stack/BUILD-LOG.md

BUILD-LOG

Append-only build log for the Minimal Mosaic Stack container proof of concept. Each phase records the plan before it runs and the observed result after it runs. No credentials are recorded in this file.

---

Phase 1: Pi package discovery

Entry 1.1 — before

• Timestamp: 2026-02-02 (session start, local)
• Intended action: Locate the current package documentation for @earendil-works/pi-coding-agent, determine the current version, the supported noninteractive command, the custom system prompt mechanism, and the documented container authentication method.
• Reason: The brief forbids guessing CLI flags, authentication paths, or SDK methods; all runtime commands must be derived from the package documentation.
• Expected result: Documented answers for all five discovery questions, recorded below, with the Pi package version pinned in the project.

Entry 1.2 — after

• Timestamp: 2026-02-02
• Commands run:
  • Read README.md of the locally installed @earendil-works/pi-coding-agent package
  • Read docs/containerization.md, excerpts of docs/models.md and docs/providers.md
  • grep '"version"' .../pi-coding-agent/package.json
  • npm view @earendil-works/pi-coding-agent version
  • Inspected host auth store structure (keys only, values never printed)
• Observed result:
  1. Package documentation: full docs ship inside the installed package (README.md plus a docs/ directory including docs/containerization.md).
  2. Current package version: 0.84.4 — the locally installed version and the npm registry latest are identical. Selected version to pin: 0.84.4.
  3. Supported noninteractive command: pi -p / pi --print — "Print response and exit". Documented in the CLI Reference. Print mode also merges piped stdin into the initial prompt (not used here).
  4. Custom system prompt: documented CLI flag --system-prompt <text> — "Replace default prompt (context files and skills still appended)". Because the generated contract prompt must fully control behavior, the run also passes the documented discovery-off switches (--no-context-files, --no-skills, --no-extensions, --no-prompt-templates, --no-themes) so nothing is appended from ambient files. (APPEND_SYSTEM.md / .pi/SYSTEM.md file conventions exist but the CLI flag is the documented noninteractive path.)
  5. Documented container authentication: docs/containerization.md documents the "Plain Docker" pattern: run the whole pi process in the container and pass provider API keys at runtime via environment variables (example: docker run -e ANTHROPIC_API_KEY ...). The documented alternative credential store is auth.json written by /login under the pi agent directory (~/.pi/agent/auth.json).
• Decision: supply the credential at runtime as a read-only mounted credential file (host auth.json, which contains a static API-key entry for the built-in zai provider) mounted at the container pi agent directory, and additionally allow the documented environment-variable path (ZAI_API_KEY / ANTHROPIC_API_KEY) as an alternative. Provider and model are non-secret settings supplied via .env (PI_PROVIDER=zai, PI_MODEL=glm-5.3-flash).
• Failure or correction: none. Host check confirmed no API-key environment variables are exported on the host, so the read-only auth.json mount is the working runtime credential path for this experiment.

---

Phase 2: Project scaffold

Entry 2.1 — before

• Timestamp: 2026-02-02
• Intended action: Create the contract fixtures (exact brief contents), the contract loader (src/load-contracts.sh), the one-shot agent runner (src/run-agent.sh), the four required scripts (scripts/build.sh, hello.sh, verify.sh, reset.sh), Containerfile, compose.yaml, pinned package.json + package-lock.json, .gitignore, README.md, LAYERS.md.
• Reason: Implement exactly the file set the brief requires, with no extra machinery (no schemas, overlays, manifests, or policy loading).
• Expected result: A complete project whose only remaining unknown is whether the pinned image builds and the real model request returns MOSAIC_HELLO_OK.

Entry 2.2 — after

• Timestamp: 2026-02-02
• Commands run: file creation; npm install --package-lock-only --ignore-scripts to generate the lockfile from the pinned dependency.
• Observed result: All files created; package-lock.json pins @earendil-works/[email protected] (exact, no range).
• Failure or correction: none.

---

Phase 3: Container image build

Entry 3.1 — before

• Timestamp: 2026-02-02
• Intended action: Run scripts/build.sh (Docker Compose build) to produce image mosaic-poc-agent:0.84.4 from node:24-bookworm-slim with the pinned Pi, the four contract fixtures at /opt/mosaic/contracts, and a non-root user (uid/gid 1000).
• Reason: Phase 1 of the required proof path; node:24-bookworm-slim is the maintained base image used in Pi's own documented containerization example.
• Expected result: docker compose build exits 0 and the image contains the contracts, the runner scripts, and the pinned pi binary, with no credentials baked in.

Entry 3.2 — after

• Timestamp: 2026-02-02
• Commands run: scripts/build.sh; docker run --rm mosaic-poc-agent:0.84.4 --version; id via --entrypoint; contract listing; credential file scan.
• Observed result:
  • Build exit 0; image tagged mosaic-poc-agent:0.84.4.
  • pi --version inside the image reports 0.84.4 (and this run also executed the contract loader successfully, writing /var/lib/mosaic/system-prompt.md).
  • Container user is uid=1000(node) gid=1000(node) — non-root.
  • All four contract files present at /opt/mosaic/contracts with read-only permissions (0555).
  • Credential scan: no auth.json or other auth files exist in the image; /home/node/.pi/agent/ is empty in the image.
• Failure or correction:
  1. First build failed: Docker Compose expects Dockerfile by default; fixed by setting build.dockerfile: Containerfile in compose.yaml.
  2. Second build failed: useradd exit 4 (uid 1000 already exists) because the maintained node image ships a node user at uid/gid 1000. Fixed by reusing the built-in node user (same 1000:1000 host mapping) instead of creating a duplicate mosaic user; container paths updated from /home/mosaic/... to /home/node/... in Containerfile, compose.yaml, README.md, .env.example.

---

Phase 4: Runtime verification

Entry 4.1 — before

• Timestamp: 2026-02-02
• Intended action: Run scripts/hello.sh (one-shot request: "Return your startup marker and nothing else."), then scripts/verify.sh (exact-match gate against MOSAIC_HELLO_OK), then the negative test (EXPECTED_MARKER=MOSAIC_NOT_OK scripts/verify.sh must exit nonzero), then the scripts/reset.sh safety tests and a final rerun after reset.
• Reason: Phases 2–7 of the required proof path plus acceptance criteria 5–11.
• Expected result: hello prints only the marker; verify exits 0; negative test exits nonzero; reset refuses unsafe paths and succeeds on the real path; rerun after reset reproduces the success.

Entry 4.2 — after

• Timestamp: 2026-02-02
• Commands run: scripts/hello.sh; scripts/verify.sh; EXPECTED_MARKER=MOSAIC_NOT_OK scripts/verify.sh; scripts/reset.sh (refusal tests: missing marker, symlink with canary file, then real reset, then missing dir); scripts/build.sh && scripts/verify.sh after reset; docker compose config mount inspection.
• Observed result:
  • hello.sh: stdout exactly MOSAIC_HELLO_OK — a real model request (provider zai, model glm-5.3-flash, auth via the read-only mounted auth.json credential file). The request string contains no marker.
  • verify.sh: PASS: response matches expected marker, exit 0.
  • Negative test: FAIL: response does not match expected marker (expected MOSAIC_NOT_OK, actual MOSAIC_HELLO_OK), exit 1.
  • reset.sh refusal tests: missing marker → exit 1, nothing deleted; symlink (with canary file at the target) → exit 1, canary survived; real path with marker → removed, exit 0; missing dir → "nothing to remove", exit 0.
  • Rerun after reset: build + verify → PASS, exit 0 (criterion 11).
  • Resolved compose mounts: only /home/jwoltje/.mosaic-dev → /var/lib/mosaic (rw) and ~/.pi/agent/auth.json → /home/node/.pi/agent/auth.json (read-only). No ~/.mosaic or ~/.config/mosaic mounts, no Docker socket.
• Failure or correction:
  1. First hello run: the contract loader's status line was printed on stdout, mixing runtime data into the model response stream and contaminating the exact-match capture. Fixed by sending the loader's status message to stderr (src/load-contracts.sh), rebuilt the image, reran: stdout is exactly the model response.
• Credential check: no credential material appears in this log, in hello/verify output, or in the image (image scan found no auth files).

Result

All 11 acceptance criteria demonstrated. The real model request passed.

---

Phase 5: Configuration-driven Hello World (M1)

Entry 5.1 — before

• Timestamp: 2026-09-03
• Intended action: Make the container POC configuration-driven. Baseline committed and tagged poc-container-hello-v0. Milestone M1 tracked in Gitea (issues #1-#4): (T1) config module with idempotent bootstrap and strict v1 validation; (T2) wire scripts and compose to config.json with fail-closed behavior; (T3) sandboxed config selftests; (T4) E2E verification and documentation.
• Reason: Per docs/plans/2026-09-02_atomic-mosaic-foundation.md — config.json must be the sole discovery entry point; updates and runs must never corrupt or invent configuration.
• Expected result: All M1 acceptance criteria pass; Hello World reproducible from configuration alone.

Entry 5.2 — after

• Timestamp: 2026-09-03
• Commands run: scripts/test-config.sh (20 cases); fail-closed checks (compose without launcher env, verify/reset with missing config); scripts/bootstrap.sh; config-driven scripts/hello.sh, scripts/verify.sh, negative marker test, sandboxed reset symlink refusal (canary survived), real reset + bootstrap + build + verify; config checksum comparison across the entire flow.
• Observed result:
  • Config selftests: 20 passed, 0 failed.
  • Fail-closed confirmed: compose exits 1 without launcher env; verify/reset exit 1 on missing config before any mutation.
  • Bootstrap created ~/.config/mosaic-dev/config.json exclusively; second run validated without rewriting (content + mtime unchanged).
  • Config-driven hello/verify returned exactly MOSAIC_HELLO_OK; verify exit 0; negative marker test exit 1.
  • Reset refused symlinked dataRoot; canary file survived; real reset removed only the configured data root.
  • config.json checksum unchanged across hello/verify/reset/bootstrap/build/verify.
• Failure or correction:
  1. Selftest harness bug: cfg helper invoked without a body for the symlink case ($2: unbound variable). Fixed in the harness; product code unaffected.
  2. E2E rerun-after-reset failure: verify.sh did not ensure the configured data root existed before the container mount. With the data root absent, Docker auto-created the host path as root:root, and the container's uid-1000 user could not write the generated system prompt. Fixed by calling bootstrap_runtime_dir in verify.sh; also hardened it to fail with a clear message when the data root exists but is not writable (root-owned leftover). Clean-slate E2E rerun: all steps green.
• Credential check: no credential material in config, scripts, logs, or test output.

Result (M1)

Configuration-driven Hello World verified. main merged with M1 and tagged config-hello-v1.

---

Phase 6: Mission and task abstraction (M2)

Entry 6.1 — before

• Timestamp: 2026-09-03
• Intended action: Add the first mission/task layer, host-side only (Gitea milestone M2, issues #6-#9): strict v1 schemas for missions and tasks, a task runner executing through the proven config-driven container path, immutable write-once run records under <dataRoot>/runs/, expectExact gating, timeouts, selftests, fixtures, and docs.
• Reason: The foundation plan's following layer — mission (objective + directives), task (bounded unit), run (one attempt), result (immutable evidence) — must exist as data and records before any policy or multi-agent work.
• Expected result: scripts/run-task.sh tasks/hello-marker.json succeeds with exactly MOSAIC_HELLO_OK; wrong expectations fail; every run leaves an immutable record; configuration remains untouched.

Entry 6.2 — after

• Timestamp: 2026-09-03
• Commands run: scripts/test-task.sh (18 cases incl. live runs); scripts/run-task.sh validate / run on committed fixtures; node scripts/mosaic-task.mjs list; config checksum comparison across runs.
• Observed result:
  • Selftests: 18 passed, 0 failed (schema negatives; live exact-marker success; wrong expectExact fails; distinct run dirs; result.json contents; list).
  • Fixture run: status succeeded, response exactly MOSAIC_HELLO_OK, mission snapshot recorded.
  • Run records written once under <dataRoot>/runs/r-<utcstamp>-<rand>/; reruns never clobber.
• Failure or correction: none this phase.
• Credential check: no credential material in task data, run records, or logs.

Result (M2)

Mission/task layer verified end-to-end. main merged with M2 and tagged mission-task-v1.

---

Phase 7: Release model and safe updates (M3)

Entry 7.1 — before

• Timestamp: 2026-09-03
• Intended action: Add the release substrate (Gitea milestone M3, issues #10-#13): RELEASE file single-sources the version (0.0.X line per owner direction), image tags derive from it, scripts/release.sh provides package/activate/rollback/status, activation is health-gated by the M2 task runner, pointer + append-only log under /state/.
• Reason: The owner's top invariant — updates must never corrupt a working installation — needs a mechanism, not a convention: gate-then-flip with recorded history and rollback.
• Expected result: Update, refusal, and rollback drills all green with config checksums unchanged.

Entry 7.2 — after

• Timestamp: 2026-09-03
• Commands run: scripts/test-release.sh (14 cases); recorded drills: update (0.0.3 -> 0.0.4 package+activate+verify), fault-injected refusal, rollback to 0.0.3.
• Observed result:
  • Selftests: 14 passed, 0 failed.
  • Update drill: packaged and activated r0.0.4 after exact-marker health gate; verify green under the new tag; config checksum unchanged.
  • Refusal drill: health-gate fault injection -> activation refused (exit 1), pointer untouched, refusal appended to the log.
  • Rollback drill: health-gated rollback to r0.0.3; pointer restored; log records package/activate/refused/rollback history append-only.
• Failure or correction:
  1. release.sh initially failed with missing state/ directory (no mkdir before pointer/log writes); fixed.
  2. Selftest harness mutated the repo RELEASE and restored the mutated copy (mv-back bug) plus a second trap replacing the first; fixed with inline backup restore and one self-healing exit trap. Product code unaffected.
• Credential check: no credential material in release state, logs, or drills.

Result (M3)

Release model and safe updates verified by drills. main merged with M3 and tagged release-model-v1.

