Task Ownership Gap Fix Scratchpad

Metadata

Date: 2026-03-13
Worktree: /home/jwoltje/src/mosaic-mono-v1-worktrees/fix-task-ownership
Branch: fix/task-mission-ownership
Scope: Fix ownership checks in TasksController/MissionsController and extend gateway ownership tests
Related tracker: worker task only; docs/TASKS.md is orchestrator-owned and left unchanged
Budget assumption: no explicit token cap; keep scope limited to requested gateway permission fixes

Close ownership gaps so task listing/creation and mission creation enforce project/mission ownership and reject cross-user access.

TasksController list() enforces ownership for projectId and missionId, and does not return cross-user data when neither filter is provided.
TasksController create() rejects unowned projectId and missionId references.
MissionsController create() rejects unowned projectId references.
Gateway ownership tests cover forbidden task creation and forbidden task listing by unowned project.

Inspect current controller and ownership test patterns.
Add failing permission tests first.
Patch controller methods with existing ownership helpers.
Run targeted gateway tests, then gateway typecheck/lint/full test.
Perform independent review, record evidence, then complete the requested git/PR workflow.

Required: yes. This is auth/permission logic and a bugfix.
Strategy: add failing tests in resource-ownership.test.ts, verify red, then implement minimal controller changes.

pnpm --filter @mosaic/gateway test -- src/__tests__/resource-ownership.test.ts
- Red: failed with 2 expected permission-path failures before controller changes.
- Green: passed after wiring ownership checks and adding owned-task filtering coverage.
pnpm --filter @mosaic/gateway typecheck
- Pass on 2026-03-13 after fixing parameter ordering and mission project nullability.
pnpm --filter @mosaic/gateway lint
- Pass on 2026-03-13.
pnpm --filter @mosaic/gateway test
- Pass on 2026-03-13 with 3 test files and 23 tests passing.
pnpm format:check
- Pass on 2026-03-13.

Manual review: checked for auth regressions, cross-user list leakage, and dashboard behavior impact; kept unfiltered task list functional by filtering to owned projects/missions instead of returning an empty list.
Automated review: ~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted running/re-run for independent review evidence.

Repository-wide Mosaic instructions require merge/issue closure, but the user explicitly instructed PR-only and no merge; follow the user instruction.
docs/TASKS.md is orchestrator-owned and will not be edited from this worker task.