feat(#707): secure Discord service ingress

CLAUDE.md

@@ -26,14 +26,13 @@ pnpm test             # Vitest (all packages)
 pnpm build            # Build all packages
 
 # Database
-pnpm --filter @mosaicstack/db db:generate  # Offline migration artifact generation only
-# PostgreSQL execution is held until KBN-101-00/-03/-05 land. Do not invoke a runner,
-# init SQL, or Compose PostgreSQL service from this checkout.
+pnpm --filter @mosaicstack/db db:push      # Push schema to PG (dev)
+pnpm --filter @mosaicstack/db db:generate  # Generate migrations
+pnpm --filter @mosaicstack/db db:migrate   # Run migrations
 
-# Dev: local PGlite data-layer work needs no PostgreSQL. Optional local queue service only:
-docker compose up -d valkey
-# Do not start Gateway/Web or root pnpm dev as a local PGlite route: the current unguarded dotenv
-# loader can inherit a daemon PostgreSQL DSN. KBN-101-02 must make that state fail closed first.
+# Dev
+docker compose up -d                  # Start PG, Valkey, OTEL, Jaeger
+pnpm --filter @mosaicstack/gateway exec tsx src/main.ts  # Start gateway
 ```
 
 ## Conventions

README.md

@@ -157,12 +157,7 @@ mosaic storage status
 mosaic storage tier
 mosaic storage export
 mosaic storage import
-# Schema migration is unavailable in this release. The current storage wrapper shells
-# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
-# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
-# --run → runner --verify → readiness. Tier copy uses only the separately held secure
-# migrate-tier route.
+mosaic storage migrate
 ```
 
 ### Telemetry
@@ -197,32 +192,29 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 git clone git@git.mosaicstack.dev:mosaicstack/stack.git
 cd stack
 
-# Install dependencies. The local tier uses in-process PGlite; leave DATABASE_URL unset.
+# Start infrastructure (Postgres, Valkey, Jaeger)
+docker compose up -d
+
+# Install dependencies
 pnpm install
 
-# Optional local queue service only. This does not start PostgreSQL.
-docker compose up -d valkey
+# Run migrations
+pnpm --filter @mosaicstack/db run db:migrate
 
