docs: finalize ri-4-001 scratchpad with verification evidence (#1275 )

docs: ri-4-001 scratchpad for PRD authority card (#1275 )
test(mosaic): RI-N3 contract specs for prdy and mission --plan adapters (#1275 )
2026-08-17 16:48:39 -05:00 · 2026-08-17 16:46:17 -05:00 · 2026-08-17 16:46:14 -05:00 · 2026-08-17 16:46:06 -05:00 · 2026-08-17 16:46:00 -05:00
31 changed files with 1574 additions and 730 deletions
@@ -12,33 +12,6 @@ The default tmux socket is `mosaic-fleet` so fleet commands do not touch the
 default tmux server. The roster is the desired-state authority; generated environment files are
 rebuildable projections, never a second source of configuration.

-## Brain-home split (fleet state vs framework templates)
-
-When a mosaic-brain clone is present, fleet **state** resolves from the brain
-home while framework templates and dispatch state stay in the config home
-(three-tree model, canon `docs/STRUCTURE-CANON.md` §2):
-
-| Path                                                                            | Without brain (legacy)                | With brain                     |
-| ------------------------------------------------------------------------------- | ------------------------------------- | ------------------------------ |
-| `fleet/agents/<seat>.env.*`                                                     | `~/.config/mosaic/fleet/agents/`      | `~/.mosaic/fleet/agents/`      |
-| `fleet/roles.local/` (overrides)                                                | `~/.config/mosaic/fleet/roles.local/` | `~/.mosaic/fleet/roles.local/` |
-| `fleet/profiles/` (working copies)                                              | `~/.config/mosaic/fleet/profiles/`    | `~/.mosaic/fleet/profiles/`    |
-| `fleet/roster.yaml`, `fleet/roles/` (baseline), `fleet/run/`, `fleet/services/` | `~/.config/mosaic/fleet/…`            | unchanged (config home)        |
-
-Activation (`packages/mosaic/src/fleet/brain-home.ts`, mirrored in
-`tools/fleet/start-agent-session.sh`):
-
-1. `MOSAIC_BRAIN_HOME` env var — explicit, always wins.
-2. Canonical `~/.mosaic` — adopted only when `MOSAIC_HOME` is the default
-   `~/.config/mosaic` AND `~/.mosaic/fleet/agents` exists. Custom
-   `--mosaic-home` values (tests, sandboxes, canaries) never adopt, keeping
-   them hermetic.
-3. Otherwise the config home (legacy single-tree behavior).
-
-Seat env dirs under a brain are subject to the same privacy boundary (0700
-dirs, 0600 files); `.env.generated` files are structure-valuable and tracked
-in the brain repo, hand-maintained `.env`/`.env.local` stay ignored and private.
-
 ## Examples

 - `examples/minimal.yaml` starts one local canary slot.
@@ -255,68 +255,6 @@ fleet_declared_transport() {
  printf '%s\n' "${declared:-tmux}"
 }

-# Brain-home fleet-state resolution (#1298; canon STRUCTURE-CANON §2).
-#
-# Seat launch envs, roles.local overrides, and profile working copies resolve
-# from the brain home when one is active; roster, baseline roles, run/, and
-# services stay under MOSAIC_HOME. This check surfaces which tree fleet state
-# resolves from and the drift a launch would otherwise hit at runtime:
-#
-# - a stale MOSAIC_BRAIN_HOME pointing at a directory with no fleet/agents is a
-#   misconfiguration the resolver honors (explicit wins) — warn, don't pass;
-# - a symlinked brain or agents dir defeats the managed-directory boundary;
-# - a group/world-readable agents dir violates the 0700 projection boundary;
-# - env files left in the config-home tree while a brain is active are split
-#   state — the write path rejects NEW split writes, but nothing would ever
-#   tell the operator the old files are stranded.
-resolve_brain_home() {
-  local explicit="${MOSAIC_BRAIN_HOME:-}"
-  if [[ -n "$(printf '%s' "$explicit" | tr -d '[:space:]')" ]]; then
-    printf '%s' "$explicit"
-    return
-  fi
-  if [[ "$(cd "$MOSAIC_HOME" 2>/dev/null && pwd -P)" == "$HOME/.config/mosaic" \
-     && -d "$HOME/.mosaic/fleet/agents" ]]; then
-    printf '%s' "$HOME/.mosaic"
-    return
-  fi
-  printf '%s' "$MOSAIC_HOME"
-}
-
-check_brain_home() {
-  local brain agents mode
-  brain="$(resolve_brain_home)"
-
-  if [[ "$brain" == "$MOSAIC_HOME" ]]; then
-    pass "Fleet state home: $MOSAIC_HOME (legacy single-tree; no brain adopted)"
-    return
-  fi
-
-  agents="$brain/fleet/agents"
-  if [[ ! -d "$agents" ]]; then
-    warn "Brain home '$brain' has no fleet/agents — seat envs will not resolve from it. Point MOSAIC_BRAIN_HOME at a brain carrying fleet/agents, or unset it."
-    return
-  fi
-  if [[ -L "$brain" || -L "$agents" ]]; then
-    warn "Brain fleet-state path resolves through a symlink ($brain) — the managed-directory boundary requires regular directories."
-    return
-  fi
-
-  mode="$(stat -c '%a' -- "$agents" 2>/dev/null)" || mode=""
-  if [[ -n "$mode" ]] && (( (8#$mode & 8#077) != 0 )); then
-    warn "Brain agents dir '$agents' is group/world-accessible (mode $mode) — the projection boundary requires 0700."
-    return
-  fi
-
-  if [[ -d "$MOSAIC_HOME/fleet/agents" ]] \
-     && ls "$MOSAIC_HOME/fleet/agents/"*.env* >/dev/null 2>&1; then
-    warn "Fleet env files exist in BOTH trees — brain '$brain' is active but '$MOSAIC_HOME/fleet/agents' still carries env files (split state). Migrate them (mosaic fleet regen) and remove the config-home copies."
-    return
-  fi
-
-  pass "Fleet state home: $brain (brain active); roster + templates: $MOSAIC_HOME"
-}
-
 check_fleet_transport() {
  local transport
  transport="$(fleet_declared_transport)"
@@ -335,8 +273,6 @@ check_fleet_transport() {

 check_fleet_transport

-check_brain_home
-
 # Legacy migration surfaces should no longer contain symlink trees.
 legacy_paths=(
  "$HOME/.claude/agent-guides"
@@ -1,108 +0,0 @@
-#!/usr/bin/env bash
-# Covers the brain-home fleet-state check in `mosaic-doctor` (#1298 follow-up).
-#
-# The functions are extracted from the shipped script rather than copied here
-# (same discipline as test-fleet-transport-check.sh): a test that carries its
-# own copy of the logic keeps passing after the shipped copy changes.
-# Extraction is by exact function header and a closing brace in column one.
-set -euo pipefail
-
-SCRIPT_DIR=$(cd -- "$(dirname "$0")" && pwd)
-DOCTOR="$SCRIPT_DIR/mosaic-doctor"
-
-fail() {
-  echo "FAIL: $*" >&2
-  exit 1
-}
-
-[ -f "$DOCTOR" ] || fail "missing mosaic-doctor at $DOCTOR"
-
-extract_function() {
-  local name="$1"
-  local extracted
-  extracted=$(sed -n "/^${name}() {/,/^}/p" "$DOCTOR")
-  [ -n "$extracted" ] || fail "could not extract ${name}() from mosaic-doctor — script reshaped?"
-  printf '%s\n' "$extracted"
-}
-
-for fn in resolve_brain_home check_brain_home; do
-  extract_function "$fn" >/dev/null
-done
-
-warn_count=0
-warn() { warn_count=$((warn_count + 1)); echo "[WARN] $*"; }
-pass() { echo "[OK] $*"; return 0; }
-
-eval "$(extract_function resolve_brain_home)"
-eval "$(extract_function check_brain_home)"
-
-ROOT=$(mktemp -d)
-trap 'rm -rf "$ROOT"' EXIT
-
-run_case() {
-  # label, expect (ok|warn), then env assignments as arguments.
-  # The check runs under `env` in a subshell, so its warn() also prints a
-  # sentinel the parent counts — a subshell counter would never be visible.
-  local label="$1" expect="$2"
-  shift 2
-  local out warns
-  out=$(env "$@" bash -c "warn() { echo \"[WARN] \$*\"; }; pass() { echo \"[OK] \$*\"; return 0; }; $(extract_function resolve_brain_home); $(extract_function check_brain_home); check_brain_home" 2>&1)
-  warns=$(printf '%s\n' "$out" | grep -c '^\[WARN\]' || true)
-  if [[ "$expect" == ok && "$warns" -eq 0 ]]; then
-    echo "ok - $label"
-  elif [[ "$expect" == warn && "$warns" -gt 0 ]]; then
-    echo "ok - $label (warned)"
-  else
-    echo "output: $out" >&2
-    fail "$label: expected $expect (warns=$warns)"
-  fi
-}
-
-# ── legacy: no brain, custom home never adopts ─────────────────────────────
-mkdir -p "$ROOT/legacy-mosaic/fleet/agents"
-run_case "custom home without brain stays legacy" ok \
-  MOSAIC_HOME="$ROOT/legacy-mosaic" HOME="$ROOT"
-
-# ── healthy brain at the default config home ───────────────────────────────
-mkdir -p "$ROOT/home/.config/mosaic" "$ROOT/home/.mosaic/fleet/agents"
-chmod 700 "$ROOT/home/.mosaic/fleet/agents"
-run_case "default home adopts healthy brain" ok \
-  MOSAIC_HOME="$ROOT/home/.config/mosaic" HOME="$ROOT/home"
-
-# ── explicit MOSAIC_BRAIN_HOME to a brain without fleet/agents → warn ──────
-mkdir -p "$ROOT/brain-noagents/fleet" "$ROOT/config"
-run_case "explicit brain without agents warns" warn \
-  MOSAIC_HOME="$ROOT/config" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-noagents"
-
-# ── explicit MOSAIC_BRAIN_HOME to a healthy brain → ok ─────────────────────
-mkdir -p "$ROOT/brain-ok/fleet/agents" "$ROOT/config2"
-chmod 700 "$ROOT/brain-ok/fleet/agents"
-run_case "explicit healthy brain passes" ok \
-  MOSAIC_HOME="$ROOT/config2" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-ok"
-
-# ── group-readable agents dir → warn (0700 boundary) ───────────────────────
-mkdir -p "$ROOT/brain-loose/fleet/agents" "$ROOT/config3"
-chmod 750 "$ROOT/brain-loose/fleet/agents"
-run_case "group-readable brain agents warns" warn \
-  MOSAIC_HOME="$ROOT/config3" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-loose"
-
-# ── symlinked agents dir → warn (managed-directory boundary) ───────────────
-mkdir -p "$ROOT/brain-link/real-agents" "$ROOT/brain-link/fleet" "$ROOT/config4"
-ln -s "$ROOT/brain-link/real-agents" "$ROOT/brain-link/fleet/agents"
-run_case "symlinked brain agents warns" warn \
-  MOSAIC_HOME="$ROOT/config4" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-link"
-
-# ── split state: envs in BOTH trees → warn ─────────────────────────────────
-mkdir -p "$ROOT/brain-split/fleet/agents" "$ROOT/config5/fleet/agents"
-chmod 700 "$ROOT/brain-split/fleet/agents" "$ROOT/config5/fleet/agents"
-touch "$ROOT/config5/fleet/agents/coder0.env.generated"
-run_case "env files in both trees warns (split state)" warn \
-  MOSAIC_HOME="$ROOT/config5" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-split"
-
-# ── config-home agents dir WITHOUT env files alongside a brain → ok ────────
-mkdir -p "$ROOT/brain-clean/fleet/agents" "$ROOT/config6/fleet/agents"
-chmod 700 "$ROOT/brain-clean/fleet/agents" "$ROOT/config6/fleet/agents"
-run_case "empty config-home agents dir alongside brain passes" ok \
-  MOSAIC_HOME="$ROOT/config6" HOME="$ROOT" MOSAIC_BRAIN_HOME="$ROOT/brain-clean"
-
-echo "ok - mosaic-doctor brain-home check"
@@ -80,26 +80,6 @@ safe_path "$MOSAIC_HOME" || fail_env unsafe-path MOSAIC_HOME "$MOSAIC_HOME"

