateGrantDto {
-  @IsUUID()
-  peerId!: string;
-
-  @IsUUID()
-  subjectUserId!: string;
-
-  @IsObject()
-  scope!: Record<string, unknown>;
-
-  @IsOptional()
-  @IsDateString()
-  expiresAt?: string;
-}
-
-export class ListGrantsDto {
-  @IsOptional()
-  @IsUUID()
-  peerId?: string;
-
-  @IsOptional()
-  @IsUUID()
-  subjectUserId?: string;
-
-  @IsOptional()
-  @IsIn(['pending', 'active', 'revoked', 'expired'])
-  status?: 'pending' | 'active' | 'revoked' | 'expired';
-}
-
-export class RevokeGrantDto {
-  @IsOptional()
-  @IsString()
-  reason?: string;
-}
--- a/apps/gateway/src/federation/grants.service.ts
+++ b/apps/gateway/src/federation/grants.service.ts
@@ -1,190 +0,0 @@
-/**
- * Federation grants service — CRUD + status transitions (FED-M2-06).
- *
- * Business logic only. CSR/cert work is handled by M2-07.
- *
- * Status lifecycle:
- *   pending → active   (activateGrant, called by M2-07 enrollment controller after cert signed)
- *   active  → revoked  (revokeGrant)
- *   active  → expired  (expireGrant, called by M6 scheduler)
- */
-
-import { ConflictException, Inject, Injectable, NotFoundException } from '@nestjs/common';
-import { type Db, and, eq, federationGrants, federationPeers } from '@mosaicstack/db';
-import { DB } from '../database/database.module.js';
-import { parseFederationScope } from './scope-schema.js';
-import type { CreateGrantDto, ListGrantsDto } from './grants.dto.js';
-
-export type Grant = typeof federationGrants.$inferSelect;
-export type Peer = typeof federationPeers.$inferSelect;
-export type GrantWithPeer = Grant & { peer: Peer };
-
-@Injectable()
-export class GrantsService {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  /**
-   * Create a new grant in `pending` state.
-   * Validates the scope against the federation scope JSON schema before inserting.
-   */
-  async createGrant(dto: CreateGrantDto): Promise<Grant> {
-    // Throws FederationScopeError (a plain Error subclass) on invalid scope.
-    parseFederationScope(dto.scope);
-
-    const [grant] = await this.db
-      .insert(federationGrants)
-      .values({
-        peerId: dto.peerId,
-        subjectUserId: dto.subjectUserId,
-        scope: dto.scope,
-        status: 'pending',
-        expiresAt: dto.expiresAt != null ? new Date(dto.expiresAt) : null,
-      })
-      .returning();
-
-    return grant!;
-  }
-
-  /**
-   * Fetch a single grant by ID. Throws NotFoundException if not found.
-   */
-  async getGrant(id: string): Promise<Grant> {
-    const [grant] = await this.db
-      .select()
-      .from(federationGrants)
-      .where(eq(federationGrants.id, id))
-      .limit(1);
-
-    if (!grant) {
-      throw new NotFoundException(`Grant ${id} not found`);
-    }
-
-    return grant;
-  }
-
-  /**
-   * Fetch a single grant by ID, joined with its associated peer row.
-   * Used by FederationAuthGuard to perform grant status + cert serial checks
-   * in a single DB round-trip.
-   *
-   * Throws NotFoundException if the grant does not exist.
-   * Throws NotFoundException if the associated peer row is missing (data integrity issue).
-   */
-  async getGrantWithPeer(id: string): Promise<GrantWithPeer> {
-    const rows = await this.db
-      .select()
-      .from(federationGrants)
-      .innerJoin(federationPeers, eq(federationGrants.peerId, federationPeers.id))
-      .where(eq(federationGrants.id, id))
-      .limit(1);
-
-    const row = rows[0];
-    if (!row) {
-      throw new NotFoundException(`Grant ${id} not found`);
-    }
-
-    return {
-      ...row.federation_grants,
-      peer: row.federation_peers,
-    };
-  }
-
-  /**
-   * List grants with optional filters for peerId, subjectUserId, and status.
-   */
-  async listGrants(filters: ListGrantsDto): Promise<Grant[]> {
-    const conditions = [];
-
-    if (filters.peerId != null) {
-      conditions.push(eq(federationGrants.peerId, filters.peerId));
-    }
-    if (filters.subjectUserId != null) {
-      conditions.push(eq(federationGrants.subjectUserId, filters.subjectUserId));
-    }
-    if (filters.status != null) {
-      conditions.push(eq(federationGrants.status, filters.status));
-    }
-
-    if (conditions.length === 0) {
-      return this.db.select().from(federationGrants);
-    }
-
-    return this.db
-      .select()
-      .from(federationGrants)
-      .where(and(...conditions));
-  }
-
-  /**
-   * Transition a grant from `pending` → `active`.
-   * Called by M2-07 enrollment controller after cert is signed.
-   * Throws ConflictException if the grant is not in `pending` state.
-   */
-  async activateGrant(id: string): Promise<Grant> {
-    const grant = await this.getGrant(id);
-
-    if (grant.status !== 'pending') {
-      throw new ConflictException(
-        `Grant ${id} cannot be activated: expected status 'pending', got '${grant.status}'`,
-      );
-    }
-
-    const [updated] = await this.db
-      .update(federationGrants)
-      .set({ status: 'active' })
-      .where(eq(federationGrants.id, id))
-      .returning();
-
-    return updated!;
-  }
-
-  /**
-   * Transition a grant from `active` → `revoked`.
-   * Sets revokedAt and optionally revokedReason.
-   * Throws ConflictException if the grant is not in `active` state.
-   */
-  async revokeGrant(id: string, reason?: string): Promise<Grant> {
-    const grant = await this.getGrant(id);
-
-    if (grant.status !== 'active') {
-      throw new ConflictException(
-        `Grant ${id} cannot be revoked: expected status 'active', got '${grant.status}'`,
-      );
-    }
-
-    const [updated] = await this.db
-      .update(federationGrants)
-      .set({
-        status: 'revoked',
-        revokedAt: new Date(),
-        revokedReason: reason ?? null,
-      })
-      .where(eq(federationGrants.id, id))
-      .returning();
-
-    return updated!;
-  }
-
-  /**
-   * Transition a grant from `active` → `expired`.
-   * Intended for use by the M6 scheduler.
-   * Throws ConflictException if the grant is not in `active` state.
-   */
-  async expireGrant(id: string): Promise<Grant> {
-    const grant = await this.getGrant(id);
-
-    if (grant.status !== 'active') {
-      throw new ConflictException(
-        `Grant ${id} cannot be expired: expected status 'active', got '${grant.status}'`,
-      );
-    }
-
-    const [updated] = await this.db
-      .update(federationGrants)
-      .set({ status: 'expired' })
-      .where(eq(federationGrants.id, id))
-      .returning();
-
-    return updated!;
-  }
-}
--- a/apps/gateway/src/federation/oid.util.ts
+++ b/apps/gateway/src/federation/oid.util.ts
@@ -1,146 +0,0 @@
-/**
- * Shared OID extraction helpers for Mosaic federation certificates.
- *
- * Custom OID registry (PRD §6, docs/federation/SETUP.md):
- *   1.3.6.1.4.1.99999.1  — mosaic_grant_id
- *   1.3.6.1.4.1.99999.2  — mosaic_subject_user_id
- *
- * The encoding convention: each extension value is an OCTET STRING wrapping
- * an ASN.1 UTF8String TLV:
- *   0x0C (tag) + 1-byte length + UTF-8 bytes
- *
- * CaService encodes values this way via encodeUtf8String(), and this module
- * decodes them with the corresponding `.slice(2)` to skip tag + length byte.
- *
- * This module is intentionally pure — no NestJS, no DB, no network I/O.
- */
-
-import { X509Certificate } from '@peculiar/x509';
-
-// ---------------------------------------------------------------------------
-// OID constants
-// ---------------------------------------------------------------------------
-
-export const OID_MOSAIC_GRANT_ID = '1.3.6.1.4.1.99999.1';
-export const OID_MOSAIC_SUBJECT_USER_ID = '1.3.6.1.4.1.99999.2';
-
-// ---------------------------------------------------------------------------
-// Extraction result types
-// ---------------------------------------------------------------------------
-
-export interface MosaicOids {
-  grantId: string;
-  subjectUserId: string;
-}
-
-export type OidExtractionResult =
-  | { ok: true; value: MosaicOids }
-  | {
-      ok: false;
-      error: 'MISSING_GRANT_ID' | 'MISSING_SUBJECT_USER_ID' | 'PARSE_ERROR';
-      detail?: string;
-    };
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const decoder = new TextDecoder();
-
-/**
- * Decode an extension value encoded as ASN.1 UTF8String TLV
- * (tag 0x0C + 1-byte length + UTF-8 bytes).
- * Validates tag, length byte, and buffer bounds before decoding.
- * Throws a descriptive Error on malformed input; caller wraps in try/catch.
- */
-function decodeUtf8StringTlv(value: ArrayBuffer): string {
-  const bytes = new Uint8Array(value);
-
-  // Need at least tag + length bytes
-  if (bytes.length < 2) {
-    throw new Error(`UTF8String TLV too short: expected at least 2 bytes, got ${bytes.length}`);
-  }
-
-  // Tag byte must be 0x0C (ASN.1 UTF8String)
-  if (bytes[0] !== 0x0c) {
-    throw new Error(
-      `UTF8String TLV tag mismatch: expected 0x0C, got 0x${bytes[0]!.toString(16).toUpperCase()}`,
-    );
-  }
-
-  // Only single-byte length form is supported (values 0–127); long form not needed
-  // for OID strings of this length.
-  const declaredLength = bytes[1]!;
-  if (declaredLength > 127) {
-    throw new Error(
-      `UTF8String TLV uses long-form length (0x${declaredLength.toString(16).toUpperCase()}), which is not supported`,
-    );
-  }
-
-  // Declared length must match actual remaining bytes
-  if (declaredLength !== bytes.length - 2) {
-    throw new Error(
-      `UTF8String TLV length mismatch: declared ${declaredLength}, actual ${bytes.length - 2}`,
-    );
-  }
-
-  // Skip: tag (1 byte) + length (1 byte)
-  return decoder.decode(bytes.slice(2));
-}
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-/**
- * Extract Mosaic custom OIDs (grantId, subjectUserId) from an X.509 certificate
- * already parsed via @peculiar/x509.
- *
- * Returns `{ ok: true, value: MosaicOids }` on success, or
- * `{ ok: false, error: <code>, detail? }` on any failure — never throws.
- */
-export function extractMosaicOids(cert: X509Certificate): OidExtractionResult {
-  try {
-    const grantIdExt = cert.getExtension(OID_MOSAIC_GRANT_ID);
-    if (!grantIdExt) {
-      return { ok: false, error: 'MISSING_GRANT_ID' };
-    }
-
-    const subjectUserIdExt = cert.getExtension(OID_MOSAIC_SUBJECT_USER_ID);
-    if (!subjectUserIdExt) {
-      return { ok: false, error: 'MISSING_SUBJECT_USER_ID' };
-    }
-
-    const grantId = decodeUtf8StringTlv(grantIdExt.value);
-    const subjectUserId = decodeUtf8StringTlv(subjectUserIdExt.value);
-
-    return {
-      ok: true,
-      value: { grantId, subjectUserId },
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: 'PARSE_ERROR',
-      detail: err instanceof Error ? err.message : String(err),
-    };
-  }
-}
-
-/**
- * Parse a PEM-encoded certificate and extract Mosaic OIDs.
- * Returns an OidExtractionResult — never throws.
- */
-export function extractMosaicOidsFromPem(certPem: string): OidExtractionResult {
-  let cert: X509Certificate;
-  try {
-    cert = new X509Certificate(certPem);
-  } catch (err) {
-    return {
-      ok: false,
-      error: 'PARSE_ERROR',
-      detail: err instanceof Error ? err.message : String(err),
-    };
-  }
-  return extractMosaicOids(cert);
-}
--- a/apps/gateway/src/federation/peer-key.util.ts
+++ b/apps/gateway/src/federation/peer-key.util.ts
@@ -1,9 +0,0 @@
-import { seal, unseal } from '@mosaicstack/auth';
-
-export function sealClientKey(privateKeyPem: string): string {
-  return seal(privateKeyPem);
-}
-
-export function unsealClientKey(sealedKey: string): string {
-  return unseal(sealedKey);
-}
--- a/apps/gateway/src/federation/scope-schema.spec.ts
+++ b/apps/gateway/src/federation/scope-schema.spec.ts
@@ -1,187 +0,0 @@
-/**
- * Unit tests for FederationScopeSchema and parseFederationScope.
- *
- * Coverage:
- *  - Valid: minimal scope
- *  - Valid: full PRD §8.1 example
- *  - Valid: resources + excluded_resources (no overlap)
- *  - Invalid: empty resources
- *  - Invalid: unknown resource value
- *  - Invalid: resources / excluded_resources intersection
- *  - Invalid: filter key not in resources
- *  - Invalid: max_rows_per_query = 0
- *  - Invalid: max_rows_per_query = 10001
- *  - Invalid: not an object / null
- *  - Defaults: include_personal defaults to true; excluded_resources defaults to []
- *  - Sentinel: console.warn fires for sensitive resources
- */
-
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import {
-  parseFederationScope,
-  FederationScopeError,
-  FederationScopeSchema,
-} from './scope-schema.js';
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-describe('parseFederationScope — valid inputs', () => {
-  it('accepts a minimal scope (resources + max_rows_per_query only)', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks'],
-      max_rows_per_query: 100,
-    });
-    expect(scope.resources).toEqual(['tasks']);
-    expect(scope.max_rows_per_query).toBe(100);
-    expect(scope.excluded_resources).toEqual([]);
-    expect(scope.filters).toBeUndefined();
-  });
-
-  it('accepts the full PRD §8.1 example', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks', 'notes', 'memory'],
-      filters: {
-        tasks: { include_teams: ['team_uuid_1', 'team_uuid_2'], include_personal: true },
-        notes: { include_personal: true, include_teams: [] },
-        memory: { include_personal: true },
-      },
-      excluded_resources: ['credentials', 'api_keys'],
-      max_rows_per_query: 500,
-    });
-    expect(scope.resources).toEqual(['tasks', 'notes', 'memory']);
-    expect(scope.excluded_resources).toEqual(['credentials', 'api_keys']);
-    expect(scope.filters?.tasks?.include_teams).toEqual(['team_uuid_1', 'team_uuid_2']);
-    expect(scope.max_rows_per_query).toBe(500);
-  });
-
-  it('accepts a scope with excluded_resources and no filter overlap', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks', 'notes'],
-      excluded_resources: ['memory'],
-      max_rows_per_query: 250,
-    });
-    expect(scope.resources).toEqual(['tasks', 'notes']);
-    expect(scope.excluded_resources).toEqual(['memory']);
-  });
-});
-
-describe('parseFederationScope — defaults', () => {
-  it('defaults excluded_resources to []', () => {
-    const scope = parseFederationScope({ resources: ['tasks'], max_rows_per_query: 1 });
-    expect(scope.excluded_resources).toEqual([]);
-  });
-
-  it('defaults include_personal to true when filter is provided without it', () => {
-    const scope = parseFederationScope({
-      resources: ['tasks'],
-      filters: { tasks: { include_teams: ['t1'] } },
-      max_rows_per_query: 10,
-    });
-    expect(scope.filters?.tasks?.include_personal).toBe(true);
-  });
-});
-
-describe('parseFederationScope — invalid inputs', () => {
-  it('throws FederationScopeError for empty resources array', () => {
-    expect(() => parseFederationScope({ resources: [], max_rows_per_query: 100 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for unknown resource value in resources', () => {
-    expect(() =>
-      parseFederationScope({ resources: ['unknown_resource'], max_rows_per_query: 100 }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws when resources and excluded_resources intersect', () => {
-    expect(() =>
-      parseFederationScope({
-        resources: ['tasks', 'memory'],
-        excluded_resources: ['memory'],
-        max_rows_per_query: 100,
-      }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws when filters references a resource not in resources', () => {
-    expect(() =>
-      parseFederationScope({
-        resources: ['tasks'],
-        filters: { notes: { include_personal: true } },
-        max_rows_per_query: 100,
-      }),
-    ).toThrow(FederationScopeError);
-  });
-
-  it('throws for max_rows_per_query = 0', () => {
-    expect(() => parseFederationScope({ resources: ['tasks'], max_rows_per_query: 0 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for max_rows_per_query = 10001', () => {
-    expect(() => parseFederationScope({ resources: ['tasks'], max_rows_per_query: 10001 })).toThrow(
-      FederationScopeError,
-    );
-  });
-
-  it('throws for null input', () => {
-    expect(() => parseFederationScope(null)).toThrow(FederationScopeError);
-  });
-
-  it('throws for non-object input (string)', () => {
-    expect(() => parseFederationScope('not-an-object')).toThrow(FederationScopeError);
-  });
-});
-
-describe('parseFederationScope — sentinel warning', () => {
-  it('emits console.warn when resources includes "credentials"', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({
-      resources: ['tasks', 'credentials'],
-      max_rows_per_query: 100,
-    });
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining(
-        '[FederationScope] WARNING: scope grants sensitive resource "credentials"',
-      ),
-    );
-  });
-
-  it('emits console.warn when resources includes "api_keys"', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({
-      resources: ['tasks', 'api_keys'],
-      max_rows_per_query: 100,
-    });
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining(
-        '[FederationScope] WARNING: scope grants sensitive resource "api_keys"',
-      ),
-    );
-  });
-
-  it('does NOT emit console.warn for non-sensitive resources', () => {
-    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    parseFederationScope({ resources: ['tasks', 'notes', 'memory'], max_rows_per_query: 100 });
-    expect(warnSpy).not.toHaveBeenCalled();
-  });
-});
-
-describe('FederationScopeSchema — boundary values', () => {
-  it('accepts max_rows_per_query = 1 (lower bound)', () => {
-    const result = FederationScopeSchema.safeParse({ resources: ['tasks'], max_rows_per_query: 1 });
-    expect(result.success).toBe(true);
-  });
-
-  it('accepts max_rows_per_query = 10000 (upper bound)', () => {
-    const result = FederationScopeSchema.safeParse({
-      resources: ['tasks'],
-      max_rows_per_query: 10000,
-    });
-    expect(result.success).toBe(true);
-  });
-});
--- a/apps/gateway/src/federation/scope-schema.ts
+++ b/apps/gateway/src/federation/scope-schema.ts
@@ -1,147 +0,0 @@
-/**
- * Federation grant scope schema and validator.
- *
- * Source of truth: docs/federation/PRD.md §8.1
- *
- * This module is intentionally pure — no DB, no NestJS, no CA wiring.
- * It is reusable from grant CRUD (M2-06) and scope enforcement (M3+).
- */
-
-import { z } from 'zod';
-
-// ---------------------------------------------------------------------------
-// Allowlist of federation resources (canonical — M3+ will extend this list)
-// ---------------------------------------------------------------------------
-export const FEDERATION_RESOURCE_VALUES = [
-  'tasks',
-  'notes',
-  'memory',
-  'credentials',
-  'api_keys',
-] as const;
-
-export type FederationResource = (typeof FEDERATION_RESOURCE_VALUES)[number];
-
-/**
- * Sensitive resources require explicit admin approval (PRD §8.4).
- * The parser warns when these appear in `resources`; M2-06 grant CRUD
- * will add a hard gate on top of this warning.
- */
-const SENSITIVE_RESOURCES: ReadonlySet<FederationResource> = new Set(['credentials', 'api_keys']);
-
-// ---------------------------------------------------------------------------
-// Sub-schemas
-// ---------------------------------------------------------------------------
-
-const ResourceArraySchema = z
-  .array(z.enum(FEDERATION_RESOURCE_VALUES))
-  .nonempty({ message: 'resources must contain at least one value' })
-  .refine((arr) => new Set(arr).size === arr.length, {
-    message: 'resources must not contain duplicate values',
-  });
-
-const ResourceFilterSchema = z.object({
-  include_teams: z.array(z.string()).optional(),
-  include_personal: z.boolean().default(true),
-});
-
-// ---------------------------------------------------------------------------
-// Top-level schema
-// ---------------------------------------------------------------------------
-
-export const FederationScopeSchema = z
-  .object({
-    resources: ResourceArraySchema,
-
-    excluded_resources: z
-      .array(z.enum(FEDERATION_RESOURCE_VALUES))
-      .default([])
-      .refine((arr) => new Set(arr).size === arr.length, {
-        message: 'excluded_resources must not contain duplicate values',
-      }),
-
-    filters: z.record(z.string(), ResourceFilterSchema).optional(),
-
-    max_rows_per_query: z
-      .number()
-      .int({ message: 'max_rows_per_query must be an integer' })
-      .min(1, { message: 'max_rows_per_query must be at least 1' })
-      .max(10000, { message: 'max_rows_per_query must be at most 10000' }),
-  })
-  .superRefine((data, ctx) => {
-    const resourceSet = new Set(data.resources);
-
-    // Intersection guard: a resource cannot be both granted and excluded
-    for (const r of data.excluded_resources) {
-      if (resourceSet.has(r)) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: `Resource "${r}" appears in both resources and excluded_resources`,
-          path: ['excluded_resources'],
-        });
-      }
-    }
-
-    // Filter keys must be a subset of resources
-    if (data.filters) {
-      for (const key of Object.keys(data.filters)) {
-        if (!resourceSet.has(key as FederationResource)) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: `filters key "${key}" references a resource not present in resources`,
-            path: ['filters', key],
-          });
-        }
-      }
-    }
-  });
-
-export type FederationScope = z.infer<typeof FederationScopeSchema>;
-
-// ---------------------------------------------------------------------------
-// Error class
-// ---------------------------------------------------------------------------
-
-export class FederationScopeError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'FederationScopeError';
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Typed parser
-// ---------------------------------------------------------------------------
-
-/**
- * Parse and validate an unknown value as a FederationScope.
- *
- * Throws `FederationScopeError` with aggregated Zod issues on failure.
- *
- * Emits `console.warn` when sensitive resources (`credentials`, `api_keys`)
- * are present in `resources` — per PRD §8.4, these require explicit admin
- * approval. M2-06 grant CRUD will add a hard gate on top of this warning.
- */
-export function parseFederationScope(input: unknown): FederationScope {
-  const result = FederationScopeSchema.safeParse(input);
-
-  if (!result.success) {
-    const issues = result.error.issues
-      .map((e) => `  - [${e.path.join('.') || 'root'}] ${e.message}`)
-      .join('\n');
-    throw new FederationScopeError(`Invalid federation scope:\n${issues}`);
-  }
-
-  const scope = result.data;
-
-  // Sentinel warning for sensitive resources (PRD §8.4)
-  for (const resource of scope.resources) {
-    if (SENSITIVE_RESOURCES.has(resource)) {
-      console.warn(
-        `[FederationScope] WARNING: scope grants sensitive resource "${resource}". Per PRD §8.4 this requires explicit admin approval and is logged.`,
-      );
-    }
-  }
-
-  return scope;
-}
--- a/apps/gateway/src/federation/server/tests/federation-auth.guard.spec.ts
+++ b/apps/gateway/src/federation/server/tests/federation-auth.guard.spec.ts
@@ -1,521 +0,0 @@
-/**
- * Unit tests for FederationAuthGuard (FED-M3-03).
- *
- * Coverage:
- *  - Missing cert (no TLS socket / no getPeerCertificate) → 401
- *  - Cert parse failure (corrupt DER raw bytes) → 401
- *  - Missing grantId OID → 401
- *  - Missing subjectUserId OID → 401
- *  - Grant not found (GrantsService throws NotFoundException) → 403
- *  - Grant in `pending` status → 403
- *  - Grant in `revoked` status → 403
- *  - Grant in `expired` status → 403
- *  - Cert serial mismatch → 403
- *  - Happy path: active grant + matching cert serial → context attached, returns true
- */
-
-import 'reflect-metadata';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ExecutionContext } from '@nestjs/common';
-import { NotFoundException } from '@nestjs/common';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import { makeMosaicIssuedCert } from '../../__tests__/helpers/test-cert.js';
-import type { GrantsService, GrantWithPeer } from '../../grants.service.js';
-
-// ---------------------------------------------------------------------------
-// Test constants
-// ---------------------------------------------------------------------------
-
-const GRANT_ID = 'a1111111-1111-1111-1111-111111111111';
-const USER_ID = 'b2222222-2222-2222-2222-222222222222';
-const PEER_ID = 'c3333333-3333-3333-3333-333333333333';
-
-// Node.js TLS serialNumber is uppercase hex (no colons)
-const CERT_SERIAL_HEX = '01';
-
-const VALID_SCOPE = { resources: ['tasks'], max_rows_per_query: 100 };
-
-// ---------------------------------------------------------------------------
-// Mock builders
-// ---------------------------------------------------------------------------
-
-/**
- * Build a minimal GrantWithPeer-shaped mock.
- */
-function makeGrantWithPeer(overrides: Partial<GrantWithPeer> = {}): GrantWithPeer {
-  return {
-    id: GRANT_ID,
-    peerId: PEER_ID,
-    subjectUserId: USER_ID,
-    scope: VALID_SCOPE,
-    status: 'active',
-    expiresAt: null,
-    createdAt: new Date('2026-01-01T00:00:00Z'),
-    revokedAt: null,
-    revokedReason: null,
-    peer: {
-      id: PEER_ID,
-      commonName: 'test-peer',
-      displayName: 'Test Peer',
-      certPem: '',
-      certSerial: CERT_SERIAL_HEX,
-      certNotAfter: new Date(Date.now() + 86_400_000),
-      clientKeyPem: null,
-      state: 'active',
-      endpointUrl: null,
-      lastSeenAt: null,
-      createdAt: new Date('2026-01-01T00:00:00Z'),
-      revokedAt: null,
-    },
-    ...overrides,
-  };
-}
-
-/**
- * Build a mock ExecutionContext with a pre-built TLS peer certificate.
- *
- * `certPem` — PEM string to present as the raw DER cert (converted to Buffer).
- *             Pass null to simulate "no cert presented".
- * `certSerialHex` — serialNumber string returned by the TLS socket.
- *                   Node.js returns uppercase hex.
- * `hasTlsSocket` — if false, raw.socket has no getPeerCertificate (plain HTTP).
- */
-function makeContext(opts: {
-  certPem: string | null;
-  certSerialHex?: string;
-  hasTlsSocket?: boolean;
-}): {
-  ctx: ExecutionContext;
-  statusMock: ReturnType<typeof vi.fn>;
-  sendMock: ReturnType<typeof vi.fn>;
-} {
-  const { certPem, certSerialHex = CERT_SERIAL_HEX, hasTlsSocket = true } = opts;
-
-  // Build peerCert object that Node.js TLS socket.getPeerCertificate() returns
-  let peerCert: Record<string, unknown>;
-  if (certPem === null) {
-    // Simulate no cert: Node.js returns object with empty string fields
-    peerCert = { raw: null, serialNumber: '' };
-  } else {
-    // Convert PEM to DER Buffer (strip headers + base64 decode)
-    const b64 = certPem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, '');
-    const raw = Buffer.from(b64, 'base64');
-    peerCert = { raw, serialNumber: certSerialHex };
-  }
-
-  const getPeerCertificate = vi.fn().mockReturnValue(peerCert);
-
-  const socket = hasTlsSocket ? { getPeerCertificate } : {}; // No getPeerCertificate → non-TLS
-
-  // Fastify reply mocks
-  const sendMock = vi.fn().mockReturnValue(undefined);
-  const headerMock = vi.fn().mockReturnValue({ send: sendMock });
-  const statusMock = vi.fn().mockReturnValue({ header: headerMock });
-
-  const request = {
-    raw: {
-      socket,
-    },
-  };
-
-  const reply = {
-    status: statusMock,
-  };
-
-  const ctx = {
-    switchToHttp: () => ({
-      getRequest: () => request,
-      getResponse: () => reply,
-    }),
-  } as unknown as ExecutionContext;
-
-  return { ctx, statusMock, sendMock };
-}
-
-/**
- * Build a mock GrantsService.
- */
-function makeGrantsService(
-  overrides: Partial<Pick<GrantsService, 'getGrantWithPeer'>> = {},
-): GrantsService {
-  return {
-    getGrantWithPeer: vi.fn().mockResolvedValue(makeGrantWithPeer()),
-    ...overrides,
-  } as unknown as GrantsService;
-}
-
-// ---------------------------------------------------------------------------
-// Test suite
-// ---------------------------------------------------------------------------
-
-describe('FederationAuthGuard', () => {
-  let certPem: string;
-
-  beforeEach(async () => {
-    // Generate a real Mosaic-issued cert with the standard OIDs
-    certPem = await makeMosaicIssuedCert({ grantId: GRANT_ID, subjectUserId: USER_ID });
-  });
-
-  // ── 401: No TLS socket ────────────────────────────────────────────────────
-
-  it('returns 401 when there is no TLS socket (plain HTTP connection)', async () => {
-    const { ctx, statusMock, sendMock } = makeContext({
-      certPem: certPem,
-      hasTlsSocket: false,
-    });
-
-    const guard = new FederationAuthGuard(makeGrantsService());
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(401);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'unauthorized', message: expect.any(String) }),
-      }),
-    );
-  });
-
-  // ── 401: Cert not presented ───────────────────────────────────────────────
-
-  it('returns 401 when the peer did not present a certificate', async () => {
-    const { ctx, statusMock, sendMock } = makeContext({ certPem: null });
-
-    const guard = new FederationAuthGuard(makeGrantsService());
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(401);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'unauthorized', message: expect.any(String) }),
-      }),
-    );
-  });
-
-  // ── 401: Cert parse failure ───────────────────────────────────────────────
-
-  it('returns 401 when the certificate DER bytes are corrupt', async () => {
-    // Build context with a cert that has garbage DER bytes
-    const corruptPem = '-----BEGIN CERTIFICATE-----\naW52YWxpZA==\n-----END CERTIFICATE-----';
-    const { ctx, statusMock, sendMock } = makeContext({ certPem: corruptPem });
-
-    const guard = new FederationAuthGuard(makeGrantsService());
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(401);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'unauthorized', message: expect.any(String) }),
-      }),
-    );
-  });
-
-  // ── 401: Missing grantId OID ─────────────────────────────────────────────
-
-  it('returns 401 when the cert is missing the grantId OID', async () => {
-    // makeSelfSignedCert produces a cert without any Mosaic OIDs
-    const { makeSelfSignedCert } = await import('../../__tests__/helpers/test-cert.js');
-    const plainCert = await makeSelfSignedCert();
-    const { ctx, statusMock, sendMock } = makeContext({ certPem: plainCert });
-
-    const guard = new FederationAuthGuard(makeGrantsService());
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(401);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'unauthorized', message: expect.any(String) }),
-      }),
-    );
-  });
-
-  // ── 401: Missing subjectUserId OID ───────────────────────────────────────
-
-  it('returns 401 when the cert has grantId OID but is missing subjectUserId OID', async () => {
-    // Build a cert with only the grantId OID by importing cert generator internals
-    const { webcrypto } = await import('node:crypto');
-    const {
-      X509CertificateGenerator,
-      Extension,
-      KeyUsagesExtension,
-      KeyUsageFlags,
-      BasicConstraintsExtension,
-      cryptoProvider,
-    } = await import('@peculiar/x509');
-
-    cryptoProvider.set(webcrypto as unknown as Parameters<typeof cryptoProvider.set>[0]);
-
-    const alg = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' } as const;
-    const keys = await webcrypto.subtle.generateKey(alg, false, ['sign', 'verify']);
-    const now = new Date();
-    const tomorrow = new Date(now.getTime() + 86_400_000);
-
-    // Encode grantId only — missing subjectUserId extension
-    const utf8 = new TextEncoder().encode(GRANT_ID);
-    const encoded = new Uint8Array(2 + utf8.length);
-    encoded[0] = 0x0c;
-    encoded[1] = utf8.length;
-    encoded.set(utf8, 2);
-
-    const cert = await X509CertificateGenerator.createSelfSigned({
-      serialNumber: '01',
-      name: 'CN=partial-oid-test',
-      notBefore: now,
-      notAfter: tomorrow,
-      signingAlgorithm: alg,
-      keys,
-      extensions: [
-        new BasicConstraintsExtension(false),
-        new KeyUsagesExtension(KeyUsageFlags.digitalSignature),
-        new Extension('1.3.6.1.4.1.99999.1', false, encoded), // grantId only
-      ],
-    });
-
-    const { ctx, statusMock, sendMock } = makeContext({ certPem: cert.toString('pem') });
-
-    const guard = new FederationAuthGuard(makeGrantsService());
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(401);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'unauthorized', message: expect.any(String) }),
-      }),
-    );
-  });
-
-  // ── 403: Grant not found ─────────────────────────────────────────────────
-
-  it('returns 403 when the grantId from the cert does not exist in DB', async () => {
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi
-        .fn()
-        .mockRejectedValue(new NotFoundException(`Grant ${GRANT_ID} not found`)),
-    });
-
-    const { ctx, statusMock, sendMock } = makeContext({ certPem });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── 403: Grant in `pending` status ───────────────────────────────────────
-
-  it('returns 403 when the grant is in pending status', async () => {
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi.fn().mockResolvedValue(makeGrantWithPeer({ status: 'pending' })),
-    });
-
-    const { ctx, statusMock, sendMock } = makeContext({ certPem });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── 403: Grant in `revoked` status ───────────────────────────────────────
-
-  it('returns 403 when the grant is in revoked status', async () => {
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi
-        .fn()
-        .mockResolvedValue(makeGrantWithPeer({ status: 'revoked', revokedAt: new Date() })),
-    });
-
-    const { ctx, statusMock, sendMock } = makeContext({ certPem });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── 403: Grant in `expired` status ───────────────────────────────────────
-
-  it('returns 403 when the grant is in expired status', async () => {
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi.fn().mockResolvedValue(makeGrantWithPeer({ status: 'expired' })),
-    });
-
-    const { ctx, statusMock, sendMock } = makeContext({ certPem });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── 403: Cert serial mismatch ─────────────────────────────────────────────
-
-  it('returns 403 when the cert serial does not match the registered peer cert serial', async () => {
-    // Return a grant whose peer has a different stored serial
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi.fn().mockResolvedValue(
-        makeGrantWithPeer({
-          peer: {
-            id: PEER_ID,
-            commonName: 'test-peer',
-            displayName: 'Test Peer',
-            certPem: '',
-            certSerial: 'DEADBEEF', // different from CERT_SERIAL_HEX='01'
-            certNotAfter: new Date(Date.now() + 86_400_000),
-            clientKeyPem: null,
-            state: 'active',
-            endpointUrl: null,
-            lastSeenAt: null,
-            createdAt: new Date('2026-01-01T00:00:00Z'),
-            revokedAt: null,
-          },
-        }),
-      ),
-    });
-
-    // Context presents cert with serial '01' but DB has 'DEADBEEF'
-    const { ctx, statusMock, sendMock } = makeContext({ certPem, certSerialHex: '01' });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── 403: subjectUserId cert/DB mismatch (CRIT-1 regression test) ─────────
-
-  it('returns 403 when the cert subjectUserId does not match the DB grant subjectUserId', async () => {
-    // Build a cert that claims an attacker's subjectUserId
-    const attackerSubjectUserId = 'attacker-user-id';
-    const attackerCertPem = await makeMosaicIssuedCert({
-      grantId: GRANT_ID,
-      subjectUserId: attackerSubjectUserId,
-    });
-
-    // DB returns a grant with the legitimate USER_ID
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi.fn().mockResolvedValue(makeGrantWithPeer({ subjectUserId: USER_ID })),
-    });
-
-    // Cert presents attacker-user-id but DB has USER_ID — should be rejected
-    const { ctx, statusMock, sendMock } = makeContext({
-      certPem: attackerCertPem,
-      certSerialHex: CERT_SERIAL_HEX,
-    });
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(false);
-    expect(statusMock).toHaveBeenCalledWith(403);
-    expect(sendMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        error: expect.objectContaining({ code: 'forbidden', message: 'Federation access denied' }),
-      }),
-    );
-  });
-
-  // ── Happy path ────────────────────────────────────────────────────────────
-
-  it('returns true and attaches federationContext on happy path', async () => {
-    const grant = makeGrantWithPeer({
-      status: 'active',
-      peer: {
-        id: PEER_ID,
-        commonName: 'test-peer',
-        displayName: 'Test Peer',
-        certPem: '',
-        certSerial: CERT_SERIAL_HEX,
-        certNotAfter: new Date(Date.now() + 86_400_000),
-        clientKeyPem: null,
-        state: 'active',
-        endpointUrl: null,
-        lastSeenAt: null,
-        createdAt: new Date('2026-01-01T00:00:00Z'),
-        revokedAt: null,
-      },
-    });
-
-    const grantsService = makeGrantsService({
-      getGrantWithPeer: vi.fn().mockResolvedValue(grant),
-    });
-
-    // Build context manually to capture what gets set on request.federationContext
-    const b64 = certPem
-      .replace(/-----BEGIN CERTIFICATE-----/, '')
-      .replace(/-----END CERTIFICATE-----/, '')
-      .replace(/\s+/g, '');
-    const raw = Buffer.from(b64, 'base64');
-    const peerCert = { raw, serialNumber: CERT_SERIAL_HEX };
-
-    const sendMock = vi.fn().mockReturnValue(undefined);
-    const headerMock = vi.fn().mockReturnValue({ send: sendMock });
-    const statusMock = vi.fn().mockReturnValue({ header: headerMock });
-
-    const request: Record<string, unknown> = {
-      raw: {
-        socket: { getPeerCertificate: vi.fn().mockReturnValue(peerCert) },
-      },
-    };
-
-    const reply = { status: statusMock };
-
-    const ctx = {
-      switchToHttp: () => ({
-        getRequest: () => request,
-        getResponse: () => reply,
-      }),
-    } as unknown as ExecutionContext;
-
-    const guard = new FederationAuthGuard(grantsService);
-    const result = await guard.canActivate(ctx);
-
-    expect(result).toBe(true);
-    expect(statusMock).not.toHaveBeenCalled();
-
-    // Verify the context was attached correctly
-    expect(request['federationContext']).toEqual({
-      grantId: GRANT_ID,
-      subjectUserId: USER_ID,
-      peerId: PEER_ID,
-      scope: VALID_SCOPE,
-    });
-  });
-});
--- a/apps/gateway/src/federation/server/tests/scope.service.spec.ts
+++ b/apps/gateway/src/federation/server/tests/scope.service.spec.ts
@@ -1,324 +0,0 @@
-/**
- * Unit tests for FederationScopeService (FED-M3-04).
- *
- * Coverage:
- *  - resource allowlist deny
- *  - excluded resource deny
- *  - invalid scope deny
- *  - invalid requested limit deny
- *  - native RBAC deny as subjectUserId
- *  - scope/native filter intersection for personal and team rows
- *  - native RBAC personal deny wins over scope include_personal allow/default
- *  - max_rows_per_query cap
- */
-
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationScopeService, type FederationNativeRbacEvaluator } from '../scope.service.js';
-import type { FederationContext } from '../federation-context.js';
-
-const GRANT_ID = 'grant-1';
-const PEER_ID = 'peer-1';
-const SUBJECT_USER_ID = 'user-1';
-
-function makeContext(scope: Record<string, unknown>): FederationContext {
-  return {
-    grantId: GRANT_ID,
-    peerId: PEER_ID,
-    subjectUserId: SUBJECT_USER_ID,
-    scope,
-  };
-}
-
-function makeNativeRbac(
-  result: Awaited<ReturnType<FederationNativeRbacEvaluator['evaluateReadAccess']>>,
-): FederationNativeRbacEvaluator {
-  return {
-    evaluateReadAccess: vi.fn().mockResolvedValue(result),
-  };
-}
-
-describe('FederationScopeService', () => {
-  let service: FederationScopeService;
-
-  beforeEach(() => {
-    service = new FederationScopeService();
-  });
-
-  it('allows a granted resource and returns a capped query filter', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({
-        resources: ['tasks'],
-        filters: { tasks: { include_teams: ['team-1', 'team-3'], include_personal: true } },
-        max_rows_per_query: 50,
-      }),
-      resource: 'tasks',
-      requestedLimit: 500,
-      nativeRbac,
-    });
-
-    expect(result).toEqual({
-      allowed: true,
-      filter: {
-        resource: 'tasks',
-        subjectUserId: SUBJECT_USER_ID,
-        includePersonal: true,
-        teamIds: ['team-1'],
-        limit: 50,
-        maxRowsPerQuery: 50,
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).toHaveBeenCalledWith({
-      grantId: GRANT_ID,
-      peerId: PEER_ID,
-      subjectUserId: SUBJECT_USER_ID,
-      resource: 'tasks',
-    });
-  });
-
-  it('defaults absent resource filters to native RBAC personal and team visibility', async () => {
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: ['notes'], max_rows_per_query: 100 }),
-      resource: 'notes',
-      nativeRbac: makeNativeRbac({
-        allowed: true,
-        access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-      }),
-    });
-
-    expect(result).toMatchObject({
-      allowed: true,
-      filter: {
-        includePersonal: true,
-        teamIds: ['team-1', 'team-2'],
-        limit: 100,
-      },
-    });
-  });
-
-  it('honors include_personal false even when native RBAC allows personal rows', async () => {
-    const result = await service.evaluateAccess({
-      context: makeContext({
-        resources: ['memory'],
-        filters: { memory: { include_personal: false } },
-        max_rows_per_query: 25,
-      }),
-      resource: 'memory',
-      nativeRbac: makeNativeRbac({
-        allowed: true,
-        access: { includePersonal: true, teamIds: [] },
-      }),
-    });
-
-    expect(result).toMatchObject({
-      allowed: true,
-      filter: {
-        includePersonal: false,
-        teamIds: [],
-      },
-    });
-  });
-
-  it('does not leak personal rows when scope allows personal but native RBAC denies personal', async () => {
-    const result = await service.evaluateAccess({
-      context: makeContext({
-        resources: ['tasks'],
-        filters: { tasks: { include_personal: true } },
-        max_rows_per_query: 25,
-      }),
-      resource: 'tasks',
-      nativeRbac: makeNativeRbac({
-        allowed: true,
-        access: { includePersonal: false, teamIds: ['team-1'] },
-      }),
-    });
-
-    expect(result).toMatchObject({
-      allowed: true,
-      filter: {
-        includePersonal: false,
-        teamIds: ['team-1'],
-      },
-    });
-  });
-
-  it('does not widen native RBAC when scope includes teams the user cannot access', async () => {
-    const result = await service.evaluateAccess({
-      context: makeContext({
-        resources: ['tasks'],
-        filters: { tasks: { include_teams: ['team-2'], include_personal: false } },
-        max_rows_per_query: 25,
-      }),
-      resource: 'tasks',
-      nativeRbac: makeNativeRbac({
-        allowed: true,
-        access: { includePersonal: true, teamIds: ['team-1'] },
-      }),
-    });
-
-    expect(result).toMatchObject({
-      allowed: true,
-      filter: {
-        includePersonal: false,
-        teamIds: [],
-      },
-    });
-  });
-
-  it('denies invalid grant scope before RBAC evaluation', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: [], max_rows_per_query: 100 }),
-      resource: 'tasks',
-      nativeRbac,
-    });
-
-    expect(result).toMatchObject({
-      allowed: false,
-      deny: {
-        code: 'invalid_scope',
-        stage: 'scope_parse',
-        statusCode: 400,
-        grantId: GRANT_ID,
-        subjectUserId: SUBJECT_USER_ID,
-        resource: 'tasks',
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).not.toHaveBeenCalled();
-  });
-
-  it('denies unsupported resource names before RBAC evaluation', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: ['tasks'], max_rows_per_query: 100 }),
-      resource: 'unknown_resource',
-      nativeRbac,
-    });
-
-    expect(result).toMatchObject({
-      allowed: false,
-      deny: {
-        code: 'invalid_resource',
-        stage: 'resource_allowlist',
-        statusCode: 403,
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).not.toHaveBeenCalled();
-  });
-
-  it('denies resources explicitly present in excluded_resources before allowlist miss', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({
-        resources: ['tasks'],
-        excluded_resources: ['credentials'],
-        max_rows_per_query: 100,
-      }),
-      resource: 'credentials',
-      nativeRbac,
-    });
-
-    expect(result).toMatchObject({
-      allowed: false,
-      deny: {
-        code: 'resource_excluded',
-        stage: 'resource_exclusion',
-        statusCode: 403,
-        resource: 'credentials',
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).not.toHaveBeenCalled();
-  });
-
-  it('denies supported resources that are not granted by scope', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: ['tasks'], max_rows_per_query: 100 }),
-      resource: 'notes',
-      nativeRbac,
-    });
-
-    expect(result).toMatchObject({
-      allowed: false,
-      deny: {
-        code: 'resource_not_granted',
-        stage: 'resource_allowlist',
-        statusCode: 403,
-        resource: 'notes',
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).not.toHaveBeenCalled();
-  });
-
-  it('denies invalid requested row limits before RBAC evaluation', async () => {
-    const nativeRbac = makeNativeRbac({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: ['tasks'], max_rows_per_query: 100 }),
-      resource: 'tasks',
-      requestedLimit: 0,
-      nativeRbac,
-    });
-
-    expect(result).toMatchObject({
-      allowed: false,
-      deny: {
-        code: 'invalid_limit',
-        stage: 'row_cap',
-        statusCode: 400,
-        details: { requestedLimit: 0 },
-      },
-    });
-    expect(nativeRbac.evaluateReadAccess).not.toHaveBeenCalled();
-  });
-
-  it('denies when native RBAC rejects subjectUserId access to the resource', async () => {
-    const result = await service.evaluateAccess({
-      context: makeContext({ resources: ['tasks'], max_rows_per_query: 100 }),
-      resource: 'tasks',
-      nativeRbac: makeNativeRbac({
-        allowed: false,
-        reason: 'read:tasks denied',
-        details: { permission: 'tasks:read' },
-      }),
-    });
-
-    expect(result).toEqual({
-      allowed: false,
-      deny: {
-        code: 'native_rbac_denied',
-        stage: 'native_rbac',
-        statusCode: 403,
-        message: 'read:tasks denied',
-        grantId: GRANT_ID,
-        peerId: PEER_ID,
-        subjectUserId: SUBJECT_USER_ID,
-        resource: 'tasks',
-        details: { permission: 'tasks:read' },
-      },
-    });
-  });
-});
--- a/apps/gateway/src/federation/server/federation-auth.guard.ts
+++ b/apps/gateway/src/federation/server/federation-auth.guard.ts
@@ -1,212 +0,0 @@
-/**
- * FederationAuthGuard — NestJS CanActivate guard for inbound federation requests.
- *
- * Validates the mTLS client certificate presented by a peer gateway, extracts
- * custom OIDs to identify the grant + subject user, loads the grant from DB,
- * asserts it is active, and verifies the cert serial against the registered peer
- * cert serial as a defense-in-depth measure.
- *
- * On success, attaches `request.federationContext` for downstream verb controllers.
- * On failure, responds with the federation wire-format error envelope (not raw
- * NestJS exception JSON) to match the federation protocol contract.
- *
- * ## Cert-serial check decision
- * The guard validates that the inbound client cert's serial number matches the
- * `certSerial` stored on the associated `federation_peers` row. This is a
- * defense-in-depth measure: even if the mTLS handshake is compromised at the
- * transport layer (e.g. misconfigured TLS terminator that forwards arbitrary
- * client certs), an attacker cannot replay a cert with a different serial than
- * what was registered during enrollment. This check is NOT loosened because:
- *  1. It is O(1) — no additional DB round-trip (peerId is on the grant row,
- *     so we join to federationPeers in the same query).
- *  2. Cert renewal MUST update the stored serial — enforced by M6 scheduler.
- *  3. The OID-only path (without serial check) would allow any cert from the
- *     same CA bearing the same grantId OID to succeed after cert compromise.
- *
- * ## FastifyRequest typing path
- * NestJS + Fastify wraps the raw Node.js IncomingMessage in a FastifyRequest.
- * The underlying TLS socket is accessed via `request.raw.socket`, which is a
- * `tls.TLSSocket` when the server is listening on HTTPS. In development/test
- * the gateway may run over plain HTTP, in which case `getPeerCertificate` is
- * not available. The guard safely handles both cases by checking for the
- * method's existence before calling it.
- *
- * Note: The guard reads the peer certificate from the *already-completed*
- * TLS handshake via `socket.getPeerCertificate(detailed=true)`. This relies
- * on the server being configured with `requestCert: true` at the TLS level
- * so Fastify/Node.js requests the client cert during the handshake.
- * The guard does NOT verify the cert chain itself — that is handled by the
- * TLS layer (Node.js `rejectUnauthorized: true` with the CA cert pinned).
- */
-
-import {
-  type CanActivate,
-  type ExecutionContext,
-  Inject,
-  Injectable,
-  Logger,
-} from '@nestjs/common';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-import * as tls from 'node:tls';
-import { X509Certificate } from '@peculiar/x509';
-import { FederationForbiddenError, FederationUnauthorizedError } from '@mosaicstack/types';
-import { extractMosaicOids } from '../oid.util.js';
-import { GrantsService } from '../grants.service.js';
-import type { FederationContext } from './federation-context.js';
-import './federation-context.js'; // side-effect import: applies FastifyRequest module augmentation
-
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Send a federation wire-format error response directly on the Fastify reply.
- * Returns false — callers return this value from canActivate.
- */
-function sendFederationError(
-  reply: FastifyReply,
-  error: FederationUnauthorizedError | FederationForbiddenError,
-): boolean {
-  const statusCode = error.code === 'unauthorized' ? 401 : 403;
-  void reply.status(statusCode).header('content-type', 'application/json').send(error.toEnvelope());
-  return false;
-}
-
-// ---------------------------------------------------------------------------
-// Guard
-// ---------------------------------------------------------------------------
-
-@Injectable()
-export class FederationAuthGuard implements CanActivate {
-  private readonly logger = new Logger(FederationAuthGuard.name);
-
-  constructor(@Inject(GrantsService) private readonly grantsService: GrantsService) {}
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    const http = context.switchToHttp();
-    const request = http.getRequest<FastifyRequest>();
-    const reply = http.getResponse<FastifyReply>();
-
-    // ── Step 1: Extract peer certificate from TLS socket ────────────────────
-    const rawSocket = request.raw.socket;
-
-    // Check TLS socket: getPeerCertificate is only available on TLS connections.
-    if (
-      !rawSocket ||
-      typeof (rawSocket as Partial<tls.TLSSocket>).getPeerCertificate !== 'function'
-    ) {
-      this.logger.warn('No TLS socket — client cert unavailable (non-mTLS connection)');
-      return sendFederationError(
-        reply,
-        new FederationUnauthorizedError('Client certificate required'),
-      );
-    }
-
-    const tlsSocket = rawSocket as tls.TLSSocket;
-    const peerCert = tlsSocket.getPeerCertificate(true);
-
-    // Node.js returns an object with empty string fields when no cert was presented.
-    if (!peerCert || !peerCert.raw) {
-      this.logger.warn('Peer certificate not presented (mTLS handshake did not supply cert)');
-      return sendFederationError(
-        reply,
-        new FederationUnauthorizedError('Client certificate required'),
-      );
-    }
-
-    // ── Step 2: Parse the DER-encoded certificate via @peculiar/x509 ────────
-    let cert: X509Certificate;
-    try {
-      // peerCert.raw is a Buffer containing the DER-encoded cert
-      cert = new X509Certificate(peerCert.raw);
-    } catch (err) {
-      this.logger.warn(
-        `Failed to parse peer certificate: ${err instanceof Error ? err.message : String(err)}`,
-      );
-      return sendFederationError(
-        reply,
-        new FederationUnauthorizedError('Client certificate could not be parsed'),
-      );
-    }
-
-    // ── Step 3: Extract Mosaic custom OIDs ──────────────────────────────────
-    const oidResult = extractMosaicOids(cert);
-
-    if (!oidResult.ok) {
-      const message =
-        oidResult.error === 'MISSING_GRANT_ID'
-          ? 'Client certificate is missing required OID: mosaic_grant_id (1.3.6.1.4.1.99999.1)'
-          : oidResult.error === 'MISSING_SUBJECT_USER_ID'
-            ? 'Client certificate is missing required OID: mosaic_subject_user_id (1.3.6.1.4.1.99999.2)'
-            : `Client certificate OID extraction failed: ${oidResult.detail ?? 'unknown error'}`;
-      this.logger.warn(`OID extraction failure [${oidResult.error}]: ${message}`);
-      return sendFederationError(reply, new FederationUnauthorizedError(message));
-    }
-
-    const { grantId, subjectUserId } = oidResult.value;
-
-    // ── Step 4: Load grant from DB ───────────────────────────────────────────
-    let grant: Awaited<ReturnType<GrantsService['getGrantWithPeer']>>;
-    try {
-      grant = await this.grantsService.getGrantWithPeer(grantId);
-    } catch {
-      // getGrantWithPeer throws NotFoundException when not found
-      this.logger.warn(`Grant not found: ${grantId}`);
-      return sendFederationError(reply, new FederationForbiddenError('Federation access denied'));
-    }
-
-    // ── Step 5: Assert grant is active ──────────────────────────────────────
-    if (grant.status !== 'active') {
-      this.logger.warn(`Grant ${grantId} is not active — status=${grant.status}`);
-      return sendFederationError(reply, new FederationForbiddenError('Federation access denied'));
-    }
-
-    // ── Step 5b: Validate cert-extracted subjectUserId against DB (CRIT-1) ──
-    // The cert claim is untrusted input; the DB row is authoritative.
-    if (subjectUserId !== grant.subjectUserId) {
-      this.logger.warn(`subjectUserId mismatch for grant ${grantId}`);
-      return sendFederationError(reply, new FederationForbiddenError('Federation access denied'));
-    }
-
-    // ── Step 6: Defense-in-depth — cert serial must match registered peer ───
-    // The serial number from Node.js TLS is upper-case hex without colons.
-    // The @peculiar/x509 serialNumber is decimal. We compare using the native
-    // Node.js crypto cert serial which is uppercase hex, matching DB storage.
-    // Both are derived from the peerCert.serialNumber Node.js provides.
-    const inboundSerial: string = peerCert.serialNumber ?? '';
-
-    if (!grant.peer.certSerial) {
-      // Peer row exists but has no stored serial — something is wrong with enrollment
-      this.logger.error(`Peer ${grant.peerId} has no stored certSerial — enrollment incomplete`);
-      return sendFederationError(reply, new FederationForbiddenError('Federation access denied'));
-    }
-
-    // Normalize both to uppercase for comparison (Node.js serialNumber is
-    // already uppercase hex; DB value was stored from extractSerial() which
-    // returns crypto.X509Certificate.serialNumber — also uppercase hex).
-    if (inboundSerial.toUpperCase() !== grant.peer.certSerial.toUpperCase()) {
-      this.logger.warn(
-        `Cert serial mismatch for grant ${grantId}: ` +
-          `inbound=${inboundSerial} registered=${grant.peer.certSerial}`,
-      );
-      return sendFederationError(reply, new FederationForbiddenError('Federation access denied'));
-    }
-
-    // ── Step 7: Attach FederationContext to request ──────────────────────────
-    // Use grant.subjectUserId from DB (authoritative) — not the cert-extracted value.
-    const federationContext: FederationContext = {
-      grantId,
-      subjectUserId: grant.subjectUserId,
-      peerId: grant.peerId,
-      scope: grant.scope as Record<string, unknown>,
-    };
-
-    request.federationContext = federationContext;
-
-    this.logger.debug(
-      `Federation auth OK — grantId=${grantId} peerId=${grant.peerId} subjectUserId=${grant.subjectUserId}`,
-    );
-
-    return true;
-  }
-}
--- a/apps/gateway/src/federation/server/federation-context.ts
+++ b/apps/gateway/src/federation/server/federation-context.ts
@@ -1,39 +0,0 @@
-/**
- * FederationContext — attached to inbound federation requests after successful
- * mTLS + grant validation by FederationAuthGuard.
- *
- * Downstream verb controllers access this via `request.federationContext`.
- */
-
-/**
- * Augment FastifyRequest so TypeScript knows about the federation context
- * property that FederationAuthGuard attaches on success.
- */
-declare module 'fastify' {
-  interface FastifyRequest {
-    federationContext?: FederationContext;
-  }
-}
-
-/**
- * Typed context object attached to the request by FederationAuthGuard.
- * Carries all data extracted from the mTLS cert + grant DB row needed
- * by downstream federation verb handlers.
- */
-export interface FederationContext {
-  /** The federation grant ID extracted from OID 1.3.6.1.4.1.99999.1 */
-  grantId: string;
-
-  /** The local subject user whose data is accessible under this grant */
-  subjectUserId: string;
-
-  /** The peer gateway ID (from the grant's peerId FK) */
-  peerId: string;
-
-  /**
-   * Grant scope — determines which resources the peer may query.
-   * Typed as Record<string, unknown> because the full scope schema lives in
-   * scope-schema.ts; downstream handlers should narrow via parseFederationScope.
-   */
-  scope: Record<string, unknown>;
-}
--- a/apps/gateway/src/federation/server/index.ts
+++ b/apps/gateway/src/federation/server/index.ts
@@ -1,31 +0,0 @@
-/**
- * Federation server-side barrel — inbound request handling.
- *
- * Exports the mTLS auth guard and the FederationContext interface
- * for use by verb controllers (M3-05/06/07).
- *
- * Usage:
- *   import { FederationAuthGuard } from './server/index.js';
- *   @UseGuards(FederationAuthGuard)
- */
-
-export { FederationAuthGuard } from './federation-auth.guard.js';
-export { FederationScopeService } from './scope.service.js';
-export type { FederationContext } from './federation-context.js';
-export type {
-  FederationNativeRbacAccess,
-  FederationNativeRbacAllowedResult,
-  FederationNativeRbacDeniedResult,
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeAllowedResult,
-  FederationScopeDeniedResult,
-  FederationScopeDenyCode,
-  FederationScopeDenyDetails,
-  FederationScopeDenyReason,
-  FederationScopeDenyStage,
-  FederationScopeEvaluationInput,
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from './scope.service.js';
--- a/apps/gateway/src/federation/server/scope.service.ts
+++ b/apps/gateway/src/federation/server/scope.service.ts
@@ -1,272 +0,0 @@
-/**
- * FederationScopeService — M3 server-side scope enforcement pipeline.
- *
- * Pure trust-boundary service: it validates the grant scope, asks an injected
- * native RBAC evaluator what the subject user can read locally, intersects that
- * answer with the federation scope filters, and returns a query filter for the
- * verb controllers. The service performs no DB calls directly.
- */
-
-import { Injectable } from '@nestjs/common';
-import {
-  FEDERATION_RESOURCE_VALUES,
-  type FederationResource,
-  FederationScopeError,
-  parseFederationScope,
-} from '../scope-schema.js';
-import type { FederationContext } from './federation-context.js';
-
-const federationResourceSet: ReadonlySet<string> = new Set<string>(FEDERATION_RESOURCE_VALUES);
-
-export type FederationScopeDenyStage =
-  | 'scope_parse'
-  | 'resource_allowlist'
-  | 'resource_exclusion'
-  | 'native_rbac'
-  | 'row_cap';
-
-export type FederationScopeDenyCode =
-  | 'invalid_scope'
-  | 'invalid_resource'
-  | 'resource_not_granted'
-  | 'resource_excluded'
-  | 'native_rbac_denied'
-  | 'invalid_limit';
-
-export type FederationScopeDenyStatus = 400 | 403;
-
-export interface FederationScopeDenyDetails {
-  readonly [key: string]: string | number | boolean | readonly string[];
-}
-
-export interface FederationScopeDenyReason {
-  readonly code: FederationScopeDenyCode;
-  readonly stage: FederationScopeDenyStage;
-  readonly statusCode: FederationScopeDenyStatus;
-  readonly message: string;
-  readonly grantId: string;
-  readonly peerId: string;
-  readonly subjectUserId: string;
-  readonly resource: string;
-  readonly details?: FederationScopeDenyDetails;
-}
-
-export interface FederationNativeRbacRequest {
-  readonly grantId: string;
-  readonly peerId: string;
-  readonly subjectUserId: string;
-  readonly resource: FederationResource;
-}
-
-export interface FederationNativeRbacAccess {
-  /** Whether this user may read personal rows for this resource. */
-  readonly includePersonal: boolean;
-
-  /** Team IDs this user may read for this resource under native RBAC. */
-  readonly teamIds: readonly string[];
-}
-
-export interface FederationNativeRbacAllowedResult {
-  readonly allowed: true;
-  readonly access: FederationNativeRbacAccess;
-}
-
-export interface FederationNativeRbacDeniedResult {
-  readonly allowed: false;
-  readonly reason?: string;
-  readonly details?: FederationScopeDenyDetails;
-}
-
-export type FederationNativeRbacResult =
-  | FederationNativeRbacAllowedResult
-  | FederationNativeRbacDeniedResult;
-
-export interface FederationNativeRbacEvaluator {
-  evaluateReadAccess(request: FederationNativeRbacRequest): Promise<FederationNativeRbacResult>;
-}
-
-export interface FederationScopeEvaluationInput {
-  readonly context: FederationContext;
-  readonly resource: string;
-  readonly requestedLimit?: number;
-  readonly nativeRbac: FederationNativeRbacEvaluator;
-}
-
-export interface FederationScopeQueryFilter {
-  readonly resource: FederationResource;
-  readonly subjectUserId: string;
-  readonly includePersonal: boolean;
-  readonly teamIds: readonly string[];
-  readonly limit: number;
-  readonly maxRowsPerQuery: number;
-}
-
-export interface FederationScopeAllowedResult {
-  readonly allowed: true;
-  readonly filter: FederationScopeQueryFilter;
-}
-
-export interface FederationScopeDeniedResult {
-  readonly allowed: false;
-  readonly deny: FederationScopeDenyReason;
-}
-
-export type FederationScopeEvaluationResult =
-  | FederationScopeAllowedResult
-  | FederationScopeDeniedResult;
-
-function isFederationResource(resource: string): resource is FederationResource {
-  return federationResourceSet.has(resource);
-}
-
-function uniqueStrings(values: readonly string[]): readonly string[] {
-  return Array.from(new Set<string>(values));
-}
-
-function intersectTeamIds(
-  nativeTeamIds: readonly string[],
-  scopedTeamIds: readonly string[] | undefined,
-): readonly string[] {
-  const uniqueNativeTeamIds = uniqueStrings(nativeTeamIds);
-
-  if (scopedTeamIds === undefined) {
-    return uniqueNativeTeamIds;
-  }
-
-  const nativeSet = new Set<string>(uniqueNativeTeamIds);
-  return uniqueStrings(scopedTeamIds).filter((teamId: string): boolean => nativeSet.has(teamId));
-}
-
-function makeDenyReason(params: {
-  readonly code: FederationScopeDenyCode;
-  readonly stage: FederationScopeDenyStage;
-  readonly statusCode?: FederationScopeDenyStatus;
-  readonly message: string;
-  readonly context: FederationContext;
-  readonly resource: string;
-  readonly details?: FederationScopeDenyDetails;
-}): FederationScopeDeniedResult {
-  return {
-    allowed: false,
-    deny: {
-      code: params.code,
-      stage: params.stage,
-      statusCode: params.statusCode ?? 403,
-      message: params.message,
-      grantId: params.context.grantId,
-      peerId: params.context.peerId,
-      subjectUserId: params.context.subjectUserId,
-      resource: params.resource,
-      ...(params.details !== undefined ? { details: params.details } : {}),
-    },
-  };
-}
-
-@Injectable()
-export class FederationScopeService {
-  async evaluateAccess(
-    input: FederationScopeEvaluationInput,
-  ): Promise<FederationScopeEvaluationResult> {
-    const { context, resource, requestedLimit, nativeRbac } = input;
-
-    let scope: ReturnType<typeof parseFederationScope>;
-    try {
-      scope = parseFederationScope(context.scope);
-    } catch (error: unknown) {
-      const message =
-        error instanceof FederationScopeError
-          ? 'Federation grant scope is invalid'
-          : 'Federation grant scope could not be parsed';
-      const details = error instanceof Error ? { reason: error.message } : undefined;
-      return makeDenyReason({
-        code: 'invalid_scope',
-        stage: 'scope_parse',
-        statusCode: 400,
-        message,
-        context,
-        resource,
-        ...(details !== undefined ? { details } : {}),
-      });
-    }
-
-    if (!isFederationResource(resource)) {
-      return makeDenyReason({
-        code: 'invalid_resource',
-        stage: 'resource_allowlist',
-        message: 'Requested federation resource is not supported',
-        context,
-        resource,
-        details: { supportedResources: FEDERATION_RESOURCE_VALUES },
-      });
-    }
-
-    if (scope.excluded_resources.includes(resource)) {
-      return makeDenyReason({
-        code: 'resource_excluded',
-        stage: 'resource_exclusion',
-        message: 'Requested federation resource is explicitly excluded by grant scope',
-        context,
-        resource,
-      });
-    }
-
-    if (!scope.resources.includes(resource)) {
-      return makeDenyReason({
-        code: 'resource_not_granted',
-        stage: 'resource_allowlist',
-        message: 'Requested federation resource is not granted by scope',
-        context,
-        resource,
-        details: { grantedResources: scope.resources },
-      });
-    }
-
-    if (requestedLimit !== undefined && (!Number.isInteger(requestedLimit) || requestedLimit < 1)) {
-      return makeDenyReason({
-        code: 'invalid_limit',
-        stage: 'row_cap',
-        statusCode: 400,
-        message: 'Requested row limit must be a positive integer',
-        context,
-        resource,
-        details: { requestedLimit },
-      });
-    }
-
-    const nativeResult = await nativeRbac.evaluateReadAccess({
-      grantId: context.grantId,
-      peerId: context.peerId,
-      subjectUserId: context.subjectUserId,
-      resource,
-    });
-
-    if (!nativeResult.allowed) {
-      return makeDenyReason({
-        code: 'native_rbac_denied',
-        stage: 'native_rbac',
-        message: nativeResult.reason ?? 'Subject user is not allowed to read this resource',
-        context,
-        resource,
-        ...(nativeResult.details !== undefined ? { details: nativeResult.details } : {}),
-      });
-    }
-
-    const scopeFilter = scope.filters?.[resource];
-    const includePersonal =
-      Boolean(scopeFilter?.include_personal ?? true) && nativeResult.access.includePersonal;
-    const teamIds = intersectTeamIds(nativeResult.access.teamIds, scopeFilter?.include_teams);
-    const limit = Math.min(requestedLimit ?? scope.max_rows_per_query, scope.max_rows_per_query);
-
-    return {
-      allowed: true,
-      filter: {
-        resource,
-        subjectUserId: context.subjectUserId,
-        includePersonal,
-        teamIds,