-# The current Gateway/Web local process is held; see docs/guides/dev-guide.md.
-# Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
+# Start all services in dev mode
+pnpm dev
 ```
 
-### Held future procedure
+### Infrastructure
 
-The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
-current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
-invoke initialization SQL, or treat the planned migrator as currently executable.
+Docker Compose provides:
 
-**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
-land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
-`mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
-this README—will provide the reviewed commands and secret-consumer interface.
-
-For local data-layer work, PGlite needs no PostgreSQL service. The optional Compose command above
-starts only Valkey; OTEL Collector and Jaeger may likewise be started individually if needed,
-without starting PostgreSQL. A Gateway/Web local process is not currently a safe PGlite route:
-its unguarded dotenv loader may inherit a daemon PostgreSQL DSN. Do not use root `pnpm dev` or a
-Gateway start command until KBN-101-02 makes that state fail closed.
+| Service               | Port      | Purpose                |
+| --------------------- | --------- | ---------------------- |
+| PostgreSQL (pgvector) | 5433      | Primary database       |
+| Valkey                | 6380      | Task queue + caching   |
+| Jaeger                | 16686     | Distributed tracing UI |
+| OTEL Collector        | 4317/4318 | Telemetry ingestion    |
 
 ### Quality Gates
 
@@ -239,7 +231,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
+- Database migration against a fresh Postgres
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.

apps/gateway/package.json

@@ -31,7 +31,6 @@
     "@mariozechner/pi-ai": "^0.65.0",
     "@mariozechner/pi-coding-agent": "^0.65.0",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@mosaicstack/agent": "workspace:^",
     "@mosaicstack/auth": "workspace:^",
     "@mosaicstack/brain": "workspace:^",
     "@mosaicstack/config": "workspace:^",

apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts

@@ -1,194 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { InMemoryDurableSessionStore } from '@mosaicstack/agent';
-import {
-  createDiscordIngressEnvelope,
-  DiscordPlugin,
-  type DiscordIngressPayload,
-} from '@mosaicstack/discord-plugin';
-import { InteractionController } from '../../agent/interaction.controller.js';
-import { RuntimeProviderService } from '../../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../../agent/durable-session.service.js';
-import { ChatGateway } from '../../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../../commands/command-authorization.service.js';
-
-const SERVICE_TOKEN = 'test-discord-service-token';
-const envKeys = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-] as const;
-const priorEnv = new Map<string, string | undefined>();
-
-function payload(content: string, messageId: string, correlationId: string): DiscordIngressPayload {
-  return {
-    content,
-    messageId,
-    correlationId,
-    guildId: 'guild-1',
-    channelId: 'channel-1',
-    userId: 'discord-admin-1',
-    conversationId: 'Nova:discord:channel-1',
-  };
-}
-
-function authorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  return new CommandAuthorizationService(
-    {
-      select: () => ({
-        from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-      }),
-    } as never,
-    {
-      get: async (key: string) => entries.get(key) ?? null,
-      set: async (key: string, value: string) => entries.set(key, value),
-      del: async (key: string) => Number(entries.delete(key)),
-    },
-  );
-}
-
-describe('interaction Discord/CLI durable-session integration', () => {
-  afterEach(() => {
-    for (const key of envKeys) {
-      const value = priorEnv.get(key);
-      if (value === undefined) delete process.env[key];
-      else process.env[key] = value;
-    }
-    priorEnv.clear();
-  });
-
-  it('enrolls through the CLI surface then resolves the same durable session from Discord', async () => {
-    for (const key of envKeys) priorEnv.set(key, process.env[key]);
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-    process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-1';
-    process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-1';
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-1';
-    process.env['DISCORD_ALLOWED_USER_IDS'] = 'discord-admin-1';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
-        guildId: 'guild-1',
-        channelId: 'channel-1',
-        pairedUsers: {
-          'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-        },
-      },
-    ]);
-
-    const durable = new DurableSessionService(
-      new InMemoryDurableSessionStore() as never,
-      {} as never,
-    );
-    const enrollmentRuntime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const controller = new InteractionController(enrollmentRuntime as never, durable);
-    await controller.enroll(
-      'Nova',
-      'Nova:discord:channel-1',
-      { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      { id: 'mosaic-admin-1', tenantId: 'tenant-1' },
-      'cli-enrollment-correlation',
-    );
-
-    const authz = authorization();
-    const terminated = vi.fn().mockResolvedValue(undefined);
-    const runtime = new RuntimeProviderService(
-      {
-        require: () => ({
-          capabilities: async () => ({ supported: ['session.terminate'] }),
-          terminate: terminated,
-        }),
-      } as never,
-      { record: async () => undefined } as never,
-      {
-        consume: (approvalId, action) =>
-          authz.consumeRuntimeTerminationApproval(approvalId, action),
-      },
-    );
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authz,
-      runtime,
-      durable,
-    );
-    const client = { data: { discordService: true }, emit: vi.fn() };
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-1'],
-      allowedChannelIds: ['channel-1'],
-      allowedUserIds: ['discord-admin-1'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-1',
-          channelId: 'channel-1',
-          pairedUsers: {
-            'discord-admin-1': { role: 'admin', mosaicUserId: 'mosaic-admin-1' },
-          },
-        },
-      ],
-    });
-    const pluginInternals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    const pluginSocket = { connected: true, emit: vi.fn() };
-    pluginInternals.client = { user: { id: 'bot-1' } };
-    pluginInternals.socket = pluginSocket;
-    pluginInternals.handleDiscordMessage({
-      id: 'approve-1',
-      guildId: 'guild-1',
-      channelId: 'channel-1',
-      author: { id: 'discord-admin-1', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-1> /approve',
-      channel: { parentId: null },
-      attachments: new Map(),
-    });
-
-    expect(pluginSocket.emit).toHaveBeenCalledWith('discord:approve', expect.any(Object));
-    const approvalEnvelope = pluginSocket.emit.mock.calls[0]?.[1];
-    await gateway.handleDiscordApproval(client as never, approvalEnvelope);
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      createDiscordIngressEnvelope(
-        payload(`/stop ${approval.approvalId}`, 'stop-1', 'discord-stop-correlation'),
-        SERVICE_TOKEN,
-      ),
-    );
-
-    expect(terminated).toHaveBeenCalledWith(
-      'runtime-1',
-      approval.approvalId,
-      expect.objectContaining({ actorId: 'mosaic-admin-1' }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'discord-stop-correlation',
-      success: true,
-    });
-  });
-});

apps/gateway/src/agent/__tests__/agent-service-ownership.test.ts

@@ -12,24 +12,18 @@ type AgentServiceInternals = {
   creating: Map<string, Promise<AgentSession>>;
 };
 
-function makeService(operatorMemory: unknown = null): AgentService {
+function makeService(): AgentService {
   return new AgentService(
-    {
-      getDefaultModel: vi.fn(() => null),
-      getRegistry: vi.fn(() => ({})),
-      findModel: vi.fn(),
-      listAvailableModels: vi.fn(() => []),
-    } as never,
+    {} as never,
     {} as never,
     {} as never,
     { available: false } as never,
     {} as never,
-    { getToolDefinitions: vi.fn(() => []) } as never,
-    { loadForSession: vi.fn(async () => ({ metaTools: [], promptAdditions: [] })) } as never,
+    {} as never,
+    {} as never,
     null,
     null,
     { collect: vi.fn().mockResolvedValue(undefined) } as never,
-    operatorMemory as never,
   );
 }
 
@@ -115,18 +109,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     ).rejects.toBeInstanceOf(ForbiddenException);
     await service.prompt(CONVERSATION_ID, 'owner prompt', OWNER_SCOPE);
     expect(session.piSession.prompt).toHaveBeenCalledWith('owner prompt');
-    await service.prompt(CONVERSATION_ID, '', OWNER_SCOPE, [
-      {
-        id: 'attachment-001',
-        name: 'diagram.png',
-        url: 'https://cdn.example.test/diagram.png',
-        mimeType: 'image/png',
-      },
-    ]);
-    expect(session.piSession.prompt).toHaveBeenLastCalledWith(
-      '\n\n[Untrusted channel attachments]\n' +
-        '{"id":"attachment-001","name":"diagram.png","mimeType":"image/png","url":"https://cdn.example.test/diagram.png"}',
-    );
 
     await expect(service.destroySession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
       ForbiddenException,
@@ -138,37 +120,6 @@ describe('AgentService owner/tenant scope enforcement', () => {
     expect(internals(service).sessions.has(CONVERSATION_ID)).toBe(false);
   });
 
-  it('derives the operator-memory scope on the createSession production path', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox').mockReturnValue([]);
-
-    // Session construction reaches the real scope derivation before the intentionally incomplete
-    // Pi test double rejects later in createAgentSession.
-    await service.createSession(CONVERSATION_ID, OWNER_SCOPE).catch(() => undefined);
-
-    expect(buildTools).toHaveBeenCalledWith(expect.any(String), OWNER_SCOPE.userId, {
-      tenantId: OWNER_SCOPE.tenantId,
-      ownerId: OWNER_SCOPE.userId,
-      sessionId: CONVERSATION_ID,
-    });
-  });
-
-  it('denies a foreign actor before it can obtain another session operator-memory scope', async () => {
-    const plugin = { capture: vi.fn(), search: vi.fn() };
-    const service = makeService(plugin);
-    internals(service).sessions.set(CONVERSATION_ID, makeSession());
-    const buildTools = vi.spyOn(service as never, 'buildToolsForSandbox');
-
-    await expect(service.createSession(CONVERSATION_ID, FOREIGN_SCOPE)).rejects.toBeInstanceOf(
-      ForbiddenException,
-    );
-
-    expect(buildTools).not.toHaveBeenCalled();
-    expect(plugin.capture).not.toHaveBeenCalled();
-    expect(plugin.search).not.toHaveBeenCalled();
-  });
-
   it('checks owner/tenant scope before returning an in-flight session creation', async () => {
     const service = makeService();
     const session = makeSession();

apps/gateway/src/agent/__tests__/runtime-provider-registry.service.test.ts

@@ -1,370 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import type { ActorTenantScope } from '../../auth/session-scope.js';
-import {
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-  type RuntimeAuditEvent,
-  type RuntimeAuditSink,
-  type RuntimeApprovalVerifier,
-} from '../runtime-provider-registry.service.js';
-
-process.env['MOSAIC_AGENT_NAME'] ??= 'test-runtime-agent';
-
-const OWNER_SCOPE: ActorTenantScope = { userId: 'owner-1', tenantId: 'tenant-1' };
-const CONTEXT = {
-  actorScope: OWNER_SCOPE,
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-class RecordingRuntimeProvider implements AgentRuntimeProvider {
-  readonly id = 'fleet';
-  readonly receivedScopes: RuntimeScope[] = [];
-  readonly sentMessages: RuntimeMessage[] = [];
-  terminateCalls = 0;
-  throwAfterSend = false;
-  throwAuthorization = false;
-
-  constructor(private readonly supported: RuntimeCapability[]) {}
-
-  async capabilities(scope: RuntimeScope): Promise<RuntimeCapabilitySet> {
-    this.receivedScopes.push(scope);
-    return { supported: this.supported };
-  }
-
-  async health(scope: RuntimeScope): Promise<RuntimeHealth> {
-    this.receivedScopes.push(scope);
-    return { status: 'healthy', checkedAt: '2026-07-12T00:00:00.000Z' };
-  }
-
-  async listSessions(scope: RuntimeScope): Promise<RuntimeSession[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async getSessionTree(scope: RuntimeScope): Promise<RuntimeSessionTree[]> {
-    this.receivedScopes.push(scope);
-    return [];
-  }
-
-  async *streamSession(
-    _sessionId: string,
-    _cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    this.receivedScopes.push(scope);
-    return;
-  }
-
-  async sendMessage(
-    _sessionId: string,
-    message: RuntimeMessage,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.sentMessages.push(message);
-    if (this.throwAuthorization) {
-      throw Object.assign(new Error('provider authorization denied'), { code: 'forbidden' });
-    }
-    if (this.throwAfterSend) {
-      throw new Error('provider acknowledgement failed');
-    }
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    this.receivedScopes.push(scope);
-    return {
-      attachmentId: 'attachment-1',
-      sessionId,
-      mode,
-      expiresAt: '2026-07-12T00:00:00.000Z',
-    };
-  }
-
-  async detach(_attachmentId: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-  }
-
-  async terminate(_sessionId: string, _approvalRef: string, scope: RuntimeScope): Promise<void> {
-    this.receivedScopes.push(scope);
-    this.terminateCalls += 1;
-  }
-}
-
-class RecordingAuditSink implements RuntimeAuditSink {
-  readonly events: RuntimeAuditEvent[] = [];
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    this.events.push(event);
-  }
-}
-
-class DenyingApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(): Promise<boolean> {
-    return false;
-  }
-}
-
-class AcceptingApprovalVerifier implements RuntimeApprovalVerifier {
-  consumedAction: Parameters<RuntimeApprovalVerifier['consume']>[1] | undefined;
-
-  async consume(
-    _approvalRef: string,
-    action: Parameters<RuntimeApprovalVerifier['consume']>[1],
-  ): Promise<boolean> {
-    this.consumedAction = action;
-    return true;
-  }
-}
-
-function makeService(
-  provider: RecordingRuntimeProvider,
-  audit: RuntimeAuditSink = new RecordingAuditSink(),
-  approval: RuntimeApprovalVerifier = new DenyingApprovalVerifier(),
-): RuntimeProviderService {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(provider);
-  return new RuntimeProviderService(registry, audit, approval);
-}
-
-describe('RuntimeProviderService security boundary', (): void => {
-  it('derives and freezes only the authenticated actor scope while preserving correlation metadata', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await service.sendMessage(
-      'fleet',
-      'session-1',
-      { content: 'hello', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    const providerScope = provider.receivedScopes[0];
-    expect(providerScope).toEqual({
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-    });
-    expect(Object.isFrozen(providerScope)).toBe(true);
-    expect(audit.events).toContainEqual(
-      expect.objectContaining({
-        providerId: 'fleet',
-        operation: 'session.send',
-        outcome: 'succeeded',
-        actorId: OWNER_SCOPE.userId,
-        tenantId: OWNER_SCOPE.tenantId,
-        channelId: CONTEXT.channelId,
-        correlationId: CONTEXT.correlationId,
-        resourceId: 'session-1',
-        durationMs: expect.any(Number),
-      }),
-    );
-    expect(JSON.stringify(audit.events)).not.toContain('hello');
-    expect(JSON.stringify(audit.events)).not.toContain('key-1');
-  });
-
-  it('does not block a provider operation when an unsafe resource ID is redacted in durable audit', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let persisted: unknown;
-    const durableAudit = new RuntimeProviderAuditService({
-      logs: {
-        ingest: async (entry: unknown): Promise<unknown> => {
-          persisted = entry;
-          return entry;
-        },
-      },
-    } as never);
-    const service = makeService(provider, durableAudit);
-
-    await service.sendMessage(
-      'fleet',
-      'session/credential-canary=secret-value',
-      { content: 'safe message', idempotencyKey: 'key-1' },
-      CONTEXT,
-    );
-
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(JSON.stringify(persisted)).not.toContain('secret-value');
-  });
-
-  it('fails closed before a provider side effect when a capability is missing', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider([]);
-    const service = makeService(provider);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/capability denied/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('requires a consumed exact-action approval before termination', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new DenyingApprovalVerifier();
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit, approval);
-
-    await expect(
-      service.terminate('fleet', 'session-1', 'forged-approval', CONTEXT),
-    ).rejects.toThrow(/approval denied/);
-    expect(provider.terminateCalls).toBe(0);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('binds an accepted termination approval to provider, session, immutable scope, and correlation', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.terminate']);
-    const approval = new AcceptingApprovalVerifier();
-    const service = makeService(provider, new RecordingAuditSink(), approval);
-
-    await service.terminate('fleet', 'session-1', 'approval-1', CONTEXT);
-
-    expect(approval.consumedAction).toEqual({
-      providerId: 'fleet',
-      sessionId: 'session-1',
-      actorId: OWNER_SCOPE.userId,
-      tenantId: OWNER_SCOPE.tenantId,
-      channelId: CONTEXT.channelId,
-      correlationId: CONTEXT.correlationId,
-      agentName: process.env['MOSAIC_AGENT_NAME'],
-    });
-    expect(provider.terminateCalls).toBe(1);
-  });
-
-  it('fails closed before invoking a provider when audit persistence rejects the request', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    const unavailableAudit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        throw new Error('audit unavailable');
-      },
-    };
-    const service = makeService(provider, unavailableAudit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/audit unavailable/);
-    expect(provider.sentMessages).toEqual([]);
-  });
-
-  it('records a provider error after invocation as failed rather than denied', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAfterSend = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider acknowledgement failed/);
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(audit.events.map((event: RuntimeAuditEvent): string => event.outcome)).toEqual([
-      'requested',
-      'failed',
-    ]);
-    expect(audit.events.at(-1)).toMatchObject({
-      errorCode: 'provider_error',
-      durationMs: expect.any(Number),
-    });
-  });
-
-  it('records a provider authorization rejection as denied rather than provider failure', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    provider.throwAuthorization = true;
-    const audit = new RecordingAuditSink();
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).rejects.toThrow(/provider authorization denied/);
-    expect(audit.events.at(-1)).toMatchObject({ outcome: 'denied', errorCode: 'policy_denied' });
-  });
-
-  it('persists only metadata-only runtime audit fields', async (): Promise<void> => {
-    let persisted: unknown;
-    const ingest = async (entry: unknown): Promise<unknown> => {
-      persisted = entry;
-      return entry;
-    };
-    const service = new RuntimeProviderAuditService({ logs: { ingest } } as never);
-
-    await service.record({
-      providerId: 'fleet',
-      operation: 'session.send',
-      outcome: 'succeeded',
-      actorId: 'owner-1',
-      tenantId: 'tenant-1',
-      channelId: 'cli',
-      correlationId: 'correlation-1',
-      resourceId: 'session-1',
-      durationMs: 12,
-    });
-
-    expect(persisted).toMatchObject({
-      content: 'runtime.provider.audit',
-      metadata: expect.objectContaining({ correlationId: 'correlation-1', durationMs: 12 }),
-    });
-    expect(JSON.stringify(persisted)).not.toContain('approval');
-  });
-
-  it('does not misreport a completed provider side effect when completion auditing fails', async (): Promise<void> => {
-    const provider = new RecordingRuntimeProvider(['session.send']);
-    let auditCalls = 0;
-    const audit: RuntimeAuditSink = {
-      async record(): Promise<void> {
-        auditCalls += 1;
-        if (auditCalls === 2) {
-          throw new Error('completion audit unavailable');
-        }
-      },
-    };
-    const service = makeService(provider, audit);
-
-    await expect(
-      service.sendMessage(
-        'fleet',
-        'session-1',
-        { content: 'hello', idempotencyKey: 'key-1' },
-        CONTEXT,
-      ),
-    ).resolves.toBeUndefined();
-    expect(provider.sentMessages).toHaveLength(1);
-    expect(auditCalls).toBe(2);
-  });
-});

apps/gateway/src/agent/agent.module.ts

@@ -1,5 +1,4 @@
 import { Global, Module } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry, HermesRuntimeProvider } from '@mosaicstack/agent';
 import { AgentService } from './agent.service.js';
 import { ProviderService } from './provider.service.js';
 import { ProviderCredentialsService } from './provider-credentials.service.js';
@@ -9,79 +8,24 @@ import { SkillLoaderService } from './skill-loader.service.js';
 import { ProvidersController } from './providers.controller.js';
 import { SessionsController } from './sessions.controller.js';
 import { AgentConfigsController } from './agent-configs.controller.js';
-import { InteractionController } from './interaction.controller.js';
 import { RoutingController } from './routing/routing.controller.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
 import { CoordModule } from '../coord/coord.module.js';
 import { McpClientModule } from '../mcp-client/mcp-client.module.js';
 import { SkillsModule } from '../skills/skills.module.js';
 import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import { CommandRuntimeApprovalVerifier } from '../commands/runtime-approval-verifier.js';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  DenyConnectorLeasePolicy,
-} from './connector-lease.service.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
-
-export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegistry {
-  const registry = new AgentRuntimeProviderRegistry();
-  registry.register(new HermesRuntimeProvider(new GatewayHermesRuntimeTransport()));
-  return registry;
-}
 
 @Global()
 @Module({
-  imports: [CoordModule, McpClientModule, SkillsModule, GCModule, LogModule, CommandsModule],
+  imports: [CoordModule, McpClientModule, SkillsModule, GCModule],
   providers: [
     ProviderService,
     ProviderCredentialsService,
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionRepository,
-    DurableSessionService,
-    ConnectorLeaseRepository,
-    DenyConnectorLeasePolicy,
-    {
-      provide: CONNECTOR_LEASE_POLICY,
-      useExisting: DenyConnectorLeasePolicy,
-    },
-    ConnectorLeaseService,
-    {
-      provide: AGENT_RUNTIME_PROVIDER_REGISTRY,
-      useFactory: createGatewayRuntimeProviderRegistry,
-    },
-    RuntimeProviderAuditService,
-    {
-      provide: RUNTIME_PROVIDER_AUDIT_SINK,
-      useExisting: RuntimeProviderAuditService,
-    },
-    {
-      provide: RUNTIME_APPROVAL_VERIFIER,
-      useExisting: CommandRuntimeApprovalVerifier,
-    },
-    RuntimeProviderService,
     AgentService,
   ],
-  controllers: [
-    ProvidersController,
-    SessionsController,
-    AgentConfigsController,
-    InteractionController,
-    RoutingController,
-  ],
+  controllers: [ProvidersController, SessionsController, AgentConfigsController, RoutingController],
   exports: [
     AgentService,
     ProviderService,
@@ -89,10 +33,6 @@ export function createGatewayRuntimeProviderRegistry(): AgentRuntimeProviderRegi
     RoutingService,
     RoutingEngineService,
     SkillLoaderService,
-    DurableSessionService,
-    RuntimeProviderService,
-    ConnectorLeaseService,
-    AGENT_RUNTIME_PROVIDER_REGISTRY,
   ],
 })
 export class AgentModule {}

apps/gateway/src/agent/agent.service.ts

@@ -15,11 +15,9 @@ import {
   type ToolDefinition,
 } from '@mariozechner/pi-coding-agent';
 import type { Brain } from '@mosaicstack/brain';
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
-import type { Memory, OperatorMemoryPlugin } from '@mosaicstack/memory';
+import type { Memory } from '@mosaicstack/memory';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { MEMORY } from '../memory/memory.tokens.js';
-import { OPERATOR_MEMORY_PLUGIN } from '../memory/memory.module.js';
 import { EmbeddingService } from '../memory/embedding.service.js';
 import { CoordService } from '../coord/coord.service.js';
 import { ProviderService } from './provider.service.js';
@@ -44,8 +42,6 @@ export interface ConversationHistoryMessage {
   role: 'user' | 'assistant' | 'system';
   content: string;
   createdAt: Date;
-  /** Validated, URI-referenced channel attachments preserved on session resume. */
-  attachments?: readonly ChannelAttachmentDto[];
 }
 
 export interface AgentSessionOptions {
@@ -139,9 +135,6 @@ export class AgentService implements OnModuleDestroy {
     @Inject(PreferencesService)
     private readonly preferencesService: PreferencesService | null,
     @Inject(SessionGCService) private readonly gc: SessionGCService,
-    @Optional()
-    @Inject(OPERATOR_MEMORY_PLUGIN)
-    private readonly operatorMemory: OperatorMemoryPlugin | null = null,
   ) {}
 
   /**
@@ -153,7 +146,6 @@ export class AgentService implements OnModuleDestroy {
   private buildToolsForSandbox(
     sandboxDir: string,
     sessionUserId: string | undefined,
-    sessionScope?: { tenantId: string; ownerId: string; sessionId: string },
   ): ToolDefinition[] {
     return [
       ...createBrainTools(this.brain),
@@ -162,9 +154,6 @@ export class AgentService implements OnModuleDestroy {
         this.memory,
         this.embeddingService.available ? this.embeddingService : null,
         sessionUserId,
-        this.operatorMemory && sessionScope
-          ? { plugin: this.operatorMemory, scope: sessionScope }
-          : undefined,
       ),
       ...createFileTools(sandboxDir),
       ...createGitTools(sandboxDir),
@@ -239,7 +228,6 @@ export class AgentService implements OnModuleDestroy {
           isAdmin: options.isAdmin,
           agentConfigId: options.agentConfigId,
           userId: options.userId,
-          tenantId: options.tenantId,
           conversationHistory: options.conversationHistory,
         };
         this.logger.log(
@@ -279,15 +267,7 @@ export class AgentService implements OnModuleDestroy {
     }
 
     // Build per-session tools scoped to the sandbox directory and authenticated user
-    const sessionUserId = mergedOptions?.userId;
-    const sessionTenantId = this.tenantIdFor(sessionUserId, mergedOptions?.tenantId);
-    const sandboxTools = this.buildToolsForSandbox(
-      sandboxDir,
-      sessionUserId,
-      sessionUserId && sessionTenantId
-        ? { tenantId: sessionTenantId, ownerId: sessionUserId, sessionId }
-        : undefined,
-    );
+    const sandboxTools = this.buildToolsForSandbox(sandboxDir, mergedOptions?.userId);
 
     // Combine static tools with dynamically discovered MCP client tools and skill tools
     const mcpTools = this.mcpClientService.getToolDefinitions();
@@ -382,7 +362,7 @@ export class AgentService implements OnModuleDestroy {
       sandboxDir,
       allowedTools,
       userId: mergedOptions?.userId,
-      tenantId: sessionTenantId,
+      tenantId: this.tenantIdFor(mergedOptions?.userId, mergedOptions?.tenantId),
       agentConfigId: mergedOptions?.agentConfigId,
       agentName: resolvedAgentName,
       metrics: {
@@ -431,7 +411,7 @@ export class AgentService implements OnModuleDestroy {
     const formatMessage = (msg: ConversationHistoryMessage): string => {
       const roleLabel =
         msg.role === 'user' ? 'User' : msg.role === 'assistant' ? 'Assistant' : 'System';
-      return `**${roleLabel}:** ${msg.content}${this.attachmentContext(msg.attachments ?? [])}`;
+      return `**${roleLabel}:** ${msg.content}`;
     };
 
     const formatted = history.map((msg) => formatMessage(msg));
@@ -490,21 +470,6 @@ export class AgentService implements OnModuleDestroy {
     return result;
   }
 
-  private attachmentContext(attachments: readonly ChannelAttachmentDto[]): string {
-    if (attachments.length === 0) return '';
-    return `\n\n[Untrusted channel attachments]\n${attachments
-      .map((attachment: ChannelAttachmentDto): string =>
-        JSON.stringify({
-          id: attachment.id,
-          name: attachment.name,
-          mimeType: attachment.mimeType,
-          url: attachment.url,
-          ...(attachment.sizeBytes !== undefined ? { sizeBytes: attachment.sizeBytes } : {}),
-        }),
-      )
-      .join('\n')}`;
-  }
-
   private resolveModel(options?: AgentSessionOptions) {
     if (!options?.provider && !options?.modelId) {
       return this.providerService.getDefaultModel() ?? null;
@@ -691,19 +656,7 @@ export class AgentService implements OnModuleDestroy {
     session.channels.delete(channel);
   }
 
-  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void>;
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] | undefined,
-  ): Promise<void>;
-  async prompt(
-    sessionId: string,
-    message: string,
-    scope: ActorTenantScope,
-    attachments: readonly ChannelAttachmentDto[] = [],
-  ): Promise<void> {
+  async prompt(sessionId: string, message: string, scope: ActorTenantScope): Promise<void> {
     const session = this.sessions.get(sessionId);
     if (!session) {
       throw new Error(`No agent session found: ${sessionId}`);
@@ -711,16 +664,12 @@ export class AgentService implements OnModuleDestroy {
     this.assertSessionScope(session, scope);
     session.promptCount += 1;
 
-    // Channel attachments are untrusted URI references. Preserve exact,
-    // authenticated metadata for the agent without treating it as authority.
-    const attachmentContext = this.attachmentContext(attachments);
-
     // Prepend session-scoped system override if present (renew TTL on each turn)
-    let effectiveMessage = `${message}${attachmentContext}`;
+    let effectiveMessage = message;
     if (this.systemOverride) {
       const override = await this.systemOverride.get(sessionId, scope);
       if (override) {
-        effectiveMessage = `[System Override]\n${override}\n\n${effectiveMessage}`;
+        effectiveMessage = `[System Override]\n${override}\n\n${message}`;
         await this.systemOverride.renew(sessionId, scope);
         this.logger.debug(`Applied system override for session ${sessionId}`);
       }

apps/gateway/src/agent/connector-lease.integration.test.ts

@@ -1,341 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Test, type TestingModule } from '@nestjs/testing';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import type { ConnectorExecutionContext, FencedConnectorAdapter } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-import {
-  CONNECTOR_LEASE_POLICY,
-  ConnectorLeaseService,
-  type ConnectorLeasePolicy,
-  type ConnectorLeasePolicySubject,
-} from './connector-lease.service.js';
-
-const authorize = vi.fn().mockResolvedValue(true);
-const policy: ConnectorLeasePolicy = { authorize };
-const context = {
-  actorScope: { userId: 'operator-a', tenantId: 'tenant-a' },
-  correlationId: 'correlation-acquire',
-};
-
-describe('gateway connector lease fencing integration', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let moduleRef: TestingModule;
-  let service: ConnectorLeaseService;
-  let repository: ConnectorLeaseRepository;
-
-  beforeAll(async (): Promise<void> => {
-    vi.useFakeTimers();
-    vi.setSystemTime(new Date('2026-07-14T17:00:00.000Z'));
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-gateway-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    moduleRef = await Test.createTestingModule({
-      providers: [
-        ConnectorLeaseRepository,
-        ConnectorLeaseService,
-        { provide: DB, useValue: handle.db },
-        { provide: CONNECTOR_LEASE_POLICY, useValue: policy },
-      ],
-    }).compile();
-    service = moduleRef.get(ConnectorLeaseService);
-    repository = moduleRef.get(ConnectorLeaseRepository);
-  });
-
-  afterAll(async (): Promise<void> => {
-    vi.useRealTimers();
-    await moduleRef.close();
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('derives tenant authority at the gateway and validates a grant before side effects', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'Mos',
-        bindingId: 'operator-chat',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      context,
-    );
-    const grant = await service.issueGrant(
-      { lease, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-grant' },
-    );
-    const execute = vi.fn(async (_message: string, leaseContext: ConnectorExecutionContext) => {
-      return leaseContext.leaseEpoch;
-    });
-    const adapter: FencedConnectorAdapter<string, string> = { execute };
-
-    await expect(service.executeGrant(grant, 'runtime.send', 'hello', adapter)).resolves.toBe('1');
-    expect(execute).toHaveBeenCalledOnce();
-    expect(authorize).toHaveBeenCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        requestedScopes: ['runtime.send'],
-        requestedTtlMs: 30_000,
-      }),
-    );
-    expect(execute.mock.calls[0]?.[1]).toMatchObject({
-      identity: { tenantId: 'tenant-a', logicalAgentId: 'mos' },
-      bindingId: 'operator-chat',
-      connectorId: 'pi-worker-a',
-    });
-  });
-
-  it('normalizes lease-derived policy subjects before authorization', async (): Promise<void> => {
-    const lease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-policy-setup' },
-    );
-    const aliasedLease = {
-      ...lease,
-      identity: { ...lease.identity, logicalAgentId: ' MOS ' },
-      bindingId: ' Operator-Chat-Policy ',
-      connectorId: ' PI-Worker-A ',
-      scopes: [' Runtime.Send '],
-      leaseEpoch: `00${lease.leaseEpoch}`,
-    };
-
-    await service.heartbeat(aliasedLease, 30_000, {
-      ...context,
-      correlationId: 'correlation-policy-heartbeat',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.heartbeat',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.issueGrant(
-      { lease: aliasedLease, scopes: [' Runtime.Send '], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-policy-grant' },
-    );
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'grant.issue',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-
-    await service.release(aliasedLease, {
-      ...context,
-      correlationId: 'correlation-policy-release',
-    });
-    expect(authorize).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        action: 'lease.release',
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-policy',
-        connectorId: 'pi-worker-a',
-        requestedScopes: ['runtime.send'],
-      }),
-    );
-  });
-
-  it('denies stale, forged, expired, cross-tenant, and cross-binding grants before effects', async (): Promise<void> => {
-    const bindingId = 'operator-chat-denials';
-    const current = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-denial-setup' },
-    );
-    const stale = await service.issueGrant(
-      { lease: current, scopes: ['runtime.send'], ttlMs: 30_000 },
-      { ...context, correlationId: 'correlation-stale' },
-    );
-    await service.takeover(
-      {
-        logicalAgentId: 'mos',
-        bindingId,
-        connectorId: 'pi-worker-b',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-        expectedEpoch: current.leaseEpoch,
-      },
-      { ...context, correlationId: 'correlation-takeover' },
-    );
-    const adapter = { execute: vi.fn().mockResolvedValue(undefined) };
-
-    await expect(service.executeGrant(stale, 'runtime.send', undefined, adapter)).rejects.toThrow();
-
-    const active = await service.current('mos', bindingId, context);
-    if (!active) throw new Error('active lease fixture is unavailable');
-    const grant = await service.issueGrant(
-      { lease: active, scopes: ['runtime.send'], ttlMs: 1_000 },
-      { ...context, correlationId: 'correlation-active' },
-    );
-    await expect(
-      service.executeGrant({ ...grant }, 'runtime.send', undefined, adapter),
-    ).rejects.toThrow();
-    await expect(
-      service.executeGrant(
-        { ...grant, bindingId: 'other-binding' },
-        'runtime.send',
-        undefined,
-        adapter,
-      ),
-    ).rejects.toThrow();
-    await expect(
-      service.issueGrant(
-        { lease: active, scopes: ['runtime.send'], ttlMs: 30_000 },
-        {
-          actorScope: { userId: 'operator-b', tenantId: 'tenant-b' },
-          correlationId: 'correlation-cross-tenant',
-        },
-      ),
-    ).rejects.toThrow();
-    const crossTenantAudit = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-cross-tenant'));
-    expect(crossTenantAudit).toHaveLength(1);
-    expect(crossTenantAudit[0]).toMatchObject({
-      tenantId: 'tenant-b',
-      logicalAgentId: 'untrusted',
-      bindingId: 'untrusted',
-      connectorId: 'untrusted',
-      reason: 'policy_denied',
-    });
-
-    vi.setSystemTime(new Date('2026-07-14T17:00:02.000Z'));
-    await expect(service.executeGrant(grant, 'runtime.send', undefined, adapter)).rejects.toThrow();
-    expect(adapter.execute).not.toHaveBeenCalled();
-  });
-
-  it('rejects submitted lifecycle scopes that differ from durable authority before policy or mutation', async (): Promise<void> => {
-    authorize.mockResolvedValue(true);
-    const heartbeatLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-heartbeat-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-heartbeat-scope-setup' },
-    );
-    const releaseLease = await service.acquire(
-      {
-        logicalAgentId: 'mos',
-        bindingId: 'operator-chat-release-scope',
-        connectorId: 'pi-worker-a',
-        scopes: ['runtime.send'],
-        ttlMs: 60_000,
-      },
-      { ...context, correlationId: 'correlation-release-scope-setup' },
-    );
-    const forgedHeartbeat = { ...heartbeatLease, scopes: ['tool.execute'] };
-    const forgedRelease = { ...releaseLease, scopes: ['tool.execute'] };
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'tool.execute';
-    });
-    authorize.mockClear();
-
-    await expect(
-      service.heartbeat(forgedHeartbeat, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    await expect(
-      service.release(forgedRelease, {
-        ...context,
-        correlationId: 'correlation-release-scope-forgery',
-      }),
-    ).rejects.toThrow('Connector authority policy denied');
-    expect(authorize).not.toHaveBeenCalled();
-
-    const currentHeartbeat = await repository.findCurrent({
-      identity: heartbeatLease.identity,
-      bindingId: heartbeatLease.bindingId,
-    });
-    const currentRelease = await repository.findCurrent({
-      identity: releaseLease.identity,
-      bindingId: releaseLease.bindingId,
-    });
-    expect(currentHeartbeat).toMatchObject({
-      leaseId: heartbeatLease.leaseId,
-      scopes: ['runtime.send'],
-      heartbeatAt: heartbeatLease.heartbeatAt,
-      expiresAt: heartbeatLease.expiresAt,
-    });
-    expect(currentRelease).toMatchObject({
-      leaseId: releaseLease.leaseId,
-      scopes: ['runtime.send'],
-    });
-    expect(currentRelease?.releasedAt).toBeUndefined();
-
-    const forgedAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-heartbeat-scope-forgery'));
-    expect(forgedAudits).toHaveLength(1);
-    expect(forgedAudits[0]).toMatchObject({
-      bindingId: heartbeatLease.bindingId,
-      connectorId: heartbeatLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-    const forgedReleaseAudits = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-release-scope-forgery'));
-    expect(forgedReleaseAudits).toHaveLength(1);
-    expect(forgedReleaseAudits[0]).toMatchObject({
-      bindingId: releaseLease.bindingId,
-      connectorId: releaseLease.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-    });
-
-    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
-      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'runtime.send';
-    });
-    await expect(
-      service.heartbeat(heartbeatLease, 30_000, {
-        ...context,
-        correlationId: 'correlation-heartbeat-scope-canonical',
-      }),
-    ).resolves.toMatchObject({ scopes: ['runtime.send'] });
-    await expect(
-      service.release(releaseLease, {
-        ...context,
-        correlationId: 'correlation-release-scope-canonical',
-      }),
-    ).resolves.toBeUndefined();
-  });
-});

apps/gateway/src/agent/connector-lease.postgres.integration.test.ts

@@ -1,76 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createDb,
-  eq,
-  logicalAgentConnectorLeases,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const hasPostgres = Boolean(process.env['DATABASE_URL']);
-const tenantId = `lease-test-${randomUUID()}`;
-const identity = { tenantId, logicalAgentId: 'mos' } as const;
-
-describe.skipIf(!hasPostgres)('ConnectorLeaseRepository real PostgreSQL integration', (): void => {
-  let handle: DbHandle;
-
-  beforeAll((): void => {
-    handle = createDb(process.env['DATABASE_URL']);
-  });
-
-  afterAll(async (): Promise<void> => {
-    if (!handle) return;
-    await handle.db
-      .delete(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, tenantId));
-    await handle.db
-      .delete(logicalAgentConnectorLeases)
-      .where(eq(logicalAgentConnectorLeases.tenantId, tenantId));
-    await handle.close();
-  });
-
-  it('preserves the exclusive CAS fence across a real pool close/reopen', async (): Promise<void> => {
-    const command = {
-      identity,
-      bindingId: 'operator-chat',
-      scopes: ['runtime.send'],
-      ttlMs: 60_000,
-    } as const;
-    const firstCoordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const contenders = await Promise.allSettled([
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-a',
-        correlationId: 'postgres-acquire-a',
-      }),
-      firstCoordinator.acquire({
-        ...command,
-        connectorId: 'connector-b',
-        correlationId: 'postgres-acquire-b',
-      }),
-    ]);
-    const acquired = contenders.find((result) => result.status === 'fulfilled');
-    if (!acquired || acquired.status !== 'fulfilled') throw new Error('no lease contender won');
-    expect(contenders.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-
-    await handle.close();
-    handle = createDb(process.env['DATABASE_URL']);
-    const reopened = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db));
-    const persisted = await reopened.current({ identity, bindingId: 'operator-chat' });
-    expect(persisted).toMatchObject({
-      leaseId: acquired.value.leaseId,
-      leaseEpoch: '1',
-    });
-
-    const takeover = await reopened.takeover({
-      ...command,
-      connectorId: 'connector-c',
-      correlationId: 'postgres-takeover',
-      expectedEpoch: acquired.value.leaseEpoch,
-    });
-    expect(takeover).toMatchObject({ connectorId: 'connector-c', leaseEpoch: '2' });
-  });
-});

apps/gateway/src/agent/connector-lease.repository.test.ts

@@ -1,149 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  connectorLeaseAuditLog,
-  createPgliteDb,
-  eq,
-  runPgliteMigrations,
-  type DbHandle,
-} from '@mosaicstack/db';
-import { ConnectorLeaseCoordinator, ConnectorLeaseError } from '@mosaicstack/agent';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-const identity = { tenantId: 'tenant-a', logicalAgentId: 'mos' } as const;
-
-function acquireCommand(connectorId: string, correlationId: string) {
-  return {
-    identity,
-    bindingId: 'operator-chat',
-    connectorId,
-    scopes: ['runtime.send', 'tool.execute'],
-    ttlMs: 60_000,
-    correlationId,
-  };
-}
-
-describe('ConnectorLeaseRepository PostgreSQL semantics', (): void => {
-  let dataDir: string;
-  let handle: DbHandle;
-  let now: Date;
-  let coordinator: ConnectorLeaseCoordinator;
-
-  beforeEach(async (): Promise<void> => {
-    dataDir = await mkdtemp(join(tmpdir(), 'mosaic-connector-lease-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    now = new Date('2026-07-14T17:00:00.000Z');
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-  });
-
-  afterEach(async (): Promise<void> => {
-    await handle.close();
-    await rm(dataDir, { recursive: true, force: true });
-  });
-
-  it('allows only one concurrent contender to acquire a binding', async (): Promise<void> => {
-    const outcomes = await Promise.allSettled([
-      coordinator.acquire(acquireCommand('connector-a', 'correlation-a')),
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-b')),
-    ]);
-
-    expect(outcomes.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    const rejected = outcomes.find((result) => result.status === 'rejected');
-    expect(rejected).toMatchObject({
-      reason: { code: 'lease_held' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('uses compare-and-swap takeover and increments the fencing epoch monotonically', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    const results = await Promise.allSettled([
-      coordinator.takeover({
-        ...acquireCommand('connector-b', 'correlation-b'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-      coordinator.takeover({
-        ...acquireCommand('connector-c', 'correlation-c'),
-        expectedEpoch: acquired.leaseEpoch,
-      }),
-    ]);
-    const winner = results.find((result) => result.status === 'fulfilled');
-
-    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
-    expect(winner?.status === 'fulfilled' ? winner.value.leaseEpoch : null).toBe('2');
-    expect(results.find((result) => result.status === 'rejected')).toMatchObject({
-      reason: { code: 'cas_mismatch' } satisfies Partial<ConnectorLeaseError>,
-    });
-  });
-
-  it('heartbeats and releases only the current connector epoch', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    now = new Date('2026-07-14T17:00:30.000Z');
-    const renewed = await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 120_000,
-      correlationId: 'correlation-renew',
-    });
-    expect(renewed.expiresAt).toBe('2026-07-14T17:02:30.000Z');
-
-    await coordinator.release({ lease: renewed, correlationId: 'correlation-release' });
-    await expect(
-      coordinator.heartbeat({
-        lease: renewed,
-        ttlMs: 120_000,
-        correlationId: 'correlation-stale',
-      }),
-    ).rejects.toMatchObject({ code: 'lease_released' } satisfies Partial<ConnectorLeaseError>);
-  });
-
-  it('survives close/reopen and requires CAS takeover to recover an expired lease', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await handle.close();
-
-    now = new Date('2026-07-14T17:02:00.000Z');
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    coordinator = new ConnectorLeaseCoordinator(new ConnectorLeaseRepository(handle.db), {
-      now: (): Date => now,
-    });
-
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-plain-acquire')),
-    ).rejects.toMatchObject({ code: 'takeover_required' } satisfies Partial<ConnectorLeaseError>);
-    const recovered = await coordinator.takeover({
-      ...acquireCommand('connector-b', 'correlation-takeover'),
-      expectedEpoch: acquired.leaseEpoch,
-    });
-    expect(recovered).toMatchObject({ connectorId: 'connector-b', leaseEpoch: '2' });
-  });
-
-  it('writes credential-safe lifecycle and rejection audit records', async (): Promise<void> => {
-    const acquired = await coordinator.acquire(acquireCommand('connector-a', 'correlation-a'));
-    await coordinator.heartbeat({
-      lease: acquired,
-      ttlMs: 60_000,
-      correlationId: 'correlation-renew',
-    });
-    await expect(
-      coordinator.acquire(acquireCommand('connector-b', 'correlation-reject')),
-    ).rejects.toBeInstanceOf(ConnectorLeaseError);
-
-    const rows = await handle.db
-      .select()
-      .from(connectorLeaseAuditLog)
-      .where(eq(connectorLeaseAuditLog.tenantId, identity.tenantId));
-    expect(rows.map((row) => row.event)).toEqual(
-      expect.arrayContaining(['acquire', 'renew', 'reject']),
-    );
-    const serialized = JSON.stringify(rows, (_key: string, value: unknown): unknown =>
-      typeof value === 'bigint' ? value.toString(10) : value,
-    );
-    expect(serialized).not.toContain('tool.execute');
-    expect(serialized).not.toContain('runtime.send');
-    expect(serialized).not.toMatch(/token|secret|credential/i);
-  });
-});

apps/gateway/src/agent/connector-lease.repository.ts

@@ -1,354 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  connectorLeaseAuditLog,
-  eq,
-  gt,
-  isNull,
-  logicalAgentConnectorLeases,
-  sql,
-  type Db,
-} from '@mosaicstack/db';
-import { ConnectorLeaseError } from '@mosaicstack/agent';
-import type {
-  ConnectorLease,
-  ConnectorLeaseAcquireMutation,
-  ConnectorLeaseAuditEvent,
-  ConnectorLeaseHeartbeatMutation,
-  ConnectorLeaseRejectReason,
-  ConnectorLeaseReleaseMutation,
-  ConnectorLeaseStore,
-  ConnectorLeaseTakeoverMutation,
-  LogicalAgentBinding,
-} from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-
-interface SuccessfulMutation {
-  readonly ok: true;
-  readonly lease: ConnectorLease;
-}
-
-interface FailedMutation {
-  readonly ok: false;
-  readonly reason: ConnectorLeaseRejectReason;
-}
-
-type MutationResult = SuccessfulMutation | FailedMutation;
-
-@Injectable()
-export class ConnectorLeaseRepository implements ConnectorLeaseStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async acquire(input: ConnectorLeaseAcquireMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const inserted = await tx
-          .insert(logicalAgentConnectorLeases)
-          .values({
-            leaseId: input.leaseId,
-            tenantId: input.identity.tenantId,
-            logicalAgentId: input.identity.logicalAgentId,
-            bindingId: input.bindingId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: 1n,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .onConflictDoNothing()
-          .returning();
-        const row = inserted[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'acquire'));
-          return { ok: true, lease };
-        }
-
-        const current = await findRow(tx, input);
-        if (current && current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const reason: ConnectorLeaseRejectReason =
-          current && (current.releasedAt || current.expiresAt <= new Date(input.now))
-            ? 'takeover_required'
-            : 'lease_held';
-        await insertAudit(tx, rejectionAudit(input, current ? toLease(current) : null, reason));
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async takeover(input: ConnectorLeaseTakeoverMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const current = await findRow(tx, input);
-        if (!current || current.leaseEpoch.toString(10) !== input.expectedEpoch) {
-          await insertAudit(
-            tx,
-            rejectionAudit(input, current ? toLease(current) : null, 'cas_mismatch'),
-          );
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        if (current.expiresAt <= new Date(input.now) && !current.releasedAt) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            leaseId: input.leaseId,
-            connectorId: input.connectorId,
-            scopes: [...input.scopes],
-            leaseEpoch: sql`${logicalAgentConnectorLeases.leaseEpoch} + 1`,
-            acquiredAt: new Date(input.now),
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            releasedAt: null,
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input),
-              eq(logicalAgentConnectorLeases.leaseId, current.leaseId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.expectedEpoch)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (!row) {
-          await insertAudit(tx, rejectionAudit(input, toLease(current), 'cas_mismatch'));
-          return { ok: false, reason: 'cas_mismatch' };
-        }
-        const lease = toLease(row);
-        await insertAudit(tx, lifecycleAudit(input, lease, 'takeover'));
-        return { ok: true, lease };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async heartbeat(input: ConnectorLeaseHeartbeatMutation): Promise<ConnectorLease> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            heartbeatAt: new Date(input.now),
-            expiresAt: new Date(input.expiresAt),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'renew'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    return unwrap(result);
-  }
-
-  async release(input: ConnectorLeaseReleaseMutation): Promise<void> {
-    const result: MutationResult = await this.db.transaction(
-      async (tx): Promise<MutationResult> => {
-        const updated = await tx
-          .update(logicalAgentConnectorLeases)
-          .set({
-            releasedAt: new Date(input.now),
-            expiresAt: new Date(input.now),
-            updatedAt: new Date(input.now),
-          })
-          .where(
-            and(
-              bindingPredicate(input.lease),
-              eq(logicalAgentConnectorLeases.leaseId, input.lease.leaseId),
-              eq(logicalAgentConnectorLeases.connectorId, input.lease.connectorId),
-              eq(logicalAgentConnectorLeases.leaseEpoch, BigInt(input.lease.leaseEpoch)),
-              isNull(logicalAgentConnectorLeases.releasedAt),
-              gt(logicalAgentConnectorLeases.expiresAt, new Date(input.now)),
-            ),
-          )
-          .returning();
-        const row = updated[0];
-        if (row) {
-          const lease = toLease(row);
-          await insertAudit(tx, lifecycleAudit(input, lease, 'release'));
-          return { ok: true, lease };
-        }
-        const current = await findRow(tx, input.lease);
-        const reason = classifyAuthorityFailure(
-          current ? toLease(current) : null,
-          input.lease,
-          input.now,
-        );
-        if (reason === 'lease_expired' && current) {
-          await insertAudit(tx, lifecycleAudit(input, toLease(current), 'expiry'));
-        }
-        await insertAudit(
-          tx,
-          rejectionAudit(
-            { ...input.lease, correlationId: input.correlationId, now: input.now },
-            current ? toLease(current) : null,
-            reason,
-          ),
-        );
-        return { ok: false, reason };
-      },
-    );
-    unwrap(result);
-  }
-
-  async findCurrent(binding: LogicalAgentBinding): Promise<ConnectorLease | null> {
-    const row = await findRow(this.db, binding);
-    return row ? toLease(row) : null;
-  }
-
-  async recordAudit(event: ConnectorLeaseAuditEvent): Promise<void> {
-    await insertAudit(this.db, event);
-  }
-}
-
-function unwrap(result: MutationResult): ConnectorLease {
-  if (!result.ok) throw new ConnectorLeaseError(result.reason, safeErrorMessage(result.reason));
-  return result.lease;
-}
-
-function safeErrorMessage(reason: ConnectorLeaseRejectReason): string {
-  return `Connector lease mutation denied: ${reason}`;
-}
-
-function bindingPredicate(binding: LogicalAgentBinding) {
-  return and(
-    eq(logicalAgentConnectorLeases.tenantId, binding.identity.tenantId),
-    eq(logicalAgentConnectorLeases.logicalAgentId, binding.identity.logicalAgentId),
-    eq(logicalAgentConnectorLeases.bindingId, binding.bindingId),
-  );
-}
-
-async function findRow(
-  db: Pick<Db, 'select'>,
-  binding: LogicalAgentBinding,
-): Promise<typeof logicalAgentConnectorLeases.$inferSelect | null> {
-  const rows = await db
-    .select()
-    .from(logicalAgentConnectorLeases)
-    .where(bindingPredicate(binding))
-    .limit(1);
-  return rows[0] ?? null;
-}
-
-function toLease(row: typeof logicalAgentConnectorLeases.$inferSelect): ConnectorLease {
-  return Object.freeze({
-    identity: Object.freeze({ tenantId: row.tenantId, logicalAgentId: row.logicalAgentId }),
-    bindingId: row.bindingId,
-    leaseId: row.leaseId,
-    connectorId: row.connectorId,
-    scopes: Object.freeze([...row.scopes]),
-    leaseEpoch: row.leaseEpoch.toString(10),
-    acquiredAt: row.acquiredAt.toISOString(),
-    heartbeatAt: row.heartbeatAt.toISOString(),
-    expiresAt: row.expiresAt.toISOString(),
-    ...(row.releasedAt ? { releasedAt: row.releasedAt.toISOString() } : {}),
-  });
-}
-
-function classifyAuthorityFailure(
-  current: ConnectorLease | null,
-  claimed: ConnectorLease,
-  now: string,
-): ConnectorLeaseRejectReason {
-  if (!current) return 'lease_missing';
-  if (current.releasedAt) return 'lease_released';
-  if (new Date(current.expiresAt) <= new Date(now)) return 'lease_expired';
-  if (current.leaseEpoch !== claimed.leaseEpoch) return 'stale_epoch';
-  return 'connector_mismatch';
-}
-
-function lifecycleAudit(
-  input: { readonly correlationId: string; readonly now: string },
-  lease: ConnectorLease,
-  event: Exclude<ConnectorLeaseAuditEvent['event'], 'reject'>,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: lease.identity,
-    bindingId: lease.bindingId,
-    connectorId: lease.connectorId,
-    leaseId: lease.leaseId,
-    leaseEpoch: lease.leaseEpoch,
-    event,
-    outcome: 'succeeded',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-  };
-}
-
-function rejectionAudit(
-  input: {
-    readonly identity: ConnectorLease['identity'];
-    readonly bindingId: string;
-    readonly connectorId: string;
-    readonly correlationId: string;
-    readonly now: string;
-  },
-  current: ConnectorLease | null,
-  reason: ConnectorLeaseRejectReason,
-): ConnectorLeaseAuditEvent {
-  return {
-    identity: input.identity,
-    bindingId: input.bindingId,
-    connectorId: input.connectorId,
-    event: 'reject',
-    outcome: 'denied',
-    correlationId: input.correlationId,
-    occurredAt: input.now,
-    ...(current ? { leaseId: current.leaseId, leaseEpoch: current.leaseEpoch } : {}),
-    reason,
-  };
-}
-
-async function insertAudit(db: Pick<Db, 'insert'>, event: ConnectorLeaseAuditEvent): Promise<void> {
-  await db.insert(connectorLeaseAuditLog).values({
-    tenantId: event.identity.tenantId,
-    logicalAgentId: event.identity.logicalAgentId,
-    bindingId: event.bindingId,
-    connectorId: event.connectorId,
-    ...(event.leaseId ? { leaseId: event.leaseId } : {}),
-    ...(event.leaseEpoch ? { leaseEpoch: BigInt(event.leaseEpoch) } : {}),
-    event: event.event,
-    outcome: event.outcome,
-    ...(event.reason ? { reason: event.reason } : {}),
-    correlationId: event.correlationId,
-    occurredAt: new Date(event.occurredAt),
-  });
-}

apps/gateway/src/agent/connector-lease.service.ts

@@ -1,285 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { ConnectorLeaseCoordinator, normalizeConnectorLease } from '@mosaicstack/agent';
-import {
-  normalizeConnectorId,
-  normalizeConnectorScopes,
-  normalizeCorrelationId,
-  normalizeLogicalAgentIdentity,
-  normalizeLogicalBindingId,
-  type AcquireConnectorLeaseInput,
-  type ConnectorExecutionGrant,
-  type ConnectorLease,
-  type ConnectorLeaseAuditEvent,
-  type FencedConnectorAdapter,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { ConnectorLeaseRepository } from './connector-lease.repository.js';
-
-export const CONNECTOR_LEASE_POLICY = Symbol('CONNECTOR_LEASE_POLICY');
-
-export type ConnectorLeasePolicyAction =
-  | 'lease.acquire'
-  | 'lease.takeover'
-  | 'lease.heartbeat'
-  | 'lease.release'
-  | 'lease.read'
-  | 'grant.issue';
-
-export interface ConnectorLeaseRequestContext {
-  readonly actorScope: ActorTenantScope;
-  readonly correlationId: string;
-}
-
-export interface GatewayConnectorLeaseRequest {
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface GatewayConnectorLeaseTakeoverRequest extends GatewayConnectorLeaseRequest {
-  readonly expectedEpoch: string;
-}
-
-export interface GatewayConnectorGrantRequest {
-  readonly lease: ConnectorLease;
-  readonly scopes: readonly string[];
-  readonly ttlMs: number;
-}
-
-export interface ConnectorLeasePolicySubject {
-  readonly action: ConnectorLeasePolicyAction;
-  readonly actorId: string;
-  readonly tenantId: string;
-  readonly logicalAgentId: string;
-  readonly bindingId: string;
-  readonly connectorId: string;
-  readonly requestedScopes: readonly string[];
-  readonly requestedTtlMs: number | null;
-}
-
-export interface ConnectorLeasePolicy {
-  authorize(subject: ConnectorLeasePolicySubject): Promise<boolean>;
-}
-
-/** M1 has no concrete cutover policy: unconfigured production use fails closed. */
-@Injectable()
-export class DenyConnectorLeasePolicy implements ConnectorLeasePolicy {
-  async authorize(_subject: ConnectorLeasePolicySubject): Promise<boolean> {
-    return false;
-  }
-}
-
-/** Gateway-owned policy surface for durable connector authority and fenced effects. */
-@Injectable()
-export class ConnectorLeaseService {
-  private readonly coordinator: ConnectorLeaseCoordinator;
-
-  constructor(
-    @Inject(ConnectorLeaseRepository) private readonly repository: ConnectorLeaseRepository,
-    @Inject(CONNECTOR_LEASE_POLICY) private readonly policy: ConnectorLeasePolicy,
-  ) {
-    this.coordinator = new ConnectorLeaseCoordinator(repository);
-  }
-
-  async acquire(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.acquire', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.acquire({ ...command, correlationId: this.correlation(context) });
-  }
-
-  async takeover(
-    request: GatewayConnectorLeaseTakeoverRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const command = this.command(request, context);
-    await this.assertPolicy('lease.takeover', command, context, command.scopes, command.ttlMs);
-    return this.coordinator.takeover({
-      ...command,
-      expectedEpoch: request.expectedEpoch,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async heartbeat(
-    lease: ConnectorLease,
-    ttlMs: number,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.heartbeat', durableLease, context, durableLease.scopes, ttlMs);
-    return this.coordinator.heartbeat({
-      lease: durableLease,
-      ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async release(lease: ConnectorLease, context: ConnectorLeaseRequestContext): Promise<void> {
-    const normalizedLease = normalizeConnectorLease(lease);
-    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
-    await this.assertPolicy('lease.release', durableLease, context, durableLease.scopes, null);
-    await this.coordinator.release({
-      lease: durableLease,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async current(
-    logicalAgentId: string,
-    bindingId: string,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease | null> {
-    const binding = {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(bindingId),
-      connectorId: 'gateway',
-    };
-    await this.assertPolicy('lease.read', binding, context, [], null);
-    return this.coordinator.current(binding);
-  }
-
-  async issueGrant(
-    request: GatewayConnectorGrantRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorExecutionGrant> {
-    const lease = normalizeConnectorLease(request.lease);
-    await this.assertTenant(lease, context);
-    const scopes = normalizeConnectorScopes(request.scopes);
-    await this.assertPolicy('grant.issue', lease, context, scopes, request.ttlMs);
-    return this.coordinator.issueGrant({
-      lease,
-      scopes,
-      ttlMs: request.ttlMs,
-      correlationId: this.correlation(context),
-    });
-  }
-
-  async executeGrant<TInput, TOutput>(
-    grant: ConnectorExecutionGrant,
-    requiredScope: string,
-    input: TInput,
-    adapter: FencedConnectorAdapter<TInput, TOutput>,
-  ): Promise<TOutput> {
-    return this.coordinator.executeGrant(grant, requiredScope, input, adapter);
-  }
-
-  private command(
-    request: GatewayConnectorLeaseRequest,
-    context: ConnectorLeaseRequestContext,
-  ): Omit<AcquireConnectorLeaseInput, 'correlationId'> {
-    return {
-      identity: normalizeLogicalAgentIdentity({
-        tenantId: context.actorScope.tenantId,
-        logicalAgentId: request.logicalAgentId,
-      }),
-      bindingId: normalizeLogicalBindingId(request.bindingId),
-      connectorId: normalizeConnectorId(request.connectorId),
-      scopes: normalizeConnectorScopes(request.scopes),
-      ttlMs: request.ttlMs,
-    };
-  }
-
-  private async assertTenant(
-    lease: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    if (lease.identity.tenantId !== context.actorScope.tenantId) {
-      await this.recordPolicyDenial(
-        {
-          identity: {
-            tenantId: context.actorScope.tenantId,
-            logicalAgentId: 'untrusted',
-          },
-          bindingId: 'untrusted',
-          connectorId: 'untrusted',
-        },
-        context,
-      );
-      throw new ForbiddenException('Connector authority tenant scope denied');
-    }
-  }
-
-  private async durableLifecycleLease(
-    submittedLease: ConnectorLease,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<ConnectorLease> {
-    await this.assertTenant(submittedLease, context);
-    const durableLease = await this.coordinator.current(submittedLease);
-    if (!durableLease || !hasSameLifecycleAuthority(submittedLease, durableLease)) {
-      await this.recordPolicyDenial(durableLease ?? submittedLease, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-    return durableLease;
-  }
-
-  private async assertPolicy(
-    action: ConnectorLeasePolicyAction,
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-    requestedScopes: readonly string[],
-    requestedTtlMs: number | null,
-  ): Promise<void> {
-    const allowed = await this.policy.authorize({
-      action,
-      actorId: context.actorScope.userId,
-      tenantId: subject.identity.tenantId,
-      logicalAgentId: subject.identity.logicalAgentId,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      requestedScopes: Object.freeze([...requestedScopes]),
-      requestedTtlMs,
-    });
-    if (!allowed) {
-      await this.recordPolicyDenial(subject, context);
-      throw new ForbiddenException('Connector authority policy denied');
-    }
-  }
-
-  private async recordPolicyDenial(
-    subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
-    context: ConnectorLeaseRequestContext,
-  ): Promise<void> {
-    const event: ConnectorLeaseAuditEvent = {
-      identity: subject.identity,
-      bindingId: subject.bindingId,
-      connectorId: subject.connectorId,
-      event: 'reject',
-      outcome: 'denied',
-      reason: 'policy_denied',
-      correlationId: this.correlation(context),
-      occurredAt: new Date().toISOString(),
-    };
-    await this.repository.recordAudit(event);
-  }
-
-  private correlation(context: ConnectorLeaseRequestContext): string {
-    return normalizeCorrelationId(context.correlationId);
-  }
-}
-
-function hasSameLifecycleAuthority(
-  submittedLease: ConnectorLease,
-  durableLease: ConnectorLease,
-): boolean {
-  return (
-    submittedLease.identity.tenantId === durableLease.identity.tenantId &&
-    submittedLease.identity.logicalAgentId === durableLease.identity.logicalAgentId &&
-    submittedLease.bindingId === durableLease.bindingId &&
-    submittedLease.leaseId === durableLease.leaseId &&
-    submittedLease.connectorId === durableLease.connectorId &&
-    submittedLease.leaseEpoch === durableLease.leaseEpoch &&
-    submittedLease.scopes.length === durableLease.scopes.length &&
-    submittedLease.scopes.every((scope: string, index: number): boolean => {
-      return scope === durableLease.scopes[index];
-    })
-  );
-}

apps/gateway/src/agent/durable-session.dto.ts

@@ -1,10 +0,0 @@
-import type { RuntimeProviderRequestContext } from './runtime-provider-registry.service.js';
-
-/** Server-side request for a replay-safe provider message. */
-export interface ProviderOutboxDto {
-  sessionId: string;
-  idempotencyKey: string;
-  correlationId: string;
-  content: string;
-  context: RuntimeProviderRequestContext;
-}

apps/gateway/src/agent/durable-session.repository.test.ts

@@ -1,416 +0,0 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { eq, sql, interactionCheckpoints, interactionInbox } from '@mosaicstack/db';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createPgliteDb, runPgliteMigrations, type DbHandle } from '@mosaicstack/db';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { DurableSessionService } from './durable-session.service.js';
-
-const IDENTITY: DurableSessionIdentity = {
-  agentName: 'Nova',
-  sessionId: 'tess-pglite-session',
-  tenantId: 'tenant-pglite',
-  ownerId: 'tess-owner',
-  providerId: 'fleet',
-  runtimeSessionId: 'nova',
-};
-
-describe('DurableSessionRepository', () => {
-  let dataDir: string | undefined;
-  let handle: DbHandle;
-  let previousAuthSecret: string | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    previousAuthSecret = process.env['BETTER_AUTH_SECRET'];
-    process.env['BETTER_AUTH_SECRET'] = 'tess-durable-state-test-sealing-key';
-    dataDir = mkdtempSync(join(tmpdir(), 'tess-durable-state-'));
-    handle = createPgliteDb(dataDir);
-    await runPgliteMigrations(handle);
-    await seedOwner(handle);
-  }, 30_000);
-
-  beforeEach(async (): Promise<void> => {
-    await handle.db.execute(sql`DELETE FROM interaction_handoffs`);
-    await handle.db.execute(sql`DELETE FROM interaction_checkpoints`);
-    await handle.db.execute(sql`DELETE FROM interaction_inbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_outbox`);
-    await handle.db.execute(sql`DELETE FROM interaction_sessions`);
-  });
-
-  afterAll(async (): Promise<void> => {
-    await handle.close();
-    if (dataDir) rmSync(dataDir, { recursive: true, force: true });
-    if (previousAuthSecret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-    else process.env['BETTER_AUTH_SECRET'] = previousAuthSecret;
-  });
-
-  it('survives a full PGlite close/reopen mid-session without duplicate inbox or outbox side effects', async () => {
-    const beforeRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await beforeRestart.create(IDENTITY);
-    await beforeRestart.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      content: 'resume after a kill',
-    });
-    await beforeRestart.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-before-kill',
-      correlationId: 'correlation-before-kill',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'one response only',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-before-kill',
-      cursor: 'cursor-before-kill',
-      summary: 'restart-safe state',
-      compactionEpoch: 1,
-    });
-    await beforeRestart.handoff({
-      sessionId: IDENTITY.sessionId,
-      handoffId: 'handoff-before-kill',
-      destination: 'mos',
-      correlationId: 'correlation-before-kill',
-      checkpointId: 'checkpoint-before-kill',
-      status: 'pending',
-    });
-    await beforeRestart.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-after-handoff',
-      cursor: 'cursor-after-handoff',
-      summary: 'newer state cannot strand the portable handoff',
-      compactionEpoch: 2,
-    });
-
-    await handle.close();
-    handle = createPgliteDb(dataDir!);
-
-    const afterRestart = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    const recovered = await afterRestart.recover(IDENTITY.sessionId);
-    const resumedHandoff = await afterRestart.resumeHandoff('handoff-before-kill');
-    const handled: string[] = [];
-    const effects: string[] = [];
-
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-    await afterRestart.drainInbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      handled.push(entry.idempotencyKey);
-    });
-    await afterRestart.dispatchOutbox(IDENTITY.sessionId, async (entry): Promise<void> => {
-      effects.push(entry.idempotencyKey);
-    });
-
-    expect(recovered.identity).toEqual(IDENTITY);
-    expect(recovered.checkpoint).toMatchObject({ checkpointId: 'checkpoint-after-handoff' });
-    expect(recovered.handoffs).toMatchObject([{ handoffId: 'handoff-before-kill' }]);
-    expect(resumedHandoff.checkpoint).toMatchObject({ checkpointId: 'checkpoint-before-kill' });
-    expect(handled).toEqual(['inbox-before-kill']);
-    expect(effects).toEqual(['outbox-before-kill']);
-  }, 30_000);
-
-  it('redacts sensitive durable payloads before persistence', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-inbox',
-      correlationId: 'correlation-redaction',
-      content: 'api_key=super-secret-canary',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'redacted-outbox',
-      correlationId: 'correlation-redaction',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'email operator@example.test api_key=super-secret-canary',
-    });
-    await coordinator.checkpoint({
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'redacted-checkpoint',
-      cursor: 'bearer super-secret-canary',
-      summary: 'email operator@example.test',
-      compactionEpoch: 0,
-    });
-
-    const snapshot = await coordinator.snapshot(IDENTITY.sessionId);
-    const [persisted] = await handle.db
-      .select({ content: interactionInbox.content })
-      .from(interactionInbox)
-      .where(eq(interactionInbox.idempotencyKey, 'redacted-inbox'));
-
-    expect(JSON.stringify(snapshot)).not.toContain('super-secret-canary');
-    expect(JSON.stringify(snapshot)).not.toContain('operator@example.test');
-    expect(persisted?.content).not.toContain('super-secret-canary');
-    expect(persisted?.content).not.toContain('[REDACTED]');
-  }, 30_000);
-
-  it('fails closed when the configured idempotency secret is unavailable', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const secret = process.env['BETTER_AUTH_SECRET'];
-    delete process.env['BETTER_AUTH_SECRET'];
-    try {
-      await expect(
-        coordinator.receive({
-          sessionId: IDENTITY.sessionId,
-          idempotencyKey: 'requires-idempotency-secret',
-          correlationId: 'correlation-secret',
-          content: 'sensitive payload',
-        }),
-      ).rejects.toThrow(/required for durable idempotency digests/);
-    } finally {
-      if (secret === undefined) delete process.env['BETTER_AUTH_SECRET'];
-      else process.env['BETTER_AUTH_SECRET'] = secret;
-    }
-  }, 30_000);
-
-  it('uses keyed pre-redaction digests to reject distinct sensitive checkpoint payloads', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      checkpointId: 'checkpoint-secret-conflict',
-      cursor: 'api_key=secret-one',
-      summary: 'bearer secret-one',
-      compactionEpoch: 1,
-    };
-    await coordinator.checkpoint(input);
-
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        cursor: 'api_key=secret-two',
-        summary: 'bearer secret-two',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-
-    const [persisted] = await handle.db
-      .select({
-        digest: interactionCheckpoints.contentDigest,
-        cursor: interactionCheckpoints.cursor,
-      })
-      .from(interactionCheckpoints)
-      .where(eq(interactionCheckpoints.checkpointId, input.checkpointId));
-    expect(persisted?.cursor).not.toContain('secret-one');
-    expect(persisted?.digest).not.toBe(
-      createHash('sha256')
-        .update(JSON.stringify([input.cursor, input.summary]))
-        .digest('hex'),
-    );
-
-    await coordinator.checkpoint({
-      ...input,
-      checkpointId: 'checkpoint-delimiter-conflict',
-      cursor: 'a\u0000b',
-      summary: 'c',
-    });
-    await expect(
-      coordinator.checkpoint({
-        ...input,
-        checkpointId: 'checkpoint-delimiter-conflict',
-        cursor: 'a',
-        summary: 'b\u0000c',
-      }),
-    ).rejects.toThrow(/checkpoint identity conflict/);
-  }, 30_000);
-
-  it('rejects distinct sensitive inbox and outbox payloads under reused idempotency keys', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    const inbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-secret-conflict',
-      correlationId: 'correlation-inbox-secret',
-      content: 'api_key=secret-one',
-    };
-    const outbox = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-secret-conflict',
-      correlationId: 'correlation-outbox-secret',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'api_key=secret-one',
-    };
-    await coordinator.receive(inbox);
-    await coordinator.enqueueOutbox(outbox);
-
-    await expect(coordinator.receive({ ...inbox, content: 'api_key=secret-two' })).rejects.toThrow(
-      /idempotency conflict/,
-    );
-    await expect(
-      coordinator.enqueueOutbox({ ...outbox, content: 'api_key=secret-two' }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('rejects database inbox and outbox idempotency-key conflicts', async () => {
-    const coordinator = new DurableSessionCoordinator(new DurableSessionRepository(handle.db));
-    await coordinator.create(IDENTITY);
-    await coordinator.receive({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'inbox-conflict',
-      correlationId: 'correlation-inbox',
-      content: 'original inbox',
-    });
-    await coordinator.enqueueOutbox({
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'outbox-conflict',
-      correlationId: 'correlation-outbox',
-      channelId: 'cli',
-      kind: 'provider.send',
-      content: 'original outbox',
-    });
-
-    await expect(
-      coordinator.receive({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'inbox-conflict',
-        correlationId: 'forged-correlation',
-        content: 'original inbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-    await expect(
-      coordinator.enqueueOutbox({
-        sessionId: IDENTITY.sessionId,
-        idempotencyKey: 'outbox-conflict',
-        correlationId: 'correlation-outbox',
-        channelId: 'forged-channel',
-        kind: 'provider.send',
-        content: 'original outbox',
-      }),
-    ).rejects.toThrow(/idempotency conflict/);
-  }, 30_000);
-
-  it('does not requeue a live outbox claim during a normal scoped dispatch', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'live-effect',
-      correlationId: 'correlation-live',
-      content: 'must not duplicate',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-live',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    expect(await repository.claimOutbox(IDENTITY.sessionId)).toMatchObject({
-      status: 'processing',
-    });
-
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, input);
-    await expect(
-      service.recoverProviderSession(IDENTITY.sessionId, {
-        ...input,
-        context: {
-          ...input.context,
-          actorScope: { userId: 'intruder', tenantId: 'tenant-pglite' },
-        },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'live-effect', status: 'processing' }],
-    });
-  }, 30_000);
-
-  it('rejects an outbox correlation mismatch before claiming the pending effect', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const input = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'mismatch-effect',
-      correlationId: 'correlation-expected',
-      content: 'must remain pending',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-expected',
-      },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(input);
-    await expect(
-      service.dispatchProviderOutbox(IDENTITY.sessionId, {
-        ...input,
-        correlationId: 'correlation-forged',
-        context: { ...input.context, correlationId: 'correlation-forged' },
-      }),
-    ).rejects.toThrow(/scope or correlation mismatch/);
-
-    expect(runtimeProviders.sendMessage).not.toHaveBeenCalled();
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [{ idempotencyKey: 'mismatch-effect', status: 'pending' }],
-    });
-  }, 30_000);
-
-  it('dispatches only the outbox record bound to the supplied correlation and channel', async () => {
-    const repository = new DurableSessionRepository(handle.db);
-    const coordinator = new DurableSessionCoordinator(repository);
-    const runtimeProviders = { sendMessage: vi.fn().mockResolvedValue(undefined) };
-    const service = new DurableSessionService(repository, runtimeProviders as never);
-    const first = {
-      sessionId: IDENTITY.sessionId,
-      idempotencyKey: 'scoped-effect-one',
-      correlationId: 'correlation-one',
-      content: 'first result',
-      context: {
-        actorScope: { userId: IDENTITY.ownerId, tenantId: IDENTITY.tenantId },
-        channelId: 'cli',
-        correlationId: 'correlation-one',
-      },
-    };
-    const second = {
-      ...first,
-      idempotencyKey: 'scoped-effect-two',
-      correlationId: 'correlation-two',
-      content: 'second result',
-      context: { ...first.context, correlationId: 'correlation-two' },
-    };
-
-    await coordinator.create(IDENTITY);
-    await service.queueProviderSend(first);
-    await service.queueProviderSend(second);
-    await service.dispatchProviderOutbox(IDENTITY.sessionId, first);
-
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledTimes(1);
-    expect(runtimeProviders.sendMessage).toHaveBeenCalledWith(
-      IDENTITY.providerId,
-      IDENTITY.runtimeSessionId,
-      { content: 'first result', idempotencyKey: 'scoped-effect-one' },
-      first.context,
-    );
-    expect(await coordinator.snapshot(IDENTITY.sessionId)).toMatchObject({
-      outbox: [
-        { idempotencyKey: 'scoped-effect-one', status: 'delivered' },
-        { idempotencyKey: 'scoped-effect-two', status: 'pending' },
-      ],
-    });
-  }, 30_000);
-});
-
-async function seedOwner(handle: DbHandle): Promise<void> {
-  await handle.db.execute(sql`
-    INSERT INTO users (id, name, email, email_verified, created_at, updated_at)
-    VALUES ('tess-owner', 'Tess Owner', 'tess-owner@example.test', false, now(), now())
-  `);
-}

apps/gateway/src/agent/durable-session.repository.ts

@@ -1,529 +0,0 @@
-import { createHash, createHmac } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  and,
-  asc,
-  desc,
-  eq,
-  interactionCheckpoints,
-  interactionHandoffs,
-  interactionInbox,
-  interactionOutbox,
-  interactionSessions,
-  type Db,
-} from '@mosaicstack/db';
-import { seal, unseal } from '@mosaicstack/auth';
-import { redactSensitiveContent } from '@mosaicstack/log';
-import type {
-  DurableCheckpoint,
-  DurableCheckpointInput,
-  DurableEnqueueResult,
-  DurableHandoff,
-  DurableHandoffInput,
-  DurableInboxEntry,
-  DurableInboxInput,
-  DurableInboxStatus,
-  DurableOutboxEntry,
-  DurableOutboxInput,
-  DurableOutboxStatus,
-  DurableSessionIdentity,
-  DurableSessionSnapshot,
-  DurableSessionStore,
-} from '@mosaicstack/agent';
-import { DB } from '../database/database.module.js';
-
-@Injectable()
-export class DurableSessionRepository implements DurableSessionStore {
-  constructor(@Inject(DB) private readonly db: Db) {}
-
-  async create(identity: DurableSessionIdentity): Promise<void> {
-    await this.db
-      .insert(interactionSessions)
-      .values({
-        id: identity.sessionId,
-        agentName: identity.agentName,
-        tenantId: identity.tenantId,
-        ownerId: identity.ownerId,
-        providerId: identity.providerId,
-        runtimeSessionId: identity.runtimeSessionId,
-      })
-      .onConflictDoNothing();
-
-    const existing = await this.session(identity.sessionId);
-    if (!existing || !sameEnrollmentScope(existing, identity)) {
-      throw new Error(`Durable session identity conflict: ${identity.sessionId}`);
-    }
-    // A recovered/re-enrolled runtime can receive a new provider session ID;
-    // the conversation handle and owner scope remain immutable.
-    if (
-      existing.providerId !== identity.providerId ||
-      existing.runtimeSessionId !== identity.runtimeSessionId
-    ) {
-      await this.db
-        .update(interactionSessions)
-        .set({ providerId: identity.providerId, runtimeSessionId: identity.runtimeSessionId })
-        .where(eq(interactionSessions.id, identity.sessionId));
-    }
-  }
-
-  async snapshot(sessionId: string): Promise<DurableSessionSnapshot | null> {
-    const identity = await this.session(sessionId);
-    if (!identity) return null;
-
-    const [inbox, outbox, checkpoints, handoffs] = await Promise.all([
-      this.db
-        .select()
-        .from(interactionInbox)
-        .where(eq(interactionInbox.sessionId, sessionId))
-        .orderBy(asc(interactionInbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionOutbox)
-        .where(eq(interactionOutbox.sessionId, sessionId))
-        .orderBy(asc(interactionOutbox.createdAt)),
-      this.db
-        .select()
-        .from(interactionCheckpoints)
-        .where(eq(interactionCheckpoints.sessionId, sessionId))
-        .orderBy(
-          desc(interactionCheckpoints.compactionEpoch),
-          desc(interactionCheckpoints.createdAt),
-        )
-        .limit(1),
-      this.db
-        .select()
-        .from(interactionHandoffs)
-        .where(eq(interactionHandoffs.sessionId, sessionId))
-        .orderBy(asc(interactionHandoffs.createdAt)),
-    ]);
-
-    const checkpoint = checkpoints[0];
-    return {
-      identity,
-      inbox: inbox.map(toInbox),
-      outbox: outbox.map(toOutbox),
-      ...(checkpoint ? { checkpoint: toCheckpoint(checkpoint) } : {}),
-      handoffs: handoffs.map(toHandoff),
-    };
-  }
-
-  async enqueueInbox(input: DurableInboxInput): Promise<DurableEnqueueResult<DurableInboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableInboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionInbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionInbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionInbox)
-      .where(
-        and(
-          eq(interactionInbox.sessionId, input.sessionId),
-          eq(interactionInbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0]) throw new Error(`Durable inbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toInbox(existing[0]);
-    if (
-      !sameInbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable inbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimInbox(sessionId: string): Promise<DurableInboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionInbox)
-        .where(
-          and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionInbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionInbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionInbox.id, entry.id), eq(interactionInbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toInbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async completeInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'processed', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseInbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionInbox.sessionId, sessionId),
-          eq(interactionInbox.idempotencyKey, idempotencyKey),
-          eq(interactionInbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async enqueueOutbox(
-    input: DurableOutboxInput,
-  ): Promise<DurableEnqueueResult<DurableOutboxStatus>> {
-    const digest = contentDigest(input.content);
-    const record: DurableOutboxInput = {
-      ...input,
-      content: redactSensitiveContent(input.content).content,
-    };
-    const inserted = await this.db
-      .insert(interactionOutbox)
-      .values({
-        ...record,
-        content: seal(record.content),
-        contentDigest: digest,
-        status: 'pending',
-      })
-      .onConflictDoNothing()
-      .returning({ status: interactionOutbox.status });
-    if (inserted[0]) return { accepted: true, status: inserted[0].status };
-
-    const existing = await this.db
-      .select()
-      .from(interactionOutbox)
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, input.sessionId),
-          eq(interactionOutbox.idempotencyKey, input.idempotencyKey),
-        ),
-      )
-      .limit(1);
-    if (!existing[0]) throw new Error(`Durable outbox enqueue failed: ${input.idempotencyKey}`);
-    const entry = toOutbox(existing[0]);
-    if (
-      !sameOutbox(entry, record) ||
-      !matchesContentDigest(existing[0].contentDigest, input.content)
-    ) {
-      throw new Error(`Durable outbox idempotency conflict: ${input.idempotencyKey}`);
-    }
-    return { accepted: false, status: entry.status };
-  }
-
-  async claimOutbox(sessionId: string): Promise<DurableOutboxEntry | null> {
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-      const candidate = await this.db
-        .select()
-        .from(interactionOutbox)
-        .where(
-          and(eq(interactionOutbox.sessionId, sessionId), eq(interactionOutbox.status, 'pending')),
-        )
-        .orderBy(asc(interactionOutbox.createdAt))
-        .limit(1);
-      const entry = candidate[0];
-      if (!entry) return null;
-      const claimed = await this.db
-        .update(interactionOutbox)
-        .set({ status: 'processing', updatedAt: new Date() })
-        .where(and(eq(interactionOutbox.id, entry.id), eq(interactionOutbox.status, 'pending')))
-        .returning();
-      if (claimed[0]) return toOutbox(claimed[0]);
-    }
-    return null;
-  }
-
-  async claimOutboxByKey(
-    sessionId: string,
-    idempotencyKey: string,
-  ): Promise<DurableOutboxEntry | null> {
-    const claimed = await this.db
-      .update(interactionOutbox)
-      .set({ status: 'processing', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'pending'),
-        ),
-      )
-      .returning();
-    return claimed[0] ? toOutbox(claimed[0]) : null;
-  }
-
-  async completeOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'delivered', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async releaseOutbox(sessionId: string, idempotencyKey: string): Promise<void> {
-    await this.db
-      .update(interactionOutbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(
-          eq(interactionOutbox.sessionId, sessionId),
-          eq(interactionOutbox.idempotencyKey, idempotencyKey),
-          eq(interactionOutbox.status, 'processing'),
-        ),
-      );
-  }
-
-  async checkpoint(input: DurableCheckpointInput): Promise<void> {
-    // Compute identity before redaction.  The persisted digest is keyed so a database
-    // reader cannot use it as an offline oracle for sensitive cursor/summary values.
-    const digest = contentDigest(JSON.stringify([input.cursor, input.summary]));
-    const checkpoint: DurableCheckpointInput = {
-      ...input,
-      cursor: redactSensitiveContent(input.cursor).content,
-      summary: redactSensitiveContent(input.summary).content,
-    };
-    const inserted = await this.db
-      .insert(interactionCheckpoints)
-      .values({
-        ...checkpoint,
-        contentDigest: digest,
-        cursor: seal(checkpoint.cursor),
-        summary: seal(checkpoint.summary),
-      })
-      .onConflictDoNothing()
-      .returning({ checkpointId: interactionCheckpoints.checkpointId });
-    if (inserted[0]) return;
-
-    const existing = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, input.sessionId),
-          eq(interactionCheckpoints.checkpointId, input.checkpointId),
-        ),
-      )
-      .limit(1);
-    if (
-      !existing[0] ||
-      !sameCheckpoint(toCheckpoint(existing[0]), checkpoint) ||
-      !matchesCheckpointDigest(existing[0].contentDigest, digest)
-    ) {
-      throw new Error(`Durable checkpoint identity conflict: ${input.checkpointId}`);
-    }
-  }
-
-  async findCheckpoint(sessionId: string, checkpointId: string): Promise<DurableCheckpoint | null> {
-    const checkpoints = await this.db
-      .select()
-      .from(interactionCheckpoints)
-      .where(
-        and(
-          eq(interactionCheckpoints.sessionId, sessionId),
-          eq(interactionCheckpoints.checkpointId, checkpointId),
-        ),
-      )
-      .limit(1);
-    const checkpoint = checkpoints[0];
-    return checkpoint ? toCheckpoint(checkpoint) : null;
-  }
-
-  async handoff(input: DurableHandoffInput): Promise<void> {
-    const checkpoint = await this.findCheckpoint(input.sessionId, input.checkpointId);
-    if (!checkpoint) {
-      throw new Error(`Durable handoff checkpoint is unavailable: ${input.checkpointId}`);
-    }
-    const inserted = await this.db
-      .insert(interactionHandoffs)
-      .values({ ...input })
-      .onConflictDoNothing()
-      .returning({ handoffId: interactionHandoffs.handoffId });
-    if (inserted[0]) return;
-
-    const existing = await this.findHandoff(input.handoffId);
-    if (!existing || !sameHandoff(existing, input)) {
-      throw new Error(`Durable handoff identity conflict: ${input.handoffId}`);
-    }
-  }
-
-  async findHandoff(handoffId: string): Promise<DurableHandoff | null> {
-    const handoffs = await this.db
-      .select()
-      .from(interactionHandoffs)
-      .where(eq(interactionHandoffs.handoffId, handoffId))
-      .limit(1);
-    const handoff = handoffs[0];
-    return handoff ? toHandoff(handoff) : null;
-  }
-
-  async requeueInFlight(sessionId: string): Promise<void> {
-    // Inbox handlers are process-local work. A provider outbox claim may have
-    // reached an external target before a crash, so it is deliberately not
-    // replayed by generic recovery.
-    await this.db
-      .update(interactionInbox)
-      .set({ status: 'pending', updatedAt: new Date() })
-      .where(
-        and(eq(interactionInbox.sessionId, sessionId), eq(interactionInbox.status, 'processing')),
-      );
-  }
-
-  private async session(sessionId: string): Promise<DurableSessionIdentity | null> {
-    const sessions = await this.db
-      .select()
-      .from(interactionSessions)
-      .where(eq(interactionSessions.id, sessionId))
-      .limit(1);
-    const session = sessions[0];
-    return session
-      ? {
-          agentName: session.agentName,
-          sessionId: session.id,
-          tenantId: session.tenantId,
-          ownerId: session.ownerId,
-          providerId: session.providerId,
-          runtimeSessionId: session.runtimeSessionId,
-        }
-      : null;
-  }
-}
-
-function contentDigest(content: string): string {
-  const secret = process.env['BETTER_AUTH_SECRET'];
-  if (!secret) {
-    throw new Error('BETTER_AUTH_SECRET is required for durable idempotency digests');
-  }
-  return `hmac:v1:${createHmac('sha256', secret).update(content).digest('hex')}`;
-}
-
-function matchesContentDigest(stored: string, content: string): boolean {
-  return (
-    stored === contentDigest(content) ||
-    stored === createHash('sha256').update(content).digest('hex')
-  );
-}
-
-function matchesCheckpointDigest(stored: string, digest: string): boolean {
-  // Legacy rows predate any pre-redaction identity and cannot safely prove equality.
-  // Reject rather than let redaction collapse distinct sensitive checkpoint payloads.
-  return stored === digest;
-}
-
-function sameEnrollmentScope(left: DurableSessionIdentity, right: DurableSessionIdentity): boolean {
-  return (
-    left.agentName === right.agentName &&
-    left.sessionId === right.sessionId &&
-    left.tenantId === right.tenantId &&
-    left.ownerId === right.ownerId
-  );
-}
-
-function sameInbox(left: DurableInboxEntry, right: DurableInboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.content === right.content
-  );
-}
-
-function sameOutbox(left: DurableOutboxEntry, right: DurableOutboxInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.idempotencyKey === right.idempotencyKey &&
-    left.correlationId === right.correlationId &&
-    left.channelId === right.channelId &&
-    left.kind === right.kind &&
-    left.content === right.content
-  );
-}
-
-function sameCheckpoint(left: DurableCheckpoint, right: DurableCheckpointInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.checkpointId === right.checkpointId &&
-    left.compactionEpoch === right.compactionEpoch
-  );
-}
-
-function sameHandoff(left: DurableHandoff, right: DurableHandoffInput): boolean {
-  return (
-    left.sessionId === right.sessionId &&
-    left.handoffId === right.handoffId &&
-    left.destination === right.destination &&
-    left.correlationId === right.correlationId &&
-    left.checkpointId === right.checkpointId &&
-    left.status === right.status
-  );
-}
-
-function toInbox(row: typeof interactionInbox.$inferSelect): DurableInboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toOutbox(row: typeof interactionOutbox.$inferSelect): DurableOutboxEntry {
-  return {
-    sessionId: row.sessionId,
-    idempotencyKey: row.idempotencyKey,
-    correlationId: row.correlationId,
-    channelId: row.channelId,
-    kind: row.kind,
-    content: unseal(row.content),
-    status: row.status,
-  };
-}
-
-function toCheckpoint(row: typeof interactionCheckpoints.$inferSelect): DurableCheckpoint {
-  return {
-    sessionId: row.sessionId,
-    checkpointId: row.checkpointId,
-    cursor: unseal(row.cursor),
-    summary: unseal(row.summary),
-    compactionEpoch: row.compactionEpoch,
-  };
-}
-
-function toHandoff(row: typeof interactionHandoffs.$inferSelect): DurableHandoff {
-  return {
-    sessionId: row.sessionId,
-    handoffId: row.handoffId,
-    destination: row.destination,
-    correlationId: row.correlationId,
-    checkpointId: row.checkpointId,
-    status: row.status,
-  };
-}

apps/gateway/src/agent/durable-session.service.ts

@@ -1,123 +0,0 @@
-import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
-import type { ProviderOutboxDto } from './durable-session.dto.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Scoped gateway boundary for the canonical durable session state machine. It deliberately
- * uses composition: raw state methods cannot be injected into channel, CLI, or
- * MCP adapters without a server-derived actor/tenant/correlation context.
- */
-@Injectable()
-export class DurableSessionService {
-  private readonly coordinator: DurableSessionCoordinator;
-
-  constructor(
-    @Inject(DurableSessionRepository) repository: DurableSessionRepository,
-    @Inject(RuntimeProviderService) private readonly runtimeProviders: RuntimeProviderService,
-  ) {
-    this.coordinator = new DurableSessionCoordinator(repository);
-  }
-
-  /** Enroll a verified runtime session under the stable cross-surface conversation handle. */
-  async enroll(
-    identity: DurableSessionIdentity,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    if (
-      identity.ownerId !== context.actorScope.userId ||
-      identity.tenantId !== context.actorScope.tenantId
-    ) {
-      throw new ForbiddenException('Durable session enrollment scope mismatch');
-    }
-    await this.coordinator.create(identity);
-  }
-
-  async queueProviderSend(input: ProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(input.sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.enqueueOutbox({
-      sessionId: input.sessionId,
-      idempotencyKey: input.idempotencyKey,
-      correlationId: input.correlationId,
-      channelId: input.context.channelId,
-      kind: 'provider.send',
-      content: input.content,
-    });
-  }
-
-  async dispatchProviderOutbox(sessionId: string, input: ProviderOutboxDto): Promise<void> {
-    if (sessionId !== input.sessionId) {
-      throw new ForbiddenException('Durable outbox session mismatch');
-    }
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    const pendingEntry = snapshot.outbox.find(
-      (entry): boolean => entry.idempotencyKey === input.idempotencyKey,
-    );
-    if (!pendingEntry) return;
-    // Validate immutable routing before claiming. A caller with a mismatched
-    // correlation/channel must not strand a pending external side effect.
-    this.assertOutboxScope(pendingEntry, input);
-    await this.coordinator.dispatchOutboxEntry(
-      sessionId,
-      input.idempotencyKey,
-      async (entry): Promise<void> => {
-        this.assertOutboxScope(entry, input);
-        await this.runtimeProviders.sendMessage(
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-          { content: entry.content, idempotencyKey: entry.idempotencyKey },
-          input.context,
-        );
-      },
-    );
-  }
-
-  /** Read durable identity/state only after deriving and checking the server-side actor scope. */
-  async getSnapshot(sessionId: string, context: RuntimeProviderRequestContext) {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, {
-      sessionId,
-      content: '',
-      idempotencyKey: 'read-only',
-      correlationId: context.correlationId,
-      context,
-    });
-    return snapshot;
-  }
-
-  /** Startup/recovery-only path; normal queue/dispatch methods never requeue live work. */
-  async recoverProviderSession(sessionId: string, input: ProviderOutboxDto): Promise<void> {
-    const snapshot = await this.coordinator.snapshot(sessionId);
-    this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);
-    await this.coordinator.recover(sessionId);
-  }
-
-  private assertOutboxScope(
-    entry: { kind: string; correlationId: string; channelId: string },
-    input: ProviderOutboxDto,
-  ): void {
-    if (
-      entry.kind !== 'provider.send' ||
-      entry.correlationId !== input.correlationId ||
-      entry.channelId !== input.context.channelId
-    ) {
-      throw new ForbiddenException('Durable outbox scope or correlation mismatch');
-    }
-  }
-
-  private assertScope(ownerId: string, tenantId: string, input: ProviderOutboxDto): void {
-    if (
-      input.context.actorScope.userId !== ownerId ||
-      input.context.actorScope.tenantId !== tenantId ||
-      input.context.correlationId !== input.correlationId
-    ) {
-      throw new ForbiddenException('Durable session scope or correlation mismatch');
-    }
-  }
-}

apps/gateway/src/agent/hermes-runtime-reachability.e2e.test.ts

@@ -1,176 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { HermesRuntimeProvider } from '@mosaicstack/agent';
-import { AgentModule } from './agent.module.js';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { BRAIN } from '../brain/brain.tokens.js';
-import { DB } from '../database/database.module.js';
-import { CoordModule } from '../coord/coord.module.js';
-import { McpClientModule } from '../mcp-client/mcp-client.module.js';
-import { SkillsModule } from '../skills/skills.module.js';
-import { GCModule } from '../gc/gc.module.js';
-import { LogModule } from '../log/log.module.js';
-import { CommandsModule } from '../commands/commands.module.js';
-import {
-  AGENT_RUNTIME_PROVIDER_REGISTRY,
-  RUNTIME_APPROVAL_VERIFIER,
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderAuditService,
-} from './runtime-provider-registry.service.js';
-import { DurableSessionService } from './durable-session.service.js';
-import { DurableSessionRepository } from './durable-session.repository.js';
-import { AgentService } from './agent.service.js';
-import { ProviderService } from './provider.service.js';
-import { ProviderCredentialsService } from './provider-credentials.service.js';
-import { RoutingService } from './routing.service.js';
-import { RoutingEngineService } from './routing/routing-engine.service.js';
-import { SkillLoaderService } from './skill-loader.service.js';
-
-const authenticatedUser = { id: 'operator-1', tenantId: 'tenant-1' };
-
-@Module({})
-class EmptyAgentDependencyModule {}
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: authenticatedUser, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-    { provide: BRAIN, useValue: {} },
-    { provide: DB, useValue: {} },
-  ],
-  exports: [AUTH, AuthGuard, BRAIN, DB],
-})
-class AuthenticatedRequestModule {}
-
-/**
- * This is deliberately an HTTP test rather than a controller unit test: it
- * exercises AgentModule's actual provider factory, Nest DI, and AuthGuard.
- */
-describe('Hermes runtime provider reachability', (): void => {
-  let app: NestFastifyApplication | undefined;
-
-  beforeAll(async (): Promise<void> => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule, AgentModule],
-    })
-      .overrideModule(CoordModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(McpClientModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(SkillsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(GCModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(LogModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideModule(CommandsModule)
-      .useModule(EmptyAgentDependencyModule)
-      .overrideProvider(RuntimeProviderAuditService)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_PROVIDER_AUDIT_SINK)
-      .useValue({ record: vi.fn().mockResolvedValue(undefined) })
-      .overrideProvider(RUNTIME_APPROVAL_VERIFIER)
-      .useValue({ consume: vi.fn().mockResolvedValue(false) })
-      .overrideProvider(DurableSessionService)
-      .useValue({})
-      .overrideProvider(DurableSessionRepository)
-      .useValue({})
-      .overrideProvider(AgentService)
-      .useValue({})
-      .overrideProvider(ProviderService)
-      .useValue({})
-      .overrideProvider(ProviderCredentialsService)
-      .useValue({})
-      .overrideProvider(RoutingService)
-      .useValue({})
-      .overrideProvider(RoutingEngineService)
-      .useValue({})
-      .overrideProvider(SkillLoaderService)
-      .useValue({})
-      .compile();
-
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-
-  afterAll(async (): Promise<void> => {
-    await app?.close();
-  });
-
-  it('returns gateway denial responses from the actual guarded interaction routes', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-
-    const attachDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/attach',
-      headers: { 'x-correlation-id': 'correlation-1' },
-      payload: { mode: 'read' },
-    });
-    expect(attachDenied.statusCode).toBe(401);
-
-    const sendDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/send',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(sendDenied.statusCode).toBe(403);
-    expect(sendDenied.json()).toMatchObject({
-      message: 'Content and idempotency key are required',
-    });
-
-    const stopDenied = await app.inject({
-      method: 'POST',
-      url: '/api/interaction/Nova/sessions/session-1/stop',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-      payload: {},
-    });
-    expect(stopDenied.statusCode).toBe(403);
-    expect(stopDenied.json()).toMatchObject({ message: 'Exact-action approval is required' });
-  });
-
-  it('requires authentication and reaches the Hermes provider registered by AgentModule', async (): Promise<void> => {
-    if (!app) throw new Error('Nest application did not initialize');
-    const registry = app.get(AGENT_RUNTIME_PROVIDER_REGISTRY);
-    expect(registry.get('runtime.hermes')).toBeInstanceOf(HermesRuntimeProvider);
-
-    const denied = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { 'x-correlation-id': 'correlation-1' },
-    });
-    expect(denied.statusCode).toBe(401);
-
-    const response = await app.inject({
-      method: 'GET',
-      url: '/api/interaction/Nova/transitional-capabilities?provider=runtime.hermes',
-      headers: { cookie: 'session=trusted', 'x-correlation-id': 'correlation-1' },
-    });
-    expect(response.statusCode).toBe(200);
-    expect(response.json()).toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { GatewayHermesRuntimeTransport } from './hermes-runtime.transport.js';
-
-const scope = {
-  actorId: 'owner-1',
-  tenantId: 'tenant-1',
-  channelId: 'cli',
-  correlationId: 'correlation-1',
-};
-
-describe('GatewayHermesRuntimeTransport', () => {
-  it('preserves a configured path prefix and authenticates the concrete runtime request', async () => {
-    const fetchFn = vi
-      .fn()
-      .mockResolvedValue(new Response(JSON.stringify(['session.list']), { status: 200 }));
-    const transport = new GatewayHermesRuntimeTransport(
-      'https://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).resolves.toEqual(['session.list']);
-
-    expect(fetchFn).toHaveBeenCalledWith(
-      new URL('https://runtime.example.test/hermes/capabilities'),
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          authorization: 'Bearer test-service-token',
-          'x-mosaic-channel-id': 'cli',
-        }),
-      }),
-    );
-  });
-
-  it('rejects non-loopback HTTP runtime endpoints before sending identity headers', async () => {
-    const fetchFn = vi.fn();
-    const transport = new GatewayHermesRuntimeTransport(
-      'http://runtime.example.test/hermes',
-      'test-service-token',
-      fetchFn,
-    );
-
-    await expect(transport.capabilities(scope)).rejects.toThrow('requires HTTPS');
-    expect(fetchFn).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/agent/hermes-runtime.transport.ts

@@ -1,121 +0,0 @@
-import type { HermesLegacySession, HermesRuntimeTransport } from '@mosaicstack/agent';
-import type {
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeStreamEvent,
-} from '@mosaicstack/types';
-
-/** Concrete HTTP transport for a configured legacy Hermes runtime endpoint. */
-export class GatewayHermesRuntimeTransport implements HermesRuntimeTransport {
-  constructor(
-    private readonly baseUrl = process.env['MOSAIC_HERMES_RUNTIME_URL']?.trim(),
-    private readonly serviceToken = process.env['MOSAIC_HERMES_RUNTIME_TOKEN']?.trim(),
-    private readonly fetchFn: typeof fetch = fetch,
-  ) {}
-
-  async capabilities(scope: RuntimeScope): Promise<string[]> {
-    return this.request<string[]>('/capabilities', scope);
-  }
-
-  async health(scope: RuntimeScope): Promise<{ status: string; detail?: string }> {
-    return this.request<{ status: string; detail?: string }>('/health', scope);
-  }
-
-  async sessions(scope: RuntimeScope): Promise<HermesLegacySession[]> {
-    return this.request<HermesLegacySession[]>('/sessions', scope);
-  }
-
-  async *stream(
-    sessionId: string,
-    cursor: string | undefined,
-    scope: RuntimeScope,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const params = new URLSearchParams(cursor ? { cursor } : {});
-    const events = await this.request<RuntimeStreamEvent[]>(
-      `/sessions/${encodeURIComponent(sessionId)}/stream?${params.toString()}`,
-      scope,
-    );
-    yield* events;
-  }
-
-  async send(sessionId: string, message: RuntimeMessage, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/messages`, scope, {
-      method: 'POST',
-      body: message,
-    });
-  }
-
-  async attach(
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    scope: RuntimeScope,
-  ): Promise<RuntimeAttachHandle> {
-    return this.request<RuntimeAttachHandle>(
-      `/sessions/${encodeURIComponent(sessionId)}/attach`,
-      scope,
-      {
-        method: 'POST',
-        body: { mode },
-      },
-    );
-  }
-
-  async detach(attachmentId: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/attachments/${encodeURIComponent(attachmentId)}`, scope, {
-      method: 'DELETE',
-    });
-  }
-
-  async terminate(sessionId: string, approvalRef: string, scope: RuntimeScope): Promise<void> {
-    await this.request(`/sessions/${encodeURIComponent(sessionId)}/terminate`, scope, {
-      method: 'POST',
-      body: { approvalRef },
-    });
-  }
-
-  private async request<T>(
-    path: string,
-    scope: RuntimeScope,
-    init: { method?: string; body?: unknown } = {},
-  ): Promise<T> {
-    if (!this.baseUrl || !this.serviceToken) {
-      throw new Error(
-        'MOSAIC_HERMES_RUNTIME_URL and MOSAIC_HERMES_RUNTIME_TOKEN must configure Hermes transport',
-      );
-    }
-    const endpoint = new URL(this.baseUrl);
-    if (endpoint.protocol !== 'https:' && !isLoopbackHttp(endpoint)) {
-      throw new Error('Hermes runtime transport requires HTTPS outside loopback');
-    }
-    const response = await this.fetchFn(
-      new URL(path.replace(/^\//, ''), `${endpoint.toString().replace(/\/$/, '')}/`),
-      {
-        method: init.method ?? 'GET',
-        headers: {
-          accept: 'application/json',
-          authorization: `Bearer ${this.serviceToken}`,
-          'x-mosaic-actor-id': scope.actorId,
-          'x-mosaic-tenant-id': scope.tenantId,
-          'x-mosaic-channel-id': scope.channelId,
-          'x-correlation-id': scope.correlationId,
-          ...(init.body ? { 'content-type': 'application/json' } : {}),
-        },
-        ...(init.body ? { body: JSON.stringify(init.body) } : {}),
-      },
-    );
-    if (!response.ok) throw new Error(`Hermes runtime request failed: ${response.status}`);
-    if (response.status === 204) return undefined as T;
-    return (await response.json()) as T;
-  }
-}
-
-function isLoopbackHttp(endpoint: URL): boolean {
-  return (
-    endpoint.protocol === 'http:' &&
-    (endpoint.hostname === 'localhost' ||
-      endpoint.hostname === '127.0.0.1' ||
-      endpoint.hostname === '::1')
-  );
-}

apps/gateway/src/agent/interaction.controller.test.ts

@@ -1,263 +0,0 @@
-import { createGatewayRuntimeProviderRegistry } from './agent.module.js';
-import { firstValueFrom } from 'rxjs';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import {
-  RuntimeApprovalDeniedError,
-  RuntimeProviderService,
-} from './runtime-provider-registry.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import { InteractionController } from './interaction.controller.js';
-
-describe('InteractionController', (): void => {
-  afterEach(() => vi.restoreAllMocks());
-
-  it('maps a denied runtime approval to Fastify HTTP 403', () => {
-    const send = vi.fn();
-    const status = vi.fn().mockReturnValue({ send });
-    const response = { status };
-    const host = { switchToHttp: () => ({ getResponse: () => response }) };
-
-    new RuntimeApprovalDeniedFilter().catch(new RuntimeApprovalDeniedError(), host as never);
-
-    expect(status).toHaveBeenCalledWith(403);
-    expect(send).toHaveBeenCalledWith({
-      statusCode: 403,
-      message: 'Runtime termination approval denied',
-    });
-  });
-
-  it('honors a differently named configured instance without a code change', async () => {
-    const prior = process.env['MOSAIC_AGENT_NAME'];
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { listSessions: vi.fn().mockResolvedValue([]) };
-    const controller = new InteractionController(runtime as never, {} as never);
-
-    await expect(
-      controller.sessions('Nova', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).resolves.toEqual([]);
-    await expect(
-      controller.sessions('Other', 'fleet', { id: 'owner', tenantId: 'team' }, 'corr-1'),
-    ).rejects.toThrow('Interaction agent is not configured');
-
-    if (prior === undefined) delete process.env['MOSAIC_AGENT_NAME'];
-    else process.env['MOSAIC_AGENT_NAME'] = prior;
-  });
-
-  it('reaches the registered Hermes provider through the authenticated transitional matrix route', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const registry = createGatewayRuntimeProviderRegistry();
-    const runtime = new RuntimeProviderService(
-      registry,
-      { record: vi.fn().mockResolvedValue(undefined) },
-      { consume: vi.fn().mockResolvedValue(false) },
-    );
-    const controller = new InteractionController(runtime, {} as never);
-
-    await expect(
-      controller.transitionalCapabilities(
-        'Nova',
-        'runtime.hermes',
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual([
-      { capability: 'kanban', status: 'unsupported' },
-      { capability: 'skills', status: 'unsupported' },
-      { capability: 'memory', status: 'unsupported' },
-      { capability: 'tools', status: 'unsupported' },
-      { capability: 'cron', status: 'unsupported' },
-    ]);
-  });
-
-  it('rejects a request without the non-simple correlation header', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ listSessions: vi.fn() } as never, {} as never);
-
-    await expect(controller.sessions('Nova', 'fleet', { id: 'owner' })).rejects.toThrow(
-      'X-Correlation-Id is required',
-    );
-  });
-
-  it('enrolls a visible runtime session under the cross-surface conversation handle', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      listSessions: vi.fn().mockResolvedValue([{ id: 'runtime-1' }]),
-    };
-    const durable = { enroll: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.enroll(
-        'Nova',
-        'conversation-1',
-        { providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        { id: 'owner', tenantId: 'team' },
-        'corr-1',
-      ),
-    ).resolves.toEqual({ status: 'enrolled', sessionId: 'conversation-1' });
-    expect(durable.enroll).toHaveBeenCalledWith(
-      {
-        agentName: 'Nova',
-        sessionId: 'conversation-1',
-        tenantId: 'team',
-        ownerId: 'owner',
-        providerId: 'fleet',
-        runtimeSessionId: 'runtime-1',
-      },
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('rejects an invalid attach mode before invoking a provider', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const controller = new InteractionController({ attach: vi.fn() } as never, {} as never);
-
-    await expect(
-      controller.attach('Nova', 'durable-1', { mode: 'write' as never }, { id: 'owner' }, 'corr-1'),
-    ).rejects.toThrow('Interaction attach mode is invalid');
-  });
-
-  it('resumes a durable session by attaching and streaming its runtime events', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtimeEvent = {
-      type: 'message.delta' as const,
-      sessionId: 'runtime-1',
-      cursor: 'cursor-1',
-      occurredAt: '2026-07-13T00:00:00.000Z',
-      content: 'resumed',
-    };
-    const runtime = {
-      attach: vi.fn().mockResolvedValue({ attachmentId: 'attach-1', sessionId: 'runtime-1' }),
-      streamSession: vi.fn(async function* () {
-        yield runtimeEvent;
-      }),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.attach('Nova', 'conversation-1', { mode: 'read' }, { id: 'owner' }, 'corr-1');
-    await expect(
-      firstValueFrom(
-        controller.stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1'),
-      ),
-    ).resolves.toEqual({ data: runtimeEvent });
-
-    expect(runtime.attach).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'read',
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-    expect(runtime.streamSession).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      undefined,
-      expect.objectContaining({ correlationId: 'corr-1' }),
-    );
-  });
-
-  it('does not create a runtime stream after the SSE subscriber disconnects during snapshot lookup', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    let resolveSnapshot!: (value: { identity: Record<string, string> }) => void;
-    const snapshot = new Promise<{ identity: Record<string, string> }>((resolve) => {
-      resolveSnapshot = resolve;
-    });
-    const runtime = { streamSession: vi.fn() };
-    const durable = { getSnapshot: vi.fn().mockReturnValue(snapshot) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    const subscription = controller
-      .stream('Nova', 'conversation-1', undefined, { id: 'owner' }, 'corr-1')
-      .subscribe();
-    subscription.unsubscribe();
-    resolveSnapshot({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    });
-    await new Promise((resolve) => setTimeout(resolve, 0));
-
-    expect(runtime.streamSession).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ['wrong actor', { getSnapshot: vi.fn().mockRejectedValue(new Error('scope mismatch')) }],
-    [
-      'session-agent mismatch',
-      {
-        getSnapshot: vi.fn().mockResolvedValue({
-          identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-        }),
-      },
-    ],
-  ])('denies a CLI stop for %s', async (_reason, durable) => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toBeDefined();
-    expect(runtime.terminate).not.toHaveBeenCalled();
-  });
-
-  it('surfaces a denied runtime approval to the CLI interaction surface', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = {
-      terminate: vi.fn().mockRejectedValue(new Error('Runtime termination approval denied')),
-    };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await expect(
-      controller.stop(
-        'Nova',
-        'durable-1',
-        { approvalRef: 'approval-1' },
-        { id: 'owner' },
-        'corr-1',
-      ),
-    ).rejects.toThrow('Runtime termination approval denied');
-  });
-
-  it('uses the durable session identity and runtime registry for an approved stop', async () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-    const runtime = { terminate: vi.fn().mockResolvedValue(undefined) };
-    const durable = {
-      getSnapshot: vi.fn().mockResolvedValue({
-        identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-      }),
-    };
-    const controller = new InteractionController(runtime as never, durable as never);
-
-    await controller.stop(
-      'Nova',
-      'durable-1',
-      { approvalRef: 'approval-1' },
-      { id: 'owner' },
-      'corr-1',
-    );
-
-    expect(runtime.terminate).toHaveBeenCalledWith(
-      'fleet',
-      'runtime-1',
-      'approval-1',
-      expect.objectContaining({
-        correlationId: 'corr-1',
-        actorScope: { userId: 'owner', tenantId: 'owner' },
-      }),
-    );
-  });
-});

apps/gateway/src/agent/interaction.controller.ts

@@ -1,293 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Sse,
-  Inject,
-  Param,
-  Post,
-  Query,
-  UseGuards,
-  UseFilters,
-} from '@nestjs/common';
-import type { RuntimeAttachMode, RuntimeStreamEvent } from '@mosaicstack/types';
-import { Observable } from 'rxjs';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import { DurableSessionService } from './durable-session.service.js';
-import { RuntimeApprovalDeniedFilter } from './runtime-approval-denied.filter.js';
-import {
-  RuntimeProviderService,
-  type RuntimeProviderRequestContext,
-} from './runtime-provider-registry.service.js';
-
-/**
- * Authenticated HTTP boundary for operator interaction clients. Identity is
- * selected from deployment configuration, never a client-side command name.
- */
-@Controller('api/interaction/:agentName')
-@UseGuards(AuthGuard)
-@UseFilters(RuntimeApprovalDeniedFilter)
-export class InteractionController {
-  constructor(
-    @Inject(RuntimeProviderService) private readonly runtime: RuntimeProviderService,
-    @Inject(DurableSessionService) private readonly durable: DurableSessionService,
-  ) {}
-
-  @Get('sessions')
-  async sessions(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.listSessions(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  @Get('transitional-capabilities')
-  async transitionalCapabilities(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.transitionalCapabilityMatrix(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  @Get('tree')
-  async tree(
-    @Param('agentName') agentName: string,
-    @Query('provider') providerId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    return this.runtime.getSessionTree(
-      this.requiredProvider(providerId),
-      this.context(user, correlationId),
-    );
-  }
-
-  /**
-   * Bind an existing, authorized runtime session to the stable conversation ID.
-   * This is the lifecycle boundary where both runtime identifiers are known.
-   */
-  @Post('sessions/:sessionId/enroll')
-  async enroll(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { providerId?: string; runtimeSessionId?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const providerId = this.requiredProvider(body.providerId ?? '');
-    const runtimeSessionId = body.runtimeSessionId?.trim();
-    if (!runtimeSessionId) throw new ForbiddenException('Runtime session identity is required');
-    const context = this.context(user, correlationId);
-    const sessions = await this.runtime.listSessions(providerId, context);
-    if (!sessions.some((session): boolean => session.id === runtimeSessionId)) {
-      throw new ForbiddenException('Runtime session is not visible to this actor');
-    }
-    await this.durable.enroll(
-      {
-        agentName,
-        sessionId,
-        tenantId: context.actorScope.tenantId,
-        ownerId: context.actorScope.userId,
-        providerId,
-        runtimeSessionId,
-      },
-      context,
-    );
-    return { status: 'enrolled', sessionId };
-  }
-
-  @Post('sessions/:sessionId/attach')
-  async attach(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { mode?: RuntimeAttachMode } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const mode = body.mode ?? 'read';
-    if (mode !== 'read' && mode !== 'control') {
-      throw new ForbiddenException('Interaction attach mode is invalid');
-    }
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    return this.runtime.attach(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      mode,
-      context,
-    );
-  }
-
-  @Sse('sessions/:sessionId/stream')
-  stream(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Query('cursor') cursor: string | undefined,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Observable<{ data: RuntimeStreamEvent }> {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    return new Observable((subscriber) => {
-      let iterator: AsyncIterator<RuntimeStreamEvent> | undefined;
-      let cancelled = false;
-      void (async (): Promise<void> => {
-        try {
-          const snapshot = await this.durable.getSnapshot(sessionId, context);
-          if (cancelled || subscriber.closed) return;
-          this.assertSessionAgent(snapshot.identity.agentName, agentName);
-          iterator = this.runtime
-            .streamSession(
-              snapshot.identity.providerId,
-              snapshot.identity.runtimeSessionId,
-              cursor?.trim() || undefined,
-              context,
-            )
-            [Symbol.asyncIterator]();
-          if (cancelled || subscriber.closed) {
-            await iterator.return?.();
-            return;
-          }
-          while (!cancelled && !subscriber.closed) {
-            const next = await iterator.next();
-            if (next.done || cancelled || subscriber.closed) break;
-            subscriber.next({ data: next.value });
-          }
-          if (!subscriber.closed) subscriber.complete();
-        } catch (error: unknown) {
-          if (!subscriber.closed) subscriber.error(error);
-        }
-      })();
-      return (): void => {
-        cancelled = true;
-        void iterator?.return?.();
-      };
-    });
-  }
-
-  @Post('sessions/:sessionId/send')
-  async send(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { content?: string; idempotencyKey?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.content?.trim() || !body.idempotencyKey?.trim()) {
-      throw new ForbiddenException('Content and idempotency key are required');
-    }
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    const input = {
-      sessionId,
-      content: body.content,
-      idempotencyKey: body.idempotencyKey,
-      correlationId: context.correlationId,
-      context,
-    };
-    await this.durable.queueProviderSend(input);
-    await this.durable.dispatchProviderOutbox(sessionId, input);
-    return { status: 'queued', sessionId };
-  }
-
-  @Post('sessions/:sessionId/stop')
-  async stop(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @Body() body: { approvalRef?: string } = {},
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    if (!body.approvalRef?.trim())
-      throw new ForbiddenException('Exact-action approval is required');
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.runtime.terminate(
-      snapshot.identity.providerId,
-      snapshot.identity.runtimeSessionId,
-      body.approvalRef,
-      context,
-    );
-    return { status: 'stopped', sessionId };
-  }
-
-  @Post('sessions/:sessionId/recover')
-  async recover(
-    @Param('agentName') agentName: string,
-    @Param('sessionId') sessionId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ) {
-    this.assertConfiguredAgent(agentName);
-    const context = this.context(user, correlationId);
-    const snapshot = await this.durable.getSnapshot(sessionId, context);
-    this.assertSessionAgent(snapshot.identity.agentName, agentName);
-    await this.durable.recoverProviderSession(sessionId, {
-      sessionId,
-      content: '',
-      idempotencyKey: `recovery:${context.correlationId}`,
-      correlationId: context.correlationId,
-      context,
-    });
-    return { status: 'recovered', sessionId };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    // This non-simple request header is mandatory for mutations. Browser
-    // cross-origin requests cannot set it without a CORS preflight, and the
-    // gateway's allowlist rejects untrusted origins before the handler runs.
-    if (!requestCorrelationId) {
-      throw new ForbiddenException('X-Correlation-Id is required');
-    }
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-
-  private assertConfiguredAgent(agentName: string): void {
-    const configured = process.env['MOSAIC_AGENT_NAME']?.trim();
-    if (!configured || configured !== agentName) {
-      throw new ForbiddenException('Interaction agent is not configured for this request');
-    }
-  }
-
-  private assertSessionAgent(sessionAgentName: string, agentName: string): void {
-    if (sessionAgentName !== agentName)
-      throw new ForbiddenException('Interaction session identity mismatch');
-  }
-
-  private requiredProvider(providerId: string): string {
-    if (!providerId?.trim()) throw new ForbiddenException('Runtime provider is required');
-    return providerId;
-  }
-}

apps/gateway/src/agent/provider.service.ts

@@ -107,7 +107,8 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
    * Interval is configurable via PROVIDER_HEALTH_INTERVAL env (seconds, default 60).
    */
   private startHealthCheckScheduler(): void {
-    const intervalSecs = this.effectiveHealthCheckIntervalSecs();
+    const intervalSecs =
+      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS;
     const intervalMs = intervalSecs * 1000;
 
     // Run an initial check immediately (non-blocking)
@@ -175,28 +176,6 @@ export class ProviderService implements OnModuleInit, OnModuleDestroy {
     });
   }
 
-  /**
-   * Returns the effective provider operational policy without credentials,
-   * endpoints, request content, or provider error details.
-   */
-  getEffectivePolicyStatus(): {
-    healthCheckIntervalSecs: number;
-    configuredProviders: string[];
-    availableModelCount: number;
-  } {
-    return {
-      healthCheckIntervalSecs: this.effectiveHealthCheckIntervalSecs(),
-      configuredProviders: this.adapters.map((adapter) => adapter.name),
-      availableModelCount: this.registry?.getAvailable().length ?? 0,
-    };
-  }
-
-  private effectiveHealthCheckIntervalSecs(): number {
-    return (
-      parseInt(process.env['PROVIDER_HEALTH_INTERVAL'] ?? '', 10) || DEFAULT_HEALTH_INTERVAL_SECS
-    );
-  }
-
   // ---------------------------------------------------------------------------
   // Adapter-pattern API
   // ---------------------------------------------------------------------------

apps/gateway/src/agent/providers.controller.test.ts

@@ -1,46 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ProvidersController } from './providers.controller.js';
-
-describe('ProvidersController operational status', (): void => {
-  it('reports provider latency and effective policy without exposing provider error details', (): void => {
-    const providerService = {
-      getProvidersHealth: vi.fn(() => [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          error: 'credential-canary=secret-value',
-        },
-      ]),
-      getEffectivePolicyStatus: vi.fn(() => ({
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      })),
-    };
-    const controller = new ProvidersController(providerService as never, {} as never, {} as never);
-
-    const status = controller.status();
-
-    expect(status).toEqual({
-      providers: [
-        {
-          name: 'fleet',
-          status: 'down',
-          latencyMs: 42,
-          lastChecked: '2026-07-12T00:00:00.000Z',
-          modelCount: 0,
-          errorCode: 'provider_unavailable',
-        },
-      ],
-      effectivePolicy: {
-        healthCheckIntervalSecs: 60,
-        configuredProviders: ['fleet'],
-        availableModelCount: 0,
-      },
-    });
-    expect(JSON.stringify(status)).not.toContain('secret-value');
-  });
-});

apps/gateway/src/agent/providers.controller.ts

@@ -33,20 +33,7 @@ export class ProvidersController {
 
   @Get('health')
   health() {
-    return { providers: this.safeProviderHealth() };
-  }
-
-  /**
-   * Safe operational status for troubleshooting and readiness checks. Provider
-   * errors are reduced to a stable code so credentials and remote responses
-   * cannot leak through this endpoint.
-   */
-  @Get('status')
-  status() {
-    return {
-      providers: this.safeProviderHealth(),
-      effectivePolicy: this.providerService.getEffectivePolicyStatus(),
-    };
+    return { providers: this.providerService.getProvidersHealth() };
   }
 
   @Post('test')
@@ -64,13 +51,6 @@ export class ProvidersController {
     return this.routingService.rank(criteria);
   }
 
-  private safeProviderHealth() {
-    return this.providerService.getProvidersHealth().map(({ error, ...provider }) => ({
-      ...provider,
-      ...(error ? { errorCode: 'provider_unavailable' } : {}),
-    }));
-  }
-
   // ── Credential CRUD ──────────────────────────────────────────────────────
 
   /**

apps/gateway/src/agent/runtime-approval-denied.filter.ts

@@ -1,13 +0,0 @@
-import { Catch, type ArgumentsHost, type ExceptionFilter } from '@nestjs/common';
-import { RuntimeApprovalDeniedError } from './runtime-provider-registry.service.js';
-
-/** Maps a consumed/missing runtime approval to a stable HTTP authorization response. */
-@Catch(RuntimeApprovalDeniedError)
-export class RuntimeApprovalDeniedFilter implements ExceptionFilter {
-  catch(_exception: RuntimeApprovalDeniedError, host: ArgumentsHost): void {
-    const response = host.switchToHttp().getResponse<{
-      status(code: number): { send(body: { statusCode: number; message: string }): void };
-    }>();
-    response.status(403).send({ statusCode: 403, message: 'Runtime termination approval denied' });
-  }
-}

apps/gateway/src/agent/runtime-provider-registry.service.ts

@@ -1,500 +0,0 @@
-import { ForbiddenException, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import { AgentRuntimeProviderRegistry } from '@mosaicstack/agent';
-import {
-  createRuntimeAuditLogEntry,
-  type LogService,
-  type RuntimeAuditErrorCode,
-} from '@mosaicstack/log';
-import type {
-  AgentRuntimeProvider,
-  RuntimeAttachHandle,
-  RuntimeAttachMode,
-  RuntimeCapability,
-  RuntimeCapabilitySet,
-  RuntimeHealth,
-  RuntimeMessage,
-  RuntimeScope,
-  RuntimeSession,
-  RuntimeSessionTree,
-  RuntimeStreamEvent,
-  TransitionalCapabilityInventoryEntry,
-  TransitionalCapabilityInventoryProvider,
-} from '@mosaicstack/types';
-import type { ActorTenantScope } from '../auth/session-scope.js';
-import { LOG_SERVICE } from '../log/log.tokens.js';
-
-export const AGENT_RUNTIME_PROVIDER_REGISTRY = Symbol('AGENT_RUNTIME_PROVIDER_REGISTRY');
-export const RUNTIME_PROVIDER_AUDIT_SINK = Symbol('RUNTIME_PROVIDER_AUDIT_SINK');
-export const RUNTIME_APPROVAL_VERIFIER = Symbol('RUNTIME_APPROVAL_VERIFIER');
-
-export type RuntimeProviderOperation =
-  | RuntimeCapability
-  | 'runtime.capabilities'
-  | 'runtime.health'
-  | 'runtime.transitional-capabilities';
-export type RuntimeProviderAuditOutcome = 'requested' | 'succeeded' | 'denied' | 'failed';
-
-/** Trusted server-side context only; it intentionally excludes client-provided identity fields. */
-export interface RuntimeProviderRequestContext {
-  actorScope: ActorTenantScope;
-  channelId: string;
-  correlationId: string;
-}
-
-/** Metadata-only audit record. Message bodies, idempotency keys, and approval refs are excluded. */
-export interface RuntimeAuditEvent {
-  providerId: string;
-  operation: RuntimeProviderOperation;
-  outcome: RuntimeProviderAuditOutcome;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  resourceId?: string;
-  durationMs?: number;
-  errorCode?: RuntimeAuditErrorCode;
-}
-
-export interface RuntimeAuditSink {
-  record(event: RuntimeAuditEvent): Promise<void>;
-}
-
-/** Exact action shape that a durable approval implementation must consume once. */
-export interface RuntimeTerminationAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  agentName: string;
-}
-
-export interface RuntimeApprovalVerifier {
-  consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean>;
-}
-
-function isTransitionalInventoryProvider(
-  provider: AgentRuntimeProvider,
-): provider is AgentRuntimeProvider & TransitionalCapabilityInventoryProvider {
-  return (
-    typeof (provider as Partial<TransitionalCapabilityInventoryProvider>)
-      .transitionalCapabilityMatrix === 'function'
-  );
-}
-
-function configuredAgentName(): string {
-  const agentName = process.env['MOSAIC_AGENT_NAME']?.trim();
-  if (!agentName) throw new RuntimeApprovalDeniedError();
-  return agentName;
-}
-
-export class RuntimeApprovalDeniedError extends Error {
-  constructor() {
-    super('Runtime termination approval denied');
-  }
-}
-
-/**
- * The default denies all runtime termination until a durable, exact-action
- * approval implementation is configured. This is safer than a permissive stub.
- */
-@Injectable()
-export class DenyRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  async consume(_approvalRef: string, _action: RuntimeTerminationAction): Promise<boolean> {
-    return false;
-  }
-}
-
-/**
- * Temporary metadata-only audit sink. M1 observability can replace this token
- * with a durable audit writer without changing provider call sites.
- */
-@Injectable()
-export class RuntimeProviderAuditService implements RuntimeAuditSink {
-  private readonly logger = new Logger(RuntimeProviderAuditService.name);
-
-  constructor(@Inject(LOG_SERVICE) private readonly logService: LogService) {}
-
-  async record(event: RuntimeAuditEvent): Promise<void> {
-    const entry = createRuntimeAuditLogEntry(event);
-    await this.logService.logs.ingest(entry);
-    this.logger.log(JSON.stringify({ event: entry.content, metadata: entry.metadata }));
-  }
-}
-
-@Injectable()
-export class RuntimeProviderService {
-  private readonly logger = new Logger(RuntimeProviderService.name);
-
-  constructor(
-    @Inject(AGENT_RUNTIME_PROVIDER_REGISTRY)
-    private readonly registry: AgentRuntimeProviderRegistry,
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly audit: RuntimeAuditSink,
-    @Inject(RUNTIME_APPROVAL_VERIFIER)
-    private readonly approvals: RuntimeApprovalVerifier,
-  ) {}
-
-  async capabilities(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeCapabilitySet> {
-    return this.execute(
-      providerId,
-      'runtime.capabilities',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeCapabilitySet> =>
-        provider.capabilities(scope),
-    );
-  }
-
-  async health(providerId: string, context: RuntimeProviderRequestContext): Promise<RuntimeHealth> {
-    return this.execute(
-      providerId,
-      'runtime.health',
-      undefined,
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeHealth> =>
-        provider.health(scope),
-    );
-  }
-
-  async transitionalCapabilityMatrix(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<TransitionalCapabilityInventoryEntry[]> {
-    return this.execute(
-      providerId,
-      'runtime.transitional-capabilities',
-      undefined,
-      undefined,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope) => {
-        if (!isTransitionalInventoryProvider(provider)) {
-          throw new NotFoundException('Runtime provider has no transitional capability inventory');
-        }
-        return provider.transitionalCapabilityMatrix(scope);
-      },
-    );
-  }
-
-  async listSessions(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSession[]> {
-    return this.execute(
-      providerId,
-      'session.list',
-      'session.list',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSession[]> =>
-        provider.listSessions(scope),
-    );
-  }
-
-  async getSessionTree(
-    providerId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeSessionTree[]> {
-    return this.execute(
-      providerId,
-      'session.tree',
-      'session.tree',
-      undefined,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeSessionTree[]> =>
-        provider.getSessionTree(scope),
-    );
-  }
-
-  streamSession(
-    providerId: string,
-    sessionId: string,
-    cursor: string | undefined,
-    context: RuntimeProviderRequestContext,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    return this.stream(
-      providerId,
-      'session.stream',
-      'session.stream',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): AsyncIterable<RuntimeStreamEvent> =>
-        provider.streamSession(sessionId, cursor, scope),
-    );
-  }
-
-  async sendMessage(
-    providerId: string,
-    sessionId: string,
-    message: RuntimeMessage,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.send',
-      'session.send',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.sendMessage(sessionId, message, scope),
-    );
-  }
-
-  async attach(
-    providerId: string,
-    sessionId: string,
-    mode: RuntimeAttachMode,
-    context: RuntimeProviderRequestContext,
-  ): Promise<RuntimeAttachHandle> {
-    return this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      sessionId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<RuntimeAttachHandle> =>
-        provider.attach(sessionId, mode, scope),
-    );
-  }
-
-  async detach(
-    providerId: string,
-    attachmentId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.attach',
-      'session.attach',
-      attachmentId,
-      context,
-      (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> =>
-        provider.detach(attachmentId, scope),
-    );
-  }
-
-  async terminate(
-    providerId: string,
-    sessionId: string,
-    approvalRef: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<void> {
-    await this.execute(
-      providerId,
-      'session.terminate',
-      'session.terminate',
-      sessionId,
-      context,
-      async (provider: AgentRuntimeProvider, scope: RuntimeScope): Promise<void> => {
-        const approved = await this.approvals.consume(approvalRef, {
-          providerId,
-          sessionId,
-          actorId: scope.actorId,
-          tenantId: scope.tenantId,
-          channelId: scope.channelId,
-          correlationId: scope.correlationId,
-          agentName: configuredAgentName(),
-        });
-        if (!approved) {
-          throw new RuntimeApprovalDeniedError();
-        }
-        await provider.terminate(sessionId, approvalRef, scope);
-      },
-    );
-  }
-
-  private async execute<T>(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability | undefined,
-    resourceId: string | undefined,
-    context: RuntimeProviderRequestContext,
-    invoke: (provider: AgentRuntimeProvider, scope: RuntimeScope) => Promise<T>,
-  ): Promise<T> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      if (requiredCapability) {
-        await this.assertCapability(provider, requiredCapability, scope);
-      }
-      invocationStarted = true;
-      const result = await invoke(provider, scope);
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-      return result;
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted && !this.isAuthorizationDenied(error)) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private async *stream(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    requiredCapability: RuntimeCapability,
-    resourceId: string,
-    context: RuntimeProviderRequestContext,
-    invoke: (
-      provider: AgentRuntimeProvider,
-      scope: RuntimeScope,
-    ) => AsyncIterable<RuntimeStreamEvent>,
-  ): AsyncIterable<RuntimeStreamEvent> {
-    const scope = this.deriveScope(context);
-    const startedAt = Date.now();
-    await this.record(providerId, operation, 'requested', scope, resourceId);
-    let invocationStarted = false;
-    try {
-      const provider = this.provider(providerId);
-      await this.assertCapability(provider, requiredCapability, scope);
-      invocationStarted = true;
-      for await (const event of invoke(provider, scope)) {
-        yield event;
-      }
-      await this.recordCompletion(providerId, operation, scope, resourceId, Date.now() - startedAt);
-    } catch (error: unknown) {
-      const durationMs = Date.now() - startedAt;
-      if (invocationStarted) {
-        await this.recordFailure(providerId, operation, scope, resourceId, durationMs);
-      } else {
-        await this.record(
-          providerId,
-          operation,
-          'denied',
-          scope,
-          resourceId,
-          durationMs,
-          'policy_denied',
-        );
-      }
-      throw error;
-    }
-  }
-
-  private isAuthorizationDenied(error: unknown): boolean {
-    return (
-      error instanceof RuntimeApprovalDeniedError ||
-      error instanceof ForbiddenException ||
-      (typeof error === 'object' &&
-        error !== null &&
-        'code' in error &&
-        (error as { code?: unknown }).code === 'forbidden')
-    );
-  }
-
-  private provider(providerId: string): AgentRuntimeProvider {
-    try {
-      return this.registry.require(providerId);
-    } catch (error: unknown) {
-      const message = error instanceof Error ? error.message : 'Runtime provider is not registered';
-      throw new NotFoundException(message);
-    }
-  }
-
-  private async assertCapability(
-    provider: AgentRuntimeProvider,
-    requiredCapability: RuntimeCapability,
-    scope: RuntimeScope,
-  ): Promise<void> {
-    const capabilities = await provider.capabilities(scope);
-    if (!capabilities.supported.includes(requiredCapability)) {
-      throw new ForbiddenException(`Runtime provider capability denied: ${requiredCapability}`);
-    }
-  }
-
-  private deriveScope(context: RuntimeProviderRequestContext): RuntimeScope {
-    const actorId = context.actorScope.userId.trim();
-    const tenantId = context.actorScope.tenantId.trim();
-    const channelId = context.channelId.trim();
-    const correlationId = context.correlationId.trim();
-    if (!actorId || !tenantId || !channelId || !correlationId) {
-      throw new ForbiddenException(
-        'Authenticated runtime actor scope and correlation are required',
-      );
-    }
-    return Object.freeze({ actorId, tenantId, channelId, correlationId });
-  }
-
-  private async recordFailure(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(
-        providerId,
-        operation,
-        'failed',
-        scope,
-        resourceId,
-        durationMs,
-        'provider_error',
-      );
-    } catch {
-      this.logger.error(
-        `Runtime provider failure audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async recordCompletion(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs: number,
-  ): Promise<void> {
-    try {
-      await this.record(providerId, operation, 'succeeded', scope, resourceId, durationMs);
-    } catch {
-      this.logger.error(
-        `Runtime provider completion audit failed provider=${providerId} operation=${operation} correlation=${scope.correlationId}`,
-      );
-    }
-  }
-
-  private async record(
-    providerId: string,
-    operation: RuntimeProviderOperation,
-    outcome: RuntimeProviderAuditOutcome,
-    scope: RuntimeScope,
-    resourceId: string | undefined,
-    durationMs?: number,
-    errorCode?: RuntimeAuditErrorCode,
-  ): Promise<void> {
-    await this.audit.record({
-      providerId,
-      operation,
-      outcome,
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      channelId: scope.channelId,
-      correlationId: scope.correlationId,
-      ...(resourceId ? { resourceId } : {}),
-      ...(durationMs !== undefined ? { durationMs } : {}),
-      ...(errorCode ? { errorCode } : {}),
-    });
-  }
-}

apps/gateway/src/agent/tools/memory-tools.test.ts

@@ -1,41 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { createMemoryTools } from './memory-tools.js';
-
-describe('createMemoryTools operator retrieval binding', () => {
-  const memory = {
-    insights: { searchByEmbedding: vi.fn(), create: vi.fn() },
-    preferences: { findByUserAndCategory: vi.fn(), findByUser: vi.fn(), upsert: vi.fn() },
-  };
-  const scope = { tenantId: 'tenant-a', ownerId: 'owner-a', sessionId: 'session-a' };
-
-  it('uses the configured plugin with the server-derived scope for retrieval and capture', async () => {
-    const plugin = {
-      search: vi.fn(async () => []),
-      capture: vi.fn(async () => ({ id: 'insight-1' })),
-    };
-    const tools = createMemoryTools(memory as never, null, 'owner-a', {
-      plugin: plugin as never,
-      scope,
-    });
-
-    await tools
-      .find((tool) => tool.name === 'memory_search')!
-      .execute('call-1', { query: 'plans' }, undefined, undefined, {} as never);
-    await tools
-      .find((tool) => tool.name === 'memory_save_insight')!
-      .execute(
-        'call-2',
-        { content: 'secret', category: 'decision' },
-        undefined,
-        undefined,
-        {} as never,
-      );
-
-    expect(plugin.search).toHaveBeenCalledWith(scope, 'plans', 5);
-    expect(plugin.capture).toHaveBeenCalledWith(scope, {
-      content: 'secret',
-      source: 'agent',
-      category: 'decision',
-    });
-  });
-});

apps/gateway/src/agent/tools/memory-tools.ts

@@ -1,11 +1,7 @@
 import { Type } from '@sinclair/typebox';
 import type { ToolDefinition } from '@mariozechner/pi-coding-agent';
-import type {
-  EmbeddingProvider,
-  Memory,
-  OperatorMemoryPlugin,
-  OperatorMemoryScope,
-} from '@mosaicstack/memory';
+import type { Memory } from '@mosaicstack/memory';
+import type { EmbeddingProvider } from '@mosaicstack/memory';
 
 /**
  * Create memory tools bound to the session's authenticated userId.
@@ -17,10 +13,8 @@ import type {
 export function createMemoryTools(
   memory: Memory,
   embeddingProvider: EmbeddingProvider | null,
-  /** Authenticated user ID from the session. All preference operations are scoped to this user. */
+  /** Authenticated user ID from the session. All memory operations are scoped to this user. */
   sessionUserId: string | undefined,
-  /** Optional configured retrieval plugin, bound to a server-derived session scope. */
-  operatorMemory?: { plugin: OperatorMemoryPlugin; scope: OperatorMemoryScope },
 ): ToolDefinition[] {
   /** Return an error result when no session user is bound. */
   function noUserError() {
@@ -52,14 +46,6 @@ export function createMemoryTools(
         limit?: number;
       };
 
-      if (operatorMemory) {
-        const results = await operatorMemory.plugin.search(operatorMemory.scope, query, limit ?? 5);
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(results, null, 2) }],
-          details: undefined,
-        };
-      }
-
       if (!embeddingProvider) {
         return {
           content: [
@@ -172,18 +158,6 @@ export function createMemoryTools(
       };
       type Cat = 'decision' | 'learning' | 'preference' | 'fact' | 'pattern' | 'general';
 
-      if (operatorMemory) {
-        const insight = await operatorMemory.plugin.capture(operatorMemory.scope, {
-          content,
-          source: 'agent',
-          category: category ?? 'learning',
-        });
-        return {
-          content: [{ type: 'text' as const, text: JSON.stringify(insight, null, 2) }],
-          details: undefined,
-        };
-      }
-
       let embedding: number[] | null = null;
       if (embeddingProvider) {
         embedding = await embeddingProvider.embed(content);

apps/gateway/src/chat/chat.dto.ts

@@ -1,4 +1,3 @@
-import type { ChannelAttachmentDto } from '@mosaicstack/types';
 import { IsOptional, IsString, IsUUID, MaxLength } from 'class-validator';
 
 export class ChatRequestDto {
@@ -33,7 +32,4 @@ export class ChatSocketMessageDto {
   @IsOptional()
   @IsUUID()
   agentId?: string;
-
-  /** Validated channel attachment references; binary content is not embedded. */
-  attachments?: readonly ChannelAttachmentDto[];
 }

apps/gateway/src/chat/chat.gateway-command-approval.spec.ts

@@ -1,74 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { ChatGateway } from './chat.gateway.js';
-
-const payload: SlashCommandPayload = {
-  command: 'gc',
-  conversationId: 'conversation-1',
-  approvalId: 'approval-1',
-};
-
-function buildGateway(commandExecutor: {
-  execute: ReturnType<typeof vi.fn>;
-  createApproval: ReturnType<typeof vi.fn>;
-}): ChatGateway {
-  return new ChatGateway(
-    {} as never,
-    {} as never,
-    {} as never,
-    {} as never,
-    commandExecutor as never,
-    {} as never,
-  );
-}
-
-describe('ChatGateway command approval ingress', () => {
-  it('passes the client approval ID through to command execution while deriving the actor server-side', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn().mockResolvedValue({ ...payload, success: true }),
-      createApproval: vi.fn(),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandExecute(client as never, payload);
-
-    expect(commandExecutor.execute).toHaveBeenCalledWith(payload, {
-      userId: 'admin-1',
-      tenantId: 'admin-1',
-    });
-    expect(client.emit).toHaveBeenCalledWith(
-      'command:result',
-      expect.objectContaining({ success: true }),
-    );
-  });
-
-  it('issues a durable approval only for the authenticated actor', async (): Promise<void> => {
-    const commandExecutor = {
-      execute: vi.fn(),
-      createApproval: vi.fn().mockResolvedValue({
-        approvalId: 'approval-1',
-        expiresAt: '2026-07-12T00:05:00.000Z',
-      }),
-    };
-    const gateway = buildGateway(commandExecutor);
-    const client = { data: { user: { id: 'admin-1' } }, emit: vi.fn() };
-
-    await gateway.handleCommandApproval(client as never, {
-      command: 'gc',
-      conversationId: 'conversation-1',
-    });
-
-    expect(commandExecutor.createApproval).toHaveBeenCalledWith(
-      { command: 'gc', conversationId: 'conversation-1' },
-      { userId: 'admin-1', tenantId: 'admin-1' },
-    );
-    expect(client.emit).toHaveBeenCalledWith('command:approval', {
-      command: 'gc',
-      conversationId: 'conversation-1',
-      success: true,
-      approvalId: 'approval-1',
-      expiresAt: '2026-07-12T00:05:00.000Z',
-    });
-  });
-});

apps/gateway/src/chat/chat.gateway-redaction.spec.ts

@@ -1,221 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ChatGateway } from './chat.gateway.js';
-
-const CONVERSATION_ID = 'conversation-1';
-const CANARY = 'sk_canary12345678';
-
-function clientConversationKey(clientId: string, conversationId: string): string {
-  return `${clientId}\u0000${conversationId}`;
-}
-
-type GatewayInternals = {
-  clientSessions: Map<string, unknown>;
-  relayEvent(client: unknown, conversationId: string, event: unknown): void;
-};
-
-function buildGateway() {
-  const brain = {
-    conversations: {
-      addMessage: vi.fn().mockResolvedValue(undefined),
-    },
-  };
-  const agentService = {
-    getSession: vi.fn().mockReturnValue(undefined),
-  };
-  const gateway = new ChatGateway(
-    agentService as never,
-    {} as never,
-    brain as never,
-    {} as never,
-    {} as never,
-    {} as never,
-  );
-
-  return { gateway: gateway as unknown as GatewayInternals, brain };
-}
-
-describe('ChatGateway redaction boundary', (): void => {
-  it('redacts a secret split across assistant deltas before egress and persistence', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const session = {
-      clientId: client.id,
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), session);
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'sk_canary' },
-    });
-
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('sk_canary');
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '12345678 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(session.assistantText).toBe(`${CANARY} `);
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain(CANARY);
-  });
-
-  it('retains a split secret label until its value can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'token ' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '=canaryvalue123 ' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET] ',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canaryvalue123');
-  });
-
-  it('holds a streamed private key until it can be redacted', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '-----BEGIN PRIVATE KEY-----\ncanary' },
-    });
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: '\n-----END PRIVATE KEY-----' },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_SECRET]',
-    });
-    expect(JSON.stringify(client.emit.mock.calls)).not.toContain('canary');
-  });
-
-  it('drops an oversized unterminated stream fragment rather than retaining it', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-
-    gateway.relayEvent(client, CONVERSATION_ID, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'x'.repeat(8_193) },
-    });
-
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: CONVERSATION_ID,
-      text: '[REDACTED_STREAM_OVERFLOW]',
-    });
-  });
-
-  it('isolates concurrent conversation streams sharing one Discord socket', (): void => {
-    const { gateway } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'discord-client',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    const firstConversation = 'Nova:discord:thread-1';
-    const secondConversation = 'Nova:discord:thread-2';
-    const createSession = (conversationId: string) => ({
-      clientId: client.id,
-      conversationId,
-      cleanup: vi.fn(),
-      assistantText: '',
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-    const firstSession = createSession(firstConversation);
-    const secondSession = createSession(secondConversation);
-    gateway.clientSessions.set(clientConversationKey(client.id, firstConversation), firstSession);
-    gateway.clientSessions.set(clientConversationKey(client.id, secondConversation), secondSession);
-
-    gateway.relayEvent(client, firstConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'first response ' },
-    });
-    gateway.relayEvent(client, secondConversation, {
-      type: 'message_update',
-      assistantMessageEvent: { type: 'text_delta', delta: 'second response ' },
-    });
-
-    expect(firstSession.assistantText).toBe('first response ');
-    expect(secondSession.assistantText).toBe('second response ');
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: firstConversation,
-      text: 'first response ',
-    });
-    expect(client.emit).toHaveBeenCalledWith('agent:text', {
-      conversationId: secondConversation,
-      text: 'second response ',
-    });
-  });
-
-  it('persists only redacted assistant content with classifications', (): void => {
-    const { gateway, brain } = buildGateway();
-    const client = {
-      connected: true,
-      id: 'client-1',
-      data: { user: { id: 'user-1' } },
-      emit: vi.fn(),
-    };
-    gateway.clientSessions.set(clientConversationKey(client.id, CONVERSATION_ID), {
-      clientId: client.id,
-      conversationId: CONVERSATION_ID,
-      cleanup: vi.fn(),
-      assistantText: CANARY,
-      toolCalls: [],
-      pendingToolCalls: new Map(),
-      scope: { userId: 'user-1', tenantId: 'tenant-1' },
-    });
-
-    gateway.relayEvent(client, CONVERSATION_ID, { type: 'agent_end' });
-
-    expect(brain.conversations.addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        content: '[REDACTED_SECRET]',
-        metadata: expect.objectContaining({ classifications: ['secret'] }),
-      }),
-      'user-1',
-    );
-    expect(JSON.stringify(brain.conversations.addMessage.mock.calls)).not.toContain(CANARY);
-  });
-});

apps/gateway/src/chat/chat.gateway.ts

@@ -1,5 +1,4 @@
-import { createHash } from 'node:crypto';
-import { Inject, Logger, Optional } from '@nestjs/common';
+import { Inject, Logger } from '@nestjs/common';
 import {
   WebSocketGateway,
   WebSocketServer,
@@ -14,32 +13,19 @@ import { Server, Socket } from 'socket.io';
 import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
 import {
   verifyDiscordIngressEnvelope,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
-  type DiscordAttachment,
   type DiscordIngressEnvelope,
   type DiscordIngressPayload,
 } from '@mosaicstack/discord-plugin';
 import type { Auth } from '@mosaicstack/auth';
 import type { Brain } from '@mosaicstack/brain';
-import { redactSensitiveContent } from '@mosaicstack/log';
 import type {
   SetThinkingPayload,
-  SlashCommandApprovalResultPayload,
   SlashCommandPayload,
   SystemReloadPayload,
   RoutingDecisionInfo,
   AbortPayload,
-  ChannelAttachmentDto,
 } from '@mosaicstack/types';
 import { AgentService, type ConversationHistoryMessage } from '../agent/agent.service.js';
-import {
-  RUNTIME_PROVIDER_AUDIT_SINK,
-  RuntimeProviderService,
-  type RuntimeAuditSink,
-} from '../agent/runtime-provider-registry.service.js';
-import { DurableSessionService } from '../agent/durable-session.service.js';
 import { AUTH } from '../auth/auth.tokens.js';
 import {
   scopeFromUser,
@@ -49,7 +35,6 @@ import {
 import { BRAIN } from '../brain/brain.tokens.js';
 import { CommandRegistryService } from '../commands/command-registry.service.js';
 import { CommandExecutorService } from '../commands/command-executor.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { RoutingEngineService } from '../agent/routing/routing-engine.service.js';
 import { v4 as uuid } from 'uuid';
 import { ChatSocketMessageDto } from './chat.dto.js';
@@ -58,7 +43,6 @@ import { DiscordReplayProtector } from '../plugin/discord-replay-protector.js';
 
 /** Per-client state tracking streaming accumulation for persistence. */
 interface ClientSession {
-  clientId: string;
   conversationId: string;
   cleanup: () => void;
   /** Accumulated assistant response text for the current turn. */
@@ -78,69 +62,6 @@ interface ClientSession {
  * Keyed by conversationId, value is the model name to use.
  */
 const modelOverrides = new Map<string, string>();
-const MAX_REDACTION_BUFFER_LENGTH = 8_192;
-const MAX_CHANNEL_ATTACHMENTS = 10;
-const MAX_ATTACHMENT_METADATA_BYTES = 16_384;
-const MAX_ATTACHMENT_ID_LENGTH = 128;
-const MAX_ATTACHMENT_NAME_LENGTH = 255;
-const MAX_ATTACHMENT_URL_LENGTH = 2_048;
-const MAX_ATTACHMENT_MIME_LENGTH = 255;
-
-function isSafeAttachmentUrl(value: string): boolean {
-  if (value.length === 0 || value.length > MAX_ATTACHMENT_URL_LENGTH) return false;
-  try {
-    const url = new URL(value);
-    return (
-      url.protocol === 'https:' &&
-      !url.username &&
-      !url.password &&
-      !url.hash &&
-      url.search.length === 0
-    );
-  } catch {
-    return false;
-  }
-}
-
-function hasValidAttachmentBounds(value: {
-  id: string;
-  name: string;
-  url: string;
-  sizeBytes?: number;
-}): boolean {
-  return (
-    value.id.length > 0 &&
-    value.id.length <= MAX_ATTACHMENT_ID_LENGTH &&
-    value.name.length > 0 &&
-    value.name.length <= MAX_ATTACHMENT_NAME_LENGTH &&
-    isSafeAttachmentUrl(value.url) &&
-    (value.sizeBytes === undefined || (Number.isFinite(value.sizeBytes) && value.sizeBytes >= 0))
-  );
-}
-
-function isDiscordAttachment(value: unknown): value is DiscordAttachment {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<DiscordAttachment>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.contentType === null ||
-      (typeof attachment.contentType === 'string' &&
-        attachment.contentType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as DiscordAttachment)
-  );
-}
-
-function hasValidAttachmentArray(value: unknown, guard: (attachment: unknown) => boolean): boolean {
-  return (
-    Array.isArray(value) &&
-    value.length <= MAX_CHANNEL_ATTACHMENTS &&
-    JSON.stringify(value).length <= MAX_ATTACHMENT_METADATA_BYTES &&
-    value.every(guard)
-  );
-}
 
 function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelope {
   if (typeof value !== 'object' || value === null) return false;
@@ -153,49 +74,23 @@ function isDiscordIngressEnvelope(value: unknown): value is DiscordIngressEnvelo
     return false;
   }
   const payload = envelope.payload as Record<string, unknown>;
-  return (
-    [
-      payload['correlationId'],
-      payload['messageId'],
-      payload['guildId'],
-      payload['channelId'],
-      payload['userId'],
-      payload['conversationId'],
-      payload['content'],
-    ].every((field: unknown): boolean => typeof field === 'string') &&
-    (payload['threadId'] === undefined || typeof payload['threadId'] === 'string') &&
-    (payload['attachments'] === undefined ||
-      hasValidAttachmentArray(payload['attachments'], isDiscordAttachment))
-  );
-}
-
-function isChannelAttachment(value: unknown): value is ChannelAttachmentDto {
-  if (typeof value !== 'object' || value === null) return false;
-  const attachment = value as Partial<ChannelAttachmentDto>;
-  return (
-    typeof attachment.id === 'string' &&
-    typeof attachment.name === 'string' &&
-    typeof attachment.url === 'string' &&
-    (attachment.mimeType === null ||
-      (typeof attachment.mimeType === 'string' &&
-        attachment.mimeType.length <= MAX_ATTACHMENT_MIME_LENGTH)) &&
-    (attachment.sizeBytes === undefined || typeof attachment.sizeBytes === 'number') &&
-    hasValidAttachmentBounds(attachment as ChannelAttachmentDto)
-  );
+  return [
+    payload['correlationId'],
+    payload['messageId'],
+    payload['guildId'],
+    payload['channelId'],
+    payload['userId'],
+    payload['conversationId'],
+    payload['content'],
+  ].every((field: unknown): boolean => typeof field === 'string');
 }
 
 function isChatSocketMessage(value: unknown): value is ChatSocketMessageDto {
   if (typeof value !== 'object' || value === null) return false;
-  const payload = value as {
-    content?: unknown;
-    conversationId?: unknown;
-    attachments?: unknown;
-  };
+  const payload = value as { content?: unknown; conversationId?: unknown };
   return (
     typeof payload.content === 'string' &&
-    (payload.conversationId === undefined || typeof payload.conversationId === 'string') &&
-    (payload.attachments === undefined ||
-      hasValidAttachmentArray(payload.attachments, isChannelAttachment))
+    (payload.conversationId === undefined || typeof payload.conversationId === 'string')
   );
 }
 
@@ -211,10 +106,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   private readonly logger = new Logger(ChatGateway.name);
   private readonly clientSessions = new Map<string, ClientSession>();
-  /** Raw stream fragments are kept in memory only until they are safe to redact and emit. */
-  private readonly textEgressBuffers = new Map<string, string>();
-  private readonly thinkingEgressBuffers = new Map<string, string>();
-  private readonly overflowedEgress = new Set<string>();
   private readonly discordReplayProtector = new DiscordReplayProtector();
 
   constructor(
@@ -224,18 +115,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     @Inject(CommandRegistryService) private readonly commandRegistry: CommandRegistryService,
     @Inject(CommandExecutorService) private readonly commandExecutor: CommandExecutorService,
     @Inject(RoutingEngineService) private readonly routingEngine: RoutingEngineService,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly commandAuthorization: CommandAuthorizationService | null = null,
-    @Optional()
-    @Inject(RuntimeProviderService)
-    private readonly runtimeRegistry: RuntimeProviderService | null = null,
-    @Optional()
-    @Inject(DurableSessionService)
-    private readonly durableSessions: DurableSessionService | null = null,
-    @Optional()
-    @Inject(RUNTIME_PROVIDER_AUDIT_SINK)
-    private readonly runtimeAudit: RuntimeAuditSink | null = null,
   ) {}
 
   afterInit(): void {
@@ -265,26 +144,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
   handleDisconnect(client: Socket): void {
     this.logger.log(`Client disconnected: ${client.id}`);
-    for (const [key, session] of this.clientSessions) {
-      if (session.clientId !== client.id) continue;
+    const session = this.clientSessions.get(client.id);
+    if (session) {
       session.cleanup();
       this.agentService.removeChannel(
         session.conversationId,
         `websocket:${client.id}`,
         session.scope,
       );
-      this.clientSessions.delete(key);
-      this.textEgressBuffers.delete(key);
-      this.thinkingEgressBuffers.delete(key);
-      this.overflowedEgress.delete(`${key}:agent:text`);
-      this.overflowedEgress.delete(`${key}:agent:thinking`);
+      this.clientSessions.delete(client.id);
     }
   }
 
-  private clientConversationKey(client: Pick<Socket, 'id'>, conversationId: string): string {
-    return `${client.id}\u0000${conversationId}`;
-  }
-
   private getClientScope(client: Socket): ActorTenantScope | null {
     const user = client.data.user as AuthenticatedUserLike | undefined;
     if (!user?.id) return null;
@@ -313,25 +184,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       }
       discordIngress = this.resolveDiscordIngress(client, rawData);
       if (!discordIngress) return;
-      data = {
-        conversationId: discordIngress.conversationId,
-        content: discordIngress.content,
-        ...(discordIngress.attachments
-          ? {
-              attachments: discordIngress.attachments.map(
-                (attachment): ChannelAttachmentDto => ({
-                  id: attachment.id,
-                  name: attachment.name,
-                  url: attachment.url,
-                  mimeType: attachment.contentType,
-                  ...(attachment.sizeBytes !== undefined
-                    ? { sizeBytes: attachment.sizeBytes }
-                    : {}),
-                }),
-              ),
-            }
-          : {}),
-      };
+      data = { conversationId: discordIngress.conversationId, content: discordIngress.content };
     } else {
       if (!isChatSocketMessage(rawData)) {
         this.logger.warn(`Rejected malformed chat message from ${client.id}`);
@@ -340,7 +193,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       data = rawData;
     }
     const conversationId = data.conversationId ?? uuid();
-    const clientConversationKey = this.clientConversationKey(client, conversationId);
     const discordServiceUserId = process.env['DISCORD_SERVICE_USER_ID'];
     if (discordIngress && !discordServiceUserId) {
       this.logger.warn(
@@ -395,7 +247,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           this.logger.log(
             `Using /model override "${modelOverride}" for conversation=${conversationId}`,
           );
-        } else if (!resolvedProvider && !resolvedModelId && !discordIngress) {
+        } else if (!resolvedProvider && !resolvedModelId) {
           // No explicit provider/model from client — use routing engine (M4-012)
           try {
             const routingDecision = await this.routingEngine.resolve(data.content, userId);
@@ -418,24 +270,12 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           }
         }
 
-        let resolvedAgentConfigId = data.agentId;
-        if (discordIngress) {
-          const binding = this.discordBindingFor(discordIngress, 'send');
-          const agentConfig = binding
-            ? await this.brain.agents.findById(binding.agentConfigId)
-            : undefined;
-          if (!binding || !agentConfig || agentConfig.name !== binding.instanceId) {
-            throw new Error('Configured Discord logical agent is not provisioned');
-          }
-          resolvedAgentConfigId = agentConfig.id;
-        }
-
         // M5-004: Use existingSessionId as sessionId when available (session reuse)
         const sessionIdToCreate = existingSessionId ?? conversationId;
         agentSession = await this.agentService.createSession(sessionIdToCreate, {
           provider: resolvedProvider,
           modelId: resolvedModelId,
-          agentConfigId: resolvedAgentConfigId,
+          agentConfigId: data.agentId,
           userId,
           tenantId: scope.tenantId,
           conversationHistory: conversationHistory.length > 0 ? conversationHistory : undefined,
@@ -476,7 +316,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           {
             conversationId,
             role: 'user',
-            content: redactSensitiveContent(data.content).content,
+            content: data.content,
             metadata: {
               timestamp: new Date().toISOString(),
               ...(correlationId
@@ -486,18 +326,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
                     discordUserId: discordIngress?.userId,
                   }
                 : {}),
-              ...(data.attachments && data.attachments.length > 0
-                ? {
-                    channelAttachments: data.attachments.map(
-                      (attachment): ChannelAttachmentDto => ({
-                        ...attachment,
-                        name: redactSensitiveContent(attachment.name).content,
-                        url: redactSensitiveContent(attachment.url).content,
-                      }),
-                    ),
-                  }
-                : {}),
-              classifications: redactSensitiveContent(data.content).classifications,
             },
           },
           userId,
@@ -511,7 +339,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
 
     // Always clean up previous listener to prevent leak
-    const existing = this.clientSessions.get(clientConversationKey);
+    const existing = this.clientSessions.get(client.id);
     if (existing) {
       existing.cleanup();
     }
@@ -526,11 +354,10 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     );
 
     // Preserve routing decision from the existing client session if we didn't get a new one
-    const prevClientSession = this.clientSessions.get(clientConversationKey);
+    const prevClientSession = this.clientSessions.get(client.id);
     const routingDecisionToStore = sessionRoutingDecision ?? prevClientSession?.lastRoutingDecision;
 
-    this.clientSessions.set(clientConversationKey, {
-      clientId: client.id,
+    this.clientSessions.set(client.id, {
       conversationId,
       cleanup,
       assistantText: '',
@@ -576,7 +403,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
     // Dispatch to agent
     try {
-      await this.agentService.prompt(conversationId, data.content, scope, data.attachments);
+      await this.agentService.prompt(conversationId, data.content, scope);
     } catch (err) {
       this.logger.error(
         `Agent prompt failed for client=${client.id}, conversation=${conversationId}`,
@@ -694,30 +521,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     client.emit('command:result', result);
   }
 
-  @SubscribeMessage('command:approve')
-  async handleCommandApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() payload: SlashCommandPayload,
-  ): Promise<void> {
-    const scope = this.getClientScope(client);
-    const approval = scope ? await this.commandExecutor.createApproval(payload, scope) : null;
-    const result: SlashCommandApprovalResultPayload = approval
-      ? {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: true,
-          approvalId: approval.approvalId,
-          expiresAt: approval.expiresAt,
-        }
-      : {
-          command: payload.command,
-          conversationId: payload.conversationId,
-          success: false,
-          message: 'Not authorized to approve this command.',
-        };
-    client.emit('command:approval', result);
-  }
-
   broadcastReload(payload: SystemReloadPayload): void {
     this.server.emit('system:reload', payload);
     this.logger.log('Broadcasted system:reload to all connected clients');
@@ -783,9 +586,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     };
 
     // Emit to all clients currently subscribed to this conversation
-    for (const session of this.clientSessions.values()) {
+    for (const [clientId, session] of this.clientSessions) {
       if (session.conversationId === conversationId && this.scopesEqual(session.scope, scope)) {
-        const socket = this.server.sockets.sockets.get(session.clientId);
+        const socket = this.server.sockets.sockets.get(clientId);
         if (socket?.connected) {
           socket.emit('session:info', payload);
         }
@@ -798,173 +601,9 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
    * Creates it if absent — safe to call concurrently since a duplicate insert
    * would fail on the PK constraint and be caught here.
    */
-  @SubscribeMessage('discord:approve')
-  async handleDiscordApproval(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'approve');
-    const isApprovalCommand = /^\/approve\s*$/i.test(ingress?.content ?? '');
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (
-      !ingress ||
-      !isApprovalCommand ||
-      !tenantId ||
-      !this.commandAuthorization ||
-      !this.durableSessions
-    )
-      return;
-    const binding = this.discordBindingFor(ingress, 'approve');
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    const agentName = binding?.instanceId;
-    if (!actorId || !agentName) {
-      this.logger.warn(
-        `Rejected Discord approval without a matching runtime agent from ${client.id}`,
-      );
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    let snapshot;
-    try {
-      snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      });
-    } catch {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    if (snapshot.identity.agentName !== agentName) {
-      client.emit('discord:approval', {
-        correlationId: ingress.correlationId,
-        success: false,
-        approvalId: undefined,
-        expiresAt: undefined,
-      });
-      return;
-    }
-    const approval = await this.commandAuthorization.createRuntimeTerminationApproval({
-      providerId: snapshot.identity.providerId,
-      sessionId: snapshot.identity.runtimeSessionId,
-      actorId,
-      tenantId,
-      channelId: ingress.channelId,
-      correlationId: this.discordRuntimeActionCorrelation(
-        binding.instanceId,
-        ingress,
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-      ),
-      agentName,
-    });
-    if (!approval) {
-      await this.runtimeAudit?.record({
-        providerId: snapshot.identity.providerId,
-        operation: 'session.terminate',
-        outcome: 'denied',
-        actorId,
-        tenantId,
-        channelId: ingress.channelId,
-        correlationId: this.discordRuntimeActionCorrelation(
-          binding.instanceId,
-          ingress,
-          snapshot.identity.providerId,
-          snapshot.identity.runtimeSessionId,
-        ),
-        resourceId: snapshot.identity.runtimeSessionId,
-        errorCode: 'policy_denied',
-      });
-    }
-    client.emit('discord:approval', {
-      correlationId: ingress.correlationId,
-      success: approval !== null,
-      approvalId: approval?.approvalId,
-      expiresAt: approval?.expiresAt,
-    });
-  }
-
-  @SubscribeMessage('discord:stop')
-  async handleDiscordStop(
-    @ConnectedSocket() client: Socket,
-    @MessageBody() envelope: DiscordIngressEnvelope,
-  ): Promise<void> {
-    if (!client.data.discordService) return;
-    const ingress = this.resolveDiscordIngress(client, envelope, 'stop');
-    const approvalRef = /^\/stop\s+([^\s]+)$/i.exec(ingress?.content ?? '')?.[1];
-    const tenantId = process.env['DISCORD_SERVICE_TENANT_ID']?.trim();
-    if (!ingress || !approvalRef || !tenantId || !this.runtimeRegistry || !this.durableSessions)
-      return;
-    const binding = this.discordBindingFor(ingress, 'stop');
-    const actorId = binding && resolveDiscordInteractionActorId(binding, ingress.userId);
-    if (!actorId) return;
-
-    try {
-      const context = {
-        actorScope: { userId: actorId, tenantId },
-        channelId: ingress.channelId,
-        correlationId: ingress.correlationId,
-      };
-      const snapshot = await this.durableSessions.getSnapshot(ingress.conversationId, context);
-      if (snapshot.identity.agentName !== binding.instanceId) throw new Error('agent mismatch');
-      // RuntimeProviderService consumes the durable approval exactly once using the
-      // provisioned approving-admin identity, never the Discord service account.
-      await this.runtimeRegistry.terminate(
-        snapshot.identity.providerId,
-        snapshot.identity.runtimeSessionId,
-        approvalRef,
-        {
-          ...context,
-          correlationId: this.discordRuntimeActionCorrelation(
-            binding.instanceId,
-            ingress,
-            snapshot.identity.providerId,
-            snapshot.identity.runtimeSessionId,
-          ),
-        },
-      );
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: true });
-    } catch {
-      client.emit('discord:stop', { correlationId: ingress.correlationId, success: false });
-    }
-  }
-
-  /**
-   * Correlates the immutable termination target rather than either Discord message.
-   * Approval and stop are distinct ingress events, but must consume the same seven-field action.
-   */
-  private discordRuntimeActionCorrelation(
-    instanceId: string,
-    ingress: DiscordIngressPayload,
-    providerId: string,
-    sessionId: string,
-  ): string {
-    const target = [
-      instanceId,
-      ingress.guildId,
-      ingress.channelId,
-      ingress.conversationId,
-      providerId,
-      sessionId,
-    ];
-    return `discord-action:v1:${createHash('sha256').update(JSON.stringify(target)).digest('hex')}`;
-  }
-
   private resolveDiscordIngress(
     client: Socket,
     envelope: DiscordIngressEnvelope,
-    operation: 'send' | 'approve' | 'stop' = 'send',
   ): DiscordIngressPayload | null {
     const payload = verifyDiscordIngressEnvelope(
       envelope,
@@ -979,25 +618,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       this.logger.warn(`Rejected invalid Discord ingress envelope from ${client.id}`);
       return null;
     }
-    try {
-      const binding = this.discordBindingFor(payload, operation);
-      if (!binding) {
-        this.logger.warn(`Rejected unpaired Discord ingress from ${client.id}`);
-        return null;
-      }
-      const expectedConversationId = `${binding.instanceId}:discord:${payload.threadId ?? payload.channelId}`;
-      if (payload.conversationId !== expectedConversationId) {
-        this.logger.warn(
-          `Rejected Discord ingress for a different logical agent from ${client.id}`,
-        );
-        return null;
-      }
-    } catch {
-      this.logger.warn(
-        `Rejected Discord ingress without valid binding configuration from ${client.id}`,
-      );
-      return null;
-    }
     if (!this.discordReplayProtector.claim(payload.messageId)) {
       this.logger.warn(
         `Rejected replayed Discord message=${payload.messageId} correlation=${payload.correlationId}`,
@@ -1007,19 +627,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     return payload;
   }
 
-  private discordBindingFor(
-    payload: DiscordIngressPayload,
-    operation: 'send' | 'approve' | 'stop',
-  ) {
-    return resolveDiscordInteractionBinding(
-      parseDiscordInteractionBindings(process.env['DISCORD_INTERACTION_BINDINGS']),
-      payload.guildId,
-      payload.channelId,
-      payload.userId,
-      operation,
-    );
-  }
-
   private readDiscordAllowlist(name: string): string[] {
     return (process.env[name] ?? '')
       .split(',')
@@ -1098,15 +705,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       const messages = await this.brain.conversations.findMessages(conversationId, userId);
       if (messages.length === 0) return [];
 
-      return messages.map((msg) => {
-        const attachments = this.persistedChannelAttachments(msg.metadata);
-        return {
-          role: msg.role as 'user' | 'assistant' | 'system',
-          content: msg.content,
-          createdAt: msg.createdAt,
-          ...(attachments ? { attachments } : {}),
-        };
-      });
+      return messages.map((msg) => ({
+        role: msg.role as 'user' | 'assistant' | 'system',
+        content: msg.content,
+        createdAt: msg.createdAt,
+      }));
     } catch (err) {
       this.logger.error(
         `Failed to load conversation history for conversation=${conversationId}`,
@@ -1116,141 +719,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
     }
   }
 
-  private persistedChannelAttachments(metadata: unknown): readonly ChannelAttachmentDto[] | null {
-    if (typeof metadata !== 'object' || metadata === null) return null;
-    const attachments = (metadata as { channelAttachments?: unknown }).channelAttachments;
-    return hasValidAttachmentArray(attachments, isChannelAttachment)
-      ? (attachments as readonly ChannelAttachmentDto[])
-      : null;
-  }
-
-  private appendAndFlushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    delta: string,
-  ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
-    const key = this.egressKey(client, conversationId, eventName);
-    if (this.overflowedEgress.has(key)) return;
-
-    const buffered = `${buffers.get(sessionKey) ?? ''}${delta}`;
-    if (buffered.length > MAX_REDACTION_BUFFER_LENGTH) {
-      buffers.delete(sessionKey);
-      this.overflowedEgress.add(key);
-      client.emit(eventName, { conversationId, text: '[REDACTED_STREAM_OVERFLOW]' });
-      return;
-    }
-
-    buffers.set(sessionKey, buffered);
-    this.flushRedactedEgress(client, conversationId, eventName, buffers, false);
-  }
-
-  /**
-   * Holds any suffix that could become a secret, email, or phone number after a
-   * later stream chunk. This avoids relying on downstream redaction after data
-   * has already reached the socket.
-   */
-  private flushRedactedEgress(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-    buffers: Map<string, string>,
-    final: boolean,
-  ): void {
-    const sessionKey = this.clientConversationKey(client, conversationId);
-    const key = this.egressKey(client, conversationId, eventName);
-    if (this.overflowedEgress.has(key)) {
-      if (final) this.overflowedEgress.delete(key);
-      return;
-    }
-
-    const buffered = buffers.get(sessionKey) ?? '';
-    const releaseLength = final ? buffered.length : this.safeRedactionPrefixLength(buffered);
-    const released = buffered.slice(0, releaseLength);
-    const pending = buffered.slice(releaseLength);
-
-    if (pending) {
-      buffers.set(sessionKey, pending);
-    } else {
-      buffers.delete(sessionKey);
-    }
-
-    if (released) {
-      client.emit(eventName, {
-        conversationId,
-        text: redactSensitiveContent(released).content,
-      });
-    }
-  }
-
-  private safeRedactionPrefixLength(content: string): number {
-    let retainedFrom = content.length;
-
-    // Retain the current token because it may become a split secret or email.
-    const token = /(?:^|\s)(\S*)$/.exec(content);
-    if (token) {
-      const matched = token[0] ?? '';
-      const trailingToken = token[1] ?? '';
-      retainedFrom = token.index + matched.length - trailingToken.length;
-    }
-
-    // The secret classifier accepts whitespace around ':' and '=', so preserve
-    // a pending label until its value and delimiter are both complete.
-    const pendingSecretLabel =
-      /(?:^|[^A-Za-z0-9_])((?:api[_-]?key|token|password|secret|bearer|authorization)\s*)$/i.exec(
-        content,
-      );
-    if (pendingSecretLabel) {
-      const label = pendingSecretLabel[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        pendingSecretLabel.index + pendingSecretLabel[0].length - label.length,
-      );
-    }
-
-    const secretLabel = /(?:api[_-]?key|token|password|secret|authorization)\s*[:=]\s*$/i.exec(
-      content,
-    );
-    if (secretLabel) {
-      retainedFrom = Math.min(retainedFrom, secretLabel.index);
-    }
-
-    // Phone numbers can contain whitespace and punctuation; preserve the full
-    // trailing numeric candidate until a non-phone character establishes a boundary.
-    const phone = /(?:^|[^A-Za-z0-9_])(\+?\d[\d(). -]*)$/.exec(content);
-    if (phone) {
-      const matched = phone[0] ?? '';
-      const trailingPhoneCandidate = phone[1] ?? '';
-      retainedFrom = Math.min(
-        retainedFrom,
-        phone.index + matched.length - trailingPhoneCandidate.length,
-      );
-    }
-
-    const privateKeyStart = content.lastIndexOf('-----BEGIN');
-    if (privateKeyStart >= 0) {
-      const privateKey = content.slice(privateKeyStart);
-      if (/-----END(?: [A-Z]+)* KEY-----/.test(privateKey)) {
-        // Release the complete block in one pass so the full-block classifier can redact it.
-        retainedFrom = content.length;
-      } else {
-        retainedFrom = Math.min(retainedFrom, privateKeyStart);
-      }
-    }
-
-    return retainedFrom;
-  }
-
-  private egressKey(
-    client: Socket,
-    conversationId: string,
-    eventName: 'agent:text' | 'agent:thinking',
-  ): string {
-    return `${this.clientConversationKey(client, conversationId)}:${eventName}`;
-  }
-
   private relayEvent(client: Socket, conversationId: string, event: AgentSessionEvent): void {
     if (!client.connected) {
       this.logger.warn(
@@ -1259,27 +727,22 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       return;
     }
 
-    const sessionKey = this.clientConversationKey(client, conversationId);
     switch (event.type) {
       case 'agent_start': {
         // Reset accumulation buffers for the new turn
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.assistantText = '';
           cs.toolCalls = [];
           cs.pendingToolCalls.clear();
         }
-        this.textEgressBuffers.set(sessionKey, '');
-        this.thinkingEgressBuffers.set(sessionKey, '');
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:text'));
-        this.overflowedEgress.delete(this.egressKey(client, conversationId, 'agent:thinking'));
         client.emit('agent:start', { conversationId });
         break;
       }
 
       case 'agent_end': {
         // Gather usage stats from the Pi session
-        const activeClientSession = this.clientSessions.get(sessionKey);
+        const activeClientSession = this.clientSessions.get(client.id);
         const agentSession = activeClientSession
           ? this.agentService.getSession(conversationId, activeClientSession.scope)
           : undefined;
@@ -1301,20 +764,6 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
             }
           : undefined;
 
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:text',
-          this.textEgressBuffers,
-          true,
-        );
-        this.flushRedactedEgress(
-          client,
-          conversationId,
-          'agent:thinking',
-          this.thinkingEgressBuffers,
-          true,
-        );
         client.emit('agent:end', {
           conversationId,
           usage: usagePayload,
@@ -1332,7 +781,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         }
 
         // Persist the assistant message with metadata
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         const userId = (client.data.user as { id: string } | undefined)?.id;
         if (cs && userId && cs.assistantText.trim().length > 0) {
           const metadata: Record<string, unknown> = {
@@ -1357,11 +806,8 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
               {
                 conversationId,
                 role: 'assistant',
-                content: redactSensitiveContent(cs.assistantText).content,
-                metadata: {
-                  ...metadata,
-                  classifications: redactSensitiveContent(cs.assistantText).classifications,
-                },
+                content: cs.assistantText,
+                metadata,
               },
               userId,
             )
@@ -1383,33 +829,27 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
       case 'message_update': {
         const assistantEvent = event.assistantMessageEvent;
         if (assistantEvent.type === 'text_delta') {
-          // Keep raw stream material in memory only; persist and emit only redacted text.
-          const cs = this.clientSessions.get(sessionKey);
+          // Accumulate assistant text for persistence
+          const cs = this.clientSessions.get(client.id);
           if (cs) {
             cs.assistantText += assistantEvent.delta;
           }
-          this.appendAndFlushRedactedEgress(
-            client,
+          client.emit('agent:text', {
             conversationId,
-            'agent:text',
-            this.textEgressBuffers,
-            assistantEvent.delta,
-          );
+            text: assistantEvent.delta,
+          });
         } else if (assistantEvent.type === 'thinking_delta') {
-          this.appendAndFlushRedactedEgress(
-            client,
+          client.emit('agent:thinking', {
             conversationId,
-            'agent:thinking',
-            this.thinkingEgressBuffers,
-            assistantEvent.delta,
-          );
+            text: assistantEvent.delta,
+          });
         }
         break;
       }
 
       case 'tool_execution_start': {
         // Track pending tool call for later recording
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           cs.pendingToolCalls.set(event.toolCallId, {
             toolName: event.toolName,
@@ -1426,7 +866,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
 
       case 'tool_execution_end': {
         // Finalise tool call record
-        const cs = this.clientSessions.get(sessionKey);
+        const cs = this.clientSessions.get(client.id);
         if (cs) {
           const pending = cs.pendingToolCalls.get(event.toolCallId);
           cs.toolCalls.push({

apps/gateway/src/commands/command-authorization.service.spec.ts

@@ -1,116 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-const adminCommand: CommandDef = {
-  name: 'gc',
-  description: 'GC',
-  aliases: [],
-  scope: 'admin',
-  execution: 'socket',
-  available: true,
-};
-const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-function createService(
-  role: string,
-  entries: Map<string, string> = new Map<string, string>(),
-): CommandAuthorizationService {
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('CommandAuthorizationService', () => {
-  it('consumes one exact actor-bound approval once', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(true);
-    expect(
-      (await service.authorize(adminCommand, payload, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('rejects an approval when the structured action is mutated', async (): Promise<void> => {
-    const service = createService('admin');
-    const approval = await service.createApproval(adminCommand, payload, 'admin-1');
-    const mutated = { ...payload, conversationId: 'other-conversation' };
-    expect(approval).not.toBeNull();
-    expect(
-      (await service.authorize(adminCommand, mutated, 'admin-1', approval!.approvalId)).allowed,
-    ).toBe(false);
-  });
-
-  it('denies an admin command to a member before approval is considered', async (): Promise<void> => {
-    const service = createService('member');
-    const approval = await service.createApproval(adminCommand, payload, 'member-1');
-    expect(approval).toBeNull();
-    expect(
-      (await service.authorize(adminCommand, payload, 'member-1', 'forged-approval-id')).allowed,
-    ).toBe(false);
-  });
-
-  it('denies a malformed durable approval expiry instead of treating it as unexpired', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-malformed-expiry',
-      agentName: 'Nova',
-    };
-    const service = createService('admin', entries);
-    const approval = await service.createRuntimeTerminationApproval(action);
-    expect(approval).not.toBeNull();
-    const key = `agent:Nova:command-approval:${approval!.approvalId}`;
-    const stored = entries.get(key);
-    expect(stored).toBeDefined();
-    entries.set(key, JSON.stringify({ ...JSON.parse(stored!), expiresAt: 'not-a-date' }));
-
-    expect(await service.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-
-  it('persists and consumes one exact runtime termination approval across a service restart', async (): Promise<void> => {
-    const entries = new Map<string, string>();
-    const action = {
-      providerId: 'fleet',
-      sessionId: 'nova',
-      actorId: 'admin-1',
-      tenantId: 'tenant-1',
-      channelId: 'discord:operator',
-      correlationId: 'correlation-1',
-      agentName: 'Nova',
-    };
-    const beforeRestart = createService('admin', entries);
-    const approval = await beforeRestart.createRuntimeTerminationApproval(action);
-
-    const afterRestart = createService('admin', entries);
-    expect(
-      await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, {
-        ...action,
-        sessionId: 'forged-session',
-      }),
-    ).toBe(false);
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      true,
-    );
-    expect(await afterRestart.consumeRuntimeTerminationApproval(approval!.approvalId, action)).toBe(
-      false,
-    );
-  });
-});

apps/gateway/src/commands/command-authorization.service.ts

@@ -1,268 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import { eq, users as usersTable, type Db } from '@mosaicstack/db';
-import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
-import { DB } from '../database/database.module.js';
-import { COMMANDS_REDIS } from './commands.tokens.js';
-
-export type CommandRole = 'admin' | 'member' | 'viewer';
-
-export interface CommandApproval {
-  approvalId: string;
-  actionDigest: string;
-  actorId: string;
-  command: string;
-  expiresAt: string;
-}
-
-/** Exact immutable binding for a privileged runtime termination. */
-export interface RuntimeTerminationApprovalAction {
-  providerId: string;
-  sessionId: string;
-  actorId: string;
-  tenantId: string;
-  channelId: string;
-  correlationId: string;
-  /** Provisioned roster identity; isolates approvals between interaction agents. */
-  agentName: string;
-}
-
-export interface RuntimeTerminationApproval extends RuntimeTerminationApprovalAction {
-  approvalId: string;
-  actionDigest: string;
-  expiresAt: string;
-}
-
-export interface CommandAuthorizationResult {
-  allowed: boolean;
-  reason?: string;
-}
-
-@Injectable()
-export class CommandAuthorizationService {
-  constructor(
-    @Inject(DB) private readonly db: Db,
-    @Inject(COMMANDS_REDIS)
-    private readonly redis: {
-      get(key: string): Promise<string | null>;
-      set(key: string, value: string, ...args: string[]): Promise<unknown>;
-      del(key: string): Promise<number>;
-    },
-  ) {}
-
-  async authorize(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-    approvalId?: string,
-  ): Promise<CommandAuthorizationResult> {
-    const role = await this.resolveRole(actorId);
-    if (!role || !this.hasScope(role, command.scope)) {
-      return { allowed: false, reason: 'not authorized for this command scope' };
-    }
-    if (command.scope !== 'admin') return { allowed: true };
-    if (!approvalId) return { allowed: false, reason: 'durable approval is required' };
-    const actionDigest = this.actionDigest(command.name, payload);
-    const approved = await this.consumeApproval(approvalId, actorId, actionDigest);
-    return approved
-      ? { allowed: true }
-      : {
-          allowed: false,
-          reason: 'approval is invalid, expired, replayed, or does not match this action',
-        };
-  }
-
-  async createApproval(
-    command: CommandDef,
-    payload: SlashCommandPayload,
-    actorId: string,
-  ): Promise<CommandApproval | null> {
-    const role = await this.resolveRole(actorId);
-    if (!role || command.scope !== 'admin' || !this.hasScope(role, command.scope)) return null;
-
-    const approvalId = randomUUID();
-    const expiresAt = new Date(Date.now() + 5 * 60_000).toISOString();
-    const approval: CommandApproval = {
-      approvalId,
-      actionDigest: this.actionDigest(command.name, payload),
-      actorId,
-      command: command.name,
-      expiresAt,
-    };
-    await this.redis.set(this.key(approvalId), JSON.stringify(approval), 'EX', '300');
-    return approval;
-  }
-
-  /**
-   * Uses the same `interaction:command-approval:*` store and one-time deletion rule as
-   * command approvals. This deliberately avoids a parallel approval database.
-   */
-  async createRuntimeTerminationApproval(
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<RuntimeTerminationApproval | null> {
-    if (!this.hasRuntimeTerminationAction(action)) return null;
-    const role = await this.resolveRole(action.actorId);
-    if (role !== 'admin') return null;
-
-    const approval: RuntimeTerminationApproval = {
-      approvalId: randomUUID(),
-      actionDigest: this.runtimeActionDigest(action),
-      ...action,
-      expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(),
-    };
-    await this.redis.set(
-      this.runtimeKey(action.agentName, approval.approvalId),
-      JSON.stringify(approval),
-      'EX',
-      '300',
-    );
-    return approval;
-  }
-
-  async consumeRuntimeTerminationApproval(
-    approvalId: string,
-    action: RuntimeTerminationApprovalAction,
-  ): Promise<boolean> {
-    const encoded = await this.redis.get(this.runtimeKey(action.agentName, approvalId));
-    if (!encoded) return false;
-    let approval: unknown;
-    try {
-      approval = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isRuntimeTerminationApproval(approval) ||
-      approval.actionDigest !== this.runtimeActionDigest(action) ||
-      approval.actorId !== action.actorId ||
-      approval.tenantId !== action.tenantId ||
-      !this.isUnexpired(approval.expiresAt)
-    ) {
-      return false;
-    }
-    if ((await this.resolveRole(approval.actorId)) !== 'admin') return false;
-    return (await this.redis.del(this.runtimeKey(action.agentName, approvalId))) === 1;
-  }
-
-  private async resolveRole(actorId: string): Promise<CommandRole | null> {
-    const [user] = await this.db
-      .select({ role: usersTable.role })
-      .from(usersTable)
-      .where(eq(usersTable.id, actorId))
-      .limit(1);
-    const role = user?.role;
-    return role === 'admin' || role === 'member' || role === 'viewer' ? role : null;
-  }
-
-  private hasScope(role: CommandRole, scope: CommandDef['scope']): boolean {
-    if (role === 'admin') return true;
-    return role === 'member' && (scope === 'core' || scope === 'agent');
-  }
-
-  private async consumeApproval(
-    approvalId: string,
-    actorId: string,
-    actionDigest: string,
-  ): Promise<boolean> {
-    const key = this.key(approvalId);
-    const encoded = await this.redis.get(key);
-    if (!encoded) return false;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(encoded);
-    } catch {
-      return false;
-    }
-    if (
-      !this.isCommandApproval(parsed) ||
-      parsed.actorId !== actorId ||
-      parsed.actionDigest !== actionDigest ||
-      !this.isUnexpired(parsed.expiresAt)
-    )
-      return false;
-    return (await this.redis.del(key)) === 1;
-  }
-
-  private actionDigest(command: string, payload: SlashCommandPayload): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          command,
-          args: payload.args?.trim() ?? '',
-          conversationId: payload.conversationId,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private hasRuntimeTerminationAction(action: RuntimeTerminationApprovalAction): boolean {
-    return [
-      action.providerId,
-      action.sessionId,
-      action.actorId,
-      action.tenantId,
-      action.channelId,
-      action.correlationId,
-      action.agentName,
-    ].every((value: string): boolean => value.trim().length > 0);
-  }
-
-  private runtimeActionDigest(action: RuntimeTerminationApprovalAction): string {
-    return createHash('sha256')
-      .update(
-        JSON.stringify({
-          providerId: action.providerId,
-          sessionId: action.sessionId,
-          actorId: action.actorId,
-          tenantId: action.tenantId,
-          channelId: action.channelId,
-          correlationId: action.correlationId,
-          agentName: action.agentName,
-        }),
-      )
-      .digest('hex');
-  }
-
-  private isUnexpired(expiresAt: unknown): expiresAt is string {
-    if (typeof expiresAt !== 'string') return false;
-    const expiresAtMs = Date.parse(expiresAt);
-    return Number.isFinite(expiresAtMs) && expiresAtMs > Date.now();
-  }
-
-  private isCommandApproval(value: unknown): value is CommandApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'expiresAt' in value &&
-      'command' in value
-    );
-  }
-
-  private isRuntimeTerminationApproval(value: unknown): value is RuntimeTerminationApproval {
-    return (
-      typeof value === 'object' &&
-      value !== null &&
-      'approvalId' in value &&
-      'actionDigest' in value &&
-      'actorId' in value &&
-      'tenantId' in value &&
-      'providerId' in value &&
-      'sessionId' in value &&
-      'channelId' in value &&
-      'correlationId' in value &&
-      'agentName' in value &&
-      'expiresAt' in value
-    );
-  }
-
-  private key(approvalId: string): string {
-    return `interaction:command-approval:${approvalId}`;
-  }
-
-  private runtimeKey(agentName: string, approvalId: string): string {
-    return `agent:${encodeURIComponent(agentName)}:command-approval:${approvalId}`;
-  }
-}

apps/gateway/src/commands/command-executor-p8012.spec.ts

@@ -106,8 +106,8 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(result.command).toBe('provider');
   });
 
-  // /provider login anthropic — no bearer token or auth URL reaches chat output
-  it('/provider login <name> keeps its one-time token out of chat output', async () => {
+  // /provider login anthropic — success with URL containing poll token
+  it('/provider login <name> returns success with URL and poll token', async () => {
     const payload: SlashCommandPayload = {
       command: 'provider',
       args: 'login anthropic',
@@ -117,9 +117,14 @@ describe('CommandExecutorService — P8-012 commands', () => {
     expect(result.success).toBe(true);
     expect(result.command).toBe('provider');
     expect(result.message).toContain('anthropic');
-    expect(result.message).not.toContain('http');
-    expect(result.message).not.toContain('token=');
-    expect(result.data).toEqual({ provider: 'anthropic' });
+    expect(result.message).toContain('http');
+    // data should contain loginUrl and pollToken
+    expect(result.data).toBeDefined();
+    const data = result.data as Record<string, unknown>;
+    expect(typeof data['loginUrl']).toBe('string');
+    expect(typeof data['pollToken']).toBe('string');
+    expect(data['loginUrl'] as string).toContain('anthropic');
+    expect(data['loginUrl'] as string).toContain(data['pollToken'] as string);
     // Verify Valkey was called
     expect(mockRedis.set).toHaveBeenCalledOnce();
     const [key, value, , ttl] = mockRedis.set.mock.calls[0] as [string, string, string, number];

apps/gateway/src/commands/command-executor-tess-security.spec.ts

@@ -1,112 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import type { SlashCommandPayload } from '@mosaicstack/types';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-import { CommandExecutorService } from './command-executor.service.js';
-
-const registry = {
-  getManifest: vi.fn(() => ({
-    version: 1,
-    commands: [
-      {
-        name: 'gc',
-        description: 'System-wide garbage collection',
-        aliases: [],
-        scope: 'admin' as const,
-        execution: 'socket' as const,
-        available: true,
-      },
-    ],
-    skills: [],
-  })),
-};
-
-const sessionGc = {
-  sweepOrphans: vi.fn().mockResolvedValue({ orphanedSessions: 1, totalCleaned: [], duration: 1 }),
-};
-
-const scope = (userId: string) => ({ userId, tenantId: 'tenant-1' });
-
-const authorization = {
-  authorize: vi.fn((_command: unknown, _payload: unknown, actorId: string) =>
-    Promise.resolve(
-      actorId === 'member-1'
-        ? { allowed: false, reason: 'durable approval is required' }
-        : { allowed: false, reason: 'not authorized for this command scope' },
-    ),
-  ),
-};
-
-function buildExecutor(authorizationService: unknown = authorization): CommandExecutorService {
-  return new CommandExecutorService(
-    registry as never,
-    { getSession: vi.fn() } as never,
-    { clear: vi.fn(), set: vi.fn() } as never,
-    sessionGc as never,
-    { set: vi.fn() } as never,
-    { agents: {} } as never,
-    null,
-    null,
-    null,
-    authorizationService as never,
-  );
-}
-
-function createDurableAuthorization(): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => {
-      entries.set(key, value);
-    },
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-describe('TESS-M1-SEC-001 command authorization abuse cases', () => {
-  const payload: SlashCommandPayload = { command: 'gc', conversationId: 'conversation-1' };
-
-  beforeEach((): void => {
-    vi.clearAllMocks();
-  });
-
-  it('denies a forged admin identity and does not execute a system-wide command', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('admin-forged-by-client'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('not authorized');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('denies a privileged command without a server-bound durable approval', async (): Promise<void> => {
-    const result = await buildExecutor().execute(payload, scope('member-1'));
-
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('approval');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-
-  it('executes an admin command only after a valid durable approval is issued and supplied', async (): Promise<void> => {
-    const executor = buildExecutor(createDurableAuthorization());
-
-    const adminScope = scope('admin-1');
-    const denied = await executor.execute(payload, adminScope);
-    const approval = await executor.createApproval(payload, adminScope);
-    const approved = await executor.execute(
-      { ...payload, approvalId: approval?.approvalId },
-      adminScope,
-    );
-
-    expect(denied.success).toBe(false);
-    expect(denied.message).toContain('approval');
-    expect(approval).not.toBeNull();
-    // A valid durable approval is consumed, but cannot authorize an unimplemented
-    // global retention operation. Session-scoped cleanup remains lifecycle-only.
-    expect(approved.success).toBe(false);
-    expect(approved.message).toContain('Global GC is disabled');
-    expect(sessionGc.sweepOrphans).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/commands/command-executor.service.ts

@@ -11,7 +11,6 @@ import { ReloadService } from '../reload/reload.service.js';
 import { McpClientService } from '../mcp-client/mcp-client.service.js';
 import { BRAIN } from '../brain/brain.tokens.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
 
 @Injectable()
@@ -34,9 +33,6 @@ export class CommandExecutorService {
     @Optional()
     @Inject(McpClientService)
     private readonly mcpClient: McpClientService | null,
-    @Optional()
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService | null = null,
   ) {}
 
   async execute(
@@ -56,16 +52,6 @@ export class CommandExecutorService {
       };
     }
 
-    const authorization = await this.authorization?.authorize(
-      def,
-      payload,
-      userId,
-      payload.approvalId,
-    );
-    if (authorization && !authorization.allowed) {
-      return { command, conversationId, success: false, message: authorization.reason };
-    }
-
     try {
       switch (command) {
         case 'model':
@@ -102,15 +88,16 @@ export class CommandExecutorService {
             success: true,
             message: 'Retry last message requested.',
           };
-        case 'gc':
-          // Global retention requires a separate, authorized and audited job.
-          // Session cleanup is performed only through the session lifecycle.
+        case 'gc': {
+          // Admin-only: system-wide GC sweep across all sessions
+          const result = await this.sessionGC.sweepOrphans();
           return {
             command: 'gc',
-            success: false,
-            message: 'Global GC is disabled pending an authorized retention job.',
+            success: true,
+            message: `GC sweep complete: ${result.orphanedSessions} orphaned sessions cleaned in ${result.duration}ms.`,
             conversationId,
           };
+        }
         case 'agent':
           return await this.handleAgent(args ?? null, conversationId, scope);
         case 'provider':
@@ -161,14 +148,6 @@ export class CommandExecutorService {
     }
   }
 
-  async createApproval(payload: SlashCommandPayload, scope: ActorTenantScope) {
-    const def = this.registry
-      .getManifest()
-      .commands.find((command) => command.name === payload.command);
-    if (!def || !this.authorization) return null;
-    return this.authorization.createApproval(def, payload, scope.userId);
-  }
-
   private async handleModel(
     args: string | null,
     conversationId: string,
@@ -435,28 +414,22 @@ export class CommandExecutorService {
           };
         }
         const pollToken = crypto.randomUUID();
-        const tokenDigest = await crypto.subtle.digest(
-          'SHA-256',
-          new TextEncoder().encode(pollToken),
-        );
-        const tokenHash = Array.from(new Uint8Array(tokenDigest), (byte: number): string =>
-          byte.toString(16).padStart(2, '0'),
-        ).join('');
-        const key = `mosaic:auth:poll:${tokenHash}`;
-        // Persist only a short-lived token digest. The raw token is delivered only by
-        // the authenticated dashboard flow, never in chat output or command metadata.
+        const key = `mosaic:auth:poll:${pollToken}`;
+        // Store pending state in Valkey (TTL 5 minutes)
         await this.redis.set(
           key,
           JSON.stringify({ status: 'pending', provider: providerName, userId }),
           'EX',
           300,
         );
+        // In production this would construct an OAuth URL
+        const loginUrl = `${process.env['MOSAIC_BASE_URL'] ?? 'http://localhost:3000'}/auth/provider/${providerName}?token=${pollToken}`;
         return {
           command: 'provider',
           success: true,
-          message: `Provider login for ${providerName} is ready. Continue in the authenticated dashboard.`,
+          message: `Open this URL to authenticate with ${providerName}:\n${loginUrl}`,
           conversationId,
-          data: { provider: providerName },
+          data: { loginUrl, pollToken, provider: providerName },
         };
       }
 

apps/gateway/src/commands/commands.integration.spec.ts

@@ -177,12 +177,14 @@ describe('CommandExecutorService — integration', () => {
     expect(result.command).toBe('nonexistent');
   });
 
-  it('/gc refuses an unaudited global sweep', async () => {
+  // /gc handler calls SessionGCService.sweepOrphans (admin-only, no userId arg)
+  it('/gc calls SessionGCService.sweepOrphans without arguments', async () => {
     const payload: SlashCommandPayload = { command: 'gc', conversationId };
     const result = await executor.execute(payload, userScope);
-    expect(mockSessionGC.sweepOrphans).not.toHaveBeenCalled();
-    expect(result.success).toBe(false);
-    expect(result.message).toContain('disabled pending an authorized retention job');
+    expect(mockSessionGC.sweepOrphans).toHaveBeenCalledWith();
+    expect(result.success).toBe(true);
+    expect(result.message).toContain('GC sweep complete');
+    expect(result.message).toContain('3 orphaned sessions');
   });
 
   // /system with args calls SystemOverrideService.set

apps/gateway/src/commands/commands.module.ts

@@ -3,10 +3,8 @@ import { createQueue, type QueueHandle } from '@mosaicstack/queue';
 import { ChatModule } from '../chat/chat.module.js';
 import { GCModule } from '../gc/gc.module.js';
 import { ReloadModule } from '../reload/reload.module.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
 import { CommandExecutorService } from './command-executor.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
-import { CommandRuntimeApprovalVerifier } from './runtime-approval-verifier.js';
 import { COMMANDS_REDIS } from './commands.tokens.js';
 
 const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
@@ -26,16 +24,9 @@ const COMMANDS_QUEUE_HANDLE = 'COMMANDS_QUEUE_HANDLE';
       inject: [COMMANDS_QUEUE_HANDLE],
     },
     CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
-    CommandExecutorService,
-  ],
-  exports: [
-    CommandRegistryService,
-    CommandAuthorizationService,
-    CommandRuntimeApprovalVerifier,
     CommandExecutorService,
   ],
+  exports: [CommandRegistryService, CommandExecutorService],
 })
 export class CommandsModule implements OnApplicationShutdown {
   constructor(@Inject(COMMANDS_QUEUE_HANDLE) private readonly handle: QueueHandle) {}

apps/gateway/src/commands/runtime-approval-verifier.ts

@@ -1,23 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import type {
-  RuntimeApprovalVerifier,
-  RuntimeTerminationAction,
-} from '../agent/runtime-provider-registry.service.js';
-import { CommandAuthorizationService } from './command-authorization.service.js';
-
-/**
- * Adapter from the provider registry's exact termination action to the shared,
- * Redis-backed `interaction:command-approval:*` store. It has no separate approval
- * persistence or replay semantics.
- */
-@Injectable()
-export class CommandRuntimeApprovalVerifier implements RuntimeApprovalVerifier {
-  constructor(
-    @Inject(CommandAuthorizationService)
-    private readonly authorization: CommandAuthorizationService,
-  ) {}
-
-  async consume(approvalRef: string, action: RuntimeTerminationAction): Promise<boolean> {
-    return this.authorization.consumeRuntimeTerminationApproval(approvalRef, action);
-  }
-}

apps/gateway/src/coord/coord.module.ts

@@ -1,32 +1,10 @@
 import { Module } from '@nestjs/common';
-import { InMemoryInteractionCoordinationPort } from '@mosaicstack/coord';
 import { CoordService } from './coord.service.js';
 import { CoordController } from './coord.controller.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import {
-  COORDINATION_CONFIG,
-  COORDINATION_PORT,
-  InteractionCoordinationService,
-} from './interaction-coordination.service.js';
 
 @Module({
-  providers: [
-    CoordService,
-    {
-      provide: COORDINATION_PORT,
-      useFactory: (): InMemoryInteractionCoordinationPort =>
-        new InMemoryInteractionCoordinationPort(),
-    },
-    {
-      provide: COORDINATION_CONFIG,
-      useFactory: () => ({
-        interactionAgentId: process.env['MOSAIC_AGENT_NAME'],
-        orchestrationAgentId: process.env['MOSAIC_ORCHESTRATOR_AGENT_NAME'],
-      }),
-    },
-    InteractionCoordinationService,
-  ],
-  controllers: [CoordController, InteractionCoordinationController],
-  exports: [CoordService, InteractionCoordinationService],
+  providers: [CoordService],
+  controllers: [CoordController],
+  exports: [CoordService],
 })
 export class CoordModule {}

apps/gateway/src/coord/interaction-coordination.controller.test.ts

@@ -1,47 +0,0 @@
-const PATH_METADATA = 'path';
-import { describe, expect, it, vi } from 'vitest';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-
-const user = { id: 'operator-1', tenantId: 'tenant-a' };
-
-describe('InteractionCoordinationController', () => {
-  it('exposes the neutral canonical route and Mos compatibility alias over identical handlers', () => {
-    expect(Reflect.getMetadata(PATH_METADATA, InteractionCoordinationController)).toEqual([
-      'api/coord/interaction',
-      'api/coord/mos',
-    ]);
-    expect(InteractionCoordinationController.prototype.handoff).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.observe).toBeTypeOf('function');
-    expect(InteractionCoordinationController.prototype.result).toBeTypeOf('function');
-  });
-
-  it('derives actor and tenant from the authenticated user rather than handoff input', async () => {
-    const coordination = {
-      handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, 'corr-1');
-
-    expect(coordination.handoff).toHaveBeenCalledWith(
-      { idempotencyKey: 'request-1', summary: 'Implement' },
-      expect.objectContaining({
-        actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-        channelId: 'cli',
-        correlationId: 'corr-1',
-      }),
-    );
-  });
-
-  it('requires a correlation header before invoking the coordination service', async () => {
-    const coordination = { handoff: vi.fn(), observe: vi.fn(), result: vi.fn() };
-    const controller = new InteractionCoordinationController(coordination as never);
-
-    await expect(
-      controller.handoff({ idempotencyKey: 'request-1', summary: 'Implement' }, user, undefined),
-    ).rejects.toThrow('X-Correlation-Id is required');
-    expect(coordination.handoff).not.toHaveBeenCalled();
-  });
-});

apps/gateway/src/coord/interaction-coordination.controller.ts

@@ -1,75 +0,0 @@
-import {
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Headers,
-  Inject,
-  Param,
-  Post,
-  UseGuards,
-} from '@nestjs/common';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { CurrentUser } from '../auth/current-user.decorator.js';
-import { scopeFromUser, type AuthenticatedUserLike } from '../auth/session-scope.js';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type {
-  InteractionCoordinationObservationDto,
-  InteractionCoordinationResponseDto,
-  InteractionCoordinationResultDto,
-  CreateHandoffDto,
-} from './interaction-coordination.dto.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-/** Authenticated interaction-plane boundary for the handoff/observe/result-only interaction coordination contract. */
-/** `api/coord/interaction` is canonical; the Mos path remains a compatibility alias. */
-@Controller(['api/coord/interaction', 'api/coord/mos'])
-@UseGuards(AuthGuard)
-export class InteractionCoordinationController {
-  constructor(
-    @Inject(InteractionCoordinationService)
-    private readonly coordination: InteractionCoordinationService,
-  ) {}
-
-  @Post('handoff')
-  async handoff(
-    @Body() request: CreateHandoffDto,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResponseDto> {
-    return { receipt: await this.coordination.handoff(request, this.context(user, correlationId)) };
-  }
-
-  @Get(':handoffId/observe')
-  async observe(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationObservationDto> {
-    return {
-      observation: await this.coordination.observe(handoffId, this.context(user, correlationId)),
-    };
-  }
-
-  @Get(':handoffId/result')
-  async result(
-    @Param('handoffId') handoffId: string,
-    @CurrentUser() user: AuthenticatedUserLike,
-    @Headers('x-correlation-id') correlationId?: string,
-  ): Promise<InteractionCoordinationResultDto> {
-    return { result: await this.coordination.result(handoffId, this.context(user, correlationId)) };
-  }
-
-  private context(
-    user: AuthenticatedUserLike,
-    correlationId?: string,
-  ): RuntimeProviderRequestContext {
-    const requestCorrelationId = correlationId?.trim();
-    if (!requestCorrelationId) throw new ForbiddenException('X-Correlation-Id is required');
-    return {
-      actorScope: scopeFromUser(user),
-      channelId: 'cli',
-      correlationId: requestCorrelationId,
-    };
-  }
-}

apps/gateway/src/coord/interaction-coordination.dto.ts

@@ -1,25 +0,0 @@
-import type {
-  CoordinationObservation,
-  CoordinationResult,
-  HandoffReceipt,
-} from '@mosaicstack/coord';
-
-/** Input accepted at the gateway coordination boundary. Agent identity is not caller-controlled. */
-export interface CreateHandoffDto {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-export interface InteractionCoordinationResponseDto {
-  receipt: HandoffReceipt;
-}
-
-export interface InteractionCoordinationObservationDto {
-  observation: CoordinationObservation;
-}
-
-export interface InteractionCoordinationResultDto {
-  result: CoordinationResult;
-}

apps/gateway/src/coord/interaction-coordination.routing.e2e.test.ts

@@ -1,88 +0,0 @@
-import 'reflect-metadata';
-import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
-import { Global, Module } from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { FastifyAdapter, type NestFastifyApplication } from '@nestjs/platform-fastify';
-import { AUTH } from '../auth/auth.tokens.js';
-import { AuthGuard } from '../auth/auth.guard.js';
-import { InteractionCoordinationController } from './interaction-coordination.controller.js';
-import { InteractionCoordinationService } from './interaction-coordination.service.js';
-
-@Global()
-@Module({
-  providers: [
-    {
-      provide: AUTH,
-      useValue: {
-        api: {
-          getSession: vi.fn(async ({ headers }: { headers: Headers }) =>
-            headers.get('cookie') === 'session=trusted'
-              ? { user: { id: 'operator-1', tenantId: 'tenant-1' }, session: { id: 'session-1' } }
-              : null,
-          ),
-        },
-      },
-    },
-    AuthGuard,
-  ],
-  exports: [AUTH, AuthGuard],
-})
-class AuthenticatedRequestModule {}
-
-describe('InteractionCoordinationController route aliases', (): void => {
-  let app: NestFastifyApplication | undefined;
-  const coordination = {
-    handoff: vi.fn(async () => ({ handoffId: 'handoff-1' })),
-    observe: vi.fn(async () => ({ status: 'running' })),
-    result: vi.fn(async () => ({ status: 'completed' })),
-  };
-
-  beforeAll(async (): Promise<void> => {
-    const moduleRef = await Test.createTestingModule({
-      imports: [AuthenticatedRequestModule],
-      controllers: [InteractionCoordinationController],
-      providers: [{ provide: InteractionCoordinationService, useValue: coordination }],
-    }).compile();
-    app = moduleRef.createNestApplication<NestFastifyApplication>(new FastifyAdapter());
-    await app.init();
-    await app.getHttpAdapter().getInstance().ready();
-  });
-  afterAll(async (): Promise<void> => app?.close());
-
-  it('routes handoff, observe, and result through the same AuthGuard-protected service for both prefixes', async (): Promise<void> => {
-    if (!app) throw new Error('test app was not initialized');
-    for (const prefix of ['/api/coord/interaction', '/api/coord/mos']) {
-      const headers = { cookie: 'session=trusted', 'x-correlation-id': `corr-${prefix}` };
-      expect(
-        (
-          await app.inject({
-            method: 'POST',
-            url: `${prefix}/handoff`,
-            headers,
-            payload: { idempotencyKey: `key-${prefix}`, summary: 'handoff' },
-          })
-        ).statusCode,
-      ).toBe(201);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/observe`, headers }))
-          .statusCode,
-      ).toBe(200);
-      expect(
-        (await app.inject({ method: 'GET', url: `${prefix}/handoff-1/result`, headers }))
-          .statusCode,
-      ).toBe(200);
-    }
-    expect(coordination.handoff).toHaveBeenCalledTimes(2);
-    expect(coordination.observe).toHaveBeenCalledTimes(2);
-    expect(coordination.result).toHaveBeenCalledTimes(2);
-    expect(
-      (
-        await app.inject({
-          method: 'POST',
-          url: '/api/coord/interaction/handoff',
-          payload: { idempotencyKey: 'denied', summary: 'x' },
-        })
-      ).statusCode,
-    ).toBe(401);
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.test.ts

@@ -1,217 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import {
-  InMemoryInteractionCoordinationPort,
-  type InteractionCoordinationPort,
-  type Handoff,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import {
-  InteractionCoordinationService,
-  type InteractionCoordinationConfig,
-  type InteractionCoordinationGatewayError,
-} from './interaction-coordination.service.js';
-
-const context: RuntimeProviderRequestContext = {
-  actorScope: { userId: 'operator-1', tenantId: 'tenant-a' },
-  channelId: 'cli',
-  correlationId: 'corr-1',
-};
-
-const config: InteractionCoordinationConfig = {
-  interactionAgentId: 'Nova',
-  orchestrationAgentId: 'Conductor',
-};
-
-function service(
-  port: InteractionCoordinationPort = new InMemoryInteractionCoordinationPort(),
-  options: {
-    config?: InteractionCoordinationConfig;
-    handoffIdFactory?: () => string;
-  } = {},
-): InteractionCoordinationService {
-  return new InteractionCoordinationService(
-    port,
-    options.config ?? config,
-    options.handoffIdFactory ?? (() => 'handoff-1'),
-  );
-}
-
-describe('InteractionCoordinationService authority boundary', (): void => {
-  it('derives identity and actor/tenant scope server-side, then round-trips the native adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const coordination = service(adapter);
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).resolves.toEqual({
-      handoffId: 'handoff-1',
-      targetAgentId: 'Conductor',
-      status: 'queued',
-      correlationId: 'corr-1',
-    });
-
-    adapter.recordActivity('handoff-1', 'running', 'Orchestrator accepted the request');
-    adapter.recordResult('handoff-1', 'completed', 'Merged by orchestrator');
-
-    const followUpContext = { ...context, correlationId: 'corr-2' };
-    await expect(coordination.observe('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-    });
-    await expect(coordination.result('handoff-1', followUpContext)).resolves.toMatchObject({
-      targetAgentId: 'Conductor',
-      status: 'completed',
-      summary: 'Merged by orchestrator',
-    });
-  });
-
-  it('fails closed without calling a port when the interaction requester is unconfigured', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: '', orchestrationAgentId: 'Conductor' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({
-      code: 'unconfigured_requester',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('rejects self-delegation configuration before delivering work', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter, {
-      config: { interactionAgentId: 'Nova', orchestrationAgentId: 'Nova' },
-    });
-
-    await expect(
-      coordination.handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toThrow('Interaction and orchestration identities must differ');
-    expect(handoff).not.toHaveBeenCalled();
-  });
-
-  it('denies cross-tenant observe and result before calling the adapter', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const observe = vi.spyOn(adapter, 'observe');
-    const result = vi.spyOn(adapter, 'result');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    const otherTenant = {
-      ...context,
-      actorScope: { ...context.actorScope, tenantId: 'tenant-b' },
-    };
-    await expect(coordination.observe('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(coordination.result('handoff-1', otherTenant)).rejects.toMatchObject({
-      code: 'cross_tenant_forbidden',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(observe).not.toHaveBeenCalled();
-    expect(result).not.toHaveBeenCalled();
-  });
-
-  it('scopes idempotency by actor and joins concurrent retries without duplicate delivery', async (): Promise<void> => {
-    let handoffSequence = 0;
-    let release: (() => void) | undefined;
-    const delivered = new Promise<void>((resolve: () => void): void => {
-      release = resolve;
-    });
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => {
-        await delivered;
-        return {
-          handoffId: handoff.handoffId,
-          targetAgentId: handoff.targetAgentId,
-          status: 'queued' as const,
-          correlationId: handoff.scope.correlationId,
-        };
-      }),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-    const coordination = service(adapter, {
-      handoffIdFactory: (): string => `handoff-${++handoffSequence}`,
-    });
-    const request = { idempotencyKey: 'request-1', summary: 'Implement the requested feature' };
-
-    const first = coordination.handoff(request, context);
-    const retry = coordination.handoff(request, context);
-    expect(adapter.handoff).toHaveBeenCalledTimes(1);
-    release?.();
-    await expect(Promise.all([first, retry])).resolves.toEqual([
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-      expect.objectContaining({ handoffId: 'handoff-1' }),
-    ]);
-
-    await expect(
-      coordination.handoff(request, {
-        ...context,
-        actorScope: { ...context.actorScope, userId: 'operator-2' },
-      }),
-    ).resolves.toMatchObject({ handoffId: 'handoff-2' });
-    expect(adapter.handoff).toHaveBeenCalledTimes(2);
-  });
-
-  it('rejects idempotency-key payload drift and malformed handoff input before delivery', async (): Promise<void> => {
-    const adapter = new InMemoryInteractionCoordinationPort();
-    const handoff = vi.spyOn(adapter, 'handoff');
-    const coordination = service(adapter);
-    await coordination.handoff(
-      { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-      context,
-    );
-
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-1', summary: 'Different work' }, context),
-    ).rejects.toMatchObject({
-      code: 'handoff_conflict',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-2', summary: '' }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    await expect(
-      coordination.handoff({ idempotencyKey: 'request-3', summary: 'x'.repeat(2_049) }, context),
-    ).rejects.toMatchObject({
-      code: 'invalid_request',
-    } satisfies Partial<InteractionCoordinationGatewayError>);
-    expect(handoff).toHaveBeenCalledTimes(1);
-  });
-
-  it('fails closed when the port reports a target that drifts from configuration', async (): Promise<void> => {
-    const adapter: InteractionCoordinationPort = {
-      handoff: vi.fn(async (handoff: Handoff) => ({
-        handoffId: handoff.handoffId,
-        targetAgentId: 'Unexpected',
-        status: 'accepted' as const,
-        correlationId: handoff.scope.correlationId,
-      })),
-      observe: vi.fn(),
-      result: vi.fn(),
-    };
-
-    await expect(
-      service(adapter).handoff(
-        { idempotencyKey: 'request-1', summary: 'Implement the requested feature' },
-        context,
-      ),
-    ).rejects.toMatchObject({ code: 'target_drift' });
-  });
-});

apps/gateway/src/coord/interaction-coordination.service.ts

@@ -1,303 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import {
-  InteractionCoordinationClient,
-  type CoordinationObservation,
-  type CoordinationResult,
-  type CoordinationScope,
-  type InteractionCoordinationIdentity,
-  type InteractionCoordinationPort,
-  type HandoffReceipt,
-} from '@mosaicstack/coord';
-import type { RuntimeProviderRequestContext } from '../agent/runtime-provider-registry.service.js';
-import type { CreateHandoffDto } from './interaction-coordination.dto.js';
-
-export const COORDINATION_PORT = Symbol('COORDINATION_PORT');
-export const COORDINATION_CONFIG = Symbol('COORDINATION_CONFIG');
-
-const HANDOFF_TRACKING_TTL_MS = 60 * 60 * 1_000;
-const MAX_TRACKED_HANDOFFS = 1_000;
-const MAX_IDEMPOTENCY_KEY_LENGTH = 128;
-const MAX_SUMMARY_LENGTH = 2_048;
-const MAX_CONTEXT_LENGTH = 8_192;
-const MAX_MISSION_ID_LENGTH = 128;
-
-export interface InteractionCoordinationConfig {
-  interactionAgentId?: string;
-  orchestrationAgentId?: string;
-}
-
-interface HandoffOwner {
-  actorId: string;
-  tenantId: string;
-  requesterAgentId: string;
-  correlationId: string;
-  expiresAt: number;
-}
-
-interface NormalizedHandoffRequest {
-  idempotencyKey: string;
-  summary: string;
-  context?: string;
-  missionId?: string;
-}
-
-interface TrackedHandoff {
-  request: NormalizedHandoffRequest;
-  receipt: Promise<HandoffReceipt>;
-  expiresAt: number;
-}
-
-/**
- * Gateway authority boundary for the interaction agent. It derives requester,
- * actor, and tenant from trusted server configuration and authentication; no
- * channel request can name a target or gain orchestrator-owned orchestration verbs.
- */
-@Injectable()
-export class InteractionCoordinationService {
-  private readonly owners = new Map<string, HandoffOwner>();
-  private readonly handoffsByIdempotencyKey = new Map<string, TrackedHandoff>();
-
-  constructor(
-    @Inject(COORDINATION_PORT) private readonly port: InteractionCoordinationPort,
-    @Inject(COORDINATION_CONFIG) private readonly config: InteractionCoordinationConfig,
-    private readonly handoffIdFactory: () => string = (): string => crypto.randomUUID(),
-  ) {}
-
-  async handoff(
-    request: CreateHandoffDto,
-    context: RuntimeProviderRequestContext,
-  ): Promise<HandoffReceipt> {
-    this.pruneExpiredTracking();
-    const normalized = this.normalizeRequest(request);
-    const scope = this.scope(context);
-    const idempotencyKey = this.idempotencyKey(normalized.idempotencyKey, scope);
-    const existing = this.handoffsByIdempotencyKey.get(idempotencyKey);
-    if (existing !== undefined) {
-      if (!sameRequest(existing.request, normalized)) {
-        throw new InteractionCoordinationGatewayError(
-          'handoff_conflict',
-          'Handoff idempotency key is already bound to different immutable input',
-        );
-      }
-      return existing.receipt;
-    }
-
-    const pending = this.deliverHandoff(this.handoffIdFactory(), normalized, scope);
-    const tracked: TrackedHandoff = {
-      request: normalized,
-      receipt: pending,
-      expiresAt: this.expiresAt(),
-    };
-    this.handoffsByIdempotencyKey.set(idempotencyKey, tracked);
-    this.enforceTrackingLimit(this.handoffsByIdempotencyKey);
-    try {
-      return await pending;
-    } catch (error: unknown) {
-      if (this.handoffsByIdempotencyKey.get(idempotencyKey) === tracked) {
-        this.handoffsByIdempotencyKey.delete(idempotencyKey);
-      }
-      throw error;
-    }
-  }
-
-  async observe(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationObservation> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().observe(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  async result(
-    handoffId: string,
-    context: RuntimeProviderRequestContext,
-  ): Promise<CoordinationResult> {
-    this.pruneExpiredTracking();
-    const scope = this.scope(context);
-    const owner = this.ownerFor(handoffId, scope);
-    return this.client().result(handoffId, { ...scope, correlationId: owner.correlationId });
-  }
-
-  private async deliverHandoff(
-    handoffId: string,
-    request: NormalizedHandoffRequest,
-    scope: CoordinationScope,
-  ): Promise<HandoffReceipt> {
-    const receipt = await this.client((): string => handoffId).handoff(request, scope);
-    const owner: HandoffOwner = {
-      actorId: scope.actorId,
-      tenantId: scope.tenantId,
-      requesterAgentId: scope.requesterAgentId,
-      correlationId: scope.correlationId,
-      expiresAt: this.expiresAt(),
-    };
-    const existing = this.owners.get(receipt.handoffId);
-    if (existing !== undefined && !sameOwner(existing, owner)) {
-      throw new InteractionCoordinationGatewayError(
-        'handoff_conflict',
-        'Handoff ID is already bound to a different authenticated scope',
-      );
-    }
-    this.owners.set(receipt.handoffId, owner);
-    this.enforceTrackingLimit(this.owners);
-    return receipt;
-  }
-
-  private client(handoffIdFactory?: () => string): InteractionCoordinationClient {
-    return new InteractionCoordinationClient(this.identity(), this.port, handoffIdFactory);
-  }
-
-  private identity(): InteractionCoordinationIdentity {
-    const interactionAgentId = this.config.interactionAgentId?.trim();
-    const orchestrationAgentId = this.config.orchestrationAgentId?.trim();
-    if (!interactionAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_requester',
-        'Interaction agent identity is not configured',
-      );
-    }
-    if (!orchestrationAgentId) {
-      throw new InteractionCoordinationGatewayError(
-        'unconfigured_target',
-        'Orchestration agent identity is not configured',
-      );
-    }
-    return { interactionAgentId, orchestrationAgentId };
-  }
-
-  private scope(context: RuntimeProviderRequestContext): CoordinationScope {
-    const identity = this.identity();
-    return Object.freeze({
-      actorId: context.actorScope.userId,
-      tenantId: context.actorScope.tenantId,
-      correlationId: context.correlationId,
-      requesterAgentId: identity.interactionAgentId,
-    });
-  }
-
-  private normalizeRequest(request: CreateHandoffDto): NormalizedHandoffRequest {
-    if (typeof request !== 'object' || request === null) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        'Handoff request is invalid',
-      );
-    }
-    const idempotencyKey = this.requiredString(
-      request.idempotencyKey,
-      'idempotency key',
-      MAX_IDEMPOTENCY_KEY_LENGTH,
-    );
-    const summary = this.requiredString(request.summary, 'summary', MAX_SUMMARY_LENGTH);
-    const context = this.optionalString(request.context, 'context', MAX_CONTEXT_LENGTH);
-    const missionId = this.optionalString(request.missionId, 'mission ID', MAX_MISSION_ID_LENGTH);
-    return Object.freeze({
-      idempotencyKey,
-      summary,
-      ...(context === undefined ? {} : { context }),
-      ...(missionId === undefined ? {} : { missionId }),
-    });
-  }
-
-  private idempotencyKey(requestKey: string, scope: CoordinationScope): string {
-    return `${scope.tenantId}\u0000${scope.actorId}\u0000${scope.requesterAgentId}\u0000${requestKey}`;
-  }
-
-  private requiredString(value: unknown, field: string, maximumLength: number): string {
-    if (typeof value !== 'string') {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} must be a string`,
-      );
-    }
-    const normalized = value.trim();
-    if (normalized.length === 0 || normalized.length > maximumLength) {
-      throw new InteractionCoordinationGatewayError(
-        'invalid_request',
-        `Handoff ${field} is invalid`,
-      );
-    }
-    return normalized;
-  }
-
-  private optionalString(value: unknown, field: string, maximumLength: number): string | undefined {
-    if (value === undefined) return undefined;
-    return this.requiredString(value, field, maximumLength);
-  }
-
-  private expiresAt(): number {
-    return Date.now() + HANDOFF_TRACKING_TTL_MS;
-  }
-
-  private pruneExpiredTracking(): void {
-    const now = Date.now();
-    for (const [key, tracked] of this.handoffsByIdempotencyKey) {
-      if (tracked.expiresAt <= now) this.handoffsByIdempotencyKey.delete(key);
-    }
-    for (const [key, owner] of this.owners) {
-      if (owner.expiresAt <= now) this.owners.delete(key);
-    }
-  }
-
-  private enforceTrackingLimit<T>(entries: Map<string, T>): void {
-    while (entries.size > MAX_TRACKED_HANDOFFS) {
-      const oldest = entries.keys().next().value;
-      if (typeof oldest !== 'string') return;
-      entries.delete(oldest);
-    }
-  }
-
-  private ownerFor(handoffId: string, scope: CoordinationScope): HandoffOwner {
-    const owner = this.owners.get(handoffId);
-    if (owner === undefined) {
-      throw new InteractionCoordinationGatewayError('not_found', 'Handoff was not found');
-    }
-    if (
-      owner.tenantId !== scope.tenantId ||
-      owner.actorId !== scope.actorId ||
-      owner.requesterAgentId !== scope.requesterAgentId
-    ) {
-      throw new InteractionCoordinationGatewayError(
-        'cross_tenant_forbidden',
-        'Handoff is outside the authenticated scope',
-      );
-    }
-    return owner;
-  }
-}
-
-export type InteractionCoordinationGatewayErrorCode =
-  | 'cross_tenant_forbidden'
-  | 'handoff_conflict'
-  | 'invalid_request'
-  | 'not_found'
-  | 'unconfigured_requester'
-  | 'unconfigured_target';
-
-function sameOwner(left: HandoffOwner, right: HandoffOwner): boolean {
-  return (
-    left.actorId === right.actorId &&
-    left.tenantId === right.tenantId &&
-    left.requesterAgentId === right.requesterAgentId
-  );
-}
-
-function sameRequest(left: NormalizedHandoffRequest, right: NormalizedHandoffRequest): boolean {
-  return (
-    left.idempotencyKey === right.idempotencyKey &&
-    left.summary === right.summary &&
-    left.context === right.context &&
-    left.missionId === right.missionId
-  );
-}
-
-export class InteractionCoordinationGatewayError extends Error {
-  constructor(
-    readonly code: InteractionCoordinationGatewayErrorCode,
-    message: string,
-  ) {
-    super(message);
-    this.name = InteractionCoordinationGatewayError.name;
-  }
-}

apps/gateway/src/gc/session-gc.service.spec.ts

@@ -3,7 +3,6 @@ import { Logger } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { SessionGCService } from './session-gc.service.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 
 type MockRedis = {
   scan: ReturnType<typeof vi.fn>;
@@ -13,12 +12,7 @@ type MockRedis = {
 describe('SessionGCService', () => {
   let service: SessionGCService;
   let mockRedis: MockRedis;
-  let mockLogService: {
-    logs: {
-      promoteSessionToWarm: ReturnType<typeof vi.fn>;
-      promoteToWarm: ReturnType<typeof vi.fn>;
-    };
-  };
+  let mockLogService: { logs: { promoteToWarm: ReturnType<typeof vi.fn> } };
 
   /**
    * Helper: build a scan mock that returns all provided keys in a single
@@ -36,7 +30,6 @@ describe('SessionGCService', () => {
 
     mockLogService = {
       logs: {
-        promoteSessionToWarm: vi.fn().mockResolvedValue(0),
         promoteToWarm: vi.fn().mockResolvedValue(0),
       },
     };
@@ -66,76 +59,54 @@ describe('SessionGCService', () => {
     expect(result.cleaned.valkeyKeys).toBeUndefined();
   });
 
-  it('escapes glob metacharacters in a session identifier', async () => {
-    await service.collect('abc*?[tenant]\\escape');
-
-    expect(mockRedis.scan).toHaveBeenCalledWith(
-      '0',
-      'MATCH',
-      'mosaic:session:abc\\*\\?\\[tenant\\]\\\\escape:*',
-      'COUNT',
-      100,
-    );
-  });
-
-  it('preserves a valid durable approval after session GC', async () => {
-    const entries = new Map<string, string>();
-    const redis = {
-      scan: vi.fn().mockResolvedValue(['0', ['mosaic:session:owned:state']]),
-      get: vi.fn(async (key: string) => entries.get(key) ?? null),
-      set: vi.fn(async (key: string, value: string) => entries.set(key, value)),
-      del: vi.fn(async (...keys: string[]) => {
-        let deleted = 0;
-        for (const key of keys) deleted += Number(entries.delete(key));
-        return deleted;
-      }),
-    };
-    const authorization = new CommandAuthorizationService(
-      {
-        select: () => ({
-          from: () => ({ where: () => ({ limit: async () => [{ role: 'admin' }] }) }),
-        }),
-      } as never,
-      redis,
-    );
-    const command = {
-      name: 'gc',
-      description: 'System-wide garbage collection',
-      aliases: [],
-      scope: 'admin',
-      execution: 'socket',
-      available: true,
-    } as never;
-    const payload = { command: 'gc', conversationId: 'owned' };
-    const approval = await authorization.createApproval(command, payload, 'admin-1');
-    const approvalKey = `interaction:command-approval:${approval!.approvalId}`;
-    const gc = new SessionGCService(redis as never, mockLogService as unknown as LogService);
-
-    await gc.collect('owned');
-
-    expect(entries.has(approvalKey)).toBe(true);
-    await expect(
-      authorization.authorize(command, payload, 'admin-1', approval!.approvalId),
-    ).resolves.toEqual({ allowed: true });
-  });
-
   it('collect() returns sessionId in result', async () => {
     const result = await service.collect('test-session-id');
     expect(result.sessionId).toBe('test-session-id');
   });
 
-  it('collect() demotes logs only for the requested session', async () => {
-    await service.collect('owned-session');
-
-    expect(mockLogService.logs.promoteSessionToWarm).toHaveBeenCalledWith(
-      'owned-session',
-      expect.any(Date),
-    );
-    expect(mockLogService.logs.promoteToWarm).not.toHaveBeenCalled();
+  it('fullCollect() deletes all session keys', async () => {
+    mockRedis.scan = makeScanMock(['mosaic:session:abc:system', 'mosaic:session:xyz:foo']);
+    const result = await service.fullCollect();
+    expect(mockRedis.del).toHaveBeenCalled();
+    expect(result.valkeyKeys).toBe(2);
   });
 
-  it('does not expose automatic global GC entry points', () => {
-    expect('fullCollect' in service).toBe(false);
-    expect('sweepOrphans' in service).toBe(false);
+  it('fullCollect() with no keys returns 0 valkeyKeys', async () => {
+    mockRedis.scan = makeScanMock([]);
+    const result = await service.fullCollect();
+    expect(result.valkeyKeys).toBe(0);
+    expect(mockRedis.del).not.toHaveBeenCalled();
+  });
+
+  it('fullCollect() returns duration', async () => {
+    const result = await service.fullCollect();
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() extracts unique session IDs and collects them', async () => {
+    // First scan call returns the global session list; subsequent calls return
+    // per-session keys during collect().
+    mockRedis.scan = vi
+      .fn()
+      .mockResolvedValueOnce([
+        '0',
+        ['mosaic:session:abc:system', 'mosaic:session:abc:messages', 'mosaic:session:xyz:system'],
+      ])
+      // collect('abc') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:abc:system', 'mosaic:session:abc:messages']])
+      // collect('xyz') scan
+      .mockResolvedValueOnce(['0', ['mosaic:session:xyz:system']]);
+    mockRedis.del.mockResolvedValue(1);
+
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBeGreaterThanOrEqual(0);
+    expect(result.duration).toBeGreaterThanOrEqual(0);
+  });
+
+  it('sweepOrphans() returns empty when no session keys', async () => {
+    mockRedis.scan = makeScanMock([]);
+    const result = await service.sweepOrphans();
+    expect(result.orphanedSessions).toBe(0);
+    expect(result.totalCleaned).toHaveLength(0);
   });
 });

apps/gateway/src/gc/session-gc.service.ts

@@ -1,4 +1,4 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
 import type { QueueHandle } from '@mosaicstack/queue';
 import type { LogService } from '@mosaicstack/log';
 import { LOG_SERVICE } from '../log/log.tokens.js';
@@ -13,18 +13,49 @@ export interface GCResult {
   };
 }
 
-/** Escape Redis glob metacharacters so a session identifier is always literal. */
-function escapeRedisGlobLiteral(value: string): string {
-  return value.replace(/[\\*?\[\]]/g, '\\$&');
+export interface GCSweepResult {
+  orphanedSessions: number;
+  totalCleaned: GCResult[];
+  duration: number;
+}
+
+export interface FullGCResult {
+  valkeyKeys: number;
+  logsDemoted: number;
+  jobsPurged: number;
+  tempFilesRemoved: number;
+  duration: number;
 }
 
 @Injectable()
-export class SessionGCService {
+export class SessionGCService implements OnModuleInit {
+  private readonly logger = new Logger(SessionGCService.name);
+
   constructor(
     @Inject(REDIS) private readonly redis: QueueHandle['redis'],
     @Inject(LOG_SERVICE) private readonly logService: LogService,
   ) {}
 
+  onModuleInit(): void {
+    // Fire-and-forget: run full GC asynchronously so it does not block the
+    // NestJS bootstrap chain.  Cold-start GC typically takes 100–500 ms
+    // depending on Valkey key count; deferring it removes that latency from
+    // the TTFB of the first HTTP request.
+    this.fullCollect()
+      .then((result) => {
+        this.logger.log(
+          `Full GC complete: ${result.valkeyKeys} Valkey keys, ` +
+            `${result.logsDemoted} logs demoted, ` +
+            `${result.jobsPurged} jobs purged, ` +
+            `${result.tempFilesRemoved} temp dirs removed ` +
+            `(${result.duration}ms)`,
+        );
+      })
+      .catch((err: unknown) => {
+        this.logger.error('Cold-start GC failed', err instanceof Error ? err.stack : String(err));
+      });
+  }
+
   /**
    * Scan Valkey for all keys matching a pattern using SCAN (non-blocking).
    * KEYS is avoided because it blocks the Valkey event loop for the full scan
@@ -48,20 +79,86 @@ export class SessionGCService {
     const result: GCResult = { sessionId, cleaned: {} };
 
     // 1. Valkey: delete all session-scoped keys
-    const pattern = `mosaic:session:${escapeRedisGlobLiteral(sessionId)}:*`;
+    const pattern = `mosaic:session:${sessionId}:*`;
     const valkeyKeys = await this.scanKeys(pattern);
     if (valkeyKeys.length > 0) {
       await this.redis.del(...valkeyKeys);
       result.cleaned.valkeyKeys = valkeyKeys.length;
     }
 
-    // 2. PG: demote hot-tier agent logs for this session only.
-    const cutoff = new Date();
-    const logsDemoted = await this.logService.logs.promoteSessionToWarm(sessionId, cutoff);
+    // 2. PG: demote hot-tier agent_logs for this session to warm
+    const cutoff = new Date(); // demote all hot logs for this session
+    const logsDemoted = await this.logService.logs.promoteToWarm(cutoff);
     if (logsDemoted > 0) {
       result.cleaned.logsDemoted = logsDemoted;
     }
 
     return result;
   }
+
+  /**
+   * Sweep GC — find orphaned artifacts from dead sessions.
+   * System-wide operation: only call from admin-authorized paths or internal
+   * scheduled jobs.  Individual session cleanup is handled by collect().
+   */
+  async sweepOrphans(): Promise<GCSweepResult> {
+    const start = Date.now();
+    const cleaned: GCResult[] = [];
+
+    // 1. Find all session-scoped Valkey keys (non-blocking SCAN)
+    const allSessionKeys = await this.scanKeys('mosaic:session:*');
+
+    // Extract unique session IDs from keys
+    const sessionIds = new Set<string>();
+    for (const key of allSessionKeys) {
+      const match = key.match(/^mosaic:session:([^:]+):/);
+      if (match) sessionIds.add(match[1]!);
+    }
+
+    // 2. For each session ID, collect stale keys
+    for (const sessionId of sessionIds) {
+      const gcResult = await this.collect(sessionId);
+      if (Object.keys(gcResult.cleaned).length > 0) {
+        cleaned.push(gcResult);
+      }
+    }
+
+    return {
+      orphanedSessions: cleaned.length,
+      totalCleaned: cleaned,
+      duration: Date.now() - start,
+    };
+  }
+
+  /**
+   * Full GC — aggressive collection for cold start.
+   * Assumes no sessions survived the restart.
+   */
+  async fullCollect(): Promise<FullGCResult> {
+    const start = Date.now();
+
+    // 1. Valkey: delete ALL session-scoped keys (non-blocking SCAN)
+    const sessionKeys = await this.scanKeys('mosaic:session:*');
+    if (sessionKeys.length > 0) {
+      await this.redis.del(...sessionKeys);
+    }
+
+    // 2. NOTE: channel keys are NOT collected on cold start
+    //    (discord/telegram plugins may reconnect and resume)
+
+    // 3. PG: demote stale hot-tier logs older than 24h to warm
+    const hotCutoff = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    const logsDemoted = await this.logService.logs.promoteToWarm(hotCutoff);
+
+    // 4. No summarization job purge API available yet
+    const jobsPurged = 0;
+
+    return {
+      valkeyKeys: sessionKeys.length,
+      logsDemoted,
+      jobsPurged,
+      tempFilesRemoved: 0,
+      duration: Date.now() - start,
+    };
+  }
 }

apps/gateway/src/health/health.controller.test.ts

@@ -1,12 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { HealthController } from './health.controller.js';
-
-describe('HealthController', (): void => {
-  it('exposes liveness and readiness without configuration details', (): void => {
-    const controller = new HealthController();
-
-    expect(controller.check()).toEqual({ status: 'ok' });
-    expect(controller.ready()).toEqual({ status: 'ready' });
-    expect(JSON.stringify(controller.ready())).not.toContain('credential');
-  });
-});

apps/gateway/src/health/health.controller.ts

@@ -6,10 +6,4 @@ export class HealthController {
   check(): { status: string } {
     return { status: 'ok' };
   }
-
-  /** Readiness intentionally exposes no configuration, provider, or credential details. */
-  @Get('ready')
-  ready(): { status: string } {
-    return { status: 'ready' };
-  }
 }

apps/gateway/src/log/cron.service.ts

@@ -6,10 +6,11 @@ import {
   type OnModuleDestroy,
 } from '@nestjs/common';
 import { SummarizationService } from './summarization.service.js';
+import { SessionGCService } from '../gc/session-gc.service.js';
 import {
   QueueService,
-  QUEUE_GC,
   QUEUE_SUMMARIZATION,
+  QUEUE_GC,
   QUEUE_TIER_MANAGEMENT,
 } from '../queue/queue.service.js';
 import type { Worker } from 'bullmq';
@@ -22,12 +23,14 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
 
   constructor(
     @Inject(SummarizationService) private readonly summarization: SummarizationService,
+    @Inject(SessionGCService) private readonly sessionGC: SessionGCService,
     @Inject(QueueService) private readonly queueService: QueueService,
   ) {}
 
   async onModuleInit(): Promise<void> {
     const summarizationSchedule = process.env['SUMMARIZATION_CRON'] ?? '0 */6 * * *'; // every 6 hours
     const tierManagementSchedule = process.env['TIER_MANAGEMENT_CRON'] ?? '0 3 * * *'; // daily at 3am
+    const gcSchedule = process.env['SESSION_GC_CRON'] ?? '0 4 * * *'; // daily at 4am
 
     // M6-003: Summarization repeatable job
     await this.queueService.addRepeatableJob(
@@ -53,12 +56,15 @@ export class CronService implements OnModuleInit, OnModuleDestroy {
     });
     this.registeredWorkers.push(tierWorker);
 
-    // Retire any repeatable global GC schedule created by older deployments.
-    // Session cleanup is now triggered only by an authorized session lifecycle operation.
-    await this.queueService.removeRepeatableJobs(QUEUE_GC, 'session-gc');
+    // M6-004: GC repeatable job
+    await this.queueService.addRepeatableJob(QUEUE_GC, 'session-gc', {}, gcSchedule);
+    const gcWorker = this.queueService.registerWorker(QUEUE_GC, async () => {
+      await this.sessionGC.sweepOrphans();
+    });
+    this.registeredWorkers.push(gcWorker);
 
     this.logger.log(
-      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}"`,
+      `BullMQ jobs scheduled: summarization="${summarizationSchedule}", tier="${tierManagementSchedule}", gc="${gcSchedule}"`,
     );
   }
 

apps/gateway/src/memory/memory.module.ts

@@ -3,10 +3,8 @@ import {
   createMemory,
   type Memory,
   createMemoryAdapter,
-  createOperatorMemoryPlugin,
   type MemoryAdapter,
   type MemoryConfig,
-  type OperatorMemoryPlugin,
 } from '@mosaicstack/memory';
 import type { Db } from '@mosaicstack/db';
 import type { StorageAdapter } from '@mosaicstack/storage';
@@ -16,9 +14,6 @@ import { DB, STORAGE_ADAPTER } from '../database/database.module.js';
 import { MEMORY } from './memory.tokens.js';
 import { MemoryController } from './memory.controller.js';
 import { EmbeddingService } from './embedding.service.js';
-import { redactSensitiveContent } from '@mosaicstack/log';
-
-export const OPERATOR_MEMORY_PLUGIN = 'OPERATOR_MEMORY_PLUGIN';
 
 export const MEMORY_ADAPTER = 'MEMORY_ADAPTER';
 
@@ -43,24 +38,9 @@ function buildMemoryConfig(config: MosaicConfig, storageAdapter: StorageAdapter)
         createMemoryAdapter(buildMemoryConfig(config, storageAdapter)),
       inject: [MOSAIC_CONFIG, STORAGE_ADAPTER],
     },
-    {
-      provide: OPERATOR_MEMORY_PLUGIN,
-      useFactory: (adapter: MemoryAdapter): OperatorMemoryPlugin | null => {
-        const instanceId = process.env['MOSAIC_OPERATOR_MEMORY_INSTANCE_ID']?.trim();
-        const namespace = process.env['MOSAIC_OPERATOR_MEMORY_NAMESPACE']?.trim();
-        if (!instanceId || !namespace) return null;
-        return createOperatorMemoryPlugin({
-          adapter,
-          instanceId,
-          namespace,
-          redact: (content) => redactSensitiveContent(content).content,
-        });
-      },
-      inject: [MEMORY_ADAPTER],
-    },
     EmbeddingService,
   ],
   controllers: [MemoryController],
-  exports: [MEMORY, MEMORY_ADAPTER, OPERATOR_MEMORY_PLUGIN, EmbeddingService],
+  exports: [MEMORY, MEMORY_ADAPTER, EmbeddingService],
 })
 export class MemoryModule {}

apps/gateway/src/plugin/discord-ingress.security.spec.ts

@@ -1,141 +1,13 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 import {
   createDiscordIngressEnvelope,
   verifyDiscordIngressEnvelope,
-  DiscordPlugin,
   type DiscordIngressPayload,
-  parseDiscordInteractionBindings,
-  resolveDiscordInteractionActorId,
-  resolveDiscordInteractionBinding,
 } from '@mosaicstack/discord-plugin';
-import { RuntimeProviderService } from '../agent/runtime-provider-registry.service.js';
-import { ChatGateway } from '../chat/chat.gateway.js';
-import { CommandAuthorizationService } from '../commands/command-authorization.service.js';
 import { validateDiscordServiceToken } from '../chat/chat.gateway-auth.js';
 import { DiscordReplayProtector } from './discord-replay-protector.js';
 
 const SERVICE_TOKEN = 'test-service-token';
-const ENV_KEYS = [
-  'DISCORD_SERVICE_TOKEN',
-  'DISCORD_SERVICE_USER_ID',
-  'DISCORD_SERVICE_TENANT_ID',
-  'DISCORD_INTERACTION_BINDINGS',
-  'DISCORD_ALLOWED_GUILD_IDS',
-  'DISCORD_ALLOWED_CHANNEL_IDS',
-  'DISCORD_ALLOWED_USER_IDS',
-  'MOSAIC_AGENT_NAME',
-  'MOSAIC_AGENT_CONFIG_ID',
-] as const;
-const savedEnv = new Map<string, string | undefined>();
-
-function configureDiscordEnv(role: 'admin' | 'member' = 'admin'): void {
-  for (const key of ENV_KEYS) savedEnv.set(key, process.env[key]);
-  process.env['DISCORD_SERVICE_TOKEN'] = SERVICE_TOKEN;
-  process.env['DISCORD_SERVICE_USER_ID'] = 'discord-service';
-  process.env['DISCORD_SERVICE_TENANT_ID'] = 'tenant-discord';
-  process.env['MOSAIC_AGENT_NAME'] = 'Nova';
-  process.env['MOSAIC_AGENT_CONFIG_ID'] = 'agent-config-nova';
-  process.env['DISCORD_ALLOWED_GUILD_IDS'] = 'guild-001';
-  process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001';
-  process.env['DISCORD_ALLOWED_USER_IDS'] = 'user-001';
-  process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-    {
-      instanceId: 'Nova',
-      agentConfigId: 'agent-config-nova',
-      guildId: 'guild-001',
-      channelId: 'channel-001',
-      pairedUsers: {
-        'user-001': {
-          role: role === 'admin' ? 'admin' : 'operator',
-          mosaicUserId: 'mosaic-admin-001',
-        },
-      },
-    },
-  ]);
-}
-
-afterEach((): void => {
-  for (const key of ENV_KEYS) {
-    const value = savedEnv.get(key);
-    if (value === undefined) delete process.env[key];
-    else process.env[key] = value;
-  }
-  savedEnv.clear();
-});
-
-function commandAuthorization(role: 'admin' | 'member'): CommandAuthorizationService {
-  const entries = new Map<string, string>();
-  const db = {
-    select: () => ({ from: () => ({ where: () => ({ limit: async () => [{ role }] }) }) }),
-  };
-  const redis = {
-    get: async (key: string) => entries.get(key) ?? null,
-    set: async (key: string, value: string) => entries.set(key, value),
-    del: async (key: string) => Number(entries.delete(key)),
-  };
-  return new CommandAuthorizationService(db as never, redis);
-}
-
-function discordGateway(role: 'admin' | 'member'): {
-  gateway: ChatGateway;
-  client: { data: { discordService: boolean }; emit: ReturnType<typeof vi.fn> };
-  consumedActions: Array<{ actorId: string; correlationId: string }>;
-  durable: { getSnapshot: ReturnType<typeof vi.fn> };
-  audit: { record: ReturnType<typeof vi.fn> };
-} {
-  const authorization = commandAuthorization(role);
-  const consumedActions: Array<{ actorId: string; correlationId: string }> = [];
-  const durable = {
-    getSnapshot: vi.fn().mockResolvedValue({
-      identity: { agentName: 'Nova', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    }),
-  };
-  const audit = { record: vi.fn().mockResolvedValue(undefined) };
-  const runtimeRegistry = new RuntimeProviderService(
-    {
-      require: () => ({
-        capabilities: async () => ({ supported: ['session.terminate'] }),
-        terminate: async () => undefined,
-      }),
-    } as never,
-    { record: async () => undefined } as never,
-    {
-      consume: async (approvalId, action) => {
-        consumedActions.push({ actorId: action.actorId, correlationId: action.correlationId });
-        return authorization.consumeRuntimeTerminationApproval(approvalId, action);
-      },
-    },
-  );
-  return {
-    gateway: new ChatGateway(
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      {} as never,
-      authorization,
-      runtimeRegistry,
-      durable as never,
-      audit as never,
-    ),
-    client: { data: { discordService: true }, emit: vi.fn() },
-    consumedActions,
-    durable,
-    audit,
-  };
-}
-
-function ingressEnvelope(
-  content: string,
-  messageId: string,
-  overrides: Partial<DiscordIngressPayload> = {},
-): ReturnType<typeof createDiscordIngressEnvelope> {
-  return createDiscordIngressEnvelope(
-    createPayload({ content, messageId, ...overrides }),
-    SERVICE_TOKEN,
-  );
-}
 
 function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordIngressPayload {
   return {
@@ -144,51 +16,13 @@ function createPayload(overrides: Partial<DiscordIngressPayload> = {}): DiscordI
     guildId: 'guild-001',
     channelId: 'channel-001',
     userId: 'user-001',
-    conversationId: 'Nova:discord:channel-001',
+    conversationId: 'discord-channel-001',
     content: 'hello Tess',
     ...overrides,
   };
 }
 
 describe('Discord ingress security', () => {
-  it('keeps legacy role-only bindings valid while withholding privileged actor identity', () => {
-    const [binding] = parseDiscordInteractionBindings(
-      JSON.stringify([
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': 'admin' },
-        },
-      ]),
-    );
-    expect(
-      resolveDiscordInteractionBinding([binding!], 'guild-001', 'channel-001', 'user-001', 'send'),
-    ).toEqual(binding);
-    expect(resolveDiscordInteractionActorId(binding!, 'user-001')).toBeNull();
-  });
-
-  it('binds a differently named configured interaction instance without code changes', () => {
-    const binding = resolveDiscordInteractionBinding(
-      [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-      'guild-001',
-      'channel-001',
-      'user-001',
-      'send',
-    );
-
-    expect(binding?.instanceId).toBe('Nova');
-  });
-
   it('accepts only the configured Discord service identity', () => {
     expect(validateDiscordServiceToken(SERVICE_TOKEN, SERVICE_TOKEN)).toBe(true);
     expect(validateDiscordServiceToken('wrong-service-token', SERVICE_TOKEN)).toBe(false);
@@ -252,464 +86,4 @@ describe('Discord ingress security', () => {
     expect(replayProtector.claim('discord-message-003')).toBe(true);
     expect(replayProtector.size).toBe(2);
   });
-
-  it('consumes the exact target once when approval and stop are separate Discord messages', async () => {
-    configureDiscordEnv();
-    const { gateway, client, consumedActions } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'approve-message', {
-        correlationId: 'approval-ingress-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-      success: boolean;
-    };
-    expect(approval.success).toBe(true);
-
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'stop-message', {
-        correlationId: 'stop-ingress-correlation',
-      }),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:stop', {
-      correlationId: 'stop-ingress-correlation',
-      success: true,
-    });
-    expect(consumedActions).toEqual([
-      {
-        actorId: 'mosaic-admin-001',
-        correlationId: expect.stringMatching(/^discord-action:v1:/),
-      },
-    ]);
-  });
-
-  it('audits a Discord mint-side authorization denial', async () => {
-    configureDiscordEnv();
-    const { gateway, client, audit } = discordGateway('member');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'denied-approve'),
-    );
-
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-    expect(audit.record).toHaveBeenCalledWith(
-      expect.objectContaining({
-        outcome: 'denied',
-        operation: 'session.terminate',
-        errorCode: 'policy_denied',
-      }),
-    );
-  });
-
-  it('rejects approval when the durable session targets a different logical agent', async () => {
-    configureDiscordEnv();
-    const { gateway, client, durable } = discordGateway('admin');
-    durable.getSnapshot.mockResolvedValueOnce({
-      identity: { agentName: 'Other', providerId: 'fleet', runtimeSessionId: 'runtime-1' },
-    });
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'mismatched-agent-approve'),
-    );
-
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-  });
-
-  it('rejects privileged envelopes with a forged current conversation route', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'forged-approval-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
-    );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'forged-stop-route', {
-        conversationId: 'Nova:discord:other-channel',
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('discord:approval', expect.anything());
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
-
-  it('rejects unpaired and non-admin Discord users for approval and stop', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('member');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'member-approve'),
-    );
-    expect(client.emit).toHaveBeenCalledWith('discord:approval', {
-      correlationId: 'correlation-001',
-      success: false,
-      approvalId: undefined,
-      expiresAt: undefined,
-    });
-
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([]);
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope('/stop forged', 'unpaired-stop'),
-    );
-    expect(client.emit).not.toHaveBeenCalledWith('discord:stop', expect.anything());
-  });
-
-  it('rejects replaying a Discord-created termination approval', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    await gateway.handleDiscordApproval(
-      client as never,
-      ingressEnvelope('/approve', 'replay-approve', {
-        correlationId: 'replay-approval-correlation',
-      }),
-    );
-    const approval = client.emit.mock.calls.find(
-      ([event]) => event === 'discord:approval',
-    )?.[1] as {
-      approvalId: string;
-    };
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-one', {
-        correlationId: 'replay-stop-correlation-one',
-      }),
-    );
-    await gateway.handleDiscordStop(
-      client as never,
-      ingressEnvelope(`/stop ${approval.approvalId}`, 'replay-stop-two', {
-        correlationId: 'replay-stop-correlation-two',
-      }),
-    );
-    const stopResults = client.emit.mock.calls.filter(([event]) => event === 'discord:stop');
-    expect(stopResults.map(([, result]) => (result as { success: boolean }).success)).toEqual([
-      true,
-      false,
-    ]);
-  });
-
-  it.each([
-    'https://user:password@cdn.example.test/diagram.png',
-    'https://cdn.example.test/diagram.png?token=secret',
-    'https://cdn.example.test/diagram.png?X-Amz-Signature=secret',
-    'https://cdn.example.test/diagram.png?auth=secret',
-    'https://cdn.example.test/diagram.png?hm=secret',
-  ])('rejects credential-bearing attachment URLs before gateway dispatch', async (url) => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', `credential-url-${url.length}`, {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [
-          { id: 'attachment-credential', name: 'diagram.png', url, contentType: 'image/png' },
-        ],
-      }),
-    );
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it("selects each binding's trusted logical-agent config when creating Discord sessions", async () => {
-    configureDiscordEnv();
-    process.env['DISCORD_ALLOWED_CHANNEL_IDS'] = 'channel-001,channel-002';
-    process.env['DISCORD_INTERACTION_BINDINGS'] = JSON.stringify([
-      {
-        instanceId: 'Nova',
-        agentConfigId: 'agent-config-nova',
-        guildId: 'guild-001',
-        channelId: 'channel-001',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-      {
-        instanceId: 'Orion',
-        agentConfigId: 'agent-config-orion',
-        guildId: 'guild-001',
-        channelId: 'channel-002',
-        pairedUsers: {
-          'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' },
-        },
-      },
-    ]);
-    const session = {
-      provider: 'configured-provider',
-      modelId: 'configured-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const createSession = vi.fn().mockResolvedValue(session);
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(undefined),
-      createSession,
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt: vi.fn().mockResolvedValue(undefined),
-    };
-    const brain = {
-      agents: {
-        findById: vi.fn((id: string) =>
-          Promise.resolve({
-            id,
-            name: id === 'agent-config-orion' ? 'Orion' : 'Nova',
-          }),
-        ),
-      },
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        findMessages: vi.fn().mockResolvedValue([]),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage: vi.fn().mockResolvedValue(undefined),
-      },
-    };
-    const routingEngine = { resolve: vi.fn() };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      routingEngine as never,
-    );
-    const client = {
-      id: 'discord-client-new-session',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start configured session', 'configured-session-001', {
-        conversationId: 'Nova:discord:channel-001',
-      }),
-    );
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('start second configured session', 'configured-session-002', {
-        channelId: 'channel-002',
-        conversationId: 'Orion:discord:channel-002',
-      }),
-    );
-
-    expect(createSession).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      expect.objectContaining({
-        agentConfigId: 'agent-config-nova',
-        userId: 'discord-service',
-        tenantId: 'tenant-discord',
-      }),
-    );
-    expect(createSession).toHaveBeenCalledWith(
-      'Orion:discord:channel-002',
-      expect.objectContaining({ agentConfigId: 'agent-config-orion' }),
-    );
-    expect(routingEngine.resolve).not.toHaveBeenCalled();
-  });
-
-  it('retains validated persisted attachments in resumed conversation history', async () => {
-    const attachment = {
-      id: 'attachment-history',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      mimeType: 'image/png',
-      sizeBytes: 4_096,
-    };
-    const gateway = new ChatGateway(
-      {} as never,
-      {} as never,
-      {
-        conversations: {
-          findMessages: vi.fn().mockResolvedValue([
-            {
-              role: 'user',
-              content: '',
-              createdAt: new Date('2026-07-14T12:00:00.000Z'),
-              metadata: { channelAttachments: [attachment] },
-            },
-          ]),
-        },
-      } as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    ) as unknown as {
-      loadConversationHistory(
-        conversationId: string,
-        userId: string,
-      ): Promise<Array<{ attachments?: readonly (typeof attachment)[] }>>;
-    };
-
-    await expect(
-      gateway.loadConversationHistory('Nova:discord:channel-001', 'discord-service'),
-    ).resolves.toEqual([expect.objectContaining({ attachments: [attachment] })]);
-  });
-
-  it('rejects malformed signed attachment payloads before gateway dispatch', async () => {
-    configureDiscordEnv();
-    const { gateway, client } = discordGateway('admin');
-    const malformedPayload: Record<string, unknown> = {
-      ...createPayload({
-        messageId: 'malformed-attachments-001',
-        conversationId: 'Nova:discord:channel-001',
-      }),
-      attachments: { id: 'not-an-array' },
-    };
-    const envelope = createDiscordIngressEnvelope(
-      malformedPayload as unknown as DiscordIngressPayload,
-      SERVICE_TOKEN,
-    );
-
-    await gateway.handleMessage(client as never, envelope);
-
-    expect(client.emit).not.toHaveBeenCalledWith('message:ack', expect.anything());
-  });
-
-  it('preserves authenticated attachment metadata through persistence and agent dispatch', async () => {
-    configureDiscordEnv();
-    const prompt = vi.fn().mockResolvedValue(undefined);
-    const addMessage = vi.fn().mockResolvedValue(undefined);
-    const session = {
-      provider: 'test-provider',
-      modelId: 'test-model',
-      piSession: {
-        thinkingLevel: 'medium',
-        getAvailableThinkingLevels: (): string[] => ['medium'],
-      },
-    };
-    const agentService = {
-      getSession: vi.fn().mockReturnValue(session),
-      recordMessage: vi.fn(),
-      onEvent: vi.fn().mockReturnValue((): void => undefined),
-      addChannel: vi.fn(),
-      prompt,
-    };
-    const brain = {
-      conversations: {
-        findById: vi.fn().mockResolvedValue({ id: 'Nova:discord:channel-001' }),
-        create: vi.fn().mockResolvedValue(undefined),
-        update: vi.fn().mockResolvedValue(undefined),
-        addMessage,
-      },
-    };
-    const gateway = new ChatGateway(
-      agentService as never,
-      {} as never,
-      brain as never,
-      {} as never,
-      {} as never,
-      {} as never,
-    );
-    const client = {
-      id: 'discord-client-001',
-      data: { discordService: true },
-      emit: vi.fn(),
-    };
-    const attachment = {
-      id: 'attachment-001',
-      name: 'diagram.png',
-      url: 'https://cdn.example.test/diagram.png',
-      contentType: 'image/png',
-      sizeBytes: 4_096,
-    };
-
-    await gateway.handleMessage(
-      client as never,
-      ingressEnvelope('', 'attachment-message-001', {
-        conversationId: 'Nova:discord:channel-001',
-        attachments: [attachment],
-      }),
-    );
-
-    const expectedAttachment = {
-      id: attachment.id,
-      name: attachment.name,
-      url: attachment.url,
-      mimeType: attachment.contentType,
-      sizeBytes: attachment.sizeBytes,
-    };
-    expect(prompt).toHaveBeenCalledWith(
-      'Nova:discord:channel-001',
-      '',
-      { userId: 'discord-service', tenantId: 'tenant-discord' },
-      [expectedAttachment],
-    );
-    expect(addMessage).toHaveBeenCalledWith(
-      expect.objectContaining({
-        conversationId: 'Nova:discord:channel-001',
-        metadata: expect.objectContaining({ channelAttachments: [expectedAttachment] }),
-      }),
-      'discord-service',
-    );
-  });
-
-  it('accepts a thread message through its allowed bound parent channel', () => {
-    const emitted = vi.fn();
-    const plugin = new DiscordPlugin({
-      token: 'unused',
-      gatewayUrl: 'http://unused',
-      serviceToken: SERVICE_TOKEN,
-      allowedGuildIds: ['guild-001'],
-      allowedChannelIds: ['channel-001'],
-      allowedUserIds: ['user-001'],
-      interactionBindings: [
-        {
-          instanceId: 'Nova',
-          agentConfigId: 'agent-config-nova',
-          guildId: 'guild-001',
-          channelId: 'channel-001',
-          pairedUsers: { 'user-001': { role: 'operator', mosaicUserId: 'mosaic-operator-001' } },
-        },
-      ],
-    });
-    const internals = plugin as unknown as {
-      client: { user: { id: string } };
-      socket: { connected: boolean; emit: ReturnType<typeof vi.fn> };
-      handleDiscordMessage(message: unknown): void;
-    };
-    internals.client = { user: { id: 'bot-001' } };
-    internals.socket = { connected: true, emit: emitted };
-    internals.handleDiscordMessage({
-      id: 'thread-message',
-      guildId: 'guild-001',
-      channelId: 'thread-001',
-      author: { id: 'user-001', bot: false },
-      mentions: { has: () => true },
-      content: '<@bot-001> hello from thread',
-      channel: { parentId: 'channel-001' },
-      attachments: new Map(),
-    });
-
-    const [, envelope] = emitted.mock.calls[0] as [
-      string,
-      ReturnType<typeof createDiscordIngressEnvelope>,
-    ];
-    expect(verifyDiscordIngressEnvelope(envelope, SERVICE_TOKEN)?.channelId).toBe('channel-001');
-  });
 });

apps/gateway/src/plugin/plugin.module.ts

@@ -6,7 +6,7 @@ import {
   type OnModuleDestroy,
   type OnModuleInit,
 } from '@nestjs/common';
-import { DiscordPlugin, parseDiscordInteractionBindings } from '@mosaicstack/discord-plugin';
+import { DiscordPlugin } from '@mosaicstack/discord-plugin';
 import { TelegramPlugin } from '@mosaicstack/telegram-plugin';
 import { PluginService } from './plugin.service.js';
 import type { IChannelPlugin } from './plugin.interface.js';
@@ -61,16 +61,6 @@ function requiredDiscordAllowlist(name: string): string[] {
   return value;
 }
 
-function optionalPositiveInteger(name: string): number | undefined {
-  const raw = process.env[name];
-  if (raw === undefined) return undefined;
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value <= 0) {
-    throw new Error(`${name} must be a positive integer when configured`);
-  }
-  return value;
-}
-
 function createPluginRegistry(): IChannelPlugin[] {
   const plugins: IChannelPlugin[] = [];
   const discordToken = process.env['DISCORD_BOT_TOKEN'];
@@ -92,16 +82,9 @@ function createPluginRegistry(): IChannelPlugin[] {
           guildId: discordGuildId,
           gatewayUrl: discordGatewayUrl,
           serviceToken: discordServiceToken,
-          messageRateLimitPerMinute: optionalPositiveInteger(
-            'DISCORD_MESSAGE_RATE_LIMIT_PER_MINUTE',
-          ),
-          threadRateLimitPerMinute: optionalPositiveInteger('DISCORD_THREAD_RATE_LIMIT_PER_MINUTE'),
           allowedGuildIds: requiredDiscordAllowlist('DISCORD_ALLOWED_GUILD_IDS'),
           allowedChannelIds: requiredDiscordAllowlist('DISCORD_ALLOWED_CHANNEL_IDS'),
           allowedUserIds: requiredDiscordAllowlist('DISCORD_ALLOWED_USER_IDS'),
-          interactionBindings: parseDiscordInteractionBindings(
-            process.env['DISCORD_INTERACTION_BINDINGS'],
-          ),
         }),
       ),
     );

apps/gateway/src/queue/queue.service.ts

@@ -162,23 +162,6 @@ export class QueueService implements OnModuleInit, OnModuleDestroy {
     );
   }
 
-  /**
-   * Remove every existing repeatable schedule for a job name. This supports
-   * safe retirement of previously registered system-wide jobs.
-   */
-  async removeRepeatableJobs(queueName: string, jobName: string): Promise<number> {
-    const queue = this.getQueue(queueName);
-    const jobs = await queue.getRepeatableJobs();
-    const matchingJobs = jobs.filter((job) => job.name === jobName);
-    await Promise.all(matchingJobs.map((job) => queue.removeRepeatableByKey(job.key)));
-    if (matchingJobs.length > 0) {
-      this.logger.log(
-        `Removed ${matchingJobs.length} repeatable "${jobName}" job(s) from "${queueName}"`,
-      );
-    }
-    return matchingJobs.length;
-  }
-
   /**
    * Register a Worker for the given queue name with error handling and
    * exponential backoff.

docs/MISSION-MANIFEST.md

@@ -10,9 +10,9 @@
 **Statement:** Ship a self-hosted, multi-user AI agent platform that consolidates the user's disparate jarvis-brain usage across home and USC workstations into a single coherent system reachable via three first-class surfaces — webUI, TUI, and CLI — with federation as the data-layer mechanism that makes cross-host agent sessions work in real time without copying user data across the boundary.
 **Phase:** Execution (workstream W1 in planning-complete state)
 **Current Workstream:** W1 — Federation v1
-**Progress:** 0 / 3 declared workstreams complete (more workstreams will be declared as scope is refined)
+**Progress:** 0 / 1 declared workstreams complete (more workstreams will be declared as scope is refined)
 **Status:** active (continuous since 2026-03-13)
-**Last Updated:** 2026-07-14 (W3 Native Kanban/SOT canon independently approved under issue #751)
+**Last Updated:** 2026-04-19 (manifest authored at the rollup level; install-ux-v2 archived; W1 federation planning landed via PR #468)
 **Source PRD:** [docs/PRD.md](./PRD.md) — Mosaic Stack v0.1.0
 **Scratchpad:** [docs/scratchpads/mvp-20260312.md](./scratchpads/mvp-20260312.md) (active since 2026-03-13; 14 prior sessions of phase-based execution)
 
@@ -67,12 +67,11 @@ The MVP is complete when ALL declared workstreams are complete AND every cross-c
 
 ## Workstreams
 
-| #   | ID   | Name                                        | Status            | Manifest                                                                              | Notes                                                    |
-| --- | ---- | ------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------- |
-| W1  | FED  | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md)               | 7 milestones, ~175K tokens, issues #460–#466 filed       |
-| W2  | TESS | Tess interaction agent                      | planning-complete | [docs/tess/MISSION-MANIFEST.md](./tess/MISSION-MANIFEST.md)                           | 5 milestones; issue #706; M1 issue #707 ready            |
-| W3  | KBN  | Native Kanban and canonical task SOT        | planning-complete | [docs/native-kanban-sot/MISSION-MANIFEST.md](./native-kanban-sot/MISSION-MANIFEST.md) | P0–P3; issue #751; implementation held until canon merge |
-| W4+ | TBD  | (additional workstreams declared as scoped) | —                 | —                                                                                     | Scope creep is expected and explicitly accommodated      |
+| #   | ID   | Name                                        | Status            | Manifest                                                                | Notes                                               |
+| --- | ---- | ------------------------------------------- | ----------------- | ----------------------------------------------------------------------- | --------------------------------------------------- |
+| W1  | FED  | Federation v1                               | planning-complete | [docs/federation/MISSION-MANIFEST.md](./federation/MISSION-MANIFEST.md) | 7 milestones, ~175K tokens, issues #460–#466 filed  |
+| W2  | TESS | Tess interaction agent                      | planning-complete | [docs/tess/MISSION-MANIFEST.md](./tess/MISSION-MANIFEST.md)             | 5 milestones; issue #706; M1 issue #707 ready       |
+| W3+ | TBD  | (additional workstreams declared as scoped) | —                 | —                                                                       | Scope creep is expected and explicitly accommodated |
 
 ### Likely Additional Workstreams (Not Yet Declared)
 

docs/PERFORMANCE.md

@@ -149,9 +149,15 @@ for any `<Image>` components added in the future.
 
 ---
 
-## Held future procedure
+## How to Apply
 
-This report is non-operative evidence, not a current runbook. Until **KBN-101-00, KBN-101-03, and KBN-101-05** land, do not execute a PostgreSQL runner from this checkout. The approved future procedure is exactly: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Deployment will supply the reviewed runner, migration-only credentials, and TLS material; Gateway startup only verifies readiness.
+```bash
+# Run the DB migration (requires a live DB)
+pnpm --filter @mosaicstack/db exec drizzle-kit migrate
+
+# Or, in Docker/Swarm — migrations run automatically on gateway startup
+# via runMigrations() in packages/db/src/migrate.ts
+```
 
 ---
 

docs/PRD.md

@@ -79,81 +79,6 @@ Jarvis (v0.2.0) is a self-hosted AI assistant with a Python FastAPI backend and
 
 ---
 
-## Fleet Declarative Configuration Management Workstream (FCM, #758)
-
-### Problem and objective
-
-The local Mosaic fleet has a roster, generated agent environment files, user-systemd units, tmux
-sessions, heartbeat files, examples, profiles, and separate gateway-backed agent records. These
-planes have drifted and are not one safe operator lifecycle. The objective is one **local fleet
-roster** as the desired-state SSOT, with generated environment, systemd, tmux, and heartbeat
-artifacts as rebuildable projections; it does not merge the local fleet control plane with the
-gateway-backed agent catalog.
-
-### Normative requirements
-
-| ID           | Requirement                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `FCM-REQ-01` | The roster SHALL be the sole writable desired-state source for local fleet membership, launch policy, and persisted lifecycle target. Generated environment files, systemd enablement, tmux sessions, and heartbeat state SHALL be non-authoritative projections.                                                                                                                                                                                                         |
-| `FCM-REQ-02` | The implementation SHALL provide one executable structural contract for YAML/JSON input and one shared semantic validator. Roster load, profile validation, provision, migration, and apply SHALL reuse the existing baseline-plus-`roles.local` profile/persona resolver; a parallel role resolver is forbidden.                                                                                                                                                         |
-| `FCM-REQ-03` | The local fleet CLI SHALL expose documented programmatic validate, show, plan, apply/reconcile, create, inspect, update, delete, start, stop, restart, status, verify, and doctor operations with stable JSON and exit-code behavior. Existing `fleet add/remove` compatibility aliases may remain during the stated deprecation window.                                                                                                                                  |
-| `FCM-REQ-04` | A fresh create SHALL persist `enabled:true` and `desired_state:stopped` unless an explicit persisted start is requested. The model SHALL distinguish enabled state, persisted desired state, and observed state. Migration, apply, reboot, and rollback SHALL not start an agent that was observed stopped before cutover.                                                                                                                                                |
-| `FCM-REQ-05` | The launch chain SHALL consume deterministic, digest-stamped generated input only. Optional local overrides SHALL be parsed as strict data, may not shadow authoritative generated keys, and may not contain arbitrary commands, credential values, channels, or unknown `MOSAIC_AGENT_*` keys. Forbidden legacy keys, including `MOSAIC_AGENT_COMMAND`, SHALL be privately quarantined before launch and reported only by key name and content hash.                     |
-| `FCM-REQ-06` | Mutations and apply SHALL validate before mutation, use an expected generation/lock, write projections atomically, produce a deterministic plan, and emit recovery information on partial failure. Reconciliation SHALL act only on local, enabled, roster-owned projections and SHALL not kill unmanaged tmux sessions by fuzzy name.                                                                                                                                    |
-| `FCM-REQ-07` | Canonical required classes are `code`, `review`, `validator`, `orchestrator`, `team-leader`, `enhancer`, and `interaction`. `validator` issues an independent final certificate but has no merge authority; `merge-gate` remains sole approve-to-land/merge authority. Team-leader capacity is bounded by an orchestrator-issued lease, and interaction is request/status only. Tess and Ultron are configurable instance/display names, not required machine identities. |
-| `FCM-REQ-08` | v1 migration SHALL be field-complete, reversible, and explicit about aliases, unresolved classes, lifecycle inference, generated-file regeneration, local override quarantine, schema-only remote/connector fields, and rollback. Every shipped example, profile, and service preset SHALL be migrated and executable, retained as an explicitly versioned v1 fixture, or retired with a replacement and deprecation note.                                                |
-| `FCM-REQ-09` | M1–M5 SHALL remain local tmux/systemd control-plane work. Remote/SSH reconciliation, connector mutation, secret references, arbitrary command/channel overrides, gateway/API convergence, and UI configuration storage are excluded and require a separate PRD/threat model.                                                                                                                                                                                              |
-| `FCM-REQ-10` | Documentation and examples are delivery gates. The M0 checklist at [docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) and the baseline disposition inventory at [docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md) SHALL be maintained as acceptance evidence.                                                                                                  |
-
-### Acceptance criteria
-
-1. `AC-FCM-01`: A valid local v2 roster can be parsed from YAML or JSON, validated structurally and semantically through the shared resolver, and rendered canonically; invalid fields, duplicate names, unresolved classes, unsupported runtime/model combinations, socket ambiguity, and incompatible options fail closed.
-2. `AC-FCM-02`: `plan` reports deterministic desired-versus-observed differences for roster, generated environment, systemd enablement, tmux/session, heartbeat, installed-asset revision, and provable orphans without mutation; `apply --check` reports drift without mutation.
-3. `AC-FCM-03`: Local create/update/delete is generation-guarded, atomic, idempotent, and safe by default; it permits supported runtime/model/harness/effort/workdir/role changes without direct editing of generated environment files and does not start a newly created agent unless explicitly persisted.
-4. `AC-FCM-04`: The generated-env/local-override launch chain rejects generated-key shadowing, arbitrary command override, unknown keys, shell evaluation, and sensitive-value diagnostics before any agent starts; known-safe legacy input is regenerated or strictly relocated, and forbidden input is quarantined.
-5. `AC-FCM-05`: Local lifecycle reconciliation implements the persisted/transient start-stop rules, exact default/named tmux socket targeting, systemd/tmux status, stale generated state, unmanaged-session reporting, and rollback without surprise restarts or fuzzy destructive targeting.
-6. `AC-FCM-06`: A v1 roster migration previews field-by-field disposition, preserves observed stopped/running state, inventories rather than reconciles remote/schema-only entries, supports a canary and rollback, and classifies every shipped example, profile, and service preset according to the M0 inventory.
-7. `AC-FCM-07`: Required role authority is validated: validator certificate is consumed but does not merge, merge-gate is the sole merge authority, team-leader leases do not change roster/credentials/authority, and interaction/Tess cannot claim orchestration or merge powers.
-8. `AC-FCM-08`: Documentation, examples, migration, troubleshooting, operational recovery, package/update asset drift, schema/example/profile validation, independent code/security review, validator certificate, and terminal-green CI are complete before #758 closes.
-
-### M0 implementation gate
-
-No source, schema, role, example, profile, systemd, or live-fleet change is authorized before M0
-lands. M0 consists only of these normative requirements, the complete task DAG, the scoped
-documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
-are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
-
----
-
-## KBN-101 Database Runtime/Migration Role Split (#771)
-
-### Problem and objective
-
-PostgreSQL Gateway/storage currently uses one `DATABASE_URL` for runtime queries and migrations. That makes the deployed application identity an owner and prevents certification that KBN immutable event, artifact, checkpoint, and evidence relations reject runtime `UPDATE`/`DELETE`. KBN-101 freezes a least-privilege runtime/migration split before KBN-100 schema work.
-
-### Normative requirements
-
-1. `K101-REQ-01`: `DATABASE_URL` SHALL be the non-owner PostgreSQL runtime connection and `DATABASE_MIGRATION_URL` SHALL be the migration-only owner/migrator connection. They are required respectively for runtime and the dedicated `mosaic-db-migrator --run|--verify` phase in `standalone`/`federated`; local PGlite is the explicit exception. The published `@mosaicstack/db` bin maps exactly `mosaic-db-migrator` to `./dist/cli.js`, its image entrypoint is exactly `mosaic-db-migrator`, accepts no URL/SQL/schema/role argv, and returns stable sanitized exits. Every current/future PostgreSQL DDL entrypoint SHALL route to that runner or be denied, and SHALL reject `DATABASE_URL`-only execution before connection/DDL. Data migration may connect only after the runner prepares and verifies the PostgreSQL target, through dedicated non-DDL `mosaic_data_importer` and exactly `--target-url-file /run/secrets/mosaic-migrate-target-url`, its fixed paired authenticated provider-version file `/run/secrets/mosaic-migrate-target-version`, plus `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`. KBN-101-05 obtains URL key `url` and version only from the same successful Vault KV-v2 response at `secret-{env}/mosaic-stack/database/importer` (`data.metadata.version`), renders them as one immutable generation into separate consumer copies, and never infers a provider version from DSN bytes. The trusted runner verifies TLS/identity/manifest, reads its fixed importer URL/version copies only for binding through safe no-follow fd checks, and signs a credential-free JCS/Ed25519 attestation using its runner-only fixed root-owned private-key file; no signing key reaches importer/runtime. The artifact binds secret version and SHA-256 of exact high-entropy credential-file bytes, canonical TLS host/port/database, CA/SPKI, PostgreSQL system identifier/database OID, importer role, manifest/schema fingerprints, producer invocation/build/image digest, issued/expires/nonce, and correlation. Before target connection the importer validates URL/version/attestation/public-key files, signature/key/expiry/replay/authenticated provider version/digest/generation/bindings and the importer-only CA at exact `DATABASE_TLS_CA_CERT_PATH`; after verified TLS and before DML it validates server/database/role/CA/schema identity, with same-fd/in-memory-byte TOCTOU protection, rotation/revocation, a privileged producer-only-to-importer-only artifact handoff controller that verifies/copies/fsyncs/atomically renames/seals before importer start, consumer isolation/no logging-oracle, and sanitized errors. Raw `--target-url`, `DATABASE_URL` fallback, runtime-owner use, missing/unsafe/substituted files, stale/replayed/tampered/wrong-key attestation, wrong binding, and DDL attempt fail before target connection/DDL; post-connect mismatch closes with zero DML/DDL. A reviewed finite classifier inventories executable current source/scripts/package bins, operator docs, deploy manifests, and exact normative contracts by path; active secure records pin both options/files, producer/key/bindings/tests, while normative contracts cannot mask instructions. Unknown active commands, duplicate-owner, ownerless, missing-path, and historical/status-only masking hits fail. `db:push` is forbidden outside an explicitly disposable local developer database and cannot accept a production-like URL.
-2. `K101-REQ-02`: Gateway runtime/replicas SHALL not execute migrations or DDL. The runner SHALL hold one `max:1` session and fixed two-int advisory namespace `1297044289` (`MOSA`), `1262636593` (`KBN1`) across preflight, reconciliation, migration, verification, and release. It SHALL compare the versioned canonical manifest v1 tuple (journal logical index/tag plus exact SQL-byte SHA-256) to the complete observed ledger mapping; count/set-only, timestamps, and physical insertion order are non-normative and insufficient.
-3. `K101-REQ-03`: PostgreSQL SHALL separate non-login platform database owner, non-login schema owner, dedicated `NOLOGIN SUPERUSER` `mosaic_extension_owner`, login migrator, dedicated login non-DDL data importer, non-login runtime capability, and login runtime roles. For PostgreSQL 17 + pgvector 0.8.2, `vector` is untrusted (`trusted` is absent and `relocatable=true`): only an externally controlled audited platform-bootstrap superuser session may `SET ROLE mosaic_extension_owner` for CREATE/UPDATE/SET SCHEMA, then `RESET ROLE`; the role has `rolcanlogin=false`, `rolsuper=true`, zero members, no runtime credential/Vault secret, and is never provided to app containers. It owns `mosaic_extensions`, fresh `vector`, and owner-bearing extension members, while `mosaic_schema_owner` receives only `USAGE` for type resolution and never ownership/`CREATE`/`ALTER`/`DROP`/member-change/default-privilege authority there. Superuser cannot be constrained by `GRANT`/`REVOKE`; this is identity/non-login/no-membership/external-control/audit isolation, not a false least-privilege claim. Extension operations require control-plane change, independent review, backup/rollback, maintenance window, and audit evidence. Managed targets that cannot establish this exact role are ineligible until an independently approved versioned provider-owned extension-owner profile exists; app/migrator ownership is never silently retained. Existing approved-owner extension relocation validates exact `pg_namespace.nspowner`, `pg_extension.extowner`, member ownership/schema/version, while legacy runtime-owned extension fails closed to a controlled shadow-database migration—never unsupported ownership alteration, catalog mutation, ownership adoption, or `DROP CASCADE`. Runtime, migrator, schema owner, importer, and all service roles must fail `SET ROLE`, catalog/direct `ALTER`/`UPDATE`/`DROP`/membership-change denial, role ownership, superuser/role-creation/schema-creation/TEMPORARY, unsafe membership, untrusted search path, missing grants, unauthenticated TLS, and immutable privilege drift checks. Application schema is fixed `mosaic` with exact `pg_catalog,mosaic` session path; historical public migrations remain byte-immutable legacy bootstrap only, every future Drizzle application declaration targets `mosaic`, and `vector` is explicitly qualified from non-writable `mosaic_extensions`. No config-derived SQL identifier is permitted.
-4. `K101-REQ-04`: `mosaicstack/stack` KBN-101-00 SHALL exclusively own `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, `infra/pg-bootstrap/README.md`, and bootstrap tests; KBN-101-05 SHALL exclusively own `tools/db/render-postgres-secrets.ts`, its tests, and current Compose/Portainer/two-gateway deployment declarations, consuming the versioned bootstrap interface without overlap. Environment IaC/Vault is named input and Mosaic deployment control plane/Jason is activation authority. Distinct runtime/migrator/importer URL, importer authenticated provider-version, DB-client CA, Gateway leaf, and PostgreSQL server key/certificate materials are provisioned before a production-like database starts. Importer and migrator have separate immutable URL/version copies at fixed `10002:10002`/`10003:10003` identities; runtime/unrelated containers receive neither importer material, attestation private key, or importer artifact. Runtime, migrator, and importer require their mounted CA plus `sslmode=verify-full`. Exact UID/GID/mode/rendering, service-DNS SANs, Vault/compose/Swarm consumer isolation, two-gateway pair ordering, server activation, pre-enforcement legacy-client drain and `hostssl` zero-plaintext-session proof, fresh/existing transition, CA-overlap rotation, TLS-only rollback, and standalone/federated/Swarm/two-gateway positive/negative TLS evidence are required. No application-generated production certificate or plaintext bootstrap exception is permitted.
-5. `K101-REQ-05`: KBN immutable relations SHALL permit the real runtime role INSERT/SELECT only and deny UPDATE/DELETE; parent retention remains RESTRICT/no-cascade. Role/password/Vault creation is external platform control, never application migration/source.
-6. `K101-REQ-06`: N-1 single-URL compatibility, rollout/rollback, Vault ownership/rotation/redaction, CI, installer, compose/Portainer, observability, and deployment handoffs SHALL be separately bounded one-card/one-PR work. Prepared slices remain inactive while current owner-runtime deployments stay N-1; Mosaic control plane/Jason alone authorizes one final atomic activation or rollback, with no force-on-red/bypass. KBN-101 planning itself SHALL not mutate production.
-7. `K101-REQ-07`: KBN-100 SHALL begin only after the KBN-101 foundation role/schema-boundary certificate; it SHALL rebase on that main head, restore generated Drizzle declaration/snapshot/journal consistency, and bound procedural immutable-table grant/trigger/backfill additions to its schema slice. KBN-101 real deployed-role immutable-operation certification SHALL complete after KBN-100 creates those relations and before KBN-105.
-
-### Acceptance criteria
-
-1. `AC-K101-01`: DTO/command-matrix tests prove required modes, PGlite exception, `mosaic-db-migrator --help|--run|--verify`/stable exits/argv refusal, public-import negative, every finite classified DDL/static-bypass inventory path and both harness pairs reject `DATABASE_URL`-only before connection/DDL, no migration-to-runtime fallback, and `db:push` refusal outside an allowlisted disposable DB. Before inventory, ownership, or status masking, the semantic fixture fails README's exact former commented code-fence generic-wrapper form and the user guide's exact former executable generic-wrapper form; source-consistency proves current `packages/storage/src/cli.ts` directly `execSync`s `pnpm --filter @mosaicstack/db db:migrate` and no `mosaic-db-migrator` bin exists, so runner-delegation documentation fails. The active `docs/guides/migrate-tier.md` route is inventoried to KBN-101-07 and proves runner-produced `--target-url-file /run/secrets/mosaic-migrate-target-url`, fixed paired provider-version file, and `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing/private-key isolation; Vault KV-v2 same-response version provenance, separate immutable generation mounts, importer CA, JCS/Ed25519 signature/key rotation/revocation, atomic artifact, expiry/replay, safe-fd secret-version/digest, canonical TLS/CA/server/database/role/manifest/schema bindings, dedicated non-DDL importer, consumer isolation/no log-oracle, and exact no-connection versus zero-DML rejection for missing/wrong/stale/replayed/tampered/wrong-key/substituted/generation-mismatched inputs. The full current non-normative docs inventory—including user guide, federation historical task/MILESTONES status, and non-operative SETUP—has an exact safe disposition. Scanner semantic checks reject automatic first-boot/startup extension/schema/migration wording, Compose-up-before-runner, init-script authority, production `.env`/monorepo auto-load/`EnvironmentFile=`/credential-export-or-argv/restart-as-secret-activation routes, and every unqualified operator-document `mosaic-db-migrator --run|--verify` hit regardless of named/normative/status classification. The exact former README/dev/deployment Compose-first sequences, former SETUP wording, exact former MILESTONES wording `pgvector extension installed + verified on startup`, former architecture-plan/PERFORMANCE/backlog runner routes, and any unqualified runner fixture fail before inventory masking. Only one `Held future procedure` Markdown section—bounded through the next equal-or-higher heading—may contain the explicit non-operative/no-current-command-authority form that names KBN-101-00/-03/-05 and preserves external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness; every runner hit outside that section fails. The README assertion for the checked-in direct CI `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` passes only as active legacy N-1, uncertified, non-authorizing-as-an-operator-route status against an isolated disposable CI database pending KBN-101-06 removal—not as an ordinary operator or approved DDL-authority route. Only local PGlite data-layer work or non-PostgreSQL Compose is current (Gateway/Web local startup is held pending daemon/inherited/project-DSN rejection).
-2. `AC-K101-02`: Fixed namespace lock contention/crash/readiness/non-interference and exact manifest-v1 reconciliation tests prove no replica race/runtime auto-migration and fail closed on every missing/unknown/duplicate/ambiguous/corrupt/stale ledger state.
-3. `AC-K101-03`: Actual PostgreSQL 17 + pgvector 0.8.2 control-file, catalog, Drizzle-generation, vector-query/operator, fresh/approved-owner/legacy-shadow/partial/resume/rollback/N-1, and real deployed-role tests prove `trusted` absent/untrusted plus relocatability, external-superuser `SET ROLE` create/update/`RESET ROLE` audit, exact `rolcanlogin=false`/`rolsuper=true`/zero-membership/no-runtime-secret state, platform/schema/extension-owner/migrator/importer/runtime separation, `pg_extension.extowner` plus owner-bearing extension-member/schema/version assertions, and runtime/migrator/schema-owner/importer/all-service-role `SET ROLE`/ALTER/DROP/member-update denial. They also prove `pg_catalog,mosaic` per-session pool safety, `mosaic_extensions` qualification, identifier injection denial, ownership/membership/ledger-read/TEMP/default grants, and unsafe privilege denial.
-4. `AC-K101-04`: Disposable standalone, federated/Swarm, and two-gateway verified-TLS positives plus for both pairs missing CA/wrong CA/wrong SAN/sslmode downgrade, server/Gateway key mode, UID/GID, secret-consumer isolation, and legacy-drain/`hostssl` negatives prove server bootstrap, ordering, and readiness; PGlite is expressly excluded from this PostgreSQL evidence.
-5. `AC-K101-05`: Real runtime-role evidence proves INSERT/SELECT succeeds and UPDATE/DELETE fails for every frozen immutable KBN relation.
-6. `AC-K101-06`: N-1/atomic activation/rollback, Vault/CA-overlap rotation/redaction, health/operator behavior, CI/deployment handoff, independent exact-head security review, and terminal-green CI evidence the foundation before KBN-100; after KBN-100, the real deployed-role immutable-operation certificate and Ultron approval release KBN-105.
-
-**Normative implementation contract:** [`docs/native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md`](./native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md). `ASSUMPTION:` existing `standalone` and `federated` are all PostgreSQL production-like modes; any new PostgreSQL tier inherits these requirements until an explicit versioned amendment.
-
----
-
 ## Tess Interaction Agent Workstream (TESS)
 
 ### Problem and Objective
@@ -250,100 +175,6 @@ Delivery uses five gated milestones: runtime contracts/security; Pi service/stat
 
 ---
 
-## Official Channel Plugin Workstream (#756)
-
-### Problem and Objective
-
-The Discord plugin currently couples Discord event handling, gateway bridging, and reply routing in one implementation and activates only on mentions. Mosaic needs an official channel adapter that behaves the same no matter whether the bound logical agent currently runs through Claude, Codex, Pi, OpenCode, or a future harness. The Discord connection and conversation address must remain stable while the gateway changes the runtime provider behind that logical session.
-
-The objective is to make Discord the first implementation of a transport-neutral official channel contract, with explicit authorization and deterministic channel/thread routing that future Matrix, Slack, and other adapters can share.
-
-### Scope
-
-#### In Scope
-
-1. `CHN-001`: Transport-neutral channel adapter, route, message, attachment, authorization-principal, response-target, and health contracts in `@mosaicstack/types`, including trusted per-binding logical-agent configuration selection.
-2. `CHN-002`: Stable channel conversation addresses based on logical agent plus channel/thread identity; harness, model, and runtime-provider IDs are forbidden from channel session keys.
-3. `DSC-001`: An authorized untagged message in a configured agent-bound channel routes to the agent and receives its response in that channel.
-4. `DSC-002`: A bot mention in a configured parent channel creates a Discord thread, or reuses the thread already attached to that same native message; the mentioned turn and subsequent thread turns route and respond in that thread.
-5. `DSC-003`: A message already inside an authorized thread inherits authorization from its configured parent and never attempts a nested thread.
-6. `DSC-004`: Guild, parent channel, user, pairing, and role authorization remains default-deny before thread creation or gateway dispatch.
-7. `DSC-005`: Discord service authentication, HMAC envelope integrity, replay protection, attachments, approvals, response chunking, and correlation behavior remain intact.
-8. `DSC-006`: The Discord adapter exposes lifecycle and health behavior through the shared channel contract without importing a harness SDK.
-
-#### Out of Scope
-
-1. The logical-agent lease, fencing epoch, execution grant, checkpoint, or cross-harness takeover implementation tracked by #754/#755.
-2. Dynamic Discord authorization administration in the web UI.
-3. Multi-guild tenant isolation, DMs, slash commands, voice, reactions, or production bot deployment.
-4. Implementing Matrix or Slack adapters in this slice.
-
-### Non-Functional Requirements
-
-1. **Security:** no thread or dispatch side effect occurs until guild, parent channel, user, pairing, role, and bounded per-user/channel rate checks pass; attachment metadata is shape- and size-bounded; credentials never enter source, messages, session keys, or logs.
-2. **Portability:** channel contracts and stable conversation IDs contain no Claude, Codex, Pi, OpenCode, model, process, or provider-specific field; each configuration-owned binding selects its trusted logical agent without changing the channel identity.
-3. **Reliability:** repeated messages for one channel/thread resolve the same conversation handle; reconnecting the adapter does not require a harness-specific rebinding.
-4. **Maintainability:** Discord-specific API translation stays in the Discord package; gateway and future adapters depend on transport-neutral contracts.
-5. **Observability:** thread creation or routing failure is reported without message content or credential material.
-
-### Acceptance Criteria
-
-1. `AC-CHN-01`: Contract and behavior tests prove the plugin route contains only logical agent plus channel/thread identity and produces the same stable conversation handle regardless of underlying harness selection.
-2. `AC-CHN-02`: A mentioned authorized parent-channel message creates a thread (or reuses its already-attached thread), dispatches to the thread conversation, and targets the response to that thread.
-3. `AC-CHN-03`: An untagged authorized parent-channel message dispatches to the parent conversation and targets the response to the parent channel.
-4. `AC-CHN-04`: Untagged follow-ups inside an authorized thread dispatch and respond in that same thread without creating a nested thread.
-5. `AC-CHN-05`: Unauthorized guilds, channels, users, unpaired users, insufficient roles, and rate-limited senders produce no thread and no gateway dispatch.
-6. `AC-CHN-06`: Shared channel contracts are exported from `@mosaicstack/types`, Discord implements the lifecycle/health seam, and no harness SDK is imported by the plugin.
-7. `AC-CHN-07`: Focused routing/auth tests, package tests, typecheck, lint, formatting, coverage, independent code/security review, and terminal-green CI pass.
-
-### Constraints, Risks, and Assumptions
-
-- Dependency: Mosaic gateway remains the policy, durable-session, audit, and runtime-provider boundary.
-- Constraint: This work must not modify orchestrator-to-Pi migration or #754/#755 lease/fencing files.
-- Risk: accepting untagged messages could create noisy or unintended agent input. Mitigation: only explicitly configured channels and paired, role-authorized users are accepted, with bounded per-user/channel message and thread rates.
-- Risk: Discord thread creation can fail because of channel permissions, archived state, or API rate limits. Mitigation: fail without dispatching a turn whose response destination cannot be honored, and emit sanitized diagnostics.
-- `ASSUMPTION:` Configured channels are dedicated agent interaction surfaces, so authorized untagged human messages are intentional agent input.
-- `ASSUMPTION:` Mention in a parent channel selects a public thread; messages already in a thread remain there because Discord has no nested threads.
-- `ASSUMPTION:` One Discord bot may serve multiple configuration-owned logical-agent bindings.
-- `ASSUMPTION:` Static allowlists and paired-user roles are the authorization administration surface for this slice.
-
-### Testing and Delivery Intent
-
-Use TDD for remote-ingress routing and permission boundaries. Required evidence includes parent-channel mention, untagged parent message, existing-thread follow-up, existing-thread mention, thread reuse, unauthorized side-effect denial, stable harness-neutral conversation identity, adapter health, and regression coverage for signed envelopes and approvals. Deliver through issue #756, a reviewed squash PR to `main`, terminal-green CI, and issue closure.
-
----
-
-## Mos Runtime Portability Workstream (MOS-PORT)
-
-### Problem and Objective
-
-Mos is currently identified partly by a harness-native session and communication process. Replacement/rebinding exists, but no gateway-enforced logical identity or fencing prevents a stale harness from continuing to reply or execute effects after takeover.
-
-The objective is to make Mos a server-derived logical Mosaic identity whose authority can move safely among runtime connectors. The gateway owns identity, lease, policy, and audit; harnesses remain replaceable adapters.
-
-### M1 Requirements
-
-1. `MOS-PORT-ID-001`: Define a normalized logical-agent identity independent of Claude Code, Pi, Codex, tmux, Matrix, and provider-native session IDs.
-2. `MOS-PORT-LEASE-001`: Persist one exclusive connector lease per tenant/logical-agent/binding with CAS acquisition, monotonic fencing epoch, TTL, heartbeat, explicit release, and takeover.
-3. `MOS-PORT-FENCE-001`: Bind every connector dispatch/execution grant to the current server-derived tenant, logical identity, binding, connector, scopes, expiry, and lease epoch.
-4. `MOS-PORT-FENCE-002`: Reject and audit stale, expired, forged, cross-tenant, cross-binding, and unauthorized grants before connector, channel, provider, or tool side effects.
-5. `MOS-PORT-OBS-001`: Emit credential-safe correlation/audit events for lease acquire, renew, takeover, reject, release, and expiry.
-6. `MOS-PORT-ARCH-001`: Runtime/provider adapters consume normalized lease context without adding harness-native schemas to Mosaic core.
-
-### M1 Acceptance Criteria
-
-1. `AC-MOS-PORT-01`: Two contenders for one binding cannot simultaneously hold current authority under concurrency.
-2. `AC-MOS-PORT-02`: Successful takeover increments the fencing epoch and every operation from the old epoch fails closed before side effects.
-3. `AC-MOS-PORT-03`: Gateway/database restart preserves lease and epoch state; expired leases can be recovered only through the authorized takeover path.
-4. `AC-MOS-PORT-04`: Cross-tenant, cross-agent, cross-binding, forged, and expired lease/grant cases are denied and audited.
-5. `AC-MOS-PORT-05`: Unit, migration, repository close/reopen, concurrency, abuse, gateway integration, independent security review, CI, and documentation gates pass.
-
-### Deferred to Later #754 Milestones
-
-Canonical checkpoint/handoff payloads, exactly-once connector receipts, concrete Claude/Pi/Codex adapters, channel cutover, and full cross-harness failover/rollback E2E are explicitly out of M1 scope.
-
----
-
 ## Architecture
 
 ### High-Level System Diagram
@@ -698,8 +529,7 @@ Discord remote control channel. Architecture inspired by OpenClaw (https://githu
 - Single-guild binding only (v0.1.0) — prevents data leaks between servers
 - Receives Discord messages, dispatches through gateway routing
 - Streams agent responses back to Discord (chunked for 2000-char limit)
-- Routes authorized untagged messages in-channel; mentions create threads (or reuse the same message's attached thread) for multi-turn topics
-- Uses stable logical-agent/channel conversation addresses independent of the active harness/provider
+- Supports mention-based activation, thread management for multi-turn
 - Bot pairing and permission management (Discord user → Mosaic user mapping)
 - DM support for private conversations
 
@@ -872,12 +702,10 @@ Telegram remote control channel.
 
 ### FR-9: Remote Control — Discord
 
-- Discord bot that connects to the gateway through a transport-neutral channel adapter contract
-- Authorized messages in configured agent-bound channels work without a mention and respond in-channel
-- Mentions in parent channels create threads, or reuse a thread already attached to that same native message, for multi-turn conversations
-- Messages already in a thread remain there without requiring repeated mentions
-- Stable logical-agent/channel conversation identity survives underlying harness/provider changes
+- Discord bot that connects to the gateway
+- Mention-based activation in channels
 - DM support for private conversations
+- Thread creation for multi-turn conversations
 - Chunked message delivery (Discord 2000-char limit)
 - Bot configuration via web dashboard
 - Permission management (which Discord users/roles can interact)
@@ -1061,13 +889,10 @@ Telegram remote control channel.
 
 ### AC-3: Discord Remote Control
 
-- [ ] Discord bot connects through the harness-neutral channel contract
-- [ ] Authorized untagged channel messages route through the gateway and respond in-channel
-- [ ] Mentioned parent-channel messages create a thread (or reuse their already-attached thread) and respond there
-- [ ] Existing-thread follow-ups stay in the thread without repeated mentions
-- [ ] Channel/session identity remains stable while the underlying harness/provider changes
+- [ ] Discord bot connects and responds to mentions
+- [ ] Messages route through gateway to agent pool
 - [ ] Responses stream back to Discord (chunked)
-- [ ] Unauthorized guilds, channels, users, pairings, and roles create no thread and dispatch no message
+- [ ] Thread creation for multi-turn conversations
 
 ### AC-4: Gateway Orchestration
 
@@ -1111,10 +936,10 @@ Telegram remote control channel.
 
 ### AC-10: Deployment
 
-- [ ] PGlite data-layer work uses no PostgreSQL; optional Compose services are selected individually and do not start PostgreSQL; Gateway/Web local start remains held until KBN-101-02 rejects daemon/inherited/project DSNs before connection or DDL
-- [ ] PostgreSQL/federated activation is unavailable until KBN-101-00/-03/-05 deliver external bootstrap, TLS/roles, runner `--run`, runner `--verify`, and Gateway/Compose readiness in that order
-- [ ] `mosaic` CLI installable and functional on bare metal after the reviewed KBN-101-05 secret-renderer/process-exec or `LoadCredential` interface exists
-- [ ] Local-only configuration documentation is distinct from production generation-pinned Vault-rendered consumer material
+- [ ] `docker compose up` starts full stack from clean state
+- [ ] `mosaic` CLI installable and functional on bare metal
+- [ ] Database migrations run automatically on first start
+- [ ] `.env.example` documents all required configuration
 
 ### AC-11: @mosaicstack/\* Packages
 
@@ -1266,7 +1091,7 @@ All work is **alpha** (< 0.1.0) until Jason approves 0.1.0 beta release.
 
 6. ASSUMPTION: **Log summarization uses Haiku-tier LLM by default, configurable.** Haiku is well-suited for summarization (compression, not generation — source material is in context). Guardrails: structured output via Zod schema (force extraction of decisions/tools/outcomes/errors as discrete fields), chunked per-session processing (no bulk conflation), extraction-focused prompts. Raw logs stay in hot tier (7 days) as safety net. Users can override the summarization model via routing engine config if they want higher fidelity. Rationale: Haiku is 10-20x cheaper than Sonnet; log summarization runs on schedule against large volumes where cost matters.
 
-7. ASSUMPTION: **Discord plugin starts minimal and single-guild only** — explicitly configured agent-bound channels accept authorized untagged messages in-channel, while mentions create threads or reuse a thread already attached to that same native message; responses are chunked. Single guild binding prevents data leaks between servers. DM support, voice, components, slash commands, and multi-guild operation are post-beta. Rationale: Ship the requested core interaction model while preserving default-deny data isolation.
+7. ASSUMPTION: **Discord plugin starts minimal and single-guild only** — DM support, mention-based channel activation, thread management, chunked responses. Single guild binding to prevent data leaks between servers. Advanced features (voice, components, slash commands, multi-guild) are post-beta. Rationale: Proven pattern from OpenClaw; ship core interaction first; data isolation is non-negotiable.
 
 8. ASSUMPTION: **Telegram plugin is lower priority than Discord** and may ship as v0.0.7 or later if Discord takes longer than expected. Rationale: Jason indicated Discord as the high-priority remote channel.
 

docs/SITEMAP.md

@@ -1,70 +0,0 @@
-# Documentation Sitemap
-
-## Fleet configuration management
-
-- [Generated environment boundary](fleet/reference/generated-env-boundary.md) — roster-derived launch projection, strict local data, legacy quarantine, and downstream interface evidence.
-- [Roster v2 structural contract](fleet/reference/roster-v2-fields.md) — local-tmux schema v2 parsing and structural validation.
-- [Role classes and authority](fleet/reference/role-classes.md) — canonical role resolver and protected authority boundaries.
-- [Executable asset dispositions](fleet/migration/example-profile-disposition.md) — shipped v1 fixture/profile/service validation posture.
-
-## Official channel plugins
-
-- [Channel protocol architecture](architecture/channel-protocol.md) — shared lifecycle, message, stable-route, authorization, and response-target contracts.
-- [Discord administrator configuration](guides/admin-guide.md#discord-ingress-security) — secrets, allowlists, bindings, role policy, and thread permissions.
-- [Discord user workflow](tess/USER-GUIDE.md#discord-conversations) — in-channel messages, mention-created threads, and runtime-transparent continuity.
-- [Channel plugin authoring](tess/PLUGIN-GUIDE.md#official-channel-adapter-contract) — requirements for future Matrix, Slack, and other official adapters.
-- [Discord package guide](../plugins/discord/README.md) — package behavior, configuration shape, and development commands.
-
-## Native Kanban and canonical task SOT
-
-- [Canonical requirements](requirements/native-kanban-sot.md) — ratified P0–P3 requirements and acceptance criteria.
-- [Workstream index](native-kanban-sot/INDEX.md) — artifact map, lane partition, and delivery order.
-- [Mission manifest](native-kanban-sot/MISSION-MANIFEST.md) — scope, authority, invariants, and gate model.
-- [Task decomposition](native-kanban-sot/TASKS.md) — dependency-ordered implementation slices and ownership boundaries.
-- [KBN-101 database role split](native-kanban-sot/KBN-101-DB-ROLE-SPLIT.md) — rc.16 direct-Drizzle storage-wrapper hold: legacy N-1/uncertified/non-operative pending -02/-03/-06/-08; exact README/user-guide wrapper forms fail before masking and source-consistency rejects runner-delegation copy; held bootstrap → TLS/roles → run → verify → readiness; plus prior attestation, pgvector owner, classifier, TLS, activation, and certification prerequisite.
-- [Federated tier data migration](guides/migrate-tier.md) — active KBN-101-07 operator route: runner-produced target attestation, dedicated non-DDL importer, and paired credential-/attestation-file references only.
-- [Frozen shared contract](native-kanban-sot/SHARED-CONTRACT.md) — schema, API, Coordinator, health, recovery, and migration contracts.
-- [KBN-101 exact-head security review](reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) — retained prior REQUEST CHANGES evidence for `da742ca`; rc.16 awaits independent exact-head re-review after closing the current generic storage-wrapper authority HIGH finding.
-- [Initial independent review](reports/native-kanban-sot/canon-initial-review-no-go.md) — KCR-001–016 findings that blocked the first draft.
-- [Final independent re-review](reports/native-kanban-sot/canon-final-rereview-go.md) — closure evidence and GO verdict.
-- [Ultron final gate](reports/native-kanban-sot/ultron-final-go.md) — final requirements, authority, schema, migration, recovery, and evidence review.
-
-## Tess interaction agent
-
-### Operator guides
-
-- [User guide](tess/USER-GUIDE.md) — authorized session, attach, send, stop, and handoff workflows.
-- [Admin guide](tess/ADMIN-GUIDE.md) — deployment configuration, policy, and approval controls.
-- [Developer guide](tess/DEVELOPER-GUIDE.md) — provider contracts, scope boundaries, and test workflow.
-- [Plugin guide](tess/PLUGIN-GUIDE.md) — adapter, redaction, and identity-as-data requirements.
-- [Operations guide](tess/OPERATIONS-GUIDE.md) — readiness, recovery, and incident-safe procedures.
-
-### Architecture and security
-
-- [Architecture](tess/ARCHITECTURE.md)
-- [Threat model](tess/THREAT-MODEL.md)
-- [Mos coordination boundary](tess/MOS-COORDINATION.md)
-- [Hermes runtime adapter design](tess/hermes-runtime-adapter-design.md)
-- [Operator plugin sketch](tess/M4-003-OPERATOR-PLUGIN-SKETCH.md)
-
-### API contract
-
-- [Tess OpenAPI contract](openapi-tess.yaml)
-
-### Migration and qualification
-
-- [Migration inventory](tess/M5-MIGRATION-INVENTORY.md)
-- [Cutover procedure](tess/M5-MIGRATION-CUTOVER.md)
-- [Rollback procedure](tess/M5-MIGRATION-ROLLBACK.md)
-- [Retention and deprecation evidence](tess/M5-MIGRATION-RETENTION-DEPRECATION.md)
-- [Verification matrix](tess/VERIFICATION-MATRIX.md)
-- [Documentation checklist](tess/M5-003-DOCUMENTATION-CHECKLIST.md)
-- [Independent Option 2 runtime-portability qualification (2026-07-14)](tess/qualification/2026-07-14-option2-runtime-portability.md)
-
-## Runtime-neutral Mos portability
-
-- [Optional AI egress gateway ADR](architecture/ADR-MOS-EGRESS-GATEWAYS.md) — placement and gates for LiteLLM, Bifrost, and purpose-built translation proxies.
-- [Runtime-neutral Mos identity and failover mission](https://git.mosaicstack.dev/mosaicstack/stack/issues/754)
-- [Logical identity and connector lease/fencing implementation](https://git.mosaicstack.dev/mosaicstack/stack/issues/755)
-- [M1 logical identity and fencing architecture](architecture/mos-runtime-portability-m1.md)
-- [M1 connector lease operations](guides/mos-connector-lease-operations.md)

docs/TASKS.md

@@ -14,12 +14,10 @@
 
 ## Workstream Rollup
 
-| id  | status            | workstream                     | progress         | tasks file                                                      | notes                                                                             |
-| --- | ----------------- | ------------------------------ | ---------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------- |
-| W1  | planning-complete | Federation v1 (FED)            | 0 / 7 milestones | [docs/federation/TASKS.md](./federation/TASKS.md)               | M1 task breakdown populated; M2–M7 deferred to mission planning                   |
-| W2  | planning-complete | Tess interaction agent         | 0 / 5 milestones | [docs/tess/TASKS.md](./tess/TASKS.md)                           | Issue #706; independent planning gate PASS; M1 issue #707 ready                   |
-| W3  | planning-complete | Native Kanban/SOT              | 0 / 4 phases     | [docs/native-kanban-sot/TASKS.md](./native-kanban-sot/TASKS.md) | Issue #751; canon independently approved; implementation held until canon merges  |
-| W4  | planning-complete | Fleet configuration management | 0 / 12 cards     | This file (§ Fleet configuration management #758)               | Issue #758; M0 docs gate defines the implementation DAG before any fleet mutation |
+| id  | status            | workstream             | progress         | tasks file                                        | notes                                                           |
+| --- | ----------------- | ---------------------- | ---------------- | ------------------------------------------------- | --------------------------------------------------------------- |
+| W1  | planning-complete | Federation v1 (FED)    | 0 / 7 milestones | [docs/federation/TASKS.md](./federation/TASKS.md) | M1 task breakdown populated; M2–M7 deferred to mission planning |
+| W2  | planning-complete | Tess interaction agent | 0 / 5 milestones | [docs/tess/TASKS.md](./tess/TASKS.md)             | Issue #706; independent planning gate PASS; M1 issue #707 ready |
 
 ## Cross-Cutting Tracking
 
@@ -43,30 +41,6 @@ Active workstream is **W1 — Federation v1**. Workers should:
 2. Read [docs/federation/TASKS.md](./federation/TASKS.md) for the next pending task
 3. Follow per-task agent + tier guidance from the workstream manifest
 
-## Fleet configuration management (#758) — M0–M5 implementation DAG
-
-> **PRD:** [Fleet declarative configuration management](./PRD.md#fleet-declarative-configuration-management-workstream-fcm-758) · **M0 acceptance:** [docs IA checklist](./fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md) · **baseline dispositions:** [legacy example/profile inventory](./fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md)
->
-> Every row below is one independently reviewable card and **one PR**. `depends_on` is a
-> hard DAG edge; no card may silently absorb another card's scope. All source cards require
-> the repository quality gates, independent code and security review, terminal-green CI, and
-> the applicable acceptance evidence before merge. Issue #758 remains open until M5 closes.
-
-| id         | status      | description                                                                                                                                                            | issue | agent         | repo              | branch                                  | depends_on                                     | estimate | notes                                                                                                            |
-| ---------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------------- | ----------------- | --------------------------------------- | ---------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------- |
-| FCM-M0-001 | done        | Publish normative PRD requirements/acceptance criteria, this M0–M5 DAG, docs-IA checklist, and legacy example/profile disposition inventory; no implementation changes | #758  | sonnet        | mosaicstack/stack | `docs/758-fleet-config-management`      | —                                              | 18K      | Merged via #760 (`c32d85a`); parent #758 intentionally remains open through M5                                   |
-| FCM-M1-001 | done        | Implement narrow local-tmux v2 roster structural contract/compiler with YAML/JSON canonicalization and schema/parser parity tests                                      | #758  | coder0        | mosaicstack/stack | `feat/758-roster-v2-compiler`           | FCM-M0-001                                     | 30K      | #764 squash `aa5b43b`; exact-head RoR and PR/main terminal-green CI; no lifecycle or live mutation               |
-| FCM-M1-002 | done        | Reuse existing profile/persona/provision resolver for roster semantics; add canonical class/authority validation and approved aliases                                  | #758  | native-sonnet | mosaicstack/stack | `feat/758-shared-role-resolution`       | FCM-M0-001                                     | 25K      | #768 squash `a5e8e55`; shared resolver and canonical authority/alias validation delivered                        |
-| FCM-M1-003 | done        | Convert the M0 legacy inventory into executable example/profile/service-preset validation and explicit v1-version/retirement checks                                    | #758  | codex         | mosaicstack/stack | `test/758-example-profile-dispositions` | FCM-M1-001, FCM-M1-002                         | 20K      | #770 squash `e9c4aa3`; shipped artifact disposition validation delivered                                         |
-| FCM-M2-001 | done        | Migrate generic launch chain to deterministic `.env.generated` plus strict data-only `.env.local`; quarantine forbidden legacy keys                                    | #758  | codex         | mosaicstack/stack | `feat/758-generated-env-boundary`       | FCM-M1-001, FCM-M1-002                         | 30K      | #772 squash `191efae`; generated/local boundary and private quarantine delivered                                 |
-| FCM-M2-002 | done        | Add generation-guarded local fleet agent create/get/update/delete mutations with plan/dry-run, atomic roster writes, and recovery output                               | #758  | codex         | mosaicstack/stack | `feat/758-fleet-agent-crud`             | FCM-M1-001, FCM-M2-001                         | 30K      | #773 squash `bc5e736`; generation-guarded atomic CRUD and recovery contracts delivered                           |
-| FCM-M3-001 | done        | Implement local roster-owned reconcile/apply plus lifecycle/status/verify/doctor contracts and stable JSON/exit codes                                                  | #758  | codex         | mosaicstack/stack | `feat/758-local-reconciler`             | FCM-M2-001, FCM-M2-002                         | 35K      | #785 squash `4990905`; exact roster-owned systemd/tmux reconcile and lifecycle contracts delivered               |
-| FCM-M3-002 | in-progress | Add isolated systemd/tmux lifecycle, drift, socket, unmanaged-session, crash, and rollback acceptance coverage                                                         | #758  | sonnet        | mosaicstack/stack | `test/758-reconciler-lifecycle-gates`   | FCM-M3-001                                     | 25K      | Canonical v2 named-socket + legacy-v1 default-server boundaries; fake adapters/temp fixtures only                |
-| FCM-M4-001 | not-started | Implement field-complete v1-to-v2 inventory/preview/migrator with alias, lifecycle, env-quarantine, and remote/connector disposition evidence                          | #758  | codex         | mosaicstack/stack | `feat/758-v1-v2-migrator`               | FCM-M1-003, FCM-M3-001                         | 35K      | Preview first; no unreviewed lifecycle inference                                                                 |
-| FCM-M4-002 | not-started | Add reversible canary migration, rollback, stale-projection/orphan classification, and current-host 9-managed/3-unmanaged fixture coverage                             | #758  | sonnet        | mosaicstack/stack | `test/758-migration-rollback-gates`     | FCM-M4-001, FCM-M3-002                         | 25K      | Never starts a previously stopped agent or kills an unproven unmanaged session                                   |
-| FCM-M5-001 | not-started | Deliver the accepted fleet documentation IA, how-to/operations/migration references, and link/example validation                                                       | #758  | haiku         | mosaicstack/stack | `docs/758-fleet-config-operator-docs`   | FCM-M1-003, FCM-M2-002, FCM-M3-001, FCM-M4-001 | 24K      | Must close every checklist item or record an approved deferral                                                   |
-| FCM-M5-002 | not-started | Package/update asset-drift checks, rolling local canary, independent validation certificate, and release evidence                                                      | #758  | sonnet        | mosaicstack/stack | `feat/758-fleet-config-release-gate`    | FCM-M3-002, FCM-M4-002, FCM-M5-001             | 30K      | Final #758 gate: quality, independent code/security review, validator certificate, merge-gate approval, green CI |
-
 ## Thin-core prompt diet (#528) — feat/contract-thin-core
 
 - Status: PR open, awaiting maintainer merge ratification (fleet-governing change).

docs/architecture/ADR-MOS-EGRESS-GATEWAYS.md

@@ -1,151 +0,0 @@
-# ADR: Optional AI egress gateways for runtime-neutral Mos
-
-**Status:** Proposed for controlled prototypes; not approved as Mosaic core
-
-**Date:** 2026-07-14
-
-**Issues:** #754, #755
-
-**Decision owner:** Mosaic Gateway / provider-adapter architecture
-
-## Context
-
-The emergency Mos continuity path kept Claude Code as the harness and translated Anthropic Messages traffic to Codex OAuth through a small localhost proxy. That preserved the existing Claude Discord plugin and transcript, but exposed two architectural facts:
-
-1. Harness identity, channel entitlement, provider credentials, and inference transport are separate concerns.
-2. A generic AI gateway can improve provider routing, budgets, and observability, but must not become Mosaic's identity, authorization, tenant, or orchestration boundary.
-
-The Tess qualification report also found that current provider rebinding is not identity-continuous failover. Mosaic still needs a logical agent identity, durable connector lease/fencing, canonical handoff/checkpoint, exactly-once receipts, concrete harness adapters, and cross-harness rollback E2E.
-
-## Decision
-
-Mosaic MAY support LiteLLM, Bifrost, the purpose-built Claude/Codex proxy, or future gateways as optional egress implementations behind `IProviderAdapter` / `AgentRuntimeProvider`.
-
-Mosaic Gateway remains authoritative for:
-
-- authenticated actor and tenant identity;
-- logical agent identity and connector binding;
-- authorization, approval, and policy;
-- lease epoch and stale-holder fencing;
-- audit correlation and redaction;
-- canonical handoff/checkpoint state;
-- idempotency and side-effect receipts.
-
-An egress gateway MUST NOT:
-
-- receive channel ingress directly;
-- authorize tools or connector ownership;
-- define Mosaic tenant or agent identity;
-- persist raw Mosaic handoffs or channel credentials;
-- bypass adapter capability negotiation;
-- silently fail over when policy, lease, or provider health is uncertain.
-
-Allowed topology:
-
-```text
-Discord / Matrix / CLI / web
-        ↓
-Mosaic Gateway: identity, authz, lease/fence, approvals, audit
-        ↓
-IProviderAdapter / AgentRuntimeProvider
-        ↓
-optional egress gateway
-        ↓
-upstream provider or subscription-backed OAuth session
-```
-
-## Candidate assessment
-
-### Purpose-built `raine/claude-code-proxy`
-
-**Disposition:** Approved only for the verified emergency localhost bridge.
-
-Strengths:
-
-- explicit Codex device OAuth flow;
-- small operational surface;
-- Anthropic Messages translation suitable for Claude Code;
-- model and reasoning-effort enforcement;
-- straightforward loopback systemd supervision and rollback.
-
-Constraints:
-
-- not a Mosaic multi-tenant control plane;
-- Claude built-in channels still depend on Claude subscription entitlement and feature lookup;
-- model aliases can obscure the upstream model unless proxy policy/logs are treated as evidence;
-- no replacement for connector leasing, canonical handoff, or exactly-once effects.
-
-### LiteLLM
-
-**Disposition:** Candidate for a formal adapter-only prototype and terms/security review.
-
-Current documentation states that ChatGPT subscription access is available through an OAuth device-code flow. LiteLLM also provides broad provider routing, virtual keys, budgets, observability, and OpenAI/Anthropic-compatible surfaces.
-
-Required prototype gates:
-
-- verify the exact ChatGPT subscription OAuth flow and supported models against current provider terms;
-- document token location, encryption, revocation, refresh, scope, and incident response;
-- prove tenant isolation and prevent virtual keys from becoming Mosaic principals;
-- verify streaming, tool calls, reasoning controls, cancellation, and idempotency metadata;
-- fail closed instead of selecting an unhealthy provider merely to return a result;
-- demonstrate that Mosaic audit correlation survives gateway retries/failover;
-- keep channel ingress and connector credentials outside LiteLLM.
-
-Source references:
-
-- [LiteLLM ChatGPT subscription provider](https://docs.litellm.ai/docs/providers/chatgpt)
-- [LiteLLM providers](https://docs.litellm.ai/docs/providers)
-
-### Bifrost
-
-**Disposition:** Candidate for governance/routing research; subscription OAuth compatibility unverified.
-
-Useful concepts include virtual keys, budgets, rate limits, weighted load balancing, and automatic provider failover. Those features may inform Mosaic egress policy, but Bifrost virtual keys are downstream credentials—not Mosaic actors or tenants.
-
-Required prototype gates:
-
-- verify Codex/ChatGPT subscription OAuth rather than assuming API-key compatibility;
-- map budgets and virtual keys to server-derived Mosaic tenants without duplicating authority;
-- prove failover does not violate connector lease, approval, or exactly-once semantics;
-- ensure request/response logs are redacted before persistence;
-- disable or constrain automatic failover when policy or side-effect state is ambiguous.
-
-Source references:
-
-- [Bifrost overview](https://docs.getbifrost.ai/overview)
-- [Bifrost repository](https://github.com/maximhq/bifrost)
-
-### `teremterem/claude-code-gpt-5-codex`
-
-**Disposition:** Not selected as the emergency implementation; useful as a historical LiteLLM recipe.
-
-The reviewed repository uses `OPENAI_API_KEY`, tells previously authenticated Claude users to log out, and documents a Claude Web Search schema incompatibility. Logging Claude out conflicts with the channel-entitlement requirement observed in the live Mos cutover. The repository therefore does not, as provided, satisfy subscription-OAuth plus built-in-channel continuity.
-
-Source references:
-
-- [Repository](https://github.com/teremterem/claude-code-gpt-5-codex)
-- [Environment template](https://github.com/teremterem/claude-code-gpt-5-codex/blob/main/.env.template)
-
-## Security consequences
-
-- Subscription OAuth grants are high-value credentials and require the same lifecycle controls as service credentials.
-- Downstream virtual keys reduce provider-key exposure but do not establish user, tenant, or agent authority.
-- Automatic retry/failover can duplicate tool or external side effects unless Mosaic owns operation IDs and receipts.
-- Gateway telemetry can contain prompts, tool schemas, and model output; redaction and retention policy must apply before persistence.
-- A localhost unauthenticated translation endpoint must remain loopback-only and process-isolated.
-
-## Acceptance before production use
-
-1. Threat model and provider-terms review approved.
-2. Credential lifecycle and revocation drill documented and exercised.
-3. Adapter contract tests pass for streaming, tools, cancellation, reasoning policy, errors, and audit correlation.
-4. Tenant-bound authorization remains entirely in Mosaic Gateway.
-5. Failure injection proves no duplicate side effects across retries or provider failover.
-6. Rollback to the prior provider path is exercised.
-7. Independent code and security reviews approve the exact deployed revision.
-
-## Follow-up
-
-- #754 owns cross-harness logical identity, checkpoint, receipt, adapter, and failover work.
-- #755 / PR #757 implements the first logical identity and connector lease/fencing boundary.
-- A later issue should prototype LiteLLM and Bifrost behind the provider adapter after #755 is merged and independently qualified.

docs/architecture/channel-protocol.md

@@ -1,9 +1,9 @@
 # Channel Protocol Architecture
 
-**Status:** Official adapter baseline implemented by #756; extended registry/multiplexing remains iterative
+**Status:** Draft
 **Authors:** Mosaic Core Team
-**Last Updated:** 2026-07-14
-**Covers:** M7-001 (OfficialChannelAdapter interface), M7-002 (ChannelMessageDto protocol), M7-003 (Matrix integration design), M7-004 (conversation multiplexing), M7-005 (remote auth bridging), M7-006 (agent-to-agent communication via Matrix), M7-007 (multi-user isolation in Matrix)
+**Last Updated:** 2026-03-22
+**Covers:** M7-001 (IChannelAdapter interface), M7-002 (ChannelMessage protocol), M7-003 (Matrix integration design), M7-004 (conversation multiplexing), M7-005 (remote auth bridging), M7-006 (agent-to-agent communication via Matrix), M7-007 (multi-user isolation in Matrix)
 
 ---
 
@@ -11,80 +11,93 @@
 
 The channel protocol defines a unified abstraction layer between Mosaic's core messaging infrastructure and the external communication channels it supports (Matrix, Discord, Telegram, TUI, WebUI, and future channels).
 
-The implemented baseline is exported from `@mosaicstack/types` and consists of four contract groups:
+The protocol consists of two main contracts:
 
-1. `OfficialChannelAdapter` — transport lifecycle and connection health.
-2. `ChannelMessageDto` / `ChannelAttachmentDto` — canonical transport data.
-3. `ChannelConversationRouteDto` — stable logical-agent conversation and authorization address.
-4. `ChannelResponseTargetDto` — channel/thread destination for replies.
+1. `IChannelAdapter` — the interface each channel driver must implement.
+2. `ChannelMessage` — the canonical message format that flows through the system.
 
-All channel-specific translation logic lives inside the adapter implementation. Runtime selection does not: gateway durable-session and provider services may rebind the logical session from Claude to Codex, Pi, OpenCode, or another harness without reconnecting the channel adapter.
+All channel-specific translation logic lives inside the adapter implementation. The rest of Mosaic works exclusively with `ChannelMessage` objects.
 
 ---
 
-## M7-001: OfficialChannelAdapter Interface
+## M7-001: IChannelAdapter Interface
 