---

Phase 8: Runtime adapter seam (M4)

Entry 8.1 — before

• Timestamp: 2026-09-03
• Intended action: Formalize the harness boundary (Gitea milestone M4, issues #16-#19): documented adapter contract under /opt/mosaic/adapters//adapter.sh; run-agent.sh becomes a dispatcher; pi extracted unchanged; deterministic mock adapter for provider-free seam tests; config gains optional execution.adapter (default pi, configVersion unchanged); mission directives gain their sanctioned injection point via the run snapshot; RELEASE bumps to 0.0.5 with a health-gated activation.
• Reason: Future harnesses (Claude, Codex, OpenCode) must be additive — one directory each — and mission content needs a single sanctioned path into the runtime.
• Expected result: All suites green including new deterministic seam cases; 0.0.5 activated by health gate; mission-bearing run recorded.

Entry 8.2 — after

• Timestamp: 2026-09-03
• Commands run: scripts/test-config.sh; scripts/test-task.sh; scripts/test-release.sh; manual seam drills (mock verbatim, unknown/traversal adapter refusal); mission injection checks; release package + activate for 0.0.5.
• Observed result:
  • Config suite 24/24 (adapter default/validation/env export).
  • Task suite 24/24 including deterministic mock cases (gate pass, expect-mismatch with reason, unknown adapter fail-closed) and mission injection asserted by prompt content.
  • Release suite 14/14; image mosaic-poc-agent:0.84.4-r0.0.5 packaged and activated via exact-marker health gate.
  • Mission directives now flow: task -> run snapshot -> container env -> generated prompt MISSION (runtime) section.
• Failure or correction:
  1. Selection authority settled: load_config always exports MOSAIC_ADAPTER from config; environment overrides for scripts are therefore not a supported selection path (by design).
  2. Selftest harness: three authoring defects fixed (helpers used before definition; one config file reused across cases leaking adapter state; a static mission fixture asserted against distinctive seam directives; plus an accidentally duplicated live block removed).
• Credential check: no credential material in adapters, prompts, run records, or logs.

Result (M4)

Adapter seam verified; harness boundary is now additive by construction. main merged with M4 and tagged adapter-seam-v1.

---

Phase 9: Workspaces + capability envelope (M5)

Entry 9.1 — before

• Timestamp: 2026-09-03
• Intended action: Optional task workspace (absent / ":run" ephemeral / named persistent) and capabilities.tools allowlist (pi built-ins); runner plumbing via MOSAIC_WORKSPACE/MOSAIC_TOOLS; pi adapter maps to cwd + --tools; mock adapter logs delivered MOSAIC_* vars for deterministic assertions (Gitea #20, #21).
• Reason: Agents that only answer text cannot do work; the workspace+tools pair is the smallest real capability step, bounded by the container.
• Expected result: plumbing asserted via run-record stderr; live pi writes a host-visible file.

Entry 9.2 — after

• Timestamp: 2026-09-03
• Commands run: build; mock plumbing run; validate negatives; full task suite; live workspace demo.
• Observed result: task suite 32/32; MOSAIC_WORKSPACE/MOSAIC_TOOLS asserted in run record; dataRoot/workspaces/ created host-side; live pi used bash to write proof.txt into the demo workspace (host-visible).
• Failure or correction: (1) batch edit dropped SUPPORTED_TOOLS const (runtime ReferenceError, exit 1 instead of 2) — restored; (2) mock env dump used export which this dash prints as export K='v' — switched to env; (3) selftest fed a mismatching mock response to the plain-task case — test bug, fixed.

Phase 10: Named sessions (M6)

Entry 10.1 — before

• Timestamp: 2026-09-03
• Intended action: Optional task.session name -> persistent session dir dataRoot/sessions/ via pi --session-dir; resume most recent with -c when present; isolation per name; teach/recall demo fixtures (Gitea #22, #23).
• Reason: L1 persistence is the prerequisite for any multi-step agent work.
• Expected result: session dir populated after first run; second run recalls taught context.

Entry 10.2 — after

• Timestamp: 2026-09-03
• Commands run: build; mock plumbing run; live teach/recall E2E; task suite.
• Observed result: task suite 32/32; teach run replied REMEMBERED and session JSONL persisted host-side; recall run resumed (-c) and answered exactly 'mosaico'; single continued session file (no duplicate sessions).
• Failure or correction: none. Design note: ephemeral (--no-session) remains the default when no session is declared.

Phase 11: Operator ergonomics (M7)

Entry 11.1 — before

• Timestamp: 2026-09-03
• Intended action: mosaic-task.mjs show (full record + snapshots + artifacts, traversal-safe), list with workspace/session columns, RELEASE -> 0.0.6, package + health-gated activate, docs (Gitea #24).
• Reason: Run records are only as valuable as they are inspectable; release activation closes the loop on container-content changes.
• Expected result: show works for real/missing/traversal ids; suites green; 0.0.6 active.

Entry 11.2 — after

• Timestamp: 2026-09-03
• Commands run: build; show on real/missing/traversal ids; full sweep; release package + activate.
• Observed result: config 24/24, task 32/32, release 14/14, verify PASS; 0.0.6 packaged and activated via exact-marker health gate.
• Failure or correction: showRun initially rejected valid run ids (lowercase-only regex vs uppercase timestamp) and crashed on missing ids (uncaught readdir) — both fixed and covered.

Autonomous run result

M5 tagged workspace-capabilities-v1, M6 tagged sessions-v1, M7 tagged operator-ergonomics-v1; release 0.0.6 active. Tracker: docs/plans/2026-09-03_autonomous-run.md.

---

Phase 12: Conductor loop — self-orchestration (M8)

Entry 12.1 — before

• Timestamp: 2026-09-03
• Intended action: Stand up the poor-man orchestration loop per docs/plans/CONDUCTOR.md: conductor (host, holds git) mirrors the repo into a worker workspace, dispatches a headless pi worker (session worker-1, tools read/write/edit/bash) to implement retry , reviews the diff, integrates, verifies (Gitea #25, #26, #27).
• Reason: The owner asked for circular task processing with agent workers; the stack now has every primitive needed — this proves it on the stack itself.
• Expected result: worker-authored retry merged with suites green and a live retry verified.

Entry 12.2 — after

• Timestamp: 2026-09-03
• Commands run: repo mirror clone; worker dispatch (tasks/worker-retry.json); diff review; apply; live retry; refinement dispatch (tasks/worker-retry-refine.json); second review; reverse+reapply combined patch; conductor interpolation fix; live retry; full sweep.
• Observed result:
  • Worker round 1: implemented retry correctly per spec in 2m28s; diff reviewed clean.
  • Live retry exposed a spec gap (direct invocation lacks launcher env exports).
  • Worker round 2 (same session, 59s): made spawnEnv self-sufficient, but used PI_* names where compose interpolates MOSAIC_*.
  • Conductor hotfix: 3-line rename to MOSAIC_PROVIDER/MOSAIC_MODEL/MOSAIC_DATA_ROOT (too trivial for a worker round).
  • Final: live retry succeeded (replied REMEMBERED, new run recorded); all suites green.
• Failure or correction: three rounds total — one spec gap (conductor), one naming mismatch (worker), one trivial rename (conductor). Each was caught by mechanical verification (run record stderr), never by hope.
• Attribution: feature authored by headless pi worker (glm-5.3-flash) in sessions worker-1; conductor reviewed, integrated, and hotfixed.

Result (M8)

Conductor loop proven end-to-end on the stack itself. main merged with M8; release 0.0.6 remains active (retry is host-side only, no image change).

---

Phase 13: Mission-level capability policy (M9)

Entry 13.1 — before

• Timestamp: 2026-09-03
• Intended action: Missions may declare capabilities.tools as governing constraints (Gitea #30); merge semantics = least-privilege intersection (task narrows, never widens; empty intersection = tool-free run). Host-side only.
• Reason: First mechanical restriction layer — the trust model becomes enforced, not instructed.
• Expected result: all four merge cases asserted from run evidence; suites green.

Entry 13.2 — after

• Observed: four merge cases verified deterministically via run-record stderr (mission-only, task-only, narrowed, emptied); invalid mission capabilities exit 2; task suite 41/41.
• Failure or correction: selftest harness could not express ABSENT vs EMPTY fields via its printf helper — fixed with an ABSENT marker; two suite config-leak defects fixed (per-command env scoping). Product unaffected.

Phase 14: Session forking (M11)

Entry 14.1 — before

• Timestamp: 2026-09-03
• Intended action: sessionForkFrom task field branches the source session's newest file (pi --fork) into the target session dir; ancestor untouched; RELEASE -> 0.0.7 with health-gated activation (Gitea #33).
• Reason: Owner flagged conversation forking from a common ancestor as a desired property; pi JSONL trees make it native.
• Expected result: forked child recalls ancestor context; ancestor file untouched; suites green; 0.0.7 active.

Entry 14.2 — after

• Observed: mock plumbing asserts fork source + target delivery; validation rejects fork-without-target and self-fork (exit 2); ghost source exits 4; live fork: child recalled 'mosaico' from ancestor context while the ancestor session file remained untouched (file-level assertion); suites 58/24/14 + verify green; 0.0.7 packaged and activated via health gate.
• Failure or correction: retryRun-style self-assignment bug in validation (compared null to target) — caught by negative test, fixed.

Result (M11)

Session forking verified. main merged with M11, tagged session-fork-v1; release 0.0.7 active.

---

Phase 15: Interactive TUI agent + TOOLS.md (M13)

Entry 15.1 — before

• Timestamp: 2026-09-03
• Intended action: Add scripts/agent.sh — an interactive TUI launcher (contracts + optional mission + agent identity + named session + optional workspace/tools) — and the pi-adapter interactive branch; remove the fixed compose command; add docs/TOOLS.md as the on-demand reference AGENTS.md routes to; RELEASE -> 0.0.8 (Gitea #35).
• Reason: The owner's bootstrap model is vanilla pi sessions directed by AGENTS.md, graduating to governed TUI agents — the first the system itself launches.
• Expected result: TUI agent launches with contracts+identity context; headless paths unchanged; TOOLS.md consolidates the reference.

Entry 15.2 — after

• Observed: mock plumbing asserts agent name/session/workspace/mission delivery; identity section asserted in generated prompt; headless hello + suites green (24/58/17/14 + verify); 0.0.8 packaged and health-gated activated.
• Failure or correction:
  1. Regression: pi adapter rewrite made MOSAIC_AGENT_NAME unconditionally required, breaking headless paths — caught by task suite (empty-stderr exit-nonzero), fixed (optional in headless; identity section simply omitted).
  2. Regression: unquoted $REQUEST_ARG word-split the request into positional args — fixed with positional-argument building (set -- ... "$@").
  3. Mission fixture wording (objective named the agent) invited the model to append its name after the marker, tripping the strict gate — fixture tightened; strict gate kept by design.
• Conductor session env hygiene: sandbox config exports now scoped per-command after a leak broke cross-suite runs.

Result (M13)

Interactive TUI agent launched and verified; TOOLS.md reference shipped. main merged with M13, tagged interactive-agent-v1; release 0.0.8 active.

---

Phase 16: Run-record retention (M10) — recorded retroactively

• Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled entry; the original phase entry was lost to editor races - see correction note below)
• Summary: mosaic-task.mjs prune [--keep=N] [--yes] - keep newest N run records, dry-run by default, append-only .pruned.log receipt, sessions/workspaces/state untouched. 8 suite cases.
• Observed: dry-run deletes nothing; keep-N honored; newest kept; receipt written; isolation asserted.
• Correction (recorded): suite-hardening edits (prune section config scoping, duplicate helper removal) were applied in the same phase.

Phase 17: Conductor auto-apply policy (M12) — recorded retroactively

• Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
• Summary: conductor-policy.json (tracked, strictly validated: enabled switch, path allowlist, gating suites) + scripts/conductor-apply.sh <runId> - succeeded-run check, clean target tree, allowlist, syntax gates, apply, suites, attribution commit; any failure reverts; push never automatic. 17 sandbox suite cases.
• Observed: all gates green; suite-failure auto-revert verified; disabled policy refuses with exit 2.
• Decision recorded: review moves to after-the-fact (history revertible) for worker patches under the policy; push remains explicit.

Phase 18: Live user context (M14) — recorded retroactively

• Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
• Summary: USER.md removed from immutable contracts (wrong owner - user info is user-owned live context); <dataRoot>/user/*.md dispatched (sorted) into every agent launch's generated prompt; bootstrap seeds user/USER.md once; loader layers now governance -> persona -> identity -> mission -> user.
• Observed: user edit propagates to next launch (TUI or headless) without rebuilds; contract-only prompts unchanged when no user dir present.
• Correction (recorded): first implementation pass did not regenerate the container - caught by owner test (edits to repo/mirror copies of USER.md did not propagate; the design, not the test, was the defect).

Phase 19: Agent seats + roles/ convention (M15) — recorded retroactively

• Timestamp of work: 2026-09-03; recorded: 2026-09-03 (back-filled)
• Summary: agents/<name>/ holds agent.json (strict validation: version, name, role?, capabilities?, workspace?, session?) + SOUL.md persona; agent.sh validates, copies runtime SOUL to dataRoot/agents/<name>/, sets MOSAIC_AGENT_SOUL_FILE; loader fills the SOUL slot from the seat persona (contract SOUL = default); identity section gains role; per-agent default workspace; compose passthroughs.
• Observed: launch with seat definition replaces the contract persona in the generated prompt; role in identity; seat record written once; suites green; RELEASE 0.0.10 packaged, health-gated activated.
• Correction (recorded): RELEASE was not bumped when container content changed - tag r0.0.9 rebuilt with different content (invariant lapse; r0.0.9 was never active). Restored: RELEASE 0.0.10 packaged beside, health-gated, activated.
• Conventions recorded per owner direction: repository root holds bootstrap-required configuration only; role contracts live in roles/.

Backfill note

Phases 16-19 were recorded retroactively on 2026-09-03 after editor-session races left them unwritten at the time of work. Ground truth for each entry: the git history (commit subjects/bodies), the Gitea milestone/issue records (#32, #34, #35, #36), and the suite files themselves. No facts were reconstructed from memory alone.

---

Phase 20: Release self-determination (M16)

Entry 20.1 — before

• Timestamp: 2026-09-03
• Intended action: The system determines what is installed and aligns itself; the user never manually runs release.sh. release.sh ensure (align-or-noop) invoked automatically by human-facing launchers (hello, verify, agent); run-task reports drift without auto-aligning (workers/suites must not trigger builds or model gates mid-automation).
• Reason: Owner direction — intelligence in operation; post-reset pointer loss required a manual release command, which contradicts the self-healing design.
• Expected result: post-reset pointer loss auto-restores via health-gated ensure; drift warns on run-task; aligned state is a no-op; M20 packages/* decision recorded.

