test(cli): compare file bytes in the org tester-init refusal check

Sol review of 221c1e9d3 (P2): the snapshot held only path names, so a
rewrite of .mosaic-org.json before the refusal passed. It now holds names,
types and file bytes; the reviewer's rewrite mutant fails it.

BUILD-LOG.md

@@ -6345,3 +6345,5 @@ R5 quote fallback room (#797 D3, 2026-11-06, MVP3 lead): r4 review P2 found that
 2026-11-09 UTC, organizations F3 (#1873, PR #1884, a8f9f0957). The WebUI restarts the Console (supervised Consoles exit and `mosaic console start` relaunches them), restarts an organization's bus from the bus-down banner with a done receipt, and sends the owner's routing, agent, instance, name, assistant, limits and model proxy writes to the selected organization's bus. Routing apply lists how a change reaches each saved agent and offers Restart NAME now. Console restarts, bus restarts and routing, agent and instance changes append to `<dataRoot>/console/actions.jsonl`. Builder plus two refactor merges: combined list 354/0 on 999d173fd. Sol review CHANGES 1/0/1. P1: on a `--dev-local-owner` Console a local agent can send the right Origin and Fetch Metadata headers and reach these controls. The pinned startup warning and the accepted no-auth dev flags already cover this, but the README claimed no agent reaches them. Lead decision: correct the README and file the cooperative local-agent peer refusal as #1883, without building it in this round. P3: the instances route wrote no trail line. Fixed in 0a73279d6; the regression test fails on 999d173fd and passes on the fix. After the refactor merge, 25 touched or README-reading files 195/0 (Node 26.12.1, one file at a time, env -i). uiorg redeployed at a8f9f0957, 22:45Z; live config offers consoleRestart and org settingsSend. Correction to this session's process: after the test run completed I replied "No response requested" and stopped until Jason asked. Open follow-ups: defect l (a bus restart after adding a credentialed agent can refuse to start), the bus restart refusal code, a stale-lock Recover control, one control for banner Restart and Settings Start, #1883. Report: /mnt/storage/scratch/mosaic-lead/reports/org-f3-review.md.
 
 2026-11-09 UTC, PRD 1.20 and defect l (#1873, #1886; PRs #1887 03fe321b1 and #1888 7a97cfc4f). PRD 1.20: Jason approved draft 2 at 22:57Z ("The file looks fine other than that"; the Montage module name stays deferred). The PRD now has 118 requirements, with REQ-WS-1..8, REQ-AGENT-1..3, REQ-SYS-1..2, REQ-ACCT-1..2 and REQ-SETUP-1..2 added and REQ-ASSIST-1, REQ-USER-1, REQ-TASK-1 and REQ-WEB-3 amended. Builder Codex Terra xhigh declined to commit because stack-copy failed 20/1 (node-gyp missing from the test Node's npm); that failure is pre-existing on 483eccb3d, so the lead committed. Sol review APPROVE 0 (word-for-word diff against draft 2, catalog order, both requirements tests). Defect l: before, an agent that declared a store credential made the next bus start refuse, because Credentials refuses a missing store root and only issue() created it. After: start creates the root 0700 when any reference names the store; a root that exists with loose modes or as a symlink still refuses. Two new credential-verbs tests fail on the parent. Bus suite 171 files one at a time, 1713/0 (Node 26.12.1, env -i). Sol review APPROVE 0. uiorg redeployed at 7a97cfc4f, 23:15Z. Follow-up: the stack-copy node-gyp test environment. Reports: /mnt/storage/scratch/mosaic-lead/reports/{prd120-land,prd120-review,defectl-review}.md.
+
+2026-11-10 UTC, unified workspace U1 and SYS1 (#1873; PRs #1889 d35447005 and #1890 2c6556ab1). U1, before: each org page read only its own bus and nothing read every org at once. After: /api/workspace returns projects, sessions, inbox, tasks and metrics from every org the owner holds, each row tagged with its org and each org with a state (ok, starting, down, timeout, invalid); `mosaic console restart` and `mosaic org reload <org>` send the F3 routes. Sol review CHANGES 0/2 on 2109458b3: malformed data from one org turned the whole read into a 503, and the per-org deadline left sockets and transport children running. Terra fix 0672d5fe8 validates each org's result inside its boundary and carries an absolute deadline and AbortSignal through the status check and transport; the new workspace-failures test is 0/10 on the parent and 10/0 on the fix. The lead re-pinned the webui bus.mjs hash in bus channel-proof (the deliberate signal/deadline change; nonces, argv and limits unchanged) and amended as d35447005. SYS1, before: no system-type kind. After: a system-type plug-in kind with five modules (business-management, coding, creative-writing, marketing, montage), an org enable list under plugins.system-type, owner-only project selection with an append-only project_system_types table (migration 3t-3u) and CLI verbs; the modules grant no tools yet (REQ-SYS-2 deferred). Sol review CHANGES 1/2 on a9629f332: the restore guard did not count project_system_types, the CLI channel did not admit the two project verbs, and the #811 migration-reader pin still expected 18 steps. Lead fix 2c6556ab1 (rebased on d35447005) adds the table to COUNTED and LISTED with refusal and in-run recount tests, admits both verbs with a run()-level channel test (red on the unfixed channel), and moves the pin to 19 steps ending 3t-3u; fix files 323/0 and rebase overlap files 63/0 (Node 26.12.1, one file at a time, env -i). Full gate on a9629f332 4040/5: the two stack-release pins above, and tester-reads 3/3, which also fails on 1616d1dd6 (project.mjs:95 refuses an org --tester init; follow-up). Correction to the uiorg deploy at 00:50Z: the deploy script switched the tree without the offline schema migration, so all five buses refused to start (normal startup refuses an older schema by design). The lead ran migrate-schema.mjs for the five org stores (3t to 3u, all ready), restarted the buses (201 each) and added the migration to the deploy script with stop-on-refusal. test3 refused writer-locked and stays down, as before. Reports: /mnt/storage/scratch/mosaic-lead/reports/{u1-review,u1-fix,org-sys1-build,sys1-review}.md.

