-
Mosaic Framework Constitution — Alpha
Pre-Releasejason.woltje released this
2026-06-22 02:21:06 +00:00 | 97 commits to main since this releaseMosaic Framework Constitution — Alpha (v0.0.39-alpha)
Closes the framework-constitution mission. All 16 DoD §8 criteria green (see docs/design/framework-constitution/ALPHA-DOD.md).
Phases (P0–P6)
- P0 (#570): MIT license + executable-leak sanitization; cred-path default.
- P1+P2 (#572): public-sanitization blocking CI gate + operator-identity purge (26 files).
- P3 (#575/#577): CONSTITUTION.md (L0) extracted + AGENTS.md → ~80-line dispatcher; gate scope hardened (yaml/toml/env/service); no CONSTITUTION.local override.
- P4 (#590/#593): upgrade-safe v2→v3 migration — framework-owned overwrite w/ backup-once, user data never touched; both installers; live-validated on a real legacy host (zero data loss).
- P5 (#605): overlay composer (compose-contract + *.local deltas, residency-preserving).
- P6 (#607): CONTRIBUTING.md + harness×gate compliance matrix + resident-budget CI gate.
- AI Guide (#8): canonical Constitution pointer.
Criterion #6 met via the resolved Q10 decision: a neutral, PII-clean sanitized persona (not a deletion); jarvis-loop.json removed.
Built and dual-engine reviewed (Claude + gpt-5.5/Codex) across two hosts (w-jarvis + dragon-lin).
Downloads
-
mosaic v0.0.31
Stable2026-06-11 20:14:20 +00:00 | 140 commits to main since this releasePublishes framework fixes merged since 0.0.30 (were never version-bumped):
- #524 Gitea/Woodpecker wrapper hardening rollup (pr-merge api_url fix, pr-create body safety, explicit repo args, woodpecker legacy creds)
- #529 thin-core prompt diet
- #533 inter-agent tmux comms tooling (tools/tmux/agent-send.sh)
Hosts upgrade via npm + install.sh to receive these.
Downloads
-
2026-04-22 06:09:54 +00:00 | 164 commits to main since this releaseM2 complete: Step-CA sidecar, federation DB schema, grants/enrollment service, admin REST API, CLI commands, integration tests, E2E test, security hardening, docs.
Downloads
-
2026-04-20 02:24:50 +00:00 | 184 commits to main since this releaseFederation v1 — Milestone 1
Federated tier infrastructure. Mosaic Stack gateway can now boot with PostgreSQL 17 + pgvector + Valkey under the new
federatedstorage tier. No federation logic yet — this milestone is the foundation only.What's in this release
- New
federatedstorage tier inmosaic.config.json(alongside existinglocalandstandalone) docker-compose.federated.ymloverlay (PG on 5433, Valkey on 6380, profile-gated)- Postgres adapter with idempotent
CREATE EXTENSION vectorandenableVectorflag - Gateway tier-detector with fail-fast probes (PG, pgvector, Valkey) and actionable error messages
mosaic storage migrate-tierCLI — one-way migration fromlocal(PGlite) /standalone→federated, idempotent, dry-run UX, advisory-lock concurrency safetymosaic gateway doctor— JSON output, per-service health, pgvector presence- 7 integration tests behind
FEDERATED_INTEGRATION=1env flag - Credential redaction at all driver-error surfaces (postgres / postgresql / redis / rediss schemes)
Migration
Operators on
localorstandalonecan migrate tofederatedusing:mosaic storage migrate-tier --dry-run # preview mosaic storage migrate-tier # execute mosaic gateway doctor --json # verifySee
docs/federation/SETUP.mdanddocs/guides/migrate-tier.mdfor full instructions.Standalone & local tiers
Existing
standaloneandlocaldeployments are unaffected. M1 changes are non-disruptive — verified by full regression run on existing test suites (351 gateway tests + 85 storage unit tests + fullpnpm test, all green).What's next
Milestone 2 (Step-CA + grant schema + admin CLI) is the first milestone with actual federation logic — gateway-to-gateway trust setup. Tracked in issue #461.
