Implements the command module for the M4-4-0 design
(docs/plans/2026-08-29-agent-enrollment-command-design.md) over the
M4-4a schema (migration 0021):
- EnrollmentModule: agent.enroll (POST /api/enrollment/agents) and
agent.enrollment.get (GET /api/enrollment/agents/:id), closed error
enum, correlation envelope on every result and refusal.
- EnrollmentRepository as the family's sole writer: fence-check ->
mutate -> audit + outbox in one transaction; actor-bound idempotency
replay with fresh authorization; intake credentials sealed
(AES-256-GCM) into provider_credentials, never echoed anywhere;
reference mode resolves the actor's stored credential; harness
validated against the live registry (fail-closed in prod until
adapters register).
- CLI parity (contract 5 s4.5): mosaic agent enroll / enrollment
subcommands; intake API key read from stdin, never argv.
- 19 integration witnesses covering design s5 items 1-9 and 11
(never-echo, sealed single-copy, reference resolution, harness
refusal codes, the s4.3 idempotency set incl. concurrent same-key,
five-point fault-injection atomicity, zero-mutation, is_system
closure, correlation + no-existence-oracle, fail-closed) plus an
8-test CLI parity spec (item 10).
fred