-        limit,
-        maxRowsPerQuery: scope.max_rows_per_query,
-      },
-    };
-  }
-}
--- a/apps/gateway/src/federation/server/verbs/tests/capabilities.controller.spec.ts
+++ b/apps/gateway/src/federation/server/verbs/tests/capabilities.controller.spec.ts
@@ -1,88 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import { describe, expect, it } from 'vitest';
-import type { FastifyRequest } from 'fastify';
-import { FederationCapabilitiesResponseSchema, FEDERATION_VERBS } from '@mosaicstack/types';
-import { FederationScopeError } from '../../../scope-schema.js';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import { CapabilitiesController } from '../capabilities.controller.js';
-
-const VALID_SCOPE = {
-  resources: ['tasks', 'notes'],
-  excluded_resources: ['credentials'],
-  max_rows_per_query: 250,
-} as const;
-
-const DEFAULTED_SCOPE = {
-  resources: ['memory'],
-  max_rows_per_query: 10,
-} as const;
-
-function makeRequest(scope: Record<string, unknown>): FastifyRequest {
-  return {
-    federationContext: {
-      grantId: 'grant-1',
-      peerId: 'peer-1',
-      subjectUserId: 'user-1',
-      scope,
-    },
-  } as FastifyRequest;
-}
-
-describe('CapabilitiesController', () => {
-  it('declares GET /api/federation/v1/capabilities', () => {
-    expect(Reflect.getMetadata('path', CapabilitiesController)).toBe(
-      'api/federation/v1/capabilities',
-    );
-    expect(Reflect.getMetadata('path', CapabilitiesController.prototype.getCapabilities)).toBe('/');
-    expect(Reflect.getMetadata('method', CapabilitiesController.prototype.getCapabilities)).toBe(
-      RequestMethod.GET,
-    );
-  });
-
-  it('is protected only by FederationAuthGuard', () => {
-    const guards = Reflect.getMetadata('__guards__', CapabilitiesController) as unknown[];
-
-    expect(guards).toEqual([FederationAuthGuard]);
-  });
-
-  it('returns resources, excluded resources, max rows, and M3 supported verbs from the active grant scope', () => {
-    const controller = new CapabilitiesController();
-
-    const response = controller.getCapabilities(makeRequest(VALID_SCOPE));
-
-    expect(response).toEqual({
-      resources: ['tasks', 'notes'],
-      excluded_resources: ['credentials'],
-      max_rows_per_query: 250,
-      supported_verbs: [...FEDERATION_VERBS],
-    });
-    expect(FederationCapabilitiesResponseSchema.safeParse(response).success).toBe(true);
-  });
-
-  it('applies scope defaults without RBAC or resource filtering', () => {
-    const controller = new CapabilitiesController();
-
-    const response = controller.getCapabilities(makeRequest(DEFAULTED_SCOPE));
-
-    expect(response).toEqual({
-      resources: ['memory'],
-      excluded_resources: [],
-      max_rows_per_query: 10,
-      supported_verbs: ['list', 'get', 'capabilities'],
-    });
-  });
-
-  it('rejects invalid scope state instead of returning an invalid capabilities contract', () => {
-    const controller = new CapabilitiesController();
-
-    expect(() =>
-      controller.getCapabilities(
-        makeRequest({
-          resources: [],
-          max_rows_per_query: 0,
-        }),
-      ),
-    ).toThrow(FederationScopeError);
-  });
-});
--- a/apps/gateway/src/federation/server/verbs/tests/get-query.service.spec.ts
+++ b/apps/gateway/src/federation/server/verbs/tests/get-query.service.spec.ts
@@ -1,348 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-  createPgliteDb,
-  missionTasks,
-  missions,
-  projects,
-  runPgliteMigrations,
-  teams,
-  users,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { FederationScopeQueryFilter } from '../../scope.service.js';
-import { FederationGetQueryService } from '../get-query.service.js';
-
-const CREDENTIAL_FILTER: FederationScopeQueryFilter = {
-  resource: 'credentials',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: [],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-const SUBJECT_USER_ID = 'fed-m3-06-subject';
-const OTHER_USER_ID = 'fed-m3-06-other';
-const TEAM_ID = '06000000-0000-4000-8000-000000000001';
-const UNAUTHORIZED_TEAM_ID = '06000000-0000-4000-8000-000000000002';
-const PERSONAL_PROJECT_ID = '06000000-0000-4000-8000-000000000101';
-const TEAM_PROJECT_ID = '06000000-0000-4000-8000-000000000102';
-const UNAUTHORIZED_PROJECT_ID = '06000000-0000-4000-8000-000000000103';
-const PERSONAL_MISSION_ID = '06000000-0000-4000-8000-000000000201';
-const TEAM_MISSION_ID = '06000000-0000-4000-8000-000000000202';
-const UNAUTHORIZED_MISSION_ID = '06000000-0000-4000-8000-000000000203';
-const SUBJECT_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000301';
-const OTHER_TEAM_NOTE_ID = '06000000-0000-4000-8000-000000000302';
-const SUBJECT_PERSONAL_NOTE_ID = '06000000-0000-4000-8000-000000000303';
-const SUBJECT_UNAUTHORIZED_NOTE_ID = '06000000-0000-4000-8000-000000000304';
-
-let dbHandle: DbHandle | undefined;
-
-function makeService() {
-  return new FederationGetQueryService({} as Db);
-}
-
-function makeDbService() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-  return new FederationGetQueryService(dbHandle.db);
-}
-
-async function seedNotesFixture() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-
-  await dbHandle.db.insert(users).values([
-    {
-      id: SUBJECT_USER_ID,
-      name: 'Federation Subject',
-      email: `${SUBJECT_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-    {
-      id: OTHER_USER_ID,
-      name: 'Federation Other',
-      email: `${OTHER_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-  ]);
-
-  await dbHandle.db.insert(teams).values([
-    {
-      id: TEAM_ID,
-      name: 'FED-M3-06 Team',
-      slug: 'fed-m3-06-team',
-      ownerId: SUBJECT_USER_ID,
-      managerId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_TEAM_ID,
-      name: 'FED-M3-06 Unauthorized Team',
-      slug: 'fed-m3-06-unauthorized-team',
-      ownerId: OTHER_USER_ID,
-      managerId: OTHER_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(projects).values([
-    {
-      id: PERSONAL_PROJECT_ID,
-      name: 'FED-M3-06 Personal Project',
-      ownerId: SUBJECT_USER_ID,
-      ownerType: 'user',
-    },
-    {
-      id: TEAM_PROJECT_ID,
-      name: 'FED-M3-06 Team Project',
-      teamId: TEAM_ID,
-      ownerType: 'team',
-    },
-    {
-      id: UNAUTHORIZED_PROJECT_ID,
-      name: 'FED-M3-06 Unauthorized Project',
-      teamId: UNAUTHORIZED_TEAM_ID,
-      ownerType: 'team',
-    },
-  ]);
-
-  await dbHandle.db.insert(missions).values([
-    {
-      id: PERSONAL_MISSION_ID,
-      name: 'FED-M3-06 Personal Mission',
-      projectId: PERSONAL_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: TEAM_MISSION_ID,
-      name: 'FED-M3-06 Team Mission',
-      projectId: TEAM_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_MISSION_ID,
-      name: 'FED-M3-06 Unauthorized Mission',
-      projectId: UNAUTHORIZED_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(missionTasks).values([
-    {
-      id: SUBJECT_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on team mission',
-      createdAt: new Date('2026-06-24T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T03:00:00.000Z'),
-    },
-    {
-      id: OTHER_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: OTHER_USER_ID,
-      notes: 'other user note on team mission',
-      createdAt: new Date('2026-06-24T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T02:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_PERSONAL_NOTE_ID,
-      missionId: PERSONAL_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on personal mission',
-      createdAt: new Date('2026-06-24T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T01:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      missionId: UNAUTHORIZED_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note outside grant-visible missions',
-      createdAt: new Date('2026-06-24T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T04:00:00.000Z'),
-    },
-  ]);
-}
-
-describe('FederationGetQueryService', () => {
-  beforeAll(async () => {
-    dbHandle = createPgliteDb(`memory://fed-m3-06-get-${Date.now()}`);
-    await runPgliteMigrations(dbHandle);
-    await seedNotesFixture();
-  });
-
-  afterAll(async () => {
-    await dbHandle?.close();
-    dbHandle = undefined;
-  });
-
-  it('denies sensitive resources in native RBAC for M3 get reads', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'credentials',
-      }),
-    ).resolves.toMatchObject({
-      allowed: false,
-      reason: 'credentials federation get access is not implemented in M3',
-    });
-  });
-
-  it('allows personal memory reads without requiring team lookup', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'memory',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-  });
-
-  it('uses subject team membership as the native RBAC upper bound for task and note reads', async () => {
-    const service = makeService();
-    const listSubjectTeamIds = vi.fn().mockResolvedValue(['team-1', 'team-2']);
-    (
-      service as unknown as {
-        listSubjectTeamIds: (subjectUserId: string) => Promise<string[]>;
-      }
-    ).listSubjectTeamIds = listSubjectTeamIds;
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'tasks',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: ['team-1', 'team-2'] },
-    });
-    expect(listSubjectTeamIds).toHaveBeenCalledWith('user-1');
-  });
-
-  it('does not query storage for sensitive get resources even if scope allowed them', async () => {
-    const service = makeService();
-
-    await expect(service.get({ filter: CREDENTIAL_FILTER, id: 'cred-1' })).resolves.toEqual({
-      status: 'denied',
-      reason: 'credentials federation get is not implemented',
-    });
-  });
-
-  it('fails closed for unsupported resources instead of returning undefined', async () => {
-    const service = makeService();
-
-    await expect(
-      service.get({
-        filter: {
-          ...CREDENTIAL_FILTER,
-          resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-        },
-        id: 'row-1',
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Unsupported federation get resource: unknown-resource',
-    });
-  });
-
-  it('does not leak another user mission task note through team-scoped get reads', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: OTHER_TEAM_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('does not return subject notes from missions outside the grant-visible project set', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: true,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-
-  it('returns a subject note only when subject ownership and authorized mission intersect', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_TEAM_NOTE_ID,
-      }),
-    ).resolves.toMatchObject({
-      status: 'found',
-      item: {
-        id: SUBJECT_TEAM_NOTE_ID,
-        missionId: TEAM_MISSION_ID,
-        content: 'subject note on team mission',
-      },
-    });
-  });
-
-  it('does not return subject personal notes when includePersonal is false', async () => {
-    const service = makeDbService();
-
-    await expect(
-      service.get({
-        filter: {
-          resource: 'notes',
-          subjectUserId: SUBJECT_USER_ID,
-          includePersonal: false,
-          teamIds: [TEAM_ID],
-          limit: 1,
-          maxRowsPerQuery: 10,
-        },
-        id: SUBJECT_PERSONAL_NOTE_ID,
-      }),
-    ).resolves.toEqual({
-      status: 'denied',
-      reason: 'Note is outside the federated scope',
-    });
-  });
-});
--- a/apps/gateway/src/federation/server/verbs/tests/get.controller.spec.ts
+++ b/apps/gateway/src/federation/server/verbs/tests/get.controller.spec.ts
@@ -1,207 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import type {
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from '../../scope.service.js';
-import { GetController } from '../get.controller.js';
-import type { FederationGetQueryResult } from '../get-query.service.js';
-
-const FEDERATION_CONTEXT = {
-  grantId: 'grant-1',
-  peerId: 'peer-1',
-  subjectUserId: 'user-1',
-  scope: { resources: ['tasks'], max_rows_per_query: 25 },
-};
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: ['team-1'],
-  limit: 1,
-  maxRowsPerQuery: 25,
-};
-
-function makeRequest(): FastifyRequest {
-  return { federationContext: FEDERATION_CONTEXT } as unknown as FastifyRequest;
-}
-
-function allowedScope(
-  filter: FederationScopeQueryFilter = TASK_FILTER,
-): FederationScopeEvaluationResult {
-  return { allowed: true, filter };
-}
-
-function makeController(opts?: {
-  scopeResult?: FederationScopeEvaluationResult;
-  queryResult?: FederationGetQueryResult;
-}) {
-  const scope = {
-    evaluateAccess: vi.fn().mockResolvedValue(opts?.scopeResult ?? allowedScope()),
-  };
-  const query = {
-    evaluateReadAccess: vi.fn(),
-    get: vi.fn().mockResolvedValue(
-      opts?.queryResult ?? {
-        status: 'found',
-        item: {
-          id: 'task-1',
-          title: 'Federated task',
-          createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        },
-      },
-    ),
-  };
-
-  return {
-    controller: new GetController(scope as never, query as never),
-    scope,
-    query,
-  };
-}
-
-describe('GetController', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('declares POST /api/federation/v1/get/:resource/:id protected only by FederationAuthGuard', () => {
-    expect(Reflect.getMetadata('path', GetController)).toBe('api/federation/v1/get');
-    expect(Reflect.getMetadata('path', GetController.prototype.get)).toBe(':resource/:id');
-    expect(Reflect.getMetadata('method', GetController.prototype.get)).toBe(RequestMethod.POST);
-    expect(Reflect.getMetadata('__guards__', GetController)).toEqual([FederationAuthGuard]);
-  });
-
-  it('runs AuthGuard context through ScopeService and returns one local-source tagged row', async () => {
-    const { controller, scope, query } = makeController();
-
-    const response = await controller.get('tasks', 'task-1', makeRequest());
-
-    expect(scope.evaluateAccess).toHaveBeenCalledWith({
-      context: FEDERATION_CONTEXT,
-      resource: 'tasks',
-      requestedLimit: 1,
-      nativeRbac: query,
-    });
-    expect(query.get).toHaveBeenCalledWith({ filter: TASK_FILTER, id: 'task-1' });
-    expect(response).toEqual({
-      item: {
-        id: 'task-1',
-        title: 'Federated task',
-        createdAt: new Date('2026-06-24T00:00:00.000Z'),
-        _source: 'local',
-      },
-    });
-  });
-
-  it('returns a federation error envelope when auth guard context is missing', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(
-      controller.get('tasks', 'task-1', {} as unknown as FastifyRequest),
-    ).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'unauthorized',
-          message: 'Federation context missing',
-        },
-      },
-      status: 401,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns a federation error envelope when scope evaluation denies access', async () => {
-    const { controller, query } = makeController({
-      scopeResult: {
-        allowed: false,
-        deny: {
-          code: 'resource_excluded',
-          stage: 'resource_exclusion',
-          statusCode: 403,
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-          grantId: 'grant-1',
-          peerId: 'peer-1',
-          subjectUserId: 'user-1',
-          resource: 'credentials',
-        },
-      },
-    });
-
-    await expect(controller.get('credentials', 'cred-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-        },
-      },
-      status: 403,
-    });
-    expect(query.get).not.toHaveBeenCalled();
-  });
-
-  it('returns 404 when the scoped query layer cannot find the resource id', async () => {
-    const { controller } = makeController({ queryResult: { status: 'not_found' } });
-
-    await expect(controller.get('tasks', 'missing-task', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'not_found' } },
-      status: 404,
-    });
-  });
-
-  it('returns 403 when the resource exists outside the RBAC/scope intersection', async () => {
-    const { controller } = makeController({
-      queryResult: { status: 'denied', reason: 'Task is outside the federated scope' },
-    });
-
-    await expect(controller.get('tasks', 'task-2', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Task is outside the federated scope',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('fails closed when the query layer denies an unsupported resource', async () => {
-    const unsupportedFilter: FederationScopeQueryFilter = {
-      ...TASK_FILTER,
-      resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-    };
-    const { controller } = makeController({
-      scopeResult: allowedScope(unsupportedFilter),
-      queryResult: {
-        status: 'denied',
-        reason: 'Unsupported federation get resource: unknown-resource',
-      },
-    });
-
-    await expect(controller.get('unknown-resource', 'row-1', makeRequest())).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Unsupported federation get resource: unknown-resource',
-        },
-      },
-      status: 403,
-    });
-  });
-
-  it('rejects empty ids before evaluating scope', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(controller.get('tasks', '   ', makeRequest())).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.get).not.toHaveBeenCalled();
-  });
-});
--- a/apps/gateway/src/federation/server/verbs/tests/list-query.service.spec.ts
+++ b/apps/gateway/src/federation/server/verbs/tests/list-query.service.spec.ts
@@ -1,428 +0,0 @@
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import {
-  createPgliteDb,
-  insights,
-  missionTasks,
-  missions,
-  preferences,
-  projects,
-  runPgliteMigrations,
-  teams,
-  users,
-  type Db,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { FederationScopeQueryFilter } from '../../scope.service.js';
-import { FederationListQueryService } from '../list-query.service.js';
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: [],
-  limit: 2,
-  maxRowsPerQuery: 2,
-};
-
-const SUBJECT_USER_ID = 'fed-m3-05-subject';
-const OTHER_USER_ID = 'fed-m3-05-other';
-const TEAM_ID = '05000000-0000-4000-8000-000000000001';
-const UNAUTHORIZED_TEAM_ID = '05000000-0000-4000-8000-000000000002';
-const PERSONAL_PROJECT_ID = '05000000-0000-4000-8000-000000000101';
-const TEAM_PROJECT_ID = '05000000-0000-4000-8000-000000000102';
-const UNAUTHORIZED_PROJECT_ID = '05000000-0000-4000-8000-000000000103';
-const PERSONAL_MISSION_ID = '05000000-0000-4000-8000-000000000201';
-const TEAM_MISSION_ID = '05000000-0000-4000-8000-000000000202';
-const UNAUTHORIZED_MISSION_ID = '05000000-0000-4000-8000-000000000203';
-const SUBJECT_TEAM_NOTE_ID = '05000000-0000-4000-8000-000000000301';
-const OTHER_TEAM_NOTE_ID = '05000000-0000-4000-8000-000000000302';
-const SUBJECT_PERSONAL_NOTE_ID = '05000000-0000-4000-8000-000000000303';
-const SUBJECT_UNAUTHORIZED_NOTE_ID = '05000000-0000-4000-8000-000000000304';
-const INSIGHT_ONE_ID = '05000000-0000-4000-8000-000000000401';
-const INSIGHT_TWO_ID = '05000000-0000-4000-8000-000000000402';
-const PREFERENCE_ONE_ID = '05000000-0000-4000-8000-000000000501';
-const PREFERENCE_TWO_ID = '05000000-0000-4000-8000-000000000502';
-
-let dbHandle: DbHandle | undefined;
-
-function makeService() {
-  return new FederationListQueryService({} as Db);
-}
-
-function makeDbService() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-  return new FederationListQueryService(dbHandle.db);
-}
-
-async function seedNotesFixture() {
-  if (!dbHandle) {
-    throw new Error('test DB not initialized');
-  }
-
-  await dbHandle.db.insert(users).values([
-    {
-      id: SUBJECT_USER_ID,
-      name: 'Federation Subject',
-      email: `${SUBJECT_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-    {
-      id: OTHER_USER_ID,
-      name: 'Federation Other',
-      email: `${OTHER_USER_ID}@example.test`,
-      emailVerified: false,
-    },
-  ]);
-
-  await dbHandle.db.insert(teams).values([
-    {
-      id: TEAM_ID,
-      name: 'FED-M3-05 Team',
-      slug: 'fed-m3-05-team',
-      ownerId: SUBJECT_USER_ID,
-      managerId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_TEAM_ID,
-      name: 'FED-M3-05 Unauthorized Team',
-      slug: 'fed-m3-05-unauthorized-team',
-      ownerId: OTHER_USER_ID,
-      managerId: OTHER_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(projects).values([
-    {
-      id: PERSONAL_PROJECT_ID,
-      name: 'FED-M3-05 Personal Project',
-      ownerId: SUBJECT_USER_ID,
-      ownerType: 'user',
-    },
-    {
-      id: TEAM_PROJECT_ID,
-      name: 'FED-M3-05 Team Project',
-      teamId: TEAM_ID,
-      ownerType: 'team',
-    },
-    {
-      id: UNAUTHORIZED_PROJECT_ID,
-      name: 'FED-M3-05 Unauthorized Project',
-      teamId: UNAUTHORIZED_TEAM_ID,
-      ownerType: 'team',
-    },
-  ]);
-
-  await dbHandle.db.insert(missions).values([
-    {
-      id: PERSONAL_MISSION_ID,
-      name: 'FED-M3-05 Personal Mission',
-      projectId: PERSONAL_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: TEAM_MISSION_ID,
-      name: 'FED-M3-05 Team Mission',
-      projectId: TEAM_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-    {
-      id: UNAUTHORIZED_MISSION_ID,
-      name: 'FED-M3-05 Unauthorized Mission',
-      projectId: UNAUTHORIZED_PROJECT_ID,
-      userId: SUBJECT_USER_ID,
-    },
-  ]);
-
-  await dbHandle.db.insert(missionTasks).values([
-    {
-      id: SUBJECT_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on team mission',
-      createdAt: new Date('2026-06-24T03:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T03:00:00.000Z'),
-    },
-    {
-      id: OTHER_TEAM_NOTE_ID,
-      missionId: TEAM_MISSION_ID,
-      userId: OTHER_USER_ID,
-      notes: 'other user note on team mission',
-      createdAt: new Date('2026-06-24T02:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T02:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_PERSONAL_NOTE_ID,
-      missionId: PERSONAL_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note on personal mission',
-      createdAt: new Date('2026-06-24T01:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T01:00:00.000Z'),
-    },
-    {
-      id: SUBJECT_UNAUTHORIZED_NOTE_ID,
-      missionId: UNAUTHORIZED_MISSION_ID,
-      userId: SUBJECT_USER_ID,
-      notes: 'subject note outside grant-visible missions',
-      createdAt: new Date('2026-06-24T04:00:00.000Z'),
-      updatedAt: new Date('2026-06-24T04:00:00.000Z'),
-    },
-  ]);
-
-  const memoryCreatedAt = new Date('2026-06-24T05:00:00.000Z');
-  await dbHandle.db.insert(insights).values([
-    {
-      id: INSIGHT_ONE_ID,
-      userId: SUBJECT_USER_ID,
-      content: 'first insight',
-      source: 'agent',
-      createdAt: memoryCreatedAt,
-      updatedAt: memoryCreatedAt,
-    },
-    {
-      id: INSIGHT_TWO_ID,
-      userId: SUBJECT_USER_ID,
-      content: 'second insight',
-      source: 'agent',
-      createdAt: memoryCreatedAt,
-      updatedAt: memoryCreatedAt,
-    },
-  ]);
-
-  await dbHandle.db.insert(preferences).values([
-    {
-      id: PREFERENCE_ONE_ID,
-      userId: SUBJECT_USER_ID,
-      key: 'fed-m3-05-pref-1',
-      value: { enabled: true },
-      createdAt: memoryCreatedAt,
-      updatedAt: memoryCreatedAt,
-    },
-    {
-      id: PREFERENCE_TWO_ID,
-      userId: SUBJECT_USER_ID,
-      key: 'fed-m3-05-pref-2',
-      value: { enabled: false },
-      createdAt: memoryCreatedAt,
-      updatedAt: memoryCreatedAt,
-    },
-  ]);
-}
-
-function stubRows(
-  service: FederationListQueryService,
-  ...pages: Array<Array<Record<string, unknown>>>
-) {
-  const mock = vi.fn();
-  for (const page of pages) {
-    mock.mockResolvedValueOnce(page);
-  }
-  (
-    service as unknown as {
-      listAllRows: (
-        _filter: FederationScopeQueryFilter,
-        _rowLimit: number,
-        _cursor: unknown,
-      ) => Promise<Array<Record<string, unknown>>>;
-    }
-  ).listAllRows = mock;
-  return mock;
-}
-
-describe('FederationListQueryService', () => {
-  beforeAll(async () => {
-    dbHandle = createPgliteDb(`memory://fed-m3-05-list-${Date.now()}`);
-    await runPgliteMigrations(dbHandle);
-    await seedNotesFixture();
-  });
-
-  afterAll(async () => {
-    await dbHandle?.close();
-    dbHandle = undefined;
-  });
-
-  it('denies sensitive resources in native RBAC for M3 list reads', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'credentials',
-      }),
-    ).resolves.toMatchObject({
-      allowed: false,
-      reason: 'credentials federation list access is not implemented in M3',
-    });
-  });
-
-  it('allows personal memory reads without requiring team lookup', async () => {
-    const service = makeService();
-
-    await expect(
-      service.evaluateReadAccess({
-        grantId: 'grant-1',
-        peerId: 'peer-1',
-        subjectUserId: 'user-1',
-        resource: 'memory',
-      }),
-    ).resolves.toEqual({
-      allowed: true,
-      access: { includePersonal: true, teamIds: [] },
-    });
-  });
-
-  it('applies the scope row cap and returns an opaque next cursor when truncated', async () => {
-    const service = makeService();
-    const listAllRows = stubRows(
-      service,
-      [
-        { id: '3', createdAt: new Date('2026-06-24T03:00:00.000Z') },
-        { id: '2', createdAt: new Date('2026-06-24T02:00:00.000Z') },
-        { id: '1', createdAt: new Date('2026-06-24T01:00:00.000Z') },
-      ],
-      [{ id: '1', createdAt: new Date('2026-06-24T01:00:00.000Z') }],
-    );
-
-    const firstPage = await service.list({ filter: TASK_FILTER });
-
-    expect(firstPage).toEqual({
-      items: [
-        { id: '3', createdAt: new Date('2026-06-24T03:00:00.000Z') },
-        { id: '2', createdAt: new Date('2026-06-24T02:00:00.000Z') },
-      ],
-      truncated: true,
-      nextCursor: expect.any(String),
-    });
-
-    expect(listAllRows).toHaveBeenNthCalledWith(1, TASK_FILTER, 3, undefined);
-
-    const secondPage = await service.list({ filter: TASK_FILTER, cursor: firstPage.nextCursor });
-    expect(secondPage).toEqual({
-      items: [{ id: '1', createdAt: new Date('2026-06-24T01:00:00.000Z') }],
-      truncated: false,
-    });
-    expect(listAllRows).toHaveBeenNthCalledWith(
-      2,
-      TASK_FILTER,
-      3,
-      expect.objectContaining({ id: '2' }),
-    );
-  });
-
-  it('rejects invalid cursors instead of falling back to the first page', async () => {
-    const service = makeService();
-    stubRows(service, [{ id: '1' }]);
-
-    await expect(service.list({ filter: TASK_FILTER, cursor: 'not-base64-json' })).rejects.toThrow(
-      'Invalid federation list cursor',
-    );
-  });
-
-  it('throws when a truncated page cannot encode a resumable cursor', async () => {
-    const service = makeService();
-    stubRows(service, [
-      { id: '2', createdAt: 'not-a-date' },
-      { id: '1', createdAt: 'not-a-date' },
-    ]);
-
-    await expect(service.list({ filter: { ...TASK_FILTER, limit: 1 } })).rejects.toThrow(
-      'Federation list cursor cannot be encoded',
-    );
-  });
-
-  it('throws on unsupported resources instead of crashing pagination', async () => {
-    const service = makeService();
-
-    await expect(
-      service.list({
-        filter: {
-          ...TASK_FILTER,
-          resource: 'unknown-resource' as FederationScopeQueryFilter['resource'],
-        },
-      }),
-    ).rejects.toThrow('Unsupported federation list resource');
-  });
-
-  it('does not leak another user mission task notes through team-scoped note reads', async () => {
-    const service = makeDbService();
-
-    const result = await service.list({
-      filter: {
-        resource: 'notes',
-        subjectUserId: SUBJECT_USER_ID,
-        includePersonal: false,
-        teamIds: [TEAM_ID],
-        limit: 10,
-        maxRowsPerQuery: 10,
-      },
-    });
-
-    const ids = result.items.map((item) => item['id']);
-    expect(ids).toEqual([SUBJECT_TEAM_NOTE_ID]);
-    expect(ids).not.toContain(OTHER_TEAM_NOTE_ID);
-  });
-
-  it('does not return subject personal mission task notes when includePersonal is false', async () => {
-    const service = makeDbService();
-
-    const result = await service.list({
-      filter: {
-        resource: 'notes',
-        subjectUserId: SUBJECT_USER_ID,
-        includePersonal: false,
-        teamIds: [TEAM_ID],
-        limit: 10,
-        maxRowsPerQuery: 10,
-      },
-    });
-
-    expect(result.items.map((item) => item['id'])).not.toContain(SUBJECT_PERSONAL_NOTE_ID);
-  });
-
-  it('does not return subject notes from missions outside the grant-visible project set', async () => {
-    const service = makeDbService();
-
-    const result = await service.list({
-      filter: {
-        resource: 'notes',
-        subjectUserId: SUBJECT_USER_ID,
-        includePersonal: true,
-        teamIds: [TEAM_ID],
-        limit: 10,
-        maxRowsPerQuery: 10,
-      },
-    });
-
-    const ids = result.items.map((item) => item['id']);
-    expect(ids).toContain(SUBJECT_PERSONAL_NOTE_ID);
-    expect(ids).toContain(SUBJECT_TEAM_NOTE_ID);
-    expect(ids).not.toContain(SUBJECT_UNAUTHORIZED_NOTE_ID);
-    expect(ids).not.toContain(OTHER_TEAM_NOTE_ID);
-  });
-
-  it('paginates memory deterministically across insights and preferences', async () => {
-    const service = makeDbService();
-    const filter: FederationScopeQueryFilter = {
-      resource: 'memory',
-      subjectUserId: SUBJECT_USER_ID,
-      includePersonal: true,
-      teamIds: [],
-      limit: 2,
-      maxRowsPerQuery: 2,
-    };
-
-    const firstPage = await service.list({ filter });
-    const secondPage = await service.list({ filter, cursor: firstPage.nextCursor });
-    const firstPageIds = firstPage.items.map((item) => item['id']);
-    const secondPageIds = secondPage.items.map((item) => item['id']);
-    const allIds = [...firstPageIds, ...secondPageIds];
-
-    expect(firstPage).toMatchObject({ truncated: true, nextCursor: expect.any(String) });
-    expect(firstPageIds).toEqual([INSIGHT_TWO_ID, INSIGHT_ONE_ID]);
-    expect(secondPageIds).toEqual([PREFERENCE_TWO_ID, PREFERENCE_ONE_ID]);
-    expect(new Set(allIds).size).toBe(allIds.length);
-  });
-});
--- a/apps/gateway/src/federation/server/verbs/tests/list.controller.spec.ts
+++ b/apps/gateway/src/federation/server/verbs/tests/list.controller.spec.ts
@@ -1,188 +0,0 @@
-import 'reflect-metadata';
-import { RequestMethod } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { FederationAuthGuard } from '../../federation-auth.guard.js';
-import type {
-  FederationScopeEvaluationResult,
-  FederationScopeQueryFilter,
-} from '../../scope.service.js';
-import { ListController } from '../list.controller.js';
-import type { FederationListQueryResult } from '../list-query.service.js';
-
-const FEDERATION_CONTEXT = {
-  grantId: 'grant-1',
-  peerId: 'peer-1',
-  subjectUserId: 'user-1',
-  scope: { resources: ['tasks'], max_rows_per_query: 25 },
-};
-
-const TASK_FILTER: FederationScopeQueryFilter = {
-  resource: 'tasks',
-  subjectUserId: 'user-1',
-  includePersonal: true,
-  teamIds: ['team-1'],
-  limit: 10,
-  maxRowsPerQuery: 25,
-};
-
-function makeRequest(): FastifyRequest {
-  return { federationContext: FEDERATION_CONTEXT } as unknown as FastifyRequest;
-}
-
-function allowedScope(
-  filter: FederationScopeQueryFilter = TASK_FILTER,
-): FederationScopeEvaluationResult {
-  return { allowed: true, filter };
-}
-
-function makeController(opts?: {
-  scopeResult?: FederationScopeEvaluationResult;
-  queryResult?: FederationListQueryResult;
-}) {
-  const scope = {
-    evaluateAccess: vi.fn().mockResolvedValue(opts?.scopeResult ?? allowedScope()),
-  };
-  const query = {
-    evaluateReadAccess: vi.fn(),
-    list: vi.fn().mockResolvedValue(
-      opts?.queryResult ?? {
-        items: [
-          {
-            id: 'task-1',
-            title: 'Federated task',
-            createdAt: new Date('2026-06-24T00:00:00.000Z'),
-          },
-        ],
-        truncated: false,
-      },
-    ),
-  };
-
-  return {
-    controller: new ListController(scope as never, query as never),
-    scope,
-    query,
-  };
-}
-
-describe('ListController', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('declares POST /api/federation/v1/list/:resource protected only by FederationAuthGuard', () => {
-    expect(Reflect.getMetadata('path', ListController)).toBe('api/federation/v1/list');
-    expect(Reflect.getMetadata('path', ListController.prototype.list)).toBe(':resource');
-    expect(Reflect.getMetadata('method', ListController.prototype.list)).toBe(RequestMethod.POST);
-    expect(Reflect.getMetadata('__guards__', ListController)).toEqual([FederationAuthGuard]);
-  });
-
-  it('runs AuthGuard context through ScopeService and returns local-source tagged rows', async () => {
-    const { controller, scope, query } = makeController();
-
-    const response = await controller.list('tasks', makeRequest(), { limit: 10 });
-
-    expect(scope.evaluateAccess).toHaveBeenCalledWith({
-      context: FEDERATION_CONTEXT,
-      resource: 'tasks',
-      requestedLimit: 10,
-      nativeRbac: query,
-    });
-    expect(query.list).toHaveBeenCalledWith({ filter: TASK_FILTER, cursor: undefined });
-    expect(response).toEqual({
-      items: [
-        {
-          id: 'task-1',
-          title: 'Federated task',
-          createdAt: new Date('2026-06-24T00:00:00.000Z'),
-          _source: 'local',
-        },
-      ],
-    });
-  });
-
-  it('preserves pagination metadata when row cap truncates the query layer result', async () => {
-    const { controller } = makeController({
-      queryResult: {
-        items: [{ id: 'task-1' }],
-        nextCursor: 'cursor-2',
-        truncated: true,
-      },
-    });
-
-    const response = await controller.list('tasks', makeRequest(), { cursor: 'cursor-1' });
-
-    expect(response).toEqual({
-      items: [{ id: 'task-1', _source: 'local' }],
-      nextCursor: 'cursor-2',
-      _truncated: true,
-    });
-  });
-
-  it('returns a federation error envelope when auth guard context is missing', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(
-      controller.list('tasks', {} as unknown as FastifyRequest, {}),
-    ).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'unauthorized',
-          message: 'Federation context missing',
-        },
-      },
-      status: 401,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.list).not.toHaveBeenCalled();
-  });
-
-  it('returns a federation error envelope when scope evaluation denies access', async () => {
-    const { controller, query } = makeController({
-      scopeResult: {
-        allowed: false,
-        deny: {
-          code: 'resource_excluded',
-          stage: 'resource_exclusion',
-          statusCode: 403,
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-          grantId: 'grant-1',
-          peerId: 'peer-1',
-          subjectUserId: 'user-1',
-          resource: 'credentials',
-        },
-      },
-    });
-
-    await expect(controller.list('credentials', makeRequest(), {})).rejects.toMatchObject({
-      response: {
-        error: {
-          code: 'scope_violation',
-          message: 'Requested federation resource is explicitly excluded by grant scope',
-        },
-      },
-      status: 403,
-    });
-    expect(query.list).not.toHaveBeenCalled();
-  });
-
-  it('rejects malformed request body fields before querying storage', async () => {
-    const { controller, scope, query } = makeController();
-
-    await expect(controller.list('tasks', makeRequest(), { cursor: 123 })).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    await expect(controller.list('tasks', makeRequest(), { limit: false })).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    await expect(controller.list('tasks', makeRequest(), { limit: 'abc' })).rejects.toMatchObject({
-      response: { error: { code: 'invalid_request' } },
-      status: 400,
-    });
-    expect(scope.evaluateAccess).not.toHaveBeenCalled();
-    expect(query.list).not.toHaveBeenCalled();
-  });
-});
--- a/apps/gateway/src/federation/server/verbs/capabilities.controller.ts
+++ b/apps/gateway/src/federation/server/verbs/capabilities.controller.ts
@@ -1,38 +0,0 @@
-/**
- * Federation capabilities verb (FED-M3-07).
- *
- * Returns the read-only capability envelope for the active grant attached by
- * FederationAuthGuard. This endpoint intentionally does not invoke native RBAC
- * or ScopeService: an active grant is enough to ask what the grant allows.
- */
-
-import { Controller, Get, Req, UseGuards } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FEDERATION_VERBS,
-  type FederationCapabilitiesResponse,
-  type FederationVerb,
-} from '@mosaicstack/types';
-import { parseFederationScope } from '../../scope-schema.js';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-
-@Controller('api/federation/v1/capabilities')
-@UseGuards(FederationAuthGuard)
-export class CapabilitiesController {
-  @Get()
-  getCapabilities(@Req() request: FastifyRequest): FederationCapabilitiesResponse {
-    if (!request.federationContext) {
-      throw new Error('Federation context missing after auth guard');
-    }
-
-    const scope = parseFederationScope(request.federationContext.scope);
-
-    return {
-      resources: [...scope.resources],
-      excluded_resources: [...scope.excluded_resources],
-      max_rows_per_query: scope.max_rows_per_query,
-      supported_verbs: [...FEDERATION_VERBS] satisfies FederationVerb[],
-    };
-  }
-}
--- a/apps/gateway/src/federation/server/verbs/get-query.service.ts
+++ b/apps/gateway/src/federation/server/verbs/get-query.service.ts
@@ -1,311 +0,0 @@
-/**
- * Federation get query layer (FED-M3-06).
- *
- * Read-only DB adapter used by GetController after FederationAuthGuard and
- * FederationScopeService have established the subject user, allowed resource,
- * native-RBAC intersection, and row cap. Audit writes are intentionally
- * deferred to M4.
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  eq,
-  inArray,
-  insights,
-  or,
-  missionTasks,
-  missions,
-  preferences,
-  projects,
-  tasks,
-  teamMembers,
-  type Db,
-} from '@mosaicstack/db';
-import { DB } from '../../../database/database.module.js';
-import type {
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeQueryFilter,
-} from '../scope.service.js';
-
-export interface FederationGetQueryRequest {
-  readonly filter: FederationScopeQueryFilter;
-  readonly id: string;
-}
-
-export interface FederationGetQueryFoundResult<T extends object = Record<string, unknown>> {
-  readonly status: 'found';
-  readonly item: T;
-}
-
-export interface FederationGetQueryNotFoundResult {
-  readonly status: 'not_found';
-}
-
-export interface FederationGetQueryDeniedResult {
-  readonly status: 'denied';
-  readonly reason: string;
-}
-
-export type FederationGetQueryResult<T extends object = Record<string, unknown>> =
-  | FederationGetQueryFoundResult<T>
-  | FederationGetQueryNotFoundResult
-  | FederationGetQueryDeniedResult;
-
-type RowObject = Record<string, unknown>;
-
-function firstRow<T>(rows: T[]): T | undefined {
-  return rows[0];
-}
-
-function rowBelongsToAccessibleProjectOrMission(
-  row: { projectId?: string | null; missionId?: string | null },
-  projectIds: readonly string[],
-  missionIds: readonly string[],
-): boolean {
-  return (
-    (typeof row.projectId === 'string' && projectIds.includes(row.projectId)) ||
-    (typeof row.missionId === 'string' && missionIds.includes(row.missionId))
-  );
-}
-
-@Injectable()
-export class FederationGetQueryService implements FederationNativeRbacEvaluator {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async evaluateReadAccess(
-    request: FederationNativeRbacRequest,
-  ): Promise<FederationNativeRbacResult> {
-    if (request.resource === 'credentials' || request.resource === 'api_keys') {
-      return {
-        allowed: false,
-        reason: `${request.resource} federation get access is not implemented in M3`,
-        details: { resource: request.resource },
-      };
-    }
-
-    if (request.resource === 'memory') {
-      return { allowed: true, access: { includePersonal: true, teamIds: [] } };
-    }
-
-    const teamIds = await this.listSubjectTeamIds(request.subjectUserId);
-    return { allowed: true, access: { includePersonal: true, teamIds } };
-  }
-
-  async get<T extends RowObject = RowObject>(
-    request: FederationGetQueryRequest,
-  ): Promise<FederationGetQueryResult<T>> {
-    return this.getByResource(request.filter, request.id) as Promise<FederationGetQueryResult<T>>;
-  }
-
-  private async getByResource(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    switch (filter.resource) {
-      case 'tasks':
-        return this.getTask(filter, id);
-      case 'notes':
-        return this.getNote(filter, id);
-      case 'memory':
-        return this.getMemory(filter, id);
-      case 'credentials':
-      case 'api_keys':
-        return { status: 'denied', reason: `${filter.resource} federation get is not implemented` };
-      default:
-        return {
-          status: 'denied',
-          reason: `Unsupported federation get resource: ${String(filter.resource)}`,
-        };
-    }
-  }
-
-  private async listSubjectTeamIds(subjectUserId: string): Promise<string[]> {
-    const rows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, subjectUserId));
-
-    return rows.map((row) => row.teamId);
-  }
-
-  private async listAccessibleProjectIds(filter: FederationScopeQueryFilter): Promise<string[]> {
-    const clauses = [];
-    if (filter.includePersonal) {
-      clauses.push(and(eq(projects.ownerType, 'user'), eq(projects.ownerId, filter.subjectUserId)));
-    }
-    if (filter.teamIds.length > 0) {
-      // Project team ownership follows TeamsService.canAccessProject: team-owned
-      // rows are authorized through projects.teamId, while ownerId remains the
-      // user who created/bootstrapped the project.
-      clauses.push(
-        and(eq(projects.ownerType, 'team'), inArray(projects.teamId, [...filter.teamIds])),
-      );
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: projects.id })
-      .from(projects)
-      .where(clauses.length === 1 ? clauses[0] : or(...clauses));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listMissionIds(projectIds: readonly string[]): Promise<string[]> {
-    if (projectIds.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: missions.id })
-      .from(missions)
-      .where(inArray(missions.projectId, [...projectIds]));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async getTask(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: tasks.id,
-          title: tasks.title,
-          description: tasks.description,
-          status: tasks.status,
-          priority: tasks.priority,
-          projectId: tasks.projectId,
-          missionId: tasks.missionId,
-          assignee: tasks.assignee,
-          tags: tasks.tags,
-          dueDate: tasks.dueDate,
-          metadata: tasks.metadata,
-          createdAt: tasks.createdAt,
-          updatedAt: tasks.updatedAt,
-        })
-        .from(tasks)
-        .where(eq(tasks.id, id))
-        .limit(1),
-    );
-
-    if (!row) {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-    if (!rowBelongsToAccessibleProjectOrMission(row, projectIds, missionIds)) {
-      return { status: 'denied', reason: 'Task is outside the federated scope' };
-    }
-
-    return { status: 'found', item: row as RowObject };
-  }
-
-  private async getNote(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const row = firstRow(
-      await this.db
-        .select({
-          id: missionTasks.id,
-          missionId: missionTasks.missionId,
-          taskId: missionTasks.taskId,
-          userId: missionTasks.userId,
-          status: missionTasks.status,
-          content: missionTasks.notes,
-          createdAt: missionTasks.createdAt,
-          updatedAt: missionTasks.updatedAt,
-        })
-        .from(missionTasks)
-        .where(eq(missionTasks.id, id))
-        .limit(1),
-    );
-
-    if (!row || row.content === null || row.content === '') {
-      return { status: 'not_found' };
-    }
-
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-
-    // mission_tasks rows are user-scoped even when the mission belongs to a team.
-    // Scope-visible missions must intersect with subject ownership; team scope
-    // narrows mission IDs but never widens note reads to another user's rows.
-    if (row.userId !== filter.subjectUserId || !missionIds.includes(row.missionId)) {
-      return { status: 'denied', reason: 'Note is outside the federated scope' };
-    }
-
-    const item = { ...row } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-
-  private async getMemory(
-    filter: FederationScopeQueryFilter,
-    id: string,
-  ): Promise<FederationGetQueryResult> {
-    const [insightRow, preferenceRow] = await Promise.all([
-      this.db
-        .select({
-          id: insights.id,
-          userId: insights.userId,
-          kind: insights.source,
-          content: insights.content,
-          category: insights.category,
-          relevanceScore: insights.relevanceScore,
-          metadata: insights.metadata,
-          createdAt: insights.createdAt,
-          updatedAt: insights.updatedAt,
-        })
-        .from(insights)
-        .where(eq(insights.id, id))
-        .limit(1)
-        .then(firstRow),
-      this.db
-        .select({
-          id: preferences.id,
-          userId: preferences.userId,
-          kind: preferences.category,
-          key: preferences.key,
-          value: preferences.value,
-          source: preferences.source,
-          mutable: preferences.mutable,
-          createdAt: preferences.createdAt,
-          updatedAt: preferences.updatedAt,
-        })
-        .from(preferences)
-        .where(eq(preferences.id, id))
-        .limit(1)
-        .then(firstRow),
-    ]);
-
-    const candidates = [insightRow, preferenceRow].filter(
-      (row): row is NonNullable<typeof row> => row !== undefined,
-    );
-    if (candidates.length === 0) {
-      return { status: 'not_found' };
-    }
-
-    if (!filter.includePersonal) {
-      return { status: 'denied', reason: 'Memory personal rows are outside the federated scope' };
-    }
-
-    const accessible = candidates.find((row) => row.userId === filter.subjectUserId);
-    if (!accessible) {
-      return { status: 'denied', reason: 'Memory row belongs to another subject user' };
-    }
-
-    const item = { ...accessible } as RowObject;
-    delete item['userId'];
-    return { status: 'found', item };
-  }
-}
--- a/apps/gateway/src/federation/server/verbs/get.controller.ts
+++ b/apps/gateway/src/federation/server/verbs/get.controller.ts
@@ -1,100 +0,0 @@
-/**
- * Federation get verb (FED-M3-06).
- *
- * POST /api/federation/v1/get/:resource/:id
- *
- * Pipeline: FederationAuthGuard attaches the active grant context, then
- * FederationScopeService enforces grant scope + native RBAC intersection, then
- * the read-only query layer fetches one local row and tags it with `_source`.
- * Read audit-log writes are deferred to M4; this controller does not persist
- * request or response bodies.
- */
-
-import { Controller, HttpException, Inject, Param, Post, Req, UseGuards } from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FederationInvalidRequestError,
-  FederationNotFoundError,
-  FederationScopeViolationError,
-  FederationUnauthorizedError,
-  SOURCE_LOCAL,
-  type FederationGetResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-import { FederationScopeService } from '../scope.service.js';
-import { FederationGetQueryService } from './get-query.service.js';
-
-type FederatedRow = Record<string, unknown> & SourceTag;
-
-function scopeDenyToHttpException(deny: {
-  readonly statusCode: 400 | 403;
-  readonly message: string;
-}): HttpException {
-  const ErrorClass =
-    deny.statusCode === 400 ? FederationInvalidRequestError : FederationScopeViolationError;
-  return new HttpException(new ErrorClass(deny.message, deny).toEnvelope(), deny.statusCode);
-}
-
-@Controller('api/federation/v1/get')
-@UseGuards(FederationAuthGuard)
-export class GetController {
-  constructor(
-    @Inject(FederationScopeService) private readonly scope: FederationScopeService,
-    @Inject(FederationGetQueryService) private readonly query: FederationGetQueryService,
-  ) {}
-
-  @Post(':resource/:id')
-  async get(
-    @Param('resource') resource: string,
-    @Param('id') id: string,
-    @Req() request: FastifyRequest,
-  ): Promise<FederationGetResponse<FederatedRow>> {
-    if (!request.federationContext) {
-      throw new HttpException(
-        new FederationUnauthorizedError('Federation context missing').toEnvelope(),
-        401,
-      );
-    }
-    if (id.trim().length === 0) {
-      throw new HttpException(
-        new FederationInvalidRequestError('Federation get id must not be empty').toEnvelope(),
-        400,
-      );
-    }
-
-    const scopeResult = await this.scope.evaluateAccess({
-      context: request.federationContext,
-      resource,
-      requestedLimit: 1,
-      nativeRbac: this.query,
-    });
-
-    if (!scopeResult.allowed) {
-      throw scopeDenyToHttpException(scopeResult.deny);
-    }
-
-    const result = await this.query.get({ filter: scopeResult.filter, id });
-    if (result.status === 'not_found') {
-      throw new HttpException(
-        new FederationNotFoundError('Requested federation resource was not found').toEnvelope(),
-        404,
-      );
-    }
-    if (result.status === 'denied') {
-      throw new HttpException(
-        new FederationScopeViolationError(result.reason, {
-          resource,
-          id,
-          grantId: request.federationContext.grantId,
-          peerId: request.federationContext.peerId,
-          subjectUserId: request.federationContext.subjectUserId,
-        }).toEnvelope(),
-        403,
-      );
-    }
-
-    return { item: { ...result.item, _source: SOURCE_LOCAL } };
-  }
-}
--- a/apps/gateway/src/federation/server/verbs/list-query.service.ts
+++ b/apps/gateway/src/federation/server/verbs/list-query.service.ts
@@ -1,408 +0,0 @@
-/**
- * Federation list query layer (FED-M3-05).
- *
- * Read-only DB adapter used by ListController after FederationAuthGuard and
- * FederationScopeService have established the subject user, allowed resource,
- * native-RBAC intersection, and row cap. Audit writes are intentionally
- * deferred to M4.
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  desc,
-  eq,
-  inArray,
-  insights,
-  isNotNull,
-  lt,
-  missionTasks,
-  missions,
-  or,
-  preferences,
-  projects,
-  tasks,
-  teamMembers,
-  type Db,
-} from '@mosaicstack/db';
-import type {
-  FederationNativeRbacEvaluator,
-  FederationNativeRbacRequest,
-  FederationNativeRbacResult,
-  FederationScopeQueryFilter,
-} from '../scope.service.js';
-import { DB } from '../../../database/database.module.js';
-
-export interface FederationListQueryRequest {
-  readonly filter: FederationScopeQueryFilter;
-  readonly cursor?: string;
-}
-
-export interface FederationListQueryResult<T extends object = Record<string, unknown>> {
-  readonly items: T[];
-  readonly nextCursor?: string;
-  readonly truncated: boolean;
-}
-
-type CursorSource = 'insights' | 'preferences';
-const CURSOR_SOURCE = Symbol('federationCursorSource');
-
-type RowObject = Record<string, unknown> & { readonly [CURSOR_SOURCE]?: CursorSource };
-
-interface KeysetCursor {
-  readonly createdAt: Date;
-  readonly id: string;
-  readonly source?: CursorSource;
-}
-
-function encodeCursor(row: RowObject): string {
-  const createdAt = row['createdAt'];
-  const id = row['id'];
-  if (!(createdAt instanceof Date) || typeof id !== 'string') {
-    throw new Error('Federation list cursor cannot be encoded');
-  }
-
-  const source = row[CURSOR_SOURCE];
-  return Buffer.from(
-    JSON.stringify({ createdAt: createdAt.toISOString(), id, ...(source ? { source } : {}) }),
-    'utf8',
-  ).toString('base64url');
-}
-
-function decodeCursor(cursor: string | undefined): KeysetCursor | undefined {
-  if (cursor === undefined) {
-    return undefined;
-  }
-
-  try {
-    const parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8')) as unknown;
-    if (typeof parsed !== 'object' || parsed === null) {
-      throw new Error('cursor must be an object');
-    }
-
-    const { createdAt, id, source } = parsed as {
-      createdAt?: unknown;
-      id?: unknown;
-      source?: unknown;
-    };
-    if (typeof createdAt !== 'string' || typeof id !== 'string' || id.length === 0) {
-      throw new Error('cursor is missing createdAt or id');
-    }
-    if (source !== undefined && source !== 'insights' && source !== 'preferences') {
-      throw new Error('cursor source is invalid');
-    }
-
-    const date = new Date(createdAt);
-    if (Number.isNaN(date.getTime())) {
-      throw new Error('cursor createdAt is invalid');
-    }
-
-    return { createdAt: date, id, ...(source ? { source } : {}) };
-  } catch {
-    throw new Error('Invalid federation list cursor');
-  }
-}
-
-function paginate<T extends RowObject>(rows: T[], limit: number): FederationListQueryResult<T> {
-  const page = rows.slice(0, limit);
-  const hasMore = rows.length > limit;
-  const nextCursor = hasMore ? encodeCursor(page[page.length - 1] ?? {}) : undefined;
-
-  return {
-    items: page,
-    truncated: hasMore,
-    ...(nextCursor !== undefined ? { nextCursor } : {}),
-  };
-}
-
-function markCursorSource<T extends RowObject>(row: T, source: CursorSource): T {
-  Object.defineProperty(row, CURSOR_SOURCE, {
-    value: source,
-    enumerable: false,
-    configurable: false,
-  });
-  return row;
-}
-
-function sortRows(rows: RowObject[]): RowObject[] {
-  return [...rows].sort((a, b) => {
-    const aTime = a['createdAt'] instanceof Date ? a['createdAt'].getTime() : 0;
-    const bTime = b['createdAt'] instanceof Date ? b['createdAt'].getTime() : 0;
-    if (aTime !== bTime) {
-      return bTime - aTime;
-    }
-    return String(b['id'] ?? '').localeCompare(String(a['id'] ?? ''));
-  });
-}
-
-@Injectable()
-export class FederationListQueryService implements FederationNativeRbacEvaluator {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async evaluateReadAccess(
-    request: FederationNativeRbacRequest,
-  ): Promise<FederationNativeRbacResult> {
-    if (request.resource === 'credentials' || request.resource === 'api_keys') {
-      return {
-        allowed: false,
-        reason: `${request.resource} federation list access is not implemented in M3`,
-        details: { resource: request.resource },
-      };
-    }
-
-    if (request.resource === 'memory') {
-      return { allowed: true, access: { includePersonal: true, teamIds: [] } };
-    }
-
-    const teamIds = await this.listSubjectTeamIds(request.subjectUserId);
-    return { allowed: true, access: { includePersonal: true, teamIds } };
-  }
-
-  async list<T extends RowObject = RowObject>(
-    request: FederationListQueryRequest,
-  ): Promise<FederationListQueryResult<T>> {
-    const cursor = decodeCursor(request.cursor);
-    const rows = await this.listAllRows(request.filter, request.filter.limit + 1, cursor);
-    return paginate(rows as T[], request.filter.limit);
-  }
-
-  private async listAllRows(
-    filter: FederationScopeQueryFilter,
-    rowLimit: number,
-    cursor: KeysetCursor | undefined,
-  ): Promise<RowObject[]> {
-    switch (filter.resource) {
-      case 'tasks':
-        return this.listTasks(filter, rowLimit, cursor);
-      case 'notes':
-        return this.listNotes(filter, rowLimit, cursor);
-      case 'memory':
-        return this.listMemory(filter, rowLimit, cursor);
-      case 'credentials':
-      case 'api_keys':
-        return [];
-      default:
-        throw new Error(`Unsupported federation list resource: ${String(filter.resource)}`);
-    }
-  }
-
-  private async listSubjectTeamIds(subjectUserId: string): Promise<string[]> {
-    const rows = await this.db
-      .select({ teamId: teamMembers.teamId })
-      .from(teamMembers)
-      .where(eq(teamMembers.userId, subjectUserId));
-
-    return rows.map((row) => row.teamId);
-  }
-
-  private async listAccessibleProjectIds(filter: FederationScopeQueryFilter): Promise<string[]> {
-    const clauses = [];
-    if (filter.includePersonal) {
-      clauses.push(and(eq(projects.ownerType, 'user'), eq(projects.ownerId, filter.subjectUserId)));
-    }
-    if (filter.teamIds.length > 0) {
-      clauses.push(
-        and(eq(projects.ownerType, 'team'), inArray(projects.teamId, [...filter.teamIds])),
-      );
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: projects.id })
-      .from(projects)
-      .where(clauses.length === 1 ? clauses[0] : or(...clauses));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listMissionIds(projectIds: readonly string[]): Promise<string[]> {
-    if (projectIds.length === 0) {
-      return [];
-    }
-
-    const rows = await this.db
-      .select({ id: missions.id })
-      .from(missions)
-      .where(inArray(missions.projectId, [...projectIds]));
-
-    return rows.map((row) => row.id);
-  }
-
-  private async listTasks(
-    filter: FederationScopeQueryFilter,
-    rowLimit: number,
-    cursor: KeysetCursor | undefined,
-  ): Promise<RowObject[]> {
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-    const clauses = [];
-
-    if (projectIds.length > 0) {
-      clauses.push(inArray(tasks.projectId, projectIds));
-    }
-    if (missionIds.length > 0) {
-      clauses.push(inArray(tasks.missionId, missionIds));
-    }
-
-    if (clauses.length === 0) {
-      return [];
-    }
-
-    const scopeClause = clauses.length === 1 ? clauses[0] : or(...clauses);
-    const cursorClause = cursor
-      ? or(
-          lt(tasks.createdAt, cursor.createdAt),
-          and(eq(tasks.createdAt, cursor.createdAt), lt(tasks.id, cursor.id)),
-        )
-      : undefined;
-
-    const rows = await this.db
-      .select({
-        id: tasks.id,
-        title: tasks.title,
-        description: tasks.description,
-        status: tasks.status,
-        priority: tasks.priority,
-        projectId: tasks.projectId,
-        missionId: tasks.missionId,
-        assignee: tasks.assignee,
-        tags: tasks.tags,
-        dueDate: tasks.dueDate,
-        metadata: tasks.metadata,
-        createdAt: tasks.createdAt,
-        updatedAt: tasks.updatedAt,
-      })
-      .from(tasks)
-      .where(and(scopeClause, cursorClause))
-      .orderBy(desc(tasks.createdAt), desc(tasks.id))
-      .limit(rowLimit);
-
-    return sortRows(rows as RowObject[]);
-  }
-
-  private async listNotes(
-    filter: FederationScopeQueryFilter,
-    rowLimit: number,
-    cursor: KeysetCursor | undefined,
-  ): Promise<RowObject[]> {
-    const projectIds = await this.listAccessibleProjectIds(filter);
-    const missionIds = await this.listMissionIds(projectIds);
-
-    if (missionIds.length === 0) {
-      return [];
-    }
-
-    // mission_tasks rows are user-scoped even when the mission belongs to a team.
-    // Team visibility can narrow the mission set, but it must never widen the
-    // query to other users' mission task notes.
-    const scopeClause = and(
-      eq(missionTasks.userId, filter.subjectUserId),
-      inArray(missionTasks.missionId, missionIds),
-    );
-    const cursorClause = cursor
-      ? or(
-          lt(missionTasks.createdAt, cursor.createdAt),
-          and(eq(missionTasks.createdAt, cursor.createdAt), lt(missionTasks.id, cursor.id)),
-        )
-      : undefined;
-
-    const rows = await this.db
-      .select({
-        id: missionTasks.id,
-        missionId: missionTasks.missionId,
-        taskId: missionTasks.taskId,
-        status: missionTasks.status,
-        content: missionTasks.notes,
-        createdAt: missionTasks.createdAt,
-        updatedAt: missionTasks.updatedAt,
-      })
-      .from(missionTasks)
-      .where(and(scopeClause, cursorClause, isNotNull(missionTasks.notes)))
-      .orderBy(desc(missionTasks.createdAt), desc(missionTasks.id))
-      .limit(rowLimit);
-
-    return sortRows(rows.filter((row) => row.content !== '') as RowObject[]);
-  }
-
-  private async listMemory(
-    filter: FederationScopeQueryFilter,
-    rowLimit: number,
-    cursor: KeysetCursor | undefined,
-  ): Promise<RowObject[]> {
-    if (!filter.includePersonal) {
-      return [];
-    }
-    if (cursor && cursor.source === undefined) {
-      throw new Error('Invalid federation list cursor');
-    }
-
-    const rows: RowObject[] = [];
-
-    // Memory spans two physical tables. To keep pagination deterministic and
-    // resumable without a SQL UNION, M3 emits a fixed block order: all insights
-    // first, then preferences. The opaque cursor records which table produced
-    // the boundary row, so the next page never re-applies one table's keyset to
-    // the other table (which could duplicate/skip rows at equal timestamps).
-    if (cursor?.source !== 'preferences') {
-      const insightCursorClause = cursor
-        ? or(
-            lt(insights.createdAt, cursor.createdAt),
-            and(eq(insights.createdAt, cursor.createdAt), lt(insights.id, cursor.id)),
-          )
-        : undefined;
-      const insightRows = await this.db
-        .select({
-          id: insights.id,
-          kind: insights.source,
-          content: insights.content,
-          category: insights.category,
-          relevanceScore: insights.relevanceScore,
-          metadata: insights.metadata,
-          createdAt: insights.createdAt,
-          updatedAt: insights.updatedAt,
-        })
-        .from(insights)
-        .where(and(eq(insights.userId, filter.subjectUserId), insightCursorClause))
-        .orderBy(desc(insights.createdAt), desc(insights.id))
-        .limit(rowLimit);
-
-      rows.push(...(insightRows as RowObject[]).map((row) => markCursorSource(row, 'insights')));
-    }
-
-    const remaining = rowLimit - rows.length;
-    if (remaining <= 0) {
-      return rows;
-    }
-
-    const preferenceCursorClause =
-      cursor?.source === 'preferences'
-        ? or(
-            lt(preferences.createdAt, cursor.createdAt),
-            and(eq(preferences.createdAt, cursor.createdAt), lt(preferences.id, cursor.id)),
-          )
-        : undefined;
-    const preferenceRows = await this.db
-      .select({
-        id: preferences.id,
-        kind: preferences.category,
-        key: preferences.key,
-        value: preferences.value,
-        source: preferences.source,
-        mutable: preferences.mutable,
-        createdAt: preferences.createdAt,
-        updatedAt: preferences.updatedAt,
-      })
-      .from(preferences)
-      .where(and(eq(preferences.userId, filter.subjectUserId), preferenceCursorClause))
-      .orderBy(desc(preferences.createdAt), desc(preferences.id))
-      .limit(remaining);
-
-    rows.push(
-      ...(preferenceRows as RowObject[]).map((row) => markCursorSource(row, 'preferences')),
-    );
-    return rows;
-  }
-}
--- a/apps/gateway/src/federation/server/verbs/list.controller.ts
+++ b/apps/gateway/src/federation/server/verbs/list.controller.ts
@@ -1,147 +0,0 @@
-/**
- * Federation list verb (FED-M3-05).
- *
- * POST /api/federation/v1/list/:resource
- *
- * Pipeline: FederationAuthGuard attaches the active grant context, then
- * FederationScopeService enforces grant scope + native RBAC intersection, then
- * the read-only query layer returns capped rows tagged with `_source`. Read
- * audit-log writes are deferred to M4; this controller does not persist request
- * or response bodies.
- */
-
-import {
-  Body,
-  Controller,
-  HttpException,
-  Inject,
-  Param,
-  Post,
-  Req,
-  UseGuards,
-} from '@nestjs/common';
-import type { FastifyRequest } from 'fastify';
-import {
-  FederationInvalidRequestError,
-  FederationScopeViolationError,
-  FederationUnauthorizedError,
-  SOURCE_LOCAL,
-  tagWithSource,
-  type FederationListResponse,
-  type SourceTag,
-} from '@mosaicstack/types';
-import { FederationAuthGuard } from '../federation-auth.guard.js';
-import '../federation-context.js';
-import { FederationScopeService } from '../scope.service.js';
-import { FederationListQueryService } from './list-query.service.js';
-
-interface FederationListRequestBody {
-  readonly limit?: unknown;
-  readonly cursor?: unknown;
-}
-
-type FederatedRow = Record<string, unknown> & SourceTag;
-
-function parseLimit(body: FederationListRequestBody | undefined): number | undefined {
-  if (body?.limit === undefined) {
-    return undefined;
-  }
-
-  const parsed =
-    typeof body.limit === 'number'
-      ? body.limit
-      : typeof body.limit === 'string' && body.limit.trim().length > 0
-        ? Number(body.limit)
-        : Number.NaN;
-
-  if (!Number.isSafeInteger(parsed) || parsed < 1) {
-    throw new HttpException(
-      new FederationInvalidRequestError(
-        'Federation list limit must be a positive integer',
-      ).toEnvelope(),
-      400,
-    );
-  }
-
-  return parsed;
-}
-
-function parseCursor(body: FederationListRequestBody | undefined): string | undefined {
-  if (body?.cursor === undefined) {
-    return undefined;
-  }
-  if (typeof body.cursor === 'string') {
-    return body.cursor;
-  }
-  throw new HttpException(
-    new FederationInvalidRequestError('Federation list cursor must be a string').toEnvelope(),
-    400,
-  );
-}
-
-@Controller('api/federation/v1/list')
-@UseGuards(FederationAuthGuard)
-export class ListController {
-  constructor(
-    @Inject(FederationScopeService) private readonly scope: FederationScopeService,
-    @Inject(FederationListQueryService) private readonly query: FederationListQueryService,
-  ) {}
-
-  @Post(':resource')
-  async list(
-    @Param('resource') resource: string,
-    @Req() request: FastifyRequest,
-    @Body() body?: FederationListRequestBody,
-  ): Promise<FederationListResponse<FederatedRow>> {
-    if (!request.federationContext) {
-      throw new HttpException(
-        new FederationUnauthorizedError('Federation context missing').toEnvelope(),
-        401,
-      );
-    }
-
-    const requestedLimit = parseLimit(body);
-    const cursor = parseCursor(body);
-    const scopeResult = await this.scope.evaluateAccess({
-      context: request.federationContext,
-      resource,
-      requestedLimit,
-      nativeRbac: this.query,
-    });
-
-    if (!scopeResult.allowed) {
-      const ErrorClass =
-        scopeResult.deny.statusCode === 400
-          ? FederationInvalidRequestError
-          : FederationScopeViolationError;
-      throw new HttpException(
-        new ErrorClass(scopeResult.deny.message, scopeResult.deny).toEnvelope(),
-        scopeResult.deny.statusCode,
-      );
-    }
-
-    let result: Awaited<ReturnType<FederationListQueryService['list']>>;
-    try {
-      result = await this.query.list({ filter: scopeResult.filter, cursor });
-    } catch (error: unknown) {
-      if (error instanceof Error && error.message === 'Invalid federation list cursor') {
-        throw new HttpException(
-          new FederationInvalidRequestError('Federation list cursor is invalid').toEnvelope(),
-          400,
-        );
-      }
-      throw error;
-    }
-
-    const response: FederationListResponse<FederatedRow> = {
-      items: tagWithSource(result.items, SOURCE_LOCAL),
-    };
-    if (result.nextCursor !== undefined) {
-      response.nextCursor = result.nextCursor;
-    }
-    if (result.truncated) {
-      response._truncated = true;
-    }
-    return response;
-  }
-}
--- a/apps/gateway/src/gc/gc.module.ts
+++ b/apps/gateway/src/gc/gc.module.ts
@@ -1,7 +1,5 @@
-import { Module, type OnApplicationShutdown, Inject, Optional } from '@nestjs/common';
+import { Module, type OnApplicationShutdown, Inject } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import { SessionGCService } from './session-gc.service.js';
 import { REDIS } from './gc.tokens.js';