PRs
Issue closed
Downloads
- New
-
mosaic v0.0.29
Stable2026-04-08 00:42:54 +00:00 | 204 commits to main since this releaseChanges
- feat(framework): superpowers enforcement, typecheck hook, file-ownership rules (#451)
- PostToolUse typecheck hook for immediate TS type error feedback
- Superpowers Enforcement section in AGENTS.md (skills, hooks, MCP, plugins)
- File-ownership partitioning rules for parallel workers in ORCHESTRATOR.md
- Settings audit in launcher validates hooks/plugins at
mosaic claudestartup
- fix(installer): preserve credentials dir and seed STANDARDS.md (#452)
- credentials/ now survives framework upgrades (added to PRESERVE_PATHS)
- AGENTS.md and STANDARDS.md seeded from defaults/ on first install
- AGENTS.md protected from deletion during upgrades
Upgrade
curl -fsSL https://mosaicstack.dev/install.sh | bashDownloads
- feat(framework): superpowers enforcement, typecheck hook, file-ownership rules (#451)
-
mosaic-v0.0.28 Pre-Release
2026-04-06 00:46:31 +00:00 | 207 commits to main since this release@mosaicstack/mosaic v0.0.28
Highlights
Drill-down main menu + provider-first flow + quick start (IUV-M03, #446)
- Wizard replaced with menu-driven architecture: Quick Start, Providers, Skills, Agent Identity, Gateway, Advanced, Finish & Apply
- Quick Start completes in 3 questions: API key, admin email, admin password
- Provider setup happens first; deterministic intent intake with preset categories and thematic agent names
- Headless backward-compat preserved (
MOSAIC_ASSUME_YES=1+ env vars)
UX polish (IUV-M02, #444)
- CORS prompt replaced with hostname/FQDN input; CORS value derived internally
- Skill installer now respects user selection (was a no-op before)
MOSAIC_HOSTNAMEenv var for headless hostname config
Hotfix (IUV-M01, #440/#441)
- Bootstrap DTO class-erasure regression fixed (was:
import typeerased DTO at runtime) - Wizard failure propagation in interactive mode
- Port prompt prefills 14242
- Pi SDK mentioned in intro copy
Other
Downloads
-
mosaic-v0.0.27 Pre-Release
2026-04-06 00:15:23 +00:00 | 211 commits to main since this releasemosaic-v0.0.27
Highlights
- Drill-down main menu: Replace linear 12-stage interrogation with menu-driven architecture (Quick Start, Providers, Agent Identity, Skills, Gateway, Advanced, Finish & Apply)
- Provider-first flow: LLM API key collection moves to the front with auto-detection of Anthropic vs OpenAI from key prefix
- Quick Start path: 3 questions (API key, admin email, password) targeting under 90 seconds for returning users
- Deterministic intent/naming: User picks intent category (general, software-dev, devops, research, content, custom) and gets thematic agent name (Mosaic, Forge, Sentinel, Atlas, Muse)
- Headless backward compat: MOSAIC_ASSUME_YES=1 + env vars still work unchanged, with new MOSAIC_AGENT_NAME and MOSAIC_AGENT_INTENT vars
New files
packages/mosaic/src/stages/provider-setup.ts- Provider API key collection + auto-detectionpackages/mosaic/src/stages/agent-intent.ts- Deterministic intent intake + namingpackages/mosaic/src/stages/quick-start.ts- Minimal-questions quick start path
Breaking changes
None. Headless installs are fully backward compatible.
Downloads
-
mosaic-v0.0.26 — Bootstrap Hotfix
Pre-Release2026-04-05 22:17:59 +00:00 | 216 commits to main since this releasemosaic-v0.0.26 — Bootstrap Hotfix
Fixes four bugs found during real-run testing of
mosaic-v0.0.25.Changes
Bug fixes
-
[CRITICAL] Admin bootstrap 400 regression —
bootstrap.controller.tsimportedBootstrapSetupDtowithimport type, erasing the class at runtime. NestJS@Body()fell back to plainObjectas the metatype, andValidationPipewithwhitelist: true+forbidNonWhitelisted: truerejected every field ("property email should not exist","property password should not exist"). Fixed by changing to a value import so the class reference is preserved fordesign:paramtypes. Covered by a new e2e integration test that binds through the real NestJS DI + Fastify pipeline. -
Wizard reports success after bootstrap failure — the interactive-mode guard in
wizard.tshad an&& headlessRuncondition, so acompleted: falseresult was silently swallowed in interactive mode and the wizard continued to print✔ Wizard complete. Fixed by removing the headless-only gate: bootstrap failure now aborts with a non-zero exit in both interactive and headless modes. -
Gateway port prompt does not prefill
14242—@clack/promptstext()accepts two distinct options:defaultValue(used only when the user submits empty) andinitialValue(prefills the input buffer). The prompter was only passingdefaultValue, so the field appeared blank. AddedinitialValuesupport toWizardPrompter.text(),ClackPrompter, andHeadlessPrompter. All prompts that have defaults now prefill the buffer so the user can press Enter to accept. -
"What is Mosaic?" intro copy missing Pi SDK — the welcome stage listed Claude Code, Codex, and OpenCode but omitted Pi SDK, the underlying agent runtime. Copy updated to include Pi SDK.