Entry 20.2 — after

• Timestamp: 2026-09-03
• Commands run: ensure with pointer removed (live drift); ensure idempotence; drift-warning demo via RELEASE bump without packaging; full suites.
• Observed result: drift detected (active: none, desired: 0.0.11) -> health-gated activate -> aligned; second ensure no-op; run-task drift warning fired on desired-version bump without packaging; all suites green (24/68/17/14 + verify).
• Failure or correction:
  1. First run-task edit anchor missed (inline comment mismatch) — reapplied with exact text.
  2. RELEASE was temporarily bumped to 0.0.12 without packaging for the drift demo — restored to 0.0.11; state pointer remained aligned.
• M20 decision recorded in ROADMAP.md: v2 adopts packages/* monorepo structure at usurpation (owner, continuity-first).
• Process note (tool races): mechanism confirmed — batching a file write/edit and a dependent bash command in one parallel block runs the bash before the write flushes. Consequences: lost doc updates, stale anchors, one premature grep. Operating rule: dependent calls sequential; every write verified before claimed complete.

Result (M16)

Release self-determination live: the system aligns itself to RELEASE without manual commands. Suites 24/68/17/14 + verify green.

Phase 21: M16 hardening + M20 decision

• Recursion guard: release.sh's health-gate task run sets MOSAIC_ENSURE_SKIP so the gate's run-task cannot re-enter release self-determination.
• run-task.sh: drift warning on pointer/RELEASE mismatch (workers and suites never trigger builds or model gates mid-automation).
• ROADMAP M20 decision recorded: v2 adopts packages/* monorepo structure at usurpation (owner, continuity-first); restructure sequenced as M20 phase 1.
• Live drill: drift 0.0.11 -> 0.0.12 detected, health-gated activate, no recursion, verify green.

Phase 22: Conductor-loop calibration with a live collaborator (#43)

• First full loop through the live-seat path: decompose → dispatch (agent-send.sh, class=actionable) → receipt → line-by-line diff review → suite-gated integration. Worker: ms-test seat (glm-5.3-flash) in the repo cwd, scoped to docs/TOOLS.md, no git.
• Before (conductor baseline): suites 24/74/14/17 green; TOOLS.md had no tools/ coverage; Maintenance table claimed test-task.sh = 58 cases (stale).
• After: TOOLS.md gains "Tools (host-side)" (agent-send.sh, agent-watch.sh, unslop-check.js), corrected counts, reading-guide fix; suites 24/74/14/17
  • verify green post-integration.
• Masking-failure rule applied: every documented flag/subcommand/exit code independently verified against tool source by the conductor, not taken from the worker's report (all claims checked out).
• Worker caught a spec gap the conductor missed: the intro reading-guide ("all entry points are scripts/*.sh") became false with the new section; amendment flagged, reviewed, accepted.
• Process correction: the worker's first reply was typed into the pane without agent-send.sh and never delivered; the protocol resend is the report of record. Comms discipline is load-bearing, not ceremony.
• CURRENT.md staleness corrected: it still named M16 as next though M16 (#38) and M17 (#40–#42, skill-lifecycle-v1, release 0.0.12) had shipped; late entries added to its completed log, next action is now M18.

Result (calibration)

The conductor loop is proven end to end on a live seat; TOOLS.md covers the tools/ tree; suites green at every gate.

Phase 23: M18 — seat-role progressive capability restriction

• Role contracts: roles/<role>.json — roleVersion, name (must match filename), tools ceiling (subset of pi built-ins), network declared (none | api-only | open; enforcement is a later milestone). Strict schema, fail closed; a non-role document (e.g. conductor-policy.json) refuses.
• mosaic-task.mjs resolve-role <file>: config-free validation, emits MOSAIC_ROLE_TOOLS / MOSAIC_ROLE_NETWORK for agent.sh to consume.
• agent.sh: a declared role binds to its contract. Missing/invalid contract refuses the launch (exit 2, names the role) — the under-equipped-seat failure mode, mirroring M17 skills. Effective tools = ceiling ∩ requested (CLI --tools or agent.json caps); no request → ceiling stands; narrowing and tool-free outcomes are loud on stderr. Adapters unchanged (MOSAIC_TOOLS carries the effective set); headless M9 chain (mission ∩ task) untouched.
• Ships roles/researcher.json — the existing researcher seat declares the role; without the contract the fail-closed gate would refuse its launch.
• Suite additions (14 cases, task suite 74 → 88): contract resolution, wrong-kind/name/network/duplicate/unsupported/missing refusals, seat narrowing E2E via mock adapter, tool-free E2E, missing-contract refusal.
• Test-authoring correction: the first version of the missing-contract case registered its check only on the failure path (a || RC=$? chain swallowed it on success); caught by count arithmetic (74 + 15 ≠ 88), restructured so the case always registers.

Result (M18)

Seat roles are ceilings, not labels: the M15 role field now resolves to a versioned contract that seats cannot escalate past. Suites 24/88/14/17 + verify green.

Phase 23 follow-up: fail-closed seat resolution under override (#46)

• Owner live-verified M18 (2026-09-03): ceiling narrowing note with the correct narrowed set, missing-contract refusal message, clean researcher launch, validator positives and negatives, tool-free note — all as expected.
• The verification surfaced a governance gap: an explicit MOSAIC_AGENTS_DIR override that cannot resolve the named seat still launched — seatless, unbounded, no role ceiling to bind.
• Owner decision: fail closed. agent.sh now refuses (exit 4, names the seat and the dir) when the override is set and no seat definition resolves; unsetting the override keeps the M13 plain governed TUI. MOSAIC_ROLES_DIR needs no symmetric change — the M18 gate already refuses unresolvable contracts.
• Task suite 88 → 90 (refusal + refusal-names-the-seat); TOOLS.md Agent section documents the refusal.

Result

Suites 24/90/14/17 + verify green. Seat resolution is now fail closed in every direction: unknown seat under override, declared role without contract, invalid contract, empty ceiling intersection.

Phase 24: M19 — harness auth tooling (pi checkpoint)

• Investigation (pi 0.84.4 docs + host auth.json metadata; values never read): provider stacking is native — one auth.json keyed by provider, resolution --api-key > auth.json > env > models.json, OAuth entries auto-refresh. Multi-account per provider is NOT native (one entry per provider, no namespacing) → named-file design confirmed: auth..json + per-launch injection.
• scripts/auth.sh: status (provider names + credential types + perms + env-side credential-like NAMES, informational; never credential material) and accounts (named files, active marker). Exit codes per convention: 3 missing for a read, 2 unparseable, 4 file/environment (symlink refuses).
• scripts/agent.sh --auth : resolves auth..json and exports PI_AUTH_FILE — the compose read-only mount source, so no new plumbing. Missing/invalid account refuses before any container work.
• scripts/test-auth.sh (13 cases, no Docker): the core assertion is the safety property itself — fixture key/token/env VALUES never reach output — plus the exit-code paths and the accounts listing.
• Scope note: headless task runs keep the default credential; worker auth selection is a separate policy decision.
• Real-host smoke: 3 providers reported (anthropic/openai-codex oauth, zai api_key), perms 600, no named accounts yet.

Result (M19)

Auth is checkpointable without exposing credentials, and multi-account has a per-launch path. Suites 24/90/14/17/13 + verify green. The agreed ROADMAP sequence M16–M19 is complete; M20 (packages/* restructure + unified CLI) is owner-gated.

Phase 24 follow-up: auth ownership corrected — data root, never ~/.pi (#48)

• Owner correction after M19 review: mosaic-managed named accounts must not live inside ~/.pi — the stack must never impact default harness usage. Recorded as a ROADMAP standing decision: the stack never writes to default harness config locations; ~/.pi is read-only to the stack.
• Correction noted honestly: M19 as shipped placed accounts beside ~/.pi/agent/auth.json. Nothing had been created there (accounts reported none), so the move breaks nothing.
• auth.sh is now config-driven (data root from config.json, fail closed — consistent with every other tool); status reports both sources labeled: default harness credential (read-only to the stack) + mosaic-managed accounts.
• Accounts live at /auth/.json, perms 0600 enforced: loose perms flagged in listings and refused by agent.sh --auth (mirrors scripts/gitea-api.sh credential hygiene).
• Test-authoring correction: the first suite rewrite asserted "(none)" in cases whose fixtures had already created accounts; caught on review before any run, assertions rewritten to match fixture state.
• auth.sh suite: 13 → 15 cases (accounts-create-nothing, loose-perms refusal, invalid-config refusal added).

Result

Suites 24/15/90/14/17 + verify green. Default harness usage is untouched by design; all mosaic-managed credentials live inside the governed data root.

Phase 25: harness/provider/auth registry specification (#49)

• Design-only phase; no implementation authorized. Draft: docs/plans/2026-09-03_auth-provider-harness-registry.md.
• Agent harness is specified in agent.json as one scalar identifier (harness: "pi" initially), resolved through a versioned harness manifest/adapter rather than a permanent hard-coded enum. Existing v1 seats migrate with a loud pi default; no CLI harness override in phase 1.
• Central registry separates providers, accounts, reusable settings profiles, runtime seat selection, and generated harness files. A seat references one reusable profile; it is not registered with each provider.
• Multiple OAuth/API accounts for one provider may be centrally authorized; pi materializes exactly one active account per provider. Runtime selection is audited data-root state; generated auth.json/models.json are disposable per-seat derivatives.
• OAuth login/refresh is host-side and centralized; agents never enroll or own refresh tokens. Exact noninteractive pi refresh mechanics remain a required implementation investigation.
• Local and remote Ollama are endpoint-provider records materialized into per-seat models.json, independently scoped from authentication accounts.
• Target mosaic CLI covers auth account lifecycle, provider lifecycle, refresh/ensure, reusable settings profiles, and seat selection. Secret material is never accepted on argv.
• Spec includes registry paths/schemas, naming/perms, fail-closed launch materialization, migration from M19, acceptance suites, and ten explicit owner review gates (including reset/backup semantics and encryption at rest).

Result (spec draft)

Spec is ready for owner/conductor review; CURRENT.md points only to that review. Implementation remains blocked until all ten gates are resolved.

Phase 25 independent review receipt (#50)

• Reviewer: live ms-test seat, zai/glm-5.3; read-only, no files edited.
• Verdict: ACCEPT WITH CHANGES. Taxonomy and reusable-profile/no-seat- registration model are sound; two technical P0 gaps plus one policy P0 block implementation.
• P0: define per-seat launch provider/model resolution; resolve rotating OAuth-token persistence for long-running seats with read-only generated auth; enforce role auth ceiling ∩ settings profile in phase 1 and repair AGENTS.md data map/reset warnings.
• Ten-gate recommendations persisted in Gitea #50. Important additions: mandatory settingsProfile for v2 seats; session account pinning sidecar; Node secret-handling core; remote Ollama HTTPS; dataRoot reset semantics; hard-delete stale generated credentials; per-account refresh locking.
• Comms note: acknowledgment returned rc=2 (submission not confirmed), but pane evidence showed it was submitted, read, and acted on. No retry was sent because duplicate delivery would be worse; watch retired.

Implementation remains blocked pending owner/conductor adjudication and a revised spec.

Phase 25 review revision: harness lifecycle (gate 1 resolved)

• Owner confirmed canonical harness IDs match executable names: pi, claude, codex, opencode. agent.json stores one scalar ID; dynamic manifest/registry resolution replaces a hard-coded schema enum.
• Spec adds mosaic harness list|detect|install|rm|status.
• Detection recognizes reviewed canonical executables, records compatible findings as available, and never imports harness homes/config/auth.
• Installation is exact-version/verified, Mosaic-managed, never global; immutable runtime packages survive dataRoot reset.
• Container seam remains explicit for review: a detected host executable is available but not launch-ready until imported/installed into a managed runtime, unless host execution gets a separate reviewed adapter.
• Gate 1 marked RESOLVED in the spec and #50; all other P0/review gates remain open. No implementation authorized.

Phase 26: frontend design operating standard (2026-09-05, before)

• Owner requested concrete design rules portable across agents and harnesses, then added mandatory site completeness: 404, privacy, applicable cookie consent, About, Contact methods, and dynamic copyright years.
• Before: ms-frontend-design is an untracked art-direction skill with broad accessibility guidance and no site-completeness acceptance checks.
• Planned: a compact core plus focused design, accessibility, visual-system, site-completeness, and verification references; remove the irrelevant license pointer at owner direction. Preserve the unrelated CURRENT action.
• Gitea issue lookup hit sandbox DNS failure; escalated lookup is pending.
• Validation planned: skill validator, local reference integrity, whitespace, and scenario walkthroughs. No runtime stack changes are planned.

Phase 26 result: frontend design operating standard (#52)

• Gitea lookup succeeded with HTTP 200 after escalation; issue #52 created with HTTP 201. The GET helper returned exit 1 despite HTTP 200 and a valid response; its empty-body cleanup expression explains that exit status. No helper changes were made.
• Replaced ms-frontend-design/SKILL.md with a 115-line portable core and five focused references: design principles, visual system, accessibility, site completeness, and verification. Removed the irrelevant license pointer.
• Added 36 identifiable rules: contextual UX heuristics, semantic visual roles, accessibility thresholds, complete states, required public-site pages/contact methods, truthful privacy content, applicable functional consent, shared dynamic copyright, and evidence of completion.
• Source check: Laws of UX, W3C WCAG/APG, Nielsen heuristics, EDPB transparency, and current CNIL cookie-guidance pages consulted. Cookie requirements are scoped by actual technologies and jurisdiction; no blanket compliance claim.
• Structural validation: bundled quick_validate.py passed; all eight local Markdown links resolve within the skill; 36 rule IDs are unique; all six skill files have final newlines and no trailing whitespace; git diff --check passed. No runtime stack suites were run for these Markdown-only changes.
• Reasoning walkthrough: seven scenarios checked against the instructions. New public sites require support pages; consent-required integrations need network/storage evidence; internal dashboards and narrow repairs preserve scope; missing business facts remain unresolved; static years need rollover; missing browser capability yields not-verified checks. No app was rendered and no independent or cross-harness execution was performed.
• Skill remains in the working tree for owner review/integration; no commit, push, or activation. CURRENT.md retains the unrelated registry review action.