 ```typescript
-interface OfficialChannelAdapter {
-  /** Stable, lowercase adapter identifier such as "discord" or "matrix". */
+interface IChannelAdapter {
+  /**
+   * Stable, lowercase identifier for this channel (e.g. "matrix", "discord").
+   * Used as a namespace key in registry lookups and log metadata.
+   */
   readonly name: string;
-  /** Establish both native-channel and gateway connections. */
-  start(): Promise<void>;
-  /** Gracefully close connections and release resources. */
-  stop(): Promise<void>;
-  /** Best-effort health; ordinary disconnection is a result, not an exception. */
-  health(): Promise<{
-    status: 'connected' | 'degraded' | 'disconnected';
-    detail?: string;
-  }>;
+
+  /**
+   * Establish a connection to the external channel backend.
+   * Called once at application startup. Must be idempotent (safe to call
+   * when already connected).
+   */
+  connect(): Promise<void>;
+
+  /**
+   * Gracefully disconnect from the channel backend.
+   * Must flush in-flight sends and release resources before resolving.
+   */
+  disconnect(): Promise<void>;
+
+  /**
+   * Return the current health of the adapter connection.
+   * Used by the admin health endpoint and alerting.
+   *
+   * - "connected"    — fully operational
+   * - "degraded"     — partial connectivity (e.g. read-only, rate-limited)
+   * - "disconnected" — no connection to channel backend
+   */
+  health(): Promise<{ status: 'connected' | 'degraded' | 'disconnected' }>;
+
+  /**
+   * Register an inbound message handler.
+   * The adapter calls `handler` for every message received from the channel.
+   * Multiple calls replace the previous handler (last-write-wins).
+   * The handler is async; the adapter must not deliver new messages until
+   * the previous handler promise resolves (back-pressure).
+   */
+  onMessage(handler: (msg: ChannelMessage) => Promise<void>): void;
+
+  /**
+   * Send a ChannelMessage to the given channel/room/conversation.
+   * `channelId` is the channel-native identifier (e.g. Matrix room ID,
+   * Discord channel snowflake, Telegram chat ID).
+   */
+  sendMessage(channelId: string, msg: ChannelMessage): Promise<void>;
+
+  /**
+   * Map a channel-native user identifier to the Mosaic internal userId.
+   * Returns null when no matching Mosaic account exists for the given
+   * channelUserId (anonymous or unlinked user).
+   */
+  mapIdentity(channelUserId: string): Promise<string | null>;
 }
 ```
 
-The small lifecycle seam lets the gateway host official plugins uniformly without moving native message translation into gateway core. Message ingress remains adapter-owned; gateway policy, durable session routing, auditing, and runtime/provider selection remain gateway-owned.
-
-### Stable conversation route
-
-```typescript
-interface ChannelConversationRouteDto {
-  bindingId: string;
-  logicalAgentId: string;
-  conversationId: string;
-  channelName: string;
-  authorizationChannelId: string;
-  responseTarget: { channelId: string; threadId?: string };
-}
-```
-
-Harness, provider, model, process, and native runtime-session identifiers are forbidden from this route. Runtime adapters consume the gateway's durable logical-session binding; channel adapters consume only the stable route and response target.
-
-### Typed ingress and egress ports
-
-`ChannelIngressPort` is the transport-neutral direct-integration seam for official adapters. The current deployed Discord adapter preserves its existing HMAC-signed Socket.IO compatibility ingress so gateway-side service authentication, replay protection, approval handling, and correlation semantics remain unchanged; it normalizes the same `ChannelIngressDto` before signing. The adapter uses a supplied `ChannelIngressPort` directly when a future gateway registration provides one. New adapters must use the shared ports rather than adding channel branches to gateway core.
-
-`ChannelBindingDto` contains the configuration-owned workspace/channel→logical-agent mapping and paired external principals; credentials are absent. After native allowlist, pairing, and role checks pass, an adapter submits `ChannelIngressDto` to `ChannelIngressPort.receive()`. It includes the normalized message, `ChannelAuthorizedPrincipalDto`, operation, correlation ID, native message ID, and stable route. Unauthorized input never reaches the port.
-
-Gateway policy and runtime routing produce `ChannelEgressDto`, which `ChannelEgressPort.send()` delivers to the route's response target. Discord's existing HMAC envelope is its authenticated wire encoding of this boundary; future Matrix/Slack adapters use their native authenticated transports while preserving the same actor/operation/correlation semantics.
-
 ### Adapter Registration
 
-Adapters are registered with the gateway plugin host at startup. The host calls `start()`/`stop()` and may monitor `health()` on a configurable interval. A richer dynamic `ChannelRegistry` remains a compatible future extension of this lifecycle contract.
+Adapters are registered with the `ChannelRegistry` service at startup. The registry calls `connect()` on each adapter and monitors `health()` on a configurable interval (default: 30 s).
 
