Resolves #13952
This flips the recovery actuator from deployment opt-in to deployment opt-out. NEO_RECOVERY_ACTUATOR_ENABLED now resolves true unless an operator explicitly disables it, and recovery targets are enabled by default from known sources: supervised tasks from the orchestrator task table, compose services from the L0 runtime-access service registry, and the built-in deploy target set.
Operators can block a specific target with NEO_RECOVERY_ACTUATOR_BLOCKED_SUPERVISED_TASKS, NEO_RECOVERY_ACTUATOR_BLOCKED_COMPOSE_SERVICES, or NEO_RECOVERY_ACTUATOR_BLOCKED_DEPLOY_TARGETS. There is no deployment-local recovery allowlist to enumerate before the immune system can act. Safety remains in the closed action set, target derivation, the L0 runtime-access allowlist, fail-loud malformed target config, and the persisted anti-thrash envelope.
Evidence: L2 focused unit/static evidence covers the close-target ACs. Residual: live deployment smoke remains under #13936 after this lands and the deployment repo consumes the new Neo SHA.
Deltas from ticket
The ticket initially only flipped the actuator enabled default. Review exposed that empty recovery allowlists still disabled the act half in practice, so this update changes the recovery target controls to opt-out blocklists and updates ADR-0026 accordingly. It does not widen the Docker runtime-access envelope, add arbitrary container ids, add shell/exec, or change diagnosis/controller routing.
Test Evidence
git diff --checknpm run agent-preflight -- ai/config.template.mjs ai/daemons/orchestrator/services/RecoveryActuatorService.mjs learn/agentos/decisions/0026-recovery-actuator.md test/playwright/fixtures/aiConfigDefaults.mjs test/playwright/unit/ai/daemons/orchestrator/services/RecoveryActuatorService.spec.mjs test/playwright/unit/test/fixtures/aiConfigDefaults.spec.mjsnpm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/services/RecoveryActuatorService.spec.mjs test/playwright/unit/test/fixtures/aiConfigDefaults.spec.mjs - 20 passed
Post-Merge Validation
Commits
740f6b61ef - fix(ai): enable recovery actuator by default (#13952)4953383a67 - docs(ai): document recovery actuator opt-out default (#13952)52eca99b1c - fix(ai): enable recovery targets by default (#13952)
Authored by Euclid (GPT-5, Codex Desktop). Session 019ef378-527d-7393-bc74-ec3a1d3f2ddf.
Resolves #13952
This flips the recovery actuator from deployment opt-in to deployment opt-out.
NEO_RECOVERY_ACTUATOR_ENABLEDnow resolves true unless an operator explicitly disables it, and recovery targets are enabled by default from known sources: supervised tasks from the orchestrator task table, compose services from the L0 runtime-access service registry, and the built-in deploy target set.Operators can block a specific target with
NEO_RECOVERY_ACTUATOR_BLOCKED_SUPERVISED_TASKS,NEO_RECOVERY_ACTUATOR_BLOCKED_COMPOSE_SERVICES, orNEO_RECOVERY_ACTUATOR_BLOCKED_DEPLOY_TARGETS. There is no deployment-local recovery allowlist to enumerate before the immune system can act. Safety remains in the closed action set, target derivation, the L0 runtime-access allowlist, fail-loud malformed target config, and the persisted anti-thrash envelope.Evidence: L2 focused unit/static evidence covers the close-target ACs. Residual: live deployment smoke remains under #13936 after this lands and the deployment repo consumes the new Neo SHA.
Deltas from ticket
The ticket initially only flipped the actuator
enableddefault. Review exposed that empty recovery allowlists still disabled the act half in practice, so this update changes the recovery target controls to opt-out blocklists and updates ADR-0026 accordingly. It does not widen the Docker runtime-access envelope, add arbitrary container ids, add shell/exec, or change diagnosis/controller routing.Test Evidence
git diff --checknpm run agent-preflight -- ai/config.template.mjs ai/daemons/orchestrator/services/RecoveryActuatorService.mjs learn/agentos/decisions/0026-recovery-actuator.md test/playwright/fixtures/aiConfigDefaults.mjs test/playwright/unit/ai/daemons/orchestrator/services/RecoveryActuatorService.spec.mjs test/playwright/unit/test/fixtures/aiConfigDefaults.spec.mjsnpm run test-unit -- test/playwright/unit/ai/daemons/orchestrator/services/RecoveryActuatorService.spec.mjs test/playwright/unit/test/fixtures/aiConfigDefaults.spec.mjs- 20 passedPost-Merge Validation
Commits
740f6b61ef-fix(ai): enable recovery actuator by default (#13952)4953383a67-docs(ai): document recovery actuator opt-out default (#13952)52eca99b1c-fix(ai): enable recovery targets by default (#13952)Authored by Euclid (GPT-5, Codex Desktop). Session 019ef378-527d-7393-bc74-ec3a1d3f2ddf.