Phase 27: agent/project/workspace planning (2026-09-06, before)

• Jason authorized documentation first, with owner review between phases. Reusable agent identities, project/workspace registration, workspace-scoped work state, Resume/Fresh launches, and execution auditability are the topic.
• Baseline: 69d1bb3aa4. Existing uncommitted skill drafts, Phase 26, and session entries belong to other work and remain untouched. The earlier owner checkpoint edit to CURRENT.md is retained as history through this entry, then superseded by the new planning direction.
• Before: Jason demonstrated researcher launch, read/ls on an empty test workspace, exit, and recall after resume. This is user-provided evidence, not a permissions-isolation test. A fresh-context demonstration did not occur; no broad foundation acceptance is inferred.
• Plan: write a plain-language requirements/phase document and a linked schema/audit discussion draft. Mark proposals and open decisions explicitly. No runtime schema, source, account, release, or workspace migration changes.
• Issue creation requested from rocko through agent-send on the discovered default socket, exit 0 delivered. Scope is issue intake only under the authorized seat identity. The repo helper still expects personal-credential JSON; it was inspected as code, not invoked. No credential values read.
• Later Archify mapping and distinct-agent gap analysis require separate owner phase approval. No review or mapping worker dispatched in this phase.
• Checks planned: Markdown references, embedded JSON syntax, evidence-source ranges, plain-language lint, and whitespace. Runtime suites are not proof of a documentation draft and are not planned unless publication is requested.

Phase 27 result: documentation draft for owner review (#53)

• Rocko reported issue #53 creation under its seat identity, POST 201 at 2026-09-06T00:12:33Z. Read the retained issue body at ~/.mosaic/fleet/lanes/archify/comms/2026-09-06T00-12Z_rocko_issue-53-body.md. No legacy personal-credential helper invocation or credential changes.
• Added docs/plans/2026-09-06_agent-project-workspace-foundation.md and docs/plans/2026-09-06_workspace-schema-and-audit.md. R1-R15 record owner intent; D1-D15 separate open decisions from proposed fields and mechanisms. Included launch identity, state ownership, work selection, registrations, execution/action evidence, message routing, concurrency, and audit limits.
• Current-source references identify global session naming, per-agent mission and SOUL files, shared prompt/temp files, and the broad data-root mount as places the later independent analysis must inspect. No race reproduction or security isolation claim. Initial citation ranges were corrected during author checking before reporting the draft ready.
• CURRENT.md now stops at owner review of this phase-1 draft. Registry #50 stays paused. Archify mapping, distinct-agent gap analysis and report review, implementation, and user tests each require later phase approval.
• Checks passed: five local links/anchors; two JSON examples parse; nine source citation groups exist within unchanged baseline files; R1-R15 and D1-D15 unique/complete; code fences, final newlines, and whitespace valid. Both new documents pass node tools/unslop-hook/unslop-check.js; git diff --check passes on the scoped planning changes. These are author structural checks, not independent review, JSON Schema validation, or runtime test evidence.
• Draft SHA-256 values: foundation: fb9e2981fee864771c20c6176995192c5624a9d3004737d9b12ce3b1fb2c53f6 schema/audit: 50ced2a31581e46a443b5a6ba8120fdde5463ff58412f7b8d7872ffcdaa7a47a
• No runtime suites, worker/map/review dispatch, implementation, commit, push, release change, migration, or issue closure. Existing unrelated work kept. Status is documentation drafted for owner review, not approved design.

Phase 27 amendment: configuration-change notice (2026-09-06, before)

• Owner approved current canonical SOUL at each launch, execution-specific input copies, no silent mid-session replacement, and visible change notices. Added owner requirement: TUI/GUI/WUI can reference the launch hash and show canonical-versus-running configuration mismatch with a Fresh recommendation.
• Documentation only under #53. Plan amendments will distinguish approved update behavior from proposed hash fields/comparison rules. Credential lifecycle, permission revocation, and exact hash scope remain separate decisions. No change detector, UI, or launcher implementation authorized.

Phase 27 amendment result: configuration-change notice (#53)

• Recorded owner-approved SOUL/update behavior as R16 and cross-interface configuration mismatch notices as R17. Clarified that today's SOUL copy is refreshed each launch, not permanently assigned to a workspace.
• Schema discussion section 2.1 distinguishes the whole launch-manifest hash from the comparable agent-configuration hash. Field names, hash definition, check/notification mechanics, and startup verification remain proposals in D16. D10 is only partly resolved; credential lifecycle remains open.
• A mismatch recommends Fresh, never automatic restart or abandonment. Added unknown comparison status, per-execution input binding, no secret hashing, no false warnings from ordinary task updates, and the distinction between a startup fingerprint and continuous process verification. Permission revocation remains independent of retaining old launch inputs.
• Added a two-workspace update test and the canonical-config-to-client-notice path for later independent tracing. CURRENT stays in owner documentation review; no new phase, runtime change, mapping, or independent review began.
• Structural checks passed: five links/anchors, two JSON examples, nine source citation groups in unchanged baseline files, R1-R17 and D1-D16, fences and whitespace; both prose checks and git diff --check passed. No runtime suites.
• Revised draft SHA-256 values, superseding earlier draft identities only: foundation: 1aada228772186896470ed52db89398f81e2949c2c38e8d49b86b8e41c6b86df schema/audit: 99e2e28f0307345c738b273950b7f0c2b01c0133c6bf5cf3ce5e1f17819b8f92
• No commit, push, or issue closure. Exact schema choices still need review.

Phase 27 interview round 1 (#53, 2026-09-06)

• Owner answered Q1 C, Q2 B, Q3 B: linked project/workspace missions with standalone workspace missions allowed within scope; bounded delegated system registration/assignment authority; shared project information plus explicitly permitted workspace visibility. Updated R2/R3, added R18, and recorded the answers in schema/audit section 7.1 with the source session.
• Q4 selected B with a qualification rejecting an unnecessary offer and preferring an initial-conversation declaration. Preserved the owner's wording. D4 remains unresolved pending a focused clarification about automatic first creation versus an explicit Fresh invocation.
• CURRENT.md reflects the owner-authorized interview and its pending question. No whole-plan approval, runtime change, map, review dispatch, or publication.
• Markdown links/anchors, JSON examples, fences/whitespace, requirement and decision IDs, both prose checks, and git diff --check passed. No suites run.

Phase 27 Q4 clarification (#53, 2026-09-06)

• Jason selected A: genuine first use creates the initial conversation and announces it without an offer. Later launches resume by default. Missing or damaged established conversations are errors, not first use.
• Updated R7, launch discussion, D4, and CURRENT; appended the clarification after the verbatim original Q4 answer. Reliable first-use history remains a storage/recovery detail, not an assumption based on file absence.
• Both prose checks, Markdown links/anchors, JSON examples, fences/whitespace, and git diff --check passed. Documentation only; no runtime tests or changes.

Phase 27 interview round 2 (#53, 2026-09-06)

• Owner Q5 A: strict single-parent hierarchy; project owns N workspaces, each workspace requires one project. Workspace missions have at most one parent project mission; dependencies do not create additional parents or grants.
• Q6 agreed to Fresh/Continue recovery information. Q7 B permits authorized independent routine acceptance and autonomous non-destructive decisions within the established goal/plan, without user interaction for each step. Owner checkpoints, protected operations, and deviations remain gated.
• Q8 A makes default Abandon assignment-only. Q9 B requires explicit authorized assignment change for unfinished prerequisites, not silent extra work. Read together with Q7, delegated coordinators can authorize within-plan changes without asking Jason each time; the worker cannot self-expand silently.
• Updated both drafts and CURRENT. R19 records bounded autonomy; section 7.2 preserves this round's answers. Exact field/lifecycle details remain open.
• Checks passed: five links/anchors, two JSON examples, nine unchanged-baseline citation groups, R1-R19/D1-D16, fences/whitespace, both prose checks, and git diff --check. No runtime tests, implementation, dispatch, or publication.

Proactive skill and dev goal protocol (2026-09-05)

• Owner requested the recommended ms-proactive-agent changes in this repository and a possible ms-goal companion for testing before /goal integration.
• Replaced fleet-only paths, mandatory extension/report dependencies, and conflicting stop/wait rules with scoped context resolution, checkpoint-based continuation, bounded goal decomposition, persistent approvals, explicit manual waits, ownership checks, and uncertain-action recovery.
• Added skills/ms-goal/SKILL.md: file-based goal lifecycle and recovery protocol, single-writer dev record convention, criterion-based completion, budget/hold preservation, and explicit requirements for future extension integration.
• Added references/execution-checks.md under ms-goal with a two-task fixture, state/failure scenarios, and future runtime checks. This is an instruction protocol; no scheduler, locking service, workspace API, or goal tool added.
• Both quick_validate.py checks passed; relative links, fenced YAML record, Markdown fences and whitespace passed. The documented fixture verifier accepted correct artifacts and rejected an incorrect hash in a temporary directory. No live model run, concurrency test, or full runtime suites.
• Existing implicit skill invocation remains enabled through default metadata. No installed skill copies, runtime configuration, CURRENT.md, or project planning documents changed. No activation, commit, push, or issue closure.

Phase 27 interview round 3 (#53, 2026-09-06)

• Q10 A permits unassigned conversation/inspection and recorded assignments for changes. Q11 corrects the automatic-connect recommendation: report the active-session conflict and offer to connect; do not auto-attach or duplicate. The exact owner example is retained in section 7.3. Service response is open.
• Q12 B separates shared work records from transcript grants. Q13 A chooses concise action metadata with separately controlled evidence and no secrets. Q14 A stops affected workspace executions upon membership removal without stopping independently authorized work elsewhere; in-flight effects remain subject to reconciliation.
• Updated R14 and added R20-R23; amended schema discussion, decision statuses, interview record, candidate tests, and CURRENT. Proposed ad-hoc task fields are not presented as approved JSON Schema. No runtime behavior is changed.
• Link/anchor checks, embedded JSON, fences/whitespace, R1-R23/D1-D16, both prose checks, and git diff --check passed. No suites, dispatch, or publication. Preserved the unrelated proactive-skill log entry and untracked skill work.

Phase 27 interview round 4 (#53, 2026-09-06)

• Owner answered A to Q15-Q19. Services get an already-active result and choose any authorized connection explicitly. One controlling interface is allowed; authorized observers remain separate and control transfer is explicit.
• Fresh requests controlled replacement, not unsafe overlap. Unknown outcomes permit authorized non-destructive investigation and evidence-based recovery, never blind replay. Required audit failure blocks affected executions; other work continues only if its required recording still functions.
• Updated R21, added R24-R27, and revised both drafts and CURRENT. Added proposed connection metadata and preserved the distinction between user decisions and unverified adapter, stale-controller, recovery, and audit-storage mechanisms. Section 7.4 records this round; earlier answers and qualifications remain.
• Link/anchor checks, JSON examples, fences/whitespace, R1-R27/D1-D16, both prose checks, and git diff --check passed. Documentation only; no runtime tests, implementation, worker dispatch, maps, commit, push, or issue closure.

Phase 27 interview round 5 (#53, 2026-09-06)

• Owner answered Q20 B/Q21 B: shared behavior-affecting configuration fingerprint plus automatic non-blocking notices and on-demand checks. Exact field/hash encoding, source verification, and delivery mechanisms remain unimplemented.
• Q22 B limits default sharing to designated general preferences; personal and project information is supplied where authorized/relevant. No user profile files or runtime context dispatch were changed by this design ruling.
• Q23 A closes workspaces by retirement, safe stop, and record retention, not deletion. Q24 A preserves legacy sessions for explicit reviewed adoption; no automatic default-project placement or filename-derived membership.
• Updated R17, added R28-R30, and amended schema discussion, D6/D13/D16, interview section 7.5, candidate tests, and CURRENT. Added proposed retirement and adoption record requirements without claiming a migration API exists.
• Link/anchor checks, JSON examples, fences/whitespace, R1-R30/D1-D16, both prose checks, and git diff --check passed. No runtime tests, implementation, dispatch, migration, commit, push, or phase advancement.

Phase 27 interview round 6 (#53, 2026-09-06)

• Owner answered Q25 A: approved plan changes pause affected work for delegated reconciliation; unaffected work may continue. Already-issued effects need accounting, and changes beyond authority or safe resolution are escalated.
• Q26 B selects standard scope permission roles with registration-specific narrowing. Roles do not redefine agent identity/type or expand authority; exact role names and permission lists remain for reviewed schema design.
• Added R31/R32, schema sections 1.1/3.2, round-6 receipt and interview checkpoint; updated D3/D15, candidate tests, and CURRENT. Distinguished agreed behavior from proposed schemas and from non-blocking configuration mismatch notices.
• No additional owner-behavior question is currently ready. Await explicit shared-understanding confirmation; technical design branches remain open. Schema/fact-finding, mapping, gap analysis, and implementation need later authorization. The 26 answers do not themselves finish or approve the plan.
• Author link/anchor, two JSON examples, fences/whitespace, R1-R32/D1-D16, both prose checks, and git diff --check passed. No runtime tests, independent review, worker dispatch, migration, commit, push, or issue closure.

Phase 27 owner behavior confirmation (#53, 2026-09-06)

• Jason replied "That looks correct" to the post-Q26 behavior summary. Recorded shared understanding of intended behavior, not approval of exact schemas or a claim that all technical design branches are resolved.
• Updated the foundation review/phase status, appended schema section 7.8, and set CURRENT to await phase-2 authorization. No automatic phase advancement.
• Author structure/link/anchor/JSON/ID and prose checks plus git diff --check passed. No runtime tests, independent review, dispatch, implementation, migration, commit, push, or issue closure.

Phase 27 phase-2 start (#53, 2026-09-06)

• Jason answered yes to defining exact records, permissions, commands, and audit guarantees with read-only technical investigation. Phase 2 is authorized; implementation, mapping, migration, publication, and issue closure are not.
• Baseline remains 69d1bb3. System config validation and Docker availability checks passed. Existing image identity is sha256:a72aa79f98e54c3c974f5ad08b82e1643a4aa6eff259ac891b738120ba963ca1.
• Host Pi is 0.85.1, not the runtime's pinned 0.84.4. Do not use host SDK documentation as proof of runtime capabilities. Investigation will use the existing pinned image and source excerpts, without changing runtime policy.
• A tool-free sandbox worker will examine supplied source excerpts. Normal runner-generated inputs/evidence are expected; no source-editing grant, persistent conversation, build, activation, or credential inspection.

