gosalyn: PRD 1.18, REQ-INST-2 prints the Console's one providers entry for the user to add to config.json and the stack never writes config.json (canon invariant 2). Status line 1.18, the 1.18 header sentence and the Version 1.18 source line before 1.17. requirements.json version 1.18 with the count still 87, and the version pin in requirements.test.mjs:24 (row 335, #1833, mos-1671, sage-4418)

docs/prd/mosaic-stack.md

@@ -1,6 +1,6 @@
 # PRD: Mosaic Stack
 
-- Status: approved, version 1.17. Jason approved draft 0.4 unchanged as
+- Status: approved, version 1.18. Jason approved draft 0.4 unchanged as
   1.0 on 2026-10-05 (lead decision 61). They approved version 1.1, the
   Organization requirements, in decision 03130d08-ddce-480d-a601-e59f64744fc3
   on 2026-10-14. They approved version 1.2, the chief of staff, the
@@ -54,7 +54,17 @@
   adds REQ-LIB-9, the Console's DOCX editor, from Jason's rulings Q195,
   Q226 and Q234. It changes what Case 2 requirements allow, so Mos puts
   the text to Jason as written, and it lands only after his yes (mos-1366,
-  Vikunja 570).
+  Vikunja 570). Version 1.18 corrects Mos's reading in REQ-INST-2 to match
+  the approved row 255 design. The stack prints the providers entry and
+  never writes config.json. What the requirement allows or forbids is
+  unchanged (mos-1671, sage-4418). Doc-only, so it takes the 1.11 path:
+  one seat drafts, a second reviews, Sage lands.
+- Version 1.18 source: Mos's ruling mos-1671 on 2026-10-25, answering
+  sage-4418. REQ-INST-2's second bullet said the stack installs the
+  bundled Pocket ID "and writes it as the Console's one providers entry."
+  It now says the stack "prints the Console's one providers entry for the
+  user to add to config.json. The stack never writes config.json (canon
+  invariant 2)."
 - Version 1.17 source: Jason's Q235, answering Q36: 'How about we see a
   markdown file, we convert the markdown file to docx, then archive or
   mark the markdown file as converted. The new standard for files in the
@@ -1517,8 +1527,10 @@ Added in version 1.4 (decision 1ea053cc).
   - The installer offers two choices: point the Console at one or more
     existing OIDC providers, or deploy a bundled Pocket ID.
   - The stack installs that Pocket ID as an install component under
-    REQ-INST-1 and writes it as the Console's one providers entry. No
-    Pocket ID source goes in the repository, and the Console gets no
+    REQ-INST-1 and prints the Console's one providers entry for the user
+    to add to config.json. The stack never writes config.json (canon
+    invariant 2). No Pocket ID source goes in the repository, and the
+    Console gets no
     sign-in path apart from its own OIDC sign-in (REQ-WEB-2).
   - Pocket ID is passkey-only for people. Agents keep per-role service
     tokens.

packages/tasks/requirements.json

@@ -1,6 +1,6 @@
 {
   "prd": "docs/prd/mosaic-stack.md",
-  "version": "1.17",
+  "version": "1.18",
   "requirements": [
     { "id": "REQ-ROLE-1", "title": "Each role is a reviewed roles/<name>.json: contract, authority map, credentials" },
     { "id": "REQ-ROLE-2", "title": "One holder per role instance, one per assistant session; the chief of staff may end a run, others need a decision" },

packages/tasks/tests/requirements.test.mjs

@@ -21,7 +21,7 @@ test("the list holds the PRD's requirement ids, in its order, at its version", (
   assert.equal(ids.length, 87);
   assert.deepEqual(list.requirements.map((r) => r.id), ids);
   assert.match(prd, new RegExp(`^- Status: approved, version ${list.version.replace('.', '\\.')}\\.`, 'm'));
-  assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.17']);
+  assert.deepEqual([list.prd, list.version], ['docs/prd/mosaic-stack.md', '1.18']);
 });
 
 test('the committed list loads frozen', () => {