@@ -11,17 +9,13 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
  providers: [
    {
      provide: GC_QUEUE_HANDLE,
-      useFactory: (config: MosaicConfig | null): QueueHandle | null => {
-        // On Local tier there is no Redis — skip the ioredis connection entirely.
-        // The Valkey GC sweep is a no-op on Local (no session keys stored there).
-        if (config?.queue?.type === 'local') return null;
+      useFactory: (): QueueHandle => {
        return createQueue();
      },
-      inject: [MOSAIC_CONFIG],
    },
    {
      provide: REDIS,
-      useFactory: (handle: QueueHandle | null) => handle?.redis ?? null,
+      useFactory: (handle: QueueHandle) => handle.redis,
      inject: [GC_QUEUE_HANDLE],
    },
    SessionGCService,
@@ -29,13 +23,9 @@ const GC_QUEUE_HANDLE = 'GC_QUEUE_HANDLE';
  exports: [SessionGCService],
 })
 export class GCModule implements OnApplicationShutdown {
-  constructor(
-    @Optional()
-    @Inject(GC_QUEUE_HANDLE)
-    private readonly handle: QueueHandle | null,
-  ) {}
+  constructor(@Inject(GC_QUEUE_HANDLE) private readonly handle: QueueHandle) {}

  async onApplicationShutdown(): Promise<void> {
-    await this.handle?.close().catch(() => {});
+    await this.handle.close().catch(() => {});
  }
 }
--- a/apps/gateway/src/gc/session-gc.service.ts
+++ b/apps/gateway/src/gc/session-gc.service.ts
@@ -1,4 +1,4 @@
-import { Inject, Injectable, Logger, Optional, type OnModuleInit } from '@nestjs/common';
+import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -32,21 +32,11 @@ export class SessionGCService implements OnModuleInit {
  private readonly logger = new Logger(SessionGCService.name);

  constructor(
-    // On Local tier there is no Redis — the GC module provides null for this token.
-    // NOTE: if a future feature stores Redis-backed state on Local tier, this guard
-    // would silently skip GC for those keys. Revisit when that happens.
-    @Optional()
-    @Inject(REDIS)
-    private readonly redis: QueueHandle['redis'] | null,
+    @Inject(REDIS) private readonly redis: QueueHandle['redis'],
    @Inject(LOG_SERVICE) private readonly logService: LogService,
  ) {}

  onModuleInit(): void {
-    if (!this.redis) {
-      // Local tier: no Valkey — skip cold-start GC entirely (correct no-op).
-      this.logger.log('SessionGCService: Valkey GC skipped on local tier (no Redis configured)');
-      return;
-    }
    // Fire-and-forget: run full GC asynchronously so it does not block the
    // NestJS bootstrap chain.  Cold-start GC typically takes 100–500 ms
    // depending on Valkey key count; deferring it removes that latency from
@@ -70,10 +60,8 @@ export class SessionGCService implements OnModuleInit {
   * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
   * KEYS is avoided because it blocks the Valkey event loop for the full scan
   * duration, which can cause latency spikes under production key volumes.
-   * Returns empty array when Redis is not available (Local tier).
   */
  private async scanKeys(pattern: string): Promise<string[]> {
-    if (!this.redis) return [];
    const collected: string[] = [];
    let cursor = '0';
    do {
@@ -90,14 +78,12 @@ export class SessionGCService implements OnModuleInit {
  async collect(sessionId: string): Promise<GCResult> {
    const result: GCResult = { sessionId, cleaned: {} };