 ```
 ChannelRegistry
-  └── register(adapter: OfficialChannelAdapter): void
-  └── getAdapter(name: string): OfficialChannelAdapter | null
-  └── listAdapters(): OfficialChannelAdapter[]
+  └── register(adapter: IChannelAdapter): void
+  └── getAdapter(name: string): IChannelAdapter | null
+  └── listAdapters(): IChannelAdapter[]
   └── healthAll(): Promise<Record<string, AdapterHealth>>
 ```
 
 ---
 
-## M7-002: ChannelMessageDto Protocol
+## M7-002: ChannelMessage Protocol
 
 ### Canonical Message Format
 
 ```typescript
-interface ChannelMessageDto {
+interface ChannelMessage {
   /**
    * Globally unique message ID.
    * Format: UUID v4. Generated by the adapter when receiving, or by Mosaic
@@ -97,7 +110,6 @@ interface ChannelMessageDto {
    * The adapter populates this from the inbound message.
    * For outbound messages, the caller supplies the target channel.
    */
-  channelName: string;
   channelId: string;
 
   /**
@@ -107,7 +119,7 @@ interface ChannelMessageDto {
   senderId: string;
 
   /** Sender classification. */
-  senderKind: 'user' | 'agent' | 'system';
+  senderType: 'user' | 'agent' | 'system';
 
   /**
    * Textual content of the message.
@@ -124,7 +136,7 @@ interface ChannelMessageDto {
    * - "image"    — binary image; content is empty, see attachments
    * - "file"     — binary file; content is empty, see attachments
    */
-  contentKind: 'text' | 'markdown' | 'code' | 'image' | 'file';
+  contentType: 'text' | 'markdown' | 'code' | 'image' | 'file';
 
   /**
    * Arbitrary key-value metadata for channel-specific extension fields.
@@ -132,7 +144,7 @@ interface ChannelMessageDto {
    * Adapters should store channel-native IDs here so round-trip correlation
    * is possible without altering the canonical fields.
    */
-  metadata: Readonly<Record<string, ChannelMetadataValue>>;
+  metadata: Record<string, unknown>;
 
   /**
    * Optional thread or reply-chain identifier.
@@ -151,21 +163,18 @@ interface ChannelMessageDto {
    * Binary or URI-referenced attachments.
    * Each attachment carries its MIME type and a URL or base64 payload.
    */
-  attachments?: readonly ChannelAttachmentDto[];
+  attachments?: ChannelAttachment[];
 
-  /** ISO-8601 wall-clock timestamp when the message was sent/received. */
-  timestamp: string;
+  /** Wall-clock timestamp when the message was sent/received. */
+  timestamp: Date;
 }
 
-interface ChannelAttachmentDto {
-  /** Channel-native attachment identifier. */
-  id: string;
-
-  /** Filename or display name. */
+interface ChannelAttachment {
+  /** Filename or identifier. */
   name: string;
 
-  /** MIME type when supplied by the channel. */
-  mimeType: string | null;
+  /** MIME type (e.g. "image/png", "application/pdf"). */
+  mimeType: string;
 
   /**
    * URL pointing to the attachment, OR a `data:` URI with base64 payload.
@@ -183,23 +192,23 @@ interface ChannelAttachmentDto {
 
 ## Channel Translation Reference
 
-The following sections document how each supported channel maps its native message format to and from `ChannelMessageDto`.
+The following sections document how each supported channel maps its native message format to and from `ChannelMessage`.
 