 FLEET_DIR="$MOSAIC_HOME/fleet"
 AGENT_ENV_DIR="$FLEET_DIR/agents"
-
-# Brain-home split (canon docs/STRUCTURE-CANON.md §2): seat launch envs live
-# under the brain home's fleet/agents when a brain is active; roster, roles
-# baseline, and runtime state (fleet/run) stay under MOSAIC_HOME.
-# Resolution mirrors packages/mosaic/src/fleet/brain-home.ts:
-#   1. MOSAIC_BRAIN_HOME env (explicit, always wins)
-#   2. ~/.mosaic — adopted only when MOSAIC_HOME is the default config home AND
-#      ~/.mosaic/fleet/agents exists
-#   3. MOSAIC_HOME (legacy single-tree)
-BRAIN_HOME="${MOSAIC_BRAIN_HOME:-}"
-if [ -z "$BRAIN_HOME" ]; then
-  BRAIN_HOME="$MOSAIC_HOME"
-  if [ "$(cd "$MOSAIC_HOME" 2>/dev/null && pwd -P)" = "$HOME/.config/mosaic" ] \
-     && [ -d "$HOME/.mosaic/fleet/agents" ]; then
-    BRAIN_HOME="$HOME/.mosaic"
-  fi
-fi
-if [ "$BRAIN_HOME" != "$MOSAIC_HOME" ]; then
-  AGENT_ENV_DIR="$BRAIN_HOME/fleet/agents"
-fi
 assert_managed_directory "$MOSAIC_HOME"
 assert_managed_directory "$FLEET_DIR"
 assert_private_directory "$AGENT_ENV_DIR"
@@ -167,54 +167,6 @@ if echo "$valid_args" | grep -qF 'bash -c'; then
  fail "launcher constructed a shell command payload"
 fi

-# ── Brain-home split (canon §2) ─────────────────────────────────────────
-# When MOSAIC_HOME is the default config home under $HOME and the host carries
-# $HOME/.mosaic/fleet/agents, seat envs resolve from the brain tree; the config
-# home still owns fleet/run (holder-owner) and remains a managed boundary.
-: > "$TMUX_CALLS"
-HOME_BRAIN="$ROOT/brain-home"
-CONFIG_HOME="$HOME_BRAIN/.config/mosaic"
-BRAIN="$HOME_BRAIN/.mosaic"
-mkdir -p "$CONFIG_HOME/fleet/run" "$BRAIN/fleet/agents" "$HOME_BRAIN/work"
-chmod 700 "$CONFIG_HOME" "$CONFIG_HOME/fleet" "$CONFIG_HOME/fleet/run" \
-  "$BRAIN/fleet/agents" "$HOME_BRAIN/work"
-printf '123e4567-e89b-12d3-a456-426614174000\n' > "$CONFIG_HOME/fleet/run/holder-owner"
-chmod 600 "$CONFIG_HOME/fleet/run/holder-owner"
-cat > "$BRAIN/fleet/agents/coder-brain.env.generated" <<EOF
-MOSAIC_AGENT_NAME=coder-brain
-MOSAIC_AGENT_CLASS=code
-MOSAIC_AGENT_RUNTIME=pi
-MOSAIC_AGENT_MODEL=openai-codex/gpt-5.6-sol
-MOSAIC_AGENT_REASONING=high
-MOSAIC_AGENT_TOOL_POLICY=code
-MOSAIC_AGENT_WORKDIR=$HOME_BRAIN/work
-MOSAIC_TMUX_SOCKET=mosaic-test
-EOF
-chmod 600 "$BRAIN/fleet/agents/coder-brain.env.generated"
-install_pane_binaries "$HOME_BRAIN"
-HOME="$HOME_BRAIN" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
-  MOSAIC_TEST_PANE_PID=$$ MOSAIC_TEST_HOME="$HOME_BRAIN" \
-  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
-  MOSAIC_HOME="$CONFIG_HOME" "$START" coder-brain
-brain_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-echo "$brain_args" | grep -qF new-session || fail "brain-home generated projection did not reach tmux"
-echo "$brain_args" | grep -qF 'coder-brain' || fail "brain-home agent env was not the launch source"
-[ -f "$BRAIN/fleet/agents/coder-brain.env.generated" ] || fail "brain generated env vanished"
-
-# Negative control: the SAME default-config-home shape but without
-# ~/.mosaic/fleet/agents — the config-home env tree is used directly (legacy).
-: > "$TMUX_CALLS"
-HOME_NOBRAIN="$ROOT/brainless-home"
-CONFIG_HOME_NOBRAIN="$HOME_NOBRAIN/.config/mosaic"
-write_generated "$CONFIG_HOME_NOBRAIN" "coder-legacy"
-install_pane_binaries "$HOME_NOBRAIN"
-HOME="$HOME_NOBRAIN" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
-  MOSAIC_TEST_PANE_PID=$$ MOSAIC_TEST_HOME="$HOME_NOBRAIN" \
-  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
-  MOSAIC_HOME="$CONFIG_HOME_NOBRAIN" "$START" coder-legacy
-legacy_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-echo "$legacy_args" | grep -qF new-session || fail "legacy single-tree launch regressed"
-
 # The pane must start through an absolute clean-environment boundary. Its
 # runtime command remains an argv vector, but no holder/session environment
 # control variable can pass through the pane command.
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh && bash framework/tools/_scripts/test-brain-home-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -1,6 +1,5 @@
 import { readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
-import { fleetAgentEnvDir, fleetRolesLocalDir } from '../fleet/brain-home.js';
 import type { Command } from 'commander';
 import {
  executeFleetAgentMutation,
@@ -150,9 +149,9 @@ async function executeCommand(
    request,
    mosaicHome,
    rosterPath,
-    agentEnvDir: fleetAgentEnvDir(mosaicHome),
+    agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
    rolesDir: join(mosaicHome, 'fleet', 'roles'),
-    overrideDir: fleetRolesLocalDir(mosaicHome),
+    overrideDir: join(mosaicHome, 'fleet', 'roles.local'),
    dryRun: forceDryRun || opts.dryRun === true,
    ...(deps.projectionApplier === undefined ? {} : { projectionApplier: deps.projectionApplier }),
  });
@@ -1,6 +1,5 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { fleetAgentEnvDir, fleetRolesLocalDir } from '../fleet/brain-home.js';
 import type { Command } from 'commander';
 import {
  parseV1MigrationObservations,
@@ -121,11 +120,11 @@ export function registerFleetMigrationCommand(
          observations,
          personaDirs: {
            rolesDir: deps.rolesDir ?? join(mosaicHome, 'fleet', 'roles'),
-            overrideDir: deps.overrideDir ?? fleetRolesLocalDir(mosaicHome),
+            overrideDir: deps.overrideDir ?? join(mosaicHome, 'fleet', 'roles.local'),
          },
          environment: {
            mosaicHome,
-            agentEnvDir: fleetAgentEnvDir(mosaicHome),
+            agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
          },
        });
        printJson(preview);
@@ -30,21 +30,19 @@ import { lstat, readFile, readdir, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, sep } from 'node:path';
 import type { Command } from 'commander';
-import { fleetRolesLocalDir } from '../fleet/brain-home.js';

 function defaultMosaicHome(): string {
  return process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
 }

-/** Baseline persona role contracts (reseeded on update; config home — framework). */
+/** Baseline persona role contracts (reseeded on update). */
 export function defaultRolesDir(mosaicHome = defaultMosaicHome()): string {
  return join(mosaicHome, 'fleet', 'roles');
 }

-/** PRESERVE-protected override layer (survives update; wins on merge).
- * Brain home (`~/.mosaic/fleet/roles.local`) when a brain is active. */
+/** PRESERVE-protected override layer (survives update; wins on merge). */
 export function defaultOverrideDir(mosaicHome = defaultMosaicHome()): string {
-  return fleetRolesLocalDir(mosaicHome);
+  return join(mosaicHome, 'fleet', 'roles.local');
 }

 /**
@@ -25,7 +25,6 @@ import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import type { Command } from 'commander';
 import YAML from 'yaml';
-import { fleetProfilesDir } from '../fleet/brain-home.js';
 import {
  defaultOverrideDir,
  extractClassesFromDir,
@@ -37,10 +36,9 @@ function defaultMosaicHome(): string {
  return process.env['MOSAIC_HOME'] ?? join(homedir(), '.config', 'mosaic');
 }

-/** Directory holding the seeded profile yaml files — brain home when active
- * (user working copies, committed), else the config home seed. */
+/** Directory holding the seeded profile yaml files. */
 export function defaultProfilesDir(mosaicHome = defaultMosaicHome()): string {
-  return fleetProfilesDir(mosaicHome);
+  return join(mosaicHome, 'fleet', 'profiles');
 }

 /** Directory holding the persona role contracts. */
@@ -3,7 +3,6 @@ import { homedir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
 import type { Command } from 'commander';
 import type { CommandRunner } from './fleet.js';
-import { fleetAgentEnvDir } from '../fleet/brain-home.js';
 import {
  applyPreparedGeneratedAgentEnvironmentProjection,
  prepareGeneratedAgentEnvironmentProjection,
@@ -154,7 +153,7 @@ export async function executeFleetRegen(
  options: FleetRegenOptions,
 ): Promise<FleetRegenResult> {
  const mosaicHome = defaultMosaicHome(deps);
-  const agentEnvDir = fleetAgentEnvDir(mosaicHome);
+  const agentEnvDir = join(mosaicHome, 'fleet', 'agents');
  const rosterPath = join(mosaicHome, 'fleet', 'roster.yaml');
  const readRoster = deps.readRoster ?? defaultReadRoster(deps, mosaicHome);
  const prepare = deps.prepareProjection ?? prepareGeneratedAgentEnvironmentProjection;
@@ -13,7 +13,6 @@ import {
 import { randomUUID } from 'node:crypto';
 import { homedir, hostname, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { fleetAgentEnvDir } from '../fleet/brain-home.js';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import * as readline from 'node:readline';
@@ -159,7 +158,7 @@ export function resolveFleetPaths(mosaicHome = defaultMosaicHome()): FleetPaths
    fleetToolsDir: join(mosaicHome, 'tools', 'fleet'),
    tmuxToolsDir: join(mosaicHome, 'tools', 'tmux'),
    systemdUserDir: join(homedir(), '.config', 'systemd', 'user'),
-    agentEnvDir: fleetAgentEnvDir(mosaicHome),
+    agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
  };
 }