-    // 1. Valkey: delete all session-scoped keys (skipped on Local tier)
-    if (this.redis) {
-      const pattern = `mosaic:session:${sessionId}:*`;
-      const valkeyKeys = await this.scanKeys(pattern);
-      if (valkeyKeys.length > 0) {
-        await this.redis.del(...valkeyKeys);
-        result.cleaned.valkeyKeys = valkeyKeys.length;
-      }
+    // 1. Valkey: delete all session-scoped keys
+    const pattern = `mosaic:session:${sessionId}:*`;
+    const valkeyKeys = await this.scanKeys(pattern);
+    if (valkeyKeys.length > 0) {
+      await this.redis.del(...valkeyKeys);
+      result.cleaned.valkeyKeys = valkeyKeys.length;
    }

    // 2. PG: demote hot-tier agent_logs for this session to warm
@@ -120,7 +106,6 @@ export class SessionGCService implements OnModuleInit {
    const cleaned: GCResult[] = [];

    // 1. Find all session-scoped Valkey keys (non-blocking SCAN)
-    // Returns empty on Local tier — no Valkey session keys exist there.
    const allSessionKeys = await this.scanKeys('mosaic:session:*');

    // Extract unique session IDs from keys
@@ -151,15 +136,11 @@ export class SessionGCService implements OnModuleInit {
   */
  async fullCollect(): Promise<FullGCResult> {
    const start = Date.now();
-    let valkeyKeysCount = 0;

-    if (this.redis) {
-      // 1. Valkey: delete ALL session-scoped keys (non-blocking SCAN)
-      const sessionKeys = await this.scanKeys('mosaic:session:*');
-      if (sessionKeys.length > 0) {
-        await this.redis.del(...sessionKeys);
-      }
-      valkeyKeysCount = sessionKeys.length;
+    // 1. Valkey: delete ALL session-scoped keys (non-blocking SCAN)
+    const sessionKeys = await this.scanKeys('mosaic:session:*');
+    if (sessionKeys.length > 0) {
+      await this.redis.del(...sessionKeys);
    }

    // 2. NOTE: channel keys are NOT collected on cold start
@@ -173,7 +154,7 @@ export class SessionGCService implements OnModuleInit {
    const jobsPurged = 0;

    return {
-      valkeyKeys: valkeyKeysCount,
+      valkeyKeys: sessionKeys.length,
      logsDemoted,
      jobsPurged,
      tempFilesRemoved: 0,
--- a/apps/gateway/src/log/cron.service.ts
+++ b/apps/gateway/src/log/cron.service.ts
@@ -19,7 +19,7 @@ import type { MosaicJobData } from '../queue/queue.service.js';
@Injectable()
 export class CronService implements OnModuleInit, OnModuleDestroy {
  private readonly logger = new Logger(CronService.name);
-  private readonly registeredWorkers: Array<Worker<MosaicJobData>> = [];
+  private readonly registeredWorkers: Worker<MosaicJobData>[] = [];

  constructor(
    @Inject(SummarizationService) private readonly summarization: SummarizationService,
@@ -28,16 +28,6 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
  ) {}

  async onModuleInit(): Promise<void> {
-    // On Local tier BullMQ is disabled — skip all job scheduling.
-    // NOTE: this means summarization, tier management, and Valkey GC jobs do not
-    // run on Local installs. For a single-user local install this is acceptable.
-    // If periodic background work is needed on Local in the future, add a
-    // setInterval-based scheduler here.
-    if (!this.queueService.isEnabled()) {
-      this.logger.log('CronService: BullMQ disabled on local tier — no jobs will be scheduled');
-      return;
-    }
-
    const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
    const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
    const gcSchedule = process.env['SESSION_GC_CRON'] ?? '0 4 * * *'; // daily at 4am
@@ -52,7 +42,7 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
    const summarizationWorker = this.queueService.registerWorker(QUEUE_SUMMARIZATION, async () => {
      await this.summarization.runSummarization();
    });
-    if (summarizationWorker) this.registeredWorkers.push(summarizationWorker);
+    this.registeredWorkers.push(summarizationWorker);

    // M6-005: Tier management repeatable job
    await this.queueService.addRepeatableJob(
@@ -64,14 +54,14 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
    const tierWorker = this.queueService.registerWorker(QUEUE_TIER_MANAGEMENT, async () => {
      await this.summarization.runTierManagement();
    });
-    if (tierWorker) this.registeredWorkers.push(tierWorker);
+    this.registeredWorkers.push(tierWorker);

    // M6-004: GC repeatable job
    await this.queueService.addRepeatableJob(QUEUE_GC, 'session-gc', {}, gcSchedule);
    const gcWorker = this.queueService.registerWorker(QUEUE_GC, async () => {
      await this.sessionGC.sweepOrphans();
    });
-    if (gcWorker) this.registeredWorkers.push(gcWorker);
+    this.registeredWorkers.push(gcWorker);

    this.logger.log(
      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}", gc="${gcSchedule}"`,
--- a/apps/gateway/src/main.ts
+++ b/apps/gateway/src/main.ts
@@ -20,12 +20,10 @@ import { Logger, ValidationPipe } from '@nestjs/common';
 import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
 import helmet from '@fastify/helmet';
 import { listSsoStartupWarnings } from '@mosaicstack/auth';
-import { loadConfig } from '@mosaicstack/config';
 import { AppModule } from './app.module.js';
 import { mountAuthHandler } from './auth/auth.controller.js';
 import { mountMcpHandler } from './mcp/mcp.controller.js';
 import { McpService } from './mcp/mcp.service.js';
-import { detectAndAssertTier, TierDetectionError } from '@mosaicstack/storage';

 async function bootstrap(): Promise<void> {
  const logger = new Logger('Bootstrap');
@@ -34,20 +32,6 @@ async function bootstrap(): Promise<void> {
    throw new Error('BETTER_AUTH_SECRET is required');
  }

-  // Pre-flight: assert all external services required by the configured tier
-  // are reachable. Runs before NestFactory.create() so failures are visible
-  // immediately with actionable remediation hints.
-  const mosaicConfig = loadConfig();
-  try {
-    await detectAndAssertTier(mosaicConfig);
-  } catch (err) {
-    if (err instanceof TierDetectionError) {
-      logger.error(`Tier detection failed: ${err.message}`);
-      logger.error(`Remediation: ${err.remediation}`);
-    }
-    throw err;
-  }
-
  for (const warning of listSsoStartupWarnings()) {
    logger.warn(warning);
  }
--- a/apps/gateway/src/preferences/system-override.service.ts
+++ b/apps/gateway/src/preferences/system-override.service.ts
@@ -1,7 +1,5 @@
-import { Inject, Injectable, Logger, Optional, type OnApplicationShutdown } from '@nestjs/common';
+import { Injectable, Logger } from '@nestjs/common';
 import { createQueue, type QueueHandle } from '@mosaicstack/queue';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { MOSAIC_CONFIG } from '../config/config.module.js';

 const SESSION_SYSTEM_KEY = (sessionId: string) => `mosaic:session:${sessionId}:system`;
 const SESSION_SYSTEM_FRAGMENTS_KEY = (sessionId: string) =>
@@ -13,54 +11,16 @@ interface OverrideFragment {
  addedAt: number;
 }

-interface LocalOverrideEntry {
-  condensed: string;
-  fragments: OverrideFragment[];
-}
-
@Injectable()
-export class SystemOverrideService implements OnApplicationShutdown {
+export class SystemOverrideService {
  private readonly logger = new Logger(SystemOverrideService.name);
-  private readonly handle: QueueHandle | null;
-  /**
-   * In-memory fallback used on Local tier (no Redis).
-   * NOTE: state is ephemeral — lost on restart. For Local single-user installs
-   * this is acceptable; system overrides are re-applied at the next session.
-   * This is a deliberate behavior change from the Redis-backed 7-day TTL.
-   */
-  private readonly localStore = new Map<string, LocalOverrideEntry>();
+  private readonly handle: QueueHandle;

-  constructor(
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
-  ) {
-    if (this.mosaicConfig?.queue?.type === 'local') {
-      this.handle = null;
-    } else {
-      this.handle = createQueue();
-    }
-  }
-
-  async onApplicationShutdown(): Promise<void> {
-    // On non-local tiers the constructor opens an ioredis connection; close it
-    // on graceful shutdown to avoid leaking the handle (local tier is null).
-    await this.handle?.close().catch(() => {});
+  constructor() {
+    this.handle = createQueue();
  }

  async set(sessionId: string, override: string): Promise<void> {
-    if (!this.handle) {
-      // Local tier: in-memory path
-      const entry = this.localStore.get(sessionId) ?? { condensed: '', fragments: [] };
-      entry.fragments.push({ text: override, addedAt: Date.now() });
-      entry.condensed = await this.condenseOverrides(entry.fragments.map((f) => f.text));
-      this.localStore.set(sessionId, entry);
-      this.logger.debug(
-        `Set system override for session ${sessionId} (local, ${entry.fragments.length} fragment(s))`,
-      );
-      return;
-    }
-
    // Load existing fragments
    const existing = await this.handle.redis.get(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId));
    const fragments: OverrideFragment[] = existing
@@ -90,17 +50,10 @@ export class SystemOverrideService implements OnApplicationShutdown {
  }

  async get(sessionId: string): Promise<string | null> {
-    if (!this.handle) {
-      return this.localStore.get(sessionId)?.condensed ?? null;
-    }
    return this.handle.redis.get(SESSION_SYSTEM_KEY(sessionId));
  }

  async renew(sessionId: string): Promise<void> {
-    if (!this.handle) {
-      // Local tier: no TTL to renew; entry persists until restart
-      return;
-    }
    const pipeline = this.handle.redis.pipeline();
    pipeline.expire(SESSION_SYSTEM_KEY(sessionId), SYSTEM_OVERRIDE_TTL_SECONDS);
    pipeline.expire(SESSION_SYSTEM_FRAGMENTS_KEY(sessionId), SYSTEM_OVERRIDE_TTL_SECONDS);
@@ -108,11 +61,6 @@ export class SystemOverrideService implements OnApplicationShutdown {
  }

  async clear(sessionId: string): Promise<void> {
-    if (!this.handle) {
-      this.localStore.delete(sessionId);
-      this.logger.debug(`Cleared system override for session ${sessionId} (local)`);
-      return;
-    }
    await this.handle.redis.del(
      SESSION_SYSTEM_KEY(sessionId),
      SESSION_SYSTEM_FRAGMENTS_KEY(sessionId),
--- a/apps/gateway/src/queue/queue.service.spec.ts
+++ b/apps/gateway/src/queue/queue.service.spec.ts
@@ -1,35 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { MosaicConfig } from '@mosaicstack/config';
-import { QueueService } from './queue.service.js';
-
-const localConfig = {
-  queue: { type: 'local' },
-} as MosaicConfig;
-
-describe('QueueService local tier', () => {
-  it('disables BullMQ and treats queue operations as local no-ops', async () => {
-    const service = new QueueService(null, localConfig);
-
-    expect(service.isEnabled()).toBe(false);
-    expect(service.getQueue('mosaic-test')).toBeNull();
-    expect(service.registerWorker('mosaic-test', vi.fn())).toBeNull();
-
-    await expect(
-      service.addRepeatableJob('mosaic-test', 'local-noop', {}, '* * * * *'),
-    ).resolves.toBeUndefined();
-    await expect(service.getHealthStatus()).resolves.toEqual({ queues: {}, healthy: true });
-    await expect(service.listJobs()).resolves.toEqual([]);
-    await expect(service.retryJob('mosaic-test__1')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.pauseQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-    await expect(service.resumeQueue('mosaic-test')).resolves.toEqual({
-      ok: false,
-      message: 'BullMQ is disabled on local tier.',
-    });
-  });
-});
--- a/apps/gateway/src/queue/queue.service.ts
+++ b/apps/gateway/src/queue/queue.service.ts
@@ -8,9 +8,7 @@ import {
 } from '@nestjs/common';
 import { Queue, Worker, type Job, type ConnectionOptions } from 'bullmq';
 import type { LogService } from '@mosaicstack/log';
-import type { MosaicConfig } from '@mosaicstack/config';
 import { LOG_SERVICE } from '../log/log.tokens.js';
-import { MOSAIC_CONFIG } from '../config/config.module.js';
 import type { JobDto, JobStatus } from './queue-admin.dto.js';

 // ---------------------------------------------------------------------------
@@ -110,42 +108,21 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
  private readonly connection: ConnectionOptions;
  private readonly queues = new Map<string, Queue<MosaicJobData>>();
  private readonly workers = new Map<string, Worker<MosaicJobData>>();
-  /** False on Local tier — BullMQ/Redis operations become no-ops. */
-  private readonly enabled: boolean;

  constructor(
    @Optional()
    @Inject(LOG_SERVICE)
    private readonly logService: LogService | null,
-    @Optional()
-    @Inject(MOSAIC_CONFIG)
-    private readonly mosaicConfig: MosaicConfig | null,
  ) {
-    this.enabled = this.mosaicConfig?.queue?.type !== 'local';
-    this.connection = this.enabled
-      ? getConnection()
-      : ({ host: '127.0.0.1', port: 6380 } as ConnectionOptions);
-  }
-
-  /** Returns true when BullMQ/Redis is active (Standalone and Federated tiers). */
-  isEnabled(): boolean {
-    return this.enabled;
+    this.connection = getConnection();
  }

  onModuleInit(): void {
-    if (this.enabled) {
-      this.logger.log('QueueService initialised (BullMQ)');
-    } else {
-      this.logger.log(
-        'QueueService: BullMQ disabled for local tier — no Redis connections will be opened',
-      );
-    }
+    this.logger.log('QueueService initialised (BullMQ)');
  }

  async onModuleDestroy(): Promise<void> {
-    if (this.enabled) {
-      await this.closeAll();
-    }
+    await this.closeAll();
  }

  // -------------------------------------------------------------------------
@@ -154,10 +131,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {

  /**
   * Get or create a BullMQ Queue for the given queue name.
-   * Returns null on Local tier where BullMQ is disabled.
   */
-  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> | null {
-    if (!this.enabled) return null;
+  getQueue<T extends MosaicJobData = MosaicJobData>(name: string): Queue<T> {
    let queue = this.queues.get(name) as Queue<T> | undefined;
    if (!queue) {
      queue = new Queue<T>(name, { connection: this.connection });
@@ -169,7 +144,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
  /**
   * Add a BullMQ repeatable job (cron-style).
   * Uses `jobId` as a deterministic key so duplicate registrations are idempotent.
-   * No-op on Local tier.
   */
  async addRepeatableJob<T extends MosaicJobData>(
    queueName: string,
@@ -177,13 +151,7 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
    data: T,
    cronExpression: string,
  ): Promise<void> {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping repeatable job "${jobName}" on "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return;
-    }
-    const queue = this.getQueue<T>(queueName)!;
+    const queue = this.getQueue<T>(queueName);
    // eslint-disable-next-line @typescript-eslint/no-explicit-any
    await (queue as Queue<any>).add(jobName, data, {
      repeat: { pattern: cronExpression },
@@ -197,18 +165,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
  /**
   * Register a Worker for the given queue name with error handling and
   * exponential backoff.
-   * Returns null on Local tier where BullMQ is disabled.
   */
-  registerWorker<T extends MosaicJobData>(
-    queueName: string,
-    handler: JobHandler<T>,
-  ): Worker<T> | null {
-    if (!this.enabled) {
-      this.logger.debug(
-        `Skipping worker registration for "${queueName}" (local tier — BullMQ disabled)`,
-      );
-      return null;
-    }
+  registerWorker<T extends MosaicJobData>(queueName: string, handler: JobHandler<T>): Worker<T> {
    const worker = new Worker<T>(
      queueName,
      async (job) => {
@@ -265,12 +223,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {

  /**
   * Return queue health statistics for all managed queues.
-   * Returns an empty healthy result on Local tier.
   */
  async getHealthStatus(): Promise<QueueHealthStatus> {
-    if (!this.enabled) {
-      return { queues: {}, healthy: true };
-    }
    const queues: QueueHealthStatus['queues'] = {};
    let healthy = true;

@@ -301,10 +255,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
  /**
   * List jobs across all managed queues, optionally filtered by status.
   * BullMQ jobs are fetched by state type from each queue.
-   * Returns empty array on Local tier.
   */
  async listJobs(status?: JobStatus): Promise<JobDto[]> {
-    if (!this.enabled) return [];
    const jobs: JobDto[] = [];
    const states: JobStatus[] = status
      ? [status]
@@ -331,10 +283,8 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   * Retry a specific failed job by its BullMQ job ID (format: "queueName:id").
   * The caller passes "<queueName>__<jobId>" as the composite ID because BullMQ
   * job IDs are not globally unique — they are scoped to their queue.
-   * Returns an error on Local tier.
   */
  async retryJob(compositeId: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
    const sep = compositeId.lastIndexOf('__');
    if (sep === -1) {
      return { ok: false, message: 'Invalid job id format. Expected "<queue>__<jobId>".' };
@@ -366,7 +316,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   * Pause a queue by name.
   */
  async pauseQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
    const queue = this.queues.get(name);
    if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
    await queue.pause();
@@ -378,7 +327,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
   * Resume a paused queue by name.
   */
  async resumeQueue(name: string): Promise<{ ok: boolean; message: string }> {
-    if (!this.enabled) return { ok: false, message: 'BullMQ is disabled on local tier.' };
    const queue = this.queues.get(name);
    if (!queue) return { ok: false, message: `Queue "${name}" not found.` };
    await queue.resume();
--- a/deploy/portainer/README.md
+++ b/deploy/portainer/README.md
@@ -1,70 +0,0 @@
-# deploy/portainer/
-
-Portainer stack templates for Mosaic Stack deployments.
-
-## Files
-
-| File                       | Purpose                                                                                                        |
-| -------------------------- | -------------------------------------------------------------------------------------------------------------- |
-| `federated-test.stack.yml` | Docker Swarm stack for federation end-to-end test instances (`mos-test-1.woltje.com`, `mos-test-2.woltje.com`) |
-
---
-
-## federated-test.stack.yml
-
-A self-contained Swarm stack that boots a federated-tier Mosaic gateway with co-located Postgres 17 (pgvector) and Valkey 8. This is a **test template** — production deployments will use a separate template with stricter resource limits and Docker secrets.
-
-### Deploy via Portainer UI
-
-1. Log into Portainer.
-2. Navigate to **Stacks → Add stack**.
-3. Set a stack name matching `STACK_NAME` below (e.g. `mos-test-1`).
-4. Choose **Web editor** and paste the contents of `federated-test.stack.yml`.
-5. Scroll to **Environment variables** and add each variable listed below.
-6. Click **Deploy the stack**.
-
-### Required environment variables
-
-| Variable             | Example                                 | Notes                                                    |
-| -------------------- | --------------------------------------- | -------------------------------------------------------- |
-| `STACK_NAME`         | `mos-test-1`                            | Unique per stack — used in Traefik router/service names. |
-| `HOST_FQDN`          | `mos-test-1.woltje.com`                 | Fully-qualified hostname served by this stack.           |
-| `POSTGRES_PASSWORD`  | _(generate randomly)_                   | Database password. Do **not** reuse between stacks.      |
-| `BETTER_AUTH_SECRET` | _(generate: `openssl rand -base64 32`)_ | BetterAuth session signing key.                          |
-| `BETTER_AUTH_URL`    | `https://mos-test-1.woltje.com`         | Public base URL of the gateway.                          |
-
-Optional variables (uncomment in the YAML or set in Portainer):
-
-| Variable                      | Notes                                                      |
-| ----------------------------- | ---------------------------------------------------------- |
-| `ANTHROPIC_API_KEY`           | Enable Claude models.                                      |
-| `OPENAI_API_KEY`              | Enable OpenAI models.                                      |
-| `OTEL_EXPORTER_OTLP_ENDPOINT` | Forward traces to a collector (e.g. `http://jaeger:4318`). |
-
-### Required external resources
-
-Before deploying, ensure the following exist on the Swarm:
-
-1. **`traefik-public` overlay network** — shared network Traefik uses to route traffic to stacks.
-   ```bash
-   docker network create --driver overlay --attachable traefik-public
-   ```
-2. **`letsencrypt` cert resolver** — configured in the Traefik Swarm stack. The stack template references `tls.certresolver=letsencrypt`; the name must match your Traefik config.
-3. **DNS A record** — `${HOST_FQDN}` must resolve to the Swarm ingress IP (or a Cloudflare-proxied address pointing there).
-
-### Deployed instances
-
-| Stack name   | HOST_FQDN               | Purpose                            |
-| ------------ | ----------------------- | ---------------------------------- |
-| `mos-test-1` | `mos-test-1.woltje.com` | DEPLOY-03 — first federation peer  |
-| `mos-test-2` | `mos-test-2.woltje.com` | DEPLOY-04 — second federation peer |
-
-### Image
-
-The gateway image is pinned by digest to `fed-v0.1.0-m1` (verified in DEPLOY-01). Update the digest in the YAML when promoting a new build — never use `:latest` or a mutable tag in Swarm.
-
-### Notes
-
- This template boots a **vanilla M1-baseline gateway** in federated tier. Federation grants (Step-CA, mTLS) are M2+ scope and not included here.
- Each stack gets its own Postgres volume (`postgres-data`) and Valkey volume (`valkey-data`) scoped to the stack name by Swarm.
- `depends_on` is honoured by Compose but ignored by Swarm — healthchecks on Postgres and Valkey ensure the gateway retries until they are ready.
--- a/deploy/portainer/federated-test.stack.yml
+++ b/deploy/portainer/federated-test.stack.yml
@@ -1,160 +0,0 @@
-# deploy/portainer/federated-test.stack.yml
-#
-# Portainer / Docker Swarm stack template — federated-tier test instance
-#
-# PURPOSE
-#   Deploys a single federated-tier Mosaic gateway with co-located Postgres
-#   (pgvector) and Valkey for end-to-end federation testing. Intended for
-#   mos-test-1.woltje.com and mos-test-2.woltje.com (DEPLOY-03/04).
-#
-# REQUIRED ENV VARS (set per-stack in Portainer → Stacks → Environment variables)
-#   STACK_NAME          Unique name for Traefik router/service labels.
-#                       Examples: mos-test-1, mos-test-2
-#   HOST_FQDN           Fully-qualified domain name served by this stack.
-#                       Examples: mos-test-1.woltje.com, mos-test-2.woltje.com
-#   POSTGRES_PASSWORD   Database password — set per stack; do NOT commit a default.
-#   BETTER_AUTH_SECRET  Random 32-char string for BetterAuth session signing.
-#                       Generate: openssl rand -base64 32
-#   BETTER_AUTH_URL     Public gateway base URL, e.g. https://mos-test-1.woltje.com
-#
-# OPTIONAL ENV VARS (uncomment and set in Portainer to enable features)
-#   ANTHROPIC_API_KEY   sk-ant-...
-#   OPENAI_API_KEY      sk-...
-#   OTEL_EXPORTER_OTLP_ENDPOINT  http://<collector>:4318
-#   OTEL_SERVICE_NAME   (default: mosaic-gateway)
-#
-# REQUIRED EXTERNAL RESOURCES
-#   traefik-public      Docker overlay network — must exist before deploying.
-#                       Create: docker network create --driver overlay --attachable traefik-public
-#   letsencrypt         Traefik cert resolver configured on the Swarm manager.
-#   DNS A record        ${HOST_FQDN} → Swarm ingress IP (or Cloudflare proxy).
-#
-# IMAGE
-#   Pinned to sha-9f1a081 (main HEAD post-#488 Dockerfile fix). The previous
-#   pin (fed-v0.1.0-m1, sha256:9b72e2...) had a broken pnpm copy and could
-#   not resolve @mosaicstack/storage at runtime. The new digest was smoke-
-#   tested locally — gateway boots, imports resolve, tier-detector runs.
-#   Update digest here when promoting a new build.
-#
-# HEALTHCHECK NOTE (2026-04-21)
-#   Switched from busybox wget to node http.get on 127.0.0.1 (not localhost) to
-#   avoid IPv6 resolution issues on Alpine. Retries increased to 5 and
-#   start_period to 60s to cover the NestJS/GC cold-start window (~40-50s).
-#   restart_policy set to `any` so SIGTERM/clean-exit also triggers restart.
-#
-# NOTE: This is a TEST template — production deployments use a separate
-#       parameterised template with stricter resource limits and secrets.
-
-version: '3.9'
-
-services:
-  gateway:
-    image: git.mosaicstack.dev/mosaicstack/stack/gateway@sha256:1069117740e00ccfeba357cae38c43f3729fe5ae702740ce474f6512414d7c02
-    # Tag for human reference: sha-9f1a081 (post-#488 Dockerfile fix; smoke-tested locally)
-    environment:
-      # ── Tier ───────────────────────────────────────────────────────────────
-      MOSAIC_TIER: federated
-
-      # ── Database ───────────────────────────────────────────────────────────
-      DATABASE_URL: postgres://gateway:${POSTGRES_PASSWORD}@postgres:5432/mosaic
-
-      # ── Queue ──────────────────────────────────────────────────────────────
-      VALKEY_URL: redis://valkey:6379
-
-      # ── Gateway ────────────────────────────────────────────────────────────
-      GATEWAY_PORT: '3000'
-      GATEWAY_CORS_ORIGIN: https://${HOST_FQDN}
-
-      # ── Auth ───────────────────────────────────────────────────────────────
-      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
-      BETTER_AUTH_URL: https://${HOST_FQDN}
-
-      # ── Observability ──────────────────────────────────────────────────────
-      OTEL_SERVICE_NAME: ${STACK_NAME:-mosaic-gateway}
-      # OTEL_EXPORTER_OTLP_ENDPOINT: http://<collector>:4318
-
-      # ── AI Providers (uncomment to enable) ─────────────────────────────────
-      # ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
-      # OPENAI_API_KEY: ${OPENAI_API_KEY}
-    networks:
-      - federated-test
-      - traefik-public
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: any
-        delay: 5s
-        max_attempts: 3
-      labels:
-        - 'traefik.enable=true'
-        - 'traefik.docker.network=traefik-public'
-        - 'traefik.http.routers.${STACK_NAME}.rule=Host(`${HOST_FQDN}`)'
-        - 'traefik.http.routers.${STACK_NAME}.entrypoints=websecure'
-        - 'traefik.http.routers.${STACK_NAME}.tls=true'
-        - 'traefik.http.routers.${STACK_NAME}.tls.certresolver=letsencrypt'
-        - 'traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000'
-    healthcheck:
-      test:
-        - 'CMD'
-        - 'node'
-        - '-e'
-        - "require('http').get('http://127.0.0.1:3000/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 60s
-    depends_on:
-      - postgres
-      - valkey
-
-  postgres:
-    image: pgvector/pgvector:pg17
-    environment:
-      POSTGRES_USER: gateway
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: mosaic
-    volumes:
-      - postgres-data:/var/lib/postgresql/data
-    networks:
-      - federated-test
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U gateway']
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 10s
-
-  valkey:
-    image: valkey/valkey:8-alpine
-    volumes:
-      - valkey-data:/data
-    networks:
-      - federated-test
-    deploy:
-      replicas: 1
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-        max_attempts: 3
-    healthcheck:
-      test: ['CMD', 'valkey-cli', 'ping']
-      interval: 10s
-      timeout: 3s
-      retries: 5
-      start_period: 5s
-
-volumes:
-  postgres-data:
-  valkey-data:
-
-networks:
-  federated-test:
-    driver: overlay
-  traefik-public:
-    external: true
--- a/docker-compose.federated.yml
+++ b/docker-compose.federated.yml
@@ -1,120 +0,0 @@
-# docker-compose.federated.yml — Federated tier overlay
-#
-# USAGE:
-#   docker compose -f docker-compose.federated.yml --profile federated up -d
-#
-# This file is a standalone overlay for the Mosaic federated tier.
-# It is NOT an extension of docker-compose.yml — it defines its own services
-# and named volumes so it can run independently of the base dev stack.
-#
-# IMPORTANT — HOST PORT CONFLICTS:
-#   The federated services bind the same host ports as the base dev stack
-#   (5433 for Postgres, 6380 for Valkey). You must stop the base dev stack
-#   before starting the federated stack on the same machine:
-#     docker compose down
-#     docker compose -f docker-compose.federated.yml --profile federated up -d
-#
-# pgvector extension:
-#   The vector extension is created automatically at first boot via
-#   ./infra/pg-init/01-extensions.sql (CREATE EXTENSION IF NOT EXISTS vector).
-#
-# Tier configuration:
-#   Used by `mosaic` instances configured with `tier: federated`.
-#   DEFAULT_FEDERATED_CONFIG points at:
-#     postgresql://mosaic:mosaic@localhost:5433/mosaic
-
-services:
-  postgres-federated:
-    image: pgvector/pgvector:pg17
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${PG_FEDERATED_HOST_PORT:-5433}:5432'
-    environment:
-      POSTGRES_USER: mosaic
-      POSTGRES_PASSWORD: mosaic
-      POSTGRES_DB: mosaic
-    volumes:
-      - pg_federated_data:/var/lib/postgresql/data
-      - ./infra/pg-init:/docker-entrypoint-initdb.d:ro
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U mosaic']
-      interval: 5s
-      timeout: 3s
-      retries: 5
-
-  valkey-federated:
-    image: valkey/valkey:8-alpine
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${VALKEY_FEDERATED_HOST_PORT:-6380}:6379'
-    volumes:
-      - valkey_federated_data:/data
-    healthcheck:
-      test: ['CMD', 'valkey-cli', 'ping']
-      interval: 5s
-      timeout: 3s
-      retries: 5
-
-  # ---------------------------------------------------------------------------
-  # Step-CA — Mosaic Federation internal certificate authority
-  #
-  # Image: pinned to 0.27.4 (latest stable as of late 2025).
-  # `latest` is forbidden per Mosaic image policy (immutable tag required for
-  # reproducible deployments and digest-first promotion in CI).
-  #
-  # Profile: `federated` — this service must not start in non-federated dev.
-  #
-  # Password:
-  #   Dev:  bind-mount ./infra/step-ca/dev-password (gitignored; copy from
-  #         ./infra/step-ca/dev-password.example and customise locally).
-  #   Prod: replace the bind-mount with a Docker secret:
-  #           secrets:
-  #             ca_password:
-  #               external: true
-  #         and reference it as `/run/secrets/ca_password` (same path the
-  #         init script already uses).
-  #
-  # Provisioner: "mosaic-fed" (consumed by apps/gateway/src/federation/ca.service.ts)
-  # ---------------------------------------------------------------------------
-  step-ca:
-    image: smallstep/step-ca:0.27.4
-    profiles: [federated]
-    restart: unless-stopped
-    ports:
-      - '${STEP_CA_HOST_PORT:-9000}:9000'
-    volumes:
-      - step_ca_data:/home/step
-      # init script — executed as the container entrypoint
-      - ./infra/step-ca/init.sh:/usr/local/bin/mosaic-step-ca-init.sh:ro
-      # X.509 template skeleton (wired in M2-04)
-      - ./infra/step-ca/templates:/etc/step-ca-templates:ro
-      # Dev password file — GITIGNORED; copy from dev-password.example
-      # In production, replace this with a Docker secret (see comment above).
-      - ./infra/step-ca/dev-password:/run/secrets/ca_password:ro
-    entrypoint: ['/bin/sh', '/usr/local/bin/mosaic-step-ca-init.sh']
-    healthcheck:
-      # The healthcheck requires the root cert to exist, which is only true
-      # after init.sh has completed on first boot. start_period gives init
-      # time to finish before Docker starts counting retries.
-      test:
-        [
-          'CMD',
-          'step',
-          'ca',
-          'health',
-          '--ca-url',
-          'https://localhost:9000',
-          '--root',
-          '/home/step/certs/root_ca.crt',
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-
-volumes:
-  pg_federated_data:
-  valkey_federated_data:
-  step_ca_data:
--- a/docker/appservice.Dockerfile
+++ b/docker/appservice.Dockerfile
@@ -1,28 +0,0 @@
-FROM node:22-alpine AS base
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
-RUN corepack enable
-
-FROM base AS builder
-WORKDIR /app
-# Copy workspace manifests first for layer-cached install
-COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
-COPY apps/appservice/package.json ./apps/appservice/
-COPY packages/ ./packages/
-COPY plugins/ ./plugins/
-RUN pnpm install --frozen-lockfile
-COPY . .
-RUN pnpm turbo run build --filter @mosaicstack/mosaic-as...
-RUN pnpm --filter @mosaicstack/mosaic-as --prod deploy --legacy /deploy
-
-FROM base AS runner
-WORKDIR /app
-ENV NODE_ENV=production
-COPY --from=builder /deploy/node_modules ./node_modules
-COPY --from=builder /deploy/package.json ./package.json
-COPY --from=builder /app/apps/appservice/dist ./dist
-USER node
-EXPOSE 8008
-HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=5 \
-  CMD ["node", "-e", "require('http').get('http://127.0.0.1:8008/health',r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]
-CMD ["node", "dist/main.js"]
--- a/docker/gateway.Dockerfile
+++ b/docker/gateway.Dockerfile
@@ -5,27 +5,18 @@ RUN corepack enable

 FROM base AS builder
 WORKDIR /app
-# Copy workspace manifests first for layer-cached install
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/gateway/package.json ./apps/gateway/
 COPY packages/ ./packages/
-COPY plugins/ ./plugins/
 RUN pnpm install --frozen-lockfile
 COPY . .
-# Build gateway and all of its workspace dependencies via turbo dependency graph
-RUN pnpm turbo run build --filter @mosaicstack/gateway...
-# Produce a self-contained deploy artifact: flat node_modules, no pnpm symlinks
-# --legacy is required for pnpm v10 when inject-workspace-packages is not set
-RUN pnpm --filter @mosaicstack/gateway --prod deploy --legacy /deploy
+RUN pnpm --filter @mosaic/gateway build

 FROM base AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-# Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
-COPY --from=builder /deploy/node_modules ./node_modules
-COPY --from=builder /deploy/package.json ./package.json
-# dist is declared in package.json "files" so pnpm deploy copies it into /deploy;
-# copy from builder explicitly as belt-and-suspenders
 COPY --from=builder /app/apps/gateway/dist ./dist
+COPY --from=builder /app/apps/gateway/package.json ./package.json
+COPY --from=builder /app/node_modules ./node_modules
 EXPOSE 4000
 CMD ["node", "dist/main.js"]
--- a/docs/MISSION-MANIFEST.md
+++ b/docs/MISSION-MANIFEST.md
@@ -1,116 +1,73 @@
-# Mission Manifest — MVP
+# Mission Manifest — Install UX v2

-> Top-level rollup tracking Mosaic Stack MVP execution.
-> Workstreams have their own manifests; this document is the source of truth for MVP scope, status, and history.
-> Owner: Orchestrator (sole writer).
+> Persistent document tracking full mission scope, status, and session history.
+> Updated by the orchestrator at each phase transition and milestone completion.

 ## Mission

-**ID:** mvp-20260312
-**Statement:** Ship a self-hosted, multi-user AI agent platform that consolidates the user's disparate jarvis-brain usage across home and USC workstations into a single coherent system reachable via three first-class surfaces — webUI, TUI, and CLI — with federation as the data-layer mechanism that makes cross-host agent sessions work in real time without copying user data across the boundary.
-**Phase:** Execution (workstream W1 in planning-complete state)
-**Current Workstream:** W1 — Federation v1
-**Progress:** 0 / 1 declared workstreams complete (more workstreams will be declared as scope is refined)
-**Status:** active (continuous since 2026-03-13)
-**Last Updated:** 2026-04-19 (manifest authored at the rollup level; install-ux-v2 archived; W1 federation planning landed via PR #468)
-**Source PRD:** [docs/PRD.md](./PRD.md) — Mosaic Stack v0.1.0
-**Scratchpad:** [docs/scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md) (active since 2026-03-13; 14 prior sessions of phase-based execution)
+**ID:** install-ux-v2-20260405
+**Statement:** The install-ux-hardening mission shipped the plumbing (uninstall, masked password, hooks consent, unified flow, headless path), but the first real end-to-end run surfaced a critical regression and a collection of UX failings that make the wizard feel neither quick nor intelligent. This mission closes the bootstrap regression as a hotfix, then rethinks the first-run experience around a provider-first, intent-driven flow with a drill-down main menu and a genuinely fast quick-start.
+**Phase:** Planning
+**Current Milestone:** IUV-M01
+**Progress:** 0 / 3 milestones
+**Status:** active
+**Last Updated:** 2026-04-05
+**Parent Mission:** [install-ux-hardening-20260405](./archive/missions/install-ux-hardening-20260405/MISSION-MANIFEST.md) (complete — `mosaic-v0.0.25`)

 ## Context

-Jarvis (v0.2.0) was a single-host Python/Next.js assistant. The user runs sessions across 3–4 workstations split between home and USC. Today every session reaches back to a single jarvis-brain checkout, which is brittle (offline-hostile, no consolidation, no shared state beyond a single repo). A prior OpenBrain attempt punished offline use, introduced cache/latency/opacity pain, and tightly coupled every session to a remote service.
+Real-run testing of `@mosaicstack/mosaic@0.0.25` uncovered:

-The MVP solution: keep each user's home gateway as the source of truth, connect gateways gateway-to-gateway over mTLS with scoped read-only data exposure, and expose the unified experience through three coherent surfaces:
-
- **webUI** — the primary visual control plane (Next.js + React 19, `apps/web`)
- **TUI** — the terminal-native interface for agent work (`packages/mosaic` wizard + Pi TUI)
- **CLI** — `mosaic` command for scripted/headless workflows
-
-Federation is required NOW because it unblocks cross-host consolidation; it is necessary but not sufficient for MVP. Additional workstreams will be declared as their scope solidifies.
-
-## Prior Execution (March 13 → April 5)
-
-This manifest was authored on 2026-04-19 to rollup work that began 2026-03-13. Before this date, MVP work was tracked via phase-based Gitea milestones and the scratchpad — there was no rollup manifest at the `docs/MISSION-MANIFEST.md` path (the slot was occupied by sub-mission manifests for `install-ux-hardening` and then `install-ux-v2`).
-
-Prior execution outline (full detail in [scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md)):
-
- **Phases 0 → 7** (Gitea milestones `ms-157` → `ms-164`, issues #1–#59): foundation, core API, agent layer, web dashboard, memory, remote control, CLI/tools, polish/beta. Substantially shipped by Session 13.
- **Phase 8** (Gitea milestone `ms-165`, issues #160–#172): platform architecture extension — teams, workspaces, `/provider` OAuth, preferences, etc. Wave-based execution plan defined at Session 14.
- **Sub-missions** during the gap: `install-ux-hardening` (complete, `mosaic-v0.0.25`), `install-ux-v2` (complete on 2026-04-19, `0.0.27` → `0.0.29`). Both archived under `docs/archive/missions/`.
-
-Going forward, MVP execution is tracked through the **Workstreams** table below. Phase-based issue numbering is preserved on Gitea but is no longer the primary control plane.
-
-## Cross-Cutting MVP Requirements
-
-These apply to every workstream and every milestone. A workstream cannot ship if it breaks any of them.
-
-| #      | Requirement                                                                                                                                                                      |
-| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| MVP-X1 | Three-surface parity: every user-facing capability is reachable via webUI **and** TUI **and** CLI (read paths at minimum; mutating paths where applicable to the surface).       |
-| MVP-X2 | Multi-tenant isolation is enforced at every boundary; no cross-user leakage under any circumstance.                                                                              |
-| MVP-X3 | Auth via BetterAuth (existing); SSO adapters per PRD; admin bootstrap remains a one-shot.                                                                                        |
-| MVP-X4 | Three quality gates green before push: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`.                                                                                       |
-| MVP-X5 | Federated tier (PG + pgvector + Valkey) is the canonical MVP deployment topology; local/standalone tiers continue to work for non-federated installs but are not the MVP target. |
-| MVP-X6 | OTEL tracing on every request path; `traceparent` propagated across the federation boundary in both directions.                                                                  |
-| MVP-X7 | Trunk merge strategy: branch from `main`, squash-merge via PR, never push to `main` directly.                                                                                    |
+1. **Critical:** admin bootstrap fails with HTTP 400 `property email should not exist` — `bootstrap.controller.ts` uses `import type { BootstrapSetupDto }`, erasing the class at runtime. Nest's `@Body()` falls back to plain `Object` metatype, and ValidationPipe with `forbidNonWhitelisted` rejects every property. One-character fix (drop the `type` keyword), but it blocks the happy path of the release that just shipped.
+2. The wizard reports `✔ Wizard complete` and `✔ Done` _after_ the bootstrap 400 — failure only propagates in headless mode (`wizard.ts:147`).
+3. The gateway port prompt does not prefill `14242` in the input buffer.
+4. `"What is Mosaic?"` intro copy does not mention Pi SDK (the actual agent runtime behind Claude/Codex/OpenCode).
+5. CORS origin prompt is confusing — the user should be able to supply an FQDN/hostname and have the system derive the CORS value.
+6. Skill / additional feature install section is unusable in practice.
+7. Quick-start asks far too many questions to be meaningfully "quick".
+8. No drill-down main menu — everything is a linear interrogation.
+9. Provider setup happens late and without intelligence. An OpenClaw-style provider-first flow would let the user describe what they want in natural language, have the agent expound on it, and have the agent choose its own name based on that intent.

