fix(install): close refused peers and reset inherited Docker cache (#1652 )

feat(install): add rootless image builds and reviewed egress proxy (#1652 )
2026-10-23 23:32:05 -05:00 · 2026-10-23 23:16:04 -05:00
59 changed files with 2510 additions and 549 deletions
@@ -5458,14 +5458,12 @@ Row 299 (573, #1806, Gander, Filbert): before, the P10 band test timed a fault r

 2026-10-24 | Goldie | Row325 / #1821 after (sage-3882 CLEAR) | Only Case1 projects key becomesstack; only old test70 expected key updated under mos-1564. New3-case test copies real .mosaic/project.json bytes, requires CLI project valid, rejects old key. Serialized shortTMP timeout-k10: new3/3, business264/264, old-key mutant killed/restored SHA9e43bfef, restored new3/3; all positive0 fail/skip/cancel. Manifest4/4 verifies including unchanged project document. Logs/load lines and mutant diff in BUILD.md; no queue writes/host action, Gladstone review/Sage gate pending.

-2026-10-24 — Poe, row 208 / 193d (#1706), before: building Console shared list,
-share controls and per-grant viewer read-only against approved design e2d161e2e.
-Base ec86f2c84. Isolated tests and UI-guard mutants pending Sage CLEAR; no live action.
+2026-10-24 | Bentina | Row157 / #1652 before (sage-3906, Q246, mos-1566) | Recovered seat/brief/design at ec86f2c84 on bentina/row157. Canonical queue next flags stale brief pin. Outbound audit finds broker gitea-grant node:https and web DNS-pinned node:https paths, triggering I2 explicit stop rule. Sage notified bentina-0001; BUILD.md records shifted cited sites. No implementation/test/Docker/credential/live-state action; awaiting lead re-pin and transport ruling.

-2026-10-24 — Poe, row 208 / 193d (#1706), after: Console shared list, share/unshare
-controls and live per-grant viewer UI implemented. Webui 418/418 and plugins
-119/119 green under sage-3925 CLEAR; four UI guard mutants killed with viewer
-bus bypass refusals. Prior old-test draft regression fixed under sage-3918;
-missing root oauth4webapi corrected by pinned npm ci under sage-3924. Evidence:
-agents/poe/work/queue-208/BUILD.md. Independent reviews and Sage's global gate
-remain; no live state, schema or bus policy change.
+2026-10-24 | Bentina | Row157 / #1652 first slot STOP (sage-3910) | New config/helper31/31 and proxy11/11 green. test-config exit1:55 pass/1 old output regression; new install20/20 green. Validator added absent install key to JSON. Stopped before Docker/install suite; slot returned Sage bentina-0004. sage-3916 authorizes preserving absent output shape/defaulting env to local: fixed own loader/new test only, no rerun before next CLEAR. test-config diff +4/-0. No commit/push; seat BUILD and01/02/03 logs.
+
+2026-10-24 | Bentina | Row157 / #1652 after (sage-3919, sage-3923) | Absent install JSON shape preserved; helper defaults local. Existing config56/56, helper/config31/31, final proxy12/12, final test-install exit0 with three release0.0.12 rootless builds/pins, internal TLS/deny/DNS checks and real Vikunja publicGET200/notifier REST dummyGET401 through services proxy. Upstream-reset correction verified. Slot returned bentina-0007; no broader suites by Sage direction. Boyd then Darkwing review, Mos provider-host measurement and Sage landing gate pending. Evidence in seat BUILD and04-08 logs; only bentina/row157 candidate push authorized.
+
+2026-10-24 | Bentina | Row157 / #1652 round2 before (boyd-0023, sage-3933) | Read reproduced B1 half-open refusal socket retention and B2 same-PID exec inherited cache bypass. Added two new regression files; no existing assertion edits. Proxy drains then destroys refused sockets with1s fallback; helper clears inherited cache/export attributes at source. No tests before CLEAR; Goldie holds slot. Source/causes recorded in seat BUILD.
+
+2026-10-24 | Bentina | Row157 / #1652 round2 after (sage-3936) | B1 refused sockets now drain/destroy with1s bound; B2 source clears inherited cache/export attributes. Archived a14+new regressions red as intended (5controls pass/7defects fail), fixed12/12, helper/config33/33, egress22/22, rootless install exit0 incl image pins/network/services dummyGET. Logs09-13 in seat work. No existing test/assertion edit for round2. Slot returned bentina-0014; followup own-branch commit/manifest for Boyd re-review; Mos and Sage landing gates pending.
@@ -76,6 +76,16 @@ Rules enforced by `scripts/mosaic-config.mjs`:

 Run paths (`build/hello/verify/reset`) fail closed when configuration is missing or invalid; they never invent it.

+The optional `install` key selects the containerized install explicitly:
+`"install": {"mode":"containerized","endpoint":"unix:///run/user/1000/docker.sock"}`.
+An absent key defaults to local mode and remains absent in validation output.
+Local mode forbids `endpoint`;
+containerized mode requires a Unix socket endpoint without whitespace
+(the actual pattern is `^unix:///[^\s]+\.sock$`). Unknown install keys or
+modes refuse with exit 2 without changing the config. Validation contacts no
+daemon; the endpoint helper checks rootless status before engine use. Keep
+existing live configs unchanged until the install rollout is authorized.
+
 ## Missions & tasks (M2)

 Missions and tasks are validated JSON data (strict schemas, version-pinned). The M2 layer is host-side only: mission directives are recorded for provenance but do not yet reach the runtime system prompt (capability/policy layer comes later).
@@ -0,0 +1,43 @@
+2026-10-24T04:05:53Z
+ 23:05:53 up 10 days, 14:25,  2 users,  load average: 2.29, 2.31, 1.89
+CLEAR sage-3910 TMPDIR=/mnt/storage/scratch/tmp/lEvgx1
+✔ install: absent (28.959485ms)
+✔ install: local (24.660305ms)
+✔ install: local endpoint (26.210523ms)
+✔ install: containerized missing endpoint (25.495263ms)
+✔ install: bad endpoint "tcp://localhost:2375" (28.62092ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (32.126399ms)
+✔ install: bad endpoint "run/docker.sock" (26.69995ms)
+✔ install: bad endpoint "unix://relative.sock" (33.36326ms)
+✔ install: bad endpoint "unix:///a b.sock" (30.579866ms)
+✔ install: bad endpoint "unix:///a.sock\n" (40.844622ms)
+✔ install: bad endpoint "unix:///a" (36.371215ms)
+✔ install: bad endpoint "" (31.603044ms)
+✔ install: bad endpoint null (29.645166ms)
+✔ install: bad endpoint 4 (30.638453ms)
+✔ install: valid endpoint (28.088952ms)
+✔ install: unknown mode (28.182929ms)
+✔ install: missing mode (26.297287ms)
+✔ install: unknown key (27.205488ms)
+✔ install: null (29.189475ms)
+✔ install: array (30.347371ms)
+✔ helper refuses rootful (76.082505ms)
+✔ helper refuses missing (58.354463ms)
+✔ helper refuses substring (86.830586ms)
+✔ helper refuses object (108.0825ms)
+✔ helper refuses invalid JSON (85.203357ms)
+✔ helper refuses null success (85.225204ms)
+✔ helper refuses rootless output but failed (67.840402ms)
+✔ helper checks once and explicitly names host for both calls (119.763305ms)
+✔ local mode refuses before Docker null (35.42747ms)
+✔ local mode refuses before Docker {"mode":"local"} (30.531767ms)
+✔ invalid config refuses before Docker (30.092363ms)
+ℹ tests 31
+ℹ suites 0
+ℹ pass 31
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 833.790665
+EXIT=0
@@ -0,0 +1,23 @@
+2026-10-24T04:06:01Z
+ 23:06:01 up 10 days, 14:25,  2 users,  load average: 2.27, 2.30, 1.89
+CLEAR sage-3910 TMPDIR=/mnt/storage/scratch/tmp/lfgV9z
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (21.273322ms)
+✔ unlisted host (1.324735ms)
+✔ unlisted port (1.081626ms)
+✔ GET (0.948442ms)
+✔ invalid port (0.95243ms)
+✔ userinfo (0.874803ms)
+✔ bad header (0.782898ms)
+✔ slow client has a total header deadline (81.829907ms)
+✔ oversized header refuses (1.267008ms)
+✔ missing, invalid and unknown lists fail closed (0.491274ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.716299ms)
+ℹ tests 11
+ℹ suites 0
+ℹ pass 11
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 156.342618
+EXIT=0
@@ -0,0 +1,90 @@
+2026-10-24T04:06:08Z
+ 23:06:08 up 10 days, 14:25,  2 users,  load average: 2.53, 2.36, 1.91
+CLEAR sage-3910 TMPDIR=/mnt/storage/scratch/tmp/6eJjJz
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    valid console.sso loads and is in the output
+OK    console.sso HS256 alg exits 2 naming the path (exit 2)
+OK    console.sso alg none exits 2 naming the path (exit 2)
+OK    console.sso missing slot field exits 2 naming the path (exit 2)
+OK    console.sso slot name outside the pattern exits 2 naming the path (exit 2)
+OK    unknown key under console exits 2 naming the path (exit 2)
+OK    valid federation key loads and is in the output
+OK    federation unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer origin over http exits 2 naming the key (exit 2)
+OK    federation peer origin with a path exits 2 naming the key (exit 2)
+OK    federation peer origin with userinfo exits 2 naming the key (exit 2)
+OK    federation peer id equal to self exits 2 naming the key (exit 2)
+OK    federation peer label empty exits 2 naming the key (exit 2)
+OK    federation not an object exits 2 naming the key (exit 2)
+OK    federation self pattern exits 2 naming the key (exit 2)
+OK    federation peers not an array exits 2 naming the key (exit 2)
+OK    federation peer not an object exits 2 naming the key (exit 2)
+OK    federation peer id pattern exits 2 naming the key (exit 2)
+OK    federation peer label over 80 characters exits 2 naming the key (exit 2)
+OK    federation duplicate peer id exits 2 naming the key (exit 2)
+OK    federation peer origin with a trailing slash exits 2 naming the key (exit 2)
+OK    federation self missing exits 2 naming the key (exit 2)
+OK    federation peer id missing exits 2 naming the key (exit 2)
+OK    federation peer label missing exits 2 naming the key (exit 2)
+OK    config without federation loads and has no federation output
+FAIL config without console loads with unchanged output
+OK    compactionReadBytes 8388608 loads and is in the output as written
+OK    compactionReadBytes "x" loads and is in the output as written
+OK    compactionStreams 2048 loads and is in the output as written
+OK    compactionStreams "x" loads and is in the output as written
+OK    failed validation modified nothing
+
+✔ install: absent (28.022711ms)
+✔ install: local (26.314077ms)
+✔ install: local endpoint (27.030768ms)
+✔ install: containerized missing endpoint (26.036164ms)
+✔ install: bad endpoint "tcp://localhost:2375" (29.311242ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (28.012086ms)
+✔ install: bad endpoint "run/docker.sock" (26.941261ms)
+✔ install: bad endpoint "unix://relative.sock" (26.90999ms)
+✔ install: bad endpoint "unix:///a b.sock" (23.646272ms)
+✔ install: bad endpoint "unix:///a.sock\n" (26.383344ms)
+✔ install: bad endpoint "unix:///a" (24.914913ms)
+✔ install: bad endpoint "" (24.320663ms)
+✔ install: bad endpoint null (25.688262ms)
+✔ install: bad endpoint 4 (26.934437ms)
+✔ install: valid endpoint (27.504294ms)
+✔ install: unknown mode (27.111833ms)
+✔ install: missing mode (26.365767ms)
+✔ install: unknown key (26.974983ms)
+✔ install: null (25.910901ms)
+✔ install: array (25.507423ms)
+ℹ tests 20
+ℹ suites 0
+ℹ pass 20
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 584.03015
+OK    install configuration cases
+selftest: 55 passed, 1 failed
+EXIT=1
@@ -0,0 +1,43 @@
+2026-10-24T04:08:52Z
+ 23:08:52 up 10 days, 14:28,  2 users,  load average: 2.16, 2.49, 2.04
+CLEAR sage-3919 TMPDIR=/mnt/storage/scratch/tmp/o2n7Db
+✔ install: absent (31.8592ms)
+✔ install: local (29.807282ms)
+✔ install: local endpoint (24.009896ms)
+✔ install: containerized missing endpoint (26.296453ms)
+✔ install: bad endpoint "tcp://localhost:2375" (26.404525ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (27.486365ms)
+✔ install: bad endpoint "run/docker.sock" (24.280876ms)
+✔ install: bad endpoint "unix://relative.sock" (24.363468ms)
+✔ install: bad endpoint "unix:///a b.sock" (24.920898ms)
+✔ install: bad endpoint "unix:///a.sock\n" (25.784031ms)
+✔ install: bad endpoint "unix:///a" (27.89803ms)
+✔ install: bad endpoint "" (28.939674ms)
+✔ install: bad endpoint null (26.129602ms)
+✔ install: bad endpoint 4 (27.601233ms)
+✔ install: valid endpoint (29.310223ms)
+✔ install: unknown mode (30.307014ms)
+✔ install: missing mode (26.432375ms)
+✔ install: unknown key (29.208115ms)
+✔ install: null (29.793ms)
+✔ install: array (28.956899ms)
+✔ helper refuses rootful (88.440017ms)
+✔ helper refuses missing (49.868469ms)
+✔ helper refuses substring (76.03165ms)
+✔ helper refuses object (77.494513ms)
+✔ helper refuses invalid JSON (78.525159ms)
+✔ helper refuses null success (79.166999ms)
+✔ helper refuses rootless output but failed (52.195589ms)
+✔ helper checks once and explicitly names host for both calls (124.380922ms)
+✔ local mode refuses before Docker null (28.199092ms)
+✔ local mode refuses before Docker {"mode":"local"} (29.618143ms)
+✔ invalid config refuses before Docker (27.543884ms)
+ℹ tests 31
+ℹ suites 0
+ℹ pass 31
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 762.528877
+EXIT=0
@@ -0,0 +1,90 @@
+2026-10-24T04:09:01Z
+ 23:09:01 up 10 days, 14:28,  2 users,  load average: 2.28, 2.50, 2.05
+CLEAR sage-3919 TMPDIR=/mnt/storage/scratch/tmp/hYypHU
+OK    absent adapter defaults to pi
+OK    adapter mock validates (exit 0)
+OK    unsupported adapter exits 2 (exit 2)
+OK    env exports adapter
+OK    bootstrap creates default when absent (exit 0)
+OK    bootstrap wrote config file
+OK    bootstrap is idempotent on existing config (exit 0)
+OK    bootstrap did not rewrite existing config
+OK    validate missing config exits 3 (exit 3)
+OK    malformed JSON exits 2 (exit 2)
+OK    unsupported configVersion exits 2 (exit 2)
+OK    unknown top-level key exits 2 (exit 2)
+OK    unknown execution key exits 2 (exit 2)
+OK    unsupported backend exits 2 (exit 2)
+OK    unsupported environment exits 2 (exit 2)
+OK    relative dataRoot exits 2 (exit 2)
+OK    non-canonical dataRoot exits 2 (exit 2)
+OK    filesystem root dataRoot exits 2 (exit 2)
+OK    home directory dataRoot exits 2 (exit 2)
+OK    dataRoot containing config dir exits 2 (exit 2)
+OK    control character in provider exits 2 (exit 2)
+OK    symlinked config file exits 2 (exit 2)
+OK    env exports resolve correctly
+OK    valid console.sso loads and is in the output
+OK    console.sso HS256 alg exits 2 naming the path (exit 2)
+OK    console.sso alg none exits 2 naming the path (exit 2)
+OK    console.sso missing slot field exits 2 naming the path (exit 2)
+OK    console.sso slot name outside the pattern exits 2 naming the path (exit 2)
+OK    unknown key under console exits 2 naming the path (exit 2)
+OK    valid federation key loads and is in the output
+OK    federation unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer unknown sub-key exits 2 naming the key (exit 2)
+OK    federation peer origin over http exits 2 naming the key (exit 2)
+OK    federation peer origin with a path exits 2 naming the key (exit 2)
+OK    federation peer origin with userinfo exits 2 naming the key (exit 2)
+OK    federation peer id equal to self exits 2 naming the key (exit 2)
+OK    federation peer label empty exits 2 naming the key (exit 2)
+OK    federation not an object exits 2 naming the key (exit 2)
+OK    federation self pattern exits 2 naming the key (exit 2)
+OK    federation peers not an array exits 2 naming the key (exit 2)
+OK    federation peer not an object exits 2 naming the key (exit 2)
+OK    federation peer id pattern exits 2 naming the key (exit 2)
+OK    federation peer label over 80 characters exits 2 naming the key (exit 2)
+OK    federation duplicate peer id exits 2 naming the key (exit 2)
+OK    federation peer origin with a trailing slash exits 2 naming the key (exit 2)
+OK    federation self missing exits 2 naming the key (exit 2)
+OK    federation peer id missing exits 2 naming the key (exit 2)
+OK    federation peer label missing exits 2 naming the key (exit 2)
+OK    config without federation loads and has no federation output
+OK    config without console loads with unchanged output
+OK    compactionReadBytes 8388608 loads and is in the output as written
+OK    compactionReadBytes "x" loads and is in the output as written
+OK    compactionStreams 2048 loads and is in the output as written
+OK    compactionStreams "x" loads and is in the output as written
+OK    failed validation modified nothing
+
+✔ install: absent (33.602997ms)
+✔ install: local (27.76628ms)
+✔ install: local endpoint (28.360207ms)
+✔ install: containerized missing endpoint (26.872508ms)
+✔ install: bad endpoint "tcp://localhost:2375" (27.729466ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (29.663768ms)
+✔ install: bad endpoint "run/docker.sock" (28.875798ms)
+✔ install: bad endpoint "unix://relative.sock" (27.427064ms)
+✔ install: bad endpoint "unix:///a b.sock" (30.77649ms)
+✔ install: bad endpoint "unix:///a.sock\n" (34.03786ms)
+✔ install: bad endpoint "unix:///a" (31.459666ms)
+✔ install: bad endpoint "" (26.221924ms)
+✔ install: bad endpoint null (31.982463ms)
+✔ install: bad endpoint 4 (34.408275ms)
+✔ install: valid endpoint (30.184118ms)
+✔ install: unknown mode (26.58596ms)
+✔ install: missing mode (26.563043ms)
+✔ install: unknown key (28.663535ms)
+✔ install: null (26.567284ms)
+✔ install: array (24.756494ms)
+ℹ tests 20
+ℹ suites 0
+ℹ pass 20
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 640.201326
+OK    install configuration cases
+selftest: 56 passed, 0 failed
+EXIT=0
@@ -0,0 +1,245 @@
+2026-10-24T04:09:14Z
+ 23:09:14 up 10 days, 14:29,  2 users,  load average: 2.58, 2.56, 2.08
+CLEAR sage-3919 TMPDIR=/mnt/storage/scratch/tmp/7xUNh5
+✔ install: absent (28.837858ms)
+✔ install: local (28.328967ms)
+✔ install: local endpoint (26.178892ms)
+✔ install: containerized missing endpoint (25.578947ms)
+✔ install: bad endpoint "tcp://localhost:2375" (24.988885ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (25.850327ms)
+✔ install: bad endpoint "run/docker.sock" (26.499708ms)
+✔ install: bad endpoint "unix://relative.sock" (42.276491ms)
+✔ install: bad endpoint "unix:///a b.sock" (32.161423ms)
+✔ install: bad endpoint "unix:///a.sock\n" (26.834457ms)
+✔ install: bad endpoint "unix:///a" (30.552354ms)
+✔ install: bad endpoint "" (28.938768ms)
+✔ install: bad endpoint null (27.00598ms)
+✔ install: bad endpoint 4 (29.63046ms)
+✔ install: valid endpoint (28.707851ms)
+✔ install: unknown mode (25.507911ms)
+✔ install: missing mode (27.101142ms)
+✔ install: unknown key (32.316453ms)
+✔ install: null (27.273355ms)
+✔ install: array (25.503395ms)
+✔ helper refuses rootful (81.447175ms)
+✔ helper refuses missing (49.32616ms)
+✔ helper refuses substring (80.299191ms)
+✔ helper refuses object (96.465808ms)
+✔ helper refuses invalid JSON (89.854499ms)
+✔ helper refuses null success (79.934412ms)
+✔ helper refuses rootless output but failed (61.053445ms)
+✔ helper checks once and explicitly names host for both calls (120.469053ms)
+✔ local mode refuses before Docker null (28.252291ms)
+✔ local mode refuses before Docker {"mode":"local"} (32.631557ms)
+✔ invalid config refuses before Docker (28.529643ms)
+ℹ tests 31
+ℹ suites 0
+ℹ pass 31
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 798.423992
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (18.932222ms)
+✔ unlisted host (1.309946ms)
+✔ unlisted port (1.067401ms)
+✔ GET (0.988233ms)
+✔ invalid port (0.919738ms)
+✔ userinfo (0.832286ms)
+✔ bad header (0.761085ms)
+✔ slow client has a total header deadline (80.345593ms)
+✔ oversized header refuses (1.044536ms)
+✔ missing, invalid and unknown lists fail closed (0.486134ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.562662ms)
+ℹ tests 11
+ℹ suites 0
+ℹ pass 11
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 149.849801
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 454B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 1.6s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 ...
+
+#5 [internal] load build context
+#5 transferring context: 31.36MB 0.1s done
+#5 DONE 0.2s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 sha256:08489011619dfda982191cb9cc0418dc48ea3b1341588aeef534e4db0ab4d3d0 447B / 447B 0.1s done
+#4 sha256:1a0cf4b1ffc8dd659bb8c6e90471bc8fec24620e4fdb68bb2b6faa56154ae146 0B / 1.71MB 0.2s
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 0B / 50.86MB 0.2s
+#4 sha256:517d640e32835287653c4b15eb5d9f6bcf48e103baea4f7e29bac937002f649b 3.31kB / 3.31kB 0.2s done
+#4 sha256:1a0cf4b1ffc8dd659bb8c6e90471bc8fec24620e4fdb68bb2b6faa56154ae146 1.71MB / 1.71MB 0.3s done
+#4 sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39 3.15MB / 28.25MB 0.3s
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 6.29MB / 50.86MB 0.5s
+#4 sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39 11.53MB / 28.25MB 0.5s
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 14.68MB / 50.86MB 0.6s
+#4 sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39 19.92MB / 28.25MB 0.6s
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 24.12MB / 50.86MB 0.8s
+#4 sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39 28.25MB / 28.25MB 0.8s done
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 49.28MB / 50.86MB 1.1s
+#4 extracting sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39
+#4 sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 50.86MB / 50.86MB 1.1s done
+#4 extracting sha256:7fd1ebe418b5079d4aa36f416af9b143d127bc75b0155d71cb5fd559b5e04d39 0.7s done
+#4 DONE 1.6s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 extracting sha256:517d640e32835287653c4b15eb5d9f6bcf48e103baea4f7e29bac937002f649b 0.0s done
+#4 extracting sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a
+#4 extracting sha256:11ffcabe0f772f0f1a9c80b4b290b5ec0de54f11c671f0fa10e5844f9b52d17a 1.0s done
+#4 DONE 2.6s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 extracting sha256:1a0cf4b1ffc8dd659bb8c6e90471bc8fec24620e4fdb68bb2b6faa56154ae146 0.0s done
+#4 extracting sha256:08489011619dfda982191cb9cc0418dc48ea3b1341588aeef534e4db0ab4d3d0 done
+#4 DONE 2.7s
+
+#6 [2/9] WORKDIR /opt/mosaic
+#6 DONE 0.0s
+
+#7 [3/9] COPY package.json package-lock.json ./
+#7 DONE 0.0s
+
+#8 [4/9] RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund && npm cache clean --force
+#8 1.008 npm warn deprecated [email protected]: Use your platform's native DOMException instead
+#8 2.464 
+#8 2.464 added 128 packages in 2s
+#8 2.465 npm notice
+#8 2.465 npm notice New major version of npm available! 11.19.0 -> 12.2.1
+#8 2.465 npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.2.1
+#8 2.465 npm notice To update run: npm install -g [email protected]
+#8 2.465 npm notice
+#8 2.562 npm warn using --force Recommended protections disabled.
+#8 DONE 2.7s
+
+#9 [5/9] COPY packages/ packages/
+#9 DONE 0.1s
+
+#10 [6/9] COPY scripts/ scripts/
+#10 DONE 0.0s
+
+#11 [7/9] COPY contracts/ contracts/
+#11 DONE 0.0s
+
+#12 [8/9] COPY roles/ roles/
+#12 DONE 0.0s
+
+#13 [9/9] COPY RELEASE ./
+#13 DONE 0.0s
+
+#14 exporting to image
+#14 exporting layers
+#14 exporting layers 3.3s done
+#14 exporting manifest sha256:b288643bbe89b43f6ffe7890598fe70801933c9e1e5d64efbfc6d87bbc502389 done
+#14 exporting config sha256:c8e137b79bfd807d4d9fc37d5ac211476decc3cc3c8db1e39b2e5dedf5471191 done
+#14 exporting attestation manifest sha256:5f2e757dd0fc2a424c78eb4bdd2ddd3039067afb54bc76bc03d6a6f9f1e2ac75 done
+#14 exporting manifest list sha256:7b4fa741d785225148156d1962a1770b40ab84b55ce8ffde5a3485b316f93b3a done
+#14 naming to docker.io/library/mosaic-core:0.0.12 done
+#14 unpacking to docker.io/library/mosaic-core:0.0.12
+#14 unpacking to docker.io/library/mosaic-core:0.0.12 1.6s done
+#14 DONE 4.9s
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 424B done
+#1 WARN: InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/mosaic-core:0.0.12
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/2] FROM docker.io/library/mosaic-core:0.0.12@sha256:7b4fa741d785225148156d1962a1770b40ab84b55ce8ffde5a3485b316f93b3a
+#4 resolve docker.io/library/mosaic-core:0.0.12@sha256:7b4fa741d785225148156d1962a1770b40ab84b55ce8ffde5a3485b316f93b3a done
+#4 DONE 0.0s
+
+#5 [2/2] RUN npm install -g --no-audit --no-fund @anthropic-ai/[email protected] @earendil-works/[email protected]  && npm cache clean --force && rm -rf /root/.npm /tmp/*
+#5 1.716 npm warn deprecated [email protected]: Use your platform's native DOMException instead
+#5 6.031 
+#5 6.031 added 167 packages in 6s
+#5 6.032 npm warn install-scripts 4 packages have install scripts not yet covered by allowScripts:
+#5 6.032 npm warn install-scripts   @anthropic-ai/[email protected] (postinstall: node install.cjs)
+#5 6.032 npm warn install-scripts   @google/[email protected] (preinstall: echo 'preinstall: no-op')
+#5 6.032 npm warn install-scripts   [email protected] (postinstall: node install.js)
+#5 6.032 npm warn install-scripts   [email protected] (postinstall: node scripts/postinstall)
+#5 6.032 npm warn install-scripts
+#5 6.032 npm warn install-scripts Run `npm install -g --allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs` to allow these scripts once, or `npm config set allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs --location=user` to allow them for all global installs.