@@ -349,90 +349,3 @@ describe('registerRuntimeLaunchers — claudex (EXPERIMENTAL overlay)', () => {
    expect(mockExit).not.toHaveBeenCalled();
  });
 });
-
-// ─── Seat harness homes (MOSAIC-D-002, brain-home split) ────────────────────
-
-import { activeSeatDir, seatPersonaOverlay } from './launch.js';
-
-describe('activeSeatDir — per-agent harness home resolution', () => {
-  let root: string;
-  const savedAgentName = process.env['MOSAIC_AGENT_NAME'];
-  const savedBrainHome = process.env['MOSAIC_BRAIN_HOME'];
-
-  beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), 'mosaic-seat-home-'));
-    delete process.env['MOSAIC_BRAIN_HOME'];
-  });
-
-  afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-    if (savedAgentName === undefined) {
-      delete process.env['MOSAIC_AGENT_NAME'];
-    } else {
-      process.env['MOSAIC_AGENT_NAME'] = savedAgentName;
-    }
-    if (savedBrainHome !== undefined) {
-      process.env['MOSAIC_BRAIN_HOME'] = savedBrainHome;
-    } else {
-      delete process.env['MOSAIC_BRAIN_HOME'];
-    }
-  });
-
-  it('resolves the seat dir when MOSAIC_BRAIN_HOME carries the seat', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBe(seat);
-  });
-
-  it('returns undefined without an agent name (bare launches stay shared)', () => {
-    delete process.env['MOSAIC_AGENT_NAME'];
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-  });
-
-  it('returns undefined when the seat dir does not exist in the brain', () => {
-    process.env['MOSAIC_AGENT_NAME'] = 'ghost';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-    mkdirSync(join(root, 'brain', 'fleet', 'agents'), { recursive: true });
-
-    expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-  });
-
-  it.each(['../escape', 'a/b', '.hidden-start', '', 'spaced name'])(
-    'rejects unsafe agent name %j (path traversal cannot leave the seat store)',
-    (name: string) => {
-      process.env['MOSAIC_AGENT_NAME'] = name;
-      process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-      expect(activeSeatDir(join(root, 'config', 'mosaic'))).toBeUndefined();
-    },
-  );
-
-  it('seatPersonaOverlay renders the seat SOUL.md as an overlay block', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    writeFileSync(join(seat, 'SOUL.md'), '# coder0 — code seat persona\n\nShips tested code.\n');
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    const overlay = seatPersonaOverlay(join(root, 'config', 'mosaic'));
-    expect(overlay).toContain('## Seat Persona');
-    expect(overlay).toContain('coder0 — code seat persona');
-  });
-
-  it('seatPersonaOverlay is empty when the seat carries no SOUL.md', () => {
-    const seat = join(root, 'brain', 'fleet', 'agents', 'coder0');
-    mkdirSync(seat, { recursive: true });
-    process.env['MOSAIC_AGENT_NAME'] = 'coder0';
-    process.env['MOSAIC_BRAIN_HOME'] = join(root, 'brain');
-
-    expect(seatPersonaOverlay(join(root, 'config', 'mosaic'))).toBe('');
-  });
-
-  it('seatPersonaOverlay is empty when no agent name is set', () => {
-    delete process.env['MOSAIC_AGENT_NAME'];
-    expect(seatPersonaOverlay(join(root, 'config', 'mosaic'))).toBe('');
-  });
-});
@@ -19,7 +19,7 @@ import {
 import { createHash, randomBytes } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { homedir, hostname } from 'node:os';
-import { join, dirname, resolve } from 'node:path';
+import { join, dirname } from 'node:path';
 import type { Command } from 'commander';
 import {
  buildResolvedFleetCommsBlock,
@@ -29,7 +29,6 @@ import {
 import { readRegularFileSecure } from '../fleet/secure-file.js';
 import { readPersonaContractBlock } from '../fleet/persona-contract.js';
 import { canonicalizeRoleClass } from './fleet-personas.js';
-import { resolveBrainHome } from '../fleet/brain-home.js';
 import { launchClaudex, type ClaudexHarnessAdapter } from './claudex.js';
 import { runLeaseEnforcementDoctorCheck } from './lease-doctor-check.js';

@@ -65,46 +64,9 @@ const HARNESS_HOME_ENV: Record<RuntimeName, string> = {
  opencode: 'XDG_CONFIG_HOME',
 };

-/** Dedicated mosaic-owned home for a runtime: ~/.config/mosaic/.<runtime>.
- * With an active brain seat (MOSAIC_AGENT_NAME + seat dir in the brain home)
- * the home is per-agent instead: <brainHome>/fleet/agents/<seat>/.<runtime> —
- * per-agent sessions, settings, and auth inside the seat dir (canon §2,
- * MOSAIC-D-002). Seat runtime dirs are dot-named so the brain's ignore policy
- * (per-seat .pi/.claude/.codex dirs) keeps credential material untracked. */
-const SEAT_AGENT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
-
-export function activeSeatDir(mosaicHome: string = MOSAIC_HOME): string | undefined {
-  const agent = process.env['MOSAIC_AGENT_NAME']?.trim();
-  if (
-    agent === undefined ||
-    agent === '' ||
-    !SEAT_AGENT_NAME_RE.test(agent) ||
-    agent.includes('..')
-  ) {
-    return undefined;
-  }
-  const brain = resolveBrainHome(mosaicHome);
-  if (resolve(brain) === resolve(mosaicHome)) return undefined; // no brain
-  const seat = join(brain, 'fleet', 'agents', agent);
-  return existsSync(seat) ? seat : undefined;
-}
-
-function harnessHome(runtime: RuntimeName, mosaicHome: string = MOSAIC_HOME): string {
-  const seat = activeSeatDir(mosaicHome);
-  if (seat !== undefined) return join(seat, `.${runtime}`);
-  return join(mosaicHome, `.${runtime}`);
-}
-
-/** Seat persona block: with an active brain seat, <seat>/SOUL.md layers
- * persona on the root generic base (canon invariant; MOSAIC-D-002). The base
- * SOUL stays load-on-demand — only the seat delta is injected by value.
- * Empty string when no seat is active or the seat carries no SOUL.md. */
-export function seatPersonaOverlay(mosaicHome: string = MOSAIC_HOME): string {
-  const seatDir = activeSeatDir(mosaicHome);
-  if (seatDir === undefined) return '';
-  const seatSoul = readOptional(join(seatDir, 'SOUL.md'));
-  if (!seatSoul.trim()) return '';
-  return '## Seat Persona\n\n' + seatSoul.trim();
+/** Dedicated mosaic-owned home for a runtime: ~/.config/mosaic/.<runtime> */
+function harnessHome(runtime: RuntimeName): string {
+  return join(MOSAIC_HOME, `.${runtime}`);
 }

 /**
@@ -220,8 +182,6 @@ function recordLaunch(runtime: RuntimeName, cliArgs: string[], yolo: boolean): v
      cli_version: CLI_VERSION,
      config_home: harnessHome(runtime),
      config_home_isolated: true,
-      config_home_kind: activeSeatDir() !== undefined ? 'seat' : 'runtime-shared',
-      agent_name: process.env['MOSAIC_AGENT_NAME']?.trim() || null,
      config_home_env: HARNESS_HOME_ENV[runtime] ?? null,
      argv: redactArgv(cliArgs),
      normative_fragments: normativeFragmentDigests(runtime),
@@ -609,11 +569,6 @@ For required push/merge/issue-close/release actions, execute without routine con
  if (soulLocal.trim()) {
    overlayBlocks.push('## Persona Overlay (SOUL.local.md)\n\n' + soulLocal.trim());
  }
-  // Seat persona (MOSAIC-D-002): per-seat SOUL.md layers on the generic base.
-  const seatPersona = seatPersonaOverlay(mosaicHome);
-  if (seatPersona !== '') {
-    overlayBlocks.push(seatPersona);
-  }
  const standardsLocal = readOptional(join(mosaicHome, 'STANDARDS.local.md'));
  if (standardsLocal.trim()) {
    overlayBlocks.push('## Standards Overlay (STANDARDS.local.md)\n\n' + standardsLocal.trim());
@@ -0,0 +1,149 @@
+import { mkdtemp, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { parse as parseYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerMissionCommand } from './mission.js';
+import { PrdService } from '@mosaicstack/prdy';
+import type { MissionInfo } from '../tui/gateway-api.js';
+
+// ── Mocks: the gateway is not available in adapter tests ──────────────────────
+
+// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
+// be initialized there too.
+const MISSION = vi.hoisted(
+  (): MissionInfo => ({
+    id: 'mission-plan-1',
+    name: 'Plan Mission Alpha',
+    description: null,
+    status: 'planning',
+    projectId: null,
+    userId: null,
+    phase: null,
+    milestones: null,
+    config: null,
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-03-04T05:06:07.000Z',
+  }),
+);
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
+  fetchMission: vi.fn(),
+  createMission: vi.fn(),
+  updateMission: vi.fn(),
+  fetchMissionTasks: vi.fn().mockResolvedValue([]),
+  createMissionTask: vi.fn(),
+  updateMissionTask: vi.fn(),
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerMissionCommand(program);
+  return program;
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
+  process.chdir(projectDir);
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  consoleStub.push(logSpy);
+});
+
+afterEach(() => {
+  // Restore only the per-test spies; module factory mocks keep their
+  // implementations across tests.
+  for (const stub of consoleStub) stub.mockRestore();
+  consoleStub = [];
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic mission --plan (thin adapter over PrdService)', () => {
+  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // PRD landed in the same store `mosaic prdy` uses.
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    // Fresh service instance (new-process equivalent) reads the linkage back.
+    const service = new PrdService({ projectPath: projectDir });
+    const docs = await service.list();
+    expect(docs).toHaveLength(1);
+
+    const prd = docs[0]!;
+    expect(prd.title).toBe('Plan Mission Alpha');
+    expect(prd.version).toBe(1);
+
+    const links = await service.listMissionLinks(prd.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: MISSION.id,
+      missionVersion: MISSION.updatedAt, // mission version marker
+      prdVersion: 1,
+    });
+
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
+  });
+
+  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
+    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
+
+    expect(persisted.missions).toHaveLength(1);
+    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
+  });
+
+  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
+    // Mission path.
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // prdy path (service, non-interactive entry).
+    const service = new PrdService({ projectPath: projectDir });
+    const direct = await service.create({ name: 'Directly Created' });
+
+    const all = await service.list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
+    expect(all).toHaveLength(2);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toContain(`${direct.id}.yaml`);
+
+    // Both are v1 in the same store with distinct stable ids.
+    for (const doc of all) {
+      expect(doc.version).toBe(1);
+      expect(files).toContain(`${doc.id}.yaml`);
+    }
+  });
+});
@@ -256,14 +256,41 @@ async function planMission(
  console.log(`Planning mission: ${mission.name}\n`);