 ## Success Criteria

-The MVP is complete when ALL declared workstreams are complete AND every cross-cutting requirement is verifiable on a live two-host deployment (woltje.com ↔ uscllc.com).
+- [ ] AC-1: Admin bootstrap completes successfully end-to-end on a fresh install (DTO value import, no forbidNonWhitelisted regression); covered by an integration or e2e test that exercises the real DTO binding.
+- [ ] AC-2: Wizard fails loudly (non-zero exit, clear error) when the bootstrap stage returns `completed: false`, in both interactive and headless modes. No more silent `✔ Wizard complete` after a 400.
+- [ ] AC-3: Gateway port prompt prefills `14242` in the input field (user can press Enter to accept).
+- [ ] AC-4: `"What is Mosaic?"` intro copy mentions Pi SDK as the underlying agent runtime.
+- [ ] AC-5: Release `mosaic-v0.0.26` tagged and published to the Gitea npm registry, unblocking the 0.0.25 happy path.
+- [ ] AC-6: CORS origin prompt replaced with FQDN/hostname input; CORS string is derived from that.
+- [ ] AC-7: Skill / additional feature install section is reworked until it is actually usable end-to-end (worker defines the concrete failure modes during diagnosis).
+- [ ] AC-8: First-run flow has a drill-down main menu with at least `Plugins` (Recommended / Custom), `Providers`, and the other top-level configuration groups. Linear interrogation is gone.
+- [ ] AC-9: `Quick Start` path completes with a minimal, curated set of questions (target: under 90 seconds for a returning user; define the exact baseline during design).
+- [ ] AC-10: Provider setup happens first, driven by a natural-language intake prompt. The agent expounds on the user's intent and chooses its own name based on that intent (OpenClaw-style). Naming is confirmable / overridable.
+- [ ] AC-11: All milestones ship as merged PRs with green CI and closed issues.

- [ ] AC-MVP-1: All declared workstreams reach `complete` status with merged PRs and green CI
- [ ] AC-MVP-2: A user session on the home gateway can transparently query work-gateway data subject to scope, with no data persisted across the boundary
- [ ] AC-MVP-3: The same user-facing capability is reachable from webUI, TUI, and CLI (per MVP-X1)
- [ ] AC-MVP-4: Two-gateway production deployment (woltje.com ↔ uscllc.com) operational ≥7 days without incident
- [ ] AC-MVP-5: All cross-cutting requirements (MVP-X1 → MVP-X7) verified with evidence
- [ ] AC-MVP-6: PRD `docs/PRD.md` "In Scope (v0.1.0 Beta)" list mapped to evidence (each item: shipped / explicitly deferred with rationale)
+## Milestones

-## Workstreams
+| #   | ID      | Name                                                         | Status      | Branch                 | Issue | Started    | Completed |
+| --- | ------- | ------------------------------------------------------------ | ----------- | ---------------------- | ----- | ---------- | --------- |
+| 1   | IUV-M01 | Hotfix: bootstrap DTO + wizard failure + port prefill + copy | in-progress | fix/bootstrap-hotfix   | #436  | 2026-04-05 | —         |
+| 2   | IUV-M02 | UX polish: CORS/FQDN, skill installer rework                 | not-started | feat/install-ux-polish | #437  | —          | —         |
+| 3   | IUV-M03 | Provider-first intelligent flow + drill-down main menu       | not-started | feat/install-ux-intent | #438  | —          | —         |

-| #   | ID  | Name                                        | Status            | Manifest                                                                | Notes                                               |
-| --- | --- | ------------------------------------------- | ----------------- | ----------------------------------------------------------------------- | --------------------------------------------------- |
-| W1  | FED | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md) | 7 milestones, ~175K tokens, issues #460–#466 filed  |
-| W2+ | TBD | (additional workstreams declared as scoped) | —                 | —                                                                       | Scope creep is expected and explicitly accommodated |
+## Subagent Delegation Plan

-### Likely Additional Workstreams (Not Yet Declared)
-
-These are anticipated based on the PRD `In Scope` list but are NOT counted toward MVP completion until they have their own manifest, milestones, and tracking issues. Listed here so the orchestrator knows what's likely coming.
-
- Web dashboard parity with PRD scope (chat, tasks, projects, missions, agent status surfaces)
- Pi TUI integration for terminal-native agent work
- CLI completeness for headless / scripted workflows that mirror webUI capability
- Remote control plugins (Discord priority, then Telegram)
- Multi-user / SSO finishing (BetterAuth + Authentik/WorkOS/Keycloak adapters per PRD)
- LLM provider expansion (Anthropic, Codex, Z.ai, Ollama, LM Studio, llama.cpp) + routing matrix
- MCP server/client capability + skill import interface
- Brain (`@mosaicstack/brain`) as the structured data layer on PG + vector
-
-When any of these solidify into a real workstream, add a row to the Workstreams table, create a workstream-level manifest under `docs/{workstream}/MISSION-MANIFEST.md`, and file tracking issues.
+| Milestone | Recommended Tier | Rationale                                                             |
+| --------- | ---------------- | --------------------------------------------------------------------- |
+| IUV-M01   | sonnet           | Tight bug cluster with known fix sites + small release cycle          |
+| IUV-M02   | sonnet           | UX rework, moderate surface, diagnostic-heavy for the skill installer |
+| IUV-M03   | opus             | Architectural redesign of first-run flow, state machine + LLM intake  |

 ## Risks

- **Scope creep is the named risk.** Workstreams will be added; the rule is that each must have its own manifest + milestones + acceptance criteria before it consumes execution capacity.
- **Federation urgency vs. surface parity** — federation is being built first because it unblocks the user, but webUI/TUI/CLI parity (MVP-X1) cannot slip indefinitely. Track surface coverage explicitly when each workstream lands.
- **Three-surface fan-out** — the same capability exposed three ways multiplies test surface and design effort. Default to a shared API/contract layer, then thin surface adapters; resist surface-specific business logic.
- **Federated-tier dependency** — MVP requires PG + pgvector + Valkey; users on local/standalone tier cannot federate. This is intentional but must be communicated clearly in the wizard.
+- **Hotfix regression surface** — the `import type` → `import` fix on the DTO class is one character but needs an integration test that binds the real DTO, not just a controller unit test, to prevent the same class-erasure regression from sneaking back in.
+- **LLM-driven intake latency / offline** — M03's provider-first intent flow assumes an available LLM call to expound on user input and choose a name. Offline installs need a deterministic fallback.
+- **Menu vs. linear back-compat** — M03 changes the top-level flow shape; existing `tools/install.sh --yes` + env-var headless path must continue to work.
+- **Scope creep in M03** — "redesign the wizard" can absorb arbitrary work. Keep it bounded with explicit non-goals.

-## Out of Scope (MVP)
+## Out of Scope

- SaaS / multi-tenant revenue model — personal/family/team tool only
- Mobile native apps — responsive web only
- Public npm registry publishing — Gitea registry only
- Voice / video agent interaction
- Full OpenClaw feature parity — inspiration only
- Calendar / GLPI / Woodpecker tooling integrations (deferred to post-MVP)
-
-## Session History
-
-For sessions 1–14 (phase-based execution, 2026-03-13 → 2026-03-15), see [scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md). Sessions below are tracked at the rollup level.
-
-| Session | Date       | Runtime | Outcome                                                                                                                                                                                                                                                                |
-| ------- | ---------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| S15     | 2026-04-19 | claude  | MVP rollup manifest authored. Install-ux-v2 archived (IUV-M03 retroactively closed — shipped via PR #446 + releases 0.0.27 → 0.0.29). Federation v1 planning landed via PR #468. W1 manifest reachable at `docs/federation/MISSION-MANIFEST.md`. Next: kickoff FED-M1. |
-
-## Next Step
-
-Begin W1 / FED-M1 — federated tier infrastructure. Task breakdown lives at [docs/federation/TASKS.md](./federation/TASKS.md).
+- Migrating the wizard to a GUI / web UI (still terminal-first)
+- Replacing the Gitea registry or the Woodpecker publish pipeline
+- Multi-tenant / multi-user onboarding (still single-admin bootstrap)
+- Reworking `mosaic uninstall` (M01 of the parent mission — stable)
--- a/docs/PRD.md
+++ b/docs/PRD.md
@@ -64,7 +64,6 @@ Jarvis (v0.2.0) is a self-hosted AI assistant with a Python FastAPI backend and
 21. `@mosaicstack/cli` — unified `mosaic` CLI
 22. Docker Compose deployment + bare-metal capability
 23. Agent log service — ingest, parse, tier, summarize agent interaction logs
-24. Local durable agent fleet canary — `mosaic fleet` / `mosaic agent` CLI for an isolated tmux-backed canary fleet using a named socket, with roster-driven local customization and rollback-safe verification

 ### Out of Scope (v0.1.0)

--- a/docs/TASKS.md
+++ b/docs/TASKS.md
@@ -1,92 +1,39 @@
-# Tasks — MVP (Top-Level Rollup)
+# Tasks — Install UX v2

 > Single-writer: orchestrator only. Workers read but never modify.
 >
-> **Mission:** mvp-20260312
-> **Manifest:** [docs/MISSION-MANIFEST.md](./MISSION-MANIFEST.md)
->
-> This file is a **rollup**. Per-workstream task breakdowns live in workstream task files
-> (e.g. `docs/federation/TASKS.md`). Workers operating inside a workstream should treat
-> the workstream file as their primary task source; this file exists for orchestrator-level
-> visibility into MVP-wide state.
->
-> **Status values:** `not-started` | `in-progress` | `done` | `blocked` | `failed`
+> **Mission:** install-ux-v2-20260405
+> **Schema:** `| id | status | description | issue | agent | branch | depends_on | estimate | notes |`
+> **Status values:** `not-started` | `in-progress` | `done` | `blocked` | `failed` | `needs-qa`
+> **Agent values:** `codex` | `sonnet` | `haiku` | `opus` | `—` (auto)

-## Workstream Rollup
+## Milestone 1 — Hotfix: bootstrap DTO + wizard failure + port prefill + copy (IUV-M01)

-| id  | status            | workstream          | progress         | tasks file                                        | notes                                                           |
-| --- | ----------------- | ------------------- | ---------------- | ------------------------------------------------- | --------------------------------------------------------------- |
-| W1  | planning-complete | Federation v1 (FED) | 0 / 7 milestones | [docs/federation/TASKS.md](./federation/TASKS.md) | M1 task breakdown populated; M2–M7 deferred to mission planning |
+| id        | status      | description                                                                                                                                                                                   | issue | agent  | branch               | depends_on | estimate | notes                                                                                          |
+| --------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------ | -------------------- | ---------- | -------- | ---------------------------------------------------------------------------------------------- |
+| IUV-01-01 | not-started | Fix `apps/gateway/src/admin/bootstrap.controller.ts:16` — switch `import type { BootstrapSetupDto }` to a value import so Nest's `@Body()` binds the real class                               | #436  | sonnet | fix/bootstrap-hotfix | —          | 3K       | one-character fix; repro is real-run `mosaic wizard` against `0.0.25`                          |
+| IUV-01-02 | not-started | Add integration / e2e test that POSTs `/api/bootstrap/setup` with `{name,email,password}` against a real Nest app instance and asserts 201 — NOT a mocked controller unit test                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-01  | 10K      | must fail before the fix and pass after; guards against the class-erasure regression recurring |
+| IUV-01-03 | not-started | `packages/mosaic/src/wizard.ts:147` — propagate `!bootstrapResult.completed` as a wizard failure in **interactive** mode too (not only headless); non-zero exit + no `✔ Wizard complete` line | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-02  | 5K       |                                                                                                |
+| IUV-01-04 | not-started | Gateway port prompt prefills `14242` in the input buffer — investigate why `promptPort`'s `defaultValue` isn't reaching the user-visible input                                                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-03  | 5K       | likely WizardPrompter adapter or @clack/prompts `initialValue` vs `defaultValue` mismatch      |
+| IUV-01-05 | not-started | `"What is Mosaic?"` intro copy updated to mention Pi SDK as the underlying agent runtime (alongside Claude Code / Codex / OpenCode)                                                           | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-04  | 2K       |                                                                                                |
+| IUV-01-06 | not-started | Tests + code review + PR merge + tag `mosaic-v0.0.26` + Gitea release + npm registry republish                                                                                                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-05  | 10K      | bump `packages/mosaic/package.json` to 0.0.25 → 0.0.26                                         |

-## Cross-Cutting Tracking
+## Milestone 2 — UX polish: CORS/FQDN, skill installer rework (IUV-M02)

-These are MVP-level checks that don't belong to any single workstream. Updated by the orchestrator at each session.
+| id        | status      | description                                                                                                                          | issue | agent  | branch                 | depends_on | estimate | notes                       |
+| --------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------- | ---------- | -------- | --------------------------- |
+| IUV-02-01 | not-started | Replace CORS origin prompt with FQDN / hostname input; derive the CORS value internally; default to `localhost` with clear help text | #437  | sonnet | feat/install-ux-polish | IUV-01-06  | 10K      |                             |
+| IUV-02-02 | not-started | Diagnose and document the concrete failure modes of the current skill / additional feature install section end-to-end                | #437  | sonnet | feat/install-ux-polish | IUV-02-01  | 8K       | needs real-run reproduction |
+| IUV-02-03 | not-started | Rework the skill installer so it is usable end-to-end (selection, install, verify, failure reporting)                                | #437  | sonnet | feat/install-ux-polish | IUV-02-02  | 20K      |                             |
+| IUV-02-04 | not-started | Tests + code review + PR merge                                                                                                       | #437  | sonnet | feat/install-ux-polish | IUV-02-03  | 10K      |                             |

-| id         | status      | description                                                                                              | notes                                                                                                                         |
-| ---------- | ----------- | -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| MVP-T01    | done        | Author MVP-level manifest at `docs/MISSION-MANIFEST.md`                                                  | This session (2026-04-19); PR pending                                                                                         |
-| MVP-T02    | done        | Archive install-ux-v2 mission state to `docs/archive/missions/install-ux-v2-20260405/`                   | IUV-M03 retroactively closed (shipped via PR #446 + releases 0.0.27→0.0.29)                                                   |
-| MVP-T03    | done        | Land federation v1 planning artifacts on `main`                                                          | PR #468 merged 2026-04-19 (commit `66512550`)                                                                                 |
-| MVP-T04    | not-started | Sync `.mosaic/orchestrator/mission.json` MVP slot with this manifest (milestone enumeration, etc.)       | Coord state file; consider whether to repopulate via `mosaic coord` or accept hand-edit                                       |
-| MVP-T05    | in-progress | Kick off W1 / FED-M1 — federated tier infrastructure                                                     | Session 16 (2026-04-19): FED-M1-01 in-progress on `feat/federation-m1-tier-config`                                            |
-| MVP-T06    | not-started | Declare additional workstreams (web dashboard, TUI/CLI parity, remote control, etc.) as scope solidifies | Track each new workstream by adding a row to the Workstream Rollup                                                            |
-| T-A292E96F | in-progress | Fix Mosaic Gitea PR metadata/login wrapper regression for U-Connect merge preflight                      | Kanban `t_a292e96f`; branch `fix/t-a292e96f-gitea-pr-metadata`; scratchpad `docs/scratchpads/t-a292e96f-gitea-pr-metadata.md` |
+## Milestone 3 — Provider-first intelligent flow + drill-down main menu (IUV-M03)