+#5 6.119 npm warn using --force Recommended protections disabled.
+#5 DONE 6.3s
+
+#6 exporting to image
+#6 exporting layers
+#6 exporting layers 18.7s done
+#6 exporting manifest sha256:16af90e8e3291626f37fb5b2e78904d87126d875e7bcc240dd2ba453ca62bc10 done
+#6 exporting config sha256:ad269f0a84c0b1c5833b787793a45df782c1aae86e37f6216782a12a01f4557b done
+#6 exporting attestation manifest sha256:436490e0d139cb0db83f260c42ac3364377971160b2418cd03ee07c18873a5f6 done
+#6 exporting manifest list sha256:bc95495952e58a005c275a9d00842242c17965d0d9c2a83c476048cbfc110946 done
+#6 naming to docker.io/library/mosaic-session:0.0.12 done
+#6 unpacking to docker.io/library/mosaic-session:0.0.12
+#6 unpacking to docker.io/library/mosaic-session:0.0.12 5.3s done
+#6 DONE 24.0s
+
+ [33m1 warning found (use docker --debug to expand):
+[0m - InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 299B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/4] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 DONE 0.0s
+
+#5 [2/4] WORKDIR /opt/mosaic
+#5 CACHED
+
+#6 [internal] load build context
+#6 transferring context: 459B 0.0s done
+#6 DONE 0.0s
+
+#7 [3/4] COPY packages/egress/ packages/egress/
+#7 DONE 0.0s
+
+#8 [4/4] COPY contracts/egress.json contracts/egress.json
+#8 DONE 0.0s
+
+#9 exporting to image
+#9 exporting layers 0.0s done
+#9 exporting manifest sha256:f3f318ddc871b5a5f953aa0709cf69194260e633e26b15daafefe40572a36f27 done
+#9 exporting config sha256:c315f86a3be49d29aa7cad287a1653424206adb43683a34b91633b9bb8a14c6b done
+#9 exporting attestation manifest sha256:d41ee39a55170821cf46236fbf6069519e52c7386e27259ee17113777fa348e1 done
+#9 exporting manifest list sha256:af29f552efea177d706779ed9afb43c89763b58de913da0a570208cdda619d50 done
+#9 naming to docker.io/library/mosaic-egress:0.0.12 done
+#9 unpacking to docker.io/library/mosaic-egress:0.0.12 0.0s done
+#9 DONE 0.1s
+internal network: listed TLS reached, unlisted host/port refused, external DNS refused
+Vikunja client public GET 200; notifier REST dummy-token GET 401
+test-install: PASS (provider-host measurement remains Mos gate)
+EXIT=0
@@ -0,0 +1,24 @@
+2026-10-24T04:13:52Z
+ 23:13:52 up 10 days, 14:33,  2 users,  load average: 2.19, 2.69, 2.26
+CLEAR sage-3923 TMPDIR=/mnt/storage/scratch/tmp/5Tw4Jn
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (17.065009ms)
+✔ unlisted host (1.179696ms)
+✔ unlisted port (4.182798ms)
+✔ GET (0.916554ms)
+✔ invalid port (0.897474ms)
+✔ userinfo (0.772938ms)
+✔ bad header (0.737254ms)
+✔ slow client has a total header deadline (81.64527ms)
+✔ oversized header refuses (1.073337ms)
+✔ missing, invalid and unknown lists fail closed (0.464571ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.555082ms)
+✔ upstream reset after CONNECT closes the tunnel without a second HTTP response (21.757224ms)
+ℹ tests 12
+ℹ suites 0
+ℹ pass 12
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 173.90579
+EXIT=0
@@ -0,0 +1,207 @@
+2026-10-24T04:13:56Z
+ 23:13:56 up 10 days, 14:33,  2 users,  load average: 2.18, 2.67, 2.26
+CLEAR sage-3923 TMPDIR=/mnt/storage/scratch/tmp/Yb2lkZ
+✔ install: absent (26.874578ms)
+✔ install: local (25.86789ms)
+✔ install: local endpoint (24.545469ms)
+✔ install: containerized missing endpoint (26.458263ms)
+✔ install: bad endpoint "tcp://localhost:2375" (24.315713ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (27.113397ms)
+✔ install: bad endpoint "run/docker.sock" (24.399221ms)
+✔ install: bad endpoint "unix://relative.sock" (26.259544ms)
+✔ install: bad endpoint "unix:///a b.sock" (24.051655ms)
+✔ install: bad endpoint "unix:///a.sock\n" (23.493287ms)
+✔ install: bad endpoint "unix:///a" (25.527734ms)
+✔ install: bad endpoint "" (24.647712ms)
+✔ install: bad endpoint null (24.029319ms)
+✔ install: bad endpoint 4 (22.545369ms)
+✔ install: valid endpoint (24.217907ms)
+✔ install: unknown mode (22.578207ms)
+✔ install: missing mode (26.668685ms)
+✔ install: unknown key (25.239503ms)
+✔ install: null (26.507504ms)
+✔ install: array (23.325961ms)
+✔ helper refuses rootful (83.142099ms)
+✔ helper refuses missing (48.938896ms)
+✔ helper refuses substring (74.574145ms)
+✔ helper refuses object (69.21506ms)
+✔ helper refuses invalid JSON (71.320245ms)
+✔ helper refuses null success (70.397988ms)
+✔ helper refuses rootless output but failed (50.077162ms)
+✔ helper checks once and explicitly names host for both calls (116.70882ms)
+✔ local mode refuses before Docker null (26.523468ms)
+✔ local mode refuses before Docker {"mode":"local"} (26.276186ms)
+✔ invalid config refuses before Docker (26.092328ms)
+ℹ tests 31
+ℹ suites 0
+ℹ pass 31
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 707.332707
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (15.694598ms)
+✔ unlisted host (1.162772ms)
+✔ unlisted port (1.047448ms)
+✔ GET (0.913924ms)
+✔ invalid port (0.930799ms)
+✔ userinfo (0.750312ms)
+✔ bad header (0.739214ms)
+✔ slow client has a total header deadline (81.348784ms)
+✔ oversized header refuses (0.992296ms)
+✔ missing, invalid and unknown lists fail closed (0.441271ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.4408ms)
+✔ upstream reset after CONNECT closes the tunnel without a second HTTP response (21.481904ms)
+ℹ tests 12
+ℹ suites 0
+ℹ pass 12
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 169.285852
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 454B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 DONE 0.0s
+
+#5 [internal] load build context
+#5 transferring context: 31.37MB 0.1s done
+#5 DONE 0.1s
+
+#6 [3/9] COPY package.json package-lock.json ./
+#6 CACHED
+
+#7 [2/9] WORKDIR /opt/mosaic
+#7 CACHED
+
+#8 [4/9] RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund && npm cache clean --force
+#8 CACHED
+
+#9 [5/9] COPY packages/ packages/
+#9 DONE 0.1s
+
+#10 [6/9] COPY scripts/ scripts/
+#10 DONE 0.0s
+
+#11 [7/9] COPY contracts/ contracts/
+#11 DONE 0.0s
+
+#12 [8/9] COPY roles/ roles/
+#12 DONE 0.0s
+
+#13 [9/9] COPY RELEASE ./
+#13 DONE 0.0s
+
+#14 exporting to image
+#14 exporting layers
+#14 exporting layers 0.4s done
+#14 exporting manifest sha256:065dd55d59585806e540929e2ea66df397d47292cc84160bb7be491ecd2b9d59 done
+#14 exporting config sha256:3d97362dc6b6242fc540f08f538068b91ec28b1d3c9a34d7bc2bebff137a7a40 done
+#14 exporting attestation manifest sha256:f66bf47e4ec5b67db64f44d8554192f646111116e165ec3bc017b5a2b011204b done
+#14 exporting manifest list sha256:d840b0ec16ce6548549d18fb8bfc6b13c76ee77e9131a317582f919c61dcaf7f done
+#14 naming to docker.io/library/mosaic-core:0.0.12 done
+#14 unpacking to docker.io/library/mosaic-core:0.0.12
+#14 unpacking to docker.io/library/mosaic-core:0.0.12 0.2s done
+#14 DONE 0.6s
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 424B done
+#1 WARN: InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/mosaic-core:0.0.12
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/2] FROM docker.io/library/mosaic-core:0.0.12@sha256:d840b0ec16ce6548549d18fb8bfc6b13c76ee77e9131a317582f919c61dcaf7f
+#4 resolve docker.io/library/mosaic-core:0.0.12@sha256:d840b0ec16ce6548549d18fb8bfc6b13c76ee77e9131a317582f919c61dcaf7f done
+#4 DONE 0.0s
+
+#5 [2/2] RUN npm install -g --no-audit --no-fund @anthropic-ai/[email protected] @earendil-works/[email protected]  && npm cache clean --force && rm -rf /root/.npm /tmp/*
+#5 1.700 npm warn deprecated [email protected]: Use your platform's native DOMException instead
+#5 5.518 
+#5 5.518 added 167 packages in 5s
+#5 5.519 npm warn install-scripts 4 packages have install scripts not yet covered by allowScripts:
+#5 5.519 npm warn install-scripts   @anthropic-ai/[email protected] (postinstall: node install.cjs)
+#5 5.519 npm warn install-scripts   @google/[email protected] (preinstall: echo 'preinstall: no-op')
+#5 5.519 npm warn install-scripts   [email protected] (postinstall: node install.js)
+#5 5.519 npm warn install-scripts   [email protected] (postinstall: node scripts/postinstall)
+#5 5.519 npm warn install-scripts
+#5 5.519 npm warn install-scripts Run `npm install -g --allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs` to allow these scripts once, or `npm config set allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs --location=user` to allow them for all global installs.
+#5 5.590 npm warn using --force Recommended protections disabled.
+#5 DONE 5.7s
+
+#6 exporting to image
+#6 exporting layers
+#6 exporting layers 16.9s done
+#6 exporting manifest sha256:d4c83e350da6f18bfa7f3dbcef9ab078d72ef7f1f957a2926726e17973969e6a done
+#6 exporting config sha256:8afa310f48e06614963dcbcdc9c3ac497d9e4bad4ddd0524062ba8a52bc3cda2 done
+#6 exporting attestation manifest sha256:b7f082a8cd17d2c90eb27a81359aea66186b80d56a6d0c5e89d29187a2f78ed4 done
+#6 exporting manifest list sha256:2b6299e5a329adf85ea36038cb0407f2328e72e848dbfe95a17bd1fefbf9cf92 done
+#6 naming to docker.io/library/mosaic-session:0.0.12 done
+#6 unpacking to docker.io/library/mosaic-session:0.0.12
+#6 unpacking to docker.io/library/mosaic-session:0.0.12 4.7s done
+#6 DONE 21.7s
+
+ [33m1 warning found (use docker --debug to expand):
+[0m - InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 299B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/4] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 DONE 0.0s
+
+#5 [internal] load build context
+#5 transferring context: 459B 0.0s done
+#5 DONE 0.0s
+
+#6 [2/4] WORKDIR /opt/mosaic
+#6 CACHED
+
+#7 [3/4] COPY packages/egress/ packages/egress/
+#7 DONE 0.0s
+
+#8 [4/4] COPY contracts/egress.json contracts/egress.json
+#8 DONE 0.0s
+
+#9 exporting to image
+#9 exporting layers 0.0s done
+#9 exporting manifest sha256:e47c86064470f291d2ea468a1002f1e5f9b2e682e42940d06bd33d4e39945a6e done
+#9 exporting config sha256:ba520eadeb66ccfa2dbd3170744fca08affb4dac377d6cf2d26ec27d98d4ee25 done
+#9 exporting attestation manifest sha256:93cbd2f8a7fb1afb858b7b1a35a3020af8e9623e3a98be71d04e9d746c25d148 done
+#9 exporting manifest list sha256:a55e9d5ec6da74933bbefac6816efd0ea5246e825f61eaa4297e7baf7b09501c done
+#9 naming to docker.io/library/mosaic-egress:0.0.12 done
+#9 unpacking to docker.io/library/mosaic-egress:0.0.12 0.0s done
+#9 DONE 0.1s
+internal network: listed TLS reached, unlisted host/port refused, external DNS refused
+Vikunja client public GET 200; notifier REST dummy-token GET 401
+test-install: PASS (provider-host measurement remains Mos gate)
+EXIT=0
@@ -0,0 +1,165 @@
+2026-10-24T04:29:25Z
+ 23:29:25 up 10 days, 14:49,  2 users,  load average: 2.63, 2.97, 2.72
+CLEAR sage-3936 TMPDIR=/mnt/storage/scratch/tmp/jcNy2F archived=a14fdc443 expected RED
+✔ refusal 408 releases server socket (allowHalfOpen=false) (62.262337ms)
+✖ refusal 408 releases server socket (allowHalfOpen=true) (552.049114ms)
+✔ refusal 400 releases server socket (allowHalfOpen=false) (12.304169ms)
+✖ refusal 400 releases server socket (allowHalfOpen=true) (509.122366ms)
+✔ refusal 403 releases server socket (allowHalfOpen=false) (11.566877ms)
+✖ refusal 403 releases server socket (allowHalfOpen=true) (508.134074ms)
+✔ refusal 431 releases server socket (allowHalfOpen=false) (11.339612ms)
+✖ refusal 431 releases server socket (allowHalfOpen=true) (507.396552ms)
+✔ refusal 502 releases server socket (allowHalfOpen=false) (11.812225ms)
+✖ refusal 502 releases server socket (allowHalfOpen=true) (509.521901ms)
+✖ inherited cache is discarded; private cache stays unexported (rootless=false) (49.005306ms)
+✖ inherited cache is discarded; private cache stays unexported (rootless=true) (42.961333ms)
+ℹ tests 12
+ℹ suites 0
+ℹ pass 5
+ℹ fail 7
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 2739.328587
+
+✖ failing tests:
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:11:79
+✖ refusal 408 releases server socket (allowHalfOpen=true) (552.049114ms)
+  AssertionError [ERR_ASSERTION]: refused peer must not retain a server socket
+  
+  1 !== 0
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:30:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 1,
+    expected: 0,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:11:79
+✖ refusal 400 releases server socket (allowHalfOpen=true) (509.122366ms)
+  AssertionError [ERR_ASSERTION]: refused peer must not retain a server socket
+  
+  1 !== 0
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:30:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 1,
+    expected: 0,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:11:79
+✖ refusal 403 releases server socket (allowHalfOpen=true) (508.134074ms)
+  AssertionError [ERR_ASSERTION]: refused peer must not retain a server socket
+  
+  1 !== 0
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:30:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 1,
+    expected: 0,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:11:79
+✖ refusal 431 releases server socket (allowHalfOpen=true) (507.396552ms)
+  AssertionError [ERR_ASSERTION]: refused peer must not retain a server socket
+  
+  1 !== 0
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:30:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 1,
+    expected: 0,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:11:79
+✖ refusal 502 releases server socket (allowHalfOpen=true) (509.521901ms)
+  AssertionError [ERR_ASSERTION]: refused peer must not retain a server socket
+  
+  1 !== 0
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/packages/egress/tests/refusal.test.mjs:30:10)
+      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
+      at async Test.run (node:internal/test_runner/test:1409:7)
+      at async Test.processPendingSubtests (node:internal/test_runner/test:974:7) {
+    generatedMessage: false,
+    code: 'ERR_ASSERTION',
+    actual: 1,
+    expected: 0,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/scripts/install-tests/review-cache.test.mjs:10:36
+✖ inherited cache is discarded; private cache stays unexported (rootless=false) (49.005306ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+  
+  0 !== 2
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/scripts/install-tests/review-cache.test.mjs:19:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.start (node:internal/test_runner/test:1262:17)
+      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: 0,
+    expected: 2,
+    operator: 'strictEqual',
+    diff: 'simple'
+  }
+
+test at ../../../../../../mnt/storage/scratch/tmp/jcNy2F/legacy/scripts/install-tests/review-cache.test.mjs:10:36
+✖ inherited cache is discarded; private cache stays unexported (rootless=true) (42.961333ms)
+  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
+  + actual - expected
+  
+    [
+      '--host',
+  +   'unix:///inherited.sock',
+  +   'ps'
+  -   'unix:///configured.sock',
+  -   'info',
+  -   '--format',
+  -   '{{json .SecurityOptions}}'
+    ]
+  
+      at TestContext.<anonymous> (file:///mnt/storage/scratch/tmp/jcNy2F/legacy/scripts/install-tests/review-cache.test.mjs:20:10)
+      at Test.runInAsyncScope (node:async_hooks:226:14)
+      at Test.run (node:internal/test_runner/test:1402:25)
+      at Test.processPendingSubtests (node:internal/test_runner/test:974:18)
+      at Test.postRun (node:internal/test_runner/test:1542:19)
+      at Test.run (node:internal/test_runner/test:1467:12)
+      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
+    generatedMessage: true,
+    code: 'ERR_ASSERTION',
+    actual: [ '--host', 'unix:///inherited.sock', 'ps' ],
+    expected: [ '--host', 'unix:///configured.sock', 'info', '--format', '{{json .SecurityOptions}}' ],
+    operator: 'deepStrictEqual',
+    diff: 'simple'
+  }
+EXIT=1 (expected 1 for reproduced defects)
@@ -0,0 +1,24 @@
+2026-10-24T04:29:39Z
+ 23:29:39 up 10 days, 14:49,  2 users,  load average: 2.20, 2.85, 2.69
+CLEAR sage-3936 TMPDIR=/mnt/storage/scratch/tmp/0gZQZl
+✔ refusal 408 releases server socket (allowHalfOpen=false) (53.837502ms)
+✔ refusal 408 releases server socket (allowHalfOpen=true) (42.030239ms)
+✔ refusal 400 releases server socket (allowHalfOpen=false) (1.261482ms)
+✔ refusal 400 releases server socket (allowHalfOpen=true) (0.904817ms)
+✔ refusal 403 releases server socket (allowHalfOpen=false) (0.917847ms)
+✔ refusal 403 releases server socket (allowHalfOpen=true) (0.804008ms)
+✔ refusal 431 releases server socket (allowHalfOpen=false) (0.718814ms)
+✔ refusal 431 releases server socket (allowHalfOpen=true) (0.668466ms)
+✔ refusal 502 releases server socket (allowHalfOpen=false) (1.344911ms)
+✔ refusal 502 releases server socket (allowHalfOpen=true) (0.979004ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=false) (82.339935ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=true) (112.830463ms)
+ℹ tests 12
+ℹ suites 0
+ℹ pass 12
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 245.761199
+EXIT=0
@@ -0,0 +1,45 @@
+2026-10-24T04:29:49Z
+ 23:29:49 up 10 days, 14:49,  2 users,  load average: 2.09, 2.81, 2.68
+CLEAR sage-3936 TMPDIR=/mnt/storage/scratch/tmp/tUdE4l
+✔ install: absent (26.366604ms)
+✔ install: local (22.63247ms)
+✔ install: local endpoint (22.799393ms)
+✔ install: containerized missing endpoint (25.600693ms)
+✔ install: bad endpoint "tcp://localhost:2375" (23.03486ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (23.131519ms)
+✔ install: bad endpoint "run/docker.sock" (24.109097ms)
+✔ install: bad endpoint "unix://relative.sock" (23.350143ms)
+✔ install: bad endpoint "unix:///a b.sock" (25.171936ms)
+✔ install: bad endpoint "unix:///a.sock\n" (23.993281ms)
+✔ install: bad endpoint "unix:///a" (23.480143ms)
+✔ install: bad endpoint "" (24.103262ms)
+✔ install: bad endpoint null (22.669641ms)
+✔ install: bad endpoint 4 (24.019575ms)
+✔ install: valid endpoint (24.603314ms)
+✔ install: unknown mode (24.602796ms)
+✔ install: missing mode (23.797819ms)
+✔ install: unknown key (22.998491ms)
+✔ install: null (25.129192ms)
+✔ install: array (24.482115ms)
+✔ helper refuses rootful (69.872106ms)
+✔ helper refuses missing (48.024972ms)
+✔ helper refuses substring (75.261764ms)
+✔ helper refuses object (69.618809ms)
+✔ helper refuses invalid JSON (69.071543ms)
+✔ helper refuses null success (72.882659ms)
+✔ helper refuses rootless output but failed (53.345431ms)
+✔ helper checks once and explicitly names host for both calls (102.552473ms)
+✔ local mode refuses before Docker null (26.011087ms)
+✔ local mode refuses before Docker {"mode":"local"} (28.185416ms)
+✔ invalid config refuses before Docker (27.514422ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=false) (75.055951ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=true) (109.227515ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 33
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 690.153576
+EXIT=0
@@ -0,0 +1,34 @@
+2026-10-24T04:29:59Z
+ 23:29:59 up 10 days, 14:49,  2 users,  load average: 1.93, 2.75, 2.66
+CLEAR sage-3936 TMPDIR=/mnt/storage/scratch/tmp/TviERP
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (23.927026ms)
+✔ unlisted host (1.732173ms)
+✔ unlisted port (1.604846ms)
+✔ GET (1.184716ms)
+✔ invalid port (1.343703ms)
+✔ userinfo (1.188622ms)
+✔ bad header (1.150055ms)
+✔ slow client has a total header deadline (81.793054ms)
+✔ oversized header refuses (1.244104ms)
+✔ missing, invalid and unknown lists fail closed (0.57805ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.746501ms)
+✔ upstream reset after CONNECT closes the tunnel without a second HTTP response (22.237884ms)
+✔ refusal 408 releases server socket (allowHalfOpen=false) (55.691211ms)
+✔ refusal 408 releases server socket (allowHalfOpen=true) (43.646383ms)
+✔ refusal 400 releases server socket (allowHalfOpen=false) (1.568816ms)
+✔ refusal 400 releases server socket (allowHalfOpen=true) (1.105107ms)
+✔ refusal 403 releases server socket (allowHalfOpen=false) (1.202959ms)
+✔ refusal 403 releases server socket (allowHalfOpen=true) (1.016559ms)
+✔ refusal 431 releases server socket (allowHalfOpen=false) (0.914639ms)
+✔ refusal 431 releases server socket (allowHalfOpen=true) (0.889516ms)
+✔ refusal 502 releases server socket (allowHalfOpen=false) (1.698346ms)
+✔ refusal 502 releases server socket (allowHalfOpen=true) (1.234793ms)
+ℹ tests 22
+ℹ suites 0
+ℹ pass 22
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 183.862745
+EXIT=0
@@ -0,0 +1,219 @@
+2026-10-24T04:30:08Z
+ 23:30:08 up 10 days, 14:49,  2 users,  load average: 1.79, 2.69, 2.64
+CLEAR sage-3936 TMPDIR=/mnt/storage/scratch/tmp/qmqk7B
+✔ install: absent (25.729884ms)
+✔ install: local (27.889152ms)
+✔ install: local endpoint (24.35751ms)
+✔ install: containerized missing endpoint (32.226985ms)
+✔ install: bad endpoint "tcp://localhost:2375" (36.932763ms)
+✔ install: bad endpoint "ssh://host/run/docker.sock" (30.311354ms)
+✔ install: bad endpoint "run/docker.sock" (25.198808ms)
+✔ install: bad endpoint "unix://relative.sock" (26.143708ms)
+✔ install: bad endpoint "unix:///a b.sock" (26.182728ms)
+✔ install: bad endpoint "unix:///a.sock\n" (24.78053ms)
+✔ install: bad endpoint "unix:///a" (25.183076ms)
+✔ install: bad endpoint "" (26.038913ms)
+✔ install: bad endpoint null (28.122111ms)
+✔ install: bad endpoint 4 (25.273681ms)
+✔ install: valid endpoint (24.978162ms)
+✔ install: unknown mode (25.362867ms)
+✔ install: missing mode (30.700943ms)
+✔ install: unknown key (25.157537ms)
+✔ install: null (25.311198ms)
+✔ install: array (22.791684ms)
+✔ helper refuses rootful (73.335956ms)
+✔ helper refuses missing (58.142601ms)
+✔ helper refuses substring (76.536037ms)
+✔ helper refuses object (71.066459ms)
+✔ helper refuses invalid JSON (75.615304ms)
+✔ helper refuses null success (74.72487ms)
+✔ helper refuses rootless output but failed (56.316538ms)
+✔ helper checks once and explicitly names host for both calls (116.375519ms)
+✔ local mode refuses before Docker null (33.189488ms)
+✔ local mode refuses before Docker {"mode":"local"} (33.416869ms)
+✔ invalid config refuses before Docker (33.260841ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=false) (77.918846ms)
+✔ inherited cache is discarded; private cache stays unexported (rootless=true) (125.24254ms)
+ℹ tests 33
+ℹ suites 0
+ℹ pass 33
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 751.025142
+✔ allows exact host and port, fragmented headers, and preserves tunnel head (21.619769ms)
+✔ unlisted host (1.449654ms)
+✔ unlisted port (1.146495ms)
+✔ GET (1.037357ms)
+✔ invalid port (0.994228ms)
+✔ userinfo (0.84581ms)
+✔ bad header (0.834734ms)
+✔ slow client has a total header deadline (81.37968ms)
+✔ oversized header refuses (1.096351ms)
+✔ missing, invalid and unknown lists fail closed (0.499339ms)
+✔ refused upstream returns 502 while retaining one allowed decision (1.730862ms)
+✔ upstream reset after CONNECT closes the tunnel without a second HTTP response (21.825124ms)
+✔ refusal 408 releases server socket (allowHalfOpen=false) (55.028256ms)
+✔ refusal 408 releases server socket (allowHalfOpen=true) (42.613145ms)
+✔ refusal 400 releases server socket (allowHalfOpen=false) (1.348936ms)
+✔ refusal 400 releases server socket (allowHalfOpen=true) (1.104981ms)
+✔ refusal 403 releases server socket (allowHalfOpen=false) (1.097498ms)
+✔ refusal 403 releases server socket (allowHalfOpen=true) (0.965577ms)
+✔ refusal 431 releases server socket (allowHalfOpen=false) (0.806917ms)
+✔ refusal 431 releases server socket (allowHalfOpen=true) (0.752832ms)
+✔ refusal 502 releases server socket (allowHalfOpen=false) (1.582846ms)
+✔ refusal 502 releases server socket (allowHalfOpen=true) (1.14509ms)
+ℹ tests 22
+ℹ suites 0
+ℹ pass 22
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 181.752441
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 454B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 0.7s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/9] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 DONE 0.0s
+
+#5 [internal] load build context
+#5 transferring context: 31.38MB 0.1s done
+#5 DONE 0.1s
+
+#6 [2/9] WORKDIR /opt/mosaic
+#6 CACHED
+
+#7 [3/9] COPY package.json package-lock.json ./
+#7 CACHED
+
+#8 [4/9] RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund && npm cache clean --force
+#8 CACHED
+
+#9 [5/9] COPY packages/ packages/
+#9 DONE 0.1s
+
+#10 [6/9] COPY scripts/ scripts/
+#10 DONE 0.0s
+
+#11 [7/9] COPY contracts/ contracts/
+#11 DONE 0.0s
+
+#12 [8/9] COPY roles/ roles/
+#12 DONE 0.0s
+
+#13 [9/9] COPY RELEASE ./
+#13 DONE 0.0s
+
+#14 exporting to image
+#14 exporting layers
+#14 exporting layers 0.4s done
+#14 exporting manifest sha256:cfd93bac400adc7580134f6177efd9d748e4b4ad65b0ff22515ca3b3ffafa530 done
+#14 exporting config sha256:bda6c7420c2df9510f081d28f50d205083867d0ce907c12290fff226c020fe38 done
+#14 exporting attestation manifest sha256:79c61e7daf7794a3db88121ce6260fafab69f182ef89773914c41ca75a44574c done
+#14 exporting manifest list sha256:82fc7a3df060c3e58799cca4f89dbd57dc007c5534fdedce54d3de637cc83b67 done
+#14 naming to docker.io/library/mosaic-core:0.0.12 done
+#14 unpacking to docker.io/library/mosaic-core:0.0.12
+#14 unpacking to docker.io/library/mosaic-core:0.0.12 0.2s done
+#14 DONE 0.7s
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 424B done
+#1 WARN: InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/mosaic-core:0.0.12
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/2] FROM docker.io/library/mosaic-core:0.0.12@sha256:82fc7a3df060c3e58799cca4f89dbd57dc007c5534fdedce54d3de637cc83b67
+#4 resolve docker.io/library/mosaic-core:0.0.12@sha256:82fc7a3df060c3e58799cca4f89dbd57dc007c5534fdedce54d3de637cc83b67 done
+#4 DONE 0.0s
+
+#5 [2/2] RUN npm install -g --no-audit --no-fund @anthropic-ai/[email protected] @earendil-works/[email protected]  && npm cache clean --force && rm -rf /root/.npm /tmp/*
+#5 1.920 npm warn deprecated [email protected]: Use your platform's native DOMException instead
+#5 6.054 
+#5 6.054 added 167 packages in 6s
+#5 6.055 npm warn install-scripts 4 packages have install scripts not yet covered by allowScripts:
+#5 6.055 npm warn install-scripts   @anthropic-ai/[email protected] (postinstall: node install.cjs)
+#5 6.055 npm warn install-scripts   @google/[email protected] (preinstall: echo 'preinstall: no-op')
+#5 6.055 npm warn install-scripts   [email protected] (postinstall: node install.js)
+#5 6.055 npm warn install-scripts   [email protected] (postinstall: node scripts/postinstall)
+#5 6.055 npm warn install-scripts
+#5 6.055 npm warn install-scripts Run `npm install -g --allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs` to allow these scripts once, or `npm config set allow-scripts=@anthropic-ai/claude-code,@google/genai,esbuild,protobufjs --location=user` to allow them for all global installs.