  try {
-    const { runPrdWizard } = await import('@mosaicstack/prdy');
-    await runPrdWizard({
+    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
+    // PrdService — no second writer path. The mission's updatedAt serves as
+    // its version marker (the gateway exposes no numeric mission version).
+    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+    const service = new PrdService({ projectPath: process.cwd() });
+
+    if (process.stdout.isTTY) {
+      const created = await runPrdWizard({
+        name: mission.name,
+        projectPath: process.cwd(),
+        interactive: true,
+      });
+      const linked = await service.linkMission({
+        prdId: created.id,
+        missionId: mission.id,
+        missionVersion: mission.updatedAt,
+        requirementIds: [],
+      });
+      console.log(
+        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
+      );
+      return;
+    }
+
+    const doc = await service.planForMission({
      name: mission.name,
-      projectPath: process.cwd(),
-      interactive: true,
+      missionId: mission.id,
+      missionVersion: mission.updatedAt,
+      requirementIds: [],
    });
+    console.log(
+      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
+    );
  } catch (err) {
-    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
    process.exit(1);
  }
 }
@@ -0,0 +1,204 @@
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { stringify as stringifyYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerPrdyCommand } from './prdy.js';
+import { PrdService } from '@mosaicstack/prdy';
+
+// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
+//    outside the tmp project dir) ──────────────────────────────────────────────
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+class ProcessExitError extends Error {
+  constructor(readonly code: number) {
+    super(`process.exit(${code})`);
+  }
+}
+
+function stubProcessExit() {
+  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    throw new ProcessExitError(code ?? 0);
+  }) as never);
+}
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let errorSpy: ReturnType<typeof vi.spyOn>;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let exitStub: ReturnType<typeof stubProcessExit>;
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerPrdyCommand(program);
+  return program;
+}
+
+function runPrdy(args: string[]): Promise<unknown> {
+  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
+}
+
+function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    id: 'cmd-import-prd',
+    title: 'Command Import PRD',
+    status: 'approved', // must be forced to draft: validity is not approval
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
+  process.chdir(projectDir);
+  exitStub = stubProcessExit();
+  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+});
+
+afterEach(() => {
+  // Restore only the per-test spies: module factory mocks must keep their
+  // implementations for the next test.
+  exitStub.mockRestore();
+  errorSpy.mockRestore();
+  logSpy.mockRestore();
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic prdy (thin adapter over PrdService)', () => {
+  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
+    await runPrdy(['--init', 'Adapter Created']);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.title).toBe('Adapter Created');
+    expect(docs[0]?.version).toBe(1);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
+  });
+
+  it('--import <file> creates a valid import through the service', async () => {
+    const filePath = path.join(projectDir, 'incoming.yaml');
+    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
+
+    await runPrdy(['--import', filePath]);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.id).toBe('cmd-import-prd');
+    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
+  });
+
+  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
+    const filePath = path.join(projectDir, 'broken.yaml');
+    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    // Typed refusal surfaced to the user, nothing created.
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
+    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Conflict Target' });
+    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
+    const beforeBytes = await readFile(storeFile, 'utf8');
+
+    const filePath = path.join(projectDir, 'divergent.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Divergent Command Import',
+        }),
+      ),
+      'utf8',
+    );
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
+
+    // Original authority document is byte-identical on disk.
+    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
+  });
+
+  it('--import --accept-successor persists the successor version explicitly', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Successor Target' });
+
+    const filePath = path.join(projectDir, 'divergent2.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Accepted Via CLI',
+        }),
+      ),
+      'utf8',
+    );
+
+    await runPrdy(['--import', filePath, '--accept-successor']);
+
+    const doc = await service.get(existing.id);
+    expect(doc.version).toBe(2);
+    expect(doc.title).toBe('Accepted Via CLI');
+    expect(doc.status).toBe('draft');
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
+  });
+
+  it('--export writes a labeled generated view and never touches authority', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const created = await service.create({ name: 'Export Via CLI' });
+    const before = await service.get(created.id);
+
+    await runPrdy(['--export', created.id]);
+
+    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
+    const md = await readFile(mdPath, 'utf8');
+    expect(md).toContain('generated view — do not edit');
+    expect(md).toContain(`prd-id: ${created.id}`);
+    expect(md).toContain('prd-version: 1');
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining(`Generated view written: ${mdPath}`),
+    );
+
+    // Authority unchanged by the export.
+    expect(await service.get(created.id)).toEqual(before);
+  });
+});
@@ -2,6 +2,10 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';

+/**
+ * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
+ * All reads/writes go through the service; there is no local writer path.
+ */
 export function registerPrdyCommand(program: Command) {
  const cmd = program
    .command('prdy')
@@ -9,12 +13,18 @@ export function registerPrdyCommand(program: Command) {
    .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
    .option('--init [name]', 'Create a new PRD')
    .option('--update [name]', 'Update an existing PRD')
+    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
+    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
+    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
    .option('--project <idOrName>', 'Scope to project')
    .action(
      async (opts: {
        gateway: string;
        init?: string | boolean;
        update?: string | boolean;
+        import?: string;
+        acceptSuccessor?: boolean;
+        export?: string | boolean;
        project?: string;
      }) => {
        // Detect project context when --project flag is provided
@@ -31,20 +41,69 @@ export function registerPrdyCommand(program: Command) {
          }
        }

