Understand the Mozaic public beta.

Set up an explicit project home.

Mozaic does not create a hidden personal workspace. Organizations are the tenant and ownership boundary; projects, repositories, forks, work, and releases belong to an explicitly named organization.

1. Create and verify your account.Use a verified email address and a password of at least 15 characters. Common and breached passwords are blocked.
2. Secure privileged actions.Enroll a passkey or security key, or configure a TOTP authenticator. Save the generated single-use recovery codes.
3. Name the organization.Choose an explicit owner for the project’s repositories, work, packages, and knowledge. New resources begin non-public.
4. Create the first project.Add a project summary, then create a repository or import an existing Git repository from a reachable source.

Organization, project, resource.

Those three scopes keep ownership and navigation visible. A user can belong to organizations; each organization contains projects; each project connects its source, reviews, pipelines, work, packages, knowledge, calendar, and activity.

Create, import, browse, and contribute.

The public beta’s production version-control adapter is Git. It supports smart HTTP clone, fetch, and push, plus Git LFS transfer and locking. The web workspace exposes branches, tags, commits, files, history, blame, comparisons, and browser editing.

Repository visibility

• New and imported repositories begin organization-only.
• An explicitly public repository can be browsed and cloned without authentication.
• Publishing a repository also requires its organization and project to be explicitly public.

Transport support

Use the HTTPS clone URL shown in the repository view. SSH Git transport is not part of the current public beta.

Accept outside work without hidden membership.

A contributor does not need membership in the target organization. They authenticate, create or select an organization they control, fork the public repository into a project there, and open a proposal against the target.

1. Fork into a named organization.The source remains visibly owned by the contributor’s organization, including a single-member organization.
2. Open a pull request.Mozaic pins the exact source and target revisions into an immutable proposal snapshot.
3. Discuss and review the snapshot.Line threads, general conversations, review decisions, and check results remain associated with the exact proposal.
4. Grant execution when needed.External-contributor code runs only after an authorized maintainer grants the exact revision and resolved pipeline plan.
5. Merge under policy.Mozaic re-evaluates required reviews, checks, signatures, and merge strategy before atomically updating the protected target.

Resolve a plan from the exact revision.

Pipeline configuration lives at .mozaic/pipeline.yml in the repository. Mozaic reads it from the selected revision, validates it, resolves image digests and other inputs, and records an immutable canonical plan before scheduling jobs.

version: 1
triggers:
  - pull_request
  - manual
jobs:
  verify:
    image: mcr.microsoft.com/dotnet/sdk@sha256:…
    steps:
      - run: dotnet restore
      - run: dotnet build --no-restore
      - run: dotnet test --no-build --no-restore

The image shown above is deliberately abbreviated; use a supported image pinned to its complete digest. The beta supports repository and manual triggers, dependent jobs, simple run steps, declared services, logs, cancellation, immutable attempts, test results, artifacts, and trusted tag publication paths.

Untrusted contribution jobs

• Run in ephemeral rootless Podman job pods outside the application container.
• Receive bounded CPU, memory, temporary storage, duration, and network policy.
• Do not receive protected secrets, privileged mode, host mounts, deployment authority, publication authority, or trusted cache writes.
• Are not silently rescheduled after possible execution; runner loss can produce an indeterminate result.

Publish immutable versions with context.

Mozaic provides NuGet v3 discovery, restore, search, autocomplete, push, symbols, listing, deprecation, and lifecycle operations. Feeds can be private or deliberately public, and standard NuGet clients use the feed URL shown in the Packages workspace.

https://{organization-slug}.mozaic.space/nuget/{feed-id}/v3/index.json

Verified release provenance

A verified tag release binds one immutable package archive entry to one exact successful trusted pipeline attempt. Its receipt retains the repository revision, canonical plan, check, artifact identity, size, digest, symbol relationship, signature evidence, and short-lived publication credential.

Keep decisions beside delivery.

Work

Starter Bug, Feature, and Task types use governed workflows. Teams can assign work, relate it to other resources, organize boards and milestones, and follow a project activity stream. Public projects can accept public issues and private security reports from authenticated contributors.

Knowledge

Project knowledge supports hierarchical pages, collaborative editing, continuously acknowledged durable operations, history, comments, attachments, structured Markdown, and stable references to engineering resources.

Make a project useful without an account.

An explicitly published project home can present the project summary, published knowledge, public repositories, verified builds, public NuGet releases, milestones, visible work, and project activity. Visitors can browse and evaluate; authenticated contributors can submit public work or private security reports and follow the fork-and-proposal path.

Secure people, roles, and privileged actions.

• Email-verified accounts use opaque server sessions and local password screening.
• WebAuthn/FIDO2 passkeys and security keys, TOTP, and single-use recovery codes are supported.
• Teams, versioned additive roles, scoped assignments, invitations, and stewardship rules govern organization access.
• Fresh strong authentication is required for selected privileged actions.
• Security-relevant changes produce governance and audit evidence.

Read the security and trust page for the isolation model and vulnerability-reporting guidance.

Current means current.

The beta is an operated hosted service with one complete Git-to-NuGet-and-knowledge path. The following table is intentionally explicit so roadmap ideas are not mistaken for available product behavior.