Phase 27 phase-2 first contract pass (#53, 2026-09-06)

• Tool-free source investigation completed as r-20260906T024609Z-68ee7f, exit 0, no persistent session, 1490 response words. Result hash: e81ac68a369a9315d827e6fc7117033f794ab7b214d2610ca07081a668045875. This is advisory source analysis, not independent gap review or acceptance.
• Extracted package 0.84.4 documentation from the existing pinned image using an unstarted container, then removed that container. Read README, RPC/JSON, session-format, security, and containerization docs completely. The candidate records hashes and image paths; host 0.85.1 docs were not used as runtime proof.
• New docs/plans/2026-09-06_foundation-phase2-contract.md proposes common types, a record catalog, permission/command rules, ordering, storage, and fingerprints. It is a partial technical draft, not complete JSON Schemas or an approved API.
• Qualified worker suggestions honestly. Its input labelled one adapter span 65-106 although the file ends at 96; actual supplied lines/citations end at 96. Other qualifications separate recorded stdout from trusted effects, scoped admission from session-specific locks, growing transcripts from immutable snapshots, and disabled extension discovery from explicit extension loading.
• Pinned docs establish documented events/exact sessions, not Mosaic integration or isolation. Q27 asks about command-level vs internal-effect audit coverage; recommendation A is a proposal only. CURRENT awaits that owner decision.
• Author document structure/links/JSON/ID checks, source-baseline equality, task validation/receipt correspondence, document hashes, three prose checks, and git diff --check passed. No proposed feature/security runtime tests, implementation, independent approval, mapping, migration, commit, push, release change, or issue closure. Normal task inputs/run evidence and generated runtime prompt are the only investigator-launch artifacts.

Phase 27 Q27 command-audit ruling (#53, 2026-09-06)

• Jason answered Q27 A. Added R33: initial managed commands require invocation evidence with actor/scope/assignment, enforced filesystem/network limits, start/end, outcome, and controlled evidence references. No promise of separate tracing for every internal file/network effect; no safety gate is waived.
• Updated all three drafts, appended interview section 7.10, and set CURRENT to command/event schema and permission/evidence drafting within phase 2.
• Author structure/link/anchor/JSON/ID checks, three prose checks, and git diff --check passed. No runtime tests, new worker dispatch, implementation, mapping, independent approval, commit, push, or phase advancement.

Phase 27 proactive phase-2 continuation (#53, 2026-09-06)

• Jason requested ms-proactive-agent. Loaded it and ms-goal; use CURRENT and the existing phase-2 plan rather than a competing goal directory or /goal API.
• Continuing assignment is issue-53-phase2, authored by darkwing in the explicit repository working directory, session 01a06e48-0718-71f2-a889-c263c4800fb9. This is a single-writer planning assignment, not an enforced runtime claim or registered workspace. Owner completion and later phase gates remain binding.
• Next work: formal command/event candidate with negative fixtures, then concrete permission/record and lifecycle details. No skill installation/activation, runtime implementation, mapping, migration, publication, or new external sends. Aggregate usage is unavailable; no explicit numeric budget was supplied.

Phase 27 reboot recovery and owner hold (#53, 2026-09-06)

• Jason reported an unexpected reboot and requested realignment/readiness. Treated this as a hold on drafting and dispatch; no automatic proactive resume.
• HEAD 69d1bb3 and dirty planning/skill work survived. Preserved all five new foundation-v1-candidate artifacts. Command schema/fixtures/checker hashes match their pre-reboot values; 38 shape checks and five deliberately shape-valid forgeries pass. These are author checks, not security enforcement.
• Record schema/fixtures are unfinished. Recovery diagnostics found 13 expected result mismatches: 11 positive records and two path cases. The first positive fixture lacks schemaVersion/id/revision/createdAt/authorizationRef. The generic fixture construction needs repair; negative results may be masking missing positive structure. Unicode byte limits and bidi controls also need explicit checks. No fixes were made under the readiness request.
• Config validates and Docker responds. Image identity and prior research run hash match the recorded evidence; no Mosaic worker container was running. Pinned temporary docs remain available. No credential contents inspected.
• CURRENT records paused state, exact next repair, manual owner resume, ownership, and unavailable aggregate usage. No pending external action is known; no automatic wake or unattended continuation is claimed.

Phase 27 explicit goal resumption (#53, 2026-09-06)

• Jason supplied the phase-2 goal, then repeated it with --wait-timeout 60. Adopted as explicit resumption of issue-53-phase2, not a second goal or a new budget. The existing single-writer scope and owner acceptance gates remain.
• No goal runtime API is exposed to this session. Use CURRENT and the phase-2 candidate as file-based records. Preserve the requested timeout value 60; flag units/runtime semantics and automatic expiration are not verified. No timer, unattended follow-up, or auto-approval is claimed.
• Resuming with the incomplete record fixtures and missing byte/control checks. Later work remains documentation/schema design and read-only investigation; no runtime implementation, mapping, migration, commit, or push.

Phase 27 resumed goal checkpoints and Q28 wait (#53, 2026-09-06)

• Repaired the interrupted fixture work rather than replacing the goal. The generator had dropped common fields when an object also had allOf. Rebuilt positive examples with both constraints and preserved original negative mutations. First repair attempt hit a nullable-target delta error before fixture publication; corrected that case and reran, with no external effect.
• Integrated explicit calendar, UTF-8 byte, Unicode control/format/surrogate, and path-component checks. Removed an unintended space-before-slash rejection. The checker now covers command and record schemas, paths, shared-definition consistency, and restricted-domain fingerprint vectors.
• Author checks pass: 38 command cases, 38 record cases, 16 path cases, seven hash vectors, plus five intentionally shape-valid forgeries. The forgeries require trusted runtime checks; none of these results proves enforcement.
• Added the schema-package README with exact permission bundle proposals, reference/publication semantics, lifecycle guards, storage/commit/recovery traces, fingerprint projection, #50 compatibility boundary, and a proposed small metadata-only implementation increment for later chartering.
• Re-read #50 without credential access or registry changes. Preserved dynamic executable-name harness IDs, central profiles/accounts, reviewed role policy, stable execution-input reconciliation, and the unresolved OAuth refresh gate.
• CURRENT and phase-2 section 11 track the explicitly resumed goal and tasks. Independent ready design/check tasks reached their author checkpoints. Q28 requires owner direction on Mosaic-controlled vs required native Pi terminal experience before dependent execution/control/input/artifact contracts. Goal is waiting, not satisfied; manual answer is the resumption condition.
• Requested --wait-timeout 60 retained, not represented as an armed timer or automatic approval. No exposed goal runtime API or automatic wake verified.
• Document links/anchors/JSON/ID checks, four prose checks, unchanged inspected runtime-source comparison, and git diff --check pass. No runtime implementation, security feature tests, independent approval, mapping, migration, commit, push, release change, issue closure, or worker dispatch during this continuation.

Phase 27 Q28 ruling and resumed contract drafting (#53, 2026-09-06)

• Jason answered Q28 A: a Mosaic-controlled terminal is acceptable; Pi remains the engine and approved operations are mediated for consistent future clients. This resumes P2-5 within the existing goal, not implementation or mapping.
• Completing planning-only execution/control/message and command-artifact shapes, checks, and the owner-review package. No native interface replacement is installed by this decision, and no safety requirement is waived.

Phase 28 NG project-local goal footer setup (#54, 2026-09-06)

• Jason authorized native Pi launches from this repository as the NG test case, prohibited symlinks, and protected the live ~/.mosaic goal extension used by other agents. Docker integration is excluded.
• Opened #54 and recorded the requirements, state/UI design, ownership, verification, rollback, and user-acceptance gates in docs/plans/2026-09-06_ng-goal-footer-dev.md. Added validated implementation and independent-review task declarations under tasks/.
• Copied the goal extension and its imported mosaic-core library as ordinary files under .pi/extensions/. .pi/SOURCE-SNAPSHOT.json records tree hashes. No copied path is a symlink and no live source file was changed.
• Correction during setup: copying all of mosaic-core made its own index.ts project-discoverable and brought tests coupled to source-brain manifests. Removed that separate entry point and tests from the local runtime copy. The goal extension retains the required mosaic-core/lib/ imports. Exactly one project extension entry point remains.
• Native Pi RPC discovery with --approve, an isolated temporary PI_CODING_AGENT_DIR, no session, and no tools returned exactly one /goal command from <cwd>/.pi/extensions/goal/index.ts; no extension error appeared.
• Focused baseline tests pass 55/55. The first broad copied goal-suite run had two failures because source tests expect absent skills-local/ files. These failures are recorded, not relabeled green. Full source-brain mosaic-core tests are outside this local dependency-copy baseline.
• Setup only. Footer implementation, exact-candidate review, full checks, native TUI inspection, Jason acceptance, commit, push, and issue closure remain open.

Phase 28 implementation and native verification (#54, 2026-09-06)

• Continued after the setup-only checkpoint at Jason's direction. The current native session authored the local footer/full recall change; the declared container implementation and review tasks were not dispatched.
• .pi/extensions/goal/ now uses a themed footer status and clears stale widget content. Bare /goal and Alt+G show the entire goal. Complete retains recall text and bounded evidence without an active loop. Blocked supports explicit resume. State stays in project-local, incarnation-fenced .pi/state/goal/.
• .pi/goal-dev.sh loads only this local extension and stores new sessions under .pi/state/sessions/. Native provider auth is reused, not copied. Docker and the live fleet extension are unchanged; live source hashes match the baseline.
• All 67 goal tests pass. Local contract fixtures resolve the source-context failures recorded at setup. Repository suites pass: config 24, task 90, release 14, conductor 17, auth 15.
• Real native Pi 0.85.1 PTY checks pass for Paused/Complete at 120 columns and Blocked/Waiting at 45, including full bare-command and Alt+G recall and one NO_COLOR case. Initial driver failures involved RPC framing and expecting an unchanged status to redraw; these were corrected and the full check rerun.
• Independent read-only native reviewer returned APPROVE. A prior attempt timed out without output and supplied no verdict. Reviewed manifest SHA-256 is 10e949db54149c6bed945fab086ad7a91461683ee5661c920f9ee6bddcf04aae. Evidence and limitations are in .pi/evidence/README.md.
• No TypeScript compiler is installed, so static checking was not run. Native loading and TypeScript execution passed. Jason's hands-on acceptance remains open. No commit, push, issue closure, or production delivery is claimed.
• Intent: post this checkpoint to issue #54, leaving it open for manual user testing. The phase-2 CURRENT record and unrelated dirty changes are preserved.
• Issue #54 checkpoint posted successfully, HTTP 201, comment 25830.

Phase 28 user acceptance, 2026-09-06 06:05 UTC

• Jason replied "It works" to the local native Pi test handoff. Recorded NG-GF-5 acceptance in the issue-54 plan. No additional test coverage is inferred.
• No code changes, commit, push, Docker integration, or live fleet changes. Static checking remains unperformed; repository delivery disposition remains open.

Phase 29 canonical extension source and replacement layout (#55, 2026-09-06)

• Inspected the legacy main tree plus targeted installer, release verifier, publish pipeline, npm helper, and representative package/plugin manifests through Gitea. The useful pattern separates canonical source, build output, installation, and publication. The legacy framework bundle and permissive npmjs helper are not copied into stack-v2.
• Moved the accepted goal source and tests into extensions/goal/, with its imported support modules in extensions/mosaic-core/lib/. The latter has no entrypoint. .pi/extensions/ is now generated and ignored.
• Added a staged, hash-verified development sync, canonical launcher, native test, and 18 packaging controls. The sync rejects full-tree drift, symlinks, nested entrypoints, and concurrent writers; interrupted replacements recover through a transaction marker and backup.
• Initial independent review requested fixes for extra destination entries, nested entrypoints, replacement interruption, stale locks, and missing tests. All were corrected. Follow-up independent review returned APPROVE.
• Final checks pass: 67 goal tests, 18 package controls, and native PTY checks for Waiting, Paused, Blocked, Complete, full command/shortcut recall, narrow width, and NO_COLOR. Canonical manifest SHA-256 is c2096c00fb505a53482ff6a94a0f293dbc1ca2058d7a1996961601af80c29946.
• Opened #55 to track phased monorepo ownership and replacement. Intent: post the verified first-increment result to #55 and the source relocation to #54. No commit, push, npm publication, Docker integration, or live fleet change.
• Gitea receipts: #55 comment 25831; #54 comment 25832 (HTTP 201).
• Verification correction: the first canonical manifest check ran from /, so all relative paths failed. Reran from the repository root; all 37 files passed. This was a check invocation error, not source drift.

Phase 27 owner-review candidate after Q28 (#53, 2026-09-06 06:33 UTC)

• Recorded Jason's Q28 A as R34 and continued the existing goal. The owner clarified the earlier /goal deployment mix-up; no timer or extension was configured by this phase-2 session. Separate #54 extension and source-layout work appeared concurrently and was left untouched. Shared log entries preserved.
• Added mediated runtime/control/input/response shapes, exact operation parameters, launch/history/config bindings, command profiles/limits, messages, decision and process evidence. Public requests cannot submit trusted runtime records.
• Repaired a conditional configuration fixture baseline after its first two mismatches. Reconciled command-result evidence by referencing the existing outcome event instead of creating competing outcome/signal definitions.
• Author checks pass: 38 command, 38 record, 16 path, 7 restricted-domain hash, 155 runtime/control/artifact and 35 synthetic rule-model cases. Ten deliberately shape-valid forgeries remain shape-valid and require real trusted rejection. Models assume synthetic facts: no actual authentication, sandbox, stopping or durable-writer enforcement is established.
• REVIEW.md reconciles the actual D1-D16 questions, identifies proof gates and requests Jason's specific phase-2 verdict. P2-5/P2-6 reached author checkpoints; P2-7 waits manually. Goal is not satisfied and issue #53 is not closed.
• Refined first-increment recommendation to an offline scope/permission inspector with a coherent synthetic bundle and no live grants. Persistent state also needs publisher/retention protections and closure of legacy broad-mount bypasses.
• Added explicit adoption rollback and preauthorized fail-safe stopping rules; neither introduces a history rewrite or an unaudited exploratory fallback.
• Six-document structure/link/example and R1-R34/D1-D16 checks pass. Prose checks pass after correcting one flagged word and review-table punctuation. git diff --check passes; inspected runtime sources still match 69d1bb3.
• No foundation runtime implementation, worker dispatch, credential operation, mapping, migration, commit, push, release change or independent verdict by this session. HEAD observed: 69d1bb3aa4. Other work is not this contract's proof.