+        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+        const service = new PrdService({ projectPath: process.cwd() });
+
        try {
-          const { runPrdWizard } = await import('@mosaicstack/prdy');
+          if (opts.import !== undefined) {
+            const input = { filePath: opts.import };
+
+            if (opts.acceptSuccessor) {
+              const successor = await service.acceptSuccessor(input);
+              console.log(
+                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
+              );
+              return;
+            }
+
+            const result = await service.importDocument(input);
+            console.log(
+              result.kind === 'created'
+                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
+                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
+            );
+            return;
+          }
+
+          if (opts.export !== undefined) {
+            const id =
+              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
+            const result = await service.exportMarkdown({ id });
+            console.log(
+              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
+            );
+            return;
+          }
+
          const name =
            typeof opts.init === 'string'
              ? opts.init
              : typeof opts.update === 'string'
                ? opts.update
                : 'untitled';
-          await runPrdWizard({
-            name,
-            projectPath: process.cwd(),
-            interactive: true,
-          });
+
+          if (process.stdout.isTTY) {
+            await runPrdWizard({
+              name,
+              projectPath: process.cwd(),
+              interactive: true,
+            });
+            return;
+          }
+
+          // Non-interactive fallback routes through the service directly.
+          const doc = await service.create({ name });
+          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
        } catch (err) {
+          if (err instanceof Error && err.name === 'PrdImportConflictError') {
+            const conflict = err as { proposal?: { version?: number } };
+            console.error(`${err.message}`);
+            console.error(
+              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
+            );
+            process.exit(1);
+          }
+
          console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
          process.exit(1);
        }
@@ -1,114 +0,0 @@
-import { mkdir, mkdtemp, rm } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  brainHomeIsActive,
-  fleetAgentEnvDir,
-  fleetProfilesDir,
-  fleetRolesLocalDir,
-  fleetStateDir,
-  resolveBrainHome,
-  type BrainHomeOptions,
-} from './brain-home.js';
-
-describe('fleet brain-home resolution', (): void => {
-  let cleanup: string | undefined;
-
-  const savedBrainEnv = process.env['MOSAIC_BRAIN_HOME'];
-
-  beforeEach((): void => {
-    delete process.env['MOSAIC_BRAIN_HOME'];
-  });
-
-  afterEach(async (): Promise<void> => {
-    if (savedBrainEnv === undefined) {
-      delete process.env['MOSAIC_BRAIN_HOME'];
-    } else {
-      process.env['MOSAIC_BRAIN_HOME'] = savedBrainEnv;
-    }
-    if (cleanup !== undefined) {
-      await rm(cleanup, { recursive: true, force: true });
-      cleanup = undefined;
-    }
-  });
-
-  async function makeTmp(): Promise<string> {
-    const root = await mkdtemp(join(tmpdir(), 'mosaic-brain-home-'));
-    cleanup = root;
-    return root;
-  }
-
-  it('MOSAIC_BRAIN_HOME env wins over every other signal', (): void => {
-    process.env['MOSAIC_BRAIN_HOME'] = '/explicit/brain';
-    expect(resolveBrainHome('/any/mosaic-home')).toBe('/explicit/brain');
-    expect(fleetAgentEnvDir('/any/mosaic-home')).toBe('/explicit/brain/fleet/agents');
-    expect(brainHomeIsActive('/any/mosaic-home')).toBe(true);
-  });
-
-  it('injected envBrainHome wins identically (test seam)', (): void => {
-    const opts: BrainHomeOptions = { envBrainHome: '/injected/brain' };
-    expect(resolveBrainHome('/any/mosaic-home', opts)).toBe('/injected/brain');
-    expect(fleetAgentEnvDir('/any/mosaic-home', opts)).toBe('/injected/brain/fleet/agents');
-  });
-
-  it('a non-default mosaicHome never adopts the canonical brain (hermetic legacy)', (): void => {
-    const mosaicHome = '/tmp/not-the-default-config-home';
-    expect(resolveBrainHome(mosaicHome)).toBe(mosaicHome);
-    expect(brainHomeIsActive(mosaicHome)).toBe(false);
-    expect(fleetAgentEnvDir(mosaicHome)).toBe(join(mosaicHome, 'fleet', 'agents'));
-  });
-
-  it('the default config home adopts the brain when it carries fleet/agents', async (): Promise<void> => {
-    const root = await makeTmp();
-    const brain = join(root, 'brain');
-    await mkdir(join(brain, 'fleet', 'agents'), { recursive: true });
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = { homes: { brain, configDefault: configHome } };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(brain);
-    expect(fleetAgentEnvDir(configHome, opts)).toBe(join(brain, 'fleet', 'agents'));
-    expect(fleetRolesLocalDir(configHome, opts)).toBe(join(brain, 'fleet', 'roles.local'));
-    expect(fleetProfilesDir(configHome, opts)).toBe(join(brain, 'fleet', 'profiles'));
-    expect(fleetStateDir(configHome, opts)).toBe(join(brain, 'fleet'));
-    expect(brainHomeIsActive(configHome, opts)).toBe(true);
-  });
-
-  it('the default config home stays legacy when no brain exists', async (): Promise<void> => {
-    const root = await makeTmp();
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = {
-      homes: { brain: join(root, 'brain'), configDefault: configHome },
-    };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(configHome);
-    expect(brainHomeIsActive(configHome, opts)).toBe(false);
-  });
-
-  it('an empty MOSAIC_BRAIN_HOME is ignored, not treated as set', (): void => {
-    process.env['MOSAIC_BRAIN_HOME'] = '   ';
-    expect(resolveBrainHome('/tmp/legacy-home')).toBe('/tmp/legacy-home');
-  });
-
-  it('adoption requires fleet/agents specifically, not any brain content', async (): Promise<void> => {
-    const root = await makeTmp();
-    const brain = join(root, 'brain');
-    await mkdir(join(brain, 'fleet'), { recursive: true }); // fleet without agents
-    const configHome = join(root, 'config', 'mosaic');
-    const opts: BrainHomeOptions = { homes: { brain, configDefault: configHome } };
-
-    expect(resolveBrainHome(configHome, opts)).toBe(configHome);
-  });
-
-  it('real-home control: a host brain is adopted only through the default home', (): void => {
-    // Control on the un-injected path: this host carries ~/.mosaic/fleet/agents,
-    // so the default config home resolves to the brain or legacy — both valid
-    // canonical endpoints — while a non-default home never adopts.
-    const defaultHome = join(homedir(), '.config', 'mosaic');
-    const resolved = resolveBrainHome(defaultHome);
-    expect([defaultHome, join(homedir(), '.mosaic')]).toContain(resolved);
-    expect(resolveBrainHome(join(homedir(), 'elsewhere', 'mosaic'))).toBe(
-      join(homedir(), 'elsewhere', 'mosaic'),
-    );
-  });
-});
@@ -1,76 +0,0 @@
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-
-/**
- * Overridable resolution inputs (tests inject tmp homes; production reads
- * the environment and the real home directory).
- */
-export interface BrainHomeOptions {
-  /** Explicit brain home; defaults to `MOSAIC_BRAIN_HOME`. */
-  readonly envBrainHome?: string;
-  /**
-   * Canonical homes used for adoption. Defaults derive from the real
-   * `homedir()`: `{ brain: ~/.mosaic, configDefault: ~/.config/mosaic }`.
-   */
-  readonly homes?: { readonly brain: string; readonly configDefault: string };
-}
-
-/**
- * Brain-home resolution — the three-tree fleet split (stack canon
- * `docs/STRUCTURE-CANON.md` §2, first carried by the USC estate brain):
- *
- *   config home (~/.config/mosaic)  framework templates + dispatch state:
- *                                   fleet/roles (baseline), fleet/roster.yaml,
- *                                   fleet/run (heartbeats), fleet/services
- *   brain home  (~/.mosaic)         user-owned fleet state, committed:
- *                                   fleet/agents/<seat>.env.*, fleet/roles.local,
- *                                   fleet/profiles working copies
- *
- * Resolution order:
- *   1. `MOSAIC_BRAIN_HOME` env (explicit, always wins)
- *   2. canonical `~/.mosaic` — adopted ONLY when mosaicHome is the real
- *      default config home AND `~/.mosaic/fleet/agents` exists. Custom
- *      `--mosaic-home` values (tests, sandboxes, canaries) never trigger
- *      adoption, keeping them hermetic and deterministic.
- *   3. mosaicHome itself (legacy single-tree behavior).
- */
-export function resolveBrainHome(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  const explicit = options.envBrainHome ?? process.env['MOSAIC_BRAIN_HOME'];
-  if (explicit !== undefined && explicit.trim() !== '') {
-    return explicit;
-  }
-  const homes = options.homes ?? {
-    brain: join(homedir(), '.mosaic'),
-    configDefault: join(homedir(), '.config', 'mosaic'),
-  };
-  if (resolve(mosaicHome) !== resolve(homes.configDefault)) {
-    return mosaicHome;
-  }
-  return existsSync(join(homes.brain, 'fleet', 'agents')) ? homes.brain : mosaicHome;
-}
-
-/** True when fleet state resolves somewhere other than the config home. */
-export function brainHomeIsActive(mosaicHome: string, options: BrainHomeOptions = {}): boolean {
-  return resolve(resolveBrainHome(mosaicHome, options)) !== resolve(mosaicHome);
-}
-
-/** Fleet state root (brain home when active, else the config home). */
-export function fleetStateDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(resolveBrainHome(mosaicHome, options), 'fleet');
-}
-
-/** Seat launch envs — `<brainHome>/fleet/agents` when a brain is active. */
-export function fleetAgentEnvDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'agents');
-}
-
-/** PRESERVE-protected persona override layer — `<brainHome>/fleet/roles.local`. */
-export function fleetRolesLocalDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'roles.local');
-}
-
-/** System-type profiles (user working copies) — `<brainHome>/fleet/profiles`. */
-export function fleetProfilesDir(mosaicHome: string, options: BrainHomeOptions = {}): string {
-  return join(fleetStateDir(mosaicHome, options), 'profiles');
-}
@@ -3,7 +3,6 @@ import { lstat, open, readFile, unlink, type FileHandle } from 'node:fs/promises
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { fleetAgentEnvDir } from './brain-home.js';
 import {
  applyPreparedAgentEnvironmentProjection,
  prepareAgentEnvironmentProjection,
@@ -618,7 +617,7 @@ function defaultPrepareProjections(
        (agent: FleetRosterV2Agent): Promise<PreparedAgentEnvironmentProjection> =>
          prepareAgentEnvironmentProjection({
            mosaicHome,
-            agentEnvDir: fleetAgentEnvDir(mosaicHome),
+            agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
            agentName: agent.name,
            generated: projectRosterV2AgentGeneratedEnv(roster, agent),
          }),
@@ -176,52 +176,6 @@ describe('generated fleet agent environment boundary', (): void => {
    expect((await stat(result.generatedPath)).mode & 0o777).toBe(0o600);
  });

-  it('brain home: accepts and writes projections under MOSAIC_BRAIN_HOME/fleet/agents', async (): Promise<void> => {
-    const savedBrainHome = process.env['MOSAIC_BRAIN_HOME'];
-    try {
-      cleanup = await mkdtemp(join(tmpdir(), 'mosaic-generated-env-'));
-      const mosaicHome = join(cleanup, 'config-home');
-      const brainHome = join(cleanup, 'brain');
-      const agentEnvDir = join(brainHome, 'fleet', 'agents');
-      process.env['MOSAIC_BRAIN_HOME'] = brainHome;
-
-      const result = await writeAgentEnvironmentProjection({
-        mosaicHome,
-        agentEnvDir,
-        agentName: 'coder0',
-        generated: generatedValues,
-      });
-
-      // Projection landed in the brain tree, not under the config home.
-      expect(result.generatedPath).toBe(join(agentEnvDir, 'coder0.env.generated'));
-      expect((await stat(join(brainHome, 'fleet'))).mode & 0o777).toBe(0o700);
-      expect((await stat(agentEnvDir)).mode & 0o777).toBe(0o700);
-      expect((await stat(result.generatedPath)).mode & 0o777).toBe(0o600);
-      await expect(stat(join(mosaicHome, 'fleet'))).rejects.toThrow();
-
-      // A config-home agentEnvDir is now REJECTED while the brain is active —
-      // the boundary must not silently split state across two trees.
-      let rejected: unknown;
-      try {
-        await writeAgentEnvironmentProjection({
-          mosaicHome,
-          agentEnvDir: join(mosaicHome, 'fleet', 'agents'),
-          agentName: 'coder1',
-          generated: { ...generatedValues, MOSAIC_AGENT_NAME: 'coder1' },
-        });
-      } catch (caught: unknown) {
-        rejected = caught;
-      }
-      expect(rejected).toBeInstanceOf(AgentEnvBoundaryError);
-    } finally {
-      if (savedBrainHome === undefined) {
-        delete process.env['MOSAIC_BRAIN_HOME'];
-      } else {
-        process.env['MOSAIC_BRAIN_HOME'] = savedBrainHome;
-      }
-    }
-  });
-
  it('regenerates desired keys, relocates safe legacy local data, and quarantines forbidden legacy input', async (): Promise<void> => {
    cleanup = await mkdtemp(join(tmpdir(), 'mosaic-generated-env-'));
    const mosaicHome = join(cleanup, 'mosaic');
@@ -2,7 +2,6 @@ import { createHash, randomUUID } from 'node:crypto';
 import { chmod, lstat, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
-import { fleetAgentEnvDir, resolveBrainHome } from './brain-home.js';
 import { compareCodePoints } from './deterministic-order.js';

 export type AgentEnvironmentKind = 'generated' | 'local';
@@ -529,15 +528,12 @@ async function validatePrivateProjectionDirectory(
  mosaicHome: string,
  agentEnvDir: string,
 ): Promise<void> {
-  // Brain-home split (canon §2): seat envs live under the brain home's
-  // fleet/agents when a brain is active; roster + templates stay config-home.
-  const expectedAgentEnvDir = fleetAgentEnvDir(mosaicHome);
+  const fleetDir = join(mosaicHome, 'fleet');
+  const expectedAgentEnvDir = join(fleetDir, 'agents');
  if (resolve(agentEnvDir) !== resolve(expectedAgentEnvDir)) {
    throw new AgentEnvBoundaryError('unsafe-directory', '(directory)', agentEnvDir);
  }
-  const stateHome = resolveBrainHome(mosaicHome);
-  const fleetDir = join(stateHome, 'fleet');
-  await assertManagedDirectoryIfPresent(stateHome, false);
+  await assertManagedDirectoryIfPresent(mosaicHome, false);
  await assertManagedDirectoryIfPresent(fleetDir, false);
  await assertManagedDirectoryIfPresent(agentEnvDir, true);
 }
@@ -547,9 +543,8 @@ async function ensurePrivateProjectionDirectory(
  agentEnvDir: string,
 ): Promise<void> {
  await validatePrivateProjectionDirectory(mosaicHome, agentEnvDir);
-  const stateHome = resolveBrainHome(mosaicHome);
-  const fleetDir = join(stateHome, 'fleet');
-  await ensureManagedDirectory(stateHome, false);
+  const fleetDir = join(mosaicHome, 'fleet');
+  await ensureManagedDirectory(mosaicHome, false);
  await ensureManagedDirectory(fleetDir, false);
  await ensureManagedDirectory(agentEnvDir, true);
 }
@@ -1,6 +1,6 @@
 import { Command } from 'commander';

-import { createPrd, listPrds, loadPrd } from './prd.js';
+import { PrdService } from './service.js';
 import { runPrdWizard } from './wizard.js';

 interface InitCommandOptions {
@@ -18,6 +18,22 @@ interface ShowCommandOptions {
  readonly id?: string;
 }

