node packages/mosaic/src/cli/main.mjs validate --registry-root /absolute/fixture-root
node packages/mosaic/src/cli/main.mjs list --registry-root /absolute/fixture-root
node --test packages/mosaic/tests/

Filesystem contract

The reader currently supports Linux with procfs and descriptor-relative paths. Other platforms refuse explicitly rather than falling back to unsafe traversal. Root and all traversed registry directories must belong to the invoking user and have mode 0700. Metadata files must be regular, owned by that user and mode 0600. Symlinks are rejected in the root path, directories and metadata files. Required directories are auth/providers, auth/accounts, auth/settings and harnesses. A missing or empty registry is invalid, not an empty successful listing.

Metadata is limited to 1 MiB per file. Directory handles anchor child access while paths are being checked, preventing a renamed ancestor from redirecting later opens. Files are opened without following symlinks and checked against their prior inode/device and permissions. This is not a claim of transactionally consistent multi-record snapshots under concurrent writers; registry mutation and materialization are outside this package slice.

Account metadata lives at auth/accounts///account.json. The credential.json sibling is never opened or inspected. No real credentials are needed for tests. Public Git fixtures do not preserve private modes: the tests copy them into temporary directories and set 0700/0600 before invoking the reader. Do not run the CLI against your real credential stores for a smoke test.

Validation contract

Record version fields are numeric 1. Unknown versions, top-level/nested unknown fields and malformed records refuse. Every custom-endpoint harness entry uses the declared api/baseUrl/models metadata shape; an unknown adapter shape requires a reviewed schema extension. URL userinfo and non-HTTP(S) protocols refuse; plain HTTP requires allowInsecureTransport: true. No secret-valued apiKey field is accepted in provider metadata.

Profiles may only default to an enrolled account. Account types must be supported by their providers, and references must resolve. Failed validation returns no partial entries or CLI listing. Diagnostics use fixed paths/codes, never input values, unknown keys or JSON parser excerpts. Invalid input exits 1; command usage errors exit 2.

The safety regression suite covers independently reproduced findings D1-D10 from issue #1500. Passing it establishes those tested properties, not a production security certification or authorization to build materialization on unreviewed code.