docs/SESSIONS.md

@@ -2123,3 +2123,4 @@ are never rewritten or removed; corrections are new entries.
 2026-11-07 UTC | Codex implementation sub-agent | Organizations release fix round 1 on ui-org-r1 | Local candidate for independent review; verification and findings recorded in /mnt/storage/scratch/mosaic-lead/uidev/org-release/report-fix-r1.md. Queue refused linked worktree; no push, merge or deployment.
 2026-11-09 UTC | Mos (lead, Claude Opus 5.5) | Organizations F3 fix round and landing (#1873) | PR #1884 merged a8f9f0957; review P3 fixed, P1 README corrected with follow-up #1883; 195/0 focused suite; uiorg redeployed 22:45Z.
 2026-11-09 UTC | Mos (lead, Claude Opus 5.5) | PRD 1.20 landing and defect l (#1873, #1886) | PR #1887 merged 03fe321b1, PR #1888 merged 7a97cfc4f; both Sol reviews APPROVE 0; bus suite 1713/0; uiorg redeployed 23:15Z; U1, U2 and U4a builds dispatched.
+2026-11-10 UTC | Mos (lead, Claude Opus 5.5) | U1 and SYS1 landings (#1873) | PR #1889 merged d35447005, PR #1890 merged 2c6556ab1; both Sol reviews CHANGES, fixed (U1 by Terra, SYS1 by the lead); uiorg at 2c6556ab1 after the missed 3t-3u store migration was run; deploy script now migrates.

packages/cli/tests/tester-reads.test.mjs

@@ -5,7 +5,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { main } from "../src/cli.mjs";
@@ -124,10 +124,10 @@ test("row 175: --tester on limits set, reset and migrate and every write form ou
 // W7 through the real tester transport: the CLI runs as its own process, so the tester-cli.mjs it
 // spawns can reach the runtime in this one.
 const MOSAIC = fileURLToPath(new URL("../../../scripts/mosaic", import.meta.url));
-function mosaic(args, env) {
+function command(executable, args, env) {
   const clean = Object.fromEntries(Object.entries(env).filter(([k]) => !/^MOSAIC_BUS_(TESTER|CLI)_NONCE$/.test(k)));
   return new Promise((resolve, reject) => {
-    const child = spawn(MOSAIC, args, { env: clean, timeout: 60000 });
+    const child = spawn(executable, args, { env: clean, timeout: 60000 });
     let out = "";
     let err = "";
     child.stdout.on("data", (d) => (out += d));
@@ -136,6 +136,8 @@ function mosaic(args, env) {
     child.on("close", (status) => resolve({ status, out, err }));
   });
 }
+const mosaic = (args, env) => command(MOSAIC, args, env);
+
 // sage-1081: these six fell through to the seat CLI, which refused with its own usage, so W1
 // (`plugins set`) and W4 (`name`) failed through the wrapper. Each now reaches packages/cli.
 test("row 175: scripts/mosaic sends plugins, name, names, follow, threads and thread to packages/cli, not the seat CLI", (t) => {
@@ -157,36 +159,55 @@ test("row 175: scripts/mosaic sends plugins, name, names, follow, threads and th
 });
 