+interface ImportCommandOptions {
+  readonly project: string;
+  readonly file: string;
+  readonly acceptSuccessor?: boolean;
+}
+
+interface ExportCommandOptions {
+  readonly project: string;
+  readonly id?: string;
+  readonly out?: string;
+}
+
+function serviceFor(project: string): PrdService {
+  return new PrdService({ projectPath: project });
+}
+
 export function buildPrdyCli(): Command {
  const program = new Command();
  program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -38,11 +54,9 @@ export function buildPrdyCli(): Command {
            template: options.template,
            interactive: true,
          })
-        : await createPrd({
+        : await serviceFor(options.project).create({
            name: options.name,
-            projectPath: options.project,
            template: options.template,
-            interactive: false,
          });

      console.log(
@@ -52,6 +66,7 @@ export function buildPrdyCli(): Command {
            id: doc.id,
            title: doc.title,
            status: doc.status,
+            version: doc.version,
            projectPath: doc.projectPath,
          },
          null,
@@ -65,7 +80,7 @@ export function buildPrdyCli(): Command {
    .description('List PRD documents for a project')
    .requiredOption('--project <path>', 'Project path')
    .action(async (options: ListCommandOptions) => {
-      const docs = await listPrds(options.project);
+      const docs = await serviceFor(options.project).list();
      console.log(JSON.stringify(docs, null, 2));
    });

@@ -75,20 +90,65 @@ export function buildPrdyCli(): Command {
    .requiredOption('--project <path>', 'Project path')
    .option('--id <id>', 'PRD document id')
    .action(async (options: ShowCommandOptions) => {
-      if (options.id !== undefined) {
-        const docs = await listPrds(options.project);
-        const match = docs.find((doc) => doc.id === options.id);
+      const doc = await serviceFor(options.project).get(options.id);
+      console.log(JSON.stringify(doc, null, 2));
+    });

-        if (match === undefined) {
-          throw new Error(`PRD id not found: ${options.id}`);
-        }
+  prdy
+    .command('import')
+    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
+    .requiredOption('--project <path>', 'Project path')
+    .requiredOption('--file <file>', 'Path to YAML PRD document')
+    .option('--accept-successor', 'Accept a conflicted import as the next version')
+    .action(async (options: ImportCommandOptions) => {
+      const service = serviceFor(options.project);
+      const input = { filePath: options.file };

-        console.log(JSON.stringify(match, null, 2));
+      if (options.acceptSuccessor) {
+        const successor = await service.acceptSuccessor(input);
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              outcome: 'successor-accepted',
+              id: successor.id,
+              version: successor.version,
+            },
+            null,
+            2,
+          ),
+        );
        return;
      }

-      const doc = await loadPrd(options.project);
-      console.log(JSON.stringify(doc, null, 2));
+      const result = await service.importDocument(input);
+      console.log(
+        JSON.stringify(
+          {
+            ok: true,
+            outcome: result.kind,
+            id: result.document.id,
+            version: result.document.version,
+            status: result.document.status,
+          },
+          null,
+          2,
+        ),
+      );
+    });
+
+  prdy
+    .command('export')
+    .description('Render a PRD to a labeled generated-view Markdown file')
+    .requiredOption('--project <path>', 'Project path')
+    .option('--id <id>', 'PRD document id')
+    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
+    .action(async (options: ExportCommandOptions) => {
+      const result = await serviceFor(options.project).exportMarkdown({
+        id: options.id,
+        outPath: options.out,
+      });
+      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
    });

  return program;
@@ -1,12 +1,35 @@
-export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
+// PrdService is the single authority surface for PRD documents. The raw store
+// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
+// goes through the service so there is no second writer path.
+export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
+export {
+  PrdService,
+  PRD_GENERATED_VIEW_LABEL,
+  PrdError,
+  PrdNotFoundError,
+  PrdUpdateError,
+  PrdImportInvalidError,
+  PrdImportConflictError,
+} from './service.js';
 export type {
  PrdStatus,
  PrdTemplate,
  PrdTemplateSection,
  PrdSection,
+  PrdMissionLinkage,
  PrdDocument,
  CreatePrdOptions,
+  PrdServiceOptions,
+  PrdCreateInput,
+  PrdSectionPatch,
+  PrdUpdateInput,
+  PrdLinkMissionInput,
+  PrdPlanForMissionInput,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
 } from './types.js';
@@ -17,17 +17,49 @@ const prdSectionSchema = z.object({
  fields: z.record(z.string(), z.string()),
 });

+const prdMissionLinkageSchema = z.object({
+  missionId: z.string().min(1),
+  missionVersion: z.string().min(1),
+  prdVersion: z.number().int().min(1),
+  requirementIds: z.array(z.string()),
+  linkedAt: z.string().datetime(),
+});
+
 const prdDocumentSchema = z.object({
  id: z.string().min(1),
  title: z.string().min(1),
  status: z.enum(['draft', 'review', 'approved', 'archived']),
  projectPath: z.string().min(1),
  template: z.string().min(1),
+  // Defaults keep documents written by older prdy versions loadable.
+  version: z.number().int().min(1).default(1),
  sections: z.array(prdSectionSchema),
+  missions: z.array(prdMissionLinkageSchema).default([]),
  createdAt: z.string().datetime(),
  updatedAt: z.string().datetime(),
 });

+/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
+function coerceTimestamps(value: unknown): unknown {
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(coerceTimestamps);
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
+    );
+  }
+  return value;
+}
+
+/** Validate an unknown value as a PRD document (throws zod errors on failure). */
+export function parsePrdDocument(value: unknown): PrdDocument {
+  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
+}
+
 function expandHome(projectPath: string): string {
  if (!projectPath.startsWith('~')) {
    return projectPath;
@@ -74,6 +106,8 @@ function prdDirectory(projectPath: string): string {
  return path.join(projectPath, PRD_DIRECTORY);
 }

+export { prdDirectory };
+
 function prdFilePath(projectPath: string, id: string): string {
  return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -113,11 +147,13 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
    status: 'draft',
    projectPath: resolvedProjectPath,
    template: template.id,
+    version: 1,
    sections: template.sections.map((section) => ({
      id: section.id,
      title: section.title,
      fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
    })),
+    missions: [],
    createdAt: now,
    updatedAt: now,
  };
@@ -190,7 +226,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
      throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
    }

-    const document = prdDocumentSchema.parse(parsed);
+    const document = parsePrdDocument(parsed);
    documents.push(document);
  }