Candidate identity at this author checkpoint (not an adoption signature):

27fd60f68d30ddc8c1a0cef96714308b8e526f60a17852f7ec21957c1870ec81  docs/plans/foundation-v1-candidate/README.md
967baed7ec4632d993a197b829a1cacbf637192f8351399c54ad502645b88a49  docs/plans/foundation-v1-candidate/REVIEW.md
b1a2b4d0df88ba6f7b197252807f3a3925ffff9375f4e70d4ff28593337c3438  docs/plans/foundation-v1-candidate/RUNTIME.md
82564a7d3200afcdda0850a9454cac6e6cd6a76687d2162c13cf214d7eac4607  docs/plans/foundation-v1-candidate/check.py
7806e42cd792935ddba1c8bcac853f049d79eab227fb7191fe622685e699203a  docs/plans/foundation-v1-candidate/command-events.fixtures.json
19e9e50359790ec9a4de5b8c817026ac075e254968de1411867222646743d31f  docs/plans/foundation-v1-candidate/command-events.schema.json
cbfcb88531838c8c3dd290257e5d9a657e552bb7dd0f67102b49a921a249da45  docs/plans/foundation-v1-candidate/fingerprint-vectors.json
d433d06da5cd38baf9e51c8857244ee70375db3b68e02a5325a6d1c2cc47da85  docs/plans/foundation-v1-candidate/records.fixtures.json
05774aaf6943cb69c113e39ff1c29676a2a230ca7bf665c50dbcaa8049672af6  docs/plans/foundation-v1-candidate/records.schema.json
02a611925923b2592d9e0e67741a542e6c2e8bec06d69ae5700f25c51d720a7a  docs/plans/foundation-v1-candidate/runtime.fixtures.json
74deeb4cd6d87ff9306ed088b9641e51f9c41db71589b5364424908842ee51bc  docs/plans/foundation-v1-candidate/runtime.schema.json
93d16f38738bb0610d5250ee54c271934e4f2201660becaa72982363d0711fda  docs/plans/foundation-v1-candidate/semantic-model.fixtures.json
c89c3bb19624826c1a84658595c71694a1fd371b9155ef50ffa4c265c099daa8  docs/plans/foundation-v1-candidate/semantic-model.py
ce58408289fceea4b99d8a77c69523a1c04e683f5084f31c7c4199ae0b9934f3  docs/plans/2026-09-06_agent-project-workspace-foundation.md
6e854e83f2a2b26cb93473611b0a47264fb64dd08b6c272c6b18257238915c82  docs/plans/2026-09-06_workspace-schema-and-audit.md
8858537bbb80ec7ec41301b3c5e8c90ccad24b9df761e132a66f29735b7ad925  docs/plans/2026-09-06_foundation-phase2-contract.md
10f1cad570e82243f90c4272027984e74d08b4de25b07a2b5d1ef9bff2a0c4c7  docs/plans/CURRENT.md

Phase 27 owner acceptance (#53 phase 2, 2026-09-06 06:52 UTC)

Jason explicitly said "accept phase 2" after clarification that acceptance is of the planning baseline, not technical/security certification or authority to implement. P2-7 and goal issue-53-phase2 are satisfied. The prior 06:33 candidate identity remains the technical review checkpoint; only acceptance/status records changed here. Mapping, independent review, implementation, commit/push and issue closure remain separately gated. No next-phase work or runtime change performed.

Foundation mapping goal: initial reconciliation

Active operator goal authorizes the technical map, not implementation. Created docs/plans/2026-09-06_foundation-technical-map.md with measured directory alignment and outstanding code-trace gates. MS55-DW-1 delivery was initially uncertain due to the known tmux bug; Dewey then explicitly acknowledged it. No resend performed. Boundary agreement accepted; Dewey still awaits owner authorization in his session.

Foundation mapping: initial code trace

Read launcher, Pi adapter, role validator/resolver, mission/tool intersection and writeOnce/result paths. Added nine source-linked reuse/change classifications, component boundaries and dependency implications to the technical map. Verified three source hashes against live bytes; no runtime files edited. Next: trace mounts, context loading and lifecycle/retention, then reconcile package placement.

Foundation mapping: context/isolation/retention trace

Inspected Compose, both runtime context/dispatch scripts, reset and retry/prune functions without invoking destructive operations. Recorded seven trace rows, five checked source identities and proposed ownership boundaries. Identified shared prompt/staging, blanket user-context injection, broad mounts, reset comment drift, unguarded replay, and deletion-before-receipt uncertainty. No runtime fixes or migrations made. Next: complete requirement coverage and reconcile package placement with Dewey for the owner/independent-review handoff.

Foundation mapping: requirement and package reconciliation

Cross-checked R1-R34 and added complete responsibility coverage. Read ROADMAP M20 owner sequencing and Dewey #55 reconciliation: packages/* is the succession target; extensions/** is current source, not a replacement decision. Added an eight-row component/ownership matrix. Formal commit-pinned review remains gated by uncommitted accepted plans/#55 source; no commit authorization inferred.

Foundation mapping: config/auth and inspector boundary

Inspected config validator/bootstrap, auth reporting source and account/CLI selection without reading credentials or invoking auth/config operations. Added four trace rows, source hashes and seven explicit inspector acceptance cases. Sole-config override and error-diagnostic caveats remain review findings, not authority changes. Baseline pinning and Dewey packaging reconciliation remain open; no runtime implementation or package-manager change.

Foundation map handoff (2026-09-06 07:16 UTC)

Prepared MAP-HANDOFF-1 with source hashes, full requirement coverage, ownership questions, baseline options and a non-author review checklist. Nine inspected legacy files match 69d1bb3; handoff structure and diff checks pass. MS55-DW-2 sent once and delivery confirmed; response pending, follow-up darkwing. Jason's separate-environment retasking report was added only as an owner-reported negative acceptance scenario. No investigation or intervention there occurred. Formal baseline publication requires owner authorization; no commit/push done.

Phase 30 package-boundary reconciliation for MAP-HANDOFF-1 (2026-09-06)

• Jason authorized a bounded investigation and reply to darkwing request MS55-DW-2. No implementation, migration, commit, review verdict, or live ~/.mosaic investigation was requested or performed.
• Read both darkwing mapping drafts without editing them. All 27 handoff inventory rows match current bytes. The nine legacy runtime sources match commit 69d1bb3 byte-for-byte. The foundation checker passes 38 command shapes, 38 record shapes, 16 paths, 7 hashes, 155 runtime/artifact shapes, and 35 semantic-model cases; this remains schema/model evidence, not runtime enforcement.
• Reconciliation position for the direct reply: retain extensions/** as current canonical source pending an explicit M20 packaging charter; keep mosaic-core/lib an internal support dependency rather than inventing a package. After M20, src/ should contain only unavoidable image/bootstrap shims that invoke packages/agent; policy, context, session and adapter behavior must not have duplicate owners.
• Package-matrix qualification: packages/mosaic owns presentation/routing, packages/config owns pure validation and resolution, packages/agent owns runtime coordination through separated privileged interfaces, and packages/auth owns auth code but never packaged secrets. Source package ownership is not a process trust boundary.
• Baseline recommendation: only with explicit commit authority, create separate path-scoped commits for darkwing's accepted planning and Dewey's #54/#55 source, then recompute the map against that integrated baseline and commit mapping artifacts separately. Never blanket-stage the dirty tree. Push remains separate. Without commit authority, retain the hash inventory as preparatory only and do not call it a formal Archify review baseline.
• Intent: send this reconciliation directly to darkwing tagged MS55-DW-2. Follow-up owner remains darkwing; return event is its recorded incorporation or correction.
• MS55-DW-2 direct reply attempt returned rc=2 after three unconfirmed submissions. Delivery is unknown; no resend was attempted. The exact body is /tmp/ms55-dw2-reply.txt for local reconciliation only; durable findings are above.

Foundation mapping reconciliation receipt (2026-09-06 07:18 UTC)

MS55-DW-2 received: Dewey agrees with package ownership, qualifying src/ as bootstrap-only shims after M20 and rejecting duplicate adapter/context logic. Package ownership is not a process privilege boundary. He corroborates the 27 input hashes and nine legacy files at 07:16 UTC; this is not independent review. Handoff records the reply without changing its measured source inventory. Only baseline authorization remains blocked; no commit/push or review dispatch.

Foundation baseline commit (2026-09-06 07:24 UTC)

Jason answered yes to scoped local baseline commits. All five repository suites and the foundation checker pass. Committed only 16 accepted foundation planning files as 44f257cb06484feda3412d9382e3587393796353; staged/committed paths verified. No unrelated files or shared logs staged, no push. MS55-DW-3 requests Dewey's separate baseline and index release; single send returned unconfirmed delivery. No blind resend or concurrent index use; integrated mapping commit waits.

Phase 29 local baseline commit receipt (#54/#55, 2026-09-06)

• Darkwing relayed Jason's explicit authorization for the separately scoped local #54/#55 baseline commit after required tests, with no push, source moves, or foundation implementation. Verified foundation commit 44f257cb as parent and an empty index before staging.
• Corrected stale pre-migration wording in the #54 plan, goal README, and two undispatched task declarations. These corrections point development at canonical extensions/ source and generated .pi/extensions/; behavior did not change.
• The first sync correctly refused because local generated state carried the older 29-file manifest format. Verified every old file against that manifest, found no symlinks or extras, and measured one canonical delta: the README launch command. Removed only the generated installation/manifest and regenerated them; no source or runtime state was removed.
• Independent baseline review found two issues before approval: the native test did not bootstrap a fresh generated installation, and the persistent sync lock was not ignored. Added test startup sync and narrowed .pi/.gitignore accordingly. A byte-exact contract fixture contains intentional trailing whitespace; added a fixture-local Git attribute rather than changing its pinned bbea48a4 bytes. Final independent review returned APPROVE.
• Pre-commit evidence: both tasks validate; 67 goal tests; 18 packaging controls; native fresh-install discovery plus Paused, Blocked, Complete, Waiting, /goal, Alt+G and NO_COLOR checks; repository suites config 24, task 90, release 14, conductor 17, auth 15; Python/shell syntax, no symlinks, generated equality, prose checks and staged diff checks passed.
• Created local commit d4696d09eb, feat(extensions): establish canonical goal source (#54, #55), with parent 44f257cb06 and exactly 43 authorized paths. No CURRENT, shared logs, darkwing maps/handoff, unrelated skills, or phase-2 foundation files entered the commit. Index is empty. No push.
• Verification corrections: the first post-commit path allowlist regex rejected all extension descendants because its pattern matched only the directory name; rerun with extensions/.* passed. A subsequent generated-install check noticed the newly committed fixture attribute had not yet been synchronized; normal fail-closed sync updated the ignored installation and the check then passed.
• Intent: return MS55-DW-3 directly to darkwing with commit, path locator, tests, and released-index evidence. Follow-up owner remains darkwing.
• MS55-DW-3 direct return attempted once; agent-send returned rc=2 after three unconfirmed submissions. Delivery is unknown, so no blind resend was attempted.

Integrated foundation mapping baseline (2026-09-06 07:40 UTC)

Verified Dewey's d4696d09eb parent, exact 43-path scope and empty index. Jason's conditional resumption instruction applied. Rebuilt MAP-HANDOFF-2 against that source/plan baseline, checked 69 input hashes and R1-R34 coverage, and adopted Dewey's package/shim/privilege qualifications. Citation-bound checks exposed two overlong ranges (agent.sh and reset.sh); corrected them to actual file ends before final verification. All five repository suites and foundation checks passed again. Committed only technical map, handoff and CURRENT as 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae; committed path set and show --check verified. Index empty/released. Shared logs and unrelated dirty work remain unstaged. No push, source move, foundation implementation, issue closure or independent review dispatch. Owner-reviewable map and independently reviewable handoff prepared; actual non-author review remains separately authorized. Sent Dewey a non-actionable closeout/index-release notice once; transport returned unconfirmed delivery. No reply obligation or retry; core handoff receipt is local.

Phase 31 quiet untimed goal waits, 2026-09-06

• Jason authorized fixing the short-run loop seen in Joe. Canonical extension only; live fleet deployment/reload is separate. Baseline 7345f33. Plan: docs/plans/2026-09-06_goal-quiet-waits.md. Intent: open a defect issue and notify darkwing that its pinned extension baseline will gain a separately reviewed fix.

Filbert written-map review requested (2026-09-06 07:52 UTC)

Jason authorized Filbert review. FM-FILBERT-1 pins mapping 7345f33 and source/plan d4696d09, requests non-author/conflict admission and evidence-backed written-map verdict, explicitly excludes renderer/runtime approval and live fleet work. Single send returned unconfirmed delivery (exit 2); no retry or pane poll. No map changes, commit, push or implementation. Await direct reply or steering.

• 2026-09-06T08:00:03.781051+00:00: #56 canonical implementation independently approved; 71 goal tests, 18 packaging controls, native timed/untimed fixtures and repository suites 24/90/14/17/15 green. Deployment inspection corrected the symlink-only assumption: 41 agent and 14 role settings still reference legacy fleet/extensions/goal, including Joe. Shared root and Velma are NG copies; preserve legacy state/UI through narrow backport. Staged legacy 67 tests pass after supplying the existing fixture files at its expected relative staging path; initial missing-fixture failures retained in evidence. Active operator goal authorizes local-first ~/.mosaic deployment. Independent backport/deployment review APPROVE; preparing exact three-target on-disk deployment, no session reload or state/settings/symlink edits. Pins 08aec1a0ff7c70ce2a5e1b6831c8ec395a94a2bafe9ca1be9c7110a6b913935c; script 248ec09b534f067d296fc70f2ce50b11810c9927321a58205e860eb19b39684a.

Admission clarification (2026-09-06 08:00 UTC)

Filbert replied FM-FILBERT-1, resolving the original delivery uncertainty. He verified candidate hashes, all 69 baseline inputs and foundation parent, but stopped before substantive review/tests because assignment compatibility was unestablished. His NOT APPROVED means incomplete review, not technical rejection. He identified d4696d09's historical CURRENT.md as the uncertainty, not evidence of an actual current competing personal assignment.