+#5 6.127 npm warn using --force Recommended protections disabled.
+#5 DONE 6.3s
+
+#6 exporting to image
+#6 exporting layers
+#6 exporting layers 19.5s done
+#6 exporting manifest sha256:8b6b7de22cf08845f8fc02961c9677afb9faf0ddc4efe04ab4073a822a60518b done
+#6 exporting config sha256:94013fda37e404bc26b7b15281138cd60afbfea672cae2d2187acc0a7c3a0d7e done
+#6 exporting attestation manifest sha256:127fcf7ecd51a985d22f5a33d5c441d8fa1e246f88dc6e990c01197b46a61427 done
+#6 exporting manifest list sha256:9a272acf49ab376fa9739f66453979487ea8ab259bc43e56f6553e2da7b20835 done
+#6 naming to docker.io/library/mosaic-session:0.0.12 done
+#6 unpacking to docker.io/library/mosaic-session:0.0.12
+#6 unpacking to docker.io/library/mosaic-session:0.0.12 5.2s done
+#6 DONE 24.8s
+
+ [33m1 warning found (use docker --debug to expand):
+[0m - InvalidDefaultArgInFrom: Default value for ARG ${CORE_IMAGE} results in empty or invalid base image name (line 2)
+#0 building with "default" instance using docker driver
+
+#1 [internal] load build definition from Dockerfile
+#1 transferring dockerfile: 299B done
+#1 DONE 0.0s
+
+#2 [internal] load metadata for docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#2 DONE 0.0s
+
+#3 [internal] load .dockerignore
+#3 transferring context: 2B done
+#3 DONE 0.0s
+
+#4 [1/4] FROM docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+#4 resolve docker.io/library/node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20 done
+#4 DONE 0.0s
+
+#5 [internal] load build context
+#5 transferring context: 517B 0.0s done
+#5 DONE 0.0s
+
+#6 [2/4] WORKDIR /opt/mosaic
+#6 CACHED
+
+#7 [3/4] COPY packages/egress/ packages/egress/
+#7 DONE 0.0s
+
+#8 [4/4] COPY contracts/egress.json contracts/egress.json
+#8 DONE 0.0s
+
+#9 exporting to image
+#9 exporting layers 0.0s done
+#9 exporting manifest sha256:db3e8991a9330374257298a4a5d4ff36779e8c8d0b00c8b8ead47fc82e32fada done
+#9 exporting config sha256:e7d66f4f785e49a6529b3ed4b708e3b985f4e737d03a66a2c861666288d435d9 done
+#9 exporting attestation manifest sha256:8d2362ebe73a0b71b175ea4d9571ab841c6f5b0913e8fa265d1f4544307987d2 done
+#9 exporting manifest list sha256:36d0bbeb3abc92fc099d95e1fac416df5cc29edf147fcfc4d8743cbe1d60e592 done
+#9 naming to docker.io/library/mosaic-egress:0.0.12 done
+#9 unpacking to docker.io/library/mosaic-egress:0.0.12 0.0s done
+#9 DONE 0.1s
+internal network: listed TLS reached, unlisted host/port refused, external DNS refused
+Vikunja client public GET 200; notifier REST dummy-token GET 401
+test-install: PASS (provider-host measurement remains Mos gate)
+EXIT=0
@@ -0,0 +1,363 @@
+# Row 157 / I2 / #1652 — Bentina build record
+
+## 2026-10-24 — recovery and pre-build hold
+
+Authority: Sage sage-3906 under Q246 / mos-1566. Seat thread:
+`d1ae468e-51ba-40c4-9513-b39ebbb40450`. Branch `bentina/row157`,
+base `ec86f2c84` (required registration commit), initially clean.
+Read root AGENTS.md, agents/bentina/README.md, the I2 brief and its shared
+rules, and the approved containerized-install design. CURRENT.md is a
+historical narrative; queue and Sage's assignment select this row. Goal
+order recovered from 2026-09-27_goals-review.md. Boyd first review, then
+Darkwing install-path review, per Sage's newer assignment.
+
+### Queue boundary
+
+The initial worktree `scripts/mosaic queue next bentina` refused because
+queue commands require the canonical checkout. Retried the same read using
+`/mnt/storage/src/mosaic-stack/scripts/mosaic` in that checkout (the documented
+queue location, without changing its configuration):
+
+```
+start row 157: I2 install images, the install config key, the endpoint helper and the egress proxy; brief docs/plans/2026-10-18_containerized-install-rows.md § I2 install images, the install config key, the endpoint helper and the egress proxy; brief differs from pinned blob; ask the lead to re-pin
+```
+
+No claimant move until Sage resolves the stale brief pin. No other queue
+write authorized. Sent Sage bentina-0001 with this refusal and the outbound
+path findings below. Implementation has not started.
+
+### Re-read of the I2 brief's cited files at ec86f2c84
+
+| Cited file / old site | Current observation |
+|---|---|
+| scripts/hello.sh:24 | Calls processing-control/src/container-cli.mjs:25; Docker moved behind processing control. |
+| scripts/build.sh:13 | Still ambient `docker compose build`:13. |
+| scripts/release.sh:39,122 | Still ambient image inspect:39 and compose build:122. |
+| scripts/agent.sh:208 | Now execs processing-control/src/container-cli.mjs --tty:209. |
+| scripts/verify.sh:36,39,45 | Ambient image inspect:37 and compose build:40; request now uses processing-control container CLI:46. |
+| scripts/land-work.sh:87-88 | Ambient network inspect/remove unchanged at 87-88. |
+| scripts/test-release.sh:58 | Docker probes now at 78,129; cleanup network rm:25; network checks:131,133. |
+| scripts/test-task.sh:139,395,442,517 | Docker probes now at 166,422,470,513,557,579; cleanup network rm:21 and network checks:581,583. |
+| scripts/mosaic-task.mjs:396 | Now calls runContainer:402, imported from processing control, rather than directly spawning Docker. |
+| packages/cli/src/git-socket.mjs:243 | dropNetwork now spawns ambient docker network rm:266; I6 retains ownership. |
+| scripts/mosaic-config.mjs:109-160 / :115 | Loader expanded for instances, Console, federation and compaction settings. validate starts:293; allowed-key expression:304 retains a prefix used by stack-release-fixture.mjs. No install key yet. |
+
+The design says to read via scripts/load_config; this is a function, not a
+file. Actual entry is scripts/common.sh:16 `load_config`, invoking
+mosaic-config.mjs env, then exporting four existing variables. No install
+mode/endpoint exports yet. No modification made.
+
+Design sections 3/4/7 re-read: exact base digest
+`node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20`;
+three release-tagged images; optional install with local default; exact
+rootless SecurityOptions array element check; baked agents/services CONNECT
+lists; JSON decision log. Spike proxy source re-read: one-chunk request
+parsing, no slow-client bound, environment allowlist; it needs the reviewed
+implementation required by I2, not a direct copy. package.json pins pi
+0.85.1; spike Dockerfile.clis pins Claude Code 2.1.296 (current session-code
+pin still needs checking before implementation).
+
+### Outbound stop condition (brief What ships; design section 7)
+
+The brief explicitly says: “If one doesn't, stop and tell Sage before
+adding a dependency.” Not all broker outbound paths use fetch at this base:
+
+- packages/bus/src/gitea-grant.mjs:11 imports node:https request;
+  send():91-140 calls httpsRequest:115 with `agent: false`, auth header,
+  optional CA, timeout and bounded response. It is not the measured fetch
+  path. runtime.mjs imports and wires the grant executor.
+- packages/bus/src/web.mjs delegates to packages/discord/src/web.mjs.
+  That implementation imports node:https/node:http:23-24, resolves public
+  addresses and pins the connection to a vetted address (:161 onward).
+  Changing it to fetch without preserving that fence would be a boundary
+  change. Its arbitrary public destinations also need reconciliation with
+  the design's fixed services host list; do not widen the list speculatively.
+- packages/tasks/src/vikunja.mjs:30,41 uses injected/default global fetch,
+  redirect:error, and processing cancellation/deadline.
+- packages/cli/src/notifier-process.mjs:41-46 supplies global fetch to
+  openDirect. packages/discord/src/notify.mjs:17 builds REST only; it
+  explicitly does not run the gateway. packages/discord/src/rest.mjs:45
+  calls injected fetch. The separate Discord connector gateway uses native
+  WebSocket (gateway.mjs:193); do not claim the notifier needs that gateway.
+- No NODE_USE_ENV_PROXY or HTTPS_PROXY setup found in host.mjs,
+  notifier-process.mjs or bus/process.mjs. I6 owns container startup;
+  I2's eventual image/process verification must demonstrate the actual path
+  with dummy credentials, after the transport ruling and a CLEAR slot.
+
+Recommendation sent to Sage: re-pin the approved brief and rule on the
+bounded handling/ownership of non-fetch paths before implementation. No new
+dependency, host-list expansion, or replacement of DNS pinning authorized.
+
+### Environment and evidence limits
+
+`/run/user/1000/docker.sock` exists as a Unix socket owned by jwoltje.
+Existence is not a rootless attestation. No Docker command or endpoint probe
+has been run. All test execution requires Sage CLEAR; none requested yet
+because there is no implementation candidate. No test, image build,
+credential read, live config/data access, daemon/volume/unit change, commit
+or push. Once unblocked, implement within the owned file list, add required
+acceptance cases, then request a concrete CLEAR with paths and suites;
+use fresh /mnt/storage/scratch/tmp/XXXXXX TMPDIR and timeout -k 10 for each
+scripts/test-*.sh. Old-test changes require Sage authorization before edits.
+Provider-host measurement ships with expected output for Mos; no real token
+will be used here.
+
+## sage-3907 — stop resolved; implementation draft
+
+Sage confirms only I6 changed since the brief pin, and will re-pin row 157.
+I2 must not change non-fetch security transports or add a dependency. Record
+all gaps, retain each named service host and code path in the contract with
+an explicit note, and build the rest. Sage owns the transport ruling before
+broker rollout in later rows. This supersedes the pre-build transport hold;
+the queue claim still awaits a current pin. No queue move attempted.
+
+Additional non-fetch broker paths found:
+
+- runtime.mjs:511 calls seat/src/working.mjs:461 publishRemote, which runs
+  git ls-remote/push at :479/:490 with credential helper input on fd 3.
+  checkout.mjs:80 gitEnv emits a fixed environment without HTTPS_PROXY.
+  This is Git HTTPS, not fetch; core's no-git design also prevents it from
+  working today. The Gitea host entry retains this caveat.
+- runtime.mjs:292 wires hostGrant; host-grant.mjs:174 spawns ssh-keyscan
+  to read public host keys at the registered address/port. It uses fixed
+  PATH-only env, not fetch or HTTP CONNECT. runtime.mjs:435 wires
+  hostExecutor; host-run.mjs:30-45 sshArgs explicitly sets
+  ProxyCommand=none and ProxyJump=none, then ssh to run authorized commands
+  using a pinned host key and private agent. Neither routes through an env
+  HTTP proxy. Hosts/ports are per registry and may be SSH, so no fabricated
+  :443 allowlist entry or network expansion was added.
+- Search-source plug-ins delegate to discord/src/web.mjs. searxng-url
+  sends search GETs to the operator's configured host; searxng-bundled points
+  at 127.0.0.1:8888. Both are non-fetch and depend on the existing DNS checks.
+  No fixed host can be truthfully named for arbitrary web.fetch or operator
+  search; no wildcard entry was added. These are documented gaps, not
+  claims of proxy coverage.
+- Separate Discord connector gateway uses native WebSocket; retained
+  gateway.discord.gg:443 with a NOT PROXIED note, as Sage directs. Notifier
+  is REST-only; no gateway test or live connector run added.
+
+Choices: dependency-free net proxy; exact list lookup; 8192-byte/5s total
+header bounds, 10s upstream connect/120s tunnel idle bounds. JSON allowed
+means the contract permitted the destination, not that upstream succeeded.
+Images use exact I1 base, core has NODE_USE_ENV_PROXY=1, session globally
+installs Claude 2.1.296 and package.json pi pin. Source context includes only
+tracked runtime paths plus explicit new I2 runtime paths, never agent work
+or host node_modules/.git. Tags derive from RELEASE. Core receives no git.
+The zai host candidate api.z.ai is confirmed by the pinned dependency's
+providers/zai.js:9 in canonical node_modules; real-token measurement remains
+Mos's gate. OpenAI candidate is from S6 and is only measured when configured.
+No live model-table config was read.
+
+New tests cover config exit/immutability; helper rootful, null/nonzero,
+substring, wrong type/JSON, exact rootless and hostile DOCKER_HOST; proxy
+fragmentation/pipelined data, deny/port/malformed/slow/oversize and JSON logs.
+test-install additionally builds, inspects pins and exercises an internal
+network plus actual Vikunja/public GET and notifier REST/dummy GET with
+proxy log evidence. The generic S5 fetch test is not repeated.
+
+Old-suite change is prepared as test-config.patch (adds new config cases
+before the existing summary). It has NOT been applied: Sage's old-test
+change rule requires approval first. No old tests changed. No tests run.
+
+## sage-3910 — first CLEAR
+
+Authorized four serialized runs exactly as requested, plus applying the
+addition-only test-config.patch. No broader suites; Sage supplies the
+landing gate. Return slot on run 4 completion or an actual stop.
+
+Additional paths retained under Sage's explicit ruling:
+- scripts/install-tests/config.test.mjs: table of install schema/exit/byte
+  preservation cases, reused by test-config.sh and test-install.sh.
+- scripts/install-tests/helper.test.mjs: fake Docker executable to assert
+  exact argv and rootless refusal before the requested call, without a daemon.
+- scripts/install-tests/network-probe.mjs: actual internal-network tunnel,
+  TLS, unlisted host/port and external DNS refusal in a core image.
+- scripts/install-tests/services-probe.mjs: actual Vikunja and notifier REST
+  client functions, public GET plus invalid dummy token, with proxy log proof.
+All are new files; no old assertion changes.
+
+## First CLEAR result and sage-3916 correction
+
+Run 1: exit 0, config/helper 31/31, zero fail/skip/cancel,
+01-install-unit.log. Run 2: exit 0, proxy 11/11, zero fail/skip/cancel,
+02-egress.log. Run 3: exit 1, config selftest 55 pass / 1 fail; new install
+cases 20/20, 03-config.log. Each log records UTC/load/CLEAR/fresh scratch TMPDIR.
+Run 4 NOT RUN: no Docker command, probe or build. Slot returned to Sage in
+bentina-0004 before any rerun.
+
+Old red: config without console loads with unchanged output
+(test-config.sh:266; log:53). Cause: this implementation unconditionally
+added install:{mode:local} to resolved JSON. Sage-3916 approves the source-only
+fix: omit output key when input omits it (optional-key convention), default
+env export to local. Applied this fix to mosaic-config.mjs and adjusted only
+the new absent-key case. No old assertion changed. No verification after fix:
+Poe has the current slot, Bentina runs next only on a new CLEAR. Run order
+will be 1, 3, 4; no reason to rerun unchanged proxy unit tests separately.
+
+The approved test-config patch is addition-only: git diff --numstat reports
+4 added, 0 removed lines for scripts/test-config.sh. No existing line or
+assertion changed. git diff --stat before first run:
+
+```
+ BUILD-LOG.md              |  2 ++
+ README.md                 |  9 +++++++++
+ docs/SESSIONS.md          |  2 ++
+ docs/TOOLS.md             | 38 ++++++++++++++++++++++++++++++++++++++
+ scripts/mosaic-config.mjs | 20 +++++++++++++++++++-
+ scripts/test-config.sh    |  4 ++++
+ 6 files changed, 74 insertions(+), 1 deletion(-)
+```
+
+New untracked paths are not included by git diff --stat; see explicit paths
+above. Claim bentina-0003 initially refused queue-lock-held; same op retried.
+Sage reports re-pin rev 3808 (sage-3913).
+
+## sage-3919 — corrected acceptance green, slot returned
+
+Run 1 exit 0, helper/config 31/31 (04-install-unit-fixed.log); run 3 exit 0,
+config selftest 56/56 plus new install 20/20 (05-config-fixed.log); run 4
+exit 0 (06-install.log), helper/config 31/31 and proxy 11/11, images built
+at RELEASE 0.0.12, rootless endpoint explicitly attested, image version
+checks passed, internal-network TLS to listed host reached, unlisted host
+and port refused, external DNS refused. Actual Vikunja public GET returned
+200 and notifier REST dummy-token GET returned 401; services proxy logs
+show both host decisions. No real token or broker started. Test-owned
+networks/containers cleaned by suite. Slot returned bentina-0005. No broader
+suites: Sage's landing gate supplies them. Claim bentina-0003 acknowledged
+rev 3812 briefed -> in-progress. No queue files changed in this worktree.
+
+Post-pass source review found one small correctness defect before handoff:
+upstream errors after a successful CONNECT would append a plaintext 502 to
+an established TLS tunnel. Corrected to close an established tunnel and
+reserve 502 for establishment errors. Added a local reset-after-CONNECT
+regression alongside the existing establishment-error test. This creates
+a new verification need: request a new CLEAR for egress units and install
+rebuild/probe before committing. Existing green logs above predate this fix;
+do not claim them for the final proxy bytes.
+
+## sage-3923 — final proxy and install evidence
+
+07-egress-final.log: exit 0, 12/12, zero fail/skip/cancel, including upstream
+reset after a CONNECT200 closes the tunnel without a second HTTP response.
+08-install-final.log: exit 0, 31/31 config/helper and 12/12 proxy,
+zero fail/skip/cancel, three images rebuilt, version checks passed,
+internal-network listed TLS200/unlisted host403/unlisted port403/external
+DNS refused, Vikunja public GET200 and notifier REST dummy-token GET401
+through services proxy; JSON log decisions verified. Explicit endpoint
+unix:///run/user/1000/docker.sock passed rootless check. Suite removed only
+its named i2 containers/networks. Slot returned to Sage in bentina-0007.
+
+No runtime source change after these final reruns. Mos-only measurement
+runner was statically hardened to report a fixed message on malformed
+credential JSON, avoiding JSON.parse's error snippet echoing private input.
+The runner and provider script have not been executed here: Mos owns the
+real-token/provider-model-table check and its output must land on #1652.
+No claim of completed provider-host measurement or final host-list approval.
+
+Acceptance accounting:
+- Install validator cases and unchanged config bytes: new 20 cases green;
+  entire existing config suite 56/56 (05-config-fixed.log); absent output
+  shape preserved; env/helper default local proven by helper's absent test.
+- Rootless guard: exact argv/array membership/status/type/refusal fake
+  cases plus real rootless check in 08-install-final.log. No ambient Docker
+  context used by new code. Other scripts' migration remains I6.
+- Images: exact base digest in Dockerfiles, release 0.0.12 tags, core node
+  24.21.0/no-git/RELEASE assertion; session Claude2.1.296/pi0.85.1 assertions;
+  all built through the helper on the explicit rootless endpoint.
+- Proxy: allow/deny/port/malformed/slow/fragmented/header-bound/upstream-error
+  and structured logs verified in final unit suite; actual TLS tunnel and
+  internal-network denials plus services client fetch paths verified by
+  install suite. The generic S5 fetch probe was not repeated.
+- Non-fetch broker/gateway/SSH/Git/web paths remain documented gaps under
+  sage-3907, not modified or silently claimed to be covered. All fixed
+  service hosts retain entries and code-path notes. No dependency added.
+- Full suites: not run here per sage-3910; Sage's landing gate supplies
+  broader coverage. Reviewer and Mos gates still pending.
+
+Static source diff whitespace check passed (excluding captured .log files
+and unified .patch context). Raw build logs retain Docker/npm output
+including whitespace; no evidence was normalized or rewritten. Old-suite
+change remains +4/-0 and every prior assertion byte-identical. No queue
+file changed here. No secret read, token test, live state/unit operation,
+daemon/volume/restart action, protected-branch push, or integration.
+
+Candidate handoff: base ec86f2c84; commit only this I2 work and receipts on
+bentina/row157, push through configured repository helper, then send Sage
+and Boyd the tip/base/manifest for first review. Darkwing follows Boyd.
+The manifest lists each changed path except its own self-reference.
+
+## Round 2 — Boyd B1/B2 (boyd-0023; Sage sage-3933)
+
+First candidate a14fdc443, manifest b0ed8395, CHANGES on #1652 comment31494.
+Read Boyd's exact scratch harnesses and logs under /mnt/storage/scratch/tmp/IyNqMs.
+B1 reproduction: normal peer control releases its socket, allowHalfOpen peer
+receives408 but getConnections still reports1 after100ms (assertion1 != 0).
+Root cause: refusal end sends FIN but clears the only deadline and leaves the
+read side open. B2 reproduction: same-PID exec inherits exported checked_pid
+and endpoint; fake rootful Docker sees ps on inherited.sock, no info; rc0 vs
+expected2. Root cause: source initializes neither cache validity nor endpoint.
+These findings agree with source inspection and require no design departure.
+No local tests were run while Goldie holds the slot.
+
+Added tests before fixes, adapted from the reviewer with explicit cleanup:
+- packages/egress/tests/refusal.test.mjs: real loopback sockets, normal and
+  half-open controls for every400/403/408/431 refusal; asserts server socket
+  count reaches0, one denial log, expected response. Removing destruction
+  after flush should fail half-open cases while normal controls still pass.
