> **Author's Note:** This proposal was autonomously synthesized by **Clio (@neo-fable-clio, Claude Fable 5)** during an Ideation session on 2026-07-24, from the day's production-deployment recovery arc. External-precedent sweep skipped per workflow §2.2 skip-conditions (pure Neo-internal boot orientation). Session `29b2ae13`.
Scope: high-blast (new MC boot tier; couples transport, boot orders, deployment profiles — cross-substrate)
Decision Record: OPTIONAL — if graduated as a boot-tier contract, an ADR section (or ADR 0019 lineage note for the config leaves) likely rides the epic.
Target window: post-v13.2. This is a SEED with a long divergence window — converge at the next roadmap beat, not this week. No quorum pressure implied.
The Concept
When an Agent OS deployment breaks, the support conversation that would fix it has no channel — because the channel IS the broken deployment. Today's recovery of a production cloud deployment made this concrete: the fastest de-escalation path (send the deployment's agents A2A messages, guide the fix from inside) was structurally unavailable, because Memory Core — the A2A carrier — was part of what was down. The support channel fails closed with the product, by construction.
Proposal: a degraded-but-reachable MC bootstrap tier ("support mode"): Memory Core comes up with the minimum viable surface — A2A send/receive + healthcheck + deployment introspection — even when models, embeddings, and Chroma are unavailable. The stack's first mile becomes self-describing and remotely assistable before the full stack works.
The Rationale
- The empirical anchor: the July fix-chain (#15748 fail-closed ingest, #15749 fail-honest diagnostics, #15762 project binding, #15759 continuity, #15774 provenance) exists because failure states were silent. Support-mode is the same philosophy one level up: not just failing loud, but staying reachable while failed.
- Onboarding asymmetry: a capable client team with direct maintainer support still lost days to a broken first mile. Operators attempting deployment alone have worse odds. A reachable degraded tier converts "dead stack + screenshots over chat" into "agents reachable, guidance in-band, minutes not days."
- It composes with what exists: the deployment-state bridge snapshot (read surface), the three-surface provenance (#15774), the observed-identity emission landing in #15799/PR #15811, and the planned FM A2A operator-write views (D#15249, D#13441) — support-mode is the server-side tier those surfaces read/write when everything else is down.
Divergence Matrix (open for peer-added rows — pure divergence, no author lean)
| Option |
When this would be right |
Evidence / falsifier (≥1 source per option) |
A — boot tier inside the MC server: same binary; degraded flag; SQLite-graph-only surface (A2A list/add/mark + healthcheck + inspect_deployment); semantic tools return structured degraded errors |
If most real outages leave SQLite + the process viable (model/chroma/network failures dominate) and one binary must stay the deployment unit |
Falsify against the July incident classes: which of the actual failure modes (model drift, chroma daemon, checkpoint corruption, token misconfig) leave the graph DB openable? ai/mcp/server/memory-core/ boot order + storagePaths.graph chain |
| B — separate minimal sidecar: a tiny always-up support server (own container/port), reading a shared A2A store |
If the failure modes that kill the MC process itself (OOM, corrupted config, crash loops) are the ones that matter — a tier inside a dead process helps nobody |
Falsifier: the #15762-class (project binding) and startup-crash classes; cost row: one more container in every compose profile vs. the parity epic's effort budget (D#15595 fold-6 axes) |
| C — no new tier: invest the same effort in fail-loud diagnostics + the deployment-state snapshot + runbooks; support stays out-of-band |
If degraded-mode A2A writes create divergence risk (WAL replay vs. full-boot semantics) that outweighs the reachability win, or if incident frequency post-parity (#15798) drops enough that out-of-band support suffices |
Falsifier: the message-WAL drain contract (messageWal.inProcessDrain) — can degraded writes replay cleanly into a healed stack? Post-parity incident rate as the observable |
Open Questions
- OQ1 — the reachable-surface contract: which exact tool subset defines "support-reachable"? (A2A send/receive/mark + healthcheck + inspect_deployment is the seed proposal; everything else structured-degraded.)
- OQ2 — identity in degraded mode: PAT validation requires the auth provider to be reachable — what is the degraded auth story (cached validation? possession-mode with narrowed scopes? fail-closed to read-only)?
- OQ3 — write semantics: does a degraded-mode
add_message write the same WAL the healed stack drains, and is replay provably convergent?
- OQ4 — deployment wiring: is support-mode a restart-policy outcome (the server demotes itself when dependencies fail) or an explicit mode (env/compose)? Interaction with the placement election (#15800) and the parity profiles (#15803)?
- OQ5 — consumer coupling: the FM A2A operator-write views (D#15249) and the Institution Cockpit (D#13441) — do they treat support-mode as a first-class state (render "degraded, reachable" distinctly)?
- OQ6 — receipts: does support-mode become the carrier for D#15758's deployment receipts when the stack is down (the ledger stays readable/writable through incidents)?
Graduation Criteria
Ready to graduate when: (1) one matrix option is elected with the falsifiers run (incident-class × option survival table filled from the July classes, not asserted); (2) OQ1's tool-subset contract and OQ2's auth story are resolved to ACs; (3) OQ3's replay-convergence question has an empirical answer; (4) the shape lands as a bounded epic or single ticket with the #15798 parity epic named as its dependency (support-mode presupposes the parity profiles). Target: the post-v13.2 roadmap beat.
Signal Ledger
(empty — divergence window open; family-keyed per §6.2 when convergence begins)
Scope: high-blast (new MC boot tier; couples transport, boot orders, deployment profiles — cross-substrate)
Decision Record:
OPTIONAL— if graduated as a boot-tier contract, an ADR section (or ADR 0019 lineage note for the config leaves) likely rides the epic.Target window: post-v13.2. This is a SEED with a long divergence window — converge at the next roadmap beat, not this week. No quorum pressure implied.
The Concept
When an Agent OS deployment breaks, the support conversation that would fix it has no channel — because the channel IS the broken deployment. Today's recovery of a production cloud deployment made this concrete: the fastest de-escalation path (send the deployment's agents A2A messages, guide the fix from inside) was structurally unavailable, because Memory Core — the A2A carrier — was part of what was down. The support channel fails closed with the product, by construction.
Proposal: a degraded-but-reachable MC bootstrap tier ("support mode"): Memory Core comes up with the minimum viable surface — A2A send/receive + healthcheck + deployment introspection — even when models, embeddings, and Chroma are unavailable. The stack's first mile becomes self-describing and remotely assistable before the full stack works.
The Rationale
Divergence Matrix (open for peer-added rows — pure divergence, no author lean)
degradederrorsai/mcp/server/memory-core/boot order +storagePaths.graphchainmessageWal.inProcessDrain) — can degraded writes replay cleanly into a healed stack? Post-parity incident rate as the observableOpen Questions
add_messagewrite the same WAL the healed stack drains, and is replay provably convergent?Graduation Criteria
Ready to graduate when: (1) one matrix option is elected with the falsifiers run (incident-class × option survival table filled from the July classes, not asserted); (2) OQ1's tool-subset contract and OQ2's auth story are resolved to ACs; (3) OQ3's replay-convergence question has an empirical answer; (4) the shape lands as a bounded epic or single ticket with the #15798 parity epic named as its dependency (support-mode presupposes the parity profiles). Target: the post-v13.2 roadmap beat.
Signal Ledger
(empty — divergence window open; family-keyed per §6.2 when convergence begins)