Sent FM-FILBERT-1-C1 once: source baseline is not current assignment authority; 7345f33 CURRENT.md:8-25 names the mapping review gate, subsequently authorized by Jason's explicit request for Filbert. Asked him to establish compatibility from his own current instructions, or return the concrete conflict/uncertainty for Jason to resolve. No permission to cancel, inspect other agents, or reprioritize. Clarification delivery unconfirmed (exit 2); no retry. Candidate remains unchanged. Await FM-FILBERT-1-C1 admission/blocker; darkwing owns follow-up.

• 2026-09-06T08:04:49.508743+00:00: #56 deployed the independently reviewed scheduling fix to ~/.mosaic/.pi/extensions/goal, Velma's independent copy, and the still-configured legacy fleet/extensions/goal (narrow backport preserving its store/UI). Pins and three verified rollback trees: ~/.mosaic/.pi/goal-backups/goal56-60590600f2c9420a881f1f4f0a5fc5cf. Fifteen role links plus Topher resolve to patched shared code. Six actual installed-entrypoint native RPC canaries (timed/untimed per target) passed with zero checks/model starts; isolated credentials-free environments and owned fixtures cleaned. No existing session reload/resume, settings/link changes, private goal writes, commit or push. Canonical patch d9caeb0c87e074196421a010e8a2de0968b3bb922010fa864ca2ec1f1902ef6b. Ready for owner reload/acceptance, not yet user-approved; #56 open. Full evidence .pi/evidence/goal56/README.md.

FM-FILBERT-1 completed review (2026-09-06 08:06 UTC)

Filbert confirmed non-authorship and no competing current assignment, withdrew the historical-CURRENT blocker and returned APPROVED for the exact written map at 7345f33 against d4696d09. Verified verdict SHA-256 6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3 and both candidate hashes against committed/current map bytes. No blocking defect; five informational findings/limits, 20 source-row and R1-R34 semantic dispositions. Independent checks reported: 69 hashes, nine legacy identities, foundation checker, config 24/24, syntax and mapping whitespace. Other full runtime/native/render suites were explicitly not run by this reviewer. Earlier incomplete NOT APPROVED is superseded, not rewritten. Owner acceptance and implementation remain gated. Sent one non-actionable closeout; delivery unconfirmed, no reply obligation or retry. Exact verdict remains unchanged. No commit, push or implementation.

Owner acceptance of reviewed technical map (2026-09-06 08:07 UTC)

Jason answered "yes" to accepting the independently reviewed written map as the technical planning baseline. Accepted mapping: 7345f330fc6bfae5aa1d896c78cfb7cbe62efbae; source/plan baseline: d4696d09eb. Verified map/handoff and Filbert verdict identities unchanged. Verdict SHA-256: 6b08c6fac0718d3db527cf9ffbfab49407e7b289d09782f5d1d0e26493eaabb3. Acceptance covers planning, not runtime/security/render proof, implementation, migration, push or issue closure. Recommended next step: separately authorized charter for the bounded synthetic inspector. No new phase started or commit made.

Synthetic inspector charter planning begins (2026-09-06 08:11 UTC)

Jason authorized continued bounded work with Filbert and Rocko. Draft 1 records explicit no-live-effect scope, nine acceptance groups, unresolved concrete input/ implementation decisions and separated author/reviewer gates under #53. Inspected author semantic model and schema definition inventory; model evaluates assumed facts, not a real graph resolver. Do not promote it to runtime authorization. FI-ROCKO-1 feasibility request delivered once to =rocko on mosaic-fleet; result pending. FI-FILBERT-1 availability-only request unconfirmed; no retry. No source implementation, source moves, commit/push, credential or live environment access. Draft structure/acceptance coverage checks pass; independent review awaits freeze.

Inspector feasibility reconciliation (2026-09-06 08:25 UTC)

Rocko admitted the bounded contribution without displacing his held Archify work. Verified original note SHA-256 92fa7b3de2591ba24fb184ed8edbabedd30c54498fdaf101649e36aaebabe9b9 and its charter input hash. Read full 466-line note. Direct committed-schema checks found missing scope-role ceiling handling, required workspace-policy fallback, reference/artifact and serialization mismatches, nonexistent FINDINGS citation, and other unsupported/underspecified claims. Recorded nine correction groups in docs/plans/reviews/2026-09-06_foundation-inspector-rocko-corrections.md. FI-ROCKO-2 delivered once (exit 0), requesting a separate corrected note; original evidence preserved. No charter freeze, independent review or implementation yet. Filbert remains available and has not co-authored the draft.

Resume duplicate goal discovery repair — 2026-09-06

Jason requested a fix after launch failed. Native combined discovery reproduced the conflict; a global exclusion experiment failed because project exclusions are separately scoped. Neither experiment modified live settings. Preparing a Resume-only shared-launcher selection repair with explicit legacy goal, wrapper-guard and existing unslop hook, preserving state and credentials. Plan docs/plans/2026-09-06_resume-goal-discovery.md.

• 2026-09-06 08:29:51 UTC: #57 independently APPROVED and deployed Resume-only explicit selection in shared launcher. Hash 9f5c987bb745b8edb6c2093f0dc4990f48229c0e429fbf388feda040cb2bfacb; verified backup ~/.mosaic/.pi/goal-backups/goal57-45d15b9891ff4ef392961615abefc8e7/launch-seat.sh. Native original-conflict control, repaired native loader, actual no-provider RPC CLI, nine selector controls, shell syntax and 71 goal tests pass. Legacy state path, wrapper interception and explicit unslop retained; other seat arguments unchanged. No existing sessions, credentials, settings, private states or shims edited. Ready for Resume retry, not fleet-wide consolidation or user acceptance. Plan docs/plans/2026-09-06_resume-goal-discovery.md.

• #57 correction, 2026-09-06: Jason rejected the legacy selection and explicitly requested shared NG. Prior technical review did not establish correct product selection. Prepared Resume-only path correction to ~/.mosaic/.pi/extensions/goal; no state migration. Independent correction review APPROVE; native combined selection loads one shared goal with Alt+G, wrapper interception and unslop. Canonical native footer/recall and 71 tests pass; installed NG runtime matches that source. Applying with a verified backup.

• 2026-09-06 08:34 UTC: #57 corrected selection deployed and post-install verified. Resume selects shared NG goal, not legacy; wrapper/unslop retained. Launcher dd9e5ece5f1a86cc286027668560198bb7a44d2ab891f7b1ab4f89d7379ca0e6; backup ~/.mosaic/.pi/goal-backups/goal57-shared-4d95a698f4bb4544a0cb90aed5e887a3/launch-seat.sh. No session interruption/state migration. Existing legacy-selected process requires a safe normal relaunch, not just /reload. Evidence .pi/evidence/goal57-shared/.

Frozen inspector charter candidate 2 (2026-09-06 08:42 UTC)

Rocko r2 received; verified f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1 and preserved r1. All nine correction groups accepted in r2. Recomputed V1-V3 digests; measured Node v26.8.1 constants (NOFOLLOW/NONBLOCK present, CLOEXEC absent). Integrated explicit overrides for requester assignment/execution limits in both scopes, closed safe error output, historical-reference admission, ambiguity, numeric/profile semantics and unsupported-operation exit 2. Candidate charter SHA-256 cbd0487a2ab699722924e2f91367bf556facb015752ce3b5a76ad474977df791. Source schema/checker identities pinned; no runtime code or tests claimed. FI-FILBERT-2 requested exact-hash independent written-charter review; one send returned unconfirmed delivery. No retry. Rocko closeout delivered (exit 0), no further assignment. Filbert review pending; owner build authority still gated.

Fleet shared NG goal ownership, 2026-09-06

Jason accepted Resume footer/recall, authorized fleet correction and scoped suite-gated commits. Inventory found 55 settings paths resolving to 24 files, shared discovery links, and two remaining ordinary goal copies. Preparing compatibility aliases and removal of Resume-only override; preserve settings, role guards, state and running sessions. Plan docs/plans/2026-09-06_fleet-goal-ownership.md.

Inspector charter candidate 3 resubmitted (2026-09-06 08:58 UTC)

Verified Filbert's FI-FILBERT-2 NOT APPROVED verdict hash 2f3858c81d32b1305cb7fd49b0d8860153d8d592ac62df2c45dd25d30af7a722. Preserved exact candidate 2 in reviews/ and left original verdict unchanged. Proposed fixes address registration delegation and mock issuer bounds, consulted work-scope restrictions, withdrawal of hidden-chain detection, explicit graph sub-order and expanded differential boundaries. No accepted record schema changed. Candidate 3 hash: 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6. Verified five finding dispositions and current schema field distinctions; this is author reconciliation, not independent approval. FI-FILBERT-3 sent once, exit 2 unconfirmed; no retry. Re-review pending; no code, deps, commit, push or live action.

Inspector charter independently approved (2026-09-06 09:03 UTC)

FI-FILBERT-3 APPROVED received and full verdict read. Verified verdict SHA-256 15f3d04cb74a7296be6a1a26f2c0907b9dd2b08fdd1eb0ef51c95c7a52ff0399, exact charter 19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6 and incorporated r2 f2f47fcfe22dca79f10f885b83d87a2f846fdb560425a4e20705c40ce4a123e1. All five prior findings closed at specification level; four informational limits retained. Reviewer reports 14 in-memory schema probes, hash checks and Node constants measurements, not CLI/runtime/security or owner-demo acceptance. Closeout delivered to Filbert (exit 0), no further work requested. Candidate and prior verdicts unchanged. Await Jason's build authorization. No code, commit, push or live changes; shared index left with Dewey per MS58-DW-1.

• 2026-09-06 09:02 UTC: #58 corrected independent review APPROVE after removing launch.env content reads; metadata-only/no-read controls added. Reviewed plan 43eb7821a484796850e5e9352f51fe8a6cffb2fb9084769070f449b529a47220 deployed with atomic source aliases and original launcher restoration. Backup ~/.mosaic/.pi/goal-backups/goal58-5baaf9ff598644c6ae364b297e3c982a. All 55 actual settings/discovery combinations load exactly one shared NG goal with wrapper/core interception and unslop. Seventeen transaction controls, six native alias cases, 71 goal tests, 18 package controls, native UI/waits, and five repository suites pass. State paths remain alias-relative as explicitly fixture-verified; no migration/private-state reads or automatic restarts. Jason accepted Resume UX; quiet-wait feedback remains preliminary. Scoped 14-file commit excludes these mixed-owner logs, CURRENT, foundation, skills and tasks. MS58-DW-1 notice rc=2 unconfirmed, no resend.

• 2026-09-06 09:10 UTC: local commit 9a5fbdbda7, exactly 14 owned paths and all hashes verified. Post-commit goal/native/package/transaction and five repository suites green; deployed pins still match. #57 closed after explicit Resume acceptance. #58 fleet user test and #56 final quiet-wait acceptance remain open. Index empty, no push. Mixed-owner logs remain unstaged. Final checkpoint .pi/evidence/goal58/README.md.

Inspector build authorized (2026-09-06 17:00 UTC)

Jason explicitly approved Rocko building the reviewed offline inspector, Filbert reviewing code independently, then an owner demo. Verified charter identity and that the implementation paths are absent/unclaimed. Prepared FI-ROCKO-3 with exact path allowlist, mandatory oracle/tests, no staging/commit/push, and no live effects. Implementation deliverable remains review-gated; A9 is Jason's later acceptance.

Inspector build dispatch and verification preparation (2026-09-06 17:02 UTC)

FI-ROCKO-3 delivered to Rocko; admission/build pending. FI-FILBERT-4 availability request unconfirmed, not retried. Prepared A1–A8 code-review evidence checklist and A9 owner-demo sequence without inventing an unimplemented CLI interface. No coordinator code edits, staging, commit or live-state activity.

FI-ROCKO-3 admission received (2026-09-06 17:05 UTC)

Rocko reports COMPATIBLE, no blocker; held Archify C1 work is not displaced. He verified charter/verdict and pinned schema/checker/fixtures, found implementation paths absent, measured integration HEAD 9a5fbdb and available Node/Python/jsonschema, and reports the foundation checker passes. These are his admission receipts, not completed build or independent code review. He is working under the exact allowlist and will return a frozen manifest, test receipts, coverage and demo commands. No expanded paths, staging, commit, push or live-state authority inferred.

Owner durability observation (2026-09-06 17:24 UTC)

Recorded Jason's report of fragile in-memory agent/work state under Stack v1 load and WAL direction in docs/plans/2026-09-06_foundation-durability-observations.md. Later runtime needs enforced write-ahead intent, explicit durability/acknowledgement semantics and crash/load recovery tests, not model-memory discipline. No incident investigation or code change. Inspector charter hash verified unchanged; Rocko's current build is not widened or retasked. No WAL implementation/proof claimed.

Mechanical workflow discussion captured (2026-09-06 17:32 UTC)

Recorded owner topics in docs/plans/2026-09-06_foundation-mechanical-workflow-topics.md: mechanical coordination, n8n/custom choice, Kanban triggers, stall/failure criteria, bounded recovery/escalation and continuity with minimal user remediation. No tool selection or recovery automation implemented; Resume/Fresh benefits remain subject to fencing, durable records and reconciliation. Inspector charter unchanged; no retasking, timer, restart or separate-environment investigation.

Owner-relayed Jarvis handoff observation (2026-09-06 17:51 UTC)

Recorded token-scope mismatch, evidence-location mismatch and watcher blind spot in docs/plans/2026-09-06_foundation-evidence-handoff-observations.md. Preserved reported artifact-present/uncommitted/unreviewed state without treating it as verified completion or a new assignment. Later design topics: explicit capability checks, agreed artifact receipts, shared watch binding and observer reconciliation. Inspector charter unchanged; no credential, watch, live-fleet or repository action in the reported deployment.