+- scripts/install-tests/review-cache.test.mjs: same-PID exec with inherited
+  exported cache, fake rootful/rootless Docker, actual loader/helper; asserts
+  first call is info at configured.sock, refusal or exact once-per-process
+  cache behavior, and no cache keys in Docker's child environment. Removing
+  source-time reset should fail; no real engine, config or credentials used.
+No existing test file or assertion edited.
+
+Minimal fixes: proxy uses endAndClose for all refusal responses, including
+upstream establishment502: destroy after the small response flushes, plus a
+fixed1s drain deadline cleared on close. Established-tunnel reset behavior
+stays unchanged. Helper unsets checked_pid/endpoint/mode on every source,
+clearing inherited export attributes; ordinary function calls still reuse
+only an attestation obtained in the current process. No dependency, contract,
+host-list or authority change. Request CLEAR for new regression red/green,
+full targeted units and test-install rebuild before commit. Old-test red
+still stops and returns slot. Sage's broader landing gate remains separate.
+
+Sage-3935 approves the five-run plan including archived red-first proof;
+Goldie holds the slot and Bentina is next. Still no node/docker test run.
+The new refusal test also includes normal/half-open502 establishment failures
+on a closed loopback port, exercising the shared termination helper on that
+path (allowed log stays true for an approved destination whose upstream fails).
+This stays within the named new regression file and approved commands.
+
+## Round 2 verified — sage-3936 slot returned
+
+Claimant move bentina-0012 acknowledged rev3825 in-review -> in-progress,
+before the correction commit. Five serialized runs, each fresh short scratch
+TMPDIR/UTC/load/CLEAR and timeout -k10:
+
+| Run | Log (this directory) | Exit | Evidence |
+|---|---|---|---|
+| 1 old archived runtime + new tests | 09-r2-archived-red.log | 1 expected | 12 tests:5 normal-peer controls pass;7 intended failures (five half-open400/403/408/431/502 cases, two inherited-cache cases);0skip/cancel |
+| 2 fixed regressions | 10-r2-regressions-green.log | 0 | 12/12,0fail/skip/cancel |
+| 3 install unit suite | 11-r2-install-units.log | 0 | 33/33,0fail/skip/cancel |
+| 4 egress suite | 12-r2-egress-suite.log | 0 | 22/22,0fail/skip/cancel |
+| 5 install images/network/services | 13-r2-install.log | 0 | 33+22 unit tests green;three images rebuilt/version pins checked;explicit rootless guard;listed TLS200,unlisted host/port403,external DNS refused;Vikunja publicGET200/notifier REST dummyGET401;JSON decisions verified |
+
+Run1 unpacked git archive of a14fdc443 into its own scratch directory and
+overlaid only the two new tests; it did not revert or modify the builder
+worktree. Failures were exact behavioral assertions, not infrastructure or
+syntax errors. All test sockets cleaned in t.after; the install suite
+removed only its i2-prefixed containers/networks. Slot returned to Sage in
+bentina-0014. No existing test file/assertion changed for round2. No code
+change after verification. Earlier config56/56 evidence remains in05 log;
+loader/config unchanged for this review. No broader suites authorized here.
+
+The round2 manifest MANIFEST-r2.sha256 covers the full candidate delta from
+original base ec86f2c84, including the unchanged historical round1 manifest;
+it excludes only its own self-reference (its hash is supplied in the review
+message). Historical round1 manifest still describes a14fdc443 and is not
+rewritten to describe later source. New manifest, candidate tip/base and
+receipts go to Sage and Boyd, then Darkwing follows Boyd's approve. The
+owner's automated review-request credential boundary still belongs to Sage;
+no token read or identity substitution is authorized. Mos provider evidence
+and Sage's broader landing gate remain required. No protected-branch push,
+real-token test, live config/state/unit action or daemon/volume operation.
@@ -0,0 +1,44 @@
+58e473e1783a9f64f6b1a696f747925b9a444d85dbe72e48e7a0dcbd62a2d4e5  BUILD-LOG.md
+67bd811b3030ba0355af2316d02e8b2931b4b2c5a74c5be904b5311de6ef81dd  README.md
+6161cc0505bf0be33ba0e7c7f0f07382cca0ec2b5ace65ac54e16c4d1e3424fc  agents/bentina/work/queue-157/01-install-unit.log
+f13213941dab22955841108d85e62f67ede2ddbc95c25a7b351f30070b035a85  agents/bentina/work/queue-157/02-egress.log
+b46c3fb5f252100f3e2de5b97bd0efc0c1fbbef26230252945f7bb309d359f5e  agents/bentina/work/queue-157/03-config.log
+fc76e5f9b19a31b494ebf4a128ef5f171f1f0712dc3928bebb6556815577015c  agents/bentina/work/queue-157/04-install-unit-fixed.log
+c9a46d969c5d28814addccd7cafe8e734d15c02a407ee80434d4e3e70a3fa4b7  agents/bentina/work/queue-157/05-config-fixed.log
+1d5505a6aba0078e7cf9936fb683e06ac900af12e9e8faf224099a5e2d825fc7  agents/bentina/work/queue-157/06-install.log
+c684dfdd8a460a915e15291fc0f92c9ba30f38d3d3dfa5fa190e7835fbcd448f  agents/bentina/work/queue-157/07-egress-final.log
+5c3efacdbcda5628882045644c32169b7020a6e49d6b89b273aba20ae042898b  agents/bentina/work/queue-157/08-install-final.log
+d2f7bd37b5ac8cc781fae1308a5b047e0ed0d1b63f8d5e22d56e0efa328c4883  agents/bentina/work/queue-157/09-r2-archived-red.log
+4230f9fcc91d1670df0d975e9c5794edb7aa9b21b24c4f415d1594373e769da4  agents/bentina/work/queue-157/10-r2-regressions-green.log
+3e5cd8d154b01ede9a9533f4ff40ac29b4e8193131fd63ba04707df51217d0bb  agents/bentina/work/queue-157/11-r2-install-units.log
+4d23ae4a6d3247a498bd446960c075235f632474fba9e8db374a32aaf4760219  agents/bentina/work/queue-157/12-r2-egress-suite.log
+a4652f0eb6dfcc177c24c5d85d7ec08096e9f49304085f817828d7ef451acd64  agents/bentina/work/queue-157/13-r2-install.log
+5b595798fa8184b15412276d070a0891fdf5cb629eabb8b7bb5f6b3d2b69b3a5  agents/bentina/work/queue-157/BUILD.md
+b0ed8395108ad398f5c9c08fbac8a1b5ca02f579a5d7b709d19d3aaf0860f9ae  agents/bentina/work/queue-157/MANIFEST.sha256
+21f9783dcfe2cac00a49d0d7930a57134bc59ec19dd7bf2e96950f79fae5b1b1  agents/bentina/work/queue-157/PROVIDER-EXPECTED.md
+6518c574291db5816057fbbc438435d0571e088c8f26d1a47ec03ff3047a5efa  agents/bentina/work/queue-157/provider-hosts.sh
+6dbef8d20ede98a9311ba47137b587c07cbc03e921b2a8429652fe362aeb4b85  agents/bentina/work/queue-157/provider-runner.mjs
+e7cb4d0c67eadec557a25385b4ea9803970818354a9e8b0780ac4de07cf34911  agents/bentina/work/queue-157/test-config.patch
+cb2b251342f0020764b7b757b22567d52380053fc15f0e1c7e665a5ec1838f24  contracts/egress.json
+58107cfa274b7551ae163ea77c56d08df530e7f08e06539ddd2999c22252d749  docs/SESSIONS.md
+edcaa526bf0a518716d4e87895d49920b8912295688809a25102ce6b9d6ebdc3  docs/TOOLS.md
+6bd1dc7c244cfb4134d813e0b149ef1182a810eb99f01a95d548f0885b216437  images/README.md
+9c6c3d5736f1ed7eb6dcdb893761b937b7108e29730daf28fe8dd0064df73740  images/core/Dockerfile
+0179d84a7b9321832efb1d90c0290c8f2f6de03db3b2b6d8379672aca598c2a0  images/egress/Dockerfile
+e246e3e3da1065f3c8cf24cc1f7ae15290f3e4c6508f0c6f17a4889a77f2d591  images/session/Dockerfile
+3930764cf5848571507eec3e5b3eda2ebb8aa2d9642f83615b462bf5035e0e75  packages/egress/README.md
+2c45bfed1f19f8a42e05552f8a10584feed8d25ccc506252d55a9a3b6c90a21c  packages/egress/package.json
+257058faee55a429d98955b6253d6b8a0bb058c50446764566586b06a8f76b61  packages/egress/src/cli.mjs
+ce3adb0515ca7e9041f36d7a82df355a3fc97e2a96fc6811ea3b9b47e464787b  packages/egress/src/proxy.mjs
+5c4e778ec9ec5b93ab681d615a2240cd342d09adfe4df1634f3d6abbf16a405b  packages/egress/tests/proxy.test.mjs
+258e954ad7e441a7dd7d25ca9208691ea167e9cb7f34d7d689ed11005adeb4b4  packages/egress/tests/refusal.test.mjs
+86e0152120b04fcfe2a4081b7686f179a139c5370027828c79572033f3cf81c3  scripts/images.sh
+3647b06df02b4d9c0a74b62c774ecdff9272e68a84c06cd85861d7bf18655d5a  scripts/install-tests/config.test.mjs
+21e05bc3e0639427f5a9d4cf166d2991964134845272df76c712ad00ea8033b6  scripts/install-tests/helper.test.mjs
+aa5328566d3e5b46fee587657dac146712735dca0aca90d3d0ad84bc20e313e1  scripts/install-tests/network-probe.mjs
+45274f6745cf931f3002e6c36dcfc46a96c8f09e01e6243c18659749673752fd  scripts/install-tests/review-cache.test.mjs
+72ae66696ad2faaf258c832fdfdf680efc8fca7099359e58da1ee01a88541d8a  scripts/install-tests/services-probe.mjs
+79a8ecfc5ab279111031d5a44906450b732b517fe98511992cafd873ab7a84d3  scripts/lib/docker.sh
+7398bb289d2f28ed15a2984bdeee7e30a704890a33b5e2a5c9f7554115aca8f9  scripts/mosaic-config.mjs
+dcf1799238141689c9d80adc6680694a609e5fb9deef7b78d6b3f4765163e3fe  scripts/test-config.sh
+08be25f67d8fc6676218b1014d34a2ce36a939231f58b657972d856ee26169b2  scripts/test-install.sh
@@ -0,0 +1,36 @@
+6995aa3bcdf50e2441142cc9b6fc9ec84853e353e7a408bbc877ee7e188e73c4  BUILD-LOG.md
+67bd811b3030ba0355af2316d02e8b2931b4b2c5a74c5be904b5311de6ef81dd  README.md
+6161cc0505bf0be33ba0e7c7f0f07382cca0ec2b5ace65ac54e16c4d1e3424fc  agents/bentina/work/queue-157/01-install-unit.log
+f13213941dab22955841108d85e62f67ede2ddbc95c25a7b351f30070b035a85  agents/bentina/work/queue-157/02-egress.log
+b46c3fb5f252100f3e2de5b97bd0efc0c1fbbef26230252945f7bb309d359f5e  agents/bentina/work/queue-157/03-config.log
+fc76e5f9b19a31b494ebf4a128ef5f171f1f0712dc3928bebb6556815577015c  agents/bentina/work/queue-157/04-install-unit-fixed.log
+c9a46d969c5d28814addccd7cafe8e734d15c02a407ee80434d4e3e70a3fa4b7  agents/bentina/work/queue-157/05-config-fixed.log
+1d5505a6aba0078e7cf9936fb683e06ac900af12e9e8faf224099a5e2d825fc7  agents/bentina/work/queue-157/06-install.log
+c684dfdd8a460a915e15291fc0f92c9ba30f38d3d3dfa5fa190e7835fbcd448f  agents/bentina/work/queue-157/07-egress-final.log
+5c3efacdbcda5628882045644c32169b7020a6e49d6b89b273aba20ae042898b  agents/bentina/work/queue-157/08-install-final.log
+f4755f24d626dc69b8159c6934e4213a907659dbb4d46d29d82efc0405b50152  agents/bentina/work/queue-157/BUILD.md
+21f9783dcfe2cac00a49d0d7930a57134bc59ec19dd7bf2e96950f79fae5b1b1  agents/bentina/work/queue-157/PROVIDER-EXPECTED.md
+6518c574291db5816057fbbc438435d0571e088c8f26d1a47ec03ff3047a5efa  agents/bentina/work/queue-157/provider-hosts.sh
+6dbef8d20ede98a9311ba47137b587c07cbc03e921b2a8429652fe362aeb4b85  agents/bentina/work/queue-157/provider-runner.mjs
+e7cb4d0c67eadec557a25385b4ea9803970818354a9e8b0780ac4de07cf34911  agents/bentina/work/queue-157/test-config.patch
+cb2b251342f0020764b7b757b22567d52380053fc15f0e1c7e665a5ec1838f24  contracts/egress.json
+d6239336e48b6a78b80680c88e83ba4b67f8cbed99bf2ee3a697b1b0611e54e9  docs/SESSIONS.md
+edcaa526bf0a518716d4e87895d49920b8912295688809a25102ce6b9d6ebdc3  docs/TOOLS.md
+6bd1dc7c244cfb4134d813e0b149ef1182a810eb99f01a95d548f0885b216437  images/README.md
+9c6c3d5736f1ed7eb6dcdb893761b937b7108e29730daf28fe8dd0064df73740  images/core/Dockerfile
+0179d84a7b9321832efb1d90c0290c8f2f6de03db3b2b6d8379672aca598c2a0  images/egress/Dockerfile
+e246e3e3da1065f3c8cf24cc1f7ae15290f3e4c6508f0c6f17a4889a77f2d591  images/session/Dockerfile
+3930764cf5848571507eec3e5b3eda2ebb8aa2d9642f83615b462bf5035e0e75  packages/egress/README.md
+2c45bfed1f19f8a42e05552f8a10584feed8d25ccc506252d55a9a3b6c90a21c  packages/egress/package.json
+257058faee55a429d98955b6253d6b8a0bb058c50446764566586b06a8f76b61  packages/egress/src/cli.mjs
+2ec533e8a2c9ace2d2dc17ac9efe75a9930ae50e93f6700e3de8aa0475b42295  packages/egress/src/proxy.mjs
+5c4e778ec9ec5b93ab681d615a2240cd342d09adfe4df1634f3d6abbf16a405b  packages/egress/tests/proxy.test.mjs
+86e0152120b04fcfe2a4081b7686f179a139c5370027828c79572033f3cf81c3  scripts/images.sh
+3647b06df02b4d9c0a74b62c774ecdff9272e68a84c06cd85861d7bf18655d5a  scripts/install-tests/config.test.mjs
+21e05bc3e0639427f5a9d4cf166d2991964134845272df76c712ad00ea8033b6  scripts/install-tests/helper.test.mjs
+aa5328566d3e5b46fee587657dac146712735dca0aca90d3d0ad84bc20e313e1  scripts/install-tests/network-probe.mjs
+72ae66696ad2faaf258c832fdfdf680efc8fca7099359e58da1ee01a88541d8a  scripts/install-tests/services-probe.mjs
+e524a285dcebe2a6350e7690650c2796e54661225ce00a67b4559e519f9e3fea  scripts/lib/docker.sh
+7398bb289d2f28ed15a2984bdeee7e30a704890a33b5e2a5c9f7554115aca8f9  scripts/mosaic-config.mjs
+dcf1799238141689c9d80adc6680694a609e5fb9deef7b78d6b3f4765163e3fe  scripts/test-config.sh
+08be25f67d8fc6676218b1014d34a2ce36a939231f58b657972d856ee26169b2  scripts/test-install.sh
@@ -0,0 +1,37 @@
+# Mos provider-host gate (not run by Bentina)
+
+Run only after candidate images build and Mos authorizes the real-token calls.
+Use a scratch config with install.mode containerized and the rootless endpoint;
+do not change the live config. Provide one JSON object on stdin with
+`claudeOAuth` and `zai`, plus optional `anthropic` / `openai` keys if those
+providers are in the actual model table. The script opens no host token file.
+Never paste the input or raw CLI output on the issue. It prints success flags
+and the proxy's host decisions only. Wrap in `timeout -k 10 600`.
+
+From the checkout:
+
+```
+Mos-private-json-producer | MOSAIC_CONFIG=/path/to/scratch-config.json agents/bentina/work/queue-157/provider-hosts.sh
+```
+
+Expected required output (with just Claude Code and pi/zai):
+
+```
+{"case":"claude","ok":true}
+{"case":"pi-zai","ok":true}
+{"hosts":["api.anthropic.com:443","api.z.ai:443"],"denied":[]}
+```
+
+Optional pi/anthropic adds `{"case":"pi-anthropic","ok":true}` and no
+host. Optional pi/openai adds `{"case":"pi-openai","ok":true}` and
+`api.openai.com:443` to sorted hosts. All cases must return ok true, exit 0,
+and denied empty. Model names are explicit candidates; Mos must reconcile
+them to the actual model table without broadening a host list on failure.
+A new host, refusal, failure, or different model requirement returns to Sage;
+there is no wildcard or automatic discovery/update. The baked agents list
+remains provisional until Mos posts matching output on #1652.
+
+Each resource name begins i2-provider; cleanup removes only this run's two
+networks and two containers. No volumes, daemon or restart operations. The
+measurement uses container root as the design requires; I5 still owns the
+full root filesystem re-measurement and final session limits.
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Mos runs this explicitly with a caller-supplied scratch MOSAIC_CONFIG and
+# credential JSON on stdin. This script reads no host credential file.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
+cd "$REPO"
+source scripts/lib/docker.sh
+mosaic_docker version >/dev/null
+release="$(tr -d '[:space:]' < RELEASE)"
+prefix="i2-provider-$(date -u +%s)-$$"
+nets=("$prefix-internal" "$prefix-egress")
+cleanup(){
+ rc=$?; trap - EXIT
+ mosaic_docker container rm -f "$prefix-session" "$prefix-proxy" >/dev/null 2>&1 || true
+ for net in "${nets[@]}"; do mosaic_docker network rm "$net" >/dev/null 2>&1 || true; done
+ exit "$rc"
+}
+trap cleanup EXIT
+mosaic_docker network create --internal "${nets[0]}" >/dev/null
+mosaic_docker network create "${nets[1]}" >/dev/null
+mosaic_docker create --name "$prefix-proxy" --network "${nets[1]}" --read-only --cap-drop ALL --security-opt no-new-privileges --pids-limit 64 --memory 128m --memory-swap 128m --cpus 0.5 "mosaic-egress:$release" agents >/dev/null
+mosaic_docker network connect --alias proxy "${nets[0]}" "$prefix-proxy"
+mosaic_docker start "$prefix-proxy" >/dev/null
+ready=0
+for attempt in {1..50}; do
+ if mosaic_docker exec "$prefix-proxy" node -e 'const s=require("node:net").connect(3128,"127.0.0.1");s.on("connect",()=>{s.destroy();process.exit(0)});s.on("error",()=>process.exit(1))'; then ready=1; break; fi
+ sleep 0.1
+done
+[ "$ready" = 1 ] || { echo proxy-not-ready >&2; exit 1; }
+rc=0
+# Token travels only in stdin and the CLI child's env; never an engine env or log.
+mosaic_docker run --rm --init -i --name "$prefix-session" --network "${nets[0]}" --log-driver none --read-only --tmpfs /root:rw,nosuid --tmpfs /tmp:rw,noexec,nosuid --cap-drop ALL --security-opt no-new-privileges --pids-limit 512 --memory 4g --memory-swap 4g --cpus 2 \
+ --mount "type=bind,src=$REPO/agents/bentina/work/queue-157/provider-runner.mjs,dst=/opt/mosaic/provider-runner.mjs,readonly" \
+ "mosaic-session:$release" node provider-runner.mjs || rc=$?
+mosaic_docker logs "$prefix-proxy" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{const rows=s.trim().split("\n").filter(Boolean).map(JSON.parse);const deny=rows.filter(r=>r.host&&!r.allowed);console.log(JSON.stringify({hosts:[...new Set(rows.filter(r=>r.allowed).map(r=>r.host+":"+r.port))].sort(),denied:[...new Set(deny.map(r=>r.host+":"+r.port))].sort()}));if(deny.length)process.exitCode=1})' || rc=$?
+exit "$rc"
@@ -0,0 +1,17 @@
+// Mos-only real-token measurement. Reads one JSON object on stdin. Never logs CLI output.
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+let input='';for await(const chunk of process.stdin){input+=chunk;if(input.length>65536)throw new Error('measurement-input-too-large');}
+let keys;try{keys=JSON.parse(input);}catch{input='';process.stderr.write('measurement-input-invalid\n');process.exit(2);}input='';
+if(!keys.claudeOAuth||!keys.zai)throw new Error('measurement-needs-claudeOAuth-and-zai');
+const prompt='Reply with exactly I2_PROVIDER_OK and no other text.';
+const env={PATH:process.env.PATH,HOME:'/root',HTTPS_PROXY:'http://proxy:3128',HTTP_PROXY:'http://proxy:3128',NODE_USE_ENV_PROXY:'1',CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:'1'};
+const pi=['--no-session','--no-tools','--no-approve','--no-extensions','--no-skills','--no-prompt-templates','--no-themes','--no-context-files'];
+const cases=[['claude','claude',['-p',prompt,'--tools',''],{CLAUDE_CODE_OAUTH_TOKEN:keys.claudeOAuth}],['pi-zai','pi',[...pi,'--provider','zai','--model','glm-5.3-flash','-p',prompt],{ZAI_API_KEY:keys.zai}]];
+if(keys.anthropic)cases.push(['pi-anthropic','pi',[...pi,'--provider','anthropic','--model','claude-sonnet-5-5','-p',prompt],{ANTHROPIC_API_KEY:keys.anthropic}]);
+if(keys.openai)cases.push(['pi-openai','pi',[...pi,'--provider','openai','--model','gpt-5.4','-p',prompt],{OPENAI_API_KEY:keys.openai}]);
+for(const [name,bin,args,secrets] of cases){
+ let ok=false;try{const {stdout}=await exec(bin,args,{env:{...env,...secrets},timeout:120000,killSignal:'SIGKILL',maxBuffer:1024*1024});ok=stdout.includes('I2_PROVIDER_OK');}catch{}
+ console.log(JSON.stringify({case:name,ok}));if(!ok)process.exitCode=1;
+}
@@ -0,0 +1,12 @@
+--- a/scripts/test-config.sh
+++ b/scripts/test-config.sh
+@@ -291,5 +291,9 @@
+ fi
+ 
+ echo
+# I2: each install shape asserts its exit code and config-byte preservation.
+node --test scripts/install-tests/config.test.mjs
+check "install configuration cases" $?
+
+ echo "selftest: $PASS passed, $FAIL failed"
+ [ "$FAIL" -eq 0 ]
@@ -1,122 +0,0 @@
-# Row 208 / 193d — Console shared threads and viewer reads
-
-Base ec86f2c84, branch poe/row208; Gitea #1706. Approved design: e2d161e2e,
-sha256 dd7fcb419ed8510e9d8d74b569183386d0942af8b68eecc0bbb5e182e677b523.
-
-## Before
-
-FED R6 supplies per-session user transport and the user-only page, row 192 SSO,
-and row 206 supplies schema 3l shares and bus refusals. No bus/schema changes needed.
-The webui channel adapter must forward the three existing share verbs.
-
-## Choices and acceptance
-
-Use the existing chat HTTP write fences and per-session transport for shares.
-Expose only live collaborator grant project/instance scopes as UI hints, never
-identity or bus authority. Re-read hints when rendering a user page; mixed grants
-must hide writes on viewer-only threads even when another project allows writes.
-Shared threads always read without session management, composer, resume or sharing.
-Keep the exact governance notice on user thread/share pages. Targets are typed
-owner/user principal names or *, avoiding a new user directory read API.
-
-Add new isolated HTTP/broker and browser coverage. Remove each UI guard in mutants
-and show the real broker still refuses viewer create, send, open and share writes.
-Every test execution requires Sage CLEAR; use scratch TMPDIR, deadlines, npm ci,
-and MOSAIC_REQUIRE_EDITOR_BUILD=1. No live state or network destinations.
-
-## Tracking
-
-Queue next from linked tree refused as designed; canonical next matched pinned brief.
-Claim poe-0001 initially refused on Sage's queue lock; retry the same operation id.
-
-Claim poe-0001 succeeded at canonical queue revision 3807 (in-progress).
-During implementation, three string replacements briefly targeted canonical
-packages/webui/src/public/{bus.js,user.js,chat.js} due to an incorrect command cwd.
-Checked the complete diffs, surgically reversed exactly those replacements, and
-applied them to this worktree. Sage independently confirmed canonical packages/
-has no remaining diff (sage-3914). No tests or live actions occurred there.
-
-poe-0002 requested the test slot. sage-3914 approved the exact serialized plan,
-but CLEAR is pending Bentina returning her slot. No node/npm/browser commands
-before CLEAR. New tests are thread-sharing.test.mjs with thread-sharing-fixture.mjs;
-mutants.mjs runs four served-source mutants with assertion kills plus bus bypass.
-
-## First verification (sage-3917 CLEAR)
-
-Scratch logs: /mnt/storage/scratch/tmp/YU1G5B/.
-Syntax 12/12 exit 0; npm-ci.log exit 0; editor-build.log exit 0;
-thread-sharing.tap 7/7 exit 0. mutants.log and poe-208-mutants.json: four
-absence-test assertion kills (exit 1 each), four bus bypass proofs (exit 0 each),
-runner exit 0. Each mutant's individual log is poe-208-NAME-kill.tap or -bypass.tap.
-Full serialized webui.tap stopped on an existing-test red: 44 pass, 1 fail before
-termination; runner exit 1. Plugins not run. Slot returned to Sage via poe-0003.
-
-Existing failure: chat-browser.test.mjs:123, uncertain writes/read failure draft
-preservation, line 133 expects #chat-body after no-bus-host. The new current.thread
-is not retained before list reads succeed, unlike old current.threads. A transient
-read failure therefore hides the existing owner conversation. Proposed fix retains
-same-thread metadata across refresh, never stale user grant scopes. No old tests
-changed and no further execution pending Sage's ruling/CLEAR.
