Resolves #14798

workspaceSafety.spec.mjs now fails fast when the orchestrator child exits before the boot log predicate matches, and the thrown error includes child exit state, log existence, data-dir listing, last log content, stdout, and stderr. The fresh-workspace daemon spawns also isolate the MCP file-sink logs and Memory Core graph DB through canonical env-owned config leaves instead of overlays or runtime singleton mutation.

Evidence: L3 (real orchestrator daemon booted in the focused integration spec and the synthetic crash path emitted full diagnostics) -> L3 required (fresh-workspace runtime boot proof + diagnostic failure contract). Residual: hosted PR CI check pending for #14798.

Deltas from ticket

The ticket identified an opaque boot timeout. During implementation, the new diagnostic surfaced two additional isolation leaks in this local clone: file-sink MCP logs were resolving through repo-root .neo-ai-data/logs, and Memory Core graph storage needed the canonical NEO_MEMORY_DB_PATH env alongside the existing orchestrator DB env. This PR fixes those in the test harness by construction.

Changed config keys:

• ai/mcp/server/knowledge-base/config.template.mjs: logPath now supports NEO_KB_LOG_PATH.
• ai/mcp/server/memory-core/config.template.mjs: logPath now supports NEO_MEMORY_LOG_PATH.
• ai/mcp/server/neural-link/config.template.mjs: logPath now supports NEO_NL_LOG_PATH.

Local config follow-up:

• No gitignored config.mjs file is committed.
• Active clones should regenerate or migrate local MCP configs after merge so the local config.mjs shape carries these env bindings.
• Harness restart is recommended for already-running KB / Memory Core / Neural Link MCP servers; new processes read the env leaves at config construction.

Test Evidence

• node --check on the three changed MCP templates and test/playwright/integration/ai/daemons/workspaceSafety.spec.mjs: passed.
• git diff --check: passed.
• node buildScripts/util/check-block-alignment.mjs ai/mcp/server/knowledge-base/config.template.mjs ai/mcp/server/memory-core/config.template.mjs ai/mcp/server/neural-link/config.template.mjs test/playwright/integration/ai/daemons/workspaceSafety.spec.mjs: passed.
• npm run test-integration-unified -- test/playwright/integration/ai/daemons/workspaceSafety.spec.mjs: 3 passed.
• Direct Node env-leaf probe for NEO_KB_LOG_PATH, NEO_MEMORY_LOG_PATH, and NEO_NL_LOG_PATH: passed.
• npm run --silent ai:structure-map -- --files --loc: passed.
• npm run agent-preflight -- --no-fix ai/mcp/server/knowledge-base/config.template.mjs ai/mcp/server/memory-core/config.template.mjs ai/mcp/server/neural-link/config.template.mjs test/playwright/integration/ai/daemons/workspaceSafety.spec.mjs: passed.
• Commit hook checks: passed.

Not counted as evidence: npm run test-unit -- test/playwright/unit/ai/mcp/server/memory-core/config.template.spec.mjs test/playwright/unit/ai/config.template.spec.mjs produced no output for several minutes and was interrupted after no matching runner process remained visible.

Post-Merge Validation

• Hosted PR CI reports integration-unified green at the PR head.
• Active peer clones regenerate or migrate local MCP configs before relying on the new log-path env overrides.
• Restart already-running KB / Memory Core / Neural Link MCP servers if their process needs the new env-binding support.

Commits

• 65f3c8de90 - fix(ai): surface workspace safety boot diagnostics (#14798)

Authored by Euclid (GPT-5, Codex Desktop). Session 6439a7c5-5f2f-4658-9226-835c317c7a0b.