 ### Matrix
 
-| ChannelMessageDto field | Matrix equivalent                                                                                                                 |
-| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Matrix event ID (`$...`)                                                            |
-| `channelId`             | Matrix room ID (`!roomid:homeserver`)                                                                                             |
-| `senderId`              | Matrix user ID (`@user:homeserver`)                                                                                               |
-| `senderKind`            | Always `"user"` for inbound; `"agent"` or `"system"` for outbound                                                                 |
-| `content`               | `event.content.body`                                                                                                              |
-| `contentKind`           | `"markdown"` if `msgtype = m.text` and body contains markdown; `"text"` otherwise; `"image"` for `m.image`; `"file"` for `m.file` |
-| `threadId`              | `event.content['m.relates_to']['event_id']` when `rel_type = m.thread`                                                            |
-| `replyToId`             | Mosaic ID looked up from `event.content['m.relates_to']['m.in_reply_to']['event_id']`                                             |
-| `attachments`           | Populated from `url` in `m.image` / `m.file` events                                                                               |
-| `timestamp`             | `new Date(event.origin_server_ts)`                                                                                                |
-| `metadata`              | `{ channelMessageId, roomId, eventType, unsigned }`                                                                               |
+| ChannelMessage field | Matrix equivalent                                                                                                                 |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Matrix event ID (`$...`)                                                            |
+| `channelId`          | Matrix room ID (`!roomid:homeserver`)                                                                                             |
+| `senderId`           | Matrix user ID (`@user:homeserver`)                                                                                               |
+| `senderType`         | Always `"user"` for inbound; `"agent"` or `"system"` for outbound                                                                 |
+| `content`            | `event.content.body`                                                                                                              |
+| `contentType`        | `"markdown"` if `msgtype = m.text` and body contains markdown; `"text"` otherwise; `"image"` for `m.image`; `"file"` for `m.file` |
+| `threadId`           | `event.content['m.relates_to']['event_id']` when `rel_type = m.thread`                                                            |
+| `replyToId`          | Mosaic ID looked up from `event.content['m.relates_to']['m.in_reply_to']['event_id']`                                             |
+| `attachments`        | Populated from `url` in `m.image` / `m.file` events                                                                               |
+| `timestamp`          | `new Date(event.origin_server_ts)`                                                                                                |
+| `metadata`           | `{ channelMessageId, roomId, eventType, unsigned }`                                                                               |
 
 **Outbound:** Adapter sends `m.room.message` with `msgtype = m.text` (or `m.notice` for system messages). Markdown content is sent with `format = org.matrix.custom.html` and a rendered HTML body.
 
@@ -207,34 +216,21 @@ The following sections document how each supported channel maps its native messa
 
 ### Discord
 
-| ChannelMessageDto field | Discord equivalent                                                      |
-| ----------------------- | ----------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Discord message snowflake |
-| `channelId`             | Discord channel ID (snowflake string)                                   |
-| `senderId`              | Discord user ID (snowflake)                                             |
-| `senderKind`            | `"user"` for human members; `"agent"` for bot messages                  |
-| `content`               | `message.content`                                                       |
-| `contentKind`           | `"markdown"` (Discord uses a markdown-like syntax natively)             |
-| `threadId`              | `message.thread.id` when the message is inside a thread channel         |
-| `replyToId`             | Mosaic ID looked up from `message.referenced_message.id`                |
-| `attachments`           | `message.attachments` mapped to `ChannelAttachmentDto`                  |
-| `timestamp`             | `new Date(message.timestamp)`                                           |
-| `metadata`              | `{ channelMessageId, guildId, channelType, mentions, embeds }`          |
+| ChannelMessage field | Discord equivalent                                                      |
+| -------------------- | ----------------------------------------------------------------------- |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Discord message snowflake |
+| `channelId`          | Discord channel ID (snowflake string)                                   |
+| `senderId`           | Discord user ID (snowflake)                                             |
+| `senderType`         | `"user"` for human members; `"agent"` for bot messages                  |
+| `content`            | `message.content`                                                       |
+| `contentType`        | `"markdown"` (Discord uses a markdown-like syntax natively)             |
+| `threadId`           | `message.thread.id` when the message is inside a thread channel         |
+| `replyToId`          | Mosaic ID looked up from `message.referenced_message.id`                |
+| `attachments`        | `message.attachments` mapped to `ChannelAttachment`                     |
+| `timestamp`          | `new Date(message.timestamp)`                                           |
+| `metadata`           | `{ channelMessageId, guildId, channelType, mentions, embeds }`          |
 
-**Outbound:** Adapter calls Discord REST `POST /channels/{id}/messages`. Markdown content is sent as-is (Discord renders it). For `contentKind = "code"` the adapter wraps in triple-backtick fences with the `metadata.language` tag.
-
-### Discord routing and thread policy
-
-A configured Discord binding maps `(guildId, parentChannelId)` to a stable logical agent and a trusted gateway agent-config ID. Gateway verifies that configuration's name matches the binding logical agent before session creation. The stable conversation handle is derived from logical agent plus response channel/thread and never includes the active harness, provider, model, process, or agent-config ID.
-
-| Inbound location/trigger                   | Conversation and response target                                |
-| ------------------------------------------ | --------------------------------------------------------------- |
-| Authorized untagged parent-channel message | Parent channel; response is sent in-channel                     |
-| Authorized bot mention in parent channel   | Thread already attached to that message, or a new public thread |
-| Authorized message already in a thread     | Existing thread; no repeated mention and no nested thread       |
-| `/approve` or `/stop <approval>`           | Current parent/thread durable session; no new topic is created  |
-
-Authorization order is fixed: guild allowlist → parent-channel allowlist → user allowlist → configured binding/pairing → operation role → per-user/channel message and thread rate limits → thread creation/dispatch. A normal Discord channel's category parent is never treated as the thread authorization parent. If requested thread creation fails, dispatch does not occur because the adapter cannot honor the response target.
+**Outbound:** Adapter calls Discord REST `POST /channels/{id}/messages`. Markdown content is sent as-is (Discord renders it). For `contentType = "code"` the adapter wraps in triple-backtick fences with the `metadata.language` tag.
 
 ### Discord service ingress security
 
@@ -244,21 +240,21 @@ The Discord adapter is an authenticated gateway service, not an anonymous Socket
 
 ### Telegram
 
-| ChannelMessageDto field | Telegram equivalent                                                                                           |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------- |
-| `id`                    | Generated UUID; `metadata.channelMessageId` = Telegram `message_id` (integer)                                 |
-| `channelId`             | Telegram `chat_id` (integer as string)                                                                        |
-| `senderId`              | Telegram `from.id` (integer as string)                                                                        |
-| `senderKind`            | `"user"` for human senders; `"agent"` for bot-originated messages                                             |
-| `content`               | `message.text` or `message.caption`                                                                           |
-| `contentKind`           | `"text"` for plain; `"markdown"` if `parse_mode = MarkdownV2`; `"image"` for `photo`; `"file"` for `document` |
-| `threadId`              | `message.message_thread_id` (for supergroup topics)                                                           |
-| `replyToId`             | Mosaic ID looked up from `message.reply_to_message.message_id`                                                |
-| `attachments`           | `photo`, `document`, `video` fields mapped to `ChannelAttachmentDto`                                          |
-| `timestamp`             | `new Date(message.date * 1000)`                                                                               |
-| `metadata`              | `{ channelMessageId, chatType, fromUsername, forwardFrom }`                                                   |
+| ChannelMessage field | Telegram equivalent                                                                                           |
+| -------------------- | ------------------------------------------------------------------------------------------------------------- |
+| `id`                 | Generated UUID; `metadata.channelMessageId` = Telegram `message_id` (integer)                                 |
+| `channelId`          | Telegram `chat_id` (integer as string)                                                                        |
+| `senderId`           | Telegram `from.id` (integer as string)                                                                        |
+| `senderType`         | `"user"` for human senders; `"agent"` for bot-originated messages                                             |
+| `content`            | `message.text` or `message.caption`                                                                           |
+| `contentType`        | `"text"` for plain; `"markdown"` if `parse_mode = MarkdownV2`; `"image"` for `photo`; `"file"` for `document` |
+| `threadId`           | `message.message_thread_id` (for supergroup topics)                                                           |
+| `replyToId`          | Mosaic ID looked up from `message.reply_to_message.message_id`                                                |
+| `attachments`        | `photo`, `document`, `video` fields mapped to `ChannelAttachment`                                             |
+| `timestamp`          | `new Date(message.date * 1000)`                                                                               |
+| `metadata`           | `{ channelMessageId, chatType, fromUsername, forwardFrom }`                                                   |
 
-**Outbound:** Adapter calls Telegram Bot API `sendMessage` with `parse_mode = MarkdownV2` for markdown content. For `contentKind = "image"` or `"file"` it uses `sendPhoto` / `sendDocument`.
+**Outbound:** Adapter calls Telegram Bot API `sendMessage` with `parse_mode = MarkdownV2` for markdown content. For `contentType = "image"` or `"file"` it uses `sendPhoto` / `sendDocument`.
 
 ---
 
@@ -266,19 +262,19 @@ The Discord adapter is an authenticated gateway service, not an anonymous Socket
 
 The TUI adapter bridges Mosaic's terminal interface (`packages/cli`) to the channel protocol so that TUI sessions can be treated as a first-class channel.
 
-| ChannelMessageDto field | TUI equivalent                                                     |
-| ----------------------- | ------------------------------------------------------------------ |
-| `id`                    | Generated UUID (TUI has no native message IDs)                     |
-| `channelId`             | `"tui:<conversationId>"` — the active conversation ID              |
-| `senderId`              | Authenticated Mosaic `userId`                                      |
-| `senderKind`            | `"user"` for human input; `"agent"` for agent replies              |
-| `content`               | Raw text from stdin / agent output                                 |
-| `contentKind`           | `"text"` for input; `"markdown"` for agent responses               |
-| `threadId`              | Not used (TUI sessions are linear)                                 |
-| `replyToId`             | Not used                                                           |
-| `attachments`           | File paths dragged/pasted into the TUI; resolved to `file://` URLs |
-| `timestamp`             | `new Date()` at the moment of send                                 |
-| `metadata`              | `{ conversationId, sessionId, ttyWidth, colorSupport }`            |
+| ChannelMessage field | TUI equivalent                                                     |
+| -------------------- | ------------------------------------------------------------------ |
+| `id`                 | Generated UUID (TUI has no native message IDs)                     |
+| `channelId`          | `"tui:<conversationId>"` — the active conversation ID              |
+| `senderId`           | Authenticated Mosaic `userId`                                      |
+| `senderType`         | `"user"` for human input; `"agent"` for agent replies              |
+| `content`            | Raw text from stdin / agent output                                 |
+| `contentType`        | `"text"` for input; `"markdown"` for agent responses               |
+| `threadId`           | Not used (TUI sessions are linear)                                 |
+| `replyToId`          | Not used                                                           |
+| `attachments`        | File paths dragged/pasted into the TUI; resolved to `file://` URLs |
+| `timestamp`          | `new Date()` at the moment of send                                 |
+| `metadata`           | `{ conversationId, sessionId, ttyWidth, colorSupport }`            |
 
 **Outbound:** The adapter writes rendered content to stdout. Markdown is rendered via a terminal markdown renderer (e.g. `marked-terminal`). Code blocks are syntax-highlighted when `metadata.colorSupport = true`.
 
@@ -288,19 +284,19 @@ The TUI adapter bridges Mosaic's terminal interface (`packages/cli`) to the chan
 
 The WebUI adapter connects the Next.js frontend (`apps/web`) to the channel protocol over the existing Socket.IO gateway (`apps/gateway`).
 
-| ChannelMessageDto field | WebUI equivalent                                             |
-| ----------------------- | ------------------------------------------------------------ |
-| `id`                    | Generated UUID; echoed back in the WebSocket event           |
-| `channelId`             | `"webui:<conversationId>"`                                   |
-| `senderId`              | Authenticated Mosaic `userId`                                |
-| `senderKind`            | `"user"` for browser input; `"agent"` for agent responses    |
-| `content`               | Message text from the input field                            |
-| `contentKind`           | `"text"` or `"markdown"`                                     |
-| `threadId`              | Not used (conversation model handles threading)              |
-| `replyToId`             | Message ID the user replied to (UI reply affordance)         |
-| `attachments`           | Files uploaded via the file picker; stored to object storage |
-| `timestamp`             | `new Date()` at send, or server timestamp from event         |
-| `metadata`              | `{ conversationId, sessionId, clientTimezone, userAgent }`   |
+| ChannelMessage field | WebUI equivalent                                             |
+| -------------------- | ------------------------------------------------------------ |
+| `id`                 | Generated UUID; echoed back in the WebSocket event           |
+| `channelId`          | `"webui:<conversationId>"`                                   |
+| `senderId`           | Authenticated Mosaic `userId`                                |
+| `senderType`         | `"user"` for browser input; `"agent"` for agent responses    |
+| `content`            | Message text from the input field                            |
+| `contentType`        | `"text"` or `"markdown"`                                     |
+| `threadId`           | Not used (conversation model handles threading)              |
+| `replyToId`          | Message ID the user replied to (UI reply affordance)         |
+| `attachments`        | Files uploaded via the file picker; stored to object storage |
+| `timestamp`          | `new Date()` at send, or server timestamp from event         |
+| `metadata`           | `{ conversationId, sessionId, clientTimezone, userAgent }`   |
 
 **Outbound:** Adapter emits a `chat:message` Socket.IO event. The WebUI React component receives it and appends to the conversation list. Markdown content is rendered client-side via the existing markdown renderer component.
 
@@ -308,7 +304,7 @@ The WebUI adapter connects the Next.js frontend (`apps/web`) to the channel prot
 
 ## Identity Mapping
 
-Gateway identity-linking policy resolves a channel-native user identifier to a Mosaic `userId` and produces `ChannelAuthorizedPrincipalDto`. Adapters provide native identity evidence but cannot self-authorize Mosaic scope. Discord currently uses configuration-owned paired users; database-backed linking remains the canonical direction for dynamic Matrix/Slack identity.
+`mapIdentity(channelUserId)` resolves a channel-native user identifier to a Mosaic `userId`. This is required to attribute inbound messages to authenticated Mosaic accounts.
 
 The implementation must query a `channel_identities` table (or equivalent) keyed on `(channel_name, channel_user_id)`. When no mapping exists the method returns `null` and the message is treated as anonymous (no Mosaic session context).
 
@@ -327,8 +323,8 @@ Identity linking flows (OAuth dance, deep-link verification token, etc.) are out
 
 ## Error Handling Conventions
 
-- `start()` must establish the native channel transport or throw a structured connection error. An adapter hosted inside the gateway must not wait for a loopback connection to that same not-yet-listening process; it starts the native transport, lets Socket.IO reconnect, and reports `degraded` until both links are ready.
-- `ChannelEgressPort.send()` implementations must throw a typed terminal error for revoked auth, an invalid route, or a missing channel. Only transient rate/network/server failures are retried with bounded exponential backoff; Discord retries reuse a stable enforced nonce to prevent duplicate chunks, while permanent 4xx failures are not retried.
+- `connect()` must throw a structured error (subclass of `ChannelConnectError`) if the initial connection cannot be established within a reasonable timeout (default: 10 s).
+- `sendMessage()` must throw `ChannelSendError` on terminal failures (auth revoked, channel not found). Transient failures (rate limit, network blip) should be retried internally with exponential backoff before throwing.
 - `health()` must never throw — it returns `{ status: 'disconnected' }` on error.
 - Adapters must emit structured logs with `{ channel: adapter.name, event, ... }` metadata for observability.
 
@@ -336,7 +332,7 @@ Identity linking flows (OAuth dance, deep-link verification token, etc.) are out
 
 ## Versioning
 
-The `ChannelMessageDto` protocol follows semantic versioning. Non-breaking field additions (new optional fields) are minor version bumps. Breaking changes (type changes, required field additions) require a major version bump and a migration guide.
+The `ChannelMessage` protocol follows semantic versioning. Non-breaking field additions (new optional fields) are minor version bumps. Breaking changes (type changes, required field additions) require a major version bump and a migration guide.
 
 Current version: **1.0.0**
 
@@ -477,7 +473,7 @@ A single Mosaic conversation can be accessed simultaneously from multiple surfac
 ### Real-Time Sync Flow
 
 1. A message arrives on any surface (TUI keystroke, browser send, Matrix event).
-2. The surface's adapter normalizes the message to `ChannelMessageDto` and delivers it to `ConversationService`.
+2. The surface's adapter normalizes the message to `ChannelMessage` and delivers it to `ConversationService`.
 3. `ConversationService` persists the message to PostgreSQL, assigns a canonical `id`, and publishes a `message:new` event to the Valkey pub/sub channel keyed by `conversationId`.
 4. All active surfaces subscribed to that `conversationId` receive the fanout event and push it to their respective clients:
    - TUI adapter: writes rendered output to the connected terminal session.
@@ -565,7 +561,7 @@ Matrix sessions for linked users are persistent and long-lived. Unlike TUI sessi
 - Their `channel_identities` row exists (link not revoked).
 - They remain members of the relevant Matrix rooms.
 
-Revoking a Matrix link (`DELETE /auth/channel-link/matrix/<matrixUserId>`) removes the `channel_identities` row and causes gateway principal resolution to deny the identity. The appservice optionally kicks the Matrix user from all Mosaic-managed rooms as part of the revocation flow (configurable, default: off).
+Revoking a Matrix link (`DELETE /auth/channel-link/matrix/<matrixUserId>`) removes the `channel_identities` row and causes `mapIdentity()` to return `null`. The appservice optionally kicks the Matrix user from all Mosaic-managed rooms as part of the revocation flow (configurable, default: off).
 
 ---
 
@@ -737,7 +733,7 @@ room_retention_policies
   created_at       TIMESTAMP
 ```
 
-The retention policy is enforced by a background job in the gateway that calls Conduit's admin API to purge events older than the configured threshold. Purged events are removed from the Conduit store but Mosaic's PostgreSQL message store retains the canonical `ChannelMessageDto` record unless the Mosaic retention policy also covers it.
+The retention policy is enforced by a background job in the gateway that calls Conduit's admin API to purge events older than the configured threshold. Purged events are removed from the Conduit store but Mosaic's PostgreSQL message store retains the canonical `ChannelMessage` record unless the Mosaic retention policy also covers it.
 
 Default retention values:
 

docs/architecture/mos-runtime-portability-m1.md

@@ -1,49 +0,0 @@
-# Mos Runtime Portability M1 — Logical Identity and Fencing
-
-## Boundary
-
-M1 separates the logical Mosaic agent from any Claude, Pi, Codex, tmux, Matrix, or provider-native session. The normalized identity is:
-
-```text
-(tenant_id, logical_agent_id, binding_id)
-```
-
-`logical_agent_id` is a server-owned stable identifier. A connector is a replaceable holder of a lease for one binding; it is not the agent identity.
-
-## Durable lease model
-
-PostgreSQL table `logical_agent_connector_leases` has one unique row per identity/binding tuple. The current row records:
-
-- an opaque lease UUID;
-- connector ID and normalized allowed scopes;
-- a positive decimal fencing epoch stored as PostgreSQL `bigint`;
-- acquired, heartbeat, expiry, release, and update timestamps.
-
-Initial acquisition is insert-only. An existing active row causes `lease_held`. An expired or released row causes `takeover_required`; ordinary acquisition cannot recover it. Authorized takeover uses compare-and-swap against the expected epoch, rotates the lease UUID, and increments the epoch atomically. Heartbeat and release match the full identity, binding, connector, lease UUID, and epoch.
-
-The companion `connector_lease_audit_log` is append-only metadata. It stores lifecycle event, outcome/reason, identity/binding/connector, epoch, correlation ID, and timestamp. It deliberately excludes scopes, grant objects, payloads, approval references, tokens, and credentials.
-
-## Execution grants
-
-`ConnectorLeaseCoordinator` issues a short-lived internal grant only after rereading the durable current lease. Defense-in-depth caps leases at 5 minutes and grants at 30 seconds by default; constructor options may tighten these limits. A grant is bound to tenant, logical agent, binding, connector, lease UUID, scope subset, expiry, and epoch.
-
-Validation occurs immediately before adapter invocation and rereads PostgreSQL. The adapter receives only `ConnectorExecutionContext`; harness-native schemas remain behind the adapter. Validation denies:
-
-- grants not minted by the current gateway process (including cloned/forged objects);
-- expired grants or leases;
-- released leases;
-- stale epochs or replaced connector/lease UUIDs;
-- missing/cross-tenant/cross-agent/cross-binding leases;
-- scopes not authorized by both grant and current lease.
-
-A gateway restart intentionally invalidates process-local grants. The durable lease and epoch survive, and a fresh grant may be issued only after current-lease and gateway-policy validation.
-
-## Concurrency and side-effect rule
-
-The database CAS determines the sole current holder. A successful takeover makes every old-epoch validation fail. Connector adapters must consume and propagate the normalized lease epoch/context so downstream effect boundaries can also fence races that occur after gateway validation.
-
-M1 does not provide exactly-once receipts or a side-effect journal. Those remain later #754 work; callers must not infer exactly-once delivery from lease fencing.
-
-## Extension boundary
-
-`ConnectorLeaseService` is the gateway-owned policy surface. Every policy decision receives the normalized requested scopes and TTL (or explicit `null` where no TTL applies), so a concrete policy can enforce least privilege and duration limits. Its production default policy denies every lease/grant operation until a server-configured connector policy is supplied. No M1 HTTP endpoint accepts caller-controlled tenant or logical identity, and no concrete Claude/Pi/Codex adapter or channel cutover is included.

docs/design/storage-abstraction-middleware.md

@@ -70,10 +70,6 @@ export function createQueue(config?: QueueConfig): QueueHandle {
 
 ### `@mosaicstack/db` (packages/db/src/client.ts)
 
-> **Historical design specimen — status-only, not an operator instruction.** KBN-101 supersedes
-> this pre-split `DATABASE_URL` fallback shape; it cannot authorize runtime migration, DDL, or a
-> connection-string fallback. See the KBN-101 runner/role contract for the produced interface.
-
 ```typescript
 import { drizzle, type PostgresJsDatabase } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';

docs/federation/MILESTONES.md

@@ -54,7 +54,7 @@ Every milestone adds tests to these layers. A milestone cannot be claimed comple
 - Add `"tier": "federated"` to `mosaic.config.json` schema and validators
 - Docker Compose `federated` profile (`docker-compose.federated.yml`) adds: Postgres+pgvector (5433), Valkey (6380), dedicated volumes
 - Tier detector in gateway bootstrap: reads config, asserts required services reachable, refuses to start otherwise
-- **Historical/status only:** the prior startup-provisioning statement is superseded. Runtime/startup extension provisioning is forbidden. PostgreSQL activation remains non-operative with no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land; this record authorizes no current DDL, Compose/init, or startup path.
+- `pgvector` extension installed + verified on startup
 - Migration logic: safe upgrade path from `local`/`standalone` → `federated` (data export/import script, one-way)
 - `mosaic doctor` reports tier + service health
 - Gateway continues to serve as a normal standalone instance (no federation yet)

docs/federation/SETUP.md

@@ -1,74 +1,280 @@
 # Federated Tier Setup Guide
 
-> **KBN-101 N-1 hold:** This page is **non-operative** and grants no current command
-> authority until KBN-101-00, KBN-101-03, and KBN-101-05 land and KBN-101-08 activates a
-> reviewed release. It does not authorize a deployment operation, initialization artifacts,
-> implicit extension/schema/migration creation, raw `CREATE`, direct database initialization, or
-> a Gateway against an unverified database. The prior direct-start wording is retired; its
-> regression fixture is owned by KBN-101-06.
+## What is the federated tier?
 
-## Held future procedure
+The federated tier is designed for multi-user and multi-host deployments. It consists of PostgreSQL 17 with pgvector extension (for embeddings and RAG), Valkey for distributed task queueing and caching, and a shared configuration across multiple Mosaic gateway instances. Use this tier when running Mosaic in production or when scaling beyond a single-host deployment.
 
-This section is non-operative and grants no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land.
+## Prerequisites
 
-The deployment control plane—not an operator shell or deployment lifecycle hook—performs this
-exact held future sequence after activation authorization: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness.
+- Docker and Docker Compose installed
+- Ports 5433 (PostgreSQL) and 6380 (Valkey) available on your host (or adjust environment variables)
+- At least 2 GB free disk space for data volumes
 
-1. External bootstrap provisions the approved database/extension prerequisites.
-2. TLS/roles are installed through the generation-pinned renderer.
-3. The dedicated one-shot runner executes `mosaic-db-migrator --run`.
-4. The same runner executes `mosaic-db-migrator --verify`, including readiness and the
-   importer-target attestation where that route is enabled.
-5. Only after successful verification may Gateway reach its independent verified-TLS Gateway
-   readiness gate.
+## Start the federated stack
 
-No step may be reordered, skipped, replaced by a raw SQL command, or delegated to an initialization
-hook.
-A missing extension, schema, migration, role, secret generation, or readiness proof is a failed
-control-plane precondition; it is not an instruction to start Compose, retry startup, or create
-anything directly.
+Run the federated overlay:
 
-## N-1 status and required disposition
+```bash
+docker compose -f docker-compose.federated.yml --profile federated up -d
+```
 
-The current branch retains historical federation artifacts, but they are not a deployable
-procedure. `docs/federation/TASKS.md` records their shipped status only. KBN-101-02 retires
-runtime/init DDL; KBN-101-05 owns the renderer/deployment handoff; KBN-101-06 verifies the
-finite scanner and command matrix; and KBN-101-07 owns this operator route. A path named in an
-inventory, a historical-status label, or a normative requirement cannot suppress the semantic
-checks above.
+This starts PostgreSQL 17 with pgvector and Valkey 8. The pgvector extension is created automatically on first boot.
 
-Until the activation certificate names an exact release, use no database startup or recovery
-command from this document. For the produced importer interface, see
-[the federated tier migration contract](../guides/migrate-tier.md); it is likewise non-operative
-until activation.
+Verify the services are running:
 
-## Federation and Step-CA reference
+```bash
+docker compose -f docker-compose.federated.yml ps
+```
 
-Federation uses PostgreSQL 17 with pgvector, Valkey, and a shared configuration across multiple
-Gateway instances. Step-CA issues federation peer X.509 certificates whose custom OIDs carry a
-grant and subject identity. The following facts are reference material only; provisioning and
-secret delivery remain deployment-control-plane work under the activation sequence.
+Expected output shows `postgres-federated` and `valkey-federated` both healthy.
 
-| OID                 | Name                     | Description           |
-| ------------------- | ------------------------ | --------------------- |
-| 1.3.6.1.4.1.99999.1 | `mosaic_grant_id`        | Federation grant UUID |
-| 1.3.6.1.4.1.99999.2 | `mosaic_subject_user_id` | Subject user UUID     |
+## Configure mosaic for federated tier
 
-The internal arc `1.3.6.1.4.1.99999` is development-only. Before an externally reachable
-production deployment, register an IANA Private Enterprise Number and version the assignments.
-Each value is DER-encoded as an ASN.1 UTF8String containing the UUID.
+Create or update your `mosaic.config.json`:
 
-The future activated Gateway requires `STEP_CA_URL`, `STEP_CA_PROVISIONER_PASSWORD`,
-`STEP_CA_PROVISIONER_KEY_JSON`, `STEP_CA_ROOT_CERT_PATH`, and `BETTER_AUTH_SECRET` through the
-reviewed secret mechanism. These names do not authorize shell exports, copied credential files,
-or an ad hoc service start.
+```json
+{
+  "tier": "federated",
+  "database": "postgresql://mosaic:mosaic@localhost:5433/mosaic",
+  "queue": "redis://localhost:6380"
+}
+```
 
-## Failure disposition
+If you're using environment variables instead:
 
-- A TLS, CA, SAN, role, runner, or readiness failure is a control-plane incident. Preserve only
-  sanitized evidence and follow the approved rollback/repair record.
-- A pgvector/extension failure is a failed external-bootstrap or runner precondition. Do not use
-  direct extension SQL, init artifacts, or a startup retry as remediation.
-- A port, container, or Valkey problem does not permit bypassing the activation sequence.
-- Federation peer-key rotation remains deferred until its separately approved migration plan;
-  do not rotate `BETTER_AUTH_SECRET` without that plan.
+```bash
+export DATABASE_URL="postgresql://mosaic:mosaic@localhost:5433/mosaic"
+export REDIS_URL="redis://localhost:6380"
+```
+
+## Verify health
+
+Run the health check:
+
+```bash
+mosaic gateway doctor
+```
+
+Expected output (green):
+
+```
+Tier: federated  Config: mosaic.config.json
+  ✓ postgres         localhost:5433       (42ms)
+  ✓ valkey           localhost:6380       (8ms)
+  ✓ pgvector         (embedded)           (15ms)
+```
+
+For JSON output (useful in CI/automation):
+
+```bash
+mosaic gateway doctor --json
+```
+
+## Step 2: Step-CA Bootstrap
+
+Step-CA is a certificate authority that issues X.509 certificates for federation peers. In Mosaic federation, it signs peer certificates with custom OIDs that embed grant and user identities, enforcing authorization at the certificate level.
+
+### Prerequisites for Step-CA
+
+Before starting the CA, you must set up the dev password:
+
+```bash
+cp infra/step-ca/dev-password.example infra/step-ca/dev-password
+# Edit dev-password and set your CA password (minimum 16 characters)
+```
+
+The password is required for the CA to boot and derive the provisioner key used by the gateway.
+
+### Start the Step-CA service
+
+Add the step-ca service to your federated stack:
+
+```bash
+docker compose -f docker-compose.federated.yml --profile federated up -d step-ca
+```
+
+On first boot, the init script (`infra/step-ca/init.sh`) runs automatically. It:
+
+- Generates the CA root key and certificate in the Docker volume
+- Creates the `mosaic-fed` JWK provisioner
+- Applies the X.509 template from `infra/step-ca/templates/federation.tpl`
+
+The volume is persistent, so subsequent boots reuse the existing CA keys.
+
+Verify the CA is healthy:
+
+```bash
+curl https://localhost:9000/health --cacert /tmp/step-ca-root.crt
+```
+
+(If the root cert file doesn't exist yet, see the extraction steps below.)
+
+### Extract credentials for the gateway
+
+The gateway requires two credentials from the running CA:
+
+**1. Provisioner key (for `STEP_CA_PROVISIONER_KEY_JSON`)**
+
+```bash
+docker exec $(docker ps -qf name=step-ca) cat /home/step/secrets/mosaic-fed.json > /tmp/step-ca-provisioner.json
+```
+
+This JSON file contains the JWK public and private keys for the `mosaic-fed` provisioner. Store it securely and pass its contents to the gateway via the `STEP_CA_PROVISIONER_KEY_JSON` environment variable.
+
+**2. Root certificate (for `STEP_CA_ROOT_CERT_PATH`)**
+
+```bash
+docker cp $(docker ps -qf name=step-ca):/home/step/certs/root_ca.crt /tmp/step-ca-root.crt
+```
+
+This PEM file is the CA's root certificate, used to verify peer certificates issued by step-ca. Pass its path to the gateway via `STEP_CA_ROOT_CERT_PATH`.
+
+### Custom OID Registry
+
+Federation certificates include custom OIDs in the certificate extension. These encode authorization metadata:
+
+| OID                 | Name                   | Description           |
+| ------------------- | ---------------------- | --------------------- |
+| 1.3.6.1.4.1.99999.1 | mosaic_grant_id        | Federation grant UUID |
+| 1.3.6.1.4.1.99999.2 | mosaic_subject_user_id | Subject user UUID     |
+
+These OIDs are verified by the gateway after the CSR is signed, ensuring the certificate was issued with the correct grant and user context.
+
+### Environment Variables
+
+Configure the gateway with the following environment variables before startup:
+
+| Variable                       | Required | Description                                                                                               |
+| ------------------------------ | -------- | --------------------------------------------------------------------------------------------------------- |
+| `STEP_CA_URL`                  | Yes      | Base URL of the step-ca instance, e.g. `https://step-ca:9000` (use `https://localhost:9000` in local dev) |
+| `STEP_CA_PROVISIONER_KEY_JSON` | Yes      | JSON-encoded JWK from `/home/step/secrets/mosaic-fed.json`                                                |
+| `STEP_CA_ROOT_CERT_PATH`       | Yes      | Absolute path to the root CA certificate (e.g. `/tmp/step-ca-root.crt`)                                   |
+| `BETTER_AUTH_SECRET`           | Yes      | Secret used to seal peer private keys at rest; already required for M1                                    |
+
+Example environment setup:
+
+```bash
+export STEP_CA_URL="https://localhost:9000"
+export STEP_CA_PROVISIONER_KEY_JSON="$(cat /tmp/step-ca-provisioner.json)"
+export STEP_CA_ROOT_CERT_PATH="/tmp/step-ca-root.crt"
+export BETTER_AUTH_SECRET="<your-secret>"
+```
+
+## Troubleshooting
+
+### Port conflicts
+
+**Symptom:** `bind: address already in use`
+
+**Fix:** Stop the base dev stack first:
+
+```bash
+docker compose down
+docker compose -f docker-compose.federated.yml --profile federated up -d
+```
+
+Or change the host port with an environment variable:
+
+```bash
+PG_FEDERATED_HOST_PORT=5434 VALKEY_FEDERATED_HOST_PORT=6381 \
+  docker compose -f docker-compose.federated.yml --profile federated up -d
+```
+
+### pgvector extension error
+
+**Symptom:** `ERROR: could not open extension control file`
+
+**Fix:** pgvector is created at first boot. Check logs:
+
+```bash
+docker compose -f docker-compose.federated.yml logs postgres-federated | grep -i vector
+```
+
+If missing, exec into the container and create it manually:
+
+```bash
+docker exec <postgres-federated-id> psql -U mosaic -d mosaic -c "CREATE EXTENSION vector;"
+```
+
+### Valkey connection refused
+
+**Symptom:** `Error: connect ECONNREFUSED 127.0.0.1:6380`
+
+**Fix:** Check service health:
+
+```bash
+docker compose -f docker-compose.federated.yml logs valkey-federated
+```
+
+If Valkey is running, verify your firewall allows 6380. On macOS, Docker Desktop may require binding to `host.docker.internal` instead of `localhost`.
+
+## Key rotation (deferred)
+
+Federation peer private keys (`federation_peers.client_key_pem`) are sealed at rest using AES-256-GCM with a key derived from `BETTER_AUTH_SECRET` via SHA-256. If `BETTER_AUTH_SECRET` is rotated, all sealed `client_key_pem` values in the database become unreadable and must be re-sealed with the new key before rotation completes.
+
+The full key rotation procedure (decrypt all rows with old key, re-encrypt with new key, atomically swap the secret) is out of scope for M2. Operators must not rotate `BETTER_AUTH_SECRET` without a migration plan for all sealed federation peer keys.
+
+## OID Assignments — Mosaic Internal OID Arc
+
+Mosaic uses the private enterprise arc `1.3.6.1.4.1.99999` for custom X.509
+certificate extensions in federation grant certificates.
+
+**IMPORTANT:** This is a development/internal OID arc. Before deploying to a
+production environment accessible by external parties, register a proper IANA
+Private Enterprise Number (PEN) at <https://pen.iana.org/pen/PenApplication.page>
+and update these assignments accordingly.
+
+### Assigned OIDs
+
+| OID                   | Symbolic name                     | Description                                               |
+| --------------------- | --------------------------------- | --------------------------------------------------------- |
+| `1.3.6.1.4.1.99999.1` | `mosaic.federation.grantId`       | UUID of the `federation_grants` row authorising this cert |
+| `1.3.6.1.4.1.99999.2` | `mosaic.federation.subjectUserId` | UUID of the local user on whose behalf the cert is issued |
+
+### Encoding
+
+Each extension value is DER-encoded as an ASN.1 **UTF8String**:
+
+```
+Tag    0x0C        (UTF8String)
+Length 0x24        (36 decimal — fixed length of a UUID string)
+Value  <36 ASCII bytes of the UUID>
+```
+
+The step-ca X.509 template at `infra/step-ca/templates/federation.tpl`
+produces this encoding via the Go template expression:
+
+```
+{{ printf "\x0c\x24%s" .Token.mosaic_grant_id | b64enc }}
+```
+
+The resulting base64 value is passed as the `value` field of the extension
+object in the template JSON.
+
+### CA Environment Variables
+
+The `CaService` (`apps/gateway/src/federation/ca.service.ts`) requires the
+following environment variables at gateway startup:
+
+| Variable                       | Required | Description                                                          |
+| ------------------------------ | -------- | -------------------------------------------------------------------- |
+| `STEP_CA_URL`                  | Yes      | Base URL of the step-ca instance, e.g. `https://step-ca:9000`        |
+| `STEP_CA_PROVISIONER_PASSWORD` | Yes      | JWK provisioner password for the `mosaic-fed` provisioner            |
+| `STEP_CA_PROVISIONER_KEY_JSON` | Yes      | JSON-encoded JWK (public + private) for the `mosaic-fed` provisioner |
+| `STEP_CA_ROOT_CERT_PATH`       | Yes      | Absolute path to the step-ca root CA certificate PEM file            |
+
+Set these variables in your environment or secret manager before starting
+the gateway. In the federated Docker Compose stack they are expected to be
+injected via Docker secrets and environment variable overrides.
+
+### Fail-loud contract
+
+The CA service (and the X.509 template) are designed to fail loudly if the
+custom OIDs cannot be embedded:
+
+- The template produces a malformed extension value (zero-length UTF8String
+  body) when the JWT claims `mosaic_grant_id` or `mosaic_subject_user_id` are
+  absent. step-ca rejects the CSR rather than issuing a cert without the OIDs.
+- `CaService.issueCert()` throws a `CaServiceError` on every error path with
+  a human-readable `remediation` string. It never silently returns a cert that
+  may be missing the required extensions.

docs/federation/TASKS.md

@@ -15,20 +15,20 @@
 
 Goal: Gateway runs in `federated` tier with containerized PG+pgvector+Valkey. No federation logic yet. Existing standalone behavior does not regress.
 
-| id        | status | description                                                                                                                                                                                                        | issue | agent  | branch                             | depends_on | estimate | notes                                                                                                                                                                                                                                                 |
-| --------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------------------- | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| FED-M1-01 | done   | Extend `mosaic.config.json` schema: add `"federated"` to `tier` enum in validator + TS types. Keep `local` and `standalone` working. Update schema docs/README where referenced.                                   | #460  | sonnet | feat/federation-m1-tier-config     | —          | 4K       | Shipped in PR #470. Renamed `team` → `standalone`; added `team` deprecation alias; added `DEFAULT_FEDERATED_CONFIG`.                                                                                                                                  |
-| FED-M1-02 | done   | Historical shipped-status record: authored a federated Compose overlay with PostgreSQL/pgvector, Valkey, volumes, and healthchecks. It is not a current startup, init, extension, schema, or migration procedure.  | #460  | sonnet | feat/federation-m1-compose         | FED-M1-01  | 5K       | Shipped in PR #471 status only. KBN-101-02 retires its init authority; KBN-101-05 replaces deployment rendering; KBN-101-07 SETUP is non-operative until activation.                                                                                  |
-| FED-M1-03 | done   | Historical shipped-status record: add pgvector support to `packages/storage/src/adapters/postgres.ts`; no adapter changes for non-federated tiers.                                                                 | #460  | sonnet | feat/federation-m1-pgvector        | FED-M1-02  | 8K       | Shipped in PR #472 status only. **KBN-101 supersedes this behavior:** it cannot authorize current runtime extension creation or any DDL; only the runner/external bootstrap contract may do so.                                                       |
-| FED-M1-04 | done   | Implement `apps/gateway/src/bootstrap/tier-detector.ts`: reads config, asserts PG/Valkey/pgvector reachable for `federated`, fail-fast with actionable error message on failure. Unit tests for each failure mode. | #460  | sonnet | feat/federation-m1-detector        | FED-M1-03  | 8K       | Shipped in PR #473. 12 tests; 5s timeouts on probes; pgvector library/permission discrimination; rejects non-bullmq for federated.                                                                                                                    |
-| FED-M1-05 | done   | Historical shipped-status record: prior tier migration implementation.                                                                                                                                             | #460  | sonnet | feat/federation-m1-migrate         | FED-M1-04  | 10K      | Shipped in PR #474 status only. **KBN-101 supersedes this route:** it cannot authorize current credentials, target connection, or DDL. The future active route requires runner verification plus target URL-file and signed attestation-file binding. |
-| FED-M1-06 | done   | Update `mosaic doctor`: report current tier, required services, actual health per service, pgvector presence, overall green/yellow/red. Machine-readable JSON output flag for CI use.                              | #460  | sonnet | feat/federation-m1-doctor          | FED-M1-04  | 6K       | Shipped in PR #475 as `mosaic gateway doctor`. Probes lifted to @mosaicstack/storage; structural TierConfig breaks dep cycle.                                                                                                                         |
-| FED-M1-07 | done   | Integration test: gateway boots in `federated` tier with docker-compose `federated` profile; refuses to boot when PG unreachable (asserts fail-fast); pgvector extension query succeeds.                           | #460  | sonnet | feat/federation-m1-integration     | FED-M1-04  | 8K       | Shipped in PR #476. 3 test files, 4 tests, gated by FEDERATED_INTEGRATION=1; reserved-port helper avoids host collisions.                                                                                                                             |
-| FED-M1-08 | done   | Integration test for migration script: seed a local PGlite with representative data (tasks, notes, users, teams), run migration, assert row counts + key samples equal on federated PG.                            | #460  | sonnet | feat/federation-m1-migrate-test    | FED-M1-05  | 6K       | Shipped in PR #477. Caught P0 in M1-05 (camelCase→snake_case) missed by mocked unit tests; fix in same PR.                                                                                                                                            |
-| FED-M1-09 | done   | Standalone regression: full agent-session E2E on existing `standalone` tier with a gateway built from this branch. Must pass without referencing any federation module.                                            | #460  | sonnet | feat/federation-m1-regression      | FED-M1-07  | 4K       | Clean canary. 351 gateway tests + 85 storage unit tests + full pnpm test all green; only FEDERATED_INTEGRATION-gated tests skip.                                                                                                                      |
-| FED-M1-10 | done   | Code review pass: security-focused on the migration script (data-at-rest during migration) + tier detector (error-message sensitivity leakage). Independent reviewer, not authors of tasks 01-09.                  | #460  | sonnet | feat/federation-m1-security-review | FED-M1-09  | 8K       | 2 review rounds caught 7 issues: credential leak in pg/valkey/pgvector errors + redact-error util; missing advisory lock; SKIP_TABLES rationale.                                                                                                      |
-| FED-M1-11 | done   | Docs update: `docs/federation/` operator notes for tier setup; README blurb on federated tier; `docs/guides/` entry for migration. Do NOT touch runbook yet (deferred to FED-M7).                                  | #460  | haiku  | feat/federation-m1-docs            | FED-M1-10  | 4K       | Shipped: `docs/federation/SETUP.md` (119 lines), `docs/guides/migrate-tier.md` (147 lines), README Configuration blurb.                                                                                                                               |
-| FED-M1-12 | done   | PR, CI green, merge to main, close #460.                                                                                                                                                                           | #460  | sonnet | feat/federation-m1-close           | FED-M1-11  | 3K       | M1 closed. PRs #470-#480 merged across 11 tasks. Issue #460 closed; release tag `fed-v0.1.0-m1` published.                                                                                                                                            |
+| id        | status | description                                                                                                                                                                                                        | issue | agent  | branch                             | depends_on | estimate | notes                                                                                                                                            |
+| --------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----- | ------ | ---------------------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
+| FED-M1-01 | done   | Extend `mosaic.config.json` schema: add `"federated"` to `tier` enum in validator + TS types. Keep `local` and `standalone` working. Update schema docs/README where referenced.                                   | #460  | sonnet | feat/federation-m1-tier-config     | —          | 4K       | Shipped in PR #470. Renamed `team` → `standalone`; added `team` deprecation alias; added `DEFAULT_FEDERATED_CONFIG`.                             |
+| FED-M1-02 | done   | Author `docker-compose.federated.yml` as an overlay profile: Postgres 17 + pgvector extension (port 5433), Valkey (6380), named volumes, healthchecks. Compose-up should boot cleanly on a clean machine.          | #460  | sonnet | feat/federation-m1-compose         | FED-M1-01  | 5K       | Shipped in PR #471. Overlay defines `postgres-federated`/`valkey-federated`, profile-gated, with pg-init for pgvector extension.                 |
+| FED-M1-03 | done   | Add pgvector support to `packages/storage/src/adapters/postgres.ts`: create extension on init (idempotent), expose vector column type in schema helpers. No adapter changes for non-federated tiers.               | #460  | sonnet | feat/federation-m1-pgvector        | FED-M1-02  | 8K       | Shipped in PR #472. `enableVector` flag on postgres StorageConfig; idempotent CREATE EXTENSION before migrations.                                |
+| FED-M1-04 | done   | Implement `apps/gateway/src/bootstrap/tier-detector.ts`: reads config, asserts PG/Valkey/pgvector reachable for `federated`, fail-fast with actionable error message on failure. Unit tests for each failure mode. | #460  | sonnet | feat/federation-m1-detector        | FED-M1-03  | 8K       | Shipped in PR #473. 12 tests; 5s timeouts on probes; pgvector library/permission discrimination; rejects non-bullmq for federated.               |
+| FED-M1-05 | done   | Write `scripts/migrate-to-federated.ts`: one-way migration from `local` (PGlite) / `standalone` (PG without pgvector) → `federated`. Dumps, transforms, loads; dry-run + confirm UX. Idempotent on re-run.         | #460  | sonnet | feat/federation-m1-migrate         | FED-M1-04  | 10K      | Shipped in PR #474. `mosaic storage migrate-tier`; DrizzleMigrationSource (corrects P0 found in review); 32 tests; idempotent.                   |
+| FED-M1-06 | done   | Update `mosaic doctor`: report current tier, required services, actual health per service, pgvector presence, overall green/yellow/red. Machine-readable JSON output flag for CI use.                              | #460  | sonnet | feat/federation-m1-doctor          | FED-M1-04  | 6K       | Shipped in PR #475 as `mosaic gateway doctor`. Probes lifted to @mosaicstack/storage; structural TierConfig breaks dep cycle.                    |
+| FED-M1-07 | done   | Integration test: gateway boots in `federated` tier with docker-compose `federated` profile; refuses to boot when PG unreachable (asserts fail-fast); pgvector extension query succeeds.                           | #460  | sonnet | feat/federation-m1-integration     | FED-M1-04  | 8K       | Shipped in PR #476. 3 test files, 4 tests, gated by FEDERATED_INTEGRATION=1; reserved-port helper avoids host collisions.                        |
+| FED-M1-08 | done   | Integration test for migration script: seed a local PGlite with representative data (tasks, notes, users, teams), run migration, assert row counts + key samples equal on federated PG.                            | #460  | sonnet | feat/federation-m1-migrate-test    | FED-M1-05  | 6K       | Shipped in PR #477. Caught P0 in M1-05 (camelCase→snake_case) missed by mocked unit tests; fix in same PR.                                       |
+| FED-M1-09 | done   | Standalone regression: full agent-session E2E on existing `standalone` tier with a gateway built from this branch. Must pass without referencing any federation module.                                            | #460  | sonnet | feat/federation-m1-regression      | FED-M1-07  | 4K       | Clean canary. 351 gateway tests + 85 storage unit tests + full pnpm test all green; only FEDERATED_INTEGRATION-gated tests skip.                 |
+| FED-M1-10 | done   | Code review pass: security-focused on the migration script (data-at-rest during migration) + tier detector (error-message sensitivity leakage). Independent reviewer, not authors of tasks 01-09.                  | #460  | sonnet | feat/federation-m1-security-review | FED-M1-09  | 8K       | 2 review rounds caught 7 issues: credential leak in pg/valkey/pgvector errors + redact-error util; missing advisory lock; SKIP_TABLES rationale. |
+| FED-M1-11 | done   | Docs update: `docs/federation/` operator notes for tier setup; README blurb on federated tier; `docs/guides/` entry for migration. Do NOT touch runbook yet (deferred to FED-M7).                                  | #460  | haiku  | feat/federation-m1-docs            | FED-M1-10  | 4K       | Shipped: `docs/federation/SETUP.md` (119 lines), `docs/guides/migrate-tier.md` (147 lines), README Configuration blurb.                          |
+| FED-M1-12 | done   | PR, CI green, merge to main, close #460.                                                                                                                                                                           | #460  | sonnet | feat/federation-m1-close           | FED-M1-11  | 3K       | M1 closed. PRs #470-#480 merged across 11 tasks. Issue #460 closed; release tag `fed-v0.1.0-m1` published.                                       |
 
 **M1 total estimate:** ~74K tokens (over-budget vs 20K PRD estimate — explanation below)
 

docs/fleet/FLEET-CONFIG-DOCS-IA-CHECKLIST.md

@@ -1,86 +0,0 @@
-# Fleet Configuration Management — Documentation IA Acceptance Checklist
-
-**Issue:** #758 · **Scope:** M0 documentation gate for the local fleet declarative-configuration program.
-
-This checklist is an acceptance contract for documentation and examples. It does not authorize
-schema, runtime, systemd, role, profile, or live-fleet changes. An item is complete only when its
-named artifact exists, is linked from the fleet documentation entry point, and its evidence is
-recorded in the M0 task/PR.
-
-## M0 baseline acceptance
-
-- [ ] `docs/PRD.md` states the roster as desired-state SSOT; generated environment, systemd,
-      tmux, and heartbeat artifacts as non-authoritative projections; and fail-closed handling of
-      unsupported or quarantined legacy input.
-- [ ] `docs/PRD.md` defines the required classes and authority boundary: `validator` certifies but
-      does not merge; `merge-gate` remains sole approve-to-land/merge authority; `team-leader`
-      capacity is lease-bounded; `interaction` is request/status only; instance names such as Tess
-      and Ultron remain configurable.
-- [ ] `docs/PRD.md` defines local lifecycle semantics for `enabled`, persisted desired state, and
-      observed state, including stopped-state preservation through migration, apply, and reboot.
-- [ ] `docs/PRD.md` defines the generated-env/local-override boundary, explicitly denies arbitrary
-      command overrides in M1–M5, and requires key-name/hash-only quarantine diagnostics.
-- [ ] `docs/PRD.md` identifies the M1–M5 local-tmux scope and excludes remote reconciliation,
-      connector mutation, secret references, arbitrary commands/channels, gateway convergence, and
-      UI configuration storage.
-- [ ] `docs/TASKS.md` contains the complete M0–M5 one-card/one-PR dependency DAG for #758 with
-      agent tier, branch, dependency, estimate, and evidence expectations.
-- [ ] `docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md` classifies every current shipped
-      fleet example, profile, and service preset before M1 implementation starts.
-
-## Required documentation IA for M1–M5
-
-| Path                                                    | Minimum content                                                              | Delivery gate |
-| ------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------- |
-| `docs/fleet/README.md`                                  | Fleet configuration entry point, desired-vs-observed decision tree, link map | M5            |
-| `docs/fleet/concepts/desired-vs-observed-state.md`      | SSOT/projection model, drift, generation and ownership                       | M5            |
-| `docs/fleet/concepts/identity-class-runtime.md`         | Stable name, display alias, class, runtime/provider/model separation         | M5            |
-| `docs/fleet/concepts/role-authority-and-leases.md`      | Required roles, validator/merge-gate separation, lease limits                | M5            |
-| `docs/fleet/concepts/generated-env-launch-chain.md`     | Generated/local files, precedence, quarantine and non-shell parsing          | M5            |
-| `docs/fleet/reference/roster-v2.schema.json`            | Executable v2 structural contract                                            | M1            |
-| `docs/fleet/reference/roster-v2-fields.md`              | Every field, default, constraint, compatibility behavior and examples        | M1            |
-| `docs/fleet/reference/cli.md`                           | `config`, `agent`, lifecycle, plan/apply, JSON and exit-code contracts       | M2–M3         |
-| `docs/fleet/reference/role-classes.md`                  | Canonical classes, aliases, authority matrix and instance-name rule          | M1            |
-| `docs/fleet/reference/lifecycle-transitions.md`         | Create/start/stop/restart/apply/reboot/rollback transition table             | M3            |
-| `docs/fleet/reference/status-and-drift.md`              | Desired/observed/managed state, orphans, revision mismatch, doctor output    | M3            |
-| `docs/fleet/how-to/create-update-delete-agent.md`       | Safe CRUD, expected generation, dry-run and rollback                         | M2            |
-| `docs/fleet/how-to/start-stop-restart.md`               | Persisted versus one-shot lifecycle actions                                  | M3            |
-| `docs/fleet/how-to/configure-tess-interaction.md`       | Configurable interaction instance; no hardcoded identity                     | M5            |
-| `docs/fleet/how-to/configure-ultron-validator.md`       | Configurable validator instance; no merge authority                          | M5            |
-| `docs/fleet/how-to/customize-roles.md`                  | Existing baseline + `roles.local` resolution and validation                  | M1            |
-| `docs/fleet/operations/reconcile-and-recover.md`        | Plan/apply failure recovery, generation lock and canary rollout              | M3            |
-| `docs/fleet/operations/env-quarantine.md`               | Legacy-key inventory, private quarantine and redaction behavior              | M2            |
-| `docs/fleet/operations/systemd-tmux-troubleshooting.md` | Socket ambiguity, ownership proof, systemd/tmux drift                        | M3            |
-| `docs/fleet/operations/backup-restore.md`               | Roster/projection backup and rollback boundaries                             | M4            |
-| `docs/fleet/operations/upgrade-assets.md`               | Source-vs-installed asset revision detection and safe refresh                | M5            |
-| `docs/fleet/migration/v1-to-v2.md`                      | Normative field map, observed-state preservation and rollback                | M4            |
-| `docs/fleet/migration/example-profile-disposition.md`   | Final disposition of every shipped example/profile                           | M1–M4         |
-| `docs/fleet/migration/legacy-class-aliases.md`          | Alias, unresolved-class, and retirement rules                                | M1            |
-
-## PRD acceptance-criteria mapping
-
-| PRD acceptance criterion                                     | Owning card(s)                     | Required evidence                                                                       |
-| ------------------------------------------------------------ | ---------------------------------- | --------------------------------------------------------------------------------------- |
-| `AC-FCM-01` schema, semantic validation, canonical rendering | FCM-M1-001, FCM-M1-002             | YAML/JSON positive/negative and schema/parser/resolver parity tests                     |
-| `AC-FCM-02` deterministic plan and no-mutation check         | FCM-M3-001                         | Stable JSON/exit-code and desired-versus-observed fixture tests                         |
-| `AC-FCM-03` safe generation-guarded CRUD                     | FCM-M2-002                         | Create/update/delete idempotency, expected-generation, dry-run, and recovery tests      |
-| `AC-FCM-04` generated/local boundary and quarantine          | FCM-M2-001                         | Launch-chain, shadow, injection, redaction, and forbidden-key tests                     |
-| `AC-FCM-05` lifecycle/reconcile/socket/drift safety          | FCM-M3-001, FCM-M3-002             | Isolated systemd/tmux, stopped-state, orphan, socket, and rollback evidence             |
-| `AC-FCM-06` v1 migration and example/profile disposition     | FCM-M4-001, FCM-M4-002, FCM-M1-003 | Preview/canary/rollback fixture plus executable disposition inventory                   |
-| `AC-FCM-07` authority and lease boundaries                   | FCM-M1-002                         | Role/authority/lease denial tests and resolved role contracts                           |
-| `AC-FCM-08` documentation and final release gate             | FCM-M5-001, FCM-M5-002             | Checklist closure, link/example validation, reviews, certificate, and terminal-green CI |
-
-## Cross-cutting evidence gates
-
-- [ ] Every retained or migrated YAML/JSON example, profile, and service preset validates through the
-      same executable schema and shared baseline-plus-`roles.local` resolver used by the CLI.
-- [ ] Every retired example/profile/service preset has a replacement link and deprecation note; no
-      unresolved legacy class or tool-policy alias remains silently shipped.
-- [ ] Documentation examples contain no secret values, arbitrary command override, or product-hardcoded
-      Tess/Ultron identity.
-- [ ] CLI snippets distinguish local fleet desired-state commands from the separate gateway-backed
-      `mosaic agent` catalog.
-- [ ] Migration, quarantine, lifecycle, status, and troubleshooting documentation state that values of
-      legacy sensitive keys are never printed.
-- [ ] M5 release review verifies links, schema/example validation, and that all checklist rows have
-      owner/evidence or an explicit approved deferral.

docs/fleet/FLEET-LAUNCH.md

@@ -1,77 +1,114 @@
 # Fleet Launch Runbook
 
-The local fleet roster is the sole writable desired-state authority for membership and launch policy.
-Generated environment files are rebuildable projections, not an operator-editable command surface.
+How every Mosaic fleet agent — workers **and** the orchestrator — is launched, and how to
+configure each one. The guiding principle: **one roster-driven launcher**. There is no bespoke
+per-agent launch script; the roster plus per-agent `.env` files are the single source of launch
+config.
 
-## Launch chain
+## The launch chain
 
-| Layer               | Responsibility                                                                                                                  |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| Roster              | `fleet/roster.yaml` supplies the agent name, class, supported runtime, model, reasoning, tool policy, workdir, and tmux socket. |
-| Projection writer   | Renders deterministic `fleet/agents/<name>.env.generated` from the roster.                                                      |
-| Optional local data | Reads a strict, data-only `fleet/agents/<name>.env.local`; it cannot shadow generated keys.                                     |
-| systemd             | Starts the launcher with `env -i` and fixed bootstrap data. It does not preload either environment file.                        |
-| session launcher    | Validates generated and local data before it queries, creates, or stops an exact tmux session.                                  |
-| runtime launch      | Derives the fixed `mosaic yolo <runtime>` argument array from validated roster data, then seeds the runtime contract.           |
+| Layer            | File                                              | Responsibility                                                                                                                                              |
+| ---------------- | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| systemd unit     | `mosaic-agent@<role>.service`                     | One templated unit per role; `ExecStart` runs the session launcher with the instance name `%i`. Defaults `MOSAIC_AGENT_RUNTIME=pi`, `MOSAIC_AGENT_NAME=%i`. |
+| session launcher | `tools/fleet/start-agent-session.sh <role>`       | Builds the launch command, opens the tmux pane, wires the heartbeat.                                                                                        |
+| launch command   | `mosaic yolo <runtime>` (or a per-agent override) | Replaces the pane's foreground process with the runtime, fully seeded.                                                                                      |
+| seeding          | `mosaic`'s `composeContract()`                    | Injects the Constitution/USER/TOOLS/runtime contract, `*.local` overlays, **and** the Fleet-Comms cheat-sheet — all via `--append-system-prompt`.           |
 
-The launcher never `source`s or `eval`s an environment file and never accepts an environment-supplied
-command. `MOSAIC_AGENT_COMMAND`, command/channel overrides, unknown keys, generated-key shadowing,
-secret-like key names, duplicate keys, comments, quoted/export syntax, and unsafe values are rejected.
+Per-agent overrides live in `fleet/agents/<role>.env`, generated from `roster.yaml` by
+`generateAgentEnv` (`packages/mosaic/src/commands/fleet.ts`) and consumed by the launcher.
 
-## Generated and local files
+## Worker launch path (default)
 
-`<name>.env.generated` is complete, deterministic, and written only by Mosaic. Its ordered keys are:
+1. `roster.yaml` carries each agent's `runtime` and optional `model_hint`.
+2. `generateAgentEnv` emits `fleet/agents/<role>.env` with `MOSAIC_AGENT_NAME`,
+   `MOSAIC_AGENT_RUNTIME`, and `MOSAIC_AGENT_MODEL`.
+3. `start-agent-session.sh` has no `MOSAIC_AGENT_COMMAND` set, so it falls through to the default
+   (line ~44):
+   ```sh
+   MOSAIC_AGENT_COMMAND="mosaic yolo $MOSAIC_AGENT_RUNTIME${MOSAIC_AGENT_MODEL:+ --model $MOSAIC_AGENT_MODEL}"
+   ```
+4. The launcher bakes `MOSAIC_AGENT_NAME` into the pane command (line ~118), so `composeContract`
+   can inject the Fleet-Comms cheat-sheet for that role.
 