-## Pointer to Active Workstream
-
-Active workstream is **W1 — Federation v1**. Workers should:
-
-1. Read [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md) for workstream scope
-2. Read [docs/federation/TASKS.md](./federation/TASKS.md) for the next pending task
-3. Follow per-task agent + tier guidance from the workstream manifest
-
-## Thin-core prompt diet (#528) — feat/contract-thin-core
-
- Status: PR open, awaiting maintainer merge ratification (fleet-governing change).
- Cut always-injected contract AGENTS+TOOLS+RUNTIME 8,827→4,122 tok (−53%); all 12 hard gates intact.
- Validation: deterministic gate-checklist PASS; headless A/B thin 7/9 vs monolith 5/9. Detail: scratchpads/contract-thin-core.md.
-
-## P5 — Overlay composer + cross-harness (#604) — feat/p5-overlay-composer
-
- Status: MERGED to main (#605). R7 (compose-contract) + R8 (cross-harness) + R9 (composer test).
- `composeContract({harness, mosaicHome})` pure fn + `.local` overlay deltas-by-value; `mosaic compose-contract <harness>` command; AGENTS bare-launch nudge; composer spec (per-tier anchor + Tier-3 byte-equality). Detail: scratchpads/p5-overlay-composer.md.
-
-## P6 — Docs, compliance matrix, alpha tag (#606) — feat/p6-docs-compliance-alpha
-
- Status: in-repo deliverables done (CONTRIBUTING.md + harness×gate compliance matrix + check-resident-budget.sh + CI wiring + ALPHA-DOD.md). Remaining: alpha tag v0.0.39-alpha (Lead, post-merge). aiguide reconcile merged (#8). Detail: scratchpads/p6-docs-compliance-alpha.md.
-
-## F3-m3 — mosaic update re-seeds framework + relaunches agents (#609) — feat/f3-m3-update-reseed
-
- Status: implemented + tested. Closes R13: `mosaic update` now re-seeds the framework (data-safe MOSAIC_SYNC_ONLY) after the CLI install so shipped launcher/runtime changes activate; `--relaunch` restarts rostered agents; `--no-reseed` opts out. Detail: scratchpads/f3-m3-update-reseed.md.
-
-## Fleet-polish bundle — boot-survival symmetry (#611) — feat/fleet-polish-bundle
-
- Status: MERGED to main. disable-on-remove (boot-resurrection bug, TDD) + add-enable + init-R5 hard guarantee. 4 new + 147 existing fleet tests green. Detail: scratchpads/fleet-polish-bundle.md.
-
-## Fleet enhancer role + two-agent floor (#614) — feat/fleet-enhancer-floor
-
- Status: MERGED to main. enhancer added to 4 presets; init guarantees 1 orchestrator + >=1 enhancer; remove protects the sole enhancer; enhancer role doc. 155 fleet tests green. Detail: scratchpads/fleet-enhancer-floor.md.
-
-## F4 — Orchestrator chat connector + Matrix (#616) — feat/f4-matrix-connector
-
- Status: Phase 1 MERGED (#617: connector interface send/subscribe/health + registry + roster schema + design). Phase 2a (#618): Matrix CS-API client + factory. 20 connector tests green; no fleet.ts changes. Remaining Phase 2: init/configure connector-selection UX + roster wiring, systemd launch wiring, Conduit deploy guide. Detail: scratchpads/f4-matrix-connector.md.
-
-## Fleet onboarding-injection — comms cheat-sheet + peer roster (#620) — feat/fleet-comms-onboarding
-
- Status: implemented + tested. Injects # Fleet Comms (peer roster + cross-host agent-send commands + FLIP-reply + --verify) into each spawned fleet agent via composeContract; optional per-agent host/ssh/socket roster fields (socket: named → -L, unset → default socket no -L). 10 + 2 tests green. Detail: scratchpads/fleet-comms-onboarding.md.
-
-## Fleet stand-up fixes — model_hint→--model + socket-default trap (#626) — feat/fleet-standup-fixes
-
- Status: implemented + tested. FIX1 model_hint→MOSAIC_AGENT_MODEL→--model. FIX2 absent socket = default tmux socket (no -L) across parse/spawn/systemd-unit/observe (socketArgs helper, bare-empty shellEnvValue, conditional -L). 158 fleet tests green; shipped presets unaffected (explicit socket_name). Detail: scratchpads/fleet-standup-fixes.md.
-
-## north-star doctrine consolidation — doc PR — feat/north-star-doctrine
-
- Status: applied Mos's consolidated merge-map to docs/fleet/north-star.md (budget governance + control plane/central register + 200k cap + delegation + unified-identity Fleet + role-based naming + tmux security + drift re-captures). Doctrine only; #622/#623/#625/#628 out-of-scope. Conflict checklist green. Detail: scratchpads/north-star-doctrine.md.
-
-## #631 — re-seed preserves user fleet data (CRITICAL) — fix/631-reseed-preserves-fleet-data
-
- Status: implemented + tested. PRIMARY: install.sh PRESERVE_PATHS += fleet/\*.yaml + fleet/agents + fleet/run (glob-aware cp-fallback); TS parity. SECONDARY: refreshActiveFleetUnits propagates unit fixes to ~/.config/systemd/user on mosaic update. bash F6 + TS + unit tests green. Detail: scratchpads/631-reseed-preserves-fleet.md.
-
-## #633 — comms-block emitter + FLEET-LAUNCH runbook — feat/633-comms-block-runbook
-
- Status: implemented + tested (TDD). `mosaic fleet comms-block <role> [--host]` wraps resolveCommsBlock → readFleetCommsBlock; fails loud (stderr + exit 1) on unknown role / missing roster instead of silent empty. docs/fleet/FLEET-LAUNCH.md runbook: worker path + orchestrator .env fold (MOSAIC_AGENT_COMMAND; line-41 [-z] short-circuits line-44 yolo hardcode) + 3 launch gotchas + #632 preserve note + North-Star 4-field arc (harness ✅/model ✅ roster-native today; yolo + command/channels = PATH B #636). 177 fleet+comms tests green (6 new resolveCommsBlock cases). PATH A of the A→B→webUI arc. Detail: scratchpads/633-comms-block-runbook.md.
+| id        | status      | description                                                                                                                                                  | issue | agent | branch                 | depends_on | estimate | notes                                                         |
+| --------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ----- | ---------------------- | ---------- | -------- | ------------------------------------------------------------- |
+| IUV-03-01 | not-started | Design doc: new first-run state machine — main menu (Plugins / Providers / …), Quick Start vs Custom paths, provider-first flow, intent intake + naming loop | #438  | opus  | feat/install-ux-intent | IUV-02-04  | 15K      | scratchpad + explicit non-goals                               |
+| IUV-03-02 | not-started | Implement drill-down main menu (Plugins: Recommended / Custom, Providers, …) as the top-level entry point of `mosaic wizard`                                 | #438  | opus  | feat/install-ux-intent | IUV-03-01  | 25K      |                                                               |
+| IUV-03-03 | not-started | Quick Start path: curated minimum question set — define the exact baseline, delete everything else from the fast path                                        | #438  | opus  | feat/install-ux-intent | IUV-03-02  | 15K      |                                                               |
+| IUV-03-04 | not-started | Provider-first natural-language intake: user describes intent → agent expounds → agent proposes a name (confirmable / overridable) — OpenClaw-style          | #438  | opus  | feat/install-ux-intent | IUV-03-03  | 25K      | offline fallback required (deterministic default name + path) |
+| IUV-03-05 | not-started | Preserve backward-compat: headless path (`MOSAIC_ASSUME_YES=1` + env vars) still works end-to-end; `tools/install.sh --yes` unchanged                        | #438  | opus  | feat/install-ux-intent | IUV-03-04  | 10K      |                                                               |
+| IUV-03-06 | not-started | Tests + code review + PR merge + `mosaic-v0.0.27` release                                                                                                    | #438  | opus  | feat/install-ux-intent | IUV-03-05  | 15K      |                                                               |
--- a/docs/archive/missions/install-ux-v2-20260405/MISSION-MANIFEST.md
+++ b/docs/archive/missions/install-ux-v2-20260405/MISSION-MANIFEST.md
@@ -1,74 +0,0 @@
-# Mission Manifest — Install UX v2
-
-> Persistent document tracking full mission scope, status, and session history.
-> Updated by the orchestrator at each phase transition and milestone completion.
-
-## Mission
-
-**ID:** install-ux-v2-20260405
-**Statement:** The install-ux-hardening mission shipped the plumbing (uninstall, masked password, hooks consent, unified flow, headless path), but the first real end-to-end run surfaced a critical regression and a collection of UX failings that make the wizard feel neither quick nor intelligent. This mission closes the bootstrap regression as a hotfix, then rethinks the first-run experience around a provider-first, intent-driven flow with a drill-down main menu and a genuinely fast quick-start.
-**Phase:** Closed
-**Current Milestone:** —
-**Progress:** 3 / 3 milestones
-**Status:** complete
-**Last Updated:** 2026-04-19 (archived during MVP manifest authoring; IUV-M03 substantively shipped via PR #446 — drill-down menu + provider-first flow + quick start; releases 0.0.27 → 0.0.29)
-**Archived to:** `docs/archive/missions/install-ux-v2-20260405/`
-**Parent Mission:** [install-ux-hardening-20260405](./archive/missions/install-ux-hardening-20260405/MISSION-MANIFEST.md) (complete — `mosaic-v0.0.25`)
-
-## Context
-
-Real-run testing of `@mosaicstack/mosaic@0.0.25` uncovered:
-
-1. **Critical:** admin bootstrap fails with HTTP 400 `property email should not exist` — `bootstrap.controller.ts` uses `import type { BootstrapSetupDto }`, erasing the class at runtime. Nest's `@Body()` falls back to plain `Object` metatype, and ValidationPipe with `forbidNonWhitelisted` rejects every property. One-character fix (drop the `type` keyword), but it blocks the happy path of the release that just shipped.
-2. The wizard reports `✔ Wizard complete` and `✔ Done` _after_ the bootstrap 400 — failure only propagates in headless mode (`wizard.ts:147`).
-3. The gateway port prompt does not prefill `14242` in the input buffer.
-4. `"What is Mosaic?"` intro copy does not mention Pi SDK (the actual agent runtime behind Claude/Codex/OpenCode).
-5. CORS origin prompt is confusing — the user should be able to supply an FQDN/hostname and have the system derive the CORS value.
-6. Skill / additional feature install section is unusable in practice.
-7. Quick-start asks far too many questions to be meaningfully "quick".
-8. No drill-down main menu — everything is a linear interrogation.
-9. Provider setup happens late and without intelligence. An OpenClaw-style provider-first flow would let the user describe what they want in natural language, have the agent expound on it, and have the agent choose its own name based on that intent.
-
-## Success Criteria
-
- [x] AC-1: Admin bootstrap completes successfully end-to-end on a fresh install (DTO value import, no forbidNonWhitelisted regression); covered by an integration or e2e test that exercises the real DTO binding. _(PR #440)_
- [x] AC-2: Wizard fails loudly (non-zero exit, clear error) when the bootstrap stage returns `completed: false`, in both interactive and headless modes. No more silent `✔ Wizard complete` after a 400. _(PR #440)_
- [x] AC-3: Gateway port prompt prefills `14242` in the input field (user can press Enter to accept). _(PR #440)_
- [x] AC-4: `"What is Mosaic?"` intro copy mentions Pi SDK as the underlying agent runtime. _(PR #440)_
- [x] AC-5: Release `mosaic-v0.0.26` tagged and published to the Gitea npm registry, unblocking the 0.0.25 happy path. _(tag: mosaic-v0.0.26, registry: 0.0.26 live)_
- [ ] AC-6: CORS origin prompt replaced with FQDN/hostname input; CORS string is derived from that.
- [ ] AC-7: Skill / additional feature install section is reworked until it is actually usable end-to-end (worker defines the concrete failure modes during diagnosis).
- [ ] AC-8: First-run flow has a drill-down main menu with at least `Plugins` (Recommended / Custom), `Providers`, and the other top-level configuration groups. Linear interrogation is gone.
- [ ] AC-9: `Quick Start` path completes with a minimal, curated set of questions (target: under 90 seconds for a returning user; define the exact baseline during design).
- [ ] AC-10: Provider setup happens first, driven by a natural-language intake prompt. The agent expounds on the user's intent and chooses its own name based on that intent (OpenClaw-style). Naming is confirmable / overridable.
- [ ] AC-11: All milestones ship as merged PRs with green CI and closed issues.
-
-## Milestones
-
-| #   | ID      | Name                                                         | Status   | Branch                 | Issue | Started    | Completed  |
-| --- | ------- | ------------------------------------------------------------ | -------- | ---------------------- | ----- | ---------- | ---------- |
-| 1   | IUV-M01 | Hotfix: bootstrap DTO + wizard failure + port prefill + copy | complete | fix/bootstrap-hotfix   | #436  | 2026-04-05 | 2026-04-05 |
-| 2   | IUV-M02 | UX polish: CORS/FQDN, skill installer rework                 | complete | feat/install-ux-polish | #437  | 2026-04-05 | 2026-04-05 |
-| 3   | IUV-M03 | Provider-first intelligent flow + drill-down main menu       | complete | feat/install-ux-intent | #438  | 2026-04-05 | 2026-04-19 |
-
-## Subagent Delegation Plan
-
-| Milestone | Recommended Tier | Rationale                                                             |
-| --------- | ---------------- | --------------------------------------------------------------------- |
-| IUV-M01   | sonnet           | Tight bug cluster with known fix sites + small release cycle          |
-| IUV-M02   | sonnet           | UX rework, moderate surface, diagnostic-heavy for the skill installer |
-| IUV-M03   | opus             | Architectural redesign of first-run flow, state machine + LLM intake  |
-
-## Risks
-
- **Hotfix regression surface** — the `import type` → `import` fix on the DTO class is one character but needs an integration test that binds the real DTO, not just a controller unit test, to prevent the same class-erasure regression from sneaking back in.
- **LLM-driven intake latency / offline** — M03's provider-first intent flow assumes an available LLM call to expound on user input and choose a name. Offline installs need a deterministic fallback.
- **Menu vs. linear back-compat** — M03 changes the top-level flow shape; existing `tools/install.sh --yes` + env-var headless path must continue to work.
- **Scope creep in M03** — "redesign the wizard" can absorb arbitrary work. Keep it bounded with explicit non-goals.
-
-## Out of Scope
-
- Migrating the wizard to a GUI / web UI (still terminal-first)
- Replacing the Gitea registry or the Woodpecker publish pipeline
- Multi-tenant / multi-user onboarding (still single-admin bootstrap)
- Reworking `mosaic uninstall` (M01 of the parent mission — stable)
--- a/docs/archive/missions/install-ux-v2-20260405/TASKS.md
+++ b/docs/archive/missions/install-ux-v2-20260405/TASKS.md
@@ -1,39 +0,0 @@
-# Tasks — Install UX v2
-
-> Single-writer: orchestrator only. Workers read but never modify.
->
-> **Mission:** install-ux-v2-20260405
-> **Schema:** `| id | status | description | issue | agent | branch | depends_on | estimate | notes |`
-> **Status values:** `not-started` | `in-progress` | `done` | `blocked` | `failed` | `needs-qa`
-> **Agent values:** `codex` | `sonnet` | `haiku` | `opus` | `—` (auto)
-
-## Milestone 1 — Hotfix: bootstrap DTO + wizard failure + port prefill + copy (IUV-M01)
-
-| id        | status | description                                                                                                                                                                                   | issue | agent  | branch               | depends_on | estimate | notes                                                                                   |
-| --------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------ | -------------------- | ---------- | -------- | --------------------------------------------------------------------------------------- |
-| IUV-01-01 | done   | Fix `apps/gateway/src/admin/bootstrap.controller.ts:16` — switch `import type { BootstrapSetupDto }` to a value import so Nest's `@Body()` binds the real class                               | #436  | sonnet | fix/bootstrap-hotfix | —          | 3K       | PR #440 merged `0ae932ab`                                                               |
-| IUV-01-02 | done   | Add integration / e2e test that POSTs `/api/bootstrap/setup` with `{name,email,password}` against a real Nest app instance and asserts 201 — NOT a mocked controller unit test                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-01  | 10K      | `apps/gateway/src/admin/bootstrap.e2e.spec.ts` — 4 tests; unplugin-swc added for vitest |
-| IUV-01-03 | done   | `packages/mosaic/src/wizard.ts:147` — propagate `!bootstrapResult.completed` as a wizard failure in **interactive** mode too (not only headless); non-zero exit + no `✔ Wizard complete` line | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-02  | 5K       | removed `&& headlessRun` guard                                                          |
-| IUV-01-04 | done   | Gateway port prompt prefills `14242` in the input buffer — investigate why `promptPort`'s `defaultValue` isn't reaching the user-visible input                                                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-03  | 5K       | added `initialValue` through prompter interface → clack                                 |
-| IUV-01-05 | done   | `"What is Mosaic?"` intro copy updated to mention Pi SDK as the underlying agent runtime (alongside Claude Code / Codex / OpenCode)                                                           | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-04  | 2K       | `packages/mosaic/src/stages/welcome.ts`                                                 |
-| IUV-01-06 | done   | Tests + code review + PR merge + tag `mosaic-v0.0.26` + Gitea release + npm registry republish                                                                                                | #436  | sonnet | fix/bootstrap-hotfix | IUV-01-05  | 10K      | PRs #440/#441/#442 merged; tag `mosaic-v0.0.26`; registry latest=0.0.26 ✓               |
-
-## Milestone 2 — UX polish: CORS/FQDN, skill installer rework (IUV-M02)
-
-| id        | status | description                                                                                                                          | issue | agent  | branch                 | depends_on | estimate | notes                                                                  |
-| --------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------- | ---------- | -------- | ---------------------------------------------------------------------- |
-| IUV-02-01 | done   | Replace CORS origin prompt with FQDN / hostname input; derive the CORS value internally; default to `localhost` with clear help text | #437  | sonnet | feat/install-ux-polish | —          | 10K      | `deriveCorsOrigin()` pure fn; MOSAIC_HOSTNAME headless var; PR #444    |
-| IUV-02-02 | done   | Diagnose and document the concrete failure modes of the current skill / additional feature install section end-to-end                | #437  | sonnet | feat/install-ux-polish | IUV-02-01  | 8K       | selection→install gap, silent catch{}, no whitelist concept            |
-| IUV-02-03 | done   | Rework the skill installer so it is usable end-to-end (selection, install, verify, failure reporting)                                | #437  | sonnet | feat/install-ux-polish | IUV-02-02  | 20K      | MOSAIC_INSTALL_SKILLS env var whitelist; SyncSkillsResult typed return |
-| IUV-02-04 | done   | Tests + code review + PR merge                                                                                                       | #437  | sonnet | feat/install-ux-polish | IUV-02-03  | 10K      | 18 new tests (13 CORS + 5 skills); PR #444 merged `172bacb3`           |
-
-## Milestone 3 — Provider-first intelligent flow + drill-down main menu (IUV-M03)
-
-| id        | status      | description                                                                                                                                                  | issue | agent | branch                 | depends_on | estimate | notes                                                         |
-| --------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ----- | ---------------------- | ---------- | -------- | ------------------------------------------------------------- |
-| IUV-03-01 | not-started | Design doc: new first-run state machine — main menu (Plugins / Providers / …), Quick Start vs Custom paths, provider-first flow, intent intake + naming loop | #438  | opus  | feat/install-ux-intent | —          | 15K      | scratchpad + explicit non-goals                               |
-| IUV-03-02 | not-started | Implement drill-down main menu (Plugins: Recommended / Custom, Providers, …) as the top-level entry point of `mosaic wizard`                                 | #438  | opus  | feat/install-ux-intent | IUV-03-01  | 25K      |                                                               |
-| IUV-03-03 | not-started | Quick Start path: curated minimum question set — define the exact baseline, delete everything else from the fast path                                        | #438  | opus  | feat/install-ux-intent | IUV-03-02  | 15K      |                                                               |
-| IUV-03-04 | not-started | Provider-first natural-language intake: user describes intent → agent expounds → agent proposes a name (confirmable / overridable) — OpenClaw-style          | #438  | opus  | feat/install-ux-intent | IUV-03-03  | 25K      | offline fallback required (deterministic default name + path) |
-| IUV-03-05 | not-started | Preserve backward-compat: headless path (`MOSAIC_ASSUME_YES=1` + env vars) still works end-to-end; `tools/install.sh --yes` unchanged                        | #438  | opus  | feat/install-ux-intent | IUV-03-04  | 10K      |                                                               |
-| IUV-03-06 | not-started | Tests + code review + PR merge + `mosaic-v0.0.27` release                                                                                                    | #438  | opus  | feat/install-ux-intent | IUV-03-05  | 15K      |                                                               |
--- a/docs/archive/missions/install-ux-v2-20260405/iuv-m03-design.md
+++ b/docs/archive/missions/install-ux-v2-20260405/iuv-m03-design.md
@@ -1,227 +0,0 @@
-# IUV-M03 Design: Provider-first intelligent flow + drill-down main menu
-
-**Issue:** #438
-**Branch:** `feat/install-ux-intent`
-**Date:** 2026-04-05
-
-## 1. New first-run state machine
-
-The linear 12-stage interrogation is replaced with a menu-driven architecture.
-
-### Flow overview
-
-```
-Welcome banner
-  |
-  v
-Detect existing install (auto)
-  |
-  v
-Main Menu (loop)
-  |-- Quick Start        -> provider key + admin creds -> finalize
-  |-- Providers          -> LLM API key config
-  |-- Agent Identity     -> intent intake + naming (deterministic)
-  |-- Skills             -> recommended / custom selection
-  |-- Gateway            -> port, storage tier, hostname, CORS
-  |-- Advanced           -> SOUL.md, USER.md, TOOLS.md, runtimes, hooks
-  |-- Finish & Apply     -> finalize + gateway bootstrap
-  v
-Done
-```
-
-### Menu navigation
-
- Main menu is a `select` prompt. Each option drills into a sub-flow.
- Completing a section returns to the main menu.
- Menu items show completion state: `[done]` hint after configuration.
- `Finish & Apply` is always last and requires at minimum a provider key (or explicit skip).
- The menu tracks configured sections in `WizardState.completedSections`.
-
-### Headless bypass
-
-When `MOSAIC_ASSUME_YES=1` or `!process.stdin.isTTY`, the entire menu is skipped.
-The wizard runs: defaults + env var overrides -> finalize -> gateway config -> bootstrap.
-This preserves full backward compatibility with `tools/install.sh --yes`.
-
-## 2. Quick Start path
-
-Target: 3-5 questions max. Under 90 seconds for a returning user.
-
-### Questions asked
-
-1. **Provider API key** (Anthropic/OpenAI) - `text` prompt with paste support
-2. **Admin email** - `text` prompt
-3. **Admin password** - masked + confirmed
-
-### Questions skipped (with defaults)
-
-| Setting                      | Default                         | Rationale              |
-| ---------------------------- | ------------------------------- | ---------------------- |
-| Agent name                   | "Mosaic"                        | Generic but branded    |
-| Port                         | 14242                           | Standard default       |
-| Storage tier                 | local                           | No external deps       |
-| Hostname                     | localhost                       | Dev-first              |
-| CORS origin                  | http://localhost:3000           | Standard web UI port   |
-| Skills                       | recommended set                 | Curated by maintainers |
-| Runtimes                     | auto-detected                   | No user input needed   |
-| Communication style          | direct                          | Most popular choice    |
-| SOUL.md / USER.md / TOOLS.md | template defaults               | Can customize later    |
-| Hooks                        | auto-install if Claude detected | Safe default           |
-
-### Flow
-
-```
-Quick Start selected
-  -> "Paste your LLM API key (Anthropic recommended):"
-  -> [auto-detect provider from key prefix: sk-ant-* = Anthropic, sk-* = OpenAI]
-  -> Apply all defaults
-  -> Run finalize (sync framework, write configs, link assets, sync skills)
-  -> Run gateway config (headless-style with defaults + provided key)
-  -> "Admin email:"
-  -> "Admin password:" (masked + confirm)
-  -> Run gateway bootstrap
-  -> Done
-```
-
-## 3. Provider-first flow
-
-Provider configuration (currently buried in gateway-config stage as "ANTHROPIC_API_KEY")
-moves to a dedicated top-level menu item and is the first question in Quick Start.
-
-### Provider detection
-
-The API key prefix determines the provider:
-
- `sk-ant-api03-*` -> Anthropic (Claude)
- `sk-*` -> OpenAI
- Empty/skipped -> no provider (gateway starts without LLM access)
-
-### Storage
-
-The provider key is stored in the gateway `.env` as `ANTHROPIC_API_KEY` or `OPENAI_API_KEY`.
-For Quick Start, this replaces the old interactive prompt in `collectAndWriteConfig`.
-
-### Menu section: "Providers"
-
-In the drill-down menu, "Providers" lets users:
-
-1. Enter/change their API key
-2. See which provider was detected
-3. Optionally configure a second provider
-
-For v0.0.27, we support Anthropic and OpenAI keys only. The key is stored
-in `WizardState` and written during finalize.
-
-## 4. Intent intake + naming (deterministic fallback - Option B)
-
-### Rationale
-
-At install time, the LLM provider may not be configured yet (chicken-and-egg).
-We use **Option B: deterministic advisor** for the install wizard.
-
-### Flow (Agent Identity menu section)
-
-```
-1. "What will this agent primarily help you with?"
-   -> Select from presets:
-      - General purpose assistant
-      - Software development
-      - DevOps & infrastructure
-      - Research & analysis
-      - Content & writing
-      - Custom (free text description)
-
-2. System proposes a thematic name based on selection:
-   - General purpose -> "Mosaic"
-   - Software development -> "Forge"
-   - DevOps & infrastructure -> "Sentinel"
-   - Research & analysis -> "Atlas"
-   - Content & writing -> "Muse"
-   - Custom -> "Mosaic" (default)
-
-3. "Your agent will be named 'Forge'. Press Enter to accept or type a new name:"
-   -> User confirms or overrides
-```
-
-### Storage
-
- Agent name -> `WizardState.soul.agentName` -> written to SOUL.md
- Intent category -> `WizardState.agentIntent` (new field) -> written to `~/.config/mosaic/agent.json`
-
-### Post-install LLM-powered intake (future)
-
-A future `mosaic configure identity` command can use the configured LLM to:
-
- Accept free-text intent description
- Generate an expounded persona
- Propose a contextual name
-
-This is explicitly out of scope for the install wizard.
-
-## 5. Headless backward-compat
-
-### Supported env vars (unchanged)
-
-| Variable                   | Used by                                        |
-| -------------------------- | ---------------------------------------------- |
-| `MOSAIC_ASSUME_YES=1`      | Skip all prompts, use defaults + env overrides |
-| `MOSAIC_ADMIN_NAME`        | Gateway bootstrap                              |
-| `MOSAIC_ADMIN_EMAIL`       | Gateway bootstrap                              |
-| `MOSAIC_ADMIN_PASSWORD`    | Gateway bootstrap                              |
-| `MOSAIC_GATEWAY_PORT`      | Gateway config                                 |
-| `MOSAIC_HOSTNAME`          | Gateway config (CORS derivation)               |
-| `MOSAIC_CORS_ORIGIN`       | Gateway config (full override)                 |
-| `MOSAIC_STORAGE_TIER`      | Gateway config (local/team)                    |
-| `MOSAIC_DATABASE_URL`      | Gateway config (team tier)                     |
-| `MOSAIC_VALKEY_URL`        | Gateway config (team tier)                     |
-| `MOSAIC_ANTHROPIC_API_KEY` | Provider config                                |
-
-### New env vars
-
-| Variable              | Purpose                                   |
-| --------------------- | ----------------------------------------- |
-| `MOSAIC_AGENT_NAME`   | Override agent name in headless mode      |
-| `MOSAIC_AGENT_INTENT` | Override intent category in headless mode |
-
-### `tools/install.sh --yes`
-
-The install script sets `MOSAIC_ASSUME_YES=1` and passes through env vars.
-No changes needed to the script itself. The new wizard detects headless mode
-at the top of `runWizard` and runs a linear path identical to the old flow.
-
-## 6. Explicit non-goals
-
- **No GUI** — this is a terminal wizard only
- **No multi-user install** — single-user, single-machine
- **No registry changes** — npm publish flow is unchanged
- **No LLM calls during install** — deterministic fallback only
- **No new dependencies** — uses existing @clack/prompts and picocolors
- **No changes to gateway API** — only the wizard orchestration changes
- **No changes to tools/install.sh** — headless compat maintained via env vars
-
-## 7. Implementation plan
-
-### Files to modify
-
-1. `packages/mosaic/src/types.ts` — add `MenuSection`, `AgentIntent`, `completedSections`, `agentIntent`, `providerKey`, `providerType` to WizardState
-2. `packages/mosaic/src/wizard.ts` — replace linear flow with menu loop
-3. `packages/mosaic/src/stages/mode-select.ts` — becomes the main menu
-4. `packages/mosaic/src/stages/provider-setup.ts` — new: provider key collection
-5. `packages/mosaic/src/stages/agent-intent.ts` — new: intent intake + naming
-6. `packages/mosaic/src/stages/menu-gateway.ts` — new: gateway sub-menu wrapper
-7. `packages/mosaic/src/stages/quick-start.ts` — new: quick start linear path
-8. `packages/mosaic/src/constants.ts` — add intent presets and name mappings
-9. `packages/mosaic/package.json` — version bump 0.0.26 -> 0.0.27
-
-### Files to add (tests)
-
-1. `packages/mosaic/src/stages/wizard-menu.spec.ts` — menu navigation tests
-2. `packages/mosaic/src/stages/quick-start.spec.ts` — quick start path tests
-3. `packages/mosaic/src/stages/agent-intent.spec.ts` — intent + naming tests
-4. `packages/mosaic/src/stages/provider-setup.spec.ts` — provider detection tests
-
-### Migration strategy
-
-The existing stage functions remain intact. The menu system wraps them —
-each menu item calls the appropriate stage function(s). The linear headless
-path calls them in the same order as before.
--- a/docs/design/framework-constitution/ALPHA-DOD.md
+++ b/docs/design/framework-constitution/ALPHA-DOD.md
@@ -1,75 +0,0 @@
-# Constitution Alpha — Definition-of-Done checklist + release notes
-
-Drafted for the `v0.0.39-alpha` tag (Lead cuts after P5 #605 → P6 #607 → aiguide #8 merge).
-Maps every DoD §8 acceptance criterion to its merged evidence. Legend:
-**✅ merged on main** · **⏳ review-ready PR (pending merge)** · **🔲 Lead action**.
-
-## DoD §8 green-checklist
-
-| #   | Acceptance criterion (DESIGN §8)                                                                       | Status | Evidence / PR     |
-| --- | ------------------------------------------------------------------------------------------------------ | ------ | ----------------- |
-| 1   | MIT `LICENSE` (root + framework) + `"license":"MIT"` in package.json                                   | ✅     | P0 #570           |
-| 2   | Three credential-path sites + hook URL fast-failed (no private paths in `*.sh`/hooks)                  | ✅     | P0 #570           |
-| 3   | `verify-sanitized.sh` (two-class, `*.sh`+`*.md`, self-tested) wired **blocking** in CI                 | ✅     | P1 #572           |
-| 4   | Operator data purged from the full set (guides / tools / init-generator)                               | ✅     | P2 #572           |
-| 5   | `rails/`→`tools/` in **both** template families                                                        | ✅     | P2 #572           |
-| 6   | `jarvis-loop.json` deleted; `defaults/SOUL.md` → **neutral sanitized persona** (Q10 decision)          | ✅     | P2 #572           |
-| 7   | `CONSTITUTION.md` extracted (gates one place, capability-verb, §1.4 split, no false "already loaded")  | ✅     | P3 #575 / #577    |
-| 8   | `AGENTS.md`/`STANDARDS.md` out of `PRESERVE_PATHS` + seed-semantics → overwrite in **both** installers | ✅     | P4 #590           |
-| 9   | Snapshot + v2→v3 migration moving user edits to `.local`/`.bak`; `FRAMEWORK_VERSION=3`                 | ✅     | P4 #590 / #593    |
-| 10  | `mosaic-init --non-interactive` fail-closed persona                                                    | ✅     | P4 #590           |
-| 11  | **5-fixture migration matrix** green against **both** installers asserting **injected bytes**          | ✅     | P4 #590 / #593    |
-| 12  | `compose-contract` built + composer unit test (per-tier anchor + Tier-3 byte-equality)                 | ⏳     | P5 #605           |
-| 13  | Resident line-count ceiling enforced (framework-owned resident files)                                  | ⏳     | P6 #607           |
-| 14  | `CONTRIBUTING.md` + harness×gate compliance matrix                                                     | ⏳     | P6 #607           |
-| 15  | `aiguide` reconciled with the Constitution                                                             | ⏳     | aiguide #8        |
-| 16  | Each phase PR CI-green; alpha tag pushed + Gitea release published                                     | 🔲     | Lead (post-merge) |
-
-**Note on #6:** the DoD's literal "delete `defaults/SOUL.md`" was superseded by the resolved
-**Q10** decision — ship a _neutral, operator-agnostic_ example persona instead of deleting it. Main
-carries the sanitized 2.6 KB neutral SOUL.md ("Mosaic agent", no operator identity); the sanitization
-gate confirms it is PII-clean. Criterion met in spirit (no operator persona leaks) via the better option.
-
-**Gate to flip 12–14 → ✅:** merge P5 #605 → P6 #607 (rebase auto-drops the dup format fix
-`adc7df2`/`9f6da92`) → aiguide #8, with `ci.yml` terminal-green on the merged head.
-
---
-
-## Release notes — `v0.0.39-alpha` (Mosaic Framework Constitution, alpha)
-
-### Mosaic Framework Constitution — Alpha
-
-This release makes the Mosaic framework a **safe-to-open-source, fork-and-customize agent
-operating layer**. It separates the non-negotiable law from operator identity, makes
-customization survive upgrades, and wires the guarantees into CI.
-
-**Highlights**
-
- **Constitution (L0).** The hard gates now live in one place — `CONSTITUTION.md` — authored in
-  capability verbs, with a thin `AGENTS.md` dispatcher that references the law instead of restating
-  it. Governance model in `constitution/LAYER-MODEL.md`.
- **Public & sanitized.** MIT-licensed; all operator identity, private paths, and credential sites
-  removed from shipped files. A self-tested `verify-sanitized.sh` gate (two rule classes) runs
-  **blocking** in CI so re-contamination can't merge.
- **Upgrade-safe customization.** Framework-owned files overwrite cleanly on upgrade while
-  `SOUL.md`/`USER.md`/`*.local.md`/`credentials` are preserved. The v2→v3 migration snapshots first
-  and moves any user-edited `AGENTS.md`/`STANDARDS.md` to `.pre-constitution.bak`/`.local.md` —
-  never silently lost. Verified by a 5-fixture matrix across **both** installers.
- **Operator overlays.** `mosaic compose-contract <harness>` merges your `*.local.md` deltas into
-  the contract per harness, so customization reaches the model as one pre-merged blob.
- **Cross-harness.** Single L0 source referenced (never restated) by Claude / Codex / OpenCode / Pi;
-  tiered injection with a byte-equal Tier-3 fallback read.
- **Guardrails in CI.** Resident line-count ceiling over framework-owned resident files; composer
-  unit test; sanitization gate — all blocking.
- **Docs.** `CONTRIBUTING.md` with the layer model, dual-installer parity rule, and a harness×gate
-  **compliance matrix** (the Codex/OpenCode/Pi hook-parity gap is tracked for v2).
-
-**Known limitations (accepted, documented in `CONTRIBUTING.md` §9)**
-
- Bare launches that bypass `mosaic` get base contracts only (no `*.local` overlays) and are not
-  drift-checked by `mosaic doctor` — mitigated by the unconditional Tier-3 self-load + a nudge.
- Codex/OpenCode/Pi mechanical hook parity, `policy/*.md` composition, and live-launch cross-harness
-  verification are **v2**.
-
-**Phase lineage:** P0 #570 · P1+P2 #572 · P3 #575/#577 · P4 #590/#593 · P5 #605 · P6 #607 ·
-aiguide #8 (umbrella #542).
--- a/docs/design/prerelease-next-dist-tag-pipeline.md
+++ b/docs/design/prerelease-next-dist-tag-pipeline.md
@@ -1,63 +0,0 @@
-# npm `@next` prerelease lane
-
-Status: **IMPLEMENTED**
-
-## Current behavior
-
-`tools/install.sh --next` provides the prerelease integration lane for the permanent `next` branch.
-
-The lane is fast-by-default:
-
-1. Install framework files from the `next` source archive.
-2. Resolve the Gitea npm registry `next` dist-tag for the globally installed packages:
-
-   ```bash
-   npm view @mosaicstack/gateway@next version
-   npm view @mosaicstack/mosaic@next version
-   ```
-
-3. Require both resolved versions to share the same `next.<pipeline>` suffix, then install the exact resolved versions.
-4. If either `@next` package is missing, unreachable, mismatched, or fails to install, fall back to the source-build path at `next`.
-
-`--next` never hard-fails solely because the prerelease npm dist-tag is unavailable.
-
-## Published packages
-
-The `next` publish pipeline publishes non-private `@mosaicstack/*` packages to the Mosaic Gitea npm registry:
-
-```text
-https://git.mosaicstack.dev/api/packages/mosaicstack/npm/
-```
-
-Observed `next` dist-tags after enabling the pipeline:
-
-```text
-@mosaicstack/mosaic@next  -> 0.0.49-next.1633
-@mosaicstack/gateway@next -> 0.0.7-next.1633
-```
-
-The gateway also publishes a Docker image as `gateway:sha-<short>` on `next` merges. The installer fast path uses the npm gateway package when available; the Docker image is for deployed gateway/runtime harness flows.
-
-## Explicit source lanes
-
-Source builds remain available and are still the authority for explicit ref validation:
-
- `--dev` always builds from source.
- `--ref <ref>` / `MOSAIC_REF=<ref>` wins over `--next` and uses the source path for that exact ref.
-
-## Pipeline shape
-
-1. Trigger on `next` merges.
-2. Compute the next prerelease version from the upcoming stable version plus the Woodpecker pipeline number (`<target-stable>-next.<CI_PIPELINE_NUMBER>`).
-3. Build and publish non-private packages in CI.
-4. Publish to the Mosaic Gitea npm registry with dist-tag `next`.
-5. Keep `latest` untouched; only main/release promotion can update `latest`.
-6. Publish gateway Docker images from `next` as `gateway:sha-<short>` only.
-
-## Guardrails
-
- `@next` is mutable prerelease convenience, not a deployment pin.
- Stable installs continue to use `@latest`.
- Contributor validation remains available through `--dev --ref <branch>`.
- Pipeline output traces every prerelease package back to the source commit on `next`.
- The installer falls back to source rather than hard-failing on prerelease registry issues.
--- a/docs/federation/ADMIN-CLI.md
+++ b/docs/federation/ADMIN-CLI.md
@@ -1,106 +0,0 @@
-# Mosaic Federation — Admin CLI Reference
-
-Available since: FED-M2
-
-## Grant Management
-
-### Create a grant
-
-```bash
-mosaic federation grant create --user <userId> --peer <peerId> --scope <scope-file.json>
-```
-
-The scope file defines what resources and rows the peer may access:
-
-```json
-{
-  "resources": ["tasks", "notes"],
-  "excluded_resources": ["credentials"],
-  "max_rows_per_query": 100
-}
-```
-
-Valid resource values: `tasks`, `notes`, `credentials`, `teams`, `users`
-
-### List grants
-
-```bash
-mosaic federation grant list [--peer <peerId>] [--status pending|active|revoked|expired]
-```
-
-Shows all federation grants, optionally filtered by peer or status.
-
-### Show a grant
-
-```bash
-mosaic federation grant show <grantId>
-```
-
-Display details of a single grant, including its scope, activation timestamp, and status.
-
-### Revoke a grant
-
-```bash
-mosaic federation grant revoke <grantId> [--reason "Reason text"]
-```
-
-Revoke an active grant immediately. Revoked grants cannot be reactivated. The optional reason is stored in the audit log.
-
-### Generate enrollment token
-
-```bash
-mosaic federation grant token <grantId> [--ttl <seconds>]
-```
-
-Generate a single-use enrollment token for the grant. The default TTL is 900 seconds (15 minutes); maximum 15 minutes.
-
-Output includes the token and the full enrollment URL for the peer to use.
-
-## Peer Management
-
-### Add a peer (remote enrollment)
-
-```bash
-mosaic federation peer add <enrollment-url>
-```
-
-Enroll a remote peer using the enrollment URL obtained from a grant token. The command:
-
-1. Generates a P-256 ECDSA keypair locally
-2. Creates a certificate signing request (CSR)
-3. Submits the CSR to the enrollment URL
-4. Verifies the returned certificate includes the correct custom OIDs (grant ID and subject user ID)
-5. Seals the private key at rest using `BETTER_AUTH_SECRET`
-6. Stores the peer record and sealed key in the local gateway database
-
-Once enrollment completes, the peer can authenticate using the certificate and private key.
-
-### List peers
-
-```bash
-mosaic federation peer list
-```
-
-Shows all enrolled peers, including their certificate fingerprints and activation status.
-
-## REST API Reference
-
-All CLI commands call the local gateway admin API. Equivalent REST endpoints:
-
-| CLI Command  | REST Endpoint                                                                               | Method            |
-| ------------ | ------------------------------------------------------------------------------------------- | ----------------- |
-| grant create | `/api/admin/federation/grants`                                                              | POST              |
-| grant list   | `/api/admin/federation/grants`                                                              | GET               |
-| grant show   | `/api/admin/federation/grants/:id`                                                          | GET               |
-| grant revoke | `/api/admin/federation/grants/:id/revoke`                                                   | PATCH             |
-| grant token  | `/api/admin/federation/grants/:id/tokens`                                                   | POST              |
-| peer list    | `/api/admin/federation/peers`                                                               | GET               |
-| peer add     | `/api/admin/federation/peers/keypair` + enrollment + `/api/admin/federation/peers/:id/cert` | POST, POST, PATCH |
-
-## Security Notes
-
- **Enrollment tokens** are single-use and expire in 15 minutes (not configurable beyond 15 minutes)
- **Peer private keys** are encrypted at rest using AES-256-GCM, keyed from `BETTER_AUTH_SECRET`
- **Custom OIDs** in issued certificates are verified post-issuance: the grant ID and subject user ID must match the certificate extensions
- **Grant activation** is atomic — concurrent enrollment attempts for the same grant are rejected
- **Revoked grants** cannot be activated; peers attempting to use a revoked grant's token will be rejected
--- a/docs/federation/MILESTONES.md
+++ b/docs/federation/MILESTONES.md
@@ -1,368 +0,0 @@
-# Mosaic Stack — Federation Implementation Milestones
-
-**Companion to:** `PRD.md`
-**Approach:** Each milestone is a verifiable slice. A milestone is "done" only when its acceptance tests pass in CI against a real (not mocked) dependency stack.
-
---
-
-## Milestone Dependency Graph
-
-```
-M1 (federated tier infra)
-  └── M2 (Step-CA + grant schema + CLI)
-        └── M3 (mTLS handshake + list/get + scope enforcement)
-              ├── M4 (search + audit + rate limit)
-              │     └── M5 (cache + offline degradation + OTEL)
-              ├── M6 (revocation + auto-renewal)  ◄── can start after M3
-              └── M7 (multi-user hardening + e2e suite)  ◄── depends on M4+M5+M6
-```
-
-M5 and M6 can run in parallel once M4 is merged.
-
---
-
-## Test Strategy (applies to all milestones)
-
-Three layers, all required before a milestone ships:
-
-| Layer              | Scope                                         | Runtime                                                                  |
-| ------------------ | --------------------------------------------- | ------------------------------------------------------------------------ |
-| **Unit**           | Per-module logic, pure functions, adapters    | Vitest, no I/O                                                           |
-| **Integration**    | Single gateway against real PG/Valkey/Step-CA | Vitest + Docker Compose test profile                                     |
-| **Federation E2E** | Two gateways on a Docker network, real mTLS   | Playwright/custom harness (`tools/federation-harness/`) introduced in M3 |
-
-Every milestone adds tests to these layers. A milestone cannot be claimed complete if the federation E2E harness fails (applies from M3 onward).
-
-**Quality gates per milestone** (same as stack-wide):
-
- `pnpm typecheck` green
- `pnpm lint` green
- `pnpm test` green (unit + integration)
- `pnpm test:federation` green (M3+)
- Independent code review passed
- Docs updated (`docs/federation/`)
- Merged PR on `main`, CI terminal green, linked issue closed
-
---
-
-## M1 — Federated Tier Infrastructure
-
-**Goal:** A gateway can run in `federated` tier with containerized Postgres + Valkey + pgvector, with no federation logic active yet.
-
-**Scope:**
-
- Add `"tier": "federated"` to `mosaic.config.json` schema and validators
- Docker Compose `federated` profile (`docker-compose.federated.yml`) adds: Postgres+pgvector (5433), Valkey (6380), dedicated volumes
- Tier detector in gateway bootstrap: reads config, asserts required services reachable, refuses to start otherwise
- `pgvector` extension installed + verified on startup
- Migration logic: safe upgrade path from `local`/`standalone` → `federated` (data export/import script, one-way)
- `mosaic doctor` reports tier + service health
- Gateway continues to serve as a normal standalone instance (no federation yet)
-
-**Deliverables:**
-
- `mosaic.config.json` schema v2 (tier enum includes `federated`)
- `apps/gateway/src/bootstrap/tier-detector.ts`
- `docker-compose.federated.yml`
- `scripts/migrate-to-federated.ts`
- Updated `mosaic doctor` output
- Updated `packages/storage/src/adapters/postgres.ts` with pgvector support
-
-**Acceptance tests:**
-| # | Test | Layer |
-| - | ---------------------------------------------------------------------------------------- | ----------- |
-| 1 | Gateway boots in `federated` tier with all services present | Integration |
-| 2 | Gateway refuses to boot in `federated` tier when Postgres unreachable (fail-fast, clear) | Integration |
-| 3 | `pgvector` extension available in target DB (`SELECT * FROM pg_extension WHERE extname='vector'`) | Integration |
-| 4 | Migration script moves a populated `local` (PGlite) instance to `federated` (Postgres) with no data loss | Integration |
-| 5 | `mosaic doctor` reports correct tier and all services green | Unit |
-| 6 | Existing standalone behavior regression: agent session works end-to-end, no federation references | E2E (single-gateway) |
-
-**Estimated budget:** ~20K tokens (infra + config + migration script)
-**Risk notes:** Pgvector install on existing PG installs is occasionally finicky; test the migration path on a realistic DB snapshot.
-
---
-
-## M2 — Step-CA + Grant Schema + Admin CLI
-
-**Goal:** An admin can create a federation grant and its counterparty can enroll. No runtime traffic flows yet.
-
-**Scope:**
-
- Embed Step-CA as a Docker Compose sidecar with a persistent CA volume
- Gateway exposes a short-lived enrollment endpoint (single-use token from the grant)
- DB schema: `federation_grants`, `federation_peers`, `federation_audit_log` (table only, not yet written to)
- Sealed storage for `client_key_pem` using the existing credential sealing key
- Admin CLI:
-  - `mosaic federation grant create --user <id> --peer <host> --scope <file>`
-  - `mosaic federation grant list`
-  - `mosaic federation grant show <id>`
-  - `mosaic federation peer add <enrollment-url>`
-  - `mosaic federation peer list`
- Step-CA signs the cert with SAN OIDs for `grantId` + `subjectUserId`
- Grant status transitions: `pending` → `active` on successful enrollment
-
-**Deliverables:**
-
- `packages/db` migration: three federation tables + enum types
- `apps/gateway/src/federation/ca.service.ts` (Step-CA client)
- `apps/gateway/src/federation/grants.service.ts`
- `apps/gateway/src/federation/enrollment.controller.ts`
- `packages/mosaic/src/commands/federation/` (grant + peer subcommands)
- `docker-compose.federated.yml` adds Step-CA service
- Scope JSON schema + validator
-
-**Acceptance tests:**
-| # | Test | Layer |
-| - | ---------------------------------------------------------------------------------------- | ----------- |
-| 1 | `grant create` writes a `pending` row with a scoped bundle | Integration |
-| 2 | Enrollment endpoint signs a CSR and returns a cert with expected SAN OIDs | Integration |
-| 3 | Enrollment token is single-use; second attempt returns 410 | Integration |
-| 4 | Cert `subjectUserId` OID matches the grant's `subject_user_id` | Unit |
-| 5 | `client_key_pem` is at-rest encrypted; raw DB read shows ciphertext, not PEM | Integration |
-| 6 | `peer add <url>` on Server A yields an `active` peer record with a valid cert + key | E2E (two gateways, no traffic) |
-| 7 | Scope JSON with unknown resource type rejected at `grant create` | Unit |
-| 8 | `grant list` and `peer list` render active / pending / revoked accurately | Unit |
-
-**Estimated budget:** ~30K tokens (schema + CA integration + CLI + sealing)
-**Risk notes:** Step-CA's API surface is well-documented but the sealing integration with existing provider-credential encryption is a cross-module concern — walk that seam deliberately.
-
---
-
-## M3 — mTLS Handshake + `list` + `get` with Scope Enforcement
-
-**Goal:** Two federated gateways exchange real data over mTLS with scope intersecting native RBAC.
-
-**Scope:**
-
- `FederationClient` (outbound): picks cert from `federation_peers`, does mTLS call
- `FederationServer` (inbound): NestJS guard validates client cert, extracts `grantId` + `subjectUserId`, loads grant
- Scope enforcement pipeline:
-  1. Resource allowlist / excluded-list check
-  2. Native RBAC evaluation as the `subjectUserId`
-  3. Scope filter intersection (`include_teams`, `include_personal`)
-  4. `max_rows_per_query` cap
- Verbs: `list`, `get`, `capabilities`
- Gateway query layer accepts `source: "local" | "federated:<host>" | "all"`; fan-out for `"all"`
- **Federation E2E harness** (`tools/federation-harness/`): docker-compose.two-gateways.yml, seed script, assertion helpers — this is its own deliverable
-
-**Deliverables:**
-
- `apps/gateway/src/federation/client/federation-client.service.ts`
- `apps/gateway/src/federation/server/federation-auth.guard.ts`
- `apps/gateway/src/federation/server/scope.service.ts`
- `apps/gateway/src/federation/server/verbs/{list,get,capabilities}.controller.ts`
- `apps/gateway/src/federation/client/query-source.service.ts` (fan-out/merge)
- `tools/federation-harness/` (compose + seed + test helpers)
- `packages/types` — federation request/response DTOs in `federation.dto.ts`
-
-**Acceptance tests:**
-| # | Test | Layer |
-| -- | -------------------------------------------------------------------------------------------------------- | ----- |
-| 1 | A→B `list tasks` returns subjectUser's tasks intersected with scope | E2E |
-| 2 | A→B `list tasks` with `include_teams: [T1]` excludes T2 tasks the user owns | E2E |
-| 3 | A→B `get credential <id>` returns 403 when `credentials` is in `excluded_resources` | E2E |
-| 4 | Client presenting cert for grant X cannot query subjectUser of grant Y (cross-user isolation) | E2E |
-| 5 | Cert signed by untrusted CA rejected at TLS layer (no NestJS handler reached) | E2E |
-| 6 | Malformed SAN OIDs → 401; cert valid but grant revoked in DB → 403 | Integration |
-| 7 | `max_rows_per_query` caps response; request for more paginated | Integration |
-| 8 | `source: "all"` fan-out merges local + federated results, each tagged with `_source` | Integration |
-| 9 | Federation responses never persist: verify DB row count unchanged after `list` round-trip | E2E |
-| 10 | Scope cannot grant more than native RBAC: user without access to team T still gets [] even if scope allows T | E2E |
-
-**Estimated budget:** ~40K tokens (largest milestone — core federation logic + harness)
-**Risk notes:** This is the critical trust boundary. Code review should focus on scope enforcement bypass and cert-SAN-spoofing paths. Every 403/401 path needs a test.
-
---
-
-## M4 — `search` Verb + Audit Log + Rate Limit
-
-**Goal:** Keyword search over allowed resources with full audit and per-grant rate limiting.
-
-**Scope:**
-
- `search` verb across `resources` allowlist (intersection of scope + native RBAC)
- Keyword search (reuse existing `packages/memory/src/adapters/keyword.ts`); pgvector search stays out of v1 search verb
- Every federated request (all verbs) writes to `federation_audit_log`: `grant_id`, `verb`, `resource`, `query_hash`, `outcome`, `bytes_out`, `latency_ms`
- No request body captured; `query_hash` is SHA-256 of normalized query params
- Token-bucket rate limit per grant (default 60/min, override per grant)
- 429 response with `Retry-After` header and structured body
- 90-day hot retention for audit log; cold-tier rollover deferred to M7
-
-**Deliverables:**
-
- `apps/gateway/src/federation/server/verbs/search.controller.ts`
- `apps/gateway/src/federation/server/audit.service.ts` (async write, no blocking)
- `apps/gateway/src/federation/server/rate-limit.guard.ts`
- Tests in harness
-
-**Acceptance tests:**
-| # | Test | Layer |
-| - | ------------------------------------------------------------------------------------------------- | ----------- |
-| 1 | `search` returns ranked hits only from allowed resources | E2E |
-| 2 | `search` excluding `credentials` does not return a match even when keyword matches a credential name | E2E |
-| 3 | Every successful request appears in `federation_audit_log` within 1s | Integration |
-| 4 | Denied request (403) is also audited with `outcome='denied'` | Integration |
-| 5 | Audit row stores query hash but NOT query body | Unit |
-| 6 | 61st request in 60s window returns 429 with `Retry-After` | E2E |
-| 7 | Per-grant override (e.g., 600/min) takes effect without restart | Integration |
-| 8 | Audit writes are async: request latency unchanged when audit write slow (simulated) | Integration |
-
-**Estimated budget:** ~20K tokens
-**Risk notes:** Ensure audit writes can't block or error-out the request path; use a bounded queue and drop-with-counter pattern rather than in-line writes.
-
---
-
-## M5 — Cache + Offline Degradation + Observability
-
-**Goal:** Sessions feel fast and stay useful when the peer is slow or down.
-
-**Scope:**
-
- In-memory response cache keyed by `(grant_id, verb, resource, query_hash)`, TTL 30s default
- Cache NOT used for `search`; only `list` and `get`
- Cache flushed on cert rotation and grant revocation
- Circuit breaker per peer: after N failures, fast-fail for cooldown window
- `_source` tagging extended with `_cached: true` when served from cache
- Agent-visible "federation offline for `<peer>`" signal emitted once per session per peer
- OTEL spans: `federation.request` with attrs `grant_id`, `peer`, `verb`, `resource`, `outcome`, `latency_ms`, `cached`
- W3C `traceparent` propagated across the mTLS boundary (both directions)
- `mosaic federation status` CLI subcommand
-
-**Deliverables:**
-
- `apps/gateway/src/federation/client/response-cache.service.ts`
- `apps/gateway/src/federation/client/circuit-breaker.service.ts`
- `apps/gateway/src/federation/observability/` (span helpers)
