Authored by Claude Opus 4.7 (Claude Code). Session continuation from cloud-deployment-trial sprint.

FAIR-band: under-target [13/30] — operator-direction (focus on multi-user cloud deployment, 2-lane coordination). Live verifier: GPT 17 / Claude 13 over last 30 merged PRs.

Evidence: L1 (9/9 TenantRepoSyncService unit tests pass; 246/246 broader orchestrator-tree pass; docs round-trip via markdown link check + grep verification for the named env vars and volume).

Refs #11791

Summary

Sub 6 of Epic #11731 — makes the server-side tenant-repo pull lane operable + observable for the cloud-deployment trial. Three load-bearing surfaces shipped: operator docs, health/telemetry payload shape, and operator log format.

Changes

Operator docs (AC1 + AC4)

• learn/agentos/cloud-deployment/TenantIngestionModel.md — new ~155-line "Server-Side Pull Mode (Tenant Repo Sync)" section. Covers when-to-use-vs-push, tenantRepos[] config with credential-boundary rules, periodic + manual triggers, the tenant-repo-mirrors volume + NEO_TENANT_REPO_MIRROR_ROOT, redeploy posture (mirrors reproducible from upstream git — backup optional), health/telemetry payload shape, the active/degraded/quarantined/disabled status enum + operator quarantine runbook, operator logging format, and push-vs-pull coexistence rules.
• learn/agentos/DeploymentCookbook.md — Section 9 extended with a server-side-pull-mode subsection pointing at the TenantIngestionModel anchor; Section 6 env-var inventory gains 3 rows for the new env vars.

Health/telemetry projection (AC2)

TenantRepoSyncService.syncTenantRepos now projects the prescribed details.repos[] shape per the #11791 Contract Ledger row 2:

{
    reason: 'periodic-sweep:1800000',
    repoCount: 3,
    completedCount: 3,
    failedCount: 0,
    repos: [
        {
            tenantId            : 'acme-corp',
            repoSlug            : 'acme-corp/widgets',
            lastIngestedRev     : 'a1b2c3d4',
            lastSyncAt          : '2026-05-25T05:30:00.000Z',
            status              : 'active',         // 'active' | 'degraded' | 'disabled'
            lastSyncDeletedCount: 0,
            lastErrorCode       : null              // present only when status !== 'active'
        }
    ]
}

Replaces the prior {repo, status, ingested, deleted, headRevision} shape. Non-prefixed underlying errors (e.g. KB_GITMIRROR_FETCH_FAILED from #11788) are wrapped as the stable KB_TENANT_REPO_SYNC_SYNC_FAILED code so operators branch on error.code, not message prose.

Operator log format (AC3)

[TenantRepoSync] Refreshing acme-corp/widgets.
[TenantRepoSync] acme-corp/widgets completed: head=a1b2c3d4 ingested=12 deleted=1 (842ms)
[TenantRepoSync] acme-corp/widgets failed: KB_TENANT_REPO_SYNC_SYNC_FAILED (git fetch failed: ...)
[TenantRepoSync] Cycle summary: 3 repos, 2 completed, 1 failed.

Duration measured against per-repo wall clock. Stable error codes from KB_TENANT_REPO_SYNC_* prefix.

Deltas from ticket (if any)

quarantined status deferred to #11942: the Contract Ledger row 3 prescribes quarantined after N consecutive failures (default 5). The consecutive-failure-count state requires the per-repo backoff persistence work I already filed under #11942 (Sub of #11790, tenant-repo-sync sophistication residuals). This PR ships active/degraded/disabled and explicitly notes the deferral in both code (inline comment near the degraded projection) and docs (the status enum table cross-references #11942). Until #11942 lands, repeated failure surfaces as degraded with the same operator-runbook guidance.

redactTenantRepoSecrets() log redaction: per the Contract Ledger row 4, redaction is the responsibility of GitMirror (#11788) on error-message construction. This PR doesn't re-implement redaction at the log layer — e.message is the value GitMirror already constructed. Stable-code prefix in the log line lets operators filter without parsing message prose.

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/services/TenantRepoSyncService.spec.mjs → 9/9 PASS (573ms). 3 new tests cover: (1) details.repos[] freshness-field shape on success, (2) degraded status + stable KB_TENANT_REPO_SYNC_* code wrapping on failure, (3) operator log format (per-repo refresh + completed + cycle summary).
• npm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/ → 246/246 PASS (6.6s) — no neighbor-spec regressions.
• Docs round-trip: markdown structure validated by grep; new cross-link from DeploymentCookbook.md §9 to TenantIngestionModel.md#server-side-pull-mode-tenant-repo-sync confirmed valid.

Post-Merge Validation

• Operator validates the per-repo health payload appears in the deployed Memory Core healthcheck output during the cloud-deployment trial (read via mcp healthcheck tool or npm run ai:mcp-healthcheck).
• Operator confirms log format matches docs during the first periodic sweep.
• quarantined status implementation tracked in #11942; not part of this PR's gate.

Depends on

Epic #11731 (parent). Subs 1-5 (#11740, #11787, #11788, #11789, #11790) all merged — this is the final operability surface on top of the now-complete pull-lane substrate.

Unblocks

40h cloud-deployment trial — operators now have authoritative docs for the pull-mode setup, per-repo freshness visibility, and operator-readable refresh logs.

Authority

Operator-direction post-batch-1+#11941 merges: "continue with a focus on the multi user cloud deployment, and coordinate on 2 lanes." This PR is my cloud-deployment lane.

Deltas after cycle-1 review

@neo-gpt #11951 cycle-1 caught 2 narrow blockers (no code changes needed):

1. Close-target shape mismatch: original Resolves #11791 was unsafe because #11791's Contract Ledger row 3 (quarantined + backoff-threshold transitions) is deferred to #11942 in this PR. Changed to Refs #11791 so the source ticket stays open until #11942's AC1+AC2 (per-repo cadence + jitter/backoff + concurrency-gate) ship the missing state-machine work. Aligns with the principle in feedback_close_as_completed_authority: partial-resolution close-targets need source-ticket alignment OR Refs-not-Resolves. The PR body Post-Merge Validation already names #11942 as the missing-piece tracker; this just makes the GitHub auto-close semantics match the actual coverage.

2. FAIR-band counted shape: refreshed under-target [verify @ merge-gate] placeholder to under-target [13/30] per live verifier (GPT 17 / Claude 13 of last 30 merged PRs). The placeholder shape was accurate-but-imprecise; the counted form gives reviewers the literal evidence anchor.