 const listing = (dir) => readdirSync(dir, { recursive: true }).map(String).sort();
+// Names, types and file bytes: a rewrite of an existing file shows up, not just a new path.
+const contents = (dir) => listing(dir).map((name) => {
+  const path = join(dir, name), st = lstatSync(path);
+  return [name, st.isFile() ? readFileSync(path).toString("base64") : st.isDirectory() ? "dir" : `mode ${st.mode}`];
+});
 async function w7(t, vars, edit) {
-  const { root, f, org } = await orgFixture(t, "acme", edit);
-  const rt = await startBroker({ dataRoot: org.root, businesses: bus(vars) });
+  const root = tmp(t, "w7-");
+  const f = fixture(root, "acme", edit);
+  const rt = await startBroker({ dataRoot: f.dataRoot, businesses: bus(vars) });
   t.after(() => rt.close());
-  return { root, f, agent: { ...f.env, CLAUDECODE: "1", CLAUDE_CODE_ENTRYPOINT: "sdk-ts" } };
+  // Production CLI routes its transport through an organization. Inject the real tester transport
+  // in a child so the legacy non-org project path can still exercise the broker and its proof.
+  const driver = join(root, "driver.mjs");
+  writeFileSync(driver, `
+    import { run } from ${JSON.stringify(new URL("../src/cli.mjs", import.meta.url).href)};
+    import { testerTransport } from ${JSON.stringify(new URL("../src/transport.mjs", import.meta.url).href)};
+    const [socket, ...args] = process.argv.slice(2);
+    process.exitCode = await run(args, undefined, {
+      testerTransport: business => testerTransport({ socket, business }),
+    });
+  `);
+  const agent = { ...f.env, CLAUDECODE: "1", CLAUDE_CODE_ENTRYPOINT: "sdk-ts" };
+  const project = (args, env = agent) => command(process.execPath, [driver, join(f.dataRoot, "bus", "broker.sock"), ...args], env);
+  return { root, f, agent, project };
 }
 
 test("row 175 W7: project init --tester makes the repository under the project area, committed by tester", async (t) => {
-  const { f, agent } = await w7(t);
-  const r = await mosaic(["project", "init", "acme", "stack", "--tester"], agent);
+  const { f, agent, project } = await w7(t);
+  const r = await project(["project", "init", "acme", "stack", "--tester"], agent);
   assert.equal(r.status, 0, r.err);
   const repo = join(f.dataRoot, "projects", "acme", "stack");
   assert.match(r.out, new RegExp(`^initialized ${repo}\ncommit [0-9a-f]{40}\n$`));
   const log = spawnSync("git", ["-C", repo, "log", "--format=%an|%cn"], { encoding: "utf8" });
   assert.equal(log.stdout, "tester|tester\n");
   // Without --tester the same init inside an agent refuses, as before.
-  const again = await mosaic(["project", "init", "acme", "stack"], agent);
+  const again = await project(["project", "init", "acme", "stack"], agent);
   assert.equal(again.status, 3);
   assert.match(again.err, /outside any agent run/);
 });
 
 test("row 175 W7: a repo outside the project area refuses tester-project-area before any bus call, and nothing changes", async (t) => {
   // The switch is off: a bind would refuse tester-off (exit 3), so exit 2 shows the area check ran first.
-  const { f, agent } = await w7(t, null, (doc) => {
+  const { f, agent, project } = await w7(t, null, (doc) => {
     doc.projects.stack.repo = join(doc.projects.stack.root, "..", "records");
     return doc;
   });
   const records = f.doc.projects.stack.repo;
   const data = listing(f.dataRoot);
-  const r = await mosaic(["project", "init", "acme", "stack", "--tester"], agent);
+  const r = await project(["project", "init", "acme", "stack", "--tester"], agent);
   assert.equal(r.status, 2, r.err);
   assert.match(r.err, /tester-project-area/);
   assert.equal(existsSync(records), false);
@@ -196,7 +217,7 @@ test("row 175 W7: a repo outside the project area refuses tester-project-area be
 test("row 175 W7: the tester bind refuses tester-off and tester-required before any directory", async (t) => {
   const off = await w7(t, null);
   const data = listing(off.f.dataRoot);
-  const r = await mosaic(["project", "init", "acme", "stack", "--tester"], off.agent);
+  const r = await off.project(["project", "init", "acme", "stack", "--tester"], off.agent);
   assert.equal(r.status, 3, r.err);
   assert.match(r.err, /tester-off/);
   assert.deepEqual(listing(off.f.dataRoot), data);
@@ -204,10 +225,21 @@ test("row 175 W7: the tester bind refuses tester-off and tester-required before
   const on = await w7(t);
   const before = listing(on.f.dataRoot);
   for (const marker of ["MOSAIC_RUN_ID", "MOSAIC_BUS_CAP", "MOSAIC_AGENT_RUN"]) {
-    const under = await mosaic(["project", "init", "acme", "stack", "--tester"], { ...on.agent, [marker]: "x" });
+    const under = await on.project(["project", "init", "acme", "stack", "--tester"], { ...on.agent, [marker]: "x" });
     assert.equal(under.status, 3, `${marker}: ${under.err}`);
     assert.match(under.err, /tester-required/, marker);
   }
   assert.deepEqual(listing(on.f.dataRoot), before);
   assert.equal(existsSync(join(on.f.dataRoot, "projects")), false);
 });
+
+// Organization setup deliberately refuses tester init before creating a project record.
+test("organization project init --tester refuses without writing", async (t) => {
+  const { f, org } = await orgFixture(t);
+  const before = contents(org.root);
+  const agent = { ...f.env, CLAUDECODE: "1", CLAUDE_CODE_ENTRYPOINT: "sdk-ts" };
+  const r = await mosaic(["project", "init", "acme", "stack", "--tester"], agent);
+  assert.equal(r.status, 3, r.err);
+  assert.match(r.err, /organization project init --tester is unavailable/);
+  assert.deepEqual(contents(org.root), before);
+});