@@ -0,0 +1,433 @@
+import { existsSync } from 'node:fs';
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import {
+  PRD_GENERATED_VIEW_LABEL,
+  PrdImportConflictError,
+  PrdImportInvalidError,
+  PrdNotFoundError,
+  PrdService,
+  PrdUpdateError,
+} from './index.js';
+import type { PrdDocument } from './index.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+let projectDir: string;
+
+async function makeProject(): Promise<string> {
+  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
+}
+
+function service(): PrdService {
+  return new PrdService({ projectPath: projectDir });
+}
+
+function storeDir(): string {
+  return path.join(projectDir, 'docs', 'prdy');
+}
+
+/** Handcraft a full, schema-valid PRD document for import scenarios. */
+function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
+  return {
+    id: 'imported-prd-20260101-000000',
+    title: 'Imported PRD',
+    status: 'draft',
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
+      {
+        id: 'scope-non-goals',
+        title: 'Scope / Non-Goals',
+        fields: { inScope: '', outOfScope: '' },
+      },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+async function writeImportFile(doc: PrdDocument): Promise<string> {
+  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
+  await writeFile(filePath, yaml.dump(doc), 'utf8');
+  return filePath;
+}
+
+beforeEach(async () => {
+  projectDir = await makeProject();
+});
+
+// ── Single authority store (AC: prdy path and mission path resolve to the
+//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
+
+describe('PrdService single authority store', () => {
+  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
+    const direct = await service().create({ name: 'Direct PRD' });
+    const viaMission = await service().planForMission({
+      name: 'Mission PRD',
+      missionId: 'mission-1',
+      missionVersion: '2026-01-01T00:00:00.000Z',
+    });
+
+    const files = await readdir(storeDir());
+    expect(files).toContain(`${direct.id}.yaml`);
+    expect(files).toContain(`${viaMission.id}.yaml`);
+
+    // A fresh service instance (new process equivalent) resolves both.
+    const all = await service().list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
+
+    // Stable versions: creation is v1; linkage writes do not bump content version.
+    expect((await service().get(direct.id)).version).toBe(1);
+    expect((await service().get(viaMission.id)).version).toBe(1);
+  });
+
+  it('round-trips documents through the store with identity intact', async () => {
+    const created = await service().create({ name: 'Round Trip', template: 'feature' });
+    const fresh = await service().get(created.id);
+
+    expect(fresh).toEqual(created);
+    expect(fresh.id).toBe(created.id);
+    expect(fresh.template).toBe('feature');
+    expect(fresh.status).toBe('draft');
+  });
+
+  it('throws a typed error for unknown ids and empty stores', async () => {
+    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
+    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── Mission linkage persistence (AC: linkage survives restart via fresh
+//    service instances) ────────────────────────────────────────────────────────
+
+describe('PrdService mission linkage', () => {
+  it('persists linkage and reads it back from a fresh service instance', async () => {
+    const created = await service().planForMission({
+      name: 'Linked PRD',
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Fresh instance — nothing in memory from the creating call.
+    const links = await service().listMissionLinks(created.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      prdVersion: 1,
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Linkage is carried in the YAML authority file itself.
+    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    const persisted = yaml.load(raw) as PrdDocument;
+    expect(persisted.missions[0]?.missionId).toBe('mission-42');
+    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
+  });
+
+  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
+    const created = await service().planForMission({
+      name: 'Relink PRD',
+      missionId: 'mission-7',
+      missionVersion: 'v1',
+    });
+
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
+    });
+
+    const relinked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'mission-7',
+      missionVersion: 'v2',
+      requirementIds: ['NFR-1'],
+    });
+
+    expect(relinked.missions).toHaveLength(1);
+    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
+  });
+
+  it('does not bump the content version when writing linkage', async () => {
+    const created = await service().create({ name: 'Stable Version' });
+    const linked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'm',
+      missionVersion: 'v1',
+    });
+    expect(linked.version).toBe(1);
+  });
+});
+
+// ── Update semantics ──────────────────────────────────────────────────────────
+
+describe('PrdService update', () => {
+  it('applies section patches and bumps the content version', async () => {
+    const created = await service().create({ name: 'Updatable' });
+    const updated = await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
+    });
+
+    expect(updated.version).toBe(2);
+    expect(updated.sections[0]?.fields).toMatchObject({
+      context: 'Some context',
+      objective: 'Goal',
+    });
+    expect((await service().get(created.id)).version).toBe(2);
+  });
+
+  it('refuses unknown section ids with a typed error', async () => {
+    const created = await service().create({ name: 'Strict' });
+    await expect(
+      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
+    ).rejects.toBeInstanceOf(PrdUpdateError);
+  });
+});
+
+// ── Markdown export is a labeled generated view, never authority ──────────────
+
+describe('PrdService exportMarkdown', () => {
+  it('writes a generated view carrying the label and source identity', async () => {
+    const created = await service().create({ name: 'Exported PRD' });
+    const result = await service().exportMarkdown({ id: created.id });
+
+    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
+    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
+    expect(result.content).toContain(`prd-id: ${created.id}`);
+    expect(result.content).toContain('prd-version: 1');
+    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
+  });
+
+  it('reflects the current version after updates', async () => {
+    const created = await service().create({ name: 'Versioned Export' });
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
+    });
+    const result = await service().exportMarkdown({ id: created.id });
+    expect(result.content).toContain('prd-version: 2');
+  });
+
+  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
+    const created = await service().create({ name: 'Guarded PRD' });
+    const before = structuredClone(await service().get(created.id));
+
+    const result = await service().exportMarkdown({ id: created.id });
+    await writeFile(
+      result.filePath,
+      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
+      'utf8',
+    );
+
+    const after = await service().get(created.id);
+    expect(after).toEqual(before);
+    expect(after.version).toBe(1);
+    expect(after.title).toBe(before.title);
+  });
+
+  it('never parses Markdown files that sit in the store directory', async () => {
+    const created = await service().create({ name: 'Decoy Guard' });
+
+    // A decoy .md file with invalid YAML must be invisible to the store.
+    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
+    // And a decoy .yaml-named Markdown body must not silently validate either.
+    await service().exportMarkdown({ id: created.id });
+
+    const listed = await service().list();
+    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
+    await expect(service().get(created.id)).resolves.toBeTruthy();
+  });
+});
+
+// ── Import: validated, conflict-aware, never silently merging ─────────────────
+
+describe('PrdService importDocument', () => {
+  it('creates a valid import through the service, as draft — validity is not approval', async () => {
+    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
+
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('created');
+    expect(result.document.id).toBe('imported-prd-20260101-000000');
+    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
+    expect(result.document.version).toBe(1);
+
+    const persisted = await service().get('imported-prd-20260101-000000');
+    expect(persisted.status).toBe('draft');
+
+    const files = await readdir(storeDir());
+    expect(files).toContain('imported-prd-20260101-000000.yaml');
+  });
+
+  it('reports identical content as a no-op without writing', async () => {
+    const created = await service().create({ name: 'Existing PRD' });
+    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+
+    const filePath = await writeImportFile(importFixture({ ...created }));
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('identical');
+    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    expect(after).toBe(before);
+  });
+
+  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
+    const existing = await service().create({ name: 'Authority PRD' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+      requirementIds: ['FR-0'],
+    });
+    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Divergent Title',
+      sections: [
+        {
+          id: 'introduction',
+          title: 'Introduction',
+          fields: { context: 'changed', objective: '' },
+        },
+      ],
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const attempt = service().importDocument({ filePath });
+    let caught: unknown;
+    try {
+      await attempt;
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(PrdImportConflictError);
+
+    const error = caught as PrdImportConflictError;
+    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
+    expect(error.existing.id).toBe(existing.id);
+    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
+    expect(error.proposal.status).toBe('draft');
+
+    // Original authority content untouched on disk.
+    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+    expect(afterBytes).toBe(beforeBytes);
+  });
+
+  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
+    const existing = await service().create({ name: 'Successor Base' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+    });
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Accepted Successor Title',
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const successor = await service().acceptSuccessor({ filePath });
+    expect(successor.id).toBe(existing.id);
+    expect(successor.version).toBe(existing.version + 1);
+    expect(successor.title).toBe('Accepted Successor Title');
+    expect(successor.status).toBe('draft');
+    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
+
+    // Persisted for a fresh reader.
+    const fresh = await service().get(existing.id);
+    expect(fresh.version).toBe(2);
+    expect(fresh.title).toBe('Accepted Successor Title');
+  });
+
+  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
+    const cases: Array<{ name: string; body: string }> = [
+      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
+      {
+        name: 'bad-status.yaml',
+        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
+      },
+      {
+        name: 'bad-version.yaml',
+        body: yaml.dump(importFixture({ version: 0 })),
+      },
+      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
+    ];
+
+    for (const fixture of cases) {
+      const filePath = path.join(projectDir, fixture.name);
+      await writeFile(filePath, fixture.body, 'utf8');
+
+      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
+        PrdImportInvalidError,
+      );
+    }
+
+    // Nothing was created: the authority store does not even exist yet.
+    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
+    const filePath = await writeImportFile(importFixture());
+    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── No second writer: no code path reads exported Markdown back into authority ─
+
+describe('no-second-writer invariant (source-level)', () => {
+  // Resolve the package source dir whether vitest runs from the package root
+  // (turbo/pnpm test) or from the worktree root.
+  function resolveSrcDir(): string {
+    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
+    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
+  }
+
+  const srcDir = resolveSrcDir();
+  const sourceFiles = [
+    'cli.ts',
+    'index.ts',
+    'prd.ts',
+    'service.ts',
+    'templates.ts',
+    'types.ts',
+    'wizard.ts',
+  ];
+
+  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
+    for (const file of sourceFiles) {
+      const text = await readFile(path.join(srcDir, file), 'utf8');
+      const readLines = text
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
+
+      for (const line of readLines) {
+        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
+      }
+    }
+  });
+
+  it('the mosaic prdy/mission adapters never read a .md file', async () => {
+    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
+    for (const file of ['prdy.ts', 'mission.ts']) {
+      const text = await readFile(path.join(adapterDir, file), 'utf8');
+      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
+        false,
+      );
+    }
+  });
+});
@@ -0,0 +1,379 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+
+import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
+import type {
+  PrdCreateInput,
+  PrdDocument,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
+  PrdLinkMissionInput,
+  PrdMissionLinkage,
+  PrdPlanForMissionInput,
+  PrdServiceOptions,
+  PrdUpdateInput,
+} from './types.js';
+
+/**
+ * PrdService is the SINGLE authority surface for PRD documents.
+ *
+ * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
+ * through this service; the YAML store under `docs/prdy/` is the authority and
+ * exported Markdown is a generated view that no code path reads back.
+ */
+
+// ── Typed errors ───────────────────────────────────────────────────────────────
+
+export class PrdError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'PrdError';
+  }
+}
+
+export class PrdNotFoundError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_NOT_FOUND');
+    this.name = 'PrdNotFoundError';
+  }
+}
+
+export class PrdUpdateError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_UPDATE_INVALID');
+    this.name = 'PrdUpdateError';
+  }
+}
+
+/** Structural refusal: the import payload failed schema validation. Nothing is written. */
+export class PrdImportInvalidError extends PrdError {
+  constructor(
+    message: string,
+    readonly issues?: string,
+  ) {
+    super(message, 'PRD_IMPORT_INVALID');
+    this.name = 'PrdImportInvalidError';
+  }
+}
+
+/**
+ * Conflict refusal: an existing PRD shares the imported id but the content
+ * diverges. Carries a PROPOSED successor (existing version + 1) that is only
+ * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
+ * never overwrites and never merges.
+ */
+export class PrdImportConflictError extends PrdError {
+  constructor(
+    message: string,
+    readonly existing: PrdDocument,
+    readonly proposal: PrdDocument,
+  ) {
+    super(message, 'PRD_IMPORT_CONFLICT');
+    this.name = 'PrdImportConflictError';
+  }
+}
+
+// ── Service ────────────────────────────────────────────────────────────────────
+
+/** The generated-view label carried by every Markdown export. */
+export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
+
+export class PrdService {
+  private readonly projectPath: string;
+
+  constructor(options: PrdServiceOptions) {
+    this.projectPath = options.projectPath;
+  }
+
+  /** Create a new PRD (version 1, draft) in the authority store. */
+  async create(input: PrdCreateInput): Promise<PrdDocument> {
+    return createPrd({
+      name: input.name,
+      projectPath: this.projectPath,
+      template: input.template,
+      interactive: false,
+    });
+  }
+
+  /** Read a PRD by id, or the most recently updated one. */
+  async get(id?: string): Promise<PrdDocument> {
+    const documents = await listPrds(this.projectPath);
+
+    if (id === undefined) {
+      const latest = documents[0];
+      if (latest === undefined) {
+        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
+      }
+      return latest;
+    }
+
+    const match = documents.find((doc) => doc.id === id);
+    if (match === undefined) {
+      throw new PrdNotFoundError(`PRD id not found: ${id}`);
+    }
+    return match;
+  }
+
+  /** List all PRDs in the authority store (most recently updated first). */
+  async list(): Promise<PrdDocument[]> {
+    return listPrds(this.projectPath);
+  }
+
+  /**
+   * Apply section field patches and bump the content version.
+   * Linkage entries are preserved; linkage writes do NOT bump the version.
+   */
+  async update(input: PrdUpdateInput): Promise<PrdDocument> {
+    const doc = await this.get(input.id);
+
+    for (const patch of input.sections) {
+      const section = doc.sections.find((candidate) => candidate.id === patch.id);
+      if (section === undefined) {
+        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
+      }
+      for (const [field, value] of Object.entries(patch.fields)) {
+        if (!(field in section.fields)) {
+          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
+        }
+        section.fields[field] = value;
+      }
+    }
+
+    doc.version += 1;
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  /**
+   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
+   * Persisted in the YAML authority, so it survives restarts.
+   */
+  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const doc = await this.get(input.prdId);
+    return this.applyLinkage(doc, input);
+  }
+
+  /** Read back the mission linkages recorded on a PRD. */
+  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
+    const doc = await this.get(prdId);
+    return doc.missions;
+  }
+
+  /**
+   * Mission planning path: create a PRD for a mission AND persist the
+   * mission↔PRD linkage in a single authority write.
+   */
+  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
+    const doc = await this.create({ name: input.name, template: input.template });
+    return this.applyLinkage(doc, {
+      prdId: doc.id,
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      requirementIds: input.requirementIds,
+    });
+  }
+
+  /**
+   * Render the PRD to a Markdown GENERATED VIEW.
+   *
+   * The output carries source identity (PRD id + version + generated-view
+   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
+   * the authority store only loads `.yaml`/`.yml` files, and no code path in
+   * this package parses the exported Markdown.
+   */
+  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
+    const doc = await this.get(input?.id);
+    const content = renderMarkdown(doc);
+    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
+
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, content, 'utf8');
+    return { filePath, content };
+  }
+
+  /**
+   * Import a YAML PRD document.
+   *
+   * Structural validation (zod) happens BEFORE anything is proposed or
+   * written. A structurally-valid import is persisted as `draft` — validity is
+   * NOT approval. If an existing PRD shares the id with divergent content, a
+   * typed {@link PrdImportConflictError} is thrown carrying a proposed
+   * successor; the original authority document is left byte-identical on disk.
+   */
+  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      const document = this.buildImportedDocument(incoming);
+      await savePrd(document);
+      return { kind: 'created', document };
+    }
+
+    if (canonicalCore(existing) === canonicalCore(incoming)) {
+      return { kind: 'identical', document: existing };
+    }
+
+    throw new PrdImportConflictError(
+      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
+        `Proposed successor: version ${existing.version + 1} (draft). ` +
+        `Accept explicitly with acceptSuccessor().`,
+      existing,
+      this.buildSuccessor(existing, incoming),
+    );
+  }
+
+  /**
+   * Explicitly accept a conflicted import as a successor version of the
+   * existing PRD. Re-validates the source file before writing; the successor
+   * is persisted with status `draft` (acceptance of the import is not approval
+   * of the PRD) and the existing mission linkages are carried forward.
+   */
+  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      throw new PrdNotFoundError(
+        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
+      );
+    }
+
+    const successor = this.buildSuccessor(existing, incoming);
+    await savePrd(successor);
+    return successor;
+  }
+
+  // ── internals ──────────────────────────────────────────────────────────────
+
+  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const entry: PrdMissionLinkage = {
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      prdVersion: doc.version,
+      requirementIds: input.requirementIds ?? [],
+      linkedAt: new Date().toISOString(),
+    };
+
+    // One entry per mission: refresh in place if the mission is already linked.
+    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
+    if (index === -1) {
+      doc.missions.push(entry);
+    } else {
+      doc.missions[index] = entry;
+    }
+
+    // Linkage is mission-side metadata, not a content revision: bump the
+    // timestamp only so ids/versions stay stable for consumers.
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  private async readImportFile(filePath: string): Promise<PrdDocument> {
+    let raw: string;
+    try {
+      raw = await fs.readFile(filePath, 'utf8');
+    } catch (error) {
+      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = yaml.load(raw);
+    } catch (error) {
+      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
+    }
+
+    try {
+      return parsePrdDocument(parsed);
+    } catch (error) {
+      throw new PrdImportInvalidError(
+        `Import file failed PRD schema validation: ${filePath}`,
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+  }
+
+  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
+    const now = new Date().toISOString();
+    return {
+      ...incoming,
+      // The import lands in THIS project's authority store.
+      projectPath: this.projectPath,
+      // A structurally-valid import is not thereby approved.
+      status: 'draft',
+      version: 1,
+      missions: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+  }
+
+  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
+    return {
+      ...incoming,
+      id: existing.id,
+      projectPath: existing.projectPath,
+      status: 'draft',
+      version: existing.version + 1,
+      missions: existing.missions,
+      createdAt: existing.createdAt,
+      updatedAt: new Date().toISOString(),
+    };
+  }
+}
+
+// ── Markdown rendering (generated view) ───────────────────────────────────────
+
+function canonicalCore(doc: PrdDocument): string {
+  return JSON.stringify([doc.title, doc.template, doc.sections]);
+}
+
+function renderMarkdown(doc: PrdDocument): string {
+  const lines: string[] = [
+    '<!--',
+    `${PRD_GENERATED_VIEW_LABEL}`,
+    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
+    `prd-id: ${doc.id}`,
+    `prd-version: ${doc.version}`,
+    `generated-at: ${new Date().toISOString()}`,
+    '-->',
+    '',
+    `# ${doc.title}`,
+    '',
+    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
+    '',
+  ];
+
+  if (doc.missions.length > 0) {
+    lines.push('## Mission Linkage', '');
+    for (const mission of doc.missions) {
+      const requirements =
+        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
+      lines.push(
+        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
+          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
+      );
+    }
+    lines.push('');
+  }
+
+  for (const section of doc.sections) {
+    lines.push(`## ${section.title}`, '');
+    for (const [field, value] of Object.entries(section.fields)) {
+      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
+    }
+  }
+
+  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
+  return lines.join('\n');
+}
@@ -19,13 +19,31 @@ export interface PrdSection {
  fields: Record<string, string>;
 }