-```dotenv
-MOSAIC_AGENT_NAME=<roster name>
-MOSAIC_AGENT_CLASS=<roster class>
-MOSAIC_AGENT_RUNTIME=<roster runtime>
-MOSAIC_AGENT_MODEL=<roster model hint>
-MOSAIC_AGENT_REASONING=<roster reasoning>
-MOSAIC_AGENT_TOOL_POLICY=<roster tool policy>
-MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
-MOSAIC_TMUX_SOCKET=<roster socket or empty>
+That is the whole worker path: roster → `.env` → `mosaic yolo <runtime>` → seeded pane.
+
+## Orchestrator fold (PATH A — ships today)
+
+The orchestrator is **just another roster agent** launched through the canonical path — not a
+snowflake script.
+
+| Piece              | Value                               |
+| ------------------ | ----------------------------------- |
+| host-side launcher | `orchestrator-launch.sh`            |
+| systemd unit       | `mosaic-fleet-orchestrator.service` |
+| tmux session       | `orchestrator` (role-named)         |
+
+Set its launch command via `fleet/agents/orchestrator.env`:
+
+```sh
+MOSAIC_AGENT_COMMAND='mosaic yolo claude --channels plugin:discord@<channel>'
 ```
 
-The generated launch contract supports `claude`, `codex`, `opencode`, and `pi`. `mosaic fleet add`
-rejects another runtime before it writes the roster or modifies generated, local, or quarantine state.
-The legacy dogfood stub remains an observability-only canary on its separate `mosaic-factory` socket;
-it has no generated-launch adapter and cannot be added through this path.
+When `MOSAIC_AGENT_COMMAND` is set, `start-agent-session.sh`'s `if [ -z "$MOSAIC_AGENT_COMMAND" ]`
+guard (line ~41) is false, so the line-44 default — **including its hardcoded `yolo`** — is skipped
+entirely. The override fully controls the runtime and flags. Routing through `mosaic yolo claude`
+(rather than a raw `claude` invocation) is what gives the orchestrator the same full
+`composeContract` seeding + Fleet-Comms cheat-sheet as every worker, with `--channels` and any
+other flags passed straight through to the `claude` binary.
 
-`<name>.env.local` is optional and may contain only non-secret machine data:
+## Launch gotchas
 
-- `MOSAIC_RUNTIME_BIN`
-- `MOSAIC_HEARTBEAT_RUN_DIR`
-- `MOSAIC_HEARTBEAT_INTERVAL`
-- `MOSAIC_CLAUDE_JSON`
-- `CLAUDE_CONFIG_DIR`
+1. **Flag conflict.** `mosaic yolo claude` already injects `--dangerously-skip-permissions`. Do
+   **not** also pass `--permission-mode bypassPermissions` — the `claude` binary would receive both.
+   Use `mosaic yolo claude …` alone (yolo covers the unattended posture), **or** non-yolo
+   `mosaic claude --permission-mode bypassPermissions …`. Never mix the two.
+2. **`MOSAIC_AGENT_NAME` must reach the pane.** The launcher bakes it from the instance name, and
+   `composeContract` gates the Fleet-Comms block on it (`launch.ts`, in `composeContract`) — **and**
+   the role must be a member of `roster.yaml`, or the block resolves empty.
+3. **`launchRuntime` guards.** `mosaic yolo claude` runs `checkSoul` / `checkRuntime` /
+   `checkSequentialThinking`. The host needs `SOUL.md` and the sequential-thinking MCP, or the
+   launch aborts (a raw `claude` invocation skipped these checks). Dry-run the composed command in a
+   throwaway tmux session before swapping a live launcher.
 
-Paths must be safe absolute paths and the heartbeat interval must be a positive integer. Projection,
-local, and quarantine files must be private regular files; the managed directories must be real,
-private, non-symlink paths. Violations fail closed before tmux interaction.
+## Why per-agent `.env` survives upgrades (#632)
 
-## Legacy input and diagnostics
+`install.sh` `PRESERVE_PATHS` includes `fleet/*.yaml`, `fleet/agents`, and `fleet/run`, so
+`mosaic update`'s framework re-seed **preserves** your roster and per-agent `.env` overrides
+(glob-aware `cp` fallback; matching TS parity in `file-adapter.ts`). Before #632, an auto re-seed
+could wipe them — which is exactly why PATH A's `.env` override is safe to rely on now.
 
-A legacy `<name>.env` is input only during projection generation. Roster-owned keys are regenerated;
-valid allowed local data can move to `.env.local`; invalid legacy input is privately retained at
-`<name>.env.quarantine`. Neither legacy nor quarantine files are launch authority.
+## Inspecting the comms wiring
 
-Diagnostics expose only rule code, key name, and a SHA-256 content hash. They do not reveal command
-text, credentials, or other values.
+- `mosaic fleet comms-block <role>` prints the Fleet-Comms cheat-sheet a given role receives at
+  launch — its `[host:session]` identity, the exact `agent-send.sh` command for each peer, and the
+  FLIP / `--verify` conventions. `--host <h>` previews a cross-host view. An unknown role or missing
+  roster **fails loud** (stderr + non-zero exit), so a typo is never a silent no-op.
+- Versus `mosaic compose-contract <runtime>`: that emits the **whole** system prompt and reads the
+  role from `MOSAIC_AGENT_NAME` (a full-prompt smoke test). `comms-block` is the targeted,
+  explicit-arg, comms-only view — e.g. `mosaic fleet comms-block coder0-0` to preview a peer.
 
-## Launch and stop behavior
+## North Star / future direction
 
-The launcher obtains the agent's socket only from the validated generated projection. It creates or
-checks the exact `=<agent-name>` tmux target; it never uses an ambient socket or fuzzy session match.
-The same strict parser runs before exact-stop behavior. A fresh native Pi heartbeat remains authoritative;
-the shell sidecar only provides fallback state when the native marker is stale or absent.
+**Vision:** a webUI lets the user edit each agent's launch config — switch **harness**
+(claude / pi / codex / opencode), toggle **yolo**, pick a **model**, set a **command/channels**
+override — with no terminal.
 
-`mosaic fleet comms-block <role>` can inspect the role's resolved Fleet-Comms block. It is a read-only
-inspection tool and fails loudly for an unknown role or missing roster.
+**Continuity — this is not a new launch path.** It is a data-model + UI-binding layer over the
+existing roster-driven launcher. Field-by-field status today:
 
-## Current M2 boundary
+| Launch-config field      | Roster-native today? | Mechanism / gap                                                                                                                                          |
+| ------------------------ | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **harness** (`runtime`)  | ✅ end-to-end        | `roster.runtime` → `generateAgentEnv` emits `MOSAIC_AGENT_RUNTIME` → launcher line 44. UI just writes the field.                                         |
+| **model** (`model_hint`) | ✅ end-to-end        | `roster.model_hint` → `MOSAIC_AGENT_MODEL` → launcher line 44 `--model`. UI just writes the field.                                                       |
+| **yolo**                 | ❌ new               | Launcher line 44 **hardcodes** `mosaic yolo`. A non-yolo toggle needs a roster `yolo` field → emit `MOSAIC_AGENT_YOLO` → make line 44 conditional.       |
+| **command / channels**   | ❌ new               | `MOSAIC_AGENT_COMMAND` is **consumed** (launcher line ~12) but `generateAgentEnv` does not emit it. Needs a roster `command`/`channels` field → emitted. |
 
-FCM-M2-001 supplies generated/local parsing, validation, projection, quarantine, and launch-boundary
-evidence only. It does not authorize roster CRUD expansion, reconciliation, lifecycle changes, remote
-or connector mutation, site canaries, or migration. M3 must establish the local reconcile/lifecycle
-path; M4 separately provides migration preview, canary, and rollback gates.
+**The arc:**
+
+- **A** — `.env` `MOSAIC_AGENT_COMMAND` hatch: manual, ships now, kept safe across upgrades by #632.
+- **B** — roster-native launch-config: harness + model are already there; add the **yolo** toggle
+  (line-44 conditional) and **command/channels** emission to complete the data model.
+- **webUI** — binds dropdowns/toggles directly to those four roster fields.
+
+PATH A's `.env` override is the **manual form** of exactly what PATH B makes roster-native and the
+webUI edits — one continuous arc, not three separate features. PATH B is tracked as #636.

docs/fleet/LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md

@@ -1,57 +0,0 @@
-# Fleet Configuration Management — Legacy Example, Profile, and Service Disposition Inventory
-
-**Issue:** #758 · **Baseline:** `origin/main` `49e8a541` · **Status:** M0 inventory; no source
-examples or profiles are changed by this document.
-
-The v2 compiler may not silently accept an unresolved class. Before M1 exits, every shipped file
-below must be either migrated and executable, retained as an explicitly versioned v1 fixture, or
-retired with a replacement/deprecation note. Class resolution must use the existing
-profile/persona/provision baseline-plus-`roles.local` resolver; this inventory does not create a
-parallel resolver. The current executable implementation and per-artifact outcomes are recorded in
-[the disposition evidence](./migration/example-profile-disposition.md).
-
-## Examples
-
-| Shipped file                                         | Current class evidence                                              | M0 disposition decision                                                                              | Required M1/M4 evidence                                              |
-| ---------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
-| `framework/fleet/examples/coding.yaml`               | `orchestrator`, `enhancer`, `implementer`, `reviewer`               | Migrate: `implementer → code`, `reviewer → review`; retain orchestration/enhancer intent             | v2 fixture validates; role aliases and authority matrix tested       |
-| `framework/fleet/examples/general.yaml`              | `orchestrator`, `enhancer`, `worker`                                | Migrate only after operator chooses a concrete canonical role for `worker`; no implicit conversion   | Explicit replacement class, or versioned v1 fixture/retirement note  |
-| `framework/fleet/examples/hybrid.yaml`               | `orchestrator`, `enhancer`, `implementer`, `researcher`, `reviewer` | Migrate aliases; resolve `researcher` through existing role resolver or retain/version               | Shared resolver validation; no ad-hoc class scanner                  |
-| `framework/fleet/examples/local-canary.yaml`         | `orchestrator`, `implementer`, `reviewer`                           | Migrate aliases; preserve its local-tmux canary purpose                                              | v2 fixture validates and preserves safe stopped/running behavior     |
-| `framework/fleet/examples/minimal.yaml`              | `canary`                                                            | Retire or version as v1 unless an existing canonical role contract is selected deliberately          | Replacement link/deprecation note or CI-valid v1 fixture             |
-| `framework/fleet/examples/operator-interaction.yaml` | `operator-interaction`                                              | Migrate alias to `interaction`; preserve instance/display name as configuration, not schema identity | v2 interaction fixture validates; no Tess literal is required        |
-| `framework/fleet/examples/research.yaml`             | `orchestrator`, `enhancer`, `researcher`, `analyst`                 | Resolve `researcher`/`analyst` through baseline + `roles.local`, or version/retire                   | Resolver evidence and explicit disposition for each unresolved class |
-
-## Profiles
-
-| Shipped file                                       | Current class evidence                                                                                                                                                                     | M0 disposition decision                                                                                                                                | Required M1/M4 evidence                                                               |
-| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
-| `framework/fleet/profiles/business.yaml`           | `ceo`, `coo`, `cfo`, `product-manager`, `marketing-lead`, `sales-lead`, `operations-manager`, `customer-success-manager`, `code`, `review`                                                 | Retain only if every class resolves through the existing role library/`roles.local`; otherwise version/retire rather than weakening validation         | Shared resolver CI result for every class; documented role source or replacement      |
-| `framework/fleet/profiles/marketing.yaml`          | `marketing-lead`, `content-strategist`, `copywriter`, `seo-specialist`, `social-media-manager`, `brand-strategist`, `growth-marketer`, `ux-designer`                                       | Same resolver-or-version/retire rule                                                                                                                   | Per-class resolver CI result and replacement/deprecation record if unresolved         |
-| `framework/fleet/profiles/personal-assistant.yaml` | `personal-assistant`, `executive-assistant`, `scheduler`, `inbox-manager`, `researcher`                                                                                                    | Same resolver-or-version/retire rule                                                                                                                   | Per-class resolver CI result; do not infer `interaction` equivalence                  |
-| `framework/fleet/profiles/research.yaml`           | `lead-researcher`, `researcher`, `data-analyst`, `data-scientist`, `market-analyst`, `documentation`, `review`                                                                             | Same resolver-or-version/retire rule                                                                                                                   | Per-class resolver CI result and explicit compatibility posture                       |
-| `framework/fleet/profiles/software-delivery.yaml`  | `orchestrator`, `board`, `planner`, `decomposition`, `code`, `review`, `security-review`, `site-tester`, `documentation`, `merge-gate`, `rebase`, `operator`, `session-review`, `enhancer` | Retain as the governance reference; add `validator`, `team-leader`, and `interaction` only through approved role/profile work, not silent substitution | CI validates all current classes; separate fixture proves required M1 authority seats |
-
-## Service presets
-
-| Shipped file                                         | Current policy evidence                                                                                                                                               | M0 disposition decision                                                                                                                                                                                                              | Required M1/M4 evidence                                                                                                                                                               |
-| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `framework/fleet/services/operator-interaction.yaml` | Generic policy only: `runtime: pi`, `model: openai/gpt-5.6-sol`, `reasoning: high`, `tool_policy: operator-interaction`; provisioning supplies the agent name as data | Retain as a generic service policy, not a Tess identity. Migrate `tool_policy: operator-interaction` only through the approved interaction tool-policy alias/semantic resolver; do not infer a class or machine name from this file. | Service-policy fixture validates runtime/model/reasoning and alias behavior; generic provisioning proves a configured interaction instance is supplied without a hardcoded Tess name. |
-
-## Required disposition controls
-
-1. **No silent aliasing:** only `implementer → code`, `reviewer → review`, and
-   `operator-interaction → interaction` are approved deterministic aliases in this M0 baseline.
-   `worker`, `analyst`, `canary`, and domain-specific classes require resolver evidence or an
-   explicit version/retirement decision.
-2. **No identity hardcoding:** Tess and Ultron are optional instance/display names. An example/profile
-   may demonstrate the capability but must not make a product name a required class or machine ID.
-3. **No lifecycle inference from an example:** examples describe desired configuration only; migration
-   of an installed v1 roster separately preserves observed stopped/running state.
-4. **No secret or command migration:** examples/profiles must not introduce credential values or
-   `MOSAIC_AGENT_COMMAND`; those legacy keys are M2 quarantine inputs, never v2 authoring fields.
-5. **Service presets are included:** service policies are inventoried alongside examples/profiles.
-   They may express launch/tool policy, but do not create a class, a canonical agent identity, or a
-   second validation path.
-6. **Evidence is executable:** M1/M4 CI must enumerate these exact files, validate retained/migrated
-   inputs through the shared resolver, and fail if a file lacks its documented disposition.

docs/fleet/backlog-conventions.md

@@ -14,17 +14,18 @@ and surfaced as `mosaic fleet backlog <sub> --json`.
 The backlog uses the existing Mosaic storage layer; there is **no** new database
 engine (no sqlite, no raw client).
 
-| Condition                          | Tier                 | Data location                                                    |
-| ---------------------------------- | -------------------- | ---------------------------------------------------------------- |
-| `DATABASE_URL` injected at runtime | Full server Postgres | the verified runtime database; it never authorizes migration/DDL |
-| `PGLITE_DATA_DIR` set (no URL)     | Embedded PGlite      | that directory                                                   |
-| neither (default)                  | Embedded PGlite      | `~/.config/mosaic/fleet/backlog`                                 |
+| Condition                      | Tier                 | Data location                    |
+| ------------------------------ | -------------------- | -------------------------------- |
+| `DATABASE_URL` set             | Full server Postgres | the configured database          |
+| `PGLITE_DATA_DIR` set (no URL) | Embedded PGlite      | that directory                   |
+| neither (default)              | Embedded PGlite      | `~/.config/mosaic/fleet/backlog` |
 
 PGlite is real Postgres semantics in-process — including the row locks the atomic
 claim relies on — so the **same code** runs on a laptop (embedded, single-host
 default) and on a full Postgres deployment. Switching tiers is config-only.
 
-For embedded PGlite only, the local backlog routine may prepare its local schema on first use. **Current operator behavior is PGlite-only.** The PostgreSQL path is held until KBN-101 activation; no current PostgreSQL CLI route, runner, or first-use migration is available or authorized. A future activated PostgreSQL runtime may connect only after its separately certified readiness gate.
+The schema (`backlog` table) is created automatically on first CLI use:
+`runMigrations()` for Postgres, `runPgliteMigrations()` for embedded PGlite.
 
 ### Update safety
 

docs/fleet/how-to/create-update-delete-agent.md

@@ -1,74 +0,0 @@
-# Create, Inspect, Update, and Delete a Local Fleet Agent
-
-Use the local roster-v2 control plane only. These commands change desired state and derived environment projections; they never start, stop, reconcile, inspect, or otherwise act on systemd, tmux, sessions, or runtimes.
-
-## Read and plan first
-
-```sh
-mosaic fleet get <name>
-mosaic fleet plan create --expected-generation <n> --agent '<json>'
-mosaic fleet plan update <name> --expected-generation <n> --agent '<json>'
-mosaic fleet plan delete <name> --expected-generation <n>
-```
-
-`plan create` takes the name from `--agent`. `plan update` and `plan delete` require the target name immediately after the operation. A plan is deterministic and side-effect free: it validates the complete proposed roster and projection targets without changing files. Use `--dry-run` on `create`, `update`, or `delete` for the same no-write result.
-
-Every successful command prints JSON. `get` returns `{ "generation", "agent" }`; mutation results contain `plan`, `applied`, `authoritativeRoster`, and `projections`.
-
-## Create safely
-
-```sh
-mosaic fleet create --expected-generation 7 --agent '{
-  "name":"coder0",
-  "alias":"Coder 0",
-  "className":"code",
-  "runtime":"pi",
-  "provider":"openai",
-  "model":"gpt-5.6-sol",
-  "reasoning":"high",
-  "toolPolicy":"code",
-  "workingDirectory":"/srv/mosaic",
-  "persistentPersona":false,
-  "resetBetweenTasks":true,
-  "launch":{"yolo":true}
-}'
-```
-
-Create defaults to `enabled: true` and `desired_state: stopped`. It does not start a process. Add `--persisted-start` only to persist `desired_state: running`; that still does not start a runtime in this M2 command. The JSON payload is an allowlist of the roster-v2 fields shown above plus `launch.yolo`; command, channel, secret-reference, and other unknown keys are rejected rather than ignored. The JSON error exposes only a stable code, never the rejected value.
-
-## Update and delete safely
-
-```sh
-mosaic fleet update coder0 --expected-generation 8 --agent '<complete JSON agent payload>'
-mosaic fleet delete coder0 --expected-generation 9
-```
-
-Updates require a complete agent JSON payload and preserve the stable name. Delete removes only the exact roster-owned `coder0.env.generated` projection. It retains `coder0.env.local`, legacy `coder0.env`, `coder0.env.quarantine`, and every unrelated projection. A delete dry-run leaves all of those files byte-identical.
-
-## Handle generation conflicts
-
-Every mutation requires the current authoritative `--expected-generation`. A stale value returns JSON `error.code: "stale-generation"` with a non-zero exit. Reload with `mosaic fleet get <name>` or reread the roster, plan again using the returned generation, then retry. A concurrent mutation returns `concurrent-mutation`; do not force or bypass the lock.
-
-## Interpret partial failures
-
-The roster is authoritative and is written before derived projections. A late projection I/O failure returns non-zero with redacted, actionable JSON:
-
-```json
-{
-  "applied": false,
-  "authoritativeRoster": "committed",
-  "projections": "incomplete",
-  "recovery": {
-    "code": "projection-apply-failed",
-    "action": "regenerate-projections-from-roster"
-  }
-}
-```
-
-This is not a rollback and not a no-op: reload the roster because its generation and membership were committed, regenerate projections from that roster, then plan a new mutation. Recovery output never contains environment values, credentials, or command text.
-
-## Exit and boundary behavior
-
-Handled validation errors and partial projection failures exit non-zero. `plan`/`--dry-run` and normal mutation JSON make the state explicit; scripts should use both the exit code and `authoritativeRoster`/`projections`, not `applied` alone.
-
-The commands operate only on `<mosaic-home>/fleet/roster.yaml`, the local roster desired-state authority. They do not accept arbitrary commands, channels, secrets, remote/connector actions, migration/canary actions, or runtime lifecycle operations.

docs/fleet/how-to/customize-roles.md

@@ -1,54 +0,0 @@
-# Customize Fleet Roles
-
-Mosaic resolves persona contracts through two layers:
-
-1. `fleet/roles/<canonical-class>.md` — seeded baseline contract.
-2. `fleet/roles.local/<canonical-class>.md` — operator override or custom role; this layer wins.
-
-The same shared resolver is used by profile validation, provisioning, roster-v2 semantic validation,
-and launch-time persona injection.
-
-## Override a baseline role
-
-Create a readable Markdown contract under `roles.local` with the canonical filename and class marker:
-
-```markdown
-# Code — local role definition
-
-The local code role (`class: code`) follows the operator's repository conventions.
-```
-
-Save it as `fleet/roles.local/code.md`. Do not edit generated or seeded baseline assets when the goal
-is a durable local customization.
-
-Legacy aliases canonicalize before lookup. Therefore `roles.local/implementer.md` does not override
-`code`; use `roles.local/code.md`. See [Legacy Fleet Class Aliases](../migration/legacy-class-aliases.md).
-
-## Add a custom class
-
-A custom class remains supported when a readable contract exists for the exact identifier:
-
-```markdown
-# Release notes — local role definition
-
-The release-notes role (`class: release-notes`) prepares operator-reviewed release copy.
-```
-
-Save it as `fleet/roles.local/release-notes.md`, then reference `class: release-notes` and a matching
-`tool_policy: release-notes` in roster v2. Adding only a `LIBRARY.md` row is insufficient.
-
-Names such as `worker`, `analyst`, and `canary` are not built-in aliases; they need genuine custom
-contracts. `agents[].alias`, Tess, and Ultron are display names and cannot select a class.
-
-## Validation and authority boundaries
-
-Semantic validation reads the winning contract and rejects missing, unreadable, or empty files.
-Protected authority is derived from canonical class metadata in code, never from role prose. A custom
-contract cannot claim merge, validation-certificate, orchestration, lease, or interaction authority.
-
-Roster v2 also fails closed when a protected class and tool policy do not match after canonicalization,
-or when an unprotected class claims a protected tool policy. The legacy `operator-interaction` policy
-canonicalizes to `interaction`.
-
-Role customization does not issue leases, store validation certificates, mutate credentials, or
-change lifecycle state.

docs/fleet/how-to/start-stop-restart.md

@@ -1,23 +0,0 @@
-# Safely Reconcile and Control a Local Fleet Agent
-
-Use the canonical local roster-v2 command surface:
-
-```sh
-mosaic fleet apply --expected-generation <n> --dry-run
-mosaic fleet apply --expected-generation <n>
-mosaic fleet reconcile --expected-generation <n>
-mosaic fleet start <name> --expected-generation <n>
-mosaic fleet stop <name> --expected-generation <n>
-mosaic fleet restart <name> --expected-generation <n>
-mosaic fleet status [name]
-mosaic fleet verify
-mosaic fleet doctor
-```
-
-Start with `--dry-run`. It validates roster semantics, deterministic projections, private managed paths, exact holder ownership, and named-socket state without changing files or lifecycle state. `apply` and `reconcile` rebuild derived projections and enforce only persisted roster state: enabled `running` agents may start, while stopped or disabled agents are not started.
-
-`start`, `stop`, and `restart` are explicit one-shot exact-service actions. They do not persist a lifecycle change. Roster CRUD is the only way to change persisted desired state.
-
-Every command prints JSON. Observation commands report drift without mutation; `verify` exits non-zero on ownership mismatch, unmanaged sessions, or drift. A failed apply that wrote some derived projections reports `projections: "incomplete"` with bounded recovery to regenerate from the roster. A lifecycle failure after projections reports incomplete lifecycle work; it is never represented as a rollback or no-op.
-
-These commands are local only. Remote/SSH/connector entries are inventory/validation-only. Commands do not accept arbitrary runtime commands, channels, secrets, generated-file desired state, or arbitrary tmux sockets.

docs/fleet/migration/example-profile-disposition.md

@@ -1,52 +0,0 @@
-# Executable Fleet Example, Profile, and Service-Preset Dispositions
-
-**Issue:** #758 · **Card:** FCM-M1-003 · **Status:** M1 executable disposition evidence
-
-This document records the executable disposition for every currently shipped fleet YAML artifact.
-The authoritative baseline classification remains the
-[legacy inventory](../LEGACY-EXAMPLE-PROFILE-DISPOSITION-INVENTORY.md). The executable guard is
-`packages/mosaic/src/fleet/example-profile-dispositions.ts`; its test fails if a shipped YAML
-artifact is added, removed, or left without one of the dispositions below.
-
-## Disposition rules
-
-- **Explicit v1 fixture:** the artifact is loaded through the existing v1 roster parser and must
-  declare `version: 1`. It remains a compatibility fixture; it is not silently treated as a v2
-  roster or given inferred aliases.
-- **Canonical profile:** the artifact is loaded through `loadProfiles`, which uses the shared
-  baseline-plus-`roles.local` persona resolver and rejects unreadable or unresolved classes.
-- **Canonical service policy:** the artifact is loaded through the operator-interaction service
-  policy reader and provisioned with a generic supplied identity. It validates its runtime, model,
-  reasoning, and legacy tool-policy compatibility without hardcoding a product identity.
-
-No artifact is retired in this card. A later retirement requires both a replacement link and a
-visible deprecation note; the executable guard must then record the new disposition before the
-artifact can be removed.
-
-## Shipped artifacts
-
-| Artifact                             | Disposition              | Executable path                   | Compatibility notes                                                                              |
-| ------------------------------------ | ------------------------ | --------------------------------- | ------------------------------------------------------------------------------------------------ |
-| `examples/coding.yaml`               | Explicit v1 fixture      | v1 roster parser                  | Retains approved `implementer` and `reviewer` compatibility inputs.                              |
-| `examples/general.yaml`              | Explicit v1 fixture      | v1 roster parser                  | Retains unresolved `worker` without an inferred canonical role.                                  |
-| `examples/hybrid.yaml`               | Explicit v1 fixture      | v1 roster parser                  | Retains `implementer`, `reviewer`, and resolver-dependent `researcher`.                          |
-| `examples/local-canary.yaml`         | Explicit v1 fixture      | v1 roster parser                  | Retains the local-tmux canary topology.                                                          |
-| `examples/minimal.yaml`              | Explicit v1 fixture      | v1 roster parser                  | Retains `canary` without an inferred canonical role.                                             |
-| `examples/operator-interaction.yaml` | Explicit v1 fixture      | v1 roster parser                  | Keeps Tess only as an example instance name; `operator-interaction` remains compatibility input. |
-| `examples/research.yaml`             | Explicit v1 fixture      | v1 roster parser                  | Retains resolver-dependent `researcher` and `analyst`.                                           |
-| `profiles/business.yaml`             | Canonical profile        | shared profile/persona resolver   | Every referenced business class must resolve to a readable contract.                             |
-| `profiles/marketing.yaml`            | Canonical profile        | shared profile/persona resolver   | Every referenced marketing class must resolve to a readable contract.                            |
-| `profiles/personal-assistant.yaml`   | Canonical profile        | shared profile/persona resolver   | No interaction equivalence is inferred.                                                          |
-| `profiles/research.yaml`             | Canonical profile        | shared profile/persona resolver   | Every research class must resolve to a readable contract.                                        |
-| `profiles/software-delivery.yaml`    | Canonical profile        | shared profile/persona resolver   | Retains the governance profile; authority validation remains FCM-M1-002 evidence.                |
-| `services/operator-interaction.yaml` | Canonical service policy | service-policy reader/provisioner | Generic provisioning supplies the instance name; the policy itself never names Tess.             |
-
-## Running the guard
-
-```bash
-pnpm --filter @mosaicstack/mosaic test -- example-profile-dispositions.spec.ts
-```
-
-The guard is intentionally limited to shipped assets and validation. It does not generate
-environment files, mutate a roster, reconcile a fleet, migrate an installed roster, or launch an
-agent.

docs/fleet/migration/legacy-class-aliases.md

@@ -1,40 +0,0 @@
-# Legacy Fleet Class Aliases
-
-Fleet class compatibility is intentionally narrow. The shared resolver accepts exactly three legacy
-class names and converts them to canonical classes before persona lookup:
-
-| Legacy value           | Canonical value | Migration action                                                                                                       |
-| ---------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| `implementer`          | `code`          | Replace class and tool-policy references with `code`.                                                                  |
-| `reviewer`             | `review`        | Replace class and tool-policy references with `review`.                                                                |
-| `operator-interaction` | `interaction`   | Replace class and roster-v2 tool-policy references with `interaction`. The legacy service artifact remains compatible. |
-
-Alias support preserves existing inputs while provisioning and typed semantic output use canonical
-identities. Requested and canonical class values remain separately observable during semantic
-validation.
-
-## Lookup and override behavior
-
-Canonicalization precedes baseline and `roles.local` lookup. A legacy-named override such as
-`roles.local/implementer.md` is not a separate authority and is not selected for an `implementer`
-request. Customize the canonical role instead, for example `roles.local/code.md`.
-
-The compatibility file `operator-interaction.md` remains shipped, but `interaction` is the canonical
-role class. Tess is an example display name only.
-
-## Unresolved and custom classes
-
-No names are inferred from historical usage, instance names, or similar wording. `worker`, `analyst`,
-`canary`, Tess, and Ultron are not aliases. An otherwise unknown class is accepted only if the shared
-resolver can read an actual baseline or `roles.local` contract for that exact class. A `LIBRARY.md`
-row without a readable contract fails semantic validation.
-
-Custom classes receive no protected authority implicitly. Protected class/tool-policy mismatches
-fail closed.
-
-## Retirement guidance
-
-New configuration should emit canonical values. Existing inputs may use the three aliases during the
-compatibility period, but operators should migrate class and tool-policy fields together. Do not
-create new legacy-named role overrides; move their intended content to the canonical filename and
-validate the roster/profile before removing the old artifact.

docs/fleet/operations/reconcile-and-recover.md

@@ -1,26 +0,0 @@
-# Reconcile and Recover a Local Fleet
-
-## Safe sequence
-
-1. Read `mosaic fleet doctor` and `mosaic fleet status`.
-2. Run `mosaic fleet apply --expected-generation <n> --dry-run`.
-3. Resolve stale generation, ownership mismatch, unsafe path, projection validation, or unmanaged-session findings before applying.
-4. Run `mosaic fleet apply --expected-generation <n>` only after the plan is understood.
-
-The reconciler uses the exact roster tmux socket, exact holder session, private installation holder identity, and the complete expected global environment. For mutations it acquires its exclusive lock before rereading the canonical roster and fencing its generation; only that under-lock roster drives validation, planning, projections, and lifecycle effects. Before effects, its exclusive lock proves real private `MOSAIC_HOME` and `fleet` ancestors, uses a private `0600` lock leaf, and binds cleanup to the created file identity and ownership token. A fake holder, contaminated global environment, missing identity, unsafe lock path, or unmanaged session fails closed. It does not adopt, kill, or rename any unproven session. A crash can leave a stale lock for explicit operator inspection; reconciliation deliberately does not guess ownership or remove it.
-
-## Partial results
-
-The roster is never changed by reconciliation. If derived projection application partially fails, JSON reports:
-
-```json
-{
-  "applied": false,
-  "authoritativeRoster": "unchanged",
-  "projections": "incomplete",
-  "lifecycle": "not-applied",
-  "recovery": { "code": "projection-apply-failed", "action": "regenerate-projections-from-roster" }
-}
-```
-
-If projections completed but lifecycle work failed, JSON reports `projections: "complete"`, `lifecycle: "incomplete"`, and the bounded action `rerun-after-inspecting-owned-resources`. If lock cleanup cannot be proven after an effect result, it adds `cleanup: { "code": "lock-cleanup-failed", "action": "inspect-lock-before-retry" }` without changing the known projection, lifecycle, or primary recovery truth. Inspect the retained lock before retrying; no rollback, release, or stale-lock removal is implied. Results do not include environment values, secrets, or privileged command content.

docs/fleet/reference/agent-mutations.md

@@ -1,43 +0,0 @@
-# Local Fleet Agent Mutations
-
-FCM-M2-002 provides local roster-v2 create, get, update, delete, and plan operations. They only change desired state and derived environment projections. They never start, stop, inspect, reconcile, or otherwise act on runtimes, systemd units, tmux sessions, or heartbeats.
-
-## CLI contract
-
-The commands operate only on the canonical `<mosaic-home>/fleet/roster.yaml` v2 authority and print one JSON object to stdout. `--agent` is a JSON object with the roster agent fields expressed as `className`, `toolPolicy`, `workingDirectory`, `persistentPersona`, `resetBetweenTasks`, and `launch: { "yolo": boolean }`.
-
-```sh
-mosaic fleet get <name>
-mosaic fleet plan <create|update|delete> [name] --expected-generation <n> [--agent '<json>'] [--persisted-start]
-mosaic fleet create --expected-generation <n> --agent '<json>' [--dry-run] [--persisted-start]
-mosaic fleet update <name> --expected-generation <n> --agent '<json>' [--dry-run]
-mosaic fleet delete <name> --expected-generation <n> [--dry-run]
-```
-
-`get` returns the authoritative generation and the selected agent. `plan create` derives its name from `--agent`; `plan update <name>` and `plan delete <name>` require the target name. `--agent` accepts only the documented roster-v2 request fields and `launch.yolo`; unknown keys such as commands, channels, or secret references are rejected. Rejection diagnostics return only the stable `invalid-request` code and never echo a rejected value. `plan` and `--dry-run` validate the complete proposed roster and projections but write neither the roster nor projections. `--persisted-start` is available only for a create request: it records `desired_state: running`, but does not start a process. Without it, create records `enabled: true` and `desired_state: stopped`. Handled failures return JSON with `error.code` and exit non-zero; unclassified validation/projection failures use the redacted `mutation-failed` code.
-
-## Generation, validation, and idempotency
-
-Each create, update, or delete request includes `expectedGeneration`. A request whose expected value differs from the authoritative roster generation fails with `stale-generation`; reload and retry with a newly computed plan. A private mutation lock rejects concurrent writers with `concurrent-mutation`.
-
-`planFleetAgentMutation` is deterministic and side-effect free. `executeFleetAgentMutation` validates the complete proposed roster through the existing structural and shared persona resolver, prepares generated/local/quarantine projections, and writes the roster authority atomically before applying derived projections. Equivalent create retries and delete requests for an already-absent agent are idempotent no-ops.
-
-Delete removes only the exact `<name>.env.generated` projection for the removed roster entry. Operator-owned `<name>.env.local`, legacy `<name>.env`, quarantine records, and unrelated projections remain untouched. An already-absent generated projection is treated as stale derived state, not as a failed mutation.
-
-## Result and recovery
-
-Mutation results are JSON-safe objects with `applied`, `authoritativeRoster`, `projections`, `plan`, and—only if a derived projection write fails after the authoritative roster write—a recovery object. `applied` is true only when every roster and derived-projection write completed. The explicit state fields prevent a partial result from being mistaken for a rollback or a no-op:
-
-```json
-{
-  "applied": false,
-  "authoritativeRoster": "committed",
-  "projections": "incomplete",
-  "recovery": {
-    "code": "projection-apply-failed",
-    "action": "regenerate-projections-from-roster"
-  }
-}
-```
-
-Dry-runs and idempotent no-ops report `authoritativeRoster: "unchanged"` and `projections: "not-applied"`; a complete mutation reports `"committed"` and `"complete"`. Recovery output identifies the authoritative roster path and regeneration action only. It never contains generated/local/quarantine values, credentials, or command text. A recovery result exits non-zero because the authoritative roster was persisted but derived projections require regeneration. Regenerate projections from the roster before attempting another mutation.

docs/fleet/reference/cli.md

@@ -1,20 +0,0 @@
-# Fleet Control-Plane CLI
-
-The local roster-v2 control plane is `mosaic fleet`.
-
-```text
-mosaic fleet apply --expected-generation <n> [--dry-run]
-mosaic fleet reconcile --expected-generation <n> [--dry-run]
-mosaic fleet start [name] --expected-generation <n> [--dry-run]
-mosaic fleet stop [name] --expected-generation <n> [--dry-run]
-mosaic fleet restart [name] --expected-generation <n> [--dry-run]
-mosaic fleet status [name]
-mosaic fleet verify
-mosaic fleet doctor
-```
-
-`apply` and `reconcile` use roster desired state. `start`, `stop`, and `restart` are exact local one-shot lifecycle effects and never persist a desired-state edit. `status`, `verify`, and `doctor` are observational.
-
-Commands emit one JSON object. Handled precondition errors emit `{ "error": { "code": "..." } }` and exit non-zero. Partial derived/lifecycle effects use explicit `authoritativeRoster`, `projections`, `lifecycle`, and bounded `recovery` fields; they never claim rollback. Any additive `cleanup` diagnostic also exits non-zero, even where known effects are complete: it is not a clean completion and the lock requires inspection before retry.
-
-This control plane is separate from the gateway-backed `mosaic agent` catalog. It is local-only and rejects remote/connector lifecycle mutation, arbitrary command/channel/secret input, and unproven tmux ownership.

docs/fleet/reference/generated-env-boundary.md

@@ -1,96 +0,0 @@
-# Fleet Generated Environment Boundary
-
-**Card:** FCM-M2-001 · **Issue:** #758 · **Status:** unreleased/card-local
-
-The local fleet roster is the desired-state authority. A launch reads a deterministic,
-roster-derived generated projection and an optional strictly data-only local file; neither file is
-a second roster or a command configuration surface.
-
-## Paths and ownership
-
-For agent `<name>` under `<MOSAIC_HOME>/fleet/agents/`:
-
-| Path                    | Owner                    | Purpose                                                                                                                      |
-| ----------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
-| `<name>.env.generated`  | Mosaic projection writer | Complete deterministic launch data rendered from the authoritative roster.                                                   |
-| `<name>.env.local`      | Operator                 | Optional, constrained local machine data. It cannot shadow generated keys.                                                   |
-| `<name>.env`            | Legacy input only        | Read once during projection generation, then regenerated/relocated or privately quarantined. It is never a launch authority. |
-| `<name>.env.quarantine` | Mosaic quarantine        | Mode-`0600` private record of forbidden legacy input; it is never read by the launcher.                                      |
-
-The systemd templates do not load either environment file. They invoke Bash with a fixed, cleared
-bootstrap environment; the launcher reads and validates `.env.generated` and `.env.local` itself before
-it queries, creates, or stops an exact tmux session. It does not `source`, `eval`, or execute an
-environment-supplied command. Exact stop derives its socket from the same validated generated projection,
-not from systemd or ambient environment data.
-
-All projection, local, and quarantine files must be regular files with no group or world permissions.
-The agent environment directory must also be a real, non-symlink private directory; it is validated
-before either environment file is read or tmux is queried. Unsafe paths, symlinks, or permissions fail
-closed. Diagnostics identify only a rule code, key name, and SHA-256 content hash; they never print
-values, credential material, or command text.
-
-## Allowed data
-
-`.env.generated` is complete and ordered exactly as follows:
-
-```dotenv
-MOSAIC_AGENT_NAME=<roster name>
-MOSAIC_AGENT_CLASS=<roster class>
-MOSAIC_AGENT_RUNTIME=<roster runtime>
-MOSAIC_AGENT_MODEL=<roster model hint>
-MOSAIC_AGENT_REASONING=<roster reasoning>
-MOSAIC_AGENT_TOOL_POLICY=<roster tool policy>
-MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
-MOSAIC_TMUX_SOCKET=<roster socket or empty>
-```
-
-The generated launch contract supports only `claude`, `codex`, `opencode`, and `pi`. `fleet add`
-uses that same runtime authority and rejects any other runtime before it writes the roster or changes
-projection, local, or quarantine files. The legacy dogfood stub on its separate `mosaic-factory`
-socket remains an observability canary; it has no generated-launch adapter and cannot be added through
-this projection path.
-
-`.env.local` may contain only these non-secret data keys:
-
-- `MOSAIC_RUNTIME_BIN`
-- `MOSAIC_HEARTBEAT_RUN_DIR`
-- `MOSAIC_HEARTBEAT_INTERVAL`
-- `MOSAIC_CLAUDE_JSON`
-- `CLAUDE_CONFIG_DIR`
-
-Local paths must be safe absolute paths and the interval must be a positive integer. Comments,
-quoted/export syntax, duplicate keys, unknown keys, generated-key shadowing, sensitive key names,
-and `MOSAIC_AGENT_COMMAND` are rejected. The launcher derives the only executable command from the
-validated runtime, model, and reasoning data; no arbitrary command compatibility path exists. When a
-Pi runtime writes a fresh `<name>.hb.native` marker, its native heartbeat remains authoritative; the
-shell sidecar resumes its `status=ok` fallback only after that marker is stale or absent.
-
-## Legacy disposition
-
-During projection generation, legacy roster-derived keys are regenerated from the roster. A valid
-allowed local value is relocated to `.env.local`; forbidden, malformed, duplicate, sensitive, and
-unknown legacy entries cause the legacy file to be moved to `.env.quarantine` and are represented by
-sanitized diagnostics. This is deterministic and idempotent after the legacy file has been consumed.
-
-## USC interface packet
-
-This card does not add a USC site file, write a USC roster, or run a site canary. The following is the
-consolidated downstream interface packet. Status is deliberately separated from checkout presence: no
-product release version has been evidenced for this interface set.
-
-| Interface               | Canonical public path and version                                                                                                                 | Tracker/release status                                                                                                | Downstream limit                                                                              |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| M1 structural compiler  | `parseRosterV2` in `packages/mosaic/src/fleet/roster-v2.ts`; schema `docs/fleet/reference/roster-v2.schema.json`; roster `version: 2`             | FCM-M1-001 is recorded done, merged as #764 (`aa5b43b`); no released product version is asserted here.                | Parse YAML/JSON and canonicalize a supplied v2 site roster without writes.                    |
-| M1 semantic resolver    | `validateRosterV2Semantics` in `packages/mosaic/src/fleet/roster-v2.ts`; baseline `framework/fleet/roles/` plus `roles.local/`                    | FCM-M1-002 remains `in-progress` in `docs/TASKS.md`; unreleased.                                                      | Reuse the shared resolver only; no parallel role resolver or lifecycle action.                |
-| M1 disposition evidence | `packages/mosaic/src/fleet/example-profile-dispositions.ts`; `docs/fleet/migration/example-profile-disposition.md`; retained fixture `version: 1` | FCM-M1-003 remains `not-started` in `docs/TASKS.md`; unreleased even though these checkout artifacts are inspectable. | Inspect fixture/profile/service disposition evidence only; it is not migration authorization. |
-| M2 generated boundary   | `packages/mosaic/src/fleet/generated-env-boundary.ts`; generated projection contract in this document                                             | FCM-M2-001 card-local and uncommitted; unreleased.                                                                    | Render/write a roster-derived projection; local input is never authority.                     |
-
-The canonical source remains `<MOSAIC_HOME>/fleet/roster.yaml` for the current local fleet path.
-Generated environment data is a rebuildable projection, not an operator-editable source of membership,
-runtime policy, or lifecycle state.
-
-**Corrected downstream gates:** M2 supplies only parse/validation/projection evidence and does not
-permit a USC site canary, reconciliation, or lifecycle mutation. M3 must first define and validate the
-canonical local reconcile/lifecycle path. M4 then supplies preview/migration and its separate
-canary/rollback gates; only after those M3 and M4 gates may a site migration or canary be considered.
-This card authorizes none of those actions.

docs/fleet/reference/lifecycle-transitions.md

@@ -1,14 +0,0 @@
-# Local Fleet Lifecycle Transitions
-
-FCM-M3-001 uses the roster-v2 `lifecycle.enabled` and `lifecycle.desired_state` fields as the only desired-state authority. Systemd, tmux, generated environment files, and heartbeats are derived or observed state.
-
-| Command                           | Desired-state write | Runtime effect                                                                                                             | Preconditions                                                                                                             |
-| --------------------------------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| `fleet apply` / `fleet reconcile` | Never               | Rebuilds projections, then starts only enabled agents desired `running`; stops disabled or desired-`stopped` roster agents | Current generation; private managed paths; valid projections; proven holder ownership; no unmanaged named-socket sessions |
-| `fleet start <name>`              | Never               | One-shot exact `mosaic-agent@<name>.service` start                                                                         | Current generation; exact enabled roster name; proven ownership                                                           |
-| `fleet stop <name>`               | Never               | One-shot exact service stop                                                                                                | Current generation; exact roster name; proven ownership                                                                   |
-| `fleet restart <name>`            | Never               | One-shot exact service restart                                                                                             | Current generation; exact roster name; proven ownership                                                                   |
-
-A stopped roster agent is never started by `apply` or `reconcile`. Direct lifecycle commands are explicit one-shot actions and do not change persisted desired state. Use roster CRUD with the explicit persisted-start option to change that desired state.
-
-All mutations require `--expected-generation <n>` and acquire one private roster-adjacent reconciliation lock before projection or lifecycle effects. Missing or stale generations and concurrent writers fail before effects; the lock is released after success, partial failure, or thrown lifecycle failure. Stale, ownership, unmanaged-session, unsupported-runtime, path, projection, and lifecycle-precondition failures return stable redacted JSON errors and a non-zero exit. No command targets a fuzzy tmux name, arbitrary socket, arbitrary command, channel, secret, or generated file as authority.

docs/fleet/reference/role-classes.md

@@ -1,45 +0,0 @@
-# Fleet Role Classes and Authority
-
-A fleet role class is a machine identity resolved from the persona library. Resolution uses the
-canonical class before consulting the baseline `fleet/roles/` and operator `fleet/roles.local/`
-layers. A readable role contract is required; an index entry alone is not semantic success.
-
-## Canonicalization
-
-Only these legacy class aliases are recognized:
-
-| Requested class        | Canonical class |
-| ---------------------- | --------------- |
-| `implementer`          | `code`          |
-| `reviewer`             | `review`        |
-| `operator-interaction` | `interaction`   |
-
-No other alias is inferred. In particular, `worker`, `analyst`, and `canary` are custom classes only
-when an operator supplies a readable contract for that exact class. Tess and Ultron are instance
-names, not classes. `agents[].alias` is display-only and cannot grant authority.
-
-Canonicalization happens before role lookup. For example, requesting `implementer` resolves
-`code.md`; a separate `roles.local/implementer.md` cannot redefine the legacy alias. A canonical
-`roles.local/code.md` still overrides the baseline `roles/code.md` contract.
-
-## Protected authority
-
-Protected authority is immutable metadata derived only from canonical class. Role prose, instance
-name, display alias, tool policy, runtime, and custom role files cannot grant it.
-
-| Canonical class   | Granted authority                                  | Explicit limits                                                                   |
-| ----------------- | -------------------------------------------------- | --------------------------------------------------------------------------------- |
-| `merge-gate`      | Sole approve-to-land and merge authority           | No authority is inferred by similarly named custom roles or policies.             |
-| `validator`       | May issue a validation certificate                 | Cannot approve-to-land or merge.                                                  |
-| `orchestrator`    | May orchestrate, manage topology, and issue leases | Cannot approve-to-land or merge.                                                  |
-| `team-leader`     | May use orchestrator-leased capacity               | Cannot issue leases or mutate roster, configuration, credentials, or merge state. |
-| `interaction`     | Request and status surface                         | Cannot orchestrate, issue leases, mutate roster/configuration, or merge.          |
-| all other classes | No protected authority implicitly                  | Custom contracts do not acquire protected powers from prose.                      |
-
-Roster-v2 semantic validation requires a protected class and its canonical tool policy to match. It
-also rejects an unprotected class paired with a protected tool policy. The legacy tool-policy name
-`operator-interaction` canonicalizes to `interaction`.
-
-This mapping describes authority metadata only. Lease issuance, validation-certificate storage or
-workflow, lifecycle reconciliation, credentials, roster mutation, and merge execution are outside
-this resolver contract.

docs/fleet/reference/roster-v2-fields.md

@@ -1,124 +0,0 @@
-# Fleet Roster v2 Structural Contract
-
-**Status:** FCM-M1-001 local-tmux structural compiler contract. This document describes parsing,
-strict structural validation, normalized in-memory representation, and deterministic rendering only.
-It does not authorize role resolution, lifecycle reconciliation, mutation, migration, remote
-placement, connector configuration, secret references, arbitrary commands, channels, gateway
-mapping, or any live-fleet change.
-
-The executable schema is [`roster-v2.schema.json`](./roster-v2.schema.json). The compiler exports
-the same schema and its test parses this file and compares it structurally with the executable contract.
-
-## Format and canonical shape
-
-The compiler accepts YAML or JSON. It reads only snake_case source fields and renders canonical,
-snake_case YAML. Rendering sorts runtime keys and agents by stable name. Agent names, class names,
-and tool-policy names are structural identifiers; whether a class or policy resolves is a later
-shared-resolver concern.
-
-```yaml
-version: 2
-generation: 1
-transport: tmux
-tmux:
-  socket_name: mosaic-fleet
-  holder_session: _holder
-defaults:
-  working_directory: ~/src
-  runtime: pi
-runtimes:
-  pi:
-    reset_command: /new
-agents:
-  - name: coder0
-    alias: Coder 0
-    class: code
-    runtime: pi
-    provider: openai
-    model: gpt-5.6-sol
-    reasoning: high
-    tool_policy: code
-    working_directory: ~/src
-    persistent_persona: false
-    reset_between_tasks: true
-    lifecycle:
-      enabled: true
-      desired_state: stopped
-    launch:
-      yolo: true
-```
-
-## Root fields
-
-| Field        | Required | Constraint            | Meaning                                                                                                                               |
-| ------------ | -------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| `version`    | yes      | integer constant `2`  | Identifies this contract. Version `1` is explicitly rejected by this compiler and remains on the existing v1 path until M4 migration. |
-| `generation` | yes      | positive safe integer | Desired-state generation. M2 uses it for mutation guards; M1 does not mutate it.                                                      |
-| `transport`  | yes      | constant `tmux`       | M1–M5 support local tmux only.                                                                                                        |
-| `tmux`       | yes      | strict object         | Explicit local socket and holder-session configuration.                                                                               |
-| `defaults`   | yes      | strict object         | Default work directory and one supported local runtime.                                                                               |
-| `runtimes`   | yes      | non-empty object      | Declared local runtime reset policy map.                                                                                              |
-| `agents`     | yes      | non-empty array       | Local fleet entries. Duplicate stable names are rejected.                                                                             |
-
-## Nested fields
-
-| Path                                                 | Required | Constraint                                                                                           |
-| ---------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------- |
-| `tmux.socket_name`                                   | yes      | non-empty `[A-Za-z0-9_.-]+`; an explicit named socket prevents default-versus-named socket ambiguity |
-| `tmux.holder_session`                                | yes      | non-empty `[A-Za-z0-9_.-]+`                                                                          |
-| `defaults.working_directory`                         | yes      | non-empty string                                                                                     |
-| `defaults.runtime`                                   | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                            |
-| `runtimes.<runtime>.reset_command`                   | yes      | non-empty string; runtime key must be a supported local runtime                                      |
-| `agents[].name`                                      | yes      | unique `[A-Za-z0-9][A-Za-z0-9_.-]*` stable machine identity                                          |
-| `agents[].alias`                                     | yes      | non-empty display string                                                                             |
-| `agents[].class`                                     | yes      | `[a-z][a-z0-9-]*`; structural only in M1, semantic role resolution is FCM-M1-002                     |
-| `agents[].runtime`                                   | yes      | `claude`, `codex`, `opencode`, or `pi`; it must be declared in `runtimes`                            |
-| `agents[].provider`, `model`, `working_directory`    | yes      | non-empty strings; provider/model capability resolution is a later card                              |
-| `agents[].reasoning`                                 | yes      | `low`, `medium`, or `high`                                                                           |
-| `agents[].tool_policy`                               | yes      | `[a-z][a-z0-9-]*`; structural only in M1                                                             |
-| `agents[].persistent_persona`, `reset_between_tasks` | yes      | booleans                                                                                             |
-| `agents[].lifecycle.enabled`                         | yes      | boolean; stored now, reconciled in FCM-M3-001                                                        |
-| `agents[].lifecycle.desired_state`                   | yes      | `running` or `stopped`                                                                               |
-| `agents[].launch.yolo`                               | yes      | boolean; structured data only, not an arbitrary command escape hatch                                 |
-
-## Semantic handoff
-
-`parseRosterV2` and `normalizeRosterV2` remain synchronous and structural. After structural success,
-call the asynchronous `validateRosterV2Semantics` handoff before using persona identity or authority.
-That validator batches the baseline `fleet/roles/` and operator `fleet/roles.local/` scans, then
-delegates every agent to the shared persona resolver.
-
-Semantic validation:
-
-- requires the winning role contract to be readable and non-empty; `LIBRARY.md` membership alone does
-  not resolve a class;
-- retains `requestedClass` separately from `canonicalClass` in typed output;
-- canonicalizes only `implementer` to `code`, `reviewer` to `review`, and
-  `operator-interaction` to `interaction`;
-- canonicalizes `tool_policy` with the same exact alias table;
-- rejects protected class/tool-policy mismatches in either direction, while accepting
-  `class: operator-interaction` with `tool_policy: operator-interaction` as canonical
-  `interaction`;
-- derives immutable protected authority only from canonical class; and
-- accepts custom baseline or `roles.local` classes without granting protected authority.
-
-`agents[].alias` remains display-only. Tess and Ultron are instance names, never semantic classes.
-Canonicalization happens before role-layer lookup, so a legacy-named override cannot redefine an
-alias as separate authority. See [Role Classes and Authority](./role-classes.md) and
-[Customize Fleet Roles](../how-to/customize-roles.md).
-
-This handoff performs no filesystem, systemd, tmux, roster, credential, lease, certificate, or
-lifecycle mutation.
-
-## Fail-closed boundary
-
-Every object is `additionalProperties: false`. The compiler rejects unknown, missing, malformed,
-and wrong-type fields before producing a model. It specifically rejects remote/SSH/host/socket
-per-agent fields, connector blocks, secret references, channel fields, arbitrary command fields,
-and gateway fields because they are unsupported in the local-tmux M1 contract. It does not silently
-ignore v1 camelCase input, version `1`, or a source that does not parse to an object.
-
-The v2 compiler is intentionally isolated from the existing v1 loader. Existing v1 rosters and
-current examples/profiles continue on their current path; FCM-M4 owns explicit inventory, preview,
-migration, and rollback. FCM-M2 owns generated-file/local-override quarantine, and FCM-M3 owns
-runtime lifecycle and reconciliation.

docs/fleet/reference/roster-v2.schema.json

@@ -1,156 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://mosaicstack.dev/schemas/fleet/roster-v2.schema.json",
-  "title": "Mosaic local tmux fleet roster v2",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "generation", "transport", "tmux", "defaults", "runtimes", "agents"],
-  "properties": {
-    "version": {
-      "const": 2
-    },
-    "generation": {
-      "type": "integer",
-      "minimum": 1,
-      "maximum": 9007199254740991
-    },
-    "transport": {
-      "const": "tmux"
-    },
-    "tmux": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["socket_name", "holder_session"],
-      "properties": {
-        "socket_name": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9_.-]+$"
-        },
-        "holder_session": {
-          "type": "string",
-          "pattern": "^[A-Za-z0-9_.-]+$"
-        }
-      }
-    },
-    "defaults": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["working_directory", "runtime"],
-      "properties": {
-        "working_directory": {
-          "type": "string",
-          "minLength": 1
-        },
-        "runtime": {
-          "enum": ["claude", "codex", "opencode", "pi"]
-        }
-      }
-    },
-    "runtimes": {
-      "type": "object",
-      "minProperties": 1,
-      "propertyNames": {
-        "enum": ["claude", "codex", "opencode", "pi"]
-      },
-      "additionalProperties": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["reset_command"],
-        "properties": {
-          "reset_command": {
-            "type": "string",
-            "minLength": 1
-          }
-        }
-      }
-    },
-    "agents": {
-      "type": "array",
-      "minItems": 1,
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": [
-          "name",
-          "alias",
-          "class",
-          "runtime",
-          "provider",
-          "model",
-          "reasoning",
-          "tool_policy",
-          "working_directory",
-          "persistent_persona",
-          "reset_between_tasks",
-          "lifecycle",
-          "launch"
-        ],
-        "properties": {
-          "name": {
-            "type": "string",
-            "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]*$"
-          },
-          "alias": {
-            "type": "string",
-            "minLength": 1
-          },
-          "class": {
-            "type": "string",
-            "pattern": "^[a-z][a-z0-9-]*$"
-          },
-          "runtime": {
-            "enum": ["claude", "codex", "opencode", "pi"]
-          },
-          "provider": {
-            "type": "string",
-            "minLength": 1
-          },
-          "model": {
-            "type": "string",
-            "minLength": 1
-          },
-          "reasoning": {
-            "enum": ["low", "medium", "high"]
-          },
-          "tool_policy": {
-            "type": "string",
-            "pattern": "^[a-z][a-z0-9-]*$"
-          },
-          "working_directory": {
-            "type": "string",
-            "minLength": 1
-          },
-          "persistent_persona": {
-            "type": "boolean"
-          },
-          "reset_between_tasks": {
-            "type": "boolean"
-          },
-          "lifecycle": {
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["enabled", "desired_state"],
-            "properties": {
-              "enabled": {
-                "type": "boolean"
-              },
-              "desired_state": {
-                "enum": ["running", "stopped"]
-              }
-            }
-          },
-          "launch": {
-            "type": "object",
-            "additionalProperties": false,
-            "required": ["yolo"],
-            "properties": {
-              "yolo": {
-                "type": "boolean"
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}

docs/fleet/reference/status-and-drift.md

@@ -1,13 +0,0 @@
-# Local Fleet Status and Drift
-
-`mosaic fleet status [name]`, `verify`, and `doctor` are observational roster-v2 commands. They emit one JSON result and do not write projections, change desired state, start services, stop services, restart services, or mutate tmux.
-
-The report distinguishes:
-
-- `missing-session`: an enabled agent desired `running` has no exact roster-named tmux session.
-- `unexpected-session`: a desired-`stopped` agent still has its exact session.
-- `disabled-running`: a disabled roster agent has its exact session.
-- `unmanagedSessions`: sessions on the configured named socket that are neither the exact holder nor an exact roster agent.
-- `holder`: `owned`, `missing`, or `ownership-mismatch` after exact holder, private install identity, and complete global tmux environment validation.
-
-`doctor` and `status` classify rather than adopt, destroy, or repair unmanaged state. `verify` is observational too, but exits non-zero if ownership cannot be proven, unmanaged sessions exist, or drift is present. Reconciliation fails closed under those conditions and never kills or adopts an unmanaged session.

docs/guides/admin-guide.md

@@ -223,10 +223,10 @@ external clients. Authentication requires a valid BetterAuth session (cookie or
 
 ### Required
 
-| Variable             | Description                                                                                                 |
-| -------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `BETTER_AUTH_SECRET` | Secret key for BetterAuth session signing. Must be set or gateway will not start.                           |
-| `DATABASE_URL`       | Runtime-only PostgreSQL connection injected from the dedicated deployment secret; no default or inline DSN. |
+| Variable             | Description                                                                               |
+| -------------------- | ----------------------------------------------------------------------------------------- |
+| `BETTER_AUTH_SECRET` | Secret key for BetterAuth session signing. Must be set or gateway will not start.         |
+| `DATABASE_URL`       | PostgreSQL connection string. Default: `postgresql://mosaic:mosaic@localhost:5433/mosaic` |
 
 ### Gateway
 
@@ -293,68 +293,24 @@ Each OIDC provider requires its client ID, client secret, and issuer URL togethe
 
 ### Plugins
 
-| Variable                                | Description                                                                                                                               |
-| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `DISCORD_BOT_TOKEN`                     | Discord bot token (enables Discord plugin)                                                                                                |
-| `DISCORD_SERVICE_TOKEN`                 | Required high-entropy service credential used to authenticate and sign Discord ingress; inject through the approved secret mechanism only |
-| `DISCORD_SERVICE_USER_ID`               | Required Mosaic service-principal user ID that owns persisted Discord conversations; the original Discord user ID remains audit metadata  |
-| `DISCORD_GUILD_ID`                      | Discord guild/server ID                                                                                                                   |
-| `DISCORD_GATEWAY_URL`                   | Gateway URL for Discord plugin to call (default: `http://localhost:14242`)                                                                |
-| `DISCORD_ALLOWED_GUILD_IDS`             | Required comma-separated Discord guild snowflake allowlist; default-deny                                                                  |
-| `DISCORD_ALLOWED_CHANNEL_IDS`           | Required comma-separated Discord channel snowflake allowlist; default-deny                                                                |
-| `DISCORD_ALLOWED_USER_IDS`              | Required comma-separated Discord user snowflake allowlist; default-deny                                                                   |
-| `DISCORD_INTERACTION_BINDINGS`          | Required JSON bindings from guild/channel to logical agent and paired Discord users with `viewer`, `operator`, or `admin` roles           |
-| `DISCORD_MESSAGE_RATE_LIMIT_PER_MINUTE` | Optional positive integer; authorized turns per guild/channel/user each minute (default: `30`)                                            |
-| `DISCORD_THREAD_RATE_LIMIT_PER_MINUTE`  | Optional positive integer; mention-thread routes per guild/channel/user each minute (default: `5`)                                        |
-| `TELEGRAM_BOT_TOKEN`                    | Telegram bot token (enables Telegram plugin)                                                                                              |
-| `TELEGRAM_GATEWAY_URL`                  | Gateway URL for Telegram plugin to call                                                                                                   |
+| Variable                      | Description                                                                                                                               |
+| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| `DISCORD_BOT_TOKEN`           | Discord bot token (enables Discord plugin)                                                                                                |
+| `DISCORD_SERVICE_TOKEN`       | Required high-entropy service credential used to authenticate and sign Discord ingress; inject through the approved secret mechanism only |
+| `DISCORD_SERVICE_USER_ID`     | Required Mosaic service-principal user ID that owns persisted Discord conversations; the original Discord user ID remains audit metadata  |
+| `DISCORD_GUILD_ID`            | Discord guild/server ID                                                                                                                   |
+| `DISCORD_GATEWAY_URL`         | Gateway URL for Discord plugin to call (default: `http://localhost:14242`)                                                                |
+| `DISCORD_ALLOWED_GUILD_IDS`   | Required comma-separated Discord guild snowflake allowlist; default-deny                                                                  |
+| `DISCORD_ALLOWED_CHANNEL_IDS` | Required comma-separated Discord channel snowflake allowlist; default-deny                                                                |
+| `DISCORD_ALLOWED_USER_IDS`    | Required comma-separated Discord user snowflake allowlist; default-deny                                                                   |
+| `TELEGRAM_BOT_TOKEN`          | Telegram bot token (enables Telegram plugin)                                                                                              |
+| `TELEGRAM_GATEWAY_URL`        | Gateway URL for Telegram plugin to call                                                                                                   |
 
 ### Discord ingress security
 
 When `DISCORD_BOT_TOKEN` is configured, `DISCORD_SERVICE_TOKEN`, `DISCORD_SERVICE_USER_ID`, and all three Discord allowlists are required. Gateway startup fails rather than enabling a broad or unauthenticated remote-control surface. The service user ID identifies a provisioned Mosaic service principal for persistence; the original Discord user ID is retained in ingress audit metadata. The service token is a secret supplied by the approved runtime secret mechanism and is never committed or logged.
 
-Inbound Discord messages must originate from an allowed guild and configured parent channel, come from an allowed and paired user whose role permits sending, and carry a signed envelope containing the native Discord message ID and a generated correlation ID. Attachment references are limited in count, metadata size, field length, and declared size; only query-free HTTPS URLs without credentials or fragments are accepted, so bearer or presigned URLs never reach persistence or an agent prompt. The gateway validates the service identity, envelope signature, allowlists, pairing, and role again before dispatching. Replayed Discord message IDs are rejected during the bounded ingress replay window. Durable inbox/idempotency retention is introduced with Tess durable state.
-
-Configured channels are dedicated agent interaction surfaces. An authorized untagged message routes to the bound logical agent and the response returns in that channel. Mentioning the bot on a normal channel message creates a public Discord thread, or reuses the thread already attached to that same message; the response and later thread messages stay in that thread without repeated mentions. A normal channel's category is not an authorization parent—only a Discord thread inherits authorization from its configured parent channel. Runtime control commands such as `/approve` and `/stop <approval>` remain on the current channel/thread because they target that durable session rather than opening a new topic.
-
-Authorization and per-user/channel rate limits are evaluated before thread creation, so an unlisted guild/channel/user, unpaired user, `viewer`, or rate-limited sender cannot create bot threads or dispatch gateway work. The bot needs Discord permissions to view/send in configured channels and create/send in public threads. If thread creation fails, the turn is not dispatched because the requested response destination cannot be honored.
-
-Conversation handles use the configured logical agent plus Discord channel/thread identity. They do not contain a Claude, Codex, Pi, OpenCode, model, process, or runtime-provider identifier; changing the runtime behind the logical session therefore does not require reconnecting the Discord bot.
-
-#### Interaction binding format
-
-`DISCORD_INTERACTION_BINDINGS` must be a non-empty JSON array. Each item requires `instanceId`, trusted `agentConfigId`, `guildId`, `channelId`, and a non-empty `pairedUsers` object. `instanceId` is the configured logical-agent name; its trusted database `agentConfigId` must resolve to an agent configuration with exactly that name, preserving provider/model/prompt/tool selection per binding. The guild/channel must also appear in their corresponding allowlists. IDs below are placeholders:
-
-```json
-[
-  {
-    "instanceId": "interaction-agent",
-    "agentConfigId": "agent-config-id",
-    "guildId": "guild-id",
-    "channelId": "channel-id",
-    "pairedUsers": {
-      "discord-user-id": {
-        "role": "operator",
-        "mosaicUserId": "mosaic-user-id"
-      }
-    }
-  }
-]
-```
-
-| Pairing role | Send message | Create/continue thread | Approve | Stop |
-| ------------ | ------------ | ---------------------- | ------- | ---- |
-| `viewer`     | No           | No                     | No      | No   |
-| `operator`   | Yes          | Yes                    | No      | No   |
-| `admin`      | Yes          | Yes                    | Yes     | Yes  |
-
-A legacy role-only value such as `"discord-user-id": "operator"` remains valid for non-privileged ingress. Approval and stop require the object form with a provisioned `mosaicUserId`; gateway policy checks that Mosaic identity and consumes one exact-action approval once. Do not make the Discord service principal an approving administrator.
-
-After changing bindings or allowlists, restart the gateway/plugin through the normal service manager and verify both Discord and gateway connectivity. The adapter reports `connected` only when both links are ready, `degraded` when one is ready, and `disconnected` when neither is ready. Test one authorized untagged channel turn, one mention-created thread, one thread follow-up, and one unauthorized user denial without using production credential values in logs or evidence.
-
-### Session retention and garbage collection
-
-Session cleanup is scoped to one session identifier and only removes that session's Valkey keys and demotes that session's hot logs. Gateway startup and scheduled jobs do not perform global session cleanup; startup removes legacy repeatable `session-gc` schedules created by older deployments. The `/gc` command is intentionally disabled until a distinct global-retention job supplies explicit authorization and audit evidence. This prevents one tenant or session's cleanup from changing another's retained data.
+Inbound Discord messages must originate from an allowed guild, channel, and user, mention the bot, and carry a signed envelope containing the native Discord message ID and a generated correlation ID. The gateway validates the service identity, envelope signature, and allowlists again before dispatching. Replayed Discord message IDs are rejected during the bounded ingress replay window. Durable inbox/idempotency retention is introduced with Tess durable state.
 
 ### Observability
 

docs/guides/deployment.md

@@ -1,67 +1,384 @@
 # Deployment Guide
 
-> **Status: non-operative for PostgreSQL, federated, and bare-metal production.** The checked-in
-> Compose PostgreSQL service mounts legacy initialization SQL and the KBN-101 bootstrap, runner,
-> secret-renderer, and process-exec interfaces do not exist yet. This page does not authorize a
-> production deployment, database initialization, manual DDL, secret provisioning, or service
-> activation.
+This guide covers deploying Mosaic in two modes: **Docker Compose** (recommended for quick setup) and **bare-metal** (production, full control).
 
-## Current safe local route
+---
 
-Use PGlite only for current in-process data-layer work; it requires no PostgreSQL. A Gateway/Web
-local process is held because its unguarded dotenv loader can inherit a daemon PostgreSQL DSN and
-reach runtime DDL. If a local queue service is useful, start only Valkey:
+## Prerequisites
+
+| Dependency       | Minimum version | Notes                                          |
+| ---------------- | --------------- | ---------------------------------------------- |
+| Node.js          | 22 LTS          | Required for ESM + `--experimental-vm-modules` |
+| pnpm             | 9               | `npm install -g pnpm`                          |
+| PostgreSQL       | 17              | Must have the `pgvector` extension             |
+| Valkey           | 8               | Redis-compatible; Redis 7+ also works          |
+| Docker + Compose | v2              | For the Docker Compose path only               |
+
+---
+
+## Docker Compose Deployment (Quick Start)
+
+The `docker-compose.yml` at the repository root starts PostgreSQL 17 (with pgvector), Valkey 8, an OpenTelemetry Collector, and Jaeger.
+
+### 1. Clone and configure
 
 ```bash
-docker compose up -d valkey
+git clone <repo-url> mosaic
+cd mosaic
+cp .env.example .env
 ```
 
-This command intentionally does not start PostgreSQL. Do not run a broad Compose start, use its
-PostgreSQL initialization mount, infer that current Compose is a production/federated route, or
-start Gateway/Web until KBN-101-02 supplies fail-closed local-tier/DSN isolation.
+Edit `.env`. The minimum required change is:
 
-## Held future procedure
+```dotenv
+BETTER_AUTH_SECRET=<output of: openssl rand -base64 32>
+```
 
-PostgreSQL local, federated, Compose, and bare-metal production activation are held until these
-artifacts land and pass their independent gates:
+### 2. Start infrastructure services
 
-1. **KBN-101-00** external privileged bootstrap artifact;
-2. **KBN-101-03** sole `mosaic-db-migrator` runner and verified-readiness artifact; and
-3. **KBN-101-05** Vault/secret-renderer-backed deployment and consumer-isolation artifact.
+```bash
+docker compose up -d
+```
 
-The required future order is external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness.
+Services and their ports:
 
-This is a held, non-operative future activation specification with no current command authority. Do not invoke the named
-runner, start PostgreSQL, or substitute a Compose/init/manual-SQL route until the owned artifacts
-are implemented and reviewed.
+| Service               | Default port             |
+| --------------------- | ------------------------ |
+| PostgreSQL            | `localhost:5433`         |
+| Valkey                | `localhost:6380`         |
+| OTEL Collector (HTTP) | `localhost:4318`         |
+| OTEL Collector (gRPC) | `localhost:4317`         |
+| Jaeger UI             | `http://localhost:16686` |
 
-## Future production secret and unit boundary (schematic only)
+Override host ports via `PG_HOST_PORT` and `VALKEY_HOST_PORT` in `.env` if the defaults conflict.
 
-No current bare-metal production unit or command is published. KBN-101-05 must supply a reviewed,
-generation-pinned Vault renderer and a process-exec or systemd `LoadCredential` interface before
-production units can exist. The interface must preserve these exact consumer boundaries:
+### 3. Install dependencies
 
-| Consumer          | May receive                                                                                  | Must never receive                                                                            |
-| ----------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| Gateway/runtime   | Its own runtime URL and DB client CA at process exec                                         | Migrator URL, importer URL/version, attestation material, signing key, PostgreSQL private key |
-| One-shot migrator | Its own migration URL, DB client CA, and runner-only signing capability                      | Runtime URL, importer consumer copy, Gateway/private PostgreSQL keys                          |
-| Data importer     | Its own immutable URL/version copies, importer CA, pinned public key, and sealed attestation | Runtime/migrator URLs, signing key, shared writable mount                                     |
-| PostgreSQL        | Its own server certificate/key and only its approved server material                         | Application, migrator, importer, or Gateway secrets                                           |
+```bash
+pnpm install
+```
 
-A future unit specification is non-executable until KBN-101-05 supplies it. It must obtain
-credentials through the renderer’s Vault generation and process-exec/`LoadCredential` boundary;
-it must not place credentials in a production environment file, a monorepo auto-load path, a shell
-export, command arguments, logs, or a manual secret-activation lifecycle instruction. Rotation and
-process replacement semantics must be delivered by the reviewed renderer/interface with generation,
-consumer-isolation, mode/owner, and no-mixed-generation evidence—not improvised in this guide.
+### 4. Initialize the database
 
-## Readiness and troubleshooting status
+```bash
+pnpm --filter @mosaicstack/db db:migrate
+```
 
-Until the future procedure is implemented, do not diagnose PostgreSQL with ad hoc SQL, connection
-strings, or initialization scripts. The future sanitized runner-verification readiness artifact is
-the required PostgreSQL readiness authority after its bootstrap/TLS prerequisites pass.
-For local PGlite development, diagnose application behavior without introducing a PostgreSQL
-connection.
+### 5. Build all packages
 
-Non-database local services may be inspected with their ordinary local health/log tools. Those
-checks do not certify PostgreSQL, federated deployment, or production readiness.
+```bash
+pnpm build
+```
+
+### 6. Start the gateway
+
+```bash
+pnpm --filter @mosaicstack/gateway dev
+```
+
+Or for production (after build):
+
+```bash
+node apps/gateway/dist/main.js
+```
+
+### 7. Start the web app
+
+```bash
+# Development
+pnpm --filter @mosaicstack/web dev
+
+# Production (after build)
+pnpm --filter @mosaicstack/web start
+```
+
+The web app runs on port `3000` by default.
+
+---
+
+## Bare-Metal Deployment
+
+Use this path when you want to manage PostgreSQL and Valkey yourself (e.g., existing infrastructure, managed cloud databases).
+
+### Step 1 — Install system dependencies
+
+```bash
+# Node.js 22 via nvm
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
+nvm install 22
+nvm use 22
+
+# pnpm
+npm install -g pnpm
+
+# PostgreSQL 17 with pgvector (Debian/Ubuntu example)
+sudo apt-get install -y postgresql-17 postgresql-17-pgvector
+
+# Valkey
+# Follow https://valkey.io/download/ for your distribution
+```
+
+### Step 2 — Create the database
+
+```sql
+-- Run as the postgres superuser
+CREATE USER mosaic WITH PASSWORD 'change-me';
+CREATE DATABASE mosaic OWNER mosaic;
+\c mosaic
+CREATE EXTENSION IF NOT EXISTS vector;
+```
+
+### Step 3 — Clone and configure
+
+```bash
+git clone <repo-url> /opt/mosaic
+cd /opt/mosaic
+cp .env.example .env
+```
+
+Edit `/opt/mosaic/.env`. Required fields:
+
+```dotenv
+DATABASE_URL=postgresql://mosaic:<password>@localhost:5432/mosaic
+VALKEY_URL=redis://localhost:6379
+BETTER_AUTH_SECRET=<openssl rand -base64 32>
+BETTER_AUTH_URL=https://your-domain.example.com
+GATEWAY_CORS_ORIGIN=https://your-domain.example.com
+NEXT_PUBLIC_GATEWAY_URL=https://your-domain.example.com
+```
+
+### Step 4 — Install dependencies and build
+
+```bash
+pnpm install
+pnpm build
+```
+
+### Step 5 — Run database migrations
+
+```bash
+pnpm --filter @mosaicstack/db db:migrate
+```
+
+### Step 6 — Start the gateway
+
+```bash
+node apps/gateway/dist/main.js
+```
+
+The gateway reads `.env` from the monorepo root automatically (via `dotenv` in `main.ts`).
+
+### Step 7 — Start the web app
+
+```bash
+# Next.js standalone output
+node apps/web/.next/standalone/server.js
+```
+
+The standalone build is self-contained; it does not require `node_modules` to be present at runtime.
+
+### Step 8 — Configure a reverse proxy
+
+#### Nginx example
+
+```nginx
+# /etc/nginx/sites-available/mosaic
+
+# Gateway API
+server {
+    listen 443 ssl;
+    server_name your-domain.example.com;
+
+    ssl_certificate     /etc/ssl/certs/your-domain.crt;
+    ssl_certificate_key /etc/ssl/private/your-domain.key;
+
+    # WebSocket support (for chat.gateway.ts / Socket.IO)
+    location /socket.io/ {
+        proxy_pass http://127.0.0.1:14242;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # REST + auth
+    location / {
+        proxy_pass http://127.0.0.1:14242;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# Web app (optional — serve on a subdomain or a separate server block)
+server {
+    listen 443 ssl;
+    server_name app.your-domain.example.com;
+
+    ssl_certificate     /etc/ssl/certs/your-domain.crt;
+    ssl_certificate_key /etc/ssl/private/your-domain.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+#### Caddy example
+
+```caddyfile
+# /etc/caddy/Caddyfile
+
+your-domain.example.com {
+    reverse_proxy /socket.io/* localhost:14242 {
+        header_up Upgrade {http.upgrade}
+        header_up Connection {http.connection}
+    }
+    reverse_proxy localhost:14242
+}
+
+app.your-domain.example.com {
+    reverse_proxy localhost:3000
+}
+```
+
+---
+
+## Production Considerations
+
+### systemd Services
+
+Create a service unit for each process.
+
+**Gateway** — `/etc/systemd/system/mosaic-gateway.service`:
+
+```ini
+[Unit]
+Description=Mosaic Gateway
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=mosaic
+WorkingDirectory=/opt/mosaic
+EnvironmentFile=/opt/mosaic/.env
+ExecStart=/usr/bin/node apps/gateway/dist/main.js
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+```
+
+**Web app** — `/etc/systemd/system/mosaic-web.service`:
+
+```ini
+[Unit]
+Description=Mosaic Web App
+After=network.target mosaic-gateway.service
+
+[Service]
+Type=simple
+User=mosaic
+WorkingDirectory=/opt/mosaic/apps/web
+EnvironmentFile=/opt/mosaic/.env
+ExecStart=/usr/bin/node .next/standalone/server.js
+Environment=PORT=3000
+Environment=HOSTNAME=127.0.0.1
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Enable and start:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now mosaic-gateway mosaic-web
+```
+
+### Log Management
+
+Gateway and web app logs go to systemd journal by default. View with:
+
+```bash
+journalctl -u mosaic-gateway -f
+journalctl -u mosaic-web -f
+```
+
+Rotate logs by configuring `journald` in `/etc/systemd/journald.conf`:
+
+```ini
+SystemMaxUse=500M
+MaxRetentionSec=30day
+```
+
+### Security Checklist
+
+- Set `BETTER_AUTH_SECRET` to a cryptographically random value (`openssl rand -base64 32`).
+- Restrict `GATEWAY_CORS_ORIGIN` to your exact frontend origin — do not use `*`.
+- Run services as a dedicated non-root system user (e.g., `mosaic`).
+- Firewall: only expose ports 80/443 externally; keep 14242 and 3000 bound to `127.0.0.1`.
+- Set `AGENT_FILE_SANDBOX_DIR` to a directory outside the application root to prevent agent tools from accessing source code.
+- If using `AGENT_USER_TOOLS`, enumerate only the tools non-admin users need.
+
+---
+
+## Troubleshooting
+
+### Gateway fails to start — "BETTER_AUTH_SECRET is required"
+
+`BETTER_AUTH_SECRET` is missing or empty. Set it in `.env` and restart.
+
+### `DATABASE_URL` connection refused
+
+Verify PostgreSQL is running and the port matches. The Docker Compose default is `5433`; bare-metal typically uses `5432`.
+
+```bash
+psql "$DATABASE_URL" -c '\conninfo'
+```
+
+### pgvector extension missing
+
+```sql
+\c mosaic
+CREATE EXTENSION IF NOT EXISTS vector;
+```
+
+### Valkey / Redis connection refused
+
+Check the URL in `VALKEY_URL`. The Docker Compose default is port `6380`.
+
+```bash
+redis-cli -u "$VALKEY_URL" ping
+```
+
+### WebSocket connections fail in production
+
+Ensure your reverse proxy forwards the `Upgrade` and `Connection` headers. See the Nginx/Caddy examples above.
+
+### Ollama models not appearing
+
+Set `OLLAMA_BASE_URL` to the URL where Ollama is running (e.g., `http://localhost:11434`) and set `OLLAMA_MODELS` to a comma-separated list of model IDs you have pulled.
+
+```bash
+ollama pull llama3.2
+```
+
+### OTEL traces not appearing in Jaeger
+
+Verify the collector is reachable at `OTEL_EXPORTER_OTLP_ENDPOINT`. With Docker Compose the default is `http://localhost:4318`. Check `docker compose ps` and `docker compose logs otel-collector`.
+
+### Summarization / embedding features not working
+
+These features require `OPENAI_API_KEY` to be set, or you must point `SUMMARIZATION_API_URL` / `EMBEDDING_API_URL` to an OpenAI-compatible endpoint (e.g., a local Ollama instance with an embeddings model).

docs/guides/dev-guide.md

@@ -39,7 +39,7 @@ mosaic-mono-v1/
 │   ├── queue/            # Valkey-backed task queue
 │   └── types/            # Shared TypeScript types
 ├── docker/               # Dockerfile(s) for containerized deployment
-├── infra/                # Infrastructure configuration (for example, OTEL collector)
+├── infra/                # Infra config (OTEL collector, pg-init scripts)
 ├── docker-compose.yml    # Local services (Postgres, Valkey, OTEL, Jaeger)
 └── CLAUDE.md             # Project conventions for AI coding agents
 ```
@@ -86,54 +86,71 @@ cd mosaic-mono-v1
 pnpm install
 ```
 
-### 2. Use the local PGlite tier
-
-The supported local tier is in-process PGlite and requires no PostgreSQL service. Leave
-`DATABASE_URL` unset for this route. Its default local configuration uses PGlite and performs no
-external database probe.
-
-If a local queue service is useful, start only that non-PostgreSQL service:
+### 2. Start Infrastructure Services
 
 ```bash
-docker compose up -d valkey
+docker compose up -d
 ```
 
-Do not use the current Compose PostgreSQL service: it mounts legacy `infra/pg-init` SQL and is
-not qualified for KBN-101. Start OTEL Collector or Jaeger individually only when needed and
-without starting PostgreSQL.
+This starts:
 
-### 3. Gateway/Web local process (held)
+| Service                  | Port           | Description          |
+| ------------------------ | -------------- | -------------------- |
+| PostgreSQL 17 + pgvector | `5433` (host)  | Primary database     |
+| Valkey 8                 | `6380` (host)  | Queue and cache      |
+| OpenTelemetry Collector  | `4317`, `4318` | OTEL gRPC and HTTP   |
+| Jaeger                   | `16686`        | Distributed trace UI |
 
-Do not start the current Gateway or web process as a local PGlite route. Gateway first loads the
-daemon configuration and then project environment files without a tier guard; a pre-existing
-`DATABASE_URL` can select PostgreSQL, where current startup still reaches runtime DDL/migrations.
-Creating a root `.env` that omits `DATABASE_URL` does not make this safe, so neither a local
-credential file nor a web environment file is a current developer procedure.
+### 3. Configure Environment
 
-PGlite remains the supported in-process data-layer implementation, and the optional Valkey command
-above remains safe because it does not start PostgreSQL. A safe Gateway/Web local procedure is held
-until KBN-101-02 rejects a daemon, inherited, root, or app-local PostgreSQL DSN and any non-local
-tier before connection or DDL; KBN-101-05 then supplies the production renderer/Vault process-exec
-or `LoadCredential` boundary.
+Create a `.env` file in the monorepo root:
 
-### Held future procedure
+```env
+# Database (matches docker-compose defaults)
+DATABASE_URL=postgresql://mosaic:mosaic@localhost:5433/mosaic
 
-PostgreSQL local and federated deployment are held until KBN-101-00 (external bootstrap),
-KBN-101-03 (runner), and KBN-101-05 (renderer-backed deployment) land. The following is the
-**held, non-operative future activation order with no current command authority**:
+# Auth (required — generate a random 32+ char string)
+BETTER_AUTH_SECRET=change-me-to-a-random-secret
 
-external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
-`mosaic-db-migrator --verify` → Gateway/Compose readiness.
+# Gateway
+GATEWAY_PORT=14242
+GATEWAY_CORS_ORIGIN=http://localhost:3000
 
-Neither current Compose nor this development guide authorizes PostgreSQL initialization SQL,
-manual DDL, or a pre-runner start.
+# Web
+NEXT_PUBLIC_GATEWAY_URL=http://localhost:14242
 
-### 5. Gateway/Web start (held)
+# Optional: Ollama
+OLLAMA_BASE_URL=http://localhost:11434
+OLLAMA_MODELS=llama3.2
+```
 
-No Gateway/Web start command is currently authorized for the local PGlite route. Do not use root
-`pnpm dev` as a workaround: it additionally starts configured integrations and cannot establish the
-required local-tier/DSN isolation. Resume this section only after KBN-101-02 provides its
-fail-closed local-startup evidence.
+The gateway loads `.env` from the monorepo root via `dotenv` at startup
+(`apps/gateway/src/main.ts`).
+
+### 4. Push the Database Schema
+
+```bash
+pnpm --filter @mosaicstack/db db:push
+```
+
+This applies the Drizzle schema directly to the database (development only; use
+migrations in production).
+
+### 5. Start the Gateway
+
+```bash
+pnpm --filter @mosaicstack/gateway exec tsx src/main.ts
+```
+
+The gateway starts on port `14242` by default.
+
+### 6. Start the Web App
+
+```bash
+pnpm --filter @mosaicstack/web dev
+```
+
+The web app starts on port `3000` by default.
 
 ---
 
@@ -283,13 +300,26 @@ Implement a standard MCP server that exposes tools via the streamable HTTP
 transport or SSE transport. The server must accept connections at a `/mcp`
 endpoint.
 
-### 2. Gateway MCP configuration (held)
+### 2. Configure `MCP_SERVERS`
 
-Do not configure MCP endpoint credentials, write them to a local environment file, or restart the
-Gateway from this guide. Gateway/Web startup is held until KBN-101-02 supplies fail-closed
-local-tier/DSN isolation and KBN-101-05 supplies the renderer/Vault process-exec or
-`LoadCredential` secret-consumer interface. The future authenticated MCP route requires verified
-HTTPS and certificate validation; plaintext bearer-token examples are forbidden.
+In your `.env`:
+
+```env
+MCP_SERVERS='[{"name":"my-server","url":"http://localhost:3001/mcp"}]'
+```
+
+With authentication:
+
+```env
+MCP_SERVERS='[{"name":"secure-server","url":"http://my-server/mcp","headers":{"Authorization":"Bearer token"}}]'
+```
+
+### 3. Restart the Gateway
+
+On startup, `McpClientService` (`apps/gateway/src/mcp-client/mcp-client.service.ts`)
+connects to each configured server, calls `tools/list`, and bridges the results
+to Pi SDK `ToolDefinition` format. These tools become available in all new agent
+sessions.
 
 ### Tool Naming
 
@@ -325,31 +355,42 @@ The schema lives in a single file:
 
 The `insights` table uses a `vector(1536)` column (pgvector) for semantic search.
 
-### PostgreSQL schema work (held)
+### Development: Push Schema
 
-Do not prepare or run a PostgreSQL target from this branch. The sole runner, bootstrap, and
-renderer are future KBN-101 artifacts, not current commands. When KBN-101-00/-03/-05 land, the
-owned activation documentation will require external bootstrap → TLS/roles → runner `--run` →
-runner `--verify` → Gateway/Compose readiness.
+Apply schema changes directly to the dev database (no migration files created):
 
-### Generating migration artifacts
+```bash
+pnpm --filter @mosaicstack/db db:push
+```
 
-`pnpm --filter @mosaicstack/db db:generate` is an offline artifact-generation command. It does
-not authorize connecting to or initializing PostgreSQL. A future reviewed PostgreSQL procedure
-will determine when its output is applied.
+### Generating Migrations
+
+For production-safe, versioned changes:
+
+```bash
+pnpm --filter @mosaicstack/db db:generate
+```
+
+This creates a new SQL migration file in `packages/db/drizzle/`.
+
+### Running Migrations
+
+```bash
+pnpm --filter @mosaicstack/db db:migrate
+```
 
 ### Drizzle Config
 
-Config is at `packages/db/drizzle.config.ts`. The schema file path and output directory are
-defined there.
+Config is at `packages/db/drizzle.config.ts`. The schema file path and output
+directory are defined there.
 
 ### Adding a New Table
 
 1. Add the table definition to `packages/db/src/schema.ts`.
 2. Export it from `packages/db/src/index.ts`.
-3. Generate the offline artifact with `pnpm --filter @mosaicstack/db db:generate`.
-4. Do not apply it to PostgreSQL until the future KBN-101 activation artifacts and their owned
-   procedure are available. Direct schema push is not a production-like workflow.
+3. Run `pnpm --filter @mosaicstack/db db:push` (dev) or
+   `pnpm --filter @mosaicstack/db db:generate && pnpm --filter @mosaicstack/db db:migrate`
+   (production).
 
 ---
 

docs/guides/migrate-tier.md

@@ -1,98 +1,147 @@
 # Migrating to the Federated Tier
 
-> **KBN-101-07 ownership:** This active documentation is a **non-operative KBN-101
-> contract** with no current command authority until KBN-101-00, KBN-101-02, KBN-101-03, KBN-101-05, and KBN-101-06 land and
-> KBN-101-08 activates an exact reviewed release. The commands below describe the produced interface only. Do not run them on the
-> current branch or replace them with direct PostgreSQL, raw SQL, legacy storage migration, or
-> credential-on-argv procedures.
+Step-by-step guide to migrate from `local` (PGlite) or `standalone` (PostgreSQL without pgvector) to `federated` (PostgreSQL 17 + pgvector + Valkey).
 
-## Held future procedure
+## When to migrate
 
-This section is non-operative and grants no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05 land.
+Migrate to federated tier when:
 
-The deployment control plane executes the complete held future procedure, in order: external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. The
-runner is the only attestation producer after its verified TLS, identity, manifest, and schema
-checks. A data importer is never a schema bootstrap, extension installer, repair command, or DDL
-consumer.
+- Scaling from single-user to multi-user deployments
+- Adding vector embeddings or RAG features
+- Running Mosaic across multiple hosts
+- Requires distributed task queueing and caching
+- Moving to production with high availability
 
-## Target material contract
+## Prerequisites
 
-KBN-101-05 obtains the target URL from Vault KV-v2
-`secret-{env}/mosaic-stack/database/importer`, key `url`, and reads its authenticated version from
-the same successful response `data.metadata.version`. A hash or DSN byte sequence is not a
-provider version. The renderer treats URL bytes and provider version as one generation, writes a
-temporary generation directory with fsync plus atomic rename, and creates separate immutable
-consumer mounts. Swarm uses distinct versioned secret/config references. A deployment cannot mix
-generations.
+- Federated stack running and healthy (see [Federated Tier Setup](../federation/SETUP.md))
+- Source database accessible and empty target database at the federated URL
+- Backup of source database (recommended before any migration)
 
-| Consumer                                      | Permitted material                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Migrator-attestation producer (`10003:10003`) | Its own migration URL/CA; read-only `/run/secrets/mosaic-migrate-target-url` and `/run/secrets/mosaic-migrate-target-version`, each `0400`, solely to bind; producer-only attestation output at `/run/mosaic-attestations-producer/migrate-target.v1.json`; root-wrapper-only signing key. It never connects with, uses, exports, logs, or forwards the importer URL/version.                                                                                                            |
-| Privileged deployment handoff controller      | After runner success and before importer creation, it receives only root-owned non-secret expected provider-version/URL-SHA-256/generation descriptor and pinned public verifier key—not URL bytes or private key. It safe-opens/verifies descriptor and producer artifact, copies exact bytes to a new importer-only mount with fsync/atomic rename, sets `10002:10002` `0400`, seals it read-only, and refuses importer start on any partial/wrong-generation/wrong-owner/mode result. |
-| Importer (`10002:10002`)                      | Its own immutable `0400` copies at the same URL/version paths; CA at exact `DATABASE_TLS_CA_CERT_PATH=/run/secrets/mosaic-db-ca.crt`; pinned Ed25519 public key; read-only `/run/mosaic-attestations/migrate-target.v1.json` supplied only by the sealed handoff.                                                                                                                                                                                                                        |
-| Gateway/runtime/unrelated container           | No importer URL/version, importer artifact, attestation private key, or unrelated CA mount.                                                                                                                                                                                                                                                                                                                                                                                              |
+## Dry-run first
 
-The migrator and importer safe-open URL, provider-version, attestation, and public-key files only
-with `O_RDONLY|O_CLOEXEC|O_NOFOLLOW`; they validate from the opened fd that the file is regular,
-has its expected owner/mode and link count one. The migrator digests only that URL fd for binding,
-then zeroizes/closes it. The importer reads URL bytes once into protected memory, validates the
-signed binding and exact CA before connecting from those same bytes, then zeroizes/closes every
-fd. It neither logs nor exposes a URL/version/attestation/key oracle.
-
-## Produced command interface
-
-After activation and only after approved target preparation, the future interface is:
+Always run a dry-run to validate the migration:
 