-
-## Approved correction (sage-3918)
-
-The old test is correct; this change broke its transient-failure draft contract.
-Retain current.thread and shared only when the old id equals the requested id.
-User chatGrants still start empty and are read fresh, so a stale hint is never
-carried forward. A real 403/404 clears thread/shared metadata plus cached history,
-drafts and operation forms. chat-browser.test.mjs remains byte-identical.
-Fix applied statically; Sage will CLEAR the four mutants, full webui and plugins
-suites after Bentina returns the slot. No node/npm/browser commands before then.
-
-Clarification during static review: retain the existing distinction between a
-thread-level refusal and a local bad-session selector (old row 272 B1 test).
-All 403/404 responses clear visible thread/shared metadata, as before; thread-level
-thread-not-owned/thread-not-found/access-refused also erase sibling cached history
-and drafts. A bad-session selector never erases valid sibling drafts/recovery keys.
-This preserves the existing invalidation contract rather than broadening the fix.
-
-sage-3920 CLEAR: first mutant rerun stopped on a new-test failure, not a valid
-mutant kill. /mnt/storage/scratch/tmp/8UlAhS/poe-208-composer-kill.tap shows null
-old.thread on initial /chat: old?.id and undefined route id compared equal.
-Fixed by requiring old to exist before either same-id metadata carry. This is a
-new defect in the approved correction, no old test change. Rerunning the plan.
-
-## Second slot outcome (sage-3920)
-
-Scratch /mnt/storage/scratch/tmp/8UlAhS/.
-Initial mutants.log exit 1 was the new null-previous-state defect above. Fixed;
-mutants-r2.log exit 0: all four assertion kills exit 1, all four bypass proofs
-exit 0 (individual logs overwritten by the successful rerun; summary JSON kept).
-Full serialized webui.tap stopped on old tests: 114 top-level pass, 5 fail,
-runner exit 1. The original draft-preservation failure and row 272 B1 both pass.
-The new old-test failure is environmental: decide-sso.test.mjs cannot import
-root dependency oauth4webapi (ERR_MODULE_NOT_FOUND); all five failures share it.
-packages/webui npm ci installs its editor tooling, not root runtime dependencies.
-No tests changed; plugins not run. Request root npm ci from pinned lockfile in
-next slot before rerunning webui and plugins. Slot returned via poe-0004.
-
-sage-3924 ruled the second red an environment gap, not a product defect. Approved
-root npm ci --ignore-scripts from the pinned lock, full webui then plugins,
-serialized. sage-3925 CLEAR starts that sequence. Push only after green; send
-base/tip and every changed path's SHA-256 to Sage and Gladstone.
-
-## Final builder verification (sage-3925 CLEAR)
-
-Root npm ci --ignore-scripts exit 0 from pinned lock.
-Full webui: exit 0, 418 pass, 0 fail, 0 skipped (271964 ms).
-Plugins: exit 0, 119 pass, 0 fail, 0 skipped (823 ms).
-Logs /mnt/storage/scratch/tmp/Et9xAa/{root-npm-ci.log,webui.tap,plugins.tap}.
-Slot returned immediately after plugins via poe-0005. All new acceptance cases
-are included in the full webui run. Four latest UI mutants and bus bypass proofs
-remain green at /mnt/storage/scratch/tmp/8UlAhS/mutants-r2.log and
-poe-208-mutants.json. No old tests changed. No bus authority/schema changes.
-
-Acceptance: owner and collaborator can share/unshare own writable threads;
-shared lists preserve the plain-list shape and show owner names safely as text;
-shared threads cannot compose, resume, mutate sessions or reshare. Viewer old
-own threads retain read history with no write controls. Mixed grants and live
-downgrades hide writes only where coverage requires; revoked shares clear the
-view. Direct browser POSTs bypass all UI checks and the real broker still
-refuses viewer create/send/open/share. Existing exact governance notice retained.
-Global scripts/test-*.sh gate and independent reviewer approval remain Sage's
-landing gate; this builder does not claim those or any live deployment.
@@ -1,28 +0,0 @@
-// Run only under Sage's CLEAR, with scratch TMPDIR and MOSAIC_REQUIRE_EDITOR_BUILD=1.
-// Mutants alter only the fixture-served copy of chat.js; repository source is untouched.
-import { spawnSync } from 'node:child_process';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-const file = 'packages/webui/tests/thread-sharing.test.mjs';
-const results = [];
-for (const mutant of ['composer', 'open', 'share', 'create']) {
-  for (const [stage, pattern, expected] of [
-    ['kill', '193d viewer UI has no', 1],
-    ['bypass', '193d bypassed UI checks', 0],
-  ]) {
-    const run = spawnSync(process.execPath, ['--test', '--test-concurrency=1', '--test-name-pattern=' + pattern, file], {
-      env: { ...process.env, POE_UI_MUTANT: mutant }, encoding: 'utf8', timeout: 90000,
-    });
-    const log = join(process.env.TMPDIR, `poe-208-${mutant}-${stage}.tap`);
-    writeFileSync(log, (run.stdout ?? '') + (run.stderr ?? ''));
-    const killedByAssertion = /ERR_ASSERTION/.test(run.stdout ?? '');
-    const passed = run.status === expected && (stage !== 'kill' || killedByAssertion);
-    results.push({ mutant, stage, exit: run.status, signal: run.signal, passed, log });
-    console.log(JSON.stringify(results.at(-1)));
-    if (!passed) {
-      writeFileSync(join(process.env.TMPDIR, 'poe-208-mutants.json'), JSON.stringify(results, null, 2));
-      process.exit(1);
-    }
-  }
-}
-writeFileSync(join(process.env.TMPDIR, 'poe-208-mutants.json'), JSON.stringify(results, null, 2));
@@ -0,0 +1,55 @@
+{
+  "version": 1,
+  "agents": [
+    {
+      "host": "api.anthropic.com",
+      "port": 443,
+      "path": "adapters/claude-code; adapters/pi (anthropic)",
+      "note": "Candidate from S6; real-token provider-host measurement by Mos pending. Claude nonessential traffic disabled."
+    },
+    {
+      "host": "api.z.ai",
+      "port": 443,
+      "path": "adapters/pi (zai)",
+      "note": "Candidate for the configured zai provider; unmeasured until Mos runs provider-hosts.sh. No authority to widen on failure."
+    },
+    {
+      "host": "api.openai.com",
+      "port": 443,
+      "path": "adapters/pi (openai)",
+      "note": "S6 dummy-key CONNECT measured; real-token provider-host measurement by Mos pending."
+    }
+  ],
+  "services": [
+    {
+      "host": "tasks.woltje.com",
+      "port": 443,
+      "path": "packages/tasks/src/vikunja.mjs:41",
+      "note": "fetch; requires NODE_USE_ENV_PROXY=1 and HTTPS_PROXY in container startup (I6)."
+    },
+    {
+      "host": "git.mosaicstack.dev",
+      "port": 443,
+      "path": "packages/bus/src/gitea-grant.mjs:115",
+      "note": "NOT PROXIED today: https.request agent:false with custom CA; transport ruling owned by Sage before broker container rollout."
+    },
+    {
+      "host": "git.mosaicstack.dev",
+      "port": 443,
+      "path": "packages/seat/src/working.mjs:471",
+      "note": "NOT VERIFIED through proxy: broker publishRemote spawns git with a scrubbed environment and credential on fd 3; core design excludes git. Sage transport ruling required."
+    },
+    {
+      "host": "discord.com",
+      "port": 443,
+      "path": "packages/cli/src/notifier-process.mjs:45 -> packages/discord/src/rest.mjs:45",
+      "note": "Notifier REST fetch only; requires NODE_USE_ENV_PROXY=1 and HTTPS_PROXY (I6)."
+    },
+    {
+      "host": "gateway.discord.gg",
+      "port": 443,
+      "path": "packages/discord/src/gateway.mjs:193",
+      "note": "NOT PROXIED today: native WebSocket in separate Discord connector, not notifier. Design names gateway; retained pending Sage transport ruling."
+    }
+  ]
+}
@@ -1620,5 +1620,11 @@ are never rewritten or removed; corrections are new entries.
 2026-10-24T00:41Z | Duckworth (Opus 5.5) | row 323 round 1 static review on 6a0f0f4f8 (sage-3865, sage-3870) | APPROVE (static) C1 Sage full gate cli, manifest 903ef022 matches, fields sourced, tests read shipped bytes, tester mutant real, N1-N2 doc (duckworth-0300) |
 2026-10-24T01:13Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row325 / #1821 Case1 project key | New goldie/row325 worktree at99930362e; pinned brief60d78e44e. Draft JSON key correction, new real-project-byte tests, sole old line70 key edit under mos-1564. Static checks only; requesting Sage CLEAR, no queue writes.
 2026-10-24T01:14Z | Goldie (a13dd6d5-5e73-4b7d-8318-02abeff24940) | Row325 / #1821 verified | sage-3882: new3/3, business264/264, one key mutant killed/restored, new3/3 again, per-run fresh shortTMP/load/helperCLEAR. Four manifest entries verify; sole old assertion key change, no queue writes. Candidate push/report to Sage and Gladstone next.
-2026-10-24 | Poe | Q246 / mos-1566, row 208 / 193d (#1706), poe/row208 | Started; approved design hash verified; implementation and isolated acceptance pending.
-2026-10-24 | Poe | Row 208 / 193d (#1706), poe/row208 | Builder acceptance green: webui 418/418, plugins 119/119, four UI mutants killed with bus bypass proofs; candidate prepared for Gladstone then Duckworth guard review.
+
+2026-10-24 | Bentina (d1ae468e-51ba-40c4-9513-b39ebbb40450) | Row157 I2 / #1652 pre-build recovery at ec86f2c84 | Blocked: canonical queue stale brief pin plus non-fetch broker outbound stop condition; sent Sage bentina-0001, recorded source drift in agents/bentina/work/queue-157/BUILD.md. No tests, Docker, credential reads, queue writes, commit or push.
+
+2026-10-24 | Bentina (d1ae468e-51ba-40c4-9513-b39ebbb40450) | Row157 / #1652 first CLEAR stop | sage-3910 tests31/31 helper/config,11/11 proxy. Own output regression stops old config run3 (55 pass/1 fail); run4 not run, no Docker. Slot returned Sage bentina-0004; source-only correction applied under sage-3916, no rerun until next CLEAR. Logs in agents/bentina/work/queue-157.
+
+2026-10-24 | Bentina (d1ae468e-51ba-40c4-9513-b39ebbb40450) | Row157 / #1652 candidate verified | sage-3919 config56/56/helper31/31; sage-3923 final proxy12/12 and install exit0 (rootless builds/pins, internal network, services fetch). Source-only transport gaps recorded under sage-3907. Slot returned bentina-0007; preparing own-branch candidate for Boyd then Darkwing, with Mos measurement/Sage full gate still pending. No protected branch/live-state/real-token action.
+
+2026-10-24 | Bentina (d1ae468e-51ba-40c4-9513-b39ebbb40450) | Row157 / #1652 round2 B1/B2 | sage-3933 scoped corrections; sage-3936 archived red proves7defect assertions/5controls, fixed12/12, helper/config33/33, egress22/22, rootless install exit0. No old assertion changes. Slot returned bentina-0014; preparing followup commit/push for Boyd then Darkwing, provider measurement/Sage gate still pending.
@@ -1365,3 +1365,42 @@ public sign-in smoke and a forged-loopback 401 check; rollback drops flags
 before middleware. Same-uid callers can still read the file; separate service
 uid is Jason's question on #385. The Authentik allowed-uid file remains an
 identity input and is never reused for proof.
+
+## Containerized image preparation (I2)
+
+`scripts/images.sh build|list` uses RELEASE tags mosaic-core, mosaic-session
+and mosaic-egress. It requires install.mode containerized and an explicit
+Unix endpoint in the selected config. Build prepares an isolated runtime
+source context and uses only the configured rootless daemon; list inspects
+the three exact tags. It does not start the stack. See images/README.md.
+
+`scripts/lib/docker.sh` is a sourceable Bash helper exposing
+`mosaic_docker <arguments...>`. It uses common.sh's load_config (which reads
+mosaic-config.mjs env), caches one successful rootless check in that Bash
+process, and adds --host to every Docker call. The first call checks the
+exit status of info before parsing .SecurityOptions as a JSON array for
+exactly name=rootless. Failure prints endpoint-not-rootless, exits the
+operation with status 2, and never forwards the requested command. Local
+mode prints containerized-install-required. No ambient context, DOCKER_HOST
+or caller-supplied mode/endpoint variable selects the target.
+
+The config loader accepts optional install with mode local/containerized.
+Absent defaults to local without adding a validation-output key; local forbids
+endpoint, containerized requires
+`^unix:///[^\s]+\.sock$`. Unknown keys, mode or bad type exit 2. validate
+checks shape only and never changes config. env adds MOSAIC_INSTALL_MODE
+and MOSAIC_DOCKER_ENDPOINT for the helper; no configVersion bump.
+
+`scripts/test-install.sh` runs the I2 config/helper/proxy cases, then builds
+and probes the images on MOSAIC_TEST_DOCKER_ENDPOINT (default explicitly
+unix:///run/user/1000/docker.sock). It creates only i2-prefixed containers
+and networks, cleans only those names, and refuses an unavailable or
+non-rootless endpoint. It neither installs nor starts a daemon. It uses
+scratch MOSAIC_CONFIG and dummy/no tokens. All test execution requires the
+assigned test slot. Run with fresh short scratch TMPDIR and timeout -k 10.
+
+Mos's real-provider measurement script and expected output are in
+agents/bentina/work/queue-157/provider-hosts.sh and PROVIDER-EXPECTED.md.
+The baked agents list is provisional until matching evidence appears on
+#1652. The services contract notes transport gaps; I2 starts no broker behind
+the proxy. Sage owns the ruling on those gaps before later install rows.
@@ -0,0 +1,34 @@
+# Containerized install images (I2)
+
+All images use the I1 base digest
+`node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20`
+(Node 24.21.0). A base or contract change requires a reviewed commit and
+new build. Tags are mosaic-core:RELEASE, mosaic-session:RELEASE and
+mosaic-egress:RELEASE, where RELEASE is the repository file's value.
+
+- core: packages, scripts, roles, contracts, production npm dependencies and
+  RELEASE, under /opt/mosaic. No git is installed. NODE_USE_ENV_PROXY=1
+  enables fetch proxy support; startup in I6 supplies HTTPS_PROXY.
+- session: core plus global Claude Code 2.1.296 (decision 91; harness README)
+  and pi at package.json's exact pin, currently 0.85.1. Claude nonessential
+  traffic is disabled. No host MOSAIC_CLAUDE_BIN is used.
+- egress: Node base, dependency-free packages/egress and baked egress contract.
+  Its required argument selects agents or services. No engine socket mount.
+
+`scripts/images.sh build` and `list` require a valid scratch/operator
+containerized config and rootless endpoint. Both use scripts/lib/docker.sh;
+local mode refuses before Docker. Build first verifies the endpoint, then
+copies only versioned runtime source plus I2's explicit new runtime paths
+into an ephemeral context. No .git, host credentials, agent work directories,
+or host node_modules enter the context. npm never receives a credential.
+
+These are image definitions, not a deployment: I4-I6 own mounting, hardening,
+networks, process entry points and actual stack launch. All run as container
+uid 0; the later launchers must set read-only rootfs, dropped caps, no new
+privileges, resource limits and their exact allowed mount lists.
+
+Verification is scripts/test-install.sh with a scratch config and explicit
+rootless endpoint. It builds images, checks pins, runs an internal-network
+CONNECT test, and exercises the Vikunja and notifier REST clients through
+the services proxy without a real credential. No broker is started behind
+that proxy by I2. The provider-host measurement is a separate Mos gate.
@@ -0,0 +1,12 @@
+FROM node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+WORKDIR /opt/mosaic
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund && npm cache clean --force
+COPY packages/ packages/
+COPY scripts/ scripts/
+COPY contracts/ contracts/
+COPY roles/ roles/
+COPY RELEASE ./
+ENV NODE_USE_ENV_PROXY=1
+USER 0
+CMD ["node", "packages/bus/src/process.mjs"]
@@ -0,0 +1,7 @@
+FROM node@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20
+WORKDIR /opt/mosaic
+COPY packages/egress/ packages/egress/
+COPY contracts/egress.json contracts/egress.json
+USER 0
+EXPOSE 3128
+ENTRYPOINT ["node", "packages/egress/src/cli.mjs"]
@@ -0,0 +1,9 @@
+ARG CORE_IMAGE
+FROM ${CORE_IMAGE}
+ARG PI_VERSION
+# Decision 91 and packages/harness/README.md pin Claude Code to this version.
+RUN npm install -g --no-audit --no-fund @anthropic-ai/[email protected] @earendil-works/pi-coding-agent@${PI_VERSION} \
+ && npm cache clean --force && rm -rf /root/.npm /tmp/*
+ENV CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+USER 0
+CMD ["node", "--version"]
@@ -0,0 +1,30 @@
+# Egress CONNECT proxy
+
+`node packages/egress/src/cli.mjs agents|services` reads the image-baked
+`contracts/egress.json`, binds port 3128, and refuses an unknown or empty
+list. It accepts CONNECT only, matching exact lower-case DNS host and port
+pairs, never a wildcard. A malformed request returns 400; an unlisted pair
+403; an incomplete header after 5 seconds 408; headers over 8192 bytes 431;
+an upstream connection failure 502. Connections have a 10-second establishment
+and 120-second idle bound. Fragmented headers and bytes following the header
+are preserved. TLS stays between the client and destination.
+
+Each decision writes exactly one JSON line:
+`{at,list,host,port,allowed}`. Malformed/slow requests have null host/port;
+allowed means the contract permitted the CONNECT, even if upstream later
+fails. Headers, tokens, URLs and tunneled data are never logged. I6's host
+appends these lines to the instance's append-only state/egress.jsonl.
+
+`node --test packages/egress/tests/*.test.mjs` uses loopback echo servers,
+no credential or external service. `scripts/test-install.sh` additionally
+runs an internal-network client and checks proxy log decisions. Every test
+run needs the assigned testing slot.
+
+The services entries describe current transport gaps in their own notes.
+Gitea's custom-CA https.request, DNS-pinned web requests, SSH operations and
+broker git publication have no measured env-proxy path. The separate Discord
+gateway uses WebSocket; the notifier only uses REST fetch. I2 changes none
+of those transports. Sage owns the ruling before broker container rollout.
+Provider hosts are candidates until Mos's measurement on #1652 matches
+agents/bentina/work/queue-157/PROVIDER-EXPECTED.md. No real token is used
+in the package or install tests.
@@ -0,0 +1 @@
+{"name":"@mosaic/egress","private":true,"type":"module","scripts":{"test":"node --test tests/*.test.mjs"}}
@@ -0,0 +1,13 @@
+import { readFileSync } from 'node:fs';
+import { createProxy } from './proxy.mjs';
+try {
+  if (process.argv.length !== 3) throw new Error('usage: cli.mjs agents|services');
+  const contract = JSON.parse(readFileSync(new URL('../../../contracts/egress.json', import.meta.url), 'utf8'));
+  const server = createProxy({ contract, list: process.argv[2] });
+  server.on('error', () => { process.stderr.write('egress-listen-failed\n'); process.exitCode = 1; });
+  server.listen(3128, '0.0.0.0');
+  for (const signal of ['SIGTERM', 'SIGINT']) process.once(signal, () => server.shutdown());
+} catch {
+  process.stderr.write('invalid-egress-contract-or-list\n');
+  process.exitCode = 2;
+}
@@ -0,0 +1,92 @@
+import net from 'node:net';
+
+const HOST = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
+// A contract entry always documents its consumer. Metadata never grants a wildcard.
+export function readList(contract, name) {
+  if (!contract || contract.version !== 1 || !['agents', 'services'].includes(name)
+      || !Array.isArray(contract[name]) || contract[name].length === 0) throw new Error('invalid-egress-contract');
+  const allowed = new Set();
+  for (const entry of contract[name]) {
+    if (!entry || typeof entry.host !== 'string' || !HOST.test(entry.host)
+        || entry.host.includes('..') || !Number.isInteger(entry.port) || entry.port < 1 || entry.port > 65535
+        || typeof entry.path !== 'string' || !entry.path || typeof entry.note !== 'string' || !entry.note) {
+      throw new Error('invalid-egress-contract');
+    }
+    allowed.add(`${entry.host}:${entry.port}`);
+  }
+  return allowed;
+}
+
+export function createProxy({ contract, list, log = line => process.stdout.write(line + '\n'),
+  headerTimeoutMs = 5000, connectTimeoutMs = 10000, idleTimeoutMs = 120000, maxHeaderBytes = 8192 } = {}) {
+  const allowed = readList(contract, list);
+  const sockets = new Set();
+  const server = net.createServer(client => {
+    sockets.add(client);
+    client.on('close', () => sockets.delete(client));
+    client.on('error', () => {});
+    let head = Buffer.alloc(0), decided = false;
+    const record = (host, port, permit) => {
+      if (decided) return;
+      decided = true;
+      log(JSON.stringify({ at: new Date().toISOString(), list, host, port, allowed: permit }));
+    };
+    // FIN alone leaves a half-open peer holding our read side. Flush the small
+    // response, then destroy both halves; a fixed drain bound covers a stuck write.
+    const endAndClose = response => {
+      const drain = setTimeout(() => client.destroy(), 1000);
+      client.once('close', () => clearTimeout(drain));
+      client.end(response, () => client.destroy());
+    };
+    const refuse = (code, label, host = null, port = null) => {
+      clearTimeout(timer);
+      client.removeListener('data', onData);
+      record(host, port, false);
+      endAndClose(`HTTP/1.1 ${code} ${label}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    };
+    const timer = setTimeout(() => refuse(408, 'Request Timeout'), headerTimeoutMs);
+    client.on('close', () => clearTimeout(timer));
+    function onData(chunk) {
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf('\r\n\r\n');
+      if ((end < 0 && head.length > maxHeaderBytes) || (end >= 0 && end + 4 > maxHeaderBytes)) return refuse(431, 'Request Header Fields Too Large');
+      if (end < 0) return;
+      const lines = head.subarray(0, end).toString('latin1').split('\r\n');
+      const match = /^CONNECT ([A-Za-z0-9.-]+):([1-9][0-9]{0,4}) HTTP\/1\.[01]$/.exec(lines.shift());
+      if (!match || lines.some(line => !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+:[\t\x20-\x7e]*$/.test(line))) return refuse(400, 'Bad Request');
+      const host = match[1].toLowerCase(), port = Number(match[2]);
+      if (!HOST.test(host) || host.includes('..') || port > 65535) return refuse(400, 'Bad Request');
+      if (!allowed.has(`${host}:${port}`)) return refuse(403, 'Forbidden', host, port);
+      clearTimeout(timer);
+      client.removeListener('data', onData);
+      client.pause();
+      record(host, port, true);
+      let established = false;
+      const upstream = net.connect({ host, port });
+      sockets.add(upstream);
+      upstream.on('close', () => { sockets.delete(upstream); if (!client.writableEnded) client.destroy(); });
+      client.on('close', () => upstream.destroy());
+      upstream.setTimeout(connectTimeoutMs, () => upstream.destroy(new Error('timeout')));
+      upstream.on('error', () => {
+        if (established) return client.destroy();
+        endAndClose('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+      });
+      upstream.once('connect', () => {
+        established = true;
+        upstream.setTimeout(idleTimeoutMs, () => upstream.destroy());
+        client.setTimeout(idleTimeoutMs, () => client.destroy());
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        const pending = head.subarray(end + 4);
+        head = null;
+        if (pending.length) upstream.write(pending);
+        upstream.pipe(client);
+        client.pipe(upstream);
+        client.resume();
+      });
+    }
+    client.on('data', onData);
+  });
+  // Callers close all tunnels explicitly on shutdown, including half headers.
