stack/docs/reports/qa/2026-08-16-1264-unattended-first-start.md

#1264 Unattended Fleet First-Start Verification

Status: IN PROGRESS | Executor: goals | Date: 2026-08-16 | Target: isolated local fixtures only

Objective

Verify that a named fleet seat launched through a systemd-equivalent, no-TTY environment on a clean host reaches its runtime boundary without an interactive Mosaic identity wizard. Preserve standalone wizard behavior and canonical roster ownership of exact seat identity.

Source evidence accepted for local verification

Daphne's canary investigation was read from jarvis-brain commit 6c0b6fc70ae6a179a1b7ff9dedfc54e9adccd19a, report docs/reports/2026-08-16_sbx-canary-greenfield-e2e.md. It measured:

systemd -> start-agent-session.sh -> mosaic yolo pi (PID 3726)
                                  -> child mosaic wizard (PID 3762)

The canary pane remains preserved and was not accessed. Product behavior is independently tested here with temporary roots and fake runtime executables; no canary or installed-host inference is scored as local PASS evidence.

Controls

• Worktree base: origin/next@476db12b92971634b67fd2057b7577ee5894e449.
• DATABASE_URL remains unset.
• No real credential, token, provider, VM, installed Mosaic tree, unit, timer, PATH profile, or live tmux session is read or mutated.
• Tiny's concurrent runtime-preflight and start-agent-session.sh PATH work are out of scope.
• Held PR #1213 is not a dependency.

Requirements-to-evidence map

Acceptance criterion	Method	Evidence
No-TTY fleet first start avoids wizard and reaches runtime	Real built-CLI subprocess with piped stdin	Focused GREEN, CLI test 1
Missing top-level identity files are initialized from shipped defaults	Exact-byte and 0600 assertions	Focused GREEN, CLI tests 1/11
Exact seat identity remains roster-owned	Captured argv plus unknown/padded/blank-name refusals	Focused GREEN, CLI tests 1/6–9
Existing operator identity is never overwritten	Custom bytes/mode with defaults removed	Focused GREEN, CLI tests 2/3
Concurrent/repeated first start is safe	Four parallel CLIs plus repeated launch	Focused GREEN, CLI tests 2/11
Missing/unsafe defaults fail without prompting	Missing, symlink, oversized, and installed-link tests	Focused GREEN, unit/CLI tests
Standalone launch retains wizard	Same real CLI without fleet identity	Focused GREEN, CLI test 10

Command evidence

Worktree helper refusal and sanctioned fallback

Command:

~/bin/mosaic-worktree.sh new fix/1264-fleet-unattended-first-start --from origin/next

Exit: 1. Stderr was retained; the helper refused because the derived worktree path was under /var/home/jason.woltje, while /src does not exist on this host. Fred explicitly authorized the plain-git fallback and path used for this task.

Command:

git -C /var/home/jason.woltje/src/stack worktree add \
  /var/home/jason.woltje/agent-work/1264-unattended-first-start \
  -b fix/1264-fleet-unattended-first-start origin/next

Exit: 0; HEAD 476db12b92971634b67fd2057b7577ee5894e449.

RED

Production source remained unchanged after adding the reproducer. The built CLI represented origin/next@476db12 behavior.

Command:

env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic exec vitest run \
  src/commands/launch-first-start.spec.ts

Exit: 1.

Test Files  1 failed (1)
Tests       1 failed (1)
[mosaic] SOUL.md not found. Running setup wizard...
◆  What would you like to do?
[mosaic] Setup failed. Run: mosaic wizard
AssertionError: expected 1 to be +0

The fixture used piped stdin (not a TTY), a temporary HOME/MOSAIC_HOME, shipped default bytes, a canonical one-seat roster, a fake pi, and a fake lease-runtime boundary. The wizard rendered and the runtime-boundary capture was never created. Complete combined stdout/stderr was retained at /tmp/1264-red.out during execution.

GREEN and baseline

After the production change, the original one-test command exited 0 with 1/1 passing. The final focused command was:

env -u DATABASE_URL pnpm --filter @mosaicstack/mosaic exec vitest run \
  src/commands/fleet-first-start-identity.spec.ts \
  src/commands/launch-first-start.spec.ts \
  src/commands/launch.spec.ts \
  src/commands/compose-contract.spec.ts \
  src/config/file-adapter.test.ts \
  src/cli-smoke.spec.ts

Exit: 0; 6/6 files and 119/119 tests passed. The 11 production-kind CLI tests cover no-TTY launch, captured exact roster name/class, byte-equal 0600 seeds, no-clobber/idempotence, partial seed, missing/symlink defaults, unknown/padded/blank ambient members, standalone interactive control, and four concurrent first starts with no temporary residue. Nine direct filesystem tests cover successful/no-clobber hard-link publication, unexpected link errors, source prevalidation, existing operator contracts, idempotence, symlink sources/destinations, and oversized input.

Full package Vitest:

Test Files  88 passed (88)
Tests       1568 passed (1568)
Exit        0

New helper coverage:

Statements 100% | Branches 93.33% | Functions 100% | Lines 100%
9/9 tests passed; coverage command exit 0

Baseline commands:

pnpm preflight                            exit 0
pnpm typecheck                            45/45 tasks, exit 0
pnpm lint                                 25/25 tasks, exit 0
pnpm build                                25/25 tasks, exit 0
pnpm format:check                         exit 0
pnpm --filter @mosaicstack/mosaic build   exit 0
bash framework/tools/fleet/test-start-agent-session.sh
                                           exit 0; retained expected fixture LD_PRELOAD warning
bash framework/tools/quality/scripts/test-install-migration.sh
                                           21 passed, 0 failed, exit 0
bash framework/tools/_scripts/test-mosaic-init-rce.sh
                                           PASS, exit 0
git diff --check                          exit 0

The aggregate test:framework-shell command exited 1 at invariant_r_unittest.py: 5/6 tests passed and the remaining test refused the operator-global Pi drift from measured 0.84.1 to installed 0.84.2. This is retained as an environment/version-coupling failure, not scored as a #1264 code failure and not retried. The aggregate stopped there; later aggregate stages are UNTESTED except for the three targeted shell suites listed above.

Root pnpm test is UNTESTED because it can execute the prohibited local PostgreSQL-dependent gateway isolation path. No PostgreSQL service, connection, migration, or initialization was used. CI is UNTESTED — pending PR.

Explicitly untested

• Canary VM remediation or restart: UNTESTED and prohibited for this task.
• Real Pi authentication/provider prompt and task execution: UNTESTED.
• PR #1213 composition layer: UNTESTED and not required.
• Deployment/published npm package behavior: UNTESTED until CI/release; deployment is not this PR's scope.

Review and residual risks

Initial independent Codex code review returned request-changes with one should-fix: a padded MOSAIC_AGENT_NAME could be trimmed for pre-seed validation and later rejected in composition, leaving seeds behind. The implementation now rejects blank or padded values before roster lookup or writes; three no-side-effect regression cases pass. Codex re-review approved the remediated delta with no findings (confidence=0.86). Its read-only sandbox could not execute Vitest because Vite needed a temporary config artifact; executor-owned focused/full results above are the test evidence.

Final Codex security review found no confirmed vulnerabilities (risk=none, confidence 0.91). Formal PR review by a reviewer other than goals/Fred and CI remain pending.

Real Pi authentication/provider prompt and task execution remain unmeasured. The local gate proves that Mosaic crosses its identity boundary and reaches the fake lease-runtime boundary; it does not claim provider readiness or deployment.