+/**
+ * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
+ *
+ * `missionVersion` is the mission-side revision marker available to the CLI
+ * (the gateway exposes `updatedAt` for missions — there is no numeric mission
+ * version yet). `prdVersion` snapshots the PRD content version at link time.
+ */
+export interface PrdMissionLinkage {
+  missionId: string;
+  missionVersion: string;
+  prdVersion: number;
+  requirementIds: string[];
+  linkedAt: string;
+}
+
 export interface PrdDocument {
  id: string;
  title: string;
  status: PrdStatus;
  projectPath: string;
  template: string;
+  /** Content revision counter. Bumped by updates and accepted imports. */
+  version: number;
  sections: PrdSection[];
+  missions: PrdMissionLinkage[];
  createdAt: string;
  updatedAt: string;
 }
@@ -36,3 +54,60 @@ export interface CreatePrdOptions {
  template?: string;
  interactive?: boolean;
 }
+
+// ── PrdService surface (single authority entry point) ─────────────────────────
+
+export interface PrdServiceOptions {
+  projectPath: string;
+}
+
+export interface PrdCreateInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdSectionPatch {
+  id: string;
+  fields: Record<string, string>;
+}
+
+export interface PrdUpdateInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  sections: PrdSectionPatch[];
+}
+
+export interface PrdLinkMissionInput {
+  /** Defaults to the most recently updated PRD. */
+  prdId?: string;
+  missionId: string;
+  missionVersion: string;
+  requirementIds?: string[];
+}
+
+export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdExportInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  /** Override the generated-view output path. */
+  outPath?: string;
+}
+
+export interface PrdExportResult {
+  filePath: string;
+  content: string;
+}
+
+/** Discriminated result of a non-conflicting import. */
+export type PrdImportResult =
+  | { kind: 'created'; document: PrdDocument }
+  | { kind: 'identical'; document: PrdDocument };
+
+export interface PrdImportInput {
+  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
+  filePath: string;
+}
@@ -2,8 +2,8 @@ import path from 'node:path';

 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';

-import { createPrd, savePrd } from './prd.js';
-import type { CreatePrdOptions, PrdDocument } from './types.js';
+import { PrdService } from './service.js';
+import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';

 interface WizardAnswers {
  goals: string;
@@ -11,20 +11,41 @@ interface WizardAnswers {
  milestones: string;
 }

-function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
-  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));
+/**
+ * Translate wizard answers into section patches using the same keyword
+ * matching the wizard always used (first section whose id contains the
+ * keyword, then first field whose name contains it, else first field).
+ */
+function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
+  const bySection = new Map<string, PrdSectionPatch>();

-  if (section === undefined) {
-    return;
-  }
+  const add = (keyword: string, value: string): void => {
+    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
+    if (section === undefined) {
+      return;
+    }

-  const fieldName =
-    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
-    Object.keys(section.fields)[0];
+    const fieldName =
+      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
+      Object.keys(section.fields)[0];

-  if (fieldName !== undefined) {
-    section.fields[fieldName] = value;
-  }
+    if (fieldName === undefined || section.fields[fieldName] === value) {
+      return;
+    }
+
+    const existing = bySection.get(section.id);
+    if (existing === undefined) {
+      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
+    } else {
+      existing.fields[fieldName] = value;
+    }
+  };
+
+  add('goal', answers.goals);
+  add('constraint', answers.constraints);
+  add('milestone', answers.milestones);
+
+  return [...bySection.values()];
 }

 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -63,15 +84,10 @@ async function promptTemplate(template?: string): Promise<string> {
  return choice;
 }

-function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
-  updateSectionField(doc, 'goal', answers.goals);
-  updateSectionField(doc, 'constraint', answers.constraints);
-  updateSectionField(doc, 'milestone', answers.milestones);
-
-  doc.updatedAt = new Date().toISOString();
-  return doc;
-}
-
+/**
+ * Interactive PRD wizard. All writes go through PrdService — the wizard is a
+ * prompt layer, never a second writer path.
+ */
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
  intro('Mosaic PRD wizard');

@@ -82,20 +98,15 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
  const constraints = await promptText('Key constraints');
  const milestones = await promptText('Planned milestones');

-  const doc = await createPrd({
-    ...options,
+  const service = new PrdService({ projectPath: options.projectPath });
+  const doc = await service.create({
    name,
    template,
-    interactive: true,
  });

-  const updated = applyWizardAnswers(doc, {
-    goals,
-    constraints,
-    milestones,
-  });
-
-  await savePrd(updated);
+  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
+  const updated =
+    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;

  outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);

@@ -0,0 +1,37 @@
+# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
+
+- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
+  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
+  Markdown export is a labeled generated view (never read back); import is
+  validated/conflict-aware with typed refusals.
+- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
+  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
+  root build rc=0.
+- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
+  typed errors (3) wizard/cli route through service (4) mosaic adapters
+  (5) contract specs both packages (6) gates (7) sabotage control (8) report
+  to /var/tmp/ri-050/ri-4-001-report.md.
+- Decisions:
+  - Linkage lives ON the PRD document (`missions` array) — one authority file,
+    survives restart, no sidecar sync problems.
+  - `version` = content revision of sections/status (bumped by update/import
+    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
+    for the card's "stable ids/versions" contract.
+  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
+    numeric version field).
+  - Import reads YAML documents only — never the exported Markdown (keeps the
+    "no code path reads exported Markdown" invariant).
+  - Import of an existing id with identical core content → `identical` no-op;
+    divergent → typed `PrdImportConflictError` carrying proposed successor
+    (existing.version + 1, status draft, linkages preserved). Original bytes
+    untouched until explicit `acceptSuccessor`.
+  - `requirementIds` default `[]` at the mission command (no requirement
+    selection UI yet) — service accepts ids when a caller has them.
+- Progress log:
+  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
+  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
+  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
+  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
+  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
+  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
+  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete
Author	SHA1	Message	Date
fargo	8d258e1d07	docs: finalize ri-4-001 scratchpad with verification evidence (#1275 ) ci/woodpecker/pr/ci Pipeline was successful Details	2026-08-17 16:48:39 -05:00
fargo	540d6f17d1	docs: ri-4-001 scratchpad for PRD authority card (#1275 )	2026-08-17 16:46:17 -05:00
fargo	a23826ccba	test(mosaic): RI-N3 contract specs for prdy and mission --plan adapters (#1275 ) - import paths: created/draft, typed refusal creates nothing, conflict refusal leaves bytes untouched, --accept-successor persists v+1 - export writes the labeled generated view; authority unchanged - mission --plan persists linkage readable by a fresh service instance; mission path and prdy path share the docs/prdy store with stable ids/versions	2026-08-17 16:46:14 -05:00
fargo	2c5d208691	feat(mosaic): route prdy and mission --plan through PrdService (#1275 ) - mosaic prdy becomes a thin adapter: --init/--update (wizard for TTY, service otherwise), --import with --accept-successor, --export - mosaic mission --plan persists the mission↔PRD linkage (mission id + version marker, PRD id + version) through the service instead of invoking the wizard as a second writer; non-TTY runs create non-interactively	2026-08-17 16:46:06 -05:00
fargo	e291bfb837	feat(prdy): add PrdService as the single PRD authority surface (#1275 ) - PrdService owns create/read/update/link/import/export; wizard and package CLI become prompt layers over the service (no second writer path) - PRD documents gain a content version and a missions linkage array persisted in the YAML authority store (survives restart); linkage writes do not bump the content version - exportMarkdown renders a labeled generated view (id + version + do-not-edit header) that no code path reads back; the store loads .yaml/.yml only - importDocument validates structure with zod before anything else, persists valid imports as draft (validity is not approval), and refuses conflicts with a typed PrdImportConflictError carrying a proposed successor; the original document stays byte-identical until acceptSuccessor - raw store writers (createPrd/savePrd) are no longer exported from the package entry point	2026-08-17 16:46:00 -05:00