- `packages/mosaic/src/commands/federation/status.ts`
-
-**Acceptance tests:**
-| # | Test | Layer |
-| - | --------------------------------------------------------------------------------------------- | ----- |
-| 1 | Two identical `list` calls within 30s: second served from cache, flagged `_cached` | Integration |
-| 2 | `search` is never cached: two identical searches both hit the peer | Integration |
-| 3 | After grant revocation, peer's cache is flushed immediately | Integration |
-| 4 | After N consecutive failures, circuit opens; subsequent requests fail-fast without network call | E2E |
-| 5 | Circuit closes after cooldown and next success | E2E |
-| 6 | With peer offline, session completes using local data, one "federation offline" signal surfaced | E2E |
-| 7 | OTEL traces show spans on both gateways correlated by `traceparent` | E2E |
-| 8 | `mosaic federation status` prints peer state, cert expiry, last success/failure, circuit state | Unit |
-
-**Estimated budget:** ~20K tokens
-**Risk notes:** Caching correctness under revocation must be provable — write tests that intentionally race revocation against cached hits.
-
---
-
-## M6 — Revocation, Auto-Renewal, CRL
-
-**Goal:** Grant lifecycle works end-to-end: admin revoke, revoke-on-delete, automatic cert renewal, CRL distribution.
-
-**Scope:**
-
- `mosaic federation grant revoke <id>` → status `revoked`, CRL updated, audit entry
- DB hook: deleting a user cascades `revoke-on-delete` on all grants where that user is subject
- Step-CA CRL endpoint exposed; serving gateway enforces CRL check on every handshake (cached CRL, refresh interval 60s)
- Client-side cert renewal job: at T-7 days, submit renewal CSR; rotate cert atomically; flush cache
- On renewal failure, peer marked `degraded` and admin-visible alert emitted
- Server A detects revocation on next request (TLS handshake fails with specific error) → peer marked `revoked`, user notified
-
-**Deliverables:**
-
- `apps/gateway/src/federation/server/crl.service.ts` + endpoint
- `apps/gateway/src/federation/server/revocation.service.ts`
- DB cascade trigger or ORM hook for user deletion → grant revocation
- `apps/gateway/src/federation/client/renewal.job.ts` (scheduled)
- `packages/mosaic/src/commands/federation/grant.ts` gains `revoke` subcommand
-
-**Acceptance tests:**
-| # | Test | Layer |
-| - | ----------------------------------------------------------------------------------------- | ----- |
-| 1 | Admin `grant revoke` → A's next request fails with TLS-level error | E2E |
-| 2 | Deleting subject user on B auto-revokes all grants where that user was the subject | Integration |
-| 3 | CRL endpoint serves correct list; revoked cert present | Integration |
-| 4 | Server rejects cert listed in CRL even if cert itself is still time-valid | E2E |
-| 5 | Cert at T-7 days triggers renewal job; new cert issued and installed without dropped requests | E2E |
-| 6 | Renewal failure marks peer `degraded` and surfaces alert | Integration |
-| 7 | A marks peer `revoked` after a revocation-caused handshake failure (not on transient network errors) | E2E |
-
-**Estimated budget:** ~20K tokens
-**Risk notes:** The atomic cert swap during renewal is the sharpest edge here — any in-flight request mid-swap must either complete on old or retry on new, never fail mid-call.
-
---
-
-## M7 — Multi-User RBAC Hardening + Team-Scoped Grants + Acceptance Suite
-
-**Goal:** The full multi-tenant scenario from §4 user stories works end-to-end, with no cross-user leakage under any circumstance.
-
-**Scope:**
-
- Three-user scenario on Server B (E1, E2, E3) each with their own Server A
- Team-scoped grants exercised: each employee's team-data visible on their own A, but E1's personal data never visible on E2's A
- User-facing UI surfaces on both gateways for: peer list, grant list, audit log viewer, scope editor
- Negative-path test matrix (every denial path from PRD §8)
- All PRD §15 acceptance criteria mapped to automated tests in the harness
- Security review: cert-spoofing, scope-bypass, audit-bypass paths explicitly tested
- Cold-storage rollover for audit log >90 days
- Docs: operator runbook, onboarding guide, troubleshooting guide
-
-**Deliverables:**
-
- Full federation acceptance suite in `tools/federation-harness/acceptance/`
- `apps/web` surfaces for peer/grant/audit management
- `docs/federation/RUNBOOK.md`, `docs/federation/ONBOARDING.md`, `docs/federation/TROUBLESHOOTING.md`
- Audit cold-tier job (daily cron, moves rows >90d to separate table or object storage)
-
-**Acceptance tests:**
-Every PRD §15 criterion must be automated and green. Additionally:
-
-| #   | Test                                                                                                  | Layer            |
-| --- | ----------------------------------------------------------------------------------------------------- | ---------------- |
-| 1   | 3-employee scenario: each A sees only its user's data from B                                          | E2E              |
-| 2   | Grant with team scope returns team data; same grant denied access to another employee's personal data | E2E              |
-| 3   | Concurrent sessions from E1's and E2's Server A to B interleave without any leakage                   | E2E              |
-| 4   | Audit log across 3-user test shows per-grant trails with no mis-attributed rows                       | E2E              |
-| 5   | Scope editor UI round-trip: edit → save → next request uses new scope                                 | E2E              |
-| 6   | Attempt to use a revoked grant's cert against a different grant's endpoint: rejected                  | E2E              |
-| 7   | 90-day-old audit rows moved to cold tier; queryable via explicit historical query                     | Integration      |
-| 8   | Runbook steps validated: an operator following the runbook can onboard, rotate, and revoke            | Manual checklist |
-
-**Estimated budget:** ~25K tokens
-**Risk notes:** This is the security-critical milestone. Budget review time here is non-negotiable — plan for two independent code reviews (internal + security-focused) before merge.
-
---
-
-## Total Budget & Timeline Sketch
-
-| Milestone | Tokens (est.) | Can parallelize?       |
-| --------- | ------------- | ---------------------- |
-| M1        | 20K           | No (foundation)        |
-| M2        | 30K           | No (needs M1)          |
-| M3        | 40K           | No (needs M2)          |
-| M4        | 20K           | No (needs M3)          |
-| M5        | 20K           | Yes (with M6 after M4) |
-| M6        | 20K           | Yes (with M5 after M3) |
-| M7        | 25K           | No (needs all)         |
-| **Total** | **~175K**     |                        |
-
-Parallelization of M5 and M6 after M4 saves one milestone's worth of serial time.
-
---
-
-## Exit Criteria (federation feature complete)
-
-All of the following must be green on `main`:
-
- Every PRD §15 acceptance criterion automated and passing
- Every milestone's acceptance table green
- Security review sign-off on M7
- Runbook walk-through completed by operator (not author)
- `mosaic doctor` recognizes federated tier and reports peer health accurately
- Two-gateway production deployment (woltje.com ↔ uscllc.com) operational for ≥7 days without incident
-
---
-
-## Next Step After This Doc Is Approved
-
-1. File tracking issues on `git.mosaicstack.dev/mosaicstack/stack` — one per milestone, labeled `epic:federation`
-2. Populate `docs/TASKS.md` with M1's task breakdown (per-task agent assignment, budget, dependencies)
-3. Begin M1 implementation
--- a/docs/federation/MISSION-MANIFEST.md
+++ b/docs/federation/MISSION-MANIFEST.md
@@ -1,108 +0,0 @@
-# Mission Manifest — Federation v1
-
-> Persistent document tracking full mission scope, status, and session history.
-> Updated by the orchestrator at each phase transition and milestone completion.
-
-## Mission
-
-**ID:** federation-v1-20260419
-**Statement:** Jarvis operates across 3–4 workstations in two physical locations (home, USC). The user currently reaches back to a single jarvis-brain checkout from every session; a prior OpenBrain attempt caused cache, latency, and opacity pain. This mission builds asymmetric federation between Mosaic Stack gateways so that a session on a user's home gateway can query their work gateway in real time without data ever persisting across the boundary, with full multi-tenant isolation and standard-PKI (X.509 / Step-CA) trust management.
-**Phase:** M3 active — mTLS handshake + list/get/capabilities verbs + scope enforcement
-**Current Milestone:** FED-M3
-**Progress:** 2 / 7 milestones
-**Status:** active
-**Last Updated:** 2026-04-21 (M2 closed via PR #503, tag `fed-v0.2.0-m2`, issue #461 closed; M3 decomposed into 14 tasks)
-**Parent Mission:** None — new mission
-
-## Test Infrastructure
-
-| Host                    | Role                                | Image                                 | Tier      |
-| ----------------------- | ----------------------------------- | ------------------------------------- | --------- |
-| `mos-test-1.woltje.com` | Federation Server A (querying side) | `gateway:fed-v0.1.0-m1` (M1 baseline) | federated |
-| `mos-test-2.woltje.com` | Federation Server B (serving side)  | `gateway:fed-v0.1.0-m1` (M1 baseline) | federated |
-
-These are TEST hosts for federation E2E (M3+). Distinct from PRD AC-12 production targets (`woltje.com` ↔ `uscllc.com`). Deployment workstream tracked in `docs/federation/TASKS.md` under FED-M2-DEPLOY-\*.
-
-## Context
-
-Federation is the solution to what originally drove OpenBrain. The prior attempt coupled every agent session to a remote service, introduced cache/latency/opacity pain, and created a hard dependency that punished offline use. This redesign:
-
-1. Makes federation **gateway-to-gateway**, not agent-to-service
-2. Keeps each user's home instance as source of truth for their data
-3. Exposes scoped, read-only data on demand without persisting across the boundary
-4. Uses X.509 mTLS via Step-CA so rotation/revocation/CRL/OCSP are standard
-5. Supports multi-tenant serving sides (employees on uscllc.com each federating back to their own home gateway) with no cross-user leakage
-6. Requires federation-tier instances on both sides (PG + pgvector + Valkey) — local/standalone tiers cannot federate
-7. Works over public HTTPS (no VPN required); Tailscale is an optional overlay
-
-Key design references:
-
- `docs/federation/PRD.md` — 16-section product requirements
- `docs/federation/MILESTONES.md` — 7-milestone decomposition with per-milestone acceptance tests
- `docs/federation/TASKS.md` — per-task breakdown (M1 populated; M2-M7 deferred to mission planning)
- `docs/research/mempalace-evaluation/` (in jarvis-brain) — why we didn't adopt MemPalace
-
-## Success Criteria
-
- [ ] AC-1: Two Mosaic Stack gateways on different hosts can establish a federation grant via CLI-driven onboarding
- [ ] AC-2: Server A can query Server B for `tasks`, `notes`, `memory` respecting scope filters
- [ ] AC-3: User on B with no grant cannot be queried by A, even if A has a valid grant for another user (cross-user isolation)
- [ ] AC-4: Revoking a grant on B causes A's next request to fail with a clear error within one request cycle
- [ ] AC-5: Cert rotation happens automatically at T-7 days; in-progress session survives rotation without user action
- [ ] AC-6: Rate-limit enforcement returns 429 with `Retry-After`; client backs off
- [ ] AC-7: With B unreachable, a session on A completes using local data and surfaces "federation offline for `<peer>`" once per session
- [ ] AC-8: Every federated request appears in B's `federation_audit_log` within 1 second
- [ ] AC-9: Scope excluding `credentials` means credentials are never returned — even via `search` with matching keywords
- [ ] AC-10: `mosaic federation status` shows cert expiry, grant status, last success/failure per peer
- [ ] AC-11: Full 3-employee multi-tenant scenario passes with no cross-user leakage
- [ ] AC-12: Two-gateway production deployment (woltje.com ↔ uscllc.com) operational ≥7 days without incident
- [ ] AC-13: All 7 milestones ship as merged PRs with green CI and closed issues
-
-## Milestones
-
-| #   | ID     | Name                                          | Status      | Branch             | Issue | Started    | Completed  |
-| --- | ------ | --------------------------------------------- | ----------- | ------------------ | ----- | ---------- | ---------- |
-| 1   | FED-M1 | Federated tier infrastructure                 | done        | (12 PRs #470-#481) | #460  | 2026-04-19 | 2026-04-19 |
-| 2   | FED-M2 | Step-CA + grant schema + admin CLI            | done        | (PRs #483-#503)    | #461  | 2026-04-21 | 2026-04-21 |
-| 3   | FED-M3 | mTLS handshake + list/get + scope enforcement | in-progress | (decomposition)    | #462  | 2026-04-21 | —          |
-| 4   | FED-M4 | search verb + audit log + rate limit          | not-started | —                  | #463  | —          | —          |
-| 5   | FED-M5 | Cache + offline degradation + OTEL            | not-started | —                  | #464  | —          | —          |
-| 6   | FED-M6 | Revocation + auto-renewal + CRL               | not-started | —                  | #465  | —          | —          |
-| 7   | FED-M7 | Multi-user RBAC hardening + acceptance suite  | not-started | —                  | #466  | —          | —          |
-
-## Budget
-
-| Milestone | Est. tokens | Parallelizable?        |
-| --------- | ----------- | ---------------------- |
-| FED-M1    | 20K         | No (foundation)        |
-| FED-M2    | 30K         | No (needs M1)          |
-| FED-M3    | 40K         | No (needs M2)          |
-| FED-M4    | 20K         | No (needs M3)          |
-| FED-M5    | 20K         | Yes (with M6 after M4) |
-| FED-M6    | 20K         | Yes (with M5 after M3) |
-| FED-M7    | 25K         | No (needs all)         |
-| **Total** | **~175K**   |                        |
-
-## Session History
-
-| Session | Date                    | Runtime | Outcome                                                                                                                               |
-| ------- | ----------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| S1      | 2026-04-19              | claude  | PRD authored, MILESTONES decomposed, 7 issues filed                                                                                   |
-| S2-S4   | 2026-04-19              | claude  | FED-M1 complete: 12 tasks (PRs #470-#481) merged; tag `fed-v0.1.0-m1`                                                                 |
-| S5-S22  | 2026-04-19 → 2026-04-21 | claude  | FED-M2 complete: 13 tasks (PRs #483-#503) merged; tag `fed-v0.2.0-m2`; issue #461 closed. Step-CA + grant schema + admin CLI shipped. |
-| S23     | 2026-04-21              | claude  | M3 decomposed into 14 tasks in `docs/federation/TASKS.md`. Manifest M3 row → in-progress. Next: kickoff M3-01.                        |
-
-## Next Step
-
-FED-M3 active. Decomposition landed in `docs/federation/TASKS.md` (M3-01..M3-14, ~100K estimate). Tracking issue #462.
-
-Execution plan (parallel where possible):
-
- **Foundation**: M3-01 (DTOs in `packages/types/src/federation/`) starts immediately — sonnet subagent on `feat/federation-m3-types`. Blocks all server + client work.
- **Server stream** (after M3-01): M3-03 (AuthGuard) + M3-04 (ScopeService) in series, then M3-05 / M3-06 / M3-07 (verbs) in parallel.
- **Client stream** (after M3-01, parallel with server): M3-08 (FederationClient) → M3-09 (QuerySourceService).
- **Harness** (parallel with everything): M3-02 (`tools/federation-harness/`) — needed for M3-11.
- **Test gates**: M3-10 (Integration) → M3-11 (E2E with harness) → M3-12 (Independent security review, two rounds budgeted).
- **Close**: M3-13 (Docs) → M3-14 (release tag `fed-v0.3.0-m3`, close #462).
-
-**Test-bed fallback:** `mos-test-1/-2` deploy is still blocked on `FED-M2-DEPLOY-IMG-FIX`. The harness in M3-02 ships a local two-gateway docker-compose so M3-11 is not blocked. Production-host validation is M7's responsibility (PRD AC-12).
--- a/docs/federation/PRD.md
+++ b/docs/federation/PRD.md
@@ -1,330 +0,0 @@
-# Mosaic Stack — Federation PRD
-
-**Status:** Draft v1 (locked for implementation)
-**Owner:** Jason
-**Date:** 2026-04-19
-**Scope:** Enables cross-instance data federation between Mosaic Stack gateways with asymmetric trust, multi-tenant scoping, and no cross-boundary data persistence.
-
---
-
-## 1. Problem Statement
-
-Jarvis operates across 3–4 workstations in two physical locations (home, USC). The user currently reaches back to a single jarvis-brain checkout from every session, and has tried OpenBrain to solve cross-session state — with poor results (cache invalidation, latency, opacity, hard dependency on a remote service).
-
-The goal is a federation model where each user's **home instance** remains the source of truth for their personal data, and **work/shared instances** expose scoped data to that user's home instance on demand — without persisting anything across the boundary.
-
-## 2. Goals
-
-1. A user logged into their **home gateway** (Server A) can query their **work gateway** (Server B) in real time during a session.
-2. Data returned from Server B is used in-session only; never written to Server A storage.
-3. Server B has multiple users, each with their own Server A. No user's data leaks to another user.
-4. Federation works over public HTTPS (no VPN required). Tailscale is a supported optional overlay.
-5. Sync latency target: seconds, or at the next data need of the agent.
-6. Graceful degradation: if the remote instance is unreachable, the local session continues with local data and a clear "federation offline" signal.
-7. Teams exist on both sides. A federation grant can share **team-owned** data without exposing other team members' personal data.
-8. Auth and revocation use standard PKI (X.509) so that certificate tooling (Step-CA, rotation, OCSP, CRL) is available out of the box.
-
-## 3. Non-Goals (v1)
-
- Mesh federation (N-to-N). v1 is strictly A↔B pairs.
- Cross-instance writes. All federation is **read-only** on the remote side.
- Shared agent sessions across instances. Sessions live on one instance; federation is data-plane only.
- Cross-instance SSO. Each instance owns its own BetterAuth identity store; federation is service-to-service, not user-to-user.
- Realtime push from B→A. v1 is pull-only (A pulls from B during a session).
- Global search index. Federation is query-by-query, not index replication.
-
-## 4. User Stories
-
- **US-1 (Solo user at home):** As the sole user on Server A, I want my agent session on workstation-1 to see the same data it saw on workstation-2, without running OpenBrain.
- **US-2 (Cross-location):** As a user with a home server and a work server, I want a session on my home laptop to transparently pull my USC-owned tasks/notes when I ask for them.
- **US-3 (Work admin):** As the admin of mosaic.uscllc.com, I want to grant each employee's home gateway scoped read access to only their own data plus explicitly-shared team data.
- **US-4 (Privacy boundary):** As employee A on mosaic.uscllc.com, my data must never appear in a session on employee B's home gateway — even if both are federated with uscllc.com.
- **US-5 (Revocation):** As a work admin, when I delete an employee, their home gateway loses access within one request cycle.
- **US-6 (Offline):** As a user in a hotel with flaky wifi, my local session keeps working; federation calls fail fast and are reported as "offline," not hung.
-
-## 5. Architecture Overview
-
-```
-┌─────────────────────────────────────┐     mTLS / X.509         ┌─────────────────────────────────────┐
-│  Server A — mosaic.woltje.com       │ ───────────────────────► │  Server B — mosaic.uscllc.com        │
-│  (home, master for Jason)           │   ◄── JSON over HTTPS    │  (work, multi-tenant)                │
-│                                     │                          │                                      │
-│  ┌──────────────┐  ┌──────────────┐ │                          │ ┌──────────────┐  ┌──────────────┐  │
-│  │  Gateway     │  │  Postgres    │ │                          │ │  Gateway     │  │  Postgres    │  │
-│  │  (NestJS)    │──│  (local SSOT)│ │                          │ │  (NestJS)    │──│  (tenant SSOT)│ │
-│  └──────┬───────┘  └──────────────┘ │                          │ └──────┬───────┘  └──────────────┘  │
-│         │                           │                          │        │                             │
-│         │  FederationClient         │                          │        │  FederationServer           │
-│         │  (outbound, scoped query) │                          │        │  (inbound, RBAC-gated)      │
-│         └───────────────────────────┼──────────────────────────┼────────┘                             │
-│                                     │                          │                                      │
-│  Step-CA (issues A's client cert)   │                          │  Step-CA (issues B's server cert,    │
-│                                     │                          │           trusts A's CA root on grant)│
-└─────────────────────────────────────┘                          └──────────────────────────────────────┘
-```
-
- Federation is a **transport-layer** concern between two gateways, implemented as a new internal module on each gateway.
- Both sides run the same code. Direction (client vs. server role) is per-request.
- Nothing in the agent runtime changes — agents query the gateway; the gateway decides local vs. remote.
-
-## 6. Transport & Authentication
-
-**Transport:** HTTPS with mutual TLS (mTLS).
-
-**Identity:** X.509 client certificates issued by Step-CA. Each federation grant materializes as a client cert on the requesting side and a trust-anchor entry (CA root or explicit cert) on the serving side.
-
-**Why mTLS over HMAC bearer tokens:**
-
- Standard rotation/revocation semantics (renew, CRL, OCSP).
- The cert subject carries identity claims (user, grant_id) that don't need a separate DB lookup to verify authenticity.
- Client certs never transit request bodies, so they can't be logged by accident.
- Transport is pinned at the TLS layer, not re-validated per-handler.
-
-**Cert contents (SAN + subject):**
-
- `CN=grant-<uuid>`
- `O=<requesting-server-hostname>` (e.g., `mosaic.woltje.com`)
- Custom OIDs embedded in SAN otherName:
-  - `mosaic.federation.grantId` (UUID)
-  - `mosaic.federation.subjectUserId` (user on the **serving** side that this grant acts-as)
- Default lifetime: **30 days**, with auto-renewal at T-7 days if the grant is still active.
-
-**Step-CA topology (v1):** Each server runs its own Step-CA instance. During onboarding, the serving side imports the requesting side's CA root. A central/shared Step-CA is out of scope for v1.
-
-**Handshake:**
-
-1. Client (A) opens HTTPS to B with its grant cert.
-2. B validates cert chain against trusted CA roots for that grant.
-3. B extracts `grantId` and `subjectUserId` from the cert.
-4. B loads the grant record, checks it is `active`, not revoked, and not expired.
-5. B enforces scope and rate-limit for this grant.
-6. Request proceeds; response returned.
-
-## 7. Data Model
-
-All tables live on **each instance's own Postgres**. Federation grants are bilateral — each side has a record of the grant.
-
-### 7.1 `federation_grants` (on serving side, Server B)
-
-| Field                       | Type        | Notes                                             |
-| --------------------------- | ----------- | ------------------------------------------------- |
-| `id`                        | uuid PK     |                                                   |
-| `subject_user_id`           | uuid FK     | Which local user this grant acts-as               |
-| `requesting_server`         | text        | Hostname of requesting gateway (e.g., woltje.com) |
-| `requesting_ca_fingerprint` | text        | SHA-256 of trusted CA root                        |
-| `active_cert_fingerprint`   | text        | SHA-256 of currently valid client cert            |
-| `scope`                     | jsonb       | See §8                                            |
-| `rate_limit_rpm`            | int         | Default 60                                        |
-| `status`                    | enum        | `pending`, `active`, `suspended`, `revoked`       |
-| `created_at`                | timestamptz |                                                   |
-| `activated_at`              | timestamptz |                                                   |
-| `revoked_at`                | timestamptz |                                                   |
-| `last_used_at`              | timestamptz |                                                   |
-| `notes`                     | text        | Admin-visible description                         |
-
-### 7.2 `federation_peers` (on requesting side, Server A)
-
-| Field                 | Type        | Notes                                            |
-| --------------------- | ----------- | ------------------------------------------------ |
-| `id`                  | uuid PK     |                                                  |
-| `peer_hostname`       | text        | e.g., `mosaic.uscllc.com`                        |
-| `peer_ca_fingerprint` | text        | SHA-256 of peer's CA root                        |
-| `grant_id`            | uuid        | The grant ID assigned by the peer                |
-| `local_user_id`       | uuid FK     | Who on Server A this federation belongs to       |
-| `client_cert_pem`     | text (enc)  | Current client cert (PEM); rotated automatically |
-| `client_key_pem`      | text (enc)  | Private key (encrypted at rest)                  |
-| `cert_expires_at`     | timestamptz |                                                  |
-| `status`              | enum        | `pending`, `active`, `degraded`, `revoked`       |
-| `last_success_at`     | timestamptz |                                                  |
-| `last_failure_at`     | timestamptz |                                                  |
-| `notes`               | text        |                                                  |
-
-### 7.3 `federation_audit_log` (on serving side, Server B)
-
-| Field         | Type        | Notes                                            |
-| ------------- | ----------- | ------------------------------------------------ |
-| `id`          | uuid PK     |                                                  |
-| `grant_id`    | uuid FK     |                                                  |
-| `occurred_at` | timestamptz | indexed                                          |
-| `verb`        | text        | `query`, `handshake`, `rejected`, `rate_limited` |
-| `resource`    | text        | e.g., `tasks`, `notes`, `credentials`            |
-| `query_hash`  | text        | SHA-256 of normalized query (no payload stored)  |
-| `outcome`     | text        | `ok`, `denied`, `error`                          |
-| `bytes_out`   | int         |                                                  |
-| `latency_ms`  | int         |                                                  |
-
-**Audit policy:** Every federation request is logged on the serving side. Read-only requests only — no body capture. Retention: 90 days hot, then roll to cold storage.
-
-## 8. RBAC & Scope
-
-Every federation grant has a scope object that answers three questions for every inbound request:
-
-1. **Who is acting?** — `subject_user_id` from the cert.
-2. **What resources?** — an allowlist of resource types (`tasks`, `notes`, `credentials`, `memory`, `teams/:id/tasks`, …).
-3. **Filter expression** — predicates applied on top of the subject's normal RBAC (see below).
-
-### 8.1 Scope schema
-
-```json
-{
-  "resources": ["tasks", "notes", "memory"],
-  "filters": {
-    "tasks": { "include_teams": ["team_uuid_1", "team_uuid_2"], "include_personal": true },
-    "notes": { "include_personal": true, "include_teams": [] },
-    "memory": { "include_personal": true }
-  },
-  "excluded_resources": ["credentials", "api_keys"],
-  "max_rows_per_query": 500
-}
-```
-
-### 8.2 Access rule (enforced on serving side)
-
-For every inbound federated query on resource R:
-
-1. Resolve effective identity → `subject_user_id`.
-2. Check R is in `scope.resources` and NOT in `scope.excluded_resources`. Otherwise 403.
-3. Evaluate the user's **normal RBAC** (what would they see if they logged into Server B directly)?
-4. Intersect with the scope filter (e.g., only team X, only personal).
-5. Apply `max_rows_per_query`.
-6. Return; log to audit.
-
-### 8.3 Team boundary guarantees
-
- Scope filters are additive, never subtractive of the native RBAC. A grant cannot grant access the user would not have had themselves.
- `include_teams` means "only these teams," not "these teams in addition to all teams."
- `include_personal: false` hides the user's personal data entirely from federation, even if they own it — useful for work-only accounts.
-
-### 8.4 No cross-user leakage
-
-When Server B has multiple users (employees) all federating back to their own Server A:
-
- Each employee has their own grant with their own `subject_user_id`.
- The cert is bound to a specific grant; there is no mechanism by which one grant's cert can be used to impersonate another.
- Audit log is per-grant.
-
-## 9. Query Model
-
-Federation exposes a **narrow read API**, not arbitrary SQL.
-
-### 9.1 Supported verbs (v1)
-
-| Verb           | Purpose                                    | Returns                         |
-| -------------- | ------------------------------------------ | ------------------------------- |
-| `list`         | Paginated list of a resource type          | Array of resources              |
-| `get`          | Fetch a single resource by id              | One resource or 404             |
-| `search`       | Keyword search within allowed resources    | Ranked list of hits             |
-| `capabilities` | What this grant is allowed to do right now | Scope object + rate-limit state |
-
-### 9.2 Not in v1
-
- Write verbs.
- Aggregations / analytics.
- Streaming / subscriptions (future: see §13).
-
-### 9.3 Agent-facing integration
-
-Agents never call federation directly. Instead:
-
- The gateway query layer accepts `source: "local" | "federated:<peer_hostname>" | "all"`.
- `"all"` fans out in parallel, merges results, tags each with `_source`.
- Federation results are in-memory only; the gateway does not persist them.
-
-## 10. Caching
-
- **In-memory response cache** with short TTL (default 30s) for `list` and `get`. `search` is not cached.
- Cache is keyed by `(grant_id, verb, resource, query_hash)`.
- Cache is flushed on cert rotation and on grant revocation.
- No disk cache. No cross-session cache.
-
-## 11. Bootstrap & Onboarding
-
-### 11.1 Instance capability tiers
-
-| Tier         | Storage  | Queue   | Memory   | Can federate?         |
-| ------------ | -------- | ------- | -------- | --------------------- |
-| `local`      | PGlite   | in-proc | keyword  | No                    |
-| `standalone` | Postgres | Valkey  | keyword  | No (can be client)    |
-| `federated`  | Postgres | Valkey  | pgvector | Yes (server + client) |
-
-Federation requires `federated` tier on **both** sides.
-
-### 11.2 Onboarding flow (admin-driven)
-
-1. Admin on Server B runs `mosaic federation grant create --user <user-id> --peer <peer-hostname> --scope-file scope.json`.
-2. Server B generates a `grant_id`, prints a one-time enrollment URL containing the grant ID + B's CA root fingerprint.
-3. Admin on Server A (or the user themselves, if allowed) runs `mosaic federation peer add <enrollment-url>`.
-4. Server A's Step-CA generates a CSR for the new grant. A submits the CSR to B over a short-lived enrollment endpoint (single-use token in the enrollment URL).
-5. B's Step-CA signs the cert (with grant ID embedded in SAN OIDs), returns it.
-6. A stores the signed cert + private key (encrypted) in `federation_peers`.
-7. Grant status flips from `pending` to `active` on both sides.
-8. Cert auto-renews at T-7 days using the standard Step-CA renewal flow as long as the grant remains active.
-
-### 11.3 Revocation
-
- **Admin-initiated:** `mosaic federation grant revoke <grant-id>` on B flips status to `revoked`, adds the cert to B's CRL, and writes an audit entry.
- **Revoke-on-delete:** Deleting a user on B automatically revokes all grants where that user is the subject.
- Server A learns of revocation on the next request (TLS handshake fails) and flips the peer to `revoked`.
-
-### 11.4 Rate limit
-
-Default `60 req/min` per grant. Configurable per grant. Enforced at the serving side. A rate-limited request returns `429` with `Retry-After`.
-
-## 12. Operational Concerns
-
- **Observability:** Each federation request emits an OTEL span with `grant_id`, `peer`, `verb`, `resource`, `outcome`, `latency_ms`. Traces correlate across both servers via W3C traceparent.
- **Health check:** `mosaic federation status` on each side shows active grants, last-success times, cert expirations, and any CRL mismatches.
- **Backpressure:** If the serving side is overloaded, it returns `503` with a structured body; the client marks the peer `degraded` and falls back to local-only until the next successful handshake.
- **Secrets:** `client_key_pem` in `federation_peers` is encrypted with the gateway's key (sealed with the instance's master key — same mechanism as `provider_credentials`).
- **Credentials never cross:** The `credentials` resource type is in the default excluded list. It must be explicitly added to scope (admin action, logged) and even then is per-grant and per-user.
-
-## 13. Future (post-v1)
-
- B→A push (e.g., "notify A when a task assigned to subject changes") via Socket.IO over mTLS.
- Mesh (N-to-N) federation.
- Write verbs with conflict resolution.
- Shared Step-CA (a "root of roots") so that onboarding doesn't require exchanging CA roots.
- Federated memory search over vector indexes with homomorphic filtering.
-
-## 14. Locked Decisions (was "Open Questions")
-
-| #   | Question                                                                  | Decision                                                                                                                                       |
-| --- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| 1   | What happens to a grant when its subject user is deleted?                 | **Revoke-on-delete.** All grants where the user is subject are auto-revoked and CRL'd.                                                         |
-| 2   | Do we audit read-only requests?                                           | **Yes.** All federated reads are audited on the serving side. Bodies are not captured; query hash + metadata only.                             |
-| 3   | Default rate limit?                                                       | **60 requests per minute per grant,** override-able per grant.                                                                                 |
-| 4   | How do we verify the requesting-server's identity beyond the grant token? | **X.509 client cert tied to the user,** issued by Step-CA (per-server) or locally generated. Cert subject carries `grantId` + `subjectUserId`. |
-
-### M1 decisions
-
- **Postgres deployment:** **Containerized** alongside the gateway in M1 (Docker Compose profile). Moving to a dedicated host is a M5+ operational concern, not a v1 feature.
- **Instance signing key:** **Separate** from the Step-CA key. Step-CA signs federation certs; the instance master key seals at-rest secrets (client keys, provider credentials). Different blast-radius, different rotation cadences.
-
-## 15. Acceptance Criteria
-
- [ ] Two Mosaic Stack gateways on different hosts can establish a federation grant via the CLI-driven onboarding flow.
- [ ] Server A can query Server B for `tasks`, `notes`, `memory` respecting scope filters.
- [ ] A user on B with no grant cannot be queried by A, even if A has a valid grant for another user.
- [ ] Revoking a grant on B causes A's next request to fail with a clear error within one request cycle.
- [ ] Cert rotation happens automatically at T-7 days; an in-progress session survives rotation without user action.
- [ ] Rate-limit enforcement returns 429 with `Retry-After`; client backs off.
- [ ] With B unreachable, a session on A completes using local data and surfaces a "federation offline for `<peer>`" signal once.
- [ ] Every federated request appears in B's `federation_audit_log` within 1 second.
- [ ] A scope excluding `credentials` means credentials are not returnable even via `search` with matching keywords.
- [ ] `mosaic federation status` shows cert expiry, grant status, and last success/failure per peer.
-
-## 16. Implementation Milestones (reference)
-
-Milestones live in `docs/federation/MILESTONES.md` (to be authored next). High-level:
-
- **M1:** Server A runs `federated` tier standalone (Postgres + Valkey + pgvector, containerized). No peer yet.
- **M2:** Step-CA embedded; `federation_grants` / `federation_peers` schema + admin CLI.
- **M3:** Handshake + `list`/`get` verbs with scope enforcement.
- **M4:** `search` verb, audit log, rate limits.
- **M5:** Cache layer, offline-degradation UX, observability surfaces.
- **M6:** Revocation flows (admin + revoke-on-delete), cert auto-renewal.
- **M7:** Multi-user RBAC hardening on B, team-scoped grants end-to-end, acceptance suite green.
-
---
-
-**Next step after PRD sign-off:** author `docs/federation/MILESTONES.md` with per-milestone acceptance tests and estimated token budget, then file tracking issues on `git.mosaicstack.dev/mosaicstack/stack`.
--- a/docs/federation/SETUP.md
+++ b/docs/federation/SETUP.md
@@ -1,280 +0,0 @@
-# Federated Tier Setup Guide
-
-## What is the federated tier?
-
-The federated tier is designed for multi-user and multi-host deployments. It consists of PostgreSQL 17 with pgvector extension (for embeddings and RAG), Valkey for distributed task queueing and caching, and a shared configuration across multiple Mosaic gateway instances. Use this tier when running Mosaic in production or when scaling beyond a single-host deployment.
-
-## Prerequisites
-
- Docker and Docker Compose installed
- Ports 5433 (PostgreSQL) and 6380 (Valkey) available on your host (or adjust environment variables)
- At least 2 GB free disk space for data volumes
-
-## Start the federated stack
-
-Run the federated overlay:
-
-```bash
-docker compose -f docker-compose.federated.yml --profile federated up -d
-```
-
-This starts PostgreSQL 17 with pgvector and Valkey 8. The pgvector extension is created automatically on first boot.
-
-Verify the services are running:
-
-```bash
-docker compose -f docker-compose.federated.yml ps
-```
-
-Expected output shows `postgres-federated` and `valkey-federated` both healthy.
-
-## Configure mosaic for federated tier
-
-Create or update your `mosaic.config.json`:
-
-```json
-{
-  "tier": "federated",
-  "database": "postgresql://mosaic:mosaic@localhost:5433/mosaic",
-  "queue": "redis://localhost:6380"
-}
-```
-
-If you're using environment variables instead:
-
-```bash
-export DATABASE_URL="postgresql://mosaic:mosaic@localhost:5433/mosaic"
-export REDIS_URL="redis://localhost:6380"
-```
-
-## Verify health
-
-Run the health check:
-
-```bash
-mosaic gateway doctor
-```
-
-Expected output (green):
-
-```
-Tier: federated  Config: mosaic.config.json
-  ✓ postgres         localhost:5433       (42ms)
-  ✓ valkey           localhost:6380       (8ms)
-  ✓ pgvector         (embedded)           (15ms)
-```
-
-For JSON output (useful in CI/automation):
-
-```bash
-mosaic gateway doctor --json
-```
-
-## Step 2: Step-CA Bootstrap
-
-Step-CA is a certificate authority that issues X.509 certificates for federation peers. In Mosaic federation, it signs peer certificates with custom OIDs that embed grant and user identities, enforcing authorization at the certificate level.
-
-### Prerequisites for Step-CA
-
-Before starting the CA, you must set up the dev password:
-
-```bash
-cp infra/step-ca/dev-password.example infra/step-ca/dev-password
-# Edit dev-password and set your CA password (minimum 16 characters)
-```
-
-The password is required for the CA to boot and derive the provisioner key used by the gateway.
-
-### Start the Step-CA service
-
-Add the step-ca service to your federated stack:
-
-```bash
-docker compose -f docker-compose.federated.yml --profile federated up -d step-ca
-```
-
-On first boot, the init script (`infra/step-ca/init.sh`) runs automatically. It:
-
- Generates the CA root key and certificate in the Docker volume
- Creates the `mosaic-fed` JWK provisioner
- Applies the X.509 template from `infra/step-ca/templates/federation.tpl`
-
-The volume is persistent, so subsequent boots reuse the existing CA keys.
-
-Verify the CA is healthy:
-
-```bash
-curl https://localhost:9000/health --cacert /tmp/step-ca-root.crt
-```
-
-(If the root cert file doesn't exist yet, see the extraction steps below.)
-
-### Extract credentials for the gateway
-
-The gateway requires two credentials from the running CA:
-
-**1. Provisioner key (for `STEP_CA_PROVISIONER_KEY_JSON`)**
-
-```bash
-docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json > /tmp/step-ca-provisioner.json
-```
-
-This JSON file contains the JWK public and private keys for the `mosaic-fed` provisioner. Store it securely and pass its contents to the gateway via the `STEP_CA_PROVISIONER_KEY_JSON` environment variable.
-
-**2. Root certificate (for `STEP_CA_ROOT_CERT_PATH`)**
-
-```bash
-docker cp $(docker ps -qf name=step-ca):/home/step/certs/root_ca.crt /tmp/step-ca-root.crt
-```
-
-This PEM file is the CA's root certificate, used to verify peer certificates issued by step-ca. Pass its path to the gateway via `STEP_CA_ROOT_CERT_PATH`.
-
-### Custom OID Registry
-
-Federation certificates include custom OIDs in the certificate extension. These encode authorization metadata:
-
-| OID                 | Name                   | Description           |
-| ------------------- | ---------------------- | --------------------- |
-| 1.3.6.1.4.1.99999.1 | mosaic_grant_id        | Federation grant UUID |
-| 1.3.6.1.4.1.99999.2 | mosaic_subject_user_id | Subject user UUID     |
-
-These OIDs are verified by the gateway after the CSR is signed, ensuring the certificate was issued with the correct grant and user context.
-
-### Environment Variables
-
-Configure the gateway with the following environment variables before startup:
-
-| Variable                       | Required | Description                                                                                               |
-| ------------------------------ | -------- | --------------------------------------------------------------------------------------------------------- |
-| `STEP_CA_URL`                  | Yes      | Base URL of the step-ca instance, e.g. `https://step-ca:9000` (use `https://localhost:9000` in local dev) |
-| `STEP_CA_PROVISIONER_KEY_JSON` | Yes      | JSON-encoded JWK from `/home/step/secrets/mosaic-fed.json`                                                |
-| `STEP_CA_ROOT_CERT_PATH`       | Yes      | Absolute path to the root CA certificate (e.g. `/tmp/step-ca-root.crt`)                                   |
-| `BETTER_AUTH_SECRET`           | Yes      | Secret used to seal peer private keys at rest; already required for M1                                    |
-
-Example environment setup:
-
-```bash
-export STEP_CA_URL="https://localhost:9000"
-export STEP_CA_PROVISIONER_KEY_JSON="$(cat /tmp/step-ca-provisioner.json)"
-export STEP_CA_ROOT_CERT_PATH="/tmp/step-ca-root.crt"
-export BETTER_AUTH_SECRET="<your-secret>"
-```
-
-## Troubleshooting
-
-### Port conflicts
-
-**Symptom:** `bind: address already in use`
-
-**Fix:** Stop the base dev stack first:
-
-```bash
-docker compose down
-docker compose -f docker-compose.federated.yml --profile federated up -d
-```
-
-Or change the host port with an environment variable:
-
-```bash
-PG_FEDERATED_HOST_PORT=5434 VALKEY_FEDERATED_HOST_PORT=6381 \
-  docker compose -f docker-compose.federated.yml --profile federated up -d
-```
-
-### pgvector extension error
-
-**Symptom:** `ERROR: could not open extension control file`
-
-**Fix:** pgvector is created at first boot. Check logs:
-
-```bash
-docker compose -f docker-compose.federated.yml logs postgres-federated | grep -i vector
-```
-
-If missing, exec into the container and create it manually:
-
-```bash
-docker exec <postgres-federated-id> psql -U mosaic -d mosaic -c "CREATE EXTENSION vector;"
-```
-
-### Valkey connection refused
-
-**Symptom:** `Error: connect ECONNREFUSED 127.0.0.1:6380`
-
-**Fix:** Check service health:
-
-```bash
-docker compose -f docker-compose.federated.yml logs valkey-federated
-```
-
-If Valkey is running, verify your firewall allows 6380. On macOS, Docker Desktop may require binding to `host.docker.internal` instead of `localhost`.
-
-## Key rotation (deferred)
-
-Federation peer private keys (`federation_peers.client_key_pem`) are sealed at rest using AES-256-GCM with a key derived from `BETTER_AUTH_SECRET` via SHA-256. If `BETTER_AUTH_SECRET` is rotated, all sealed `client_key_pem` values in the database become unreadable and must be re-sealed with the new key before rotation completes.
-
-The full key rotation procedure (decrypt all rows with old key, re-encrypt with new key, atomically swap the secret) is out of scope for M2. Operators must not rotate `BETTER_AUTH_SECRET` without a migration plan for all sealed federation peer keys.
-
-## OID Assignments — Mosaic Internal OID Arc
-
-Mosaic uses the private enterprise arc `1.3.6.1.4.1.99999` for custom X.509
-certificate extensions in federation grant certificates.
-
-**IMPORTANT:** This is a development/internal OID arc. Before deploying to a
-production environment accessible by external parties, register a proper IANA
-Private Enterprise Number (PEN) at <https://pen.iana.org/pen/PenApplication.page>
-and update these assignments accordingly.
-
-### Assigned OIDs
-
-| OID                   | Symbolic name                     | Description                                               |
-| --------------------- | --------------------------------- | --------------------------------------------------------- |
-| `1.3.6.1.4.1.99999.1` | `mosaic.federation.grantId`       | UUID of the `federation_grants` row authorising this cert |
-| `1.3.6.1.4.1.99999.2` | `mosaic.federation.subjectUserId` | UUID of the local user on whose behalf the cert is issued |
-
-### Encoding
-
-Each extension value is DER-encoded as an ASN.1 **UTF8String**:
-
-```
-Tag    0x0C        (UTF8String)
-Length 0x24        (36 decimal — fixed length of a UUID string)
-Value  <36 ASCII bytes of the UUID>
-```
-
-The step-ca X.509 template at `infra/step-ca/templates/federation.tpl`
-produces this encoding via the Go template expression:
-
-```
-{{ printf "\x0c\x24%s" .Token.mosaic_grant_id | b64enc }}
-```
-
-The resulting base64 value is passed as the `value` field of the extension
-object in the template JSON.
-
-### CA Environment Variables
-
-The `CaService` (`apps/gateway/src/federation/ca.service.ts`) requires the
-following environment variables at gateway startup:
-
-| Variable                       | Required | Description                                                          |
-| ------------------------------ | -------- | -------------------------------------------------------------------- |
-| `STEP_CA_URL`                  | Yes      | Base URL of the step-ca instance, e.g. `https://step-ca:9000`        |
-| `STEP_CA_PROVISIONER_PASSWORD` | Yes      | JWK provisioner password for the `mosaic-fed` provisioner            |
-| `STEP_CA_PROVISIONER_KEY_JSON` | Yes      | JSON-encoded JWK (public + private) for the `mosaic-fed` provisioner |
-| `STEP_CA_ROOT_CERT_PATH`       | Yes      | Absolute path to the step-ca root CA certificate PEM file            |
-
-Set these variables in your environment or secret manager before starting
-the gateway. In the federated Docker Compose stack they are expected to be
-injected via Docker secrets and environment variable overrides.
-
-### Fail-loud contract
-
-The CA service (and the X.509 template) are designed to fail loudly if the
-custom OIDs cannot be embedded:
-
- The template produces a malformed extension value (zero-length UTF8String
-  body) when the JWT claims `mosaic_grant_id` or `mosaic_subject_user_id` are
-  absent. step-ca rejects the CSR rather than issuing a cert without the OIDs.
- `CaService.issueCert()` throws a `CaServiceError` on every error path with
-  a human-readable `remediation` string. It never silently returns a cert that
-  may be missing the required extensions.
--- a/docs/federation/TASKS.md
+++ b/docs/federation/TASKS.md
@@ -1,154 +0,0 @@
-# Tasks — Federation v1
-
-> Single-writer: orchestrator only. Workers read but never modify.
->
-> **Mission:** federation-v1-20260419
-> **Schema:** `| id | status | description | issue | agent | branch | depends_on | estimate | notes |`
-> **Status values:** `not-started` | `in-progress` | `done` | `blocked` | `failed` | `needs-qa`
-> **Agent values:** `codex` | `glm-5.1` | `haiku` | `sonnet` | `opus` | `—` (auto)
->
-> **Scope of this file:** M1 is fully decomposed below. M2–M7 are placeholders pending each milestone's entry into active planning — the orchestrator expands them one milestone at a time to avoid speculative decomposition of work whose shape will depend on what M1 surfaces.
-
---
-
-## Milestone 1 — Federated tier infrastructure (FED-M1)
-
-Goal: Gateway runs in `federated` tier with containerized PG+pgvector+Valkey. No federation logic yet. Existing standalone behavior does not regress.
-
-| id        | status | description                                                                                                                                                                                                        | issue | agent  | branch                             | depends_on | estimate | notes                                                                                                                                            |
-| --------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| FED-M1-01 | done   | Extend `mosaic.config.json` schema: add `"federated"` to `tier` enum in validator + TS types. Keep `local` and `standalone` working. Update schema docs/README where referenced.                                   | #460  | sonnet | feat/federation-m1-tier-config     | —          | 4K       | Shipped in PR #470. Renamed `team` → `standalone`; added `team` deprecation alias; added `DEFAULT_FEDERATED_CONFIG`.                             |
-| FED-M1-02 | done   | Author `docker-compose.federated.yml` as an overlay profile: Postgres 17 + pgvector extension (port 5433), Valkey (6380), named volumes, healthchecks. Compose-up should boot cleanly on a clean machine.          | #460  | sonnet | feat/federation-m1-compose         | FED-M1-01  | 5K       | Shipped in PR #471. Overlay defines `postgres-federated`/`valkey-federated`, profile-gated, with pg-init for pgvector extension.                 |
-| FED-M1-03 | done   | Add pgvector support to `packages/storage/src/adapters/postgres.ts`: create extension on init (idempotent), expose vector column type in schema helpers. No adapter changes for non-federated tiers.               | #460  | sonnet | feat/federation-m1-pgvector        | FED-M1-02  | 8K       | Shipped in PR #472. `enableVector` flag on postgres StorageConfig; idempotent CREATE EXTENSION before migrations.                                |
-| FED-M1-04 | done   | Implement `apps/gateway/src/bootstrap/tier-detector.ts`: reads config, asserts PG/Valkey/pgvector reachable for `federated`, fail-fast with actionable error message on failure. Unit tests for each failure mode. | #460  | sonnet | feat/federation-m1-detector        | FED-M1-03  | 8K       | Shipped in PR #473. 12 tests; 5s timeouts on probes; pgvector library/permission discrimination; rejects non-bullmq for federated.               |
-| FED-M1-05 | done   | Write `scripts/migrate-to-federated.ts`: one-way migration from `local` (PGlite) / `standalone` (PG without pgvector) → `federated`. Dumps, transforms, loads; dry-run + confirm UX. Idempotent on re-run.         | #460  | sonnet | feat/federation-m1-migrate         | FED-M1-04  | 10K      | Shipped in PR #474. `mosaic storage migrate-tier`; DrizzleMigrationSource (corrects P0 found in review); 32 tests; idempotent.                   |
-| FED-M1-06 | done   | Update `mosaic doctor`: report current tier, required services, actual health per service, pgvector presence, overall green/yellow/red. Machine-readable JSON output flag for CI use.                              | #460  | sonnet | feat/federation-m1-doctor          | FED-M1-04  | 6K       | Shipped in PR #475 as `mosaic gateway doctor`. Probes lifted to @mosaicstack/storage; structural TierConfig breaks dep cycle.                    |
-| FED-M1-07 | done   | Integration test: gateway boots in `federated` tier with docker-compose `federated` profile; refuses to boot when PG unreachable (asserts fail-fast); pgvector extension query succeeds.                           | #460  | sonnet | feat/federation-m1-integration     | FED-M1-04  | 8K       | Shipped in PR #476. 3 test files, 4 tests, gated by FEDERATED_INTEGRATION=1; reserved-port helper avoids host collisions.                        |
-| FED-M1-08 | done   | Integration test for migration script: seed a local PGlite with representative data (tasks, notes, users, teams), run migration, assert row counts + key samples equal on federated PG.                            | #460  | sonnet | feat/federation-m1-migrate-test    | FED-M1-05  | 6K       | Shipped in PR #477. Caught P0 in M1-05 (camelCase→snake_case) missed by mocked unit tests; fix in same PR.                                       |
-| FED-M1-09 | done   | Standalone regression: full agent-session E2E on existing `standalone` tier with a gateway built from this branch. Must pass without referencing any federation module.                                            | #460  | sonnet | feat/federation-m1-regression      | FED-M1-07  | 4K       | Clean canary. 351 gateway tests + 85 storage unit tests + full pnpm test all green; only FEDERATED_INTEGRATION-gated tests skip.                 |
-| FED-M1-10 | done   | Code review pass: security-focused on the migration script (data-at-rest during migration) + tier detector (error-message sensitivity leakage). Independent reviewer, not authors of tasks 01-09.                  | #460  | sonnet | feat/federation-m1-security-review | FED-M1-09  | 8K       | 2 review rounds caught 7 issues: credential leak in pg/valkey/pgvector errors + redact-error util; missing advisory lock; SKIP_TABLES rationale. |
-| FED-M1-11 | done   | Docs update: `docs/federation/` operator notes for tier setup; README blurb on federated tier; `docs/guides/` entry for migration. Do NOT touch runbook yet (deferred to FED-M7).                                  | #460  | haiku  | feat/federation-m1-docs            | FED-M1-10  | 4K       | Shipped: `docs/federation/SETUP.md` (119 lines), `docs/guides/migrate-tier.md` (147 lines), README Configuration blurb.                          |
-| FED-M1-12 | done   | PR, CI green, merge to main, close #460.                                                                                                                                                                           | #460  | sonnet | feat/federation-m1-close           | FED-M1-11  | 3K       | M1 closed. PRs #470-#480 merged across 11 tasks. Issue #460 closed; release tag `fed-v0.1.0-m1` published.                                       |
-
-**M1 total estimate:** ~74K tokens (over-budget vs 20K PRD estimate — explanation below)
-
-**Why over-budget:** PRD's 20K estimate reflected implementation complexity only. The per-task breakdown includes tests, review, and docs as separate tasks per the delivery cycle, which catches the real cost. The final per-milestone budgets in MISSION-MANIFEST will be updated after M1 completes with actuals.
-
---
-
-## Pre-M2 — Test deployment infrastructure (FED-M2-DEPLOY)
-
-Goal: Two federated-tier gateways stood up on Portainer at `mos-test-1.woltje.com` and `mos-test-2.woltje.com` running the M1 release (`gateway:fed-v0.1.0-m1`). This is the test bed for M2 enrollment work and the M3 federation E2E harness. No federation logic exercised yet — pure infrastructure validation.
-
-> **Why now:** M2 enrollment requires a real second gateway to test peer-add flows; standing the test hosts up before M2 code lands gives both code and deployment streams a fast feedback loop.
-
-> **Parallelizable:** This workstream runs in parallel with the M2 code workstream (M2-01 → M2-13). They re-converge at M2-10 (E2E test).
-
-> **Tracking issue:** #482.
-
-| id                    | status      | description                                                                                                                                                                                                             | issue | agent  | branch                                | depends_on   | estimate | notes                                                                                                                                              |