+  server.shutdown = () => { for (const socket of sockets) socket.destroy(); return new Promise(resolve => server.close(resolve)); };
+  return server;
+}
@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import { once } from 'node:events';
+import { createProxy, readList } from '../src/proxy.mjs';
+const entry=(host,port)=>({host,port,path:'fixture',note:'dummy loopback echo; no external service'});
+async function fixture(t){
+ const echo=net.createServer(s=>{s.on('error',()=>{});s.pipe(s)});echo.listen(0,'127.0.0.1');await once(echo,'listening');
+ const port=echo.address().port,logs=[];
+ const proxy=createProxy({contract:{version:1,agents:[entry('127.0.0.1',port)]},list:'agents',log:s=>logs.push(JSON.parse(s)),headerTimeoutMs:80});
+ proxy.listen(0,'127.0.0.1');await once(proxy,'listening');
+ t.after(async()=>{await proxy.shutdown();await new Promise(r=>echo.close(r));});
+ function request(bytes,fragment=false){return new Promise((resolve,reject)=>{
+  const s=net.connect(proxy.address().port,'127.0.0.1');let out='';
+  s.on('error',reject);s.setTimeout(2000,()=>s.destroy(new Error('test timeout')));
+  s.on('data',c=>{out+=c.toString();if(out.includes('hello'))s.end();});s.on('close',()=>resolve(out));
+  s.on('connect',()=>{if(fragment){s.write(bytes.slice(0,8));setTimeout(()=>s.write(bytes.slice(8)),5);}else if(bytes)s.write(bytes);});
+ });}
+ return{port,logs,request};
+}
+test('allows exact host and port, fragmented headers, and preserves tunnel head',async t=>{
+ const f=await fixture(t);const r=await f.request(`CONNECT 127.0.0.1:${f.port} HTTP/1.1\r\nHost: fixture\r\n\r\nhello`,true);assert.match(r,/^HTTP\/1.1 200/);assert.ok(r.endsWith('hello'));
+ assert.equal(f.logs.length,1);assert.deepEqual(Object.keys(f.logs[0]),['at','list','host','port','allowed']);assert.equal(f.logs[0].allowed,true);assert.equal(f.logs[0].port,f.port);assert.equal(f.logs[0].host,'127.0.0.1');assert.equal(f.logs[0].list,'agents');assert.ok(Number.isFinite(Date.parse(f.logs[0].at)));
+});
+for(const [name,line,code] of [['unlisted host','CONNECT example.invalid:443 HTTP/1.1',403],['unlisted port','CONNECT 127.0.0.1:1 HTTP/1.1',403],['GET','GET / HTTP/1.1',400],['invalid port','CONNECT example.com:99999 HTTP/1.1',400],['userinfo','CONNECT [email protected]:443 HTTP/1.1',400],['bad header','CONNECT example.com:443 HTTP/1.1\r\nbad',400]])test(name,async t=>{
+ const f=await fixture(t);assert.match(await f.request(line+'\r\n\r\n'),new RegExp('^HTTP/1.1 '+code));assert.equal(f.logs.length,1);assert.equal(f.logs[0].allowed,false);
+});
+test('slow client has a total header deadline',async t=>{const f=await fixture(t);assert.match(await f.request('CON'),/^HTTP\/1.1 408/);assert.equal(f.logs.length,1);assert.equal(f.logs[0].host,null);});
+test('oversized header refuses',async t=>{const f=await fixture(t);assert.match(await f.request('X'.repeat(9000)),/^HTTP\/1.1 431/);});
+test('missing, invalid and unknown lists fail closed',()=>{
+ for(const args of [[{},'agents'],[{version:1,agents:[]},'agents'],[{version:1,agents:[entry('*.example.com',443)]},'agents'],[{version:1,agents:[entry('example.com',443)]},'other']])assert.throws(()=>readList(...args),/invalid-egress-contract/);
+});
+
+test('refused upstream returns 502 while retaining one allowed decision',async t=>{
+ const closed=net.createServer();closed.listen(0,'127.0.0.1');await once(closed,'listening');const port=closed.address().port;await new Promise(r=>closed.close(r));
+ const logs=[],proxy=createProxy({contract:{version:1,agents:[entry('127.0.0.1',port)]},list:'agents',log:s=>logs.push(JSON.parse(s))});
+ proxy.listen(0,'127.0.0.1');await once(proxy,'listening');t.after(()=>proxy.shutdown());
+ const output=await new Promise((resolve,reject)=>{const s=net.connect(proxy.address().port,'127.0.0.1');let result='';s.on('error',reject);s.setTimeout(2000,()=>s.destroy(new Error('timeout')));s.on('connect',()=>s.write(`CONNECT 127.0.0.1:${port} HTTP/1.1\r\n\r\n`));s.on('data',b=>result+=b);s.on('close',()=>resolve(result));});
+ assert.match(output,/^HTTP\/1.1 502/);assert.equal(logs.length,1);assert.equal(logs[0].allowed,true);
+});
+
+test('upstream reset after CONNECT closes the tunnel without a second HTTP response',async t=>{
+ const upstream=net.createServer(s=>{s.on('error',()=>{});s.write('payload');setTimeout(()=>s.resetAndDestroy(),20);});
+ upstream.listen(0,'127.0.0.1');await once(upstream,'listening');const port=upstream.address().port;
+ const proxy=createProxy({contract:{version:1,agents:[entry('127.0.0.1',port)]},list:'agents',log:()=>{}});
+ proxy.listen(0,'127.0.0.1');await once(proxy,'listening');t.after(async()=>{await proxy.shutdown();await new Promise(r=>upstream.close(r));});
+ const output=await new Promise((resolve,reject)=>{const s=net.connect(proxy.address().port,'127.0.0.1');let result='';s.on('error',reject);s.setTimeout(2000,()=>s.destroy(new Error('timeout')));s.on('connect',()=>s.write(`CONNECT 127.0.0.1:${port} HTTP/1.1\r\n\r\n`));s.on('data',b=>result+=b);s.on('close',()=>resolve(result));});
+ assert.match(output,/^HTTP\/1.1 200/);assert.ok(output.endsWith('payload'));assert.equal(output.split('HTTP/1.1').length,2);
+});
@@ -0,0 +1,32 @@
+// Boyd B1: response receipt is insufficient; the server must release the socket.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import { once } from 'node:events';
+import { setTimeout as delay } from 'node:timers/promises';
+import { createProxy } from '../src/proxy.mjs';
+
+const count = server => new Promise((resolve,reject) => server.getConnections((error,n) => error ? reject(error) : resolve(n)));
+const cases = [[408,'CON'],[400,'GET / HTTP/1.1\r\n\r\n'],[403,'CONNECT denied.invalid:443 HTTP/1.1\r\n\r\n'],[431,'X'.repeat(9000)],[502,null]];
+for (const [code,request] of cases) for (const allowHalfOpen of [false,true]) test(`refusal ${code} releases server socket (allowHalfOpen=${allowHalfOpen})`,async t => {
+  const logs=[];
+  let host='example.invalid',port=443;
+  if(code===502){
+    const closed=net.createServer();closed.listen(0,'127.0.0.1');await once(closed,'listening');
+    host='127.0.0.1';port=closed.address().port;await new Promise(resolve=>closed.close(resolve));
+  }
+  const proxy=createProxy({contract:{version:1,agents:[{host,port,path:'fixture',note:'loopback refusal test'}]},list:'agents',log:line=>logs.push(JSON.parse(line)),headerTimeoutMs:40});
+  proxy.listen(0,'127.0.0.1');await once(proxy,'listening');
+  const client=net.connect({host:'127.0.0.1',port:proxy.address().port,allowHalfOpen});
+  t.after(async()=>{client.destroy();await proxy.shutdown();});
+  let output='';client.on('data',chunk=>output+=chunk.toString());
+  client.setTimeout(2000,()=>client.destroy(new Error('test timeout')));
+  const ended=once(client,'end');
+  await once(client,'connect');client.write(request??`CONNECT ${host}:${port} HTTP/1.1\r\n\r\n`);await ended;
+  assert.match(output,new RegExp('^HTTP/1.1 '+code));
+  const deadline=Date.now()+500;
+  let remaining=await count(proxy);
+  while(remaining && Date.now()<deadline){await delay(10);remaining=await count(proxy);}
+  assert.equal(remaining,0,'refused peer must not retain a server socket');
+  assert.equal(logs.length,1);assert.equal(logs[0].allowed,code===502);
+});
@@ -9,9 +9,6 @@ const VERBS = new Set([
  "thread.messages",
  "thread.send",
  "thread.open",
-  "thread.shares",
-  "thread.share",
-  "thread.unshare",
  "session.list",
  "session.create",
  "session.clear",
@@ -1091,16 +1091,3 @@ During Q175's read-only interim both buttons show as unavailable and point to
 `mosaic halt` / `mosaic resume` in the instance CLI. There is no halt-only send
 exception or alternate authentication path. Landing the UI and activating it
 remain separately gated.
-
-Row 208 (193d): Chat includes a **Shared with me** list. Shared threads are
-read-only, including for the business owner. On your own writable threads,
-**Share read-only** accepts `user:ID`, the business owner's name, or `*` for
-everyone with coverage; **Unshare** ends that target's share. A share grants
-no project or instance access of its own.
-
-Viewers can read shared threads and their old own threads. Their pages omit
-creation, composer, resume, share and session mutation controls. Mixed grants
-apply separately to each project and instance; a collaborator grant elsewhere
-does not enable writes here. Grant hints refresh on each user chat render and
-background refresh, while the bus decides every operation from live grants.
-The existing user notice names the governance records visible to the owner.
@@ -18,16 +18,6 @@ export function consoleAccess({ load, business }) {
    } catch { return null; }
  };
  return Object.freeze({
-    // UI hints only: no grants belonging to another user, receipts or subjects escape.
-    chatGrants: session => {
-      try {
-        if (lookup(session.provider, session.sub) !== session.user) return [];
-        const doc = load(), b = business();
-        return doc.grants.filter(g => g.user === session.user && g.business === b &&
-          covers(g, { business: b, project: g.projects[0], instance: g.instances[0] }, new Date(), { level: 'collaborator' }))
-          .map(g => ({ projects: [...g.projects], instances: [...g.instances] }));
-      } catch { return []; }
-    },
    // The user id this (provider, sub) signs in as, or null.
    find: ({ provider, sub }) => lookup(provider, sub),
    // Is this session's user still the holder of its own subject, with a live grant?
@@ -22,7 +22,6 @@ const STATUS = {
  'unknown-verb': 503, 'channel-operation': 503,
  'tester-off': 403, 'tester-required': 403, 'tester-refused': 403,
  // FED R6 (#1800): the broker's refusals of a granted user.
-  'share-not-covered': 403, 'share-exists': 409, 'share-not-found': 404,
  'access-refused': 403, 'access-revoked': 401,
 };
 function safeMessage(code) {
@@ -73,7 +72,7 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
    if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(403, 'cross-site');
  }
  try {
-    const match = /^\/api\/chat\/threads\/([^/]+)\/(messages|open|sessions|clear|cancel|operation|shares|share|unshare)$/.exec(path);
+    const match = /^\/api\/chat\/threads\/([^/]+)\/(messages|open|sessions|clear|cancel|operation)$/.exec(path);
    if (match) {
      thread = match[1];
      if (!id(thread)) throw Error();
@@ -90,9 +89,6 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
        if (!exact(v, ['project', 'name', 'instance'], ['project', 'name']) || !id(v.project) || !name(v.name) ||
            (Object.hasOwn(v, 'instance') && (typeof v.instance !== 'string' || !KEY.test(v.instance)))) throw Error();
        action = 'createThread'; args = v;
-      } else if (['share', 'unshare'].includes(match?.[2])) {
-        if (!exact(v, ['to']) || typeof v.to !== 'string' || !v.to.length || v.to.length > 200 || /[\r\n\0]/.test(v.to)) throw Error();
-        action = match[2]; args = { thread, to: v.to };
      } else if (match?.[2] === 'sessions') {
        if (!exact(v, ['name', 'op']) || !name(v.name) || !KEY.test(v.op ?? '')) throw Error();
        action = 'createSession'; args = { thread, name: v.name, op: v.op };
@@ -113,12 +109,9 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
    } else if (path === '/api/chat/projects') {
      query(search, []); action = 'projects'; args = {};
    } else if (path === '/api/chat/threads') {
-      const q = query(search, ['project', 'shared']);
-      if (q.has('shared') && q.get('shared') !== 'true') throw Error();
+      const q = query(search, ['project']);
      if (q.has('project') && !id(q.get('project'))) throw Error();
-      action = 'threads'; args = { ...(q.has('project') ? { project: q.get('project') } : {}), ...(q.has('shared') ? { shared: true } : {}) };
-    } else if (match?.[2] === 'shares') {
-      query(search, []); action = 'shares'; args = { thread };
+      action = 'threads'; args = q.has('project') ? { project: q.get('project') } : {};
    } else if (match?.[2] === 'sessions') {
      query(search, []); action = 'sessions'; args = { thread };
    } else if (match?.[2] === 'operation') {
@@ -162,13 +155,6 @@ export async function chatHTTP(req, res, { path, search, chat, named, send, prev
      } : {};
      return json(res, 200, { rows: value, ...page, at: new Date().toISOString() });
    }
-    if (action === 'share' || action === 'unshare') {
-      if (value?.thread !== thread || value?.to !== args.to || value?.op !== action) {
-        line('error=outcome-unknown'); return refuse(503, 'outcome-unknown', 'unknown');
-      }
-      line(`thread=${thread} op=${action}`);
-      return json(res, 200, { thread, to: value.to, op: value.op });
-    }
    if (!value || (action === 'open' ? value.opened !== thread : !id(value.id)) ||
        (action === 'createThread' && (typeof value.instance !== 'string' || !KEY.test(value.instance)))) {
      line('error=outcome-unknown');
@@ -24,10 +24,7 @@ export function createChat({ call, owner = null }) {
  return Object.freeze({
    projects: () => channel('project.list', {}),
    createProject: ({ name, repo }) => channel('project.create', { name, ...(repo === undefined ? {} : { repo }) }),
-    threads: ({ project, shared } = {}) => channel('thread.list', { ...(project === undefined ? {} : { project }), ...(shared === true ? { shared: true } : {}) }),
-    shares: ({ thread }) => channel('thread.shares', { thread }),
-    share: ({ thread, to }) => channel('thread.share', { thread, to }),
-    unshare: ({ thread, to }) => channel('thread.unshare', { thread, to }),
+    threads: ({ project } = {}) => channel('thread.list', project === undefined ? {} : { project }),
    createThread: ({ project, name, instance }) => channel('thread.create', { project, name, ...(instance === undefined ? {} : { instance }) }),
    sessions: ({ thread }) => channel('session.list', { thread }),
    createSession: ({ thread, name, op }) => channel('session.create', { thread, name, op }),
@@ -1232,7 +1232,7 @@
    window.MosaicChat?.leave(path);
    if (path === '/chat' || path.startsWith('/chat/')) {
      // Row 177 (#1675): the tester Console writes to its own threads.
-      await window.MosaicChat.render({ path, container: $('bus-view'), canSend: canSend || isTester, tester: isTester, navigated });
+      await window.MosaicChat.render({ path, container: $('bus-view'), canSend: canSend || isTester, navigated });
      if (g !== gen || out()) return;
      shown = route; schedule(); return;
    }
@@ -57,35 +57,23 @@
  const disabledSession = pending => disabled(pending || selectedInactive());
  const disabled = pending => !current.canSend || out() || pending ? ' disabled' : '';
  const stamp = at => `<time>${txt(at)}</time>`;
-  // Per-grant UI hints; all writes still use the caller's bus principal.
-  const scopeWrites = (project, instance) => !current.user || current.chatGrants.some(g =>
-    (g.projects.includes('*') || g.projects.includes(project)) &&
-    (instance === undefined || g.instances.includes('*') || g.instances.includes(instance)));
-  const threadWrites = () => !!current.thread && !current.shared && scopeWrites(current.thread?.project, current.thread?.instance);
-  function sharing(t) {
-    if (!current.canSend || !threadWrites() || current.tester) return '';
-    const f = form('share:' + t.id);
-    return `<section aria-label="Thread sharing"><h2>Share read-only</h2><p>Share with a user (user:id), the business owner's name, or * for everyone granted on this thread.</p><ul>${(current.shares ?? []).map(r => `<li>${txt(r.to)} <button class="btn" type="button" data-unshare="${esc(r.to)}"${disabled(f.pending)}>Unshare</button></li>`).join('')}</ul><form id="chat-share-form"><label>Share with<input id="chat-share-target" value="${esc(f.to ?? '')}" maxlength="200" required></label><button class="btn" type="submit"${disabled(f.pending)}>Share read-only</button></form><p role="status">${txt(f.receipt)}</p></section>`;
-  }
  function creation(kind, key) {
    const f = form(key), project = kind === 'project';
-    if (current.user && (project || !scopeWrites(key))) return '';
    const repo = project && current.repos.length ? `<label>Repository (optional)<select id="chat-repo" data-chat-field="repo"><option value="">No repository link</option>${current.repos.map(r => `<option value="${esc(r)}"${r === f.repo ? ' selected' : ''}>${txt(r)}</option>`).join('')}</select></label>` : '';
-    const choices = (current.instances ?? []).filter(r => scopeWrites(key, r.instance));
+    const choices = current.instances ?? [];
    const picker = project ? '' : `<label>Thread with<select id="chat-instance" data-chat-field="instance" required${disabled(f.pending || !!current.instanceError || !choices.length)}><option value="">Choose who this thread is with</option>${choices.map(row => `<option value="${esc(row.instance)}"${row.instance === f.instance ? ' selected' : ''}>${txt(row.name === row.instance ? row.instance : `${row.name} (${row.instance})`)}</option>`).join('')}</select></label>`;
    const unavailable = !project && (!!current.instanceError || !choices.some(row => row.instance === f.instance));
    const status = !project && current.instanceError ? current.instanceError : f.receipt || (!project && !choices.length ? 'No thread instances are configured.' : '');
    return `<form id="chat-${kind}-form" class="chat-create" data-key="${esc(key)}"><h2>New ${kind}</h2><label>Name<input id="chat-${kind}-name" data-chat-field="name" value="${esc(f.name)}" maxlength="200" required${disabled(f.pending)}></label>${repo}${picker}<button class="btn" type="submit"${disabled(f.pending || unavailable)}>${f.pending ? 'Creating…' : `Create ${kind}`}</button><p role="status">${txt(status)}</p></form>`;
  }
  function threads(rows) {
-    return rows.length ? `<ul class="chat-thread-list">${rows.map(t => `<li>${link('threads', t.id, t.name)} <span class="muted">${txt(t.instance)}${t.shared ? ` · Shared by ${txt(t.owner)}` : ''}</span></li>`).join('')}</ul>` : '<p>No threads yet.</p>';
+    return rows.length ? `<ul class="chat-thread-list">${rows.map(t => `<li>${link('threads', t.id, t.name)} <span class="muted">${txt(t.instance)}</span></li>`).join('')}</ul>` : '<p>No threads yet.</p>';
  }
  const sessionPath = (thread, session) => `#/chat/threads/${thread}/sessions/${session}`;
  const countLabel = value => !value ? 'unavailable (count collector not installed)' :
    value.known === true && Number.isSafeInteger(value.count) && value.count >= 0 ? String(value.count) :
      `unknown (${value.reason ?? 'not-collected'})`;
  function sessionControls(t) {
-    if (!threadWrites()) return '<p>Read-only thread.</p>';
    if (current.legacyDefault) return '<p role="status">Sessions are not available for this account.</p>';
    const c = current, selected = c.sessions.find(r => r.id === c.session), f = form('session:' + t.id);
    const clear = form('clear:' + c.key);
@@ -96,7 +84,7 @@
    const s = state(current.key);
    const messages = s.rows.map(m => `<li data-message="${esc(m.id)}"><div class="chat-message-meta"><strong>${txt(m.from_role)}</strong> ${stamp(m.at)}</div><div class="chat-body">${txt(m.body)}</div></li>`).join('');
    const receipt = s.receipt;
-    return `<section class="chat-conversation" data-thread="${esc(t.id)}" data-session="${esc(current.session)}"><p>${link('projects', t.project, current.projects.find(p => p.id === t.project)?.name ?? 'Project')} / ${txt(t.instance)}</p>${heading(t.name)}${sessionControls(t)}${sharing(t)}<p class="muted">Reading never wakes the assistant. An accepted message is not an answer.</p>${threadWrites() ? `<button class="btn" type="button" id="chat-resume"${disabledSession(s.pending)}>Resume assistant</button>` : ''}<ol class="chat-log" tabindex="0" aria-label="Thread conversation">${messages || '<li class="muted">No messages yet.</li>'}</ol><div class="chat-paging">${s.more ? '<p>Showing earlier history. Read forward to reach the current conversation.</p><button class="btn" type="button" id="chat-next">Read next messages</button>' : '<p class="muted">Caught up to the last read.</p>'}<button class="btn" type="button" id="chat-new"${s.follow ? ' hidden' : ''}>New messages — go to end</button></div>${threadWrites() ? `<form id="chat-send-form"><label for="chat-body">Message this thread</label><textarea id="chat-body" rows="4"${disabledSession(s.pending)}>${esc(s.draft)}</textarea><button class="btn primary" type="submit"${disabledSession(s.pending)}>Send</button></form>` : ''}<p id="chat-receipt" role="status">${txt(receipt)}</p></section>`;
+    return `<section class="chat-conversation" data-thread="${esc(t.id)}" data-session="${esc(current.session)}"><p>${link('projects', t.project, current.projects.find(p => p.id === t.project)?.name ?? 'Project')} / ${txt(t.instance)}</p>${heading(t.name)}${sessionControls(t)}<p class="muted">Reading never wakes the assistant. An accepted message is not an answer.</p><button class="btn" type="button" id="chat-resume"${disabledSession(s.pending)}>Resume assistant</button><ol class="chat-log" tabindex="0" aria-label="Thread conversation">${messages || '<li class="muted">No messages yet.</li>'}</ol><div class="chat-paging">${s.more ? '<p>Showing earlier history. Read forward to reach the current conversation.</p><button class="btn" type="button" id="chat-next">Read next messages</button>' : '<p class="muted">Caught up to the last read.</p>'}<button class="btn" type="button" id="chat-new"${s.follow ? ' hidden' : ''}>New messages — go to end</button></div><form id="chat-send-form"><label for="chat-body">Message this thread</label><textarea id="chat-body" rows="4"${disabledSession(s.pending)}>${esc(s.draft)}</textarea><button class="btn primary" type="submit"${disabledSession(s.pending)}>Send</button></form><p id="chat-receipt" role="status">${txt(receipt)}</p></section>`;
  }
  function capture() {
    if (!current) return null;
@@ -110,16 +98,16 @@
    let html = '<div class="chat-area"><p><a href="#/chat">Chat projects</a></p>';
    if (c.error) html += `<p class="chat-error banner err" role="alert">${txt(c.error)}</p>`;
    if (c.kind === 'thread') {
-      const t = c.thread;
+      const t = c.threads.find(t => t.id === c.id);
      if (t && (c.session || c.legacyDefault) && !c.refused) html += conversation(t);
      else html += heading('Thread unavailable');
    } else if (c.kind === 'project') {
      const p = c.projects.find(p => p.id === c.id);
      html += heading(p?.name ?? 'Project unavailable');
-      if (p && !c.refused) html += threads(c.threads.filter(t => !t.shared)) + '<h2>Shared with me</h2>' + threads(c.threads.filter(t => t.shared)) + creation('thread', c.id);
+      if (p && !c.refused) html += threads(c.threads) + creation('thread', c.id);
    } else {
      html += heading('Chat') + '<p>Business projects and your named assistant threads.</p><div class="chat-projects">' +
-        c.projects.map(p => `<section class="panel"><h2>${link('projects', p.id, p.name)}</h2>${p.repo ? `<p class="muted">Repository: ${txt(p.repo)}</p>` : ''}${threads(c.threads.filter(t => t.project === p.id && !t.shared))}</section>`).join('') + (c.projects.length ? '' : '<p>No projects yet.</p>') + '</div><h2>Shared with me</h2>' + threads(c.threads.filter(t => t.shared)) + creation('project', 'projects');
+        c.projects.map(p => `<section class="panel"><h2>${link('projects', p.id, p.name)}</h2>${p.repo ? `<p class="muted">Repository: ${txt(p.repo)}</p>` : ''}${threads(c.threads.filter(t => t.project === p.id))}</section>`).join('') + (c.projects.length ? '' : '<p>No projects yet.</p>') + '</div>' + creation('project', 'projects');
    }
    if (!c.canSend) html += '<p class="muted">Creating and sending require signed-in send mode. This Console only reads.</p>';
    c.container.innerHTML = html + '</div>';
@@ -144,7 +132,7 @@
      err.code === 'thread-not-found' ? 'Thread not found.' :
      err.code === 'session-not-found' ? 'Session not found in this thread.' : 'Chat could not be read. Refresh to try again; your draft is kept.';
  }
-  async function render({ path, container, canSend, user = false, tester = false, navigated = false, next = false }) {
+  async function render({ path, container, canSend, navigated = false, next = false }) {
    if (out()) return;
    const match = /^\/chat(?:\/(projects|threads)\/([0-9a-f-]+)(?:\/sessions\/([0-9a-f-]+))?)?$/.exec(path);
    controller?.abort(); controller = new AbortController();
@@ -156,46 +144,23 @@
      paint(); return;
    }
    const old = current;
-    current = { container, kind, id, canSend, user, tester, chatGrants: [], thread: old && old.id === id ? old.thread : null, shared: old && old.id === id ? old.shared : false, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], instances: old?.instances ?? [], instanceError: kind === 'project' ? 'Reading thread instances…' : '', error: '', refused: false, legacyDefault: false, sessions: old && old.id === id ? old.sessions ?? [] : [], session: match[3] ?? (old && old.id === id ? old.session : null), key: match[3] ? id + '/' + match[3] : old && old.id === id ? old.key : id };
+    current = { container, kind, id, canSend, projects: old?.projects ?? [], threads: old?.threads ?? [], repos: old?.repos ?? [], instances: old?.instances ?? [], instanceError: kind === 'project' ? 'Reading thread instances…' : '', error: '', refused: false, legacyDefault: false, sessions: old && old.id === id ? old.sessions ?? [] : [], session: match[3] ?? (old && old.id === id ? old.session : null), key: match[3] ? id + '/' + match[3] : old && old.id === id ? old.key : id };
    if (navigated || !old) container.innerHTML = '<p class="chat-loading" role="status">Reading chat…</p>';
    try {
-      if (user) {
-        const config = await fetch('/api/config', { cache: 'no-store', redirect: 'manual', signal });
-        if (config.type === 'opaqueredirect' || config.status === 401) { signOut(); return; }
-        if (!config.ok) throw new ChatError('invalid-response');
-        const hints = await config.json();
-        if (g !== generation || out()) return;
-        current.chatGrants = Array.isArray(hints.chatGrants) ? hints.chatGrants : [];
-        current.canSend = hints.send === true;
-      }
      // Resolve the explicit session before touching history/cursors. Missing selectors never
      // silently fall back to a sibling. The saved default is used only for thread-only routes.
-      const [projects, listed, shared] = await Promise.all([
+      const [projects, listed, catalog] = await Promise.all([
        request('projects', undefined, signal),
        request('threads' + (kind === 'project' ? '?project=' + id : ''), undefined, signal),
-        tester ? { rows: [] } : request('threads?shared=true' + (kind === 'project' ? '&project=' + id : ''), undefined, signal).catch(err => {
-          if (['signed-out', 'access-revoked'].includes(err.code)) throw err;
-          return { rows: [] };
-        }),
+        kind === 'thread' ? request(`threads/${id}/sessions`, undefined, signal).catch(err => {
+          // A denied optional catalog does not revoke an existing default-thread grant.
+          // Explicit selectors and every other failure keep their refusal/error state.