Packages
@mosaicstack/mosaic0.0.25 → 0.0.26
Downloads
-
-
2026-04-05 20:53:26 +00:00 | 219 commits to main since this release@mosaicstack/mosaic 0.0.25 — install UX hardening
Closes the install-ux-hardening-20260405 mission. All 7 acceptance criteria satisfied across three feature PRs.
New features
mosaic uninstall(PR #429)- Top-level command that cleanly reverses every mutation made by
tools/install.sh— framework data, npm CLI, nested stack deps, runtime asset injections in~/.claude/, and npmrc scope mapping - Flags:
--framework,--cli,--gateway,--all,--keep-data,--yes,--dry-run - New install manifest at
~/.config/mosaic/.install-manifest.jsondrives deterministic reversal; heuristic fallback for installs that predate the manifest - Shell fallback:
curl … | bash -s -- --uninstallworks without a functioning CLI
Wizard remediation (PR #431)
- Password entry is now masked in raw mode with a confirmation prompt (no plaintext echo)
- New hooks-preview stage shows exactly which Claude hooks will be installed and captures explicit consent
- New
mosaic config hooks list|enable|disablesubcommands for post-install management - Headless install path:
MOSAIC_ASSUME_YES=1+MOSAIC_ADMIN_NAME/EMAIL/PASSWORDlets CI/automation complete the wizard without a TTY
Unified first-run wizard (PR #433)
mosaic wizardandmosaic gateway installare collapsed into a single cohesive flow with shared in-memory state- Gateway config + admin bootstrap are now terminal stages 11 & 12 of
runWizard - The fragile 10-minute
$XDG_RUNTIME_DIR/mosaic-install-state.jsonsession bridge has been removed mosaic gateway installstill works standalone (thin wrapper over the same stages) for users who already went through the wizardstate.hooks.accepted === falsenow propagates end-to-end viaMOSAIC_SKIP_CLAUDE_HOOKS— declining hooks actually skips hook installation
Stats
- 24 test files, 219 tests passing (+15 net new since 0.0.24)
- 4 rounds of independent codex code review applied across the milestones
Upgrade
npm i -g @mosaicstack/mosaic@0.0.25Alpha — stays in 0.0.x until GA.
Downloads
- Top-level command that cleanly reverses every mutation made by
-
mosaic v0.0.24
Pre-Release2026-04-05 14:49:05 +00:00 | 227 commits to main since this release@mosaicstack/mosaic 0.0.24 — alpha
First version where
npm i -g @mosaicstack/mosaic@latest && mosaic --helpworks end-to-end from a clean global install.Fixes
- Third correction wave for the systemic publish-skip bug: memory, queue, and storage registry copies at 0.0.3 were built before M5 added their
registerXCommandexports. The publish workflow silently skipped them because their versions matched the registry.
Version bumps
@mosaicstack/memory0.0.3 → 0.0.4@mosaicstack/queue0.0.3 → 0.0.4@mosaicstack/storage0.0.3 → 0.0.4@mosaicstack/mosaic0.0.23 → 0.0.24
Verification
mosaic --helpexits 0 and prints the alphabetized command list- All 38 typecheck, 21 lint, format:check, and 162 mosaic tests pass
- All four packages confirmed on Gitea registry at their new versions
Alpha — stays in 0.0.x until GA.
Downloads
- Third correction wave for the systemic publish-skip bug: memory, queue, and storage registry copies at 0.0.3 were built before M5 added their