 ```bash
-# Deployment control plane has already completed the held runner procedure above.
 mosaic storage migrate-tier --to federated \
-  --target-url-file /run/secrets/mosaic-migrate-target-url \
-  --target-attestation-file /run/mosaic-attestations/migrate-target.v1.json \
+  --target-url postgresql://mosaic:mosaic@localhost:5433/mosaic \
   --dry-run
 ```
 
-The provider-version file is fixed deployment material, not argv. This connecting dry-run consumes its nonce; before an actual copy, the deployment control plane must provide fresh runner verification and a new sealed handoff. The runner uses its migration
-identity; the importer connects only as non-DDL `mosaic_data_importer` and only after all
-pre-connect validation. After verified TLS and before DML it compares PostgreSQL system ID,
-database OID, `current_user`, CA/SPKI, and manifest/schema fingerprints to the artifact.
+Expected output (partial example):
 
-## Required refusals and evidence
+```
+[migrate-tier] Analyzing source tier: pglite
+[migrate-tier] Analyzing target tier: federated
+[migrate-tier] Precondition: target is empty ✓
+  users: 5 rows
+  teams: 2 rows
+  conversations: 12 rows
+  messages: 187 rows
+  ... (all tables listed)
+[migrate-tier] NOTE: Source tier has no pgvector support. insights.embedding will be NULL on all migrated rows.
+[migrate-tier] DRY-RUN COMPLETE (no data written). 206 total rows would be migrated.
+```
 
-KBN-101-02/-03/-05/-06 must prove, with stable sanitized errors, that no target connection occurs
-for missing/unsafe URL/version/attestation/public-key files; symlink, hardlink, owner, mode, or
-TOCTOU violations; mixed URL/version generations; missing/wrong CA mount; stale/replayed/tampered
-or revoked-key artifacts; provider rotation/revocation; wrong TLS/server/database/role/manifest
-binding; raw `--target-url`; `DATABASE_URL` fallback; runtime/owner identity; consumer leakage;
-or any DDL attempt. Post-connect identity mismatch closes with zero DML/DDL. Tests also prove no
-forwarding, child environment, logging, or error oracle leaks URL/version/key/artifact contents.
+Review the output. If it shows an error (e.g., target not empty), address it before proceeding.
 
-The attestation is credential-free JCS with detached Ed25519 signature and binds issued/expiry,
-nonce, authenticated provider version, exact URL-fd SHA-256, TLS host/port/database, CA/SPKI,
-PostgreSQL system ID/database OID, importer role, manifest/schema, and producer identity. Provider
-version rotation invalidates an old artifact and requires a fresh rendered generation plus runner
-verification.
+## Run the migration
 
-## Actual copy after dry-run
-
-After reviewed dry-run, obtain the required fresh verification/attestation generation, then use:
+When ready, run without `--dry-run`:
 
 ```bash
-# Deployment control plane has supplied fresh runner verification and attestation.
 mosaic storage migrate-tier --to federated \
-  --target-url-file /run/secrets/mosaic-migrate-target-url \
-  --target-attestation-file /run/mosaic-attestations/migrate-target.v1.json \
+  --target-url postgresql://mosaic:mosaic@localhost:5433/mosaic \
   --yes
 ```
 
-The dry-run artifact is terminally replayed and must be rejected; `--yes` bypasses no file,
-generation, signature, TLS, identity, or DDL control.
+The `--yes` flag skips the confirmation prompt (required in non-TTY environments like CI).
 
-## Data boundary and recovery
+The command will:
 
-The importer has only an allowlisted mutable-table DML registry. It has no grant for immutable KBN
-relations, schemas, roles, memberships, extensions, catalogs, or the Drizzle ledger. Source PGlite
-uses its explicit local directory and does not make a PostgreSQL URL fallback valid.
+1. Acquire an advisory lock (blocks concurrent invocations)
+2. Copy data from source to target in dependency order
+3. Report rows migrated per table
+4. Display any warnings (e.g., null vector embeddings)
 
-A failed or ambiguous migration is a control-plane incident: preserve sanitized evidence, retain
-the approved backup/rollback state, and retry only after independent review. Never inspect,
-unlock, repair, or initialize the target with ad hoc SQL or copied credentials.
+## What gets migrated
+
+All persistent, user-bound data is migrated in dependency order:
+
+- **users, teams, team_members** — user and team ownership
+- **accounts** — OAuth provider tokens (durable credentials)
+- **projects, agents, missions, tasks** — all project and agent definitions
+- **conversations, messages** — all chat history
+- **preferences, insights, agent_logs** — preferences and observability
+- **provider_credentials** — stored API keys and secrets
+- **tickets, events, skills, routing_rules, appreciations** — auxiliary records
+
+Full order is defined in code (`MIGRATION_ORDER` in `packages/storage/src/migrate-tier.ts`).
+
+## What gets skipped and why
+
+Three tables are intentionally not migrated:
+
+| Table             | Reason                                                                                          |
+| ----------------- | ----------------------------------------------------------------------------------------------- |
+| **sessions**      | TTL'd auth sessions from the old environment; they will fail JWT verification on the new target |
+| **verifications** | One-time tokens (email verify, password reset) that have either expired or been consumed        |
+| **admin_tokens**  | Hashed tokens bound to the old environment's secret keys; must be re-issued                     |
+
+**Note on accounts and provider_credentials:** These durable credentials ARE migrated because they are user-bound and required for resuming agent work on the target environment. After migration to a multi-tenant federated deployment, operators may want to audit or wipe these if users are untrusted or credentials should not be shared.
+
+## Idempotency and concurrency
+
+The migration is **idempotent**:
+
+- Re-running is safe (uses `ON CONFLICT DO UPDATE` internally)
+- Ideal for retries on transient failures
+- Concurrent invocations are blocked by a Postgres advisory lock; the second caller will wait
+
+If a previous run is stuck, check for advisory locks:
+
+```sql
+SELECT * FROM pg_locks WHERE locktype='advisory';
+```
+
+If you need to force-unlock (dangerous):
+
+```sql
+SELECT pg_advisory_unlock(<lock_id>);
+```
+
+## Verify the migration
+
+After migration completes, spot-check the target:
+
+```bash
+# Count rows on a few critical tables
+psql postgresql://mosaic:mosaic@localhost:5433/mosaic -c \
+  "SELECT 'users' as table, COUNT(*) FROM users UNION ALL
+   SELECT 'conversations' as table, COUNT(*) FROM conversations UNION ALL
+   SELECT 'messages' as table, COUNT(*) FROM messages;"
+```
+
+Verify a known user or project exists by ID:
+
+```bash
+psql postgresql://mosaic:mosaic@localhost:5433/mosaic -c \
+  "SELECT id, email FROM users WHERE email='<your-email>';"
+```
+
+Ensure vector embeddings are NULL (if source was PGlite) or populated (if source was postgres + pgvector):
+
+```bash
+psql postgresql://mosaic:mosaic@localhost:5433/mosaic -c \
+  "SELECT embedding IS NOT NULL as has_vector FROM insights LIMIT 5;"
+```
+
+## Rollback
+
+There is no in-place rollback. If the migration fails:
+
+1. Restore the target database from a pre-migration backup
+2. Investigate the failure logs
+3. Rerun the migration
+
+Always test migrations in a staging environment first.

docs/guides/mos-connector-lease-operations.md

@@ -1,43 +0,0 @@
-# Mos Connector Lease Operations — M1
-
-## Operational status
-
-M1 installs the durable schema and gateway policy/adapter boundary. It does **not** activate a connector, expose a lease administration endpoint, or cut over a channel. The default gateway connector-lease policy is deny-all until a later work package supplies an authorized server-side policy and concrete adapter.
-
-## Events to monitor
-
-Use correlation IDs to follow `connector_lease_audit_log` events:
-
-| Event      | Meaning                                                               |
-| ---------- | --------------------------------------------------------------------- |
-| `acquire`  | First holder inserted for an unused binding                           |
-| `renew`    | Current holder heartbeat extended the TTL                             |
-| `takeover` | Authorized CAS replaced the holder and incremented epoch              |
-| `release`  | Current holder explicitly relinquished authority                      |
-| `expiry`   | An expired current lease was observed                                 |
-| `reject`   | Policy, CAS, expiry, scope, or fencing validation denied an operation |
-
-Audit data is metadata-only. Raw grant objects, connector payloads, scopes, tokens, approval references, and credentials must never be added to audit output.
-
-## Incident checks
-
-For suspected duplicate/stale connector effects:
-
-1. Correlate the attempted operation with its `reject`, `takeover`, or `expiry` event.
-2. Compare the current row's connector ID, lease UUID, epoch, expiry, and release time with the adapter's normalized execution context.
-3. Treat an old epoch, old lease UUID, expired lease, or released lease as non-authoritative. Do not retry it as the old holder.
-4. Recovery uses the authorized takeover path with the observed expected epoch. Ordinary acquire is intentionally rejected for expired/released rows.
-5. If an external effect may already have happened, preserve evidence and do not assume lease fencing provides exactly-once replay safety.
-
-## Migration and rollback safety
-
-Migration `0016_salty_morlocks.sql` is additive: it creates two new tables and indexes without modifying existing authorization/session tables. Before rollout, normal database backup and migration verification still apply. Rolling application code back leaves unused additive tables in place; dropping tables is not part of automated rollback because it would destroy lease/audit evidence.
-
-## Security constraints
-
-- Tenant comes from authenticated gateway context, never a connector request field.
-- Logical agent, binding, connector, and scope identifiers use normalized constrained forms.
-- Takeover requires explicit gateway policy authorization and an expected epoch.
-- Default defense-in-depth TTL caps are 5 minutes for leases and 30 seconds for grants; policy may enforce stricter limits.
-- Validation and rejection audit complete before adapter side effects.
-- Existing authz and exact-action approval controls remain additional required gates; a valid connector lease does not bypass them.

docs/guides/user-guide.md

@@ -522,14 +522,8 @@ mosaic storage export --bucket agent-artifacts --output ./artifacts.tar.gz
 # Import data into storage
 mosaic storage import --bucket agent-artifacts --input ./artifacts.tar.gz
 
-# Schema migration is unavailable in this release. The current storage wrapper shells
-# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
-# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
-# --run → runner --verify → readiness.
-
-# Tier copy uses only the separately held secure migrate-tier route. Never use a legacy
-# --from/--to storage-migrate command or pass a credential on argv.
+# Migrate data between tiers
+mosaic storage migrate --from hot --to cold --older-than 30d
 ```
 
 ---

docs/native-kanban-sot/DOCUMENTATION-CHECKLIST.md

@@ -1,36 +0,0 @@
-# Documentation Completion Checklist — Native Kanban/SOT Canon
-
-**Tracking:** Mosaic Stack issue #751
-**Scope:** Requirements and contract publication only; runtime implementation follows in separate slices.
-
-## Required artifacts
-
-- [x] Project `docs/PRD.md` exists; the workstream requirements refine its task/project-management scope.
-- [x] Canonical workstream requirements published at `docs/requirements/native-kanban-sot.md`.
-- [x] Mission manifest, task decomposition, frozen shared contract, and typed contract declarations included.
-- [x] `docs/SITEMAP.md` updated.
-- [x] Independent initial review and final GO report stored under `docs/reports/native-kanban-sot/`.
-- [x] Task scratchpad stored under `docs/scratchpads/`.
-- [ ] User/Admin/Developer guides — N/A for canon-only publication; required in implementation slices that change behavior or operations.
-- [ ] OpenAPI and endpoint index — N/A until KBN-105 freezes implementation-ready endpoint contracts.
-
-## Structural and root hygiene
-
-- [x] Canonical requirements are under `docs/requirements/`.
-- [x] Workstream artifacts are under `docs/native-kanban-sot/`.
-- [x] Review reports are under `docs/reports/native-kanban-sot/`.
-- [x] No new unscoped document was added to the `docs/` root.
-- [x] Root mission/task rollups link to the workstream.
-
-## Review gate
-
-- [x] Author and independent reviewer are different agents.
-- [x] KCR-001–016 closure was independently verified.
-- [x] Ultron final gate returned GO with zero BLOCKER/HIGH findings.
-- [x] Formatter, lint, typecheck, strict contract TypeScript, link, scope, and invariant publication validation passed in the current Stack toolchain.
-- [ ] PR review, CI, squash merge, and issue closure remain required before publication completion.
-
-## Publishing
-
-- [x] Canonical source remains in-repository.
-- [x] No external publishing platform is required for this internal architecture contract.

docs/native-kanban-sot/INDEX.md

@@ -1,66 +0,0 @@
-# Native Kanban/SOT Canon
-
-**Status:** KCR-001–016 independently cleared; KBN-101 rc.16 current generic storage-wrapper authority remediation awaits independent exact-head re-review under issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771)
-**Date:** 2026-07-14
-**Implementation hold:** no feature implementation starts until this canon is squash-merged to `main` with terminal-green CI; after merge, every slice remains held until its KBN prerequisite graph is satisfied.
-
-## Artifacts
-
-| Artifact                                                                                                       | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Canonical requirements](../requirements/native-kanban-sot.md)                                                 | Canonical P0–P3 requirements, all seven ratified decisions, fixed invariants, thin MVP, recovery tiers, non-goals, and per-requirement acceptance criteria                                                                                                                                                                                                                                                                                                                                                                                  |
-| [`MISSION-MANIFEST.md`](./MISSION-MANIFEST.md)                                                                 | Mission/authority boundaries, exact role chain, gate model, mandatory SecReview triggers, Certifier final/no-merge rule, and collision-free slice ownership                                                                                                                                                                                                                                                                                                                                                                                 |
-| [`TASKS.md`](./TASKS.md)                                                                                       | Dependency-ordered, bounded P0–P3 slices with IN/OUT scope, dependencies, shared contracts, file ownership, evidence, and USC coder2/3/4/5 parallelization                                                                                                                                                                                                                                                                                                                                                                                  |
-| [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md)                                                       | rc.16 direct-Drizzle current storage-wrapper hold: legacy N-1/uncertified/non-operative pending -02/-03/-06/-08; exact README commented/user-guide executable forms fail before masking and source-consistency rejects runner-delegation copy; held future bootstrap → TLS/roles → run → verify → readiness; plus prior production boundary, pgvector owner, attestation, inventory, manifests, DDL classifier, TLS/bootstrap, activation, and certification contract; foundation prerequisite of KBN-100 and real-role gate before KBN-105 |
-| [`SHARED-CONTRACT.md`](./SHARED-CONTRACT.md)                                                                   | Remediated v1 integration contract: proof authority, exact failures/routes/DTOs/MCP ownership, concrete current-main field migration map, relational invariants, Coordinator split, recovery delivery                                                                                                                                                                                                                                                                                                                                       |
-| [`contracts/kanban-schema.v1.ts`](./contracts/kanban-schema.v1.ts)                                             | Drizzle target declarations including exact owner/principal membership, project congruence, tags/archive, proposals, persisted assignments, monotonic fences, durable retry, immutable evidence/audit                                                                                                                                                                                                                                                                                                                                       |
-| [`contracts/mechanical-coordinator.v1.ts`](./contracts/mechanical-coordinator.v1.ts)                           | Pure snapshot decision engine separated from persistence/service adapter; ID-bound approvals, bigint-safe fences, durable retry/quarantine, artifact-backed checkpoints, exact failures                                                                                                                                                                                                                                                                                                                                                     |
-| [`contracts/health-state.v1.ts`](./contracts/health-state.v1.ts)                                               | Discriminated public health, separate branded transaction-local write proof, and non-overlapping denial/transport/version-conflict mappings                                                                                                                                                                                                                                                                                                                                                                                                 |
-| [`contracts/recovery-posture.v1.ts`](./contracts/recovery-posture.v1.ts)                                       | Provider-neutral shape schema plus normative runtime refinement, cross-field constraints, and Lite/Standard/High-assurance defaults                                                                                                                                                                                                                                                                                                                                                                                                         |
-| [`tsconfig.json`](./tsconfig.json)                                                                             | Strict no-emit project scope for linting and compiling the four frozen TypeScript contracts against the current Stack Drizzle declarations                                                                                                                                                                                                                                                                                                                                                                                                  |
-| [`DOCUMENTATION-CHECKLIST.md`](./DOCUMENTATION-CHECKLIST.md)                                                   | Publication documentation gate and implementation-slice deferrals                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| [KBN-101 exact-head security review](../reports/native-kanban-sot/kbn-101-contract-security-review-82ce325.md) | Historical `da742ca` REQUEST CHANGES report retained as prior closure evidence; rc.16 awaits independent exact-head re-review after closing the current generic storage-wrapper authority HIGH finding                                                                                                                                                                                                                                                                                                                                      |
-| [Initial independent review](../reports/native-kanban-sot/canon-initial-review-no-go.md)                       | KCR-001–016 findings that blocked the first draft                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| [Final independent re-review](../reports/native-kanban-sot/canon-final-rereview-go.md)                         | Closure matrix, reproducible validation evidence, and GO verdict                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| [Ultron final gate](../reports/native-kanban-sot/ultron-final-go.md)                                           | Final requirements, authority, schema, migration, recovery, decomposition, and evidence review GO                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-
-## Recommended USC lane partition
-
-| Lane       | Natural seam                         | Exclusive ownership                                                                                                                                     |
-| ---------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **coder2** | Schema + migrations + recovery slice | Unified Drizzle schema, migration SQL/meta/journal/tests, then recovery parser/mechanism/runbook files                                                  |
-| **coder3** | Domain + Gateway + MCP server        | Workspace-safe repositories, DTOs/controllers/services, exact `apps/gateway/src/mcp/**` files, health proof, proposals, Coordinator persistence adapter |
-| **coder4** | Pure Coordinator + tooling           | `packages/coord` mechanical engine, CLI/MCP consumers, generated projection, one-way importer and cutover tooling; lane-serialized internally           |
-| **coder5** | Web                                  | Tasks/Projects Kanban/List/detail and later Coordinator/migration-review UI                                                                             |
-| **Mos**    | Serialized integration               | Canon publication, frozen-contract changes, shared-root/exports, integration gates, merge authority                                                     |
-
-The safe order is KBN-010 → KBN-101 foundation → KBN-100 → KBN-101 deployed-role immutable-operation certificate → KBN-105, then coder3 Gateway/MCP server, coder4 CLI/projection, coder5 web, and coder2 recovery can proceed on disjoint files. KBN-100 is blocked on the KBN-101 foundation; real deployed-role certification—not synthetic test roles—is required before KBN-105. coder4 then runs pure Coordinator → importer → cutover tooling serially. No two active slices edit the same files.
-
-## Recovery defaults
-
-| Tier           | RPO / RTO    | WAL / PITR          | Base backup | Restore / break-glass   | Off-cluster                                     |
-| -------------- | ------------ | ------------------- | ----------- | ----------------------- | ----------------------------------------------- |
-| Lite           | 24h / 24h    | disabled / disabled | daily       | quarterly / annual      | encrypted separate target                       |
-| Standard       | 1h / 8h      | q15m / 14d          | daily       | quarterly / semiannual  | encrypted separate object storage               |
-| High-assurance | **15m / 4h** | **q5m / 35d**       | **daily**   | **monthly / quarterly** | **encrypted base+WAL, separate failure domain** |
-
-These knobs affect recovery posture only. PostgreSQL remains the sole writable SOT in every tier. Fail-closed writes, generated-file non-authority, attributable post-recovery proposals, non-LLM Coordinator limits, and Certifier final-gate/no-merge authority are fixed for every tier.
-
-## Non-blocking implementation sub-decisions for Mos
-
-The source plan and ratified seven decisions resolve all build-blocking product choices. The following implementation-local selections remain for the owning slices/Mos and must not weaken v1:
-
-1. Exact PostgreSQL write-health probe SQL and bounded proof lifetime; authority and failures are frozen.
-2. Dependency-cycle serialization mechanism (recursive CTE plus transaction/advisory lock or equivalent); required behavior is frozen.
-3. Whether RLS lands in the first migration or immediately after the tested session-context pattern; workspace constraints/repository authorization are required from migration one.
-4. Concrete off-cluster backup provider/bucket and selected production recovery tier; High-assurance minima are frozen if selected.
-5. Cutover reconciliation thresholds and stabilization duration, to be owner-approved before P3 execution.
-
-None authorizes a second writer, dual sync, LLM scheduling, Coordinator gate waiver/merge, or Certifier merge authority.
-
-## Publication validation evidence
-
-- Concrete TypeScript contracts are formatted with repository Prettier.
-- All four contracts pass strict TypeScript no-emit checking against the current Stack Drizzle toolchain.
-- Contract remediation and KCR-001–016 traceability are recorded in the issue scratchpad and linked review reports.
-- Independent re-review returned GO with KCR-001–016 closed; implementation remains held until canon merge and the dependency-ordered KBN prerequisites complete.

docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md

@@ -1,415 +0,0 @@
-# KBN-010 — Threat, Authorization, and Constraint-Impact Gate
-
-- **Issue:** [#753](https://git.mosaicstack.dev/mosaicstack/stack/issues/753)
-- **Gate status:** **PASS / GO**
-- **Reviewed baseline:** `origin/main` at `49e8a54` (2026-07-14)
-- **Frozen target:** `SHARED-CONTRACT.md` v1.0.0-rc.4 and `contracts/*.v1.ts`
-- **Disposition input:** contract commit `3f6a3387b419eb99453ee10dd25ba888faaab0b5`, tree `7ebab8fa530a7180036928cea9527f808548aa14`
-- **Scope:** documentation and future-test planning only; no runtime, schema, migration, API, configuration, dependency, CI, or deployment change
-
-## 1. Decision
-
-KBN-010 is **PASS / GO** against frozen contract rc.4. The original rc.3 finding remains historical detection evidence:
-
-- **KBN010-SI-001 — rc.3 invalid mission composite-FK candidate key.** At rc.3, `missionsV1` declared a primary key on `id` and a unique key on `(workspace_id, project_id, id)`, but not a candidate key on `(workspace_id, id)`. Both `artifacts_workspace_mission_fk` and `approval_decisions_workspace_mission_fk` referenced exactly `(missions.workspace_id, missions.id)`. PostgreSQL requires the referenced column list of a foreign key to match a non-partial unique/primary candidate key; uniqueness of `id` alone did not satisfy that two-column reference. The rc.3 DDL was therefore invalid, and KBN-010 correctly blocked it.
-
-Contract rc.4 resolves SI-001 by adding the non-partial `missions_workspace_id_uidx` candidate key on `(workspace_id, id)` while retaining the global `id` primary key and the project-congruent `(workspace_id, project_id, id)` key. Both polymorphic child FKs retain their exact workspace-safe ordered columns and `ON DELETE RESTRICT`; no target, tenancy, project-congruence, exactly-one-target, N-1, rollback, no-cascade, identity, approval, or fencing authority is weakened.
-
-Independent Homelab non-author schema/security review returned **APPROVE** for the exact rc.4 commit/tree/content and found no collision with #757 connector fencing. SI-001 has no unresolved contract/schema-design impact.
-
-This GO completes the KBN-010 analysis/review prerequisite only. It does **not** claim that runtime schema or migration DDL exists. KBN-100 remains held and may be released only after this PR squash-merges, the merged change reaches terminal-green CI on `main`, and issue #753 closes.
-
-### 1.1 Independent rc.4 evidence identity
-
-- **Commit:** `3f6a3387b419eb99453ee10dd25ba888faaab0b5`
-- **Tree:** `7ebab8fa530a7180036928cea9527f808548aa14`
-- **Stable full-index SHA-256:** `6b40a76265c4f3e6d1d30a7f262a2dd16e0d51997e99c146b59f527e6524cd42`
-- **Stable patch-id:** `058cf98026fcd1043703c866aee047c8bb144740`
-- **Verdict:** Homelab independent non-author schema/security review **APPROVE**.
-- **Reviewed conclusions:** the candidate key repairs both dependent FKs; tenant safety, polymorphic exactly-one-target semantics, RESTRICT/no-cascade behavior, and N-1/rollback semantics remain valid; #757 uses separate tables/indexes/FKs/identity/fence authority and has no collision.
-
-A command-rendered patch SHA may differ when Git rendering options, headers, or command form differ. That rendering digest is non-authoritative. Canonical review identity is the Git commit object plus tree and exact file content; the stable full-index digest and stable patch-id above are corroborating identities.
-
-## 2. Method and trust boundaries
-
-### 2.1 Inputs inspected
-
-- Canonical requirements: `docs/requirements/native-kanban-sot.md`.
-- Workstream manifest and read-only task plan.
-- Frozen health, schema, Mechanical Coordinator, and recovery contracts in full.
-- Actual current-main schema, Better Auth guard/scope helpers, project/task/mission/team controllers and repositories, fleet backlog, and `TASKS.md` parser/writer.
-- Issue #753 through the Mosaic provider wrapper.
-
-### 2.2 Current-main exposure that the target must replace, not inherit
-
-| Current-main fact                                                                                                                                         | Constraint on future implementation                                                                                               |
-| --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| Teams are global; projects, missions, tasks, agents, and fleet backlog have no `workspace_id`.                                                            | KBN-100 must add the workspace boundary and KBN-110 must query by server-derived workspace in every repository operation.         |
-| `AuthGuard` authenticates a Better Auth user, while `scopeFromUser` falls back through optional tenant/team/org claims and finally user ID.               | Kanban tenancy must derive from an authenticated **active workspace membership**, not this compatibility fallback or caller data. |
-| Team list/get/member endpoints return global team data to any authenticated user.                                                                         | New Kanban endpoints must use a uniform no-oracle denial and must not reuse global team lookup as authorization.                  |
-| Project/task repositories load and mutate by bare IDs; controller checks are separate and sometimes distinguish not-found from forbidden.                 | Workspace predicates and authorization must be inside the authoritative transaction/repository command path.                      |
-| Tasks can have nullable project/mission links, free-text assignee, JSON tags, no aggregate version, and no fence.                                         | Expand/backfill/quarantine must precede NOT NULL/composite constraints; new commands cannot trust legacy fields.                  |
-| `mission_tasks.status` is a second status writer.                                                                                                         | Pre-expand must prohibit it as a write source and later retire it only after N-1 evidence.                                        |
-| Fleet `backlog` has global JSON dependencies and TTL claims without workspace, assignment, approval, session, or fencing.                                 | It must be frozen and imported as non-dispatching shadow data; it cannot be adapted into the canonical lease path.                |
-| `packages/coord/src/tasks-file.ts` parses and mutates `TASKS.md`.                                                                                         | KBN-120 must replace production use with generated, read-only projection code and prove there is no import/mutation path.         |
-| No Kanban transaction-local health proof, semantic audit/event chain, change proposals, canonical outbox, approval binding, or fenced lease model exists. | These are new frozen invariants, not behaviors that may be inferred from current endpoints.                                       |
-
-## 3. Authorization matrix
-
-The exact route/DTO freeze belongs to KBN-105. This matrix fixes the minimum authorization behavior that freeze and later implementation must preserve.
-
-| Principal/state                                    | Permitted authority                                                                   | Required authoritative checks                                                                                                                     | Explicit denials                                                                                                |
-| -------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| Unauthenticated caller                             | Public health observation only, if deployment exposes it                              | Health DTO validation; no proof field accepted                                                                                                    | All canonical reads/mutations; health observation never authorizes a write                                      |
-| Active workspace `owner`/`admin` user              | Policy-allowed workspace administration and domain commands                           | Better Auth session; active membership; server-derived workspace; command-family role; expected version/idempotency                               | Foreign workspace, suspended workspace, revoked membership, caller workspace override                           |
-| Active workspace `member` user                     | Policy-allowed project/task/proposal commands                                         | Active membership plus project/team capability and target checks in the same transaction                                                          | Admin, approval, purge, service-only Coordinator, and unrelated project commands                                |
-| Active workspace `auditor` user                    | Workspace-scoped reads and audit/evidence inspection                                  | Active membership and read capability                                                                                                             | Every mutation, approval, lease, token issuance, purge                                                          |
-| Active workspace `service` identity                | Only explicitly issued command families                                               | Credential maps to workspace+agent+session; agent enabled; session live; role/capability allowlist; token expiry/audience; DB recheck per command | Raw DB credentials, user/admin fallback, cross-workspace scope, command families absent from token and registry |
-| Enabled agent with live session                    | Agent commands matching its declared and policy-approved specialist role/capabilities | Exact workspace+agent+session binding, heartbeat/state, assignment target, lease, current decimal-string fence                                    | Ended/offline/degraded session where policy disallows; disabled agent; another assignment/session/fence         |
-| Mechanical Coordinator engine                      | Pure eligibility/order/expiry decisions from immutable snapshots                      | Complete workspace-local snapshot and policy revision                                                                                             | Authentication, ID loading, SQL, proof minting, scope invention, approval, certification, merge                 |
-| Coordinator persistence service                    | Service-only assignment/lease/checkpoint/recovery commands                            | Fresh transaction-local proof; locks; current assignment/approval/task/session/policy/fence                                                       | Public/user proof-by-value, stale approval/policy, direct completion/certification/merge                        |
-| Reviewer/SecReview/Certifier                       | Attributable evidence decisions allowed by gate policy                                | Active authority, author differs from reviewer, mandatory SecReview classification, immutable artifacts                                           | Self-review; missing evidence; Certifier merge/issue-close/release                                              |
-| Break-glass retention operator                     | Narrow, time-bounded purge procedure only                                             | Separate break-glass authority, reason, scope, approvals, immutable pre-purge evidence, semantic audit, post-action reconciliation                | Normal application role DELETE/UPDATE, bulk unscoped purge, unaudited hard delete                               |
-| Revoked/expired/disabled identity or ended session | None beyond policy-permitted public observation                                       | Revocation/lifecycle checked from PostgreSQL on every command                                                                                     | Cached token/Valkey state cannot preserve authority                                                             |
-
-**No-oracle rule:** authentication may return 401, but once authenticated, a foreign-workspace, nonexistent, inaccessible, or wrong-project identifier must follow the one KBN-105-frozen 404/403 policy with the same response shape and no foreign metadata, timing-derived detail, or WebSocket/MCP discrepancy.
-
-## 4. Threat matrix
-
-Every disposition is against the frozen target, not a claim about current-main behavior.
-
-| ID  | Attacker or failure                                                                     | Asset                                   | Precondition and abuse path                                                                                             | Frozen preventive/detective control                                                                                                                           | Required schema/API/negative-test evidence                                                                                                                                   | Future owner                     | Residual risk                                                       | Disposition                                                                          |
-| --- | --------------------------------------------------------------------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
-| T01 | Authenticated user supplies a foreign workspace/resource ID                             | Tenant confidentiality and integrity    | Caller knows or guesses project/task/mission/team IDs and probes REST, MCP, WebSocket, repository, or Coordinator paths | `workspace_id` on every canonical row; composite relations; server-derived tenant; uniform no-oracle denial                                                   | Composite FK/unique DDL; every repository predicate includes workspace; N100-01/02, N110-01..05, N130-01                                                                     | KBN-100, 105, 110, 130           | Timing/volume side channels require operational review              | Controlled after evidence                                                            |
-| T02 | Revoked or inactive member retains an old session                                       | Ownership and mutation authority        | Authentication remains valid after workspace membership revocation                                                      | Active membership rechecked in the authoritative transaction for owners, principals, proposers, and decision actors                                           | Active/inactive membership fixtures; N100-03, N110-06/07; no cached membership authority                                                                                     | KBN-100, 110                     | Better Auth session may remain valid for unrelated features         | Controlled after evidence                                                            |
-| T03 | User joins/forges a team relation outside its workspace                                 | Team-owned projects and tasks           | Global-current-main team behavior or a stale membership is reused                                                       | Team is intra-workspace only; workspace/team composites; active workspace membership precedes team authorization                                              | Cross-workspace team/member/owner insert and command denials; N100-04/05, N110-08                                                                                            | KBN-100, 110                     | Team-role policy mistakes remain possible                           | Controlled after evidence                                                            |
-| T04 | Same-workspace IDs from a different project are combined                                | Planning hierarchy integrity            | Valid mission/milestone/parent/current-milestone UUIDs are substituted                                                  | Project-congruent composite relations and serialized hierarchy validation                                                                                     | Mission/milestone/parent/current milestone mismatch and parent-cycle tests; N100-06..10, N110-09                                                                             | KBN-100, 110                     | Deep hierarchy checks can be expensive                              | Controlled after evidence                                                            |
-| T05 | Foreign or unrelated evidence/link/artifact IDs are attached                            | Review and audit truth                  | Caller has a valid same-workspace or foreign artifact UUID                                                              | Workspace-aware joins; immutable artifact digest/revision; semantic same-target validation in authoritative transaction                                       | Mixed-workspace and same-workspace wrong-task/mission checkpoint/approval evidence tests; N100-11..14, N210-15/16                                                            | KBN-100, 110, 210                | Same-workspace semantic validation is application-enforced          | Controlled after evidence                                                            |
-| T06 | Stolen, over-scoped, or replayed service token                                          | Coordinator and task mutation authority | Service credential is accepted as admin/user or claims are trusted without DB state                                     | Command-family least privilege; agent/session workspace binding; no raw DB credentials; enabled/live state checked per command                                | Auth registry fixtures prove audience/expiry/role/capability; revoked agent and ended session denials; N105-01, N110-10..13, N210-01/02                                      | KBN-105, 110, 210                | Credential theft until expiry/revocation check                      | Controlled after evidence                                                            |
-| T07 | Caller forges public `healthy` or replays a stale health response                       | Sole-writer/fail-closed invariant       | Public health body or caller field reaches mutation context                                                             | Public DTO is observation only; public DTOs reject proof/health fields; Gateway mints internal proof after live PG transaction probe                          | Contradictory union and forbidden-field tests; N105-02, N110-14..17                                                                                                          | KBN-105, 110, 140                | Health endpoint can still be used for reconnaissance                | Controlled after evidence                                                            |
-| T08 | Internal stale, wrong-policy, or wrong-transaction proof is reused                      | Transaction integrity                   | A branded value leaks or an adapter fails to revalidate it                                                              | Non-exported brand; transaction identity, `checkedAt <= now < validUntil`, and policy revision revalidated immediately before mutation                        | Wrong transaction, expiry boundary, future timestamp, policy mismatch, commit-after-expiry tests; N110-18..22                                                                | KBN-110, 140                     | In-process code can bypass TypeScript; runtime checks are mandatory | Controlled after evidence                                                            |
-| T09 | DB/transport uncertainty is mislabeled as deliberate denial or conflict                 | Safe retry and exactly-once result      | Timeout occurs before/after commit and client changes key or retries 503                                                | Exact 503/502/504/timeout/409 union; unknown outcome retries only with same idempotency key                                                                   | Exhaustive fixture mapping and commit-before-timeout replay; N105-03, N110-23..27, N120-01/02                                                                                | KBN-105, 110, 120, 140           | External client may ignore retry rules                              | Controlled after evidence                                                            |
-| T10 | Assignment payload forges task version, target agent/session, role, expiry, or proposer | Work routing authority                  | Lease service trusts command DTO rather than persisted assignment                                                       | Persisted assignment identity; exactly-one principal/proposer; exact agent/session composite; acquire accepts IDs then reloads+locks                          | Cross-workspace and same-workspace target substitutions, stale task version, invalid role, expired assignment; N100-15..18, N210-03..08                                      | KBN-100, 200, 210                | Compromised authorized proposer can make harmful proposals          | Controlled by approval/audit                                                         |
-| T11 | Approval proof is forged by value or borrowed from another assignment                   | Gate integrity                          | Caller submits `approved=true`, unrelated decision ID, stale policy, or self-approval                                   | Relational approval bound to assignment; lock/reload; policy revision; author≠reviewer and mandatory SecReview                                                | No proof-by-value DTO; wrong assignment/task/workspace/policy/actor/decision tests; N105-04, N210-09..14, N230-01                                                            | KBN-105, 210, 230                | Colluding principals remain an organizational risk                  | Controlled after evidence                                                            |
-| T12 | Revoked policy or expired proposal/assignment is raced against lease acquisition        | Routing policy                          | Approval and lease transactions do not lock/revalidate current rows                                                     | Lock assignment, approval, task, target session; compare current policy and expiry inside fresh-proof transaction                                             | Concurrent revoke/expire/acquire tests with one valid terminal result; N210-17..19                                                                                           | KBN-210, 230                     | Clock skew if DB time is not canonical                              | Controlled after evidence                                                            |
-| T13 | Stale worker sends ack/heartbeat/checkpoint/review after reassignment                   | Canonical task and evidence state       | Old process retains task/session IDs                                                                                    | Task-row-locked atomic monotonic bigint fence; every worker command carries exact lease/session/fence                                                         | Lower, expired, future, and other-task fences denied; old worker loses after new lease; N100-19/20, N210-20..24                                                              | KBN-100, 210, 230                | Signed bigint exhaustion is theoretical                             | Controlled after evidence                                                            |
-| T14 | JavaScript precision truncates a fence                                                  | Stale-worker exclusion                  | bigint token is serialized as number above `2^53-1`                                                                     | Drizzle bigint and decimal-string wire type only                                                                                                              | `9007199254740993` and near-`int8` boundary round trips; numeric JSON rejected; N105-05, N210-25                                                                             | KBN-105, 210                     | Nonconforming external clients                                      | Controlled after evidence                                                            |
-| T15 | Checkpoint/evidence from another lease/task/session is submitted                        | Recovery and certification evidence     | Same-workspace valid IDs are mixed                                                                                      | Exact lease composite binds workspace+task+assignment/session+fence; checkpoint composite binds lease+fence; evidence join plus semantic artifact-owner check | Same-workspace mismatched task/assignment/lease/session/checkpoint/artifact tests; N100-21..23, N210-26..31                                                                  | KBN-100, 210                     | Artifact URI target may disappear outside DB                        | Controlled with digest/retention                                                     |
-| T16 | Outage note or pending/rejected proposal mutates/orders work                            | Sole SOT and gate integrity             | Importer/UI treats note/proposal as task state                                                                          | Proposals are inert; only explicit accept invokes normal typed command after recovery                                                                         | Row/outbox/task counts unchanged for pending/rejected; no readiness/dependency/lease effect; N110-28..31                                                                     | KBN-110, 140                     | Humans may act outside Mosaic operationally                         | Accepted as attributable residual                                                    |
-| T17 | Submission event is missing, foreign, or for another proposal                           | Proposal audit chain                    | Caller supplies an existing event UUID                                                                                  | Preallocated proposal ID; event-first same transaction; workspace composite FK; exact event type/aggregate/version semantic check                             | Missing/foreign/wrong-type/wrong-proposal event rolls back event+proposal; N100-24/25, N110-32..36                                                                           | KBN-100, 110                     | Semantic checks are transaction code, not only FK                   | Controlled after evidence                                                            |
-| T18 | Acceptance borrows an unrelated command event                                           | Proposal and target integrity           | Same-workspace event exists for another target/command/proposal                                                         | Accept locks proposal+target, executes normal command, requires workspace/target match, causation=submission event, payload proposal ID                       | Foreign, wrong target/type/command/causation/payload event aborts target/event/proposal atomically; N100-26, N110-37..43                                                     | KBN-100, 110                     | Event payload schema drift                                          | Controlled by KBN-105 fixtures                                                       |
-| T19 | Application role updates/deletes audit, approval evidence, checkpoint, or artifact      | Nonrepudiation                          | Broad DB grants or parent cascade exists                                                                                | INSERT/SELECT-only application roles; RESTRICT parent deletes; archive/cancel normal lifecycle                                                                | Role-level UPDATE/DELETE denied; parent delete RESTRICT; digest unchanged; N100-27..31                                                                                       | KBN-100                          | DB superuser can alter state                                        | Break-glass/infra audit residual                                                     |
-| T20 | Break-glass purge is used as routine deletion or erases its own evidence                | Retention and incident forensics        | Elevated credential available                                                                                           | Separate audited retention procedure, bounded scope, reason, pre/post evidence, authority separation                                                          | Normal role denied; expired/missing approval denied; purge cannot delete its authorizing audit package; N115-01, N230-02/03                                                  | KBN-115, 230                     | Privileged DBA compromise                                           | Accepted operational residual                                                        |
-| T21 | PostgreSQL unavailable or partitioned                                                   | Canonical state                         | Public health/Valkey remains live while transaction probe fails                                                         | Fail closed; no alternate writer/hidden queue; 503 only for proven not-applied; transport uncertainty remains unknown                                         | Fault injection proves DB rows/outbox/files/Valkey unchanged on deliberate denial; commit-unknown replay; N110-44..48, N140-01                                               | KBN-110, 140, 230                | Availability loss is intentional                                    | Accepted by Option A                                                                 |
-| T22 | Valkey unavailable, duplicated, stale, or partitioned                                   | Scheduling notifications                | Queue wake is treated as truth or publication fails                                                                     | Valkey derived/expendable; transactional outbox in PG; idempotent publisher; recovery from PG                                                                 | Commit with Valkey down leaves pending outbox; replay publishes once logically; stale wake reloads PG; N110-49, N140-02, N230-04..06                                         | KBN-110, 210, 230                | Duplicate at-least-once delivery                                    | Consumers must be idempotent                                                         |
-| T23 | Coordinator restarts between assignment, lease, checkpoint, or outbox steps             | Durable orchestration truth             | Process-local cache is treated as authority                                                                             | PostgreSQL stores assignments, execution state, leases, fences, checkpoints, events, outbox; `recoverFromPostgres`                                            | Restart at every transaction boundary reconstructs identical active/expired/pending sets without Valkey/files; N210-32..36, N230-07                                          | KBN-210, 230                     | Recovery latency                                                    | Controlled after evidence                                                            |
-| T24 | Dependency cycle or concurrent reciprocal edge                                          | Readiness and dispatch safety           | Two transactions each see an acyclic graph before inserting                                                             | Unique directed edge; no self-edge; serialized recursive cycle check; readiness evaluates all blockers                                                        | Self/duplicate/cycle and concurrent A→B/B→A tests; all predecessor property test; N100-32..35, N200-01/02                                                                    | KBN-100, 200, 230                | Very large DAG performance                                          | Bounded operational residual                                                         |
-| T25 | Parent-task cycle or project-incongruent relation                                       | Planning hierarchy                      | Valid same-workspace IDs are arranged into an invalid tree                                                              | Project-congruent composites; serialized parent-cycle/orphan validation required by REQ-PLAN-001                                                              | Self/indirect parent cycle, orphan, and cross-project mission/milestone/parent tests; N100-06..10                                                                            | KBN-100, 110                     | Cycle validation is service/transaction enforced                    | Controlled after evidence                                                            |
-| T26 | Concurrent update, duplicate retry, or idempotency payload drift                        | Aggregate consistency                   | Two clients use same version/key with different payloads                                                                | Expected-version check; semantic event and outbox in same transaction; key returns prior immutable result only for identical command                          | One update wins; stale gets 409; duplicate identical returns prior; payload drift rejected; N110-50..54, N140-03                                                             | KBN-105, 110, 140                | Long-lived clients face visible conflicts                           | Intentional user-visible residual                                                    |
-| T27 | State/event/outbox partial commit                                                       | Audit and notification consistency      | Separate transactions or exception after state write                                                                    | One PostgreSQL transaction for state+semantic event+outbox                                                                                                    | Failure injected after each insert rolls all three back; success revisions align; N110-55..58                                                                                | KBN-110, 140                     | Outbox publication remains asynchronous                             | Controlled after evidence                                                            |
-| T28 | Malicious/incorrect importer injects foreign workspace data or dispatchable work        | Migration integrity                     | Source keys collide, lineage is absent, or importer has direct DB authority                                             | Immutable source snapshots/checksums; one-way Gateway/migration-only port; workspace-safe idempotent modes; shadow records cannot dispatch                    | Foreign/malformed/duplicate/partial-resume/lineage checksum and no-dispatch tests; N300-01..08                                                                               | KBN-300, 330                     | Source data may be semantically ambiguous                           | Quarantine and owner sign-off                                                        |
-| T29 | Cutover leaves legacy writer or forward/reverse sync active                             | Sole-writer invariant                   | Credentials/processes survive switch or rollback is improvised                                                          | Writer inventory, freeze, final delta, Gateway switch, credential shutdown, no dual write; rollback authority changes after first DB mutation                 | Process/credential inventory; concurrent-writer assertion; before/after-mutation rollback rehearsal; N320-01..06, N330-01                                                    | KBN-320, 330, 340                | Missed external automation                                          | Owner-gated residual                                                                 |
-| T30 | Generated `TASKS.md`/`mission.json` is edited or parsed into DB                         | Canonical state                         | Current-main parser/writer remains reachable or file watcher imports changes                                            | Generated non-authoritative header/IDs/time/revision; no production importer; regenerate/overwrite only                                                       | Static import search, tamper/regeneration, read-only permission, source-revision parity; N120-03..07, N140-04                                                                | KBN-120, 140                     | Humans may mistake snapshots for live data                          | Header and docs mitigate                                                             |
-| T31 | N-1 compatibility copies legacy ambiguity into canonical authority                      | Data integrity                          | Nullable/global/current-main fields are guessed during backfill                                                         | Nullable-first expand; deterministic mapping or quarantine; checksums; no new-only status before switch; legacy fields retained                               | Production-shape, ambiguous owner/assignee, status shadow, JSON/config/digest, rollback tests; N100-36..44                                                                   | KBN-100                          | Quarantined records require human decision                          | Controlled by signed reconciliation                                                  |
-| T32 | Recovery posture claims durability not provided by mechanisms                           | Availability and audit retention        | Shape-only validation or optimistic RPO is accepted                                                                     | Normative validator; WAL/PITR/RPO/storage/high-assurance constraints; mechanism and restore evidence                                                          | Unknown/impossible/weakened configuration plus actual mechanism/restore tests; N115-02..08                                                                                   | KBN-115                          | Backup operator or storage compromise                               | Separate failure domain residual                                                     |
-| T33 | rc.3 frozen DDL could not create mission-scoped evidence/approval FKs                   | Tenant/evidence relational integrity    | KBN-100 generated DDL from the rc.3 contract without an exact composite candidate key                                   | rc.4 adds non-partial `missions_workspace_id_uidx(workspace_id,id)` before both dependent FKs while retaining global and project-congruent keys               | KBN-100 must execute N100-45..50: exact-key reconciliation, candidate-before-FKs, duplicate feasibility, empty/prod/N-1/rollback, and both-child foreign-workspace negatives | KBN-100 after PR/CI/#753 release | Runtime DDL remains unimplemented and must prove the frozen order   | **Resolved by rc.4 + independent APPROVE; implementation evidence remains required** |
-
-## 5. Constraint-impact matrix
-
-| Impact ID | Required invariant                          | Frozen schema impact                                                                                          | API/transaction impact                                                                                 | Required evidence                                                                                                                             | Owner                            | Status                                                                            |
-| --------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- | --------------------------------------------------------------------------------- |
-| CI-01     | Hard workspace tenancy and no oracle        | `workspace_id`, workspace-aware unique/FKs on all canonical rows                                              | Server-derived workspace; uniform denial on all surfaces                                               | N100-01..14; N110-01..09; N130-01                                                                                                             | KBN-100/105/110/130              | Resolved by frozen controls                                                       |
-| CI-02     | Active user membership                      | Membership row plus unique `(workspace_id,user_id)`; active state retained                                    | Recheck active membership in same authoritative transaction                                            | N100-03; N110-06/07                                                                                                                           | KBN-100/110                      | Resolved; not FK-only                                                             |
-| CI-03     | Service identity least privilege/revocation | Agent/session workspace, lifecycle, state, roles, capabilities                                                | Token maps to exact agent/session; command-family allowlist; DB recheck; no admin/raw DB fallback      | N105-01; N110-10..13; N210-01/02                                                                                                              | KBN-105/110/210                  | Resolved at auth/API layer                                                        |
-| CI-04     | Project-congruent hierarchy                 | Composite project/mission/milestone/parent/current-milestone relations                                        | Lock/serialized parent-cycle and orphan validation                                                     | N100-06..10                                                                                                                                   | KBN-100/110                      | Resolved; cycle behavior required                                                 |
-| CI-05     | Health-proof authority                      | Internal branded proof has transaction/time/policy fields                                                     | Probe and revalidate on same PG transaction; no public field                                           | N105-02/03; N110-14..27                                                                                                                       | KBN-105/110                      | Resolved by frozen controls                                                       |
-| CI-06     | Assignment/approval identity                | Exactly-one principal/proposer, exact agent/session assignment, relational approval                           | Reload+lock all IDs; compare version/target/state/expiry/policy/decision                               | N100-15..18; N210-03..19                                                                                                                      | KBN-100/210                      | Resolved by frozen controls                                                       |
-| CI-07     | Monotonic bigint fencing                    | Durable bigint counter, exact lease/fence keys, one active lease                                              | Atomic increment/RETURNING; decimal-string DTO; reject every stale worker command                      | N100-19..23; N210-20..31                                                                                                                      | KBN-100/105/210                  | Resolved by frozen controls                                                       |
-| CI-08     | Proposal event chain                        | Both workspace-aware event FKs; event table created first                                                     | Exact submission/acceptance semantic checks in one transaction                                         | N100-24..26; N110-28..43                                                                                                                      | KBN-100/110                      | Resolved; semantic checks not FK-only                                             |
-| CI-09     | Immutable audit/evidence retention          | RESTRICT parents; INSERT/SELECT-only immutable tables                                                         | Archive/cancel normal flow; separately authorized purge                                                | N100-27..31; N115-01; N230-02/03                                                                                                              | KBN-100/115/230                  | Resolved by frozen controls                                                       |
-| CI-10     | DB/Valkey/outbox/restart semantics          | PG outbox and durable orchestration rows                                                                      | Fail closed; same-key uncertainty retry; Valkey reloads PG; restart from PG                            | N110-44..49; N140-01/02; N230-04..07                                                                                                          | KBN-110/210/230                  | Resolved by frozen controls                                                       |
-| CI-11     | DAG/race/idempotency/version                | Unique edge; self check; event idempotency; aggregate versions                                                | Serialized recursive cycle check; payload binding; expected-version conflict                           | N100-32..35; N110-50..58; N200-01/02                                                                                                          | KBN-100/110/200                  | Resolved by frozen controls                                                       |
-| CI-12     | Import/cutover trust boundary               | Lineage/artifact/event fields; shadow state cannot dispatch                                                   | One-way scoped importer, freeze, no direct DB/file authority, no dual writer                           | N300-01..08; N320-01..06                                                                                                                      | KBN-300/320/330                  | Resolved by frozen controls                                                       |
-| CI-13     | Generated-file no-import                    | No canonical file schema/import contract                                                                      | Projection-only package; static reachability check removes current parser from production Kanban paths | N120-03..07; N140-04                                                                                                                          | KBN-120/140                      | Resolved by frozen controls                                                       |
-| CI-14     | Mission-scoped artifact and approval FKs    | rc.4 adds non-partial `missions_workspace_id_uidx(workspace_id,id)` and retains global/project-congruent keys | KBN-100 must emit the candidate before both exact RESTRICT FKs and preserve N-1/rollback order         | N100-45..50: exact reconciliation, duplicate feasibility, empty/prod/N-1/rollback, and separate artifact/approval foreign-workspace negatives | KBN-100 after PR/CI/#753 release | **Resolved by rc.4 and independent APPROVE; future executable evidence required** |
-
-## 6. Exact future negative-test catalog
-
-These names are normative evidence identifiers for future slices. Equivalent test-file names are acceptable only if traceability retains these IDs and expected outcomes.
-
-### KBN-100 — schema and migration
-
-- **N100-01** reject every canonical child row whose `workspace_id` differs from its parent.
-- **N100-02** reject foreign-workspace link, artifact, proposal target, dependency, assignment, lease, checkpoint, approval, and event relationships.
-- **N100-03** reject an inactive/revoked member as accountable owner, proposer, decision actor, archive actor, or user principal in the authoritative command transaction.
-- **N100-04** reject a team/project relation crossing workspaces.
-- **N100-05** reject a team authorization path when the user lacks active membership in the team's workspace.
-- **N100-06** reject task→mission project mismatch.
-- **N100-07** reject task→milestone and project→current-milestone project mismatch.
-- **N100-08** reject task→parent project mismatch and self-parent.
-- **N100-09** reject indirect parent cycles under concurrent transactions.
-- **N100-10** reject mission→milestone project mismatch/orphan.
-- **N100-11** reject checkpoint artifact from another workspace.
-- **N100-12** reject checkpoint artifact owned by another same-workspace task/mission unless an explicitly frozen evidence rule permits it.
-- **N100-13** reject approval evidence from another workspace.
-- **N100-14** reject same-workspace approval evidence unrelated to the approval target.
-- **N100-15** reject zero/multiple assignment principals and zero/multiple proposers.
-- **N100-16** reject target session without its exact target agent.
-- **N100-17** reject assignment task/agent/session crossing workspaces.
-- **N100-18** reject non-positive task version and expired assignment acquisition.
-- **N100-19** concurrent lease insert permits one active lease and returns one winner.
-- **N100-20** successive leases return strictly increasing bigint fences.
-- **N100-21** reject checkpoint with another task, lease, or fence.
-- **N100-22** reject duplicate/non-monotonic checkpoint sequence.
-- **N100-23** reject evidence join for a mismatched checkpoint/task.
-- **N100-24** proposal insert without exact submission event fails atomically.
-- **N100-25** foreign/wrong-type/wrong-proposal submission event fails atomically.
-- **N100-26** foreign/wrong-target/unrelated acceptance event fails atomically.
-- **N100-27** application role cannot UPDATE/DELETE `task_events`.
-- **N100-28** application role cannot UPDATE/DELETE checkpoints/artifacts/evidence joins.
-- **N100-29** parent hard delete is RESTRICTed while audit/evidence children exist.
-- **N100-30** archive does not alter canonical lifecycle status.
-- **N100-31** purge without break-glass authority/evidence is denied.
-- **N100-32** reject dependency self-edge and duplicate directed pair regardless of type.
-- **N100-33** reject direct and indirect dependency cycles.
-- **N100-34** concurrent reciprocal dependency inserts cannot both commit.
-- **N100-35** readiness remains false until every blocking predecessor and completion condition passes.
-- **N100-36** empty DB migration succeeds after the contract amendment.
-- **N100-37** production-shape expand retains all legacy declarations.
-- **N100-38** crash/resume backfill is idempotent and checksum-stable.
-- **N100-39** ambiguous workspace/owner/assignee is quarantined, never guessed.
-- **N100-40** no `ready`/`in_review` status is emitted to N-1 readers before switch.
-- **N100-41** `mission_tasks.status` cannot remain a write source.
-- **N100-42** tags/assignee/date/mission JSON/config/description/agent fields reconcile without loss.
-- **N100-43** claimed fleet backlog rows are quarantined and imported rows cannot dispatch.
-- **N100-44** pre-switch rollback works while post-first-mutation rollback requires freeze/reconciliation.
-- **N100-45** reconcile both exact child FK column lists to the rc.4 `(workspace_id,id)` mission candidate while retaining the global `id` primary key and `(workspace_id,project_id,id)` key.
-- **N100-46** empty-DB migration creates `missions_workspace_id_uidx` before `artifacts_workspace_mission_fk` and `approval_decisions_workspace_mission_fk`.
-- **N100-47** production-shape preflight finds no duplicate `(workspace_id,id)` groups, preserves global `id` uniqueness, and applies the candidate before both dependent FKs.
-- **N100-48** N-1 startup/read/write remains unchanged; pre-switch rollback drops both dependents before the candidate and preserves the global/project-congruent keys.
-- **N100-49** artifact insert using a valid mission ID paired with a foreign workspace fails before commit.
-- **N100-50** approval-decision insert using a valid mission ID paired with a foreign workspace fails before commit.
-
-### KBN-105/KBN-110/KBN-120/KBN-130/KBN-140 — API and P1
-
-- **N105-01** every route has an explicit user/service command-family policy; user/admin tokens cannot call service-only Coordinator mutations.
-- **N105-02** public DTO validation rejects `writeProof`, internal context, body `workspaceId`, and caller-asserted health.
-- **N105-03** fixture exhaustiveness prevents 503, 502/504/timeout, and 409 cross-mapping.
-- **N105-04** approval DTO accepts an ID and decision command only, never approval proof-by-value.
-- **N105-05** all fence fields accept/emit decimal strings and reject JSON numbers.
-- **N110-01** listing with a foreign `workspaceId` or foreign filter ID follows the frozen no-oracle denial and returns no rows/counts/cursors.
-- **N110-02** get by foreign or nonexistent aggregate ID has the same frozen denial shape and no foreign metadata.
-- **N110-03** create/update/archive with a foreign owner, parent, project, mission, milestone, tag, or target ID is denied before mutation.
-- **N110-04** dependency/proposal commands with foreign target IDs are denied with unchanged state/event/outbox counts.
-- **N110-05** REST, MCP, WebSocket, and internal Coordinator paths produce equivalent no-oracle behavior for the same foreign ID.
-- **N110-06** a revoked/inactive owner is denied even with a still-valid Better Auth session.
-- **N110-07** stale membership/team cache cannot authorize a proposer, decision actor, archive actor, or principal after revocation.
-- **N110-08** a team ID from another workspace cannot authorize or own the command target.
-- **N110-09** same-workspace but wrong-project mission/milestone/parent IDs are denied inside the transaction.
-- **N110-10** an expired service token is denied before repository access.
-- **N110-11** an audience- or workspace-mismatched service token is denied without an existence oracle.
-- **N110-12** an over-scoped service token cannot call a command family absent from its role/capability allowlist.
-- **N110-13** disabled agent or ended session revokes service-token command authority immediately on PostgreSQL recheck.
-- **N110-14** contradictory public health state/boolean combinations fail validation.
-- **N110-15** Valkey-only liveness cannot mint or substitute a PostgreSQL write proof.
-- **N110-16** caller-forged public `healthy` cannot enter internal mutation context.
-- **N110-17** public REST/MCP/CLI bodies containing health/proof fields are rejected.
-- **N110-18** an expired internal proof produces no state/event/outbox write.
-- **N110-19** a future-dated or not-yet-valid proof produces no write.
-- **N110-20** a policy-revision-mismatched proof produces no write.
-- **N110-21** a proof minted on another transaction/connection produces no write.
-- **N110-22** a proof that expires before the final pre-mutation check produces no write.
-- **N110-23** deliberate read-only/write-unavailable denial maps only to authoritative 503/not-applied/non-retryable.
-- **N110-24** timeout before commit maps to transport-unknown and permits only same-key retry.
-- **N110-25** timeout after commit maps to transport-unknown and same-key retry returns the committed canonical result once.
-- **N110-26** expected-version mismatch maps only to 409/not-applied/non-retryable.
-- **N110-27** recovery replay with a changed idempotency key cannot masquerade as the original uncertain request.
-- **N110-28** pending proposal cannot alter target fields/status/rank/version.
-- **N110-29** rejected proposal cannot affect readiness, dependencies, or gates.
-- **N110-30** pending/rejected proposal cannot create an assignment or lease.
-- **N110-31** direct proposal-row state manipulation cannot bypass normal command execution.
-- **N110-32** proposal submission without a submission event rolls back fully.
-- **N110-33** foreign-workspace submission event rolls back fully.
-- **N110-34** wrong aggregate/event type submission event rolls back fully.
-- **N110-35** same-workspace event for another proposal rolls back fully.
-- **N110-36** submission event with wrong previous/new version semantics rolls back fully.
-- **N110-37** foreign-workspace acceptance event rolls back proposal, target, event, and outbox.
-- **N110-38** same-workspace event for another target aggregate rolls back acceptance.
-- **N110-39** event from an unrelated normal command rolls back acceptance.
-- **N110-40** event caused by a different submission event rolls back acceptance.
-- **N110-41** event whose payload lacks or changes `changeProposalId` rolls back acceptance.
-- **N110-42** event for another proposal with the same target/command rolls back acceptance.
-- **N110-43** missing accepted-command event after target handling rolls back the entire transaction.
-- **N110-44** read-only-degraded denial changes no DB row/outbox/file/Valkey/provider state.
-- **N110-45** write-unavailable denial changes no DB row/outbox/file/Valkey/provider state.
-- **N110-46** PostgreSQL disconnect cannot redirect a command to any fallback writer.
-- **N110-47** commit uncertainty remains `unknown` and never becomes a fabricated 503/not-applied result.
-- **N110-48** same-key replay after recovery returns one canonical result with no duplicate event/outbox row.
-- **N110-49** Valkey publication failure leaves committed PG outbox pending and replayable.
-- **N110-50** two same-version updates produce one winner and one visible 409 loser.
-- **N110-51** identical duplicate key+payload returns the prior immutable result without another event/outbox row.
-- **N110-52** same key with payload/command drift is rejected as an idempotency conflict.
-- **N110-53** the same key in another workspace cannot reveal or reuse the first workspace's result.
-- **N110-54** stale reconnect/update cannot silently overwrite a newer aggregate revision.
-- **N110-55** failure after state write but before semantic event rolls back state.
-- **N110-56** failure after semantic event but before outbox rolls back state and event.
-- **N110-57** failure after outbox insert but before commit rolls back state, event, and outbox.
-- **N110-58** success commits matching aggregate/event/outbox revisions and correlation/causation.
-- **N120-01** CLI never retries an authoritative 503 deliberate denial.
-- **N120-02** CLI retries only transport-unknown outcomes and preserves the exact idempotency key.
-- **N120-03** generated projection header contains non-authoritative warning, workspace/project IDs, generated time, and source revision.
-- **N120-04** projection revision and records match the API snapshot revision exactly.
-- **N120-05** hand-tampering is overwritten or rejected by regeneration and never mutates PostgreSQL.
-- **N120-06** static/runtime reachability finds no parser/import path from `TASKS.md`, `mission.json`, or another export.
-- **N120-07** projection writer has no domain mutation/raw SQL/Valkey authority.
-- **N130-01** UI foreign/no-access/not-found state follows the frozen no-oracle response and renders no stale foreign data.
-- **N140-01** real-Gateway DB fault journey proves fail-closed no-fallback behavior.
-- **N140-02** real-Gateway Valkey-loss journey proves pending outbox replay.
-- **N140-03** real-Gateway concurrent update/retry journey proves version and idempotency semantics.
-- **N140-04** generated-file tamper journey proves projection parity and no import.
-
-### KBN-115/KBN-200/KBN-210/KBN-230 — recovery and coordination
-
-- **N115-01** retention purge without current break-glass authority, reason, immutable evidence, or bounded scope is denied and audited.
-- **N115-02** recovery posture with an unknown top-level or storage field is rejected.
-- **N115-03** PITR retention without WAL archival is rejected.
-- **N115-04** WAL archival with zero PITR retention is rejected.
-- **N115-05** claimed RPO better than the configured backup/WAL mechanism is rejected.
-- **N115-06** unencrypted, optional, or same-failure-domain storage is rejected.
-- **N115-07** weakened high-assurance values are rejected.
-- **N115-08** shape-only validation cannot pass without normative mechanism and restore evidence.
-- **N200-01** cyclic/incomplete dependency snapshots never become eligible.
-- **N200-02** identical immutable snapshot+policy+time returns identical ordering and explanation with no I/O/model import.
-- **N210-01** disabled agent cannot claim, ack, heartbeat, checkpoint, or submit review.
-- **N210-02** ended/offline/mismatched session cannot claim, ack, heartbeat, checkpoint, or submit review.
-- **N210-03** foreign-workspace task is rejected after lock/reload without an oracle.
-- **N210-04** stale task version is rejected before fence increment.
-- **N210-05** assignment target agent mismatch is rejected.
-- **N210-06** target session mismatch is rejected.
-- **N210-07** expired assignment is rejected.
-- **N210-08** assignment in rejected/released/expired/superseded/leased-invalid state is rejected.
-- **N210-09** missing approval is rejected.
-- **N210-10** rejected/escalated/requested approval is rejected as approval authority.
-- **N210-11** stale policy-revision approval is rejected.
-- **N210-12** foreign-workspace approval is rejected without an oracle.
-- **N210-13** approval for another assignment is rejected.
-- **N210-14** author self-approval/review is rejected when independence is required.
-- **N210-15** foreign-workspace artifact evidence is rejected.
-- **N210-16** same-workspace artifact unrelated to the assignment/task/gate is rejected.
-- **N210-17** concurrent policy revocation versus acquire cannot produce a lease under the revoked revision.
-- **N210-18** concurrent assignment expiry versus acquire cannot produce a lease after expiry.
-- **N210-19** concurrent session end versus acquire cannot produce a lease for the ended session.
-- **N210-20** lower fencing token is rejected without writes.
-- **N210-21** token from an older lease is rejected without writes.
-- **N210-22** token paired with another task is rejected without writes.
-- **N210-23** token paired with another session is rejected without writes.
-- **N210-24** token on an expired/revoked/released lease is rejected without writes.
-- **N210-25** fences above JavaScript safe integer round-trip exactly as decimal strings.
-- **N210-26** lease task does not match assignment task and is rejected.
-- **N210-27** lease agent/session does not match assignment target and is rejected.
-- **N210-28** checkpoint task does not match lease task and is rejected.
-- **N210-29** checkpoint fence does not match exact lease fence and is rejected.
-- **N210-30** checkpoint sequence duplicate/regression is rejected.
-- **N210-31** checkpoint artifact does not match workspace/task/evidence semantics and is rejected.
-- **N210-32** restart after assignment persistence reconstructs the pending assignment.
-- **N210-33** restart after lease commit reconstructs exact active lease and fence.
-- **N210-34** restart after checkpoint commit reconstructs checkpoint/recovery state.
-- **N210-35** restart during expiry/retry/quarantine reconstructs durable disposition and eligibility.
-- **N210-36** restart with pending outbox reconstructs publication work without Valkey/files.
-- **N230-01** author=self-review and missing mandatory SecReview cannot certify or complete.
-- **N230-02** normal application role cannot execute retention purge.
-- **N230-03** break-glass purge cannot delete or alter its own authorization/evidence chain.
-- **N230-04** Valkey down leaves canonical work in PostgreSQL/outbox.
-- **N230-05** duplicate wake produces one logical effect after PostgreSQL reload/idempotency.
-- **N230-06** stale wake cannot revive an expired/revoked assignment or lease.
-- **N230-07** restart with no Valkey/files reconstructs leases/retry/quarantine/outbox exactly.
-
-### KBN-300/KBN-320/KBN-330/KBN-340 — migration and cutover
-
-- **N300-01** source record targeting another workspace is denied/quarantined without an oracle.
-- **N300-02** malformed source record is rejected with attributable reject evidence.
-- **N300-03** duplicate source system/key/batch replay is idempotent.
-- **N300-04** source snapshot/checksum drift aborts apply/verify.
-- **N300-05** partial import resumes from durable lineage without duplicating state/events.
-- **N300-06** imported shadow record cannot become ready, assigned, or leased automatically.
-- **N300-07** missing source key/file/checksum/batch lineage prevents apply/sign-off.
-- **N300-08** importer cannot use direct DB, generated file, Valkey, or provider issue as canonical write authority.
-- **N320-01** cutover without a verified write freeze fails safe.
-- **N320-02** active legacy writer process or credential blocks cutover.
-- **N320-03** reverse and forward synchronization cannot run concurrently.
-- **N320-04** failed final delta/reconciliation blocks client switch.
-- **N320-05** rollback before first canonical DB mutation may switch authority back only after freeze assertion.
-- **N320-06** rollback after first canonical mutation requires freeze, DB-delta export/reconciliation, and owner decision.
-- **N330-01** rehearsal cannot sign off while counts/checksums/exceptions/writer inventory differ.
-- **N340-01** cutover cannot proceed without owner authorization, terminal evidence, scoped identities, and zero active legacy writers.
-
-## 7. Requirements traceability
-
-| Requirement      | Threats/impacts              | Planned evidence                                                |
-| ---------------- | ---------------------------- | --------------------------------------------------------------- |
-| REQ-SOT-001      | T16, T21, T22, T27, T29, T30 | N110-28..31, N110-44..49, N110-55..58, N120-03..07, N320-01..06 |
-| REQ-SOT-002      | T07, T08, T09, T21           | N105-02/03, N110-14..27, N110-44..48                            |
-| REQ-SOT-003      | T30                          | N120-03..07, N140-04                                            |
-| REQ-SOT-004      | T16..18                      | N100-24..26, N110-28..43                                        |
-| REQ-TEN-001      | T01..05, T15, T33            | N100-01..14, N100-45..50, N110-01..09, N210-15/16               |
-| REQ-ID-001       | T02, T03, T06, T10..12       | N105-01, N110-06..13, N210-01..19                               |
-| REQ-PLAN-001     | T04, T25                     | N100-06..10                                                     |
-| REQ-TASK-001     | T13, T26, T31                | N100-20, N100-37..42, N110-50..54                               |
-| REQ-TASK-002     | T16, T24                     | N110-28..31, N100-35, N200-01                                   |
-| REQ-DEP-001      | T24                          | N100-32..35, N200-01                                            |
-| REQ-ASN-001      | T10..12                      | N100-15..18, N210-03..19                                        |
-| REQ-AUD-001      | T17..20, T22, T27            | N100-24..31, N110-32..43, N110-49, N110-55..58                  |
-| REQ-API-001      | T01, T06..18, T26            | N105-01..05 plus KBN-110 catalog                                |
-| REQ-UI-002/003   | T01, T15, T26                | N130-01 and real-Gateway KBN-140 journeys                       |
-| REQ-COORD-001    | T22..24                      | N200-01/02, N210-32..36                                         |
-| REQ-COORD-002    | T10..12, T16                 | N210-03..19, N110-28..31                                        |
-| REQ-COORD-003    | T13..15, T23                 | N100-19..23, N210-20..36                                        |
-| REQ-COORD-004    | T23, T26                     | N210-32..36, N230-07                                            |
-| REQ-GATE-001/002 | T11, T19, T20                | N210-09..14, N230-01..03                                        |
-| REQ-REC-001      | T20, T32                     | N115-01..08                                                     |
-| REQ-MIG-001/002  | T28, T29, T31                | N100-37..44, N300-01..08, N320-01..06, N330-01, N340-01         |
-
-REQ-UI-001 and REQ-UI-004 are downstream functional/accessibility requirements rather than schema-threat controls; they remain owned by KBN-130/KBN-140. Their security-relevant tenancy, conflict, and stale-reconnect portions are covered above.
-
-## 8. Issue #753 acceptance mapping
-
-| Issue requirement/criterion                                     | Evidence in this document                           | Result                                         |
-| --------------------------------------------------------------- | --------------------------------------------------- | ---------------------------------------------- |
-| Cross-workspace owners, principals, evidence, project hierarchy | T01–T05, T15, T25; CI-01–04                         | Mapped                                         |
-| Active membership and service-token boundaries                  | Authorization matrix; T02, T03, T06; CI-02/03       | Mapped                                         |
-| Stale/forged health and transaction-local proof                 | T07–T09, T21; CI-05                                 | Mapped                                         |
-| Assignment/approval forgery and monotonic fencing               | T10–T15; CI-06/07                                   | Mapped                                         |
-| Change-proposal abuse and event binding                         | T16–T18; CI-08                                      | Mapped                                         |
-| Immutable audit and break-glass                                 | T19/T20; CI-09                                      | Mapped                                         |
-| PostgreSQL/Valkey failures                                      | T21–T23; CI-10                                      | Mapped                                         |
-| Dependency/idempotency/version races                            | T24–T27; CI-11                                      | Mapped                                         |
-| Import/cutover and generated-file boundary                      | T28–T31; CI-12/13                                   | Mapped                                         |
-| Every schema/API/test impact explicit                           | Constraint matrix and negative-test catalog         | Mapped                                         |
-| No unresolved schema impact                                     | CI-14; rc.4 resolved-impact record                  | **PASS — none unresolved**                     |
-| Independent SecReview                                           | Homelab non-author exact commit/tree/content review | **PASS / APPROVE**                             |
-| PR merge, terminal-green main CI, and #753 closure              | Orchestrator-owned post-worker gates                | Pending; KBN-100 remains held until completion |
-
-## 9. UNRESOLVED SCHEMA IMPACTS
-
-none
-
-### Resolved-impact record — KBN010-SI-001
-
-- **Historical detection:** rc.3 lacked an exact `(workspace_id,id)` candidate key for the artifact and approval-decision mission FKs. This document's original BLOCKED verdict was correct and remains preserved in §1 and T33.
-- **Resolution:** rc.4 adds non-partial `missions_workspace_id_uidx(workspace_id,id)` before both exact dependent FKs while retaining the global primary key and project-congruent key.
-- **Reviewed object:** commit `3f6a3387b419eb99453ee10dd25ba888faaab0b5`, tree `7ebab8fa530a7180036928cea9527f808548aa14`.
-- **Corroborating identities:** full-index SHA-256 `6b40a76265c4f3e6d1d30a7f262a2dd16e0d51997e99c146b59f527e6524cd42`; stable patch-id `058cf98026fcd1043703c866aee047c8bb144740`.
-- **Independent verdict:** Homelab non-author schema/security review **APPROVE**. It confirmed PostgreSQL candidate/FK validity, unchanged tenant and polymorphic exactly-one-target safety, RESTRICT/no-cascade semantics, N-1/rollback validity, and no shared table/index/FK/identity/fence authority collision with #757.
-- **Digest interpretation:** a command-rendered patch digest varied with rendering command/options and is non-authoritative. Git commit + tree + exact file content are canonical; stable full-index SHA-256 and stable patch-id corroborate that identity.
-- **Residual implementation obligations:** KBN-100 must create the candidate before both dependent FKs; prove production-shape duplicate feasibility without weakening global uniqueness; pass empty/prod/N-1/rollback tests; reconcile both exact FK targets; and separately reject foreign-workspace mission references for artifacts and approval decisions (N100-45..50).
-- **Implementation status:** no runtime schema, migration, API, or deployment implementation is claimed by this gate disposition.
-
-## 10. Residual risk and handoff
-
-- Active membership, polymorphic targets, same-task evidence semantics, parent/DAG cycle checks, token scope, and no-oracle behavior depend on authoritative transaction code and must not be treated as FK-only guarantees.
-- DB superuser and break-glass compromise cannot be eliminated by application constraints; separation of duties, immutable external backup/audit evidence, drills, and monitoring remain required.
-- PostgreSQL unavailability intentionally sacrifices writes for integrity. Transport-unknown outcomes remain safe only when clients preserve the exact idempotency key.
-- Imported ambiguous records remain quarantined until owner sign-off; no automated mapping may convert ambiguity into authority.
-- SI-001 is resolved at frozen contract/design-review level only. KBN-100 still owes N100-45..50 executable migration evidence.
-
-**Handoff status:** KBN-010 **PASS / GO** at rc.4. KBN-100 remains held until this PR squash-merges, terminal-green CI completes on `main`, and issue #753 closes; the orchestrator owns those remaining gates.

docs/native-kanban-sot/MISSION-MANIFEST.md

@@ -1,195 +0,0 @@
-# Mission Manifest — Mosaic Native Kanban and Canonical Task SOT P0–P3
-
-**Mission status:** CANON INDEPENDENTLY APPROVED; publication in progress under issue [#751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)
-**Date:** 2026-07-14
-**Human decision owner:** Jason
-**Orchestrator/publication owner:** web1 control plane (`mos-claude`; `mosaic-100` acting during Claude quota outage)
-**Execution topology:** USC web1, partitioned across collision-free GPT coder2/3/4/5 lanes
-**Canonical requirements:** [`../requirements/native-kanban-sot.md`](../requirements/native-kanban-sot.md)
-**Frozen integration contract:** `SHARED-CONTRACT.md` and `contracts/*.v1.ts`
-
-## 1. Mission statement
-
-Extend current `mosaicstack/stack` main into the sole native control plane for workspace-scoped project, mission, milestone, task, dependency, assignment, lease, approval, evidence, and audit state. First deliver a thin writable Kanban/List vertical slice; then add deterministic mechanical coordination and execute a one-way migration/cutover from jarvis-brain/Vikunja project/task stores.
-
-Success means every user, agent, orchestrator, specialist, and UI sees and mutates the same PostgreSQL aggregate revisions through typed Gateway commands, with no writable fallback and no hidden second authority.
-
-## 2. Scope boundaries
-
-### In scope
-
-- Current Drizzle/PostgreSQL schema extension and migrations.
-- Workspace tenancy and authorization from the first migration.
-- Projects, missions, milestones, tasks, normalized tags, dependencies, assignments, durable execution/quarantine state, links, immutable artifacts/evidence joins, outage change proposals, events, approvals, leases, checkpoints, and transactional outbox.
-- NestJS Gateway queries and explicit lifecycle commands.
-- MCP/CLI agent surfaces and generated read-only projections.
-- Thin writable Next.js Tasks Kanban/List, task detail, minimal Projects CRUD, filters, dependency readiness, ownership/lease separation, and audit timeline.
-- Non-LLM Mechanical Coordinator eligibility, proposal, approval-policy, lease/fence, heartbeat, retry, expiry, quarantine, and restart recovery.
-- Planning, Enhance, Coder, Review, SecReview, PR-Monitor, and Certifier role/gate representation.
-- One-way shadow importer, reconciliation, write freeze, final delta, cutover, rollback package, and legacy read-only stabilization.
-- Recovery-posture configuration and health-state/fail-closed contract.
-
-### Out of scope
-
-- Greenfield services, Prisma runtime revival, or jarvis-brain flat files as runtime storage.
-- Writable Markdown/JSON/Valkey/browser/provider fallback.
-- Gitea issue/PR replacement or generic bidirectional provider sync.
-- Calendar, email, GLPI cache, CRM, billing, time tracking, personal-brain migration.
-- LLM scheduling or scope interpretation by the Coordinator.
-- Autonomous gate waiver, certification, merge, release, deployment, or issue closure by Coordinator.
-- Merge authority for Certifier.
-- P4 full portfolio/mission designer and P5 fleet-scale policy unless separately released.
-
-## 3. Fixed invariants
-
-Every deployment MUST preserve all of the following:
-
-1. PostgreSQL is the sole writable SOT.
-2. Drizzle on current stack main is the only persistence foundation.
-3. Mutations fail closed when DB write-health cannot be proven `healthy`.
-4. No file, Valkey, browser, queue, provider, or human note becomes a fallback writer.
-5. `TASKS.md`, `mission.json`, and every file export are generated, read-only, non-authoritative, and never import sources.
-6. Human outage notes become attributable post-recovery proposals only.
-7. Workspace is the hard tenant; Team is intra-workspace authorization.
-8. Valkey is expendable; PostgreSQL owns state, leases, fencing, audit, and outbox.
-9. Mechanical Coordinator is deterministic/non-LLM and cannot invent scope, waive gates, certify, or merge.
-10. Certifier is the final independent quality gate and has no merge authority.
-11. Mutations use idempotency and optimistic aggregate versions; worker commands also require a current fencing token.
-12. Recovery tier changes only backup/recovery posture, never authority or gate semantics.
-
-## 4. Configurable recovery posture
-
-Deployments select Lite, Standard, or High-assurance defaults from [`../requirements/native-kanban-sot.md`](../requirements/native-kanban-sot.md) and `contracts/recovery-posture.v1.ts`. Configurable fields are limited to:
-
-- backup/base-backup cadence;
-- RPO and RTO targets;
-- PITR retention;
-- WAL archive cadence;
-- restore-test frequency;
-- break-glass drill frequency;
-- encrypted off-cluster storage.
-
-High-assurance defaults are fixed reference values: RPO 15 minutes, RTO 4 hours, encrypted off-cluster WAL every 5 minutes with 35-day PITR, daily base backup, monthly restore test, and quarterly break-glass drill.
-
-## 5. Canonical role map
-
-```text
-User
-  ↓ objectives, constraints, ratified decisions
-Interaction Layer
-  ↓ workspace/project context; no scheduling authority
-Portfolio Orchestrator
-  ↓ approved mission, cross-project priority/capacity
-Project Sub-Orchestrator
-  ↓ decomposition, DAG, acceptance, release, routing policy, overrides
-Gateway
-  ↓ authenticated/authorized typed commands
-Project/Task Domain Services
-  ↓ transactional state + semantic event + outbox
-Mechanical Coordinator
-  ↓ deterministic eligibility/proposal/lease/fence/retry/quarantine
-Specialists
-  Planning → Enhance → Coder → Review → conditional SecReview → remediation
-  ↓ complete evidence bundle
-Certifier
-  ↓ final pass/reject/escalate; NO merge authority
-Project Sub-Orchestrator / control plane
-  ↓ merge authority after all gates
-Post-merge validation
-```
-
-### Authority table
-
-| Role/layer               | Owns                                                                                                        | Explicitly cannot do                               |
-| ------------------------ | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
-| User                     | Objectives, constraints, Jason-owned decisions                                                              | Direct DB/file authority bypass                    |
-| Interaction              | Conversation and context resolution                                                                         | Schedule, approve, lease, certify                  |
-| Portfolio Orchestrator   | Mission approval, cross-project priority/capacity/global holds                                              | Implement or self-certify specialist work          |
-| Project Sub-Orchestrator | Task decomposition/DAG/acceptance, release to ready, routing policy, overrides, remediation, merge go-ahead | Bypass required independent gates                  |
-| Gateway                  | Identity, tenancy, DTO validation, commands, state-machine enforcement                                      | Accept file edits or client SQL as mutations       |
-| Domain services          | Transactional business invariants, semantic events/outbox                                                   | Depend on Valkey/files for committed truth         |
-| Mechanical Coordinator   | Eligibility, dependencies, proposal, approved routing, lease/fence, heartbeat, retry/quarantine             | Invent/alter scope, waive gates, certify, merge    |
-| Specialists              | Bounded planning/implementation/review artifacts under a task lease                                         | Modify another lane's owned files or self-approve  |
-| Certifier                | Final independent evidence/traceability/gate decision                                                       | Merge, close provider issue, release, waive policy |
-
-## 6. Gate model
-
-### Mandatory gates
-
-1. Requirements/contract freeze before parallel implementation.
-2. P0 schema/authority threat model and tenant isolation review.
-3. Author and reviewer MUST be different principals/sessions.
-4. Functional review validates requirements, endpoint registry, concurrency, and negative paths.
-5. **Mandatory SecReview (`secrev`)** for any auth, authorization, tenant, service-token, secret, database schema/migration, data-integrity, import/cutover, audit, lease/fencing, recovery, or destructive-retirement surface.
-6. Review findings enter bounded remediation owned by the implementation lane.
-7. Raising reviewer re-verifies remediation.
-8. Certifier performs the final independent evidence and traceability gate.
-9. Merge authority remains with `mos-claude`/Project Sub-Orchestrator control plane after gates pass.
-10. Post-merge CI and situational validation must be terminal green before closure.
-
-### Gate outcomes
-
-- **PASS:** evidence complete; next authority may proceed.
-- **REJECT:** findings are explicit and route to remediation.
-- **ESCALATE:** policy/owner decision required; no implicit waiver.
-
-No role can transform a missing gate into a warning by changing status, editing a projection, or writing Valkey.
-
-## 7. Slice ownership rules
-
-1. USC web1 is the sole execution environment; coder2/3/4/5 are independent bounded lanes under Mos.
-2. Every slice has one named file-tree owner and an explicit IN/OUT boundary in `TASKS.md`.
-3. Two active slices MUST NOT edit the same source file, migration file, generated snapshot, lockfile, or API contract.
-4. coder2 exclusively owns `packages/db/src/schema.ts`, `packages/db/drizzle/**`, migration journal/meta/tests, then its disjoint recovery-parser/runbook slice. All schema requests serialize through coder2.
-5. Frozen `contracts/*.v1.ts` are read-only inputs during implementation. Contract changes require Mos approval, a version bump/amendment, and coordinated rebase before work resumes.
-6. coder3 exclusively owns Gateway DTO/controllers/services and the enumerated `apps/gateway/src/mcp/**` server files. coder4 owns CLI/projection clients and never edits MCP server files. Web consumers use the exact KBN-105 endpoint/DTO freeze.
-7. coder4 executes one lane order: CLI/projection → pure Coordinator → importer → cutover. The pure Coordinator under `packages/coord` does not load IDs or access DB, Gateway, Valkey, recovery I/O, or web files; coder3 owns the persistence/service adapter.
-8. Migration/import tooling calls Gateway/migration-only approved ports and does not add a second database model.
-9. Each lane commits only its owned files and reports any needed cross-slice change as a contract-change request instead of editing another lane's tree.
-10. Cross-review is mandatory: no lane reviews its own changes. Recommended ring is coder2 ← coder5, coder3 ← coder2, coder4 ← coder3, coder5 ← coder4, followed by independent SecReview where triggered and Certifier final.
-11. Integration-only edits are a separate serialized slice after component lanes are green; no opportunistic merge-conflict resolution may alter semantics.
-
-## 8. Delivery phases and exit gates
-
-### P0 — Canon and authority foundation
-
-- Publish this canon, frozen schema/ports/health/recovery contracts, threat model, authorization matrix, exact endpoint/DTO registry, concrete current-main field-by-field migration map, and standards amendment.
-- Build hold remains active until independent author≠reviewer re-review returns GO on health proof/failures, approval binding, fencing, tenant relationships, proposals, migration map, slice ordering/API freeze, recovery validation, and vocabulary alignment.
-- Exit: no unresolved second writer or contract blocker, tenant boundary frozen, all seven decisions traceable, and independent re-review GO recorded.
-
-### P1 — Thin native MVP
-
-- Schema/migration, tenant-safe Gateway, CLI/MCP/projection, writable Kanban/List/Projects, dependencies/readiness/audit.
-- Exit: same revision across web/CLI/MCP/projection; cross-workspace tests fail closed; generated files cannot mutate state.
-
-### P2 — Mechanical coordination
-
-- Agent/session registry, deterministic engine, approval queue, PostgreSQL leases/fencing/checkpoints/outbox, retry/quarantine, operations UI.
-- Exit: one lease winner, stale tokens rejected, dependencies/approvals enforced, DB/Valkey fault semantics proven, Certifier gate has no merge authority.
-
-### P3 — Shadow migration and cutover
-
-- Importer, lineage, reconciliation, reviewer UI, write freeze, final delta, Gateway switch, legacy read-only, stabilization and rollback package.
-- Exit: signed reconciliation, zero active legacy writers, scoped Gateway identities, imported backlog cannot dispatch accidentally.
-
-## 9. Evidence required for mission closure
-
-- Requirement-to-test/evidence matrix.
-- Schema/migration and N-1 rolling-deploy proof.
-- Cross-workspace API/repository/import/Coordinator negative tests.
-- Health-state and fail-closed fault injection.
-- Valkey-loss/outbox replay and Coordinator restart tests.
-- Concurrent lease and stale fencing tests.
-- Endpoint-registry alignment across web/CLI/MCP/Gateway.
-- Accessible real-Gateway Kanban journeys.
-- Generated projection tamper/no-import proof.
-- One-way migration dry-run/apply/verify and field reconciliation.
-- Author-independent functional review and required SecReview.
-- Certifier final decision and evidence bundle.
-- Merged main SHA, terminal green CI, closed linked task/issue, and post-merge situational validation under orchestrator ownership.
-
-## 10. Change control
-
-This manifest is derived from the ratified source plan. Any change to SOT authority, workspace tenancy, fixed statuses, Coordinator/Certifier authority, health-state semantics, schema v1, migration direction, or recovery-tier field set is a contract change. Contract changes require Jason/Mos authorization and cannot be inferred by an implementation lane.
-
-No coder lane may start while the build hold is active. KBN-010 must complete before KBN-100; KBN-105 exact endpoint/DTO freeze must complete before any API consumer implementation.