+          if (err.code === 'access-refused' && !match[3]) return null;
+          throw err;
+        }) : null,
      ]);
      if (g !== generation || out()) return;
-      current.projects = projects.rows;
-      const own = new Set(listed.rows.map(t => t.id));
-      current.threads = [...listed.rows, ...shared.rows.filter(t => !own.has(t.id)).map(t => ({ ...t, shared: true }))];
-      current.thread = current.threads.find(t => t.id === id);
-      current.shared = current.thread?.shared === true;
-      const catalog = kind === 'thread' && !current.shared ? await request(`threads/${id}/sessions`, undefined, signal).catch(err => {
-        if (err.code === 'access-refused' && !match[3]) return null;
-        throw err;
-      }) : null;
-      if (g !== generation || out()) return;
-      if (current.shared && match[3]) throw new ChatError('session-not-found', 404);
-      current.shares = [];
-      if (kind === 'thread' && current.canSend && threadWrites() && !tester) {
-        const shares = await request(`threads/${id}/shares`, undefined, signal).catch(() => ({ rows: [] }));
-        if (g !== generation || out()) return;
-        current.shares = shares.rows;
-      }
+      current.projects = projects.rows; current.threads = listed.rows;
      let s = null, page = null, after = null;
      if (kind === 'thread' && catalog === null) {
        current.legacyDefault = true; current.sessions = []; current.session = null;
@@ -243,13 +208,13 @@
          if (g !== generation || out()) return;
          if (!listed.rows.every(row => typeof row?.instance === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(row.instance) && typeof row.name === 'string'))
            throw new ChatError('invalid-response');
-          current.instances = listed.rows.filter(r => scopeWrites(id, r.instance)); current.instanceError = '';
+          current.instances = listed.rows; current.instanceError = '';
          const f = form(id);
-          if (f.instance && !current.instances.some(row => row.instance === f.instance)) {
+          if (f.instance && !listed.rows.some(row => row.instance === f.instance)) {
            f.instance = ''; f.instanceChosen = true;
            f.receipt = 'The selected instance is no longer available. Choose who this thread is with.';
          }
-          if (!f.instanceChosen && !f.instance && current.instances.length === 1) f.instance = current.instances[0].instance;
+          if (!f.instanceChosen && !f.instance && listed.rows.length === 1) f.instance = listed.rows[0].instance;
        } catch (err) {
          if (err.name === 'AbortError' || out() || g !== generation) return;
          current.instances = [];
@@ -279,7 +244,7 @@
        for (const key of forms.keys()) if (key.includes(id)) forms.delete(key);
      }
      if (err.status === 403 || err.status === 404) {
-        current.projects = []; current.threads = []; current.thread = null; current.shared = false; current.refused = true;
+        current.projects = []; current.threads = []; current.refused = true;
      }
      paint(navigated);
    }
@@ -293,7 +258,6 @@
  document.addEventListener('input', event => {
    if (!current || out()) return;
    if (event.target.id === 'chat-operation') { const f = form('clear:' + current.key); if (f.pending) return; f.op = event.target.value; f.record = null; const button = document.getElementById('chat-cancel'); if (button) button.disabled = !current.canSend || f.pending || !f.op; }
-    if (event.target.id === 'chat-share-target') form('share:' + current.id).to = event.target.value;
    if (event.target.id === 'chat-body') state(current.key ?? current.id).draft = event.target.value;
    const f = event.target.closest('.chat-create');
    if (f && event.target.dataset.chatField) {
@@ -311,8 +275,6 @@
  async function write(action, key, value, path) {
    if (!current || !current.canSend || out()) return;
    const isThread = action === 'send' || action === 'open';
-    if ((isThread || action === 'createSession') && !threadWrites()) return;
-    if (action === 'createProject' && current.user || action === 'createThread' && !scopeWrites(value.project, value.instance)) return;
    const targetThread = current.id;
    const s = isThread ? state(key) : form(key);
    if (s.pending || isThread && selectedInactive()) return;
@@ -352,9 +314,7 @@
  document.addEventListener('submit', event => {
    if (!current || !event.target.id.startsWith('chat-')) return;
    event.preventDefault();
-    if (event.target.id === 'chat-share-form') {
-      void changeShare('share', form('share:' + current.id).to ?? '');
-    } else if (event.target.id === 'chat-send-form') {
+    if (event.target.id === 'chat-send-form') {
      const id = current.id, session = current.session, key = current.key;
      void write('send', key, { body: state(key).draft, ...(session ? { session } : {}) }, `threads/${id}/messages`);
    } else if (event.target.id === 'chat-session-form') {
@@ -376,7 +336,6 @@
  });
  document.addEventListener('click', event => {
    if (!current || out()) return;
-    if (event.target.dataset.unshare) void changeShare('unshare', event.target.dataset.unshare);
    if (event.target.id === 'chat-resume') void write('open', current.key, current.session ? { session: current.session } : {}, `threads/${current.id}/open`);
    if (event.target.id === 'chat-cancel') void cancelClear();
    if (event.target.id === 'chat-clear') void clearContext();
@@ -388,23 +347,6 @@
      location.hash = sessionPath(current.id, event.target.value);
    }
  });
-  async function changeShare(op, to) {
-    if (!current?.canSend || !threadWrites() || current.tester || out()) return;
-    const id = current.id, f = form('share:' + id);
-    if (f.pending || !to.trim()) return;
-    f.pending = true; f.receipt = ''; paint();
-    try {
-      const r = await request(`threads/${id}/${op}`, { to });
-      if (r.thread !== id || r.to !== to || r.op !== op) throw new ChatError('outcome-unknown');
-      f.receipt = op === 'share' ? 'Shared read-only.' : 'Share ended.';
-      if (op === 'share') f.to = '';
-    } catch (e) {
-      f.receipt = e.sent === false ? `Share refused (${inert(e.code)}).` : 'Outcome unknown. Read shares before trying again; nothing was retried.';
-    } finally {
-      f.pending = false;
-      if (!out() && current?.id === id) { await refresh(); paint(); }
-    }
-  }
  const clearText = r => r.state === 'cancelled' ? `Operation ${r.op}: ${r.retired === true ? 'startup cancelled; old session remains retired' : 'replacement cancelled; old session active'}. Cancelled inputs are not replayed.` : `Operation ${r.op}: ${r.state}; successor ${r.successor}; start ${r.start ?? 'pending'}${r.refusal ? '; ' + r.refusal : ''}. No stop is forced.`;
  async function checkClear(thread, key, f) {
    if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(f.op ?? '')) { f.receipt = 'Enter a valid operation key.'; paint(); return; }
@@ -419,7 +361,7 @@
  }
  async function cancelClear() {
    const c = current, key = c.key, f = form('clear:' + key);
-    if (!c.canSend || !threadWrites() || out() || f.pending || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(f.op ?? '')) return;
+    if (!c.canSend || out() || f.pending || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,159}$/.test(f.op ?? '')) return;
    if (!window.confirm(`Cancel clear operation ${f.op}? Before retirement this restores the old session to active. After retirement it only cancels successor startup. Cancelled messages are never replayed, and nothing is un-retired.`)) return;
    const op = f.op;
    f.pending = true; paint();
@@ -437,7 +379,7 @@
  }
  async function clearContext() {
    const c = current, key = c.key, selected = c.sessions.find(r => r.id === c.session), f = form('clear:' + key);
-    if (!c.canSend || !threadWrites() || out() || f.pending || selectedInactive() || !Number.isSafeInteger(selected?.revision)) return;
+    if (!c.canSend || out() || f.pending || selectedInactive() || !Number.isSafeInteger(selected?.revision)) return;
    if (!window.confirm(`Clear context for "${selected.name}"? This ends this session after a safe stop and starts fresh context. History and the old checkout (including unpushed work) are retained. The successor uses a fresh approved checkout; old work is not copied. This can wait for safe stop or capacity.`)) return;
    // A lost answer retains this key. Only status reads are allowed afterward.
    if (f.op && !['cancelled', 'failed'].includes(f.record?.state)) { await checkClear(c.id, key, f); return; }
@@ -9,11 +9,10 @@
    return path.startsWith('/chat') ? path : '/chat';
  };
  function show(navigated) {
-    if (ready && window.MosaicChat) void window.MosaicChat.render({ path: route(), container: $('chat'), canSend, user: true, navigated });
+    if (ready && window.MosaicChat) void window.MosaicChat.render({ path: route(), container: $('chat'), canSend, navigated });
  }
  document.addEventListener('mosaic-signed-out', () => { $('signed-out').hidden = false; $('sign-out').hidden = true; });
  window.addEventListener('hashchange', () => show(true));
-  setInterval(() => { if (!document.hidden) show(false); }, 5000);
  fetch('/api/config', { cache: 'no-store', redirect: 'manual' }).then(async res => {
    if (res.type === 'opaqueredirect' || res.status === 401) { document.dispatchEvent(new Event('mosaic-signed-out')); return; }
    const config = await res.json();
@@ -632,7 +632,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
  if (send !== null && ((preview === null && sso === null) || typeof send !== 'function')) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
  const server = createServer(async (req, res) => {
    // A granted user's request rebinds these below; every other request keeps the owner's.
-    let { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files } = owner, granted = false, chatGrants = [];
+    let { bus, reads, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing, upstream, files } = owner, granted = false;
    res.setHeader('x-content-type-options', 'nosniff');
    res.setHeader('referrer-policy', 'no-referrer');
    // Under --sso the Sign out form's POST is redirected to the provider's end-session endpoint, and
@@ -700,7 +700,6 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
        if (userOptions === null) return json(res, 503, { error: 'not-configured', message: 'the Console has no user transport' });
        ({ bus, send, settingsWrite, projectFiles, projectFile, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite, agentWrite, processing } = userOptions(session));
        reads = null; upstream = null; files = USER_FILES; granted = true;
-        chatGrants = sso.chatGrants?.(session) ?? [];
      }
    }
    if (named && preview !== null) {
@@ -840,7 +839,7 @@ export async function startServer({ host = '127.0.0.1', port = 7330, board = DEF
    // `send`: the page shows the composer only where a send can pass (the public name, --send on).
    // `edit`: the editor shows Save only where a save can pass, the same test as the route's.
    // `user` and `federation` (FED R6) only when there is one, so the owner's config is unchanged.
-    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true, chatGrants } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, decide: !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
+    if (path === '/api/config') return json(res, 200, { board: upstream, ...(tester ? { tester: true } : {}), ...(sso ? { sso: true } : {}), ...(granted ? { user: true } : {}), ...(hub ? { federation: hub } : {}), send: !tester && Boolean(send) && named, decide: !tester && !granted && Boolean(send) && Boolean(decisionWrite) && named && sso !== null, edit: !tester && !granted && Boolean(send) && Boolean(projectSave) && named });
    if (path === '/healthz') return json(res, 200, { ok: true, ...(sso ? { sso: sso.health() } : {}) });
    if (path === '/favicon.ico') { res.writeHead(204); return res.end(); }
    const file = files.get(path);
@@ -352,7 +352,6 @@ export async function createSso(config, { secrets, fetch: customFetch = null, lo

  return {
    publicOrigin, publicHost, sessions, logins, handle, session, returnURL,
-    chatGrants: session => users?.chatGrants?.(session) ?? [],
    health: () => Object.fromEntries([...providers].map(([id, e]) => [id, e.state])),
    formTargets: () => [...new Set([...providers.values()].filter(e => e.as?.end_session_endpoint).map(e => new URL(e.as.end_session_endpoint).origin))],
    summary: () => config.providers.map(p => ({ id: p.id, issuer: p.issuer, subjects: p.subjects.length })),
@@ -1,87 +0,0 @@
-// Row 208: isolated real broker + chat HTTP; no config, slot, provider or live host.
-import { createServer, request } from 'node:http';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { Broker } from '../../bus/src/broker.mjs';
-import { Store } from '../../bus/src/store.mjs';
-import { createChat } from '../src/chat.mjs';
-import { chatHTTP } from '../src/chat-http.mjs';
-import { consoleAccess } from '../src/access.mjs';
-import { BusReadError } from '../src/bus.mjs';
-
-export const mutants = {
-  composer: ["${threadWrites() ? `<form id=\"chat-send-form\"", "${true ? `<form id=\"chat-send-form\""],
-  open: ['${threadWrites() ? `<button class="btn" type="button" id="chat-resume"', '${true ? `<button class="btn" type="button" id="chat-resume"'],
-  share: ["if (!current.canSend || !threadWrites() || current.tester) return '';", "if (!current.canSend || current.tester) return '';"],
-  create: ["if (current.user && (project || !scopeWrites(key))) return '';", "if (current.user && project) return '';"],
-};
-export async function sharingFixture(t, { owner = false, mutant = process.env.POE_UI_MUTANT } = {}) {
-  const dir = mkdtempSync(join(tmpdir(), 'poe-sharing-'));
-  const store = new Store(dir), calls = [], lines = [];
-  const access = { accessVersion: 1, revision: 1, users: [
-    { id: 'alice', home: 'local', subjects: [{ provider: 'fake', sub: 'alice-sub' }] },
-    { id: 'bob', home: 'local', subjects: [{ provider: 'fake', sub: 'bob-sub' }] },
-  ], grants: ['alice', 'bob'].map(user => ({ id: 'g-' + user, user, business: 'demo', projects: ['*'], instances: ['assistant'], level: 'collaborator' })) };
-  const broker = new Broker({ store, access: () => access, businesses: { demo: {
-    id: 'demo', human: 'jason', arbiters: { technical: 'chief', delivery: 'chief' },
-    roles: { chief: { definition: 'chief-of-staff', authority: { withinRole: ['message.send'], crossRole: [] } }, assistant: { definition: 'assistant', authority: { withinRole: ['message.send'], crossRole: [] } } },
-    definitions: { 'chief-of-staff': {}, assistant: { messaging: JSON.parse(readFileSync(new URL('../../../roles/assistant.json', import.meta.url))).messaging } },
-  } } });
-  const human = broker.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
-  const invoke = (cap, verb, args = {}) => broker.request(cap, { verb, args });
-  const alice = () => broker.bindUser({ business: 'demo', user: 'alice' });
-  const bob = () => broker.bindUser({ business: 'demo', user: 'bob' });
-  const project = invoke(human, 'project.create', { name: 'Viewer project' }).id;
-  const other = invoke(human, 'project.create', { name: 'Collaborator project' }).id;
-  const own = invoke(alice(), 'thread.create', { project, instance: 'assistant', name: 'Old own thread' }).id;
-  const writable = invoke(alice(), 'thread.create', { project: other, instance: 'assistant', name: 'Writable thread' }).id;
-  const shared = invoke(bob(), 'thread.create', { project, instance: 'assistant', name: 'Shared thread <img src=x onerror=alert(1)>' }).id;
-  invoke(alice(), 'thread.send', { thread: own, body: 'Own history' });
-  invoke(bob(), 'thread.send', { thread: shared, body: 'Shared history' });
-  invoke(bob(), 'thread.share', { thread: shared, to: 'user:alice' });
-  access.grants[0].level = 'viewer';
-  const hints = consoleAccess({ load: () => access, business: () => 'demo' });
-  const principal = () => owner ? human : alice();
-  const chat = createChat({ call: async (verb, args) => {
-    calls.push([verb, args]);
-    if (verb === 'plugins') return { plugins: { channel: ['webui'] } };
-    try { return invoke(principal(), verb, args); }
-    catch (e) { throw new BusReadError(e.code); }
-  } });
-  const source = readFileSync(new URL('../src/public/chat.js', import.meta.url), 'utf8');
-  let chatSource = source;
-  if (mutant) {
-    const [before, after] = mutants[mutant] ?? [];
-    if (!before || !source.includes(before)) throw Error('mutant anchor missing: ' + mutant);
-    chatSource = source.replace(before, after);
-  }
-  const server = createServer(async (req, res) => {
-    const url = new URL(req.url, 'http://fixture');
-    if (url.pathname === '/api/config') {
-      res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-      return res.end(JSON.stringify({ send: true, user: !owner, chatGrants: hints.chatGrants({ user: 'alice', provider: 'fake', sub: 'alice-sub' }) }));
-    }
-    if (url.pathname.startsWith('/api/chat/')) return chatHTTP(req, res, {
-      path: url.pathname, search: url.search, chat, named: true, send: true,
-      preview: { sso: true, user: owner ? 'jason' : 'alice', origin: origin() }, log: line => lines.push(line),
-    });
-    if (url.pathname === '/chat.js') { res.writeHead(200, { 'content-type': 'text/javascript' }); return res.end(chatSource); }
-    if (url.pathname === '/') {
-      res.writeHead(200, { 'content-type': 'text/html' });
-      return res.end('<!doctype html><title>Sharing fixture</title><div id="view"></div><script src="/chat.js"></script>');
-    }
-    res.writeHead(404); res.end();
-  });
-  await new Promise(r => server.listen(0, '127.0.0.1', r));
-  const origin = () => `http://127.0.0.1:${server.address().port}`;
-  t.after(async () => { await new Promise(r => server.close(r)); store.close(); rmSync(dir, { recursive: true, force: true }); });
-  const http = (path, value, extra = {}) => new Promise((resolve, reject) => {
-    const body = value === undefined ? undefined : JSON.stringify(value);
-    const req = request(origin() + path, { method: body ? 'POST' : 'GET', headers: body ? { origin: origin(), 'sec-fetch-site': 'same-origin', 'content-type': 'application/json', ...extra } : extra }, res => {
-      let data = ''; res.on('data', chunk => { data += chunk; });
-      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(data) }));
-    }); req.on('error', reject); req.end(body);
-  });
-  return { store, access, broker, human, alice, bob, invoke, project, other, own, writable, shared, calls, lines, origin: origin(), http, hints, source, chatSource };
-}
@@ -1,164 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { sharingFixture } from './thread-sharing-fixture.mjs';
-import { browser } from './browser.mjs';
-import { startServer } from '../src/serve.mjs';
-import { consoleBus } from '../src/console-bus.mjs';
-
-async function page(t, f) {
-  const b = await browser(); t.after(() => b.close());
-  await b.navigate(f.origin);
-  const render = async path => {
-    await b.evaluate(`(async()=>{location.hash=${JSON.stringify('#' + path)};await MosaicChat.render({path:${JSON.stringify(path)},container:document.getElementById('view'),canSend:true,user:${!f.owner},navigated:true});return true;})()`);
-  };
-  const wait = expr => b.evaluate(`(async()=>{for(let i=0;i<100;i++){if(${expr})return true;await new Promise(r=>setTimeout(r,30));}return false;})()`);
-  return { b, render, wait };
-}
-const counts = f => Object.fromEntries(['threads', 'messages', 'thread_opens', 'thread_shares'].map(table => [table, f.store.get(`SELECT count(*) n FROM ${table}`).n]));
-
-test('193d HTTP shares use the caller, plain/shared lists, exact args and write fences', async t => {
-  const f = await sharingFixture(t);
-  let r = await f.http('/api/chat/threads?shared=true');
-  assert.equal(r.status, 200); assert.deepEqual(r.body.rows.map(x => x.id), [f.shared]);
-  assert.equal(r.body.rows[0].owner, 'user:bob');
-  r = await f.http('/api/chat/threads');
-  assert.deepEqual(r.body.rows.map(x => x.id), [f.own, f.writable]);
-  assert.ok(r.body.rows.every(x => !Object.hasOwn(x, 'owner')), 'plain list shape unchanged');
-  assert.equal((await f.http(`/api/chat/threads/${f.shared}/messages`)).status, 200);
-  const before = counts(f);
-  for (const [path, body] of [
-    ['/api/chat/threads', { project: f.project, instance: 'assistant', name: 'forbidden' }],
-    [`/api/chat/threads/${f.own}/messages`, { body: 'forbidden' }],
-    [`/api/chat/threads/${f.own}/open`, {}],
-    [`/api/chat/threads/${f.own}/share`, { to: 'user:bob' }],
-    [`/api/chat/threads/${f.own}/unshare`, { to: 'user:bob' }],
-  ]) {
-    r = await f.http(path, body);
-    assert.equal(r.status, 403, path); assert.equal(r.body.error, 'access-refused'); assert.equal(r.body.sent, false);
-  }
-  assert.equal((await f.http(`/api/chat/threads/${f.own}/shares`)).body.error, 'access-refused');
-  assert.deepEqual(counts(f), before);
-  f.access.grants[0].level = 'collaborator';
-  r = await f.http(`/api/chat/threads/${f.own}/share`, { to: 'user:bob' });
-  assert.equal(r.status, 200); assert.deepEqual(r.body, { thread: f.own, to: 'user:bob', op: 'share' });
-  assert.deepEqual((await f.http(`/api/chat/threads/${f.own}/shares`)).body.rows.map(x => x.to), ['user:bob']);
-  assert.equal((await f.http(`/api/chat/threads/${f.own}/unshare`, { to: 'user:bob' })).status, 200);
-  for (const [path, body] of [
-    ['/api/chat/threads?shared=false', undefined], ['/api/chat/threads?shared=true&shared=true', undefined],
-    [`/api/chat/threads/${f.own}/share`, { to: 'user:bob', owner: 'jason' }],
-    [`/api/chat/threads/${f.own}/share`, { to: 'user:bob', verb: 'thread.send' }],
-    [`/api/chat/threads/${f.own}/shares?to=user:bob`, undefined],
-  ]) assert.equal((await f.http(path, body)).status, 400, path);
-  assert.equal((await f.http(`/api/chat/threads/${f.own}/share`, { to: '*' }, { origin: 'http://other.test' })).status, 403);
-  assert.equal((await f.http(`/api/chat/threads/${f.own}/share`, { to: '*' }, { 'sec-fetch-site': 'cross-site' })).status, 403);
-  f.invoke(f.bob(), 'thread.unshare', { thread: f.shared, to: 'user:alice' });
-  assert.equal((await f.http(`/api/chat/threads/${f.shared}/messages`)).body.error, 'thread-not-owned');
-});
-
-test('193d config supplies only the signed-in user live collaborator scopes and updates on downgrade', async t => {
-  const f = await sharingFixture(t);
-  f.access.grants.push({ ...f.access.grants[0], id: 'mixed', level: 'collaborator', projects: [f.other] });
-  const session = { user: 'alice', name: 'alice', provider: 'fake', sub: 'alice-sub' };
-  let web;
-  const sso = { get publicHost() { return `127.0.0.1:${web.address().port}`; }, get publicOrigin() { return `http://${this.publicHost}`; },
-    formTargets: () => [], session: () => session, chatGrants: s => f.hints.chatGrants(s) };
-  web = await startServer({ port: 0, sso, log: () => {}, userOptions: () => consoleBus(async () => [], { send: true }) });
-  t.after(() => new Promise(r => web.close(r)));
-  const read = async () => (await fetch(`http://127.0.0.1:${web.address().port}/api/config`)).json();
-  let config = await read();
-  assert.equal(config.user, true); assert.deepEqual(config.chatGrants, [{ projects: [f.other], instances: ['assistant'] }]);
-  assert.equal(config.send, true, 'send mode is separate from individual grant levels');
-  f.access.grants[2].level = 'viewer';
-  assert.deepEqual((await read()).chatGrants, []);
-  f.access.grants[2].level = 'collaborator'; f.access.grants[2].expires = new Date(Date.now() - 1000).toISOString();
-  assert.deepEqual((await read()).chatGrants, []);
-  assert.deepEqual(f.hints.chatGrants({ ...session, sub: 'bob-sub' }), []);
-});
-
-test('193d viewer UI has no composer, resume, share, session mutations or create controls', async t => {
-  const f = await sharingFixture(t); f.owner = false;
-  const { b, render } = await page(t, f);
-  await render('/chat');
-  assert.match(await b.evaluate('document.getElementById("view").textContent'), /Shared with me/);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-project-form")'), false);
-  await render('/chat/projects/' + f.project);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-thread-form")'), false);
-  for (const thread of [f.own, f.shared]) {
-    await render('/chat/threads/' + thread);
-    assert.match(await b.evaluate('document.querySelector(".chat-log").textContent'), /history/);
-    for (const selector of ['#chat-send-form', '#chat-resume', '#chat-share-form', '#chat-session-form', '#chat-clear', '#chat-cancel']) {
-      assert.equal(await b.evaluate(`!!document.querySelector(${JSON.stringify(selector)})`), false, `${thread}: ${selector}`);
-    }
-  }
-  assert.equal(await b.evaluate('!!document.querySelector("img")'), false, 'shared name remains text');
-  const sharedSessions = f.calls.filter(([verb, args]) => verb === 'session.list' && args.thread === f.shared);
-  assert.equal(sharedSessions.length, 0, 'shared read never requests an owner-only catalog');
-});
-
-test('193d mixed grants keep viewer project read-only and collaborator own thread writable; downgrade hides controls', async t => {
-  const f = await sharingFixture(t); f.owner = false;
-  f.access.grants.push({ ...f.access.grants[0], id: 'mixed', level: 'collaborator', projects: [f.other] });
-  const { b, render, wait } = await page(t, f);
-  await render('/chat/threads/' + f.own);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-send-form")'), false);
-  await render('/chat/threads/' + f.writable);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-send-form")'), true);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-share-form")'), true);
-  await b.evaluate('(()=>{const x=document.getElementById("chat-share-target");x.value="user:bob";x.dispatchEvent(new Event("input",{bubbles:true}));document.querySelector("#chat-share-form button").click();return true;})()');
-  assert.equal(await wait('!!document.querySelector("[data-unshare]")'), true);
-  assert.equal(f.store.get("SELECT count(*) n FROM thread_shares WHERE thread=? AND op='share'", f.writable).n, 1);
-  await b.evaluate('document.querySelector("[data-unshare]").click(),true');
-  assert.equal(await wait('!document.querySelector("[data-unshare]")'), true);
-  f.access.grants[2].level = 'viewer';
-  await render('/chat/threads/' + f.writable);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-send-form,#chat-share-form,#chat-resume")'), false);
-  // Loss of a share clears visible history on the next render.