-| --------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------ | ------------------------------------- | ------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
-| FED-M2-DEPLOY-01      | done        | Verify `gateway:fed-v0.1.0-m1` image was published by `.woodpecker/publish.yml` on tag push; if not, investigate and remediate. Document image URI in deployment artifact.                                              | #482  | sonnet | (verified inline, no PR)              | —            | 2K       | Tag exists; digest `sha256:9b72e202a9eecc27d31920b87b475b9e96e483c0323acc57856be4b1355db1ec` captured for digest-pinned deploys.                   |
-| FED-M2-DEPLOY-02      | done        | Author Portainer git-stack compose file `deploy/portainer/federated-test.stack.yml` (gateway + PG-pgvector + Valkey, env-driven). Use immutable tag, not `latest`.                                                      | #482  | sonnet | feat/federation-deploy-stack-template | DEPLOY-01    | 5K       | Shipped in PR #485. Digest-pinned. Env: STACK_NAME, HOST_FQDN, POSTGRES_PASSWORD, BETTER_AUTH_SECRET, BETTER_AUTH_URL.                             |
-| FED-M2-DEPLOY-IMG-FIX | in-progress | Gateway image runtime broken (ERR_MODULE_NOT_FOUND for `dotenv`); Dockerfile copies `.pnpm/` store but not `apps/gateway/node_modules` symlinks. Switch to `pnpm deploy` for self-contained runtime.                    | #482  | sonnet | (subagent in flight)                  | DEPLOY-02    | 4K       | Subagent `a78a9ab0ddae91fbc` in flight. Triggers Kaniko rebuild on merge; capture new digest; bump stack template in follow-up PR before redeploy. |
-| FED-M2-DEPLOY-03      | blocked     | Deploy stack to mos-test-1.woltje.com via `~/.config/mosaic/tools/portainer/`. Verify M1 acceptance: federated-tier boot succeeds; `mosaic gateway doctor --json` returns green; pgvector `vector(3)` round-trip works. | #482  | sonnet | feat/federation-deploy-test-1         | IMG-FIX      | 3K       | Stack created on Portainer endpoint 3 (Swarm `local`), but blocked on image fix. Container fails on boot until IMG-FIX merges + redeploy.          |
-| FED-M2-DEPLOY-04      | blocked     | Deploy stack to mos-test-2.woltje.com via Portainer wrapper. Same M1 acceptance probes as DEPLOY-03.                                                                                                                    | #482  | sonnet | feat/federation-deploy-test-2         | IMG-FIX      | 3K       | Same status as DEPLOY-03. Stack created; blocked on image fix.                                                                                     |
-| FED-M2-DEPLOY-05      | not-started | Document deployment in `docs/federation/TEST-INFRA.md`: hosts, image tags, secrets sourcing, redeploy procedure, teardown. Update MISSION-MANIFEST with deployment status.                                              | #482  | haiku  | feat/federation-deploy-docs           | DEPLOY-03,04 | 3K       | Operator-facing doc; mentions but does not duplicate `tools/portainer/README.md`.                                                                  |
-
-**Deploy workstream estimate:** ~16K tokens
-
---
-
-## Milestone 2 — Step-CA + grant schema + admin CLI (FED-M2)
-
-Goal: An admin can create a federation grant; counterparty enrolls; cert is signed by Step-CA with SAN OIDs for `grantId` + `subjectUserId`. No runtime federation traffic flows yet (that's M3).
-
-| id        | status | description                                                                                                                                                                                      | issue | agent  | branch                             | depends_on       | estimate | notes                                                                                                                                                        |
-| --------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------------------- | ---------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| FED-M2-01 | done   | DB migration: `federation_grants`, `federation_peers`, `federation_audit_log` tables + enum types (`grant_status`, `peer_state`). Drizzle schema + migration generation; migration tests.        | #461  | sonnet | feat/federation-m2-schema          | —                | 5K       | Shipped in PR #486. DESC indexes + reserved cols added after first review; migration tests green.                                                            |
-| FED-M2-02 | done   | Add Step-CA sidecar to `docker-compose.federated.yml`: official `smallstep/step-ca` image, persistent CA volume, JWK provisioner config baked into init script.                                  | #461  | sonnet | feat/federation-m2-stepca          | DEPLOY-02        | 4K       | Shipped in PR #494. Profile-gated under `federated`; CA password from secret; dev compose uses dev-only password file.                                       |
-| FED-M2-03 | done   | Scope JSON schema + validator: `resources` allowlist, `excluded_resources`, `include_teams`, `include_personal`, `max_rows_per_query`. Vitest unit tests for valid + invalid scopes.             | #461  | sonnet | feat/federation-m2-scope-schema    | —                | 4K       | Shipped in PR #496 (bundled with grants service). Validator independent of CA; reusable from grant CRUD + M3 scope enforcement.                              |
-| FED-M2-04 | done   | `apps/gateway/src/federation/ca.service.ts`: Step-CA client (CSR submission, OID-bearing cert retrieval). Mocked + integration tests against real Step-CA container.                             | #461  | sonnet | feat/federation-m2-ca-service      | M2-02            | 6K       | Shipped in PR #494. SAN OIDs 1.3.6.1.4.1.99999.1 (grantId) + 1.3.6.1.4.1.99999.2 (subjectUserId); integration test asserts both OIDs present in issued cert. |
-| FED-M2-05 | done   | Sealed storage for `client_key_pem` reusing existing `provider_credentials` sealing key. Tests prove DB-at-rest is ciphertext, not PEM. Key rotation path documented (deferred impl).            | #461  | sonnet | feat/federation-m2-key-sealing     | M2-01            | 5K       | Shipped in PR #495. Crypto seam isolated; tests confirm ciphertext-at-rest; key rotation deferred to M6.                                                     |
-| FED-M2-06 | done   | `grants.service.ts`: CRUD + status transitions (`pending` → `active` → `revoked`); integrates M2-03 (scope) + M2-05 (sealing). Unit tests cover all transitions including invalid ones.          | #461  | sonnet | feat/federation-m2-grants-service  | M2-03, M2-05     | 6K       | Shipped in PR #496. All status transitions covered; invalid transition tests green; revocation handler deferred to M6.                                       |
-| FED-M2-07 | done   | `enrollment.controller.ts`: short-lived single-use token endpoint; CSR signing; updates grant `pending` → `active`; emits enrollment audit (table-only write, M4 tightens).                      | #461  | sonnet | feat/federation-m2-enrollment      | M2-04, M2-06     | 6K       | Shipped in PR #497. Tokens single-use with 410 on replay; TTL 15min; rate-limited at request layer.                                                          |
-| FED-M2-08 | done   | Admin CLI: `mosaic federation grant create/list/show` + `peer add/list`. Integration with grants.service (no API duplication). Help output + machine-readable JSON option.                       | #461  | sonnet | feat/federation-m2-cli             | M2-06, M2-07     | 7K       | Shipped in PR #498. `peer add <enrollment-url>` client-side flow; JSON output flag; admin REST controller co-shipped.                                        |
-| FED-M2-09 | done   | Integration tests covering MILESTONES.md M2 acceptance tests #1, #2, #3, #5, #7, #8 (single-gateway suite). Real Step-CA container; vitest profile gated by `FEDERATED_INTEGRATION=1`.           | #461  | sonnet | feat/federation-m2-integration     | M2-08            | 8K       | Shipped in PR #499. All 6 acceptance tests green; gated by FEDERATED_INTEGRATION=1.                                                                          |
-| FED-M2-10 | done   | E2E test against deployed mos-test-1 + mos-test-2 (or local two-gateway docker-compose if Portainer not ready): MILESTONES test #6 `peer add` yields `active` peer record with valid cert + key. | #461  | sonnet | feat/federation-m2-e2e             | M2-08, DEPLOY-04 | 6K       | Shipped in PR #500. Local two-gateway docker-compose path used; `peer add` yields active peer with valid cert + sealed key.                                  |
-| FED-M2-11 | done   | Independent security review (sonnet, not author of M2-04/05/06/07): focus on single-use token replay, sealing leak surfaces, OID match enforcement, scope schema bypass paths.                   | #461  | sonnet | feat/federation-m2-security-review | M2-10            | 8K       | Shipped in PR #501. Two-round review; enrollment-token replay, OID-spoofing CSR, and key leak in error messages all verified and hardened.                   |
-| FED-M2-12 | done   | Docs update: `docs/federation/SETUP.md` Step-CA section; new `docs/federation/ADMIN-CLI.md` with grant/peer commands; scope schema reference; OID registration note. Runbook still M7-deferred.  | #461  | haiku  | feat/federation-m2-docs            | M2-11            | 4K       | Shipped in PR #502. SETUP.md CA bootstrap section added; ADMIN-CLI.md created; scope schema reference and OID note included.                                 |
-| FED-M2-13 | done   | PR aggregate close, CI green, merge to main, close #461. Release tag `fed-v0.2.0-m2`. Mark deploy stream complete. Update mission manifest M2 row.                                               | #461  | sonnet | chore/federation-m2-close          | M2-12            | 3K       | Release tag `fed-v0.2.0-m2` created; issue #461 closed; all M2 PRs #494–#502 merged to main.                                                                 |
-
-**M2 code workstream estimate:** ~72K tokens (vs MILESTONES.md 30K — same over-budget pattern as M1, where per-task breakdown including tests/review/docs catches the real cost).
-
-**Deploy + code combined:** ~88K tokens.
-
-## Milestone 3 — mTLS handshake + list/get + scope enforcement (FED-M3)
-
-Goal: Two federated gateways exchange real data over mTLS. Inbound requests pass through cert validation → grant lookup → scope enforcement → native RBAC → response. `list`, `get`, and `capabilities` verbs land. The federation E2E harness (`tools/federation-harness/`) is the new permanent test bed for M3+ and is gated on every milestone going forward.
-
-> **Critical trust boundary.** Every 401/403 path needs a test. Code review is non-negotiable; M3-12 budgets two review rounds.
->
-> **Tracking issue:** #462.
-
-| id        | status      | description                                                                                                                                                                                                                                                                                            | issue | agent  | branch                               | depends_on                        | estimate | notes                                                                                                                                                    |
-| --------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ------------------------------------ | --------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| FED-M3-01 | done        | `packages/types/src/federation/` — request/response DTOs for `list`, `get`, `capabilities` verbs. Wire-format zod schemas + inferred TS types. Includes `FederationRequest`, `FederationListResponse<T>`, `FederationGetResponse<T>`, `FederationCapabilitiesResponse`, error envelope, `_source` tag. | #462  | sonnet | feat/federation-m3-types             | —                                 | 4K       | Reusable from gateway server + client + harness. Pure types — no I/O, no NestJS.                                                                         |
-| FED-M3-02 | done        | `tools/federation-harness/` scaffold: `docker-compose.two-gateways.yml` (Server A + Server B + step-CA), `seed.ts` (provisions grants, peers, sample tasks/notes/credentials per scope variant), `harness.ts` helper (boots stack, returns typed clients). README documents harness use.               | #462  | sonnet | feat/federation-m3-harness           | DEPLOY-04 (soft)                  | 8K       | Falls back to local docker-compose if `mos-test-1/-2` not yet redeployed (DEPLOY chain blocked on IMG-FIX). Permanent test infra used by M3+.            |
-| FED-M3-03 | done        | `apps/gateway/src/federation/server/federation-auth.guard.ts` (NestJS guard). Validates inbound client cert from Fastify TLS context, extracts `grantId` + `subjectUserId` from custom OIDs, loads grant from DB, asserts `status='active'`, attaches `FederationContext` to request.                  | #462  | sonnet | feat/federation-m3-auth-guard        | M3-01                             | 8K       | Reuses OID parsing logic mirrored from `ca.service.ts` post-issuance verification. 401 on malformed/missing OIDs; 403 on revoked/expired/missing grant.  |
-| FED-M3-04 | in-progress | `apps/gateway/src/federation/server/scope.service.ts`. Pipeline: (1) resource allowlist + excluded check, (2) native RBAC eval as `subjectUserId`, (3) scope filter intersection (`include_teams`, `include_personal`), (4) `max_rows_per_query` cap. Pure service — DB calls injected.                | #462  | sonnet | feat/federation-m3-scope-service     | M3-01                             | 10K      | Hardest correctness target in M3. Reuses `parseFederationScope` (M2-03). Returns either `{ allowed: true, filter }` or structured deny reason for audit. |
-| FED-M3-05 | in-progress | `apps/gateway/src/federation/server/verbs/list.controller.ts`. Wires AuthGuard → ScopeService → tasks/notes/memory query layer; applies row cap; tags rows with `_source`. Resource selector via path param.                                                                                           | #462  | sonnet | feat/federation-m3-verb-list         | M3-03, M3-04                      | 6K       | Routes: `POST /api/federation/v1/list/:resource`. No body persistence. Audit write deferred to M4.                                                       |
-| FED-M3-06 | not-started | `apps/gateway/src/federation/server/verbs/get.controller.ts`. Single-resource fetch by id; same pipeline as list. 404 on not-found, 403 on RBAC/scope deny — both audited the same way.                                                                                                                | #462  | sonnet | feat/federation-m3-verb-get          | M3-03, M3-04                      | 6K       | `POST /api/federation/v1/get/:resource/:id`. Mirrors list controller patterns.                                                                           |
-| FED-M3-07 | done        | `apps/gateway/src/federation/server/verbs/capabilities.controller.ts`. Read-only enumeration: returns `{ resources, excluded_resources, max_rows_per_query, supported_verbs }` derived from grant scope. Always allowed for an active grant — no RBAC eval.                                            | #462  | sonnet | feat/federation-m3-verb-capabilities | M3-03                             | 4K       | `GET /api/federation/v1/capabilities`. Smallest verb; useful sanity check that mTLS + auth guard work end-to-end.                                        |
-| FED-M3-08 | done        | `apps/gateway/src/federation/client/federation-client.service.ts`. Outbound mTLS dialer: picks `(certPem, sealed clientKey)` from `federation_peers`, unwraps key, builds undici Agent with mTLS, calls peer verb, parses typed response, wraps non-2xx into `FederationClientError`.                  | #462  | sonnet | feat/federation-m3-client            | M3-01                             | 8K       | Independent of server stream — can land in parallel with M3-03/04. Cert/key cached per-peer; flushed by future M5/M6 logic.                              |
-| FED-M3-09 | done        | `apps/gateway/src/federation/client/query-source.service.ts`. Accepts `source: "local" \| "federated:<host>" \| "all"` from gateway query layer; for `"all"` fans out to local + each peer in parallel; merges results; tags every row with `_source`.                                                 | #462  | sonnet | feat/federation-m3-query-source      | M3-08                             | 8K       | Per-peer failure surfaces as `_partial: true` in response, not hard failure (sets up M5 offline UX). M5 adds caching + circuit breaker on top.           |
-| FED-M3-10 | not-started | Integration tests for MILESTONES.md M3 acceptance #6 (malformed OIDs → 401; valid cert + revoked grant → 403) and #7 (`max_rows_per_query` cap). Real PG, mocked TLS context (Fastify req shim).                                                                                                       | #462  | sonnet | feat/federation-m3-integration       | M3-05, M3-06                      | 8K       | Vitest profile gated by `FEDERATED_INTEGRATION=1`. Single-gateway suite; no harness required.                                                            |
-| FED-M3-11 | not-started | E2E tests for MILESTONES.md M3 acceptance #1, #2, #3, #4, #5, #8, #9, #10 (8 cases). Uses harness from M3-02; two real gateways, real Step-CA, real mTLS. Each test asserts both happy-path response and audit/no-persist invariants.                                                                  | #462  | sonnet | feat/federation-m3-e2e               | M3-02, M3-04, M3-05, M3-06, M3-09 | 12K      | Largest single task. Each acceptance gets its own `it(...)` for clear failure attribution.                                                               |
-| FED-M3-12 | not-started | Independent security review (sonnet, not author of M3-03/04/05/06/07/08/09): focus on cert-SAN spoofing, OID extraction edge cases, scope-bypass via filter manipulation, RBAC-bypass via subjectUser swap, response leakage when scope deny.                                                          | #462  | sonnet | feat/federation-m3-security-review   | M3-11                             | 10K      | Two review rounds budgeted. PRD requires explicit test for every 401/403 path — review verifies coverage.                                                |
-| FED-M3-13 | not-started | Docs update: `docs/federation/SETUP.md` mTLS handshake section, new `docs/federation/HARNESS.md` for federation-harness usage, OID reference table in SETUP.md, scope enforcement pipeline diagram. Runbook still M7-deferred.                                                                         | #462  | haiku  | feat/federation-m3-docs              | M3-12                             | 5K       | One ASCII diagram for the auth-guard → scope → RBAC pipeline; helps future reviewers reason about denial paths.                                          |
-| FED-M3-14 | not-started | PR aggregate close, CI green, merge to main, close #462. Release tag `fed-v0.3.0-m3`. Update mission manifest M3 row → done; M4 row → in-progress when work begins.                                                                                                                                    | #462  | sonnet | chore/federation-m3-close            | M3-13                             | 3K       | Same close pattern as M1-12 / M2-13.                                                                                                                     |
-
-**M3 estimate:** ~100K tokens (vs MILESTONES.md 40K — same per-task breakdown pattern as M1/M2: tests, review, and docs split out from implementation cost). Largest milestone in the federation mission.
-
-**Parallelization opportunities:**
-
- M3-08 (client) can land in parallel with M3-03/M3-04 (server pipeline) — they only share DTOs from M3-01.
- M3-02 (harness) can land in parallel with everything except M3-11.
- M3-05/M3-06/M3-07 (verbs) are independent of each other once M3-03/M3-04 land.
-
-**Test bed fallback:** If `mos-test-1.woltje.com` / `mos-test-2.woltje.com` are still blocked on `FED-M2-DEPLOY-IMG-FIX` when M3-11 is ready to run, the harness's local `docker-compose.two-gateways.yml` is a sufficient stand-in. Production-host validation moves to M7 acceptance suite (PRD AC-12).
-
-**Backlog sync — 2026-06-24 (orchestrator):** Status reconciled against `origin/main` (release 0.0.48). Landed on main: **FED-M3-01** (DTOs, PR #506), **FED-M3-02** (harness scaffold, PR #505), **FED-M3-03** (mTLS auth-guard, PR #509 — CRIT-1/2 + HIGH-1..4 remediated in-PR), **FED-M3-08** (outbound mTLS client, PR #508). With M3-01/03/08 merged, three cards became dependency-clear and were dispatched to the idle coder lane: **FED-M3-04** scope.service → coder0 (`feat/federation-m3-scope-service`); **FED-M3-09** query-source + **FED-M3-07** capabilities verb → coder1 (`feat/federation-m3-query-source` first). Reviewer warmed for the M3 trust-boundary PRs. Remaining blocked-by-DAG: M3-05/06 (await M3-04), M3-10 (await M3-05/06), M3-11 (await M3-09), M3-12→14 (tail). Deploy chain (DEPLOY-IMG-FIX → 03/04) still independent of M3 code — harness local docker-compose fallback covers M3-11.
-
-**Backlog sync #2 — 2026-06-24 (orchestrator):** **FED-M3-09** (query-source) merged via PR #673 and **FED-M3-07** (capabilities) merged via PR #674 — both squash-merged on independent agent review-of-record + green CI (formal Gitea approve unavailable under the shared service account; merge is not gated by the self-approve guard). **FED-M3-05** (list verb) dispatched to coder1 (based on the M3-04 branch, rebase onto main once #672 lands). **FED-M3-04** (scope.service, PR #672) is in review-changes (one include_personal no-leak test outstanding). **DAG fix:** corrected `FED-M3-11` depends_on from `M3-02, M3-09` → `M3-02, M3-04, M3-05, M3-06, M3-09` — the E2E acceptance cases (#1–#5, #8–#10) exercise list/get over mTLS, so the server verbs + scope service are hard prerequisites; the original edge set omitted them and caused a premature M3-11 dispatch. Note: M3 read-path invariant for M3-11 is **no-persist + existing enrollment audit only** — read-verb audit-log writes are deferred to M4 (see M3-05/06 notes), so M3-11 must not assert read-audit-log entries.
-
-## Milestone 4 — search + audit + rate limit (FED-M4)
-
-_Deferred. Issue #463._
-
-## Milestone 5 — cache + offline + OTEL (FED-M5)
-
-_Deferred. Issue #464._
-
-## Milestone 6 — revocation + auto-renewal + CRL (FED-M6)
-
-_Deferred. Issue #465._
-
-## Milestone 7 — multi-user hardening + acceptance suite (FED-M7)
-
-_Deferred. Issue #466._
-
---
-
-## Execution Notes
-
-**Agent assignment rationale:**
-
- `codex` for most implementation tasks (OpenAI credit pool preferred for feature code)
- `sonnet` for tests (pattern-based, moderate complexity), `doctor` work (cross-cutting), and independent code review
- `haiku` for docs and the standalone regression canary (cheapest tier for mechanical/verification work)
- No `opus` in M1 — save for cross-cutting architecture decisions if they surface later
-
-**Branch strategy:** Each task gets its own feature branch off `main`. Tasks within a milestone merge in dependency order. Final aggregate PR (FED-M1-12) isn't a branch of its own — it's the merge of the last upstream task that closes the issue.
-
-**Queue guard:** Every push and every merge in this mission must run `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose push|merge` per Mosaic hard gate #6.
--- a/docs/fleet/FLEET-LAUNCH.md
+++ b/docs/fleet/FLEET-LAUNCH.md
@@ -1,114 +0,0 @@
-# Fleet Launch Runbook
-
-How every Mosaic fleet agent — workers **and** the orchestrator — is launched, and how to
-configure each one. The guiding principle: **one roster-driven launcher**. There is no bespoke
-per-agent launch script; the roster plus per-agent `.env` files are the single source of launch
-config.
-
-## The launch chain
-
-| Layer            | File                                              | Responsibility                                                                                                                                              |
-| ---------------- | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| systemd unit     | `mosaic-agent@<role>.service`                     | One templated unit per role; `ExecStart` runs the session launcher with the instance name `%i`. Defaults `MOSAIC_AGENT_RUNTIME=pi`, `MOSAIC_AGENT_NAME=%i`. |
-| session launcher | `tools/fleet/start-agent-session.sh <role>`       | Builds the launch command, opens the tmux pane, wires the heartbeat.                                                                                        |
-| launch command   | `mosaic yolo <runtime>` (or a per-agent override) | Replaces the pane's foreground process with the runtime, fully seeded.                                                                                      |
-| seeding          | `mosaic`'s `composeContract()`                    | Injects the Constitution/USER/TOOLS/runtime contract, `*.local` overlays, **and** the Fleet-Comms cheat-sheet — all via `--append-system-prompt`.           |
-
-Per-agent overrides live in `fleet/agents/<role>.env`, generated from `roster.yaml` by
-`generateAgentEnv` (`packages/mosaic/src/commands/fleet.ts`) and consumed by the launcher.
-
-## Worker launch path (default)
-
-1. `roster.yaml` carries each agent's `runtime` and optional `model_hint`.
-2. `generateAgentEnv` emits `fleet/agents/<role>.env` with `MOSAIC_AGENT_NAME`,
-   `MOSAIC_AGENT_RUNTIME`, and `MOSAIC_AGENT_MODEL`.
-3. `start-agent-session.sh` has no `MOSAIC_AGENT_COMMAND` set, so it falls through to the default
-   (line ~44):
-   ```sh
-   MOSAIC_AGENT_COMMAND="mosaic yolo $MOSAIC_AGENT_RUNTIME${MOSAIC_AGENT_MODEL:+ --model $MOSAIC_AGENT_MODEL}"
-   ```
-4. The launcher bakes `MOSAIC_AGENT_NAME` into the pane command (line ~118), so `composeContract`
-   can inject the Fleet-Comms cheat-sheet for that role.
-
-That is the whole worker path: roster → `.env` → `mosaic yolo <runtime>` → seeded pane.
-
-## Orchestrator fold (PATH A — ships today)
-
-The orchestrator is **just another roster agent** launched through the canonical path — not a
-snowflake script.
-
-| Piece              | Value                               |
-| ------------------ | ----------------------------------- |
-| host-side launcher | `orchestrator-launch.sh`            |
-| systemd unit       | `mosaic-fleet-orchestrator.service` |
-| tmux session       | `orchestrator` (role-named)         |
-
-Set its launch command via `fleet/agents/orchestrator.env`:
-
-```sh
-MOSAIC_AGENT_COMMAND='mosaic yolo claude --channels plugin:discord@<channel>'
-```
-
-When `MOSAIC_AGENT_COMMAND` is set, `start-agent-session.sh`'s `if [ -z "$MOSAIC_AGENT_COMMAND" ]`
-guard (line ~41) is false, so the line-44 default — **including its hardcoded `yolo`** — is skipped
-entirely. The override fully controls the runtime and flags. Routing through `mosaic yolo claude`
-(rather than a raw `claude` invocation) is what gives the orchestrator the same full
-`composeContract` seeding + Fleet-Comms cheat-sheet as every worker, with `--channels` and any
-other flags passed straight through to the `claude` binary.
-
-## Launch gotchas
-
-1. **Flag conflict.** `mosaic yolo claude` already injects `--dangerously-skip-permissions`. Do
-   **not** also pass `--permission-mode bypassPermissions` — the `claude` binary would receive both.
-   Use `mosaic yolo claude …` alone (yolo covers the unattended posture), **or** non-yolo
-   `mosaic claude --permission-mode bypassPermissions …`. Never mix the two.
-2. **`MOSAIC_AGENT_NAME` must reach the pane.** The launcher bakes it from the instance name, and
-   `composeContract` gates the Fleet-Comms block on it (`launch.ts`, in `composeContract`) — **and**
-   the role must be a member of `roster.yaml`, or the block resolves empty.
-3. **`launchRuntime` guards.** `mosaic yolo claude` runs `checkSoul` / `checkRuntime` /
-   `checkSequentialThinking`. The host needs `SOUL.md` and the sequential-thinking MCP, or the
-   launch aborts (a raw `claude` invocation skipped these checks). Dry-run the composed command in a
-   throwaway tmux session before swapping a live launcher.
-
-## Why per-agent `.env` survives upgrades (#632)
-
-`install.sh` `PRESERVE_PATHS` includes `fleet/*.yaml`, `fleet/agents`, and `fleet/run`, so
-`mosaic update`'s framework re-seed **preserves** your roster and per-agent `.env` overrides
-(glob-aware `cp` fallback; matching TS parity in `file-adapter.ts`). Before #632, an auto re-seed
-could wipe them — which is exactly why PATH A's `.env` override is safe to rely on now.
-
-## Inspecting the comms wiring
-
- `mosaic fleet comms-block <role>` prints the Fleet-Comms cheat-sheet a given role receives at
-  launch — its `[host:session]` identity, the exact `agent-send.sh` command for each peer, and the
-  FLIP / `--verify` conventions. `--host <h>` previews a cross-host view. An unknown role or missing
-  roster **fails loud** (stderr + non-zero exit), so a typo is never a silent no-op.
- Versus `mosaic compose-contract <runtime>`: that emits the **whole** system prompt and reads the
-  role from `MOSAIC_AGENT_NAME` (a full-prompt smoke test). `comms-block` is the targeted,
-  explicit-arg, comms-only view — e.g. `mosaic fleet comms-block coder0-0` to preview a peer.
-
-## North Star / future direction
-
-**Vision:** a webUI lets the user edit each agent's launch config — switch **harness**
-(claude / pi / codex / opencode), toggle **yolo**, pick a **model**, set a **command/channels**
-override — with no terminal.
-
-**Continuity — this is not a new launch path.** It is a data-model + UI-binding layer over the
-existing roster-driven launcher. Field-by-field status today:
-
-| Launch-config field      | Roster-native today? | Mechanism / gap                                                                                                                                          |
-| ------------------------ | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **harness** (`runtime`)  | ✅ end-to-end        | `roster.runtime` → `generateAgentEnv` emits `MOSAIC_AGENT_RUNTIME` → launcher line 44. UI just writes the field.                                         |
-| **model** (`model_hint`) | ✅ end-to-end        | `roster.model_hint` → `MOSAIC_AGENT_MODEL` → launcher line 44 `--model`. UI just writes the field.                                                       |
-| **yolo**                 | ❌ new               | Launcher line 44 **hardcodes** `mosaic yolo`. A non-yolo toggle needs a roster `yolo` field → emit `MOSAIC_AGENT_YOLO` → make line 44 conditional.       |
-| **command / channels**   | ❌ new               | `MOSAIC_AGENT_COMMAND` is **consumed** (launcher line ~12) but `generateAgentEnv` does not emit it. Needs a roster `command`/`channels` field → emitted. |
-
-**The arc:**
-
- **A** — `.env` `MOSAIC_AGENT_COMMAND` hatch: manual, ships now, kept safe across upgrades by #632.
- **B** — roster-native launch-config: harness + model are already there; add the **yolo** toggle
-  (line-44 conditional) and **command/channels** emission to complete the data model.
- **webUI** — binds dropdowns/toggles directly to those four roster fields.
-
-PATH A's `.env` override is the **manual form** of exactly what PATH B makes roster-native and the
-webUI edits — one continuous arc, not three separate features. PATH B is tracked as #636.
--- a/docs/fleet/NORTH_STAR.md
+++ b/docs/fleet/NORTH_STAR.md
@@ -1,79 +0,0 @@
-# Mosaic Fleet — NORTH STAR
-
-> **Generated file — do not edit by hand.**
-> Projected deterministically from [`NORTH_STAR.yaml`](./NORTH_STAR.yaml) by the pure
-> generator in `packages/mosaic/src/commands/fleet.ts` (`renderNorthStarMarkdown`).
-> Edit the YAML, then regenerate. Self-contained Mosaic — no Hermes dependency.
-
-## Mission
-
-A self-driving Mosaic system that 24/7 unattended converts a machine-readable goal set into merged, CI-green, budget-bounded change — looping plan→backlog→assign→execute→verify→merge→reassess — on Mosaic's OWN native backlog/dispatch engine. Mosaic is general-purpose: the user declares the system type they want (software delivery, personal assistant, research, business/operations, …) and the orchestrator provisions the matching persona roster and structure; the delivery fleet is one profile among many.
-
-## Substrate
-
-The Mosaic Backlog is the backlog of record + dispatch engine, built on Mosaic's native Postgres storage service (@mosaicstack/db drizzle; PGlite-embedded by default, full Postgres by config). NOT Hermes.
-
-## Standing objectives
-
- **NS-1** — Single machine-readable source (this file) drives planning; prose docs are projections.
- **NS-2** — Every backlog item is an independently-shippable unit with stable id, priority, depends_on DAG, represented as a Mosaic Backlog card; spend tracked as advisory projection.
- **NS-3** — The supervisor guarantees movement: no idle agent while ready dependency-satisfied work exists; no empty backlog without a replan request; assignment via Mosaic native dispatch/claim.
- **NS-4** — Exactly one merge-gate approver; nothing reaches main except via pr-merge.sh after pr-ci-wait.sh success; Gitea branch protection is the backstop.
- **NS-5** — Every unit bounded by wall-clock TTL on its claim; token caps enforced only where a real meter exists, else advisory.
- **NS-6** — Context cleared between tasks for ephemeral runners (reset_between_tasks); persona+mission re-injected per task.
- **NS-7** — Meta-loop (session-review + enhancer) continuously proposes small fleet-improvement PRs.
- **NS-8** — Single operator-flippable PAUSE kill-switch (fleet/run/PAUSED) honored before every dispatch and every merge.
- **NS-9** — Mosaic is a general-purpose multi-agent system: the user declares the SYSTEM TYPE to run (e.g. software delivery, personal assistant, research, business/operations) and the orchestrator provisions the matching persona roster and org structure from a cross-domain baseline persona library; the delivery/coding fleet is one profile among many.
-
-## Success criteria
-
- **AC-NS-1** — The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer) healthy across reboot.
- **AC-NS-2** — A goal added to this YAML is decomposed to cards and either merged or escalated, with no human in the loop.
- **AC-NS-3** — No PR merges with failure/error/no-status/timeout CI, and none bypass pr-merge.sh.
- **AC-NS-4** — TTL is enforced on claims; token caps remain advisory until a real meter exists.
- **AC-NS-5** — Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
- **AC-NS-6** — A user can declare a system type and the fleet provisions the matching persona roster + topology from the baseline library, with no code change.
- **AC-NS-7** — A user-customized persona (edited or added via the orchestrator) survives `mosaic update`: baseline reseed never clobbers user overrides.
-
-## Workstreams
-
-| id  | title                                                                                                       |
-| --- | ----------------------------------------------------------------------------------------------------------- |
-| A   | Substrate — Mosaic Backlog on native Postgres storage service                                               |
-| B   | Supervisor — movement guarantee, two-agent floor, dispatch/claim                                            |
-| C   | Planner — goal decomposition into independently-shippable cards                                             |
-| D   | Merge-gate — single approver, pr-merge.sh after CI wait                                                     |
-| E   | Meta-loop — session-review + enhancer improvement PRs                                                       |
-| F   | Safety-rails — TTL claims, advisory spend, PAUSE kill-switch                                                |
-| H   | Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization |
-
-## Goals (backlog projection)
-
-| id  | title                                                                                                                                             | phase | priority    | depends_on |
-| --- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------- | ---------- |
-| A1  | Machine-readable NORTH_STAR.yaml + Markdown projection                                                                                            | 1     | must-have   | —          |
-| A2  | Mosaic Backlog schema + storage-service card store (drizzle/PGlite)                                                                               | 1     | must-have   | A1         |
-| A3a | Card lifecycle — create/claim/release with stable ids + depends_on DAG                                                                            | 1     | must-have   | A2         |
-| A3b | TTL-bounded claim enforcement (wall-clock) on cards                                                                                               | 1     | must-have   | A3a        |
-| A4  | Advisory spend projection per card (degrades to TTL, no real meter)                                                                               | 1     | should-have | A3a        |
-| B1  | Supervisor tick — readiness scan, two-agent-floor health check                                                                                    | 2     | must-have   | A3a        |
-| B2  | Native dispatch/claim — assign ready dependency-satisfied work                                                                                    | 2     | must-have   | A3b, B1    |
-| B3a | Planner decompose — goal added to YAML → cards                                                                                                    | 2     | must-have   | A2, B1     |
-| B3b | Replan request on empty backlog; escalate on no-decompose                                                                                         | 2     | should-have | B3a        |
-| G1  | PAUSE kill-switch + merge-gate honored before dispatch and merge                                                                                  | 2     | must-have   | B2         |
-| H1  | Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)                                             | 1     | must-have   | A1         |
-| H2  | System-type profiles — declarative mapping of system type to persona roster + topology                                                            | 2     | must-have   | H1         |
-| H3  | System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure                                          | 2     | must-have   | H2         |
-| H4  | Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides) | 2     | must-have   | H1         |
-
-## Assumptions (vetoable)
-
- **ASM-1** (vetoable) — The Mosaic Backlog on the native Postgres storage service is the backlog of record.
- **ASM-2** (vetoable) — Claude gate roles have no native busy status, so readiness = pane-idle + heartbeat.
- **ASM-3** (vetoable) — Two-agent floor = 1 orchestrator + >=1 enhancer.
- **ASM-4** (vetoable) — Baseline personas ship in framework/fleet/roles/ (reseeded on update); user overrides live in a separate PRESERVE_PATHS-protected layer and win on merge.
-
-## Spend
-
- **advisory:** true
- No per-task token meter yet; budgets degrade to TTL. Spend is tracked only as an advisory projection alongside each card.
--- a/docs/fleet/NORTH_STAR.yaml
+++ b/docs/fleet/NORTH_STAR.yaml
@@ -1,215 +0,0 @@
-# Mosaic Fleet — NORTH_STAR (machine-readable source of truth)
-#
-# This file is the single machine-readable source of truth for fleet planning.
-# Prose docs (including NORTH_STAR.md) are deterministic PROJECTIONS of this file.
-# Regenerate the Markdown projection with the pure generator in
-# packages/mosaic/src/commands/fleet.ts (renderNorthStarMarkdown). Edit the YAML,
-# never the .md.
-#
-# Self-contained Mosaic. NO Hermes runtime dependency. The backlog of record is
-# the Mosaic Backlog on Mosaic's OWN native Postgres storage service.
-
-version: 1
-
-mission: >-
-  A self-driving Mosaic system that 24/7 unattended converts a machine-readable
-  goal set into merged, CI-green, budget-bounded change — looping
-  plan→backlog→assign→execute→verify→merge→reassess — on Mosaic's OWN native
-  backlog/dispatch engine. Mosaic is general-purpose: the user declares the
-  system type they want (software delivery, personal assistant, research,
-  business/operations, …) and the orchestrator provisions the matching persona
-  roster and structure; the delivery fleet is one profile among many.
-
-substrate:
-  note: >-
-    The Mosaic Backlog is the backlog of record + dispatch engine, built on
-    Mosaic's native Postgres storage service (@mosaicstack/db drizzle;
-    PGlite-embedded by default, full Postgres by config). NOT Hermes.
-
-standing_objectives:
-  - id: NS-1
-    text: >-
-      Single machine-readable source (this file) drives planning; prose docs are
-      projections.
-  - id: NS-2
-    text: >-
-      Every backlog item is an independently-shippable unit with stable id,
-      priority, depends_on DAG, represented as a Mosaic Backlog card; spend
-      tracked as advisory projection.
-  - id: NS-3
-    text: >-
-      The supervisor guarantees movement: no idle agent while ready
-      dependency-satisfied work exists; no empty backlog without a replan
-      request; assignment via Mosaic native dispatch/claim.
-  - id: NS-4
-    text: >-
-      Exactly one merge-gate approver; nothing reaches main except via
-      pr-merge.sh after pr-ci-wait.sh success; Gitea branch protection is the
-      backstop.
-  - id: NS-5
-    text: >-
-      Every unit bounded by wall-clock TTL on its claim; token caps enforced
-      only where a real meter exists, else advisory.
-  - id: NS-6
-    text: >-
-      Context cleared between tasks for ephemeral runners
-      (reset_between_tasks); persona+mission re-injected per task.
-  - id: NS-7
-    text: >-
-      Meta-loop (session-review + enhancer) continuously proposes small
-      fleet-improvement PRs.
-  - id: NS-8
-    text: >-
-      Single operator-flippable PAUSE kill-switch (fleet/run/PAUSED) honored
-      before every dispatch and every merge.
-  - id: NS-9
-    text: >-
-      Mosaic is a general-purpose multi-agent system: the user declares the
-      SYSTEM TYPE to run (e.g. software delivery, personal assistant, research,
-      business/operations) and the orchestrator provisions the matching persona
-      roster and org structure from a cross-domain baseline persona library; the
-      delivery/coding fleet is one profile among many.
-
-success_criteria:
-  - id: AC-NS-1
-    text: >-
-      The supervisor keeps a two-agent floor (1 orchestrator + >=1 enhancer)
-      healthy across reboot.
-  - id: AC-NS-2
-    text: >-
-      A goal added to this YAML is decomposed to cards and either merged or
-      escalated, with no human in the loop.
-  - id: AC-NS-3
-    text: >-
-      No PR merges with failure/error/no-status/timeout CI, and none bypass
-      pr-merge.sh.
-  - id: AC-NS-4
-    text: >-
-      TTL is enforced on claims; token caps remain advisory until a real meter
-      exists.
-  - id: AC-NS-5
-    text: >-
-      Flipping fleet/run/PAUSED halts dispatch and merges within one tick.
-  - id: AC-NS-6
-    text: >-
-      A user can declare a system type and the fleet provisions the matching
-      persona roster + topology from the baseline library, with no code change.
-  - id: AC-NS-7
-    text: >-
-      A user-customized persona (edited or added via the orchestrator) survives
-      `mosaic update`: baseline reseed never clobbers user overrides.
-
-workstreams:
-  - id: A
-    title: Substrate — Mosaic Backlog on native Postgres storage service
-  - id: B
-    title: Supervisor — movement guarantee, two-agent floor, dispatch/claim
-  - id: C
-    title: Planner — goal decomposition into independently-shippable cards
-  - id: D
-    title: Merge-gate — single approver, pr-merge.sh after CI wait
-  - id: E
-    title: Meta-loop — session-review + enhancer improvement PRs
-  - id: F
-    title: Safety-rails — TTL claims, advisory spend, PAUSE kill-switch
-  - id: H
-    title: Personas & system profiles — cross-domain library, system-type provisioning, update-surviving customization
-
-goals:
-  - id: A1
-    title: Machine-readable NORTH_STAR.yaml + Markdown projection
-    phase: 1
-    priority: must-have
-    depends_on: []
-  - id: A2
-    title: Mosaic Backlog schema + storage-service card store (drizzle/PGlite)
-    phase: 1
-    priority: must-have
-    depends_on: [A1]
-  - id: A3a
-    title: Card lifecycle — create/claim/release with stable ids + depends_on DAG
-    phase: 1
-    priority: must-have
-    depends_on: [A2]
-  - id: A3b
-    title: TTL-bounded claim enforcement (wall-clock) on cards
-    phase: 1
-    priority: must-have
-    depends_on: [A3a]
-  - id: A4
-    title: Advisory spend projection per card (degrades to TTL, no real meter)
-    phase: 1
-    priority: should-have
-    depends_on: [A3a]
-  - id: B1
-    title: Supervisor tick — readiness scan, two-agent-floor health check
-    phase: 2
-    priority: must-have
-    depends_on: [A3a]
-  - id: B2
-    title: Native dispatch/claim — assign ready dependency-satisfied work
-    phase: 2
-    priority: must-have
-    depends_on: [A3b, B1]
-  - id: B3a
-    title: Planner decompose — goal added to YAML → cards
-    phase: 2
-    priority: must-have
-    depends_on: [A2, B1]
-  - id: B3b
-    title: Replan request on empty backlog; escalate on no-decompose
-    phase: 2
-    priority: should-have
-    depends_on: [B3a]
-  - id: G1
-    title: PAUSE kill-switch + merge-gate honored before dispatch and merge
-    phase: 2
-    priority: must-have
-    depends_on: [B2]
-  - id: H1
-    title: Cross-domain baseline persona library (exec, marketing, ops, research, assistant + engineering roles)
-    phase: 1
-    priority: must-have
-    depends_on: [A1]
-  - id: H2
-    title: System-type profiles — declarative mapping of system type to persona roster + topology
-    phase: 2
-    priority: must-have
-    depends_on: [H1]
-  - id: H3
-    title: System-type provisioning — user declares type; orchestrator instantiates the matching roster + structure
-    phase: 2
-    priority: must-have
-    depends_on: [H2]
-  - id: H4
-    title: Update-surviving persona customization — ad-hoc edits/additions persisted in a PRESERVE-protected override layer (baseline merged with overrides)
-    phase: 2
-    priority: must-have
-    depends_on: [H1]
-
-assumptions:
-  - id: ASM-1
-    vetoable: true
-    text: >-
-      The Mosaic Backlog on the native Postgres storage service is the backlog
-      of record.
-  - id: ASM-2
-    vetoable: true
-    text: >-
-      Claude gate roles have no native busy status, so readiness = pane-idle +
-      heartbeat.
-  - id: ASM-3
-    vetoable: true
-    text: 'Two-agent floor = 1 orchestrator + >=1 enhancer.'
-  - id: ASM-4
-    vetoable: true
-    text: >-
-      Baseline personas ship in framework/fleet/roles/ (reseeded on update);
-      user overrides live in a separate PRESERVE_PATHS-protected layer and win
-      on merge.
-
-spend:
-  advisory: true
-  note: >-
-    No per-task token meter yet; budgets degrade to TTL. Spend is tracked only
-    as an advisory projection alongside each card.
--- a/docs/fleet/PRD-fleet-suite.md
+++ b/docs/fleet/PRD-fleet-suite.md
@@ -1,109 +0,0 @@
-# PRD — Mosaic Fleet Suite (init, configure, operate)
-
-> **Workstream:** W-FLEET (Fleet) under mission `mvp-20260312` · **Phase:** 3→4 productization
-> **North star:** [docs/fleet/north-star.md](./north-star.md) · prior: Phase-2 observability (#579), durable launch (#581), real-agent enablement (#583/#584/#586), releases 0.0.35–0.0.37
-> **Lead:** Jarvis @ `w-jarvis`. **Collaborator:** coder agent @ `dragon-lin` (jwoltje@10.1.10.37:coder0-0).
-> Owner of this file: Fleet workstream lead. Does not modify MVP single-writer control-plane files.
-
-## Mission
-
-Turn the proven fleet primitives into a **user-installable, AI-free-configurable fleet product**:
-a user runs `mosaic fleet init`, answers a few questions (general / coding / research / hybrid),
-gets a recommended set of agents plus one always-on orchestrator wired for chat-ops, and can
-operate, mutate, re-create, and observe the fleet — over tmux today and Matrix tomorrow — from
-CLI/TUI and (designed-for) the webUI.
-
-**Immediate tangible goal:** the **"Mos"** orchestrator agent running on `w-jarvis`, reachable
-in **Discord channel `1517622518662434996`** (server `1112631390438166618`). Once the fleet is
-functional, we use the fleet itself to continue the work.
-
-## Requirements
-
-### A. Configure-without-AI CLI
-
-| ID  | Requirement                                                                                                   |
-| --- | ------------------------------------------------------------------------------------------------------------- |
-| R1  | `mosaic fleet` command set is functional end-to-end (init/install/start/stop/status/ps/verify + agent verbs). |
-| R2  | `mosaic fleet init` is an interactive, **AI-free** CLI wizard.                                                |
-| R3  | Init asks the **configuration type**: `general`, `coding`, `research`, `hybrid`, … (extensible).              |
-| R4  | Based on the answer, the fleet is populated with a **recommended set of agents** (a preset).                  |
-| R5  | **Exactly one main orchestrator agent** is always configured, regardless of type.                             |
-| R10 | A set of **recommended configurations (presets)** ships for easy duplication.                                 |
-| R8  | User can **re-create** the fleet when config needs change (idempotent re-init / reconfigure).                 |
-| R17 | Fleet controls are **simple and intuitive**.                                                                  |
-
-### B. Comms & orchestrator chat-ops
-
-| ID  | Requirement                                                                                                                       |
-| --- | --------------------------------------------------------------------------------------------------------------------------------- |
-| R6  | Init can wire the orchestrator to a chat connector — **Telegram / Discord / Matrix / Slack** — for command + comms.               |
-| R7  | Designed with the end-goal of **Matrix comms on a locally-controlled server**.                                                    |
-| R16 | Fleet supports **tmux AND Matrix** comms, **user-configurable** at init or any time. Not all users want Matrix.                   |
-| R19 | **"Mos" orchestrator on Discord** (`chan 1517622518662434996` / `srv 1112631390438166618`) on `w-jarvis` — the first live target. |
-
-### C. Runtime, health, lifecycle
-
-| ID  | Requirement                                                                        |
-| --- | ---------------------------------------------------------------------------------- |
-| R9  | Fleet is **mutable by the orchestrator agent** — add/remove agents per need.       |
-| R13 | Fleet **gracefully handles Pi + Claude harness updates** — keep harnesses current. |
-| R14 | The **Pi harness is customized** for proper tool usage, etc.                       |
-| R15 | **Agent heartbeat** properly configured for **Claude AND GPT/Pi** agents.          |
-
-### D. Surfaces, testing, docs
-
-| ID  | Requirement                                                                         |
-| --- | ----------------------------------------------------------------------------------- |
-| R18 | Fleet built so the **webUI can view / monitor / terminate / butt-in** on a session. |
-| R11 | Installed and **tested on both `w-jarvis` and `dragon-lin`**.                       |
-| R12 | **Documentation**: how to install, configure, and use the fleet.                    |
-
-## Architecture / approach
-
- **Config model:** `roster.yaml` is the source of truth (already exists). Add **presets** (`general`/`coding`/`research`/`hybrid`) as shipped example rosters; `init` selects a preset, always injects the orchestrator, and writes the roster. Re-init = regenerate roster (preserve user/site overrides — mirrors install env-merge from #567).
- **Orchestrator agent:** always present; carries the chat connector config (connector type + target IDs) so it can be commanded over chat. tmux is the substrate; the connector bridges chat ↔ the orchestrator session.
- **Comms layers (R16):** (1) **tmux** inter-agent (`agent-send`, proven) — default, always available. (2) **chat connector** for human↔orchestrator (Discord now; Matrix the strategic target). (3) **Matrix** as the locally-controlled cross-agent bus (future). Connector is pluggable + reconfigurable.
- **Heartbeat (R15):** runtime-agnostic launcher sidecar already covers pi/claude/codex (#584). Refine per-runtime (native HB) with the **custom Pi harness** (R14) + a Claude path.
- **Updates (R13):** `mosaic update` (CLI) + a fleet-aware harness-update step that refreshes pi/claude/codex and re-launches agents safely (drain → update → relaunch via the durable launcher).
- **webUI (R18):** the fleet exposes machine-readable state (`fleet ps --json` already carries tenant/host/heartbeat/managed) + control verbs (start/stop/watch/send); webUI consumes these (control plane rides federation per north star). Ensure a stable JSON contract + a terminate/attach(butt-in) path.
-
-## Phases (incremental, each shippable)
-
-| Phase                             | Deliverable                                                                                                                         | Notes                                 |
-| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
-| **F1 Presets + init wizard**      | preset rosters (general/coding/research/hybrid) + always-orchestrator + AI-free `fleet init` selecting a preset; re-init idempotent | R1–R5, R8, R10, R17                   |
-| **F2 Connector + Mos-on-Discord** | orchestrator chat-connector config (Discord first) + **Mos live on Discord `1517…`/`1112…`** on w-jarvis                            | R6, R19, partial R16                  |
-| **F3 Heartbeat + harness**        | HB confirmed for claude + pi/gpt; **custom Pi harness** (tool usage, native HB, model self-report); graceful harness updates        | R13, R14, R15                         |
-| **F4 Matrix + comms toggle**      | Matrix connector (local server) + user toggle tmux/Matrix at init/anytime                                                           | R7, R16                               |
-| **F5 Orchestrator-mutable fleet** | orchestrator can add/remove agents at runtime                                                                                       | R9                                    |
-| **F6 webUI hooks**                | stable JSON contract + terminate/attach surface for webUI view/monitor/terminate/butt-in                                            | R18                                   |
-| **F7 Test + docs**                | install+test on w-jarvis AND dragon-lin; user docs (install/configure/use)                                                          | R11, R12 (runs alongside every phase) |
-
-## Work division (proposed — confirm with dragon-lin)
-
- **Jarvis @ w-jarvis (Lead):** F1 presets+wizard, F2 connector+Mos-on-Discord, F5 mutability, F6 webUI hooks; merge authority + dual-engine reviews; co-testing on w-jarvis.
- **coder @ dragon-lin:** F3 custom Pi harness + harness-update flow (pi/codex-savvy); plus its in-flight constitution P4–P6 (P4 installer rework underpins `fleet init`/updates — coordinate the install path). Co-testing on dragon-lin (R11).
- **Shared:** F4 Matrix (whoever has bandwidth); F7 testing/docs continuous.
-
-## Immediate target: Mos on Discord (F2 first slice)
-
-The discord plugin is available (`~/.claude.json`). Path: configure the **orchestrator** as a durable
-fleet session running Claude Code with the discord plugin bridged to channel `1517622518662434996`
-(server `1112631390438166618`) on w-jarvis, with the existing Discord Bridge Protocol (ack within
-~3s, reply via `mcp__discord__reply`, no `AskUserQuestion`). Heartbeat via the launcher sidecar.
-
-## Success criteria
-
- A non-AI user can `mosaic fleet init`, pick a type, and get a working fleet + orchestrator.
- **Mos answers in Discord `1517…`** on w-jarvis.
- Fleet runs + is observable (`fleet ps`) on **both** w-jarvis and dragon-lin.
- Harness updates handled gracefully; HB healthy for claude + pi/gpt agents.
- Docs let a new operator install/configure/use the fleet.
- Re-init + orchestrator mutation work.
-
-## Assumptions (veto-able)
-
- `ASSUMPTION:` presets ship as example rosters under the framework (`fleet/examples/*.yaml`), selected by `init`.
- `ASSUMPTION:` chat connectors are pluggable; Discord first (target exists), Matrix is the strategic default later.
- `ASSUMPTION:` "Mos" = a Claude Code orchestrator session with the discord plugin (reuses the documented Discord Bridge Protocol).
- `ASSUMPTION:` per north star, runtimes default to Codex/pi-on-Codex for workers; the orchestrator "Mos" runs Claude Code (in Claude Code, which is allowed).
--- a/Show More
+++ b/Show More