docs/native-kanban-sot/SHARED-CONTRACT.md

@@ -1,335 +0,0 @@
-# Native Kanban/SOT — Remediated Shared Contract v1
-
-**Status:** CONTROL-PLANE rc.16 KBN-101 current generic storage-wrapper authority remediation complete; awaiting independent exact-head re-review. Prior KCR-001–016 and rc.4 SI-001 decisions retained; KBN-101 foundation certification precedes KBN-100 and real immutable-operation certification precedes KBN-105
-**Version:** 1.0.0-rc.16
-**Date:** 2026-07-15
-**Change authority:** Mosaic control plane/Jason only
-**SI-001 amendment authority:** `web1:mosaic-100` control-plane decision under issue #753
-
-## Amendment record
-
-### 1.0.0-rc.16 — Current generic storage-wrapper authority closure
-
-- **Current-source truth:** `packages/storage/src/cli.ts` currently shells `storage migrate --run` directly to `pnpm --filter @mosaicstack/db db:migrate` through `execSync`; no `mosaic-db-migrator` executable exists. README and user-guide command guidance therefore remove that command and any runner-delegation claim. The current wrapper is legacy N-1, uncertified, non-operative, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
-- **Future-only boundary:** future schema migration remains non-operative and follows external bootstrap → TLS/roles → runner `--run` → runner `--verify` → readiness; tier copy uses only the separately held secure migrate-tier route.
-- **Unmaskable semantic/source-consistency evidence:** before inventory, ownership, or status masking, -06 fails the exact former README commented code-fence generic-wrapper form and exact user-guide executable generic-wrapper form. Its source-consistency test proves the direct-Drizzle `execSync` target and absent runner bin, so any documentation describing current wrapper delegation to the runner fails.
-- **Non-effect:** prior runner, legacy-CI, Compose, production-secret, attestation, pgvector, manifest, lock, TLS, activation, and serial-gate closures remain unchanged.
-
-### 1.0.0-rc.15 — Held runner and legacy-CI authority closure
-
-- **Held runner only:** Current operator documents cannot advertise `mosaic-db-migrator --run|--verify` as executable. The sole passing future form is one `Held future procedure` Markdown section, bounded through its next equal-or-higher heading, that explicitly says non-operative/no-current-command-authority, names KBN-101-00/-03/-05, and preserves external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway/Compose readiness. Any runner hit outside that section fails before inventory/ownership/status masking.
-- **PGlite/current-CI boundary:** Fleet backlog current behavior is PGlite-only; PostgreSQL CLI/runner authority remains held until activation. README classifies the checked-in direct `db:migrate` CI job as active legacy N-1, uncertified, non-authorizing as an operator route, and pending KBN-101-06 removal; it is a known direct-DDL exception against an isolated disposable CI database, not approved ordinary behavior. The -06 fixture asserts every required status term and rejects ordinary-authority presentation.
-- **Non-effect:** prior Compose, production-secret, attestation, pgvector, manifest, lock, TLS, activation, and serial-gate closures remain unchanged.
-
-### 1.0.0-rc.14 — Current Compose and production-secret route closure
-
-- **Current developer boundary:** `README.md` and `docs/guides/dev-guide.md` permit only in-process PGlite data-layer work and explicitly selected non-PostgreSQL Compose services. Gateway/Web local start is held because the current unguarded loader can inherit a daemon/project PostgreSQL DSN and reach runtime DDL; KBN-101-02 must reject it before connection. The current PostgreSQL Compose mount is legacy/unqualified; PostgreSQL and federated activation are held until KBN-101-00/-03/-05 and then follow external bootstrap → TLS/roles → runner `--run` → `--verify` → Gateway/Compose readiness.
-- **Production boundary:** `docs/guides/deployment.md` is non-operative until the KBN-101-05 renderer-backed process-exec or `LoadCredential` interface exists. It contains no active production environment-file, monorepo auto-load, credential export/argv, or secret-activation lifecycle route; future units must preserve generation-pinned Vault consumer isolation.
-- **Unmaskable semantic negatives:** -06 fails the exact former README/dev/deployment Compose-first sequences and every production `.env`, `EnvironmentFile=`, credential export/argv, or restart-as-secret-activation fixture before owned/status/normative classification. The held PGlite/non-PostgreSQL route and future ordered activation are the only passing fixtures.
-
-### 1.0.0-rc.13 — Federation-MILESTONES indirect-startup closure
-
-- **Complete operator inventory:** `docs/federation/MILESTONES.md` is exclusively KBN-101-07 and an exact KBN-101-06 `operator-document` `status-only` record. Its former `pgvector extension installed + verified on startup` wording is superseded and forbidden; it authorizes no current DDL, Compose/init, or runtime/startup path.
-- **Unmaskable semantic negative:** before inventory disposition, the scanner fixture proves that exact former wording fails. The only passing status-only sequence is external bootstrap → TLS/roles → `mosaic-db-migrator --run` → `mosaic-db-migrator --verify` → Gateway readiness.
-
-### 1.0.0-rc.12 — Deployable importer generation and indirect-DDL-route closure
-
-- **Authenticated generation:** KBN-101-05 owns one canonical Vault KV-v2 importer record, `secret-{env}/mosaic-stack/database/importer` key `url`, with its version taken only from the same successful `data.metadata.version` response. Value plus provider version are one generation, never inferred from DSN bytes. The renderer creates separate immutable `0400` URL/version copies for migrator `10003:10003` binding-only access and importer `10002:10002` access; it uses fsync/atomic generation replacement for Compose and distinct versioned secret/config references for Swarm, so deployment cannot mix generations.
-- **Bounded consumers:** importer alone receives its URL/version, CA at `DATABASE_TLS_CA_CERT_PATH`, pinned public key, and read-only attestation; migrator receives its own migration URL/CA, the URL/version only for no-connect/no-export binding, attestation output, and the root-wrapper-only private key. Safe fd open/fstat/digest/zeroize/close semantics, a privileged producer-only-to-importer-only attestation handoff controller (verify, exact-byte copy, fsync/atomic rename, `10002:10002` `0400` seal, then importer start), no shared writable file, no logging/oracle, provider rotation/revocation, CA/mount, consumer-isolation, and symlink/hardlink/owner/mode/TOCTOU negatives are mandatory.
-- **Indirect-DDL closure:** `docs/federation/SETUP.md` is non-operative until KBN-101 activation and documents only external bootstrap → TLS/roles → runner `--run` → `--verify` → Gateway readiness. The -06 scanner performs unsuppressible semantic checks for automatic first-boot/startup extension/schema/migration language, Compose-up-before-runner, and init-script authority; the former SETUP wording fails and the remediated sequence passes.
-
-### 1.0.0-rc.11 — Target-bound importer attestation and exhaustive operator-route closure
-
-- **Target-bound proof:** trusted `mosaic-db-migrator --verify` now produces the atomic, credential-free `migrate-target.v1.json` JCS/Ed25519 artifact from a runner-only root-owned signing-key reference; the importer receives only pinned public verification keys and the artifact. Its signed v1 fields bind issued/expiry/nonce, exact secret version and SHA-256 of high-entropy target-file bytes, canonical TLS host/port/database, CA/SPKI, PostgreSQL system identifier/database OID, expected importer role, manifest/schema fingerprints, and producer invocation/build/image/correlation. No DSN, username, password, credential bytes, or signing key enters the artifact, importer, runtime, logs, or output.
-- **Fail-closed importer:** `mosaic storage migrate-tier` requires both `--target-url-file /run/secrets/mosaic-migrate-target-url` and `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`. Before target connection it validates files, signature/key/expiry/replay, secret version/digest, TLS/CA/role/manifest bindings and opens/digests/connects from the same in-memory URL bytes. After verified TLS but before transaction/DML it matches server ID, database OID, `current_user`, CA/SPKI, and manifest/schema; failure distinguishes zero connection from connection/zero-DML and DDL remains impossible. Rotation overlap/revocation, atomic rename, replay cache, secret rotation invalidation, and wrong/substituted/stale/tampered/file-change tests are mandatory.
-- **Closed documentation surface:** KBN-101-06 inventories every current non-normative scanner hit, including `docs/guides/user-guide.md` and status-only `docs/federation/TASKS.md`; the latter is historical and cannot authorize DDL. The legacy `storage migrate` tier-copy syntax is unavailable. `storage migrate` is schema-wrapper delegation only; secure tier data copy is `migrate-tier`. Exact KBN PRD/contract/shared/task paths may be `normative-contract` scan class but are still scanned and cannot mask executable instructions. The normative detail remains [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-- **Non-effect:** pgvector closure, manifest, lock, role graph, TLS, activation, and KBN-100/KBN-105 serial gates are unchanged.
-
-### 1.0.0-rc.10 — PostgreSQL-valid untrusted pgvector owner and active migrate-tier closure
-
-- **Valid extension authority:** PostgreSQL 17 + pgvector 0.8.2 `vector` is untrusted (`trusted` absent; `relocatable=true`), so `mosaic_extension_owner` is exactly `NOLOGIN SUPERUSER`, not `NOSUPERUSER`. It is dedicated solely to `mosaic_extensions`, `vector`, and owner-bearing extension members; `rolcanlogin=false`, `rolsuper=true`, zero members, no runtime credential/Vault secret, and no app-container delivery are catalog and deployment proof. An externally controlled audited bootstrap-superuser session alone `SET ROLE`s for extension CREATE/UPDATE/SET SCHEMA, then `RESET ROLE`; fresh and shadow paths do so, while in-place existing work requires exact pre-existing `extowner`.
-- **Explicit superuser exception:** `GRANT`/`REVOKE` cannot privilege-limit a superuser. The containment is dedicated identity, no login, no membership, external control plane, audit, independent review, backup/rollback, and maintenance window—not a false least-privilege claim. Runtime, migrator, schema owner, importer, and every service role cannot assume the role or alter/update/drop/change extension membership. Managed targets without this exact role are ineligible unless a versioned provider-owned extension-owner profile is independently approved.
-- **Active secure data-migration route:** `docs/guides/migrate-tier.md` is exclusively KBN-101-07, is active rather than historical, and specifies runner-prepared/verified PostgreSQL destination plus a dedicated non-DDL importer. KBN-101-02 freezes `--target-url-file /run/secrets/mosaic-migrate-target-url`, never credential argv; raw `--target-url`, `DATABASE_URL` fallback, runtime owner, missing/unsafe file, wrong mode, and DDL all fail before target connection/DDL. KBN-101-06 inventory/matrix records the route and exact secure fields, then tests its finite operator-document closure.
-- **Non-effect:** manifest, lock, `mosaic` application schema, TLS, activation, and KBN-100/KBN-105 serial gates remain unchanged. The normative detail remains [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-
-### 1.0.0-rc.9 — KBN-101 extension-schema boundary, disjoint manifests, and scanner mechanics
-
-- **Extension schema owner:** `mosaic_extension_owner`, not `mosaic_schema_owner`, creates and owns `mosaic_extensions`, `vector`, and extension-member objects. The external bootstrap actor `SET ROLE`s for fresh creation or approved-owner relocation, then `RESET ROLE`s; rc.10 replaces the earlier membership wording with the PostgreSQL-valid zero-member superuser exception. Schema owner has only `USAGE` for legacy type resolution—never ownership, `CREATE`, `ALTER`, `DROP`, member change, or default-privilege authority. Runtime, migrator, and schema owner must fail catalog and direct DDL denials; shadow/resume/rollback repeat the owner/default-privilege proof.
-- **Exclusive delivery DAG:** KBN-101-00…09 now has a complete, nonoverlapping exact file/glob manifest with named tests/evidence. The runner mapping is exactly `"mosaic-db-migrator": "./dist/cli.js"` and image `ENTRYPOINT ["mosaic-db-migrator"]`; `packages/storage/src/{cli,migrate-tier}.ts` belongs only to -02, and -07 is documentation only. -08/-09 own evidence paths only. -00…07 are prepared artifacts; the immutable N-1 image remains live until -08 atomic activation, so no independently deployed intermediate can bypass runtime controls.
-- **Mechanical classifier:** -06 owns the exact scanner, inventory fixture, command-matrix harness, and CI wiring. Inventory records pin path/class/owner/disposition/allowed tokens/rationale/expiry/review revision; unknown, duplicate-owner, ownerless, missing-path, invalid allowlist, and historical-category masking fail. The architecture plan's operative direct `db:migrate` is replaced by sole-runner guidance rather than hidden under a historical category.
-- **Non-effect:** manifest v1, lock, `mosaic` application-schema ownership, TLS, activation, KBN-100/KBN-105 serial gates, and all earlier canon decisions remain unchanged. The normative detail remains [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-
-### 1.0.0-rc.8 — KBN-101 finite authority, executable runner, and pgvector-owner remediation
-
-- **Finite authority closure:** KBN-101-06 classifies every current executable source/script/package bin, operator document, and deploy manifest by exact path; unclassified current hits fail. Byte-immutable historical SQL, PGlite-only routines, negative-test literals, vendored/generated artifacts, and clearly labeled historical reports are exact-path/category reviewed allowlists only. `packages/db/src/index.ts` loses its public `runMigrations` export with a direct-import/compile negative; `docs/fleet/backlog-conventions.md` and `docs/PERFORMANCE.md` lose first-use/direct-Drizzle/Gateway-startup migration instructions and carry runner/readiness route negatives. A token scan is only input to the classifier, never proof of authority.
-- **Executable exclusive cards:** KBN-101-03 alone publishes `mosaic-db-migrator` from `packages/db/package.json`/`src/cli.ts`, owns `docker/db-migrator.Dockerfile`, and keeps `{runner,config.dto,manifest,identity,tls}` private, with exact `--run|--verify|--help`, env-only input, stable exits, and command tests. KBN-101-00 alone owns `infra/pg-bootstrap/roles.sql`, `infra/pg-bootstrap/extensions.sql`, `infra/pg-bootstrap/README.md`, plus bootstrap tests. KBN-101-05 alone owns `tools/db/render-postgres-secrets.ts`, renderer tests, and Compose/Portainer/Swarm/two-gateway declarations, consuming the versioned bootstrap interface. No card overlaps renderer/bootstrap/deployment ownership.
-- **Extension-owner transition:** `mosaic_extension_owner` is a dedicated NOLOGIN role whose membership/credentials never reach services; the external bootstrap actor alone may `SET ROLE` during bootstrap. Fresh vector and member objects retain that owner. PostgreSQL has no supported extension-owner alteration: approved-owner existing extension relocation validates `pg_extension.extowner`, members/schema/version and uses tested `ALTER EXTENSION ... SET SCHEMA`; legacy runtime-owned extension fails closed to a controlled shadow database migration with backup, evidence, quiesce/final delta, atomic switch, and read-only rollback window. No catalog mutation, ownership adoption, or `DROP CASCADE` is permitted. Runtime/migrator/schema-owner extension ALTER/DROP/member-update denial is mandatory.
-- **Non-effect:** manifest v1, lock namespace, role/search-path, relocation/TLS/activation, KBN-100/KBN-105 serial gates, and all retained canon decisions are strengthened, not weakened. The normative detail remains [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-
-### 1.0.0-rc.7 — KBN-101 complete current-path, relocation, and two-gateway remediation
-
-- **Finite current-path closure:** static inventory and the `DATABASE_URL`-only-before-connect/DDL denial matrix now explicitly include Gateway's former temporary-table pgvector test (runner-prepared persistent read/query-only fixture), `docker/init-db.sql` retirement, `migrate-tier.ts` runner/bootstrap-only guidance, and the active two-gateway harness. The harness is migrated, not retired: `postgres-a/b → mosaic-db-migrator-a/b → gateway-a/b`, each with isolated URL/CA material, verified readiness, SANs, and positive/negative TLS evidence.
-- **Executable relocation:** KBN-101-03 exclusively owns `schema.ts`, Drizzle snapshots/journal/generated relocation and exact tests. All future application declarations use exported `pgSchema('mosaic')`; immutable historical SQL runs only in trusted legacy `public`. `vector` is fixed in non-writable `mosaic_extensions`, with exact catalog relocatability/version eligibility, explicit type/operator qualification, catalog-class ordering, unknown-object fail-closed behavior, clean/current-public/partial/reverse rollback tests, and an N-1 release order.
-- **Bound deployment ownership:** `mosaicstack/stack` KBN-101-00/05 owns current Compose, Portainer, two-gateway, bootstrap renderer/templates, UID/GID declarations, and rendered validation. Gateway is fixed to `10001:10001`; PostgreSQL UID/GID is image-inspected and frozen only after digest pinning. Exact secret paths, atomic renderer behavior, Compose/Swarm targets/modes, Gateway/PostgreSQL leaf separation, and two-pair TLS failure evidence are required. Mosaic deployment control plane/Jason is the named activation authority; environment IaC/Vault supplies versioned input only.
-- **Correct traceability:** REQ-03 maps to role/schema/search-path, REQ-04 to TLS, REQ-05 to post-KBN-100 immutability, REQ-06 to rollout/rollback, and REQ-07 to the KBN-101 → KBN-100 → KBN-101 → KBN-105 sequence. No prior manifest/lock/role/DAG/activation decision is weakened.
-
-### 1.0.0-rc.6 — KBN-101 closed DDL/TLS/ledger activation remediation
-
-- **Choice:** `mosaic-db-migrator` is the sole application/CI/test PostgreSQL DDL control plane. Every legacy entrypoint is routed or denied, rejects `DATABASE_URL`-only before connection/DDL, and `db:push` is unavailable outside an allowlisted disposable developer target. The runner holds one `max:1` session with fixed `pg_try_advisory_lock(1297044289,1262636593)` across preflight through release.
-- **Exact ledger:** manifest v1 canonically serializes journal logical index/tag and SHA-256 of exact shipped migration bytes. It maps each observed ledger hash to one tuple; physical insertion order is non-normative, while missing/unknown/duplicate/ambiguous/corrupt/stale states fail closed. Shipped `0009` bytes remain unchanged; a missing/effects-absent `0009` runs normally, an applied-late hash maps normally, and partial/full effects with missing hash require backup restoration or separately reviewed repair—not manual adoption.
-- **TLS/search path:** operator/IaC owns CA and server leaf lifecycle, exact compose/Swarm secret mounts, server TLS activation, service-DNS SANs, verified-TLS readiness, transition, CA overlap rotation, and rollback. Runtime/migrator use `verify-full`; PGlite is not PostgreSQL TLS evidence. Application sessions use only `pg_catalog,mosaic`; no URL/config-derived identifier reaches SQL.
-- **Safe release:** cards 00–07 land prepared but inactive; owner-runtime deployments remain N-1. Mosaic control plane/Jason alone authorizes one atomic TLS/roles → runner → readiness → runtime activation or rollback. No runtime-operator compatibility switch, bypass, plaintext interval, or force-on-red exists; all temporary support is removed before KBN-101-08.
-- **Non-effect:** role graph, immutable certification after KBN-100, KBN-105 gate, rc.5’s preserved rc.4 SI-001 invariants, and all KCR-001–016 decisions remain unchanged. Exact detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-
-### 1.0.0-rc.5 — KBN-101 role/connection split
-
-- **Choice:** PostgreSQL `standalone` and `federated` runtime uses `DATABASE_URL` only as a non-owner `mosaic_runtime` login; an explicit migration phase uses `DATABASE_MIGRATION_URL` only as `mosaic_migrator`, which `SET ROLE`s to non-login `mosaic_schema_owner` for DDL. Local PGlite remains an explicit embedded exception.
-- **No fallback / no startup DDL:** missing migration URL fails the migration phase; it never falls back to runtime URL/default/config. Gateway replicas do not run migrations. An advisory-locked migration phase verifies the exact ordered Drizzle ledger fingerprint before replicas may become ready.
-- **Privilege model:** non-login `mosaic_platform_database_owner` is outside application paths; `mosaic_schema_owner` owns only application/ledger schemas. `mosaic_runtime` has only `mosaic_runtime_capability`, owns no object/schema, cannot assume owner/migrator, has no TEMPORARY privilege, has only read access to the Drizzle ledger, and must fail startup if effective identity, unsafe attributes, authenticated TLS, search path, schema version, grants, or immutable relation privileges differ from the frozen contract. `task_events`, `artifacts`, `task_checkpoints`, `task_checkpoint_artifacts`, and `approval_decision_artifacts` grant runtime only INSERT/SELECT; KBN-100 retains RESTRICT/no-cascade semantics.
-- **Non-effect:** rc.4 SI-001 candidate-key/FK order and all KCR-001–016 tenancy, SOT, proposal-audit, approval, fence, recovery, no-cascade, endpoint, and wire invariants are unchanged. This amendment neither creates roles/secrets nor changes production deployment.
-- **Gate:** KBN-101’s role/schema-boundary foundation certificate, Vault/redaction/rotation, N-1/rollback, and independent security GO are mandatory before KBN-100. After KBN-100 creates the immutable relations, KBN-101 real deployed-role immutable-operation certification plus Ultron GO is mandatory before KBN-105; synthetic test-role success alone is insufficient. Exact implementation detail is normative in [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md).
-
-### 1.0.0-rc.4 — KBN010-SI-001 (preserved)
-
-- **Choice:** add the explicitly named, non-partial unique candidate key `missions_workspace_id_uidx` on `missions(workspace_id, id)` and retain `missions_workspace_project_id_uidx` on `(workspace_id, project_id, id)`.
-- **Rationale:** mission `id` remains globally unique, while the composite candidate key makes the frozen tenant-safe generic mission relations valid. `artifacts` and `approval_decisions` are polymorphic exactly-one-target records and do not consistently carry `project_id`; widening both children would unnecessarily broaden v1 and its target semantics.
-- **Exact effect:** `artifacts_workspace_mission_fk` and `approval_decisions_workspace_mission_fk` continue to reference the exact ordered columns `missions(workspace_id, id)` with RESTRICT deletion, now backed by a matching candidate key.
-- **Non-effect:** no SOT, tenancy, project-congruence, proposal-audit, approval, fencing, immutability, no-cascade, API, or wire-version invariant changes. The `SuccessEnvelopeV1.contractVersion` remains `1.0.0`.
-- **Historical evidence boundary:** `KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` intentionally remains the immutable rc.3 blocker verdict that detected SI-001; this rc.4 record and the #753 scratchpad append are the authorized disposition. Rewriting the gate verdict is outside this amendment's exclusive scope.
-- **Gate:** this amendment resolves the DDL defect identified by KBN010-SI-001 but does not itself lift KBN-100; independent schema/SecReview remains required.
-
-## 1. Authority
-
-Concrete contracts are the four `contracts/*.v1.ts` files. PostgreSQL/current-main Drizzle is the sole writable SOT. In PostgreSQL standalone/federated deployments, KBN-101 rc.13 DDL/ledger/TLS/role/attestation/generation separation is a precondition to schema implementation and certification. Public health, Valkey, files, exports, providers, browser state, and outage notes cannot authorize/reconstruct writes. Mechanical Coordinator is non-LLM with no scope/gate/certification/merge authority. Certifier is final independent gate with no merge authority. No feature lane starts until this canon merges and the KBN-010/KBN-105 prerequisites are satisfied.
-
-## 2. Health proof and exact failures
-
-`KanbanHealthResponseV1` is a discriminated union:
-
-| State                |  read | write | Capability                                          |
-| -------------------- | ----: | ----: | --------------------------------------------------- |
-| `healthy`            |  true |  true | reads; public state still cannot authorize mutation |
-| `read-only-degraded` |  true | false | reads only                                          |
-| `write-unavailable`  | false | false | diagnostics only                                    |
-
-Every response has `checkedAt`, `validUntil`, `policyRevision`; contradictory booleans fail validation.
-
-For a mutation, Gateway opens the PostgreSQL transaction, executes the live write probe on that transaction/connection, mints the internal branded `PostgresWriteHealthProofV1`, and revalidates time/policy/transaction identity immediately before mutation. Public REST/MCP/CLI DTOs never accept health/proof fields. Valkey/caller assertions cannot mint proof. Pure Coordinator takes `KanbanEvaluationContextV1`; persistence takes `InternalKanbanMutationContextV1` or probes internally.
-
-| Case                         |                        HTTP | Frozen result                                                       | Retry                |
-| ---------------------------- | --------------------------: | ------------------------------------------------------------------- | -------------------- |
-| degraded write               |                         503 | `KANBAN_WRITE_HEALTH_UNPROVEN`, `read-only-degraded`, `not_applied` | false                |
-| write unavailable            |                         503 | `KANBAN_WRITE_UNAVAILABLE`, `write-unavailable`, `not_applied`      | false                |
-| version conflict             |                         409 | `AGGREGATE_VERSION_CONFLICT`, actual version, `not_applied`         | false                |
-| timeout/unreachable          |             timeout/502/504 | `retryable_transport_error`, `unknown`                              | same idempotency key |
-| stale fence/session/approval | coordinator rejection union | `not_applied`                                                       | false                |
-
-Required negatives: contradictory state, expired/policy-mismatched/wrong-transaction proof, Valkey-only health, forged healthy, and exhaustive non-cross-mapping of 503 vs 502/504/timeout vs 409.
-
-## 3. Canonical schema invariants
-
-Complete declaration: `contracts/kanban-schema.v1.ts`.
-
-- Tables: tenant/identity (`workspaces`, members, teams/members, agents/sessions); planning (`projects`, `milestones`, current-milestone join, `missions`, mission-milestones, `tasks`, normalized tags, dependencies); orchestration (`task_assignments`, durable execution state, leases, checkpoints/evidence); governance (`change_proposals`, immutable artifacts/evidence, events, approvals, outbox, external links).
-- Task statuses: `backlog | ready | in_progress | blocked | in_review | done | cancelled`.
-- Assignment states everywhere: `awaiting_approval | policy_pre_authorized | approved | rejected | leased | released | expired | superseded`.
-- Specialist roles everywhere: `planning | enhance | coder | review | security-review | pr-monitor | certifier`.
-- Owner uses exactly-one user/team; assignment principal exactly-one user/team/agent; users require active membership; agent/session and all evidence are workspace-bound.
-- Task→mission/milestone/parent, mission→milestone, and project→current-milestone are project-congruent composite relations.
-- Mission `id` remains globally unique. The additional non-partial `missions_workspace_id_uidx` candidate key on `(workspace_id, id)` exists only to support the frozen workspace-safe polymorphic artifact and approval-decision mission relations; the project-congruent `(workspace_id, project_id, id)` key remains authoritative wherever `project_id` is present.
-- Dependency identity is workspace+predecessor+successor independent of type.
-- Approval evidence and checkpoint evidence are workspace-scoped joins to immutable artifacts, never JSON ID arrays.
-- Proposal audit links are composite relations: `(workspace_id, submitted_audit_event_id)` and `(workspace_id, accepted_command_audit_event_id)` reference `task_events(workspace_id, id)` with RESTRICT deletion.
-- Assignment is persisted with task/version, exact target/session, expiry/state/policy/proposer/reason. Approval relates to assignment. Lease acquisition accepts IDs, then reloads/locks and validates every relation.
-- `tasks.fencing_counter` is bigint; locked atomic increment/RETURNING creates a decimal-string lease token. Lease/checkpoint composites bind exact workspace+task+assignment/session+fence.
-- `task_execution_states` durably records retry/quarantine/exhaustion.
-- Tags are normalized; legacy `tasks.tags` remains through N-1. Archive is explicit actor/reason/time and does not change lifecycle.
-- Canonical parents use RESTRICT. Events/checkpoints/artifacts/evidence are INSERT/SELECT-only for application roles. Normal flow archives/cancels; purge is audited break-glass retention work.
-
-## 4. Outage proposal contract
-
-`change_proposals` stores workspace, active-member proposer, source-note digest, target/version, typed command/payload, idempotency, lifecycle, decision actor/reason/time, proposal version, and submit/accepted event IDs. Both event IDs are workspace-aware composite foreign keys to `task_events(workspace_id, id)`; a bare UUID is never sufficient.
-
-Submission preallocates the proposal ID. One transaction inserts `change_proposal.submitted` with the proposal workspace, `aggregate_type='change_proposal'`, `aggregate_id=<new proposal ID>`, `previous_version=NULL`, and `new_version=1`, then inserts the proposal referencing that event. Missing, foreign-workspace, wrong-type, or unrelated-proposal events abort the transaction.
-
-Submit/list/get/accept/reject are explicit Gateway commands. Pending/rejected proposals are inert: no scheduling, dependency/gate satisfaction, or direct target mutation. Acceptance locks proposal+target, obtains fresh transaction-local proof, verifies pending/expected version, invokes the normal command handler, and atomically stores the emitted normal-command event ID. That event must share the proposal workspace, match `target_aggregate_type` and `target_aggregate_id`, use `causation_id=submitted_audit_event_id`, and carry `payload.changeProposalId=<locked proposal ID>`. Missing, foreign-workspace, unrelated-target, unrelated-proposal, or unrelated-command events abort acceptance.
-
-## 5. Concrete current-main N-1 migration delta
-
-**Inspected:** `origin/main:packages/db/src/schema.ts` at `e72388b2cbfe400842fe940fa6cabf984ed43711` (2026-07-13). It has global teams/no workspace keys, legacy project/mission/task statuses, nullable task project/mission, `tasks.assignee/tags/due_date`, mission JSON/config, duplicated `mission_tasks.status`, legacy agent fields, and separate fleet `backlog` claims.
-
-Legacy columns remain declared in unified `schema.ts` for expand + full N-1/rollback window. Generation must not infer early drops.
-
-### 5.1 Ordered phases
-
-1. **Pre-expand:** N-1 patch stops `mission_tasks.status` as write source; inventory writers; backup/checksum.
-2. **Expand:** add enums/tables and nullable-first columns; retain legacy declarations/uniques; emit no v1-only status.
-3. **Backfill:** bootstrap workspace; bounded idempotent cursor/checksum batches; quarantine ambiguous rows.
-4. **Validate:** no null tenant, cross-project link, ambiguous owner; status/tag/date/config retention; then constraints/NOT NULL.
-5. **Compatibility:** N-1 reads legacy; same-DB transaction mirrors only unavoidable fields; never file/Valkey dual write.
-6. **Switch:** stop N-1 writers; Gateway sole command boundary; enable canonical statuses.
-7. **Contract release:** later release after rollback/N-1; remove compatibility/global uniques/legacy fields.
-
-### 5.2 Mission candidate-key and dependent-FK DDL order
-
-KBN-100 migration DDL must execute the SI-001 portion in this order:
-
-1. expand/backfill `missions.workspace_id` and `missions.project_id` while preserving the global `missions.id` primary key and the project-congruent `missions_workspace_project_id_uidx` key;
-2. prove duplicate-key feasibility on the production-shape dataset: `(workspace_id, id)` has no duplicate groups and global `id` uniqueness remains intact;
-3. create the non-partial unique index `missions_workspace_id_uidx` on exact ordered columns `(workspace_id, id)`;
-4. only after step 3, create/alter `artifacts` and add `artifacts_workspace_mission_fk` from `(workspace_id, mission_id)` to exact `missions(workspace_id, id)` with `ON DELETE RESTRICT`;
-5. only after step 3, create/alter `approval_decisions` and add `approval_decisions_workspace_mission_fk` from `(workspace_id, mission_id)` to exact `missions(workspace_id, id)` with `ON DELETE RESTRICT`;
-6. validate both constraints and prove a mission ID paired with a foreign workspace is rejected for each child.
-
-The candidate key is intentionally redundant with globally unique `missions.id`, but PostgreSQL requires a matching unique candidate key for the exact two-column FK target. It is additive and N-1-safe. Pre-switch rollback drops the two dependent FKs/tables before dropping this candidate key, preserves the global primary key and project-congruent key, and follows the existing freeze/reconciliation rule after the first canonical mutation.
-
-### 5.3 New audit/proposal DDL order
-
-KBN-100 migration DDL may begin only after KBN-101 foundation role/schema-boundary certification. It runs in the explicit migrator/owner phase—not Gateway startup—and its generated Drizzle declaration/snapshot/journal must be mutually consistent. It must execute in this order:
-
-1. create `task_events` and its unique `(workspace_id, id)` key;
-2. create `change_proposals` with nullable acceptance-event ID and required submission-event ID;
-3. add `change_proposals_workspace_submitted_event_fk` from `(workspace_id, submitted_audit_event_id)` to `task_events(workspace_id, id)` with `ON DELETE RESTRICT`;
-4. add `change_proposals_workspace_accepted_command_event_fk` from `(workspace_id, accepted_command_audit_event_id)` to the same composite key with `ON DELETE RESTRICT`;
-5. install application-role immutability privileges and same-transaction semantic validation before enabling proposal commands.
-
-The submission transaction inserts the event first using a preallocated proposal UUID, then the proposal. Acceptance inserts the normal command event before updating the locked proposal. Neither FK is omitted or replaced by a bare UUID/index check.
-
-### 5.4 Field map
-
-| Current                                        | Expand/backfill                                                                                                       | N-1 compatibility                                     | Switch/contract                                                                    |
-| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| global `teams`, `team_members`                 | add workspace nullable; bootstrap; validate active owners                                                             | retain global slug/FKs                                | workspace composites; global unique contracts later                                |
-| `projects.status`                              | add `canonical_status`; map active/paused/completed/archived                                                          | mirror representable values; no `planning`            | canonical authority; legacy contracts later                                        |
-| project `owner_id/team_id/owner_type`          | add exact accountable user/team; deterministic map or quarantine                                                      | preserve old reads and compare drift                  | canonical exact-one; remove legacy after parity                                    |
-| current milestone                              | create milestones then join table (no circular DDL)                                                                   | absent to N-1                                         | join is authority                                                                  |
-| nullable `missions.project_id`                 | derive workspace/project; null/orphan exception, never guess                                                          | keep nullable legacy read                             | canonical required; validate/set NOT NULL later                                    |
-| mission relational candidate keys              | retain global `id` PK and project-congruent key; add non-partial `(workspace_id,id)` key before artifact/approval FKs | additive key is ignored safely by N-1 readers/writers | retain both composite keys; generic mission children use exact workspace+ID target |
-| mission `description`                          | add objective; preserve description; reviewed nonblank mapping                                                        | N-1 description                                       | objective authority; retain until signed review                                    |
-| `missions.status`                              | add canonical; planning→draft, active/paused/completed/failed same                                                    | no new-only statuses emitted                          | canonical authority                                                                |
-| mission `milestones` JSON                      | normalize with source digest; preserve malformed/original                                                             | N-1 reads JSON; no reverse sync                       | normalized authority; JSON removed after checksum sign-off                         |
-| mission config/metadata/phase/user             | retain all; map known typed policy only                                                                               | all remain declared                                   | remove only by signed consumer inventory                                           |
-| nullable `tasks.project_id`                    | derive explicit/mission project; orphan quarantine                                                                    | retain nullable read/write during compatibility       | canonical required; NOT NULL later                                                 |
-| `tasks.mission_id`                             | add project-congruent composite                                                                                       | old relation readable                                 | composite authority                                                                |
-| `tasks.status`                                 | canonical: not-started→backlog, in-progress→in_progress, others same                                                  | no ready/in_review emission                           | canonical authority                                                                |
-| `tasks.assignee`                               | deterministic active user/team/agent assignment; raw value preserved if ambiguous                                     | mirror text only if unambiguous                       | canonical owner/assignment; remove after no-loss sign-off                          |
-| `tasks.tags` JSON                              | normalize trim/case/dedupe with original digest                                                                       | transactionally mirror normalized rows                | normalized authority; JSON later removed                                           |
-| `tasks.due_date`                               | copy exactly to `due_at`                                                                                              | mirror                                                | due_at authority; legacy later                                                     |
-| task common fields                             | preserve metadata byte-for-byte; add criteria/rank/retry/archive/version/fence                                        | old reads valid                                       | new fields canonical                                                               |
-| `mission_tasks.status`                         | keep; prohibit as write source; linked status ignored; unlinked becomes task or reject                                | read-only compatibility value                         | membership uses task mission; status dropped after no readers                      |
-| mission-task notes/PR/user                     | map to metadata/artifact/event/link/attribution; preserve                                                             | read-only                                             | remove after parity                                                                |
-| `agents.status`                                | add workspace/lifecycle/runtime/roles; status remains presence                                                        | retain all legacy fields                              | lifecycle/roles authority; status may remain telemetry                             |
-| agent project/owner/prompt/tools/skills/config | preserve; validate tenant; derive typed capabilities without loss                                                     | N-1 reads                                             | removal only by separate inventory                                                 |
-| fleet `backlog`                                | map to designated-project tasks; edges; claimed rows quarantine                                                       | freeze claims before switch; read-only compare        | task/lease authority; retire after stabilization                                   |
-
-### 5.5 Required migration tests
-
-Empty DB; exact production-shape snapshot; crash/resume; rollback before switch; N-1 startup/read/write; workspace/member negatives; status-shadow/no premature new status; `mission_tasks.status` write prohibition; tags/assignee/date/mission JSON/config/description/agent checksum; project congruence/current-milestone order; backlog freeze/no dispatch; and proof legacy declarations persist until contract release.
-
-SI-001 adds frozen future executable evidence: empty and production-shape migrations create `missions_workspace_id_uidx` before either dependent FK; duplicate-key feasibility preflight returns no `(workspace_id,id)` duplicate groups without weakening global `id` uniqueness; N-1 startup/read/write behavior is unchanged; pre-switch rollback removes dependents before the candidate key; both exact FK column lists reconcile to the candidate key; and foreign-workspace mission references fail for both artifacts and approval decisions. TDD is not applicable to this design-only amendment; KBN-100 must implement these negative migration tests before runtime schema release.
-
-Proposal-specific negatives must attempt: missing submission event, foreign-workspace submission event, foreign-workspace acceptance event, same-workspace event for another proposal, event for another target aggregate, and unrelated normal-command event. Every attempt must fail atomically with no accepted proposal and no target mutation.
-
-## 6. Ownership and Coordinator split
-
-coder2 solely owns `packages/db/src/schema.ts`, `packages/db/drizzle/**`, journal/metadata, and migration tests. No other lane generates migrations. Expand is additive; no drop/rename/narrow; constraints validate before NOT NULL; compatibility is same-DB only; contract is later.
-
-KBN-200/coder4 owns pure `MechanicalCoordinatorDecisionEngineV1`: complete immutable snapshots in, deterministic eligibility/proposal/retry decisions out; no ID loading, SQL, Gateway, Valkey, proof, persistence, restart I/O, or LLM.
-
-KBN-210/coder3 owns `MechanicalCoordinatorServicePortV1`: ID loading, locks, fresh proof, assignment/approval persistence, atomic fencing, lease/checkpoint/outbox, Valkey wakes, durable retry/quarantine, and `recoverFromPostgres`. Cycle: load snapshots → pure decision → persist assignment → authoritative approval/policy → acquire by IDs/locks → increment fence → lease → ack/heartbeat/checkpoint → submit to review or durable retry/quarantine. No completion/certification/merge method exists.
-
-## 7. Exact Gateway/DTO freeze for KBN-105
-
-### 7.1 Common wire rules
-
-Base is `/api/v1/workspaces/:workspaceId`. Mutations require header `Idempotency-Key` (1–128 chars). Existing-aggregate mutations also require `If-Match-Version` (positive integer); create and privileged assignment-cycle requests are the only exceptions, while proposal submission carries `expectedTargetVersion` in its body. Body workspace fields are forbidden. Tenant denial follows one 404/403 policy without foreign existence detail.
-
-```ts
-interface SuccessEnvelopeV1<T> {
-  contractVersion: '1.0.0';
-  data: T;
-  aggregateRevision: string;
-  correlationId: string;
-}
-interface ListEnvelopeV1<T> extends SuccessEnvelopeV1<T[]> {
-  page: { cursor: string | null; nextCursor: string | null; limit: number };
-}
-```
-
-Errors are the exact health/transport/version unions in §2 plus validation/auth/not-found. Public DTOs never expose/accept internal write proof.
-
-### 7.2 Exact route registry
-
-| Method/path                                             | Request body/query                                                                                                                                                                                                             | Success data                                                         |
-| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------- |
-| `GET /kanban-health`                                    | none                                                                                                                                                                                                                           | `KanbanHealthResponseV1`                                             |
-| `GET /projects`                                         | `status,ownerUserId,ownerTeamId,cursor,limit`                                                                                                                                                                                  | project list                                                         |
-| `POST /projects`                                        | `name,key,description,status,priority,ownerUserId XOR ownerTeamId,metadata`                                                                                                                                                    | project                                                              |
-| `GET /projects/:projectId`                              | none                                                                                                                                                                                                                           | project                                                              |
-| `PATCH /projects/:projectId`                            | editable create fields + expected header                                                                                                                                                                                       | project                                                              |
-| `POST /projects/:projectId/archive`                     | `reason`                                                                                                                                                                                                                       | project                                                              |
-| `GET /tasks`                                            | `projectId,missionId,milestoneId,status,priority,ownerUserId,ownerTeamId,specialistRole,tag,dueState,archived,cursor,limit`                                                                                                    | task summary list                                                    |
-| `POST /tasks`                                           | `projectId,missionId?,milestoneId?,parentTaskId?,title,description?,acceptanceCriteria[],status,priority,rank,ownerUserId XOR ownerTeamId,specialistRole?,dueAt?,notBeforeAt?,estimateMinutes?,retryPolicy?,tagIds[],metadata` | task detail                                                          |
-| `GET /tasks/:taskId`                                    | none                                                                                                                                                                                                                           | task detail including readiness/dependencies/assignment/lease/events |
-| `PATCH /tasks/:taskId`                                  | editable non-transition fields                                                                                                                                                                                                 | task detail                                                          |
-| `POST /tasks/:taskId/transition`                        | `toStatus,reason?`                                                                                                                                                                                                             | task detail                                                          |
-| `POST /tasks/:taskId/move`                              | `toStatus?,beforeTaskId?,afterTaskId?`                                                                                                                                                                                         | task detail with persisted rank                                      |
-| `POST /tasks/:taskId/archive`                           | `reason`                                                                                                                                                                                                                       | task detail                                                          |
-| `PUT /tasks/:taskId/tags`                               | `tagIds[]`                                                                                                                                                                                                                     | task detail                                                          |
-| `POST /tasks/:taskId/dependencies`                      | `predecessorTaskId,type`                                                                                                                                                                                                       | dependency                                                           |
-| `DELETE /tasks/:taskId/dependencies/:predecessorTaskId` | no body                                                                                                                                                                                                                        | deleted dependency ID                                                |
-| `GET /tasks/:taskId/events`                             | `cursor,limit`                                                                                                                                                                                                                 | event list                                                           |
-| `GET /tags`                                             | `query,cursor,limit`                                                                                                                                                                                                           | tag list                                                             |
-| `POST /tags`                                            | `name,color?`                                                                                                                                                                                                                  | tag                                                                  |
-| `GET /change-proposals`                                 | `state,targetType,targetId,cursor,limit`                                                                                                                                                                                       | proposal list                                                        |
-| `POST /change-proposals`                                | `sourceNoteDigest,targetType,targetId,expectedTargetVersion,commandType,commandPayload`                                                                                                                                        | inert proposal                                                       |
-| `GET /change-proposals/:proposalId`                     | none                                                                                                                                                                                                                           | proposal                                                             |
-| `POST /change-proposals/:proposalId/accept`             | `reason`                                                                                                                                                                                                                       | proposal + normal command result                                     |
-| `POST /change-proposals/:proposalId/reject`             | `reason`                                                                                                                                                                                                                       | proposal                                                             |
-| `GET /coordinator/eligibility`                          | `projectId?,missionId?,cursor,limit`                                                                                                                                                                                           | `EligibilityDecisionV1[]`                                            |
-| `POST /coordinator/assignment-cycles`                   | `limit`                                                                                                                                                                                                                        | assignment proposals; privileged internal                            |
-| `POST /coordinator/assignments/:assignmentId/approve`   | `decision,reason,policyRevision,artifactIds[]`                                                                                                                                                                                 | approval decision                                                    |
-| `POST /coordinator/leases/acquire`                      | `taskId,assignmentId,approvalDecisionId,targetSessionId,leaseTtlSeconds`                                                                                                                                                       | lease with decimal-string fence                                      |
-| `POST /coordinator/leases/:leaseId/ack`                 | `taskId,sessionId,fencingToken`                                                                                                                                                                                                | lease                                                                |
-| `POST /coordinator/leases/:leaseId/heartbeat`           | `taskId,sessionId,fencingToken,extendSeconds`                                                                                                                                                                                  | lease                                                                |
-| `POST /coordinator/leases/:leaseId/checkpoints`         | `taskId,sessionId,fencingToken,sequence,resumableSummary,artifactIds[],contextUsagePercent`                                                                                                                                    | checkpoint                                                           |
-| `POST /coordinator/leases/:leaseId/submit-review`       | `taskId,sessionId,fencingToken,artifactIds[],summary`                                                                                                                                                                          | task in `in_review`                                                  |
-
-All Coordinator mutations except human approval are service-identity-only. Generic task PATCH cannot perform claim/heartbeat/checkpoint/review/certification/completion shortcuts. Completion after certification uses a separately gated lifecycle command owned by the Portfolio/Sub-Orchestrator flow, not the Coordinator.
-
-### 7.3 DTO invariants
-
-Task summary/detail use exact schema vocabularies, owner union, `version: number`, `fencingCounter: string`, explicit `archivedAt/by/reason`, normalized tags, computed readiness, and separate assignment/lease. Assignment DTO includes one persisted ID, task/version, exact principal/agent/session, role, state, expiry, policy, proposer/reason. Lease/checkpoint DTOs serialize every fence as decimal string. Proposal DTO exposes no hidden write authority.
-
-### 7.4 MCP ownership and mapping
-
-coder3 exclusively owns:
-
-- `apps/gateway/src/mcp/mcp.dto.ts`
-- `mcp.controller.ts`
-- `mcp.service.ts`
-- `mcp.module.ts`
-- `mcp.tokens.ts`
-- `mcp.service.spec.ts`
-
-MCP tools are thin maps: `mosaic_projects_{list,get,create,update,archive}`, `mosaic_tasks_{list,get,create,update,transition,move,archive,set_tags,add_dependency,remove_dependency}`, and `mosaic_change_proposals_{list,get,submit,accept,reject}` to the exact routes above. coder4 owns CLI/projection clients only and must not edit Gateway MCP files.
-
-KBN-105 publishes route+DTO fixture digest before KBN-110/120/130. Every web/CLI/MCP call must match this registry and the generated client.
-
-## 8. Recovery contract and bounded delivery slice
-
-Runtime must invoke normative `validateRecoveryPostureV1`; JSON Schema alone is insufficient. It rejects unknown fields, PITR/WAL mismatch, RPO better than mechanism, unsafe storage, and weakened High-assurance. High-assurance is RPO 15m/RTO 4h, WAL ≤5m, PITR ≥35d, base ≤24h, restore test ≤30d, break-glass ≤90d, encrypted separate-failure-domain storage.
-
-KBN-115/coder2 owns `packages/config/src/recovery-posture.ts`, tests, and recovery runbook. It wires parser/refinement, override audit, mechanism assertions, restore test, and break-glass evidence. Any deployment manifest is separately enumerated and Mos-serialized. Recovery config has no SOT/gate/Coordinator authority fields.
-
-## 9. Integration, security, and hold
-
-Required release evidence includes KBN-101 foundation role/schema-boundary and post-KBN-100 real immutable-operation deployed-role certificates (not synthetic roles), empty/prod/partial/rollback/N-1 migration tests; cross-workspace and same-workspace wrong-project negatives; active-membership owners/principals; proposal inertness/normal acceptance; exact failure mapping; concurrent monotonic bigint fences; relational lease/checkpoint/evidence mismatch; immutability privileges/RESTRICT; recovery validation/mechanism evidence; endpoint registry alignment; accessible web journeys; author≠reviewer; mandatory SecReview; final Certifier pass/no merge authority.
-
-### 9.1 SI-001 amendment gate and #757 boundary
-
-- KBN-100 must provide the §5.2 candidate-key ordering, duplicate-feasibility, exact-FK reconciliation, empty/prod/N-1/rollback, and two-child foreign-workspace evidence before SI-001 can be certified closed.
-- All prior KCR-001–016 decisions and fixed SOT/tenant/authority, proposal-audit, approval, task-fencing, immutability, and no-cascade invariants remain unchanged.
-- Read-only PR #757 cross-check: its logical-agent connector lease/CAS fencing uses separate runtime tables/contracts and `lease_epoch`; rc.4 changes only the frozen `missions` candidate key. There is no shared table, index, FK, identity, fence, or authority semantic to consume or reconcile, and #757 remains owned by its existing lane.
-
-The build hold remains active until independent re-review reports GO for KCR-001–016 and the rc.4 SI-001 amendment. Mos alone releases waves and serializes integration roots.

docs/native-kanban-sot/TASKS.md

@@ -1,278 +0,0 @@
-# Native Kanban/SOT P0–P3 — Dependency-Ordered Build Slices
-
-**Status:** CANON INDEPENDENTLY APPROVED; PUBLICATION IN PROGRESS
-**Tracking:** [Mosaic Stack issue #751](https://git.mosaicstack.dev/mosaicstack/stack/issues/751)
-**Execution:** USC web1 only; collision-free GPT coder2/3/4/5 lanes
-**Contract:** `SHARED-CONTRACT.md` + four `contracts/*.v1.ts` files
-**Implementation hold:** no feature slice starts until the canon PR is merged to `main` with terminal-green CI; after merge, each slice remains held until every declared KBN prerequisite is complete.
-
-> This publication file is not a runtime task authority. After cutover, repository `TASKS.md` is generated read-only and never imported.
-
-## Execution invariants
-
-- PostgreSQL is the sole writable SOT; current-main Drizzle is the persistence foundation.
-- Mutations require fresh internal PostgreSQL transaction-local write proof and fail closed otherwise.
-- Public health DTOs, Valkey, files, browser state, providers, and outage notes cannot authorize writes.
-- Outage notes return only through attributable `change_proposals`; proposal acceptance executes the normal command.
-- Mechanical Coordinator is non-LLM and cannot invent scope, waive gates, certify, or merge.
-- Certifier is final independent gate with no merge authority.
-- Workspace is the hard tenant. Project hierarchy is project-congruent. Assignment, approval, lease, fence, checkpoint, and evidence are relationally bound.
-- Recovery tiers change recovery posture only.
-
-## 1. Collision-free ownership
-
-| USC lane                                                | Exclusive ownership                                                                                                                                                                                                                                                                                              | Must not edit                                               |
-| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
-| **coder2 — schema/recovery**                            | `packages/db/src/schema.ts`; `packages/db/drizzle/**`; DB tests; `packages/config/src/recovery-posture.ts`; `packages/config/src/recovery-posture.spec.ts`; `docs/runbooks/kanban-postgres-recovery.md`                                                                                                          | Gateway, Brain repositories, Coordinator, web, CLI/importer |
-| **coder3 — domain/Gateway/MCP server**                  | Kanban repositories under `packages/brain/src/`; Gateway workspace/project/mission/milestone/task/kanban/health/coord modules; **exact MCP files:** `apps/gateway/src/mcp/mcp.dto.ts`, `mcp.controller.ts`, `mcp.service.ts`, `mcp.module.ts`, `mcp.tokens.ts`, `mcp.service.spec.ts`; Gateway root wiring/tests | DB schema/migrations, `packages/coord`, web, CLI/importer   |
-| **coder4 — CLI → pure Coordinator → migration tooling** | In this one fixed lane order: KBN-120 (`packages/mosaic` CLI/projection) → KBN-200 (`packages/coord/src/mechanical/**`) → KBN-300/320 (`scripts/kanban-migration/**`)                                                                                                                                            | DB, Gateway/MCP server, web                                 |
-| **coder5 — web**                                        | `apps/web/src/app/(dashboard)/{tasks,projects}/**`; `apps/web/src/components/{tasks,projects}/**`; Kanban web API/types; later Coordinator/migration-review routes                                                                                                                                               | DB, Gateway, Coordinator, CLI/importer                      |
-| **Mos — publication/integration**                       | Contract amendments, exact endpoint registry publication, serialized root exports/manifests/lockfiles, integration gates                                                                                                                                                                                         | Active lane feature files                                   |
-
-Shared roots, package exports/manifests, lockfiles, and generated artifacts are integration-serialized. Contract changes stop affected lanes and require Mos approval.
-
-## 2. Parallelization legend
-
-- **SERIAL:** prerequisite must be complete and reviewed.
-- **PARALLEL-GROUP:** disjoint files and exact frozen contract permit concurrent work.
-- **LANE-SERIAL:** one lane's stated order cannot change.
-- **INTEGRATION-SERIAL:** component heads green first; semantic findings return to owner.
-
-## 3. Corrected dependency graph
-
-```text
-KBN-000 canon remediation
-  -> KBN-010 threat/auth/constraint-impact gate (MUST COMPLETE)
-      -> KBN-101 foundation role/schema-boundary certificate (SERIAL)
-          -> KBN-100 schema + concrete N-1 migration implementation
-              ├─ KBN-101 post-KBN-100 deployed-role immutable-operation certificate (SERIAL)
-              │    -> KBN-105 exact endpoint/DTO/error/registry freeze (SERIAL)
-              │        ├─ KBN-110 domain + Gateway + MCP server implementation
-              │        ├─ KBN-120 CLI/projection implementation [coder4 first]
-              │        └─ KBN-130 web MVP implementation
-              └─ KBN-115 recovery parser/mechanism slice [coder2 lane-serial]
-KBN-110 + KBN-120 + KBN-130 + KBN-115
-  -> KBN-140 P1 integration/SIT
-      -> KBN-200 pure decision engine [coder4 after KBN-120]
-          -> KBN-210 persistence/service adapter + approval/lease binding
-              -> KBN-220 Coordinator operations UI
-                  -> KBN-230 P2 concurrency/fault/gate integration
-KBN-230
-  -> KBN-300 importer dry-run/apply/verify [coder4 after KBN-200]
-      ├─ KBN-310 migration reviewer UI
-      └─ KBN-320 cutover/rollback tooling [coder4 after KBN-300]
-KBN-310 + KBN-320
-  -> KBN-330 rehearsal/reconciliation
-      -> KBN-340 owner-gated cutover/stabilization
-```
-
-No consumer implementation begins before KBN-105. No schema work begins before KBN-010 completes and the KBN-101 foundation role/schema-boundary certificate passes; the real immutable-operation certificate follows KBN-100 and blocks KBN-105. The coder4 order is always KBN-120 → KBN-200 → KBN-300 → KBN-320.
-
-## 4. P0 — Canon, threat gate, schema, and exact API freeze
-
-### KBN-000 — Remediate and publish canon
-
-- **Status:** COMPLETE — PR #752 squash-merged as `49e8a54`; issue #751 closed; post-merge pipeline #1798 terminal success.
-- **Owner:** Mosaic publication control plane.
-- **Mode:** SERIAL; completed.
-- **IN:** Resolve KCR-001–016 in requirements, schema, health, Coordinator, recovery, migration map, and slices; independent re-review.
-- **OUT:** Feature implementation.
-- **Depends on:** none.
-- **Contract surfaces:** all canon.
-- **Evidence:** strict TS; Prettier; per-finding traceability; independent author≠reviewer GO; Ultron GO; terminal-green CI.
-
-### KBN-010 — Threat, authorization, and constraint-impact gate
-
-- **Status:** IN PROGRESS — issue [#753](https://git.mosaicstack.dev/mosaicstack/stack/issues/753).
-- **Owner:** `kbn-coder3`; independent `secrev`.
-- **Mode:** SERIAL prerequisite of KBN-100.
-- **Exclusive files:** `docs/native-kanban-sot/KBN-010-THREAT-AUTH-CONSTRAINT-GATE.md` and task scratchpad only.
-- **IN:** Cross-workspace owners/principals/evidence; active membership; stale/forged health; approval forgery; fence monotonicity; audit retention; proposal target/audit-event forgery; service tokens; DB/Valkey outage.
-- **OUT:** Runtime/schema edits.
-- **Depends on:** KBN-000 independent re-review GO.
-- **Contract surfaces:** schema constraints, health proof, exact errors, command-family authorization.
-- **Evidence:** signed constraint-impact matrix; no unresolved schema-impact finding; SecReview pass.
-
-### KBN-101 — PostgreSQL runtime/migration role split and deployed-role certification
-
-- **Status:** IN PROGRESS — issue [#771](https://git.mosaicstack.dev/mosaicstack/stack/issues/771); rc.16 closes HIGH-1 current generic storage-wrapper authority: README/user-guide remove `storage migrate --run` guidance and false runner delegation; current source is direct-Drizzle, legacy N-1, uncertified, non-operative, and forbidden pending -02/-03/-06/-08 activation. The -06 fixture fails both exact former forms before inventory/status masking and source-consistency rejects current direct-Drizzle wrapper as runner delegation. It awaits independent exact-head re-review; implementation remains held.
-- **Owner:** Mos integration control plane; independently reviewed by security/Ultron.
-- **Mode:** SERIAL foundation certificate blocks KBN-100; its post-KBN-100 real immutable-operation certificate blocks KBN-105.
-- **IN:** Exact `DATABASE_URL` non-owner runtime versus `DATABASE_MIGRATION_URL` owner/migrator connection contract; sole published `mosaic-db-migrator --run|--verify` PostgreSQL DDL path and all legacy/future entrypoint closure; active migrate-tier destination only after runner prepare/verify through exact `--target-url-file /run/secrets/mosaic-migrate-target-url`, paired authenticated provider-version file, and signed `--target-attestation-file /run/mosaic-attestations/migrate-target.v1.json`; runner-only signing key/public-key isolation; canonical Vault KV-v2 target URL/version, generation-pinned renderer, importer CA/public-key/attestation plus privileged sealed producer-to-importer handoff, safe-fd/consumer-isolation/no-log-oracle, TLS/server/database/role/manifest/schema binding, expiry/replay/provider-rotation/TOCTOU/no-DML controls, and dedicated non-DDL importer; finite exact-path scanner/allowlist/active-route review plus unsuppressible automatic-startup/init/Compose-before-runner semantic negatives and every-path before-connect denial matrix; `DATABASE_TLS_CA_CERT_PATH` plus operator/IaC CA/server-key/cert lifecycle, exact service-DNS SANs, Vault/compose/Swarm mount modes, TLS server/bootstrap/rotation/rollback; PGlite exception; fixed two-int advisory lock; manifest-v1 logical-index/tag/exact-byte-SHA-256 ledger reconciliation including safe `0009`; fixed `mosaic` schema and exact `pg_catalog,mosaic` pooled session path; platform/schema/`NOLOGIN SUPERUSER` extension-owner/migrator/importer/runtime roles; approved-owner versus legacy-owner shadow pgvector transition; ownership, zero membership/no runtime secret, TEMP/ledger-read/default privilege and immutable grant proof; N-1 inactive prepared cards then atomic activation/rollback authority; Vault/redaction/observability/operator runbooks; one-card/one-PR implementation DAG.
-- **OUT:** Production mutation in this planning card; KBN-100 tables/data backfill; application API behavior; KBN-105 route/DTO freeze.
-- **Depends on:** KBN-010 completed.
-- **Contract surfaces:** [`KBN-101-DB-ROLE-SPLIT.md`](./KBN-101-DB-ROLE-SPLIT.md); `SHARED-CONTRACT.md` rc.15 amendment.
-- **Evidence:** foundation: exact `--help|--run|--verify`/exit/argv/import-negative plus DTO entrypoint negatives for every finite classified current DDL/static-bypass path (including `DATABASE_URL`-only, runner fixture, retired init, sanitized current operator guidance, both harness pairs, and `db:push` refusal); active migrate-tier paired URL/version/attestation files, signing/public-key isolation, canonical Vault KV-v2 authenticated version, generation-pinned renderer, importer CA, safe fd/TOCTOU/consumer-isolation/no-log-oracle, atomic JCS/Ed25519, digest/TLS/server/database/role/manifest/schema binding, expiry/replay/provider rotation/revocation, zero-connection versus zero-DML, prepared-target/importer/no-DDL negatives; clean/pre-0009/skipped/applied-late/duplicate/unknown/missing/corrupt/stale/backup plus public-to-`mosaic`/partial/reverse runner proof; fixed-lock contention/crash/readiness/unrelated-key tests; runtime cannot invoke migrations/DDL/TEMP; actual pgvector 0.8.2 control metadata, fresh/approved-owner existing/legacy-owner shadow/partial-resume-rollback/N-1 pgvector evidence with `rolcanlogin=false`, `rolsuper=true`, zero members, external-superuser `SET ROLE`/`RESET ROLE` audit, `pg_extension.extowner`, owner-bearing member/schema/version and runtime/migrator/schema-owner/importer/all-service-role `SET ROLE`/ALTER/DROP/member-update denial; disposable standalone, federated/Swarm, and two-gateway verified-TLS positives plus both-pair CA/SAN/downgrade/key mode/UID-GID/URL-secret consumer-isolation and legacy-drain/`hostssl` zero-plaintext negatives; exclusive bootstrap/renderer/manifest ownership test; catalog relocation/vector-query/operator/Drizzle-only-`mosaic`, role/grant/search-path/pool-reset/identifier checks; N-1/atomic TLS-only rollback/no-force-on-red rehearsal; named Vault/bootstrap-control-plane/CA-overlap/redaction/operator evidence; independent author≠reviewer security GO. Post-KBN-100: real deployed non-owner INSERT/SELECT and UPDATE/DELETE denial for immutable event/artifact/evidence relations plus Ultron GO.
-
-### KBN-100 — Unified Drizzle schema and concrete N-1 migration
-
-- **Owner:** **coder2**.
-- **Mode:** SERIAL.
-- **Exclusive files:** `packages/db/src/schema.ts`, `packages/db/drizzle/**`, DB tests.
-- **IN:** All frozen tables/joins/enums; workspace/project-congruent constraints; owners/principals; tags/archive; change proposals with both workspace-aware task-event composite FKs and frozen event-before-proposal DDL order; assignment approvals; durable execution/quarantine; monotonic bigint fence; exact checkpoint/evidence joins; RESTRICT/immutability; concrete current-main expand/backfill/switch/contract map.
-- **OUT:** Repositories, Gateway, Coordinator behavior, UI, importer.
-- **Depends on:** **KBN-010 completed and KBN-101 foundation role/schema-boundary certificate PASS**. KBN-100 is blocked until both are terminal; it rebases on KBN-101 main, restores generated Drizzle declaration/snapshot/journal consistency, and confines procedural immutable-table grant/trigger/backfill work to its schema ownership. Its new relations are then subject to KBN-101 post-KBN-100 deployed-role certification.
-- **Contract surfaces:** `kanban-schema.v1.ts`; SHARED-CONTRACT current-main delta map.
-- **Evidence:** reviewed SQL; empty/prod-shape/partial-resume/rollback tests; N-1 app safety; legacy columns remain declared; workspace/project mismatch negatives; proposal event-FK missing/foreign-workspace tests; one active lease; monotonic fence; parent-delete RESTRICT; immutability privileges; SecReview.
-
-### KBN-105 — Exact Gateway/MCP endpoint, DTO, and error freeze
-
-- **Owner:** Mos + coder3 contract author; independent endpoint-alignment reviewer.
-- **Mode:** SERIAL after KBN-100; prerequisite for KBN-110/120/130.
-- **Exclusive files:** canonical endpoint-registry/DTO contract docs; no implementation.
-- **IN:** Exact routes and methods from SHARED-CONTRACT §8; request/success/error fields; status codes; pagination/filter/revision envelopes; idempotency/expected-version headers/fields; proposal commands; health proof exclusion from public DTOs; MCP tool-to-route map.
-- **OUT:** Controller/service/client implementation.
-- **Depends on:** KBN-100 and KBN-101 post-KBN-100 deployed-role immutable-operation certification PASS.
-- **Contract surfaces:** health/error unions; schema IDs/statuses; Gateway DTO freeze.
-- **Evidence:** every FE/CLI/MCP call maps 1:1 to a route; 503/502-504/409 non-cross-map fixtures; contract digest published.
-
-### KBN-115 — Recovery posture parser, mechanisms, and evidence
-
-- **Owner:** **coder2**, lane-serial after KBN-100.
-- **Mode:** PARALLEL with KBN-110/120/130 after KBN-105.
-- **Exclusive files:** `packages/config/src/recovery-posture.ts`, `.spec.ts`, `docs/runbooks/kanban-postgres-recovery.md`; deployment-specific backup manifest changes are a separately enumerated Mos integration patch.
-- **IN:** Wire normative `validateRecoveryPostureV1`; override audit; backup/WAL/PITR mechanism assertions; off-cluster encryption/failure-domain checks; restore and break-glass evidence procedure.
-- **OUT:** SOT/gate/Coordinator policy knobs; DB business schema.
-- **Depends on:** KBN-100, KBN-105.
-- **Contract surfaces:** `recovery-posture.v1.ts` only.
-- **Evidence:** impossible-combination tests; High-assurance weakening tests; selected-tier mechanism verification; restore and break-glass evidence; SecReview.
-
-## 5. P1 — Thin native MVP
-
-### KBN-110 — Workspace-safe domain, Gateway, MCP server, and proposal commands
-
-- **Owner:** **coder3**.
-- **Mode:** PARALLEL-GROUP P1-A after KBN-105.
-- **Exclusive files:** ownership map, including all exact MCP server files listed there.
-- **IN:** Workspace-safe repositories; project/task/dependency/tag/archive CRUD; transitions; exact owners; assignment/approval/link/artifact queries; submit/query/accept/reject change proposals; health endpoint; internal write-proof mint/revalidation; event/outbox atomicity; frozen DTOs/routes.
-- **OUT:** Scheduling algorithm, web, CLI, DB schema.
-- **Depends on:** KBN-100, KBN-105.
-- **Contract surfaces:** all four TypeScript contracts and exact registry.
-- **Evidence:** DTO/service/controller/integration tests; active-membership and no-oracle negatives; proposal cannot mutate directly; submission event is the new proposal's exact `change_proposal.submitted` event; acceptance links the executed normal command for the locked proposal and same workspace/target; missing, foreign-workspace, unrelated-proposal/target/command event negatives; exact failure mapping; endpoint registry; SecReview.
-
-### KBN-120 — CLI, MCP client mapping, and generated projection
-
-- **Owner:** **coder4**; first coder4 slice.
-- **Mode:** PARALLEL-GROUP P1-A after KBN-105.
-- **Exclusive files:** `packages/mosaic/src/commands/{kanban,tasks,projects}.ts`; `packages/mosaic/src/projections/**`; tests. **No `apps/gateway/src/mcp/**` edits.\*\*
-- **IN:** Frozen query/mutation routes; proposal commands; compact context; generated `TASKS.md`; deliberate denial/transport/conflict handling.
-- **OUT:** Gateway/MCP server, file importer, raw SQL/Valkey, Coordinator.
-- **Depends on:** KBN-105; runtime integration later requires KBN-110.
-- **Evidence:** contract fixtures; same revision; no import parser; same idempotency key on transport retry; 503 never auto-retried.
-
-### KBN-130 — Writable Kanban/List and minimal Projects UI
-
-- **Owner:** **coder5**.
-- **Mode:** PARALLEL-GROUP P1-A after KBN-105.
-- **Exclusive files:** web ownership map.
-- **IN:** Workspace context; projects; tasks; tags; explicit archive; detail; accessible move/reorder; filters; dependency/readiness; owner/assignment/lease; audit; proposal visibility; conflict/loading/error/reconnect.
-- **OUT:** Gateway/schema, Coordinator operations UI, migration UI.
-- **Depends on:** KBN-105; runtime integration later requires KBN-110.
-- **Evidence:** frozen contract mocks; real-Gateway journeys; keyboard/non-drag; tags/archive semantics; no-oracle tenant negatives; 503/transport/409 distinct UI.
-
-### KBN-140 — P1 integration and situational gate
-
-- **Owner:** Mos integration; independent reviewer/SecReview/Certifier.
-- **Mode:** INTEGRATION-SERIAL.
-- **IN:** KBN-110/120/130/115; unavoidable root exports only.
-- **OUT:** P2 behavior.
-- **Depends on:** KBN-110, KBN-120, KBN-130, KBN-115.
-- **Evidence:** clean migration; web/CLI/MCP/projection revision parity; forged/expired health negatives; change-proposal event-chain success plus missing/foreign/unrelated-event negatives; tag/archive; tenant negatives; endpoint registry; author-independent review; Certifier pass.
-
-## 6. P2 — Mechanical Coordinator
-
-### KBN-200 — Pure deterministic decision engine
-
-- **Owner:** **coder4**; second coder4 slice, strictly after KBN-120.
-- **Mode:** SERIAL in coder4 lane.
-- **Exclusive files:** `packages/coord/src/mechanical/**` and pure tests.
-- **IN:** `MechanicalCoordinatorDecisionEngineV1`; complete immutable snapshots; eligibility/explanation; fairness/order; capability matching; expiry/retry/quarantine decisions.
-- **OUT:** ID loading, PostgreSQL, Drizzle, Gateway, Valkey, health-proof minting, persistence, `recoverFromPostgres`, LLM calls.
-- **Depends on:** KBN-140 (or Mos may release after KBN-120 + frozen types if no P1 semantic risk remains).
-- **Evidence:** deterministic/property tests; snapshot completeness; no I/O/model imports; no authority methods.
-
-### KBN-210 — Coordinator persistence/service adapter and approval-bound leases
-
-- **Owner:** **coder3**.
-- **Mode:** SERIAL after KBN-200.
-- **Exclusive files:** Gateway `coord` and repositories.
-- **IN:** `MechanicalCoordinatorServicePortV1`; snapshot loading; proposal persistence; manual/versioned policy approval; acquire by IDs; reload+lock task/assignment/approval/session; fresh txn-local write proof; atomic task fence increment; lease/ack/heartbeat/checkpoint/submit; durable retry/quarantine; outbox/Valkey wake; restart recovery.
-- **OUT:** Pure algorithm, UI, DB schema.
-- **Depends on:** KBN-110, KBN-200.
-- **Evidence:** forged/stale approval rejection; target/session/version/expiry/policy checks; concurrent monotonic fences; same-workspace mismatch negatives; bigint precision; stale worker rejection; DB/Valkey faults; SecReview.
-
-### KBN-220 — Coordinator operations UI
-
-- **Owner:** **coder5**.
-- **Mode:** after KBN-210 exact DTO freeze.
-- **IN:** Roster; eligibility; persisted assignment state; approvals/overrides; exact lease/fence; durable retry/quarantine; role/gate/Certifier visibility.
-- **OUT:** Scheduling decisions, schema, merge control for Certifier.
-- **Depends on:** KBN-210.
-- **Evidence:** authorized journeys; reason required; stale refresh; no Certifier merge; endpoint alignment/accessibility.
-
-### KBN-230 — P2 concurrency/fault/gate integration
-
-- **Owner:** Mos integration; independent reviewer/SecReview/Certifier.
-- **Mode:** INTEGRATION-SERIAL.
-- **Depends on:** KBN-200, KBN-210, KBN-220.
-- **Evidence:** one lease; monotonic fences; exact relational mismatches rejected; expired proof; forged healthy; approval binding; restart; durable quarantine; outbox recovery; author≠reviewer; Certifier final/no merge.
-
-## 7. P3 — Shadow migration and cutover
-
-### KBN-300 — One-way importer dry-run/apply/verify
-
-- **Owner:** **coder4**; third coder4 slice.
-- **Mode:** after KBN-230.
-- **Exclusive files:** `scripts/kanban-migration/import/**`.
-- **IN:** Immutable jarvis-brain/Vikunja snapshots; deterministic mapping; source digest/lineage; Gateway writes; rejects; no dispatch.
-- **OUT:** Bidirectional sync, direct DB/file canonical writes, unrelated brain data.
-- **Depends on:** KBN-230.
-- **Evidence:** idempotency; counts/fields; malformed/foreign rejects; no dispatch; SecReview.
-
-### KBN-310 — Shadow reviewer UI
-
-- **Owner:** **coder5**.
-- **Mode:** PARALLEL-GROUP P3-A after KBN-300 report freeze.
-- **IN:** Read-only counts/diffs/rejects/lineage/sign-off.
-- **OUT:** Apply/cutover mutations.
-- **Depends on:** KBN-300.
-- **Evidence:** read-only and tenant tests; pagination/accessibility.
-
-### KBN-320 — Cutover/rollback tooling
-
-- **Owner:** **coder4**; fourth coder4 slice, after KBN-300.
-- **Mode:** PARALLEL-GROUP P3-A with KBN-310.
-- **Exclusive files:** `scripts/kanban-migration/cutover/**`.
-- **IN:** Freeze assertion; backup/checksum; final delta; client switch; legacy writer/credential shutdown; rollback delta; stabilization.
-- **OUT:** Destructive deletion, reverse sync, ungated production execution.
-- **Depends on:** KBN-300.
-- **Evidence:** fail-safe rehearsal; no dual writer; rollback authority; SecReview.
-
-### KBN-330 — Migration rehearsal/reconciliation
-
-- **Owner:** Mos + coder4 support + independent data reviewer.
-- **Mode:** INTEGRATION-SERIAL.
-- **Depends on:** KBN-310, KBN-320.
-- **Evidence:** signed exceptions; selected-tier restore; backlog hold; no legacy changes; Certifier readiness.
-
-### KBN-340 — Final cutover/stabilization
-
-- **Owner:** Mos/control plane; owner-gated operation.
-- **Mode:** SERIAL.
-- **Depends on:** KBN-330 PASS and Jason authorization.
-- **Evidence:** no legacy writer; scoped Gateway identities; no accidental dispatch; terminal green health/CI; Certifier evidence; owner retirement approval.
-
-## 8. Consistent USC wave schedule
-
-| Wave | coder2                                    | coder3                                                                               | coder4                         | coder5                         |
-| ---- | ----------------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------ | ------------------------------ |
-| 0    | Wait                                      | **KBN-010**                                                                          | Wait                           | Wait                           |
-| 0.5  | Wait                                      | **KBN-101 foundation** Mos-controlled role/connection contract and certificate       | Wait                           | Wait                           |
-| 1    | **KBN-100** after KBN-101 foundation PASS | Review bounded schema/grant implementation                                           | Wait                           | Wait                           |
-| 1.5  | Certification support                     | **KBN-101 post-KBN-100 deployed-role immutable-operation certificate**, then KBN-105 | Wait                           | Wait                           |
-| 2    | **KBN-115** after KBN-100                 | **KBN-105** exact freeze, then KBN-110                                               | **KBN-120** only after KBN-105 | **KBN-130** only after KBN-105 |
-| 3    | Review support                            | Finish KBN-110                                                                       | **KBN-200 after KBN-120**      | Finish KBN-130                 |
-| 4    | —                                         | **KBN-210 after KBN-200**                                                            | Review/support                 | **KBN-220 after KBN-210 DTOs** |
-| 5    | —                                         | P2 remediation                                                                       | **KBN-300 then KBN-320**       | **KBN-310**                    |
-
-Mos alone releases slices and lifts the build hold after independent re-review GO.