-  await render('/chat/threads/' + f.shared);
-  f.invoke(f.bob(), 'thread.unshare', { thread: f.shared, to: 'user:alice' });
-  await render('/chat/threads/' + f.shared);
-  assert.equal(await b.evaluate('!!document.querySelector(".chat-log")'), false);
-});
-
-test('193d owner has share controls on own threads and shared threads remain read-only', async t => {
-  const f = await sharingFixture(t, { owner: true }); f.owner = true;
-  const own = f.invoke(f.human, 'thread.create', { project: f.project, instance: 'assistant', name: 'Owner thread' }).id;
-  f.invoke(f.bob(), 'thread.share', { thread: f.shared, to: 'jason' });
-  const { b, render } = await page(t, f);
-  await render('/chat/threads/' + own);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-share-form")'), true);
-  await render('/chat/threads/' + f.shared);
-  assert.match(await b.evaluate('document.querySelector(".chat-log").textContent'), /Shared history/);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-share-form,#chat-send-form,#chat-resume")'), false);
-});
-
-// Run under each served-source mutant after the normal absence test kills it.
-// Every browser POST bypasses all local UI checks and still uses the viewer transport.
-test('193d bypassed UI checks still reach a refusing bus for every viewer write', async t => {
-  const f = await sharingFixture(t); f.owner = false;
-  const { b, render } = await page(t, f);
-  await render('/chat/threads/' + f.own);
-  const before = counts(f);
-  for (const [path, value] of [
-    ['threads', { project: f.project, instance: 'assistant', name: 'mutant create' }],
-    [`threads/${f.own}/messages`, { body: 'mutant send' }],
-    [`threads/${f.own}/open`, {}], [`threads/${f.own}/share`, { to: 'user:bob' }],
-  ]) {
-    const r = JSON.parse(await b.evaluate(`(async()=>{const r=await fetch('/api/chat/'+${JSON.stringify(path)},{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(${JSON.stringify(value)})});return JSON.stringify({status:r.status,body:await r.json()});})()`));
-    assert.equal(r.status, 403, path); assert.equal(r.body.error, 'access-refused'); assert.equal(r.body.sent, false);
-  }
-  assert.deepEqual(counts(f), before);
-  for (const verb of ['thread.create', 'thread.send', 'thread.open', 'thread.share']) assert.ok(f.calls.some(([v]) => v === verb), `${verb} reached the bus`);
-});
-
-
-test('193d collaborator shares stay read-only and never expose reshare or wake controls', async t => {
-  const f = await sharingFixture(t); f.owner = false;
-  f.access.grants[0].level = 'collaborator';
-  const { b, render } = await page(t, f);
-  await render('/chat/threads/' + f.shared);
-  assert.equal(await b.evaluate('!!document.querySelector("#chat-share-form,#chat-send-form,#chat-resume,#chat-session-form")'), false);
-  for (const [action, body] of [['messages', { body: 'shared write' }], ['open', {}], ['share', { to: '*' }]]) {
-    const r = await f.http(`/api/chat/threads/${f.shared}/${action}`, body);
-    assert.equal(r.status, 403); assert.equal(r.body.error, 'thread-not-owned');
-  }
-});
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Build/list the I2 images, explicitly on the configured rootless endpoint.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$REPO/scripts/lib/docker.sh"
+cd "$REPO"
+release="$(tr -d '[:space:]' < RELEASE)"
+[[ "$release" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo invalid-release >&2; exit 2; }
+[ $# -eq 1 ] || { echo 'usage: images.sh build|list' >&2; exit 4; }
+case "$1" in
+  list)
+    for image in mosaic-core mosaic-session mosaic-egress; do
+      mosaic_docker image inspect "$image:$release" --format '{{.RepoTags}} {{.Id}}'
+    done
+    ;;
+  build)
+    # Attest before preparing the context or making any engine mutation.
+    mosaic_docker version >/dev/null
+    context="$(mktemp -d)"
+    trap 'rm -rf "$context"' EXIT
+    # A source-only context: no .git, host credentials, node_modules or agent work.
+    # Tracked runtime files plus only I2's new runtime paths, from this candidate.
+    while IFS= read -r -d '' file; do
+      [ -f "$file" ] && [ ! -L "$file" ] || { echo "invalid-image-source: $file" >&2; exit 2; }
+      mkdir -p "$context/$(dirname "$file")"
+      cp -- "$file" "$context/$file"
+    done < <({ git ls-files -z -- packages scripts roles contracts package.json package-lock.json RELEASE images;
+      git ls-files --others --exclude-standard -z -- packages/egress contracts/egress.json images scripts/lib/docker.sh scripts/images.sh; })
+    pi_version="$(node -p 'require("./package.json").dependencies["@earendil-works/pi-coding-agent"]')"
+    [[ "$pi_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo invalid-pi-version >&2; exit 2; }
+    mosaic_docker build --file "$context/images/core/Dockerfile" --tag "mosaic-core:$release" "$context"
+    mosaic_docker build --file "$context/images/session/Dockerfile" --build-arg "CORE_IMAGE=mosaic-core:$release" --build-arg "PI_VERSION=$pi_version" --tag "mosaic-session:$release" "$context"
+    mosaic_docker build --file "$context/images/egress/Dockerfile" --tag "mosaic-egress:$release" "$context"
+    ;;
+  *) echo 'usage: images.sh build|list' >&2; exit 4 ;;
+esac
@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+const root = new URL('../../', import.meta.url).pathname;
+const cases = [
+  ['absent', undefined, 0], ['local', {mode:'local'}, 0],
+  ['local endpoint', {mode:'local',endpoint:'unix:///run/user/1000/docker.sock'}, 2],
+  ['containerized missing endpoint', {mode:'containerized'}, 2],
+  ...['tcp://localhost:2375','ssh://host/run/docker.sock','run/docker.sock','unix://relative.sock','unix:///a b.sock','unix:///a.sock\n','unix:///a','',null,4].map(endpoint => ['bad endpoint '+JSON.stringify(endpoint),{mode:'containerized',endpoint},2]),
+  ['valid endpoint', {mode:'containerized',endpoint:'unix:///run/user/1000/docker.sock'},0],
+  ['unknown mode',{mode:'guess'},2], ['missing mode',{},2],
+  ['unknown key',{mode:'local',extra:true},2], ['null',null,2], ['array',[],2],
+];
+for (const [name, install, code] of cases) test('install: '+name, () => {
+  const scratch=mkdtempSync(join(tmpdir(),'i2-config-'));
+  try {
+    const config=join(scratch,'config.json');
+    const doc={configVersion:1,environment:'development',dataRoot:join(scratch,'data'),execution:{backend:'docker',provider:'zai',model:'m'},...(install===undefined?{}:{install})};
+    const bytes=JSON.stringify(doc)+'\n';writeFileSync(config,bytes);
+    const result=spawnSync(process.execPath,[join(root,'scripts/mosaic-config.mjs'),'validate'],{encoding:'utf8',env:{...process.env,MOSAIC_CONFIG:config}});
+    assert.equal(result.status,code,result.stderr);
+    assert.equal(readFileSync(config,'utf8'),bytes);
+    if(code===0)assert.deepEqual(JSON.parse(result.stdout).install,install);
+  } finally {rmSync(scratch,{recursive:true,force:true});}
+});
@@ -0,0 +1,29 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+const root=new URL('../../',import.meta.url).pathname;
+function fixture(t,{options='["name=rootless"]',status=0,install={mode:'containerized',endpoint:'unix:///i2/test.sock'}}={}){
+ const dir=mkdtempSync(join(tmpdir(),'i2-helper-'));t.after(()=>rmSync(dir,{recursive:true,force:true}));mkdirSync(join(dir,'bin'));
+ const config=join(dir,'config.json'), calls=join(dir,'calls');
+ writeFileSync(config,JSON.stringify({configVersion:1,environment:'development',dataRoot:join(dir,'data'),execution:{backend:'docker',provider:'zai',model:'m'},...(install===null?{}:{install})}));
+ writeFileSync(join(dir,'bin/docker'),`#!/usr/bin/env node\nconst fs=require('node:fs');const a=process.argv.slice(2);fs.appendFileSync(process.env.CALLS,JSON.stringify(a)+'\\n');if(a[2]==='info'){process.stdout.write(process.env.OPTIONS);process.exit(Number(process.env.STATUS));}\n`,{mode:0o755});
+ const run=body=>spawnSync('bash',['-c',`source "$1/scripts/lib/docker.sh"; ${body}`,'bash',root],{encoding:'utf8',env:{...process.env,PATH:join(dir,'bin')+':'+process.env.PATH,MOSAIC_CONFIG:config,CALLS:calls,OPTIONS:options,STATUS:String(status),DOCKER_HOST:'tcp://wrong:2375'}});
+ const read=()=>{try{return readFileSync(calls,'utf8').trim().split('\n').map(JSON.parse)}catch{return []}};
+ return {run,read};
+}
+for(const [name,options,status] of [['rootful','["name=seccomp"]',0],['missing','null',1],['substring','["prefix-name=rootless"]',0],['object','{"name":"name=rootless"}',0],['invalid JSON','not-json',0],['null success','null',0],['rootless output but failed','["name=rootless"]',1]])test('helper refuses '+name,t=>{
+ const f=fixture(t,{options,status}),r=f.run('mosaic_docker ps');assert.equal(r.status,2,r.stderr);assert.match(r.stderr,/endpoint-not-rootless/);assert.equal(f.read().length,1);
+});
+test('helper checks once and explicitly names host for both calls',t=>{
+ const f=fixture(t),r=f.run('mosaic_docker ps && mosaic_docker image ls');assert.equal(r.status,0,r.stderr);
+ assert.deepEqual(f.read(),[['--host','unix:///i2/test.sock','info','--format','{{json .SecurityOptions}}'],['--host','unix:///i2/test.sock','ps'],['--host','unix:///i2/test.sock','image','ls']]);
+});
+for(const install of [null,{mode:'local'}])test('local mode refuses before Docker '+JSON.stringify(install),t=>{
+ const f=fixture(t,{install}),r=f.run('mosaic_docker ps');assert.equal(r.status,2);assert.match(r.stderr,/containerized-install-required/);assert.deepEqual(f.read(),[]);
+});
+test('invalid config refuses before Docker',t=>{
+ const f=fixture(t,{install:{mode:'containerized',endpoint:'tcp://wrong'}}),r=f.run('mosaic_docker ps');assert.equal(r.status,2);assert.deepEqual(f.read(),[]);
+});
@@ -0,0 +1,25 @@
+// Runs in a core image on an internal network. Dummy token only; public GETs only.
+import assert from 'node:assert/strict';
+import net from 'node:net';
+import tls from 'node:tls';
+import { lookup } from 'node:dns/promises';
+async function tunnel(host, port, handshake=false) {
+ return new Promise((resolve,reject)=>{
+  const socket=net.connect(3128,'proxy');let head='';
+  const timer=setTimeout(()=>socket.destroy(new Error('proxy timeout')),15000);
+  socket.on('error',reject);socket.on('close',()=>clearTimeout(timer));
+  socket.on('connect',()=>socket.write(`CONNECT ${host}:${port} HTTP/1.1\r\n\r\n`));
+  socket.on('data',function read(chunk){
+   head+=chunk.toString('latin1');if(!head.includes('\r\n\r\n'))return;
+   socket.off('data',read);const status=Number(head.split(' ')[1]);
+   if(status!==200||!handshake){socket.destroy();return resolve(status);}
+   const secure=tls.connect({socket,servername:host});
+   secure.on('error',reject);secure.on('secureConnect',()=>{const ok=secure.authorized;secure.destroy();ok?resolve(status):reject(new Error('TLS unauthorized'));});
+  });
+ });
+}
+assert.equal(await tunnel('api.anthropic.com',443,true),200);
+assert.equal(await tunnel('example.com',443),403);
+assert.equal(await tunnel('api.anthropic.com',22),403);
+await assert.rejects(lookup('example.com'));
+console.log('internal network: listed TLS reached, unlisted host/port refused, external DNS refused');
@@ -0,0 +1,25 @@
+// Boyd B2: exec preserves PID, so a fresh Bash cannot trust inherited cache markers.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync,mkdirSync,writeFileSync,readFileSync,rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+const repo=fileURLToPath(new URL('../../',import.meta.url));
+for(const rootless of [false,true])test('inherited cache is discarded; private cache stays unexported (rootless='+rootless+')',t=>{
+  const dir=mkdtempSync(join(tmpdir(),'i2-cache-'));t.after(()=>rmSync(dir,{recursive:true,force:true}));
+  const bin=join(dir,'bin'),calls=join(dir,'calls'),config=join(dir,'config.json'),runner=join(dir,'run.sh');mkdirSync(bin);
+  writeFileSync(config,JSON.stringify({configVersion:1,environment:'development',dataRoot:join(dir,'data'),execution:{backend:'docker',provider:'zai',model:'fixture'},install:{mode:'containerized',endpoint:'unix:///configured.sock'}}));
+  writeFileSync(join(bin,'docker'),`#!/usr/bin/env node\nconst fs=require('node:fs');const args=process.argv.slice(2);const cache=Object.keys(process.env).filter(k=>['_mosaic_docker_checked_pid','_mosaic_docker_endpoint','_mosaic_docker_mode'].includes(k));fs.appendFileSync(process.env.CALLS,JSON.stringify({args,cache})+'\\n');if(args[2]==='info')process.stdout.write(process.env.OPTIONS);\n`,{mode:0o755});
+  writeFileSync(runner,'#!/usr/bin/env bash\nset -euo pipefail\nsource "$1/scripts/lib/docker.sh"\nmosaic_docker ps\nmosaic_docker image ls\n');
+  const env={PATH:bin+':'+process.env.PATH,HOME:dir,TMPDIR:dir,MOSAIC_CONFIG:config,CALLS:calls,OPTIONS:rootless?'["name=rootless"]':'["name=seccomp"]'};
+  const result=spawnSync('bash',['-c','export _mosaic_docker_checked_pid="$BASHPID" _mosaic_docker_endpoint=unix:///inherited.sock _mosaic_docker_mode=containerized; exec bash "$1" "$2"','outer',runner,repo],{env,encoding:'utf8',timeout:5000});
+  const rows=readFileSync(calls,'utf8').trim().split('\n').map(JSON.parse);
+  assert.equal(result.status,rootless?0:2,result.stderr);
+  assert.deepEqual(rows[0].args,['--host','unix:///configured.sock','info','--format','{{json .SecurityOptions}}']);
+  assert.equal(rows.length,rootless?3:1);
+  for(const row of rows)assert.deepEqual(row.cache,[],'attestation cache must not reach child environment');
+  if(rootless)assert.deepEqual(rows.slice(1).map(r=>r.args),[['--host','unix:///configured.sock','ps'],['--host','unix:///configured.sock','image','ls']]);
+  else assert.match(result.stderr,/endpoint-not-rootless/);
+});
@@ -0,0 +1,9 @@
+// Real service-client code, dummy/no token, public GET only. No notifier state/config.
+import assert from 'node:assert/strict';
+import { client } from '../../packages/tasks/src/vikunja.mjs';
+import { createRest } from '../../packages/discord/src/rest.mjs';
+assert.equal(process.env.NODE_USE_ENV_PROXY,'1');
+const result=await client({baseUrl:'https://tasks.woltje.com'})('', 'GET','/info');
+assert.equal(result.status,200);
+await assert.rejects(createRest({token:'i2-dummy-invalid-token'}).getMe(),e=>e.details?.status===401);
+console.log('Vikunja client public GET 200; notifier REST dummy-token GET 401');
@@ -0,0 +1,33 @@
+# Containerized-install Docker entry point. Source from a host script, then
+# call mosaic_docker. No ambient Docker context or endpoint environment is used.
+# scripts/common.sh owns load_config (there is no scripts/load_config file).
+# An exec can inherit the same PID and exported cache values. Only attestations
+# performed after this source may populate the process-local, unexported cache.
+unset _mosaic_docker_checked_pid _mosaic_docker_endpoint _mosaic_docker_mode
+_mosaic_docker_repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+source "$_mosaic_docker_repo/scripts/common.sh"
+
+mosaic_docker() {
+    if [ "${_mosaic_docker_checked_pid:-}" != "$BASHPID" ]; then
+        # load_config's loader path is repository relative.
+        local config_env
+        config_env="$(cd "$_mosaic_docker_repo" && load_config && printf '%s\n' "$MOSAIC_INSTALL_MODE" "$MOSAIC_DOCKER_ENDPOINT")" || return 2
+        _mosaic_docker_mode="${config_env%%$'\n'*}"
+        _mosaic_docker_endpoint="${config_env#*$'\n'}"
+        if [ "$_mosaic_docker_mode" != containerized ]; then
+            echo "containerized-install-required" >&2
+            return 2
+        fi
+        local options
+        if ! options="$(command docker --host "$_mosaic_docker_endpoint" info --format '{{json .SecurityOptions}}' 2>/dev/null)"; then
+            echo "endpoint-not-rootless" >&2
+            return 2
+        fi
+        if ! printf '%s' "$options" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try {const a=JSON.parse(s);process.exit(Array.isArray(a)&&a.includes("name=rootless")?0:1)}catch{process.exit(1)}})'; then
+            echo "endpoint-not-rootless" >&2
+            return 2
+        fi
+        _mosaic_docker_checked_pid="$BASHPID"
+    fi
+    command docker --host "$_mosaic_docker_endpoint" "$@"
+}
@@ -290,6 +290,21 @@ function validateFederation(value) {
  return { self: value.self, peers };
 }

+// I2: shape only. The endpoint helper, never configuration validation, checks Docker.
+function validateInstall(value) {
+  if (!isPlainObject(value)) fail(2, '"install" must be a JSON object');
+  rejectUnknownKeys(value, ["mode", "endpoint"], '"install"');
+  if (!["local", "containerized"].includes(value.mode)) fail(2, 'install.mode must be local or containerized');
+  if (value.mode === "local") {
+    if (Object.hasOwn(value, "endpoint")) fail(2, 'install.endpoint is forbidden in local mode');
+    return { mode: "local" };
+  }
+  if (typeof value.endpoint !== "string" || !/^unix:\/\/\/[^\s]+\.sock$/.test(value.endpoint) || /\s/.test(value.endpoint) || value.endpoint.includes("\0")) {
+    fail(2, 'install.endpoint must match ^unix:///[^\\s]+\\.sock$');
+  }
+  return { mode: "containerized", endpoint: value.endpoint };
+}
+
 async function validate(document, file) {
  if (!isPlainObject(document)) {
    fail(2, "configuration must be a JSON object");
@@ -301,7 +316,7 @@ async function validate(document, file) {
  // packages/cli/tests/stack-release-fixture.mjs edits it to make an older loader.
  rejectUnknownKeys(
    document,
-    ["configVersion", "environment", "dataRoot", "execution", "console", "federation"].concat(["compactionReadBytes", "compactionStreams"]),
+    ["configVersion", "environment", "dataRoot", "execution", "console", "federation"].concat(["compactionReadBytes", "compactionStreams", "install"]),
    "configuration",
  );

@@ -343,6 +358,7 @@ async function validate(document, file) {
  const federationKey = Object.hasOwn(document, "federation") ? validateFederation(document.federation) : undefined;

  return {
+    ...(Object.hasOwn(document, "install") ? { install: validateInstall(document.install) } : {}),
    configVersion: document.configVersion,
    environment: document.environment,
    dataRoot,
@@ -537,6 +553,8 @@ try {
          `MOSAIC_PROVIDER=${shellQuote(resolved.execution.provider)}`,
          `MOSAIC_MODEL=${shellQuote(resolved.execution.model)}`,
          `MOSAIC_ADAPTER=${shellQuote(resolved.execution.adapter)}`,
+          `MOSAIC_INSTALL_MODE=${shellQuote(resolved.install?.mode ?? "local")}`,
+          `MOSAIC_DOCKER_ENDPOINT=${shellQuote(resolved.install?.endpoint ?? "")}`,
          "",
        ].join("\n"),
      );
@@ -291,5 +291,9 @@ else
 fi

 echo
+# I2: each install shape asserts its exit code and config-byte preservation.
+node --test scripts/install-tests/config.test.mjs
+check "install configuration cases" $?
+
 echo "selftest: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# I2 only. No live config, credentials, daemon/volume changes or ambient endpoint.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO"
+node --test scripts/install-tests/*.test.mjs
+node --test packages/egress/tests/*.test.mjs
+endpoint="${MOSAIC_TEST_DOCKER_ENDPOINT:-unix:///run/user/1000/docker.sock}"
+# No skip: a missing/refused endpoint is a failed prerequisite to report to Sage.
+scratch="$(mktemp -d)"
+prefix="i2-$(date -u +%s)-$$"
+containers=(); networks=()
+cleanup() {
+  local rc=$?
+  trap - EXIT
+  for name in "${containers[@]}"; do mosaic_docker container rm -f "$name" >/dev/null 2>&1 || true; done
+  for name in "${networks[@]}"; do mosaic_docker network rm "$name" >/dev/null 2>&1 || true; done
+  rm -rf "$scratch"
+  exit "$rc"
+}
+trap cleanup EXIT
+node - "$scratch" "$endpoint" <<'JS'
+const fs=require('node:fs'),path=require('node:path');const [dir,endpoint]=process.argv.slice(2);
+fs.writeFileSync(path.join(dir,'config.json'),JSON.stringify({configVersion:1,environment:'development',dataRoot:path.join(dir,'data'),execution:{backend:'docker',provider:'zai',model:'fixture'},install:{mode:'containerized',endpoint}}));
+JS
+export MOSAIC_CONFIG="$scratch/config.json"
+source scripts/lib/docker.sh
+mosaic_docker version >/dev/null
+scripts/images.sh build
+release="$(tr -d '[:space:]' < RELEASE)"
+# Image assertions: versions, release and no git in core; no stack is launched.
+containers+=("$prefix-core-check")
+mosaic_docker run --rm --name "$prefix-core-check" --read-only --network none --cap-drop ALL --security-opt no-new-privileges "mosaic-core:$release" node -e 'const fs=require("node:fs");if(process.version!=="v24.21.0")process.exit(1);if(fs.existsSync("/usr/bin/git"))process.exit(1);if(fs.readFileSync("RELEASE","utf8").trim()!==process.argv[1])process.exit(1)' "$release"
+containers+=("$prefix-session-check")
+mosaic_docker run --rm --name "$prefix-session-check" --read-only --network none --cap-drop ALL --security-opt no-new-privileges "mosaic-session:$release" sh -c 'test "$(claude --version | cut -d " " -f1)" = 2.1.296 && test "$(pi --version)" = 0.85.1'
+networks+=("$prefix-internal" "$prefix-egress")
+mosaic_docker network create --internal "$prefix-internal" >/dev/null
+mosaic_docker network create "$prefix-egress" >/dev/null
+# Two lists are tested one after the other. The I6 two-network separation gate stays I6's.
+for list in agents services; do
+  proxy="$prefix-$list"; containers+=("$proxy")
+  mosaic_docker create --name "$proxy" --network "$prefix-egress" --read-only --cap-drop ALL --security-opt no-new-privileges --pids-limit 64 --memory 128m --memory-swap 128m --cpus 0.5 "mosaic-egress:$release" "$list" >/dev/null
+  mosaic_docker network connect --alias proxy "$prefix-internal" "$proxy"
+  mosaic_docker start "$proxy" >/dev/null
+  # Bounded readiness on the container's own loopback; no published port.
+  ready=0
+  for attempt in {1..50}; do
+    if mosaic_docker exec "$proxy" node -e 'const s=require("node:net").connect(3128,"127.0.0.1");s.on("connect",()=>{s.destroy();process.exit(0)});s.on("error",()=>process.exit(1));s.setTimeout(500,()=>process.exit(1))'; then ready=1; break; fi
+    sleep 0.1
+  done
+  [ "$ready" -eq 1 ] || { echo proxy-not-ready >&2; exit 1; }
+  if [ "$list" = agents ]; then
+    containers+=("$prefix-probe-$list")
+    mosaic_docker run --rm --name "$prefix-probe-$list" --network "$prefix-internal" --read-only --cap-drop ALL --security-opt no-new-privileges \
+      --mount "type=bind,src=$REPO/scripts/install-tests/network-probe.mjs,dst=/opt/mosaic/scripts/install-tests/network-probe.mjs,readonly" \
+      "mosaic-core:$release" node scripts/install-tests/network-probe.mjs
+  else
+    # Service entry points are checked directly; S5's generic fetch probe is not repeated.
+    containers+=("$prefix-probe-$list")
+    mosaic_docker run --rm --name "$prefix-probe-$list" --network "$prefix-internal" --read-only --cap-drop ALL --security-opt no-new-privileges \
+      -e NODE_USE_ENV_PROXY=1 -e HTTPS_PROXY=http://proxy:3128 \
+      --mount "type=bind,src=$REPO/scripts/install-tests/services-probe.mjs,dst=/opt/mosaic/scripts/install-tests/services-probe.mjs,readonly" \
+      "mosaic-core:$release" node scripts/install-tests/services-probe.mjs
+  fi
+  mosaic_docker logs "$proxy" > "$scratch/$list.jsonl"
+  node - "$scratch/$list.jsonl" "$list" <<'JS'
+const fs=require('node:fs'),assert=require('node:assert/strict');const [file,list]=process.argv.slice(2);
+const lines=fs.readFileSync(file,'utf8').trim().split('\n').map(JSON.parse);
+assert.ok(lines.some(l=>l.allowed));for(const line of lines){assert.deepEqual(Object.keys(line),['at','list','host','port','allowed']);assert.equal(line.list,list);}
+if(list==='agents')assert.ok(lines.some(l=>l.host==='example.com'&&!l.allowed));
+else for(const host of ['tasks.woltje.com','discord.com'])assert.ok(lines.some(l=>l.host===host&&l.allowed));
+JS
+  mosaic_docker container rm -f "$proxy" >/dev/null
+ done
+echo 'test-install: PASS (provider-host measurement remains Mos gate)'
Author	SHA1	Message	Date
jason.woltje	2da63d5e30	fix(install): close refused peers and reset inherited Docker cache (#1652 )	2026-10-23 23:32:05 -05:00
jason.woltje	a14fdc4436	feat(install): add rootless image builds and reviewed egress proxy (#1652 )	2026-10-23 23:16:04 -05:00
				`@@ -0,0 +1 @@`
				`{"name":"@mosaic/egress","private":true,"type":"module","scripts":{"test":"node --test tests/*.test.mjs"}}`