Authored by GPT-5.5 (Codex Desktop). Session 019e4c2e-c7aa-72a2-b0bc-58c0996c63f3.

FAIR-band: in-band [15/30 - current author count over last 30 merged]

Refs #11725 Related: #11720 Related: #11751 Related: #11753 Related: #11728

Deltas

• Pins the production cloud compose profile to explicit false toggles for local-only orchestrator lanes: primary-dev-sync, kbSync, bridgeDaemon wake delivery, Golden Path repo enrichment, and MLX.
• Sets the deployed Memory Core service to NEO_MAILBOX_DEFAULT_REPLY_POLICY=blocked, keeping cloud A2A writes on the strict tenant-bound reply policy while local wake delivery stays disabled.
• Extends the #11725 compose unit guard to parse ai/deploy/docker-compose.yml and assert the deployed wake/mailbox boundary directly.
• Updates DeploymentCookbook.md so the deployment authority names the strict mailbox env var alongside the orchestrator cloud-profile toggles.

Evidence: L2 deterministic compose-contract validation. This PR completes the CI-safe #11725 cloud-profile negative-behavior assertion after #11751 shipped MCP healthchecks / orchestrator health gating. The adoption-ladder journey-proof half is now Claude's parallel lane.

Deltas from ticket

• Completes the cloud-profile negative-behavior slice: local desktop wake delivery is explicitly disabled/no-op through NEO_ORCHESTRATOR_BRIDGE_DAEMON_ENABLED=false; Memory Core A2A message writes are tenant-bound through NEO_MAILBOX_DEFAULT_REPLY_POLICY=blocked.
• Keeps the proof in the CI-safe lane. No heavyweight local-model or Docker runtime path was added to default CI.
• Leaves #11728 alone. That ticket is tutorial-only and is already completed by merged PR #11753.
• Leaves ticket 11725 open after this PR; Claude is taking the adoption-ladder journey-proof half as the parallel lane.

Slot Rationale

• Modified learn/agentos/DeploymentCookbook.md: disposition delta rewrite; the cookbook is the #11720 deployment authority and now names the strict mailbox policy next to the cloud-profile wake/local-only toggles. This is conditional deployment documentation, not always-loaded agent substrate.
• Modified ai/deploy/docker-compose.yml: disposition keep; this is the production profile contract for #11725, so explicit env pins reduce future deployment drift.
• Modified test/playwright/unit/ai/buildScripts/mcpHealthcheck.spec.mjs: disposition keep; the test is a CI-safe drift guard over the compose contract.

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/buildScripts/mcpHealthcheck.spec.mjs - 8 passed.
• npm run test-unit -- test/playwright/unit/ai/scripts/orchestrator-daemon.spec.mjs - 9 passed.
• git diff --check - passed.
• git diff --cached --check - passed before commit.
• Pre-push freshness check: merge-base HEAD origin/dev == origin/dev at 06727b25f461250066fee107e2349e7a6284fed7; outgoing log contains only d7cb9fad6 feat(ai): pin cloud-profile wake boundaries (#11725).
• Not run: Docker runtime validation; this Codex environment does not provide Docker.

Post-Merge Validation

• On a Docker-capable host, run docker compose --profile cloud -f ai/deploy/docker-compose.yml config and verify the orchestrator env pins plus MC mailbox policy render as expected.
• Start the cloud profile and confirm KB/MC healthchecks gate orchestrator startup as established by #11751.

Residual Risk

• Ticket 11725 remains open until the parallel adoption-ladder journey-proof lane lands.
• Docker runtime behavior still needs host-level validation; the merged default-CI contract from this PR prevents the deployment profile from omitting the local wake/A2A negative assertions.

Commits

• d7cb9fad6 - feat(ai): pin cloud-profile wake boundaries (#11725)