The BRAIN example fixture carried the operator's forge namespace
(jason.woltje/mosaic-brain) — operator-identity token on the public
denylist, caught by the sanitization gate in pipeline 2629. Replaced
with a generic example.invalid owner; same direct-flow shape. Suite
101/101 green; sanitization gate green.
Path-conditional Woodpecker step validating .mosaic/repo.json on touch:
runs the wave-1 validator with --require-v2 (authoring rule: edited/new
declarations must be schema_version 2; any VALIDATION_ERROR fails the
pipeline) plus the 101-arm hermetic hostile-input suite. Validator vendored
into the framework tree per spec sec5.1 final home (provenance header:
brain main 515bcbab, PR 28 R9 PASS; body verbatim). CI provisions an
explicit fixture MOSAIC_HOST_ROOT — the root gate is a runtime anchor and
CI has no host; grammar/schema/refs/flow/remote/path surface all prove.
Step triggers on .mosaic/repo.json, structure/**, or ci.yml changes
(manual runs always include it). TOOLS-REFERENCE gains the structure
section (resident-index discoverability). Enumeration guard green via the
ci.yml surface (population 68).