Inspector build admission findings (2026-09-06 18:17 UTC)

Read full FI-ROCKO-3 report and CLI; report hash 857470d97af6aeae4e7d7942c2a1d8455bfcda74ff68b8e1dc4ba8d066521fa4 verified. Integration HEAD is 9a5fbdbda7. Initial manifest check stopped at a demo hash mismatch; diagnostic helper's directory-handling error was corrected before the complete audit. Final audit: 34/35 explicit table hashes match; one transposed demo hash differs; both fixture-tree manifests/counts match. No completed coordinator manifest produced. Source inspection also found six unapproved oracle exception cases and an extra serialized exit field; demo checksum command does not preserve a before snapshot. Report omits O_NONBLOCK but actual CLI includes it: receipt discrepancy, not a measured FIFO failure. Recorded C1–C5 and delivered FI-ROCKO-4 once (exit 0). Rocko may correct within original source/test scope plus replacement report/manifest; prior report preserved. No new code executed by coordinator, no independent code review dispatched, no acceptance inferred from author green totals.

Inspector pattern/profile clarification proposed (2026-09-06 18:39 UTC)

Verified r2 report 0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19 and manifest 2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196. After correcting audit helper assumptions about grouped manifest structure, verified all 239 file hashes/modes/sizes, aggregates and pinned inputs. C1 typo reconciled. Oracle remains honestly red on four pattern cases; no code acceptance inferred. Proposed FI-C2-1: real schema compatibility plus independently enforced strict identifier profile, with zero schema-column exceptions. Inline Python/Node regex witnesses confirm single-final-LF distinction; no inspector code executed here. Addendum hash afe2980be2f91e701dae5af3018831ac5c300474f52bcc06e740ce5b5cc68ca5. FI-FILBERT-5 sent once, delivery unconfirmed. Rocko keep-frozen receipt delivered. No charter overwrite, code instruction, source-schema change, commit or live work.

Owner federation/comms direction captured (2026-09-06 20:26 UTC)

Recorded master site/instance/project/workspace/agent registry and proposed mosaic comms flags/examples in docs/plans/2026-09-06_foundation-federation-comms-topics.md. Preserved UUID parent-resolution direction and configurable transport choices; flagged scoped endpoint versus reusable identity, authorization, name ambiguity, partition/revocation and durable receipt questions. No backend selected or command claimed installed. Inspector unchanged; no retasking or transport migration.

Owner installer/onboarding requirements captured (2026-09-06 21:02 UTC)

Recorded required/optional steps, automated mode selection, proposed install.sh flags, break-glass/internal/external auth, agent/harness/provider setup, defaults, profiles/presets, skip-to-finish and later configuration mode in docs/plans/2026-09-06_foundation-install-onboarding-topics.md. Raw password/API-key argv flags marked for safer secret-input design. Current bootstrap authority and inspector scope unchanged; no installation, account linking or live mutation.

Pattern/profile review reconciled; build correction resumed (2026-09-06 21:04 UTC)

During owner status check, found and read completed FI-FILBERT-5 APPROVED artifact, not previously surfaced as a direct return in this conversation. Verified its 03c979b77cc6b03b6685ba51ed1ce24c3f1d7b274ce8f772263a103670050da7 hash and exact reviewed addendum identity. This closes the stale review wait, not the red code gate. FI-ROCKO-5 delivered once (exit 0), authorizing the reviewed C2 correction within existing owner-approved code/test paths and new r3 report/manifest paths. Full required tests, frozen independent code review and owner demo still pending. No staging, commit, push or live changes.

Inspector r3 admitted to full independent code review (2026-09-06 21:30 UTC)

Received FI-ROCKO-5 completion. Verified report ec0444c94c9caf16472fdba1ff3fbc767dffd1a798b9a2da837598c9f4b25508 and manifest 3c2253b6c9f31e448c77aaac53977d41baecfb30e15845dcfffd8dc694428547, all 294 candidate files/modes/sizes/hashes, exact allowlist/no extras, aggregates, pinned inputs and HEAD 9a5fbdb. Writer reports 63 tests, 43 selftest checks, oracle zero disagreements, foundation checker and five suites green. No independent execution of those tests claimed by coordinator. FI-FILBERT-6 full CODE review requested with exact identities and isolated-test boundaries; one send returned unconfirmed delivery. No retry. Rocko keep-frozen receipt delivered. Code verdict and owner demo pending; no staging, commit, push or live effects.

Demo push: independent code rejection reconciled (2026-09-07 14:17 UTC)

Found and read completed FI-FILBERT-6 NOT APPROVED artifact; verified verdict SHA-256 e4cc5970aab20240e6ea3a9a1513ef942ff167fefbb03356b9a32c89999adb3d. Independent witnesses identify five blocking implementation findings and one ownership-inventory improvement despite green supplied tests. FI-ROCKO-6 delivered once, exact original code scope plus r4 receipts; no charter weakening or demo acceptance inferred. Inspected legacy suite branch locators: test-task.sh:408-458 really launches model/session tasks. Full non-live integration coverage remains a separate unresolved test-scope gate; previous green receipts are not reclassified as independent non-live coverage. No new test/engine execution in this cycle.

Integration verification boundary measured (2026-09-07 14:29 UTC)

Reconciled declared r4 build return: absent, FI-ROCKO-6 still awaiting return. Inspected task/release/conductor suite source; recorded actual live-task branches, RELEASE mutations and disposable Git fixture needs in docs/plans/reviews/2026-09-07_foundation-inspector-integration-test-boundary.md. No suites executed, skips relabelled, shared index touched or live permission inferred. Unrelated new root SOUL.md left untouched. Ready local test-scope planning complete; wait for corrected code and explicit full-test scope.

R4 admission and remaining ordering/test gates (2026-09-07 14:45 UTC)

Verified r4 report/manifest and 331 file hashes/modes/sizes. R4 reports fixes and a legitimate integration blocker, not a full-suite pass. Its disclosure leaves declaration inventory order input-dependent; inspected registry traversal and sent FI-ROCKO-7 for complete §10.4 coverage, delivered once. Fixed diagnostic name registry-declaration-missing accepted without changing authority or refusal semantics. Correction preserved: Rocko now reports r3's task suite included live model branches despite the no-live boundary. This contradicts its original no-live assertion; r3 report remains untouched and must not be treated as non-live evidence. No such branches run in r4 or by coordinator here. Asked Jason whether to defer the two mixed live suites for offline-demo acceptance, with incomplete coverage explicit. No ruling, live authority or demo approval inferred.

Offline-demo test gate decision (2026-09-07 14:48 UTC)

Jason explicitly approved deferring test-task.sh/test-release.sh for the offline demo, not declaring them passed. Decision artifact records retained inspector/oracle/ non-live checks, independent review and owner-demo gates. FI-DEMO-GATE-1 queued to busy Rocko (exit 0); no separate acknowledgement yet. R5 report absent at check. No live authority, permanent test removal or retroactive approval of r3 inferred.

Inspector r5 independent re-review requested (2026-09-07 15:06 UTC)

FI-ROCKO-7 complete received. Verified report 17c67427dfdf1bc5dac491c4d0223928e87fdfc67a26175ac239eb2b2f7b7dec and manifest a63bb103e4cfe51bbd8a42cd95545f935ac83c1da51cf469298375cf94ced135, 369 file hashes/modes/sizes, exact scope/no extras, aggregates, pinned inputs and HEAD. Writer reports ordering fixes, maintained witness regressions and authorized tests green, with task/release explicitly deferred by owner. FI-FILBERT-7 re-review sent once (unconfirmed); Rocko freeze receipt delivered. No independent approval or new coordinator test execution claimed. Declared verdict path recorded for next reconciliation so missed notification does not leave a completed review undiscovered. No code edits, staging, commit, push or live activity.

R5 review reconciled (2026-09-07 15:24 UTC)

Found completed NOT APPROVED code verdict; hash 154e7b5d804c059d6fec4c936c78e4ae33bb7fc273ba3a5eec7b00d0a9ce1e59. Prior reference/access/history defects independently closed; remaining R5-1 is Unicode tie-break collision causing unstable error order. FI-ROCKO-8 delivered for a focused correction and regression tests under existing authority; r6 receipt paths offered, older evidence preserved. Authorized offline integration passed in review; task/release still deferred. No accepted demo or live action inferred.

R6 independent re-review requested (2026-09-07 15:36 UTC)

Verified r6 report ee0e83efd7c71eddecf5e26f939e9a34ba85b184cfcd1cffac9ff9e56ea13c37 and manifest a4a4493000aff5905337a643886ca36e7c5377d52deed77b8aeab7174ca73dcf, 382 file hashes/modes/sizes and pinned inputs. FI-FILBERT-8 requests Unicode ordering re-review plus retained closure/coverage; one send unconfirmed, no retry. Rocko freeze receipt delivered. Unrelated launcher/docs changes not integrated. Writer tests remain writer receipts; independent verdict and owner demo pending.

ACT-04 concept reference and test preparation (2026-09-07)

Owner requested pulling the selected OpenClaw concepts and preparing tests with Darkwing. Before: imported SOUL guide and ACT-1 planning existed; selected concept snapshot and synthetic review pack did not. After: twelve documents plus upstream LICENSE copied byte-for-byte from source revision 5c59952cd0a451c4aadd277c329e4ad0a3fca36f into docs/reference/openclaw-concepts, with source paths, sizes and hashes. docs/plans/act-1-tests contains the runbook, eleven scenarios, synthetic fixtures and a proposed personality; active agent context is unchanged. scripts/prepare-concept-tests.mjs validates/stages review inputs only and never launches a model or copies credentials.

Verification: thirteen imported files and eleven scenario records passed checks; existing scripts/test-darkwing-launch.mjs passed both host and container-path fixture tests. Preparation created /tmp/mosaic-act1-l2id7s with mode 0700 and 22 NOT_RUN baseline/candidate result rows. Behavioral evaluation and proposed runtime capabilities remain untested/deferred. No active tmux work, demo code, launch inputs, shared index, commit/push, external messages or live model calls were changed/initiated by this preparation. Handoff is stored, not delivered.

Mosaic concept documentation annexation (2026-09-07)

Owner requested adopting the stored concepts fully and removing foreign product nomenclature. Replaced twelve imported reference pages and the existing SOUL guide with thirteen Mosaic concept documents under docs/concepts. Added a concept index; current implementation and proposed design are explicitly distinguished. Removed the retired import directory after preserving original hashes, source revision and the required license in docs/reference/concepts. Original reference material remains recoverable from the recorded source checkout and the initial staged review snapshot.

Updated the ACT-1 scenario catalog, runbook and preparation utility for the new concept ownership and schema-2 provenance manifest. Verified thirteen current concept hashes, license identity, eleven synthetic scenarios, fifty local documentation links and clean diff whitespace. Staged /tmp/mosaic-act1-xVwXtF for review; all behavioral results remain NOT_RUN. No launch/runtime policy, active agent, demo candidate, credentials, external communication, shared index or deployment changed.

Approved inspector r6 demo prepared (2026-09-07 16:28 UTC)

Read full FI-FILBERT-8 APPROVED verdict, verified ab9dd5e5c3cad5c9263e873ff82cac444da2d36040e907e4798b208fa1c08b13 and all 382 candidate hashes/modes/sizes. Ran four real CLI examples in an isolated verified copy: allowed read, allowed change preview, missing-registration refusal, unresolved reassignment. Expected exits 0/0/3/3, stderr empty, no observed copy/HOME change; shared candidate hashes rechecked unchanged. Saved demo receipt/guide. This is coordinator demonstration evidence, not Jason A9 acceptance. Reviewer structural-equality/native-parser qualifications and deferred task/release coverage retained. Filbert closeout delivered. No code edits, commits, push or live effects.

Repository conversion #1495 begins (2026-09-07 17:23 UTC)

Jason explicitly instructed completion and confirmed no repository work is active. Created #1495. Perform reversible local cutover: v2 root, legacy v1/ excluding nested Git metadata, refactor branch and canonical stack origin. Preserve both histories, pending work, hidden files and external backups. No push, live runtime/config change or blanket staging. Verify content before and after; retain inspector identity/coverage limits.

Repository conversion #1495 completed locally (2026-09-07 17:35 UTC)

Commit 127a54fdff on refactor, canonical origin mosaicstack/stack. New foundation at /mnt/storage/src/mosaic-stack, v1 archived below v1/, no nested .git. Old v2 path is a compatibility symlink. Both parent histories and all original refs/pending/local work preserved. Verified backups at /mnt/storage/src/.mosaic-stack-conversion-20260907T172430Z; original v2 directory also retained as a hidden retired copy. Exact v1 tree equality: 3507 tracked files. Only that tree plus four conversion docs committed; prior pending work unstaged.

Actual checks: Node 80/0, inspector selftests 43/0, schema oracle 1568 records/zero disagreements, foundation checker PASS, config/auth/conductor 24/15/17. Postcommit conductor 17/0 and four demo outcomes passed. No engine/network guard invoked. Approved 382-file inspector and all pins unchanged. Git fsck, parent/tree and alias identity checks passed; index clean. Tests used synthetic HOME/TMPDIR; fixture Git mutations were disposable. No v1/live/deployment tests; task/release remain deferred.

Verification correction: first staged-scope helper counted the trailing NUL as an empty path and stopped before commit. Diagnosed exact difference {''}, fixed the helper filtering, reran and verified exactly 3511 real paths. No scope waiver.

Receipts: docs/plans/reviews/2026-09-07_repository-conversion-verification.json and 2026-09-07_repository-conversion-postcommit-verification.json. No push, trunk integration, live service/config/data change, package install or inspector A9 acceptance inferred. Shared logs/CURRENT and existing owner work remain pending.

Conversion closeout (2026-09-07 17:37 UTC)

Issue mosaicstack/stack#1495 closed via successful API comment + PATCH after local verification; scope explicitly local cutover, not publication. Canonical-path notices: Rocko delivered; Filbert and Dewey delivery unconfirmed (input boxes not locatable), no retries. Root README/AGENTS/CURRENT and compatibility symlink carry the new identity regardless of transport. No claim of their acknowledgement.

Commit/push wave completed — R5 transport contract

Filbert independently APPROVED frozen R5; working/source hashes matched. Approved correction and evidence committed as 69f10a40 (#1496), then refactor plus exactly 17 tags pushed atomically and all 18 remote refs verified. Six #53 planning artifacts verified in published commit; owner closure evidence at docs/plans/reviews/2026-09-07_issue53-closeout.md. A9 acceptance recorded; config/auth/conductor/foundation/extension/task/release 24/15/17/43/18/90/14 all green. Transport and remote-shell injection controls passed; live transport reported acceptance unknown as required. Registry review alignment is next. No trunk merge/deployment; newer relocation changes preserved unstaged.